Prevent server-side rendering of header login form

[saschaszott]

References

n/a

Description

ngbDropdownMenu renders its content even while the dropdown is closed. As a result, every SSR response currently contains the complete login form with email and password inputs, the "register" and "forgot password" links, and the buttons of all external auth providers. None of this is useful to crawlers / bots, and before hydration the dropdown can't be opened anyway.

The login form in the header's login dropdown (<ds-log-in> in auth-nav-menu.component.html) is now wrapped in a @defer block. It is no longer part of the server-side rendered HTML and is only rendered in the browser after hydration. The "Log In" button and the dropdown container itself are still rendered during SSR.

Instructions for Reviewers

1. Build and start DSpace frontend in prod mode (with SSR enabled)
2. Check the SSR output of any page that is not excluded from SSR, e.g., an item landing page: The dropdown container should only contain <!---->. There should be no <ds-log-in>, no password input.
3. Open the same page in a browser (not logged in):
   • The "Log In" button is visible immediately and the header doesn't shift
   • Opening the dropdown shows the login form as before
   • The browser console shows no hydration errors (NG05xx)
4. Open /login and verify that the standalone login page still contains the form in its SSR output.

Checklist

This checklist provides a reminder of what we are going to look for when reviewing your PR. You do not need to complete this checklist prior creating your PR (draft PRs are always welcome).
However, reviewers may request that you complete any actions in this list if you have not done so. If you are unsure about an item in the checklist, don't hesitate to ask. We're here to help!

• My PR is created against the main branch of code (unless it is a backport or is fixing an issue specific to an older branch).
• My PR is small in size (e.g. less than 1,000 lines of code, not including comments & specs/tests), or I have provided reasons as to why that's not possible.
• My PR follows all coding best practices based on the Code Conventions Guide
• My PR passes ESLint validation using npm run lint
• My PR doesn't introduce circular dependencies (verified via npm run check-circ-deps)
• My PR includes TypeDoc comments for all new (or modified) public methods and classes. It also includes TypeDoc for large or complex private methods.
• My PR passes all specs/tests and includes new/updated specs or tests based on the Code Testing Guide.
• My PR aligns with Accessibility guidelines if it makes changes to the user interface.
• My PR uses i18n (internationalization) keys instead of hardcoded English text, to allow for translations.
• My PR includes details on how to test it. I've provided clear instructions to reviewers on how to successfully test this fix or feature.
• If my PR includes new libraries/dependencies (in package.json), I've made sure their licenses align with the DSpace BSD License based on the Licensing of Contributions documentation.
• If my PR includes new features or configurations, I've provided basic technical documentation in the PR itself.
• If my PR fixes an issue ticket, I've linked them together.

[alanorth]

Thanks @saschaszott. I tested this locally in production mode and confirmed the ds-log-in element was present before, but missing afterward.

Before:

$ curl -s http://localhost:4000/entities/publication/0bc64a68-f318-474e-b70c-1fa5e0eb6dbe | grep ds-log-in | wc -l
2

After:

$ curl -s http://localhost:4000/entities/publication/0bc64a68-f318-474e-b70c-1fa5e0eb6dbe | grep ds-log-in | wc -l
0

As expected, the ds-log-in element is present on the /login page:

$ curl -s http://localhost:4000/login | grep ds-log-in | wc -l
2

In the browser the login dropdown works as expected.