fix(auth): relabel "Resend code" to "Send a new code"

.changeset/send-a-new-code-label.md

@@ -0,0 +1,9 @@
+---
+'ePDS': patch
+---
+
+The sign-in button that emails you another code now says "Send a new code" instead of "Resend code".
+
+**Affects:** End users
+
+**End users:** each request emails a genuinely new code and stops the previous one working, so "Resend" was misleading — it suggested the code already in your inbox was still the one to type. The confirmation after clicking now starts "Sent!" rather than "Resent!", and still tells you that earlier codes no longer work. The same wording appears on the recovery and account sign-in pages, and on the link offered beside a rejected or expired code.

e2e/step-definitions/auth.steps.ts

@@ -901,7 +901,7 @@ When('the OTP form re-checks PAR liveness', async function (this: EpdsWorld) {
 })
 
 Then(
-  'the Resend code button is no longer offered',
+  'the Send a new code button is no longer offered',
   async function (this: EpdsWorld) {
     const page = getPage(this)
     await expect(page.locator('#btn-resend')).toBeHidden({ timeout: 5_000 })

features/passwordless-authentication.feature

@@ -364,7 +364,7 @@ Feature: Passwordless authentication via email OTP
     And the login page shows an OTP verification form
     When the PAR request_uri has expired before the bridge fires
     And the OTP form re-checks PAR liveness
-    Then the Resend code button is no longer offered
+    Then the Send a new code button is no longer offered
     And a Start over button is offered instead
 
   # The demo OAuth client stores its OAuth state (state value, code

packages/auth-service/src/__tests__/login-page.test.ts

@@ -658,7 +658,7 @@ describe('renderLoginPage inline Resend action on expired OTP', () => {
     // after expiry cleanup. Retyping cannot recover any of those, so
     // the action must not be withheld from the plain-invalid branch.
     expect(html).toMatch(
-      /else if \(!parLikelyDead\(\)\)[\s\S]*?showErrorWithAction\(\s*result\.error,\s*'Resend code'/,
+      /else if \(!parLikelyDead\(\)\)[\s\S]*?showErrorWithAction\(\s*result\.error,\s*'Send a new code'/,
     )
   })
 

packages/auth-service/src/routes/account-login.ts

@@ -223,7 +223,7 @@ function renderOtpForm(opts: {
       <form method="POST" action="/account/send-otp" style="margin-top: 12px;">
         <input type="hidden" name="csrf" value="${escapeHtml(opts.csrfToken)}">
         <input type="hidden" name="email" value="${escapeHtml(opts.email)}">
-        <button type="submit" class="btn-secondary">Resend code</button>
+        <button type="submit" class="btn-secondary">Send a new code</button>
       </form>
     </div>
     ${POWERED_BY_HTML}

packages/auth-service/src/routes/login-page.ts

@@ -725,7 +725,7 @@ export function renderLoginPage(opts: {
         <button type="submit" class="btn-primary">Verify</button>
       </form>
       <div class="otp-actions">
-        <button type="button" class="btn-secondary" id="btn-resend">Resend code</button>
+        <button type="button" class="btn-secondary" id="btn-resend">Send a new code</button>
         <button type="button" class="btn-secondary" id="btn-back">Use different email</button>
       </div>
       <a href="/auth/recover?request_uri=${encodeURIComponent(opts.pdsPublicUrl + '/placeholder')}"
@@ -1358,7 +1358,7 @@ export function renderLoginPage(opts: {
               // would re-offer an action the page has deliberately
               // withdrawn. The aborted-flow notice carries its own
               // restart action, so nothing is lost by staying quiet.
-              showErrorWithAction(result.error, 'Resend code', function() {
+              showErrorWithAction(result.error, 'Send a new code', function() {
                 document.getElementById('btn-resend').click();
               });
             } else {
@@ -1396,7 +1396,7 @@ export function renderLoginPage(opts: {
         if (await abortIfFlowDead()) return;
         var result = await sendOtp(currentEmail);
         this.disabled = false;
-        this.textContent = 'Resend code';
+        this.textContent = 'Send a new code';
         if (result.error) {
           showError(result.error);
         } else {
@@ -1409,7 +1409,7 @@ export function renderLoginPage(opts: {
           // sending a new OTP invalidates every earlier one, and a user
           // who needed to resend is the user whose mail may be in spam.
           showSuccess(
-            'Resent! Make sure to use the new code; earlier ones no longer work. ' +
+            'Sent! Make sure to use the new code; earlier ones no longer work. ' +
               'It may be in your spam folder.',
           );
         }

packages/auth-service/src/routes/recovery.ts

@@ -462,7 +462,7 @@ export function renderRecoveryOtpForm(opts: {
         <input type="hidden" name="request_uri" value="${escapeHtml(opts.requestUri)}">
         <input type="hidden" name="email" value="${escapeHtml(opts.email)}">
         ${noHeartbeatField}
-        <button type="submit" class="btn-secondary">Resend code</button>
+        <button type="submit" class="btn-secondary">Send a new code</button>
       </form>
       <a href="${backHref}" class="btn-secondary">Back to sign in</a>
     </div>