@W-20890250 Handle request limit and monthly quota error states for passwordless and reset password by hajinsuha1 · Pull Request #3574 · SalesforceCommerceCloud/pwa-kit

hajinsuha1 · 2026-01-14T16:53:03Z

Description

Adds a new "Too many requests" error message when /passwordless/login or /password/reset return a 400 response:

{
  "status_code" : "400 BAD_REQUEST",
  "message" : "Too many login requests were made. Please try again later."
}

/passwordless/login returns too many requests error:

/password/reset returns too many requests error:

Also updated Email Confirmation page to display errors if form has any set. This ensures if the "Too many requests" error is returned, when a user spams the "Resend Link" button, the error is displayed.

Full list of API error to UI error message mapping can be found here

Types of Changes

Bug fix (non-breaking change that fixes an issue)
New feature (non-breaking change that adds functionality)
Documentation update
Breaking change (could cause existing functionality to not work as expected)
Other changes (non-breaking changes that does not fit any of the above)

Breaking changes include:

Removing a public function or component or prop

Adding a required argument to a function

Changing the data type of a function parameter or return value

Adding a new peer dependency to package.json

Changes

display errors in Email Confirmation page
added new auth-utils.js that contains utility methods for mapping passwordless and reset password API error messages to user-friendly error messages
added mapping of the following API error messages:
- "no callback_uri is registered for client" -> "This feature is not currently available"
- "Too many login requests were made. Please try again later." -> Too many requests. For your security, please wait 10 ** minutes before trying again.
- "Monthly quota for passwordless login mode email has been exceeded" -> "This feature is not currently available"

How to Test-Drive This PR

Too many requests error

Navigate to https://wasatch-mrt-feature-private.mrt-storefront-staging.com/us/en-us
Open the developer console
Click on the profile icon on the top right, enter your email, click the Continue button. Then click Resend Link button 6 times in 10 minutes.
Verify Too many requests. For your security, please wait 10 minutes before trying again. error is displayed
Close and reopen the auth modal, enter your email, click the Continue button.
Verify Too many requests. For your security, please wait 10 minutes before trying again. error is displayed
Click Password button, click Forgot Password link. Click Reset Password and repeat this 3 more times to trigger the too many requests error
Verify Too many requests. For your security, please wait 10 minutes before trying again. error is displayed
Repeat these steps in the login page: https://wasatch-mrt-feature-private.mrt-storefront-staging.com/us/en-us/login

`no callback_uri is registered for client` error

Navigate to https://wasatch-mrt-passwordless-poc.mrt-storefront-staging.com/us/en-us
Click on the profile icon on the top right, enter your email, click the Continue button.
Verify This feature is not currently available. error is displayed
Click Password button, click Forgot Password link. Click Reset Password.
Verify This feature is not currently available. error is displayed
Repeat these steps in the login page: https://wasatch-mrt-passwordless-poc.mrt-storefront-staging.com/us/en-us/login

Checklists

General

Changes are covered by test cases
CHANGELOG.md updated with a short description of changes (not required for documentation updates)

Accessibility Compliance

You must check off all items in one of the follow two lists:

There are no changes to UI

or...

Changes were tested with a Screen Reader (iOS VoiceOver or Android Talkback) and had no issues
Changes comply with WCAG 2.0 guidelines levels A and AA
Changes to common UI patterns and interactions comply with WAI-ARIA best practices

Localization

Changes include a UI text update in the Retail React App (which requires translation)

…, update Commerce API parameters to test with staging-001" This reverts commit 66bcafa.

…rror message for "too many requests" errors

…swordlessLogin and getPasswordResetToken errors

cc-prodsec · 2026-01-14T16:53:14Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

…ail mode, update Commerce API parameters to test with staging-001"" This reverts commit bf61c9b.

…etPassword

…or messages and add corresponding unit test

hajinsuha1 · 2026-01-14T21:22:32Z

packages/commerce-sdk-react/src/auth/index.ts

+        const res = await slasClient.getPasswordResetToken(options, true)
+        if (res && res.status !== 200) {
+            const errorData = await res.json()
+            throw new Error(`${res.status} ${String(errorData.message)}`)
+        }


calling getPasswordResetToken(options, true) returns the rawResponse which was need to pass the error message to retail-react-app for determining which error message to display

hajinsuha1 · 2026-01-14T21:26:09Z

packages/template-retail-react-app/app/components/email-confirmation/index.jsx

+                    {form.formState.errors?.global && (
+                        <Alert status="error">
+                            <AlertIcon color="red.500" boxSize={4} />
+                            <Text fontSize="sm" ml={3}>
+                                {form.formState.errors.global.message}
+                            </Text>
+                        </Alert>
+                    )}


This has been added to the email confirmation page now that we need to display a "Too many requests" error

hajinsuha1 · 2026-01-14T21:27:21Z

packages/template-retail-react-app/app/constants.js

    SOCIAL: 'social'
 }

-export const PASSWORDLESS_ERROR_MESSAGES = [


this has been moved to auth-utils.js above and renamed to PASSWORDLESS_FEATURE_UNAVAILABLE_ERRORS as it is only used there

hajinsuha1 added 3 commits January 13, 2026 13:01

Reapply "Enable SLAS private client and passwordless login email mode…

bf61c9b

…, update Commerce API parameters to test with staging-001" This reverts commit 66bcafa.

Enhance error handling for password reset functionality and add new e…

ceb2b79

…rror message for "too many requests" errors

create getTokenBasedAuthErrorMessage util and use it for authorizePas…

ec15311

…swordlessLogin and getPasswordResetToken errors

hajinsuha1 added 4 commits January 14, 2026 11:53

Revert "Reapply "Enable SLAS private client and passwordless login em…

6167eb8

…ail mode, update Commerce API parameters to test with staging-001"" This reverts commit bf61c9b.

split error message utility into one for passwordless and one for res…

c4e15b1

…etPassword

add unit tests

e8dc05e

Enhance PasswordlessEmailConfirmation component to display global err…

ab643f5

…or messages and add corresponding unit test

hajinsuha1 commented Jan 14, 2026

View reviewed changes

changelog updates and translations

4620ff0

hajinsuha1 marked this pull request as ready for review January 15, 2026 15:01

hajinsuha1 requested a review from a team as a code owner January 15, 2026 15:01

yunakim714 approved these changes Jan 15, 2026

View reviewed changes

hajinsuha1 merged commit 3d79932 into feature/email-otp Jan 16, 2026
42 checks passed

hajinsuha1 deleted the W-20890250-handle-error-states-passwordless-and-reset-password branch January 16, 2026 14:43

hajinsuha1 mentioned this pull request Jan 16, 2026

Feature: Passwordless Login and Password Reset supports use of email mode #3525

Merged

12 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

@W-20890250 Handle request limit and monthly quota error states for passwordless and reset password#3574

@W-20890250 Handle request limit and monthly quota error states for passwordless and reset password#3574
hajinsuha1 merged 8 commits intofeature/email-otpfrom
W-20890250-handle-error-states-passwordless-and-reset-password

hajinsuha1 commented Jan 14, 2026 •

edited

Loading

Uh oh!

cc-prodsec commented Jan 14, 2026 •

edited

Loading

Uh oh!

hajinsuha1 Jan 14, 2026 •

edited

Loading

Uh oh!

hajinsuha1 Jan 14, 2026

Uh oh!

hajinsuha1 Jan 14, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

hajinsuha1 commented Jan 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Types of Changes

Changes

How to Test-Drive This PR

Too many requests error

no callback_uri is registered for client error

Checklists

General

Accessibility Compliance

Localization

Uh oh!

cc-prodsec commented Jan 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

hajinsuha1 Jan 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

hajinsuha1 Jan 14, 2026

Choose a reason for hiding this comment

Uh oh!

hajinsuha1 Jan 14, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

hajinsuha1 commented Jan 14, 2026 •

edited

Loading

`no callback_uri is registered for client` error

cc-prodsec commented Jan 14, 2026 •

edited

Loading

hajinsuha1 Jan 14, 2026 •

edited

Loading