.agents/TODO.md

@@ -16,6 +16,8 @@ Dieses Dokument enthält den aktuellen Entwicklungsstand und detaillierte Aufgab
   - Firebase-Projekt Setup & Anbindung
   - Newsletter-System (Firebase Firestore)
   - Benutzerprofile (Registrierung, Login, Favoriten)
+  - *Rework (Mai 2026): CSS aus login.php in style.css extrahiert, session.php gehärtet,
+    Firebase v10 Error-Codes korrigiert — via korrektem Feature-Branch-Workflow (PR #7)*
 - [x] **Phase 3: Nährwerte & Rezepterweiterung**
   - Datenmodell & Admin.php Erweiterung
   - Visuelles Nährwert-Widget (Floema-Präzision)

.agents/brain.md

@@ -33,5 +33,20 @@ This document summarizes the architectural knowledge, conventions, and learnings
 - **Phase 3 (Nutrition):** Implemented. Recipes now store `calories`, `protein`, `carbs`, and `fat`. Admin panel handles inputs, and the UI displays them beautifully.
 - **Phase 4 (Interactive Cooking Mode):** Implemented. Recipes now support step-by-step looping background videos and interactive timers (`step_videos`, `step_timers`). The UI utilizes a fullscreen overlay slider with Vanilla JS logic.
 
-## 6. Next Steps
+## 6. Git Workflow Violations & Recovery
-According to `TODO.md`, the next major feature block is **Phase 5 (PWA & Offline Support)**, which involves service workers, manifest files, and enabling the app to be installable on mobile devices.
+
+- **Phase 2 (commit `21833fa`) and Phase 4 (commit `a4a2d83`) were committed directly to `main`**, bypassing the required feature branch → PR flow. This is the correct diagnosis when someone says "Phase X wasn't saved properly" — the code exists, but the audit trail does not.
+- **Recovery strategy (retroactive feature branch):** Branch from current `main`, clean up / improve the work on that branch, then open a PR. This produces the audit trail without rewriting history. Do not force-push or attempt to amend merged commits in `main`.
+
+## 7. Phase 2 Architecture Details
+
+- **Auth CSS location:** All auth/profile/favorites styles live in `assets/style.css` under the `PHASE 2` section header. `login.php` should have **no inline `<style>` block**.
+- **Firebase SDK version:** Using the **v10 compat SDK** (loaded via `gstatic.com`). The compat layer allows legacy v8-style API calls (`window.auth.signInWithEmailAndPassword`). This is intentional.
+- **Firebase v10 error code change:** `auth/wrong-password` and `auth/user-not-found` were consolidated into `auth/invalid-credential` in Firebase v10. All three must be handled for backwards compatibility.
+- **Session sync flow:** `head.php` → `onAuthStateChanged` fires → XHR POST to `api/session.php` with uid/email/token → PHP sets `$_SESSION['fc_user']` → page reloads to show auth state.
+- **Token is NOT verified server-side:** `api/session.php` trusts the client-sent UID and email. The ID Token is stored but not validated cryptographically. Acceptable for a food blog; would need Firebase Admin SDK for sensitive apps.
+- **Dark mode is forced:** The site is dark-only by design. `head.php` sets `data-theme="dark"` unconditionally to prevent FOUC. There is no light mode toggle and this is intentional.
+
+## 8. Next Steps
+
+According to `TODO.md`, all 5 phases are complete. The next work will be new features or bug fixes as directed by the user.

api/session.php

@@ -1,5 +1,22 @@
 <?php
-// PHP session synchronizer endpoint for Firebase Auth
+/**
+ * PHP Session Synchronizer for Firebase Auth
+ *
+ * This endpoint is called client-side via XHR whenever Firebase Auth detects
+ * a state change (login or logout). It creates or destroys a PHP session that
+ * mirrors the Firebase auth state, allowing server-rendered PHP pages to react
+ * to auth status.
+ *
+ * SECURITY NOTE: This endpoint accepts the Firebase UID and email from the
+ * client POST body and trusts them to set the PHP session. The Firebase ID Token
+ * is stored but NOT cryptographically verified server-side (which would require
+ * the Firebase Admin SDK or a REST call to the Google tokeninfo endpoint).
+ * This is an acceptable trade-off for a low-risk food blog, but for a
+ * production app handling sensitive data, server-side token verification
+ * via the Firebase Admin SDK should be implemented.
+ */
+
+header('Content-Type: application/json');
 
 if (session_status() === PHP_SESSION_NONE) {
     session_start();
@@ -8,32 +25,37 @@ if (session_status() === PHP_SESSION_NONE) {
 $action = $_POST['action'] ?? '';
 
 if ($action === 'login') {
-    $uid = $_POST['uid'] ?? '';
+    $uid   = trim($_POST['uid']   ?? '');
-    $email = $_POST['email'] ?? '';
+    $email = trim($_POST['email'] ?? '');
-    $token = $_POST['token'] ?? '';
+    $token = trim($_POST['token'] ?? '');
+
+    // Validate required fields – reject obviously malformed requests early
+    if ($uid === '' || $email === '' || !filter_var($email, FILTER_VALIDATE_EMAIL)) {
+        http_response_code(400);
+        echo json_encode(['status' => 'error', 'message' => 'Invalid or missing uid/email']);
+        exit;
+    }
 
-    if ($uid !== '') {
     $_SESSION['fc_user'] = [
         'uid'   => $uid,
         'email' => $email,
-            'token' => $token
+        'token' => $token, // Stored for potential future server-side verification
     ];
     echo json_encode(['status' => 'success', 'message' => 'Logged in']);
-    } else {
+
-        http_response_code(400);
-        echo json_encode(['status' => 'error', 'message' => 'Missing UID']);
-    }
 } elseif ($action === 'logout') {
     $_SESSION = [];
-    if (ini_get("session.use_cookies")) {
+    if (ini_get('session.use_cookies')) {
         $params = session_get_cookie_params();
-        setcookie(session_name(), '', time() - 42000,
+        setcookie(
-            $params["path"], $params["domain"],
+            session_name(), '', time() - 42000,
-            $params["secure"], $params["httponly"]
+            $params['path'], $params['domain'],
+            $params['secure'], $params['httponly']
         );
     }
     session_destroy();
     echo json_encode(['status' => 'success', 'message' => 'Logged out']);
+
 } else {
     http_response_code(400);
     echo json_encode(['status' => 'error', 'message' => 'Invalid action']);

assets/style.css

@@ -1741,6 +1741,284 @@ body.nav-open { overflow: hidden; }
    ║  PHASE 2: AUTHENTICATION, FAVORITES & NEWSLETTER STYLES       ║
    ╚══════════════════════════════════════════════════════════════╝ */
 
+/* ── Auth Page Layout ── */
+.auth-page {
+  padding: clamp(6rem, 10vh, 10rem) var(--grid-margin) clamp(4rem, 8vh, 6rem);
+  min-height: 80vh;
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+}
+
+/* ── Auth Card ── */
+.auth-card {
+  width: 100%;
+  max-width: 500px;
+  background: var(--surface-2);
+  border: 1px solid var(--stroke);
+  box-shadow: var(--shadow);
+  border-radius: var(--radius);
+  padding: clamp(2rem, 5vw, 3.5rem);
+  position: relative;
+  overflow: hidden;
+  transition: transform 0.4s var(--ease-out-expo), opacity 0.4s ease;
+}
+
+/* ── Auth Tabs (Login / Register toggle) ── */
+.auth-tabs {
+  display: flex;
+  justify-content: center;
+  gap: 2rem;
+  margin-bottom: 2.5rem;
+  border-bottom: 1px solid var(--stroke);
+  padding-bottom: 0.8rem;
+}
+.auth-tab {
+  font-family: var(--font-serif-display);
+  font-size: 1.5rem;
+  color: var(--color-text-muted);
+  background: none;
+  border: none;
+  cursor: pointer;
+  padding: 0;
+  position: relative;
+  transition: color 0.3s ease;
+}
+.auth-tab.active {
+  color: var(--ink);
+}
+.auth-tab::after {
+  content: '';
+  position: absolute;
+  bottom: -0.9rem;
+  left: 0;
+  width: 100%;
+  height: 2px;
+  background-color: var(--color-accent-gold);
+  transform: scaleX(0);
+  transform-origin: center;
+  transition: transform 0.4s var(--ease-out-expo);
+}
+.auth-tab.active::after {
+  transform: scaleX(1);
+}
+
+/* ── Auth Forms ── */
+.auth-form {
+  display: none;
+  flex-direction: column;
+  gap: 1.5rem;
+}
+.auth-form.active {
+  display: flex;
+  animation: authFadeIn 0.5s var(--ease-out-expo) both;
+}
+@keyframes authFadeIn {
+  from { opacity: 0; transform: translateY(10px); }
+  to   { opacity: 1; transform: translateY(0); }
+}
+
+/* ── Auth Form Fields ── */
+.auth-field {
+  display: flex;
+  flex-direction: column;
+  gap: 0.5rem;
+}
+.auth-field label {
+  font-family: var(--font-sans-clean);
+  font-size: 0.8rem;
+  text-transform: uppercase;
+  letter-spacing: 0.08em;
+  font-weight: 700;
+  color: var(--muted);
+}
+.auth-field input,
+.auth-field select {
+  padding: 1rem 1.25rem;
+  border-radius: 10px;
+  border: 1px solid var(--stroke);
+  background: var(--surface);
+  color: var(--ink);
+  font-family: var(--font-sans-clean);
+  font-size: 0.95rem;
+  transition: border-color 0.3s ease, box-shadow 0.3s ease;
+  outline: none;
+}
+.auth-field input:focus,
+.auth-field select:focus {
+  border-color: var(--color-accent-gold);
+  box-shadow: 0 0 0 3px var(--accent-soft);
+}
+
+/* ── Auth Submit Button Row ── */
+.auth-btn-row {
+  margin-top: 1rem;
+}
+.auth-btn-row button {
+  width: 100%;
+  justify-content: center;
+}
+
+/* ── Auth Form Switch Link ── */
+.auth-switch-text {
+  text-align: center;
+  font-size: 0.9rem;
+  color: var(--muted);
+  margin-top: 1.5rem;
+}
+.auth-switch-text button {
+  background: none;
+  border: none;
+  color: var(--ink);
+  font-weight: 700;
+  cursor: pointer;
+}
+
+/* ── Auth Alert (Error Message) ── */
+.auth-alert {
+  background: #fdf2f2;
+  border: 1px solid #fbd5d5;
+  color: #9b1c1c;
+  padding: 1rem;
+  border-radius: 8px;
+  font-size: 0.9rem;
+  margin-bottom: 1.5rem;
+  display: none;
+  animation: authFadeIn 0.3s ease;
+}
+[data-theme="dark"] .auth-alert {
+  background: #2b1515;
+  border-color: #5a1818;
+  color: #ff9b9b;
+}
+
+/* ── Loading Spinner ── */
+.spinner {
+  width: 20px;
+  height: 20px;
+  border: 2px solid rgba(255, 255, 255, 0.3);
+  border-radius: 50%;
+  border-top-color: #fff;
+  animation: spin 0.8s linear infinite;
+  display: none;
+}
+@keyframes spin {
+  to { transform: rotate(360deg); }
+}
+.btn-reveal:disabled {
+  opacity: 0.7;
+  cursor: not-allowed;
+}
+.btn-reveal:disabled .spinner {
+  display: inline-block;
+}
+.btn-reveal:disabled .btn-reveal-text {
+  display: none;
+}
+
+/* ── Profile & Dashboard Shell ── */
+.profile-shell {
+  width: 100%;
+  max-width: 1100px;
+  display: grid;
+  grid-template-columns: 1fr;
+  gap: 3rem;
+}
+@media (min-width: 850px) {
+  .profile-shell {
+    grid-template-columns: 320px 1fr;
+  }
+}
+
+/* ── Profile Sidebar ── */
+.profile-sidebar {
+  background: var(--surface-2);
+  border: 1px solid var(--stroke);
+  border-radius: var(--radius);
+  padding: 2.5rem;
+  display: flex;
+  flex-direction: column;
+  gap: 2rem;
+  height: fit-content;
+  box-shadow: var(--shadow);
+}
+.profile-avatar {
+  width: 80px;
+  height: 80px;
+  border-radius: 50%;
+  background: var(--accent-soft);
+  color: var(--color-accent-gold);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-family: var(--font-serif-display);
+  font-size: 2.5rem;
+  border: 1px solid rgba(195, 166, 119, 0.3);
+}
+.profile-meta h2 {
+  font-size: 1.75rem;
+  margin-bottom: 0.25rem;
+  font-family: var(--font-serif-display);
+}
+.profile-meta p {
+  font-size: 0.9rem;
+  color: var(--muted);
+}
+.profile-details {
+  border-top: 1px solid var(--stroke);
+  padding-top: 1.5rem;
+  display: flex;
+  flex-direction: column;
+  gap: 1.2rem;
+}
+.profile-stat-box {
+  display: flex;
+  flex-direction: column;
+  gap: 0.3rem;
+}
+.profile-stat-label {
+  font-size: 0.72rem;
+  text-transform: uppercase;
+  letter-spacing: 0.08em;
+  font-weight: 700;
+  color: var(--muted);
+}
+.profile-stat-val {
+  font-size: 1rem;
+  font-weight: 600;
+  color: var(--ink);
+}
+
+/* ── Profile Main Content Area ── */
+.profile-main {
+  display: flex;
+  flex-direction: column;
+  gap: 2rem;
+}
+.profile-favorites-title {
+  font-family: var(--font-serif-display);
+  font-size: 2rem;
+  border-bottom: 1px solid var(--stroke);
+  padding-bottom: 0.8rem;
+  margin-bottom: 1rem;
+}
+
+/* ── Favorites Grid ── */
+.favorites-grid {
+  display: grid;
+  grid-template-columns: repeat(auto-fill, minmax(280px, 1fr));
+  gap: var(--grid-gap);
+}
+.favorites-empty {
+  text-align: center;
+  padding: 4rem 2rem;
+  background: var(--surface-2);
+  border: 1px dashed var(--stroke);
+  border-radius: var(--radius);
+  color: var(--muted);
+}
+
 /* ── Premium Heart Buttons ── */
 .card__image {
   position: relative;

login.php

@@ -1,4 +1,4 @@
-<?php
+<?php
 require __DIR__ . '/helpers.php';
 
 $lang = (isset($_GET['lang']) && strtolower($_GET['lang']) === 'de') ? 'de' : 'en';
@@ -78,300 +78,9 @@ include __DIR__ . '/partials/head.php';
 include __DIR__ . '/partials/header.php';
 ?>
 
-<style>
+<?php /* Auth page, profile dashboard, and favorites styles are in assets/style.css (Phase 2 section) */ ?>
-/* ── Premium Authentication Page Styling ── */
-.auth-page {
-  padding: clamp(6rem, 10vh, 10rem) var(--grid-margin) clamp(4rem, 8vh, 6rem);
-  min-height: 80vh;
-  display: flex;
-  flex-direction: column;
-  align-items: center;
-  justify-content: center;
-}
 
-.auth-card {
-  width: 100%;
-  max-width: 500px;
-  background: var(--surface-2);
-  border: 1px solid var(--stroke);
-  box-shadow: var(--shadow);
-  border-radius: var(--radius);
-  padding: clamp(2rem, 5vw, 3.5rem);
-  position: relative;
-  overflow: hidden;
-  transition: transform 0.4s var(--ease-out-expo), opacity 0.4s ease;
-}
 
-.auth-tabs {
-  display: flex;
-  justify-content: center;
-  gap: 2rem;
-  margin-bottom: 2.5rem;
-  border-bottom: 1px solid var(--stroke);
-  padding-bottom: 0.8rem;
-}
-
-.auth-tab {
-  font-family: var(--font-serif-display);
-  font-size: 1.5rem;
-  color: var(--color-text-muted);
-  background: none;
-  border: none;
-  cursor: pointer;
-  padding: 0;
-  position: relative;
-  transition: color 0.3s ease;
-}
-
-.auth-tab.active {
-  color: var(--ink);
-}
-
-.auth-tab::after {
-  content: '';
-  position: absolute;
-  bottom: -0.9rem;
-  left: 0;
-  width: 100%;
-  height: 2px;
-  background-color: var(--color-accent-gold);
-  transform: scaleX(0);
-  transform-origin: center;
-  transition: transform 0.4s var(--ease-out-expo);
-}
-
-.auth-tab.active::after {
-  transform: scaleX(1);
-}
-
-.auth-form {
-  display: none;
-  flex-direction: column;
-  gap: 1.5rem;
-}
-
-.auth-form.active {
-  display: flex;
-  animation: authFadeIn 0.5s var(--ease-out-expo) both;
-}
-
-@keyframes authFadeIn {
-  from { opacity: 0; transform: translateY(10px); }
-  to { opacity: 1; transform: translateY(0); }
-}
-
-.auth-field {
-  display: flex;
-  flex-direction: column;
-  gap: 0.5rem;
-}
-
-.auth-field label {
-  font-family: var(--font-sans-clean);
-  font-size: 0.8rem;
-  text-transform: uppercase;
-  letter-spacing: 0.08em;
-  font-weight: 700;
-  color: var(--muted);
-}
-
-.auth-field input, .auth-field select {
-  padding: 1rem 1.25rem;
-  border-radius: 10px;
-  border: 1px solid var(--stroke);
-  background: var(--surface);
-  color: var(--ink);
-  font-family: var(--font-sans-clean);
-  font-size: 0.95rem;
-  transition: border-color 0.3s ease, box-shadow 0.3s ease;
-  outline: none;
-}
-
-.auth-field input:focus, .auth-field select:focus {
-  border-color: var(--color-accent-gold);
-  box-shadow: 0 0 0 3px var(--accent-soft);
-}
-
-.auth-btn-row {
-  margin-top: 1rem;
-}
-
-.auth-btn-row button {
-  width: 100%;
-  justify-content: center;
-}
-
-.auth-switch-text {
-  text-align: center;
-  font-size: 0.9rem;
-  color: var(--muted);
-  margin-top: 1.5rem;
-}
-
-.auth-switch-text button {
-  background: none;
-  border: none;
-  color: var(--ink);
-  font-weight: 700;
-  cursor: pointer;
-}
-
-/* ── Profile & Dashboard Styling ── */
-.profile-shell {
-  width: 100%;
-  max-width: 1100px;
-  display: grid;
-  grid-template-columns: 1fr;
-  gap: 3rem;
-}
-
-@media (min-width: 850px) {
-  .profile-shell {
-    grid-template-columns: 320px 1fr;
-  }
-}
-
-.profile-sidebar {
-  background: var(--surface-2);
-  border: 1px solid var(--stroke);
-  border-radius: var(--radius);
-  padding: 2.5rem;
-  display: flex;
-  flex-direction: column;
-  gap: 2rem;
-  height: fit-content;
-  box-shadow: var(--shadow);
-}
-
-.profile-avatar {
-  width: 80px;
-  height: 80px;
-  border-radius: 50%;
-  background: var(--accent-soft);
-  color: var(--color-accent-gold);
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  font-family: var(--font-serif-display);
-  font-size: 2.5rem;
-  border: 1px solid rgba(195,166,119,0.3);
-}
-
-.profile-meta h2 {
-  font-size: 1.75rem;
-  margin-bottom: 0.25rem;
-  font-family: var(--font-serif-display);
-}
-
-.profile-meta p {
-  font-size: 0.9rem;
-  color: var(--muted);
-}
-
-.profile-details {
-  border-top: 1px solid var(--stroke);
-  padding-top: 1.5rem;
-  display: flex;
-  flex-direction: column;
-  gap: 1.2rem;
-}
-
-.profile-stat-box {
-  display: flex;
-  flex-direction: column;
-  gap: 0.3rem;
-}
-
-.profile-stat-label {
-  font-size: 0.72rem;
-  text-transform: uppercase;
-  letter-spacing: 0.08em;
-  font-weight: 700;
-  color: var(--muted);
-}
-
-.profile-stat-val {
-  font-size: 1rem;
-  font-weight: 600;
-  color: var(--ink);
-}
-
-.profile-main {
-  display: flex;
-  flex-direction: column;
-  gap: 2rem;
-}
-
-.profile-favorites-title {
-  font-family: var(--font-serif-display);
-  font-size: 2rem;
-  border-bottom: 1px solid var(--stroke);
-  padding-bottom: 0.8rem;
-  margin-bottom: 1rem;
-}
-
-.favorites-grid {
-  display: grid;
-  grid-template-columns: repeat(auto-fill, minmax(280px, 1fr));
-  gap: var(--grid-gap);
-}
-
-.favorites-empty {
-  text-align: center;
-  padding: 4rem 2rem;
-  background: var(--surface-2);
-  border: 1px dashed var(--stroke);
-  border-radius: var(--radius);
-  color: var(--muted);
-}
-
-/* Alert styling */
-.auth-alert {
-  background: #fdf2f2;
-  border: 1px solid #fbd5d5;
-  color: #9b1c1c;
-  padding: 1rem;
-  border-radius: 8px;
-  font-size: 0.9rem;
-  margin-bottom: 1.5rem;
-  display: none;
-  animation: authFadeIn 0.3s ease;
-}
-
-[data-theme="dark"] .auth-alert {
-  background: #2b1515;
-  border-color: #5a1818;
-  color: #ff9b9b;
-}
-
-/* Loading state spinner */
-.spinner {
-  width: 20px;
-  height: 20px;
-  border: 2px solid rgba(255,255,255,0.3);
-  border-radius: 50%;
-  border-top-color: #fff;
-  animation: spin 0.8s linear infinite;
-  display: none;
-}
-
-@keyframes spin {
-  to { transform: rotate(360deg); }
-}
-
-.btn-reveal:disabled {
-  opacity: 0.7;
-  cursor: not-allowed;
-}
-
-.btn-reveal:disabled .spinner {
-  display: inline-block;
-}
-
-.btn-reveal:disabled .btn-reveal-text {
-  display: none;
-}
-</style>
 
 <main class="auth-page">
   <div class="auth-alert" id="authAlert"></div>
@@ -536,8 +245,14 @@ function handleLogin(e) {
     .catch(error => {
       btn.disabled = false;
       let errMsg = error.message;
-      if (error.code === 'auth/wrong-password' || error.code === 'auth/user-not-found') {
+      // Firebase v10 compat SDK consolidates wrong-password + user-not-found
-        errMsg = "Invalid email or password.";
+      // into auth/invalid-credential. Handle all three for backwards compatibility.
+      if (
+        error.code === 'auth/invalid-credential' ||
+        error.code === 'auth/wrong-password'     ||
+        error.code === 'auth/user-not-found'
+      ) {
+        errMsg = 'Invalid email or password.';
       }
       showAlert(errMsg);
     });

partials/head.php

@@ -70,7 +70,9 @@ $description = $description ?? 'Seasonal recipes, tested tips, and approachable
   <!-- Lenis smooth scroll (CDN) -->
   <script src="https://cdn.jsdelivr.net/npm/@studio-freight/lenis@1.0.42/bundled/lenis.min.js"></script>
 
-  <!-- Set theme instantly to avoid flash -->
+  <!-- Set theme instantly before paint to avoid FOUC (flash of unstyled content).
+       FlixCooks is a dark-only design by choice — no light mode is offered.
+       The theme attribute and localStorage flag are set unconditionally here. -->
   <script>
     (function(){
       document.documentElement.setAttribute('data-theme', 'dark');