ai_ml_operations/chat_ios
2
0 Fork 0
Code Issues 9 Pull Requests Actions Packages Projects Releases Wiki Activity

Sign in #2

New Issue
Open
opened 2026-10-23 03:36:08 -07:00 by westfarn · 0 comments
westfarn commented 2026-10-23 03:36:08 -07:00
Owner
Copy link
Copy source

Part of #1.

Web route: /signin/
Source: llm-fe/src/llm-fe/pages/SignIn/SignIn.tsx

Cold start with no stored session opens this screen. Do not open the public landing page.

Screenshot

Sign in

Phone-width capture of https://hesychia.ai/signin/. Analytics consent banner dismissed before capture.

Behavior

  • Glass card: Hesychia mark, wordmark, email, password, Sign In.
  • On load, GET /public/settings/.
    • enable_account_registration true: show “Don’t have an account? Sign up” and SSO buttons for providers flagged in oauth.google / oauth.microsoft.
    • false: hide sign-up and SSO. Settings failure is treated as registration off.
  • Forgot Password goes to /password_reset/.
  • Terms of Service goes to /terms_of_service/. If the user is already signed in and has not acknowledged terms, that screen posts the acknowledge call and then opens Dashboard. It is a gate, not the marketing site.
  • Validation: email format required, password required.
  • Success stores access and refresh, then GET /user/get/.
    • has_signed_tos true → Dashboard (/).
    • false → terms acknowledge, then Dashboard.
  • Also call RevenueCat logIn with the Django user id.
  • Failure shows “Error retrieving account. Try again”.
  • SSO leaves the app for {API}/auth/oauth/{google|microsoft}/start/?intent=login and returns through /auth/callback/, then the same post-login routing as password sign-in.
  • Sign out from any signed-in page: POST blacklist/ with the refresh token, clear tokens, RevenueCat logOut, return here.

API

REST base is REACT_APP_BACKEND_REST_API_BASE_URL (prod https://chatbackend.aimloperations.com/api/). Authenticated calls use Authorization: Bearer <access>.

Call Purpose
GET /public/settings/ Registration flag and OAuth provider flags. No auth.
POST /token/obtain/ Body { "username": email, "password" }. Returns { access, refresh }.
GET /user/get/ Current account: id, email, names, is_company_manager, has_signed_tos, has_usable_password, company.
POST /token/refresh/ Rotate access token. Web interceptor does this on 401.
POST /user/acknowledge_tos/ Required before Dashboard when has_signed_tos is false.
POST blacklist/ Body { "refresh_token" }. Sign out.

iOS

Build this screen. It is the logged-out start. Store tokens in the Keychain. SSO uses ASWebAuthenticationSession and a return URL for /auth/callback/.

Part of #1. Web route: `/signin/` Source: `llm-fe/src/llm-fe/pages/SignIn/SignIn.tsx` Cold start with no stored session opens this screen. Do not open the public landing page. ## Screenshot ![Sign in](https://git.aimloperations.com/attachments/2ec6b929-c6a1-4206-b6fb-6f50170cd2eb) Phone-width capture of https://hesychia.ai/signin/. Analytics consent banner dismissed before capture. ## Behavior - Glass card: Hesychia mark, wordmark, email, password, Sign In. - On load, `GET /public/settings/`. - `enable_account_registration` true: show “Don’t have an account? Sign up” and SSO buttons for providers flagged in `oauth.google` / `oauth.microsoft`. - false: hide sign-up and SSO. Settings failure is treated as registration off. - Forgot Password goes to `/password_reset/`. - Terms of Service goes to `/terms_of_service/`. If the user is already signed in and has not acknowledged terms, that screen posts the acknowledge call and then opens Dashboard. It is a gate, not the marketing site. - Validation: email format required, password required. - Success stores `access` and `refresh`, then `GET /user/get/`. - `has_signed_tos` true → Dashboard (`/`). - false → terms acknowledge, then Dashboard. - Also call RevenueCat `logIn` with the Django user id. - Failure shows “Error retrieving account. Try again”. - SSO leaves the app for `{API}/auth/oauth/{google|microsoft}/start/?intent=login` and returns through `/auth/callback/`, then the same post-login routing as password sign-in. - Sign out from any signed-in page: `POST blacklist/` with the refresh token, clear tokens, RevenueCat `logOut`, return here. ## API REST base is `REACT_APP_BACKEND_REST_API_BASE_URL` (prod `https://chatbackend.aimloperations.com/api/`). Authenticated calls use `Authorization: Bearer <access>`. | Call | Purpose | | --- | --- | | `GET /public/settings/` | Registration flag and OAuth provider flags. No auth. | | `POST /token/obtain/` | Body `{ "username": email, "password" }`. Returns `{ access, refresh }`. | | `GET /user/get/` | Current account: id, email, names, `is_company_manager`, `has_signed_tos`, `has_usable_password`, `company`. | | `POST /token/refresh/` | Rotate access token. Web interceptor does this on 401. | | `POST /user/acknowledge_tos/` | Required before Dashboard when `has_signed_tos` is false. | | `POST blacklist/` | Body `{ "refresh_token" }`. Sign out. | ## iOS Build this screen. It is the logged-out start. Store tokens in the Keychain. SSO uses `ASWebAuthenticationSession` and a return URL for `/auth/callback/`.
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
twestfall westfarn (Ryan Westfall)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: ai_ml_operations/chat_ios#2