fix: reduce auth hydration and stabilize signup#3591
Draft
marcusgrando wants to merge 9 commits into
Draft
Conversation
3183f2c to
e18b848
Compare
Remove account hydration from pre-switch sign-in tracking and reuse token verification tracking metadata to avoid duplicate account/profile requests during login. Derive active plan state from account info so the account guard no longer blocks login on contract or service order product calls; Billing and Copilot still lazy-load contract plan data.
e18b848 to
958fb2f
Compare
Install git before security checkout, fetch the PR base branch for architecture governance, and run the security linter only against changed files so legacy findings outside the PR do not block the login hydration fix.
8a2cca7 to
258006a
Compare
Handle non-API signup errors without throwing inside the catch block, always clear the loading state, and cover the recaptcha failure path before the signup request is sent.
Keep successful email signup on the activation flow even if analytics tracking fails after account creation. This prevents a created but inactive account from leaving the user on the signup form without the activation instructions.
Detect stale Stripe checkout session errors during signup plan submission and reuse the existing recovery path instead of showing the raw Stripe message. This refreshes the checkout session when confirmation rejects a consumed, expired, or environment-mismatched session.
Remove Vue compiler macro imports from drawer components so local startup no longer reports defineExpose import warnings. The macro calls stay in place because Vue exposes them through the compiler.
Move legacy drawer service calls behind Vue Query composables so the defineExpose cleanup does not expose direct service imports to the changed-file architecture gate. This keeps existing drawer contracts while satisfying the TanStack governance check in CI.
Harden signup activation after navigation failures, make security changed-file lint resilient to zero or orphan base refs, and keep security lint scoped to security rules. Also tighten plan entitlement input handling and remove stale tracking fallback code.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bug fix
What was the problem?
Login restored the account session with extra blocking calls in the critical path:
In the HAR, Contract took about 2.09s and Service Orders took about 2.93s after the duplicated account hydration.
Email sign-up had a separate issue: after the account was created, a post-success analytics tracking error could keep the UI on the sign-up form instead of showing the activation step. This left the user with a created but inactive account, which then produced User not activated. on login until activation was completed.
The post-activation paid plan step could also surface Stripe raw errors such as No such checkout.session when Stripe rejected a checkout session during confirmation. That request is made inside Stripe.js, so it may not show as a regular Console API request in DevTools.
Expected behavior
Login should restore the session and decide onboarding redirects without waiting for Contract or Service Orders product calls. Contract plan data should still load where it is actually used, such as Billing and Copilot.
Email sign-up should show the activation instructions after successful account creation, even if analytics tracking fails.
The paid plan checkout should refresh stale Stripe sessions instead of showing raw Stripe session identifiers to the user.
How was it solved
How to test