From ef83ce4452a8ba0567155e1e9b24d44bcd0703a8 Mon Sep 17 00:00:00 2001
From: hamed <15238-genius.ha@users.noreply.drupalcode.org>
Date: Sun, 19 Jul 2026 19:02:05 +0330
Subject: [PATCH] feat: enhance login error handling to differentiate between
 staff-only and wrong password errors

---
 .claude/skills/qa-clinicpro/driver.mjs | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/.claude/skills/qa-clinicpro/driver.mjs b/.claude/skills/qa-clinicpro/driver.mjs
index f9734f70..cfacc455 100644
--- a/.claude/skills/qa-clinicpro/driver.mjs
+++ b/.claude/skills/qa-clinicpro/driver.mjs
@@ -113,8 +113,12 @@ async function login(role) {
   const j = await r.json();
   if (j.access_token) return j;
 
-  // ERR_AUTH_006 here means "staff-only endpoint", not "wrong password".
-  if (j?.errors?.some((e) => e.code === 'ERR_AUTH_006')) {
+  // ERR_AUTH_006 means "staff-only endpoint", not "wrong password".
+  // ERR_AUTH_005 IS "wrong password" — expected whenever the local DB was
+  // replaced by a production dump, which brings its own hashes and drops the
+  // QA accounts' passwords. OTP still authenticates those users, so fall
+  // through to it rather than failing the whole run.
+  if (j?.errors?.some((e) => e.code === 'ERR_AUTH_006' || e.code === 'ERR_AUTH_005')) {
     const o = await otpLogin(mobile_number).catch((e) => ({ _err: e.message }));
     if (o.access_token) return o;
     // send-code is capped at 5/hour/IP; once burned, mint the JWT with the app's