@open-mercato/onboarding 0.7.1-develop.7106.1.53fe9dd1b1 → 0.7.1-develop.7112.1.d486e6f1b2

package/src/modules/onboarding/api/post/onboarding.ts

@@ -12,6 +12,7 @@ import { createFallbackTranslator } from '@open-mercato/shared/lib/i18n/translat
 import { sendEmail } from '@open-mercato/shared/lib/email/send'
 import { onboardingStartSchema } from '@open-mercato/onboarding/modules/onboarding/data/validators'
 import { OnboardingService } from '@open-mercato/onboarding/modules/onboarding/lib/service'
+import { sendExistingAccountNotice } from '@open-mercato/onboarding/modules/onboarding/lib/existing-account-notice'
 import VerificationEmail from '@open-mercato/onboarding/modules/onboarding/emails/VerificationEmail'
 import AdminNotificationEmail from '@open-mercato/onboarding/modules/onboarding/emails/AdminNotificationEmail'
 import { User } from '@open-mercato/core/modules/auth/data/entities'
@@ -105,10 +106,36 @@ export async function POST(req: Request) {
     }, { status: 400 })
   }
 
+  // An unauthenticated caller must not be able to tell whether the submitted address
+  // already has an account (#5505), so every accepted submission answers with this exact
+  // body and a caller-visible email failure looks the same on both branches.
+  const acceptedResponse = () => NextResponse.json({ ok: true, email: parsed.data.email })
+  const emailSendFailedResponse = () => NextResponse.json({
+    ok: false,
+    error: translate(
+      'onboarding.errors.emailSendFailed',
+      'We could not send the verification email. Please try again or contact support.',
+    ),
+  }, { status: 502 })
+
   try {
     const container = await createRequestContainer()
     const em = (container.resolve('em') as EntityManager)
 
+    // Resolved before the account lookup so a misconfigured APP_URL fails the same way for
+    // both branches instead of becoming a second way to probe for an existing account.
+    let baseUrl: string
+    try {
+      baseUrl = getSecurityEmailBaseUrl(req)
+    } catch (error) {
+      const mapped = mapSecurityEmailUrlError(error, {
+        scope: 'onboarding.start',
+        configMessage: 'Self-service onboarding is not configured.',
+      })
+      if (mapped) return NextResponse.json({ ok: false, error: mapped.body.error }, { status: mapped.status })
+      throw error
+    }
+
     const existingUser = await findOneWithDecryption(em, User, {
       deletedAt: null,
       $or: [
@@ -117,12 +144,45 @@ export async function POST(req: Request) {
       ],
     })
     if (existingUser) {
-      const message = translate('onboarding.errors.emailExists', 'We already have an account with this email. Try signing in or resetting your password.')
-      return NextResponse.json({
-        ok: false,
-        error: message,
-        fieldErrors: { email: message },
-      }, { status: 409 })
+      // The notice goes to the account owner, not to the submitter, so it is rendered in the
+      // instance default locale rather than the one this request carried — the submitter must
+      // not get to choose which language lands in someone else's inbox.
+      const noticeTranslate = locale === defaultLocale
+        ? translate
+        : createFallbackTranslator(await loadDictionary(defaultLocale))
+      // Never create an onboarding request for an address that already has an account —
+      // the submitter's name and organization must not reach the account owner's inbox.
+      // The neutral notice below is the only, out-of-band acknowledgement of the account.
+      try {
+        await sendExistingAccountNotice({
+          container,
+          email: parsed.data.email,
+          loginUrl: `${baseUrl}/login`,
+          subject: noticeTranslate('onboarding.existingAccountEmail.subject', 'About your Open Mercato account'),
+          copy: {
+            preview: noticeTranslate(
+              'onboarding.existingAccountEmail.preview',
+              'Someone tried to create an Open Mercato workspace with this email address.',
+            ),
+            heading: noticeTranslate('onboarding.existingAccountEmail.heading', 'You already have an account'),
+            greeting: noticeTranslate('onboarding.existingAccountEmail.greeting', 'Hello,'),
+            body: noticeTranslate(
+              'onboarding.existingAccountEmail.body',
+              'Someone just used this email address to start creating an Open Mercato workspace. This address already has an account, so we did not create a new one.',
+            ),
+            cta: noticeTranslate('onboarding.existingAccountEmail.cta', 'Sign in'),
+            ignore: noticeTranslate(
+              'onboarding.existingAccountEmail.ignore',
+              "If this was you, sign in or reset your password. If it wasn't, you can safely ignore this message — nothing about your account has changed.",
+            ),
+            footer: noticeTranslate('onboarding.existingAccountEmail.footer', 'Open Mercato · Onboarding service'),
+          },
+        })
+      } catch (err) {
+        logger.error('Existing account notice email failed', { err })
+        return emailSendFailedResponse()
+      }
+      return acceptedResponse()
     }
 
     const service = new OnboardingService(em)
@@ -133,28 +193,15 @@ export async function POST(req: Request) {
       token = result.token
     } catch (err) {
       if (err instanceof Error && err.message.startsWith('PENDING_REQUEST:')) {
-        const minutes = Number(err.message.split(':')[1] || '10')
-        const message = translate('onboarding.errors.pendingRequest', 'We already have a pending verification. Please try again in about {minutes} minutes or contact the administrator.', { minutes })
-        return NextResponse.json({
-          ok: false,
-          error: message,
-          fieldErrors: { email: message },
-        }, { status: 409 })
+        // The pending-request window is an anti-spam throttle, not a caller-visible state:
+        // reporting it would let two probes rebuild the enumeration oracle, because the
+        // window only ever exists for an address that has no account.
+        logger.info('Onboarding request throttled by pending verification')
+        return acceptedResponse()
       }
       throw err
     }
 
-    let baseUrl: string
-    try {
-      baseUrl = getSecurityEmailBaseUrl(req)
-    } catch (error) {
-      const mapped = mapSecurityEmailUrlError(error, {
-        scope: 'onboarding.start',
-        configMessage: 'Self-service onboarding is not configured.',
-      })
-      if (mapped) return NextResponse.json({ ok: false, error: mapped.body.error }, { status: mapped.status })
-      throw error
-    }
     const verifyUrl = `${baseUrl}/api/onboarding/onboarding/verify?token=${token}`
 
     const firstName = request.firstName || parsed.data.firstName
@@ -187,13 +234,7 @@ export async function POST(req: Request) {
       request.lastEmailSentAt = null
       await em.flush()
       logger.error('Verification email failed', { err })
-      return NextResponse.json({
-        ok: false,
-        error: translate(
-          'onboarding.errors.emailSendFailed',
-          'We could not send the verification email. Please try again or contact support.',
-        ),
-      }, { status: 502 })
+      return emailSendFailedResponse()
     }
 
     const adminEmail = process.env.ADMIN_EMAIL || 'piotr@catchthetornado.com'
@@ -220,7 +261,7 @@ export async function POST(req: Request) {
       logger.error('Admin email failed', { err })
     }
 
-    return NextResponse.json({ ok: true, email: request.email })
+    return acceptedResponse()
   } catch (error) {
     logger.error('Onboarding start failed', { err: error })
     return NextResponse.json({
@@ -247,7 +288,7 @@ const onboardingErrorSchema = z.object({
 
 const onboardingPostDoc: OpenApiMethodDoc = {
   summary: 'Submit onboarding request',
-  description: 'Accepts a self-service onboarding form submission and triggers email verification.',
+  description: 'Accepts a self-service onboarding form submission and triggers email verification. The response never reveals whether the submitted address already has an account: an address that does receives an out-of-band notice email instead of a verification link, and the caller sees the same accepted response either way. The guarantee covers the response status and body, not response latency — the new-address branch hashes a password and sends two emails where the existing-account branch sends one, so a caller that measures timing can still tell them apart. Deployments should also keep rate limiting enabled (and use the redis strategy when running more than one replica): the per-address window on the existing-account notice is backed by the rate limiter, so with rate limiting disabled the address owner receives one notice per accepted submission instead of one per ten minutes.',
   tags: [onboardingTag],
   requestBody: {
     contentType: 'application/json',
@@ -255,14 +296,14 @@ const onboardingPostDoc: OpenApiMethodDoc = {
     description: 'Onboarding form payload with contact and organization information.',
   },
   responses: [
-    { status: 200, description: 'Onboarding request accepted.', schema: onboardingSuccessSchema },
+    { status: 200, description: 'Onboarding request accepted. Returned for a new address, for an address that already has an account, and for a submission inside the pending-verification window.', schema: onboardingSuccessSchema },
   ],
   errors: [
     { status: 400, description: 'Validation failed', schema: onboardingErrorSchema },
     { status: 404, description: 'Self-service onboarding disabled', schema: onboardingErrorSchema },
-    { status: 409, description: 'Existing account or pending request', schema: onboardingErrorSchema },
     { status: 429, description: 'Too many onboarding submissions from this IP', schema: rateLimitErrorSchema },
     { status: 500, description: 'Unexpected server error', schema: onboardingErrorSchema },
+    { status: 502, description: 'Outbound email could not be delivered', schema: onboardingErrorSchema },
   ],
 }
 

package/src/modules/onboarding/emails/ExistingAccountEmail.tsx

@@ -0,0 +1,54 @@
+import React from 'react'
+import { Html, Head, Preview, Body, Container, Heading, Text, Section, Button, Hr } from '@react-email/components'
+
+export type ExistingAccountEmailCopy = {
+  preview: string
+  heading: string
+  greeting: string
+  body: string
+  cta: string
+  ignore: string
+  footer: string
+}
+
+type ExistingAccountEmailProps = {
+  loginUrl: string
+  copy: ExistingAccountEmailCopy
+}
+
+export default function ExistingAccountEmail({ loginUrl, copy }: ExistingAccountEmailProps) {
+  return (
+    <Html>
+      <Head>
+        <title>{copy.heading}</title>
+      </Head>
+      <Preview>{copy.preview}</Preview>
+      <Body style={{ backgroundColor: '#f1f5f9', fontFamily: 'Helvetica, Arial, sans-serif', padding: '24px 0' }}>
+        <Container style={{ backgroundColor: '#ffffff', padding: '32px', borderRadius: '12px', margin: '0 auto', maxWidth: '520px' }}>
+          <Heading style={{ fontSize: '24px', fontWeight: 600, margin: '0 0 16px' }}>{copy.heading}</Heading>
+          <Text style={{ fontSize: '16px', color: '#334155', marginBottom: '16px' }}>{copy.greeting}</Text>
+          <Text style={{ fontSize: '16px', color: '#334155', marginBottom: '16px', lineHeight: '24px' }}>{copy.body}</Text>
+          <Section style={{ textAlign: 'center', margin: '32px 0' }}>
+            <Button
+              href={loginUrl}
+              style={{
+                backgroundColor: '#111827',
+                color: '#ffffff',
+                padding: '12px 24px',
+                borderRadius: '8px',
+                fontSize: '15px',
+                textDecoration: 'none',
+                display: 'inline-block',
+              }}
+            >
+              {copy.cta}
+            </Button>
+          </Section>
+          <Text style={{ fontSize: '14px', color: '#64748b', marginBottom: '16px', lineHeight: '22px' }}>{copy.ignore}</Text>
+          <Hr style={{ borderColor: '#e2e8f0', margin: '24px 0' }} />
+          <Text style={{ fontSize: '12px', color: '#94a3b8' }}>{copy.footer}</Text>
+        </Container>
+      </Body>
+    </Html>
+  )
+}

package/src/modules/onboarding/i18n/de.json

@@ -37,7 +37,6 @@
   "onboarding.email.marketingConsentYes": "Marketing-Einwilligung: Ja",
   "onboarding.email.preview": "Bestätigen Sie Ihre E-Mail, um Ihren Open Mercato-Arbeitsbereich zu aktivieren",
   "onboarding.email.subject": "Bestätigen Sie Ihre E-Mail, um das Onboarding abzuschließen",
-  "onboarding.errors.emailExists": "Es existiert bereits ein Konto mit dieser E-Mail-Adresse. Versuchen Sie, sich anzumelden oder Ihr Passwort zurückzusetzen.",
   "onboarding.errors.emailInvalid": "Geben Sie eine gültige geschäftliche E-Mail-Adresse ein.",
   "onboarding.errors.emailSendFailed": "Die Bestätigungs-E-Mail konnte nicht gesendet werden. Bitte versuchen Sie es erneut oder kontaktieren Sie den Support.",
   "onboarding.errors.firstNameRequired": "Vorname ist erforderlich.",
@@ -45,11 +44,17 @@
   "onboarding.errors.organizationNameRequired": "Organisationsname ist erforderlich.",
   "onboarding.errors.passwordMismatch": "Die Passwörter müssen übereinstimmen.",
   "onboarding.errors.passwordRequired": "Das Passwort muss die Anforderungen erfüllen: {requirements}.",
-  "onboarding.errors.pendingRequest": "Es liegt bereits eine ausstehende Verifizierung vor. Bitte versuchen Sie es in etwa {minutes} Minuten erneut oder kontaktieren Sie den Administrator.",
   "onboarding.errors.termsRequired": "Bitte akzeptieren Sie die Nutzungsbedingungen, um fortzufahren.",
+  "onboarding.existingAccountEmail.body": "Jemand hat gerade mit dieser E-Mail-Adresse begonnen, einen Open Mercato-Arbeitsbereich zu erstellen. Für diese Adresse existiert bereits ein Konto, daher haben wir kein neues angelegt.",
+  "onboarding.existingAccountEmail.cta": "Anmelden",
+  "onboarding.existingAccountEmail.footer": "Open Mercato · Onboarding-Service",
+  "onboarding.existingAccountEmail.greeting": "Hallo,",
+  "onboarding.existingAccountEmail.heading": "Sie haben bereits ein Konto",
+  "onboarding.existingAccountEmail.ignore": "Wenn Sie das waren, melden Sie sich an oder setzen Sie Ihr Passwort zurück. Andernfalls können Sie diese Nachricht ignorieren — an Ihrem Konto hat sich nichts geändert.",
+  "onboarding.existingAccountEmail.preview": "Jemand hat versucht, mit dieser E-Mail-Adresse einen Open Mercato-Arbeitsbereich zu erstellen.",
+  "onboarding.existingAccountEmail.subject": "Zu Ihrem Open Mercato-Konto",
   "onboarding.form.confirmPassword": "Passwort bestätigen",
   "onboarding.form.email": "Geschäftliche E-Mail",
-  "onboarding.form.emailExists": "Es existiert bereits ein Konto mit dieser E-Mail-Adresse. Versuchen Sie, sich anzumelden oder Ihr Passwort zurückzusetzen.",
   "onboarding.form.firstName": "Vorname",
   "onboarding.form.genericError": "Etwas ist schiefgelaufen. Bitte versuchen Sie es erneut oder kontaktieren Sie den Support.",
   "onboarding.form.lastName": "Nachname",

package/src/modules/onboarding/i18n/en.json

@@ -37,7 +37,6 @@
   "onboarding.email.marketingConsentYes": "Marketing consent: Yes",
   "onboarding.email.preview": "Confirm your email to activate your Open Mercato workspace",
   "onboarding.email.subject": "Confirm your email to finish onboarding",
-  "onboarding.errors.emailExists": "We already have an account with this email. Try signing in or resetting your password.",
   "onboarding.errors.emailInvalid": "Enter a valid work email.",
   "onboarding.errors.emailSendFailed": "We could not send the verification email. Please try again or contact support.",
   "onboarding.errors.firstNameRequired": "First name is required.",
@@ -45,11 +44,17 @@
   "onboarding.errors.organizationNameRequired": "Organization name is required.",
   "onboarding.errors.passwordMismatch": "Passwords must match.",
   "onboarding.errors.passwordRequired": "Password must meet the requirements: {requirements}.",
-  "onboarding.errors.pendingRequest": "We already have a pending verification. Please try again in about {minutes} minutes or contact the administrator.",
   "onboarding.errors.termsRequired": "Please accept the terms to continue.",
+  "onboarding.existingAccountEmail.body": "Someone just used this email address to start creating an Open Mercato workspace. This address already has an account, so we did not create a new one.",
+  "onboarding.existingAccountEmail.cta": "Sign in",
+  "onboarding.existingAccountEmail.footer": "Open Mercato · Onboarding service",
+  "onboarding.existingAccountEmail.greeting": "Hello,",
+  "onboarding.existingAccountEmail.heading": "You already have an account",
+  "onboarding.existingAccountEmail.ignore": "If this was you, sign in or reset your password. If it wasn't, you can safely ignore this message — nothing about your account has changed.",
+  "onboarding.existingAccountEmail.preview": "Someone tried to create an Open Mercato workspace with this email address.",
+  "onboarding.existingAccountEmail.subject": "About your Open Mercato account",
   "onboarding.form.confirmPassword": "Confirm password",
   "onboarding.form.email": "Work email",
-  "onboarding.form.emailExists": "We already have an account with this email. Try signing in or resetting your password.",
   "onboarding.form.firstName": "First name",
   "onboarding.form.genericError": "Something went wrong. Please try again or contact support.",
   "onboarding.form.lastName": "Last name",

package/src/modules/onboarding/i18n/es.json

@@ -37,7 +37,6 @@
   "onboarding.email.marketingConsentYes": "Consentimiento de marketing: Sí",
   "onboarding.email.preview": "Confirme su correo electrónico para activar su espacio de trabajo en Open Mercato",
   "onboarding.email.subject": "Confirme su correo electrónico para finalizar la incorporación",
-  "onboarding.errors.emailExists": "Ya tenemos una cuenta con este correo electrónico. Intente iniciar sesión o restablecer su contraseña.",
   "onboarding.errors.emailInvalid": "Ingrese un correo electrónico de trabajo válido.",
   "onboarding.errors.emailSendFailed": "No pudimos enviar el correo de verificación. Intente de nuevo o comuníquese con soporte.",
   "onboarding.errors.firstNameRequired": "El nombre es obligatorio.",
@@ -45,11 +44,17 @@
   "onboarding.errors.organizationNameRequired": "El nombre de la organización es obligatorio.",
   "onboarding.errors.passwordMismatch": "Las contraseñas deben coincidir.",
   "onboarding.errors.passwordRequired": "La contraseña debe cumplir los requisitos: {requirements}.",
-  "onboarding.errors.pendingRequest": "Ya tenemos una verificación pendiente. Intente de nuevo en aproximadamente {minutes} minutos o comuníquese con el administrador.",
   "onboarding.errors.termsRequired": "Acepte los términos para continuar.",
+  "onboarding.existingAccountEmail.body": "Alguien acaba de usar este correo electrónico para empezar a crear un espacio de trabajo de Open Mercato. Esta dirección ya tiene una cuenta, así que no creamos ninguna nueva.",
+  "onboarding.existingAccountEmail.cta": "Iniciar sesión",
+  "onboarding.existingAccountEmail.footer": "Open Mercato · Servicio de onboarding",
+  "onboarding.existingAccountEmail.greeting": "Hola:",
+  "onboarding.existingAccountEmail.heading": "Ya tiene una cuenta",
+  "onboarding.existingAccountEmail.ignore": "Si fue usted, inicie sesión o restablezca su contraseña. Si no, puede ignorar este mensaje: no ha cambiado nada en su cuenta.",
+  "onboarding.existingAccountEmail.preview": "Alguien intentó crear un espacio de trabajo de Open Mercato con este correo electrónico.",
+  "onboarding.existingAccountEmail.subject": "Sobre su cuenta de Open Mercato",
   "onboarding.form.confirmPassword": "Confirmar contraseña",
   "onboarding.form.email": "Correo electrónico de trabajo",
-  "onboarding.form.emailExists": "Ya tenemos una cuenta con este correo electrónico. Intente iniciar sesión o restablecer su contraseña.",
   "onboarding.form.firstName": "Nombre",
   "onboarding.form.genericError": "Algo salió mal. Intente de nuevo o comuníquese con soporte.",
   "onboarding.form.lastName": "Apellido",

package/src/modules/onboarding/i18n/ko.json

@@ -37,7 +37,6 @@
   "onboarding.email.marketingConsentYes": "마케팅 동의: 예",
   "onboarding.email.preview": "Open Mercato 워크스페이스를 활성화하려면 이메일을 확인하세요",
   "onboarding.email.subject": "온보딩을 완료하려면 이메일을 확인하세요",
-  "onboarding.errors.emailExists": "이미 이 이메일로 등록된 계정이 있습니다. 로그인하거나 비밀번호를 재설정해 보세요.",
   "onboarding.errors.emailInvalid": "유효한 업무용 이메일을 입력하세요.",
   "onboarding.errors.emailSendFailed": "확인 이메일을 보내지 못했습니다. 다시 시도하거나 지원팀에 문의하세요.",
   "onboarding.errors.firstNameRequired": "이름은 필수입니다.",
@@ -45,11 +44,17 @@
   "onboarding.errors.organizationNameRequired": "조직 이름은 필수입니다.",
   "onboarding.errors.passwordMismatch": "비밀번호가 일치해야 합니다.",
   "onboarding.errors.passwordRequired": "비밀번호는 다음 요구 사항을 충족해야 합니다: {requirements}.",
-  "onboarding.errors.pendingRequest": "이미 대기 중인 검증이 있습니다. 약 {minutes}분 후에 다시 시도하거나 관리자에게 문의하세요.",
   "onboarding.errors.termsRequired": "계속하려면 약관에 동의해 주세요.",
+  "onboarding.existingAccountEmail.body": "방금 누군가 이 이메일 주소로 Open Mercato 워크스페이스 생성을 시작했습니다. 이 주소에는 이미 계정이 있어 새 계정을 만들지 않았습니다.",
+  "onboarding.existingAccountEmail.cta": "로그인",
+  "onboarding.existingAccountEmail.footer": "Open Mercato · 온보딩 서비스",
+  "onboarding.existingAccountEmail.greeting": "안녕하세요,",
+  "onboarding.existingAccountEmail.heading": "이미 계정이 있습니다",
+  "onboarding.existingAccountEmail.ignore": "본인이 요청하셨다면 로그인하거나 비밀번호를 재설정하세요. 그렇지 않다면 이 메시지를 무시하셔도 됩니다. 계정에는 아무런 변경이 없습니다.",
+  "onboarding.existingAccountEmail.preview": "누군가 이 이메일 주소로 Open Mercato 워크스페이스를 만들려고 했습니다.",
+  "onboarding.existingAccountEmail.subject": "Open Mercato 계정 안내",
   "onboarding.form.confirmPassword": "비밀번호 확인",
   "onboarding.form.email": "업무용 이메일",
-  "onboarding.form.emailExists": "이미 이 이메일로 등록된 계정이 있습니다. 로그인하거나 비밀번호를 재설정해 보세요.",
   "onboarding.form.firstName": "이름",
   "onboarding.form.genericError": "문제가 발생했습니다. 다시 시도하거나 지원팀에 문의하세요.",
   "onboarding.form.lastName": "성",

package/src/modules/onboarding/i18n/pl.json

@@ -37,7 +37,6 @@
   "onboarding.email.marketingConsentYes": "Zgoda marketingowa: Tak",
   "onboarding.email.preview": "Potwierdź swój email, aby aktywować obszar roboczy Open Mercato",
   "onboarding.email.subject": "Potwierdź swój email, aby dokończyć onboarding",
-  "onboarding.errors.emailExists": "Mamy już konto z tym adresem email. Spróbuj się zalogować lub zresetować hasło.",
   "onboarding.errors.emailInvalid": "Podaj prawidłowy służbowy adres email.",
   "onboarding.errors.emailSendFailed": "Nie udało się wysłać emaila weryfikacyjnego. Spróbuj ponownie lub skontaktuj się z pomocą techniczną.",
   "onboarding.errors.firstNameRequired": "Imię jest wymagane.",
@@ -45,11 +44,17 @@
   "onboarding.errors.organizationNameRequired": "Nazwa organizacji jest wymagana.",
   "onboarding.errors.passwordMismatch": "Hasła muszą się zgadzać.",
   "onboarding.errors.passwordRequired": "Hasło musi spełniać wymagania: {requirements}.",
-  "onboarding.errors.pendingRequest": "Mamy już oczekującą weryfikację. Spróbuj ponownie za około {minutes} minut lub skontaktuj się z administratorem.",
   "onboarding.errors.termsRequired": "Proszę zaakceptować regulamin, aby kontynuować.",
+  "onboarding.existingAccountEmail.body": "Ktoś właśnie użył tego adresu email, aby rozpocząć tworzenie obszaru roboczego Open Mercato. Ten adres ma już konto, więc nie utworzyliśmy nowego.",
+  "onboarding.existingAccountEmail.cta": "Zaloguj się",
+  "onboarding.existingAccountEmail.footer": "Open Mercato · Usługa onboardingu",
+  "onboarding.existingAccountEmail.greeting": "Dzień dobry,",
+  "onboarding.existingAccountEmail.heading": "Masz już konto",
+  "onboarding.existingAccountEmail.ignore": "Jeśli to Ty, zaloguj się lub zresetuj hasło. Jeśli nie, możesz bezpiecznie zignorować tę wiadomość — w Twoim koncie nic się nie zmieniło.",
+  "onboarding.existingAccountEmail.preview": "Ktoś próbował utworzyć obszar roboczy Open Mercato z tym adresem email.",
+  "onboarding.existingAccountEmail.subject": "W sprawie Twojego konta Open Mercato",
   "onboarding.form.confirmPassword": "Potwierdź hasło",
   "onboarding.form.email": "Służbowy email",
-  "onboarding.form.emailExists": "Mamy już konto z tym adresem email. Spróbuj się zalogować lub zresetować hasło.",
   "onboarding.form.firstName": "Imię",
   "onboarding.form.genericError": "Coś poszło nie tak. Spróbuj ponownie lub skontaktuj się z pomocą techniczną.",
   "onboarding.form.lastName": "Nazwisko",

package/src/modules/onboarding/lib/existing-account-notice.ts

@@ -0,0 +1,109 @@
+import { hashForLookup } from '@open-mercato/shared/lib/encryption/aes'
+import { sendEmail } from '@open-mercato/shared/lib/email/send'
+import type { RateLimitConfig } from '@open-mercato/shared/lib/ratelimit/types'
+import ExistingAccountEmail, { type ExistingAccountEmailCopy } from '../emails/ExistingAccountEmail'
+
+/**
+ * Best-effort ten-minute anti-spam window on the notice, backed by `rateLimiterService`.
+ *
+ * The duration matches the window `OnboardingService.createOrUpdateRequest` enforces on
+ * verification emails, but the mechanism is deliberately weaker and must not be read as
+ * equivalent: that window is a database column (`OnboardingRequest.lastEmailSentAt`), which is
+ * authoritative, shared by every process and independent of the rate-limiting configuration.
+ * This one is a limiter counter, so it is per-process under the default `memory` strategy
+ * (`RATE_LIMIT_STRATEGY=redis` restores a shared window across replicas) and absent entirely
+ * when rate limiting is switched off — `RateLimiterService.consume()` returns `allowed: true`
+ * unconditionally while `RATE_LIMIT_ENABLED=false`. An instance exposing self-service
+ * onboarding should therefore keep rate limiting enabled, or the address owner can be mailed
+ * once per accepted submission instead of once per window.
+ *
+ * Failing closed when the limiter is unavailable is not an option here: skipping the send would
+ * make the has-account branch answer 200 while the no-account branch still answers 502 on an
+ * instance with broken mail delivery, which re-opens the enumeration oracle (#5505) the uniform
+ * response shape closes. The window is a spam brake, never a disclosure control.
+ */
+const NOTICE_WINDOW_SECONDS = 10 * 60
+
+const noticeRateLimitConfig: RateLimitConfig = {
+  points: 1,
+  duration: NOTICE_WINDOW_SECONDS,
+  blockDuration: 0,
+  keyPrefix: 'onboarding-existing-account',
+}
+
+export type ExistingAccountNoticeOutcome = 'sent' | 'throttled'
+
+type RateLimiterLike = {
+  consume: (key: string, config: RateLimitConfig) => Promise<{ allowed: boolean }>
+  delete: (key: string, config: RateLimitConfig) => Promise<void>
+}
+
+type ContainerLike = { resolve: (name: string) => unknown }
+
+export type SendExistingAccountNoticeArgs = {
+  container: ContainerLike
+  email: string
+  loginUrl: string
+  subject: string
+  copy: ExistingAccountEmailCopy
+}
+
+/**
+ * The limiter is registered only when rate limiting is configured, so an unregistered token
+ * is a normal deployment state rather than an error. Resolved from the request container
+ * instead of the core bootstrap singleton so this route keeps its lean module graph.
+ *
+ * Returning `null` means the notice is sent unthrottled — the fail-open half of the trade-off
+ * documented on `NOTICE_WINDOW_SECONDS`, chosen because a skipped send would answer differently
+ * from the no-account branch and re-open the enumeration oracle. The same reasoning is why
+ * `consume()`'s `degraded` flag is not read: a degraded limiter still has to send.
+ */
+function resolveRateLimiter(container: ContainerLike): RateLimiterLike | null {
+  try {
+    const resolved = container.resolve('rateLimiterService')
+    if (!resolved || typeof resolved !== 'object') return null
+    const candidate = resolved as Partial<RateLimiterLike>
+    if (typeof candidate.consume !== 'function' || typeof candidate.delete !== 'function') return null
+    return candidate as RateLimiterLike
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Tell the address owner — out of band — that someone tried to create a workspace with an
+ * email that already has an account. The HTTP caller never learns which branch ran, so the
+ * copy carries nothing the submitter supplied (no name, no organization name) and the mail
+ * is the only place the existing account is acknowledged.
+ *
+ * Throws whatever `sendEmail` throws so the caller can answer with the same 502 body the
+ * verification-email branch already returns.
+ */
+export async function sendExistingAccountNotice(
+  args: SendExistingAccountNoticeArgs,
+): Promise<ExistingAccountNoticeOutcome> {
+  const rateLimiterService = resolveRateLimiter(args.container)
+  const throttleKey = hashForLookup(args.email)
+
+  if (rateLimiterService) {
+    const consumed = await rateLimiterService.consume(throttleKey, noticeRateLimitConfig)
+    if (!consumed.allowed) return 'throttled'
+  }
+
+  try {
+    await sendEmail({
+      to: args.email,
+      subject: args.subject,
+      react: ExistingAccountEmail({ loginUrl: args.loginUrl, copy: args.copy }),
+    })
+  } catch (error) {
+    // Release the window the same way the verification branch clears `lastEmailSentAt` on a
+    // failed send, so a retry behaves identically on both branches of a broken-mail instance.
+    if (rateLimiterService) {
+      await rateLimiterService.delete(throttleKey, noticeRateLimitConfig).catch(() => {})
+    }
+    throw error
+  }
+
+  return 'sent'
+}