cdc-rba-site: a plain CDC login page for the RBA rules tests

Live at https://ppp.rba-rules.morenorub.io/ (DreamHost shared hosting, Apache, ~/ppp.rba-rules.morenorub.io, beside the other IOC PoCs; the previous host, ppp.morenorub.io, redirects there with a 301). Static pages with the SAP CDC Web SDK and a screen-set, nothing else: no OIDC, no backend, no build step. It exists to try every risk-based authentication (RBA) rule of a site and watch what the SDK reports. It is an educational PoC, so every page sits at its own visible route. The root redirects to the login page (302, in the .htaccess).

Pages

Page	What it shows
`login.html`	Opens the login screen when there is no session; `onLogin` goes to the console with the risk assessment.
`register.html`	Opens the registration screen, same header and session line, to see which rules fire on a new account.
`readme.html`	This file as a page of the site, generated at deploy from `README.md` with marked and `readme-template.html`. Linked from the header of both pages. `README.md` itself is still served as plain text (`.htaccess`).

Site and apiKey

Item	Value
Site	Juan's own CDC site for the PPP tests, data center EU1, trusted domain `ppp.rba-rules.morenorub.io` (added to the Trusted Site URLs in the console)
apiKey	`4_uVG18hGCJy1mRnrse6eJAg` (in `login.html` and `register.html`, the `gigya.js` tag)
Screen-set	The site default from the console (`defaultRegScreenSet` in the SDK config, `OIDC-RegistrationLogin` today); `Default-RegistrationLogin` as fallback in `rba.js`
Data center	US1 (`cdns.gigya.com`)

If the SDK answers with a domain error, ppp.rba-rules.morenorub.io is missing from the trusted site URLs of that site in the CDC console. The site has no CNAME prefix, so the SDK talks to accounts.eu1.gigya.com directly and no reverse proxy is needed (the Olympics PPP sites use the prefix olympicid, which on this domain has no certificate; that is why the page has a site of its own). If the page loads but the screen stays empty, the site has no default screen-set in the console and the fallback name does not exist: set the default in the console or change FALLBACK_SCREEN_SET.

Files

File	Role
`login.html`	The header (Olympic rings, Olympics.com, the RBA tests tag), the session line, the Login and Register buttons, `#container` for the screen-set. Loads `rba.js` before `gigya.js` so the global `onGigyaServiceReady` exists when the SDK looks for it. `data-start-screen="gigya-login-screen"` on the body.
`register.html`	Same page with `data-start-screen="gigya-register-screen"`: the registration screen opens on load.
`rba.js`	`onGigyaServiceReady` registers `onLogin` and `onLogout` once and asks CDC for the session: a live session paints the green line, no session paints the screen named by the body attribute. Every event payload goes to the console. `loginWithRaaS`, `registerWithRaaS`, `logoutWithRaaS` wrap `showScreenSet` and `accounts.logout`.
(CDN) `@animateicons/vanilla@0.2.0`, `lucide.js`	Draws the animated `file-text` icon of the README link (`<animate-icons>`). A trial of AnimateIcons for the fleet: pinned version, 948 KB raw / 109 KB gzip, played from `rba.js` on hover of the whole link.
`readme-template.html`	The head and the header of the site around a marker where the deploy puts the converted README.
`rba.css`	Colours as variables, then one block per band of the page: header, session line, title and actions, screen-set container.
`.htaccess`	Apache rules: dotfiles answer 404, the root goes to `login.html`, `README.md` is plain text, 10 minute cache on `.js` and `.css`.
`deploy-rba-site.sh`	Generates `readme.html` (marked, pinned) and uploads the files to DreamHost over rsync (`dreamhost`) and compares each one back over HTTP.

Where the look comes from

The header follows olympics.com: a thin white bar with a light line under it, the five rings at a discreet size and the name in a system sans. The page started from the OP test pages in docs/la28-new-op-pages/ (live under ioc/ on morenorub.io) and kept only their centered container; every OIDC piece of those pages (the OIDC SDK, consent and error pages, logout pages) stays out.

Deploy

./deploy-rba-site.sh

The .htaccess caches .js and .css for 10 minutes (DreamHost's default is 30 days), so a hard reload shows the new version at once. The ?v= suffix in the pages is kept as a habit and is bumped on bigger changes (2026-10-26d today).

What to look at during the RBA tests

Open /login.html with DevTools on the Console tab.
Log in with a PPP account. Every challenge a rule triggers (captcha, TFA, account lock, an extra screen) is rendered by CDC inside the screen-set.
On success the console prints onLogin with the full event payload, and the same object stays in window.lastLoginEvent for inspection. The session line under the bar shows the email and the UID.
Logout from the button on the session line; onLogout is logged too and the screen of the page comes back for the next case. With a session still open the page shows no form: every case starts from a logout, so RBA evaluates a clean login each time.

Errors the page shows

Every screen-set is opened with onAfterSubmit and onError, so a refused submit reaches the page. The session line turns red and says the code and a text (403120 · Account temporarily locked out (RBA rule)), the response is logged and kept in window.lastSubmitResponse. For every code except 403042 (wrong login or password) and 403043 (login identifier exists), whose field text the screen-set already explains, the same line replaces the error text inside the form. The codes with a text of their own are in ERROR_TEXTS in rba.js: 403042, 403043, 403120, 403100 (password change required), 403101 and 403102 (two-factor pending), 206001 and 206002 (registration and email verification pending). Any other code shows the errorMessage CDC sends.

The skill cdc-screensets-poc describes the pattern this page follows.