[milanPR15]

Part 4 of 5 of IDN-02, split from #55. Base: part 3. Review and merge in order 1 → 5, without squash.

Component and requirement IDs

• Component: Identity frontend (Team 1, IDN-02)
• Requirements: IDN-02, SEC-01, SEC-05, OPS-07
• Stories: US-07 (login screen), US-08 (login state, protected routes, logout)
• Author(s): Milan Stojanovic, with anja-sreckovic (US-07) and Danko Marković (US-08) as co-authors in the commit

Changes

Size: 18 files, +427 / −18 without package-lock.json.

• US-07: LoginForm and login/page.tsx. Fields have labels and the form works from the keyboard. The button is disabled while the request runs, so a double click does not send two requests, and a failed login shows one generic message. The password and the session are never stored in localStorage or in the URL.
• US-08: AuthProvider restores the user from /api/auth/me after a reload. apiFetch sends every request through one client and returns to the login screen on 401, and the "Log out" button calls logout and clears the local state.
• Routing: React Router (react-router-dom) separates the public pages (/, /login) from the protected route (/access-demo). Hiding a page is not an access check; the server checks every request.
• Composition: the KT1 coursework panel from main (CourseworkKt1) stays on the public start page. CreateAccountForm (IDN-01) is now on the protected page.

Verification

• npm ci and npm run build: OK.

Architecture and data flow

The frontend authentication boundary is described in docs/ARCHITECTURE.md (part 5).

Security checks and negative tests

The frontend is not a security boundary: all checks stay on the server (part 3). No token or password is kept in browser storage.

Dependencies

• Base: part 3. Next: part 5.

Stack

1. IDN-02 (1/5): group identity code by kind folders (moves only) #61 group identity code by kind folders (moves only), base main
2. IDN-02 (2/5): US-02 US-03 US-09 identity database, session store and seed #62 identity database, session store and seed (US-02, US-03, US-09)
3. IDN-02 (3/5): US-04 US-05 US-06 login, logout and session check #63 login, logout and session check (US-04, US-05, US-06)
4. IDN-02 (4/5): US-07 US-08 frontend login, protected routes and logout #64 frontend login, protected routes and logout (US-07, US-08)
5. IDN-02 (5/5): US-01 US-10 US-11 contracts, DFD, architecture and run instructions #65 contracts, DFD, architecture and run instructions (US-01, US-10, US-11)

Replaces #55.

🤖 Generated with Claude Code