improvement(auth): unify sign-in and access pages by emir-karabeg · Pull Request #9461 · simstudioai/sim

emir-karabeg · 2026-10-30T00:56:01Z

Summary

Give sign-in, signup, verification, recovery, consent, shared-resource access, email preferences, and CLI/desktop handoffs one isolated @sim/auth-ui component system.
Keep authentication handlers, callback validation, session/resource cookies, authorization policy, and deployment identity/legal/support configuration intact. Auth remains noindex and independent of App theme and custom CSS.
Consolidate email/password defaults and local provider icons. Preserve social-only signup navigation, searchable-selector editing keys, and native desktop title-bar clearance.
Correct loading geometry and centered feedback, handle returned social sign-in errors, keep unavailable CLI workspaces out of approval payloads, and preserve page titles on branded deployments.
Update desktop E2E coverage for the new controls, loaded fonts, validation feedback, fullscreen transitions, and theme isolation.

Validation

Cleanup passes completed across React behavior, state, callbacks, query ownership, URL state, design, comments, and tests; the latest field/icon commit was reviewed separately.
Browser-verified shared components at mobile, tablet, desktop, and short-screen sizes. Reproduced and verified the selector keyboard and desktop spacing fixes.
Browser comparisons verified responsive loader/skeleton sizing and long account details at 320, 390, 768, and 1440px.
Pinned Biome checks and diff whitespace checks pass for the audited changes.
Full repository builds, tests, type checks, audits, and packaged desktop E2E run in CI. Current-head CI is the release gate; earlier local results are recorded in apps/sim/auth-migration/validation.json.
Live third-party provider and enterprise-tenant flows still require environment-specific acceptance testing. Production performance has not been benchmarked by this audit.

The design contract and token snapshot live in packages/auth-ui/design; route/state inventories live in apps/sim/auth-migration. Docs and Landing are outside this change.

vercel · 2026-10-30T00:56:06Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 30, 2026 2:33am UTC

gitguardian · 2026-10-30T00:56:08Z

⚠️ GitGuardian has uncovered 9 secrets following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secrets in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
39283788	Triggered	Generic High Entropy Secret	`4e943cf`	apps/sim/auth-migration/baseline.json	View secret
39283786	Triggered	Generic High Entropy Secret	`4e943cf`	apps/sim/auth-migration/baseline.json	View secret
39283784	Triggered	Generic Password	`4e943cf`	apps/sim/auth-migration/baseline.json	View secret
39283785	Triggered	Generic High Entropy Secret	`4e943cf`	apps/sim/auth-migration/baseline.json	View secret
39283782	Triggered	Generic High Entropy Secret	`4e943cf`	apps/sim/auth-migration/baseline.json	View secret
39283781	Triggered	Generic High Entropy Secret	`4e943cf`	apps/sim/auth-migration/baseline.json	View secret
39283789	Triggered	Generic High Entropy Secret	`4e943cf`	apps/sim/auth-migration/baseline.json	View secret
39283787	Triggered	Generic High Entropy Secret	`4e943cf`	apps/sim/auth-migration/baseline.json	View secret
39283783	Triggered	Generic High Entropy Secret	`4e943cf`	apps/sim/auth-migration/baseline.json	View secret

🛠 Guidelines to remediate hardcoded secrets

Understand the implications of revoking this secret by investigating where it is used in your code.
Replace and store your secrets safely. Learn here the best practices.
Revoke and rotate these secrets.
If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

following these best practices for managing and storing secrets including API keys and other credentials
install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

waleedlatif1 · 2026-10-30T01:53:44Z

@greptile

waleedlatif1 · 2026-10-30T01:53:45Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-30T01:53:49Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

waleedlatif1 · 2026-10-30T01:55:27Z

The nine GitGuardian generic-high-entropy findings in apps/sim/auth-migration/baseline.json are file checksums. I independently recomputed SHA-256 for each flagged file using the manifest's recorded baseline commit; all nine match exactly. They are not authentication credentials.

The manifest remains intact, and no detector exclusions or status overrides were added. These findings need normal false-positive classification in GitGuardian before its check can be considered clear.

greptile-apps · 2026-10-30T01:58:23Z

Confidence Score: 5/5

[High impact] The PR appears safe to merge; no new blocking issue was found.

Summary

Moves sign-in and access pages onto the isolated @sim/auth-ui components.

Account pages share one isolated set of sign-in and recovery controls.
Public gates and connected-resource pages use the shared Auth controls.
CLI and desktop screens share Auth controls for approvals and handoffs.
Auth pages stay out of search results and branded custom CSS.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Auth and access pages] --> B[AuthShell]
  C[Invite loading] --> D[InviteLayout]
  E[Enterprise claim] --> D
  D --> B
  B --> F["@sim/auth-ui"]
  G[Desktop recovery pages] --> F
  H[Auth path list] --> I[Custom CSS isolation]
  H --> J[Search indexing policy]

_{Reviews (3) · Last reviewed commit: "fix(auth): preserve invitation loading a..." · Reviewed by Greptile}

cubic-dev-ai

All reported issues were addressed across 118 files

_{This PR changes authentication, authorization, or input validation. Ultrareviews find 2.4x more serious bugs than standard reviews. Comment @cubic-dev-ai ultrareview to run one.

Turn on auto-fix | Re-trigger cubic}

waleedlatif1 · 2026-10-30T02:19:36Z

@greptile

waleedlatif1 · 2026-10-30T02:19:37Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-30T02:19:43Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 120 files

_{Click Fix with cubic on a comment, or reply @cubic-dev-ai fix this, and cubic writes the fix.

Turn on auto-fix | Re-trigger cubic}

waleedlatif1 · 2026-10-30T02:49:53Z

@greptile

waleedlatif1 · 2026-10-30T02:49:55Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-30T02:50:00Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 120 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Tip: Get a Slack DM when cubic finishes reviewing your PRs. Connect Slack

Turn on auto-fix | Re-trigger cubic}

vercel Bot deployed to Preview October 30, 2026 01:02

View deployment

emir-karabeg changed the title ~~Redesign Auth with an isolated Paper component system~~ Redesign Auth with an isolated component system Oct 30, 2026

vercel Bot temporarily deployed to Preview October 30, 2026 01:07 Inactive

vercel Bot temporarily deployed to Preview October 30, 2026 01:46 Inactive

emir-karabeg and others added 4 commits October 29, 2026 18:46

feat(auth): implement isolated Paper design system

4e943cf

chore(auth): remove design-tool attribution

1b6dd29

fix(auth): preserve navigation and desktop layout in redesign

dd6ef5e

fix(auth): consolidate fields and localize icons

f81becc

waleedlatif1 force-pushed the codex/auth-paper-rebuild branch from c5bc33a to f81becc Compare October 30, 2026 01:53

waleedlatif1 changed the title ~~Redesign Auth with an isolated component system~~ improvement(auth): unify sign-in and access pages Oct 30, 2026

waleedlatif1 marked this pull request as ready for review October 30, 2026 01:53

waleedlatif1 requested a review from a team as a code owner October 30, 2026 01:53

greptile-apps Bot reviewed Oct 30, 2026

View reviewed changes

Comment thread packages/auth-ui/src/styles.module.css Outdated

Comment thread packages/auth-ui/src/compositions.tsx

cubic-dev-ai Bot reviewed Oct 30, 2026

View reviewed changes

vercel Bot deployed to Preview October 30, 2026 02:00

View deployment

fix(auth): resolve review findings and complete layout isolation

cdb8b61

cubic-dev-ai Bot reviewed Oct 30, 2026

View reviewed changes

Comment thread apps/sim/app/invite/[id]/loading.tsx Outdated

fix(auth): preserve invitation loading and branding boundaries

30c0e87

vercel Bot temporarily deployed to Preview October 30, 2026 02:33 Inactive

cubic-dev-ai Bot reviewed Oct 30, 2026

View reviewed changes

Conversation

emir-karabeg commented Oct 30, 2026 • edited by waleedlatif1 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Validation

Uh oh!

vercel Bot commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gitguardian Bot commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ GitGuardian has uncovered 9 secrets following the scan of your pull request.

Uh oh!

waleedlatif1 commented Oct 30, 2026

Uh oh!

waleedlatif1 commented Oct 30, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 30, 2026

Uh oh!

waleedlatif1 commented Oct 30, 2026

Uh oh!

greptile-apps Bot commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Diagram

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Oct 30, 2026

Uh oh!

waleedlatif1 commented Oct 30, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 30, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

waleedlatif1 commented Oct 30, 2026

Uh oh!

waleedlatif1 commented Oct 30, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 30, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

emir-karabeg commented Oct 30, 2026 •

edited by waleedlatif1

Loading

vercel Bot commented Oct 30, 2026 •

edited

Loading

gitguardian Bot commented Oct 30, 2026 •

edited

Loading

greptile-apps Bot commented Oct 30, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading