fix(auth): translate event onboarding and retry failed invite lookups by MisbahAnsar · Pull Request #389 · NEARBuilders/citynode.app

MisbahAnsar · 2026-10-21T01:20:04Z

Closes #386

Summary

Event /onboard?code= was overwritten back to English-only copy with an endless spinner when invite lookup failed.

 OnboardPage
-  hardcoded English, spinner until info arrives
-  join error → Explore only
+  LoginI18nProvider + auth.onboard.* (en/es/fr/zh)
+  "Join the community"
+  lookup error → Retry
+  join failure → specific reason + next step

…e lookups Event join was overwritten back to English-only copy with an endless spinner on lookup failure. Wire the existing auth.onboard keys, community wording, typed redeem reasons, and a Retry state so attendees can finish joining. Co-authored-by: Cursor <cursoragent@cursor.com>

A lapsed session now says to sign in with a different account, closed invites say to contact the community, and the step bar no longer depends on login i18n being in scope. Co-authored-by: Cursor <cursoragent@cursor.com>

…le copy Revoked and used-up invites no longer fail the browser suite on old "revoked"/"reached its limit" wording, and a completed join still shows the success panel if the QR expires before the attendee reloads. Co-authored-by: Cursor <cursoragent@cursor.com>

…kflow.

The regression job died because it asked for the pnpm store path before pnpm existed, so the cache path was empty. Also keep the plugin test loop from failing on folders with no package.json.

Regression HTML loads were treating valid session cookies as signed-out because Playwright stored them as localhost domain cookies and a cached null session skipped the real getSession read.

itexpert120 · 2026-10-22T16:08:19Z

@private-review full

multi-review

Inline findings for 96e81f4; see the summary comment for the rest.

multi-review · 2026-10-22T16:10:34Z


  const [accountCreated, setAccountCreated] = useState(false);
-  const [redeemed, setRedeemed] = useState<Redeemed | null>(null);
+  const [redeemed, setRedeemed] = useState<Redeemed | null>(() => readStoredRedeemed(code));


🟠 Medium · correctness: Cached join is keyed only by invite code, so another user or a signed-out visitor sees “You're in” without joining

readStoredRedeemed(code) sets redeemed from sessionStorage using only citynode.onboard.redeemed:<code>. It does not check who is signed in. Once redeemed is truthy, two things follow: the join effect returns early, so redeemOnboardingCode never runs, and the joined panel renders.

Concrete scenario: user A joins via /onboard?code=X. A signs out in the same tab, which happens on a shared phone or a borrowed device at an event. User B then signs in and opens the same link. B is shown “You've joined Chicago Builders…” but is never added to the organization or team.

The same applies to a signed-out visitor whose session has lapsed. They get the joined panel, and because session?.user.name is undefined they also get the DisplayNameStep, whose updateUser call then fails.

The cache is also unnecessary for the case it was added for. The server already treats a repeat redeem as idempotent: a prior redeemer who is still a member gets the joined result even after the code expires (services/onboarding.ts lines 395–413). Stale entries (for example after the member was removed) also keep showing the joined state for the rest of the tab session.

Suggested fix: Store the user id with the cached result and only restore it when session.user.id matches, ignoring it while the session is pending or null. Alternatively, drop the sessionStorage cache and rely on the server's idempotent redeem, which already handles reloads after the code expires.

multi-review · 2026-10-22T16:10:35Z

Multi Review · `50991e8` (changes since `96e81f4`)

The PR returns the resolved session row from the auth plugin's getContext so the host can show signed-in pages as signed in again on the server. It deletes the app-level requireSession workaround and the sessionStorage join cache on /onboard, which was keyed only by invite code. Without the cache, a reload sends the join request again, and the server answers "already joined" for existing members even after the code expires. Risk looks low, and the earlier cached-join finding no longer applies.

No new issues found · 1 still open from earlier

What was checked (8 areas)

SessionService.getContext: the new session field on the cookie-session, API-key and signed-out paths
Callers of getContext: the /v1/auth/context route, UI callers of apiClient.auth.getContext, and integration tests
requestContextSchema and contextSessionSchema against the shape the service returns, and places that build the type by hand (UI tests use casts)
getSession already returns the session token, so getContext exposes nothing new
The onboard.tsx join effect without the sessionStorage cache, including remounts and different users
Server redeem logic in onboarding.ts: a member reusing an expired code gets "already joined"
ui/src/app.ts: requireSession now comes from lib/auth (everything-dev/ui/auth); callers are _authenticated.tsx and _admin.tsx; the root route's handling of the server-provided session
Earlier finding about the cached join keyed only by invite code: no longer applies because the cache is gone

Still open from earlier reviews

🟠 Medium plugins/auth/ui/src/routes/_public/onboard.tsx:170 Cached join is keyed only by invite code, so another user or a signed-out visitor sees “You're in” without joining

_{Comment @multi-review to re-review new commits, or @multi-review full for a full review.}

… cache Return the resolved session from the auth plugin's getContext() so the host's SSR auth sees signed-in users again, and revert the requireSession workaround in ui/src/app.ts. Drop the sessionStorage join cache on /onboard. It was keyed only by the invite code, so a later visitor in the same tab (another user or a signed-out one) saw the joined state without redeeming. The server already treats a repeat redeem by an existing member as idempotent, including after the code expires, so a reload re-redeems and still lands on the joined panel.

itexpert120 · 2026-10-22T18:55:09Z

@multi-review

adenarc · 2026-10-23T16:51:27Z

@MisbahAnsar resolve merge conflicts.

…tests in CI

MisbahAnsar · 2026-10-23T19:01:34Z

@adenarc

…lookup-errors # Conflicts: # plugins/auth-ui/vitest.config.ts

adenarc

Went through this twice. The i18n coverage looks complete (every key used exists in all 4 locales) and the wording is all "community" now. A few things inline, mostly around error states.

…ying refused joins Only show the invitation load error when there is no invitation to show, and drop the Retry spinner that could not render. An unrecognised FORBIDDEN or BAD_REQUEST from redeem now shows a contact-the-community state instead of Retry. An expired session now asks the member to sign in again rather than use a different account. Status panels put their test id on the panel root.

elliotBraem · 2026-10-24T20:27:29Z

Hold off on this one @MisbahAnsar, I can take it from here

elliotBraem

Blocking

…ss unit-test CI job Salvage of #386-onboard-i18n-lookup-errors after local auth-ui moved to the upstream published auth plugin (#425): - Extract cookie mapping/encoding into tests/regression/lib/playwright-cookies.mjs with unit tests (Cookie values and Secure flag now follow the stack origin, so Chromium sends minted session cookies back to the app) - auth-test-instance: pin baseURL + cookie options to the stack origin - ci-child: gate a regression-unit job (test:regression:unit) The onboard i18n/retry half of the original PR now belongs upstream in everything-dev plugins/auth/ui/ (see citynode#386).

elliotBraem · 2026-10-28T17:03:37Z

Resolved the conflicts by rebranching onto current main — but not by re-adding everything. Since #425 removed the local auth-ui plugin in favor of the upstream published @everything-dev/auth-plugin, the PR now splits in two halves:

Kept (this PR, salvaged from the original):

tests/regression/lib/playwright-cookies.mjs + unit tests — cookie mapping/encoding helpers (values and Secure flag now follow the stack origin instead of a localhost domain, so Chromium sends minted session cookies back to the app)
auth-session.ts / seeded.ts refactors and spec updates (event-station, organizer-stations, organization-approval) to use injectSessionCookies
auth-test-instance.ts: baseURL + fixtureAuthCookieOptions pinned to the stack origin (hand-merged with main's frozen-schema/no-migration change)
ci-child.yml: new gating regression-unit job running test:regression:unit

Dropped (superseded / dead here):

all plugins/auth-ui/** — deleted on main by chore: remove local auth-ui, use upstream published auth plugin #425; the onboard page now ships from the upstream plugin
the changeset (changesets were dropped in 805678b), the .gitignore line, and the jsdom lockfile hunk
the onboarding.spec.ts wording change — the expected copy (revoked, reached its limit) still matches the published upstream plugin

Moved upstream: the actual #386 fix (i18n + "community" wording + retry on failed invite lookup) now belongs in plugins/auth/ui/ in NEARBuilders/everything-dev, which still has the bug — see the upstream issue I filed.

Also picked up a tiny formatting fix in bos.app.ts (pre-existing on main, would have failed lint).

…lookup-errors

…heck

…om/NEARBuilders/citynode.app into fix/386-onboard-i18n-lookup-errors

MisbahAnsar requested a review from elliotBraem October 21, 2026 01:20

MisbahAnsar and others added 5 commits October 21, 2026 06:58

fix(auth): make onboard join failures tell people what to do next

cb7c93e

A lapsed session now says to sign in with a different account, closed invites say to contact the community, and the step bar no longer depends on login i18n being in scope. Co-authored-by: Cursor <cursoragent@cursor.com>

Merge main into onboard i18n branch so the PR uses the current CI wor…

1c35d18

…kflow.

ci: install pnpm before caching its store

59b4a63

The regression job died because it asked for the pnpm store path before pnpm existed, so the cache path was empty. Also keep the plugin test loop from failing on folders with no package.json.

fix(auth): keep seeded sessions signed in on SSR routes

96e81f4

Regression HTML loads were treating valid session cookies as signed-out because Playwright stored them as localhost domain cookies and a cached null session skipped the real getSession read.

multi-review Bot reviewed Oct 22, 2026

View reviewed changes

This was referenced Oct 23, 2026

Show the community's channels on the joined screen #394

Open

Don't tell people who left that they've rejoined #399

Open

Epic: Node member pathways #408

Open

MisbahAnsar added 2 commits October 23, 2026 23:50

Merge origin/main into fix/386-onboard-i18n-lookup-errors

c090fea

fix(onboard): tie joins to the signed-in member and run harness unit …

dcbedd3

…tests in CI

MisbahAnsar and others added 2 commits October 24, 2026 00:56

refactor(onboard): drop implementation comments

6dfe674

Merge remote-tracking branch 'origin/main' into fix/386-onboard-i18n-…

82fc64b

…lookup-errors # Conflicts: # plugins/auth-ui/vitest.config.ts

jlwaugh mentioned this pull request Oct 24, 2026

fix(changesets): restore the Release workflow after the auth-plugin removal #416

Closed

adenarc reviewed Oct 24, 2026

View reviewed changes

jlwaugh mentioned this pull request Oct 24, 2026

Land members in their community from Home and Overview #393

Closed

12 tasks

elliotBraem requested changes Oct 24, 2026

View reviewed changes

elliotBraem added 2 commits October 28, 2026 12:00

style: unquote repository key in bos.app.ts

8ca37c0

elliotBraem mentioned this pull request Oct 28, 2026

Onboarding at events: translate /onboard, use "community" wording, and handle failed invite lookups NEARBuilders/everything-dev#653

Open

elliotBraem added 4 commits October 28, 2026 12:40

Merge branch 'main' into fix/386-onboard-i18n-lookup-errors

fc0b0fc

Merge remote-tracking branch 'origin/main' into fix/386-onboard-i18n-…

e2de3a3

…lookup-errors

fix(ui): drop dead isPersonal reference left by #466 to restore typec…

9f746e7

…heck

Merge branch 'fix/386-onboard-i18n-lookup-errors' of https://github.c…

d6423bc

…om/NEARBuilders/citynode.app into fix/386-onboard-i18n-lookup-errors

elliotBraem approved these changes Oct 28, 2026

View reviewed changes

elliotBraem merged commit 57b1e56 into main Oct 28, 2026
7 checks passed

elliotBraem deleted the fix/386-onboard-i18n-lookup-errors branch October 28, 2026 18:05

Conversation

MisbahAnsar commented Oct 21, 2026

Summary

Uh oh!

itexpert120 commented Oct 22, 2026

Uh oh!

multi-review Bot left a comment

Choose a reason for hiding this comment

Uh oh!

multi-review Bot Oct 22, 2026

Choose a reason for hiding this comment

Uh oh!

multi-review Bot commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Multi Review · 50991e8 (changes since 96e81f4)

Still open from earlier reviews

Uh oh!

itexpert120 commented Oct 22, 2026

Uh oh!

adenarc commented Oct 23, 2026

Uh oh!

MisbahAnsar commented Oct 23, 2026

Uh oh!

adenarc left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

elliotBraem commented Oct 24, 2026

Uh oh!

elliotBraem left a comment

Choose a reason for hiding this comment

Uh oh!

elliotBraem commented Oct 28, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

multi-review Bot commented Oct 22, 2026 •

edited

Loading

Multi Review · `50991e8` (changes since `96e81f4`)