hi hello. oh, ive been 10 hours doing the same thing!!1 god. So, I was doing the frontend design without using figma and uhh yes. And also removed the ability to use your login to.. login to the app. You just use your email (otp, and passkeys).

First, I forgot how to use figma, I only remember some shortcuts. I was going to use it (for frontend and logos) but seeing how struggled to make simple things, I only used it to swap the colors of the logo of MEOW AUTH, hmm yes, very meow. .

The frontend stuff… I frankly ALSO do not remember anything.. or well I do now remember some things thanks to me fighting to uncenter a div hah. The stack is practically svelte, as always, client rendered and scss (sassy :o) for the styling. In the start I was just going to use the same styling and structure of my first iteration of this project, beepauth (ew), and after doing all of that I thought “god, this looks pretty bad”, soo I then tried to make it look a bit better WITHOUT starting from zero again. And I did style it a bit better but I didn’t even like it. Like it felt like I hadnt even advanced at all, like if the same shitty fricking backend was the same from the past (probably noone would care because probably uhh noone cares.) [brains a weired and even more mine i guess, wawa].

So, naturally, i did the less sane thing, REDOING EVERYTHING again. Had to watch tutorials to relearn how use sass and picked up also some new css stuff that I wont even use (minus the layers! that pretty cool!!). And from that css stuff I discovered Oklch.. yes i swapped my whole color palette to that using their harmonizer that uses the equivalent of WCAG, APCA (contrast bg to text!).

At least the frontend now looks decent (or the first blocks fo the website). sadly the only frcking shitting heckign parts ive made are the login (and register BUT THATS THE SAME).

AWIT WAIT WAWA, I also swapped some gears in the BACKEND! I removed the login (username) entirely, now its just demoted to a non unique display name (for openid!). you must be asking why, because I changed it to use the login not long ago. Well, because I don’t have to force a user to give me a username AND their email on signup. Its easier to just give the email. And if you already have an account and hit, without knowing (our typical autopilot mode), the signup page, I can silently make a AuthChallenge for login instead of signup because both handlers return the same result. Then, after registering, I just force you to set a display name (by default its just the email, i could leave it like that but currently I want it to force you set a custom display name for OPENID).

By doing that, I practically removed the “vectors” (ooh hackiry stuffiry) for user enumeration [those vectors were the endpoints to see if a login (username) or email was already taken] (I also made so the login endpoint gives you a fake challenge id when the email doesnt exist {This works thanks to having the auth exchange handlers return “invalid code” even if the challenge doesnt even exist}).

here’s your screenshot of a login page that looks exactly like very other login page, maybe even shittier (sorry i am bad doing these kinds of things.) [also you have the logo colors, i went with purple because it looks cool and its a cool color] {the “Psst, over here” its just a random greeting, just like the ones i have in the emails} [[sorry for wasting 10 hours doing nothing]]: