fix: unbreak the invitation flow and email-shaped-username login

[otavio]

What

Fixes the three defects behind a customer being unable to accept a workspace invitation, and unblocks the 149 production accounts whose username is an email address.

Why

The customer's browser showed the top-level ErrorBoundary on /accept-invite:

Failed to execute 'insertBefore' on 'Node': The node before which the new node is to be inserted is not a child of this node.

The backend was healthy — the user was confirmed, the invitation pending and unexpired, the cache entry present. The failure was in the browser, and separately in login identifier resolution.

Changes

• ui, translation opt-out: translate="no" plus <meta name="google" content="notranslate"> on the console, its migrate entry, and the website. Chrome's auto-translation moves each text node into a <font> wrapper; the node survives, so React keeps writing to it, but it is no longer a child of the parent React recorded. The next insertBefore or removeChild throws NotFoundError. Nothing in ui/ used the HTML translate attribute, so the opt-out breaks no intentional per-element usage.

• ui, bare text nodes: wrapped the bare text in the AcceptInvite and Login alert subtrees in <span>. React materialises a text node as a fiber only when text and elements are siblings; such a node is fatal under a translated DOM whenever React must insert a sibling before it or remove it. An element anchor survives translation.

• server, identifier resolution: AuthLocalUser now tries the email column first and falls back to the username column. The username rule in pkg/validator has always permitted @ (^([a-z0-9-_.@]){3,32}$), so an email-shaped identifier is not necessarily an email. Resolving only by email returned a permanent 401. The rule is extracted to store.UserResolveByAuthIdentifier because cloud repeats it in three recovery flows.

• website: added the missing src/vite-env.d.ts so tsc -b resolves the ?raw import the new test needs.

Testing

simulateBrowserTranslation() (src/tests/simulateBrowserTranslation.ts) reproduces Chrome's rewrite in jsdom. The AcceptInvite test fails on the unpatched page with NotFoundError: The node to be removed is not a child of this node.

Worth knowing while reviewing:

• Login.tsx never crashed. Its conditional is the last child, so React appends, which is safe. It is hardened, not fixed — no test can go red for it.
• 52 sites elsewhere still carry the shape (22 insert-before, 30 remove-child), across billing, dialogs, install-keys, sessions and the website. translate="no" already protects all of them in Chrome. They remain exposed to anything else that rewrites the DOM. Not fixed here to keep the blast radius small.
• Auto-translation was not verified in a real Chrome — this environment has no browser with a non-English UI language. Only the DOM rewrite and the resulting React error class were reproduced. Please confirm in a real Chrome before release.

The store integration tests (api/store/pg, TestEnrollmentE2E_*) need testcontainers and were not run.

[github-actions]

Code Review Complete

The automated review ran but did not post an updated summary — this usually means no new issues were found since the previous review. If you've pushed changes and want a fresh pass, comment /review.

View job