[chore] Refactor HTML templates and CSS (#2480)

* [chore] Refactor HTML templates and CSS

* eslint

* ignore "Local"

* rss tests

* fiddle with OG just a tiny bit

* dick around with polls a bit more so SR stops saying "clickable"

* remove break

* oh lord

* don't lazy load avatar

* fix ogmeta tests

* clean up some cruft

* catch remaining calls to c.HTML

* fix error rendering + stack overflow in tag

* allow templating attributes

* fix indent

* set aria-hidden on status complementary content, since it's already present in the label anyway

* tidy up templating calls a little

* try to make styling a bit more consistent + readable

* fix up some remaining CSS issues

* fix up reports

4 files changed, 63 insertions, 37 deletions

diff --git a/internal/api/auth/authorize.go b/internal/api/auth/authorize.go
index 4977ae4f2..e4694de57 100644
--- a/internal/api/auth/authorize.go
+++ b/internal/api/auth/authorize.go
@@ -144,17 +144,25 @@ func (m *Module) AuthorizeGETHandler(c *gin.Context) {
 		return
 	}
 
-	// the authorize template will display a form to the user where they can get some information
-	// about the app that's trying to authorize, and the scope of the request.
-	// They can then approve it if it looks OK to them, which will POST to the AuthorizePOSTHandler
-	c.HTML(http.StatusOK, "authorize.tmpl", gin.H{
-		"appname":    app.Name,
-		"appwebsite": app.Website,
-		"redirect":   redirect,
-		"scope":      scope,
-		"user":       acct.Username,
-		"instance":   instance,
-	})
+	// The authorize template will display a form
+	// to the user where they can see some info
+	// about the app that's trying to authorize,
+	// and the scope of the request. They can then
+	// approve it if it looks OK to them, which
+	// will POST to the AuthorizePOSTHandler.
+	page := apiutil.WebPage{
+		Template: "authorize.tmpl",
+		Instance: instance,
+		Extra: map[string]any{
+			"appname":    app.Name,
+			"appwebsite": app.Website,
+			"redirect":   redirect,
+			"scope":      scope,
+			"user":       acct.Username,
+		},
+	}
+
+	apiutil.TemplateWebPage(c, page)
 }
 
 // AuthorizePOSTHandler should be served as POST at https://example.org/oauth/authorize
diff --git a/internal/api/auth/callback.go b/internal/api/auth/callback.go
index 97b3ae279..d0fa78322 100644
--- a/internal/api/auth/callback.go
+++ b/internal/api/auth/callback.go
@@ -143,11 +143,17 @@ func (m *Module) CallbackGETHandler(c *gin.Context) {
 			apiutil.ErrorHandler(c, gtserror.NewErrorInternalError(err), m.processor.InstanceGetV1)
 			return
 		}
-		c.HTML(http.StatusOK, "finalize.tmpl", gin.H{
-			"instance":          instance,
-			"name":              claims.Name,
-			"preferredUsername": claims.PreferredUsername,
-		})
+
+		page := apiutil.WebPage{
+			Template: "finalize.tmpl",
+			Instance: instance,
+			Extra: map[string]any{
+				"name":              claims.Name,
+				"preferredUsername": claims.PreferredUsername,
+			},
+		}
+
+		apiutil.TemplateWebPage(c, page)
 		return
 	}
 	s.Set(sessionUserID, user.ID)
@@ -177,12 +183,18 @@ func (m *Module) FinalizePOSTHandler(c *gin.Context) {
 			apiutil.ErrorHandler(c, errWithCode, m.processor.InstanceGetV1)
 			return
 		}
-		c.HTML(http.StatusOK, "finalize.tmpl", gin.H{
-			"instance":          instance,
-			"name":              form.Name,
-			"preferredUsername": form.Username,
-			"error":             err,
-		})
+
+		page := apiutil.WebPage{
+			Template: "finalize.tmpl",
+			Instance: instance,
+			Extra: map[string]any{
+				"name":              form.Name,
+				"preferredUsername": form.Username,
+				"error":             err,
+			},
+		}
+
+		apiutil.TemplateWebPage(c, page)
 	}
 
 	// check if the username conforms to the spec
diff --git a/internal/api/auth/oob.go b/internal/api/auth/oob.go
index 5953524ab..8c7b1f2a5 100644
--- a/internal/api/auth/oob.go
+++ b/internal/api/auth/oob.go
@@ -21,7 +21,6 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"net/http"
 
 	"github.com/gin-contrib/sessions"
 	"github.com/gin-gonic/gin"
@@ -101,10 +100,15 @@ func (m *Module) OobHandler(c *gin.Context) {
 	// we're done with the session now, so just clear it out
 	m.clearSession(s)
 
-	c.HTML(http.StatusOK, "oob.tmpl", gin.H{
-		"instance": instance,
-		"user":     acct.Username,
-		"oobToken": oobToken,
-		"scope":    scope,
-	})
+	page := apiutil.WebPage{
+		Template: "oob.tmpl",
+		Instance: instance,
+		Extra: map[string]any{
+			"user":     acct.Username,
+			"oobToken": oobToken,
+			"scope":    scope,
+		},
+	}
+
+	apiutil.TemplateWebPage(c, page)
 }
diff --git a/internal/api/auth/signin.go b/internal/api/auth/signin.go
index a6b503a83..a8713d05f 100644
--- a/internal/api/auth/signin.go
+++ b/internal/api/auth/signin.go
@@ -32,8 +32,8 @@ import (
 	"golang.org/x/crypto/bcrypt"
 )
 
-// login just wraps a form-submitted username (we want an email) and password
-type login struct {
+// signIn just wraps a form-submitted username (we want an email) and password
+type signIn struct {
 	Email    string `form:"username"`
 	Password string `form:"password"`
 }
@@ -55,10 +55,12 @@ func (m *Module) SignInGETHandler(c *gin.Context) {
 			return
 		}
 
-		// no idp provider, use our own funky little sign in page
-		c.HTML(http.StatusOK, "sign-in.tmpl", gin.H{
-			"instance": instance,
-		})
+		page := apiutil.WebPage{
+			Template: "sign-in.tmpl",
+			Instance: instance,
+		}
+
+		apiutil.TemplateWebPage(c, page)
 		return
 	}
 
@@ -83,7 +85,7 @@ func (m *Module) SignInGETHandler(c *gin.Context) {
 func (m *Module) SignInPOSTHandler(c *gin.Context) {
 	s := sessions.Default(c)
 
-	form := &login{}
+	form := &signIn{}
 	if err := c.ShouldBind(form); err != nil {
 		m.clearSession(s)
 		apiutil.ErrorHandler(c, gtserror.NewErrorBadRequest(err, oauth.HelpfulAdvice), m.processor.InstanceGetV1)
@@ -129,7 +131,7 @@ func (m *Module) ValidatePassword(ctx context.Context, email string, password st
 	}
 
 	if err := bcrypt.CompareHashAndPassword([]byte(user.EncryptedPassword), []byte(password)); err != nil {
-		err := fmt.Errorf("password hash didn't match for user %s during login attempt: %s", user.Email, err)
+		err := fmt.Errorf("password hash didn't match for user %s during sign in attempt: %s", user.Email, err)
 		return incorrectPassword(err)
 	}