[romanetar]

ref: https://app.clickup.com/t/86bcjd796

Problem

onValidateEmail treated every failed POST /auth/login/account-verify as "user not found". A 419 (session cookie not sent back, e.g. Safari or an MDM profile blocking cookies), a 5xx or a network error switched the page to "Create an account for:" and pushed existing users to register, which also fails with 419, leaving them stuck.

Changes

• Classify the account-verify failure by status (resources/js/login/error_handling.js):
  • 404: unchanged, sets an explicit account_not_found flag (sign-up title, register / one-time code options).
  • 419: "session expired or browser blocking cookies" message plus a Reload page button; no sign-up state.
  • 429: existing "Too many requests. Try it later." message.
  • other / network: generic message plus a Try again button; no sign-up state.
• getSignUpSignInTitle() depends on account_not_found instead of errors.email being non-empty.
• emitOtpAction (POST /auth/login/otp) and resendVerificationEmail show the session-expired message on a 419.
• Locked-account / unverified-email branches (200 responses) are untouched.
• No server-side changes.

Tests

• npx jest resources/js/login: 10 unit tests for the status classification.
• Not covered by automated tests: rendering of LoginPage (it renders on import and isn't exported), and the locked / unverified branches.

Manual check

Load /auth/login, delete the session cookie, submit an existing email: the page must not show "Create an account for:".

Summary by CodeRabbit

• Bug Fixes
  • Login verification failures now display clearer messages, including when an account isn’t found, requests are too frequent, or a session has expired.
  • Retry options are shown for eligible verification errors. For expired sessions, users are prompted to reload instead.
  • Account-creation options now appear when verification indicates that no account was found.
  • Expired sessions during one-time-code or verification-email actions now display an alert and stop further error handling.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 71289218-b854-411d-bc4d-b2f0799a850d

📥 Commits

Reviewing files that changed from the base of the PR and between 4b28901 and 5b94041.

📒 Files selected for processing: 3

• resources/js/login/error_handling.js
• resources/js/login/error_handling.test.js
• resources/js/login/login.js

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The login code now classifies account-verification errors and records the result in page state. It displays error-specific messages and actions, and handles session-expired errors during OTP emission and verification-email resend.

Changes: Login Error Handling

Layer / File(s)	Summary
Classify verification errors resources/js/login/error_handling.js, resources/js/login/error_handling.test.js	Adds error types and messages, classifies status codes 404, 419, and 429, and identifies session expiration. Tests cover those results and generic statuses.
Apply classifications in login flows resources/js/login/login.js	LoginPage records account-verification error state, uses classified results for verification failures, and handles session expiration during OTP emission and verification-email resend. Successful verification and account clearing reset the error state.
Render error-specific actions resources/js/login/login.js	The sign-up title and available retry, reload, and account-creation actions depend on the recorded error state.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: smarcet

Merge Risk: ⚪ Minimal · up to 5b940

Account-verification failures show the intended recovery actions. The change is ready to merge after normal checks.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: preventing the sign-up state after account verification fails with 419 or 5xx errors.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 3…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 3 files.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

📘 OpenAPI / Swagger preview

➡️ https://OpenStackweb.github.io/openstackid/openapi/pr-178/

This page is automatically updated on each push to this PR.