feat(#26): Add custom login form

deployment/docker-compose-dev.yaml

@@ -26,10 +26,13 @@ services:
       KC_HOSTNAME: ${KEYCLOAK_HOSTNAME}
       KC_HTTP_ENABLED: true
       KC_HEALTH_ENABLED: true
+      KC_SPI_THEME_CACHE_THEMES: false
     env_file:
       - .env.dev
     ports:
       - "7080:8080"
+    volumes:
+      - ./keycloak-theme:/opt/keycloak/themes
     depends_on:
       keycloak-db:
         condition: service_healthy

deployment/docker-compose-prod.yaml

@@ -26,6 +26,7 @@ services:
       - "8080:8080"
     volumes:
       - legalconsenthub_pdf_cache:/var/lib/legalconsenthub/pdfs
+      - ./keycloak-theme:/opt/keycloak/themes
     depends_on:
       legalconsenthub-db:
         condition: service_started

deployment/keycloak-theme/legalconsenthub/login/login-username.ftl

@@ -0,0 +1,58 @@
+<#import "template.ftl" as layout>
+<@layout.registrationLayout displayMessage=!messagesPerField.existsError('username') displayInfo=realm.password && realm.registrationAllowed && !registrationDisabled??; section>
+    <#if section = "header">
+        <h1 id="kc-page-title">${msg("loginAccountTitle")}</h1>
+    <#elseif section = "form">
+        <div id="kc-form">
+            <div id="kc-form-wrapper">
+                <#if realm.password>
+                    <form id="kc-form-login" onsubmit="login.disabled = true; return true;" action="${url.loginAction}" method="post">
+                        <div class="form-group">
+                            <label for="username" class="pf-c-form__label pf-c-form__label-text">
+                                <#if !realm.loginWithEmailAllowed>${msg("username")}<#elseif !realm.registrationEmailAsUsername>${msg("usernameOrEmail")}<#else>${msg("email")}</#if>
+                            </label>
+                            <input tabindex="1" id="username" class="pf-c-form-control" name="username" value="${(login.username!'')}" type="text" autofocus autocomplete="username"
+                                   aria-invalid="<#if messagesPerField.existsError('username')>true</#if>"
+                            />
+                            <#if messagesPerField.existsError('username')>
+                                <span id="input-error" class="input-error" aria-live="polite">
+                                    ${kcSanitize(messagesPerField.getFirstError('username'))?no_esc}
+                                </span>
+                            </#if>
+                        </div>
+
+                        <div id="kc-form-buttons" class="form-group">
+                            <input tabindex="4" class="pf-c-button pf-m-primary pf-m-block" name="login" id="kc-login" type="submit" value="${msg("doLogIn")}"/>
+                        </div>
+                    </form>
+                </#if>
+            </div>
+        </div>
+    <#elseif section = "info">
+        <#if realm.password && realm.registrationAllowed && !registrationDisabled??>
+            <div id="kc-registration">
+                <span>${msg("noAccount")} <a tabindex="6" href="${url.registrationUrl}">${msg("doRegister")}</a></span>
+            </div>
+        </#if>
+    <#elseif section = "socialProviders">
+        <#if realm.password && social?? && social.providers?has_content>
+            <div id="kc-social-providers">
+                <hr/>
+                <h4>${msg("identity-provider-login-label")}</h4>
+                <ul>
+                    <#list social.providers as p>
+                        <li>
+                            <a id="social-${p.alias}" href="${p.loginUrl}">
+                                <#if p.iconClasses?has_content>
+                                    <i class="${p.iconClasses}" aria-hidden="true"></i>
+                                </#if>
+                                <span>${p.displayName!}</span>
+                            </a>
+                        </li>
+                    </#list>
+                </ul>
+            </div>
+        </#if>
+    </#if>
+</@layout.registrationLayout>
+

deployment/keycloak-theme/legalconsenthub/login/login.ftl

@@ -0,0 +1,123 @@
+<#import "template.ftl" as layout>
+<@layout.registrationLayout displayMessage=!messagesPerField.existsError('username','password') displayInfo=realm.password && realm.registrationAllowed && !registrationDisabled??; section>
+    <#if section = "header">
+        <#-- Logo is added via CSS ::before pseudo-element -->
+        <#if auth.attemptedUsername?has_content>
+            <#-- Password step: show username in disabled field with back arrow -->
+        <#else>
+            <h1 id="kc-page-title">${msg("loginAccountTitle")}</h1>
+        </#if>
+    <#elseif section = "form">
+        <div id="kc-form">
+            <div id="kc-form-wrapper">
+                <#if realm.password>
+                    <form id="kc-form-login" onsubmit="login.disabled = true; return true;" action="${url.loginAction}" method="post">
+                        <#if auth.attemptedUsername?has_content>
+                            <#-- Password step: show username as disabled input with back link in label -->
+                            <div class="form-group">
+                                <div class="label-with-action">
+                                    <label for="username-display" class="pf-c-form__label pf-c-form__label-text">${msg("username")}</label>
+                                    <a href="${url.loginRestartFlowUrl}" class="change-username-link" aria-label="${msg("restartLoginTooltip")}" title="${msg("restartLoginTooltip")}">
+                                        <svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                                            <path d="M17 3a2.85 2.83 0 1 1 4 4L7.5 20.5 2 22l1.5-5.5Z"/>
+                                            <path d="m15 5 4 4"/>
+                                        </svg>
+                                        <span>${msg("doChange")}</span>
+                                    </a>
+                                </div>
+                                <input type="text" id="username-display" class="pf-c-form-control" value="${auth.attemptedUsername}" disabled readonly />
+                            </div>
+                        <#else>
+                            <#-- Username step -->
+                            <#if !usernameHidden??>
+                                <div class="form-group">
+                                    <label for="username" class="pf-c-form__label pf-c-form__label-text">
+                                        <#if !realm.loginWithEmailAllowed>${msg("username")}<#elseif !realm.registrationEmailAsUsername>${msg("usernameOrEmail")}<#else>${msg("email")}</#if>
+                                    </label>
+                                    <input tabindex="1" id="username" class="pf-c-form-control" name="username" value="${(login.username!'')}" type="text" autofocus autocomplete="username"
+                                           aria-invalid="<#if messagesPerField.existsError('username','password')>true</#if>"
+                                    />
+                                    <#if messagesPerField.existsError('username','password')>
+                                        <span id="input-error" class="input-error" aria-live="polite">
+                                            ${kcSanitize(messagesPerField.getFirstError('username','password'))?no_esc}
+                                        </span>
+                                    </#if>
+                                </div>
+                            </#if>
+                        </#if>
+
+                        <#if auth.attemptedUsername?has_content || !usernameHidden??>
+                            <#-- Show password field if we're on password step OR if username is visible (combined form) -->
+                        </#if>
+
+                        <#if auth.attemptedUsername?has_content>
+                            <#-- Password step -->
+                            <div class="form-group">
+                                <label for="password" class="pf-c-form__label pf-c-form__label-text">${msg("password")}</label>
+                                <input tabindex="2" id="password" class="pf-c-form-control" name="password" type="password" autocomplete="current-password" autofocus
+                                       aria-invalid="<#if messagesPerField.existsError('username','password')>true</#if>"
+                                />
+                                <#if messagesPerField.existsError('password')>
+                                    <span id="input-error-password" class="input-error" aria-live="polite">
+                                        ${kcSanitize(messagesPerField.getFirstError('password'))?no_esc}
+                                    </span>
+                                </#if>
+                            </div>
+                        </#if>
+
+                        <#if (realm.rememberMe && !usernameHidden??) || realm.resetPasswordAllowed>
+                            <div class="form-group login-pf-settings">
+                                <#if realm.rememberMe && !usernameHidden??>
+                                    <div id="kc-form-options">
+                                        <div class="checkbox">
+                                            <label>
+                                                <#if login.rememberMe??>
+                                                    <input tabindex="3" id="rememberMe" name="rememberMe" type="checkbox" checked> ${msg("rememberMe")}
+                                                <#else>
+                                                    <input tabindex="3" id="rememberMe" name="rememberMe" type="checkbox"> ${msg("rememberMe")}
+                                                </#if>
+                                            </label>
+                                        </div>
+                                    </div>
+                                </#if>
+                                <#if realm.resetPasswordAllowed>
+                                    <span class="forgot-password"><a tabindex="5" href="${url.loginResetCredentialsUrl}">${msg("doForgotPassword")}</a></span>
+                                </#if>
+                            </div>
+                        </#if>
+
+                        <div id="kc-form-buttons" class="form-group">
+                            <input type="hidden" id="id-hidden-input" name="credentialId" <#if auth.selectedCredential?has_content>value="${auth.selectedCredential}"</#if>/>
+                            <input tabindex="4" class="pf-c-button pf-m-primary pf-m-block" name="login" id="kc-login" type="submit" value="${msg("doLogIn")}"/>
+                        </div>
+                    </form>
+                </#if>
+            </div>
+        </div>
+    <#elseif section = "info">
+        <#if realm.password && realm.registrationAllowed && !registrationDisabled??>
+            <div id="kc-registration">
+                <span>${msg("noAccount")} <a tabindex="6" href="${url.registrationUrl}">${msg("doRegister")}</a></span>
+            </div>
+        </#if>
+    <#elseif section = "socialProviders">
+        <#if realm.password && social?? && social.providers?has_content>
+            <div id="kc-social-providers">
+                <hr/>
+                <h4>${msg("identity-provider-login-label")}</h4>
+                <ul>
+                    <#list social.providers as p>
+                        <li>
+                            <a id="social-${p.alias}" href="${p.loginUrl}">
+                                <#if p.iconClasses?has_content>
+                                    <i class="${p.iconClasses}" aria-hidden="true"></i>
+                                </#if>
+                                <span>${p.displayName!}</span>
+                            </a>
+                        </li>
+                    </#list>
+                </ul>
+            </div>
+        </#if>
+    </#if>
+</@layout.registrationLayout>

deployment/keycloak-theme/legalconsenthub/login/messages/messages_de.properties

@@ -0,0 +1,30 @@
+# LegalConsentHub Keycloak Theme - German translations
+# Override default Keycloak messages here
+
+# Login page
+loginAccountTitle=Anmelden
+usernameOrEmail=Benutzername oder E-Mail
+username=Benutzername
+email=E-Mail
+password=Passwort
+doLogIn=Anmelden
+
+# Remember me / Forgot password
+rememberMe=Angemeldet bleiben
+doForgotPassword=Passwort vergessen?
+
+# Registration
+noAccount=Noch kein Konto?
+doRegister=Registrieren
+
+# Restart login (change username)
+restartLoginTooltip=Benutzername \u00e4ndern
+doChange=\u00c4ndern
+
+# Errors
+invalidUserMessage=Ung\u00fcltiger Benutzername oder Passwort.
+invalidPasswordMessage=Ung\u00fcltiger Benutzername oder Passwort.
+
+# Social providers
+identity-provider-login-label=Oder anmelden mit
+

deployment/keycloak-theme/legalconsenthub/login/messages/messages_en.properties

@@ -0,0 +1,30 @@
+# LegalConsentHub Keycloak Theme - English translations
+# Override default Keycloak messages here
+
+# Login page
+loginAccountTitle=Sign in
+usernameOrEmail=Username or email
+username=Username
+email=Email
+password=Password
+doLogIn=Sign In
+
+# Remember me / Forgot password
+rememberMe=Remember me
+doForgotPassword=Forgot password?
+
+# Registration
+noAccount=Don\u0027t have an account?
+doRegister=Register
+
+# Restart login (change username)
+restartLoginTooltip=Change username
+doChange=Change
+
+# Errors
+invalidUserMessage=Invalid username or password.
+invalidPasswordMessage=Invalid username or password.
+
+# Social providers
+identity-provider-login-label=Or sign in with
+

deployment/keycloak-theme/legalconsenthub/login/resources/css/styles.css

@@ -0,0 +1,577 @@
+/* LegalConsentHub Keycloak Theme - Matching Nuxt UI 4 Styling */
+/* Compatible with Keycloak 26+ PatternFly-based themes */
+
+/* CSS Variables matching Nuxt UI green/zinc theme */
+:root {
+  /* Green palette (primary) */
+  --lch-green-50: #effdf5;
+  --lch-green-100: #d9fbe8;
+  --lch-green-200: #b3f5d1;
+  --lch-green-300: #75edae;
+  --lch-green-400: #00dc82;
+  --lch-green-500: #00c16a;
+  --lch-green-600: #00a155;
+  --lch-green-700: #007f45;
+  --lch-green-800: #016538;
+  --lch-green-900: #0a5331;
+  --lch-green-950: #052e16;
+
+  /* Zinc palette (neutral) */
+  --lch-zinc-50: #fafafa;
+  --lch-zinc-100: #f4f4f5;
+  --lch-zinc-200: #e4e4e7;
+  --lch-zinc-300: #d4d4d8;
+  --lch-zinc-400: #a1a1aa;
+  --lch-zinc-500: #71717a;
+  --lch-zinc-600: #52525b;
+  --lch-zinc-700: #3f3f46;
+  --lch-zinc-800: #27272a;
+  --lch-zinc-900: #18181b;
+  --lch-zinc-950: #09090b;
+}
+
+/* ========================================
+   LIGHT THEME (Default)
+   ======================================== */
+
+/* Full page layout - center the card */
+html.login-pf,
+html.login-pf body {
+  height: 100%;
+  margin: 0;
+  padding: 0;
+  background: linear-gradient(135deg, var(--lch-zinc-100) 0%, var(--lch-zinc-200) 100%) !important;
+  font-family: ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif !important;
+}
+
+.login-pf-page {
+  display: flex !important;
+  flex-direction: column !important;
+  justify-content: center !important;
+  align-items: center !important;
+  min-height: 100vh !important;
+  padding: 1rem !important;
+  box-sizing: border-box !important;
+}
+
+/* Hide the default header with realm name */
+#kc-header,
+.login-pf-page-header {
+  display: none !important;
+}
+
+/* Card container */
+.card-pf {
+  background: white !important;
+  border-radius: 0.75rem !important;
+  box-shadow: 0 10px 25px -5px rgb(0 0 0 / 0.1), 0 8px 10px -6px rgb(0 0 0 / 0.1) !important;
+  border: 1px solid var(--lch-zinc-200) !important;
+  padding: 2.5rem !important;
+  width: 100% !important;
+  max-width: 24rem !important;
+  box-sizing: border-box !important;
+}
+
+/* Logo - Add before the header */
+.login-pf-header::before {
+  content: "";
+  display: block;
+  width: 100%;
+  height: 3rem;
+  margin-bottom: 1.5rem;
+  background-image: url("../img/logo.svg");
+  background-repeat: no-repeat;
+  background-position: center;
+  background-size: contain;
+}
+
+/* Page title */
+.login-pf-header {
+  text-align: center !important;
+  margin-bottom: 1.5rem !important;
+}
+
+#kc-page-title {
+  font-size: 1.5rem !important;
+  font-weight: 700 !important;
+  color: var(--lch-zinc-900) !important;
+  margin: 0 !important;
+  line-height: 1.3 !important;
+}
+
+/* Form groups */
+.form-group {
+  margin-bottom: 1.25rem !important;
+}
+
+/* Labels */
+.pf-c-form__label,
+.pf-c-form__label-text,
+.control-label,
+label {
+  display: block !important;
+  font-size: 0.875rem !important;
+  font-weight: 500 !important;
+  color: var(--lch-zinc-700) !important;
+  margin-bottom: 0.5rem !important;
+}
+
+/* Form inputs - PatternFly override */
+.pf-c-form-control,
+input[type="text"],
+input[type="password"],
+input[type="email"] {
+  width: 100% !important;
+  padding: 0.75rem 1rem !important;
+  font-size: 0.9375rem !important;
+  line-height: 1.5 !important;
+  color: var(--lch-zinc-900) !important;
+  background-color: white !important;
+  border: 1px solid var(--lch-zinc-300) !important;
+  border-radius: 0.5rem !important;
+  box-shadow: 0 1px 2px 0 rgb(0 0 0 / 0.05) !important;
+  transition: border-color 0.15s ease-in-out, box-shadow 0.15s ease-in-out !important;
+  box-sizing: border-box !important;
+  outline: none !important;
+}
+
+.pf-c-form-control:focus,
+input[type="text"]:focus,
+input[type="password"]:focus,
+input[type="email"]:focus {
+  border-color: var(--lch-green-400) !important;
+  box-shadow: 0 0 0 3px rgba(0, 220, 130, 0.2) !important;
+}
+
+.pf-c-form-control:hover,
+input[type="text"]:hover,
+input[type="password"]:hover,
+input[type="email"]:hover {
+  border-color: var(--lch-zinc-400) !important;
+}
+
+/* Primary button - Sign In (using ID for consistency across all login pages) */
+#kc-login {
+  display: block !important;
+  width: 100% !important;
+  padding: 0.5rem 0.75rem !important;
+  font-size: 1rem !important;
+  font-weight: 500 !important;
+  line-height: 1.5 !important;
+  color: white !important;
+  background-color: var(--lch-green-500) !important;
+  border: none !important;
+  border-radius: 0.5rem !important;
+  cursor: pointer !important;
+  transition: background-color 0.15s ease-in-out, transform 0.1s ease-in-out, box-shadow 0.15s ease-in-out !important;
+  text-align: center !important;
+  box-sizing: border-box !important;
+}
+
+#kc-login:hover {
+  background-color: var(--lch-green-400) !important;
+  box-shadow: 0 4px 6px -1px rgb(0 0 0 / 0.1), 0 2px 4px -2px rgb(0 0 0 / 0.1) !important;
+}
+
+#kc-login:active {
+  background-color: var(--lch-green-700) !important;
+  transform: scale(0.98) !important;
+}
+
+#kc-login:focus {
+  outline: none !important;
+  box-shadow: 0 0 0 3px rgba(0, 220, 130, 0.3) !important;
+}
+
+/* Secondary/link buttons */
+.pf-c-button.pf-m-link {
+  display: inline-flex !important;
+  align-items: center !important;
+  justify-content: center !important;
+  padding: 0.5rem 1rem !important;
+  font-size: 0.875rem !important;
+  font-weight: 500 !important;
+  color: var(--lch-green-600) !important;
+  background-color: transparent !important;
+  border: none !important;
+  cursor: pointer !important;
+  transition: color 0.15s ease-in-out !important;
+}
+
+.pf-c-button.pf-m-link:hover {
+  color: var(--lch-green-700) !important;
+  text-decoration: underline !important;
+}
+
+/* Links */
+a {
+  color: var(--lch-green-600) !important;
+  text-decoration: none !important;
+  transition: color 0.15s ease-in-out !important;
+}
+
+a:hover {
+  color: var(--lch-green-700) !important;
+  text-decoration: underline !important;
+}
+
+/* Alert/Error messages */
+.alert,
+.pf-c-alert {
+  padding: 1rem !important;
+  border-radius: 0.5rem !important;
+  margin-bottom: 1rem !important;
+  font-size: 0.875rem !important;
+}
+
+.alert-error,
+.alert-danger,
+.pf-m-danger {
+  background-color: #fef2f2 !important;
+  border: 1px solid #fecaca !important;
+  color: #dc2626 !important;
+}
+
+.alert-warning,
+.pf-m-warning {
+  background-color: #fffbeb !important;
+  border: 1px solid #fde68a !important;
+  color: #d97706 !important;
+}
+
+.alert-success,
+.pf-m-success {
+  background-color: var(--lch-green-50) !important;
+  border: 1px solid var(--lch-green-200) !important;
+  color: var(--lch-green-700) !important;
+}
+
+.alert-info,
+.pf-m-info {
+  background-color: #eff6ff !important;
+  border: 1px solid #bfdbfe !important;
+  color: #2563eb !important;
+}
+
+/* Checkbox styling */
+input[type="checkbox"] {
+  width: 1rem !important;
+  height: 1rem !important;
+  accent-color: var(--lch-green-500) !important;
+  border-radius: 0.25rem !important;
+  margin-right: 0.5rem !important;
+}
+
+/* Remember me / form options */
+#kc-form-options {
+  margin-top: 0.5rem !important;
+}
+
+#kc-form-options label {
+  display: flex !important;
+  align-items: center !important;
+  font-size: 0.875rem !important;
+  color: var(--lch-zinc-600) !important;
+  font-weight: 400 !important;
+}
+
+/* Forgot password link */
+.login-pf-settings {
+  display: flex !important;
+  justify-content: space-between !important;
+  align-items: center !important;
+}
+
+/* Social login section */
+#kc-social-providers {
+  margin-top: 1.5rem !important;
+  padding-top: 1.5rem !important;
+  border-top: 1px solid var(--lch-zinc-200) !important;
+}
+
+#kc-social-providers ul {
+  list-style: none !important;
+  padding: 0 !important;
+  margin: 0 !important;
+  display: flex !important;
+  flex-direction: column !important;
+  gap: 0.75rem !important;
+}
+
+#kc-social-providers a {
+  display: flex !important;
+  align-items: center !important;
+  justify-content: center !important;
+  padding: 0.75rem 1rem !important;
+  border: 1px solid var(--lch-zinc-300) !important;
+  border-radius: 0.5rem !important;
+  background: white !important;
+  color: var(--lch-zinc-700) !important;
+  font-weight: 500 !important;
+  transition: background-color 0.15s ease-in-out, border-color 0.15s ease-in-out !important;
+}
+
+#kc-social-providers a:hover {
+  background-color: var(--lch-zinc-100) !important;
+  border-color: var(--lch-zinc-400) !important;
+  text-decoration: none !important;
+}
+
+/* Registration link */
+#kc-registration {
+  margin-top: 1.5rem !important;
+  text-align: center !important;
+  font-size: 0.875rem !important;
+  color: var(--lch-zinc-600) !important;
+}
+
+/* Info section */
+#kc-info {
+  margin-top: 1rem !important;
+  text-align: center !important;
+  font-size: 0.875rem !important;
+  color: var(--lch-zinc-500) !important;
+}
+
+/* Password visibility toggle button */
+.pf-c-button.pf-m-control {
+  background: transparent !important;
+  border: none !important;
+  color: var(--lch-zinc-500) !important;
+  cursor: pointer !important;
+  padding: 0.5rem !important;
+}
+
+.pf-c-button.pf-m-control:hover {
+  color: var(--lch-zinc-700) !important;
+}
+
+/* Username display with change link (password step) */
+.label-with-action {
+  display: flex !important;
+  align-items: center !important;
+  justify-content: space-between !important;
+  margin-bottom: 0.5rem !important;
+}
+
+.label-with-action label {
+  margin-bottom: 0 !important;
+}
+
+.change-username-link {
+  display: inline-flex !important;
+  align-items: center !important;
+  gap: 0.25rem !important;
+  font-size: 0.75rem !important;
+  font-weight: 500 !important;
+  color: var(--lch-zinc-500) !important;
+  background: none !important;
+  border: none !important;
+  padding: 0 !important;
+  transition: color 0.15s ease-in-out !important;
+}
+
+.change-username-link:hover {
+  color: var(--lch-green-600) !important;
+  text-decoration: none !important;
+}
+
+.change-username-link svg {
+  width: 0.875rem !important;
+  height: 0.875rem !important;
+}
+
+.change-username-link span {
+  line-height: 1 !important;
+}
+
+/* Disabled username input styling */
+input[disabled],
+input[readonly] {
+  background-color: var(--lch-zinc-100) !important;
+  color: var(--lch-zinc-600) !important;
+  cursor: not-allowed !important;
+  border-color: var(--lch-zinc-200) !important;
+}
+
+input[disabled]:hover,
+input[readonly]:hover {
+  border-color: var(--lch-zinc-200) !important;
+}
+
+/* Hide the default username display in header */
+#kc-username {
+  display: none !important;
+}
+
+/* Input error styling */
+.input-error {
+  display: block !important;
+  margin-top: 0.5rem !important;
+  font-size: 0.8125rem !important;
+  color: #dc2626 !important;
+}
+
+/* ========================================
+   DARK THEME (System preference)
+   ======================================== */
+
+@media (prefers-color-scheme: dark) {
+  html.login-pf,
+  html.login-pf body {
+    background: linear-gradient(135deg, var(--lch-zinc-900) 0%, var(--lch-zinc-950) 100%) !important;
+  }
+
+  .card-pf {
+    background: var(--lch-zinc-800) !important;
+    border-color: var(--lch-zinc-700) !important;
+  }
+
+  #kc-page-title {
+    color: var(--lch-zinc-50) !important;
+  }
+
+  .pf-c-form__label,
+  .pf-c-form__label-text,
+  .control-label,
+  label {
+    color: var(--lch-zinc-300) !important;
+  }
+
+  .pf-c-form-control,
+  input[type="text"],
+  input[type="password"],
+  input[type="email"] {
+    background-color: var(--lch-zinc-900) !important;
+    border-color: var(--lch-zinc-600) !important;
+    color: var(--lch-zinc-100) !important;
+  }
+
+  .pf-c-form-control:hover,
+  input[type="text"]:hover,
+  input[type="password"]:hover,
+  input[type="email"]:hover {
+    border-color: var(--lch-zinc-500) !important;
+  }
+
+  .pf-c-form-control:focus,
+  input[type="text"]:focus,
+  input[type="password"]:focus,
+  input[type="email"]:focus {
+    border-color: var(--lch-green-400) !important;
+    box-shadow: 0 0 0 3px rgba(0, 220, 130, 0.25) !important;
+  }
+
+  a {
+    color: var(--lch-green-400) !important;
+  }
+
+  a:hover {
+    color: var(--lch-green-300) !important;
+  }
+
+  #kc-form-options label,
+  #kc-registration {
+    color: var(--lch-zinc-400) !important;
+  }
+
+  #kc-info {
+    color: var(--lch-zinc-500) !important;
+  }
+
+  .alert-error,
+  .alert-danger,
+  .pf-m-danger {
+    background-color: #450a0a !important;
+    border-color: #7f1d1d !important;
+    color: #fca5a5 !important;
+  }
+
+  .alert-warning,
+  .pf-m-warning {
+    background-color: #451a03 !important;
+    border-color: #78350f !important;
+    color: #fcd34d !important;
+  }
+
+  .alert-success,
+  .pf-m-success {
+    background-color: var(--lch-green-950) !important;
+    border-color: var(--lch-green-800) !important;
+    color: var(--lch-green-300) !important;
+  }
+
+  .alert-info,
+  .pf-m-info {
+    background-color: #1e3a5f !important;
+    border-color: #1e40af !important;
+    color: #93c5fd !important;
+  }
+
+  #kc-social-providers {
+    border-top-color: var(--lch-zinc-700) !important;
+  }
+
+  #kc-social-providers a {
+    background: var(--lch-zinc-800) !important;
+    border-color: var(--lch-zinc-600) !important;
+    color: var(--lch-zinc-200) !important;
+  }
+
+  #kc-social-providers a:hover {
+    background-color: var(--lch-zinc-700) !important;
+    border-color: var(--lch-zinc-500) !important;
+  }
+
+  .pf-c-button.pf-m-control {
+    color: var(--lch-zinc-400) !important;
+  }
+
+  .pf-c-button.pf-m-control:hover {
+    color: var(--lch-zinc-200) !important;
+  }
+
+  /* Username display - dark mode */
+  input[disabled],
+  input[readonly] {
+    background-color: var(--lch-zinc-900) !important;
+    color: var(--lch-zinc-400) !important;
+    border-color: var(--lch-zinc-700) !important;
+  }
+
+  input[disabled]:hover,
+  input[readonly]:hover {
+    border-color: var(--lch-zinc-700) !important;
+  }
+
+  .change-username-link {
+    color: var(--lch-zinc-400) !important;
+  }
+
+  .change-username-link:hover {
+    color: var(--lch-green-400) !important;
+  }
+
+  .input-error {
+    color: #fca5a5 !important;
+  }
+}
+
+/* ========================================
+   RESPONSIVE ADJUSTMENTS
+   ======================================== */
+
+@media (max-width: 480px) {
+  .card-pf {
+    margin: 0.5rem !important;
+    padding: 1.5rem !important;
+  }
+
+  #kc-page-title {
+    font-size: 1.25rem !important;
+  }
+
+  .login-pf-header::before {
+    height: 2.5rem !important;
+  }
+}

deployment/keycloak-theme/legalconsenthub/login/resources/img/logo.svg

@@ -0,0 +1,38 @@
+<svg
+  width="1020"
+  height="200"
+  viewBox="0 0 1020 200"
+  fill="none"
+  xmlns="http://www.w3.org/2000/svg"
+>
+  <path
+    d="M377 200C379.16 200 381 198.209 381 196V103C381 103 386 112 395 127L434 194C435.785 197.74 439.744 200 443 200H470V50H443C441.202 50 439 51.4941 439 54V148L421 116L385 55C383.248 51.8912 379.479 50 376 50H350V200H377Z"
+    fill="#3f3f46"
+  />
+  <path
+    d="M726 92H739C742.314 92 745 89.3137 745 86V60H773V92H800V116H773V159C773 169.5 778.057 174 787 174H800V200H783C759.948 200 745 185.071 745 160V116H726V92Z"
+    fill="#3f3f46"
+  />
+  <path
+    d="M591 92V154C591 168.004 585.742 179.809 578 188C570.258 196.191 559.566 200 545 200C530.434 200 518.742 196.191 511 188C503.389 179.809 498 168.004 498 154V92H514C517.412 92 520.769 92.622 523 95C525.231 97.2459 526 98.5652 526 102V154C526 162.059 526.457 167.037 530 171C533.543 174.831 537.914 176 545 176C552.217 176 555.457 174.831 559 171C562.543 167.037 563 162.059 563 154V102C563 98.5652 563.769 96.378 566 94C567.96 91.9107 570.028 91.9599 573 92C573.411 92.0055 574.586 92 575 92H591Z"
+    fill="#3f3f46"
+  />
+  <path
+    d="M676 144L710 92H684C680.723 92 677.812 93.1758 676 96L660 120L645 97C643.188 94.1758 639.277 92 636 92H611L645 143L608 200H634C637.25 200 640.182 196.787 642 194L660 167L679 195C680.818 197.787 683.75 200 687 200H713L676 144Z"
+    fill="#3f3f46"
+  />
+  <path
+    d="M168 200H279C282.542 200 285.932 198.756 289 197C292.068 195.244 295.23 193.041 297 190C298.77 186.959 300.002 183.51 300 179.999C299.998 176.488 298.773 173.04 297 170.001L222 41C220.23 37.96 218.067 35.7552 215 34C211.933 32.2448 207.542 31 204 31C200.458 31 197.067 32.2448 194 34C190.933 35.7552 188.77 37.96 187 41L168 74L130 9.99764C128.228 6.95784 126.068 3.75491 123 2C119.932 0.245087 116.542 0 113 0C109.458 0 106.068 0.245087 103 2C99.9323 3.75491 96.7717 6.95784 95 9.99764L2 170.001C0.226979 173.04 0.00154312 176.488 1.90993e-06 179.999C-0.0015393 183.51 0.229648 186.959 2 190C3.77035 193.04 6.93245 195.244 10 197C13.0675 198.756 16.4578 200 20 200H90C117.737 200 137.925 187.558 152 164L186 105L204 74L259 168H186L168 200ZM89 168H40L113 42L150 105L125.491 147.725C116.144 163.01 105.488 168 89 168Z"
+    fill="#00dc82"
+  />
+  <path
+    d="M958 60.0001H938C933.524 60.0001 929.926 59.9395 927 63C924.074 65.8905 925 67.5792 925 72V141C925 151.372 923.648 156.899 919 162C914.352 166.931 908.468 169 899 169C889.705 169 882.648 166.931 878 162C873.352 156.899 873 151.372 873 141V72.0001C873 67.5793 872.926 65.8906 870 63.0001C867.074 59.9396 863.476 60.0001 859 60.0001H840V141C840 159.023 845.016 173.458 855 184C865.156 194.542 879.893 200 899 200C918.107 200 932.844 194.542 943 184C953.156 173.458 958 159.023 958 141V60.0001Z"
+    fill="#00dc82"
+  />
+  <path
+    fill-rule="evenodd"
+    clip-rule="evenodd"
+    d="M1000 60.0233L1020 60V77L1020 128V156.007L1020 181L1020 189.004C1020 192.938 1019.98 194.429 1017 197.001C1014.02 199.725 1009.56 200 1005 200H986.001V181.006L986 130.012V70.0215C986 66.1576 986.016 64.5494 989 62.023C991.819 59.6358 995.437 60.0233 1000 60.0233Z"
+    fill="#00dc82"
+  />
+</svg>

deployment/keycloak-theme/legalconsenthub/login/theme.properties

@@ -0,0 +1,5 @@
+parent=keycloak
+import=common/keycloak
+styles=css/login.css css/styles.css
+locales=en,de
+

legalconsenthub/app/pages/callback.vue

@@ -1,11 +1,30 @@
 <template>
-  <h1>Authentication callback processing...</h1>
+  <div class="min-h-screen w-full flex items-center justify-center">
+    <UCard variant="subtle" class="w-full max-w-sm text-center">
+      <div class="flex flex-col items-center gap-4 py-4">
+        <UIcon name="i-lucide-loader-circle" class="size-10 text-primary animate-spin" />
+        <p class="text-xl font-medium text-muted">
+          {{ $t('auth.redirecting') }}
+        </p>
+      </div>
+    </UCard>
+  </div>
 </template>
 
 <script setup lang="ts">
+definePageMeta({ auth: false, layout: 'auth' })
+
+const { t: $t } = useI18n()
+
 onMounted(async () => {
   const logger = useLogger().withTag('auth callback')
   try {
+    // Check if we're in a popup window opened by nuxt-auth-utils
+    if (window.opener) {
+      window.close()
+      return
+    }
+    // Regular redirect flow (not a popup)
     await navigateTo('/')
   } catch (e) {
     logger.error('Error during login', e)

legalconsenthub/app/pages/login.vue

@@ -30,10 +30,17 @@
 definePageMeta({ auth: false, layout: 'auth' })
 
 const { t: $t } = useI18n()
+const { loggedIn, openInPopup } = useUserSession()
 
 useSeoMeta({ title: $t('auth.login') })
 
+watch(loggedIn, (isLoggedIn) => {
+  if (isLoggedIn) {
+    navigateTo('/')
+  }
+})
+
 function handleSignIn() {
-  navigateTo('/auth/keycloak', { external: true })
+  openInPopup('/auth/keycloak')
 }
 </script>

legalconsenthub/i18n/locales/de.json

@@ -175,7 +175,8 @@
     "redirectMessage": "Sie werden zur Authentifizierung zu Keycloak weitergeleitet",
     "signIn": "Mit Keycloak anmelden",
     "termsAgreement": "Mit der Anmeldung stimmen Sie unseren Nutzungsbedingungen zu",
-    "login": "Anmelden"
+    "login": "Anmelden",
+    "redirecting": "Sie werden weitergeleitet"
   },
   "error": {
     "pageNotFound": "Seite nicht gefunden",

legalconsenthub/i18n/locales/en.json

@@ -175,7 +175,8 @@
     "redirectMessage": "You will be redirected to Keycloak to authenticate",
     "signIn": "Sign in with Keycloak",
     "termsAgreement": "By signing in, you agree to our terms of service",
-    "login": "Login"
+    "login": "Login",
+    "redirecting": "You are being redirected"
   },
   "error": {
     "pageNotFound": "Page not found",

legalconsenthub/server/routes/auth/keycloak.get.ts

@@ -38,7 +38,7 @@ export default defineOAuthKeycloakEventHandler({
       loggedInAt: Date.now()
     })
 
-    return sendRedirect(event, '/')
+    return sendRedirect(event, '/callback')
   },
 
   onError(event) {