fix(web): re-evaluate signup submit gate when async breach check resolves

YousifShkara commented

2026-06-30 08:34:36 +02:00

Owner

The signup form gates "Create Account" on every password-requirement row passing plus the confirm-match. The HIBP breach check is debounced 500 ms and async; when it lands, it flips #pw-breach between pass/fail/pending but never calls refreshSubmit(). So the gate is whatever the most-recent input event computed, which ran 500 ms ago with the row in pending.

User-visible: type a leaked password (breach goes red, button disabled, correct). Type a clean strong password. Every row turns green and the confirm-match badge says "Passwords match", but "Create Account" stays greyed out because the gate was last evaluated when the breach row was still pending, not when it later resolved to pass. The only recovery today is to focus-toggle a field so another input event runs after the resolution.

Add refreshSubmit() after every setState(rowBreach, ...) inside checkBreach: the result path, the unavailable-crypto bail, the network-failure bail, and the catch bail. The synchronous local-rule path (rowLen / rowCase / rowDigit) already refreshes once at the end of the input handler, so this only touches the async path.

#BUNYIP-283

The signup form gates "Create Account" on every password-requirement row passing plus the confirm-match. The HIBP breach check is debounced 500 ms and async; when it lands, it flips `#pw-breach` between pass/fail/pending but never calls `refreshSubmit()`. So the gate is whatever the most-recent `input` event computed, which ran 500 ms ago with the row in `pending`. User-visible: type a leaked password (breach goes red, button disabled, correct). Type a clean strong password. Every row turns green and the confirm-match badge says "Passwords match", but "Create Account" stays greyed out because the gate was last evaluated when the breach row was still `pending`, not when it later resolved to `pass`. The only recovery today is to focus-toggle a field so another `input` event runs after the resolution. Add `refreshSubmit()` after every `setState(rowBreach, ...)` inside `checkBreach`: the result path, the unavailable-crypto bail, the network-failure bail, and the catch bail. The synchronous local-rule path (rowLen / rowCase / rowDigit) already refreshes once at the end of the input handler, so this only touches the async path. #BUNYIP-283

YousifShkara self-assigned this

2026-06-30 08:34:36 +02:00

YousifShkara added 1 commit

2026-06-30 08:34:36 +02:00

fix(web): re-evaluate signup submit gate when async breach check resolves

E2E / Playwright against deployment (pull_request) Failing after 23s

Details

Check / fmt + clippy + build + tests (pull_request) Successful in 8m40s

Details

0f76514f5e

The signup form gates "Create Account" on every password-requirement row passing plus the confirm-match. The HIBP breach check is debounced 500 ms and async; when it lands, it flips `#pw-breach` between pass/fail/pending but never calls `refreshSubmit()`. So the gate is whatever the most-recent `input` event computed, which ran 500 ms ago with the row in `pending`.

User-visible: type a leaked password (breach goes red, button disabled, correct). Type a clean strong password. Every row turns green and the confirm-match badge says "Passwords match", but "Create Account" stays greyed out because the gate was last evaluated when the breach row was still `pending`, not when it later resolved to `pass`. The only recovery today is to focus-toggle a field so another `input` event runs after the resolution.

Add `refreshSubmit()` after every `setState(rowBreach, ...)` inside `checkBreach`: the result path, the unavailable-crypto bail, the network-failure bail, and the catch bail. The synchronous local-rule path (rowLen / rowCase / rowDigit) already refreshes once at the end of the input handler, so this only touches the async path.

#BUNYIP-283

YousifShkara added 1 commit

2026-06-30 08:56:52 +02:00

Merge remote-tracking branch 'origin/main' into fix/BUNYIP-283-signup-submit-gate-breach-async

E2E / Playwright against deployment (pull_request) Successful in 23s

Details

Check / fmt + clippy + build + tests (pull_request) Successful in 9m35s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

017e3594ab

YousifShkara merged commit 57b99a9b87 into main

2026-06-30 09:11:37 +02:00