fix(auth): make signup's code step copy conditional - #106
Merged
Conversation
The backend no longer answers 409 for an address that already has an account (PowerInterviewAI/backend#55). It returns 200 either way and mails a code to a free address or a "you already have an account" notice to a taken one, so signup's step two saying "We sent a verification code to x@y.z" is now wrong for half the people who read it - and the ones it is wrong for are waiting to paste a code that is never coming. The copy is conditional in the same shape the reset wizard already uses, and it names the other outcome so that user knows to go and sign in rather than sit on this screen. It does not report which of the two happened, because that is the enumeration the backend change removed and the UI is the obvious place to put it straight back. No behavioural change needed beyond copy: step one already advances on success alone, and 200 is now the answer in both cases. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
alpha5611331
requested review from
anton-karlovskiy,
chmm195,
kevinkamto and
mchl7852
August 19, 2026 17:05
The step two copy now tells a user whose address is already registered to go and sign in, and that was the one step with no way to do it. Step one carries the link; the code step had only "Change email" and "Resend code", neither of which is what that user wants, and "Change email" is actively the wrong suggestion when the address they typed was correct. It did not matter before this branch, because a taken address never reached step two: the 409 stopped it at step one, where the link already is. Removing the 409 moved exactly those users onto the one screen that could not serve them. Same shape and wording as the link on step one. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
sendVerificationCode resolving true used to mean a code was sent - a taken address got false, from the 409. Now it means the request went through, and a taken address gets an "already have an account" notice instead of a code. The resend button's success toast still said "Verification code resent" regardless, which is wrong for exactly the users this PR changed the behavior for: they click resend, see a toast confirming a code that was never sent, and go on waiting for it. Worded generically instead, matching what the docstring on sendVerificationCode already says the boolean means. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Code Review ✅ ApprovedMakes signup's verification code step copy conditional to prevent email enumeration attacks following backend authentication changes. No issues found. OptionsAuto-apply is off → Gitar will not commit updates to this branch. Comment with these commands to change the behavior for this request:
Important Your trial ends in 4 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more. Was this helpful? React with 👍 / 👎 | Gitar |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backend counterpart: PowerInterviewAI/backend#56 (land that first - this only makes sense against its API shape)
send-verification-codeused to answer 409 for an address that already had an account, which is why signup could say so inline and immediately. That made the care taken in the reset wizard pointless: the same question was answerable one screen over, with no auth. The backend now answers 200 either way and mails a code to a free address or a "you already have an account" notice to a taken one.The problem that leaves behind
Signup's step two says:
That is now wrong for everyone whose address was already registered, and they are exactly the people who cannot act on it. They sit on the code screen waiting to paste something that is never coming.
The copy
Conditional in the same shape the reset wizard already uses, and it names the other outcome so that user knows to go and sign in rather than wait. It deliberately does not report which of the two actually happened - that is the enumeration the backend change removed, and the UI is the obvious place to hand it straight back.
Everything else already worked
No behavioural change was needed. Step one already advanced on success alone, and 200 is now the answer in both cases, so the wizard moves to the code step either way on its own.
AuthService.sendVerificationCode's docstring now says what atrueresult means (the request went through, not that the address is free), matching whatforgotPasswordalready carries, so nobody later "improves" it back into an existence check.Verification
eslint, bothtscconfigs, andpnpm test:mainall clean locally.Copy-only change, so there is nothing new to pin in
test:main; the property that would regress lives in the backend PR's tests.🤖 Generated with Claude Code