ShaoLOWu 21fb080530

fix(frontend): allow non-ASCII local parts in auth password forms (#7488) (#7498) ...

* fix(frontend): allow non-ASCII local parts in auth password forms (#7488)

The sign-in, register, admin-setup and change-password forms relied on the
browser's type="email" constraint validation, which rejects any non-ASCII
local part before the submit handler runs. The backend identity schema
deliberately accepts such addresses (see emailSchema in @/core/auth/types),
so an account created via the API, an administrator or OIDC could never sign
in through the password form.

Forms are now noValidate, and the permissive isValidEmail helper (one @,
non-empty local part and domain, no whitespace) runs in the handlers instead,
staying strictly weaker than what the backend accepts.

* fix(auth): normalize emails and restore form password checks

---------

Co-authored-by: Willem Jiang <willem.jiang@gmail.com>

2026-10-25 22:09:58 +08:00

..

password-forms.dom.test.tsx

fix(frontend): allow non-ASCII local parts in auth password forms (#7488) (#7498)

2026-10-25 22:09:58 +08:00

remember-session-option.test.ts

perf(frontend): bound delivery, bundles, and long-running UI work (#4622)

2026-08-01 22:19:59 +08:00