fix(web): show auth errors instead of silently reloading#242
Merged
Conversation
Login showed no message on wrong credentials and just reloaded. The handler called signIn with redirect:true, which makes next-auth navigate on both success and failure, so the browser reloaded to /login?error= and the `if (result?.error)` branch never ran: the error handling was dead code. Switched to redirect:false, so the result is read here, the message renders, and success navigates via router.push + refresh. The password-reset (OTP) form had two related bugs, both found while verifying the "check forgot-password too" ask: - It set form error under `root.serverError` but the JSX rendered `errors.root.message`, which a nested key leaves undefined, so a failed reset showed an empty paragraph and no text. - The catch swallowed the error, so react-hook-form's isSubmitSuccessful stayed true and the "Password reset successful" alert rendered even on failure. The success alert is now gated on the absence of a root error, and errors are cleared at the start of each submit. register-form was already correct (redirect:false); added a regression test so the login bug cannot reappear there unnoticed. Tests: component specs for all three forms under vitest + RTL, with useTurnstile and the network boundary mocked. Each new failing case was confirmed to fail against the pre-change component before the fix. The login signIn mock reflects real redirect semantics (redirect:true yields no readable result), so the "shows an error" test is a faithful guard. Verified: typecheck clean, build clean, 0 lint errors (20 warnings, unchanged), 164 unit tests (from 155). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the login form showing no message on wrong credentials and just reloading the page. While verifying the sign-up and forgot-password flows for the same issue, two related bugs on the password-reset form were found and fixed.
Changes
signIn(..., { redirect: true }), which makes next-auth navigate on both success and failure, so the browser reloaded and the error branch was never reached. Switched toredirect: false, so the result is read locally: the message renders on failure and a successful login navigates viarouter.push+router.refresh.root.serverErrorkey while the JSX renderederrors.root.message, so a failed reset showed an empty paragraph. Aligned both toroot, and errors are cleared at the start of each submit.isSubmitSuccessfultrue, so the success alert rendered even on failure. The alert is now gated on the absence of a root error.redirect: false); added a regression test so the login bug cannot reappear here unnoticed.Tests
Component specs for all three forms (vitest + React Testing Library) with the Turnstile hook and the network boundary mocked. Each new failing case was confirmed to fail against the pre-change component before the fix; the login mock reflects real next-auth redirect semantics so the "shows an error" test is a faithful guard.
Verification
typecheck clean, build clean, 0 lint errors (warnings unchanged), unit tests 155 to 164.
🤖 Generated with Claude Code