mirror of
https://github.com/element-hq/matrix-authentication-service.git
synced 2026-10-15 15:31:02 +00:00
Devon HudsonandClaude Opus 5.5
b7dd2949d2
With password registration disabled, opening an invite link whose token is unknown, revoked, expired or used redirected to the upstream provider or to `/login`, so the invitee never learned that the link was the problem. The page now stays, with the "invite invalid" alert above the provider buttons and the sign-in link. A valid token which isn't passwordless can't register there, so it still redirects. Posting a token which has become invalid re-renders the page with only the token's error, instead of validating the rest of the form, which would tell whether a username exists even with registration closed. The page submits a token only when it resolved, and the re-rendered form drops it, so that the next submission is an ordinary registration rather than the same error. A blank token is no token, on the link and on the form alike, and spaces around one are ignored. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CZdGaj9bJcn5QeeUw8YXoF