From 0e0c9d8fdea0c72da7b26af2c517ea9b441725ed Mon Sep 17 00:00:00 2001
From: AIRONAX Developer <aironax@outlook.com>
Date: Fri, 2 Oct 2026 21:13:55 +0530
Subject: [PATCH 1/4] refactor(render): centralize engine HTML template
 relative paths

Add TemplatePath and parse-set helpers (shell layout, shell inner pages,
auth pages) so handlers stop hardcoding filenames under templates/.
---
 core/engine/render/templates_paths.go         | 61 +++++++++++++++++++
 core/engine/templates/{ => auth}/login.html   |  0
 core/engine/templates/{ => auth}/setup.html   |  0
 .../templates/{ => auth}/totp_login.html      |  0
 core/engine/templates/{ => shell}/base.html   |  0
 5 files changed, 61 insertions(+)
 create mode 100644 core/engine/render/templates_paths.go
 rename core/engine/templates/{ => auth}/login.html (100%)
 rename core/engine/templates/{ => auth}/setup.html (100%)
 rename core/engine/templates/{ => auth}/totp_login.html (100%)
 rename core/engine/templates/{ => shell}/base.html (100%)

diff --git a/core/engine/render/templates_paths.go b/core/engine/render/templates_paths.go
new file mode 100644
index 0000000..f23ad96
--- /dev/null
+++ b/core/engine/render/templates_paths.go
@@ -0,0 +1,61 @@
+package render
+
+import "path/filepath"
+
+// Relative paths under TemplatesPath (core/engine/templates).
+const (
+	TemplateShellBase = "shell/base.html"
+
+	TemplatePartialMenuIcons     = "partials/menu_icons.html"
+	TemplatePartialHomeHub       = "partials/home_hub.html"
+	TemplatePartialAppsModule    = "partials/apps_module.html"
+	TemplatePartialLoginBrand    = "partials/login_brand_aside.html"
+	TemplatePartialAuthHead      = "partials/auth_head.html"
+
+	TemplateAuthLogin = "auth/login.html"
+	TemplateAuthTOTP  = "auth/totp_login.html"
+	TemplateAuthSetup = "auth/setup.html"
+
+	TemplatePortalHome  = "portal/portal_home.html"
+	TemplatePortalShare = "portal/portal_share.html"
+
+	TemplatePagesHome           = "pages/home_dashboard.html"
+	TemplatePagesApps           = "pages/apps.html"
+	TemplatePagesAppLogs        = "pages/app_logs.html"
+	TemplatePagesSettingsHub    = "pages/settings_hub.html"
+	TemplatePagesSettingsAccount = "pages/settings_account.html"
+	TemplatePagesSettingsFieldACL = "pages/settings_field_acl.html"
+	TemplatePagesSettingsModelACL = "pages/settings_model_acl.html"
+)
+
+// TemplatePath joins templatesDir with a relative template path.
+func TemplatePath(templatesDir, rel string) string {
+	return filepath.Join(templatesDir, rel)
+}
+
+// ShellLayoutTemplateFiles returns files parsed for base.html layout rendering.
+func ShellLayoutTemplateFiles(templatesDir string) []string {
+	return []string{
+		TemplatePath(templatesDir, TemplateShellBase),
+		TemplatePath(templatesDir, TemplatePartialMenuIcons),
+	}
+}
+
+// ShellInnerTemplateFiles returns files parsed for a shell inner page (pages/*.html).
+func ShellInnerTemplateFiles(templatesDir, pageRel string) []string {
+	return []string{
+		TemplatePath(templatesDir, pageRel),
+		TemplatePath(templatesDir, TemplatePartialMenuIcons),
+		TemplatePath(templatesDir, TemplatePartialHomeHub),
+		TemplatePath(templatesDir, TemplatePartialAppsModule),
+	}
+}
+
+// AuthTemplateFiles returns files parsed for standalone auth pages (login, TOTP, setup).
+func AuthTemplateFiles(templatesDir, pageRel string) []string {
+	return []string{
+		TemplatePath(templatesDir, pageRel),
+		TemplatePath(templatesDir, TemplatePartialLoginBrand),
+		TemplatePath(templatesDir, TemplatePartialAuthHead),
+	}
+}
diff --git a/core/engine/templates/login.html b/core/engine/templates/auth/login.html
similarity index 100%
rename from core/engine/templates/login.html
rename to core/engine/templates/auth/login.html
diff --git a/core/engine/templates/setup.html b/core/engine/templates/auth/setup.html
similarity index 100%
rename from core/engine/templates/setup.html
rename to core/engine/templates/auth/setup.html
diff --git a/core/engine/templates/totp_login.html b/core/engine/templates/auth/totp_login.html
similarity index 100%
rename from core/engine/templates/totp_login.html
rename to core/engine/templates/auth/totp_login.html
diff --git a/core/engine/templates/base.html b/core/engine/templates/shell/base.html
similarity index 100%
rename from core/engine/templates/base.html
rename to core/engine/templates/shell/base.html

From 26dab0d46bf76512bc0ee50f2798dfe99db705f0 Mon Sep 17 00:00:00 2001
From: AIRONAX Developer <aironax@outlook.com>
Date: Fri, 2 Oct 2026 21:14:16 +0530
Subject: [PATCH 2/4] refactor(templates): organize engine HTML under shell,
 auth, pages, portal, partials

Move base.html to shell/, auth pages to auth/, portal pages to portal/,
and shell inner bodies to pages/ (drop *_inner suffix). Split shared
defines into partials (menu icons, home hub, apps module forms, auth
assets, login brand aside). Wire RenderPage, shell inner render, auth
template cache, setup, and portal handlers via render/templates_paths.go.
---
 core/engine/render/page.go                    |  8 +--
 core/engine/templates/README.md               | 17 +++++
 core/engine/templates/auth/login.html         | 25 +------
 core/engine/templates/auth/setup.html         | 16 +----
 core/engine/templates/auth/totp_login.html    | 16 +----
 .../app_logs.html}                            |  0
 .../{apps_inner.html => pages/apps.html}      | 68 -------------------
 .../home_dashboard.html}                      |  0
 .../settings_account.html}                    |  0
 .../settings_field_acl.html}                  |  0
 .../settings_hub.html}                        |  0
 .../settings_model_acl.html}                  |  0
 .../templates/partials/apps_module.html       | 67 ++++++++++++++++++
 core/engine/templates/partials/auth_head.html |  8 +++
 .../home_hub.html}                            |  8 ---
 .../templates/partials/login_brand_aside.html | 34 ++++++++++
 .../engine/templates/partials/menu_icons.html |  7 ++
 .../templates/{ => portal}/portal_home.html   |  0
 .../templates/{ => portal}/portal_share.html  |  0
 core/server/web/login.go                      | 37 ++++++----
 core/server/web/portal_handlers.go            |  5 +-
 core/server/web/setup_handlers.go             | 13 ++--
 core/server/web/shell_render.go               |  7 +-
 core/server/web/web_constants.go              | 23 +++----
 24 files changed, 189 insertions(+), 170 deletions(-)
 create mode 100644 core/engine/templates/README.md
 rename core/engine/templates/{app_logs_inner.html => pages/app_logs.html} (100%)
 rename core/engine/templates/{apps_inner.html => pages/apps.html} (81%)
 rename core/engine/templates/{home_dashboard_inner.html => pages/home_dashboard.html} (100%)
 rename core/engine/templates/{settings_account_inner.html => pages/settings_account.html} (100%)
 rename core/engine/templates/{settings_field_acl_inner.html => pages/settings_field_acl.html} (100%)
 rename core/engine/templates/{settings_hub_inner.html => pages/settings_hub.html} (100%)
 rename core/engine/templates/{settings_model_acl_inner.html => pages/settings_model_acl.html} (100%)
 create mode 100644 core/engine/templates/partials/apps_module.html
 create mode 100644 core/engine/templates/partials/auth_head.html
 rename core/engine/templates/{shell_partials.html => partials/home_hub.html} (75%)
 create mode 100644 core/engine/templates/partials/login_brand_aside.html
 create mode 100644 core/engine/templates/partials/menu_icons.html
 rename core/engine/templates/{ => portal}/portal_home.html (100%)
 rename core/engine/templates/{ => portal}/portal_share.html (100%)

diff --git a/core/engine/render/page.go b/core/engine/render/page.go
index 0471360..3becbe0 100644
--- a/core/engine/render/page.go
+++ b/core/engine/render/page.go
@@ -13,16 +13,14 @@ func RenderPage(ctx context.Context, templatesDir string, data PageData, bootstr
 	if len(data.SWCBootstrapJSON) == 0 {
 		data.SWCBootstrapJSON = BuildSWCBootstrapJSON(ctx, data, bootstrapWorkspace)
 	}
-	tmpl, err := template.ParseFiles(
-		filepath.Join(templatesDir, "base.html"),
-		filepath.Join(templatesDir, "shell_partials.html"),
-	)
+	paths := ShellLayoutTemplateFiles(templatesDir)
+	tmpl, err := template.ParseFiles(paths...)
 	if err != nil {
 		return "", err
 	}
 	var buf bytes.Buffer
 	// Must execute the layout by name: the partials file only defines {{template "sumMenuIcon"}}.
-	if err := tmpl.ExecuteTemplate(&buf, "base.html", data); err != nil {
+	if err := tmpl.ExecuteTemplate(&buf, filepath.Base(TemplateShellBase), data); err != nil {
 		return "", err
 	}
 	return buf.String(), nil
diff --git a/core/engine/templates/README.md b/core/engine/templates/README.md
new file mode 100644
index 0000000..c20ed13
--- /dev/null
+++ b/core/engine/templates/README.md
@@ -0,0 +1,17 @@
+# Engine HTML templates
+
+Root path: `core/engine/templates` (`templates_path` in config). Relative paths are defined in [`render/templates_paths.go`](../render/templates_paths.go).
+
+| Folder | Role | Loaded by |
+|--------|------|-----------|
+| `shell/` | Authenticated app chrome (`base.html`) | `render.RenderPage` |
+| `partials/` | Shared `{{define}}` fragments (menu icons, home hub, apps forms, login brand, auth assets) | Parsed with shell layout, shell inner pages, or auth pages |
+| `pages/` | Main column HTML injected into `base.html` | `web.renderShellPage` / `executeInnerTemplate` |
+| `auth/` | Standalone login, TOTP, setup wizards | `web.getAuthTemplate`, setup handler |
+| `portal/` | Portal home and share pages | `web.loadPortalTemplates` |
+
+## Parse sets
+
+- **Shell layout:** `shell/base.html` + `partials/menu_icons.html`
+- **Shell inner page:** `pages/<page>.html` + menu, home hub, and apps partials
+- **Auth page:** `auth/<page>.html` + `partials/login_brand_aside.html` + `partials/auth_head.html`
diff --git a/core/engine/templates/auth/login.html b/core/engine/templates/auth/login.html
index fb49d7b..e6a3683 100644
--- a/core/engine/templates/auth/login.html
+++ b/core/engine/templates/auth/login.html
@@ -4,32 +4,11 @@
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>Sign in — {{.AppName}}</title>
-    {{range .Stylesheets}}
-    <link rel="stylesheet" href="{{.}}">
-    {{end}}
-    <link rel="preconnect" href="https://fonts.googleapis.com">
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-    <link href="https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,400;0,500;0,700;1,400&display=swap" rel="stylesheet">
+    {{template "auth_head_assets" .}}
 </head>
 <body class="sum-login-page">
 <div class="sum-login-shell">
-    <aside class="sum-login-brand" aria-hidden="false">
-        <div class="sum-login-brand-inner">
-            {{if .LogoURL}}
-            <img src="{{.LogoURL}}" alt="" class="sum-login-brand-logo"/>
-            {{else}}
-            <div class="sum-login-logo sum-login-logo--placeholder sum-login-brand-logo" aria-hidden="true">S</div>
-            {{end}}
-            <p class="sum-login-brand-kicker">{{.AppName}} ERP</p>
-            <h2 class="sum-login-brand-title">{{if .CompanyName}}{{.CompanyName}}{{else}}Secure workspace access{{end}}</h2>
-            <p class="sum-login-brand-copy">Enterprise resource planning with role-based access, audit trails, and optional single sign-on.</p>
-            <ul class="sum-login-trust-list">
-                <li>Encrypted sessions</li>
-                <li>Multi-factor authentication</li>
-                <li>Administrator-controlled identity providers</li>
-            </ul>
-        </div>
-    </aside>
+    {{template "login_brand_aside" .}}
     <main class="sum-login-panel">
         <div class="sum-login-card sum-login-card--panel">
             <h1>Sign in</h1>
diff --git a/core/engine/templates/auth/setup.html b/core/engine/templates/auth/setup.html
index 4f170f0..b8e5155 100644
--- a/core/engine/templates/auth/setup.html
+++ b/core/engine/templates/auth/setup.html
@@ -4,23 +4,11 @@
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>Database setup — Sumeru</title>
-    {{range .Stylesheets}}
-    <link rel="stylesheet" href="{{.}}">
-    {{end}}
-    <link rel="preconnect" href="https://fonts.googleapis.com">
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-    <link href="https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,400;0,500;0,700;1,400&display=swap" rel="stylesheet">
+    {{template "auth_head_assets" .}}
 </head>
 <body class="sum-login-page">
 <div class="sum-login-shell">
-    <aside class="sum-login-brand" aria-hidden="false">
-        <div class="sum-login-brand-inner">
-            <div class="sum-login-logo sum-login-logo--placeholder sum-login-brand-logo" aria-hidden="true">S</div>
-            <p class="sum-login-brand-kicker">Sumeru ERP</p>
-            <h2 class="sum-login-brand-title">Database setup</h2>
-            <p class="sum-login-brand-copy">Connect your PostgreSQL database, create your company, and define the first administrator account.</p>
-        </div>
-    </aside>
+    {{template "login_brand_aside" .}}
     <main class="sum-login-panel">
 <div class="sum-login-card sum-setup-card sum-setup-card--wide sum-login-card--panel">
     <p class="sum-setup-progress" id="stepLabel" aria-live="polite">Step 1 of 4</p>
diff --git a/core/engine/templates/auth/totp_login.html b/core/engine/templates/auth/totp_login.html
index 86b23bd..d98ce04 100644
--- a/core/engine/templates/auth/totp_login.html
+++ b/core/engine/templates/auth/totp_login.html
@@ -4,23 +4,11 @@
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>Two-factor authentication — {{.AppName}}</title>
-    {{range .Stylesheets}}
-    <link rel="stylesheet" href="{{.}}">
-    {{end}}
-    <link rel="preconnect" href="https://fonts.googleapis.com">
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-    <link href="https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,400;0,500;0,700;1,400&display=swap" rel="stylesheet">
+    {{template "auth_head_assets" .}}
 </head>
 <body class="sum-login-page">
 <div class="sum-login-shell">
-    <aside class="sum-login-brand" aria-hidden="false">
-        <div class="sum-login-brand-inner">
-            <div class="sum-login-logo sum-login-logo--placeholder sum-login-brand-logo" aria-hidden="true">S</div>
-            <p class="sum-login-brand-kicker">{{.AppName}} ERP</p>
-            <h2 class="sum-login-brand-title">Verify your identity</h2>
-            <p class="sum-login-brand-copy">Enter the code from your authenticator app to finish signing in.</p>
-        </div>
-    </aside>
+    {{template "login_brand_aside" .}}
     <main class="sum-login-panel">
         <div class="sum-login-card sum-login-card--panel">
             <h1>Authentication code</h1>
diff --git a/core/engine/templates/app_logs_inner.html b/core/engine/templates/pages/app_logs.html
similarity index 100%
rename from core/engine/templates/app_logs_inner.html
rename to core/engine/templates/pages/app_logs.html
diff --git a/core/engine/templates/apps_inner.html b/core/engine/templates/pages/apps.html
similarity index 81%
rename from core/engine/templates/apps_inner.html
rename to core/engine/templates/pages/apps.html
index db24a51..5d8fdac 100644
--- a/core/engine/templates/apps_inner.html
+++ b/core/engine/templates/pages/apps.html
@@ -371,71 +371,3 @@ <h2 id="sum-apps-sys-heading" class="sum-apps-section-label-prem">Technical modu
     </div>
     {{end}}
 </div>
-
-{{define "apps_control_bar"}}
-<form class="sum-apps-control-bar sum-control-bar-wrap" method="get" action="/web/apps" role="search">
-    <input type="hidden" name="layout" value="{{.Layout}}" />
-    {{if .Category}}<input type="hidden" name="category" value="{{.Category}}" />{{end}}
-    <div class="sum-control-bar-row">
-        <div class="sum-control-bar-search-area">
-            <div class="sum-control-bar-search-wrap">
-                <div class="sum-control-bar-search-body">
-                    <input id="sum-apps-q" class="sum-control-bar-search" type="search" name="q" value="{{.Search}}" placeholder="Search apps…" autocomplete="off" aria-label="Search apps" />
-                </div>
-                <button type="submit" class="sum-control-bar-search-submit" aria-label="Search apps">
-                    <svg class="sum-control-bar-search-icon-svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><circle cx="11" cy="11" r="7"/><path d="M21 21l-4.35-4.35"/></svg>
-                </button>
-            </div>
-        </div>
-        <div class="sum-control-bar-tools">
-            <div class="sum-control-bar-segment" role="group" aria-label="Catalog options">
-                <label class="sum-apps-segment-select">
-                    <span class="sum-control-bar-segment-btn {{if ne .Filter "all"}}sum-control-bar-segment-btn--active{{end}}">
-                        <svg class="sum-control-bar-segment-icon" width="15" height="15" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><polygon points="22 3 2 3 10 12.46 10 19 14 21 14 12.46 22 3"/></svg>
-                        <span class="sum-control-bar-segment-label">Filters</span>
-                        {{if ne .Filter "all"}}<span class="sum-control-bar-badge">1</span>{{end}}
-                    </span>
-                    <select name="filter" data-auto-submit aria-label="Filter apps by installation status" title="Filter apps">
-                        <option value="all" {{if eq .Filter "all"}}selected{{end}}>All apps</option>
-                        <option value="installed" {{if eq .Filter "installed"}}selected{{end}}>Installed</option>
-                        <option value="uninstalled" {{if eq .Filter "uninstalled"}}selected{{end}}>Not installed</option>
-                    </select>
-                </label>
-                <label class="sum-apps-segment-select">
-                    <span class="sum-control-bar-segment-btn {{if ne .Scope "all"}}sum-control-bar-segment-btn--active{{end}}">
-                        <svg class="sum-control-bar-segment-icon" width="15" height="15" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M12 2L2 7l10 5 10-5-10-5z"/><path d="M2 17l10 5 10-5"/><path d="M2 12l10 5 10-5"/></svg>
-                        <span class="sum-control-bar-segment-label">Show</span>
-                        {{if ne .Scope "all"}}<span class="sum-control-bar-badge">1</span>{{end}}
-                    </span>
-                    <select name="scope" data-auto-submit aria-label="Show applications or technical modules" title="Show module type">
-                        <option value="all" {{if eq .Scope "all"}}selected{{end}}>Apps &amp; technical</option>
-                        <option value="apps" {{if eq .Scope "apps"}}selected{{end}}>Apps only</option>
-                        <option value="technical" {{if eq .Scope "technical"}}selected{{end}}>Technical only</option>
-                    </select>
-                </label>
-                <label class="sum-apps-segment-select">
-                    <span class="sum-control-bar-segment-btn {{if .GroupBy}}sum-control-bar-segment-btn--active{{end}}">
-                        <svg class="sum-control-bar-segment-icon" width="15" height="15" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M17 21v-2a4 4 0 0 0-4-4H5a4 4 0 0 0-4 4v2"/><circle cx="9" cy="7" r="4"/><path d="M23 21v-2a4 4 0 0 0-3-3.87"/><path d="M16 3.13a4 4 0 0 1 0 7.75"/></svg>
-                        <span class="sum-control-bar-segment-label">Group By</span>
-                        {{if .GroupBy}}<span class="sum-control-bar-badge">1</span>{{end}}
-                    </span>
-                    <select name="group_by" data-auto-submit aria-label="Group apps in the catalog" title="Group apps">
-                        <option value="" {{if not .GroupBy}}selected{{end}}>None</option>
-                        <option value="category" {{if eq .GroupBy "category"}}selected{{end}}>Category</option>
-                    </select>
-                </label>
-            </div>
-        </div>
-    </div>
-</form>
-{{end}}
-
-{{define "apps_post_hiddens"}}
-<input type="hidden" name="apps_layout" value="{{.Layout}}" />
-<input type="hidden" name="apps_filter" value="{{.Filter}}" />
-<input type="hidden" name="apps_scope" value="{{.Scope}}" />
-<input type="hidden" name="apps_q" value="{{.Search}}" />
-<input type="hidden" name="apps_category" value="{{.Category}}" />
-<input type="hidden" name="apps_group_by" value="{{.GroupBy}}" />
-{{if .CSRFToken}}<input type="hidden" name="csrf_token" value="{{.CSRFToken}}" />{{end}}
-{{end}}
diff --git a/core/engine/templates/home_dashboard_inner.html b/core/engine/templates/pages/home_dashboard.html
similarity index 100%
rename from core/engine/templates/home_dashboard_inner.html
rename to core/engine/templates/pages/home_dashboard.html
diff --git a/core/engine/templates/settings_account_inner.html b/core/engine/templates/pages/settings_account.html
similarity index 100%
rename from core/engine/templates/settings_account_inner.html
rename to core/engine/templates/pages/settings_account.html
diff --git a/core/engine/templates/settings_field_acl_inner.html b/core/engine/templates/pages/settings_field_acl.html
similarity index 100%
rename from core/engine/templates/settings_field_acl_inner.html
rename to core/engine/templates/pages/settings_field_acl.html
diff --git a/core/engine/templates/settings_hub_inner.html b/core/engine/templates/pages/settings_hub.html
similarity index 100%
rename from core/engine/templates/settings_hub_inner.html
rename to core/engine/templates/pages/settings_hub.html
diff --git a/core/engine/templates/settings_model_acl_inner.html b/core/engine/templates/pages/settings_model_acl.html
similarity index 100%
rename from core/engine/templates/settings_model_acl_inner.html
rename to core/engine/templates/pages/settings_model_acl.html
diff --git a/core/engine/templates/partials/apps_module.html b/core/engine/templates/partials/apps_module.html
new file mode 100644
index 0000000..3e205d9
--- /dev/null
+++ b/core/engine/templates/partials/apps_module.html
@@ -0,0 +1,67 @@
+{{define "apps_control_bar"}}
+<form class="sum-apps-control-bar sum-control-bar-wrap" method="get" action="/web/apps" role="search">
+    <input type="hidden" name="layout" value="{{.Layout}}" />
+    {{if .Category}}<input type="hidden" name="category" value="{{.Category}}" />{{end}}
+    <div class="sum-control-bar-row">
+        <div class="sum-control-bar-search-area">
+            <div class="sum-control-bar-search-wrap">
+                <div class="sum-control-bar-search-body">
+                    <input id="sum-apps-q" class="sum-control-bar-search" type="search" name="q" value="{{.Search}}" placeholder="Search apps…" autocomplete="off" aria-label="Search apps" />
+                </div>
+                <button type="submit" class="sum-control-bar-search-submit" aria-label="Search apps">
+                    <svg class="sum-control-bar-search-icon-svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><circle cx="11" cy="11" r="7"/><path d="M21 21l-4.35-4.35"/></svg>
+                </button>
+            </div>
+        </div>
+        <div class="sum-control-bar-tools">
+            <div class="sum-control-bar-segment" role="group" aria-label="Catalog options">
+                <label class="sum-apps-segment-select">
+                    <span class="sum-control-bar-segment-btn {{if ne .Filter "all"}}sum-control-bar-segment-btn--active{{end}}">
+                        <svg class="sum-control-bar-segment-icon" width="15" height="15" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><polygon points="22 3 2 3 10 12.46 10 19 14 21 14 12.46 22 3"/></svg>
+                        <span class="sum-control-bar-segment-label">Filters</span>
+                        {{if ne .Filter "all"}}<span class="sum-control-bar-badge">1</span>{{end}}
+                    </span>
+                    <select name="filter" data-auto-submit aria-label="Filter apps by installation status" title="Filter apps">
+                        <option value="all" {{if eq .Filter "all"}}selected{{end}}>All apps</option>
+                        <option value="installed" {{if eq .Filter "installed"}}selected{{end}}>Installed</option>
+                        <option value="uninstalled" {{if eq .Filter "uninstalled"}}selected{{end}}>Not installed</option>
+                    </select>
+                </label>
+                <label class="sum-apps-segment-select">
+                    <span class="sum-control-bar-segment-btn {{if ne .Scope "all"}}sum-control-bar-segment-btn--active{{end}}">
+                        <svg class="sum-control-bar-segment-icon" width="15" height="15" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M12 2L2 7l10 5 10-5-10-5z"/><path d="M2 17l10 5 10-5"/><path d="M2 12l10 5 10-5"/></svg>
+                        <span class="sum-control-bar-segment-label">Show</span>
+                        {{if ne .Scope "all"}}<span class="sum-control-bar-badge">1</span>{{end}}
+                    </span>
+                    <select name="scope" data-auto-submit aria-label="Show applications or technical modules" title="Show module type">
+                        <option value="all" {{if eq .Scope "all"}}selected{{end}}>Apps &amp; technical</option>
+                        <option value="apps" {{if eq .Scope "apps"}}selected{{end}}>Apps only</option>
+                        <option value="technical" {{if eq .Scope "technical"}}selected{{end}}>Technical only</option>
+                    </select>
+                </label>
+                <label class="sum-apps-segment-select">
+                    <span class="sum-control-bar-segment-btn {{if .GroupBy}}sum-control-bar-segment-btn--active{{end}}">
+                        <svg class="sum-control-bar-segment-icon" width="15" height="15" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M17 21v-2a4 4 0 0 0-4-4H5a4 4 0 0 0-4 4v2"/><circle cx="9" cy="7" r="4"/><path d="M23 21v-2a4 4 0 0 0-3-3.87"/><path d="M16 3.13a4 4 0 0 1 0 7.75"/></svg>
+                        <span class="sum-control-bar-segment-label">Group By</span>
+                        {{if .GroupBy}}<span class="sum-control-bar-badge">1</span>{{end}}
+                    </span>
+                    <select name="group_by" data-auto-submit aria-label="Group apps in the catalog" title="Group apps">
+                        <option value="" {{if not .GroupBy}}selected{{end}}>None</option>
+                        <option value="category" {{if eq .GroupBy "category"}}selected{{end}}>Category</option>
+                    </select>
+                </label>
+            </div>
+        </div>
+    </div>
+</form>
+{{end}}
+
+{{define "apps_post_hiddens"}}
+<input type="hidden" name="apps_layout" value="{{.Layout}}" />
+<input type="hidden" name="apps_filter" value="{{.Filter}}" />
+<input type="hidden" name="apps_scope" value="{{.Scope}}" />
+<input type="hidden" name="apps_q" value="{{.Search}}" />
+<input type="hidden" name="apps_category" value="{{.Category}}" />
+<input type="hidden" name="apps_group_by" value="{{.GroupBy}}" />
+{{if .CSRFToken}}<input type="hidden" name="csrf_token" value="{{.CSRFToken}}" />{{end}}
+{{end}}
diff --git a/core/engine/templates/partials/auth_head.html b/core/engine/templates/partials/auth_head.html
new file mode 100644
index 0000000..9b7de42
--- /dev/null
+++ b/core/engine/templates/partials/auth_head.html
@@ -0,0 +1,8 @@
+{{define "auth_head_assets"}}
+    {{range .Stylesheets}}
+    <link rel="stylesheet" href="{{.}}">
+    {{end}}
+    <link rel="preconnect" href="https://fonts.googleapis.com">
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+    <link href="https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,400;0,500;0,700;1,400&display=swap" rel="stylesheet">
+{{end}}
diff --git a/core/engine/templates/shell_partials.html b/core/engine/templates/partials/home_hub.html
similarity index 75%
rename from core/engine/templates/shell_partials.html
rename to core/engine/templates/partials/home_hub.html
index 02b27aa..b1f53b4 100644
--- a/core/engine/templates/shell_partials.html
+++ b/core/engine/templates/partials/home_hub.html
@@ -1,11 +1,3 @@
-{{define "sumMenuIcon"}}
-{{- if . -}}
-<svg class="sum-menu-icon" aria-hidden="true" width="18" height="18" viewBox="0 0 24 24" focusable="false">
-  <use href="/static/img/menu-icons.svg#i-{{.}}"></use>
-</svg>
-{{- end -}}
-{{end}}
-
 {{define "sumHomePinIcon"}}
 <svg class="sum-home-pin-icon" width="16" height="16" viewBox="0 0 24 24" aria-hidden="true">
   <path class="sum-home-pin-icon-outline" d="M19 21l-7-5-7 5V5a2 2 0 0 1 2-2h10a2 2 0 0 1 2 2v16z" fill="none" stroke="currentColor" stroke-width="2" stroke-linejoin="round"/>
diff --git a/core/engine/templates/partials/login_brand_aside.html b/core/engine/templates/partials/login_brand_aside.html
new file mode 100644
index 0000000..2b0acb9
--- /dev/null
+++ b/core/engine/templates/partials/login_brand_aside.html
@@ -0,0 +1,34 @@
+{{define "login_brand_aside"}}
+<aside class="sum-login-brand{{if .Brand.AccentClass}} {{.Brand.AccentClass}}{{end}}" aria-label="Sign-in branding">
+    <div class="sum-login-brand-bg" aria-hidden="true"></div>
+    <div class="sum-login-brand-inner">
+        <div class="sum-login-brand-lockup">
+            <img src="{{.Brand.LogoURL}}" alt="{{.Brand.LogoAlt}}" class="sum-login-brand-logo" width="96" height="96"/>
+        </div>
+        {{if .Brand.Kicker}}
+        <p class="sum-login-brand-kicker">{{.Brand.Kicker}}</p>
+        {{end}}
+        <h2 class="sum-login-brand-title">{{.Brand.Headline}}</h2>
+        <p class="sum-login-brand-copy">{{.Brand.Tagline}}</p>
+        {{if .Brand.ShowTrustChips}}
+        <ul class="sum-login-trust-chips" role="list">
+            <li class="sum-login-trust-chip">
+                <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" aria-hidden="true"><path d="M20 6L9 17l-5-5"/></svg>
+                Encrypted sessions
+            </li>
+            <li class="sum-login-trust-chip">
+                <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" aria-hidden="true"><path d="M20 6L9 17l-5-5"/></svg>
+                Multi-factor authentication
+            </li>
+            <li class="sum-login-trust-chip">
+                <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" aria-hidden="true"><path d="M20 6L9 17l-5-5"/></svg>
+                Admin-controlled SSO
+            </li>
+        </ul>
+        {{end}}
+        {{if .Brand.ShowPoweredBy}}
+        <p class="sum-login-powered">Powered by {{$.AppName}}</p>
+        {{end}}
+    </div>
+</aside>
+{{end}}
diff --git a/core/engine/templates/partials/menu_icons.html b/core/engine/templates/partials/menu_icons.html
new file mode 100644
index 0000000..51cbd12
--- /dev/null
+++ b/core/engine/templates/partials/menu_icons.html
@@ -0,0 +1,7 @@
+{{define "sumMenuIcon"}}
+{{- if . -}}
+<svg class="sum-menu-icon" aria-hidden="true" width="18" height="18" viewBox="0 0 24 24" focusable="false">
+  <use href="/static/img/menu-icons.svg#i-{{.}}"></use>
+</svg>
+{{- end -}}
+{{end}}
diff --git a/core/engine/templates/portal_home.html b/core/engine/templates/portal/portal_home.html
similarity index 100%
rename from core/engine/templates/portal_home.html
rename to core/engine/templates/portal/portal_home.html
diff --git a/core/engine/templates/portal_share.html b/core/engine/templates/portal/portal_share.html
similarity index 100%
rename from core/engine/templates/portal_share.html
rename to core/engine/templates/portal/portal_share.html
diff --git a/core/server/web/login.go b/core/server/web/login.go
index d7d43d7..4477bc8 100644
--- a/core/server/web/login.go
+++ b/core/server/web/login.go
@@ -8,7 +8,6 @@ import (
 	"html/template"
 	"net/http"
 	"net/url"
-	"path/filepath"
 	"strconv"
 	"strings"
 	"sync"
@@ -33,10 +32,9 @@ type loginPageData struct {
 	Error             string
 	CSRFToken         string
 	Stylesheets       []string
-	LogoURL           string
+	Brand             loginBrand
 	AuthProviders     []loginAuthProvider
 	LocalLoginEnabled bool
-	CompanyName       string
 	AppName           string
 	InfoTitle         string
 	InfoBody          string
@@ -203,14 +201,22 @@ func parsePositiveInt(s string) int {
 	return n
 }
 
+func resetAuthTemplateCache() {
+	authTemplateMu.Lock()
+	defer authTemplateMu.Unlock()
+	authTemplateCache = map[string]*template.Template{}
+	authTemplateErrs = map[string]error{}
+}
+
 func getAuthTemplate(filename string) (*template.Template, error) {
 	authTemplateMu.Lock()
 	defer authTemplateMu.Unlock()
 	if _, loaded := authTemplateErrs[filename]; loaded {
 		return authTemplateCache[filename], authTemplateErrs[filename]
 	}
-	path := filepath.Join(config.AppConfig.TemplatesPath, filename)
-	tmpl, err := template.ParseFiles(path)
+	dir := config.AppConfig.TemplatesPath
+	paths := render.AuthTemplateFiles(dir, filename)
+	tmpl, err := template.ParseFiles(paths...)
 	authTemplateCache[filename] = tmpl
 	authTemplateErrs[filename] = err
 	return tmpl, err
@@ -223,11 +229,10 @@ func buildLoginPageData(r *http.Request, next, errorMessage, csrfToken string) l
 		Error:             errorMessage,
 		CSRFToken:         csrfToken,
 		Stylesheets:       assets.LoginStylesheetURLs(),
-		LogoURL:           render.ShellLogoURL(),
+		Brand:             resolveLoginBrand(ctx),
 		AuthProviders:     listEnabledAuthProviders(ctx),
 		LocalLoginEnabled: authLocalEnabled(ctx),
-		CompanyName:       loginPageCompanyName(ctx),
-		AppName:           "Sumeru",
+		AppName:           loginBrandPlatformName,
 		Year:              time.Now().Year(),
 	}
 	if flash, ok := FlashFromQueryMessage(r.URL.Query().Get(flashMessageParam)); ok {
@@ -244,7 +249,7 @@ func buildLoginPageData(r *http.Request, next, errorMessage, csrfToken string) l
 	return data
 }
 
-func writeAuthFormPage(w http.ResponseWriter, r *http.Request, templateFile, logRoute string, statusCode int, next, errorMessage, csrfToken string) {
+func writeAuthFormPage(w http.ResponseWriter, r *http.Request, templateFile, logRoute string, statusCode int, next, errorMessage, csrfToken string, adjust func(*loginPageData)) {
 	tmpl, err := getAuthTemplate(templateFile)
 	if err != nil {
 		if statusCode == http.StatusOK {
@@ -267,12 +272,16 @@ func writeAuthFormPage(w http.ResponseWriter, r *http.Request, templateFile, log
 	if statusCode != http.StatusOK {
 		w.WriteHeader(statusCode)
 	}
-	_ = tmpl.Execute(w, buildLoginPageData(r, next, errorMessage, csrfToken))
+	data := buildLoginPageData(r, next, errorMessage, csrfToken)
+	if adjust != nil {
+		adjust(&data)
+	}
+	_ = tmpl.Execute(w, data)
 }
 
 func showAuthFormError(w http.ResponseWriter, r *http.Request, templateFile, logRoute string, statusCode int, next, errorMessage string) {
 	csrfToken := setLoginCSRFCookie(w)
-	writeAuthFormPage(w, r, templateFile, logRoute, statusCode, next, errorMessage, csrfToken)
+	writeAuthFormPage(w, r, templateFile, logRoute, statusCode, next, errorMessage, csrfToken, nil)
 }
 
 func registerTOTPRoutes() {
@@ -286,7 +295,9 @@ func TOTPLoginGet(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	csrfToken := setLoginCSRFCookie(w)
-	writeAuthFormPage(w, r, totpLoginTemplateFile, totpLoginRoute, http.StatusOK, resolveLoginNext(r), "", csrfToken)
+	writeAuthFormPage(w, r, totpLoginTemplateFile, totpLoginRoute, http.StatusOK, resolveLoginNext(r), "", csrfToken, func(data *loginPageData) {
+		data.Brand = totpLoginBrand(data.Brand)
+	})
 }
 
 func TOTPLoginPost(w http.ResponseWriter, r *http.Request) {
@@ -421,7 +432,7 @@ func LoginGet(w http.ResponseWriter, r *http.Request) {
 	}
 
 	csrfToken := setLoginCSRFCookie(w)
-	writeAuthFormPage(w, r, loginTemplateFile, loginRoute, http.StatusOK, resolveLoginNext(r), "", csrfToken)
+	writeAuthFormPage(w, r, loginTemplateFile, loginRoute, http.StatusOK, resolveLoginNext(r), "", csrfToken, nil)
 }
 
 func LoginPost(w http.ResponseWriter, r *http.Request) {
diff --git a/core/server/web/portal_handlers.go b/core/server/web/portal_handlers.go
index 3d7db81..c1ef1ba 100644
--- a/core/server/web/portal_handlers.go
+++ b/core/server/web/portal_handlers.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"html/template"
 	"net/http"
-	"path/filepath"
 	"strconv"
 	"strings"
 	"sync"
@@ -152,13 +151,13 @@ func loadPortalTemplates() (*template.Template, *template.Template, error) {
 	portalTemplateOnce.Do(func() {
 		dir := config.AppConfig.TemplatesPath
 		portalHomeTmpl, portalTemplateErr = template.ParseFiles(
-			filepath.Join(dir, "portal_home.html"),
+			render.TemplatePath(dir, render.TemplatePortalHome),
 		)
 		if portalTemplateErr != nil {
 			return
 		}
 		portalShareTmpl, portalTemplateErr = template.ParseFiles(
-			filepath.Join(dir, "portal_share.html"),
+			render.TemplatePath(dir, render.TemplatePortalShare),
 		)
 	})
 	return portalHomeTmpl, portalShareTmpl, portalTemplateErr
diff --git a/core/server/web/setup_handlers.go b/core/server/web/setup_handlers.go
index 59828c0..ccb2c85 100644
--- a/core/server/web/setup_handlers.go
+++ b/core/server/web/setup_handlers.go
@@ -7,13 +7,13 @@ import (
 	"html/template"
 	"net/http"
 	"os"
-	"path/filepath"
 	"strings"
 	"syscall"
 	"time"
 
 	"sumeru/core/applog"
 	"sumeru/core/engine/assets"
+	"sumeru/core/engine/render"
 	"sumeru/core/errcode"
 	"sumeru/core/module"
 	"sumeru/core/orm"
@@ -35,6 +35,8 @@ type setupPageData struct {
 	DbName             string
 	Stylesheets        []string
 	SetupTokenRequired bool
+	AppName            string
+	Brand              loginBrand
 }
 
 // SetupInitHandler runs database sync, installs base, bootstraps security from the JSON wizard payload, then restarts.
@@ -144,14 +146,17 @@ func buildSetupPageData() setupPageData {
 		DbName:             config.AppConfig.DbName,
 		Stylesheets:        assets.LoginStylesheetURLs(),
 		SetupTokenRequired: strings.TrimSpace(config.AppConfig.SetupToken) != "",
+		AppName:            loginBrandPlatformName,
+		Brand:              setupLoginBrand(),
 	}
 }
 
 func writeSetupPage(w http.ResponseWriter, ctx context.Context, pageData setupPageData) {
-	templatePath := filepath.Join(config.AppConfig.TemplatesPath, setupTemplateFile)
-	templateFile, err := template.ParseFiles(templatePath)
+	dir := config.AppConfig.TemplatesPath
+	paths := render.AuthTemplateFiles(dir, setupTemplateFile)
+	templateFile, err := template.ParseFiles(paths...)
 	if err != nil {
-		logSetupFailure(ctx, "Failed to parse setup template", err, map[string]interface{}{"template": templatePath})
+		logSetupFailure(ctx, "Failed to parse setup template", err, map[string]interface{}{"template": setupTemplateFile})
 		http.Error(w, "Setup template missing", http.StatusInternalServerError)
 		return
 	}
diff --git a/core/server/web/shell_render.go b/core/server/web/shell_render.go
index badf659..782567a 100644
--- a/core/server/web/shell_render.go
+++ b/core/server/web/shell_render.go
@@ -5,8 +5,6 @@ import (
 	"context"
 	"html/template"
 	"net/http"
-	"path/filepath"
-
 	"sumeru/core/engine/render"
 	"sumeru/core/errcode"
 	"sumeru/core/server/config"
@@ -50,10 +48,7 @@ func resolveShellRoute(opts shellPageOpts, r *http.Request) string {
 }
 
 func executeInnerTemplate(ctx context.Context, w http.ResponseWriter, route string, opts shellPageOpts) (template.HTML, bool) {
-	templatePaths := []string{
-		filepath.Join(config.AppConfig.TemplatesPath, opts.InnerTemplate),
-		filepath.Join(config.AppConfig.TemplatesPath, shellPartialsTemplate),
-	}
+	templatePaths := render.ShellInnerTemplateFiles(config.AppConfig.TemplatesPath, opts.InnerTemplate)
 	templateFile, err := template.ParseFiles(templatePaths...)
 	if err != nil {
 		webLogFail(ctx, route, "render", "Failed to parse inner template", err, logStatusFailure, map[string]interface{}{"template": opts.InnerTemplate})
diff --git a/core/server/web/web_constants.go b/core/server/web/web_constants.go
index 5ebaae5..cbb2344 100644
--- a/core/server/web/web_constants.go
+++ b/core/server/web/web_constants.go
@@ -31,7 +31,7 @@ const (
 // Setup wizard limits and templates.
 const (
 	maxSetupInitBodyBytes = 1 << 17 // 128 KiB
-	setupTemplateFile     = "setup.html"
+	setupTemplateFile     = render.TemplateAuthSetup
 	setupOperation        = "setup"
 	setupCompleteMessage  = "Setup complete — server is restarting…"
 	setupTokenHeader      = "X-Setup-Token"
@@ -41,8 +41,7 @@ const (
 
 // Shell layout templates and defaults.
 const (
-	shellPartialsTemplate = "shell_partials.html"
-	defaultPageTitle      = "Sumeru"
+	defaultPageTitle = "Sumeru"
 )
 
 // Pinned apps API form fields and limits.
@@ -61,8 +60,8 @@ const (
 
 // Login page identifiers and form fields.
 const (
-	loginTemplateFile       = "login.html"
-	totpLoginTemplateFile   = "totp_login.html"
+	loginTemplateFile       = render.TemplateAuthLogin
+	totpLoginTemplateFile   = render.TemplateAuthTOTP
 	totpLoginRoute          = "/web/login/totp"
 	loginCSRFCookie         = "sumeru_login_csrf"
 	loginNextCookie         = "sumeru_login_next"
@@ -128,7 +127,7 @@ const (
 // Home dashboard page identifiers.
 const (
 	homeMenuRootXMLID = "base.menu_home_root"
-	homeInnerTemplate = "home_dashboard_inner.html"
+	homeInnerTemplate = render.TemplatePagesHome
 	homePageTitle     = "Home"
 	homeStylesheetURL = "/static/css/sumeru-home.css"
 	homeEmptyMessage  = "No installed applications. Install apps from Apps."
@@ -138,7 +137,7 @@ const (
 // App logs page identifiers.
 const (
 	appLogsMenuXMLID       = "base.menu_app_logs"
-	appLogsInnerTemplate   = "app_logs_inner.html"
+	appLogsInnerTemplate   = render.TemplatePagesAppLogs
 	appLogsPageTitle       = "App Logs"
 	appLogsBreadcrumb      = "Event Log"
 	appLogModel            = "app.log"
@@ -151,13 +150,13 @@ const (
 const (
 	settingsRootMenuXMLID      = "base.menu_settings_root"
 	settingsHubMenuXMLID       = render.MenuGeneralSettingsXMLID
-	settingsHubInnerTemplate   = "settings_hub_inner.html"
+	settingsHubInnerTemplate   = render.TemplatePagesSettingsHub
 	settingsHubPageTitle       = "Settings"
 	settingsHubStylesheetURL   = "/static/css/sumeru-settings-hub.css"
 	settingsHubBodyClass         = " sum-body--settings-hub"
-	settingsAccountInnerTemplate  = "settings_account_inner.html"
-	settingsFieldACLInnerTemplate = "settings_field_acl_inner.html"
-	settingsModelACLInnerTemplate = "settings_model_acl_inner.html"
+	settingsAccountInnerTemplate  = render.TemplatePagesSettingsAccount
+	settingsFieldACLInnerTemplate = render.TemplatePagesSettingsFieldACL
+	settingsModelACLInnerTemplate = render.TemplatePagesSettingsModelACL
 	groupUserXML                 = "base.group_user"
 )
 
@@ -298,7 +297,7 @@ const (
 const (
 	appsRoute         = "/web/apps"
 	appsPageTitle     = "Apps"
-	appsInnerTemplate = "apps_inner.html"
+	appsInnerTemplate = render.TemplatePagesApps
 	appsModuleModel   = "sys.module"
 )
 

From 27fea0e4d48c32f5e3023005940a98326476a1aa Mon Sep 17 00:00:00 2001
From: AIRONAX Developer <aironax@outlook.com>
Date: Fri, 2 Oct 2026 21:14:27 +0530
Subject: [PATCH 3/4] feat(web): login tenant branding with company logo and
 default Sumeru mark

Add core.company login_logo and login_tagline with form fields. Resolve
sign-in panel branding: company upload via public GET /web/login/logo,
then logo_path in config, then bundled sumeru-logo.svg. Modern left-panel
CSS with accent classes from company color index. Document host-level
logo_path and company_display_name in sumeru.conf.example.
---
 addons/base/models/core_company.go            |   2 +
 addons/base/views/core_company_form_views.xml |   9 ++
 core/engine/assets/css/sumeru-login.css       | 127 +++++++++++----
 core/engine/assets/img/sumeru-logo.svg        |  10 ++
 core/server/web/login_brand_logo.go           |  67 ++++++++
 core/server/web/login_branding.go             | 149 ++++++++++++++++++
 core/server/web/routes_table.go               |   1 +
 sumeru.conf.example                           |   4 +-
 8 files changed, 338 insertions(+), 31 deletions(-)
 create mode 100644 core/engine/assets/img/sumeru-logo.svg
 create mode 100644 core/server/web/login_brand_logo.go
 create mode 100644 core/server/web/login_branding.go

diff --git a/addons/base/models/core_company.go b/addons/base/models/core_company.go
index 8b382b0..e81eaa4 100644
--- a/addons/base/models/core_company.go
+++ b/addons/base/models/core_company.go
@@ -24,4 +24,6 @@ type CoreCompany struct {
 	MailChatterEnabled       sdk.Boolean               `sumeru:"string=Chatter,default=true"`
 	MailActivityPanelEnabled sdk.Boolean               `sumeru:"string=Activity panel,default=true"`
 	Color                    sdk.Integer               `sumeru:"string=Color Index"`
+	LoginLogo                sdk.Text                  `sumeru:"string=Login logo"`
+	LoginTagline             sdk.String                `sumeru:"string=Login tagline"`
 }
diff --git a/addons/base/views/core_company_form_views.xml b/addons/base/views/core_company_form_views.xml
index b9842f1..756f36a 100644
--- a/addons/base/views/core_company_form_views.xml
+++ b/addons/base/views/core_company_form_views.xml
@@ -28,6 +28,15 @@
                     </group>
                 </group>
 
+                <group string="Login branding">
+                    <group>
+                        <field name="login_logo" string="Login logo" widget="image"/>
+                    </group>
+                    <group>
+                        <field name="login_tagline" string="Login tagline" placeholder="Shown on the sign-in page…"/>
+                    </group>
+                </group>
+
                 <group string="Address">
                     <group>
                         <field name="street" string="Street"/>
diff --git a/core/engine/assets/css/sumeru-login.css b/core/engine/assets/css/sumeru-login.css
index f03fffc..eb425c9 100644
--- a/core/engine/assets/css/sumeru-login.css
+++ b/core/engine/assets/css/sumeru-login.css
@@ -15,8 +15,16 @@
 }
 
 .sum-login-brand {
+  --sum-login-accent: var(--sum-header);
+  position: relative;
   flex: 1 1 42%;
-  background: linear-gradient(145deg, var(--sum-header) 0%, var(--sum-header-dark) 55%, #1a2332 100%);
+  overflow: hidden;
+  background: linear-gradient(
+    155deg,
+    var(--sum-header-dark) 0%,
+    var(--sum-header) 42%,
+    color-mix(in srgb, var(--sum-login-accent) 35%, #1a2332) 100%
+  );
   color: var(--sum-surface);
   display: flex;
   align-items: center;
@@ -24,65 +32,126 @@
   padding: 3rem 2.5rem;
 }
 
+.sum-login-brand--accent-0 { --sum-login-accent: #875a7b; }
+.sum-login-brand--accent-1 { --sum-login-accent: #9c9c9c; }
+.sum-login-brand--accent-2 { --sum-login-accent: #67917a; }
+.sum-login-brand--accent-3 { --sum-login-accent: #a06666; }
+.sum-login-brand--accent-4 { --sum-login-accent: #8899aa; }
+.sum-login-brand--accent-5 { --sum-login-accent: #d4a017; }
+.sum-login-brand--accent-6 { --sum-login-accent: #6a5acd; }
+.sum-login-brand--accent-7 { --sum-login-accent: #4682b4; }
+.sum-login-brand--accent-8 { --sum-login-accent: #c0392b; }
+.sum-login-brand--accent-9 { --sum-login-accent: #e67e22; }
+.sum-login-brand--accent-10 { --sum-login-accent: #27ae60; }
+.sum-login-brand--accent-11 { --sum-login-accent: #3498db; }
+
+.sum-login-brand-bg {
+  position: absolute;
+  inset: 0;
+  pointer-events: none;
+  background-image:
+    linear-gradient(rgba(255, 255, 255, 0.04) 1px, transparent 1px),
+    linear-gradient(90deg, rgba(255, 255, 255, 0.04) 1px, transparent 1px);
+  background-size: 32px 32px;
+  mask-image: radial-gradient(ellipse 85% 70% at 30% 40%, #000 20%, transparent 75%);
+}
+
+.sum-login-brand-bg::after {
+  content: "";
+  position: absolute;
+  width: 420px;
+  height: 420px;
+  right: -120px;
+  top: -80px;
+  border-radius: 50%;
+  background: radial-gradient(circle, color-mix(in srgb, var(--sum-login-accent) 45%, transparent) 0%, transparent 70%);
+  opacity: 0.55;
+}
+
 .sum-login-brand-inner {
-  max-width: 420px;
+  position: relative;
+  z-index: 1;
+  max-width: 440px;
 }
 
-.sum-login-brand-logo {
+.sum-login-brand-lockup {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  padding: 0.65rem;
   margin: 0 0 1.75rem;
-  width: 72px;
-  height: 72px;
+  border-radius: 20px;
+  background: rgba(255, 255, 255, 0.08);
+  border: 1px solid rgba(255, 255, 255, 0.14);
+  box-shadow: 0 12px 40px rgba(0, 0, 0, 0.22);
+}
+
+.sum-login-brand-logo {
+  display: block;
+  width: 96px;
+  height: 96px;
+  object-fit: contain;
+  border-radius: 14px;
 }
 
 .sum-login-brand-kicker {
   margin: 0 0 0.5rem;
   font-size: var(--sum-font-size-sm);
   font-weight: var(--sum-font-weight-semibold);
-  letter-spacing: 0.08em;
+  letter-spacing: 0.12em;
   text-transform: uppercase;
-  opacity: 0.85;
+  opacity: 0.88;
+  color: color-mix(in srgb, var(--sum-login-accent) 55%, #fff);
 }
 
 .sum-login-brand-title {
   margin: 0 0 1rem;
-  font-size: 1.75rem;
+  font-size: clamp(1.5rem, 2.5vw, 2rem);
   font-weight: var(--sum-font-weight-bold);
-  line-height: 1.2;
-  letter-spacing: -0.02em;
+  line-height: 1.15;
+  letter-spacing: -0.025em;
 }
 
 .sum-login-brand-copy {
   margin: 0 0 1.5rem;
   font-size: var(--sum-font-size-md);
   line-height: 1.55;
-  opacity: 0.92;
+  opacity: 0.9;
+  max-width: 36ch;
 }
 
-.sum-login-trust-list {
+.sum-login-trust-chips {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.5rem;
   margin: 0;
   padding: 0;
   list-style: none;
+}
+
+.sum-login-trust-chip {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.35rem;
+  padding: 0.35rem 0.65rem;
   font-size: var(--sum-font-size-sm);
-  line-height: 1.6;
-  opacity: 0.9;
+  line-height: 1.35;
+  border-radius: 999px;
+  background: rgba(255, 255, 255, 0.1);
+  border: 1px solid rgba(255, 255, 255, 0.12);
 }
 
-.sum-login-trust-list li {
-  position: relative;
-  padding-left: 1.25rem;
-  margin-bottom: 0.35rem;
+.sum-login-trust-chip svg {
+  flex-shrink: 0;
+  opacity: 0.9;
 }
 
-.sum-login-trust-list li::before {
-  content: "";
-  position: absolute;
-  left: 0;
-  top: 0.55em;
-  width: 6px;
-  height: 6px;
-  border-radius: 50%;
-  background: var(--sum-surface);
-  opacity: 0.75;
+.sum-login-powered {
+  margin: 2rem 0 0;
+  font-size: var(--sum-font-size-sm);
+  letter-spacing: 0.04em;
+  text-transform: uppercase;
+  opacity: 0.65;
 }
 
 .sum-login-panel {
@@ -229,7 +298,7 @@
     font-size: 1.35rem;
   }
 
-  .sum-login-trust-list {
+  .sum-login-trust-chips {
     display: none;
   }
 }
diff --git a/core/engine/assets/img/sumeru-logo.svg b/core/engine/assets/img/sumeru-logo.svg
new file mode 100644
index 0000000..bcf2cbe
--- /dev/null
+++ b/core/engine/assets/img/sumeru-logo.svg
@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 96 96" role="img" aria-label="Sumeru">
+  <defs>
+    <linearGradient id="sum-mark" x1="12" y1="8" x2="84" y2="88" gradientUnits="userSpaceOnUse">
+      <stop offset="0" stop-color="#5b8def"/>
+      <stop offset="1" stop-color="#2d4a7a"/>
+    </linearGradient>
+  </defs>
+  <rect width="96" height="96" rx="22" fill="url(#sum-mark)"/>
+  <path fill="#fff" d="M28 32c0-4.4 3.6-8 8-8h24c4.4 0 8 3.6 8 8v4H28v-4zm0 12h40v4c0 4.4-3.6 8-8 8H36c-4.4 0-8-3.6-8-8v-4zm8 16h24c4.4 0 8 3.6 8 8v4H28v-4c0-4.4 3.6-8 8-8z"/>
+</svg>
diff --git a/core/server/web/login_brand_logo.go b/core/server/web/login_brand_logo.go
new file mode 100644
index 0000000..d72c341
--- /dev/null
+++ b/core/server/web/login_brand_logo.go
@@ -0,0 +1,67 @@
+package web
+
+import (
+	"encoding/base64"
+	"net/http"
+	"strings"
+)
+
+const maxLoginLogoDecodedBytes = 512 << 10 // 512 KiB
+
+// LoginBrandLogoHandler serves the first company's login_logo for unauthenticated sign-in pages.
+func LoginBrandLogoHandler(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+	payload := loadLoginCompanyLogoPayload(r.Context())
+	if payload == "" {
+		http.NotFound(w, r)
+		return
+	}
+	mime, data, ok := parseLoginLogoDataURL(payload)
+	if !ok {
+		http.NotFound(w, r)
+		return
+	}
+	if len(data) > maxLoginLogoDecodedBytes {
+		http.NotFound(w, r)
+		return
+	}
+	w.Header().Set("Content-Type", mime)
+	w.Header().Set("Cache-Control", "public, max-age=300")
+	w.Header().Set("X-Content-Type-Options", "nosniff")
+	_, _ = w.Write(data)
+}
+
+func parseLoginLogoDataURL(raw string) (mime string, data []byte, ok bool) {
+	raw = strings.TrimSpace(raw)
+	if !strings.HasPrefix(raw, "data:") {
+		return "", nil, false
+	}
+	rest := strings.TrimPrefix(raw, "data:")
+	semi := strings.Index(rest, ";")
+	if semi <= 0 {
+		return "", nil, false
+	}
+	mime = strings.TrimSpace(rest[:semi])
+	if !strings.HasPrefix(mime, "image/") {
+		return "", nil, false
+	}
+	if !strings.HasPrefix(rest[semi:], ";base64,") {
+		return "", nil, false
+	}
+	b64 := strings.TrimPrefix(rest[semi:], ";base64,")
+	decoded, err := base64.StdEncoding.DecodeString(b64)
+	if err != nil {
+		return "", nil, false
+	}
+	if len(decoded) == 0 {
+		return "", nil, false
+	}
+	return mime, decoded, true
+}
+
+func registerLoginBrandRoutes() {
+	registerPublic(http.MethodGet, loginBrandLogoRoute, LoginBrandLogoHandler)
+}
diff --git a/core/server/web/login_branding.go b/core/server/web/login_branding.go
new file mode 100644
index 0000000..348760f
--- /dev/null
+++ b/core/server/web/login_branding.go
@@ -0,0 +1,149 @@
+package web
+
+import (
+	"context"
+	"strconv"
+	"strings"
+
+	"sumeru/core/engine/render"
+	"sumeru/core/orm"
+	"sumeru/core/server/config"
+)
+
+const (
+	defaultSumeruLogoURL     = "/static/img/sumeru-logo.svg"
+	loginBrandLogoRoute      = "/web/login/logo"
+	loginBrandPlatformName   = "Sumeru"
+	defaultLoginHeadline     = "Enterprise workspace"
+	defaultLoginTagline      = "Role-based access, audit trails, and optional single sign-on for your organization."
+	defaultLoginTenantTagline = "Sign in to continue to your workspace."
+)
+
+// loginBrand is the left-panel hero on auth pages (login, TOTP, setup).
+type loginBrand struct {
+	LogoURL        string
+	LogoAlt        string
+	Kicker         string
+	Headline       string
+	Tagline        string
+	ShowTrustChips bool
+	ShowPoweredBy  bool
+	AccentClass    string
+}
+
+type loginCompanyRow struct {
+	Name         string
+	LoginLogo    string
+	LoginTagline string
+	Color        int
+}
+
+var kanbanAccentHex = []string{
+	"#875a7b", "#9c9c9c", "#67917a", "#a06666", "#8899aa", "#d4a017",
+	"#6a5acd", "#4682b4", "#c0392b", "#e67e22", "#27ae60", "#3498db",
+}
+
+func resolveLoginBrand(ctx context.Context) loginBrand {
+	row := loadLoginCompanyRow(ctx)
+	return buildLoginBrand(row)
+}
+
+func defaultSumeruLoginBrand() loginBrand {
+	return loginBrand{
+		LogoURL:        defaultSumeruLogoURL,
+		LogoAlt:        loginBrandPlatformName,
+		Kicker:         loginBrandPlatformName,
+		Headline:       defaultLoginHeadline,
+		Tagline:        defaultLoginTagline,
+		ShowTrustChips: true,
+	}
+}
+
+func buildLoginBrand(row loginCompanyRow) loginBrand {
+	out := defaultSumeruLoginBrand()
+
+	cfgName := strings.TrimSpace(config.AppConfig.CompanyDisplayName)
+	companyName := strings.TrimSpace(row.Name)
+	if companyName == "" {
+		companyName = cfgName
+	}
+
+	tagline := strings.TrimSpace(row.LoginTagline)
+	hasCompanyLogo := strings.TrimSpace(row.LoginLogo) != ""
+	shellLogo := strings.TrimSpace(render.ShellLogoURL())
+
+	switch {
+	case hasCompanyLogo:
+		out.LogoURL = loginBrandLogoRoute
+		out.LogoAlt = companyName
+		if companyName == "" {
+			out.LogoAlt = loginBrandPlatformName
+		}
+	case shellLogo != "":
+		out.LogoURL = shellLogo
+		out.LogoAlt = loginBrandPlatformName
+	}
+
+	tenantBranded := hasCompanyLogo || companyName != "" || tagline != ""
+	if tenantBranded && companyName != "" {
+		out.Kicker = "Welcome"
+		out.Headline = companyName
+		if tagline != "" {
+			out.Tagline = tagline
+		} else {
+			out.Tagline = defaultLoginTenantTagline
+		}
+		out.ShowPoweredBy = true
+	} else if cfgName != "" {
+		out.Kicker = "Welcome"
+		out.Headline = cfgName
+		out.Tagline = defaultLoginTenantTagline
+		out.ShowPoweredBy = true
+	}
+
+	if class := kanbanAccentClass(row.Color); class != "" {
+		out.AccentClass = class
+	}
+	return out
+}
+
+func loadLoginCompanyRow(ctx context.Context) loginCompanyRow {
+	ctx = orm.AuditedBypass(ctx, "login.brand")
+	rows, err := orm.SearchLimit(ctx, "core.company", nil, 1)
+	if err != nil || len(rows) == 0 {
+		return loginCompanyRow{}
+	}
+	rec := rows[0]
+	return loginCompanyRow{
+		Name:         oauthRowString(rec, "name"),
+		LoginLogo:    oauthRowString(rec, "login_logo"),
+		LoginTagline: oauthRowString(rec, "login_tagline"),
+		Color:        int(oauthRowInt(rec, "color")),
+	}
+}
+
+func loadLoginCompanyLogoPayload(ctx context.Context) string {
+	return strings.TrimSpace(loadLoginCompanyRow(ctx).LoginLogo)
+}
+
+func kanbanAccentClass(colorIndex int) string {
+	if colorIndex < 0 || colorIndex >= len(kanbanAccentHex) {
+		return ""
+	}
+	return "sum-login-brand--accent-" + strconv.Itoa(colorIndex)
+}
+
+func totpLoginBrand(base loginBrand) loginBrand {
+	base.Headline = "Verify your identity"
+	base.Tagline = "Enter the code from your authenticator app to finish signing in."
+	base.ShowTrustChips = false
+	return base
+}
+
+func setupLoginBrand() loginBrand {
+	b := defaultSumeruLoginBrand()
+	b.Headline = "Database setup"
+	b.Tagline = "Connect your PostgreSQL database, create your company, and define the first administrator account."
+	b.ShowTrustChips = false
+	return b
+}
diff --git a/core/server/web/routes_table.go b/core/server/web/routes_table.go
index 7ad6b13..15cd754 100644
--- a/core/server/web/routes_table.go
+++ b/core/server/web/routes_table.go
@@ -60,6 +60,7 @@ func registerAuthRoutes() {
 	registerAPIKeyRevealRoute()
 	registerOAuthRoutes()
 	registerTOTPRoutes()
+	registerLoginBrandRoutes()
 }
 
 func registerWorkspaceRoutes() {
diff --git a/sumeru.conf.example b/sumeru.conf.example
index e582d0e..e8e6ec4 100644
--- a/sumeru.conf.example
+++ b/sumeru.conf.example
@@ -46,8 +46,8 @@ log_rolling = false
 # assets_path =
 # templates_path =
 # brand_css =
-# logo_path =
-# company_display_name =
+# logo_path =            # Host-level sign-in + shell logo when core.company login_logo is empty (served as /static/app-logo)
+# company_display_name = # Sign-in headline when no company name in the database yet
 # user_display_name =
 
 # Database pool (optional — tune for production load)

From 4facf878f527a7978e3bf03279f674b6c5bf41b2 Mon Sep 17 00:00:00 2001
From: AIRONAX Developer <aironax@outlook.com>
Date: Fri, 2 Oct 2026 21:14:37 +0530
Subject: [PATCH 4/4] test(web): login branding resolver, logo route, and auth
 HTML shell

Export build-brand and logo-route helpers for tests. Add logo priority
and data-URL parsing tests. Extend login GET test for brand lockup and
default SVG. Reset auth template cache when TemplatesPath changes in tests.
---
 core/server/web/testexports.go              | 44 ++++++++++
 test/core/server/web/login_branding_test.go | 90 +++++++++++++++++++++
 test/core/server/web/login_csrf_test.go     |  3 +-
 3 files changed, 136 insertions(+), 1 deletion(-)
 create mode 100644 test/core/server/web/login_branding_test.go

diff --git a/core/server/web/testexports.go b/core/server/web/testexports.go
index fe8253f..1251c0c 100644
--- a/core/server/web/testexports.go
+++ b/core/server/web/testexports.go
@@ -445,6 +445,50 @@ func ListEnabledAuthProvidersForTest(ctx context.Context) []LoginAuthProviderFor
 // LoginPageCompanyNameForTest returns branding text for the login page.
 func LoginPageCompanyNameForTest(ctx context.Context) string { return loginPageCompanyName(ctx) }
 
+// TestLoginBrandLogoRoute is the public company login logo URL.
+const TestLoginBrandLogoRoute = loginBrandLogoRoute
+
+// TestDefaultSumeruLogoURL is the bundled default sign-in logo path.
+const TestDefaultSumeruLogoURL = defaultSumeruLogoURL
+
+// LoginCompanyRowForTest configures synthetic login branding inputs.
+type LoginCompanyRowForTest struct {
+	Name         string
+	LoginLogo    string
+	LoginTagline string
+	Color        int
+}
+
+// LoginBrandSnapshotForTest is the resolved left-panel branding for assertions.
+type LoginBrandSnapshotForTest struct {
+	LogoURL        string
+	ShowPoweredBy  bool
+	ShowTrustChips bool
+}
+
+// BuildLoginBrandForTest resolves branding from a synthetic company row (no DB).
+func BuildLoginBrandForTest(row LoginCompanyRowForTest) LoginBrandSnapshotForTest {
+	b := buildLoginBrand(loginCompanyRow(row))
+	return LoginBrandSnapshotForTest{
+		LogoURL:        b.LogoURL,
+		ShowPoweredBy:  b.ShowPoweredBy,
+		ShowTrustChips: b.ShowTrustChips,
+	}
+}
+
+// ParseLoginLogoDataURLForTest decodes login logo data URLs for tests.
+func ParseLoginLogoDataURLForTest(raw string) (mime string, data []byte, ok bool) {
+	return parseLoginLogoDataURL(raw)
+}
+
+// LoginBrandLogoGetForTest exposes the public login logo handler.
+func LoginBrandLogoGetForTest(w http.ResponseWriter, r *http.Request) {
+	LoginBrandLogoHandler(w, r)
+}
+
+// ResetAuthTemplateCacheForTest clears parsed auth HTML templates (tests change TemplatesPath).
+func ResetAuthTemplateCacheForTest() { resetAuthTemplateCache() }
+
 // LogoutGetForTest exposes the logout GET handler for tests.
 func LogoutGetForTest(w http.ResponseWriter, r *http.Request) { LogoutGet(w, r) }
 
diff --git a/test/core/server/web/login_branding_test.go b/test/core/server/web/login_branding_test.go
new file mode 100644
index 0000000..c140a71
--- /dev/null
+++ b/test/core/server/web/login_branding_test.go
@@ -0,0 +1,90 @@
+package web_test
+
+import (
+	"encoding/base64"
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"sumeru/core/engine/render"
+	"sumeru/core/server/config"
+	"sumeru/core/server/web"
+)
+
+func TestBuildLoginBrand_logoPriority(t *testing.T) {
+	render.SetShellBranding(render.ShellBranding{})
+	t.Cleanup(func() { render.SetShellBranding(render.ShellBranding{}) })
+
+	defaultBrand := web.BuildLoginBrandForTest(web.LoginCompanyRowForTest{})
+	if defaultBrand.LogoURL != web.TestDefaultSumeruLogoURL {
+		t.Fatalf("default logo: got %q want %q", defaultBrand.LogoURL, web.TestDefaultSumeruLogoURL)
+	}
+	if defaultBrand.ShowPoweredBy {
+		t.Fatal("default brand should not show powered-by")
+	}
+	if !defaultBrand.ShowTrustChips {
+		t.Fatal("default brand should show trust chips")
+	}
+
+	withCompanyLogo := web.BuildLoginBrandForTest(web.LoginCompanyRowForTest{
+		Name:      "Acme",
+		LoginLogo: "data:image/png;base64,abcd",
+	})
+	if withCompanyLogo.LogoURL != web.TestLoginBrandLogoRoute {
+		t.Fatalf("company logo route: got %q", withCompanyLogo.LogoURL)
+	}
+	if !withCompanyLogo.ShowPoweredBy {
+		t.Fatal("tenant brand should show powered-by")
+	}
+
+	render.SetShellBranding(render.ShellBranding{LogoURL: "/static/app-logo"})
+	cfgBrand := web.BuildLoginBrandForTest(web.LoginCompanyRowForTest{})
+	if cfgBrand.LogoURL != "/static/app-logo" {
+		t.Fatalf("config logo: got %q", cfgBrand.LogoURL)
+	}
+}
+
+func TestParseLoginLogoDataURL(t *testing.T) {
+	png := []byte{0x89, 0x50, 0x4e, 0x47}
+	raw := "data:image/png;base64," + base64.StdEncoding.EncodeToString(png)
+	mime, data, ok := web.ParseLoginLogoDataURLForTest(raw)
+	if !ok || mime != "image/png" || len(data) != len(png) {
+		t.Fatalf("parse ok=%v mime=%q len=%d", ok, mime, len(data))
+	}
+	if _, _, bad := web.ParseLoginLogoDataURLForTest("data:text/plain;base64,YQ=="); bad {
+		t.Fatal("expected reject non-image mime")
+	}
+}
+
+func TestLoginBrandLogoGet_notFoundWithoutLogo(t *testing.T) {
+	req := httptest.NewRequest(http.MethodGet, web.TestLoginBrandLogoRoute, nil)
+	rec := httptest.NewRecorder()
+	web.LoginBrandLogoGetForTest(rec, req)
+	if rec.Code != http.StatusNotFound {
+		t.Fatalf("status: got %d", rec.Code)
+	}
+}
+
+func TestLoginGet_rendersBrandLockup(t *testing.T) {
+	root := sumeruModuleRoot(t)
+	prevTemplates := config.AppConfig.TemplatesPath
+	config.AppConfig.TemplatesPath = filepath.Join(root, "core", "engine", "templates")
+	t.Cleanup(func() { config.AppConfig.TemplatesPath = prevTemplates })
+	web.ResetAuthTemplateCacheForTest()
+
+	req := httptest.NewRequest(http.MethodGet, web.TestLoginRoute, nil)
+	rec := httptest.NewRecorder()
+	web.LoginGetForTest(rec, req)
+	body := rec.Body.String()
+	for _, needle := range []string{
+		"sum-login-brand-lockup",
+		web.TestDefaultSumeruLogoURL,
+		"sum-login-trust-chip",
+	} {
+		if !strings.Contains(body, needle) {
+			t.Fatalf("missing %q in login HTML", needle)
+		}
+	}
+}
diff --git a/test/core/server/web/login_csrf_test.go b/test/core/server/web/login_csrf_test.go
index f551de1..c264c12 100644
--- a/test/core/server/web/login_csrf_test.go
+++ b/test/core/server/web/login_csrf_test.go
@@ -184,12 +184,13 @@ func TestLoginGet_rendersEnterpriseShell(t *testing.T) {
 	t.Cleanup(func() {
 		config.AppConfig.TemplatesPath = prevTemplates
 	})
+	web.ResetAuthTemplateCacheForTest()
 
 	req := httptest.NewRequest(http.MethodGet, web.TestLoginRoute+"?msg="+web.TestOAuthDeniedMsg, nil)
 	rec := httptest.NewRecorder()
 	web.LoginGetForTest(rec, req)
 	body := rec.Body.String()
-	for _, needle := range []string{"sum-login-shell", "sum-login-brand", "Sign in", "Authorized users only"} {
+	for _, needle := range []string{"sum-login-shell", "sum-login-brand-lockup", web.TestDefaultSumeruLogoURL, "Sign in", "Authorized users only"} {
 		if !strings.Contains(body, needle) {
 			t.Fatalf("missing %q in login HTML", needle)
 		}