fix(auth): give login and post-login loading real feedback and evidence - #543
Open
LiChenyang-GZ wants to merge 3 commits into
Open
LiChenyang-GZ wants to merge 3 commits into
LiChenyang-GZ wants to merge 3 commits into
Conversation
- Sign-in button shows a loading state and blocks a second tap while authorize() is in flight (source of TRANSACTION_ACTIVE_ALREADY). - Navigate as soon as tokens are saved; the timezone write no longer blocks the redirect for up to 30s on a slow connection. - Set the auth query directly instead of invalidating it, removing the guard race that bounced users through the sign-in screen. - Toast per Auth0 error code on failure; report non-cancel failures to Sentry with the raw cause and duration. - ProtectedGate shows a retry / sign-out screen when /User or /user-preferences fails, and no longer routes existing users into onboarding when the profile request fails. - Report and toast when a 401 clears the session, guarded so voluntary logout stays silent. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Contributor
Test Results126 tests 126 ✅ 9s ⏱️ Results for commit 2b926ea. ♻️ This comment has been updated with latest results. |
Contributor
|
Tokens issued through an Auth0 custom domain carry that domain as `iss`, so the API now accepts both the tenant issuer and the custom one. Apps built before this change keep logging in through the tenant domain and stay valid; discovery and the Management API keep using the tenant domain because the signing keys are shared. The custom domain is wired through as `Auth0:CustomDomain` (empty by default, set to auth.blotztask.com in both bicepparam files). The mobile app switches its Auth0 domain in the config plugin, the three EAS profiles, and the local .env; the plugin change alters the native callback host, so this needs a native build. The three login analytics events gain an `auth_domain` property so success rates can be compared across the two domains after release. Deploy order: verify the domain in Auth0, deploy the API, then ship the mobile build. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Stall detection: when a login is still pending 15s after the app returns to the foreground, record PostHog login_failed (Stalled) and Sentry login_stalled, flush, and release the button. This is the case where authorize() neither resolves nor rejects, which previously left only a login_started with no outcome. Also: - Android USER_CANCELLED reported to Sentry at info level (the "app came back without callback data" signature); NoTokensReturned too. - Flush PostHog at every login exit so a reinstall does not drop it. - PostHog distinct_id stamped on Sentry as a tag at launch, identify and reset, so the two timelines can be joined. - token_refresh_failed on silent getAuthToken() failures, once per 5 minutes, NO_CREDENTIALS excluded. - startup_slow when the splash is still up 10s after launch, tagged with which gate was pending. - app_entered once both gate requests succeed, with source (login or restore), destination and ms since launch. - post_login_load_failed when the gate error screen is shown. - useLogout resets analytics identity before clearSession() so a dismissed logout prompt no longer attributes the next account's events to the previous one. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Login failures and post-login loading currently give the user nothing to act on, and leave no evidence for us.
get-started-button.tsx: loading state + double-tap guard (source ofTRANSACTION_ACTIVE_ALREADY); navigate as soon as tokens are saved, timezone written in the background (was blocking the redirect up to 30s); set the auth query directly instead of invalidating it (removes the guard race); toast per Auth0 error code; non-cancel failures reported to Sentry with cause and duration.(protected)/index.tsx+ newload-error-screen.tsx: retry / sign-out screen when/Useror/user-preferencesfails, and existing users are no longer routed into onboarding when the profile request fails.error-handlers.ts: Sentry report + toast when a 401 clears the session, guarded so voluntary logout stays silent.No change to token storage, refresh, or PostHog events.
Release note
Status: