From 56e49b27a25d204a4550c2418e78df13cb9bfff5 Mon Sep 17 00:00:00 2001
From: Codex <codex@local>
Date: Thu, 14 May 2026 19:43:12 +0800
Subject: [PATCH] Fix cloud login submit binding

---
 public/app.js                | 10 +++++-----
 public/mobile.js             | 10 +++++-----
 test/access-password.test.js | 16 ++++++++++++++++
 3 files changed, 26 insertions(+), 10 deletions(-)

diff --git a/public/app.js b/public/app.js
index 963a23c..101dea3 100644
--- a/public/app.js
+++ b/public/app.js
@@ -111,6 +111,11 @@ let resolveRequestId = 0;
 let temporaryQueryItems = [];
 let appStarted = false;
 
+authForm?.addEventListener("submit", async (event) => {
+  event.preventDefault();
+  await submitAccessPassword();
+});
+
 for (const [platform, element] of Object.entries(urlInputs)) {
   element.addEventListener("input", () => {
     dirtyUrlInputs.add(platform);
@@ -610,11 +615,6 @@ dutyRunNow?.addEventListener("click", () => {
   runDutyNow();
 });
 
-authForm?.addEventListener("submit", async (event) => {
-  event.preventDefault();
-  await submitAccessPassword();
-});
-
 initializeApp();
 document.addEventListener("hotness:programs-changed", refreshPrograms);
 
diff --git a/public/mobile.js b/public/mobile.js
index e45f689..964438b 100644
--- a/public/mobile.js
+++ b/public/mobile.js
@@ -63,6 +63,11 @@ let dirtyUrlInputs = new Set();
 let deferredInstallPrompt = null;
 let appStarted = false;
 
+authForm?.addEventListener("submit", async (event) => {
+  event.preventDefault();
+  await submitAccessPassword();
+});
+
 for (const [platform, element] of Object.entries(urlInputs)) {
   element.addEventListener("input", () => {
     dirtyUrlInputs.add(platform);
@@ -176,11 +181,6 @@ window.addEventListener("appinstalled", () => {
   updateInstallPrompt("installed");
 });
 
-authForm?.addEventListener("submit", async (event) => {
-  event.preventDefault();
-  await submitAccessPassword();
-});
-
 initializeApp();
 
 async function initializeApp() {
diff --git a/test/access-password.test.js b/test/access-password.test.js
index f15bd6b..c3e6d34 100644
--- a/test/access-password.test.js
+++ b/test/access-password.test.js
@@ -29,6 +29,14 @@ test("desktop page has a password gate and sends auth token with API calls", ()
   assert.match(desktopCss, /\.auth-gate/);
 });
 
+test("desktop login submit is bound before the rest of the app can fail", () => {
+  const authBinding = desktopJs.indexOf('authForm?.addEventListener("submit"');
+  const collectBinding = desktopJs.indexOf('form.addEventListener("submit"');
+  assert.ok(authBinding > -1, "auth submit binding should exist");
+  assert.ok(collectBinding > -1, "collect submit binding should exist");
+  assert.ok(authBinding < collectBinding, "auth binding must run before normal app bindings");
+});
+
 test("mobile page has the same password gate for cloud use", () => {
   assert.match(mobileHtml, /id="auth-gate"/);
   assert.match(mobileHtml, /id="auth-password"/);
@@ -38,3 +46,11 @@ test("mobile page has the same password gate for cloud use", () => {
   assert.match(mobileJs, /x-hotness-auth-token/i);
   assert.match(mobileCss, /\.auth-gate/);
 });
+
+test("mobile login submit is bound before normal capture events", () => {
+  const authBinding = mobileJs.indexOf('authForm?.addEventListener("submit"');
+  const collectBinding = mobileJs.indexOf('form.addEventListener("submit"');
+  assert.ok(authBinding > -1, "auth submit binding should exist");
+  assert.ok(collectBinding > -1, "collect submit binding should exist");
+  assert.ok(authBinding < collectBinding, "auth binding must run before normal app bindings");
+});