fix(ui): M6 recheck-1 frontend - preview-by-token/id, idempotent wizard, empty PKCE secret

R1-P1-2: previewExclusions DTO now carries localPathToken (new candidate)
or sourceId (existing source) instead of a raw localPath; AddSourceWizard
sends the dialog token, SourceTable's edit-exclusions sends the source id.
R1-P2-3: setup store createFirstSource is idempotent - it short-circuits
when sourceId is already set, so re-entering the encryption step (Back from
confirm, then Next) does not re-call add_source with a consumed token.
R1-P2-4: CredentialsWalkthrough canSubmit requires only a non-empty client
ID (a PKCE installed-app client legitimately has an empty secret).

Tests: SourceTable preview-by-sourceId, createFirstSource re-entry is a
no-op, empty-secret submit allowed + forwarded, blocked with no client ID.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CyiRqk2DVwmJjEu5gcD1m

Author: pmaxhogan

ui/src/__tests__/settings-components.test.ts

@@ -209,11 +209,11 @@ describe("SourceTable", () => {
     const editor = wrapper.get('[data-testid="exclusion-editor"]');
     expect(invokeMock).toHaveBeenCalledWith(
       "preview_exclusions",
-      // The `previewExclusions` IPC wrapper nests the request under `req`
-      // (matching the Rust `preview_exclusions(req: ExclusionPreviewRequest)`
-      // signature), so the localPath lives at `req.localPath`.
+      // R1-P1-2: an EXISTING source is previewed by its id (the backend resolves
+      // the local path from SQLite), NEVER a raw webview path. The wrapper nests
+      // the request under `req` (matching the Rust signature).
       expect.objectContaining({
-        req: expect.objectContaining({ localPath: "/home/u/docs" }),
+        req: expect.objectContaining({ sourceId: "src-1" }),
       }),
     );
     const excludeArea = editor.findAll("textarea")[1];

ui/src/__tests__/setup-wizard.test.ts

@@ -34,6 +34,7 @@ vi.mock("@tauri-apps/api/event", () => ({
 
 import { i18n } from "../i18n";
 import SetupWizard from "../views/SetupWizard.vue";
+import CredentialsWalkthrough from "../components/CredentialsWalkthrough.vue";
 import { useSetupStore } from "../stores/setup";
 import { useSourcesStore } from "../stores/sources";
 
@@ -189,6 +190,36 @@ describe("setup store OAuth sequence (SPEC s11.1)", () => {
     expect(sources.sources).toHaveLength(1);
   });
 
+  it("createFirstSource is idempotent - re-entry does not re-call add_source (R1-P2-3)", async () => {
+    // The one-shot folder dialog token is CONSUMED by the backend on the first
+    // add_source. Re-entering the encryption step (Back from confirm, then Next
+    // again) must NOT re-call add_source - it would fail with a stale token and
+    // wedge the wizard. Assert the second createFirstSource is a no-op.
+    const setup = useSetupStore();
+    setup.accountId = "acct-1";
+    setup.localPath = "/home/user/Docs";
+    setup.localPathToken = "tok-folder";
+    setup.driveFolderId = "drive-folder-1";
+    setup.driveFolderPath = "/Backups/Docs";
+    setup.encryptionEnabled = true;
+
+    await setup.createFirstSource();
+    expect(setup.sourceId).toBe("src-1");
+    const addCallsAfterFirst = invokeMock.mock.calls.filter(
+      (c) => c[0] === "add_source",
+    ).length;
+    expect(addCallsAfterFirst).toBe(1);
+
+    // Re-enter the step: createFirstSource must short-circuit (no second add).
+    await setup.createFirstSource();
+    const addCallsAfterSecond = invokeMock.mock.calls.filter(
+      (c) => c[0] === "add_source",
+    ).length;
+    expect(addCallsAfterSecond).toBe(1);
+    expect(setup.errorCode).toBeNull();
+    expect(setup.sourceId).toBe("src-1");
+  });
+
   it("startInitialSync scopes sync_now to the new source", async () => {
     const setup = useSetupStore();
     setup.sourceId = "src-1";
@@ -335,3 +366,54 @@ describe("SetupWizard walks all five steps (DESIGN s8.5)", () => {
     ]);
   });
 });
+
+describe("CredentialsWalkthrough empty-secret (R1-P2-4, DESIGN s6.1)", () => {
+  it("allows submit with a client ID and an EMPTY client secret", async () => {
+    // A PKCE installed-app client legitimately has no secret. The sign-in button
+    // must enable on a non-empty client ID ALONE, and submitting must pass the
+    // (empty) secret straight through to the backend.
+    installFakeBackend();
+    const wrapper = mount(CredentialsWalkthrough, {
+      global: { plugins: [i18n] },
+    });
+    await flushPromises();
+
+    const inputs = wrapper.findAll("input");
+    // Client ID only; leave the secret EMPTY.
+    await inputs[0].setValue("my-installed-app-client-id");
+    await flushPromises();
+
+    const signInBtn = wrapper
+      .findAll("button")
+      .find((b) => b.text() === i18n.global.t("wizard.step2.signInButton"));
+    expect(signInBtn).toBeTruthy();
+    // R1-P2-4: enabled despite the empty secret.
+    expect(signInBtn!.attributes("disabled")).toBeUndefined();
+
+    await signInBtn!.trigger("click");
+    await flushPromises();
+
+    // The empty secret was forwarded as-is (trimmed empty string).
+    expect(invokeMock).toHaveBeenCalledWith("submit_oauth_credentials", {
+      session: FAKE_SESSION,
+      clientId: "my-installed-app-client-id",
+      clientSecret: "",
+    });
+  });
+
+  it("still blocks submit when the client ID is empty", async () => {
+    installFakeBackend();
+    const wrapper = mount(CredentialsWalkthrough, {
+      global: { plugins: [i18n] },
+    });
+    await flushPromises();
+    const inputs = wrapper.findAll("input");
+    // Secret present but NO client ID -> still blocked.
+    await inputs[1].setValue("some-secret");
+    await flushPromises();
+    const signInBtn = wrapper
+      .findAll("button")
+      .find((b) => b.text() === i18n.global.t("wizard.step2.signInButton"));
+    expect(signInBtn!.attributes("disabled")).toBeDefined();
+  });
+});

ui/src/components/AddSourceWizard.vue

@@ -205,12 +205,14 @@ async function goToCrumb(index: number): Promise<void> {
 }
 
 async function loadPreview(): Promise<void> {
-  if (localPath.value === null) return;
+  // R1-P1-2: preview by the backend-minted dialog TOKEN (not a raw path). The
+  // token is peeked non-consumingly, so add_source still gets its single use.
+  if (localPathToken.value === null) return;
   previewLoading.value = true;
   errorMessage.value = null;
   try {
     preview.value = await ipc.previewExclusions({
-      localPath: localPath.value,
+      localPathToken: localPathToken.value,
       respectGitignore: respectGitignore.value,
       includePatterns: includePatterns.value,
       excludePatterns: excludePatterns.value,

ui/src/components/CredentialsWalkthrough.vue

@@ -29,11 +29,11 @@ const clientSecret = ref("");
 
 let unlisten: UnlistenFn | null = null;
 
+// R1-P2-4 (DESIGN s6.1): a PKCE installed-app client legitimately has an EMPTY
+// secret, so only a non-empty client ID is required to submit. The secret is
+// passed through as-is (possibly empty).
 const canSubmit = computed(
-  () =>
-    clientId.value.trim().length > 0 &&
-    clientSecret.value.trim().length > 0 &&
-    !setup.busy,
+  () => clientId.value.trim().length > 0 && !setup.busy,
 );
 
 /** Human-facing status line for the in-flight OAuth handshake. */

ui/src/components/SourceTable.vue

@@ -82,8 +82,10 @@ function cancelEdit(): void {
 async function loadEditPreview(source: SourceDto): Promise<void> {
   editPreviewLoading.value = true;
   try {
+    // R1-P1-2 (SPEC s11.6.1): preview an EXISTING source by its id - the backend
+    // resolves the local path from SQLite, never from a webview-supplied string.
     editPreview.value = await ipc.previewExclusions({
-      localPath: source.localPath,
+      sourceId: source.id,
       respectGitignore: editRespectGitignore.value,
       includePatterns: splitPatterns(editIncludeText.value),
       excludePatterns: splitPatterns(editExcludeText.value),

ui/src/ipc/types.ts

@@ -119,7 +119,12 @@ export interface DriveFolderListing {
 }
 
 export interface ExclusionPreviewRequest {
-  localPath: string;
+  // R1-P1-2 (SPEC s11.6.1): the preview root is NEVER a raw webview path. Pass
+  // EITHER the one-shot dialog token (a NEW candidate folder, from
+  // pickFolderDialog) OR an existing source id; the backend resolves the path
+  // from the token binding / SQLite. Exactly one must be set.
+  localPathToken?: string | null;
+  sourceId?: string | null;
   respectGitignore: boolean;
   includePatterns: string[];
   excludePatterns: string[];

ui/src/stores/setup.ts

@@ -195,6 +195,14 @@ export const useSetupStore = defineStore("setup", () => {
    * path + a picked Drive destination.
    */
   async function createFirstSource(): Promise<void> {
+    // R1-P2-3: idempotent. The one-shot folder dialog token is CONSUMED by the
+    // backend on the first add_source, so re-entering the encryption step (Back
+    // from confirm, then Next again) must NOT re-call add_source - it would fail
+    // with a stale/consumed token and wedge the wizard. If the source already
+    // exists, this is a no-op (the staged phrase + ack state are preserved).
+    if (sourceId.value !== null) {
+      return;
+    }
     busy.value = true;
     errorCode.value = null;
     try {