feat(onboarding): simplified bouncer auth (S2)

Soju path shows only Username + Password (SASL PLAIN); no mechanism
picker or EXTERNAL/none. Direct IRC-network path keeps full auth options.

Author: trevarj

app/src/main/kotlin/io/github/trevarj/motd/ui/onboarding/OnboardingReducer.kt

@@ -149,7 +149,16 @@ fun onboardingReducer(state: OnboardingState, action: OnboardingAction): Onboard
         is OnboardingAction.GoTo -> state.copy(step = action.step)
 
         is OnboardingAction.ChooseConnection ->
-            state.copy(choice = action.choice)
+            // soju logs in with SASL PLAIN (bouncer user + password); force the mode so the
+            // AUTH step only needs to collect the two fields and the entity persists as PLAIN.
+            state.copy(
+                choice = action.choice,
+                auth = if (action.choice == ConnectionChoice.SOJU) {
+                    state.auth.copy(mode = AuthMode.PLAIN)
+                } else {
+                    state.auth
+                },
+            )
 
         is OnboardingAction.ApplyLiberaPreset ->
             state.copy(

app/src/main/kotlin/io/github/trevarj/motd/ui/onboarding/OnboardingScreen.kt

@@ -46,6 +46,7 @@ import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.res.painterResource
 import androidx.compose.ui.res.stringResource
 import androidx.compose.ui.text.font.FontWeight
+import androidx.compose.ui.text.input.PasswordVisualTransformation
 import androidx.compose.ui.text.style.TextAlign
 import androidx.compose.ui.tooling.preview.Preview
 import androidx.compose.ui.unit.dp
@@ -109,7 +110,13 @@ fun OnboardingContent(
                 OnboardingStep.WELCOME -> WelcomePage()
                 OnboardingStep.CHOICE -> ChoicePage(state, onChoose, onLibera)
                 OnboardingStep.SERVER -> ServerPage(state, onServerChange, onAuthChange, authOnly = false)
-                OnboardingStep.AUTH -> ServerPage(state, onServerChange, onAuthChange, authOnly = true)
+                OnboardingStep.AUTH ->
+                    // soju always uses SASL PLAIN: show only user/password, no mechanism picker.
+                    if (state.isSoju) {
+                        SojuAuthPage(state, onAuthChange)
+                    } else {
+                        ServerPage(state, onServerChange, onAuthChange, authOnly = true)
+                    }
                 OnboardingStep.CONNECT -> ConnectPage(state, onRetry, onToggleBouncer, onAddBouncer)
                 OnboardingStep.FINISH -> FinishPage()
             }
@@ -277,6 +284,42 @@ private fun ServerPage(
     }
 }
 
+/**
+ * Simplified AUTH page for the soju bouncer path: only username + password, always SASL PLAIN.
+ * No mechanism picker (NONE/EXTERNAL are meaningless for soju login).
+ */
+@Composable
+private fun SojuAuthPage(
+    state: OnboardingState,
+    onAuthChange: (AuthForm) -> Unit,
+) {
+    Column(
+        modifier = Modifier.fillMaxSize().verticalScroll(rememberScrollState()).padding(24.dp),
+        verticalArrangement = Arrangement.spacedBy(12.dp),
+    ) {
+        Text(
+            stringResource(R.string.onboarding_auth_title),
+            style = MaterialTheme.typography.titleLarge,
+            fontWeight = FontWeight.Bold,
+        )
+        OutlinedTextField(
+            value = state.auth.saslUser,
+            onValueChange = { onAuthChange(state.auth.copy(saslUser = it)) },
+            label = { Text(stringResource(R.string.onboarding_auth_soju_username)) },
+            singleLine = true,
+            modifier = Modifier.fillMaxWidth(),
+        )
+        OutlinedTextField(
+            value = state.auth.saslPassword,
+            onValueChange = { onAuthChange(state.auth.copy(saslPassword = it)) },
+            label = { Text(stringResource(R.string.onboarding_auth_soju_password)) },
+            singleLine = true,
+            visualTransformation = PasswordVisualTransformation(),
+            modifier = Modifier.fillMaxWidth(),
+        )
+    }
+}
+
 @Composable
 private fun ConnectPage(
     state: OnboardingState,

app/src/main/res/values/strings.xml

@@ -50,6 +50,9 @@
     <string name="onboarding_auth_sasl_password">Password</string>
     <string name="onboarding_auth_choose_cert">Choose certificate</string>
     <string name="onboarding_auth_cert_selected">Certificate: %1$s</string>
+    <!-- soju bouncer auth: always SASL PLAIN, no picker (WP-S2) -->
+    <string name="onboarding_auth_soju_username">Username</string>
+    <string name="onboarding_auth_soju_password">Password</string>
     <string name="onboarding_connect_title">Connecting</string>
     <string name="onboarding_connect_retry">Retry</string>
     <string name="onboarding_connect_networks_title">Bouncer networks</string>

app/src/test/kotlin/io/github/trevarj/motd/ui/onboarding/OnboardingReducerTest.kt

@@ -50,6 +50,44 @@ class OnboardingReducerTest {
         assertEquals(NetworkRole.BOUNCER_ROOT, s.role)
     }
 
+    @Test
+    fun `soju choice forces SASL PLAIN auth mode`() {
+        val s = onboardingReducer(
+            OnboardingState(step = OnboardingStep.CHOICE),
+            OnboardingAction.ChooseConnection(ConnectionChoice.SOJU),
+        )
+        assertEquals(AuthMode.PLAIN, s.auth.mode)
+    }
+
+    @Test
+    fun `soju AUTH advance requires both username and password`() {
+        // After choosing soju, mode is PLAIN so AUTH validity gates on both fields.
+        val base = reduce(
+            OnboardingState(step = OnboardingStep.CHOICE),
+            OnboardingAction.ChooseConnection(ConnectionChoice.SOJU),
+        ).copy(step = OnboardingStep.AUTH)
+
+        assertFalse(base.canAdvance)
+        assertFalse(base.copy(auth = base.auth.copy(saslUser = "u")).canAdvance)
+        val complete = base.copy(auth = base.auth.copy(saslUser = "u", saslPassword = "p"))
+        assertTrue(complete.canAdvance)
+        assertEquals(OnboardingStep.CONNECT, onboardingReducer(complete, OnboardingAction.Next).step)
+    }
+
+    @Test
+    fun `network choice leaves auth mode untouched`() {
+        // Direct path keeps the full picker: NONE stays valid, EXTERNAL still selectable.
+        val s = onboardingReducer(
+            OnboardingState(step = OnboardingStep.CHOICE),
+            OnboardingAction.ChooseConnection(ConnectionChoice.NETWORK),
+        )
+        assertEquals(AuthMode.NONE, s.auth.mode)
+        val none = s.copy(step = OnboardingStep.AUTH)
+        assertTrue(none.canAdvance)
+        val external = none.copy(auth = none.auth.copy(mode = AuthMode.EXTERNAL, certAlias = "a"))
+        assertTrue(external.canAdvance)
+    }
+
     @Test
     fun `libera preset fills host port tls and selects network path`() {
         val s = onboardingReducer(