@vertesia/ui 1.5.0-dev.20260910.052912Z → 1.5.1

package/src/shell/login/SignInPasswordStep.test.tsx

@@ -0,0 +1,71 @@
+import { fireEvent, render, screen, waitFor } from '@testing-library/react';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+const mocks = vi.hoisted(() => ({ signInWithPassword: vi.fn() }));
+
+vi.mock('@vertesia/ui/i18n', () => ({
+    useUITranslation: () => ({ t: (key: string) => key }),
+}));
+
+vi.mock('./signInUtils', () => ({ signInWithPassword: mocks.signInWithPassword }));
+
+const { default: SignInPasswordStep } = await import('./SignInPasswordStep');
+
+const EMAIL = 'claude@reviewers.vertesia.io';
+
+function submitWith(password: string) {
+    fireEvent.change(screen.getByLabelText('auth.password.label'), { target: { value: password } });
+    fireEvent.click(screen.getByRole('button', { name: /auth.password.submit/ }));
+}
+
+describe('SignInPasswordStep', () => {
+    afterEach(() => {
+        mocks.signInWithPassword.mockReset();
+        document.body.innerHTML = '';
+    });
+
+    it('asks for a password before calling sign-in', () => {
+        render(<SignInPasswordStep email={EMAIL} onBack={vi.fn()} />);
+
+        fireEvent.click(screen.getByRole('button', { name: /auth.password.submit/ }));
+
+        expect(screen.getByRole('alert').textContent).toBe('auth.password.required');
+        expect(mocks.signInWithPassword).not.toHaveBeenCalled();
+    });
+
+    it('shows the failure and lets the user retry', async () => {
+        mocks.signInWithPassword.mockResolvedValue({ ok: false, reason: 'invalid-credentials' });
+        render(<SignInPasswordStep email={EMAIL} onBack={vi.fn()} />);
+
+        submitWith('wrong');
+
+        await waitFor(() => expect(screen.getByRole('alert').textContent).toBe('auth.password.invalidCredentials'));
+        expect(mocks.signInWithPassword).toHaveBeenCalledWith(EMAIL, 'wrong');
+        expect((screen.getByRole('button', { name: /auth.password.submit/ }) as HTMLButtonElement).disabled).toBe(
+            false,
+        );
+    });
+
+    // Success hands off to the session's auth-state listener, which unmounts the screen; until then
+    // the button must stay disabled so a second click cannot start a second sign-in.
+    it('keeps the submit disabled after a successful sign-in', async () => {
+        mocks.signInWithPassword.mockResolvedValue({ ok: true });
+        render(<SignInPasswordStep email={EMAIL} onBack={vi.fn()} />);
+
+        submitWith('secret');
+
+        await waitFor(() => expect(mocks.signInWithPassword).toHaveBeenCalledOnce());
+        const submit = screen.getAllByRole('button').find((b) => (b as HTMLButtonElement).type === 'submit');
+        expect((submit as HTMLButtonElement).disabled).toBe(true);
+        expect(screen.queryByRole('alert')).toBeNull();
+    });
+
+    it('returns to the email step from the change link', () => {
+        const onBack = vi.fn();
+        render(<SignInPasswordStep email={EMAIL} onBack={onBack} />);
+
+        fireEvent.click(screen.getByRole('button', { name: 'auth.change' }));
+
+        expect(onBack).toHaveBeenCalledOnce();
+    });
+});

package/src/shell/login/SignInPasswordStep.tsx

@@ -0,0 +1,103 @@
+import { Spinner } from '@vertesia/ui/core';
+import { useUITranslation } from '@vertesia/ui/i18n';
+import { ArrowRight } from 'lucide-react';
+import { useEffect, useRef, useState } from 'react';
+import {
+    SignInEmailRow,
+    SignInPasswordField,
+    SignInStepButton,
+    SignInStepHeader,
+    SignInStepLayout,
+} from './SignInPrimitives';
+import { type PasswordSignInFailure, signInWithPassword } from './signInUtils';
+
+interface SignInPasswordStepProps {
+    email: string;
+    tenantName?: string;
+    onBack: () => void;
+}
+
+/** Password sign-in for an address whose tenant issues passwords instead of federating an IdP. */
+export default function SignInPasswordStep({ email, tenantName, onBack }: SignInPasswordStepProps) {
+    const { t } = useUITranslation();
+    const [password, setPassword] = useState('');
+    const [failure, setFailure] = useState<PasswordSignInFailure | null>(null);
+    const [emptyError, setEmptyError] = useState(false);
+    const [loading, setLoading] = useState(false);
+    const inputRef = useRef<HTMLInputElement>(null);
+
+    useEffect(() => {
+        inputRef.current?.focus();
+    }, []);
+
+    const submit = async (e: React.FormEvent) => {
+        e.preventDefault();
+        if (loading) return;
+        if (!password) {
+            setEmptyError(true);
+            return;
+        }
+        setEmptyError(false);
+        setFailure(null);
+        setLoading(true);
+        const result = await signInWithPassword(email, password);
+        if (!result.ok) {
+            setFailure(result.reason);
+            setLoading(false);
+        }
+        // On success the spinner stays up: the session's auth-state listener finishes the login and
+        // unmounts this screen.
+    };
+
+    // Literal keys, one per failure, so i18next-cli extraction sees every message.
+    const failureMessage = (reason: PasswordSignInFailure) => {
+        switch (reason) {
+            case 'invalid-credentials':
+                return t('auth.password.invalidCredentials');
+            case 'too-many-attempts':
+                return t('auth.password.tooManyAttempts');
+            case 'not-password-tenant':
+                return t('auth.password.notAvailable');
+            case 'failed':
+                return t('auth.password.failed');
+        }
+    };
+    const error = emptyError ? t('auth.password.required') : failure ? failureMessage(failure) : undefined;
+
+    return (
+        <SignInStepLayout>
+            <SignInStepHeader
+                eyebrow={tenantName ?? t('auth.password.eyebrow')}
+                title={t('auth.password.title')}
+                body={t('auth.password.body')}
+            />
+
+            <SignInEmailRow email={email} actionLabel={t('auth.change')} onAction={onBack} />
+
+            <form onSubmit={submit} noValidate className={`flex flex-col ${error ? 'gap-2' : 'gap-6'}`}>
+                <SignInPasswordField
+                    inputRef={inputRef}
+                    label={t('auth.password.label')}
+                    value={password}
+                    onChange={(value) => {
+                        setPassword(value);
+                        if (emptyError) setEmptyError(false);
+                    }}
+                    invalid={!!error}
+                    error={error}
+                />
+
+                <SignInStepButton type="submit" disabled={loading}>
+                    {loading ? (
+                        <Spinner />
+                    ) : (
+                        <>
+                            <span>{t('auth.password.submit')}</span>
+                            <ArrowRight className="!size-3.5" />
+                        </>
+                    )}
+                </SignInStepButton>
+            </form>
+        </SignInStepLayout>
+    );
+}

package/src/shell/login/SignInPrimitives.tsx

@@ -363,6 +363,11 @@ export function SignInOrDivider({ children }: { children: ReactNode }) {
     );
 }
 
+const SIGNIN_INPUT_CLASS =
+    'h-[42px] px-3.5 rounded-md border border-border bg-background text-sm text-foreground placeholder:text-muted ' +
+    'outline-none transition focus:border-info focus:ring-4 focus:ring-info/15 ' +
+    'aria-[invalid=true]:border-destructive aria-[invalid=true]:ring-destructive/15';
+
 interface SignInEmailFieldProps {
     inputRef?: Ref<HTMLInputElement>;
     label: ReactNode;
@@ -393,7 +398,7 @@ export function SignInEmailField({
                 id="vt-login-email"
                 name="vt-login-email"
                 type="email"
-                className="h-[42px] px-3.5 rounded-md border border-border bg-background text-sm text-foreground placeholder:text-muted outline-none transition focus:border-info focus:ring-4 focus:ring-info/15 aria-[invalid=true]:border-destructive aria-[invalid=true]:ring-destructive/15"
+                className={SIGNIN_INPUT_CLASS}
                 placeholder={placeholder}
                 value={value}
                 onChange={(e) => onChange(e.target.value)}
@@ -414,3 +419,50 @@ export function SignInEmailField({
         </div>
     );
 }
+
+interface SignInPasswordFieldProps {
+    inputRef?: Ref<HTMLInputElement>;
+    label: ReactNode;
+    value: string;
+    onChange: (value: string) => void;
+    invalid?: boolean;
+    error?: ReactNode;
+}
+
+/**
+ * Labeled password input with an inline error. Unlike the email field it leaves password managers
+ * enabled: a password account's credential is issued once and is expected to be stored in one.
+ */
+export function SignInPasswordField({
+    inputRef,
+    label,
+    value,
+    onChange,
+    invalid = false,
+    error,
+}: SignInPasswordFieldProps) {
+    return (
+        <div className="flex flex-col gap-1.5">
+            <label htmlFor="vt-login-password" className="text-xs font-medium text-foreground/80">
+                {label}
+            </label>
+            <input
+                ref={inputRef}
+                id="vt-login-password"
+                name="vt-login-password"
+                type="password"
+                className={SIGNIN_INPUT_CLASS}
+                value={value}
+                onChange={(e) => onChange(e.target.value)}
+                aria-invalid={invalid}
+                aria-describedby={error ? 'vt-login-password-error' : undefined}
+                autoComplete="current-password"
+            />
+            {error && (
+                <div id="vt-login-password-error" role="alert" className="text-xs text-destructive">
+                    {error}
+                </div>
+            )}
+        </div>
+    );
+}

package/src/shell/login/SignInProvidersStep.tsx

@@ -1,27 +1,31 @@
 import { useUITranslation } from '@vertesia/ui/i18n';
 import { SignInEmailRow, SignInProviderButton, SignInStepHeader, SignInStepLayout } from './SignInPrimitives';
-import { type ProviderId, providerLabel, startSignIn } from './signInUtils';
+import { type ProviderId, providerLabel, type RedirectProviderId, startSignIn } from './signInUtils';
 
 interface SignInProvidersStepProps {
     email: string;
     onBack: () => void;
     onProviderClicked: (provider: ProviderId) => void;
+    /** The address resolved to a password tenant on retry, so the parent shows the password step. */
+    onPasswordRequired: (email: string) => void;
     redirectTo?: string;
 }
 
-const PROVIDERS: ProviderId[] = ['google', 'github', 'microsoft'];
+const PROVIDERS: RedirectProviderId[] = ['google', 'github', 'microsoft'];
 
 export default function SignInProvidersStep({
     email,
     onBack,
     onProviderClicked,
+    onPasswordRequired,
     redirectTo,
 }: SignInProvidersStepProps) {
     const { t } = useUITranslation();
 
-    const pick = async (provider: ProviderId) => {
+    const pick = async (provider: RedirectProviderId) => {
         onProviderClicked(provider);
-        await startSignIn(provider, email, redirectTo);
+        const result = await startSignIn(provider, email, redirectTo);
+        if (!result.ok && result.reason === 'password-required') onPasswordRequired(email);
     };
 
     return (

package/src/shell/login/SignInReturningStep.tsx

@@ -21,6 +21,8 @@ interface SignInReturningStepProps {
     session: LastSuccessfulLogin;
     onNotYou: () => void;
     onProviderClicked: (provider: ProviderId) => void;
+    /** The address signs in with a password, so the parent shows the password step instead. */
+    onPasswordRequired: (email: string) => void;
     redirectTo?: string;
 }
 
@@ -28,6 +30,7 @@ export default function SignInReturningStep({
     session,
     onNotYou,
     onProviderClicked,
+    onPasswordRequired,
     redirectTo,
 }: SignInReturningStepProps) {
     const { t } = useUITranslation();
@@ -36,14 +39,23 @@ export default function SignInReturningStep({
     const avatar = <SignInInitialsBadge initials={emailInitial(session.email)} />;
     // A stored tenantName means we resolved the user's organization.
     const hasTenant = !!session.tenantName;
+    const lastProvider = session.lastProvider;
     const primaryLabel =
-        session.lastProvider === 'oidc'
-            ? t('auth.continueWithSignIn')
-            : t('auth.continueWithProvider', { provider: providerLabel(session.lastProvider) });
+        lastProvider === 'password'
+            ? t('auth.password.continue')
+            : lastProvider === 'oidc'
+              ? t('auth.continueWithSignIn')
+              : t('auth.continueWithProvider', { provider: providerLabel(lastProvider) });
 
-    const continueWith = async (provider: ProviderId) => {
-        onProviderClicked(provider);
-        await startSignIn(provider, session.email, redirectTo);
+    const continueWithLastProvider = async () => {
+        if (lastProvider === 'password') {
+            onPasswordRequired(session.email);
+            return;
+        }
+        onProviderClicked(lastProvider);
+        // The stored provider can be stale: the address may now resolve to a password tenant.
+        const result = await startSignIn(lastProvider, session.email, redirectTo);
+        if (!result.ok && result.reason === 'password-required') onPasswordRequired(session.email);
     };
 
     return (
@@ -76,9 +88,9 @@ export default function SignInReturningStep({
 
             <div className="flex flex-col gap-2">
                 <SignInProviderButton
-                    provider={session.lastProvider}
+                    provider={lastProvider}
                     label={primaryLabel}
-                    onClick={() => continueWith(session.lastProvider)}
+                    onClick={continueWithLastProvider}
                     variant="filled"
                 />
                 <SignInStepButton variant="ghost" onClick={onNotYou}>

package/src/shell/login/SignInTenantStep.tsx

@@ -8,13 +8,15 @@ import {
     SignInStepLayout,
 } from './SignInPrimitives';
 import SignInWithProviderButton from './SignInWithProviderButton';
-import { type ProviderId, providerLabel } from './signInUtils';
+import { providerLabel, type RedirectProviderId } from './signInUtils';
 
 interface SignInTenantStepProps {
     email: string;
     tenant: TenantInfo;
     onBack: () => void;
     onProviderClicked: () => void;
+    /** The tenant re-resolved as a password tenant, so the parent shows the password step. */
+    onPasswordRequired: (email: string) => void;
     redirectTo?: string;
 }
 
@@ -32,12 +34,13 @@ export default function SignInTenantStep({
     tenant,
     onBack,
     onProviderClicked,
+    onPasswordRequired,
     redirectTo,
 }: SignInTenantStepProps) {
     const { t } = useUITranslation();
     const tenantName = tenant.label || tenant.name || t('auth.blocked.tenantFallback');
     // Brands keep their identity; anything else routes through OIDC.
-    const provider: ProviderId =
+    const provider: RedirectProviderId =
         tenant.provider === 'google' || tenant.provider === 'github' || tenant.provider === 'microsoft'
             ? tenant.provider
             : 'oidc';
@@ -68,6 +71,7 @@ export default function SignInTenantStep({
                     redirectTo={redirectTo}
                     variant="filled"
                     onClick={onProviderClicked}
+                    onPasswordRequired={() => onPasswordRequired(email)}
                 />
                 <SignInStepButton variant="ghost" onClick={onBack}>
                     {t('auth.tenant.notPartOf', { name: tenantName })}

package/src/shell/login/SignInWithProviderButton.tsx

@@ -1,15 +1,17 @@
 import { useUITranslation } from '@vertesia/ui/i18n';
 import { SignInProviderButton } from './SignInPrimitives';
-import { type ProviderId, providerLabel, startSignIn, startSignInWithoutTenant } from './signInUtils';
+import { providerLabel, type RedirectProviderId, startSignIn, startSignInWithoutTenant } from './signInUtils';
 
 interface SignInWithProviderButtonProps {
-    provider: ProviderId;
+    provider: RedirectProviderId;
     /** Email for the tenant-aware flow. Omit for a no-tenant sign-in (e.g. SignInModal). */
     email?: string;
     redirectTo?: string;
     variant?: 'outline' | 'filled';
     /** Fired on click, before the redirect. */
     onClick?: () => void;
+    /** Fired instead of a redirect when the email resolves to a password tenant. */
+    onPasswordRequired?: () => void;
 }
 
 // "Continue with <provider>" button that owns its sign-in redirect.
@@ -19,6 +21,7 @@ export default function SignInWithProviderButton({
     redirectTo,
     variant = 'outline',
     onClick,
+    onPasswordRequired,
 }: SignInWithProviderButtonProps) {
     const { t } = useUITranslation();
     const label =
@@ -26,15 +29,16 @@ export default function SignInWithProviderButton({
             ? t('auth.continueWithSignIn')
             : t('auth.continueWithProvider', { provider: providerLabel(provider) });
 
-    const signIn = () => {
+    const signIn = async () => {
         onClick?.();
-        if (email) {
-            void startSignIn(provider, email, redirectTo);
-        } else {
+        if (!email) {
             // OIDC needs a resolved tenant; the no-email path is only hit by no-tenant buttons.
             startSignInWithoutTenant(provider, redirectTo);
+            return;
         }
+        const result = await startSignIn(provider, email, redirectTo);
+        if (!result.ok && result.reason === 'password-required') onPasswordRequired?.();
     };
 
-    return <SignInProviderButton provider={provider} label={label} onClick={signIn} variant={variant} />;
+    return <SignInProviderButton provider={provider} label={label} onClick={() => void signIn()} variant={variant} />;
 }

package/src/shell/login/SigninScreen.tsx

@@ -15,6 +15,7 @@ import {
 import { useCallback, useEffect, useState } from 'react';
 import SignInAuthPending from './SignInAuthPending';
 import SignInEmailStep, { type TenantInfo } from './SignInEmailStep';
+import SignInPasswordStep from './SignInPasswordStep';
 import SignInProvidersStep from './SignInProvidersStep';
 import SignInRecoveryStep, { type SignInRecoveryKind } from './SignInRecoveryStep';
 import SignInRestrictedEnvStep from './SignInRestrictedEnvStep';
@@ -79,6 +80,7 @@ type Mode =
     | 'email'
     | 'providers'
     | 'tenant'
+    | 'password'
     | 'blocked'
     | 'returning'
     | 'pending'
@@ -185,7 +187,13 @@ function SigninScreenImpl({
     const onProceedFromEmail = useCallback((e: string, t: TenantInfo | undefined) => {
         setEmail(e);
         setTenant(t);
-        setMode(t ? 'tenant' : 'providers');
+        // A password tenant has no identity provider to pick; ask for its password directly.
+        setMode(t?.provider === 'password' ? 'password' : t ? 'tenant' : 'providers');
+    }, []);
+
+    const onPasswordRequired = useCallback((e: string) => {
+        setEmail(e);
+        setMode('password');
     }, []);
 
     const onBack = useCallback(() => {
@@ -336,6 +344,14 @@ function SigninScreenImpl({
         );
     } else if (mode === 'signup' && !localStorage.getItem('tenantName')) {
         content = <SignupForm onSignup={onSignup} goBack={startOver} />;
+    } else if (mode === 'password' && email) {
+        content = (
+            <SignInPasswordStep
+                email={email}
+                tenantName={tenant?.label || tenant?.name || storedSession?.tenantName || undefined}
+                onBack={onBack}
+            />
+        );
     } else if (mode === 'tenant' && tenant) {
         content = (
             <SignInTenantStep
@@ -343,13 +359,26 @@ function SigninScreenImpl({
                 tenant={tenant}
                 onBack={onBack}
                 onProviderClicked={() => onProviderClicked((tenant.provider ?? 'oidc') as ProviderId)}
+                onPasswordRequired={onPasswordRequired}
             />
         );
     } else if (mode === 'providers') {
-        content = <SignInProvidersStep email={email} onBack={onBack} onProviderClicked={onProviderClicked} />;
+        content = (
+            <SignInProvidersStep
+                email={email}
+                onBack={onBack}
+                onProviderClicked={onProviderClicked}
+                onPasswordRequired={onPasswordRequired}
+            />
+        );
     } else if (mode === 'returning' && storedSession) {
         content = (
-            <SignInReturningStep session={storedSession} onNotYou={onNotYou} onProviderClicked={onProviderClicked} />
+            <SignInReturningStep
+                session={storedSession}
+                onNotYou={onNotYou}
+                onProviderClicked={onProviderClicked}
+                onPasswordRequired={onPasswordRequired}
+            />
         );
     } else {
         content = <SignInEmailStep initialEmail={email} onProceed={onProceedFromEmail} />;

package/src/shell/login/signInPassword.test.ts

@@ -0,0 +1,133 @@
+import { FirebaseError } from 'firebase/app';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+const mocks = vi.hoisted(() => ({
+    auth: { tenantId: null as string | null },
+    setFirebaseTenant: vi.fn(),
+    signInWithEmailAndPassword: vi.fn(),
+    signInWithRedirect: vi.fn(),
+}));
+
+vi.mock('@vertesia/ui/session', () => ({
+    getFirebaseAuth: () => mocks.auth,
+    setFirebaseTenant: mocks.setFirebaseTenant,
+}));
+
+vi.mock('firebase/auth', async (importOriginal) => ({
+    ...(await importOriginal<typeof import('firebase/auth')>()),
+    signInWithEmailAndPassword: mocks.signInWithEmailAndPassword,
+    signInWithRedirect: mocks.signInWithRedirect,
+}));
+
+const { passwordFailureReason, readPendingSignin, signInWithPassword, startSignIn } = await import('./signInUtils');
+
+const PASSWORD_TENANT = {
+    label: 'Vertesia Reviewers',
+    name: 'reviewers',
+    firebaseTenantId: 'reviewers-abc12',
+    provider: 'password',
+    domain: ['reviewers.vertesia.io'],
+};
+const OIDC_TENANT = { ...PASSWORD_TENANT, label: 'Acme', name: 'acme', provider: 'oidc', domain: ['acme.com'] };
+const EMAIL = 'claude@reviewers.vertesia.io';
+
+describe('passwordFailureReason', () => {
+    // One answer for every credential failure, so the form cannot be used to probe which
+    // addresses exist or are disabled.
+    it.each([
+        'auth/invalid-credential',
+        'auth/wrong-password',
+        'auth/user-not-found',
+        'auth/user-disabled',
+        'auth/invalid-email',
+    ])('folds %s into invalid-credentials', (code) => {
+        expect(passwordFailureReason(new FirebaseError(code, code))).toBe('invalid-credentials');
+    });
+
+    it('reports throttling separately', () => {
+        expect(passwordFailureReason(new FirebaseError('auth/too-many-requests', 'throttled'))).toBe(
+            'too-many-attempts',
+        );
+    });
+
+    it('treats anything else as a generic failure', () => {
+        expect(passwordFailureReason(new FirebaseError('auth/network-request-failed', 'offline'))).toBe('failed');
+        expect(passwordFailureReason(new Error('boom'))).toBe('failed');
+        expect(passwordFailureReason(undefined)).toBe('failed');
+    });
+});
+
+describe('signInWithPassword', () => {
+    beforeEach(() => {
+        mocks.setFirebaseTenant.mockReset();
+        mocks.signInWithEmailAndPassword.mockReset();
+        mocks.signInWithRedirect.mockReset();
+    });
+
+    afterEach(() => {
+        sessionStorage.clear();
+        localStorage.clear();
+    });
+
+    it('signs a password-tenant user in place and records the pending sign-in', async () => {
+        mocks.setFirebaseTenant.mockResolvedValue(PASSWORD_TENANT);
+        mocks.signInWithEmailAndPassword.mockResolvedValue({});
+
+        await expect(signInWithPassword(EMAIL, 'secret')).resolves.toEqual({ ok: true });
+
+        expect(mocks.setFirebaseTenant).toHaveBeenCalledWith(EMAIL);
+        expect(mocks.signInWithEmailAndPassword).toHaveBeenCalledWith(mocks.auth, EMAIL, 'secret');
+        expect(readPendingSignin()).toEqual({
+            email: EMAIL,
+            provider: 'password',
+            tenantName: 'Vertesia Reviewers',
+        });
+        expect(mocks.signInWithRedirect).not.toHaveBeenCalled();
+    });
+
+    // The password form is reachable only through tenant resolution, but the helper re-checks: an
+    // address that resolves to a federated tenant must never be offered a password.
+    it('refuses an address whose tenant is not a password tenant', async () => {
+        mocks.setFirebaseTenant.mockResolvedValue(OIDC_TENANT);
+
+        await expect(signInWithPassword('someone@acme.com', 'secret')).resolves.toEqual({
+            ok: false,
+            reason: 'not-password-tenant',
+        });
+        expect(mocks.signInWithEmailAndPassword).not.toHaveBeenCalled();
+    });
+
+    it('fails without signing in when the tenant cannot be resolved', async () => {
+        mocks.setFirebaseTenant.mockResolvedValue(undefined);
+
+        await expect(signInWithPassword(EMAIL, 'secret')).resolves.toEqual({ ok: false, reason: 'failed' });
+        expect(mocks.signInWithEmailAndPassword).not.toHaveBeenCalled();
+    });
+
+    it('clears the pending sign-in when Firebase rejects the credential', async () => {
+        mocks.setFirebaseTenant.mockResolvedValue(PASSWORD_TENANT);
+        mocks.signInWithEmailAndPassword.mockRejectedValue(new FirebaseError('auth/invalid-credential', 'bad'));
+
+        await expect(signInWithPassword(EMAIL, 'wrong')).resolves.toEqual({
+            ok: false,
+            reason: 'invalid-credentials',
+        });
+        expect(readPendingSignin()).toBeNull();
+    });
+});
+
+describe('startSignIn', () => {
+    beforeEach(() => {
+        mocks.setFirebaseTenant.mockReset();
+        mocks.signInWithRedirect.mockReset();
+    });
+
+    // A returning session's stored provider can go stale; a password tenant has nowhere to redirect.
+    it('does not redirect when the address resolves to a password tenant', async () => {
+        mocks.setFirebaseTenant.mockResolvedValue(PASSWORD_TENANT);
+
+        await expect(startSignIn('google', EMAIL)).resolves.toEqual({ ok: false, reason: 'password-required' });
+        expect(mocks.signInWithRedirect).not.toHaveBeenCalled();
+        expect(readPendingSignin()).toBeNull();
+    });
+});