Part of #2322. src/web/pages/signup-passkey.ts borrows signinAllowed today.
Done looks like:
[ ] Passkey signup, and any OAuth callback that creates an account, call signupAllowed(ctx) before they make the account. A callback that creates nothing (for example error=access_denied) is not counted.
[ ] test/signup-passkey.test.ts and the OAuth code-flow suite ("a callback carrying error=access_denied burns the state and creates nothing"; find it with grep -l 'OAuth code flow' test/*.ts) stay green. A suite raises signup.per_source in its setup when it needs more than 5 signups, and changes no assertion.
[ ] Test: a passkey signup past the limit is refused with the wait.
Part of #2322.
src/web/pages/signup-passkey.tsborrowssigninAllowedtoday.Done looks like:
signupAllowed(ctx)before they make the account. A callback that creates nothing (for exampleerror=access_denied) is not counted.test/signup-passkey.test.tsand the OAuth code-flow suite ("a callback carrying error=access_denied burns the state and creates nothing"; find it withgrep -l 'OAuth code flow' test/*.ts) stay green. A suite raisessignup.per_sourcein its setup when it needs more than 5 signups, and changes no assertion.