fix(#411): sanitize login error messages through parseAuthError — prevent raw error leakage

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-16 15:45:40 -06:00
parent 4d9b75994f
commit 5328390f4c
2 changed files with 43 additions and 10 deletions
--- a/apps/web/src/app/(auth)/login/page.tsx
+++ b/apps/web/src/app/(auth)/login/page.tsx
@@ -102,11 +102,10 @@ export default function LoginPage(): ReactElement {
        const result = await signIn.email({ email, password });

        if (result.error) {
-          setError(
-            typeof result.error.message === "string"
-              ? result.error.message
-              : "Unable to sign in. Please check your credentials and try again."
+          const parsed = parseAuthError(
+            result.error.message ? new Error(String(result.error.message)) : result.error
          );
+          setError(parsed.message);
        } else {
          router.push("/tasks");
        }