[WIP] many usability fixes (needs untangling) - #165

Closed

aspiers wants to merge 37 commits into

mainfrom

fix/otp-expiry-resend-bug

Commits on May 7, 2026

fix(auth-service): hide Resend on OTP screen when sign-in cannot recover

aspiers
and
claude
committed
ccf4ece
fix(demo): cookie outlasts OTP form sit times + honest error when it doesn't

aspiers
and
claude
committed
a5cb519
fix(auth-service): "Use different email" clears the email field + focuses it

aspiers
and
claude
committed
988be35
fix(auth-service): don't flash "Invalid OTP" on an empty Verify click

aspiers
and
claude
committed
073da54
fix(auth-service): inline Send-a-new-code on "Too many attempts" lockout

aspiers
and
claude
committed
4e23ee1
fix(demo): surface PDS timeout error_description as session_expired

aspiers
and
claude
committed
f6a243c
fix(auth-service): friendlier stale-recovery-link error message

aspiers
and
claude
committed
4a899b6
fix(auth-service): also inline Resend after the post-lockout "Invalid OTP"

aspiers
and
claude
committed
f01f703
fix(auth-service): friendlier stale-authorize-link error message

aspiers
and
claude
committed
7a177e5
fix(auth-service): recovery link carries the real request_uri, not a placeholder

aspiers
and
claude
committed
7dbd5d7
test(auth-service): unit-test the new login-page UX guards

aspiers
and
claude
committed
11ea1cc
fix(auth-service): filter pasted OTP content to the configured charset

aspiers
and
claude
committed
5eddf75
fix(auth-service): filter typed OTP keystrokes to the configured charset

aspiers
and
claude
committed
a3f594a
fix(auth-service): account-login surfaces honest lockout message

aspiers
and
claude
committed
4aab907
test(auth-service): unit-test account-login error-message picker

aspiers
and
claude
committed
3b82b31
fix(demo): invalid_grant on token exchange surfaces as session_expired

aspiers
and
claude
committed
010f0c0
refactor(auth-service): share OTP-verify error-message picker between flows

aspiers
and
claude
committed
f900a9a
fix(auth-service): clear OTP boxes on Resend so old typing does not linger

aspiers
and
claude
committed
e0c367b
feat(auth-service): hint to check spam folder on OTP form

aspiers
and
claude
committed
74459b8
test(auth-service): dedupe OTP-verify-error tests via shared constants + it.each

aspiers
and
claude
committed
452eec3
fix(auth-service): explicit autocomplete=email on every email input

aspiers
and
claude
committed
453d9a5
fix(auth-service): make sign-in errors announce to screen readers

aspiers
and
claude
committed
35e76d2
fix(demo): friendlier error banners, no developer-facing wording

aspiers
and
claude
committed
c1cd111
fix(auth-service): charset filter on account-login + recovery OTP inputs

aspiers
and
claude
committed
619eedf
fix(auth-service): handle picker error says "not available", not "just taken"

aspiers
and
claude
committed
d3e75a2
test(e2e): de-flake @demo-cookie-expiry by skipping the email round-trip

aspiers
and
claude
committed
97e5acb
fix(auth-service): SMS / email autofill distributes the OTP across boxes

aspiers
and
claude
committed
fe13498
fix(pds-core): handle picker live-check flags reserved handles as unavailable

aspiers
and
claude
committed
83de694
fix(auth-service): visible keyboard focus on Verify and Resend buttons

aspiers
and
claude
committed
50077c0
fix(auth-service): visible keyboard focus on remaining route buttons

aspiers
and
claude
committed
645a2fb
chore(changeset): keyboard focus-visible on buttons

aspiers
and
claude
committed
1493801
fix(demo): error banner announces to screen readers via role=alert

aspiers
and
claude
committed
116f833
refactor(pds-core): extract handleIsUnavailable for the check-handle route

aspiers
and
claude
committed
fea121e
fix(shared): renderError adds role=alert on the error <p>

aspiers
and
claude
committed
5fc9837
fix(shared): malformed client_id no longer leaks into displayed app name

aspiers
and
claude
committed
3ed32b9
fix(auth-service): account settings shows success / error banners after every action

aspiers
and
claude
committed
40ad0e0
refactor(auth-service): extract flash-resolver from /account route handler

aspiers
and
claude
committed
473f6a0