From 1867a1aac8f2fd8080d8bfc829e0abbe7a6babea Mon Sep 17 00:00:00 2001 From: Macky Date: Fri, 7 Aug 2026 21:00:15 +0700 Subject: [PATCH] fix(auth): login resolves by EITHER username or email Root cause of 'wrong password' right after logout->login (no redeploy): after first-run setup sets an email, users naturally type their EMAIL in the login field, but verify() only looked up by USERNAME -> user not found -> 'invalid credentials' shown as wrong password. Now verify(ident) = get_user_or_none(username) OR by_email(ident). Verified: login by username (200) and by email (200) both work with the new password. Tests: m0/setup/e2e all pass. --- backend/app/auth/users.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/backend/app/auth/users.py b/backend/app/auth/users.py index 9795836..0797460 100644 --- a/backend/app/auth/users.py +++ b/backend/app/auth/users.py @@ -146,8 +146,10 @@ class UserStore: return self.users.update(self._norm(username), must_setup=False) # ── auth ─────────────────────────────────────────────────────────── - def verify(self, username: str, password: str) -> dict[str, Any]: - user = self.get_user_or_none(username) + def verify(self, ident: str, password: str) -> dict[str, Any]: + # Resolve by EITHER username OR email (the login form doesn't distinguish, + # and users naturally type their email after setup). Fall back to username. + user = self.get_user_or_none(ident) or self.by_email(ident) if not user or not user.get("active", True): raise AuthError("invalid credentials") if not check_password_hash(user["password_hash"], password):