Mobile sign-in: a person who has to verify their email during the hand-off gets a mail link to 页面不存在, and the verify page drops the refusal time #30157

domain:server#2 · hotlong · session_c967d7a472b0485c94711bfcb22159c8

Category: ① product defect with a named location.

Business reason: a new user who signs up during the mobile sign-in (the system auth session, objectstack-ai/mobile#148), on a server that requires email verification, gets a verification mail whose link lands on 页面不存在. The mail is the only road back, so that person cannot finish signing in from it. Nobody is hitting this yet, because no released app uses the flow; it would start when one does.

Reader: domain:ui, one PR on ui/apps/console/src/pages/auth/. objectstack-ai/mobile#190 is the first consumer.

Duplicate search: withConsoleBaseRootRelative in issues (0 hits) and verify-email-prompt redirect handoff (2 hits, #29997 and a closed QA run, neither about this).

reach: read from the code on origin/main, not run end to end. First touch should measure it. The helper's wrong answer for this kind of path was measured in the browser on #29971, which is the same defect in a sibling path. Found by the contract review of PR #30010 (comment on that PR, head 3e59db0af0).

1. The verification mail's link

RegisterPage.tsx (verificationCallbackURL) and VerifyEmailPromptPage.tsx (callbackURL) send a safe redirect through withConsoleBaseRootRelative, which treats every redirect as a Console route. For a hand-off redirect that gives /_console/api/v1/auth/one-time-token/handoff?…, a page that does not exist.

Not just a prefix fix. Which browser opens that mail matters. It is usually not the system auth session the app is waiting on, and a token handed out there may have no app waiting for it. So the right callback is a product question: decide what a person who verifies by mail should see. Fix the dead end at minimum, and say in the PR what the chosen answer does.

2. The refusal time is dropped on this road

PR #30010 carries handoff_refused_at on the links between /login and /register, through handoffMarkQuery. Three hops still drop it: LoginPage's EMAIL_NOT_VERIFIED branch, RegisterPage's onVerificationRequired (each builds the query from email and redirect), and VerifyEmailPromptPage.handleBackToLogin (rebuilds /login?redirect=).

A person with an old session on a device whose clock is behind who takes this road is judged by the age check alone and forwarded into the route's 401 JSON. It stops and cannot loop. It needs several conditions at once, so it is the smaller half.

Acceptance notes

• Depends on PR feat(plugin-auth): a page navigation to the mobile hand-off that has to sign in first goes to the sign-in page #30010 for handoffMarkQuery and the mark; start after it lands.
• A test per hop, with a control that a non-hand-off redirect keeps today's links byte for byte.
• A browser check of the mail's link for the case above.
• This is a session-transfer flow: the maintainer reviews and merges.

Related: objectstack-ai/mobile#148. Not a blocker of it: a Google sign-in should not take this road (not measured), and a person verifying by email is the case affected.