@@ -0,0 +1,12 @@
+---
+'@object-ui/auth': patch
+'@object-ui/console': patch
+---
+
+fix(auth,console): the sign-up form shows a password mismatch under the confirm field, and the register page links privacy and terms
+
+Clause-②: no
+Metadata-protocol: none
+
+- **Mismatch on the field.** `RegisterForm` showed "Passwords do not match" as the error banner at the top of the form, above the name field. The message now sits under the confirm-password input, which carries `aria-invalid` and names the message through `aria-describedby`. Editing either password clears it. The banner still carries what the server refuses (an existing account, a closed registration). The text is the same `labels.passwordMismatchError`, so no locale key changes. Every page that renders `RegisterForm` gets this.
+- **Legal links on sign-up.** The console's `/register` now draws the same footer as `/login`: the locale switch, plus the privacy and terms links that `GET /api/v1/auth/config` serves as `features.privacyUrl` / `features.termsUrl`. A link appears only when its URL is served and is an http(s) URL or a same-origin path. Both pages now read the links through one shared reader.
@@ -0,0 +1,73 @@
+/**
+ * AuthFooter — the row under the auth card on `/login` and `/register`: the
+ * locale switch at the left; at the right the privacy and terms links, each
+ * only when the server's auth config serves its URL.
+ *
+ * Lifted out of `LoginPage` unchanged (objectui#12600) so the sign-up page,
+ * where a visitor accepts the terms, draws the same links from the same reader
+ * instead of a copy (#25885).
+ *
+ * No version or environment pill: the runtime config the preview badge reads
+ * (`GET /api/v1/runtime/config`) carries the platform stage and no product
+ * version or environment label, so there is nothing to print (objectui#12600).
+ */
+
+import type { AuthPublicConfig } from '@object-ui/auth';
+import { useObjectTranslation } from '@object-ui/i18n';
+import { LocaleSwitcher } from '@object-ui/app-shell';
+
+/**
+ * Accept a legal-link URL from the server only as an absolute http(s) URL or a
+ * same-origin path. Anything else (a `javascript:` URL, a protocol-relative
+ * `//host`, a non-string) renders no link.
+ */
+function legalHref(value: unknown): string | undefined {
+  if (typeof value !== 'string') return undefined;
+  const href = value.trim();
+  if (/^https?:\/\//i.test(href)) return href;
+  if (href.startsWith('/') && !href.startsWith('//')) return href;
+  return undefined;
+}
+
+/**
+ * The legal links the server's public auth config serves: `features.termsUrl`
+ * and `features.privacyUrl`, which the spec lists among its non-flag keys
+ * (`PUBLIC_AUTH_CONFIG_NON_FLAG_KEYS`) and the runtime defaults to its own
+ * public pages, or omits when an operator blanks them. `AuthPublicConfig` does
+ * not declare the two keys, so they are read here by name; nothing is
+ * rendered for a key the server did not send.
+ */
+export function readLegalLinks(cfg: AuthPublicConfig | null): { privacyUrl?: string; termsUrl?: string } {
+  const features = cfg?.features as { privacyUrl?: unknown; termsUrl?: unknown } | undefined;
+  return { privacyUrl: legalHref(features?.privacyUrl), termsUrl: legalHref(features?.termsUrl) };
+}
+
+export function AuthFooter({ privacyUrl, termsUrl }: { privacyUrl?: string; termsUrl?: string }) {
+  const { t } = useObjectTranslation();
+  const linkClass =
+    'underline-offset-4 transition-colors hover:text-foreground hover:underline focus-visible:outline-none focus-visible:underline';
+  return (
+    <div
+      data-testid="auth-footer"
+      className="flex min-h-8 items-center justify-between gap-3 px-1 text-xs text-muted-foreground"
+    >
+      <div className="flex items-center">
+        <LocaleSwitcher />
+      </div>
+      {privacyUrl || termsUrl ? (
+        <span className="inline-flex items-center gap-2.5">
+          {privacyUrl ? (
+            <a href={privacyUrl} target="_blank" rel="noopener noreferrer" className={linkClass}>
+              {t('auth.login.footer.privacy', { defaultValue: 'Privacy' })}
+            </a>
+          ) : null}
+          {termsUrl ? (
+            <a href={termsUrl} target="_blank" rel="noopener noreferrer" className={linkClass}>
+              {t('auth.login.footer.terms', { defaultValue: 'Terms' })}
+            </a>
+          ) : null}
+        </span>
+      ) : null}
+    </div>
+  );
+}
@@ -59,10 +59,10 @@ import {
   isInvitationRedirect,
   needsBootstrapProbe,
   useBootstrapStatus,
-  LocaleSwitcher,
   InvitationSignUpPrompt,
 } from '@object-ui/app-shell';
 import { AuthLayout } from './AuthLayout';
+import { AuthFooter, readLegalLinks } from './AuthFooter';
 import { followOauthAuthorize } from './followAuthorize';
 // Was module-private here; lifted to a shared module so `SetupPage` (whose
 // first-run exits went without it) and `RegisterPage` (which had copied it)
@@ -80,32 +80,6 @@ interface DevSeedAdmin {
   password?: string;
 }
 
-/**
- * Accept a legal-link URL from the server only as an absolute http(s) URL or a
- * same-origin path. Anything else (a `javascript:` URL, a protocol-relative
- * `//host`, a non-string) renders no link.
- */
-function legalHref(value: unknown): string | undefined {
-  if (typeof value !== 'string') return undefined;
-  const href = value.trim();
-  if (/^https?:\/\//i.test(href)) return href;
-  if (href.startsWith('/') && !href.startsWith('//')) return href;
-  return undefined;
-}
-
-/**
- * The legal links the server's public auth config serves: `features.termsUrl`
- * and `features.privacyUrl`, which the spec lists among its non-flag keys
- * (`PUBLIC_AUTH_CONFIG_NON_FLAG_KEYS`) and the runtime defaults to its own
- * public pages, or omits when an operator blanks them. `AuthPublicConfig` does
- * not declare the two keys, so they are read here by name; nothing is
- * rendered for a key the server did not send.
- */
-function readLegalLinks(cfg: AuthPublicConfig | null): { privacyUrl?: string; termsUrl?: string } {
-  const features = cfg?.features as { privacyUrl?: unknown; termsUrl?: unknown } | undefined;
-  return { privacyUrl: legalHref(features?.privacyUrl), termsUrl: legalHref(features?.termsUrl) };
-}
-
 function RouterLink(props: { href: string; className?: string; children: React.ReactNode }) {
   return (
     <Link to={props.href} className={props.className}>
@@ -381,7 +355,7 @@ export function LoginPage() {
             </>
           )}
         </Card>
-        <LoginFooter privacyUrl={legalLinks.privacyUrl} termsUrl={legalLinks.termsUrl} />
+        <AuthFooter privacyUrl={legalLinks.privacyUrl} termsUrl={legalLinks.termsUrl} />
       </div>
     </AuthLayout>
   );
@@ -467,44 +441,6 @@ function DevAdminRow({ seed }: { seed: DevSeedAdmin }) {
   );
 }
 
-/**
- * Under the card: the locale switch at the left; at the right the privacy and
- * terms links, each only when the server's auth config serves its URL.
- *
- * No version or environment pill: the runtime config the preview badge reads
- * (`GET /api/v1/runtime/config`) carries the platform stage and no product
- * version or environment label, so there is nothing to print (objectui#12600).
- */
-function LoginFooter({ privacyUrl, termsUrl }: { privacyUrl?: string; termsUrl?: string }) {
-  const { t } = useObjectTranslation();
-  const linkClass =
-    'underline-offset-4 transition-colors hover:text-foreground hover:underline focus-visible:outline-none focus-visible:underline';
-  return (
-    <div
-      data-testid="auth-footer"
-      className="flex min-h-8 items-center justify-between gap-3 px-1 text-xs text-muted-foreground"
-    >
-      <div className="flex items-center">
-        <LocaleSwitcher />
-      </div>
-      {privacyUrl || termsUrl ? (
-        <span className="inline-flex items-center gap-2.5">
-          {privacyUrl ? (
-            <a href={privacyUrl} target="_blank" rel="noopener noreferrer" className={linkClass}>
-              {t('auth.login.footer.privacy', { defaultValue: 'Privacy' })}
-            </a>
-          ) : null}
-          {termsUrl ? (
-            <a href={termsUrl} target="_blank" rel="noopener noreferrer" className={linkClass}>
-              {t('auth.login.footer.terms', { defaultValue: 'Terms' })}
-            </a>
-          ) : null}
-        </span>
-      ) : null}
-    </div>
-  );
-}
-
 /**
  * In place of the form while the server cannot be reached (objectui#11806);
  * `RegisterPage` shows the same panel. Built from `@object-ui/auth`'s own form
 
@@ -23,6 +23,9 @@
  *    verification mail's link so it survives the inbox (objectui#10893).
  *  - Replays an `/oauth2/authorize` query string when the user landed
  *    here mid-SSO so the IdP can continue the flow post-signup.
+ *  - Draws `/login`'s footer under the form — the locale switch and the
+ *    privacy / terms links the server's auth config serves, from the same
+ *    reader (#25885): sign-up is where a visitor accepts the terms.
  */
 
 import { useEffect, useLayoutEffect, useRef, useState } from 'react';
@@ -44,6 +47,7 @@ import { followOauthAuthorize } from './followAuthorize';
 // implementation — objectui#4181. Behaviour here is unchanged.
 import { withConsoleBase, withConsoleBaseRootRelative } from '../../utils/consoleBase';
 import { ServerUnreachable } from './LoginPage';
+import { AuthFooter, readLegalLinks } from './AuthFooter';
 
 function isSafeRedirect(target: string | null): target is string {
   return !!target && target.startsWith('/') && !target.startsWith('//');
@@ -215,6 +219,7 @@ export function RegisterPage() {
   }
 
   const loginUrl = redirect ? `/login?redirect=${encodeURIComponent(redirect)}` : '/login';
+  const legalLinks = readLegalLinks(authConfig);
   // objectui#10893 — when the server gates sign-in on email verification, the
   // mail's link is the only road back, so it must carry `?redirect=` (e.g. the
   // invitation the user registered from). Only a safe in-app target is
@@ -318,6 +323,7 @@ export function RegisterPage() {
         }}
       />
       </Card>
+      <AuthFooter privacyUrl={legalLinks.privacyUrl} termsUrl={legalLinks.termsUrl} />
     </AuthLayout>
   );
 }
 
@@ -0,0 +1,82 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
+/**
+ * #25885 — the sign-up page links privacy and terms, as `/login` does.
+ *
+ * Sign-up is where a visitor accepts the terms, yet only `/login` drew the
+ * legal links `GET /api/v1/auth/config` serves as `features.privacyUrl` /
+ * `features.termsUrl`. The register page now draws the same footer, from the
+ * same reader, and nothing for a URL the server did not send or that is not
+ * http(s) / same-origin. Login's own pins stay in
+ * `LoginPage.layout-12600.test.tsx`.
+ */
+
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { render, screen, cleanup } from '@testing-library/react';
+import { MemoryRouter } from 'react-router-dom';
+import { AuthProvider } from '@object-ui/auth';
+import type { AuthClient } from '@object-ui/auth';
+import { RegisterPage } from '../RegisterPage';
+
+afterEach(cleanup);
+
+function renderRegister(config: Record<string, unknown>) {
+  window.history.replaceState({}, '', '/register');
+  const client = {
+    getSession: vi.fn().mockResolvedValue(null),
+    getConfig: vi.fn().mockResolvedValue(config),
+  } as unknown as AuthClient;
+  return render(
+    <AuthProvider authUrl="/api/v1/auth" client={client}>
+      <MemoryRouter initialEntries={['/register']}>
+        <RegisterPage />
+      </MemoryRouter>
+    </AuthProvider>,
+  );
+}
+
+const LEGAL = {
+  features: {
+    privacyUrl: 'https://legal.example.com/privacy',
+    termsUrl: '/legal/terms',
+  },
+};
+
+describe('RegisterPage — privacy and terms links (#25885)', () => {
+  it('links privacy and terms in its footer when the auth config serves their URLs', async () => {
+    renderRegister(LEGAL);
+
+    await screen.findByLabelText('Confirm Password');
+    const footer = screen.getByTestId('auth-footer');
+    const privacy = screen.getByRole('link', { name: 'Privacy' });
+    const terms = screen.getByRole('link', { name: 'Terms' });
+    expect(footer.contains(privacy) && footer.contains(terms)).toBe(true);
+    expect(privacy.getAttribute('href')).toBe(LEGAL.features.privacyUrl);
+    expect(terms.getAttribute('href')).toBe(LEGAL.features.termsUrl);
+    expect(privacy.getAttribute('rel')).toContain('noopener');
+  });
+
+  it('renders no legal link when the auth config serves no URL', async () => {
+    renderRegister({ features: {} });
+
+    await screen.findByLabelText('Confirm Password');
+    expect(screen.queryByRole('link', { name: 'Privacy' })).toBeNull();
+    expect(screen.queryByRole('link', { name: 'Terms' })).toBeNull();
+  });
+
+  it('renders no legal link for a URL that is neither http(s) nor a same-origin path', async () => {
+    renderRegister({
+      features: { privacyUrl: 'javascript:alert(1)', termsUrl: '//evil.example.com/terms' },
+    });
+
+    await screen.findByLabelText('Confirm Password');
+    expect(screen.queryByRole('link', { name: 'Privacy' })).toBeNull();
+    expect(screen.queryByRole('link', { name: 'Terms' })).toBeNull();
+  });
+});
@@ -91,6 +91,9 @@ export interface RegisterFormProps {
   hideIcon?: boolean;
 }
 
+/** The confirm field's own error line, named by its `aria-describedby`. */
+const CONFIRM_ERROR_ID = 'register-confirm-password-error';
+
 const DefaultLink = ({ href, className, children }: AuthLinkComponentProps) => (
   <a href={href} className={className}>{children}</a>
 );
@@ -146,6 +149,9 @@ export function RegisterForm({
   const [password, setPassword] = useState('');
   const [confirmPassword, setConfirmPassword] = useState('');
   const [error, setError] = useState<string | null>(null);
+  // #25885 — the mismatch belongs to the confirm field, under it, not to the
+  // top banner above the first field; the banner keeps the server's refusals.
+  const [confirmError, setConfirmError] = useState<string | null>(null);
 
   const l = {
     nameLabel: labels.nameLabel ?? 'Name',
@@ -167,9 +173,10 @@ export function RegisterForm({
   const handleSubmit = async (e: React.FormEvent) => {
     e.preventDefault();
     setError(null);
+    setConfirmError(null);
 
     if (password !== confirmPassword) {
-      setError(l.passwordMismatchError);
+      setConfirmError(l.passwordMismatchError);
       return;
     }
 
@@ -263,7 +270,10 @@ export function RegisterForm({
               type="password"
               placeholder={l.passwordPlaceholder}
               value={password}
-              onChange={(e) => setPassword(e.target.value)}
+              onChange={(e) => {
+                setPassword(e.target.value);
+                setConfirmError(null);
+              }}
               required
               minLength={8}
               autoComplete="new-password"
@@ -281,13 +291,27 @@ export function RegisterForm({
               type="password"
               placeholder={l.confirmPasswordPlaceholder}
               value={confirmPassword}
-              onChange={(e) => setConfirmPassword(e.target.value)}
+              onChange={(e) => {
+                setConfirmPassword(e.target.value);
+                setConfirmError(null);
+              }}
               required
               minLength={8}
               autoComplete="new-password"
               disabled={isLoading}
-              className={AUTH_INPUT_CLASS}
+              aria-invalid={confirmError ? true : undefined}
+              aria-describedby={confirmError ? CONFIRM_ERROR_ID : undefined}
+              className={
+                confirmError
+                  ? `${AUTH_INPUT_CLASS} border-destructive focus-visible:border-destructive focus-visible:ring-destructive/30`
+                  : AUTH_INPUT_CLASS
+              }
             />
+            {confirmError && (
+              <p id={CONFIRM_ERROR_ID} role="alert" className="text-[13px] font-medium text-destructive">
+                {confirmError}
+              </p>
+            )}
           </div>
 
           <button