[JacobStephens2]

Summary

 POST /sign-in      → 401 refused / 429 slowdown
 POST /set-password → 401 wrong code / 503 email setup off
-bare fragments or plain text
+full Console account page with the configured Theme

Preserve status codes, message text, retry links and Retry-After: 60. Reuse the existing password-off notice.

Closes #1167

Evidence

• Before: Each regression failed against its bare reply: missing Theme for the two 401s and 429; text/plain instead of HTML for the 503.
  After: Each focused regression passed after its implementation:

  cargo test --test console a_wrong_code_reply_uses_the_console_theme
  cargo test --test console email_flow_is_off_without_a_key_and_in_no_sign_in_mode
  cargo test --test console a_refused_sign_in_reply_uses_the_configured_console_theme
  cargo test --test console http_slowdown_survives_restarts_and_allowed_accounts_still_need_a_password

• Final validation passed: cargo fmt --check; cargo clippy --all-targets -- -D warnings; CARGO_INCREMENTAL=0 scripts/affected-tests main (3,037 passed, 68 skipped).

The initial full-suite attempt stopped on disk exhaustion in Eval Arm fixtures after 428 passes. Cleaned this worktree's Cargo outputs and disabled incremental caching for the rerun.

Test seams

• Console HTTP: POST /set-password for an invalid code and disabled email setup; POST /sign-in for refusal and slowdown. Observe the full themed page, stylesheet, message, links, status and Retry-After.

Unaddressed findings

Standards

None. The independent review raised 0 findings.

Spec

None. The independent review raised 0 findings.

Security

None. Guidance-mode review of f202d45a...HEAD plus supporting code found no introduced finding: the four replies render only static strings with no attacker input interpolated, status codes and Retry-After are unchanged, and the configured theme is allowlist-validated at config load and HTML-escaped at render. Throwaway reflection probes against the /sign-in and /set-password error replies passed and were removed; no regression test was kept because no finding was demonstrated.

Security review outcome

No unaddressed introduced findings.

Review coverage

Standards and Spec each read all six changed files. Unread changed files: none. Generated-output exclusions: none.

Merge Danger

Door: two-way

Revert the reply rendering and its tests to roll back.

Blast Radius: Console

The sign-in and set-password error pages.

Built with codex codex-cli 0.164.0 · gpt-6.1-sol · xhigh