fix: reduce auth hydration and stabilize signup#3591
Open
marcusgrando wants to merge 12 commits into
Open
Conversation
marcusgrando
requested review from
HerbertJulio,
gdsantana,
isaquebock,
pauloSF0,
rafaelgarbinatto and
robsongajunior
as code owners
marcusgrando
force-pushed
the
grando/fix-login-hydration
branch
2 times, most recently
from
3183f2c to
e18b848
Compare
Remove account hydration from pre-switch sign-in tracking and reuse token verification tracking metadata to avoid duplicate account/profile requests during login. Derive active plan state from account info so the account guard no longer blocks login on contract or service order product calls; Billing and Copilot still lazy-load contract plan data.
marcusgrando
force-pushed
the
grando/fix-login-hydration
branch
from
e18b848 to
958fb2f
Compare
marcusgrando
changed the title
Install git before security checkout, fetch the PR base branch for architecture governance, and run the security linter only against changed files so legacy findings outside the PR do not block the login hydration fix.
marcusgrando
force-pushed
the
grando/fix-login-hydration
branch
from
8a2cca7 to
258006a
Compare
Handle non-API signup errors without throwing inside the catch block, always clear the loading state, and cover the recaptcha failure path before the signup request is sent.
Keep successful email signup on the activation flow even if analytics tracking fails after account creation. This prevents a created but inactive account from leaving the user on the signup form without the activation instructions.
marcusgrando
changed the title
Detect stale Stripe checkout session errors during signup plan submission and reuse the existing recovery path instead of showing the raw Stripe message. This refreshes the checkout session when confirmation rejects a consumed, expired, or environment-mismatched session.
Remove Vue compiler macro imports from drawer components so local startup no longer reports defineExpose import warnings. The macro calls stay in place because Vue exposes them through the compiler.
Move legacy drawer service calls behind Vue Query composables so the defineExpose cleanup does not expose direct service imports to the changed-file architecture gate. This keeps existing drawer contracts while satisfying the TanStack governance check in CI.
Harden signup activation after navigation failures, make security changed-file lint resilient to zero or orphan base refs, and keep security lint scoped to security rules. Also tighten plan entitlement input handling and remove stale tracking fallback code.
Use has_service_order_plan from account info as the authoritative source for the post-login plan gate. Remove the duplicate hasActivePlan state, keep hydration free of Contract/service-order fallback, and cover true/false/non-boolean behavior in focused tests.
Keep SSO sign-in analytics from depending on token tracking payload presence, while avoiding tracking failed redirects back to login. Clean stale plan-gate comments and remove unused drawer loading returns surfaced by review.
Normalize has_service_order_plan in the account info adapter so the onboarding gate depends on a visible boolean contract instead of an implicit spread. Default missing or non-boolean backend values to false and cover the adapter behavior with focused tests.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bug fix
What was the problem?
Login restored the account session with extra blocking calls in the critical path:
In the HAR, Contract took about 2.09s and Service Orders took about 2.93s after the duplicated account hydration.
Email sign-up had a separate issue: after the account was created, a post-success analytics tracking error could keep the UI on the sign-up form instead of showing the activation step. This left the user with a created but inactive account, which then produced User not activated. on login until activation was completed.
The post-activation paid plan step could also surface Stripe raw errors such as No such checkout.session when Stripe rejected a checkout session during confirmation. That request is made inside Stripe.js, so it may not show as a regular Console API request in DevTools.
Reviews also found that the has_service_order_plan dependency was only implicit via response spread, SSO sign-in analytics could be skipped if the verify payload missed user_tracking_info, and a few comments/returned loading refs were stale after the login changes.
Expected behavior
Login should restore the session and decide onboarding redirects without waiting for Contract or Service Orders product calls. Contract plan data should still load where it is actually used, such as Billing and Copilot.
has_service_order_plan from /api/account/info is the source of truth for the post-login plan gate: false opens plan configuration, true skips the plan screen and logs the user into Console. The account adapter should expose that dependency explicitly and default missing/non-boolean values to false.
SSO sign-in analytics should still attempt tracking for successful non-first-login SSO redirects even when token tracking data is absent, using store data fallback.
Email sign-up should show the activation instructions after successful account creation, even if analytics tracking fails.
The paid plan checkout should refresh stale Stripe sessions instead of showing raw Stripe session identifiers to the user.
How was it solved
How to test