Login redirects straight into GitHub's OAuth flow — no separate form,
since GitHub is the only provider stage 3 wires up so far. Account and
its emails page both bounce to /login on a null me query rather than
rendering an empty state, since there's nothing useful to show a
signed-out visitor there. identity_origin() derives the API host from
window.location instead of a build-time constant, since dev and prod
share one build and only differ by which new.<x> domain served it.
The home page was a placeholder and every page rendered its content
with no chrome, so nothing tied them together. A shared Nav (logo,
page-specific right-side slot) now wraps all four pages; login and
account got card layouts and real spacing instead of a single button
floating on a blank page.
Gradient art panel (brand-color radial blooms, hairline diagonal
pattern, SVG-turbulence grain) with the mark's ring blown up large,
floating yellow accent shapes straddling the seam. Matches the
branding deck's hero treatment instead of a plain centered CTA.
Bigger bold heading, logo lockup moved to bottom-left like the deck,
a hairline divider at the seam, the ring bleeding across it instead
of sitting fully inside the art panel, and a more saturated/textured
gradient. Dropped the MIT-licensed footer line — repo trivia, not
something a landing page needs.
Bottom-left logo placement (copied from the branding deck's slide
layout) read as broken on an actual site — nav belongs at the top,
consistent with every other page. Home now also checks the session:
signed-in visitors get 'Account' / 'Go to account' instead of a
Sign in prompt they've already gotten past.
Sends a link via addEmail rather than adding outright; the banner
reads ?verified=1/0 off the redirect the backend's /email/verify
sends people back to.
'+ Link another GitHub account' on /account starts the OAuth flow in
link mode; link_error banner surfaces a failed attempt (already
claimed elsewhere) instead of a bare error page. /account/emails now
shows where each email came from and lets the user make any verified
one primary, or remove ones they added manually.
Surfaces me.pendingEmailVerifications on /account/emails — addEmail
already worked as a resend, this just makes a pending request visible
instead of silently invisible until the link is clicked or expires.
provider_login_url/provider_link_url are generic now; /login shows
both buttons, /account's link section iterates a small provider list
instead of a single hardcoded GitHub link.
Avatar now renders the provider's picture when linked_identity has
one, falling back to the initials circle otherwise; the profile
header picks up the first linked identity's avatar too. Nicknames
render as @username instead of bare text. sources on emails follows
the backend's move to a list — 'via GitHub, GitLab' instead of
whichever provider synced last.
Adds a "Delete account" section to /account: a confirm modal that
mails a link rather than deleting anything client-side (identity
locks the account only once that link is opened and Gitea confirms
it's deletable). Also handles every ?deletion= flag the confirm/
restore redirects can send — confirmed, restored, invalid, and the
still-owns-* refusal reasons — as a banner on the account page.
Adds src/org.rs as the GraphQL client for the new org/team/grant
backend, a /org/:slug/teams page for creating teams, managing
membership, and granting/revoking repository access, and an
Organizations section on /account linking into it.
Adds /:owner rendering the three-layer contribution heatmap (native,
linked-public, linked-private) as hand-built SVG grids — no JS
dependency, since Gitea's own heatmap component is gone after the cut.
The route is a catch-all registered last so it doesn't shadow the
static routes above it (/login, /account, /org/...).
Also adds a heatmap-privacy section on /account (toggle + audience
select) and a link from there to the user's own profile heatmap.
Toggle buttons (All / GitHub / GitLab / Codeberg) let you pick which
linked accounts' contributions show, individually or combined — each
selected provider renders as its own labeled grid rather than a single
merged sum, matching identity's new per-provider GraphQL breakdown.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Promote the verified 0.4 implementation from develop to main after successful dev cutover, E2E, resilience tests and architecture audit.