🐞 Fix login hints never reaching the login form

Three independent defects each stopped `login_hint__*` parameters from
prefilling the Keycloak username field.

`parseLoginHints` iterated `URLSearchParams.entries()` and `Map.keys()`
with `for ... of`. The portal compiles with `target: "es5"` and no
`downlevelIteration`, so both loops became indexed loops over an iterator
whose `length` is `undefined`, and never ran a single iteration. Hints
were therefore always empty, so the portal took the plain login path and
left the hints in the redirect URI. The unit tests did not catch this
because `@swc/jest` builds them for `es2022`.

`createLoginUrl` and `createRegisterUrl` return `Promise<string>` in
keycloak-js 26, and were passed unawaited to `appendLoginHints`, which
threw `Invalid URL` and aborted the redirect. TypeScript reports this,
but the webpack build runs `ts-loader` with `transpileOnly`.

The voting portal login template dropped stock Keycloak's
`value="${(login.username!'')}"`, so the username field rendered empty
even when Keycloak had resolved the hint.

Author: edulix

packages/keycloak-extensions/sequent-theme/src/main/resources/theme/sequent.voting-portal/login/login.ftl

@@ -17,7 +17,7 @@ SPDX-License-Identifier: AGPL-3.0-only
                         <div class="${properties.kcFormGroupClass!}">
                             <label for="username" class="${properties.kcLabelClass!}"><#if !realm.loginWithEmailAllowed>${msg("username")}<#elseif !realm.registrationEmailAsUsername>${msg("usernameOrEmail")}<#else>${msg("email")}</#if></label>
 
-                            <input tabindex="1" id="username" class="${properties.kcInputClass!}" name="username" type="text" autofocus autocomplete="off"
+                            <input tabindex="1" id="username" class="${properties.kcInputClass!}" name="username" value="${(login.username!'')}" type="text" autofocus autocomplete="off"
                                    aria-invalid="<#if messagesPerField.existsError('username','password')>true</#if>"
                             />
 

packages/voting-portal/src/providers/AuthContextProvider.tsx

@@ -313,28 +313,20 @@ const AuthContextProvider = (props: AuthContextProviderProps) => {
                         }
 
                         if (Object.keys(loginHints).length > 0) {
-                            window.location.assign(
-                                appendLoginHints(
-                                    keycloak.createRegisterUrl(registerOptions),
-                                    loginHints
-                                )
-                            )
+                            const registerUrl = await keycloak.createRegisterUrl(registerOptions)
+                            window.location.assign(appendLoginHints(registerUrl, loginHints))
                             return
                         }
 
                         return await keycloak.register(registerOptions)
                     } else {
                         if (Object.keys(loginHints).length > 0) {
-                            window.location.assign(
-                                appendLoginHints(
-                                    keycloak.createLoginUrl({
-                                        ...keycloakInitOptions,
-                                        // Stock username forms only understand the standard OIDC hint.
-                                        loginHint: loginHints.username,
-                                    }),
-                                    loginHints
-                                )
-                            )
+                            const loginUrl = await keycloak.createLoginUrl({
+                                ...keycloakInitOptions,
+                                // Stock username forms only understand the standard OIDC hint.
+                                loginHint: loginHints.username,
+                            })
+                            window.location.assign(appendLoginHints(loginUrl, loginHints))
                             return
                         }
 

packages/voting-portal/src/utils/loginHints.ts

@@ -69,9 +69,11 @@ export const parseLoginHints = (search: string): ParsedLoginHints => {
     const searchParams = new URLSearchParams(search)
     const hints = new Map<string, string>()
 
-    for (const [parameterName, value] of searchParams.entries()) {
+    // The portal is compiled targeting ES5, where `for ... of` over an iterator
+    // (as opposed to an array) is transpiled into a no-op indexed loop.
+    searchParams.forEach((value, parameterName) => {
         if (!parameterName.startsWith(LOGIN_HINT_PREFIX)) {
-            continue
+            return
         }
 
         const hintName = parameterName.slice(LOGIN_HINT_PREFIX.length)
@@ -85,11 +87,11 @@ export const parseLoginHints = (search: string): ParsedLoginHints => {
         if (hints.size > MAX_LOGIN_HINT_COUNT) {
             throw new InvalidLoginHintsError()
         }
-    }
+    })
 
-    for (const hintName of hints.keys()) {
+    hints.forEach((_value, hintName) => {
         searchParams.delete(`${LOGIN_HINT_PREFIX}${hintName}`)
-    }
+    })
 
     const remainingSearch = searchParams.toString()
     return {