hcengineering / hcengineering/platform
UX: "Change password" silently fails for Google/GitHub SSO-only accounts
- Dominant language
- TypeScript
- Stars
- 27.7k
- Forks
- 2.2k
- PR merge metrics
- No merged PRs in 30d
Description
## Summary
For accounts created exclusively via Google or GitHub SSO (no email+password identity), the **Settings → Change password** form accepts input and shows no error, but the password is never activated for direct email+password login. The user has no indication that the operation did nothing useful.
## Steps to reproduce
1. Create a huly.app account using **Sign in with Google** (never set a password)
2. Go to **Settings → Change password**
3. Leave "Current password" blank, enter a new password twice, click **Save**
4. Try to sign in at huly.app with your email + that password
5. Login fails silently (API returns `platform:status:AccountNotFound`)
## Expected behaviour
One of:
- **Option A:** The form succeeds and actually enables email+password login for the account (links the email identity with a password).
- **Option B:** The form shows a clear message: *"Your account uses Google login. To set a password, you must first verify your email via a one-time code."* and redirects to the OTP flow.
## Actual behaviour
- The form accepts the input with no error
- Email+password login still fails with `AccountNotFound`
- The only working login path for SSO users is the OTP flow (`loginOtp` → `validateOtp`), but there is no UI hint pointing to this
## Impact
- Confusing for developers and power users trying to use API/CLI tooling (e.g. MCP servers, import scripts) that authenticate with email+password
- No error feedback means users waste time debugging what appears to be a valid credential
## Environment
- huly.app (cloud)
- Account type: Google SSO only
- Observed via the `@hcengineering/account-client` SDK (`login(email, password)` returns `AccountNotFound`)
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.