fix(webapp): stop stale login errors reappearing on the login page

The /login loader read the flashed auth error without committing the
session, so the flash was never consumed: once any login attempt
flashed an error (for example a rejected email address), it reappeared
on every /login visit and made later, successful attempts look like
they failed. Commit the session when an error was read, and read the
error in the redirectTo branch too instead of dropping it.

The /login/magic action also stored its validation and rate limit
errors with session.set, which survives every later read. Switch those
to session.flash so they render once and clear.

Author: samejr

.server-changes/consume-stale-login-errors.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: fix
+---
+
+Fixed stale login errors: an error from a previous login attempt (for example a rejected email address) no longer keeps reappearing on the login page and no longer makes later, successful attempts look like they failed.

apps/webapp/app/routes/login._index/route.tsx

@@ -23,7 +23,10 @@ import { isGithubAuthSupported, isGoogleAuthSupported } from "~/services/auth.se
 import { getLastAuthMethod } from "~/services/lastAuthMethod.server";
 import { commitSession, setRedirectTo } from "~/services/redirectTo.server";
 import { getUserId } from "~/services/session.server";
-import { getUserSession } from "~/services/sessionStorage.server";
+import {
+  commitSession as commitUserSession,
+  getUserSession,
+} from "~/services/sessionStorage.server";
 import { ssoController } from "~/services/sso.server";
 import { flags as getGlobalFlags } from "~/v3/featureFlags.server";
 import { requestUrl } from "~/utils/requestUrl.server";
@@ -111,8 +114,31 @@ export async function loader({ request }: LoaderFunctionArgs) {
     showSsoAuth = (globalFlags as Record<string, unknown>).hasSso === true;
   }
 
+  // Read the flashed auth error and, when one exists, commit the session so
+  // the flash is consumed. Reading without committing leaves the flash in the
+  // cookie, so a stale error (e.g. a once-rejected email address) would
+  // resurface on every future /login visit and make later, successful login
+  // attempts look like they failed.
+  const userSession = await getUserSession(request);
+  const error = userSession.get("auth:error");
+
+  let authError: string | undefined;
+  if (error) {
+    if ("message" in error) {
+      authError = error.message;
+    } else {
+      authError = JSON.stringify(error, null, 2);
+    }
+  }
+
+  const headers = new Headers();
+  if (error) {
+    headers.append("Set-Cookie", await commitUserSession(userSession));
+  }
+
   if (redirectTo) {
     const session = await setRedirectTo(request, redirectTo);
+    headers.append("Set-Cookie", await commitSession(session));
 
     return typedjson(
       {
@@ -121,39 +147,26 @@ export async function loader({ request }: LoaderFunctionArgs) {
         showGoogleAuth: isGoogleAuthSupported,
         showSsoAuth,
         lastAuthMethod,
-        authError: null,
+        authError,
         notice,
         isVercelMarketplace: redirectTo.startsWith("/vercel/callback"),
       },
-      {
-        headers: {
-          "Set-Cookie": await commitSession(session),
-        },
-      }
+      { headers }
     );
   } else {
-    const session = await getUserSession(request);
-    const error = session.get("auth:error");
-
-    let authError: string | undefined;
-    if (error) {
-      if ("message" in error) {
-        authError = error.message;
-      } else {
-        authError = JSON.stringify(error, null, 2);
-      }
-    }
-
-    return typedjson({
-      redirectTo: null,
-      showGithubAuth: isGithubAuthSupported,
-      showGoogleAuth: isGoogleAuthSupported,
-      showSsoAuth,
-      lastAuthMethod,
-      authError,
-      notice,
-      isVercelMarketplace: false,
-    });
+    return typedjson(
+      {
+        redirectTo: null,
+        showGithubAuth: isGithubAuthSupported,
+        showGoogleAuth: isGoogleAuthSupported,
+        showSsoAuth,
+        lastAuthMethod,
+        authError,
+        notice,
+        isVercelMarketplace: false,
+      },
+      { headers }
+    );
   }
 }
 

apps/webapp/app/routes/login.magic/route.tsx

@@ -141,7 +141,9 @@ export async function action({ request }: ActionFunctionArgs) {
 
   if (!result.success) {
     const session = await getUserSession(request);
-    session.set("auth:error", {
+    // flash, not set: a set() key survives every later read/commit, so the
+    // error would reappear on each /login visit long after the failed attempt.
+    session.flash("auth:error", {
       message: "Please enter a valid email address.",
     });
 
@@ -191,7 +193,8 @@ export async function action({ request }: ActionFunctionArgs) {
               : "Failed sending magic link. Please try again shortly.";
 
           const session = await getUserSession(request);
-          session.set("auth:error", {
+          // flash, not set — same one-shot semantics as the validation error above.
+          session.flash("auth:error", {
             message: errorMessage,
           });