Skip to content

fix: 2FA login always shows generic "bad credentials" error #9

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ninocss merged 2 commits into from
Apr 11, 2026
Merged

fix: 2FA login always shows generic "bad credentials" error #9

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b145339
fix: return otpInvalid for any server error when 2FA OTP is submitted
Copilot Apr 11, 2026
a8efdef
fix: simplify invalidOtp check - any error with OTP provided is treat…
Copilot Apr 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion lib/main.dart
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -182,12 +182,15 @@ Future<Map<String, dynamic>?> _authenticateUntis({
};
}

// Treat any server error as an invalid OTP when a code was provided, so
// the caller can show the 2FA-specific error instead of the generic
// "check your credentials" message.
final invalidOtp =
combined.contains('invalid otp') ||
combined.contains('invalid verification') ||
combined.contains('wrong otp') ||
combined.contains('otp invalid') ||
(contains2faHint && otpCode != null && otpCode.isNotEmpty);
(otpCode != null && otpCode.isNotEmpty);
Comment on lines 188 to +193
Copy link

Copilot AI Apr 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

With the new (otpCode != null && otpCode.isNotEmpty) clause, the preceding string checks in invalidOtp are redundant for the OTP-present path (the expression will always be true). If the intent is “any error when OTP is provided”, this can be simplified to improve readability and avoid implying that keyword matching still matters in that branch.

Copilot uses AI. Check for mistakes.
if (invalidOtp) {
Comment on lines +185 to 194
Copy link

Copilot AI Apr 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

invalidOtp now becomes true for any JSON-RPC error whenever a non-empty OTP was sent. This will classify unrelated server-side/auth errors (e.g., wrong username/password, invalid school/server, temporary backend failures) as “OTP invalid”, which can mislead users and mask actionable errors. Consider restricting this fallback to clearly auth-related failures (e.g., specific error codes/messages like "bad credentials") or returning a distinct flag so the UI can show a non-OTP error when appropriate.

Copilot uses AI. Check for mistakes.
return {
'otpInvalid': true,
Expand Down
Loading