Convert the settings page neon gradient section headers (blue/purple/green)
to the shared SectionCard, and replace the verify page's harsh multi-stop
status gradients with subtle status-tinted headers while keeping the
green/amber/red/blue semantics. The me page already used a consistent
rounded-2xl card style, so it needed no change.
Reuse the SectionCard component to unify the neon section headers, center
the page in a max-w-6xl container, and give the welcome panel and login
card consistent rounded corners and subtle shadows, matching the home
and register pages.
Reuse the SectionCard component to unify the green/purple/blue neon
section headers, center the page in a max-w-6xl container, and give the
welcome panel and form card consistent rounded corners and subtle
shadows, matching the home page.
Unify the per-section neon gradient headers (blue/green/purple) into a
single consistent SectionCard component with a calm surface header and
hairline divider, constrain the page to a centered max-w-6xl container,
and soften the hero/cards with rounded-3xl corners and subtle shadows.
The username normalization, dummy-hash constant, password check and
email-verification gate were duplicated between precheckLogin and the
NextAuth credentials authorize handler. Move them into a single
login-core module so both paths share one source of truth and stay
consistent.
.nvmrc and package.json engines.node must match the exact version the
CI environment runs, otherwise scripts/check-node-toolchain.mjs fails
the strict equality assertion.
precheckLogin already normalized the username with NFC, but the
NextAuth credentials authorize handler only trimmed it. This caused a
mismatch for accounts with accented/non-ASCII usernames: the precheck
passed while the actual sign-in lookup found no user and returned
'invalid username or password'.
Also normalize the password to NFC in both the precheck and the
authorize handler to match how register.ts hashes it.
- Serve /swf and /nitro-assets (~2.8GB) with 7-day Cache-Control plus
stale-while-revalidate so client opens stop re-fetching hundreds of
files while asset updates still propagate in the background
- Issue the SSO ticket and the online count query in parallel on the
client page to shave a round-trip off the critical render path
- Send the verification email after the response via after() so it
never blocks sign-up
- Invalidate the cached login lookup right after account creation so
the automatic sign-in always finds the fresh row
- Auto sign in with the submitted credentials and go straight to /me,
with a fallback to /login?registered=1 if sign-in is refused (e.g.
email verification required)
- Cache the register page's online/latest user queries to cut DB load
under traffic
- Fix terms checkbox label double-toggle cancelling the selection
- Add pages.register.redirecting translation to all locales
Recent optimization commits accidentally gutted next.config.ts, removing
the createNextIntlPlugin wrapper. This caused every page to crash at
runtime with 'Couldn't find next-intl config file', showing the error
page after a successful build.
Restores:
- next-intl plugin (./src/i18n/request.ts)
- Security headers (HSTS, X-Frame-Options, nosniff, etc.)
- Redirects from /admin/import/* to /admin/studio/*
- Cache headers for /assets and /images, AVIF/WebP image formats
- compress and productionBrowserSourceMaps
Keeps recent improvements: reactStrictMode and optimizePackageImports.
openhands
Simo