From 9d42d61f6b9cf532e5b952917ef62afbad6b8a89 Mon Sep 17 00:00:00 2001
From: glass beadian <glassbeadian@hdys.band>
Date: Tue, 13 Oct 2026 16:57:38 +0000
Subject: [PATCH] edge: restyle the oCIS idp sign-in wall into the Hub palette

The sign-in page is served by oCIS's idp service, which the web theme.json
cannot touch. Inject hub-signin.css via sub_filter on /signin/ until oCIS
sits behind the Hub OIDC issuer (see docs/design/2026-10-13-files-oidc-sso.md).
---
 infra/occupymedia/edge/hub-signin.css | 41 +++++++++++++++++++++++++++
 infra/occupymedia/edge/nginx.conf     | 22 ++++++++++++++
 2 files changed, 63 insertions(+)
 create mode 100644 infra/occupymedia/edge/hub-signin.css

diff --git a/infra/occupymedia/edge/hub-signin.css b/infra/occupymedia/edge/hub-signin.css
new file mode 100644
index 0000000..64ab15a
--- /dev/null
+++ b/infra/occupymedia/edge/hub-signin.css
@@ -0,0 +1,41 @@
+/* Hub restyle of the oCIS idp sign-in page, injected by the edge (see
+ * nginx.conf location /signin/). The page ships with ownCloud's default
+ * light theme; this brings it into the Hub palette until oCIS sits behind
+ * the Hub OIDC issuer (docs/design/2026-10-13-files-oidc-sso.md), after
+ * which the wall is never shown to Hub users at all. */
+html, body {
+  background: #0f0a09 !important;
+  color: #f5f5f5 !important;
+  font-family: system-ui, -apple-system, "Segoe UI", Roboto, sans-serif !important;
+}
+h1, h2, label, p, span, small {
+  color: #f5f5f5 !important;
+}
+form {
+  background: #161211 !important;
+  border: 1px solid #2a2320 !important;
+  border-radius: 12px !important;
+}
+input[type="text"], input[type="password"], input[type="email"] {
+  background: #0a0706 !important;
+  border: 1px solid #3a322d !important;
+  color: #f5f5f5 !important;
+  border-radius: 6px !important;
+}
+input[type="text"]:focus, input[type="password"]:focus, input[type="email"]:focus {
+  border-color: #ff1610 !important;
+  outline: none !important;
+}
+button[type="submit"], .btn-primary, input[type="submit"] {
+  background: #ff1610 !important;
+  border: none !important;
+  color: #fff !important;
+  font-weight: 600 !important;
+  border-radius: 8px !important;
+}
+button[type="submit"]:hover, .btn-primary:hover, input[type="submit"]:hover {
+  background: #e3130e !important;
+}
+a {
+  color: #ff6b66 !important;
+}
diff --git a/infra/occupymedia/edge/nginx.conf b/infra/occupymedia/edge/nginx.conf
index 6c0c9c3..c096e5c 100644
--- a/infra/occupymedia/edge/nginx.conf
+++ b/infra/occupymedia/edge/nginx.conf
@@ -234,9 +234,31 @@ http {
       default_type application/json;
       alias /opt/occ-brand/hub-theme.json;
     }
+    location = /themes/owncloud/hub-signin.css {
+      default_type text/css;
+      alias /opt/occ-brand/hub-signin.css;
+    }
     location /themes/owncloud/assets/ {
       alias /opt/occ-brand/;
     }
+    # The oCIS idp sign-in page ships ownCloud's light theme; restyle it into
+    # the Hub palette at the edge until oCIS sits behind the Hub OIDC issuer
+    # (docs/design/2026-10-13-files-oidc-sso.md).
+    location /signin/ {
+      proxy_pass http://192.168.13.210:9200;
+      proxy_http_version 1.1;
+      proxy_set_header Host $host;
+      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header X-Forwarded-Proto https;
+      proxy_set_header Upgrade $http_upgrade;
+      proxy_set_header Connection $connection_upgrade;
+      proxy_read_timeout 3600s;
+      proxy_send_timeout 3600s;
+      proxy_buffering off;
+      sub_filter '</head>' '<link rel="stylesheet" href="/themes/owncloud/hub-signin.css"></head>';
+      sub_filter_once on;
+      sub_filter_types text/html;
+    }
     location / {
       proxy_pass http://192.168.13.210:9200;
       # Hub in-app Drive frames oCIS web from app.occupymedia.cc: framing policy