From 7ceaed0423b0960d42dc23a54cf9fa1ba563cc61 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A1n=20Vor=C4=8D=C3=A1k?= Date: Tue, 25 Aug 2026 21:55:41 +0200 Subject: [PATCH 1/2] sign-in modal: register via Auth0 native signup, not Cloud's wizard MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit "Create a free account" hardcoded a link to cloud.redpanda.com/sign-up, Cloud's full onboarding wizard, which provisions a trial org + resources even for a docs-only sign-in. Point it at docs-login's /login?signup=1 fast path instead, mirroring how the Continue button already routes through /login?disclosed=1 — docs-site resolves that to Auth0's native screen_hint=signup screen on its Auth0 client. --- src/js/26-docs-account.js | 5 +++++ src/partials/header-content.hbs | 8 +++++++- 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/src/js/26-docs-account.js b/src/js/26-docs-account.js index 165c5908..e248a75e 100644 --- a/src/js/26-docs-account.js +++ b/src/js/26-docs-account.js @@ -21,6 +21,7 @@ var signoutLink = container.querySelector('[data-account-signout]') var modal = container.querySelector('[data-signin-modal]') var modalCta = container.querySelector('[data-signin-modal-continue]') + var modalSignup = container.querySelector('[data-signin-modal-signup]') var CACHE_KEY = 'docs-account-me' @@ -197,6 +198,10 @@ // and go straight to Auth0. The bare signinLink href (middle-click, or no // modal markup) stays undisclosed and gets the interstitial. if (modalCta) modalCta.href = '/login?disclosed=1&return_to=' + returnTo() + // Same fast path, but for signup: lands on Auth0's native "Sign up" screen + // instead of Cloud's cloud.redpanda.com/sign-up onboarding wizard (which + // provisions a trial org + resources a docs-only sign-in doesn't need). + if (modalSignup) modalSignup.href = '/login?disclosed=1&signup=1&return_to=' + returnTo() // Signed in: the console link lives in the account dropdown, so hide the // standalone toolbar/overflow Cloud Console links (avoid two paths) diff --git a/src/partials/header-content.hbs b/src/partials/header-content.hbs index 36acad1d..abd56d75 100644 --- a/src/partials/header-content.hbs +++ b/src/partials/header-content.hbs @@ -169,7 +169,13 @@ Continue -

No account yet? Create a free account

+ {{!-- Registers directly against the docs Auth0 client (screen_hint=signup) + instead of Cloud's cloud.redpanda.com/sign-up onboarding wizard, which + provisions a trial org + resources a docs-only sign-in doesn't need. + Same-tab like Continue (docs-account.js sets disclosed=1&signup=1& + return_to=...), not target=_blank: it's our own /login now, not an + external site. --}} +

No account yet? Create a free account

{{!-- Privacy disclosure. The modal CTA links to /login?disclosed=1, which docs-login.mjs uses to SKIP the server interstitial, so for anyone signing in from here this note is the only From 7433ddcadbe269182dc4aae1cc5b808e85f53b40 Mon Sep 17 00:00:00 2001 From: JakeSCahill Date: Wed, 26 Aug 2026 16:21:25 +0100 Subject: [PATCH 2/2] sign-in modal: keep "Create a free account" on Cloud's real wizard Revert 7ceaed0's core change. Auth0's native screen_hint=signup skips org provisioning entirely: the docs Auth0 client requires organization membership, and org creation only happens inside Cloud's own onboarding wizard (cloud-ui/cloud-api), which an Auth0-native signup never touches. So every account created through /login?signup=1 ends up permanently org-less -- login_error=org_setup_incomplete forever, since verifying the emailed address does not create an organization. Team decision was to keep routing "Create a free account" through Cloud's real wizard (so accounts actually work) and instead skip the wasted welcome-cluster provisioning for docs-tagged signups on the Cloud side -- see cloudv2's signUpSource/backoffice-worker work, which solves the original waste concern without breaking login. Also, while touching this file: - returnTo() now includes window.location.hash. It previously dropped the URL fragment, so signing in from a page with a #section-anchor silently lost the reader's position; docs-site's safeReturnTo() already accepts it as-is. - Corrected the org_setup_incomplete/access_denied toast copy to match the same fix just made in docs-site docs-login.mjs: pointed at finishing Cloud account setup, not at "click the verification link," which cannot fix a missing organization and was sending users into a permanent retry loop. --- src/js/26-docs-account.js | 28 +++++++++++++++------------- src/partials/header-content.hbs | 18 +++++++++++------- 2 files changed, 26 insertions(+), 20 deletions(-) diff --git a/src/js/26-docs-account.js b/src/js/26-docs-account.js index e248a75e..54d63b1d 100644 --- a/src/js/26-docs-account.js +++ b/src/js/26-docs-account.js @@ -21,7 +21,6 @@ var signoutLink = container.querySelector('[data-account-signout]') var modal = container.querySelector('[data-signin-modal]') var modalCta = container.querySelector('[data-signin-modal-continue]') - var modalSignup = container.querySelector('[data-signin-modal-signup]') var CACHE_KEY = 'docs-account-me' @@ -44,7 +43,11 @@ } function returnTo () { - return encodeURIComponent(window.location.pathname + window.location.search) + // Include the hash: without it, a user reading a specific #section-anchor + // who signs in gets bounced back to the top of the page instead of where + // they were. docs-site's safeReturnTo() already accepts a path+query+hash + // string as-is (it only checks scheme/shape, not content). + return encodeURIComponent(window.location.pathname + window.location.search + window.location.hash) } // Feature modal shown before sending the user to /login. @@ -198,10 +201,6 @@ // and go straight to Auth0. The bare signinLink href (middle-click, or no // modal markup) stays undisclosed and gets the interstitial. if (modalCta) modalCta.href = '/login?disclosed=1&return_to=' + returnTo() - // Same fast path, but for signup: lands on Auth0's native "Sign up" screen - // instead of Cloud's cloud.redpanda.com/sign-up onboarding wizard (which - // provisions a trial org + resources a docs-only sign-in doesn't need). - if (modalSignup) modalSignup.href = '/login?disclosed=1&signup=1&return_to=' + returnTo() // Signed in: the console link lives in the account dropdown, so hide the // standalone toolbar/overflow Cloud Console links (avoid two paths) @@ -290,13 +289,16 @@ state_mismatch: 'Your sign-in link expired. Please try again.', // Auth0 access_denied: the account isn't a member of a required Redpanda // Cloud organization (or declined consent). Retrying the same account won't - // help, so say why instead of a generic "try again" loop. - access_denied: 'Your account is not in a Redpanda Cloud organization yet. Click the verification link in your email, or ask your organization admin to invite you.', - // Signed up but never clicked the verification link Redpanda Cloud emailed. - // Kept in sync with LOGIN_ERROR_MESSAGES in docs-site docs-login.mjs: without - // an entry here this code fell through to the generic "try again" default, - // which is the one thing that cannot work until the address is verified. - org_setup_incomplete: 'Click the verification link Redpanda Cloud emailed you, then sign in again.', + // help, so say why instead of a generic "try again" loop. Verifying an + // emailed address does not create an organization -- only finishing Cloud's + // own onboarding does -- so this doesn't point at the inbox. + access_denied: 'Your account is not in a Redpanda Cloud organization yet. Ask your organization admin to invite you, or finish setting up your account on Redpanda Cloud.', + // Account has no Redpanda Cloud organization yet. Kept in sync with + // LOGIN_ERROR_MESSAGES.org_setup_incomplete in docs-site docs-login.mjs: + // verifying the emailed address does NOT create an organization (that only + // happens inside Cloud's own onboarding wizard), so retrying sign-in fails + // identically every time until account setup is actually finished on Cloud. + org_setup_incomplete: 'Finish creating your account on Redpanda Cloud, then come back and sign in.', } var toast = document.createElement('div') toast.setAttribute('role', 'alert') diff --git a/src/partials/header-content.hbs b/src/partials/header-content.hbs index abd56d75..1eb2f7b6 100644 --- a/src/partials/header-content.hbs +++ b/src/partials/header-content.hbs @@ -169,13 +169,17 @@ - {{!-- Registers directly against the docs Auth0 client (screen_hint=signup) - instead of Cloud's cloud.redpanda.com/sign-up onboarding wizard, which - provisions a trial org + resources a docs-only sign-in doesn't need. - Same-tab like Continue (docs-account.js sets disclosed=1&signup=1& - return_to=...), not target=_blank: it's our own /login now, not an - external site. --}} - + {{!-- Reverted 2026-08-26: registering via Auth0's native screen_hint=signup + (instead of Cloud's cloud.redpanda.com/sign-up wizard) skips org + provisioning entirely -- the docs Auth0 client requires org + membership, so an Auth0-native signup produces a permanently + org-less account (login_error=org_setup_incomplete forever; + verifying the email does not fix it, since org creation only + happens inside Cloud's own onboarding). Team decision was to keep + routing "Create a free account" through Cloud's real wizard and + instead skip the WASTED WELCOME CLUSTER for docs-tagged signups on + the Cloud side (see cloudv2 signUpSource/backoffice-worker work). --}} + {{!-- Privacy disclosure. The modal CTA links to /login?disclosed=1, which docs-login.mjs uses to SKIP the server interstitial, so for anyone signing in from here this note is the only