From c3cd567da22a3d27505451e43aaccddd7cb88e9e Mon Sep 17 00:00:00 2001
From: Jason Ross <jason.ross841@gmail.com>
Date: Thu, 2 Jul 2026 22:29:53 -0500
Subject: [PATCH] feat(accountsetup): warn against using account password for
 app password

New users unfamiliar with app passwords commonly try their regular
account password first and get a confusing auth failure. Add a
disclaimer as supporting text directly under the "App password" field
on AppPasswordSetupScreen (shared by every preset provider), instead
of leaving the warning only in the intro InfoCards above.

Closes #160

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .../ui/onboarding/OnboardingFlowTest.kt         | 17 +++++++++++++++++
 .../ui/accountsetup/AppPasswordSetupScreen.kt   |  1 +
 app/src/main/res/values/strings.xml             |  1 +
 3 files changed, 19 insertions(+)

diff --git a/app/src/androidTest/kotlin/org/libremail/ui/onboarding/OnboardingFlowTest.kt b/app/src/androidTest/kotlin/org/libremail/ui/onboarding/OnboardingFlowTest.kt
index ff116c8..f33996f 100644
--- a/app/src/androidTest/kotlin/org/libremail/ui/onboarding/OnboardingFlowTest.kt
+++ b/app/src/androidTest/kotlin/org/libremail/ui/onboarding/OnboardingFlowTest.kt
@@ -280,4 +280,21 @@ class OnboardingFlowTest {
         composeTestRule.onNodeWithText(string(R.string.app_password_open_page, "iCloud Mail"))
             .assertIsDisplayed()
     }
+
+    @Test
+    fun appPasswordSetup_showsAccountPasswordDisclaimerNearField() {
+        setOnboardingContent(FakeAccountRepository(), FakeMailRepository())
+
+        composeTestRule.onNodeWithText(string(R.string.onboarding_add_account)).performClick()
+        waitForText("Gmail")
+        composeTestRule.onNodeWithText("Gmail").performClick()
+
+        // Issue #160: new users unfamiliar with app passwords commonly try their regular account
+        // password first. The disclaimer must render as supporting text directly under the "App
+        // password" field itself (not only in the intro InfoCards above), on every preset provider
+        // screen since they all share this composable.
+        waitForText(string(R.string.app_password_field))
+        composeTestRule.onNodeWithText(string(R.string.app_password_field_disclaimer))
+            .performScrollTo().assertIsDisplayed()
+    }
 }
diff --git a/app/src/main/kotlin/org/libremail/ui/accountsetup/AppPasswordSetupScreen.kt b/app/src/main/kotlin/org/libremail/ui/accountsetup/AppPasswordSetupScreen.kt
index 6fc780d..1eea05b 100644
--- a/app/src/main/kotlin/org/libremail/ui/accountsetup/AppPasswordSetupScreen.kt
+++ b/app/src/main/kotlin/org/libremail/ui/accountsetup/AppPasswordSetupScreen.kt
@@ -188,6 +188,7 @@ fun AppPasswordSetupScreen(
                 singleLine = true,
                 visualTransformation = PasswordVisualTransformation(),
                 keyboardOptions = KeyboardOptions(keyboardType = KeyboardType.Password),
+                supportingText = { Text(stringResource(R.string.app_password_field_disclaimer)) },
                 modifier = Modifier.fillMaxWidth(),
             )
 
diff --git a/app/src/main/res/values/strings.xml b/app/src/main/res/values/strings.xml
index 8134527..8855e90 100644
--- a/app/src/main/res/values/strings.xml
+++ b/app/src/main/res/values/strings.xml
@@ -204,6 +204,7 @@
     <string name="app_password_open_failed">Couldn\'t open your browser</string>
     <string name="app_password_email">Email address</string>
     <string name="app_password_field">App password</string>
+    <string name="app_password_field_disclaimer">Do not try to use your account password. It will not work. You must use an app password.</string>
     <string name="app_password_show_servers">Server settings</string>
     <string name="app_password_server_imap">Incoming (IMAP): %1$s:%2$d (%3$s)</string>
     <string name="app_password_server_smtp">Outgoing (SMTP): %1$s:%2$d (%3$s)</string>
-- 
2.47.3