From 36a2c29891c30b97ffe1db7d7f7b2aaea5fc4479 Mon Sep 17 00:00:00 2001 From: Lakhan Samani Date: Tue, 28 Jul 2026 14:33:23 +0530 Subject: [PATCH] fix(mfa): remove misleading Back link from post-signup MFA setup MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The post-signup MFA-setup screen is shown after the account has already been created server-side (withheld-token first-time-setup flow). Its onBack handler only reset mfaOfferData, which toggles between the MFA screen and the signup form. It never touched formData, so Back dropped the user onto the signup form still pre-filled with the just-used email. Resubmitting was guaranteed to fail with "user with given email already exists" — Back was a dead end into a predictable duplicate-email error, not an actual undo. Stop passing onBack here so the {onBack && } guard in AuthorizerMFASetup hides it, leaving "Skip for now" (skipMfaSetup) as the sole, correct way to exit. onBack usage in the login contexts (AuthorizerBasicAuthLogin, AuthorizerPasskeyLogin, AuthorizerRoot) is unaffected — login is idempotent with no uniqueness check. --- src/components/AuthorizerSignup.tsx | 1 - 1 file changed, 1 deletion(-) diff --git a/src/components/AuthorizerSignup.tsx b/src/components/AuthorizerSignup.tsx index b4dce2d..9a21374 100644 --- a/src/components/AuthorizerSignup.tsx +++ b/src/components/AuthorizerSignup.tsx @@ -347,7 +347,6 @@ export const AuthorizerSignup: FC<{ }} totpEnrollment={mfaOfferData.totpEnrollment || undefined} heading="Set up multi-factor authentication" - onBack={() => setMfaOfferData({ ...initMfaOfferData })} loginContext={{ email: mfaOfferData.email, phone_number: mfaOfferData.phone_number,