Claus Lohmar
b8ead2bf2d
The shell now renders the CORE nav entries — Home · Account for everyone, Users · Modules only for an admin — alongside the registry entries, with the discovered `home` dashboard collapsed onto the core Home entry (SPEC-010 §3). A signed-in user with no passkey, who has not opted out and is not on a loopback origin, now sees a prominent "Add a passkey" banner linking to the Account page (SPEC-010 §6). This closes the D-041 gap where the wizard's direct session mint bypasses the TOTP-login nudge, so the admin was never prompted. The door computes (admin, banner) in serveGUID — it already holds the session, identity and user — and attaches it to the request context; the new web.PageFor copies it onto every authenticated page (RequestContext is untouched, so identification stays separate from authorisation, D-003).
27 lines
1.2 KiB
HTML
27 lines
1.2 KiB
HTML
<!doctype html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1">
|
|
<title>{{.Title}}</title>
|
|
<meta name="theme-color" content="#101828">
|
|
{{if .CSRF}}<meta name="csrf-token" content="{{.CSRF}}">{{end}}
|
|
<link rel="manifest" href="{{.StaticPath}}manifest.webmanifest">
|
|
<link rel="icon" type="image/png" sizes="192x192" href="{{.StaticPath}}icon-192.png">
|
|
<link rel="apple-touch-icon" href="{{.StaticPath}}icon-192.png">
|
|
<link rel="stylesheet" href="{{.StaticPath}}app.css">
|
|
<script src="{{.StaticPath}}app.js" defer></script>
|
|
<script src="{{.StaticPath}}webauthn.js" defer></script>
|
|
</head>
|
|
<body>
|
|
<header class="app-header">
|
|
<a class="brand" href="{{.HomeHref}}">{{.AppName}}</a>
|
|
{{if .Nav}}<nav aria-label="Main"><ul>{{range .Nav}}<li><a href="{{.Href}}"{{if .Active}} aria-current="page"{{end}}>{{.Label}}</a></li>{{end}}</ul></nav>{{end}}
|
|
</header>
|
|
{{if .Flash}}<p class="flash {{.FlashKind}}" role="status">{{.Flash}}</p>{{end}}
|
|
{{if .PasskeyBanner}}<p class="banner" role="status"><strong>You have no passkey.</strong> <a href="/{{.GUID}}/account">Add one</a> to sign in without the one-time code.</p>{{end}}
|
|
<main id="main"{{.MainAttrs}}>
|
|
{{.Content}}
|
|
</main>
|
|
</body>
|
|
</html>
|