Marc-André Bombeck 1dde3034c6 fix(auth): say a refused sign-in in the sign-in page's own words ...

The sign-in refusals carry only their status's generic code, so once the
sign-in page read codes, a wrong password, a wrong second-factor code
and a refused security key all said "Your session has ended", and a
lockout said "too many requests just now".

localizedSignInError reads a generic 401 as the step's own failure and a
generic 429 as "Too many attempts. Wait a few minutes and try again.";
a code the step names itself keeps its sentence. The password, passkey,
code and security-key steps use it. The rate-limit sentence moves from
auth.claim to auth.signInRateLimited, since the claim page and the
sign-in page now share it, and the Korean one takes the polite form the
rest of the catalogue uses.

2026-11-12 13:54:34 +01:00

..

__tests__

fix(auth): take the push subscription off on every sign-out button

2026-11-12 13:51:44 +01:00

claim-profile.tsx

fix(auth): say a refused sign-in in the sign-in page's own words

2026-11-12 13:54:34 +01:00

insecure-transport-banner.tsx

fix(auth): refuse a sign-in over plain http before it spends a factor (#1097)

2026-10-03 18:21:19 +02:00

mfa-login-step.tsx

fix(auth): say a refused sign-in in the sign-in page's own words

2026-11-12 13:54:34 +01:00

oidc-reproof-return.tsx

feat(auth): let a single-sign-on account confirm it is you at its provider

2026-10-29 08:56:51 +01:00