Jakob Wennberg
0bb0b89353
* feat(auth): inline, specific error states on login and signup Auth failures now render inline next to the form instead of as a top-right toast: a persistent alert with role=alert, aria-invalid field highlighting, and focus returned to the offending field. Login maps GoTrue error codes (invalid_credentials, email_not_confirmed, rate limits, user_banned) to specific Swedish/English messages, with a reset-password link embedded in the credentials error. The credentials message stays 'wrong email or password' by design: GoTrue returns one code for both cases to prevent account enumeration. Signup gets a live password-requirements checklist, field-level errors for weak/mismatched passwords, and inline handling of email-exists, invalid-email and rate-limit responses with a sign-in link where that is the recovery path. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(auth): treat email_provider_disabled as signup-disabled with specific copy Review follow-up: GoTrue signals disabled email/password signups with email_provider_disabled as well as signup_disabled; classify both (plus the message-string fallback for older GoTrue) and give the register form a specific inline message instead of the generic fallback. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
63 lines
2.2 KiB
TypeScript
63 lines
2.2 KiB
TypeScript
/**
|
|
* Classifies Supabase GoTrue auth errors into a small set of kinds the auth
|
|
* pages can map to specific, localized inline messages.
|
|
*
|
|
* Security note: GoTrue deliberately returns the same `invalid_credentials`
|
|
* code for "unknown email" and "wrong password" so the login form cannot be
|
|
* used to probe which addresses have accounts (anti-enumeration). The UI must
|
|
* keep that ambiguity: "wrong email or password", never "wrong password".
|
|
*
|
|
* Hosted runs a current GoTrue where `error.code` is always set; self-hosted
|
|
* installations may run older images without `code`, so the classifier falls
|
|
* back on the stable English message strings, then on HTTP status.
|
|
*/
|
|
|
|
export type AuthErrorKind =
|
|
| 'invalid_credentials'
|
|
| 'email_not_confirmed'
|
|
| 'rate_limited'
|
|
| 'user_banned'
|
|
| 'email_exists'
|
|
| 'weak_password'
|
|
| 'email_invalid'
|
|
| 'signup_disabled'
|
|
| 'unknown'
|
|
|
|
const CODE_MAP: Record<string, AuthErrorKind> = {
|
|
invalid_credentials: 'invalid_credentials',
|
|
email_not_confirmed: 'email_not_confirmed',
|
|
over_request_rate_limit: 'rate_limited',
|
|
over_email_send_rate_limit: 'rate_limited',
|
|
user_banned: 'user_banned',
|
|
user_already_exists: 'email_exists',
|
|
email_exists: 'email_exists',
|
|
weak_password: 'weak_password',
|
|
email_address_invalid: 'email_invalid',
|
|
signup_disabled: 'signup_disabled',
|
|
email_provider_disabled: 'signup_disabled',
|
|
}
|
|
|
|
export function classifyAuthError(error: unknown): AuthErrorKind {
|
|
if (typeof error !== 'object' || error === null) return 'unknown'
|
|
const { code, message, status } = error as {
|
|
code?: unknown
|
|
message?: unknown
|
|
status?: unknown
|
|
}
|
|
|
|
if (typeof code === 'string' && CODE_MAP[code]) return CODE_MAP[code]
|
|
|
|
if (typeof message === 'string') {
|
|
if (/invalid login credentials/i.test(message)) return 'invalid_credentials'
|
|
if (/email not confirmed/i.test(message)) return 'email_not_confirmed'
|
|
if (/already registered/i.test(message)) return 'email_exists'
|
|
if (/signups? not allowed/i.test(message)) return 'signup_disabled'
|
|
if (/signups? (are )?disabled/i.test(message)) return 'signup_disabled'
|
|
if (/rate limit/i.test(message)) return 'rate_limited'
|
|
}
|
|
|
|
if (status === 429) return 'rate_limited'
|
|
|
|
return 'unknown'
|
|
}
|