test: cover the cloud auth surface (#14987)

## Summary

Adds the missing test coverage for the cloud sign-in and sign-up
surface. Four files had no tests at all.

## Changes

- **What**: Tests only, no product code.

Previously uncovered: the `beforeEnter` route guards and their
`switchAccount` escape hatch, `usePostAuthRedirect`, the sign-in
password schema, and the terms notice. The rest extends existing files
rather than duplicating their setup.

Covered here: route guards on both `/cloud/login` and `/cloud/signup`,
post-auth redirect precedence and its open-redirect guard, password
boundaries and character classes, the terms notice and its outbound-link
safety, the sign-in form's validation states and autofill attributes,
the turnstile gate on sign-up, and the insecure-context warning for
self-hosted HTTP origins.

- **Breaking**: None.

## Review Focus

The route-guard tests drive both `/cloud/login` and `/cloud/signup`
through the same `describe.for`. Those guards are byte-identical
duplicates, so testing one would leave the other free to regress.

One assumption from the plan turned out to be wrong, and the test pins
the real behaviour instead: a pristine sign-in button is **enabled**,
not disabled. PrimeVue leaves `$form.valid` undefined until a field is
touched, so submitting a pristine form is what surfaces the errors.

`globalThis.isSecureContext` is `undefined` under happy-dom rather than
`true`, so the insecure-context test stubs the *secure* case. The value
is a setup-time snapshot, so the stub has to precede mount.

## Testing

90 tests. Every one was mutation-checked: the behaviour it pins was
broken in the source, the test confirmed failing, then reverted. **No
survivors.**

| Area | Cases | Representative mutation → result |
| --- | --- | --- |
| Password + email schema | 19 | drop any one complexity regex → that
case fails; move the refine `path` → mismatch fails |
| Open-redirect guard | 7 | read the last repeated query entry instead
of the first → fails; decode fallback returns a `/` path → fails |
| Post-auth redirect | 7 | `router.replace` → `push` → fails; drop the
OAuth-resume early return → deep-link precedence fails |
| Route guards | 19 | negate `isLoggedIn` → both routes fail; `if
(!to.query.switchAccount)` → `if (true)` → escape hatch fails |
| Terms notice | 5 | drop `rel="noopener noreferrer"` → fails; hard-code
any locale fragment → fails |
| Sign-in form | 12 | drop `:disabled="!$form.valid"` → fails;
`current-password` → `new-password` → fails |
| Sign-up form | 15 | remove `useThrottleFn` → double-submit fails; make
`resetTurnstile` a no-op → fails |
| Login view | 6 | insecure-context warning `v-if="false"` → fails;
force the webview notice → fails |

Three guards are unkillable in isolation and die only once the outer
gate is also removed, which is the signature of defence-in-depth rather
than dead code: `CloudSignInForm.onSubmit`'s `event.valid`,
`SignUpForm.onSubmit`'s `waitingForTurnstile`, and both forms' loading
gate behind `Button`'s `disabled || loading`.

No e2e spec. The two flows worth driving end to end — the deep-link
round trip and the already-signed-in redirect — are pinned closer to the
logic in `usePostAuthRedirect.test.ts` and
`onboardingCloudRoutes.test.ts`, the latter on both routes. A browser
spec added a slower path to the same assertions.

---------

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: CodeRabbit <noreply@coderabbit.ai>
Co-authored-by: Christian Byrne <cbyrne@comfy.org>

Author: 4 people

src/components/dialog/content/signin/SignUpForm.test.ts

@@ -43,9 +43,6 @@ const mockReset = vi.fn()
 let emitTurnstileToken: ((token: string) => void) | undefined
 let emitTurnstileUnavailable: ((unavailable: boolean) => void) | undefined
 
-// The reset-on-toggle behavior lives in useTurnstileGate itself (see
-// useTurnstile.test.ts); this fake just wires token/unavailable through to
-// `waiting` the same way so SignUpForm's submit gating can be exercised.
 vi.mock('@/composables/auth/useTurnstile', () => ({
   useTurnstile: () => ({
     enabled: mockTurnstileEnabled
@@ -62,9 +59,8 @@ vi.mock('@/composables/auth/useTurnstile', () => ({
   })
 }))
 
-// Stub the real widget (which loads the external Turnstile script) with one that
-// exposes a spyable reset() and lets a test drive the v-model token/unavailable
-// the way a solved challenge (or a broken/slow widget) would.
+// The real widget loads an external Turnstile script; this stub exposes a
+// spyable reset() and lets a test drive the token/unavailable v-models.
 vi.mock('./TurnstileWidget.vue', async () => {
   const { defineComponent: defineMock } = await import('vue')
   return {
@@ -118,8 +114,6 @@ describe('SignUpForm', () => {
     return { ...utils, user }
   }
 
-  /** Render through a host that keeps a ref, so the parent-facing exposed
-   * `resetTurnstile()` can be invoked the way SignInContent would. */
   function renderWithRef() {
     const formRef = ref<{ resetTurnstile: () => void } | null>(null)
     const Host = defineComponent({
@@ -246,11 +240,6 @@ describe('SignUpForm', () => {
     })
   })
 
-  // Regression coverage for the shadow-mode race: previously submit was only
-  // gated in 'enforce' mode, so most real signups in 'shadow' mode raced
-  // ahead of the async Cloudflare challenge and reached the backend with an
-  // empty token. Gating now depends only on whether the widget is enabled
-  // (shadow or enforce both render it), so both modes behave identically here.
   describe('Turnstile submit gating', () => {
     it('disables the submit button until a token is present', async () => {
       mockTurnstileEnabled.value = true
@@ -268,7 +257,10 @@ describe('SignUpForm', () => {
 
       await user.click(screen.getByRole('button', { name: signUpButton }))
 
-      expect(onSubmit).not.toHaveBeenCalled()
+      expect(
+        onSubmit,
+        'gating on enabled (not enforce) is what stops a shadow-mode signup racing ahead with an empty token'
+      ).not.toHaveBeenCalled()
     })
 
     it('emits submit with the token once the challenge is solved', async () => {
@@ -297,4 +289,66 @@ describe('SignUpForm', () => {
       expect(onSubmit).toHaveBeenCalledWith(expectedValues, undefined)
     })
   })
+
+  describe('Turnstile wait hint accessibility', () => {
+    it('announces the wait politely while the challenge is pending', async () => {
+      mockTurnstileEnabled.value = true
+      renderComponent()
+      await nextTick()
+
+      const hint = screen.getByRole('status')
+      expect(
+        hint,
+        'the hint is the only thing telling a screen-reader user why submit is unavailable'
+      ).toHaveTextContent(enMessages.auth.turnstile.submitBlockedHint)
+      expect(hint).toHaveAttribute('aria-live', 'polite')
+    })
+
+    it('points the disabled submit button at the hint', async () => {
+      mockTurnstileEnabled.value = true
+      const { user } = renderComponent()
+      await fillValidSignup(user)
+      await nextTick()
+
+      const submit = screen.getByRole('button', { name: signUpButton })
+      expect(
+        submit,
+        'an otherwise-valid form must stay disabled while the challenge is pending'
+      ).toBeDisabled()
+      expect(submit).toHaveAttribute(
+        'aria-describedby',
+        screen.getByRole('status').id
+      )
+    })
+
+    it('drops the description once the challenge resolves', async () => {
+      mockTurnstileEnabled.value = true
+      renderComponent()
+      await nextTick()
+
+      emitTurnstileToken!('token-xyz')
+      await nextTick()
+
+      expect(
+        screen.getByRole('button', { name: signUpButton })
+      ).not.toHaveAttribute('aria-describedby')
+    })
+  })
+
+  describe('double-submit throttling', () => {
+    it('emits once when the button is clicked twice in quick succession', async () => {
+      const onSubmit = vi.fn()
+      const { user } = renderComponent({ onSubmit })
+      await fillValidSignup(user)
+      const submit = screen.getByRole('button', { name: signUpButton })
+
+      await user.click(submit)
+      await user.click(submit)
+
+      expect(
+        onSubmit,
+        'an impatient double-click would otherwise create the account twice'
+      ).toHaveBeenCalledOnce()
+    })
+  })
 })

src/platform/cloud/onboarding/CloudLoginView.test.ts

@@ -27,14 +27,17 @@ const FREE_RUN_MESSAGES = {
     login: {
       cloudNewUser: 'New to Comfy?',
       cloudSignUp: 'Sign up here',
-      freeRunsSuffix: 'to get {count} free run. | to get {count} free runs.'
+      freeRunsSuffix: 'to get {count} free run. | to get {count} free runs.',
+      insecureContextWarning: 'This connection is insecure'
     }
   }
 }
 
 async function renderLoginView(
   url = '/cloud/login',
-  messages: Partial<typeof FREE_RUN_MESSAGES> = {}
+  messages: {
+    auth?: { login?: Partial<typeof FREE_RUN_MESSAGES.auth.login> }
+  } = {}
 ) {
   const router = createRouter({
     history: createMemoryHistory(),
@@ -56,7 +59,6 @@ async function renderLoginView(
         createI18n({ legacy: false, locale: 'en', messages: { en: messages } })
       ],
       stubs: {
-        Message: true,
         CloudSignInForm: { template: '<form data-testid="signin-form" />' }
       }
     }
@@ -65,6 +67,7 @@ async function renderLoginView(
 
 afterEach(() => {
   isEmbeddedWebView.value = false
+  vi.unstubAllGlobals()
 })
 
 describe('CloudLoginView', () => {
@@ -107,6 +110,29 @@ describe('CloudLoginView', () => {
     ).not.toBeInTheDocument()
   })
 
+  it.for([true, false])(
+    'renders the insecure-context warning only over plain HTTP (secure: %s)',
+    async (secure: boolean) => {
+      vi.stubGlobal('isSecureContext', secure)
+      const { unmount } = await renderLoginView('/cloud/login', {
+        auth: {
+          login: { insecureContextWarning: 'This connection is insecure' }
+        }
+      })
+
+      const warning = screen.queryByText('This connection is insecure')
+      if (secure) {
+        expect(warning).not.toBeInTheDocument()
+      } else {
+        expect(
+          warning,
+          'a self-hosted HTTP origin can have credentials intercepted, so the warning must render'
+        ).toBeInTheDocument()
+      }
+      unmount()
+    }
+  )
+
   it('does not region-gate sign-in, because an existing account already completed sign-up', async () => {
     const user = (await import('@testing-library/user-event')).default.setup()
     await renderLoginView()

src/platform/cloud/onboarding/components/CloudSignInForm.test.ts

@@ -0,0 +1,195 @@
+import userEvent from '@testing-library/user-event'
+import { render, screen, waitFor } from '@testing-library/vue'
+import PrimeVue from 'primevue/config'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { createI18n } from 'vue-i18n'
+import { createMemoryHistory, createRouter } from 'vue-router'
+
+import enMessages from '@/locales/en/main.json' with { type: 'json' }
+import CloudSignInForm from '@/platform/cloud/onboarding/components/CloudSignInForm.vue'
+
+const loading = vi.hoisted(() => ({ value: false }))
+vi.mock('@/stores/authStore', () => ({
+  useAuthStore: () => ({
+    get loading() {
+      return loading.value
+    }
+  })
+}))
+
+const LOGIN_COPY = enMessages.auth.login
+
+function renderForm(
+  authError?: string,
+  messages: Record<string, object | string> = {}
+) {
+  const router = createRouter({
+    history: createMemoryHistory(),
+    routes: [
+      {
+        path: '/cloud/forgot-password',
+        name: 'cloud-forgot-password',
+        component: { template: '<div />' }
+      }
+    ]
+  })
+  return render(CloudSignInForm, {
+    props: { authError },
+    global: {
+      plugins: [
+        router,
+        PrimeVue,
+        createI18n({ legacy: false, locale: 'en', messages: { en: messages } })
+      ]
+    }
+  })
+}
+
+const renderRealForm = () => renderForm(undefined, enMessages)
+
+const emailField = () =>
+  screen.getByPlaceholderText(LOGIN_COPY.emailPlaceholder)
+const passwordField = () =>
+  screen.getByPlaceholderText(LOGIN_COPY.passwordPlaceholder)
+const submitButton = () =>
+  screen.getByRole('button', { name: LOGIN_COPY.loginButton })
+
+beforeEach(() => {
+  loading.value = false
+})
+
+describe('CloudSignInForm', () => {
+  it('renders the auth error inline', () => {
+    renderForm('The password you entered is incorrect.')
+
+    expect(
+      screen.getByText('The password you entered is incorrect.')
+    ).toBeInTheDocument()
+  })
+
+  it('renders nothing when there is no auth error', () => {
+    renderForm()
+
+    expect(
+      screen.queryByText('The password you entered is incorrect.')
+    ).not.toBeInTheDocument()
+  })
+})
+
+describe('CloudSignInForm password manager support', () => {
+  it('marks the email field for autofill with a stable id', () => {
+    renderRealForm()
+
+    expect(emailField()).toHaveAttribute('id', 'cloud-sign-in-email')
+    expect(emailField()).toHaveAttribute('name', 'email')
+    expect(emailField()).toHaveAttribute('autocomplete', 'email')
+  })
+
+  it('marks the password field as current-password, not new-password', () => {
+    renderRealForm()
+
+    expect(passwordField()).toHaveAttribute('id', 'cloud-sign-in-password')
+    expect(passwordField()).toHaveAttribute('autocomplete', 'current-password')
+  })
+
+  it('binds both labels to their inputs', () => {
+    renderRealForm()
+
+    expect(screen.getByLabelText(LOGIN_COPY.emailLabel)).toBe(emailField())
+    expect(screen.getByLabelText(LOGIN_COPY.passwordLabel)).toBe(
+      passwordField()
+    )
+  })
+})
+
+describe('CloudSignInForm submit gating', () => {
+  // PrimeVue leaves `$form.valid` undefined until a field is touched, so the
+  // pristine button is enabled by design and is not asserted here.
+  it('disables submit once a field is touched and invalid', async () => {
+    const user = userEvent.setup()
+    renderRealForm()
+
+    await user.type(emailField(), 'not-an-email')
+
+    await waitFor(() => {
+      expect(submitButton()).toBeDisabled()
+    })
+  })
+
+  it('enables submit once both fields are filled', async () => {
+    const user = userEvent.setup()
+    renderRealForm()
+
+    await user.type(emailField(), 'user@example.com')
+    await user.type(passwordField(), 'Password1!')
+
+    await waitFor(() => {
+      expect(submitButton()).toBeEnabled()
+    })
+  })
+
+  it('surfaces a field error for a malformed email', async () => {
+    const user = userEvent.setup()
+    renderRealForm()
+
+    await user.type(emailField(), 'not-an-email')
+    await user.type(passwordField(), 'Password1!')
+    await user.click(submitButton())
+
+    await waitFor(() => {
+      expect(
+        screen.getByText(enMessages.validation.invalidEmail)
+      ).toBeInTheDocument()
+    })
+  })
+
+  it('does not emit submit for a malformed email, by button or by Enter', async () => {
+    const user = userEvent.setup()
+    const { emitted } = renderRealForm()
+
+    await user.type(emailField(), 'not-an-email')
+    await user.type(passwordField(), 'Password1!')
+    await user.click(submitButton())
+    await user.type(passwordField(), '{Enter}')
+
+    expect(emitted().submit).toBeUndefined()
+  })
+
+  it('submits on Enter from the password field', async () => {
+    const user = userEvent.setup()
+    const { emitted } = renderRealForm()
+
+    await user.type(emailField(), 'user@example.com')
+    await user.type(passwordField(), 'Password1!{Enter}')
+
+    await waitFor(() => {
+      expect(
+        emitted().submit,
+        'a handler wired only to the button click would never fire for the Enter key most people submit with'
+      ).toBeTruthy()
+    })
+    expect(emitted().submit[0]).toEqual([
+      { email: 'user@example.com', password: 'Password1!' }
+    ])
+  })
+})
+
+describe('CloudSignInForm in-flight state', () => {
+  it('disables submit and marks it busy while an auth action runs', () => {
+    loading.value = true
+    renderRealForm()
+
+    expect(submitButton()).toBeDisabled()
+    expect(submitButton()).toHaveAttribute('aria-busy', 'true')
+  })
+
+  it('does not emit submit while loading', async () => {
+    const user = userEvent.setup()
+    loading.value = true
+    const { emitted } = renderRealForm()
+
+    await user.click(submitButton())
+
+    expect(emitted().submit).toBeUndefined()
+  })
+})