fix(panel): clean up login screen copy and add runtime awareness

- Remove environment variable password hint from login form
- Add `runtime` field to session info to indicate `"docker"` or `"process"` mode
- Only show Docker-socket warning when panel is actually running in Docker mode
- Refactor `SessionBody` creation into reusable `session_body()` function
- Update TypeScript types with `PanelRuntime` type and runtime field

Author: bnolens

.textile-monorepo-source

@@ -1 +1 @@
-cd5d47e8de947e521ceee2eb619f6da312c1a912
+549519de470ac23089c433e55e132b452658e0e5

.textile-stitch-release-version

@@ -1 +1 @@
-0.1.151
+0.1.152

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "stitch-bot"
-version = "0.1.151"
+version = "0.1.152"
 edition = "2021"
 description = "Stitch — Textile filler-network operator bot; market-makes the filler order book with signed UniswapX limit orders."
 license = "AGPL-3.0-or-later"

Cargo.toml

@@ -30,20 +30,28 @@ pub struct SessionBody {
     /// True when the panel accepts a proxy identity header, so the UI can explain
     /// why it's waiting on `tailscale serve` instead of showing a blank page.
     tailnet_login: bool,
+    /// How the panel supervises bots: `"docker"` or `"process"` (desktop).
+    /// The login screen uses this to show a Docker-socket warning only when it
+    /// applies.
+    runtime: &'static str,
 }
 
-/// Who am I? Never fails: an unauthenticated caller gets `authenticated: false`
-/// plus which login methods exist.
-pub async fn current(State(state): State<AppState>, req: axum::extract::Request) -> Response {
-    let identity = identify(&state, &req).ok();
-    Json(SessionBody {
+fn session_body(state: &AppState, identity: Option<&Identity>) -> SessionBody {
+    SessionBody {
         authenticated: identity.is_some(),
-        identity: identity.as_ref().map(|i| i.label().to_string()),
+        identity: identity.map(|i| i.label().to_string()),
         password_login: state.cfg.auth.password_hash().is_some(),
         tailnet_login: state.cfg.trust_identity_header
             && !state.cfg.auth.allowed_users().is_empty(),
-    })
-    .into_response()
+        runtime: state.cfg.runtime.as_str(),
+    }
+}
+
+/// Who am I? Never fails: an unauthenticated caller gets `authenticated: false`
+/// plus which login methods exist.
+pub async fn current(State(state): State<AppState>, req: axum::extract::Request) -> Response {
+    let identity = identify(&state, &req).ok();
+    Json(session_body(&state, identity.as_ref())).into_response()
 }
 
 #[derive(Deserialize)]
@@ -93,12 +101,7 @@ pub async fn login(
     tracing::info!("a password login succeeded");
     Ok((
         [(header::SET_COOKIE, session_cookie_header(&token))],
-        Json(SessionBody {
-            authenticated: true,
-            identity: Some(Identity::Password.label().to_string()),
-            password_login: true,
-            tailnet_login: false,
-        }),
+        Json(session_body(&state, Some(&Identity::Password))),
     )
         .into_response())
 }
@@ -269,6 +272,7 @@ mod tests {
         assert_eq!(v["authenticated"], false);
         assert_eq!(v["passwordLogin"], true);
         assert_eq!(v["tailnetLogin"], false);
+        assert_eq!(v["runtime"], "docker");
     }
 
     #[tokio::test]

src/panel/http/session.rs

@@ -63,10 +63,7 @@ export default function Login({
                 aria-hidden
                 className="sr-only"
               />
-              <Field
-                label="Panel password"
-                hint="The password you chose in the Stitch desktop app (or STITCH_PANEL_PASSWORD_HASH)."
-              >
+              <Field label="Panel password">
                 <Input
                   type="password"
                   name="password"
@@ -99,9 +96,12 @@ export default function Login({
           </Card>
         )}
 
-        <p className="text-center text-xs text-faint">
-          Whoever reaches this panel controls the Docker socket on this host.
-        </p>
+        {session.runtime === 'docker' && (
+          <p className="text-center text-xs text-faint">
+            Access to this panel includes control of the Docker socket on this
+            host.
+          </p>
+        )}
       </div>
     </div>
   )

web/src/pages/Login.tsx

@@ -121,11 +121,15 @@ export interface SaveResult {
   message: string
 }
 
+export type PanelRuntime = 'docker' | 'process'
+
 export interface SessionInfo {
   authenticated: boolean
   identity: string | null
   passwordLogin: boolean
   tailnetLogin: boolean
+  /** How the panel supervises bots. Desktop uses `process` (no Docker socket). */
+  runtime: PanelRuntime
 }
 
 export interface ActionResult {