wip

public/css/style.css

@@ -3657,10 +3657,33 @@ code {
   background: var(--input-bg);
   color: var(--input-color);
 }
-.paper-page .form-control:focus {
+.paper-page .form-control:focus,
+.paper-page .custom-select:focus {
+  color: var(--input-color);
+  background: var(--input-bg);
   border-color: var(--accent);
   box-shadow: 0 0 0 2px var(--accent-soft);
 }
+.form-control:focus,
+.custom-select:focus,
+input:focus,
+textarea:focus,
+select:focus {
+  color: var(--input-color) !important;
+  background-color: var(--input-bg) !important;
+}
+.form-control::selection,
+input::selection,
+textarea::selection {
+  background: var(--accent-soft);
+  color: var(--input-color);
+}
+.dark-mode .form-control::selection,
+.dark-mode input::selection,
+.dark-mode textarea::selection {
+  background: rgba(167, 178, 255, 0.30);
+  color: var(--input-color);
+}
 
 /* Primary/accent button variants */
 .btn.btn-ink {

public/script/app.js

@@ -1210,6 +1210,12 @@ angular
               $scope.sourceUrl = "https://github.com/" + res.data.source.fullName;
               $scope.terms = res.data.options.terms.filter((f) => f).join("\n");
               $scope.source = res.data.source;
+              // Remember the saved branch so the source.branch watcher knows
+              // not to bump source.commit to GitHub HEAD on edit-page load
+              // (#360). Without this, just opening the Edit form silently
+              // pulled in any new commits and saving — even to toggle a
+              // checkbox — picked them up.
+              $scope._originalBranch = res.data.source.branch;
               $scope.options = Object.assign({}, $scope.options, res.data.options);
               $scope.conference = res.data.conference;
               $scope.repositoryID = res.data.source.repositoryID;
@@ -1304,13 +1310,22 @@ angular
       $scope.$watch("source.branch", async () => {
         if ($scope.detectedType !== "repo") return;
         const selected = $scope.branches.filter((f) => f.name == $scope.source.branch)[0];
-        if (selected) {
+        if (!selected) return;
+        // In update mode, preserve the saved commit while the branch is
+        // unchanged — see #360. Saving the form (e.g. to turn off
+        // auto-update) used to bump the commit to GitHub HEAD because this
+        // watcher overwrote it on edit-page load.
+        const keepSavedCommit =
+          $scope.isUpdate &&
+          $scope._originalBranch === $scope.source.branch &&
+          !!$scope.source.commit;
+        if (!keepSavedCommit) {
           $scope.source.commit = selected.commit;
-          $scope.readme = selected.readme;
-          await getReadme();
-          anonymizeReadme();
-          $scope.$apply();
         }
+        $scope.readme = selected.readme;
+        await getReadme();
+        anonymizeReadme();
+        $scope.$apply();
       });
 
       $scope.getBranches = async (force) => {

src/server/routes/connection.ts

@@ -11,6 +11,7 @@ import UserModel from "../../core/model/users/users.model";
 import { IUserDocument } from "../../core/model/users/users.types";
 import AnonymousError from "../../core/AnonymousError";
 import AnonymizedPullRequestModel from "../../core/model/anonymizedPullRequests/anonymizedPullRequests.model";
+import { hashToken } from "./token-auth";
 
 export function ensureAuthenticated(
   req: express.Request,
@@ -166,3 +167,52 @@ router.get(
     res.redirect("/");
   }
 );
+
+// Dev-friendly login: accept an admin API token and establish a session
+// cookie so the web UI is reachable without going through GitHub OAuth.
+// Token may come from `Authorization: Bearer …`, `?token=…`, or JSON body.
+router.all(
+  "/login-token",
+  async function (req: express.Request, res: express.Response) {
+    const fromHeader = (() => {
+      const h = req.headers["authorization"];
+      if (typeof h !== "string") return null;
+      const m = h.match(/^Bearer\s+(.+)$/i);
+      return m ? m[1].trim() : null;
+    })();
+    const token =
+      fromHeader ||
+      (typeof req.query.token === "string" ? req.query.token : null) ||
+      (req.body && typeof req.body.token === "string" ? req.body.token : null);
+    if (!token) {
+      return res.status(400).json({ error: "missing_token" });
+    }
+    try {
+      const model = await UserModel.findOne({
+        "apiTokens.tokenHash": hashToken(token),
+      });
+      if (!model) return res.status(401).json({ error: "invalid_token" });
+      const synthUser = {
+        username: model.username,
+        accessToken: model.accessTokens?.github,
+        profile: undefined,
+        user: model,
+      };
+      req.login(synthUser, (err) => {
+        if (err) {
+          console.error("[login-token] req.login failed", err);
+          return res.status(500).json({ error: "login_failed" });
+        }
+        UserModel.updateOne(
+          { _id: model._id, "apiTokens.tokenHash": hashToken(token) },
+          { $set: { "apiTokens.$.lastUsedAt": new Date() } }
+        ).catch(() => undefined);
+        if (req.method === "GET") return res.redirect("/");
+        return res.json({ ok: true, username: model.username });
+      });
+    } catch (err) {
+      console.error("[login-token] error", err);
+      res.status(500).json({ error: "server_error" });
+    }
+  }
+);

src/server/routes/repository-private.ts

@@ -365,7 +365,16 @@ router.post(
 
       validateNewRepo(repoUpdate);
 
-      if (repoUpdate.source.commit != repo.model.source.commit) {
+      // Only the commit/branch backs the cached FileModel — anonymization
+      // options (terms, image/link toggles, etc.) are applied on the fly per
+      // request. Re-running the download queue is therefore only needed when
+      // the underlying snapshot moves. Other edits (e.g. turning off
+      // auto-update — see #360) just persist and return.
+      const sourceChanged =
+        repoUpdate.source.commit != repo.model.source.commit ||
+        repoUpdate.source.branch != repo.model.source.branch;
+
+      if (sourceChanged) {
         repo.model.anonymizeDate = new Date();
         repo.model.source.commit = repoUpdate.source.commit;
         await repo.remove();