PONGo_ios/LoginView.swift
Jon Vanvik 203465913c Apply code-review fixes: identity/pagination, load races, TLS pin, leaks
Addresses a multi-agent code review (26 confirmed findings + a URLSession
leak) across correctness, concurrency, security, and cleanup:

- MongoDocument.id: deterministic fallback (was UUID() on every access) to stop
  SwiftUI List/ForEach identity churn; getAll pagination drives its cursor off
  the real _id via documentId, so a missing _id stops paging instead of looping
  on a fabricated cursor.
- View models: per-load generation guard (+ captured-tab guard on ONU detail)
  so a cancelled or overlapping load can't commit stale results or land data on
  the wrong tab.
- JSONValue.intValue: guard Int(d) against NaN/inf/out-of-range (crash).
- ServerTrustEvaluator: hash the real SubjectPublicKeyInfo (prepend the
  algorithm-specific ASN.1 SPKI header) so a standard openssl-captured
  public-key pin actually matches; unknown key types fail closed.
- AppEnvironment.configure: clear stale cookies + Keychain creds on host change.
- FirmwareFile.isCompatible: empty metadata no longer passes as compatible-for-all.
- APIClient: invalidate URLSession on deinit (per-configure/probe leak).
- Dashboard best-effort sections keep last-good on transient failure; unified
  optical thresholds; LoginView prefill-once; populatedBuckets unique ForEach id;
  Format rounding rollover; dead-code/docstring/dedup cleanups.

Verification pending on the Mac (no Swift toolchain on the Linux dev box).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-05-31 16:36:49 +02:00

80 lines
2.8 KiB
Swift

import SwiftUI
struct LoginView: View {
@Environment(AppEnvironment.self) private var env
@State private var email = ""
@State private var password = ""
@State private var remember = true
@State private var phase: LoadPhase = .idle
@State private var didPrefill = false
var body: some View {
NavigationStack {
Form {
Section {
TextField("Email", text: $email)
.textContentType(.username)
.keyboardType(.emailAddress)
.textInputAutocapitalization(.never)
.autocorrectionDisabled()
SecureField("Password", text: $password)
.textContentType(.password)
Toggle("Remember me", isOn: $remember)
} header: {
Text("Sign in")
} footer: {
if let host = env.configuration?.host {
Text("Connecting to \(host)")
}
}
Section {
Button {
Task { await signIn() }
} label: {
HStack {
Spacer()
if phase == .loading { ProgressView() } else { Text("Sign in") }
Spacer()
}
}
.disabled(email.isEmpty || password.isEmpty || phase == .loading)
}
if case .failed(let msg) = phase {
Section { Text(msg).foregroundStyle(.red).font(.footnote) }
}
}
.navigationTitle("MCMS")
.toolbar {
ToolbarItem(placement: .topBarLeading) {
NavigationLink {
SettingsView(isInitialSetup: false)
} label: {
Image(systemName: "gearshape")
}
}
}
.onAppear {
// Prefill from the Keychain ONCE onAppear fires again when the
// user returns from Settings, and re-running this would wipe any
// credentials they'd already typed.
guard !didPrefill else { return }
didPrefill = true
email = env.savedEmail ?? ""
password = env.savedPassword ?? ""
}
}
}
private func signIn() async {
phase = .loading
do {
try await env.signIn(email: email, password: password, remember: remember)
phase = .loaded
} catch {
phase = .failed((error as? APIError)?.localizedDescription ?? error.localizedDescription)
}
}
}