Display Auth redirect errors

Status#

The signed-in and signed-out error notices, clean post-login redirect, tests, and Preview 2 browser proof are complete.

Problem#

Better Auth redirects failed sign-in attempts back to the Auth UI with an error query parameter. The signed-in home currently ignores it, so /?error=Sign_up_is_not_available_for_this_email_address renders the normal account page with no explanation.

Decision#

Render a persistent destructive notice above the account card when the Auth home URL contains an error:

• prefer error_description when present;
• otherwise turn the error code's underscores into spaces;
• accept future error codes without a hard-coded allowlist;
• rely on React text rendering so query data is never interpreted as markup.

The URL remains the source of truth, so refreshes preserve the explanation and normal visits without an error remain unchanged.

Checklist#

• Add a failing UI-level regression test for the screenshot URL. A server-rendered component test reproduces the missing notice for the exact error value.
• Render error_description, falling back to a humanized error code. The signed-in home validates both search fields and renders a destructive alert.
• Verify arbitrary query text is rendered as text and the no-error state is unchanged. The regression test covers escaped markup and the empty render.
• Run Auth tests, typecheck, lint, and formatting checks. All 79 Auth tests pass, including the UI and redirect cases; Auth typecheck and touched-file lint/format checks pass.
• Verify the error notice against a production-shaped preview. Auth Preview 2 renders the screenshot error and prefers a supplied error_description.
• Update the draft PR with browser proof. PR #2291 includes the exact preview URL and an inline screenshot.
• Show redirect errors immediately on the public login page. The protected-route handoff and legacy nested redirects now put the error fields directly on /login, which renders the shared notice.
• Remove handled error fields from the post-login destination while preserving its other path, query, and hash. A pure redirect regression test covers the screenshot URL plus a destination with unrelated query and hash state.
• Keep malformed redirect input from crashing login. Invalid URL syntax is explicitly classified and left for the existing safe redirect guard, with a regression for http://[::1.
• Verify both signed-in and signed-out error paths against the preview. Preview 2 shows the notice on public login with redirect=/, normalizes a legacy nested link, and forwards a signed-in login error to the account home.

Implementation notes#

• Screenshot repro: /?error=Sign_up_is_not_available_for_this_email_address
• Better Auth converts OAuth callback failures to underscore-separated error values and may also supply error_description.
• The root cause was the Auth home route having no search validation or rendering path for Better Auth's redirect error fields.
• Follow-up review found that a signed-out request to the protected home nests its error URL in /login?redirect=...; this hides the error until after sign-in and then displays stale failure state.
• The correct hypothesis was that one redirect carried two kinds of state: user-facing failure details and the post-login destination. Separating them makes the failure visible immediately and leaves the destination clean.
• Bugbot follow-up found that parsing a malformed user-provided redirect could throw before the existing open-redirect guard. The parser now classifies that expected TypeError while rethrowing unexpected failures.
• The original clipboard URL used Preview 14; PR #2291 was assigned Preview 2. Verifying the allocated slot avoided mistaking Preview 14's old build for a regression in the new route.