Address review feedback and fix auth E2E fixtures

Set active org after invitation accept, clear delayed redirects on
unmount, and surface sign-out errors. Reject duplicate sign-up in the
same org with the expected Better Auth code. Align E2E helpers with the
servicestart tenant and stabilize signup tests.

Author: jlouisugbo

components/auth/AcceptInvitationActions.tsx

@@ -55,6 +55,17 @@ export function AcceptInvitationButton({
         setMessage({ kind: "error", text: AuthMessage.AcceptFailed });
         return;
       }
+      const { organizationId } = (await res.json()) as {
+        organizationId: string;
+      };
+      const { error: activeOrgError } =
+        await authClient.organization.setActive({
+          organizationId,
+        });
+      if (activeOrgError) {
+        setMessage({ kind: "error", text: AuthMessage.AcceptFailed });
+        return;
+      }
     } catch {
       setMessage({ kind: "error", text: AuthMessage.AcceptFailed });
       return;
@@ -75,21 +86,30 @@ export function AcceptInvitationButton({
 /** Signs out so the invitee can open the link again with their account. */
 export function SignOutButton() {
   const router = useRouter();
-  const [pending, setPending] = useState(false);
+  const [message, setMessage] = useState<FormMessage>();
+  const pending = message?.kind === "loading";
 
   const signOut = async () => {
-    setPending(true);
+    setMessage({ kind: "loading", text: AuthMessage.Loading });
     try {
-      await authClient.signOut();
+      const { error } = await authClient.signOut();
+      if (error) {
+        setMessage({ kind: "error", text: AuthMessage.SignOutFailed });
+        return;
+      }
       router.refresh();
-    } finally {
-      setPending(false);
+      setMessage(undefined);
+    } catch {
+      setMessage({ kind: "error", text: AuthMessage.SignOutFailed });
     }
   };
 
   return (
-    <AuthSubmitButton type="button" pending={pending} onClick={signOut}>
-      Sign out
-    </AuthSubmitButton>
+    <div className="flex flex-col gap-6">
+      <AuthFormMessage message={message} />
+      <AuthSubmitButton type="button" pending={pending} onClick={signOut}>
+        Sign out
+      </AuthSubmitButton>
+    </div>
   );
 }

components/auth/ResetPasswordForm.tsx

@@ -1,7 +1,6 @@
 "use client";
 
 import { useState, type FormEvent } from "react";
-import { useRouter } from "next/navigation";
 import AuthLayout from "@/components/auth/AuthLayout";
 import AuthPasswordField from "@/components/auth/AuthPasswordField";
 import { focusFirstInvalidField } from "@/components/auth/AuthTextField";
@@ -15,6 +14,7 @@ import {
   SUCCESS_REDIRECT_DELAY_MS,
 } from "@/components/auth/authConstants";
 import authClient from "@/lib/authClient";
+import { useDelayedRedirect } from "@/lib/hooks/useDelayedRedirect";
 import {
   PASSWORD_POLICY_HINT,
   hasErrors,
@@ -27,7 +27,7 @@ const INVALID_TOKEN_CODE = "INVALID_TOKEN";
 
 /** The reset form for the `token` from the emailed link; null when missing. */
 export default function ResetPasswordForm({ token }: { token: string | null }) {
-  const router = useRouter();
+  const scheduleRedirect = useDelayedRedirect();
   const [expired, setExpired] = useState(false);
   const [password, setPassword] = useState("");
   const [confirmPassword, setConfirmPassword] = useState("");
@@ -69,7 +69,7 @@ export default function ResetPasswordForm({ token }: { token: string | null }) {
     }
 
     setMessage({ kind: "success", text: AuthMessage.PasswordReset });
-    setTimeout(() => router.push("/login"), SUCCESS_REDIRECT_DELAY_MS);
+    scheduleRedirect("/login", SUCCESS_REDIRECT_DELAY_MS);
   };
 
   if (token === null || expired) {

components/auth/SignupForm.tsx

@@ -2,7 +2,6 @@
 
 import Link from "next/link";
 import { useState, type FormEvent } from "react";
-import { useRouter } from "next/navigation";
 import AuthTextField, {
   focusFirstInvalidField,
 } from "@/components/auth/AuthTextField";
@@ -25,6 +24,7 @@ import {
 } from "@/lib/authValidation";
 import { getSlugFromHost, INVITATION_ID_HEADER } from "@/lib/clientAuthUtils";
 import { useActiveOrganization } from "@/lib/hooks/useActiveOrganization";
+import { useDelayedRedirect } from "@/lib/hooks/useDelayedRedirect";
 
 /** BetterAuth's code for an email that already has an account in this org. */
 const ACCOUNT_EXISTS_CODE = "USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL";
@@ -48,7 +48,7 @@ export default function SignupForm({
   invitation,
   loginHref = "/login",
 }: SignupFormProps) {
-  const router = useRouter();
+  const scheduleRedirect = useDelayedRedirect();
   const org = useActiveOrganization();
   const [firstName, setFirstName] = useState("");
   const [lastName, setLastName] = useState("");
@@ -116,7 +116,7 @@ export default function SignupForm({
     }
 
     setMessage({ kind: "success", text: AuthMessage.AccountCreated });
-    setTimeout(() => router.push("/"), SUCCESS_REDIRECT_DELAY_MS);
+    scheduleRedirect("/", SUCCESS_REDIRECT_DELAY_MS);
   };
 
   return (

components/auth/authConstants.ts

@@ -11,6 +11,7 @@ export const AuthMessage = {
   PasswordReset: "Password reset. Taking you to log in…",
   ResetFailed: "Couldn't reset your password. Try again.",
   AcceptFailed: "Couldn't accept the invitation. Try again.",
+  SignOutFailed: "Couldn't sign out. Try again.",
 } as const;
 
 /** Long enough to read a success message before the page moves on. */

lib/authUtils.ts

@@ -17,6 +17,7 @@ import {
 } from "@/lib/services/InvitationService";
 import { UserService } from "@/lib/services/UserService";
 import { User } from "better-auth";
+import { APIError } from "better-auth/api";
 import db from "@/lib/db";
 import { users } from "@/lib/schema";
 import { getSlugFromHost, INVITATION_ID_HEADER } from "./clientAuthUtils";
@@ -314,20 +315,20 @@ export function createUserOverride(ctx: CreateUserCtx) {
       email,
       organizationId,
     );
-    let id: string;
-    if (!existingUser) {
-      // Create new user
-      id = crypto.randomUUID();
-      await db.insert(users).values({
-        name: name || "",
-        email,
-        organizationId,
-        ...rest,
-        id,
+    if (existingUser) {
+      throw new APIError("BAD_REQUEST", {
+        message: "User already exists. Use another email.",
+        code: "USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL",
       });
-    } else {
-      id = existingUser.id;
     }
+    const id = crypto.randomUUID();
+    await db.insert(users).values({
+      name: name || "",
+      email,
+      organizationId,
+      ...rest,
+      id,
+    });
     return await UserService.findById(id);
   };
 }

lib/hooks/useDelayedRedirect.ts

@@ -0,0 +1,27 @@
+"use client";
+
+import { useCallback, useEffect, useRef } from "react";
+import { useRouter } from "next/navigation";
+
+/** Schedules `router.push` after a delay; clears pending navigation on unmount. */
+export function useDelayedRedirect() {
+  const router = useRouter();
+  const timeoutRef = useRef<ReturnType<typeof setTimeout> | undefined>(
+    undefined,
+  );
+
+  useEffect(() => {
+    return () => {
+      if (timeoutRef.current !== undefined) {
+        clearTimeout(timeoutRef.current);
+      }
+    };
+  }, []);
+
+  return useCallback((path: string, delayMs: number) => {
+    if (timeoutRef.current !== undefined) {
+      clearTimeout(timeoutRef.current);
+    }
+    timeoutRef.current = setTimeout(() => router.push(path), delayMs);
+  }, [router]);
+}

tests/e2e/authPages.spec.ts

@@ -1,4 +1,4 @@
-import { expect, test } from "@playwright/test";
+import { expect, test, type Page } from "@playwright/test";
 import { and, eq, like } from "drizzle-orm";
 import db from "@/lib/db";
 import { verifications } from "@/lib/schema";
@@ -13,7 +13,22 @@ test.describe("Auth pages", () => {
     await ensureServicestartOrganization();
   });
 
-  test.describe("signup", () => {
+  test.describe.serial("signup", () => {
+    test.beforeEach(async ({ page }) => {
+      await page.context().clearCookies();
+    });
+
+    async function fillPasswordFields(page: Page, password: string) {
+      const passwordField = page.getByLabel("Password", { exact: true });
+      const confirmField = page.getByLabel("Confirm Password", {
+        exact: true,
+      });
+      await passwordField.fill(password);
+      await confirmField.fill(password);
+      await expect(passwordField).toHaveValue(password);
+      await expect(confirmField).toHaveValue(password);
+    }
+
     test("shows inline errors instead of submitting an invalid form", async ({
       page,
     }) => {
@@ -54,16 +69,13 @@ test.describe("Auth pages", () => {
       page,
     }) => {
       const user = buildTestUser();
-      await signUpAndGetSession(user);
+      await signUpAndGetSession(user, "servicestart");
       await page.goto("/signup");
 
       await page.getByLabel("First Name").fill("Existing");
       await page.getByLabel("Last Name").fill("User");
       await page.getByLabel("Email").fill(user.email);
-      await page.getByLabel("Password", { exact: true }).fill(user.password);
-      await page
-        .getByLabel("Confirm Password", { exact: true })
-        .fill(user.password);
+      await fillPasswordFields(page, user.password);
       await page.getByRole("button", { name: "Create Account" }).click();
 
       const message = page.getByTestId("form-message");
@@ -79,10 +91,7 @@ test.describe("Auth pages", () => {
       await page.getByLabel("First Name").fill("New");
       await page.getByLabel("Last Name").fill("Volunteer");
       await page.getByLabel("Email").fill(user.email);
-      await page.getByLabel("Password", { exact: true }).fill(user.password);
-      await page
-        .getByLabel("Confirm Password", { exact: true })
-        .fill(user.password);
+      await fillPasswordFields(page, user.password);
       await page.getByRole("button", { name: "Create Account" }).click();
 
       await expect(page.getByText(AuthMessage.AccountCreated)).toBeVisible();
@@ -96,7 +105,7 @@ test.describe("Auth pages", () => {
   test.describe("login", () => {
     test("says when the password is wrong", async ({ page }) => {
       const user = buildTestUser();
-      await signUpAndGetSession(user);
+      await signUpAndGetSession(user, "servicestart");
       await page.goto("/login");
 
       await page.getByLabel("Email").fill(user.email);
@@ -135,7 +144,7 @@ test.describe("Auth pages", () => {
 
   test("forgot password sends a reset email", async ({ page }) => {
     const user = buildTestUser();
-    const { user: created } = await signUpAndGetSession(user);
+    const { user: created } = await signUpAndGetSession(user, "servicestart");
     await page.goto("/forgotpassword");
 
     await page.getByLabel("Email").fill(user.email);

tests/unit/testUtils.ts

@@ -104,8 +104,9 @@ export async function createOrganization(slug: string) {
  */
 export async function signUpAndGetHeaders(
   user: ReturnType<typeof buildTestUser>,
+  organizationSlug?: string,
 ) {
-  const slug = await getOrgSlug();
+  const slug = organizationSlug ?? (await getOrgSlug());
   const res = await auth.api.signUpEmail({
     body: {
       ...user,
@@ -126,8 +127,9 @@ export async function signUpAndGetHeaders(
  */
 export async function signUpAndGetSession(
   user: ReturnType<typeof buildTestUser>,
+  organizationSlug?: string,
 ) {
-  const slug = await getOrgSlug();
+  const slug = organizationSlug ?? (await getOrgSlug());
   const res = await auth.api.signUpEmail({
     body: {
       ...user,