From 94e0e5dd70989105d3d6376c9dfabb2742262b38 Mon Sep 17 00:00:00 2001
From: hz <zeeshaun@gmail.com>
Date: Sun, 26 Jul 2026 14:52:41 -0500
Subject: [PATCH] Confirm passwords for external account creation

---
 scripts/ui/login_screen.gd | 19 +++++++++++++++++--
 tests/steam_login_test.gd  | 14 ++++++++++++++
 2 files changed, 31 insertions(+), 2 deletions(-)

diff --git a/scripts/ui/login_screen.gd b/scripts/ui/login_screen.gd
index 8670cb8..6d26195 100644
--- a/scripts/ui/login_screen.gd
+++ b/scripts/ui/login_screen.gd
@@ -42,6 +42,7 @@ var steam_action: OptionButton
 var steam_username_input: LineEdit
 var steam_email_input: LineEdit
 var steam_password_input: LineEdit
+var steam_confirm_input: LineEdit
 var steam_legal_check: CheckBox
 var external_buttons: Dictionary = {}
 var panel_gutter: MarginContainer
@@ -338,7 +339,9 @@ func _build_steam_view() -> VBoxContainer:
 	steam_username_input = _add_field(view, "Username or email", "Choose a username")
 	steam_email_input = _add_field(view, "Email", "name@example.com")
 	steam_password_input = _add_field(view, "Password", "At least 8 characters", true)
+	steam_confirm_input = _add_field(view, "Confirm password", "Re-enter your password", true)
 	_add_password_reveal(steam_password_input)
+	_add_password_reveal(steam_confirm_input)
 	steam_legal_check = _add_legal_consent(view)
 	_add_primary_button(view, "Continue", _complete_steam)
 	_add_back_button(view, "Cancel external sign in", "login")
@@ -855,7 +858,10 @@ func _on_steam_status(result: int, code: int, _headers: PackedStringArray, body:
 
 
 func _on_steam_action_changed(index: int) -> void:
-	steam_email_input.visible = index == 0
+	_set_field_visible(steam_email_input, index == 0)
+	_set_field_visible(steam_confirm_input, index == 0)
+	if index != 0:
+		steam_confirm_input.text = ""
 	steam_legal_check.visible = index == 0
 	steam_username_input.placeholder_text = "Choose a username" if index == 0 else "Existing email or username"
 
@@ -863,7 +869,7 @@ func _on_steam_action_changed(index: int) -> void:
 func _complete_steam() -> void:
 	var action := "create" if steam_action.selected == 0 else "link"
 	if action == "create":
-		var validation := _validate_account(steam_username_input.text.strip_edges(), steam_email_input.text.strip_edges(), steam_password_input.text, steam_password_input.text)
+		var validation := _validate_account(steam_username_input.text.strip_edges(), steam_email_input.text.strip_edges(), steam_password_input.text, steam_confirm_input.text)
 		if not validation.is_empty(): return _show_error(validation)
 		if not steam_legal_check.button_pressed:
 			return _show_error("Agree to the Terms of Service and acknowledge the Privacy Policy to create an account.")
@@ -876,6 +882,15 @@ func _complete_steam() -> void:
 	}, "Connecting account...")
 
 
+func _set_field_visible(input: LineEdit, visible_value: bool) -> void:
+	input.visible = visible_value
+	var index := input.get_index()
+	if index > 0:
+		var label := input.get_parent().get_child(index - 1)
+		if label is Label:
+			label.visible = visible_value
+
+
 func _on_steam_completed(result: int, code: int, _headers: PackedStringArray, body: PackedByteArray) -> void:
 	_set_busy(false)
 	if result != HTTPRequest.RESULT_SUCCESS or code < 200 or code >= 300:
diff --git a/tests/steam_login_test.gd b/tests/steam_login_test.gd
index 7dda5c8..f104ad6 100644
--- a/tests/steam_login_test.gd
+++ b/tests/steam_login_test.gd
@@ -15,6 +15,7 @@ func _run() -> void:
 	_test_elapsed_timeout_clears_flow()
 	_test_transient_failure_keeps_transaction()
 	_test_leaving_completion_cancels_flow()
+	_test_external_account_password_confirmation()
 	login.queue_free()
 	await process_frame
 	quit(1 if failures > 0 else 0)
@@ -47,6 +48,19 @@ func _test_leaving_completion_cancels_flow() -> void:
 	_assert(login.poll_timer.is_stopped(), "leaving Steam account completion should stop polling")
 
 
+func _test_external_account_password_confirmation() -> void:
+	login._on_steam_action_changed(0)
+	_assert(login.steam_confirm_input.visible, "new external accounts should show password confirmation")
+	_assert(login.steam_confirm_input.secret, "external password confirmation should be masked")
+	_assert(
+		login._validate_account("new_user", "new@example.com", "password-one", "password-two") == "Passwords do not match.",
+		"external account creation should reject mismatched passwords")
+	login.steam_confirm_input.text = "password-one"
+	login._on_steam_action_changed(1)
+	_assert(not login.steam_confirm_input.visible, "existing-account linking should hide password confirmation")
+	_assert(login.steam_confirm_input.text.is_empty(), "hidden confirmation text should be cleared")
+
+
 func _assert(condition: bool, message: String) -> void:
 	if condition:
 		return