@micha.bigler/ui-core-micha 3.5.0 → 3.6.0

package/CHANGELOG.md

@@ -2,6 +2,33 @@
 
 Only notable, user-facing changes. Not every version — see `WORK_ORDERS.md` for the full history.
 
+## 3.6.0 — AUTH-8
+
+**Behavior change, not purely additive — re-check error displays after adopting this version.**
+`extractErrorInfo` (`src/utils/auth-errors.js`) previously returned the hardcoded, untranslated
+literal `'GENERIC'` as the `.code` for ANY backend error shaped `{"detail": "..."}` — Django's
+generic error format, produced by DRF's `Throttled`/`Http404`/`PermissionDenied` and any unhandled
+`APIException`. This unconditionally overrode every caller's own, properly translated
+`defaultCode` (all 39 call sites in this repo already pass one). Fixed: the `{detail}` fallback now
+returns `code: null`, so `normaliseApiError`'s existing `info.code || defaultCode` correctly falls
+back to the caller's default instead. `.message` still carries the raw `detail` text unchanged.
+
+Also closes 7 translation gaps found while auditing every `defaultCode` in use (`Auth.RECOVERY_LOGIN_FAILED`,
+`Auth.USER_LIST_FAILED`, `Auth.USER_DELETE_FAILED`, `Auth.USER_ROLE_UPDATE_FAILED`,
+`Auth.USER_SUPPORT_UPDATE_FAILED`, `Auth.PASSKEY_CANCELLED`, `Auth.MFA_CHALLENGE_FAILED`) — these
+existed as fallback codes in the source but had no translation entry in any of the 4 shipped
+locales, so they would have rendered as a raw, untranslated key even with the code-precedence fix
+above. All 39 in-use `defaultCode` values are now confirmed translated in `de`/`en`/`fr`/`sw`.
+
+## 3.5.1 — AUTH-7
+
+`loginWithPassword`'s "already authenticated" (409) retry — the re-fetch of the current user when
+allauth reports a still-valid session — no longer lets a second failure (e.g. the account's own
+request quota being exhausted elsewhere) escape as a raw, unnormalised error. It now goes through
+the same `normaliseApiError` path every other login failure already uses, so the caller (any app's
+`LoginPage`) gets a `.code` it can translate instead of a bare exception. The success path (409 +
+successful retry) is byte-identical; no prop/behavior contract changed for any existing caller.
+
 ## 3.5.0 — MSG-19
 
 `DirectMessageLauncher`'s recipient picker is now a searchable MUI `Autocomplete` instead of a

package/WORK_ORDERS.md

@@ -27,6 +27,8 @@ prefixed ID; never reuse a bare flat number across workstreams.
 
 | ID | Titel | Beschreibung | Datum | Status | Commit(s) | Notiz |
 |---|---|---|---|---|---|---|
+| AUTH-7 | `loginWithPassword`s 409-Retry gegen Zweitfehlschlag haerten | allauth-headless antwortet mit 409 ("already authenticated"), wenn die Session bereits gueltig ist; `loginWithPassword` ruft dann `fetchCurrentUser()` erneut auf. Schlaegt dieser Retry ebenfalls fehl, wurde der Fehler bisher roh durchgereicht statt normalisiert. Spec [`work-orders/AUTH-7.md`](work-orders/AUTH-7.md) | 2026-09-05 | done | ae7aa89 | **Tier 3** (Shared-Core). Ausgeloest durch `kira`: ein erschoepfter globaler Throttle-Bucket (siehe `kira/KIRA-TRACK-3`) liess den 409-Retry selbst mit 429 fehlschlagen, roh statt normalisiert durchgereicht. Rein additiver Bugfix, kein Prop-/Verhaltensvertrag geaendert. **Implementiert (Codex gpt-5.6-luna):** genau wie geplant, `src/auth/authApi.jsx` + neue `tests/authApiLogin.test.js`. review: codex/gpt-5.6-luna (`reviewer` 4 Lenses + `ui_reviewer` + `sec_reviewer`, ein Hintergrund-Batch) 3 raised · 1 accepted · 2 rejected · worst accepted: defect (aber ausserhalb des Scopes dieser WO, siehe unten) — `envelope`/`regression`/`duplication`/`sec_reviewer`: 0 raised. `tests`-Lens: 2 raised, BEIDE empirisch widerlegt (Fix testweise zurueckgerollt, betroffener Test schlug korrekt fehl — sind keine echten Luecken) → rejected. `ui_reviewer`: 1 raised, akzeptiert als real (empirisch bestaetigt: `normaliseApiError('...', 'Auth.LOGIN_FAILED')` liefert bei einem DRF-`{"detail": "..."}`-Fehler `code: 'GENERIC'` statt des übergebenen Default-Codes, weil `extractErrorInfo` in `src/utils/auth-errors.js` `'GENERIC'` bereits als gesetzten Wert zurückgibt, der `info.code || defaultCode` gewinnt) — **PRE-EXISTING in einer anderen Datei, nicht durch diesen Diff verursacht, an JEDER anderen Call-Site derselben Funktion bereits vorhanden** → out-of-scope fuer AUTH-7, nicht hier gefixt, nachverfolgt als `AUTH-8`. Tests: `npx vitest run tests/authApiLogin.test.js tests/AuthContext.test.jsx tests/authApiRegistration.test.js` 7/7 gruen. **PATCH-Bump 3.5.0 -> 3.5.1** (`package.json` + `CHANGELOG.md`), kein Consumer-Pin-Bump noetig (rein additiv). |
+| AUTH-8 | `extractErrorInfo`s `GENERIC`-Code ueberschreibt jeden `defaultCode` | Bei jedem DRF-Fehler mit `{"detail": "..."}`-Form (u.a. Django `Throttled`/`Http404`/`PermissionDenied` — genau die Form, die den urspruenglichen 429 aus `kira` ausloeste) liefert `extractErrorInfo` (`src/utils/auth-errors.js`) `code: 'GENERIC'`; `normaliseApiError`s `info.code \|\| defaultCode` waehlt dann IMMER `'GENERIC'`, nie den vom Aufrufer uebergebenen `defaultCode` (z. B. `'Auth.LOGIN_FAILED'`). `'GENERIC'` ist an keiner Stelle als i18n-Key registriert — die UI zeigt vermutlich den rohen String statt einer Uebersetzung. **Betrifft JEDE bestehende `normaliseApiError(...)`-Call-Site in diesem Repo**, nicht nur `loginWithPassword`. Spec [`work-orders/AUTH-8.md`](work-orders/AUTH-8.md) | 2026-09-05 | done | d3af6ac | Gefunden von `ui_reviewer` waehrend `AUTH-7`s Review, empirisch bestaetigt (`node --input-type=module -e "..."` gegen die echte Funktion). Operator-Entscheidung 2026-09-05: zuerst angehen. **Implementiert (Codex gpt-5.6-luna):** `code: 'GENERIC'` -> `code: null` im `data.detail`-Zweig, die anderen zwei Zweige unveraendert; neue `tests/authErrors.test.js` (4 Tests). review: codex/gpt-5.6-luna (`reviewer` 4 Lenses + `ui_reviewer` + `sec_reviewer`, ein Hintergrund-Batch) 1 raised · 1 accepted · worst accepted: defect — `envelope`/`regression`/`duplication`/`tests`/`sec_reviewer`: 0 raised (regression bestaetigte zusaetzlich per Grep: keine bestehende Test-Assertion haengt am alten `'GENERIC'`-Wert). `ui_reviewer` fand einen ECHTEN, empirisch bestaetigten Zusatzbefund: 7 von 39 im Code verwendeten `defaultCode`-Schluesseln (`Auth.RECOVERY_LOGIN_FAILED`, `Auth.USER_LIST_FAILED`, `Auth.USER_DELETE_FAILED`, `Auth.USER_ROLE_UPDATE_FAILED`, `Auth.USER_SUPPORT_UPDATE_FAILED`, `Auth.PASSKEY_CANCELLED`, `Auth.MFA_CHALLENGE_FAILED`) waren in KEINER der 4 Sprachen registriert — waeren also auch nach dem Code-Precedence-Fix weiterhin roh statt uebersetzt angezeigt worden. Auf Operator-Wunsch ("zuerst das angehen... stoert mich schon lange, auch dass die Meldungen nicht sauber uebersetzt sind") direkt mitgefixt: alle 7 Keys in `src/i18n/authTranslations.ts` ergaenzt (de/fr/en/sw), Stil an bestehende Nachbar-Keys angelehnt. Erneuter Scan aller 39 Aufrufstellen gegen die Uebersetzungsdatei: 0 fehlend. Tests: `npx vitest run tests/authErrors.test.js tests/authErrorCodeRendering.test.jsx tests/authApiLogin.test.js tests/authApiRegistration.test.js tests/authTranslations.test.js tests/i18nAggregate.test.js` 29/29 gruen. **MINOR-Bump 3.5.1 -> 3.6.0** (nicht PATCH) — aendert beobachtbares Verhalten fuer jeden `{detail}`-foermigen Fehler, keine rein additive Aenderung; Changelog warnt Konsumenten explizit, ihre Fehleranzeige nach dem Pin-Bump gegenzupruefen. |
 | MSG-19 | `DirectMessageLauncher` recipient picker: searchable Autocomplete replaces the flat List | Operator request: the new-DM recipient picker had no search, the same friction the fleet's own "Einfache Bedienung schlägt Vollständigkeit" rule already names ("a picker without search stops working long before the list feels long"). The `List`/`ListItemButton` picker is replaced with an MUI `Autocomplete` bound to the same `selectedId`/`selectedCandidate` state; the component's public prop contract (`candidates`, `scope`, `onOpen`) and its `start()`/scope-resolution logic are unchanged — only the picker's own rendering and selection mechanism changed. | 2026-09-05 | done | 7d99d82 | No WO file — operator-requested, fixed directly. Tier 3 (shared-core, `ui-core-micha`). Only current consumer of this component: jg-ferien (confirmed via a fleet-wide grep for `DirectMessageLauncher`), and jg-ferien's own tests fully mock it, so this change has zero blast radius there until jg-ferien separately bumps its `@micha.bigler/ui-core-micha` pin. Implemented directly in Claude (no Codex dispatch — pure component-level UI change). **review: claude/sonnet · 0 raised** (verified null-safety of `isOptionEqualToValue`/`getOptionLabel` against MUI's own `useAutocomplete` source, confirmed the rewritten test file preserves every one of the original 7 cases plus one new filtering case, confirmed i18n completeness) + **ui_reviewer: claude/sonnet · 4 raised · 4 accepted · worst accepted: defect** — (U1: the new "typed query matches nothing" state had no `noOptionsText` and would have shown MUI's hardcoded, untranslated English default — added `MessagingDirect.NO_MATCHES` in all 4 languages plus a test; U2: the Autocomplete was missing `fullWidth`, breaking from this repo's own one other Autocomplete-in-Dialog convention (`SupportRecoveryRequestsTab.jsx`) and regressing from the old List's full-width block layout — added; U3: reused `MessagingDirect.CANDIDATES`'s old plural-noun wording ("Recipients") as a visible single-select field label read awkwardly — reworded to an instruction-style label ("Select recipient") matching the sibling component's own convention, in all 4 languages; U4 (inferred, not rendered/verified): `autoFocus` on the TextField combined with the dialog's `fullScreen` mobile breakpoint could open the virtual keyboard unprompted — removed `autoFocus` entirely, since MUI's own `Dialog` already focuses the first focusable descendant on open by design, making it redundant). Two additional self-found nits fixed post-review: a defensive null-guard added to `candidateLabel` (matching the sibling `getUserOptionLabel` convention, even though confirmed unreachable under MUI's current calling contract) and a one-line update to `docs/messaging-deviations.md` item 18 (stale reference to "displays... candidate list" not mentioning the new search). Tests: `messagingDirectMessageLauncher.test.jsx` rewritten (9/9 green, up from 7 — the rewrite required discovering and documenting a real jsdom/RTL gotcha: MUI's `Autocomplete` only reacts to a typed value once the input is genuinely `.focus()`-ed, not merely `mouseDown`-ed) + `i18nAggregate.test.js` (4/4) both green; `tsc -p tsconfig.build.json` clean. Version bumped 3.4.0 → 3.5.0 (minor — additive UI capability, no prop-contract change) via the repo's `publish.yml` (push-to-`main` + version bump). jg-ferien bumps its pin separately, in its own repo, once this lands on npm. |
 | AUTH-6 | `QrSignupManager` additive `registrationContext`/`defaultMaxRedemptions` props | jg-ferien's `JG-MEM-1` (department QR-join) needs a per-department signup context and a high, poster-scale redemption default — `QrSignupManager` only exposed `enabled`/`expiryDays`. Two new optional props added, both defaulting to today's exact behaviour: `registrationContext` (merged into the generated token's `registration_context`) and `defaultMaxRedemptions` (overrides the low internal default). | 2026-08-28 | done | 1749c09 | No WO file — operator-requested, fixed directly, same convention as AUTH-3. Tier 3 (shared-core). Implemented by `codex exec` (jg-ferien's JG-MEM-1 dispatch touched this repo additively per that WO's own allowance), left uncommitted for the Orchestrator's own review before landing here. **review: claude/sonnet · 2 raised · 2 accepted · worst accepted: defect** — (R1: the new context-change effect also calls `setMaxRedemptions`, and with `maxRedemptions` in that same effect's dependency array, a context change after the admin had typed a custom redemption count fired a second, redundant `createSignupQr` call — fixed by reading the current value through a ref instead of a reactive dependency, so `setMaxRedemptions` no longer re-triggers the effect that just set it; R2: the one new test only covered the happy path on a fresh mount, with no test proving the existing `AccountPage` call (`enabled`/`expiryDays` only) stays byte-for-byte unaffected, and no test that would have caught R1 — two regression tests added: a bare old-prop-shape call asserting the exact legacy payload + single call, and a context-change-after-custom-redemptions call asserting exactly one `createSignupQr` invocation). Confirmed backward compatible against the one existing consumer, `AccountPage.jsx:369-372` (unaffected — it never passes the new props). Tests: `QrSignupManager.registrationContext.test.jsx` (3/3, incl. the two new regression cases) + `AccountPage.test.jsx` (4/4) + `SignUpPage.test.jsx` (10/10) all green — 17/17 total across the three files touching this component. No `ui_reviewer`/`sec_reviewer` (pure prop/effect-timing change, no visual surface, no auth-enforcement logic — the actual token validation stays entirely server-side in `django-core-micha`, already reviewed under `JG-MEM-1`). **Rebased onto a concurrent session's `UCM-CHART-17`/`-18` pushes (3.3.0/3.3.1 already published) — republished as 3.4.0 instead of the originally-committed 3.3.0** (minor — new capability, not a fix), via the repo's `publish.yml` (push-to-`main` + version bump). jg-ferien bumps its pin separately once this lands on npm. |
 | UCM-CHART-18 | The PNG export shows what the chart says, not what the user can click | Two defects, one file, a few lines apart -- both raised by `HRAM-CHT-7`'s independent `ui_reviewer` (2026-08-25) and confirmed, partly by reading and partly live. **(1) Interactive controls are in the image.** Since 3.3.0 the PNG rasterises `ChartFrame`'s whole `chartRef` box, and `chartRef` wraps `children` only -- not `toolbar`, `controls` or `meta` -- so anything a panel renders as children is now in the file: hram's `StructuralReachabilityPanel:468` footer `IconButton` (always visible, so **every** PNG of that panel carries a button), `AllocationPerformancePanel:536,548` and `OptimizationResultsPanel:1120,1141`. **(2) `transform` is not inlined** -- neither property list (`:32-36`, `:44-52`) has it, so `OptimizationResultsPanel:1107`'s rotated legend swatch exports as a **square instead of a diamond**. **Fixed here rather than in the app for two reasons:** it is a property of the element kind, not of each panel -- an exported image should show what the chart communicates, not what can be clicked -- and the alternative (moving controls into `ChartFrame`'s `controls`/`toolbar` slots) would **undo a deliberate design decision**, since `HRAM-RES-30` put that info affordance in the footer beside the caveat line. After this, hram needs **only a pin bump**. Full order [`work-orders/UCM-CHART-18.md`](work-orders/UCM-CHART-18.md) | 2026-08-25 | done | `5f34a2b` | **Tier 3** -- shared-core. `ui_reviewer` (what belongs in an exported image, and the MUI-legend counter-check) + `reviewer` (the ordering trap, the `transform` double-apply question); no `sec_reviewer`. **THE single most likely way to get this wrong:** `inlineComputedStyles` walks source and clone **in lockstep by index** (`:70-77`), so removing controls from the clone **before** it shifts every subsequent index and elements silently receive their neighbours' styles -- an export that looks plausible and is wrong everywhere after the first removal. Removal happens **after** the style walk, and the code comment must say so. **Counter-check that is not optional:** what disappears must be operation, not content -- a consumer whose legend items are `<button>`s (MUI's own legend can be interactive) would lose its legend, and the affected hram panels all pass `hideLegend` so they are **not** the test case; verify against a chart that keeps MUI's own legend, and if it vanishes that changes the approach. Also: `transform` may **double-apply** on SVG nodes that carry it as a presentation attribute the clone already keeps -- check `xLabels="angled"` before assuming it is inert. **Release: patch -> 3.3.1** -- this repairs behaviour 3.3.0 itself introduced rather than adding capability, the same reasoning `UCM-CHART-16` went out on, while `-15`/`-17` were minors because they changed what a consumer gets on purpose. Gate is **opening the files**, as for `UCM-CHART-17`: both defects were invisible to every test and visible immediately in an exported image. **Implementation:** `.claude/models.local.json` has no local override (defaults apply) -- `implementation.runtime` is `claude`/`sonnet`, implemented directly, no Codex dispatch. The lockstep-index ordering was respected from the start (`inlineComputedStyles` before `stripInteractiveControls`), `transform`/`transform-origin` added to the shared property list. **Verification (real Chrome, via the dev harness's module graph, no probe entry ever committed):** all four WO cases confirmed with hard evidence, not visual impression -- (1) a control in `children` (`IconButton` beside static text): captured the PNG path's actual intermediate SVG, confirmed no `<button` tag/text while the sibling and chart survive. (2) MUI's own legend (non-interactive, two series): fully intact, both labels present. (3) a rotated swatch: pixel-sampled the real rasterised PNG on a real `<canvas>` -- bounding-box corner reads background white, centre reads the swatch's own colour, i.e. a genuine diamond. (4) `xLabels="angled"`: the exported tick carries both the original `transform` XML attribute (kept by `cloneNode`) and the newly-inlined computed matrix; the matrix values mathematically match a SINGLE -45° rotation (`cos(-45°)=0.707107`), not a doubled one -- confirmed the inline `style` declaration wins over the presentation attribute rather than composing with it. 89 affected chart tests green (14 in `exportChart.test.js`), `tsc` clean. **Review: codex/gpt-5.6-luna (`reviewer` + `ui_reviewer`, concurrent) · 5 raised · 3 accepted · worst accepted: high (interactive-legend content loss)** (id not divisible by 5, no rotation configured). **Both reviewers independently converged on the SAME defect**, exactly the risk the WO's own Envelope named and required a live counter-check for: the initial fix REMOVED (not unwrapped) MUI's own interactive legend items (`onItemClick`/`toggleVisibilityOnClick` renders each item as `<button role="button" class="...MuiChartsLegend-series...">`), deleting the swatch+label along with the click handler -- the WO's own words, "if it vanishes, that is a finding that changes the approach, not a detail to paper over." FIXED: `MuiChartsLegend-series` matches are now UNWRAPPED (replaced with a plain `<span>` carrying the same class/style/children) instead of removed; re-verified live against an ACTUAL interactive legend (`slotProps={{legend:{toggleVisibilityOnClick:true}}}`, confirmed the live items render as real `<BUTTON>` tags) -- export contains zero `<button` tags, `MuiChartsLegend-series` and both series labels survive intact. `reviewer` additionally found: the interactive-control selector missed `a[href]`/`[role="link"]` (accepted, added -- also corrects the CHANGELOG's own "drill-down links" claim, which wasn't true until this fix); and the original ordering test's button was the LAST descendant, so a wrong call order wouldn't have shifted any node the test actually asserted on -- content-presence checks can't observe a style misattribution, only a wrong STYLE VALUE can (accepted, rewrote with a distinctively-styled trailing sibling, confirmed by temporarily reverting the call order that the new assertion genuinely fails). Two findings rejected as decoration/informational only (transform double-apply already reasoned through correctly by both reviewers; a jsdom-literal vs. browser-matrix distinction in the unit test, already covered by the separate real-browser verification track). |

package/dist/auth/authApi.js

@@ -107,8 +107,13 @@ export async function loginWithPassword(email, password) {
         }
         // 409 = Already logged in
         if (status === 409) {
-            const user = await fetchCurrentUser();
-            return { user, needsMfa: false };
+            try {
+                const user = await fetchCurrentUser();
+                return { user, needsMfa: false };
+            }
+            catch (retryError) {
+                throw normaliseApiError(retryError, 'Auth.LOGIN_FAILED');
+            }
         }
         throw normaliseApiError(error, 'Auth.LOGIN_FAILED');
     }

package/dist/i18n/authTranslations.js

@@ -204,6 +204,12 @@ export const authTranslations = {
         "en": "Passkey authentication was cancelled.",
         "sw": "Uthibitishaji wa Passkey umeghairiwa."
     },
+    "Auth.PASSKEY_CANCELLED": {
+        "de": "Der Passkey-Vorgang wurde abgebrochen.",
+        "fr": "L'opération avec le passkey a été annulée.",
+        "en": "The passkey operation was cancelled.",
+        "sw": "Operesheni ya Passkey imeghairiwa."
+    },
     "Auth.PASSKEY_LIST_FAILED": {
         "de": "Die gespeicherten Passkeys konnten nicht geladen werden.",
         "fr": "Les passkeys enregistrés n'ont pas pu être chargés.",
@@ -228,6 +234,12 @@ export const authTranslations = {
         "en": "Two-factor authentication failed.",
         "sw": "Uthibitishaji wa hatua mbili umeshindwa."
     },
+    "Auth.MFA_CHALLENGE_FAILED": {
+        "de": "Die Zwei-Faktor-Challenge konnte nicht angefordert werden.",
+        "fr": "Le défi d'authentification à deux facteurs n'a pas pu être demandé.",
+        "en": "The two-factor challenge could not be requested.",
+        "sw": "Changamoto ya uthibitishaji wa hatua mbili haikuweza kuombwa."
+    },
     "Auth.TOTP_REQUEST_FAILED": {
         "de": "Die TOTP-Einrichtung konnte nicht gestartet werden.",
         "fr": "La configuration TOTP n'a pas pu être démarrée.",
@@ -258,6 +270,12 @@ export const authTranslations = {
         "en": "Recovery codes could not be regenerated.",
         "sw": "Misimbo ya urejesho haikuweza kuundwa upya."
     },
+    "Auth.RECOVERY_LOGIN_FAILED": {
+        "de": "Die Anmeldung über den Wiederherstellungslink ist fehlgeschlagen.",
+        "fr": "La connexion via le lien de récupération a échoué.",
+        "en": "Recovery login failed.",
+        "sw": "Kuingia kwa njia ya urejeshaji kumeshindwa."
+    },
     "Auth.PAGE_CHANGE_PASSWORD_SUBTITLE": {
         "de": "Geben Sie Ihr aktuelles und ein neues Passwort ein.",
         "fr": "Saisissez votre mot de passe actuel et un nouveau mot de passe.",
@@ -1794,6 +1812,30 @@ export const authTranslations = {
         "en": "An account already exists for this email address. Please log in.",
         "sw": "Akaunti tayari ipo kwa anwani hii ya barua pepe. Tafadhali ingia."
     },
+    "Auth.USER_LIST_FAILED": {
+        "de": "Die Benutzerliste konnte nicht geladen werden.",
+        "fr": "La liste des utilisateurs n'a pas pu être chargée.",
+        "en": "The user list could not be loaded.",
+        "sw": "Orodha ya watumiaji haikuweza kupakiwa."
+    },
+    "Auth.USER_DELETE_FAILED": {
+        "de": "Der Benutzer konnte nicht gelöscht werden.",
+        "fr": "L'utilisateur n'a pas pu être supprimé.",
+        "en": "The user could not be deleted.",
+        "sw": "Mtumiaji hakuweza kufutwa."
+    },
+    "Auth.USER_ROLE_UPDATE_FAILED": {
+        "de": "Die Rolle des Benutzers konnte nicht aktualisiert werden.",
+        "fr": "Le rôle de l'utilisateur n'a pas pu être mis à jour.",
+        "en": "The user's role could not be updated.",
+        "sw": "Jukumu la mtumiaji halikuweza kusasishwa."
+    },
+    "Auth.USER_SUPPORT_UPDATE_FAILED": {
+        "de": "Der Support-Status des Benutzers konnte nicht aktualisiert werden.",
+        "fr": "Le statut de support de l'utilisateur n'a pas pu être mis à jour.",
+        "en": "The user's support status could not be updated.",
+        "sw": "Hali ya usaidizi ya mtumiaji haikuweza kusasishwa."
+    },
     "Auth.SIGNUP_QR_MAX_REDEMPTIONS_LABEL": {
         "de": "Max. Verwendungen",
         "fr": "Utilisations max.",

package/dist/utils/auth-errors.js

@@ -17,7 +17,7 @@ export function extractErrorInfo(error) {
     }
     // Fallback for generic Django errors
     if (typeof data.detail === 'string') {
-        return { status, code: 'GENERIC', message: data.detail, raw: data };
+        return { status, code: null, message: data.detail, raw: data };
     }
     return { status, code: null, message: null, raw: data };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@micha.bigler/ui-core-micha",
-  "version": "3.5.0",
+  "version": "3.6.0",
   "main": "dist/index.js",
   "module": "dist/index.js",
   "sideEffects": [

package/src/auth/authApi.jsx

@@ -114,8 +114,12 @@ export async function loginWithPassword(email, password) {
     
     // 409 = Already logged in
     if (status === 409) {
-        const user = await fetchCurrentUser();
-        return { user, needsMfa: false };
+        try {
+          const user = await fetchCurrentUser();
+          return { user, needsMfa: false };
+        } catch (retryError) {
+          throw normaliseApiError(retryError, 'Auth.LOGIN_FAILED');
+        }
     }
 
     throw normaliseApiError(error, 'Auth.LOGIN_FAILED');

package/src/i18n/authTranslations.ts

@@ -231,6 +231,13 @@ export const authTranslations = {
     "sw": "Uthibitishaji wa Passkey umeghairiwa."
   },
 
+  "Auth.PASSKEY_CANCELLED": {
+    "de": "Der Passkey-Vorgang wurde abgebrochen.",
+    "fr": "L'opération avec le passkey a été annulée.",
+    "en": "The passkey operation was cancelled.",
+    "sw": "Operesheni ya Passkey imeghairiwa."
+  },
+
   "Auth.PASSKEY_LIST_FAILED": {
     "de": "Die gespeicherten Passkeys konnten nicht geladen werden.",
     "fr": "Les passkeys enregistrés n'ont pas pu être chargés.",
@@ -259,6 +266,13 @@ export const authTranslations = {
     "sw": "Uthibitishaji wa hatua mbili umeshindwa."
   },
 
+  "Auth.MFA_CHALLENGE_FAILED": {
+    "de": "Die Zwei-Faktor-Challenge konnte nicht angefordert werden.",
+    "fr": "Le défi d'authentification à deux facteurs n'a pas pu être demandé.",
+    "en": "The two-factor challenge could not be requested.",
+    "sw": "Changamoto ya uthibitishaji wa hatua mbili haikuweza kuombwa."
+  },
+
   "Auth.TOTP_REQUEST_FAILED": {
     "de": "Die TOTP-Einrichtung konnte nicht gestartet werden.",
     "fr": "La configuration TOTP n'a pas pu être démarrée.",
@@ -293,6 +307,13 @@ export const authTranslations = {
     "en": "Recovery codes could not be regenerated.",
     "sw": "Misimbo ya urejesho haikuweza kuundwa upya."
   },
+
+  "Auth.RECOVERY_LOGIN_FAILED": {
+    "de": "Die Anmeldung über den Wiederherstellungslink ist fehlgeschlagen.",
+    "fr": "La connexion via le lien de récupération a échoué.",
+    "en": "Recovery login failed.",
+    "sw": "Kuingia kwa njia ya urejeshaji kumeshindwa."
+  },
   "Auth.PAGE_CHANGE_PASSWORD_SUBTITLE": {
     "de": "Geben Sie Ihr aktuelles und ein neues Passwort ein.",
     "fr": "Saisissez votre mot de passe actuel et un nouveau mot de passe.",
@@ -1842,6 +1863,31 @@ export const authTranslations = {
     "en": "An account already exists for this email address. Please log in.",
     "sw": "Akaunti tayari ipo kwa anwani hii ya barua pepe. Tafadhali ingia."
   },
+
+  "Auth.USER_LIST_FAILED": {
+    "de": "Die Benutzerliste konnte nicht geladen werden.",
+    "fr": "La liste des utilisateurs n'a pas pu être chargée.",
+    "en": "The user list could not be loaded.",
+    "sw": "Orodha ya watumiaji haikuweza kupakiwa."
+  },
+  "Auth.USER_DELETE_FAILED": {
+    "de": "Der Benutzer konnte nicht gelöscht werden.",
+    "fr": "L'utilisateur n'a pas pu être supprimé.",
+    "en": "The user could not be deleted.",
+    "sw": "Mtumiaji hakuweza kufutwa."
+  },
+  "Auth.USER_ROLE_UPDATE_FAILED": {
+    "de": "Die Rolle des Benutzers konnte nicht aktualisiert werden.",
+    "fr": "Le rôle de l'utilisateur n'a pas pu être mis à jour.",
+    "en": "The user's role could not be updated.",
+    "sw": "Jukumu la mtumiaji halikuweza kusasishwa."
+  },
+  "Auth.USER_SUPPORT_UPDATE_FAILED": {
+    "de": "Der Support-Status des Benutzers konnte nicht aktualisiert werden.",
+    "fr": "Le statut de support de l'utilisateur n'a pas pu être mis à jour.",
+    "en": "The user's support status could not be updated.",
+    "sw": "Hali ya usaidizi ya mtumiaji haikuweza kusasishwa."
+  },
   "Auth.SIGNUP_QR_MAX_REDEMPTIONS_LABEL": {
     "de": "Max. Verwendungen",
     "fr": "Utilisations max.",

package/src/utils/auth-errors.js

@@ -20,7 +20,7 @@ export function extractErrorInfo(error) {
   
   // Fallback for generic Django errors
   if (typeof data.detail === 'string') {
-    return { status, code: 'GENERIC', message: data.detail, raw: data };
+    return { status, code: null, message: data.detail, raw: data };
   }
 
   return { status, code: null, message: null, raw: data };
@@ -36,4 +36,4 @@ export function normaliseApiError(error, defaultCode = 'Auth.GENERIC_ERROR') {
   err.status = info.status;
   err.raw = info.raw;
   return err;
-}
+}

package/tests/authApiLogin.test.js

@@ -0,0 +1,42 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const client = vi.hoisted(() => ({
+  post: vi.fn(),
+  get: vi.fn(),
+}));
+
+vi.mock('../src/auth/apiClient', () => ({ default: client }));
+
+import { loginWithPassword } from '../src/auth/authApi';
+
+describe('loginWithPassword', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('returns the current user when login reports an existing session', async () => {
+    const user = { id: 1, email: 'ada@example.com' };
+    client.post.mockRejectedValue({ response: { status: 409 } });
+    client.get.mockResolvedValue({ data: user });
+
+    await expect(loginWithPassword('ada@example.com', 'password')).resolves.toEqual({
+      user,
+      needsMfa: false,
+    });
+  });
+
+  it('normalizes a failure while retrying the current user after a 409', async () => {
+    const retryError = {
+      response: { status: 429, data: { detail: 'Too many requests' } },
+    };
+    client.post.mockRejectedValue({ response: { status: 409 } });
+    client.get.mockRejectedValue(retryError);
+
+    await expect(loginWithPassword('ada@example.com', 'password')).rejects.toSatisfy((error) => {
+      expect(error).toBeInstanceOf(Error);
+      expect(error.code).toBeDefined();
+      expect(error).not.toBe(retryError);
+      return true;
+    });
+  });
+});

package/tests/authErrors.test.js

@@ -0,0 +1,43 @@
+import { describe, expect, it } from 'vitest';
+import { extractErrorInfo, normaliseApiError } from '../src/utils/auth-errors.js';
+
+describe('auth error normalisation', () => {
+  it('uses the caller default for generic detail errors while preserving the detail message', () => {
+    const responseError = {
+      response: { status: 429, data: { detail: 'Die Anfrage wurde gedrosselt...' } },
+    };
+    const info = extractErrorInfo(responseError);
+    const error = normaliseApiError(responseError, 'Auth.LOGIN_FAILED');
+
+    expect(info.code).toBeNull();
+    expect(error.code).toBe('Auth.LOGIN_FAILED');
+    expect(error.message).toBe('Die Anfrage wurde gedrosselt...');
+    expect(error.status).toBe(429);
+  });
+
+  it('uses its namespaced default when no caller default is provided', () => {
+    const error = normaliseApiError({
+      response: { status: 429, data: { detail: 'Die Anfrage wurde gedrosselt...' } },
+    });
+
+    expect(error.code).toBe('Auth.GENERIC_ERROR');
+  });
+
+  it('preserves a backend code from the errors array', () => {
+    const error = normaliseApiError(
+      { response: { data: { errors: [{ code: 'enter_current_password', message: 'x' }] } } },
+      'Auth.PROFILE_UPDATE_FAILED',
+    );
+
+    expect(error.code).toBe('enter_current_password');
+  });
+
+  it('preserves a backend code from the response data', () => {
+    const error = normaliseApiError(
+      { response: { data: { code: 'invalid_credentials' } } },
+      'Auth.LOGIN_FAILED',
+    );
+
+    expect(error.code).toBe('invalid_credentials');
+  });
+});

package/work-orders/AUTH-7.md

@@ -0,0 +1,181 @@
+# AUTH-7 — `loginWithPassword`'s "already authenticated" retry must not crash raw on a second failure
+
+---
+
+# A. Envelope — authored by the Expertenchat
+
+## Goal & expected outcome
+- Ziel: allauth-headless antwortet auf `POST /auth/login` mit `409` ("Conflict"), wenn bereits
+  eine gültige Session existiert (die Session ist real gültig — kein Fehlerfall an sich).
+  `loginWithPassword` (`src/auth/authApi.jsx:97-123`) behandelt das korrekt, indem es dann
+  `fetchCurrentUser()` erneut aufruft, um den bereits eingeloggten User zurückzugeben. Schlägt
+  DIESER Retry-Call aber ebenfalls fehl (beobachtet 2026-09-05: ein anderer, unabhängig
+  überlasteter Endpunkt hatte den globalen `user`-Throttle-Bucket geleert, sodass auch
+  `/api/users/current/` mit 429 antwortete), wird der Fehler ungefangen durchgereicht — kein
+  `.code`, keine Übersetzung, ein rohes Error-Objekt statt eines normalen Login-Fehlers.
+- Expected outcome: schlägt der 409-Retry fehl, bekommt der Aufrufer (`LoginPage.jsx:219-220`
+  liest `err.code`) einen normalisierten Fehler mit `.code` — dieselbe Fehlerform wie jeder andere
+  Login-Fehlerpfad in dieser Funktion, kein Sonderfall.
+
+## Scope + non-goals
+- In scope: ausschliesslich der 409-Zweig in `loginWithPassword`
+  (`src/auth/authApi.jsx:116-119`) — den bereits vorhandenen `fetchCurrentUser()`-Retry-Call in
+  ein eigenes try/catch nehmen und einen Fehlschlag über `normaliseApiError` weiterwerfen, exakt
+  wie jeder andere Fehlerpfad in dieser Funktion (Zeile 121) es bereits tut.
+- Explizite Non-Goals / nicht anfassen: der **Erfolgsfall** dieses Zweigs (409 + erfolgreicher
+  Retry → `{ user, needsMfa: false }`) bleibt bytegleich. `AuthContext.jsx`s Bootstrap-Catch-Block
+  (Zeile 107-109) wird NICHT geändert — geprüft: `user` ist beim ersten Mount ohnehin bereits
+  `null`, eine Fallunterscheidung nach Statuscode hätte dort unter keinem real erreichbaren
+  Codepfad einen beobachtbaren Effekt (der Effect läuft genau einmal pro Seitenaufruf), wäre also
+  Änderung ohne Wirkung in einer Shared-Core-Datei — bewusst ausgelassen. Keine neue Kontext-Prop,
+  keine Änderung an einer konsumierenden App (`kira` o.a.) — der Fix ist rein additiv/intern zu
+  `authApi.jsx`. `package.json`s Versionsfeld wird als Teil dieser WO angepasst (PATCH-Bump, siehe
+  Teil C) — das ist Prozess/Publish-Mechanik dieses Repos, kein Scope-Zusatz am eigentlichen Fix.
+
+## Tier · precondition / gate
+- Tier: 3 — Änderung INNERHALB von Shared-Core (`ui-core-micha`), unabhängig vom Umfang (AGENTS.md
+  → Tiering-Tabelle). Kein Precondition/Gate; die Änderung ist rein additiv (ein neuer catch um
+  einen bestehenden Call), kein Breaking Change, kein Versions-Bump nötig, keine konsumierende App
+  muss etwas tun.
+
+## Risks
+- Der Erfolgspfad (409 + Retry gelingt) darf sich nicht ändern — sonst bricht der bestehende
+  "bereits eingeloggt"-Login-Flow für ALLE Apps, die `ui-core-micha` konsumieren.
+- Der neue catch darf den `normaliseApiError`-Fehler nicht verschlucken oder verfälschen — die
+  aufrufende `LoginPage.jsx` liest `err.code` für die i18n-Anzeige.
+
+## Required tests to WRITE
+- Neue Datei `tests/authApiLogin.test.js` (Muster: `tests/authApiRegistration.test.js` — `apiClient`
+  gemockt via `vi.mock`, `client.post`/`client.get` direkt gestubbt, kein React/Testing-Library
+  nötig, `loginWithPassword` direkt importiert und aufgerufen):
+  1. `post` rejects mit `{ response: { status: 409 } }`, `get` (der `fetchCurrentUser`-Retry)
+     resolved mit `{ data: { id: 1, ... } }` → `loginWithPassword` liefert
+     `{ user: {...}, needsMfa: false }` (dokumentiert den unveränderten Erfolgspfad).
+  2. `post` rejects mit `{ response: { status: 409 } }`, `get` (der Retry) rejects zusätzlich mit
+     `{ response: { status: 429, data: { detail: '...' } } }` → `loginWithPassword` wirft einen
+     Error mit einem gesetzten `.code` (nicht `undefined`, nicht das rohe Axios-Error-Objekt).
+
+---
+
+# B. Implementation map — filled by the Orchestrator — ADDRESSED TO THE IMPLEMENTER
+
+## Context package
+
+**Named file to change:** `src/auth/authApi.jsx:97-123` (`loginWithPassword`), konkret nur
+Zeilen 115-119:
+
+```js
+    // 409 = Already logged in
+    if (status === 409) {
+        const user = await fetchCurrentUser();
+        return { user, needsMfa: false };
+    }
+
+    throw normaliseApiError(error, 'Auth.LOGIN_FAILED');
+```
+
+Ändere zu (Retry in eigenes try/catch, Fehlschlag desselben `normaliseApiError`-Wegs wie jeder
+andere Fehlerpfad dieser Funktion):
+
+```js
+    // 409 = Already logged in
+    if (status === 409) {
+        try {
+          const user = await fetchCurrentUser();
+          return { user, needsMfa: false };
+        } catch (retryError) {
+          throw normaliseApiError(retryError, 'Auth.LOGIN_FAILED');
+        }
+    }
+
+    throw normaliseApiError(error, 'Auth.LOGIN_FAILED');
+```
+
+`normaliseApiError` ist bereits oben in der Datei importiert (Zeile 3, aus `../utils/auth-errors`)
+— keine neue Abhängigkeit.
+
+**Invariants / Pitfalls:**
+- `fetchCurrentUser()` (Zeile 16-24, gleiche Datei) wirft bei jedem Fehler das **rohe** Axios-Error
+  weiter (kein eigener catch dort) — das ist bereits der Zustand, den dieser Fix abfängt; nicht
+  `fetchCurrentUser()` selbst ändern.
+- Der äussere `catch (error)`-Block (Zeile 103) bleibt unverändert; nur der 409-Zweig innerhalb
+  bekommt einen zusätzlichen inneren try/catch. Die MFA-Prüfung (Zeile 108-112) und der finale
+  `throw normaliseApiError(error, ...)` (Zeile 121, für den ursprünglichen `error`, NICHT den
+  `retryError`) bleiben unverändert.
+- `normaliseApiError`s zweites Argument ist ein Default-Code, kein spezifischer 429-Code — es gibt
+  keinen eigenen i18n-Key für "Login gerade nicht möglich, Konto ist gedrosselt"; Wiederverwendung
+  von `'Auth.LOGIN_FAILED'` (bereits vorhandener Key) ist beabsichtigt, kein neuer i18n-Key nötig
+  in irgendeiner konsumierenden App.
+
+Directive: Arbeite ausschliesslich aus diesem Kontext-Paket; öffne nur die genannte Datei plus die
+genannte Testdatei-Vorlage zur Verifikation. Kein breites Erkunden im restlichen `src/auth/`.
+
+## Target repo working directory (absolute)
+
+`C:\Users\Micha Bigler\Documents\webapps\ui-core-micha`
+
+## Preamble — REQUIRED, part of this file
+
+> The text above is the COMPLETE spec — the committed WO file's content, not a plan to refine;
+> there is no separate plan file. Read the nearest `AGENTS.md`, the relevant
+> `.codex/skills/<role>/SKILL.md`, and the app `MEMORY.md` ONLY for conventions. Stay in scope; do
+> not touch auth/permissions/deps/schema/CI unless the spec says so; do not update `MEMORY.md`.
+> **Do NOT edit `WORK_ORDERS.md`** — the register row and the review verdicts are the
+> orchestrator's alone. **Your tools are for editing source and test files and for running the
+> tests you wrote — nothing else.** Do NOT install dependencies, touch a lockfile, run a package
+> manager, or tidy up stray files; if something in the repo state blocks you, stop and report it as
+> `RESULT: BLOCKED <reason>` instead of fixing it. Do NOT `git add`/`commit`/`push` — leave every
+> change uncommitted in the working tree for the orchestrator's independent review. WRITE the
+> tests the `Required tests` section calls for AND **RUN the tests you just wrote** to confirm
+> they execute and pass — that is the ONLY test run you do (NOT the app's affected/full suite, NOT
+> any review). The orchestrator re-runs the authoritative set + does the independent review after
+> you finish — those are the gate; your own run does not count as the gate.
+>
+> Narrate continuously: a `PLAN: <step1> | <step2> | …` line up front, then a single-line
+> `PROGRESS: [<n>/<total>] <present-tense action>` before every relevant action (and `… done` on
+> completion), spaced so no gap exceeds ~2 min, stdout unbuffered, plus exactly one final
+> `RESULT: DONE|BLOCKED <reason>`.
+
+---
+
+# C. Orchestrator only — NOT ADDRESSED TO THE IMPLEMENTER
+
+> **If you are the implementer reading this work order as your own specification: STOP at this
+> line. Everything below describes what the Orchestrator does AFTER you finish. You do none of it
+> — no reviewers, no verification run, no register edit, no commit.** You ARE the invocation
+> described below; do NOT shell out to `codex exec`.
+
+## Execution directive
+
+Implement through `codex exec` in the background, invoked directly via Bash with both mandatory
+flags. Fallback to direct Claude implementation only on Codex quota/rate-limit/non-zero exit
+(flips authorship — independent reviewer becomes mandatory, already mandatory at Tier 3).
+
+## Review routing
+
+Tier 3, full set, all concurrent in one background batch: `reviewer` (all 4 lenses — this is
+shared-core, `duplication` and `regression` lenses matter most here), `ui_reviewer` (diff touches
+a `.jsx` file consumed by every app's login page — narrow context: this diff + the relevant
+`AGENTS.md` auth-error-handling convention), `sec_reviewer` (auth/login flow). Orchestrator's own
+targeted security pass runs alongside, additional not substitute.
+
+## Verification
+
+Authoritative test run: `npx vitest run tests/authApiLogin.test.js tests/AuthContext.test.jsx
+tests/authApiRegistration.test.js` (affected area — everything touching `authApi.jsx` and the
+login flow it feeds). No prototype artifact in scope, no rendered side-by-side needed (no visual
+change).
+
+## Register + commit
+
+Bump `package.json`'s `version` `3.5.0` -> `3.5.1` (PATCH — bugfix, no interface/behavior change
+for any existing caller) as part of this same commit, matching this repo's established
+push-to-`main` + version-bump publish flow (see `MSG-19`'s register row for precedent). Commit on
+`main` (this repo has no `develop`). `WORK_ORDERS.md` row for `AUTH-7`, named review verdict.
+After push, verify the bumped version actually published (per
+`reference_dcm_ucm_publish_topology` — publish-from-main has no staging gate, check the live
+package version after push). **No consumer pin-bump is required for this to take effect for
+kira** — this is a pure bugfix with no interface change, so record explicitly in the Notiz that no
+app needs to bump its `@micha.bigler/ui-core-micha` pin for this fix to matter (kira's *symptom*
+was caused by the throttle exhaustion fixed in `KIRA-TRACK-3`, not by this bug alone — this fix
+only prevents a raw/uncaught error the NEXT time any app's login flow race is hit).

package/work-orders/AUTH-8.md

@@ -0,0 +1,184 @@
+# AUTH-8 — `extractErrorInfo`'s hardcoded `'GENERIC'` code must not out-rank the caller's own default
+
+---
+
+# A. Envelope — authored by the Expertenchat
+
+## Goal & expected outcome
+- Ziel: `extractErrorInfo` (`src/utils/auth-errors.js:2-27`) gibt für jeden Backend-Fehler der
+  Form `{"detail": "..."}` (Djangos generisches Fehlerformat — u.a. DRF `Throttled`, `Http404`,
+  `PermissionDenied`, jede unbehandelte `APIException`; exakt die Form des 429/409, das die
+  gesamte `KIRA-TRACK-3`/`AUTH-7`-Untersuchung ausgelöst hat) den hartcodierten Code `'GENERIC'`
+  zurück. `normaliseApiError` (Zeile 29-38) wählt dann `info.code || defaultCode` — da `'GENERIC'`
+  ein truthy String ist, GEWINNT er IMMER gegen den von JEDER der 39 bestehenden Aufrufstellen in
+  diesem Repo übergebenen, spezifischen `defaultCode` (z. B. `'Auth.LOGIN_FAILED'`,
+  `'Auth.PROFILE_UPDATE_FAILED'`, …). `'GENERIC'` ist an KEINER Stelle als i18n-Key registriert
+  (verifiziert: kein Treffer in `src/i18n/`, keine Erwähnung ausserhalb dieser einen Zeile) — die
+  UI zeigt also für JEDEN `{detail}`-förmigen Backend-Fehler den rohen String `"GENERIC"` statt
+  einer übersetzten Meldung, gleich welcher Aufrufer betroffen ist.
+- Expected outcome: ein `{detail}`-förmiger Fehler liefert `code === <übergebener defaultCode>`
+  (übersetzt, wie jeder andere fehlende/unbekannte Code auch) — `data.detail`s Text bleibt weiterhin
+  in `.message` erhalten (nützlich für Logs/Debugging), beeinflusst aber nicht mehr `.code`.
+
+## Scope + non-goals
+- In scope: ausschliesslich `src/utils/auth-errors.js` — die EINE Zeile, die `code: 'GENERIC'`
+  zurückgibt, wird zu `code: null` (dann gewinnt in `normaliseApiError` korrekt der übergebene
+  `defaultCode`, exakt wie bei jedem anderen Fehler ohne erkennbaren Code).
+- Explizite Non-Goals / nicht anfassen: die ANDEREN beiden Zweige von `extractErrorInfo`
+  (`data.errors[0].code`, `data.code`) liefern einen ECHTEN, vom Backend gesetzten Code — dieses
+  Verhalten ist korrekt und bleibt unverändert; nicht "verbessern" oder umbauen.
+  `normaliseApiError`s Signatur/Rückgabeform (`Error` mit `.code`/`.status`/`.raw`) bleibt gleich.
+  Keine neue i18n-Übersetzung für `'GENERIC'` selbst nötig — der Fix macht den String obsolet,
+  statt ihn übersetzbar zu machen. Keine Änderung an `LoginPage.jsx`/`SecurityComponent.jsx`/
+  anderen Konsumenten — die lesen bereits `err.code || '<eigener Default>'` und profitieren
+  automatisch, ohne selbst geändert zu werden.
+
+## Tier · precondition / gate
+- Tier: 3 — Shared-Core (`ui-core-micha`), betrifft laut Aufrufstellen-Scan ALLE 39 bestehenden
+  `normaliseApiError(...)`-Aufrufe in diesem Repo (jede Funktion in `src/auth/authApi.jsx` und
+  `src/utils/authService.js`). Kein Precondition/Gate.
+- **Wichtig fürs Versionsschema:** anders als `AUTH-7` (rein additiv) ändert dieser Fix
+  BEOBACHTBARES Verhalten für jeden Aufrufer, der aktuell (fehlerhaft) `.code === 'GENERIC'`
+  bekommt — das ist der Bug selbst, aber jede konsumierende App, die diese Version zieht, sieht ab
+  sofort eine ANDERE (korrekte) übersetzte Meldung an Stellen, wo bisher der rohe String
+  `"GENERIC"` erschien. Deshalb MINOR-Bump (nicht PATCH) vorgesehen, siehe Teil C.
+
+## Risks
+- Wird der Fix zu breit gefasst (z. B. `'GENERIC'` komplett aus dem Vokabular entfernt statt nur
+  die eine Codepfad-Priorität zu korrigieren), könnte das `.message`-Feld (der rohe `data.detail`-
+  Text) verlorengehen — das wird von KEINEM bekannten Aufrufer als Anzeige-Text verwendet (alle
+  lesen `.code` fürs Rendering, s.o.), aber sicherheitshalber in den Tests absichern.
+- Die beiden UNVERÄNDERTEN Zweige (`data.errors[].code`, `data.code`) müssen per Regressionstest
+  nachweislich unverändert bleiben.
+
+## Required tests to WRITE
+Neue Datei `tests/authErrors.test.js` (reiner Unit-Test, kein React/Testing-Library nötig — direkter
+Import von `normaliseApiError`/`extractErrorInfo` aus `../src/utils/auth-errors.js`):
+1. `{ response: { status: 429, data: { detail: 'Die Anfrage wurde gedrosselt...' } } }` mit
+   `normaliseApiError(err, 'Auth.LOGIN_FAILED')` aufgerufen → `.code === 'Auth.LOGIN_FAILED'` (NICHT
+   `'GENERIC'`), `.message === 'Die Anfrage wurde gedrosselt...'`, `.status === 429`.
+2. Ohne übergebenen `defaultCode` (Default-Parameter) mit demselben `{detail}`-Fehler → `.code ===
+   'Auth.GENERIC_ERROR'` (der Funktions-Default, nicht `'GENERIC'`).
+3. Regression: `{ response: { data: { errors: [{ code: 'enter_current_password', message: 'x' }] } } }`
+   → `.code === 'enter_current_password'` (übergebener `defaultCode` NICHT verwendet — echter
+   Backend-Code gewinnt weiterhin, unverändert).
+4. Regression: `{ response: { data: { code: 'invalid_credentials' } } }` → `.code ===
+   'invalid_credentials'` (unverändert).
+
+---
+
+# B. Implementation map — filled by the Orchestrator — ADDRESSED TO THE IMPLEMENTER
+
+## Context package
+
+**Named file to change:** `src/utils/auth-errors.js:21-24`:
+
+```js
+  // Fallback for generic Django errors
+  if (typeof data.detail === 'string') {
+    return { status, code: 'GENERIC', message: data.detail, raw: data };
+  }
+```
+
+Ändere die zurückgegebene `code`-Property von `'GENERIC'` zu `null`:
+
+```js
+  // Fallback for generic Django errors. `code: null` here (not a fake sentinel)
+  // lets normaliseApiError's `info.code || defaultCode` correctly prefer the
+  // caller's own specific default — `data.detail` is Django's generic
+  // human-readable message field, never a machine code, and no caller of
+  // normaliseApiError anywhere in this repo expects to see 'GENERIC' as a code
+  // (grepped: zero references outside this one line, zero i18n key for it).
+  if (typeof data.detail === 'string') {
+    return { status, code: null, message: data.detail, raw: data };
+  }
+```
+
+**Do NOT touch** the other two branches (lines 11-15 `data.errors[0]`, lines 17-19 `data.code`) or
+`normaliseApiError` itself (lines 29-38) — its `info.code || defaultCode` logic is already correct;
+the bug was entirely in what `extractErrorInfo` fed it.
+
+**Invariants / Pitfalls:**
+- `normaliseApiError`'s OWN default parameter is `defaultCode = 'Auth.GENERIC_ERROR'` (line 29) —
+  this is a DIFFERENT string (`'Auth.GENERIC_ERROR'`, already namespaced like every other code in
+  this file) from the bug's `'GENERIC'` sentinel. Do not confuse the two or "fix" the wrong one.
+- `data.detail` being falsy/absent already falls through correctly to the final `return { status,
+  code: null, message: null, raw: data }` (line 26) — that path is already correct and untouched.
+- No i18n file needs a new key — this fix does not introduce any new user-visible string; it makes
+  the ALREADY-TRANSLATED caller-specific keys (e.g. `Auth.LOGIN_FAILED`, confirmed translated in
+  de/fr/en/sw) reachable again.
+
+Directive: Arbeite ausschliesslich aus diesem Kontext-Paket; öffne nur `src/utils/auth-errors.js`
+und die neue Testdatei zur Verifikation. Kein breites Erkunden in `authApi.jsx`/`authService.js` —
+deren 39 Aufrufstellen sind bereits korrekt (sie übergeben schon einen sinnvollen `defaultCode`);
+sie müssen nicht einzeln angeschaut werden.
+
+## Target repo working directory (absolute)
+
+`C:\Users\Micha Bigler\Documents\webapps\ui-core-micha`
+
+## Preamble — REQUIRED, part of this file
+
+> The text above is the COMPLETE spec — the committed WO file's content, not a plan to refine;
+> there is no separate plan file. Read the nearest `AGENTS.md`, the relevant
+> `.codex/skills/<role>/SKILL.md`, and the app `MEMORY.md` ONLY for conventions. Stay in scope; do
+> not touch auth/permissions/deps/schema/CI unless the spec says so; do not update `MEMORY.md`.
+> **Do NOT edit `WORK_ORDERS.md`** — the register row and the review verdicts are the
+> orchestrator's alone. **Your tools are for editing source and test files and for running the
+> tests you wrote — nothing else.** Do NOT install dependencies, touch a lockfile, run a package
+> manager, or tidy up stray files; if something in the repo state blocks you, stop and report it as
+> `RESULT: BLOCKED <reason>` instead of fixing it. Do NOT `git add`/`commit`/`push` — leave every
+> change uncommitted in the working tree for the orchestrator's independent review. WRITE the
+> tests the `Required tests` section calls for AND **RUN the tests you just wrote** to confirm
+> they execute and pass — that is the ONLY test run you do (NOT the app's affected/full suite, NOT
+> any review). The orchestrator re-runs the authoritative set + does the independent review after
+> you finish — those are the gate; your own run does not count as the gate.
+>
+> Narrate continuously: a `PLAN: <step1> | <step2> | …` line up front, then a single-line
+> `PROGRESS: [<n>/<total>] <present-tense action>` before every relevant action (and `… done` on
+> completion), spaced so no gap exceeds ~2 min, stdout unbuffered, plus exactly one final
+> `RESULT: DONE|BLOCKED <reason>`.
+
+---
+
+# C. Orchestrator only — NOT ADDRESSED TO THE IMPLEMENTER
+
+> **If you are the implementer reading this work order as your own specification: STOP at this
+> line. Everything below describes what the Orchestrator does AFTER you finish. You do none of it
+> — no reviewers, no verification run, no register edit, no commit.** You ARE the invocation
+> described below; do NOT shell out to `codex exec`.
+
+## Execution directive
+
+Implement through `codex exec` in the background, invoked directly via Bash with both mandatory
+flags. Fallback to direct Claude implementation only on Codex quota/rate-limit/non-zero exit
+(flips authorship — independent reviewer becomes mandatory, already mandatory at Tier 3). Codex
+confirmed available today (two successful dispatches already this session, `KIRA-TRACK-3`/
+`AUTH-7`) — no fresh probe needed.
+
+## Review routing
+
+Tier 3, full set, all concurrent in one background batch: `reviewer` (all 4 lenses — `regression`
+matters most here given 39 call sites; `envelope` needs Part A inline), `ui_reviewer` (this is
+specifically an i18n/error-rendering correctness fix — narrow context: the diff + confirmation that
+every `defaultCode` used across `authApi.jsx`/`authService.js` is actually a translated key in all
+shipped locales), `sec_reviewer` (confirm `.message`/`.raw` still expose no more than before — this
+diff should REDUCE not increase what reaches the UI, since `'GENERIC'` is replaced by `null`).
+Orchestrator's own targeted pass runs alongside.
+
+## Verification
+
+Authoritative test run: `npx vitest run tests/authErrors.test.js tests/authErrorCodeRendering.test.jsx
+tests/authApiLogin.test.js tests/authApiRegistration.test.js` (affected area — everything touching
+`auth-errors.js` and its consumers). No prototype artifact, no rendered side-by-side (no markup
+changed).
+
+## Register + commit
+
+Bump `package.json`'s `version` — **MINOR**, not PATCH, per the Envelope's tier note (observable
+behavior change for existing `{detail}`-shaped-error callers, not purely additive) — from whatever
+`AUTH-7` landed at, to the next `3.x.0`. `CHANGELOG.md` entry MUST explicitly warn: existing
+consumers who upgrade will see a DIFFERENT (correct, translated) message wherever they previously
+saw the raw string `"GENERIC"` for a `{detail}`-shaped backend error — re-check that UI surface
+after bumping the pin, don't assume silent compatibility the way `AUTH-7`'s bump was. Commit on
+`main`. `WORK_ORDERS.md` row for `AUTH-8` → `done`, named review verdict, landing SHA.