Repository navigation
fix(web): explain password requirements on signup instead of generic error - #1248
Merged
Merged
Conversation
…error Browser-generated passwords (e.g. Chrome) often lack a symbol, which the /auth/register API rejects with only 'Invalid registration request'. - show the password requirements under the field and set passwordrules so password managers generate compliant passwords - validate the password client-side and list what is missing - surface the API 'errors' details instead of the generic message Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Contributor
|
Note Currently processing new changes in this PR. This may take a few minutes, please wait... ⚙️ Run configuration
📒 Files selected for processing: 7
✨ Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
riderx
added a commit
that referenced
this pull request
Oct 21, 2026
main (#1248) added password requirement checks to register.ts; the VM test context did not provide the imported helpers or password element methods. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
riderx
added a commit
that referenced
this pull request
Oct 21, 2026
main (#1248) added passwordrules to the register password field, which Astro's attribute types do not include, so astro check failed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
riderx
added a commit
that referenced
this pull request
Oct 22, 2026
…no trial) for paid-ads visitors (#1234) * feat(ads): direct offer (no free trial) for paid-ads visitors Visitors landing with ?offer=direct (added to every ad URL) are persisted via first-touch attribution (cookie + localStorage) and flagged before first paint with data-offer="direct" on <html>. Trial copy (data-trial-copy) is swapped for 14-day money-back guarantee copy (data-direct-copy) with pure CSS, so there is no flash and normal visitors see no change. - attribution: capture offer=direct only, persist it, send metadata.offer on signup and signup_offer to PostHog, forward it on register/console links - OfferText component + global CSS toggles - header, SignupCta, live-update, native-build, builder/webapp/no-mac solutions pages and /register/ render both variants - new direct-offer message keys, contexts regenerated - attribution tests extended Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(ads): money-back guarantee copy on /pricing/ for direct offer Swap trial wording on the pricing page for offer=direct visitors: hero H1, plan buttons, calculator CTAs, "How pricing works" highlight and the Trial & Support FAQ (visible copy only, JSON-LD unchanged). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(ads): send offer via register API and fix pricing CTA contrast check - RegisterUserInput accepts the optional `offer: 'direct'`; register and registration tests assert it reaches the POST /auth/register body and the user_signed_up event (signup_offer). - Plan CTAs get a stable data-plan-cta hook. The contrast check now measures the visible label variant on /pricing/ and /pricing/?offer=direct instead of relying on the trial-specific aria-label. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(ads): per-ad images for ChatGPT builder-to-mobile campaigns Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(ads): ChatGPT ad images for use-case pages and money-back guarantee Adds 12 images for live-update, native-build, build-without-mac and webapp-to-mobile, puts the 14-day money-back guarantee on every image, and moves them to public/ads/chatgpt/. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(ads): list image and tracking URL for every ChatGPT ad Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(attribution): expire the direct offer 180 days after capture Store the capture time (offer_at) with the offer and drop offers that are missing a timestamp or older than 180 days, in both the inline first-touch script and lib/attribution. Revisits keep the original capture time, so rewriting the cookie no longer extends the offer. offer_at is not forwarded on register/console links. normalizeOffer now accepts only the exact value 'direct' (no trimming or case folding), and the PostHog fallback reader sets signup_offer. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(copy): direct-offer label for the comparison row and aria-label context Direct visitors pay first, so the "Try before you pay" comparison row on live-update and native-build now reads "Money-back guarantee" for them. Rename direct_offer_plan_cta_aria to direct_offer_plan_cta_aria_label and match _aria_label before the generic _label rule in the context generator, so translators see it as an accessible label. Contexts regenerated with bun run generate:message-contexts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(contrast): scan the direct-offer pricing page in an isolated context The offer=direct navigation persisted the offer in the shared context, so every later route was scanned as a paid-ads visitor. Run it in a throwaway browser context and run the axe color-contrast scan on that variant too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(ads): native-build a_command copy matches the iOS-only command Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(register): stub password validation helpers in the VM harness main (#1248) added password requirement checks to register.ts; the VM test context did not provide the imported helpers or password element methods. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(types): declare the passwordrules input attribute for astro check main (#1248) added passwordrules to the register password field, which Astro's attribute types do not include, so astro check failed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(ads): deploy the site before importing the ChatGPT campaigns Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
A user (tech@hellobello.at) couldn't sign up on capgo.app/register using their browser's suggested strong password and only got "Invalid registration request".
The
/auth/registerAPI requires an uppercase letter, a lowercase letter, a number and a special character. Chrome's generated passwords often have no symbol (e.g.xY7kq2mPzR9wB4n), so the API rejects them. It does return the reason in anerrorsarray, but the landing page ignored it and showed only the genericmessage. The form also had no hint and no client-side check.Fix
aria-describedby.passwordrulesattribute on the input so Safari/Chrome password managers generate passwords that meet the policy.getPasswordRequirementErrors) and lists exactly what's missing before submitting. It also setsaria-invalidand moves focus to the field.errors, those are shown instead of "Invalid registration request".password_requirementswith translator context.Screenshot
Submitting a Chrome-style generated password with no symbol:
Tests
bun test apps/web/src/services/registration.test.ts: 5 pass. New tests cover APIerrorsbeing shown and the client-side policy.🤖 Generated with Claude Code
Need help on this PR? Tag
@codesmith-botwith what you need.Summary by CodeRabbit
New Features
Bug Fixes