kanban: render the login form through morph::forms (#357)

* kanban: render the login form through morph::forms

`examples/LADDER.md` designates kanban the ladder's single polished
showcase, and its GUI used none of `morph::forms`: seven QML files, 26
hand-written input controls, and zero schema-driven forms. That is what
`examples/IMPLEMENTATION.md` rule 2 forbids by default, and the rung README
recorded the gap without supplying either justification rule 2 allows.

Triage settled which of the two applies by running the experiment rather
than arguing it: `morph::forms::schemaJson<A>()` compiled against this rung's
real, unmodified DTOs produces a usable schema for `Login`, `CreateColumn`,
`CreateSwimlane`, `CreateTask`, `AddComment` and `MoveTaskPosition` alike.
The rule-3 strong ids are not a blocker -- `TaskId` emits as
`{"type":["integer","null"],...}` under `$defs`, and `DynamicForm` resolves
`$ref` into `$defs` -- and `MoveTaskPosition::optionalFields` is honoured. So
justification (a), "the generated UI cannot express the interaction", is not
available for any of the form-shaped inputs here.

`LoginView.qml` is converted first: it is the smallest complete instance of
the whole path -- schema document, controller contract, shipped renderer,
typed reply -- and it establishes the pattern the remaining screens follow.
It now has no hand-written field and no hand-written submit button; if
`Login` grows a second member, that file does not change.

`Login` gains `explicitSubmit = true` so the renderer draws its own Submit
button. Without it `DynamicForm` submits as soon as every required field is
`ready`, which for a one-field login means firing mid-typing on the first
username prefix that happens to be a valid principal.

`ProjectAdminBridge` grows the controller contract the renderer calls:
`schemasJson` and `submitIfValid`, forwarding to a presenter `submitForm`
that dispatches through the type-erased `executeJson` path. `login` is
demoted from `Q_INVOKABLE` to a plain method -- nothing in `gui/qml/` calls
it any more, and dead QML surface is exactly what
`test_kanban_qml_surface.cpp` exists to catch. `submitIfValid` needs an
audit exemption for the opposite reason: its caller is the shipped
`DynamicForm.qml`, outside this rung's tree, which the audit does not scan.

`replyReceived` introduces a seam this rung did not have -- it broadcasts a
result JSON to every bound QML handler, and `Login`'s result carries the
token. `submitForm` redacts the token from its copy, and a new test asserts
that directly; the pre-existing signal-parameter sweep only sees `QString`
and could not have caught a leak through it. That test's comment claimed
this rung had no such seam at all, which is no longer true, so it is
rewritten rather than left to mislead.

The README's "not exercised" paragraph becomes a per-element rule-2 ledger
naming what is still hand-built, which action is behind it, and why each one
is unjustified -- with the drag-and-drop board the single plausible (a).

Verified on a `MORPH_BUILD_LADDER=ON -DMORPH_BUILD_FORMS_QML=ON` configure:
140 kanban tests pass, including the offscreen QML smoke test that loads
Main.qml and every file reachable from it. That test was mutation-checked by
pointing the import at a non-existent module, which fails it -- so its pass
is real evidence the renderer resolves, not a vacuous one.

Part of #344; the remaining screens are still to convert.

Signed-off-by: Yaraslau Tamashevich <yaraslau.tamashevich@gmail.com>

* kanban: clang-format the forms-conversion changes

The whole-tree clang-format gate flagged the presenter, the QML bridge and
their test. No behaviour change; all 140 kanban cases still pass.

Signed-off-by: Yaraslau Tamashevich <yaraslau.tamashevich@gmail.com>

---------

Signed-off-by: Yaraslau Tamashevich <yaraslau.tamashevich@gmail.com>

Author: Yaraslaut

examples/kanban/README.md

@@ -124,25 +124,45 @@ Strand ordering under real contention (2), typed server-side validation (3),
 authorization at Kanboard's granularity (4), journal-derived activity + undo
 (5, 6), the full offline stack (7), shared board instances throughout.
 
-**Not exercised: `morph::forms`.** Every screen in `gui/qml/` is hand-built
-Qt Quick. The rung's source trees hold three comment lines mentioning
-`MorphForms`/`FormsController` and no code that uses either, and every input
-is a hand-written `TextField`/`ComboBox`/`SpinBox`
-(`gui/qml/LoginView.qml:63`, `gui/qml/RulesView.qml:89`, `:97`, `:103`,
-`gui/qml/MembersView.qml:56`, `:81`, `:87`,
-`gui/qml/ProjectListView.qml:125`, plus `gui/qml/BoardView.qml`'s
-column/task/comment entry fields and `gui/qml/TaskDetailPopup.qml`'s comment
-field).
-[`IMPLEMENTATION.md`](../IMPLEMENTATION.md)'s rule 2 forbids hand-built input
-widgets by default and requires a written justification here for each one; no
-such justification has been written, and the GUI design spec the QML comments
-point at (`docs/superpowers/specs/2026-08-17-kanban-gui-design.md` §4)
-settles the bridge/property-bag architecture without addressing forms at all.
-Recorded as
-[#344](https://github.com/LASTRADA-Software/morph/issues/344) (the
-flagship-GUI forms-bypass finding) rather than justified after the fact here:
-deciding *which* of rule 2's two justifications applies is a design call this
-rung has not made.
+**`morph::forms`: the login form only.** `gui/qml/LoginView.qml` renders
+`Login` through `morph::forms::schemaJson<Login>()` and the shipped
+`MorphForms` `DynamicForm`, submitting via the renderer's own explicit Submit
+button — the same shape `bookmarks`, `polls`, `lims` and `pastebin` ship. It
+has no hand-written field and no hand-written submit button; if `Login` grows
+a second member, that file does not change.
+
+Every *other* input in this rung is still hand-built Qt Quick, which
+[`IMPLEMENTATION.md`](../IMPLEMENTATION.md)'s rule 2 forbids by default and
+which this README owes a per-element justification for. It does not have one,
+and the honest position is that most of these have no justification available:
+
+| Hand-built input | Action behind it | Rule 2 status |
+|---|---|---|
+| `gui/qml/RulesView.qml:89`, `:97`, `:103` | rule definition | **Unjustified.** Not yet attempted through the renderer. |
+| `gui/qml/MembersView.qml:56`, `:81`, `:87` | `SetMemberRole` / `RemoveMember` | **Unjustified.** A principal string plus a role `enum class` is squarely in the forms palette. |
+| `gui/qml/ProjectListView.qml:125` | `CreateProject` | **Unjustified.** One `std::string name`. |
+| `gui/qml/BoardView.qml` column/task/comment entry | `CreateColumn`, `CreateSwimlane`, `CreateTask`, `AddComment` | **Unjustified.** `schemaJson<A>()` renders all four today — verified, see below. |
+| `gui/qml/BoardView.qml` drag-and-drop board | `MoveTaskPosition` | **Rule 2(a), plausibly.** A drag gesture is not a form somebody fills in; a schema-rendered version of it would be beside the point. Still owes a written finding if kept. |
+
+The claim in that last column is measured, not assumed:
+`morph::forms::schemaJson<A>()` was compiled against this rung's real,
+unmodified DTOs and produces a usable schema for `Login`, `CreateColumn`,
+`CreateSwimlane`, `CreateTask`, `AddComment` and `MoveTaskPosition` alike.
+The rule-3 strong ids are not a blocker — `TaskId` emits as
+`{"type":["integer","null"],…}` under `$defs`, and `DynamicForm` resolves
+`$ref` into `$defs` — and `MoveTaskPosition::optionalFields` is honoured.
+So rule 2's justification (a), "the generated UI *cannot* express the
+interaction", is **not available** for any of the form-shaped rows above.
+
+That leaves converting them, which is tracked as
+[morph#344](https://github.com/LASTRADA-Software/morph/issues/344). Login went
+first because it is the smallest complete instance of the whole path — schema
+document, controller contract, renderer, typed reply — and it establishes the
+pattern the rest follow. The rung's GUI design spec
+(`docs/superpowers/specs/2026-08-17-kanban-gui-design.md` §4) settles the
+two-bridge/property-bag architecture and never mentions forms, schemas or
+`DynamicForm`, so it was never the justification the QML comments treated it
+as.
 
 ## Expected strain points
 

examples/kanban/gui/qml/LoginView.qml

@@ -1,41 +1,61 @@
 // SPDX-License-Identifier: Apache-2.0
 //
-// kanban's first screen. Dev-mode login: a username field, no password, no
-// schema-driven form -- unlike bookmarks/polls/pastebin, this rung's GUI
-// design spec (docs/superpowers/specs/2026-08-17-kanban-gui-design.md §4)
-// binds plain QVariantMap/QVariantList property bags rather than MorphForms'
-// DynamicForm, so Login's one field is a hand-built TextField here.
+// kanban's first screen. One schema-driven form and nothing else — no
+// hand-built username field and no hand-built submit button: the generated
+// form renders `Login`'s single `std::string username` member with its
+// required-gate, and the renderer's own Submit button submits it
+// (examples/IMPLEMENTATION.md rule 2, "schema-driven forms only"). If `Login`
+// ever grows a second field, this file does not change.
+//
+// This screen used to be a hand-built `TextField` + `Button`, on the strength
+// of this rung's GUI design spec
+// (docs/superpowers/specs/2026-08-17-kanban-gui-design.md §4) — which settles
+// the two-bridge/property-bag architecture and says nothing about forms at
+// all, so it never justified the exception rule 2 requires. See morph#344, and
+// the rung README's "morph subsystems exercised" section for what is still
+// hand-built here and what that costs.
 //
 // `projectAdminBridge` defaults to null so this same file also loads with
 // nothing wired up, which is exactly what the offscreen engine-load smoke
-// test (tests/test_gui_qml_smoke.cpp) does.
+// test (tests/test_gui_qml_smoke.cpp) does — and why `loginSchema` is read
+// defensively below rather than assuming a live bridge.
 
 pragma ComponentBehavior: Bound
 
 import QtQuick
 import QtQuick.Controls
 import QtQuick.Layouts
+import MorphForms
 
 Item {
     id: page
 
     /// The ProjectAdminBridge gui/main.cpp builds, or null when unwired.
     property var projectAdminBridge: null
 
+    /// schemaJson<Login>(), parsed out of the bridge's schema document.
+    /// `({})` while unwired, which is what the smoke test loads.
+    readonly property var loginSchema: page.projectAdminBridge === null
+                                       ? ({})
+                                       : (JSON.parse(page.projectAdminBridge.schemasJson)["Login"] || ({}))
+
     /// Whatever the last login attempt reported, shown verbatim.
     property string status: ""
     property bool statusIsError: false
 
     Connections {
         target: page.projectAdminBridge
 
-        // Main.qml navigates on the successful loggedIn(principal) signal --
-        // this only has to show a failure ("invalid principal", "handler not
-        // bound", ...) rather than leave the user staring at a button that
-        // seemed to do nothing.
-        function onFailed(message) {
-            page.status = message
-            page.statusIsError = true
+        // Login's outcome arrives here like every other form's. Main.qml
+        // navigates on the successful loggedIn(principal) signal -- this only
+        // has to show a failure ("invalid principal", "handler not bound",
+        // ...) rather than leave the user staring at a button that seemed to
+        // do nothing.
+        function onReplyReceived(actionType, ok, payload) {
+            if (actionType !== "Login")
+                return
+            page.status = ok ? "" : payload
+            page.statusIsError = !ok
         }
     }
 
@@ -60,23 +80,17 @@ Item {
                   + "kanban/dto/auth_dto.hpp for exactly what that does and does not mean."
         }
 
-        TextField {
-            id: usernameField
-            Layout.fillWidth: true
-            placeholderText: "username"
-            onAccepted: signInButton.clicked()
-        }
-
-        Button {
-            id: signInButton
+        DynamicForm {
             Layout.fillWidth: true
-            text: "Sign in"
-            enabled: page.projectAdminBridge !== null && usernameField.text.length > 0
-            onClicked: {
-                page.status = ""
-                page.statusIsError = false
-                page.projectAdminBridge.login(usernameField.text)
-            }
+            actionType: "Login"
+            schema: page.loginSchema
+            // Bound, and safe to bind: `Login` declares `explicitSubmit = true`
+            // (kanban/dto/auth_dto.hpp), so its schema carries
+            // `"x-submitMode": "explicit"` and the renderer never auto-submits
+            // -- it renders its own Submit button, gated on the same `ready`
+            // state, and that click is the sole trigger
+            // (docs/spec/forms/forms.md, "Explicit submit mode").
+            controller: page.projectAdminBridge
         }
 
         Label {

examples/kanban/gui_lib/kanban_schemas.hpp

@@ -0,0 +1,36 @@
+// SPDX-License-Identifier: Apache-2.0
+#pragma once
+
+#include <morph/forms/forms.hpp>
+#include <string>
+
+#include "kanban/dto/auth_dto.hpp"
+
+/// @file
+/// The `{actionType: schemaJson<A>()}` document kanban's schema-driven forms
+/// render from.
+///
+/// One place, so every shell that builds a `ProjectAdminBridge` — the desktop
+/// client and the tests alike — renders from the same document rather than
+/// each assembling its own. Mirrors `bookmarks/gui_lib/bookmark_schemas.hpp`,
+/// which established the shape.
+///
+/// **Only `Login` is here today.** This rung's other inputs are still
+/// hand-built Qt Quick, which `examples/IMPLEMENTATION.md` rule 2 forbids by
+/// default — see the rung README's "morph subsystems exercised" section for
+/// the per-element accounting and morph#344 for why they are not all converted
+/// at once.
+
+namespace kanban::gui {
+
+/// @brief Builds the schema document for every action this rung renders.
+///
+/// Not cached here: `morph::forms::schemaJson<A>()` already memoises one
+/// string per compiled action type, so the only cost repeated here is the
+/// concatenation, which happens once per shell at construction.
+/// @return `{actionType: schema}` JSON.
+[[nodiscard]] inline std::string kanbanSchemasJson() {
+    return std::string{"{\"Login\":"} + ::morph::forms::schemaJson<kanban::Login>() + "}";
+}
+
+}  // namespace kanban::gui

examples/kanban/gui_lib/project_admin_presenter.cpp

@@ -1,7 +1,9 @@
 // SPDX-License-Identifier: Apache-2.0
 #include "project_admin_presenter.hpp"
 
+#include <glaze/glaze.hpp>
 #include <morph/session/session.hpp>
+#include <string>
 #include <utility>
 
 #include "gui/error_text.hpp"
@@ -33,6 +35,57 @@ void ProjectAdminPresenter::login(const QString& username) {
         [this](const std::exception_ptr& err) { reportError(err); });
 }
 
+void ProjectAdminPresenter::submitForm(const QString& actionType, const QString& bodyJson) {
+    // `executeJson` is the type-erased counterpart of the typed `execute`
+    // calls below: the schema renderer only ever knows an action by the string
+    // the schema names it with. Routing is a single handler today because
+    // `Login` is the only schema-driven form in this rung — see
+    // `kanban_schemas.hpp` and morph#344. When a second model's action joins
+    // the document, this becomes the same actionType->handler table
+    // `bookmarks::gui::BookmarkFormsController::dispatch` already has, and the
+    // unroutable case must report rather than silently drop: QML names types
+    // as strings, so a typo has to arrive somewhere a human reads it.
+    const std::string type = actionType.toStdString();
+    if (type != "Login") {
+        emit formReplyReceived(actionType, false,
+                               QStringLiteral("no model in this client serves action '") + actionType + u'\'');
+        return;
+    }
+    track<std::string>(
+        _authHandler.executeJson(type, bodyJson.toStdString()),
+        [this, actionType](std::string resultJson) {
+            // A successful Login is the one reply this client reads rather
+            // than merely displays: the token has to be installed before
+            // anything else dispatches.
+            // The same glaze reflection the wire used, so nothing here parses
+            // JSON by hand; `read_json` returns a truthy error context on
+            // failure. Named the same way, for the same reason, as
+            // `bookmarks::gui::decodeLoginResult`.
+            LoginResult result;
+            if (glz::read_json(result, resultJson)) {
+                emit formReplyReceived(actionType, false,
+                                       QStringLiteral("login succeeded but its reply could not be decoded"));
+                return;
+            }
+            onLoginSucceeded(result);
+            // The token has already done its one job -- installed onto the
+            // session above -- so it has no reason to leave this function.
+            // `formReplyReceived` reaches every bound QML handler, and one
+            // that rendered `payload` unconditionally would otherwise put a
+            // live bearer credential on screen (and into any screenshot of
+            // it). Re-encoding a redacted copy keeps the signal's shape
+            // unchanged rather than making this a QML surface change. Same
+            // reasoning, and the same redaction, as
+            // `bookmarks::gui::FormsBridge::submitIfValid`.
+            LoginResult redacted = result;
+            redacted.token = AuthToken{};
+            emit formReplyReceived(actionType, true, QString::fromStdString(glz::write_json(redacted).value_or("{}")));
+        },
+        [this, actionType](const std::exception_ptr& err) {
+            emit formReplyReceived(actionType, false, ::morph::ladder::gui::errorText(err));
+        });
+}
+
 void ProjectAdminPresenter::refreshProjects() {
     track<GetMyProjectsResult>(
         _projectHandler.execute(GetMyProjects{}),

examples/kanban/gui_lib/project_admin_presenter.hpp

@@ -50,6 +50,21 @@ class ProjectAdminPresenter : public ::morph::ladder::gui::Presenter {
     /// @param username The identity to log in as.
     void login(const QString& username);
 
+    /// @brief Dispatches @p bodyJson as @p actionType's body through the
+    ///        type-erased `executeJson` path, for the schema-driven forms
+    ///        `DynamicForm` renders.
+    ///
+    /// The schema renderer names action types as strings and hands back an
+    /// assembled JSON body, so this is the entry point it needs — the typed
+    /// `login()` above stays for callers that already have a `QString`
+    /// username. A successful `Login` still installs its token here rather
+    /// than in the QML bridge, so the one place this rung learns an identity
+    /// is unchanged by which of the two paths dispatched it.
+    ///
+    /// @param actionType Registered action type id, as the schema names it.
+    /// @param bodyJson   Fully-assembled JSON body, as `DynamicForm` builds it.
+    void submitForm(const QString& actionType, const QString& bodyJson);
+
     /// @brief Lists every project the caller has any role on. Emits
     ///        `projectsListed` on success, `failed` on error.
     void refreshProjects();
@@ -107,6 +122,18 @@ class ProjectAdminPresenter : public ::morph::ladder::gui::Presenter {
     ///        `std::exception::what()`, ready for direct display.
     void failed(QString message);
 
+    /// @brief Emitted once per `submitForm`, carrying that form's outcome.
+    ///
+    /// Separate from `failed` because a form's own view shows its own result
+    /// inline, next to the fields that produced it, rather than through the
+    /// shell's shared error surface.
+    /// @param actionType The action the reply belongs to.
+    /// @param ok         Whether the dispatch succeeded.
+    /// @param payload    Result JSON on success, the error message otherwise.
+    ///                   A successful `Login`'s token is redacted first — see
+    ///                   `submitForm`'s definition.
+    void formReplyReceived(QString actionType, bool ok, QString payload);
+
 private:
     /// @brief Installs @p result's token as the shared `Bridge`'s default
     ///        session, so every subsequent action from every presenter

examples/kanban/gui_lib/project_admin_qml_bridge.cpp

@@ -6,6 +6,7 @@
 #include <utility>
 
 #include "gui/id_qml.hpp"
+#include "kanban_schemas.hpp"
 
 namespace kanban::gui {
 
@@ -78,10 +79,17 @@ ProjectAdminBridge::ProjectAdminBridge(::morph::bridge::Bridge& bridge, ::morph:
     connect(&_presenter, &ProjectAdminPresenter::memberRoleSet, this, &ProjectAdminBridge::memberRoleSet);
     connect(&_presenter, &ProjectAdminPresenter::memberRemoved, this, &ProjectAdminBridge::memberRemoved);
     connect(&_presenter, &ProjectAdminPresenter::failed, this, &ProjectAdminBridge::failed);
+    connect(&_presenter, &ProjectAdminPresenter::formReplyReceived, this, &ProjectAdminBridge::replyReceived);
 }
 
+QString ProjectAdminBridge::schemasJson() const { return QString::fromStdString(kanbanSchemasJson()); }
+
 void ProjectAdminBridge::login(const QString& username) { _presenter.login(username); }
 
+void ProjectAdminBridge::submitIfValid(const QString& actionType, const QString& bodyJson) {
+    _presenter.submitForm(actionType, bodyJson);
+}
+
 void ProjectAdminBridge::refreshProjects() { _presenter.refreshProjects(); }
 
 void ProjectAdminBridge::createProject(const QString& name) { _presenter.createProject(name); }