fix(auth): make SSO failures recoverable on the login flow

[posthog]

Problem

• Users who hit an SSO failure land on /auth/error, cannot self-serve past it, and loop through the login screen. /auth/error is reached on every one of the last 60 days across dev, qa, openframe.miami, and production openframe.ai (low volume, ~1–10 sessions/day), and 30 days of $rageclick data shows dead-control frustration on /auth/signup, /auth/login, invite pages, "Continue with Google", and "Create Account".
• The frontend turns one backend failure into a five-attempt dead end in three specific places, plus a dead signup button:

Symptom	Cause
Error page shows a raw code ([authorization_request_not_found], full AADSTS700016… text)	error/page.tsx renders searchParams.get('error') verbatim; the error-code map is never consulted
"Go to Login" drops the user on the Sign Up tab	the button pushes the raw path /auth, not the login form
A silent SSO bounce back to /auth/login shows nothing	login-form-section.tsx has no channel to read a callback failure
"Create Account" is a dead button while the domain check runs	submit is silently disabled during the debounced checking state

The root authentication failure is on the OpenFrame gateway, not in this repo. This change improves error clarity, return navigation, and button honesty; it does not fix the OAuth callback itself.

Changes

• Resolve errors to human copy. New resolveAuthError in auth-error-codes.ts maps the cases seen in the recordings — authorization_request_not_found, invalid_token_response, session expired, and the AADSTS family — to plain copy. Matching is substring-based, so a bracket-wrapped code or the full provider text both resolve. The raw string stays as a small diagnostic detail below the message.
• Fix return navigation. The error page "Go to Login" button now targets routes.auth.login instead of the raw /auth string (also clears a route-registry violation).
• Surface a failed callback. The login screen reads ?error= and shows the resolved message in an Alert above the form, so a silent bounce is no longer silent.
• Make signup submit honest. "Create Account" stays enabled while the availability check runs; clicking mid-check shows a "still checking" toast instead of doing nothing. The button only disables when the form is genuinely invalid.

Testing

• npm run type-check — clean
• npm run lint:biome (changed files) — clean
• npm run build — compiles; /auth/error and /auth/login build as expected

---

Created with PostHog Desktop from this inbox report.