supabase / supabase / 26520622592

73%

push

github

[FE-3483] fix(studio): redirect OAuth callback errors to /sign-in (#46414)

OAuth/SSO callback failures (e.g. GitHub returning an email that
collides with gotrue's `users_email_partial_key` constraint) were
stranding users on `/sign-in-mfa` with the raw error rendered under the
"Two-factor authentication" heading. They now redirect to `/sign-in`,
where the error surfaces above the email form under "Welcome back" and
the form stays interactive so users can fall back to email/password
without refreshing.

Addresses FE-3483.

**Changed:**
- `pages/sign-in-mfa.tsx`: redirect to `/sign-in` when
`auth.initialize()` returns an error, instead of stopping the loader and
rendering the error on the MFA page. The error is already captured in
the shared `AuthProvider` state by `gotrueClient.initialize()` before
the redirect, so it survives the navigation via `useAuthError()`.
- `components/interfaces/SignIn/SignInForm.tsx`: render `useAuthError()`
as an inline `AlertError` above the email/password fields. Form stays
interactive so users hitting the duplicate-email case can use email
sign-in inline.

This is the "surgical" option from the ticket — option 3 (point the
OAuth callbacks at `/sign-in` directly) is still the right long-term
cleanup.

## To test

1. Visit
`/sign-in-mfa#error=server_error&error_description=Database+error+saving+new+user`
— should redirect to `/sign-in` with the error rendered above the email
form under "Welcome back".
2. Type into the email/password fields — form should be interactive
(this is the part the "replace the form" alternative would have broken).
3. Hard-reload `/sign-in` — no `AlertError`, normal form.
4. Sign in with a real email/password account that has MFA enabled —
`/sign-in-mfa` should load normally with the "Two-factor authentication"
heading and verification form. No redirect, no `AlertError`.
5. Try
`/sign-in-mfa?returnTo=%2Forganizations#error=server_error&error_description=test`
— after redirect the URL should be `/si... (continued)

972 of 1368 branches covered (71.05%)

Branch coverage included in aggregate %.

1501 of 2059 relevant lines covered (72.9%)

245.19 hits per line