Link to /login/github, and let the wizard report its own failures

[compscidr]

Lands with goblogplatform/GoBlog#636.

Why

The GitHub button assembled GitHub's authorize URL here, with window.location concatenated straight into redirect_uri. A next containing & ended the value early and everything after it reached GitHub as further authorize parameters (goblogplatform/GoBlog#631).

goblog builds the URL now, so this becomes a plain anchor:

<a id="github-button" href="/login/github{{ if .next }}...?next={{ .next | urlquery }}{{ end }}">

No client_id in the page, no inline script, and the escaping is tested once in Go instead of duplicated across four theme repos.

⚠️ Merge order

goblogplatform/GoBlog#636 must merge and release first. /login/github does not exist until it ships; on an older goblog this link 404s and GitHub login is dead.

This is the reverse of the #624 round, where the themes went first — there they had to tolerate a goblog change, here they depend on a new route.

---

Also now: the ?code= block goes

goblog exchanges the code at /login itself, against a state it minted, so that block can never fire (goblogplatform/GoBlog#637). It was also the client half of a login CSRF: it posted whatever code appeared in the query to /api/login, which no longer exists.

Updated requirement: needs goblog with #638 (which includes #636).

🤖 Generated with Claude Code

Also in this theme

wizard_db.html read data.responseJSON.error in its AJAX error handler. responseJSON is undefined whenever the body was not JSON — a proxy error, an HTML error page, a dropped connection — so reading .error threw: the button went red and the reason never appeared. It falls back through statusText now, and renders with .text() rather than .html() (goblogplatform/GoBlog#632).

Note for the deploy: iac clones this theme at main, so merging this before goblog #636 is released would break goblog.live's GitHub login on the next playbook run, even one for an unrelated reason.

[Copilot]

Copilot review overview

🔵 Needs a closer look

It has an explicit external dependency on a backend route shipping first (/login/github), and I can’t verify release/merge sequencing correctness from this repo alone.

Review effort: Lite
Findings: None

What changed in this PR

Updates the theme’s GitHub login entrypoint to rely on the new server-side /login/github route (avoiding client-side OAuth URL construction and redirect URI injection issues), and improves the DB wizard’s AJAX error reporting so failures are reliably surfaced to the user.

Changes:

• Replace the GitHub login button’s client-side OAuth URL assembly with a plain anchor to /login/github (optionally including a next query param).
• Make the DB test wizard’s AJAX error handler resilient when the response body is not JSON, and render the message safely via .text().

File	Description
templates/​login.html	Switches GitHub login button to link to /login/github with optional next parameter; removes inline JS that built the GitHub authorize URL.
templates/​wizard_db.html	Hardens AJAX error handling when responseJSON is absent and avoids HTML injection by using .text().

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.