Skip to content

feat: Public URL UX, accessible OAuth switch, and dashboard focus rings - #129

Merged
com55 merged 4 commits into
mainfrom
feat/public-url-oauth-toggle-focus
Nov 10, 2026
Merged

com55 merged 4 commits into
mainfrom
feat/public-url-oauth-toggle-focus

Conversation

@com55

@com55 com55 commented Nov 10, 2026

Copy link
Copy Markdown
Owner

Summary

Dashboard and editor UX around Public URL, MCP OAuth, and keyboard focus. No version bump.

A. Public URL (field stays on the Settings tab)

  • MCP OAuth has a Set Public URL shortcut that opens Settings and focuses/scrolls to the Public URL field.
  • The MCP server URL no longer falls back to location.origin when Public URL is unset. The UI shows “Set a Public URL to get the MCP server URL” and disables Copy.
  • Red warning in MCP OAuth (and the editor sidebar) when OAuth is enabled and Public URL is empty, or the latest persisted check for the current URL failed. A stale check for a different URL does not count. Missing checks are not treated as failures.
  • Latest check result (ok, status, checkedAt, publicBaseUrl) is persisted as SettingsStore metadata (not a lockable settings.js field) and returned on GET /settings. POST /settings/check-public-url writes it. The existing SSRF-guarded probe is reused; no new fetch paths.
  • Saving or changing Public URL runs that same check automatically. The manual Check button remains.
  • Access tokens gain a base URL choice: This page's URL (default) vs Public URL. Public URL is disabled with a hint until a Public URL is set.

A.5 decision: this is a per-browser UI preference in localStorage (ai-access.token-url-base), not a server setting. It only changes what the Access tokens UI displays and copies. Server-side access-path fallback is unchanged. A <select> is used instead of a binary switch so the two named bases stay explicit.

B. Enable MCP OAuth

The dashboard and editor sidebar checkboxes are accessible role="switch" toggles (aria-checked, Space/Enter, clickable labels). Existing confirm-dialog behavior when enabling without a suitable Public URL is unchanged.

C. Focus rings

Dashboard nav items, <summary> (including Diagnostics), and buttons use a thin 2px var(--accent) outline with a 2px offset on :focus-visible only (no ring on mouse click). Section heading programmatic focus still has no ring (h2:focus { outline: none }, #128).

Test plan

  • SKIP_TEST_BUILD=1 npx vitest run — 1,356 tests
  • yarn lint — 0 errors, 80 warnings
  • yarn build / yarn build:prod
  • Throwaway Node-RED 4.1.17 and 5.0.9 on port 1890 only (not 1880/1881): MCP OAuth red warning (unset and failed check), unset /mcp hint, Set Public URL shortcut, Access tokens base both states, toggle on/off in dashboard and editor sidebar, keyboard Tab vs mouse click on nav and Diagnostics
  • Screenshots: /workspace/shots-puburl/nr4-*.png and nr5-*.png

Do not merge or release until review.

Show a Settings shortcut and a hint instead of falling back to the page
origin for the MCP server URL. Persist Public URL check results, auto-check
on change, and warn when OAuth is on with a missing or failed URL. Add a
per-browser Access tokens base URL choice. Replace the Enable MCP OAuth
checkbox with an accessible switch in the dashboard and editor sidebar, and
use thin :focus-visible accent rings on dashboard nav, summaries, and buttons.
Replace the Access tokens base URL select with a right-aligned segmented
control on the heading row. Persist a check only when it matches the
current Public URL; do not store unsaved or invalid raw values. Clearing
the URL skips the probe and stores null. PUT returns immediately and
runs probes serially with latest-wins; the dashboard refetches when the
result arrives. Use the same OAuth warning text in the dashboard and
editor sidebar.
Assigning undefined to an optional string field failed CI type-check.
Catch fire-and-forget probe rejections so a persistence failure cannot
become an unhandledRejection. On plugin cleanup, bump the check
generation, abort in-flight probes, and refuse later settings writes.
Cancel Settings poll loops when leaving the tab, and show a Refresh
affordance if a pending check outlasts the poll budget. Handle Home and
End on the Access tokens base URL radiogroup.
@com55
com55 merged commit 06efbeb into main Nov 10, 2026
7 checks passed
@com55
com55 deleted the feat/public-url-oauth-toggle-focus branch November 10, 2026 10:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant