From c86cff5dad786974fb91ca8b5010d17082a7e3f5 Mon Sep 17 00:00:00 2001 From: Lucas Berger Date: Mon, 15 Jun 2026 16:22:47 -0400 Subject: [PATCH] fix(12): IN-04 trim email before sending to /api/setup/credential email.trim() was already used in the saveDisabled guard but not applied to the mutate call payload. A non-empty value with leading/trailing spaces would pass the guard and reach the server untrimmed, causing Zod's z.string().email() to reject it with a generic 400 and no diagnostic path for the user. Co-Authored-By: Claude Sonnet 4.6 --- apps/pwa/src/routes/SetupPage.tsx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/pwa/src/routes/SetupPage.tsx b/apps/pwa/src/routes/SetupPage.tsx index fcb9c5b..92f7757 100644 --- a/apps/pwa/src/routes/SetupPage.tsx +++ b/apps/pwa/src/routes/SetupPage.tsx @@ -772,7 +772,7 @@ function Step3Credential({ onBack, onSuccess, onLocked, stepHeadingRef }: Step3P if (saveDisabled) return; setValidationState('idle'); setCredentialVerified(false); - completeMutation.mutate({ fastmailEmail: email, appPassword: password }); + completeMutation.mutate({ fastmailEmail: email.trim(), appPassword: password }); } function handleComplete() {