From f0fb065dc2e3c31e9a3529bc28edcacdae157b75 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 25 Apr 2026 16:32:31 +0000
Subject: [PATCH] feat: hide deSEC password field until
 email-already-registered 422 error

Agent-Logs-Url: https://github.com/nextcloud/all-in-one/sessions/d4f48d74-6e53-474c-b5bf-a9705525de45

Co-authored-by: szaimen <42591237+szaimen@users.noreply.github.com>
---
 php/public/forms.js                        | 12 ++++++++++--
 php/templates/includes/desec-register.twig |  8 +++++---
 2 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/php/public/forms.js b/php/public/forms.js
index b37fdcdb..ec326b8c 100644
--- a/php/public/forms.js
+++ b/php/public/forms.js
@@ -16,13 +16,21 @@
     setTimeout(toast.remove.bind(toast), 10000)
   }
 
-  function handleEvent(e) {
+  function handleEvent(e, form) {
     const xhr = e.target;
     if (xhr.status === 201) {
       window.location.replace(xhr.getResponseHeader('Location'));
     } else if (xhr.status === 422) {
       disableSpinner()
       showError(xhr.response);
+      if (form) {
+        const revealSelector = form.dataset.revealOnError;
+        const revealWhen = form.dataset.revealWhen;
+        if (revealSelector && (!revealWhen || xhr.response.includes(revealWhen))) {
+          const target = document.querySelector(revealSelector);
+          if (target) target.style.display = '';
+        }
+      }
     } else if (xhr.status === 500) {
       showError("Server error. Please check the mastercontainer logs for details. This page will reload after 10s automatically. Then you can check the mastercontainer logs.");
       // Reload after 10s since it is expected that the updated view is shown (e.g. after starting containers)
@@ -50,7 +58,7 @@
         lastError.remove()
       }
       let xhr = new XMLHttpRequest();
-      xhr.addEventListener('load', handleEvent);
+      xhr.addEventListener('load', function(e) { handleEvent(e, form); });
       xhr.addEventListener('error', () => showError("Failed to talk to server."));
       xhr.addEventListener('error', () => disableSpinner());
       xhr.open(form.method, form.getAttribute("action"));
diff --git a/php/templates/includes/desec-register.twig b/php/templates/includes/desec-register.twig
index 6a015194..4e4d6a08 100644
--- a/php/templates/includes/desec-register.twig
+++ b/php/templates/includes/desec-register.twig
@@ -12,12 +12,14 @@
         </form>
     {% else %}
         <p>Please enter your email address. You can also enter a desired subdomain slug (the part before <code>.dedyn.io</code>); leave it blank for a random one.</p>
-        <p>If you already have a deSEC account for this email address, enter your deSEC password in the optional password field below to log in with it instead of creating a new account.</p>
-        <form method="POST" action="api/desec/register" class="xhr">
+        <form method="POST" action="api/desec/register" class="xhr" data-reveal-on-error="#desec-password-field" data-reveal-when="already registered at deSEC">
             <input type="hidden" name="{{csrf.keys.name}}" value="{{csrf.name}}">
             <input type="hidden" name="{{csrf.keys.value}}" value="{{csrf.value}}">
             <input type="email" name="desec_email" placeholder="your@email.com" required />
-            <input type="password" name="desec_password" placeholder="deSEC password (only if already registered)" autocomplete="current-password" />
+            <div id="desec-password-field" style="display:none">
+                <p>This email address is already registered at deSEC. Enter your deSEC password below to log in with it instead of creating a new account.</p>
+                <input type="password" name="desec_password" placeholder="deSEC password" autocomplete="current-password" />
+            </div>
             <input type="text" name="desec_slug" placeholder="my-nextcloud (optional)" pattern="[a-z0-9]([a-z0-9\-]{0,61}[a-z0-9])?" title="Only lowercase letters, digits and hyphens (1–63 characters). No leading or trailing hyphen." />
             <input type="submit" value="Register free domain via deSEC" />
         </form>