luckberg/familysync
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(12): IN-04 trim email before sending to /api/setup/credential

Browse Source 
email.trim() was already used in the saveDisabled guard but not applied to
the mutate call payload. A non-empty value with leading/trailing spaces would
pass the guard and reach the server untrimmed, causing Zod's z.string().email()
to reject it with a generic 400 and no diagnostic path for the user.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Lucas Berger
2026-06-15 16:22:47 -04:00
co-authored by Claude Sonnet 4.6
parent b0b5bceaed
commit c86cff5dad
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/pwa/src/routes/SetupPage.tsx
+1 -1
View File
@@ -772,7 +772,7 @@ function Step3Credential({ onBack, onSuccess, onLocked, stepHeadingRef }: Step3P
if (saveDisabled) return;
setValidationState('idle');
setCredentialVerified(false);
completeMutation.mutate({ fastmailEmail: email, appPassword: password });
completeMutation.mutate({ fastmailEmail: email.trim(), appPassword: password });
}
function handleComplete() {