From 7e50969d0209f330f1df489c5ef6113926ecea34 Mon Sep 17 00:00:00 2001
From: "Simon L." <szaimen@e.mail.de>
Date: Mon, 22 Jun 2026 13:34:32 +0200
Subject: [PATCH] feat(desec): keep the typed slug across the registration flow

A slug typed into the deSEC form was lost when the form re-rendered after a
201 redirect (e.g. on the awaiting-verification step), forcing the user to
re-enter it. Persist the requested slug in the AIO config when register()
runs and pre-fill the slug input from it on every step, then clear it once a
domain is set. Stored in configuration.json rather than a URL parameter so it
survives the multi-step flow without leaking into the iframe address.

Signed-off-by: Simon L. <szaimen@e.mail.de>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 php/public/index.php                       |  1 +
 php/src/Data/ConfigurationManager.php      | 10 ++++++++++
 php/src/Desec/DesecManager.php             |  6 ++++++
 php/templates/includes/desec-register.twig |  6 +++---
 4 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/php/public/index.php b/php/public/index.php
index 95f815fb..46c39786 100644
--- a/php/public/index.php
+++ b/php/public/index.php
@@ -205,6 +205,7 @@ $app->get('/desec', function (Request $request, Response $response, array $args)
         'domain' => $configurationManager->domain,
         'desec_email' => $configurationManager->desecEmail,
         'desec_password' => $configurationManager->desecPassword,
+        'desec_slug' => $configurationManager->desecSlug,
         'is_desec_domain' => $configurationManager->isDesecDomain(),
         'desec_account_registered' => $configurationManager->isDesecAccountRegistered(),
         'desec_awaiting_verification' => $configurationManager->isDesecAwaitingVerification(),
diff --git a/php/src/Data/ConfigurationManager.php b/php/src/Data/ConfigurationManager.php
index 54a77055..aa757dd5 100644
--- a/php/src/Data/ConfigurationManager.php
+++ b/php/src/Data/ConfigurationManager.php
@@ -213,6 +213,16 @@ class ConfigurationManager
         set { $this->set('desec_email', $value); }
     }
 
+    /**
+     * The subdomain slug the user last requested. Persisted across the multi-step
+     * registration flow so the slug input can be pre-filled when the form re-renders
+     * (e.g. after email verification). Not a secret; cleared once a domain is set.
+     */
+    public string $desecSlug {
+        get => $this->get('desec_slug', '');
+        set { $this->set('desec_slug', $value); }
+    }
+
     /**
      * Base URL of the deSEC API. Configurable via the 'desec_api_base' config key
      * (configuration.json) only — intentionally NOT an environment variable — so the
diff --git a/php/src/Desec/DesecManager.php b/php/src/Desec/DesecManager.php
index 080e726b..0e2fb8a0 100644
--- a/php/src/Desec/DesecManager.php
+++ b/php/src/Desec/DesecManager.php
@@ -45,6 +45,10 @@ class DesecManager {
 
         $validatedSlug = $this->validateSlug($slug);
 
+        // Persist the requested slug so the form can pre-fill it when it re-renders on the
+        // next step of the flow (e.g. after email verification). Cleared once a domain is set.
+        $this->configurationManager->desecSlug = $validatedSlug;
+
         [$token, $isNewAccount] = $this->obtainToken($email, $password);
 
         // An empty token means a brand-new account was created but its email is not yet
@@ -62,6 +66,8 @@ class DesecManager {
 
         $this->configurationManager->aioCommunityContainers = ["caddy", "dnsmasq"];
         $this->configurationManager->setDomain($domain, true);
+        // Registration is complete; the stored slug is no longer needed.
+        $this->configurationManager->desecSlug = '';
         $this->updateIpIfDesecDomain();
 
         return true;
diff --git a/php/templates/includes/desec-register.twig b/php/templates/includes/desec-register.twig
index 1a7ca899..148efdab 100644
--- a/php/templates/includes/desec-register.twig
+++ b/php/templates/includes/desec-register.twig
@@ -7,7 +7,7 @@
         <input type="hidden" name="{{csrf.keys.name}}" value="{{csrf.name}}">
         <input type="hidden" name="{{csrf.keys.value}}" value="{{csrf.value}}">
         <input type="password" name="desec_password" placeholder="Existing deSEC password (only if you already had an account)" autocomplete="current-password" />
-        <input type="text" name="desec_slug" placeholder="my-nextcloud (optional)" pattern="[a-z0-9]([a-z0-9\-]{0,61}[a-z0-9])?" title="Only lowercase letters, digits and hyphens (1–63 characters). No leading or trailing hyphen." />
+        <input type="text" name="desec_slug" value="{{ desec_slug|default('') }}" placeholder="my-nextcloud (optional)" pattern="[a-z0-9]([a-z0-9\-]{0,61}[a-z0-9])?" title="Only lowercase letters, digits and hyphens (1–63 characters). No leading or trailing hyphen." />
         <input type="submit" value="I have verified my email – register domain" />
     </form>
 {% elseif desec_account_registered %}
@@ -15,7 +15,7 @@
     <form method="POST" action="api/desec/register" class="xhr">
         <input type="hidden" name="{{csrf.keys.name}}" value="{{csrf.name}}">
         <input type="hidden" name="{{csrf.keys.value}}" value="{{csrf.value}}">
-        <input type="text" name="desec_slug" placeholder="my-nextcloud (optional)" pattern="[a-z0-9]([a-z0-9\-]{0,61}[a-z0-9])?" title="Only lowercase letters, digits and hyphens (1–63 characters). No leading or trailing hyphen." />
+        <input type="text" name="desec_slug" value="{{ desec_slug|default('') }}" placeholder="my-nextcloud (optional)" pattern="[a-z0-9]([a-z0-9\-]{0,61}[a-z0-9])?" title="Only lowercase letters, digits and hyphens (1–63 characters). No leading or trailing hyphen." />
         <input type="submit" value="Register free domain via deSEC" />
     </form>
 {% else %}
@@ -26,7 +26,7 @@
         <input type="hidden" name="{{csrf.keys.value}}" value="{{csrf.value}}">
         <input type="email" name="desec_email" placeholder="your@email.com" required />
         <input type="password" name="desec_password" placeholder="deSEC password (only if already registered)" autocomplete="current-password" />
-        <input type="text" name="desec_slug" placeholder="my-nextcloud (optional)" pattern="[a-z0-9]([a-z0-9\-]{0,61}[a-z0-9])?" title="Only lowercase letters, digits and hyphens (1–63 characters). No leading or trailing hyphen." />
+        <input type="text" name="desec_slug" value="{{ desec_slug|default('') }}" placeholder="my-nextcloud (optional)" pattern="[a-z0-9]([a-z0-9\-]{0,61}[a-z0-9])?" title="Only lowercase letters, digits and hyphens (1–63 characters). No leading or trailing hyphen." />
         <input type="submit" value="Register free domain via deSEC" />
     </form>
     <p><strong>Note:</strong> By submitting this form you agree to the <a target="_blank" href="https://desec.io/terms">deSEC terms of service</a>. The registered domain and your deSEC account credentials are stored in the AIO configuration. After registration, set your router's DHCP DNS server to this machine's local IP address so LAN devices resolve the domain locally (see the <a target="_blank" href="https://github.com/nextcloud/all-in-one/tree/main/community-containers/dnsmasq">dnsmasq documentation</a>). Alternatively adjust the hosts files on your clients so that they can reach the server using the local ip-address.</p>