fix(web): restore password-manager autofill on auth forms via autocomplete tokens

[neilsoult]

Description

PR #8517 ([VPAT-27]) set autoComplete="off" on the auth email/password inputs. On the sign-in screen this stops Bitwarden and 1Password from offering to autofill the password, and it also fails WCAG 2.1 SC 1.3.5 Identify Input Purpose — which requires these fields to expose their purpose through the autocomplete tokens (username, current-password, new-password), not off.

This restores autofill by using the correct purpose tokens instead of disabling autocomplete. The sign-in password input is shared between sign-in and sign-up via the mode prop, so its token is conditional.

Scope of this PR: the apps/web sign-in/sign-up forms (the login-critical path). The same tokens should be mirrored to the admin/space auth forms and the packages/ui auth-form / password-input components that #8517 also touched — happy to extend this PR or follow up.

Type of Change

• Bug fix (non-breaking change which fixes an issue)

Changes

• email.tsx: email field autoComplete="off" → "username"
• password.tsx: password field autoComplete="off" → mode === EAuthModes.SIGN_IN ? "current-password" : "new-password"
• password.tsx: confirm_password field autoComplete="off" → "new-password"

Test Scenarios

• Sign-in page with a saved login in Bitwarden/1Password: autofill suggestion now appears on the password field and fills email + password.
• Sign-up: password + confirm are treated as new-password (no stale-credential suggestion).

References

• Regresses autofill introduced by [VPAT-27] chore(security): disable autocomplete on sensitive input fields #8517
  Fixes: [bug]: Password managers (Bitwarden/1Password) can't autofill the sign-in password field — autocomplete="off" on auth inputs regresses WCAG 1.3.5 #9739

Summary by CodeRabbit

• Enhancements
  • Improved browser and password-manager autofill support for email and password fields during sign-in and sign-up.
  • Password fields now use context-appropriate autofill behavior, including separate handling for current and newly created passwords.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

Neilson Soult seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: fdc60c4a-6028-455d-a748-48b573fab8fe

📥 Commits

Reviewing files that changed from the base of the PR and between 3717500 and 910e729.

📒 Files selected for processing (2)

• apps/web/core/components/account/auth-forms/email.tsx
• apps/web/core/components/account/auth-forms/password.tsx

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

Authentication form inputs now use purpose-specific autocomplete tokens. Sign-in passwords use current-password; sign-up and confirmation passwords use new-password; email inputs use username.

Changes

Authentication autocomplete

Layer / File(s)	Summary
Set authentication field autocomplete tokens apps/web/core/components/account/auth-forms/email.tsx, apps/web/core/components/account/auth-forms/password.tsx	Email inputs use username. Password inputs use current-password for sign-in and new-password for sign-up and confirmation fields.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Merge Risk: ⚪ Minimal · up to 910e7

This restores standards-based password-manager autofill on the web sign-in and sign-up forms without changing authentication behavior or credential handling. No actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: restoring password-manager autofill in web authentication forms through autocomplete tokens.
Description check	✅ Passed	The description includes the required change summary, bug-fix classification, test scenarios, and reference to issue #9739. Screenshots are not necessary for this form-only change.
Linked Issues check	✅ Passed	The changes satisfy the primary requirements in #9739 for the apps/web sign-in and sign-up forms. They apply username, current-password, and new-password tokens to the appropriate fields and restore t…
Out of Scope Changes check	✅ Passed	The changes are limited to autocomplete attributes in the apps/web authentication forms and align with the stated issue and pull request scope. No unrelated changes are present.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…

Full details: Linked Issues check

Explanation

The changes satisfy the primary requirements in #9739 for the apps/web sign-in and sign-up forms. They apply username, current-password, and new-password tokens to the appropriate fields and restore the intended autofill behavior.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2 files.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coldtea-pr-lens]

◈ PR Lens

🟢 +0 new · 🟠 ~1 changed · 🔴 -0 removed · 0 flows · 2 files · commit 24bc4ec

Architecture

1 component touched across 3 lanes.

Open full size

Data flow

No data-flow sequence changed in this PR.

Drill down

Client Applications — 1 component

🟡 CHANGED Plane Web App

Updates authentication form inputs with standard autocomplete attributes to support browser and password manager autofill.

• apps/web/core/components/account/auth-forms/email.tsx:74-77
• apps/web/core/components/account/auth-forms/password.tsx:213-253

View

• Architecture lens
• Data flow lens
• Expand every detail
• Show unchanged neighbours

Tip

Run PR Lens on your own machine: npx skills add coldteadotai/pr-lens installs the agent skill. Then tell your coding agent: "Diagram the change you just made with PR Lens and attach it to the pull request."

🪧 More tips

• Draw a diff before it is even a pull request: npx @coldtea/pr-lens-cli analyze --base origin/main reads the diff with your own model key, and npx @coldtea/pr-lens-cli render .pr-lens/graph.json draws the same lenses on your machine.
• The boxes under View are live. Tick Architecture lens or Data flow lens to choose which diagrams appear, or Expand every detail to open every drill-down at once. The comment redraws in place a few seconds later.
• Show unchanged neighbours lists the components this change did not touch alongside the ones it did, so the drill-down shows what the changed code sits next to.
• GitHub will not let you zoom an image in a comment. The link under each diagram opens it full size on a page of its own, where you can.
• The CLI's render picks up .github/pr-lens.yml automatically and applies your corrections (renames, exclusions, lane pins) at draw time.
• Would you rather run it from CI on a key of your own? Add .github/workflows/pr-lens.yml with coldteadotai/pr-lens/packages/action@v0 and a model key in your repository secrets, say GEMINI_API_KEY. The Action asks Gemini by default, or OpenAI and any endpoint speaking /chat/completions through its provider input.
• PR Lens is free for open source. A star on the repository is what keeps it going.
• Push a new commit and the whole comment re-renders for the new head. An older run never overwrites a newer one, so a slow render cannot put a stale diagram back.
• The diagrams follow your GitHub theme, so dark mode gets the dark render and light mode the light one, and the moving dots show this pull request's data in motion.

---

◈ Rendered by PR Lens · crafted with ❤️ by the Coldtea team · Something drawn wrong?