From ccb4d32d39adce15b6c7911b890ad273e13f62e3 Mon Sep 17 00:00:00 2001
From: Lilleman auf Larv <lilleman@larvit.se>
Date: Sat, 31 Oct 2026 12:59:28 +0100
Subject: [PATCH] =?UTF-8?q?Answer=20prose=20round=201:=200=20=F0=9F=94=B4,?=
 =?UTF-8?q?=204=20=F0=9F=9F=A1=20(0=20misread);=20comments=20say=20what=20?=
 =?UTF-8?q?the=20forms=20post=20where,=20restating=20test=20comments=20go?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/auth/flow-view.test.ts | 1 -
 src/auth/flow-view.ts      | 6 +++---
 todo.md                    | 2 +-
 views/auth.ejs             | 6 +++---
 4 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/src/auth/flow-view.test.ts b/src/auth/flow-view.test.ts
index 7f46936..6cf8527 100644
--- a/src/auth/flow-view.test.ts
+++ b/src/auth/flow-view.test.ts
@@ -101,7 +101,6 @@ test("collects oidc nodes as SSO providers (text logo = initial), keeping csrf a
 });
 
 test("the code field takes a pasted code: one-time-code autofill + numeric inputmode + digits, whitespace around them allowed", () => {
-  // The host trims the code before Kratos sees it (routes.ts), so only a stray non-digit is refused.
   const view = buildFlowView(
     flow([
       node({ name: "csrf_token", type: "hidden", value: "tok" }),
diff --git a/src/auth/flow-view.ts b/src/auth/flow-view.ts
index 6a41a95..da0ad25 100644
--- a/src/auth/flow-view.ts
+++ b/src/auth/flow-view.ts
@@ -69,7 +69,7 @@ export const AUTH_FLOWS: Record<string, FlowType> = {
   "/verification": "verification",
 };
 
-// The flows that take an emailed one-time code, whose form posts to the host to have it trimmed.
+// The flows that take an emailed one-time code. Their form posts to the host, which trims the code.
 export const CODE_FLOWS: ReadonlySet<FlowType> = new Set(["recovery", "verification"]);
 
 // Where each flow's card links; its words come from the catalog under `auth.<flow>.*`.
@@ -126,8 +126,8 @@ const ssoLogo = (value: string): string => (value.charAt(0) || "?").toUpperCase(
 
 function toField(node: UiNode, name: string, type: string, t: Translate): FlowField {
   const value = str(node.attributes["value"]);
-  // The recovery/verification one-time code: numeric, so a numeric keypad and a digits pattern, which
-  // allows the whitespace a paste brings since the host trims it (routes.ts → codeFlowSubmit).
+  // The recovery/verification one-time code is numeric: a numeric keypad and a digits pattern. The
+  // pattern allows whitespace around the digits, as a paste brings; routes.ts → codeFlowSubmit trims it.
   // one-time-code enables OS/email autofill (Kratos sends no autocomplete for the node).
   const isCode = name === "code";
   const autocomplete = str(node.attributes["autocomplete"]) ?? (isCode ? "one-time-code" : undefined);
diff --git a/todo.md b/todo.md
index c7ffc71..9c1dcb5 100644
--- a/todo.md
+++ b/todo.md
@@ -29,7 +29,7 @@
 ### 45. Link the admin's recovery-code notice to the flow the code was minted on, so the user can enter it.
 
 The notice (`examples/plugins/admin/views/partials/user-form-body.ejs`) links a bare `/recovery`,
-which starts a fresh flow at its email step. Kratos binds an admin-minted code to the flow it minted,
+which starts a fresh flow at its email step. Kratos binds an admin-minted code to the flow it was minted on,
 whose URL is the `recovery_link` that `createRecoveryCode` returns as `RecoveryCode.link`. Render that
 link instead.
 
diff --git a/views/auth.ejs b/views/auth.ejs
index 76c60f8..9bfae0b 100644
--- a/views/auth.ejs
+++ b/views/auth.ejs
@@ -1,9 +1,9 @@
 <%#
   Themed Kratos self-service page inside the unified app shell: sign-in / register /
   reset / verify / settings. Renders a FlowView (src/auth/flow-view.ts) into the shell content, reusing the
-  auth-card + field partials. The form posts to flow.action — Kratos owns its CSRF. The
-  shell's menu is permission-filtered (anonymous ⇒ public items + Sign in); the topbar carries no heading,
-  so the card's own <h1> is the page's single heading. Data: chrome (PageChrome), flow (FlowView).
+  auth-card + field partials. The shell's menu is permission-filtered (anonymous ⇒ public items +
+  Sign in); the topbar carries no heading, so the card's own <h1> is the page's single
+  heading. Data: chrome (PageChrome), flow (FlowView).
 %><%
   const nav = include("partials/nav-tree", { nodes: chrome.nav });
   const card = include("partials/auth-card", {