From 1f74dab346368acebb0e492c87b3b01d06acdc5e Mon Sep 17 00:00:00 2001
From: sacha <sacha.memmi@reach5.co>
Date: Mon, 8 Sep 2025 15:53:37 +0200
Subject: [PATCH] Prevent login from unverified identifier during signup

---
 src/main/models.ts         | 2 +-
 src/main/oAuthClient.ts    | 5 ++++-
 src/main/webAuthnClient.ts | 5 ++++-
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/src/main/models.ts b/src/main/models.ts
index 87b1480..9d7c515 100644
--- a/src/main/models.ts
+++ b/src/main/models.ts
@@ -270,7 +270,7 @@ export type SessionInfo = {
 
 export type OrchestrationToken = string
 
-export type AuthenticationToken = { tkn: string, mfaRequired?: boolean }
+export type AuthenticationToken = { tkn?: string, mfaRequired?: boolean }
 
 export type PasswordlessResponse = MFA.ChallengeId
 
diff --git a/src/main/oAuthClient.ts b/src/main/oAuthClient.ts
index 807286a..cec825a 100644
--- a/src/main/oAuthClient.ts
+++ b/src/main/oAuthClient.ts
@@ -498,7 +498,10 @@ export default class OAuthClient {
               }
             })
             .then(tkn => this.storeCredentialsInBrowser(loginParams).then(() => tkn))
-            .then(tkn => this.loginCallback(tkn, auth))
+            .then(tkn => {
+              if(tkn.tkn == undefined) return Promise.resolve({})
+              else return this.loginCallback(tkn, auth)
+            })
 
     return resultPromise.catch(err => {
       if (err.error) {
diff --git a/src/main/webAuthnClient.ts b/src/main/webAuthnClient.ts
index 0e31358..7ebea1a 100644
--- a/src/main/webAuthnClient.ts
+++ b/src/main/webAuthnClient.ts
@@ -269,7 +269,10 @@ export default class WebAuthnClient {
                 webauthnId: registrationOptions.options.publicKey.user.id
               }
             })
-            .then((tkn) => this.oAuthClient.loginCallback(tkn, auth))
+            .then((tkn) => {
+              if(tkn.tkn == undefined) return Promise.resolve({})
+              else return this.oAuthClient.loginCallback(tkn, auth)
+            })
         })
         .catch((err) => {
           if (err.error) this.eventManager.fireEvent('login_failed', err)