fix(auth-service): hide Resend on OTP screen when sign-in cannot recover#165

Open

aspiers wants to merge 37 commits into

mainfrom

fix/otp-expiry-resend-bug

Commits on May 7, 2026

fix(auth-service): hide Resend on OTP screen when sign-in cannot recover

aspiers
and
claude
committed
fix(demo): cookie outlasts OTP form sit times + honest error when it doesn't

aspiers
and
claude
committed
fix(auth-service): "Use different email" clears the email field + focuses it

aspiers
and
claude
committed
fix(auth-service): don't flash "Invalid OTP" on an empty Verify click

aspiers
and
claude
committed
fix(auth-service): inline Send-a-new-code on "Too many attempts" lockout

aspiers
and
claude
committed
fix(demo): surface PDS timeout error_description as session_expired

aspiers
and
claude
committed
fix(auth-service): friendlier stale-recovery-link error message

aspiers
and
claude
committed
fix(auth-service): also inline Resend after the post-lockout "Invalid OTP"

aspiers
and
claude
committed
fix(auth-service): friendlier stale-authorize-link error message

aspiers
and
claude
committed
fix(auth-service): recovery link carries the real request_uri, not a placeholder

aspiers
and
claude
committed
test(auth-service): unit-test the new login-page UX guards

aspiers
and
claude
committed
fix(auth-service): filter pasted OTP content to the configured charset

aspiers
and
claude
committed
fix(auth-service): filter typed OTP keystrokes to the configured charset

aspiers
and
claude
committed
fix(auth-service): account-login surfaces honest lockout message

aspiers
and
claude
committed
test(auth-service): unit-test account-login error-message picker

aspiers
and
claude
committed
fix(demo): invalid_grant on token exchange surfaces as session_expired

aspiers
and
claude
committed
refactor(auth-service): share OTP-verify error-message picker between flows

aspiers
and
claude
committed
fix(auth-service): clear OTP boxes on Resend so old typing does not linger

aspiers
and
claude
committed
feat(auth-service): hint to check spam folder on OTP form

aspiers
and
claude
committed
test(auth-service): dedupe OTP-verify-error tests via shared constants + it.each

aspiers
and
claude
committed
fix(auth-service): explicit autocomplete=email on every email input

aspiers
and
claude
committed
fix(auth-service): make sign-in errors announce to screen readers

aspiers
and
claude
committed
fix(demo): friendlier error banners, no developer-facing wording

aspiers
and
claude
committed
fix(auth-service): charset filter on account-login + recovery OTP inputs

aspiers
and
claude
committed
fix(auth-service): handle picker error says "not available", not "just taken"

aspiers
and
claude
committed
test(e2e): de-flake @demo-cookie-expiry by skipping the email round-trip

aspiers
and
claude
committed
fix(auth-service): SMS / email autofill distributes the OTP across boxes

aspiers
and
claude
committed
fix(pds-core): handle picker live-check flags reserved handles as unavailable

aspiers
and
claude
committed
fix(auth-service): visible keyboard focus on Verify and Resend buttons

aspiers
and
claude
committed
fix(auth-service): visible keyboard focus on remaining route buttons

aspiers
and
claude
committed
chore(changeset): keyboard focus-visible on buttons

aspiers
and
claude
committed
fix(demo): error banner announces to screen readers via role=alert

aspiers
and
claude
committed
refactor(pds-core): extract handleIsUnavailable for the check-handle route

aspiers
and
claude
committed
fix(shared): renderError adds role=alert on the error <p>

aspiers
and
claude
committed
fix(shared): malformed client_id no longer leaks into displayed app name

aspiers
and
claude
committed
fix(auth-service): account settings shows success / error banners after every action

aspiers
and
claude
committed
refactor(auth-service): extract flash-resolver from /account route handler

aspiers
and
claude
committed