Repository navigation

[WIP] many usability fixes (needs untangling) - #165

Closed

aspiers wants to merge 37 commits into

mainfrom

fix/otp-expiry-resend-bug

Commits on May 7, 2026
- fix(auth-service): hide Resend on OTP screen when sign-in cannot recover
  
  aspiers
  and
  claude
  committed
  ccf4ece
- fix(demo): cookie outlasts OTP form sit times + honest error when it doesn't
  
  aspiers
  and
  claude
  committed
  a5cb519
- fix(auth-service): "Use different email" clears the email field + focuses it
  
  aspiers
  and
  claude
  committed
  988be35
- fix(auth-service): don't flash "Invalid OTP" on an empty Verify click
  
  aspiers
  and
  claude
  committed
  073da54
- fix(auth-service): inline Send-a-new-code on "Too many attempts" lockout
  
  aspiers
  and
  claude
  committed
  4e23ee1
- fix(demo): surface PDS timeout error_description as session_expired
  
  aspiers
  and
  claude
  committed
  f6a243c
- fix(auth-service): friendlier stale-recovery-link error message
  
  aspiers
  and
  claude
  committed
  4a899b6
- fix(auth-service): also inline Resend after the post-lockout "Invalid OTP"
  
  aspiers
  and
  claude
  committed
  f01f703
- fix(auth-service): friendlier stale-authorize-link error message
  
  aspiers
  and
  claude
  committed
  7a177e5
- fix(auth-service): recovery link carries the real request_uri, not a placeholder
  
  aspiers
  and
  claude
  committed
  7dbd5d7
- test(auth-service): unit-test the new login-page UX guards
  
  aspiers
  and
  claude
  committed
  11ea1cc
- fix(auth-service): filter pasted OTP content to the configured charset
  
  aspiers
  and
  claude
  committed
  5eddf75
- fix(auth-service): filter typed OTP keystrokes to the configured charset
  
  aspiers
  and
  claude
  committed
  a3f594a
- fix(auth-service): account-login surfaces honest lockout message
  
  aspiers
  and
  claude
  committed
  4aab907
- test(auth-service): unit-test account-login error-message picker
  
  aspiers
  and
  claude
  committed
  3b82b31
- fix(demo): invalid_grant on token exchange surfaces as session_expired
  
  aspiers
  and
  claude
  committed
  010f0c0
- refactor(auth-service): share OTP-verify error-message picker between flows
  
  aspiers
  and
  claude
  committed
  f900a9a
- fix(auth-service): clear OTP boxes on Resend so old typing does not linger
  
  aspiers
  and
  claude
  committed
  e0c367b
- feat(auth-service): hint to check spam folder on OTP form
  
  aspiers
  and
  claude
  committed
  74459b8
- test(auth-service): dedupe OTP-verify-error tests via shared constants + it.each
  
  aspiers
  and
  claude
  committed
  452eec3
- fix(auth-service): explicit autocomplete=email on every email input
  
  aspiers
  and
  claude
  committed
  453d9a5
- fix(auth-service): make sign-in errors announce to screen readers
  
  aspiers
  and
  claude
  committed
  35e76d2
- fix(demo): friendlier error banners, no developer-facing wording
  
  aspiers
  and
  claude
  committed
  c1cd111
- fix(auth-service): charset filter on account-login + recovery OTP inputs
  
  aspiers
  and
  claude
  committed
  619eedf
- fix(auth-service): handle picker error says "not available", not "just taken"
  
  aspiers
  and
  claude
  committed
  d3e75a2
- test(e2e): de-flake @demo-cookie-expiry by skipping the email round-trip
  
  aspiers
  and
  claude
  committed
  97e5acb
- fix(auth-service): SMS / email autofill distributes the OTP across boxes
  
  aspiers
  and
  claude
  committed
  fe13498
- fix(pds-core): handle picker live-check flags reserved handles as unavailable
  
  aspiers
  and
  claude
  committed
  83de694
- fix(auth-service): visible keyboard focus on Verify and Resend buttons
  
  aspiers
  and
  claude
  committed
  50077c0
- fix(auth-service): visible keyboard focus on remaining route buttons
  
  aspiers
  and
  claude
  committed
  645a2fb
- chore(changeset): keyboard focus-visible on buttons
  
  aspiers
  and
  claude
  committed
  1493801
- fix(demo): error banner announces to screen readers via role=alert
  
  aspiers
  and
  claude
  committed
  116f833
- refactor(pds-core): extract handleIsUnavailable for the check-handle route
  
  aspiers
  and
  claude
  committed
  fea121e
- fix(shared): renderError adds role=alert on the error <p>
  
  aspiers
  and
  claude
  committed
  5fc9837
- fix(shared): malformed client_id no longer leaks into displayed app name
  
  aspiers
  and
  claude
  committed
  3ed32b9
- fix(auth-service): account settings shows success / error banners after every action
  
  aspiers
  and
  claude
  committed
  40ad0e0
- refactor(auth-service): extract flash-resolver from /account route handler
  
  aspiers
  and
  claude
  committed
  473f6a0

Commits

Commits on May 7, 2026