antiwork · stefanbinoj · Dec 15, 2025 · Dec 15, 2025 · Dec 15, 2025 · Dec 15, 2025
diff --git a/app/controllers/concerns/inertia_rendering.rb b/app/controllers/concerns/inertia_rendering.rb
@@ -7,12 +7,14 @@ module InertiaRendering
   included do
     inertia_share do
       RenderingExtension.custom_context(view_context).merge(
-        current_user: current_user_props(current_user, impersonated_user),
         authenticity_token: form_authenticity_token,
         flash: inertia_flash_props,
         title: @title
       )
     end
+    inertia_share if: :user_signed_in? do
+      { current_user: current_user_props(current_user, impersonated_user) }
+    end
   end
 
   private

diff --git a/app/controllers/logins_controller.rb b/app/controllers/logins_controller.rb
@@ -1,24 +1,28 @@
 # frozen_string_literal: true
 
 class LoginsController < Devise::SessionsController
-  include OauthApplicationConfig, ValidateRecaptcha
+  include OauthApplicationConfig, ValidateRecaptcha, InertiaRendering
 
   skip_before_action :check_suspended, only: %i[create destroy]
   before_action :block_json_request, only: :new
   after_action :clear_dashboard_preference, only: :destroy
   before_action :reset_impersonated_user, only: :destroy
   before_action :set_noindex_header, only: :new, if: -> { params[:next]&.start_with?("/oauth/authorize") }
 
+  layout "inertia", only: [:new]
+
   def new
-    @hide_layouts = true
+    @load_recaptcha = true
     return redirect_to login_path(next: request.referrer) if params[:next].blank? && request_referrer_is_a_valid_after_login_path?
-    @auth_presenter = AuthPresenter.new(params:, application: @application)
+
+    auth_presenter = AuthPresenter.new(params:, application: @application)
+    render inertia: "Logins/New", props: auth_presenter.login_props
   end
 
   def create
     site_key = GlobalConfig.get("RECAPTCHA_LOGIN_SITE_KEY")
     if !(Rails.env.development? && site_key.blank?) && !valid_recaptcha_response?(site_key: site_key)
-      return respond_with_login_failure("Sorry, we could not verify the CAPTCHA. Please try again.")
+      return redirect_with_login_error("Sorry, we could not verify the CAPTCHA. Please try again.")
     end
 
     if params["user"].instance_of?(ActionController::Parameters)
@@ -27,11 +31,11 @@ def create
       @user = User.where(email: login_identifier).first || User.where(username: login_identifier).first if login_identifier.present?
     end
 
-    return respond_with_login_failure("An account does not exist with that email.") if @user.blank?
+    return redirect_with_login_error("An account does not exist with that email.") if @user.blank?
 
-    return respond_with_login_failure("Please try another password. The one you entered was incorrect.") unless @user.valid_password?(password)
+    return redirect_with_login_error("Please try another password. The one you entered was incorrect.") unless @user.valid_password?(password)
 
-    return respond_with_login_failure("You cannot log in because your account was permanently deleted. Please sign up for a new account to start selling!") if @user.deleted?
+    return redirect_with_login_error("You cannot log in because your account was permanently deleted. Please sign up for a new account to start selling!") if @user.deleted?
 
     if @user.suspended_for_fraud?
       check_suspended
@@ -44,16 +48,18 @@ def create
         flash[:warning] = "Your password has previously appeared in a data breach as per haveibeenpwned.com and should never be used. We strongly recommend you change your password everywhere you have used it."
       end
 
-      render json: { redirect_location: login_path_for(@user) }
+      redirect_to login_path_for(@user), allow_other_host: true
     end
   end
 
   private
-    def respond_with_login_failure(message)
-      render json: { error_message: message }, status: :unprocessable_entity
+    def block_json_request
+      return if request.inertia?
+
+      head :bad_request if request.format.json?
     end
 
-    def block_json_request
-      render json: {}, success: false, status: :bad_request if request.format.json?
+    def redirect_with_login_error(message)
+      redirect_to login_path, warning: message, status: :see_other
     end
 end
diff --git a/app/controllers/signup_controller.rb b/app/controllers/signup_controller.rb
@@ -1,14 +1,17 @@
 # frozen_string_literal: true
 
 class SignupController < Devise::RegistrationsController
-  include OauthApplicationConfig, ValidateRecaptcha
+  include OauthApplicationConfig, ValidateRecaptcha, InertiaRendering
 
   before_action :verify_captcha_and_handle_existing_users, only: :create
   before_action :set_noindex_header, only: :new, if: -> { params[:next]&.start_with?("/oauth/authorize") }
 
+  layout "inertia", only: [:new]
+
   def new
-    @hide_layouts = true
-    @auth_presenter = AuthPresenter.new(params:, application: @application)
+    @load_recaptcha = true
+    auth_presenter = AuthPresenter.new(params:, application: @application)
+    render inertia: "Signup/New", props: auth_presenter.signup_props
   end
 
   def create
@@ -44,7 +47,10 @@ def create
       # Do not require 2FA for newly signed up users
       remember_two_factor_auth
 
-      render json: { success: true, redirect_location: login_path_for(@user) }
+      respond_to do |format|
+        format.html { redirect_to login_path_for(@user), allow_other_host: true }
+        format.json { render json: { success: true, redirect_location: login_path_for(@user) } }
+      end
     else
       error_message = if !params[:user] || params[:user][:email].blank?
         "Please provide a valid email address."
@@ -54,10 +60,10 @@ def create
         @user.errors.full_messages[0]
       end
 
-      render json: {
-        success: false,
-        error_message:
-      }
+      respond_to do |format|
+        format.html { redirect_with_signup_error(error_message) }
+        format.json { render json: { success: false, error_message: error_message } }
+      end
     end
   end
 
@@ -95,10 +101,11 @@ def verify_captcha_and_handle_existing_users
       if params[:user] && params[:user][:buyer_signup].blank?
         site_key = GlobalConfig.get("RECAPTCHA_SIGNUP_SITE_KEY")
         if !(Rails.env.development? && site_key.blank?) && !valid_recaptcha_response?(site_key: site_key)
-          return render json: {
-            success: false,
-            error_message: "Sorry, we could not verify the CAPTCHA. Please try again."
-          }
+          respond_to do |format|
+            format.html { redirect_with_signup_error("Sorry, we could not verify the CAPTCHA. Please try again.") }
+            format.json { render json: { success: false, error_message: "Sorry, we could not verify the CAPTCHA. Please try again." } }
+          end
+          return
         end
       end
 
@@ -109,12 +116,22 @@ def verify_captcha_and_handle_existing_users
 
       if !user.deleted? && user.try(:valid_password?, params[:user][:password])
         sign_in_or_prepare_for_two_factor_auth(user)
-        render json: { success: true, redirect_location: login_path_for(user) }
+        respond_to do |format|
+          format.html { redirect_to login_path_for(user) }
+          format.json { render json: { success: true, redirect_location: login_path_for(user) } }
+        end
       else
-        render json: { success: false, error_message: "An account already exists with this email." }
+        respond_to do |format|
+          format.html { redirect_with_signup_error("An account already exists with this email.") }
+          format.json { render json: { success: false, error_message: "An account already exists with this email." } }
+        end
       end
     end
 
+    def redirect_with_signup_error(message)
+      redirect_to signup_path, warning: message, status: :see_other
+    end
+
     def build_user_with_params(user_params = nil)
       return unless user_params.present?
 

diff --git a/app/javascript/components/FlashError.tsx b/app/javascript/components/FlashError.tsx
@@ -0,0 +1,22 @@
+import { usePage } from "@inertiajs/react";
+import * as React from "react";
+
+import { type AlertPayload } from "$app/components/server-components/Alert";
+
+type PageProps = {
+  flash?: AlertPayload;
+};
+
+export const FlashError: React.FC = () => {
+  const { flash } = usePage<PageProps>().props;
+
+  if (flash?.status === "warning" && flash.message) {
+    return (
+      <div role="alert" className="danger">
+        {flash.message}
+      </div>
+    );
+  }
+
+  return null;
+};
diff --git a/app/javascript/components/server-components/SignupPage.tsx b/app/javascript/components/server-components/SignupPage.tsx
diff --git a/app/javascript/data/login.ts b/app/javascript/data/login.ts
@@ -2,35 +2,6 @@ import { cast } from "ts-safe-cast";
 
 import { ResponseError, request } from "$app/utils/request";
 
-export type LoginPayload = {
-  email: string;
-  password: string;
-  recaptchaResponse: string | null;
-  next: string | null;
-};
-
-export const login = async (data: LoginPayload): Promise<{ redirectLocation: string }> => {
-  const response = await request({
-    method: "POST",
-    url: Routes.login_path(),
-    accept: "json",
-    data: {
-      user: {
-        login_identifier: data.email,
-        password: data.password,
-      },
-      next: data.next,
-      "g-recaptcha-response": data.recaptchaResponse,
-    },
-  });
-  if (!response.ok) {
-    const { error_message } = cast<{ error_message: string }>(await response.json());
-    throw new ResponseError(error_message);
-  }
-  const { redirect_location } = cast<{ redirect_location: string }>(await response.json());
-  return { redirectLocation: redirect_location };
-};
-
 export const renewPassword = async (email: string) => {
   const response = await request({
     method: "POST",