Welcome back

Use your St Mary's email address

Are you a parent?Sign in here →

before // . If anything is missing we fall back to the canonical SMILE // labels so the page still renders cleanly when hit directly without the // host-router pipeline (e.g. local file open). (function applyBranding() { var h = (window.SMILE_HOST || {}); var heroLabel = h.heroLabel || 'SMILE'; var subtitle = h.subtitle || "St Mary's School Ascot"; var brandKey = (h.brandKey || 'navy').toLowerCase(); // Brand-key class on the card switches accent tints. var card = document.getElementById('auth-card'); if (card) card.classList.add('brand-' + brandKey); // Hero badge + page copy var badge = document.getElementById('auth-hero-badge-label'); if (badge) badge.textContent = heroLabel; var sub = document.getElementById('auth-pane-subtitle'); if (sub) { // First sentence personalises with module label; second stays generic // so staff always know they're getting the school account flow. sub.textContent = 'Sign in to ' + heroLabel + ' with your school Microsoft account.'; } // Browser tab label try { document.title = heroLabel + ' — SMILE · ' + subtitle; } catch (e) { /* read-only in some sandboxes */ } })(); // ── AUTO-REDIRECT ───────────────────────────────────────── // Honour ?redirect=... if it's same-origin, else send to /. var _loginRedirect = new URLSearchParams(window.location.search).get('redirect') || '/'; if (_loginRedirect.charAt(0) !== '/' || _loginRedirect.charAt(1) === '/') _loginRedirect = '/'; // Domain hint mirrors public/login.html so MSAL skips the home-realm // discovery screen for our tenant. Keep in sync if the school's primary // domain ever changes. var ENTRA_DOMAIN_HINT = 'stmarysascot.com'; // Hero photo — admin-configurable login hero shared with public/login.html // and parent-login.html. Silent failure leaves the brand gradient intact. (function loadHeroPhoto() { try { fetch('/api/photos/login-hero', { cache: 'no-store' }) .then(function(r) { return r.ok ? r.json() : null; }) .then(function(d) { if (!d || !d.data || !d.data.url) return; var hero = document.getElementById('auth-hero'); var img = document.getElementById('auth-hero-image'); if (!hero || !img) return; img.addEventListener('load', function() { hero.classList.add('has-photo'); }); img.addEventListener('error', function() {}); img.src = d.data.url; }) .catch(function() {}); } catch (e) {} })(); function _entraLoginUrl(silent) { var p = new URLSearchParams(); p.set('post_login_redirect_uri', _loginRedirect); p.set('domain_hint', ENTRA_DOMAIN_HINT); if (silent) p.set('prompt', 'none'); return '/.auth/login/aad?' + p.toString(); } var entraBtn = document.getElementById('entra-login-btn'); if (entraBtn) entraBtn.href = _entraLoginUrl(false); // ── SILENT SSO — match canonical login.html behaviour ───── // If the user already has a Microsoft session, sign them in via a hidden // iframe so the wrapped App Service cookie is set without a "Pick an // account" interstitial. Falls back to the interactive button on failure. function _trySilentSso() { return new Promise(function(resolve) { var iframe = document.createElement('iframe'); iframe.setAttribute('aria-hidden', 'true'); iframe.style.cssText = 'position:absolute;width:0;height:0;border:0;visibility:hidden;left:-9999px'; iframe.src = _entraLoginUrl(true); var done = false; function finish(ok) { if (done) return; done = true; try { document.body.removeChild(iframe); } catch (e) {} resolve(!!ok); } var bail = setTimeout(function() { finish(false); }, 5000); iframe.addEventListener('load', function() { setTimeout(function() { fetch('/.auth/me', { credentials: 'include', cache: 'no-store' }) .then(function(r) { return r.ok ? r.json() : []; }) .then(function(d) { clearTimeout(bail); var authed = Array.isArray(d) ? d.length > 0 : !!(d && (d.user_id || d.userId)); finish(authed); }) .catch(function() { clearTimeout(bail); finish(false); }); }, 200); }); document.body.appendChild(iframe); }); } // If silent SSO succeeds, follow the post-login redirect immediately. // The Easy Auth cookie is already set so the next request hits the // module behind the host-aware router with full session context. _trySilentSso().then(function(ok) { if (ok) window.location.replace(_loginRedirect); }); function startEntraSignIn(ev) { // Let the anchor's href carry the redirect — interactive path. Returning // true here just preserves default navigation; the function exists for // parity with public/login.html so future hooks (analytics, telemetry) // can be added in one place. return true; }