Keep login renderable when the optional signup route is absent

[alexeygrigorev]

Status

P0 deterministic regression; engineer-ready and independent of #186. This issue repairs login-route composability only. It does not decide or alter whether account creation is enabled.

Scheduled full regression 33315212334 at exact origin/main SHA face8e4808d65afbf0374d1ced7a88079950d663 proves /accounts/login/ returns 500 when the active URLConf intentionally exposes accounts.urls without allauth's optional account_signup name. The traceback is exact:

• accounts/views/login.py:118 eagerly evaluates reverse("account_signup");
• Django raises NoReverseMatch because core.tests.seo_fixture_urls deliberately includes accounts.urls, Studio, and the management API, but not allauth.urls;
• preview and Studio redirects therefore reach a broken login page instead of the required safe sign-in surface.

Commit a792553 introduced the hard dependency while making the existing login-page account links use a resolved destination. Full website.urls does include allauth after accounts.urls, so the ordinary site has the route; the reduced security/preview surface intentionally does not.

Normative authority

• _docs/specs/01-platform-architecture.md § “Member signup, profile, Slack, and course registration”: signup is conditional, and return intent is server-side/path-only.
• _docs/specs/07-security-privacy-operations.md §§ “Web and application security” and “Identity and authorization”: safe errors must not expose sensitive state; login/signup controls remain bounded and fail closed.
• _docs/PROCESS.md: a regression receives its own groomed lifecycle and exact-candidate engineer, tester, PM, merge, and on-call evidence.
• Enforce non-indexable development and preview behavior #36 owns the non-indexable development/preview surface whose reduced URLConf exposed this failure.
• /accounts/signup/ is open despite ACCOUNT_ALLOW_REGISTRATION = False #186 exclusively owns the unresolved account-creation posture.

Product contract

The login view is usable under every supported URLConf that exposes it. The account-creation destination is an optional navigation capability, not a prerequisite for rendering or authenticating.

• When account_signup resolves in the active URLConf, preserve the current exact signup destination and safe next behavior.
• When it does not resolve, render the normal login page successfully and omit every account-creation entrance that would otherwise point to it.
• Do not invent or hard-code /accounts/signup/, add allauth to a reduced URLConf, redirect to an unrelated destination, or expose a broken/empty anchor.
• Absence of the optional route creates no account, EmailAddress, session, durable job, audit success event, or network/provider side effect.

This is policy-neutral fail-closed behavior. It neither approves open signup nor implements #186 Option A, B, or C.

Scope

• Make social_login_view represent optional signup-route availability without raising NoReverseMatch during view execution or template rendering.
• Make both responsive account-creation placements in accounts/templates/accounts/login.html conditional on a real resolved destination.
• Add focused tests for the full URLConf and a deliberately reduced URLConf with login present and account_signup absent.
• Preserve safe internal next on the real signup link and existing login/provider/local-owner behavior.
• Complete graph-selected verification and independent responsive screenshot review on the exact frozen candidate.

Explicit non-goals

• No change to ACCOUNT_ALLOW_REGISTRATION, ACCOUNT_EMAIL_VERIFICATION, ACCOUNT_ADAPTER, allauth signup behavior, social consolidation, identity inventory, account models, or migrations.
• No choice or partial implementation of /accounts/signup/ is open despite ACCOUNT_ALLOW_REGISTRATION = False #186's signup, verification, collision, enumeration, abuse, or public-entrance posture.
• No redesign or copy change to the login or signup pages.
• No addition of allauth/signup routes to core.tests.seo_fixture_urls or another intentionally reduced URLConf.
• No weakening/removal of the preview, Studio, safe-redirect, noindex, cache, console, or external-request assertions that exposed the defect.
• No hard-coded fallback URL and no broad redesign/Audit and refine sitewide design consistency #237 replay.

Dependencies and lifecycle boundary

No product decision is required, and #186 is not a dependency: the full URLConf's currently available signup link remains unchanged whichever posture the owner later selects. #186 remains open with decision; this issue must not remove that label or infer approval.

Use a fresh clean worktree from current origin/main. A local redesign-lineage commit named d331827 is not issue-owned evidence and must not be replayed wholesale. Its reverse_lazy("account_signup") approach merely defers lookup until template coercion; because the template renders the value, laziness alone does not establish the absent-route contract. Implement and prove the explicit optional capability instead.

Acceptance criteria

• With full website.urls, signed-out GET /accounts/login/ returns 200, renders the existing Create an account entrances with exact destination /accounts/signup/, and preserves an allowed internal next value exactly through the signup destination.
• With a supported reduced URLConf that includes accounts.urls but has no account_signup name, signed-out GET /accounts/login/ returns 200 with the normal Sign In page and no NoReverseMatch or server error.
• In that absent-route state, no Create an account link, empty/broken account-creation anchor, hard-coded signup URL, or alternate signup promise is rendered in either responsive placement.
• The absent-route state does not add a signup route: direct resolution/request remains the reduced URLConf's safe missing-route result and creates no user, EmailAddress, authenticated session, durable job, audit success event, or provider/network call.
• Existing provider choices, development-owner form availability, generic safe error copy, rate-limit behavior, and safe path-only login next behavior remain unchanged in both URLConf states.
• External, scheme-relative, credential-bearing, malformed, and auth-loop next values remain rejected and are not reflected into either login or signup destinations.
• Focused Django tests exercise both route-present and route-absent states and prove template rendering, not merely context construction or lazy-object creation.
• The fresh change-selective plan is generated from the exact candidate; all selected checks complete with no undocumented skips, and the regression cases from run 33315212334 reach their intended assertions rather than failing on login rendering.
• An independent tester inspects desktop and mobile screenshots of the reduced preview/Studio login state and the full-URLConf login state, confirming the correct page, conditional entrance, focus/readability, no error page, and no layout regression.
• A separate PM accepts the exact tester-passed fingerprint before an engineer creates a focused Closes #296 commit; orchestrator then performs the no-ff merge/push and on-call alone observes exact-SHA CI.

Browser scenarios

1. At desktop and mobile widths, a signed-out visitor follows the protected preview redirect under core.tests.seo_fixture_urls; login returns 200, shows Sign In, preserves the safe preview intent, omits account-creation links, and has no console/server error.
2. At desktop and mobile widths, a signed-out visitor follows the Studio redirect under the same reduced URLConf and receives the same safe login contract without gaining a signup route.
3. Under full website.urls, the existing account-creation links remain visible and target /accounts/signup/ with a valid internal next; unsafe intent is discarded.
4. Keyboard traversal in both states reaches only real visible controls with the existing focus treatment; no empty or broken account-creation control remains.

Engineering handoff

Start from exact current origin/main, not the dirty root or local redesign branch. Keep the candidate uncommitted and frozen after posting the Software Engineer report. This issue changes a rendered conditional, so full graph-selected Playwright and tester-owned screenshots are required; a backend-only smoke run is not sufficient.

[alexeygrigorev]

Grooming complete

Disposition: distinct P0 source/test-contract regression; engineer-ready without resolving #186. Full website URL configuration continues to expose the existing signup link, while a supported reduced URL configuration must render login and omit the unavailable entrance. No signup setting, adapter, mutation semantics, or product posture is selected.

The issue body now contains exact authority, scope/non-goals, both route-present and route-absent criteria, fail-closed side-effect boundaries, responsive browser scenarios, and lifecycle requirements. Django reverse laziness alone is explicitly insufficient because template rendering coerces the lazy value. Start only from a fresh clean origin/main candidate; do not replay the local redesign lineage.

No repository file, test, browser, workflow, commit, push, provider, or production state was changed during grooming.

[alexeygrigorev]

Software Engineer Report — fail-closed recovery

Status: IMPLEMENTED AND FROZEN, BUT NOT TESTER-READY. The issue-specific regression is green in focused Django and desktop/mobile browser coverage, but the graph-selected full Playwright component is terminal red on inherited mainline failures. No broad failure is waived, no screenshot is claimed, and this is not a Software Engineer PASS.

Candidate identity

• Worktree/branch: /home/alexey/git/dtc-website/.tmp/issue-296-engineer / issue-296-engineer
• Base and observed HEAD: face8e4808d65afbf0374d1ced7a88079950d663 (origin/main at candidate creation)
• Worktree state: four intended unstaged modifications; uncommitted, unpushed, and unmerged
• Text diff SHA-256: 26e306e9d242d25690e6b266792c8151adb2fd774b8814af3d073ed445cfd0d4
• Changed paths only:
  • accounts/templates/accounts/login.html
  • accounts/tests/test_auth_configuration.py
  • accounts/views/login.py
  • playwright_tests/test_development_seo.py
• Final git diff --check: passed

Implemented behavior

social_login_view now treats account_signup as an optional navigation capability: it catches only NoReverseMatch and supplies None when the active URLConf does not expose that name. Both existing responsive Create an account placements render only when a real reversed destination exists. The full URLConf keeps the existing /accounts/signup/ destination and path-only safe next; the reduced preview/security URLConf renders the normal sign-in page without adding, hard-coding, or promising a signup route.

The focused side-effect regression proves that the absent route stays a 404/unresolvable route and creates no user, EmailAddress, session, durable job, or audit event. Provider choices, development-owner login, generic denials, and safe-next behavior were not redesigned. No model, migration, setting, adapter, signup policy, provider integration, or #186 decision changed.

Versioned plan

• Selection: .tmp/verification/ci-selection.json, SHA-256 c884d9bd245c6997566dc4a1c76c45d1004b8a0d47d63d92a10d677328f9287a
• Plan: .tmp/verification/verification-plan.json, SHA-256 8240916106bc6c1962b56cb444f04f2eac20273ad36e437994ceffee4d1f8bdf
• Base/head in plan: face8e4808d65afbf0374d1ced7a88079950d663 / face8e4808d65afbf0374d1ced7a88079950d663, with the uncommitted worktree included
• Source-tree manifest SHA-256: c74e3d2866a8a63b4c588f9f7d8a94c57decae539494ac70fb85960fec912348
• Ownership graph SHA-256: 05ffeee99244c9becd5e98e40be08188f1c5e2a61204daece984c3beb1d1bce6
• Render SHA-256: e5975fa211773ed554210c971c3c5b2a2854fbe8f6c61a3c425f91d2d095fd6e
• Profile/reason/browser: full / render_impact / full
• Direct nodes: shared.accounts, surface.playwright; downstream nodes: none
• Risk flags: auth_security_privacy, shared_runtime, test_infrastructure

Fail-closed execution buckets:

• rerun: selector passed and produced the plan above; Playwright ran fresh and failed terminally as documented below.
• reused: none.
• skipped/incomplete: plan-required full Django (make test-django-full), complete quality contract (quality-contract-v1), attributable container envelope (make verification-container), evidence/report envelope, and independent screenshots. A revision-level container-check.json exists, but recovery found no producer envelope tying it to this uncommitted diff, so it is deliberately not credited. Prior make test-ci and focused quality results are useful diagnostics only without retained result envelopes.
• not_applicable: compatibility (outside_impact_closure) and content invariants (outside_large_content_closure).

The plan-selected screenshot component remains pending_independent_tester, not passed and not N/A. Required plan captures include desktop/mobile home, not-found, courses, and Studio sign-in; #296 additionally requires independent desktop/mobile reduced preview/Studio login and full-URLConf login inspection.

Focused green evidence recovered from the prior engineer

These commands/results were reported before the prior agent terminated. Their raw logs/evidence envelopes did not survive, so they are recorded transparently and are not promoted into a green aggregate report:

• DJANGO_SETTINGS_MODULE=website.settings.test uv run --frozen python manage.py test --noinput accounts.tests.test_auth_configuration — 37 tests passed plus 132 passing subtests.
• DJANGO_SETTINGS_MODULE=website.settings.test uv run --frozen python manage.py test --noinput accounts.tests.test_single_identity.SafeNextCanonicalizationTests accounts.tests.test_development_owner.DevelopmentOwnerLoginTests — 10 tests passed plus 28 passing subtests.
• make test-ci — 607 passed.
• Focused Ruff check, Ruff format check, and mypy over the changed Python surface were reported green; no raw output survived, so the plan-required complete quality component remains incomplete.

Fresh browser gate

Before relaunch, recovery inspected the abandoned attempt: no #296 Playwright process and no usable run artifact existed. A same-repository process census in the same shell invocation returned exact BROWSER_CENSUS_ZERO; only then did the plan-selected make test-playwright start. The candidate diff remained byte-identical.

Terminal result:

• collected 252; selected 249; deselected 3;
• pytest summary: 227 passed, 22 failed, 20 errors, 3 deselected;
• flake-policy summary: attempted=249 passed=215 failed=34 skipped=0 rerun=0 quarantined=0 complete=0;
• duration: 2,076.75 seconds (34m36s); make exit 2;
• no retry, quarantine, timeout extension, or partial-pass reinterpretation.

All #296 browser assertions reached their intended behavior and passed:

• reduced-URLConf explicit/unmapped and protected-preview login at desktop and mobile;
• reduced preview token/response safety matrix;
• full-URLConf signup destination and safe/unsafe next behavior at desktop and mobile.

The required full component nevertheless remains red. The terminal broad failures map to already-open P0 ownership rather than this four-file diff:

• Fix homepage testimonial overflow and restore the release gate #232 owns the homepage/accessibility release-gate failures, including the complete registry, Chromium/Blink semantics, JavaScript-off public semantics, and foundation homepage evidence.
• Fix undersized Random topic target in the homepage graph toolbar #236 owns the undersized homepage graph Random topic control; this run observed height 33.9375 where 44 is required, including the home/events composition failure.
• Harden historical registration source preparation and publish aggregate event counts #112 owns the historical-registration total and Studio historical-import browser failures.
• Accept safe localized podcast resources without weakening external URL policy #270 owns podcast composition failures from the current external-HTTPS-only validator; the retained traceback shows a podcast resource rejected with Public podcast resource must be an https address, producing 500s across affected hubs/seasons and cascading foundation/podcast assertions.
• Keep Spotify creator podcast embeds offline in Playwright #279 owns the offline Spotify/provider browser-harness boundary covering the podcast/accessibility context teardown-error group.
• Reconcile non-reproducible public projection after face8e4 #253 remains the known frozen public-projection/terminology blocker on this exact base; it is not resolved or reclassified by a browser run.
• Restore face8e4 formatting, typing, and focused content gates #261 remains the known exact-base formatting/typing/focused-content/full-Django restoration lane; it is not resolved or reclassified here.

No terminal failure implicated accounts/views/login.py, accounts/templates/accounts/login.html, the new reduced-URLConf assertions, or the new full-URLConf browser assertion. That attribution is useful debugging evidence, but PROCESS still requires the selected suite itself to be green.

Freeze and exact next step

The worktree is frozen at the identity above. Do not send it to an independent tester, capture acceptance screenshots, request PM acceptance, commit, push, merge, or close #296 from this report.

Next, the owning lanes must land and verify the exact-base blockers (#253/#261 and the #112/#232/#236/#270/#279 browser failures) without changing #296 by inference. After accepted main advances, reconstruct/rebase the four-file #296 candidate onto that accepted base, recompute the versioned plan and all digests, rerun every selected component under an exclusive browser census, and require a terminal green full Playwright result. Only then may a separate tester recompute the plan, validate evidence, capture/open the required desktop/mobile login states, and hand the exact fingerprint to PM.

No commit, push, merge, issue acceptance, provider/network operation, production-data access, or screenshot claim occurred in this engineering recovery.

[alexeygrigorev]

Product Manager Review — HOLD (not tester-ready)

I reviewed the groomed #296 contract, _docs/PROCESS.md, the frozen engineer report (comment 5480530328), and the candidate worktree read-only.

Verdict: HOLD. This is not PM acceptance and does not authorize tester handoff, a commit, merge, push, or closure.

Candidate and plan audit

The candidate is bounded and its identity is reproducible:

• base/current HEAD: face8e4808d65afbf0374d1ced7a88079950d663;
• worktree .tmp/issue-296-engineer, branch issue-296-engineer;
• exactly four unstaged paths: accounts/templates/accounts/login.html, accounts/tests/test_auth_configuration.py, accounts/views/login.py, and playwright_tests/test_development_seo.py;
• recomputed binary/text diff SHA-256: 26e306e9d242d25690e6b266792c8151adb2fd774b8814af3d073ed445cfd0d4, matching the report; git diff --check passes;
• candidate remains uncommitted, unpushed, and unmerged.

The worktree verification plan records full / render_impact, the four paths, graph 05ffeee99244c9becd5e98e40be08188f1c5e2a61204daece984c3beb1d1bce6, and render digest e5975fa211773ed554210c971c3c5b2a2854fbe8f6c61a3c425f91d2d095fd6e. Its legacy committed-range selector correctly says diff_empty because the candidate is uncommitted; that selector is not candidate execution evidence. All plan component evidence fields are null in this worktree, and no retained #296 verification-run/report envelope exists.

Evidence disposition

The focused Django (37 tests + 132 subtests, then 10 tests + 28 subtests), test-ci (607), and targeted quality results are engineer-reported diagnostics only. The report explicitly says their raw logs/evidence envelopes did not survive. They cannot satisfy the independent tester or PM gate.

The fresh local browser attempt was correctly preceded by BROWSER_CENSUS_ZERO and reported no retry, quarantine, or timeout reinterpretation. However its count record is not internally reconcilable: collected 252 = selected 249 + deselected 3, but the reported pytest totals 227 passed + 22 failed + 20 errors + 3 deselected = 272. The flake-policy totals (249 attempted, 215 passed, 34 failed) do not repair that discrepancy, and no raw run artifact is retained. Therefore the full-browser evidence is terminal red and provenance-incomplete, even though the report says every #296-specific assertion reached its intended behavior.

The attributed inherited failure groups remain actionable and must not be waived:

• Fix homepage testimonial overflow and restore the release gate #232: homepage/accessibility and JavaScript-off semantics;
• Fix undersized Random topic target in the homepage graph toolbar #236: undersized Random topic control;
• Harden historical registration source preparation and publish aggregate event counts #112: historical-registration/Studio import browser failures;
• Accept safe localized podcast resources without weakening external URL policy #270: localized podcast-resource 500s;
• Keep Spotify creator podcast embeds offline in Playwright #279: Spotify/provider harness teardown failures;
• Reconcile non-reproducible public projection after face8e4 #253: frozen public-projection/terminology gate;
• Restore face8e4 formatting, typing, and focused content gates #261: pagination/formatting/typing/full-Django restoration gate.

The exact scheduled run 33315212334 also failed at this same SHA. Attribution is useful for routing, but PROCESS requires a terminal green full component on the exact rebuilt candidate.

Screenshots

No .tmp/screenshots/issue-296/ files exist. The modified browser tests write their regression screenshots under .tmp/screenshots/issue-36/; those are neither independent tester evidence nor #296 acceptance evidence. The plan and issue require a separate tester to recompute the plan, capture and open all graph-selected desktop/mobile states, plus #296 reduced preview/Studio login and full-URLConf login states. This criterion is pending and cannot be marked N/A.

#186 boundary

#186 remains OPEN with bug, P0, decision, auth, and security; no owner has selected a signup posture. The four-path diff changes no signup setting, adapter, direct GET/POST semantics, provider policy, or identity mutation. Keeping the existing full-URLConf signup link and omitting it only when the reduced URLConf lacks the optional route is policy-neutral. Do not remove #186's decision label, infer “closed by default,” or accept #296 as a signup-policy decision.

Required recovery order

Preserve this candidate frozen as a reconstruction reference. Restore the green base in this order:

1. repair the authoritative content source needed by Reconcile non-reproducible public projection after face8e4 #253, then complete Reconcile non-reproducible public projection after face8e4 #253;
2. complete Restore face8e4 formatting, typing, and focused content gates #261;
3. complete Keep Spotify creator podcast embeds offline in Playwright #279;
4. complete Restore path-only podcast guest links after the shared Wiki URL change #223, then Accept safe localized podcast resources without weakening external URL policy #270 on one repaired-base sequence;
5. complete Fix homepage testimonial overflow and restore the release gate #232, then Fix undersized Random topic target in the homepage graph toolbar #236;
6. complete Keep failed structured-component evidence schema-valid #280.

Then engineering must reconstruct/rebase #296 onto the exact accepted origin/main, recompute selection/plan/graph/render digests, and produce a retained complete verification envelope. Only after a terminal green full browser run and all other selected components pass may the separate tester capture/inspect uncontaminated desktop/mobile screenshots and post a tester-final report with no required failure, skip, or pending item. PM acceptance remains a later, separate gate.

[alexeygrigorev]

PM recovery-order correction — #295 precedes reconstruction

The previous HOLD sequence omitted the newly groomed migration-inventory gate #295. On current origin/main@face8e4808d65afbf0374d1ced7a88079950d663 (face8e4), scheduled run 33412714315 has failed quality, Django, and migrations; the migration component is 17/18, with the projection digest mismatch owned by #253 and the missing events/migrations/0012_shorten_event_slugs.py inventory entry owned by #295.

The corrected canonical recovery order is:

content source repair → #253 → #261 → #295 → #279 → #223 → #270 → #232 → #236 → #280 → #296

#296 remains frozen and on PM HOLD. After the preceding accepted base is available, engineering must reconstruct/rebase #296 and recompute its evidence; this note does not authorize tester handoff, acceptance, commit, merge, or push.