From 42868fc2e612f54c77ce1cef9f9413ca8dc77036 Mon Sep 17 00:00:00 2001
From: Duncan Tourolle <duncan@tourolle.paris>
Date: Sun, 16 Aug 2026 11:31:27 +0200
Subject: [PATCH] feat(login): reveal-password toggle, and stop the keyboard
 editing credentials
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add an eye/eye-off button inside the password field so a typed password can
be checked against what was intended — the difference between "wrong
password" and "wrong keyboard" was previously invisible.

`bind:value` is not allowed alongside a dynamic `type`, so the field is wired
manually via value/oninput; unlike branching on two separate inputs, this
keeps focus and caret position when the toggle is pressed.

Both fields also get autocapitalize/autocorrect/spellcheck off and proper
autocomplete hints. The Android soft keyboard was free to capitalise or
autocorrect the username, which silently changes a credential the user
believes they typed correctly.
---
 src/routes/login/+page.svelte | 50 +++++++++++++++++++++++++++++------
 1 file changed, 42 insertions(+), 8 deletions(-)

diff --git a/src/routes/login/+page.svelte b/src/routes/login/+page.svelte
index 62fe1066..00e87d01 100644
--- a/src/routes/login/+page.svelte
+++ b/src/routes/login/+page.svelte
@@ -7,6 +7,7 @@
   let serverName = $state("");
   let username = $state("");
   let password = $state("");
+  let showPassword = $state(false);
   let connecting = $state(false);
   let loggingIn = $state(false);
   let localError = $state<string | null>(null);
@@ -146,6 +147,10 @@
             type="text"
             bind:value={username}
             placeholder="Enter your username"
+            autocapitalize="none"
+            autocorrect="off"
+            autocomplete="username"
+            spellcheck="false"
             class="w-full px-4 py-3 bg-[var(--color-surface)] border border-gray-700 rounded-lg focus:outline-none focus:border-[var(--color-jellyfin)] text-white placeholder-gray-500"
             disabled={loggingIn}
           />
@@ -155,14 +160,43 @@
           <label for="password" class="block text-sm font-medium text-gray-300 mb-2">
             Password
           </label>
-          <input
-            id="password"
-            type="password"
-            bind:value={password}
-            placeholder="Enter your password"
-            class="w-full px-4 py-3 bg-[var(--color-surface)] border border-gray-700 rounded-lg focus:outline-none focus:border-[var(--color-jellyfin)] text-white placeholder-gray-500"
-            disabled={loggingIn}
-          />
+          <div class="relative">
+            <!-- `type` is dynamic, so bind:value is not allowed here (Svelte); wire it manually. -->
+            <input
+              id="password"
+              type={showPassword ? "text" : "password"}
+              value={password}
+              oninput={(e) => (password = e.currentTarget.value)}
+              placeholder="Enter your password"
+              autocapitalize="none"
+              autocorrect="off"
+              autocomplete="current-password"
+              spellcheck="false"
+              class="w-full pl-4 pr-12 py-3 bg-[var(--color-surface)] border border-gray-700 rounded-lg focus:outline-none focus:border-[var(--color-jellyfin)] text-white placeholder-gray-500"
+              disabled={loggingIn}
+            />
+            <button
+              type="button"
+              onclick={() => (showPassword = !showPassword)}
+              disabled={loggingIn}
+              aria-label={showPassword ? "Hide password" : "Show password"}
+              aria-pressed={showPassword}
+              class="absolute inset-y-0 right-0 px-3 flex items-center text-gray-400 hover:text-white disabled:opacity-50 focus:outline-none focus:text-white"
+            >
+              {#if showPassword}
+                <!-- eye-off -->
+                <svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                  <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13.875 18.825A10.05 10.05 0 0112 19c-4.478 0-8.268-2.943-9.543-7a9.97 9.97 0 011.563-3.029m5.858.908a3 3 0 114.243 4.243M9.878 9.878l4.242 4.242M9.88 9.88l-3.29-3.29m7.532 7.532l3.29 3.29M3 3l3.59 3.59m0 0A9.953 9.953 0 0112 5c4.478 0 8.268 2.943 9.543 7a10.025 10.025 0 01-4.132 5.411m0 0L21 21" />
+                </svg>
+              {:else}
+                <!-- eye -->
+                <svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                  <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15 12a3 3 0 11-6 0 3 3 0 016 0z" />
+                  <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M2.458 12C3.732 7.943 7.523 5 12 5c4.478 0 8.268 2.943 9.542 7-1.274 4.057-5.064 7-9.542 7-4.477 0-8.268-2.943-9.542-7z" />
+                </svg>
+              {/if}
+            </button>
+          </div>
         </div>
 
         {#if localError || $authError}