Refactor login page (#31530)

As requested in
https://github.com/go-gitea/gitea/pull/31504#issuecomment-2196196646.
This PR refactor the login page:

![Screenshot from 2024-07-04
19-23-10](https://github.com/go-gitea/gitea/assets/6918444/c45700f4-6747-473c-bdee-2156718a7953)

![Screenshot from 2024-07-04
19-23-21](https://github.com/go-gitea/gitea/assets/6918444/b1bf71cf-85f9-4517-a409-cc6d72e6af8f)

![Screenshot from 2024-06-30
09-35-20](https://github.com/go-gitea/gitea/assets/6918444/728cc37e-0cca-4883-afec-a43663d2c666)
- [x] use separate box for passkey login and go to registration
- [x] move forgot passoword next to password label
- [x] fix password required label `*` and padding
- [x] remove tabs from login page

---------

Co-authored-by: silverwind <me@silverwind.io>
(cherry picked from commit 9c00dda33ad7bd594dd8f331fa1bf0acefc2ca54)

Conflict resolution:
* signin_navbar.tmpl has been deleted
* additions in form.css
* major code changes in signin_openid
* ...

options/locale/locale_en-US.ini

@@ -399,8 +399,8 @@ relevant_repositories = Only relevant repositories are being shown, <a href="%s"
 
 [auth]
 create_new_account = Register account
-register_helper_msg = Already have an account? Sign in now!
+already_have_account = Already have an account?
-social_register_helper_msg = Already have an account? Link it now!
+sign_in_now = Sign in now!
 disable_register_prompt = Registration is disabled. Please contact your site administrator.
 disable_register_mail = Email confirmation for registration is disabled.
 manual_activation_only = Contact your site administrator to complete activation.
@@ -408,7 +408,8 @@ remember_me = Remember this device
 remember_me.compromised = The login token is not valid anymore which may indicate a compromised account. Please check your account for unusual activities.
 forgot_password_title= Forgot password
 forgot_password = Forgot password?
-sign_up_now = Need an account? Register now.
+need_account = Need an account?
+sign_up_now = Register now.
 sign_up_successful = Account was successfully created. Welcome!
 confirmation_mail_sent_prompt = A new confirmation email has been sent to <b>%s</b>. Please check your inbox within the next %s to complete the registration process. If the email is incorrect, you can log in, and request another confirmation email to be sent to a different address.
 must_change_password = Update your password
@@ -473,6 +474,7 @@ sspi_auth_failed = SSPI authentication failed
 password_pwned = The password you chose is on a <a target="_blank" rel="noopener noreferrer" href="https://haveibeenpwned.com/Passwords">list of stolen passwords</a> previously exposed in public data breaches. Please try again with a different password and consider changing this password elsewhere too.
 password_pwned_err = Could not complete request to HaveIBeenPwned
 last_admin = You cannot remove the last admin. There must be at least one admin.
+back_to_sign_in = Back to Sign In
 
 [mail]
 view_it_on = View it on %s

templates/user/auth/captcha.tmpl

@@ -1,5 +1,5 @@
 {{if .EnableCaptcha}}{{if eq .CaptchaType "image"}}
-	<div class="inline field">
+	<div class="inline field tw-text-center">
 		{{.Captcha.CreateHTML}}
 	</div>
 	<div class="required field {{if .Err_Captcha}}error{{end}}">
@@ -7,18 +7,17 @@
 		<input id="captcha" name="captcha" value="{{.captcha}}" autocomplete="off">
 	</div>
 {{else if eq .CaptchaType "recaptcha"}}
-	<div class="inline field required">
+	<div class="inline field tw-text-center required">
 		<div id="captcha" data-captcha-type="g-recaptcha" class="g-recaptcha-style" data-sitekey="{{.RecaptchaSitekey}}"></div>
 	</div>
 	<script src='{{URLJoin .RecaptchaURL "api.js"}}'></script>
 {{else if eq .CaptchaType "hcaptcha"}}
-	<div class="inline field required">
+	<div class="inline field tw-text-center required">
 		<div id="captcha" data-captcha-type="h-captcha" class="h-captcha-style" data-sitekey="{{.HcaptchaSitekey}}"></div>
 	</div>
 	<script src='https://hcaptcha.com/1/api.js'></script>
 {{else if eq .CaptchaType "mcaptcha"}}
-	<div class="inline field">
+	<div class="inline field tw-text-center">
-		<label></label>
 		<div class="m-captcha-style" id="mcaptcha__widget-container"></div>
 		<div id="captcha" data-captcha-type="m-captcha" data-sitekey="{{.McaptchaSitekey}}" data-instance-url="{{.McaptchaURL}}"></div>
 	</div>

templates/user/auth/oauth_container.tmpl

@@ -0,0 +1,29 @@
+{{if or .OAuth2Providers .EnableOpenIDSignIn}}
+<div class="divider divider-text">
+	{{ctx.Locale.Tr "sign_in_or"}}
+</div>
+<div id="oauth2-login-navigator" class="tw-py-1">
+	<div class="tw-flex tw-flex-col tw-justify-center">
+		<div id="oauth2-login-navigator-inner" class="tw-flex tw-flex-col tw-flex-wrap tw-items-center tw-gap-2">
+			{{range $provider := .OAuth2Providers}}
+				<a class="{{$provider.Name}} ui button tw-flex tw-items-center tw-justify-center tw-py-2 tw-w-full oauth-login-link" href="{{AppSubUrl}}/user/oauth2/{{$provider.DisplayName}}">
+					{{$provider.IconHTML 28}}
+					{{ctx.Locale.Tr "sign_in_with_provider" $provider.DisplayName}}
+				</a>
+			{{end}}
+			{{if .EnableOpenIDSignIn}}
+				<a class="openid ui button tw-flex tw-items-center tw-justify-center tw-py-2 tw-w-full" href="{{AppSubUrl}}/user/login/openid">
+				{{svg "fontawesome-openid" 28 "tw-mr-2"}}
+				{{ctx.Locale.Tr "sign_in_with_provider" "OpenID"}}
+				</a>
+			{{end}}
+			{{if .EnableSSPI}}
+				<a class="ui button tw-flex tw-items-center tw-justify-center tw-py-2 tw-w-full" rel="nofollow" href="{{AppSubUrl}}/user/login?auth_with_sspi=1">
+					{{svg "fontawesome-windows"}}
+					&nbsp;SSPI
+				</a>
+			{{end}}
+		</div>
+	</div>
+</div>
+{{end}}

templates/user/auth/signin.tmpl

@@ -1,8 +1,7 @@
 {{template "base/head" .}}
 <div role="main" aria-label="{{.Title}}" class="page-content user signin{{if .LinkAccountMode}} icon{{end}}">
-	{{template "user/auth/signin_navbar" .}}
 	<div class="ui middle very relaxed page grid">
-		<div class="ui container column fluid">
+		<div class="column tw-flex tw-flex-col tw-gap-4 tw-max-w-2xl tw-m-auto">
 			{{template "user/auth/signin_inner" .}}
 		</div>
 	</div>

templates/user/auth/signin_inner.tmpl

@@ -1,23 +1,25 @@
-{{if or (not .LinkAccountMode) (and .LinkAccountMode .LinkAccountModeSignIn)}}
+<div class="ui container fluid">
-{{template "base/alert" .}}
+	{{if or (not .LinkAccountMode) (and .LinkAccountMode .LinkAccountModeSignIn)}}
-{{end}}
+	{{template "base/alert" .}}
-<h4 class="ui top attached header center">
+	{{end}}
+	<h4 class="ui top attached header center">
 		{{if .LinkAccountMode}}
 			{{ctx.Locale.Tr "auth.oauth_signin_title"}}
 		{{else}}
 			{{ctx.Locale.Tr "auth.login_userpass"}}
 		{{end}}
-</h4>
+	</h4>
-<div class="ui attached segment">
+	<div class="ui attached segment">
-	<form class="ui form tw-max-w-2xl tw-m-auto" action="{{.SignInLink}}" method="post">
+		<form class="ui form" action="{{.SignInLink}}" method="post">
 			{{.CsrfTokenHtml}}
 			<div class="required field {{if and (.Err_UserName) (or (not .LinkAccountMode) (and .LinkAccountMode .LinkAccountModeSignIn))}}error{{end}}">
 				<label for="user_name">{{ctx.Locale.Tr "home.uname_holder"}}</label>
 				<input id="user_name" type="text" name="user_name" value="{{.user_name}}" autofocus required>
 			</div>
 			{{if or (not .DisablePassword) .LinkAccountMode}}
-	<div class="required field {{if and (.Err_Password) (or (not .LinkAccountMode) (and .LinkAccountMode .LinkAccountModeSignIn))}}error{{end}}">
+			<div class="required field {{if and (.Err_Password) (or (not .LinkAccountMode) (and .LinkAccountMode .LinkAccountModeSignIn))}}error{{end}} form-field-content-aside-label">
 				<label for="password">{{ctx.Locale.Tr "password"}}</label>
+				<a href="{{AppSubUrl}}/user/forgot_password">{{ctx.Locale.Tr "auth.forgot_password"}}</a>
 				<input id="password" name="password" type="password" value="{{.password}}" autocomplete="current-password" required>
 			</div>
 			{{end}}
@@ -33,38 +35,31 @@
 			{{template "user/auth/captcha" .}}
 
 			<div class="field">
-		<button class="ui primary button">
+				<button class="ui primary button tw-w-full">
 					{{if .LinkAccountMode}}
 						{{ctx.Locale.Tr "auth.oauth_signin_submit"}}
 					{{else}}
 						{{ctx.Locale.Tr "sign_in"}}
 					{{end}}
 				</button>
-		<a href="{{AppSubUrl}}/user/forgot_password">{{ctx.Locale.Tr "auth.forgot_password"}}</a>
 			</div>
+		</form>
+
+		{{template "user/auth/oauth_container" .}}
+	</div>
+</div>
+
+<div class="ui container fluid">
+	{{template "user/auth/webauthn_error" .}}
+
+	<div class="ui attached segment header top tw-max-w-2xl tw-m-auto tw-flex tw-flex-col tw-items-center">
+		<a class="signin-passkey">{{ctx.Locale.Tr "auth.signin_passkey"}}</a>
 
 		{{if .ShowRegistrationButton}}
 			<div class="field">
+				<span>{{ctx.Locale.Tr "auth.need_account"}}</span>
 				<a href="{{AppSubUrl}}/user/sign_up">{{ctx.Locale.Tr "auth.sign_up_now"}}</a>
 			</div>
 		{{end}}
-
-	{{if .OAuth2Providers}}
-	<div class="divider divider-text">
-		{{ctx.Locale.Tr "sign_in_or"}}
 	</div>
-	<div id="oauth2-login-navigator" class="tw-py-1">
-		<div class="tw-flex tw-flex-col tw-justify-center">
-			<div id="oauth2-login-navigator-inner" class="tw-flex tw-flex-col tw-flex-wrap tw-items-center tw-gap-2">
-				{{range $provider := .OAuth2Providers}}
-					<a class="{{$provider.Name}} ui button tw-flex tw-items-center tw-justify-center tw-py-2 tw-w-full oauth-login-link" href="{{AppSubUrl}}/user/oauth2/{{$provider.DisplayName}}">
-						{{$provider.IconHTML 28}}
-						{{ctx.Locale.Tr "sign_in_with_provider" $provider.DisplayName}}
-					</a>
-				{{end}}
-			</div>
-		</div>
-	</div>
-	{{end}}
-	</form>
 </div>

templates/user/auth/signin_navbar.tmpl

@@ -1,24 +0,0 @@
-{{if or .EnableOpenIDSignIn .EnableSSPI}}
-<overflow-menu class="ui secondary pointing tabular top attached borderless menu navbar secondary-nav">
-	<div class="overflow-menu-items tw-justify-center">
-		<a class="{{if .PageIsLogin}}active {{end}}item" rel="nofollow" href="{{AppSubUrl}}/user/login">
-			{{ctx.Locale.Tr "auth.tab_signin"}}
-		</a>
-		<a class="{{if .PageIsSignUp}}active{{end}} item" rel="nofollow" href="{{AppSubUrl}}/user/sign_up">
-			{{ctx.Locale.Tr "auth.tab_signup"}}
-		</a>
-		{{if .EnableOpenIDSignIn}}
-		<a class="{{if .PageIsLoginOpenID}}active {{end}}item" rel="nofollow" href="{{AppSubUrl}}/user/login/openid">
-			{{svg "fontawesome-openid"}}
-			&nbsp;{{ctx.Locale.Tr "auth.tab_openid"}}
-		</a>
-		{{end}}
-		{{if .EnableSSPI}}
-		<a class="item" rel="nofollow" href="{{AppSubUrl}}/user/login?auth_with_sspi=1">
-			{{svg "fontawesome-windows"}}
-			&nbsp;SSPI
-		</a>
-		{{end}}
-	</div>
-</overflow-menu>
-{{end}}

templates/user/auth/signin_openid.tmpl

@@ -1,7 +1,12 @@
 {{template "base/head" .}}
 <div role="main" aria-label="{{.Title}}" class="page-content user signin openid">
-	{{template "user/auth/signin_navbar" .}}
+	<div class="ui middle very relaxed page grid">
-	<div class="ui container">
+		<div class="column tw-flex tw-flex-col tw-gap-4 tw-max-w-2xl tw-m-auto">
+			<a href="{{AppSubUrl}}/user/login" class="tw-mx-auto">
+				<img width="100" height="100" src="{{AssetUrlPrefix}}/img/logo.svg" alt="{{ctx.Locale.Tr "logo"}}">
+			</a>
+
+			<div class="ui container fluid">
 				{{template "base/alert" .}}
 				<h4 class="ui top attached header center">
 					{{svg "fontawesome-openid"}}
@@ -27,10 +32,20 @@
 							</div>
 						</div>
 						<div class="inline field">
-				<button class="ui primary button">{{ctx.Locale.Tr "sign_in"}}</button>
+							<button class="ui primary button tw-w-full">{{ctx.Locale.Tr "sign_in"}}</button>
 						</div>
 					</form>
 				</div>
 			</div>
+
+			<div class="ui container fluid">
+				{{template "user/auth/webauthn_error" .}}
+
+				<div class="ui attached segment header top tw-flex tw-flex-col tw-items-center">
+					<a href="{{AppSubUrl}}/user/login">{{ctx.Locale.Tr "auth.back_to_sign_in"}}</a>
+				</div>
+			</div>
+		</div>
+	</div>
 </div>
 {{template "base/footer" .}}

templates/user/auth/signup.tmpl

@@ -1,8 +1,9 @@
 {{template "base/head" .}}
 <div role="main" aria-label="{{.Title}}" class="page-content user signin{{if .LinkAccountMode}} icon{{end}}">
-	{{template "user/auth/signin_navbar" .}}
 	<div class="ui middle very relaxed page grid">
+		<div class="column tw-flex tw-flex-col tw-gap-4 tw-max-w-2xl tw-m-auto">
 			{{template "user/auth/signup_inner" .}}
 		</div>
+	</div>
 </div>
 {{template "base/footer" .}}

templates/user/auth/signup_inner.tmpl

@@ -1,4 +1,4 @@
-<div class="ui container column fluid{{if .LinkAccountMode}} icon{{end}}">
+<div class="ui container fluid{{if .LinkAccountMode}} icon{{end}}">
 	<h4 class="ui top attached header center">
 		{{if .LinkAccountMode}}
 			{{ctx.Locale.Tr "auth.oauth_signup_title"}}
@@ -7,7 +7,7 @@
 		{{end}}
 	</h4>
 	<div class="ui attached segment">
-		<form class="ui form tw-max-w-2xl tw-m-auto" action="{{.SignUpLink}}" method="post">
+		<form class="ui form" action="{{.SignUpLink}}" method="post">
 			{{.CsrfTokenHtml}}
 			{{if or (not .LinkAccountMode) (and .LinkAccountMode .LinkAccountModeRegister)}}
 			{{template "base/alert" .}}
@@ -38,7 +38,7 @@
 				{{template "user/auth/captcha" .}}
 
 				<div class="inline field">
-					<button class="ui primary button">
+					<button class="ui primary button tw-w-full">
 						{{if .LinkAccountMode}}
 							{{ctx.Locale.Tr "auth.oauth_signup_submit"}}
 						{{else}}
@@ -46,31 +46,20 @@
 						{{end}}
 					</button>
 				</div>
-
-				{{if not .LinkAccountMode}}
-				<div class="inline field">
-					<a href="{{AppSubUrl}}/user/login">{{ctx.Locale.Tr "auth.register_helper_msg"}}</a>
-				</div>
-				{{end}}
 			{{end}}
 
-			{{if .OAuth2Providers}}
+			{{template "user/auth/oauth_container" .}}
-			<div class="divider divider-text">
-				{{ctx.Locale.Tr "sign_in_or"}}
-			</div>
-			<div id="oauth2-login-navigator" class="tw-py-1">
-				<div class="tw-flex tw-flex-col tw-justify-center">
-					<div id="oauth2-login-navigator-inner" class="tw-flex tw-flex-col tw-flex-wrap tw-items-center tw-gap-2">
-						{{range $provider := .OAuth2Providers}}
-							<a class="{{$provider.Name}} ui button tw-flex tw-items-center tw-justify-center tw-py-2 tw-w-full oauth-login-link" href="{{AppSubUrl}}/user/oauth2/{{$provider.DisplayName}}">
-								{{$provider.IconHTML 28}}
-								{{ctx.Locale.Tr "sign_in_with_provider" $provider.DisplayName}}
-							</a>
-						{{end}}
-					</div>
-				</div>
-			</div>
-			{{end}}
 		</form>
 	</div>
 </div>
+
+<div class="ui container fluid">
+	<div class="ui attached segment header top tw-flex tw-flex-col tw-items-center">
+		{{if not .LinkAccountMode}}
+		<div class="field">
+			<span>{{ctx.Locale.Tr "auth.already_have_account"}}</span>
+			<a href="{{AppSubUrl}}/user/login">{{ctx.Locale.Tr "auth.sign_in_now"}}</a>
+		</div>
+		{{end}}
+	</div>
+</div>

web_src/css/form.css

@@ -448,6 +448,24 @@ textarea:focus,
   }
 }
 
+/* form fields with additional content besides their label, used on login form
+ * use like <div class="field"><label/><a/><input/></div> */
+.form-field-content-aside-label {
+  display: grid;
+  grid-template-columns: 1fr 1fr;
+}
+.form-field-content-aside-label > *:nth-child(2) {
+  text-align: right;
+  margin-bottom: 4px;
+}
+.form-field-content-aside-label input {
+  grid-column: span 2;
+}
+
+.ui.form .field > .selection.dropdown {
+  min-width: 14em; /* matches the default min width */
+}
+
 .new.webhook form .help {
   margin-left: 25px;
 }