(bug) Resending a one-time login code after the flow expires reports HTTP 200 and a generic failure

[mmabrouk]

When I sit on the login code-entry screen past the flow's lifetime and click "Resend one-time password", the request to /api/auth/signinup/code/resend returns HTTP 200 with body {"status":"RESTART_FLOW_ERROR"}, no email is sent, and the UI shows only "Resend OTP failed. Please try again." Nothing tells me the login attempt expired or that I need to start over; the control that actually recovers the flow is the unlabeled "Continue with OTP" button behind it.

Steps to reproduce:

1. Request a login code, wait ~45 minutes without entering it.
2. Click "Resend one-time password".
3. Observe the 200 + RESTART_FLOW_ERROR response, no email, and the generic failure message.

Seen on staging v0.107.0 during release QA (2026-08-02); auth flow predates the release.

[linear-code]

AGE-4053

[dosubot]

Looking at the code, the resendOTP handler in SendOTP/index.tsx does handle RESTART_FLOW_ERROR inside the try block — it clears the login attempt info and sets isLoginCodeVisible back to false to navigate to the email screen [1]. So the recovery path is wired up, but the issue is the user-facing message:

if (response.status === "RESTART_FLOW_ERROR") {
    setMessage({
        message: "Resend OTP failed. Please try again",
        type: "error",
    })
    clearLoginAttemptInfo()
    setIsLoginCodeVisible(false)
}

Two problems here:

1. The error message is misleading. "Resend OTP failed. Please try again" implies a transient failure. It should say something like "Your login session has expired. Please enter your email to start again." so the user understands what happened and what the redirect back to the email screen means.

2. The message may flash and disappear. Because setIsLoginCodeVisible(false) fires immediately after setMessage(...), the component unmounts and navigates back to the email entry screen — meaning the user likely never reads the error toast before it's gone. The redirect itself is correct, but the UX is jarring without an explanation on the destination screen.

A fix would involve either showing the explanatory message on the email-entry screen after redirect, or adding a brief delay/confirmation before navigating away.

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.

[HurrairaBaloch]

I'd like to work on this. I'll keep the expired-flow recovery explicit: preserve a clear session-expired message on the email-entry screen after RESTART_FLOW_ERROR, avoid a misleading transient-error message, and add focused coverage for the resend path before opening a PR.

[HurrairaBaloch]

I’m withdrawing from this issue, so it is available for another contributor.