Give the same error for every failed login

An unknown or passwordless account was rejected without the i18n key that
a wrong password gets, so the response told which emails have an account.
This commit is contained in:
Alexis Loskoutoff committed 2026-11-05 17:29:48 +01:00
1 parent 2f5342b427
commit 0d90542119
1 file changed
+2 -2
+2 -2
View File
@@ -35,13 +35,13 @@ export default {
.first();
if (!user) {
throw new errs.AuthError(ERROR_MESSAGE_INVALID_AUTH);
throw new errs.AuthError(ERROR_MESSAGE_INVALID_AUTH, ERROR_MESSAGE_INVALID_AUTH_I18N);
}
const auth = await authModel.query().where("user_id", "=", user.id).where("type", "=", "password").first();
if (!auth) {
throw new errs.AuthError(ERROR_MESSAGE_INVALID_AUTH);
throw new errs.AuthError(ERROR_MESSAGE_INVALID_AUTH, ERROR_MESSAGE_INVALID_AUTH_I18N);
}
const valid = await auth.verifyPassword(data.secret);