From 1fae314eb4f79b0b56525f3aabc679826f2d2504 Mon Sep 17 00:00:00 2001
From: Sam Rolfe <samuelrolfe@gmail.com>
Date: Mon, 10 Aug 2026 17:04:21 +1000
Subject: [PATCH] tag claim flow: scanned code auto-fills Add Tag field
 (?code=), unclaimed tag page shows 'Add this tag to my account' when logged
 in, login honors next= so code survives the login step

---
 frontend/internal/handlers/auth.go     | 12 ++++++++++--
 frontend/internal/handlers/tag_page.go |  3 +++
 frontend/internal/handlers/tags.go     |  8 +++++---
 frontend/templates/account-panel.html  |  2 +-
 frontend/templates/tag-public.html     |  6 +++++-
 5 files changed, 24 insertions(+), 7 deletions(-)

diff --git a/frontend/internal/handlers/auth.go b/frontend/internal/handlers/auth.go
index c5ce95a..ea52251 100644
--- a/frontend/internal/handlers/auth.go
+++ b/frontend/internal/handlers/auth.go
@@ -64,7 +64,11 @@ func (a *App) Register(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}
-	http.Redirect(w, r, "/account", http.StatusSeeOther)
+	next := r.FormValue("next")
+	if next == "" || !strings.HasPrefix(next, "/") || strings.HasPrefix(next, "//") {
+		next = "/account"
+	}
+	http.Redirect(w, r, next, http.StatusSeeOther)
 }
 
 func (a *App) LoginPage(w http.ResponseWriter, r *http.Request) {
@@ -93,7 +97,11 @@ func (a *App) Login(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}
-	http.Redirect(w, r, "/account", http.StatusSeeOther)
+	next := r.FormValue("next")
+	if next == "" || !strings.HasPrefix(next, "/") || strings.HasPrefix(next, "//") {
+		next = "/account"
+	}
+	http.Redirect(w, r, next, http.StatusSeeOther)
 }
 
 func (a *App) Logout(w http.ResponseWriter, r *http.Request) {
diff --git a/frontend/internal/handlers/tag_page.go b/frontend/internal/handlers/tag_page.go
index 00ebe1f..dde1e65 100644
--- a/frontend/internal/handlers/tag_page.go
+++ b/frontend/internal/handlers/tag_page.go
@@ -13,6 +13,7 @@ import (
 type publicData struct {
 	UpdatedAt   pgtype.Timestamptz
 	Preview     bool
+	Authed      bool
 	ID          int64
 	TagCode     string
 	Status      string
@@ -48,8 +49,10 @@ func (a *App) PublicTag(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	_, authed := auth.GetUserID(r)
 	pd := publicData{
 		Preview:     r.URL.Query().Get("preview") == "1",
+		Authed:      authed,
 		UpdatedAt:   tag.UpdatedAt,
 		ID:          tag.ID,
 		TagCode:     tag.TagCode,
diff --git a/frontend/internal/handlers/tags.go b/frontend/internal/handlers/tags.go
index 3d82010..59ada23 100644
--- a/frontend/internal/handlers/tags.go
+++ b/frontend/internal/handlers/tags.go
@@ -18,8 +18,9 @@ import (
 const maxTagsPerAccount = 20
 
 type accountData struct {
-	Tags     []db.Tag
-	AddError string
+	Tags       []db.Tag
+	AddError   string
+	AddTagCode string
 }
 
 func ownerID(uid int64) pgtype.Int8 {
@@ -33,7 +34,7 @@ func (a *App) Account(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}
-	a.render(w, r, "account", "My Tags", accountData{Tags: tags}, "")
+	a.render(w, r, "account", "My Tags", accountData{Tags: tags, AddTagCode: r.URL.Query().Get("code")}, "")
 }
 
 // AddTag binds a tag code to the current account (HTMX: returns account-panel).
@@ -44,6 +45,7 @@ func (a *App) AddTag(w http.ResponseWriter, r *http.Request) {
 	oid := ownerID(uid)
 	data := accountData{}
 
+	data.AddTagCode = code
 	if code == "" {
 		data.AddError = "Enter a tag code."
 	} else {
diff --git a/frontend/templates/account-panel.html b/frontend/templates/account-panel.html
index 167831f..93623ac 100644
--- a/frontend/templates/account-panel.html
+++ b/frontend/templates/account-panel.html
@@ -4,7 +4,7 @@
 
   <div class="mt-4 rounded-xl border border-stone-200 bg-white p-4 shadow-sm">
     <form hx-post="/account/tags" hx-target="#account-panel" hx-swap="outerHTML" class="flex gap-2">
-      <input name="tag_code" type="text" placeholder="Enter tag code (e.g. TEST000001)" class="flex-1 rounded border border-stone-300 px-3 py-2 text-sm" required>
+      <input name="tag_code" type="text" value="{{.AddTagCode}}" placeholder="Enter tag code (e.g. TEST000001)" class="flex-1 rounded border border-stone-300 px-3 py-2 text-sm" required autofocus>
       <button type="submit" class="rounded bg-stone-900 px-4 py-2 text-sm font-semibold text-white hover:bg-stone-700">Add tag</button>
       <span class="htmx-indicator self-center text-xs text-stone-400">Adding…</span>
     </form>
diff --git a/frontend/templates/tag-public.html b/frontend/templates/tag-public.html
index 348cf70..4cd592e 100644
--- a/frontend/templates/tag-public.html
+++ b/frontend/templates/tag-public.html
@@ -6,8 +6,12 @@
       <h1 class="mt-4 text-2xl font-bold">This tag isn't set up yet</h1>
       <p class="mt-2 text-stone-600">This Where Woof tag hasn't been claimed. If this is your tag, log in and add it to your account to set up the return details.</p>
       <div class="mt-6 flex justify-center gap-3">
-        <a href="/login" class="rounded bg-stone-900 px-4 py-2 text-sm font-semibold text-white hover:bg-stone-700">Log in</a>
+        {{if .Data.Authed}}
+        <a href="/account?code={{.Data.TagCode}}" class="rounded bg-stone-900 px-4 py-2 text-sm font-semibold text-white hover:bg-stone-700">➕ Add this tag to my account</a>
+        {{else}}
+        <a href="/login?next=/account?code={{.Data.TagCode}}" class="rounded bg-stone-900 px-4 py-2 text-sm font-semibold text-white hover:bg-stone-700">Log in</a>
         <a href="/register" class="rounded bg-amber-500 px-4 py-2 text-sm font-semibold text-stone-900 hover:bg-amber-400">Create account</a>
+        {{end}}
       </div>
     </div>
   {{else if eq .Data.Status "suspended"}}