Dashboard: browser & password-manager autofill disabled on self-hosted sign-in / sign-up forms

What's the bug

On the new dashboard (apps/dashboard), the self-hosted login and signup forms cannot be autofilled or saved by browsers or password managers (1Password, Dashlane, and the built-in Chrome/Safari/Firefox managers). Every field is emitted with anti-autofill signals, so:

• password managers don't offer to fill the email/password on /auth/sign-in, and
• browsers don't offer to save the credential after a successful login/signup.

This affects the community (email + password → POST /v1/auth/login) and the EE/better-auth self-hosted login forms. It does not affect Novu Cloud, where Clerk renders its own autofill-aware form.

Root cause

The shared Input primitive unconditionally spreads an "autofill off" bundle onto every <input>:

• apps/dashboard/src/utils/constants.ts
  typescript复制

  export const AUTOCOMPLETE_PASSWORD_MANAGERS_OFF = {
    autoComplete: 'off',
    'data-1p-ignore': true,      // 1Password: ignore
    'data-form-type': 'other',   // Dashlane / others: not a login
  };

• apps/dashboard/src/components/primitives/input.tsx spreads {...AUTOCOMPLETE_PASSWORD_MANAGERS_OFF} onto the underlying input for all callers.

The auth forms use <Input> but never pass their own name / autoComplete, so those off-defaults win:

• apps/dashboard/src/utils/self-hosted/components.tsx (community SignIn / SignUp)
• apps/dashboard/src/utils/better-auth/components/sign-in.tsx and sign-up.tsx

Result: the rendered inputs have no name, no autocomplete="current-password" / "email" / "new-password", plus data-1p-ignore and data-form-type="other" — the exact combination that tells browsers and password managers to skip both fill and save.

How it got here

The behavior wasn't intended for the auth forms:

• #6975 introduced AUTOCOMPLETE_PASSWORD_MANAGERS_OFF scoped to a single component (the Create Workflow sidebar), to stop 1Password/browser suggestions from covering the workflow name/identifier fields.
• #7281 (integrations create/update flow) later moved the constant into the shared primitives/input.tsx, which unintentionally applied it to every input — including sign-in / sign-up.

Steps to reproduce

1. Run a self-hosted dashboard build (VITE_SELF_HOSTED=true).
2. Open /auth/sign-in with a password manager installed (or rely on the browser's built-in one).
3. Observe: no autofill suggestion on the email/password fields; after logging in, no "save password" prompt. Same on /auth/sign-up.

Expected behavior

Auth (sign-in / sign-up) fields should be autofillable and saveable by browsers and password managers.

Suggested fix

Exempt the auth inputs from the shared "off" default and give them the standard tokens:

• Email → name="email" + autoComplete="email" (or "username")
• Sign-in password → name="password" + autoComplete="current-password"
• Sign-up password → autoComplete="new-password"
• On those auth inputs, cancel the manager-off markers (e.g. data-1p-ignore={false}, data-form-type={undefined}), or make primitives/input.tsx not force AUTOCOMPLETE_PASSWORD_MANAGERS_OFF on auth fields.

The workflow-editor / integration-credential use cases that motivated #6975 / #7281 can keep the off-behavior via an opt-in prop, rather than it being the base-component default.

Environment

• Novu self-hosted, v3.x dashboard (apps/dashboard), community edition (email + password auth).
• Not applicable to Novu Cloud (Clerk-hosted sign-in).