From bcc1dbc284839db0955c172ad2dbe2db7c4eeaa5 Mon Sep 17 00:00:00 2001
From: aarbit <aarbit@gmail.com>
Date: Mon, 28 Sep 2026 09:42:26 -0500
Subject: [PATCH] Fix production auth bugs: swallowed error message, dev hint
 leak

CompleteProfileScreen threw a raw PostgrestError (not an Error instance),
so `err instanceof Error` was false and the real message got swallowed.
LoginScreen's Mailpit hint was showing in production; gated behind DEV.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017DUU6CnxECCDeqDNYJgr5x
---
 src/components/auth/CompleteProfileScreen.tsx |  5 ++++-
 src/components/auth/LoginScreen.tsx           | 18 ++++++++++--------
 2 files changed, 14 insertions(+), 9 deletions(-)

diff --git a/src/components/auth/CompleteProfileScreen.tsx b/src/components/auth/CompleteProfileScreen.tsx
index 85b5eab..5643319 100644
--- a/src/components/auth/CompleteProfileScreen.tsx
+++ b/src/components/auth/CompleteProfileScreen.tsx
@@ -25,7 +25,10 @@ export default function CompleteProfileScreen({ onDone }: { onDone: () => void }
 
       const { error } = await supabase.from('profiles').update({ username: username.trim() }).eq('id', user.id)
       if (error) {
-        throw error.code === '23505' ? new Error('That username is already taken.') : error
+        // PostgrestError is a plain object, not an Error instance — wrap it
+        // so its message survives the catch block below instead of falling
+        // through to the generic fallback message.
+        throw error.code === '23505' ? new Error('That username is already taken.') : new Error(error.message)
       }
       onDone()
     } catch (err) {
diff --git a/src/components/auth/LoginScreen.tsx b/src/components/auth/LoginScreen.tsx
index 45ec20a..5f218b8 100644
--- a/src/components/auth/LoginScreen.tsx
+++ b/src/components/auth/LoginScreen.tsx
@@ -67,13 +67,15 @@ export default function LoginScreen() {
             We sent a confirmation link to <span className="font-medium">{email}</span>. You'll need to confirm
             before you can sign in.
           </p>
-          <p className="mt-2 text-[11px] text-slate-400">
-            Local dev: open Mailpit at{' '}
-            <a href="http://127.0.0.1:54324" className="underline" target="_blank" rel="noreferrer">
-              127.0.0.1:54324
-            </a>{' '}
-            to see it — no real email is sent.
-          </p>
+          {import.meta.env.DEV && (
+            <p className="mt-2 text-[11px] text-slate-400">
+              Local dev: open Mailpit at{' '}
+              <a href="http://127.0.0.1:54324" className="underline" target="_blank" rel="noreferrer">
+                127.0.0.1:54324
+              </a>{' '}
+              to see it — no real email is sent.
+            </p>
+          )}
           <button
             onClick={() => {
               setConfirmSent(false)
@@ -91,7 +93,7 @@ export default function LoginScreen() {
   return (
     <div className="flex h-screen items-center justify-center bg-slate-50">
       <form onSubmit={handleSubmit} className="w-full max-w-sm rounded-lg border border-slate-200 bg-white p-6 shadow-sm">
-        <h1 className="text-sm font-semibold text-indigo-700">AV Planner</h1>
+        <h1 className="text-sm font-semibold text-indigo-700">Diagrav</h1>
         <p className="mt-1 text-xs text-slate-500">{mode === 'sign-in' ? 'Sign in' : 'Create an account'}</p>
 
         <button