refactor(phase-2): extract auth CSS to stylesheet, harden session API, fix Firebase v10 error codes

- Move 374-line inline style block from login.php into assets/style.css (Phase 2 section)
- Add auth-page, auth-card, auth-tabs, auth-form, profile-shell and related
  classes to the main stylesheet as the single source of truth for all styles
- Fix Firebase v10 compat SDK error code: auth/invalid-credential now handled
  alongside legacy auth/wrong-password and auth/user-not-found codes
- Harden api/session.php: add Content-Type JSON header, email format validation,
  and a full security documentation comment explaining the token trust model
- Add FOUC comment to partials/head.php clarifying dark-only design intent

api/session.php

@@ -1,5 +1,22 @@
 <?php
-// PHP session synchronizer endpoint for Firebase Auth
+/**
+ * PHP Session Synchronizer for Firebase Auth
+ *
+ * This endpoint is called client-side via XHR whenever Firebase Auth detects
+ * a state change (login or logout). It creates or destroys a PHP session that
+ * mirrors the Firebase auth state, allowing server-rendered PHP pages to react
+ * to auth status.
+ *
+ * SECURITY NOTE: This endpoint accepts the Firebase UID and email from the
+ * client POST body and trusts them to set the PHP session. The Firebase ID Token
+ * is stored but NOT cryptographically verified server-side (which would require
+ * the Firebase Admin SDK or a REST call to the Google tokeninfo endpoint).
+ * This is an acceptable trade-off for a low-risk food blog, but for a
+ * production app handling sensitive data, server-side token verification
+ * via the Firebase Admin SDK should be implemented.
+ */
+
+header('Content-Type: application/json');
 
 if (session_status() === PHP_SESSION_NONE) {
     session_start();
@@ -8,32 +25,37 @@ if (session_status() === PHP_SESSION_NONE) {
 $action = $_POST['action'] ?? '';
 
 if ($action === 'login') {
-    $uid = $_POST['uid'] ?? '';
+    $uid   = trim($_POST['uid']   ?? '');
-    $email = $_POST['email'] ?? '';
+    $email = trim($_POST['email'] ?? '');
-    $token = $_POST['token'] ?? '';
+    $token = trim($_POST['token'] ?? '');
-    
+
-    if ($uid !== '') {
+    // Validate required fields – reject obviously malformed requests early
-        $_SESSION['fc_user'] = [
+    if ($uid === '' || $email === '' || !filter_var($email, FILTER_VALIDATE_EMAIL)) {
-            'uid' => $uid,
-            'email' => $email,
-            'token' => $token
-        ];
-        echo json_encode(['status' => 'success', 'message' => 'Logged in']);
-    } else {
         http_response_code(400);
-        echo json_encode(['status' => 'error', 'message' => 'Missing UID']);
+        echo json_encode(['status' => 'error', 'message' => 'Invalid or missing uid/email']);
+        exit;
     }
+
+    $_SESSION['fc_user'] = [
+        'uid'   => $uid,
+        'email' => $email,
+        'token' => $token, // Stored for potential future server-side verification
+    ];
+    echo json_encode(['status' => 'success', 'message' => 'Logged in']);
+
 } elseif ($action === 'logout') {
     $_SESSION = [];
-    if (ini_get("session.use_cookies")) {
+    if (ini_get('session.use_cookies')) {
         $params = session_get_cookie_params();
-        setcookie(session_name(), '', time() - 42000,
+        setcookie(
-            $params["path"], $params["domain"],
+            session_name(), '', time() - 42000,
-            $params["secure"], $params["httponly"]
+            $params['path'], $params['domain'],
+            $params['secure'], $params['httponly']
         );
     }
     session_destroy();
     echo json_encode(['status' => 'success', 'message' => 'Logged out']);
+
 } else {
     http_response_code(400);
     echo json_encode(['status' => 'error', 'message' => 'Invalid action']);

assets/style.css

@@ -1741,6 +1741,284 @@ body.nav-open { overflow: hidden; }
    ║  PHASE 2: AUTHENTICATION, FAVORITES & NEWSLETTER STYLES       ║
    ╚══════════════════════════════════════════════════════════════╝ */
 
+/* ── Auth Page Layout ── */
+.auth-page {
+  padding: clamp(6rem, 10vh, 10rem) var(--grid-margin) clamp(4rem, 8vh, 6rem);
+  min-height: 80vh;
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+}
+
+/* ── Auth Card ── */
+.auth-card {
+  width: 100%;
+  max-width: 500px;
+  background: var(--surface-2);
+  border: 1px solid var(--stroke);
+  box-shadow: var(--shadow);
+  border-radius: var(--radius);
+  padding: clamp(2rem, 5vw, 3.5rem);
+  position: relative;
+  overflow: hidden;
+  transition: transform 0.4s var(--ease-out-expo), opacity 0.4s ease;
+}
+
+/* ── Auth Tabs (Login / Register toggle) ── */
+.auth-tabs {
+  display: flex;
+  justify-content: center;
+  gap: 2rem;
+  margin-bottom: 2.5rem;
+  border-bottom: 1px solid var(--stroke);
+  padding-bottom: 0.8rem;
+}
+.auth-tab {
+  font-family: var(--font-serif-display);
+  font-size: 1.5rem;
+  color: var(--color-text-muted);
+  background: none;
+  border: none;
+  cursor: pointer;
+  padding: 0;
+  position: relative;
+  transition: color 0.3s ease;
+}
+.auth-tab.active {
+  color: var(--ink);
+}
+.auth-tab::after {
+  content: '';
+  position: absolute;
+  bottom: -0.9rem;
+  left: 0;
+  width: 100%;
+  height: 2px;
+  background-color: var(--color-accent-gold);
+  transform: scaleX(0);
+  transform-origin: center;
+  transition: transform 0.4s var(--ease-out-expo);
+}
+.auth-tab.active::after {
+  transform: scaleX(1);
+}
+
+/* ── Auth Forms ── */
+.auth-form {
+  display: none;
+  flex-direction: column;
+  gap: 1.5rem;
+}
+.auth-form.active {
+  display: flex;
+  animation: authFadeIn 0.5s var(--ease-out-expo) both;
+}
+@keyframes authFadeIn {
+  from { opacity: 0; transform: translateY(10px); }
+  to   { opacity: 1; transform: translateY(0); }
+}
+
+/* ── Auth Form Fields ── */
+.auth-field {
+  display: flex;
+  flex-direction: column;
+  gap: 0.5rem;
+}
+.auth-field label {
+  font-family: var(--font-sans-clean);
+  font-size: 0.8rem;
+  text-transform: uppercase;
+  letter-spacing: 0.08em;
+  font-weight: 700;
+  color: var(--muted);
+}
+.auth-field input,
+.auth-field select {
+  padding: 1rem 1.25rem;
+  border-radius: 10px;
+  border: 1px solid var(--stroke);
+  background: var(--surface);
+  color: var(--ink);
+  font-family: var(--font-sans-clean);
+  font-size: 0.95rem;
+  transition: border-color 0.3s ease, box-shadow 0.3s ease;
+  outline: none;
+}
+.auth-field input:focus,
+.auth-field select:focus {
+  border-color: var(--color-accent-gold);
+  box-shadow: 0 0 0 3px var(--accent-soft);
+}
+
+/* ── Auth Submit Button Row ── */
+.auth-btn-row {
+  margin-top: 1rem;
+}
+.auth-btn-row button {
+  width: 100%;
+  justify-content: center;
+}
+
+/* ── Auth Form Switch Link ── */
+.auth-switch-text {
+  text-align: center;
+  font-size: 0.9rem;
+  color: var(--muted);
+  margin-top: 1.5rem;
+}
+.auth-switch-text button {
+  background: none;
+  border: none;
+  color: var(--ink);
+  font-weight: 700;
+  cursor: pointer;
+}
+
+/* ── Auth Alert (Error Message) ── */
+.auth-alert {
+  background: #fdf2f2;
+  border: 1px solid #fbd5d5;
+  color: #9b1c1c;
+  padding: 1rem;
+  border-radius: 8px;
+  font-size: 0.9rem;
+  margin-bottom: 1.5rem;
+  display: none;
+  animation: authFadeIn 0.3s ease;
+}
+[data-theme="dark"] .auth-alert {
+  background: #2b1515;
+  border-color: #5a1818;
+  color: #ff9b9b;
+}
+
+/* ── Loading Spinner ── */
+.spinner {
+  width: 20px;
+  height: 20px;
+  border: 2px solid rgba(255, 255, 255, 0.3);
+  border-radius: 50%;
+  border-top-color: #fff;
+  animation: spin 0.8s linear infinite;
+  display: none;
+}
+@keyframes spin {
+  to { transform: rotate(360deg); }
+}
+.btn-reveal:disabled {
+  opacity: 0.7;
+  cursor: not-allowed;
+}
+.btn-reveal:disabled .spinner {
+  display: inline-block;
+}
+.btn-reveal:disabled .btn-reveal-text {
+  display: none;
+}
+
+/* ── Profile & Dashboard Shell ── */
+.profile-shell {
+  width: 100%;
+  max-width: 1100px;
+  display: grid;
+  grid-template-columns: 1fr;
+  gap: 3rem;
+}
+@media (min-width: 850px) {
+  .profile-shell {
+    grid-template-columns: 320px 1fr;
+  }
+}
+
+/* ── Profile Sidebar ── */
+.profile-sidebar {
+  background: var(--surface-2);
+  border: 1px solid var(--stroke);
+  border-radius: var(--radius);
+  padding: 2.5rem;
+  display: flex;
+  flex-direction: column;
+  gap: 2rem;
+  height: fit-content;
+  box-shadow: var(--shadow);
+}
+.profile-avatar {
+  width: 80px;
+  height: 80px;
+  border-radius: 50%;
+  background: var(--accent-soft);
+  color: var(--color-accent-gold);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-family: var(--font-serif-display);
+  font-size: 2.5rem;
+  border: 1px solid rgba(195, 166, 119, 0.3);
+}
+.profile-meta h2 {
+  font-size: 1.75rem;
+  margin-bottom: 0.25rem;
+  font-family: var(--font-serif-display);
+}
+.profile-meta p {
+  font-size: 0.9rem;
+  color: var(--muted);
+}
+.profile-details {
+  border-top: 1px solid var(--stroke);
+  padding-top: 1.5rem;
+  display: flex;
+  flex-direction: column;
+  gap: 1.2rem;
+}
+.profile-stat-box {
+  display: flex;
+  flex-direction: column;
+  gap: 0.3rem;
+}
+.profile-stat-label {
+  font-size: 0.72rem;
+  text-transform: uppercase;
+  letter-spacing: 0.08em;
+  font-weight: 700;
+  color: var(--muted);
+}
+.profile-stat-val {
+  font-size: 1rem;
+  font-weight: 600;
+  color: var(--ink);
+}
+
+/* ── Profile Main Content Area ── */
+.profile-main {
+  display: flex;
+  flex-direction: column;
+  gap: 2rem;
+}
+.profile-favorites-title {
+  font-family: var(--font-serif-display);
+  font-size: 2rem;
+  border-bottom: 1px solid var(--stroke);
+  padding-bottom: 0.8rem;
+  margin-bottom: 1rem;
+}
+
+/* ── Favorites Grid ── */
+.favorites-grid {
+  display: grid;
+  grid-template-columns: repeat(auto-fill, minmax(280px, 1fr));
+  gap: var(--grid-gap);
+}
+.favorites-empty {
+  text-align: center;
+  padding: 4rem 2rem;
+  background: var(--surface-2);
+  border: 1px dashed var(--stroke);
+  border-radius: var(--radius);
+  color: var(--muted);
+}
+
 /* ── Premium Heart Buttons ── */
 .card__image {
   position: relative;

login.php

@@ -1,4 +1,4 @@
-<?php
+<?php
 require __DIR__ . '/helpers.php';
 
 $lang = (isset($_GET['lang']) && strtolower($_GET['lang']) === 'de') ? 'de' : 'en';
@@ -78,300 +78,9 @@ include __DIR__ . '/partials/head.php';
 include __DIR__ . '/partials/header.php';
 ?>
 
-<style>
+<?php /* Auth page, profile dashboard, and favorites styles are in assets/style.css (Phase 2 section) */ ?>
-/* ── Premium Authentication Page Styling ── */
-.auth-page {
-  padding: clamp(6rem, 10vh, 10rem) var(--grid-margin) clamp(4rem, 8vh, 6rem);
-  min-height: 80vh;
-  display: flex;
-  flex-direction: column;
-  align-items: center;
-  justify-content: center;
-}
 
-.auth-card {
-  width: 100%;
-  max-width: 500px;
-  background: var(--surface-2);
-  border: 1px solid var(--stroke);
-  box-shadow: var(--shadow);
-  border-radius: var(--radius);
-  padding: clamp(2rem, 5vw, 3.5rem);
-  position: relative;
-  overflow: hidden;
-  transition: transform 0.4s var(--ease-out-expo), opacity 0.4s ease;
-}
 
-.auth-tabs {
-  display: flex;
-  justify-content: center;
-  gap: 2rem;
-  margin-bottom: 2.5rem;
-  border-bottom: 1px solid var(--stroke);
-  padding-bottom: 0.8rem;
-}
-
-.auth-tab {
-  font-family: var(--font-serif-display);
-  font-size: 1.5rem;
-  color: var(--color-text-muted);
-  background: none;
-  border: none;
-  cursor: pointer;
-  padding: 0;
-  position: relative;
-  transition: color 0.3s ease;
-}
-
-.auth-tab.active {
-  color: var(--ink);
-}
-
-.auth-tab::after {
-  content: '';
-  position: absolute;
-  bottom: -0.9rem;
-  left: 0;
-  width: 100%;
-  height: 2px;
-  background-color: var(--color-accent-gold);
-  transform: scaleX(0);
-  transform-origin: center;
-  transition: transform 0.4s var(--ease-out-expo);
-}
-
-.auth-tab.active::after {
-  transform: scaleX(1);
-}
-
-.auth-form {
-  display: none;
-  flex-direction: column;
-  gap: 1.5rem;
-}
-
-.auth-form.active {
-  display: flex;
-  animation: authFadeIn 0.5s var(--ease-out-expo) both;
-}
-
-@keyframes authFadeIn {
-  from { opacity: 0; transform: translateY(10px); }
-  to { opacity: 1; transform: translateY(0); }
-}
-
-.auth-field {
-  display: flex;
-  flex-direction: column;
-  gap: 0.5rem;
-}
-
-.auth-field label {
-  font-family: var(--font-sans-clean);
-  font-size: 0.8rem;
-  text-transform: uppercase;
-  letter-spacing: 0.08em;
-  font-weight: 700;
-  color: var(--muted);
-}
-
-.auth-field input, .auth-field select {
-  padding: 1rem 1.25rem;
-  border-radius: 10px;
-  border: 1px solid var(--stroke);
-  background: var(--surface);
-  color: var(--ink);
-  font-family: var(--font-sans-clean);
-  font-size: 0.95rem;
-  transition: border-color 0.3s ease, box-shadow 0.3s ease;
-  outline: none;
-}
-
-.auth-field input:focus, .auth-field select:focus {
-  border-color: var(--color-accent-gold);
-  box-shadow: 0 0 0 3px var(--accent-soft);
-}
-
-.auth-btn-row {
-  margin-top: 1rem;
-}
-
-.auth-btn-row button {
-  width: 100%;
-  justify-content: center;
-}
-
-.auth-switch-text {
-  text-align: center;
-  font-size: 0.9rem;
-  color: var(--muted);
-  margin-top: 1.5rem;
-}
-
-.auth-switch-text button {
-  background: none;
-  border: none;
-  color: var(--ink);
-  font-weight: 700;
-  cursor: pointer;
-}
-
-/* ── Profile & Dashboard Styling ── */
-.profile-shell {
-  width: 100%;
-  max-width: 1100px;
-  display: grid;
-  grid-template-columns: 1fr;
-  gap: 3rem;
-}
-
-@media (min-width: 850px) {
-  .profile-shell {
-    grid-template-columns: 320px 1fr;
-  }
-}
-
-.profile-sidebar {
-  background: var(--surface-2);
-  border: 1px solid var(--stroke);
-  border-radius: var(--radius);
-  padding: 2.5rem;
-  display: flex;
-  flex-direction: column;
-  gap: 2rem;
-  height: fit-content;
-  box-shadow: var(--shadow);
-}
-
-.profile-avatar {
-  width: 80px;
-  height: 80px;
-  border-radius: 50%;
-  background: var(--accent-soft);
-  color: var(--color-accent-gold);
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  font-family: var(--font-serif-display);
-  font-size: 2.5rem;
-  border: 1px solid rgba(195,166,119,0.3);
-}
-
-.profile-meta h2 {
-  font-size: 1.75rem;
-  margin-bottom: 0.25rem;
-  font-family: var(--font-serif-display);
-}
-
-.profile-meta p {
-  font-size: 0.9rem;
-  color: var(--muted);
-}
-
-.profile-details {
-  border-top: 1px solid var(--stroke);
-  padding-top: 1.5rem;
-  display: flex;
-  flex-direction: column;
-  gap: 1.2rem;
-}
-
-.profile-stat-box {
-  display: flex;
-  flex-direction: column;
-  gap: 0.3rem;
-}
-
-.profile-stat-label {
-  font-size: 0.72rem;
-  text-transform: uppercase;
-  letter-spacing: 0.08em;
-  font-weight: 700;
-  color: var(--muted);
-}
-
-.profile-stat-val {
-  font-size: 1rem;
-  font-weight: 600;
-  color: var(--ink);
-}
-
-.profile-main {
-  display: flex;
-  flex-direction: column;
-  gap: 2rem;
-}
-
-.profile-favorites-title {
-  font-family: var(--font-serif-display);
-  font-size: 2rem;
-  border-bottom: 1px solid var(--stroke);
-  padding-bottom: 0.8rem;
-  margin-bottom: 1rem;
-}
-
-.favorites-grid {
-  display: grid;
-  grid-template-columns: repeat(auto-fill, minmax(280px, 1fr));
-  gap: var(--grid-gap);
-}
-
-.favorites-empty {
-  text-align: center;
-  padding: 4rem 2rem;
-  background: var(--surface-2);
-  border: 1px dashed var(--stroke);
-  border-radius: var(--radius);
-  color: var(--muted);
-}
-
-/* Alert styling */
-.auth-alert {
-  background: #fdf2f2;
-  border: 1px solid #fbd5d5;
-  color: #9b1c1c;
-  padding: 1rem;
-  border-radius: 8px;
-  font-size: 0.9rem;
-  margin-bottom: 1.5rem;
-  display: none;
-  animation: authFadeIn 0.3s ease;
-}
-
-[data-theme="dark"] .auth-alert {
-  background: #2b1515;
-  border-color: #5a1818;
-  color: #ff9b9b;
-}
-
-/* Loading state spinner */
-.spinner {
-  width: 20px;
-  height: 20px;
-  border: 2px solid rgba(255,255,255,0.3);
-  border-radius: 50%;
-  border-top-color: #fff;
-  animation: spin 0.8s linear infinite;
-  display: none;
-}
-
-@keyframes spin {
-  to { transform: rotate(360deg); }
-}
-
-.btn-reveal:disabled {
-  opacity: 0.7;
-  cursor: not-allowed;
-}
-
-.btn-reveal:disabled .spinner {
-  display: inline-block;
-}
-
-.btn-reveal:disabled .btn-reveal-text {
-  display: none;
-}
-</style>
 
 <main class="auth-page">
   <div class="auth-alert" id="authAlert"></div>
@@ -536,8 +245,14 @@ function handleLogin(e) {
     .catch(error => {
       btn.disabled = false;
       let errMsg = error.message;
-      if (error.code === 'auth/wrong-password' || error.code === 'auth/user-not-found') {
+      // Firebase v10 compat SDK consolidates wrong-password + user-not-found
-        errMsg = "Invalid email or password.";
+      // into auth/invalid-credential. Handle all three for backwards compatibility.
+      if (
+        error.code === 'auth/invalid-credential' ||
+        error.code === 'auth/wrong-password'     ||
+        error.code === 'auth/user-not-found'
+      ) {
+        errMsg = 'Invalid email or password.';
       }
       showAlert(errMsg);
     });

partials/head.php

@@ -70,7 +70,9 @@ $description = $description ?? 'Seasonal recipes, tested tips, and approachable
   <!-- Lenis smooth scroll (CDN) -->
   <script src="https://cdn.jsdelivr.net/npm/@studio-freight/lenis@1.0.42/bundled/lenis.min.js"></script>
 
-  <!-- Set theme instantly to avoid flash -->
+  <!-- Set theme instantly before paint to avoid FOUC (flash of unstyled content).
+       FlixCooks is a dark-only design by choice — no light mode is offered.
+       The theme attribute and localStorage flag are set unconditionally here. -->
   <script>
     (function(){
       document.documentElement.setAttribute('data-theme', 'dark');