From 8992d924940999e399d735188a638a61476a1d01 Mon Sep 17 00:00:00 2001
From: mihretue <muluhome@gmail.com>
Date: Thu, 27 Aug 2026 13:42:18 +0000
Subject: [PATCH] feat(signup): present the Fayda proof after signup and skip
 the second OTP
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The verify step now returns an encrypted verificationToken alongside the
readable identity. After the existing signup succeeds, the page posts it to
POST /profiles/me/fayda, which marks the phone verified when it is the one
Fayda vouched for and fills the still-empty profile fields. Best-effort: the
account already works if the call fails, and the token can be presented again.

When the server confirms the phone, the page goes straight to the portal
instead of /otp-verify — Fayda already verified that exact number with its own
OTP, and asking for a second one on the same number is theatre. An applicant
who edited the prefilled number still gets the normal OTP step.
---
 libs/auth/src/lib/pages/SignupPage.tsx   | 27 ++++++++++++++++++++++--
 libs/auth/src/lib/utils/fayda-session.ts |  8 +++++++
 2 files changed, 33 insertions(+), 2 deletions(-)

diff --git a/libs/auth/src/lib/pages/SignupPage.tsx b/libs/auth/src/lib/pages/SignupPage.tsx
index 29b03e6c8..3b41c45de 100644
--- a/libs/auth/src/lib/pages/SignupPage.tsx
+++ b/libs/auth/src/lib/pages/SignupPage.tsx
@@ -76,6 +76,7 @@ export function SignupPage() {
     transactionToken: string;
     expiresIn: number;
   }>();
+  const [linkTrigger] = useApiMutation<{ phoneNumberVerified?: boolean }>();
 
   const verified = (field: string) => fayda?.verifiedFields.includes(field) ?? false;
   const conflicted = (field: string) => fayda?.conflicts.includes(field) ?? false;
@@ -89,8 +90,10 @@ export function SignupPage() {
   const faydaMark = (field: string): { description?: React.ReactNode } => {
     if (conflicted(field)) {
       return {
+        // component="span" on these badges: the description slot renders
+        // inside a <p>, where Badge's default <div> is invalid HTML.
         description: (
-          <Badge size="xs" variant="light" color="orange">
+          <Badge component="span" size="xs" variant="light" color="orange">
             {t('fayda.fieldConflict', 'Already used by another account')}
           </Badge>
         ),
@@ -100,6 +103,7 @@ export function SignupPage() {
       return {
         description: (
           <Badge
+            component="span"
             size="xs"
             variant="light"
             color="teal"
@@ -234,9 +238,28 @@ export function SignupPage() {
       const me = await meTrigger({ url: '/auth/me', method: 'GET' }).unwrap();
       dispatch(setUser(me));
 
+      // Records the Fayda-verified identity on the new account: marks the
+      // phone verified when it is the one Fayda vouched for, and fills the
+      // still-empty profile fields. Best-effort — the account already works,
+      // and the token can be presented again on a retry.
+      let faydaPhoneVerified = false;
+      if (fayda?.verificationToken) {
+        try {
+          const applied = await linkTrigger({
+            url: '/profiles/me/fayda',
+            method: 'POST',
+            body: { verificationToken: fayda.verificationToken },
+          }).unwrap();
+          faydaPhoneVerified = Boolean(applied?.phoneNumberVerified);
+        } catch {
+          /* deliberately ignored — signup already succeeded */
+        }
+      }
       faydaSession.clearResult();
 
-      if (data.isPhoneNumberVerified) {
+      // Fayda already verified this exact number via its own OTP; asking for
+      // a second OTP on the same number is theatre.
+      if (data.isPhoneNumberVerified || faydaPhoneVerified) {
         navigate(loginRedirectPath);
       } else {
         navigate('/otp-verify', {
diff --git a/libs/auth/src/lib/utils/fayda-session.ts b/libs/auth/src/lib/utils/fayda-session.ts
index d61db63c1..0dda61b00 100644
--- a/libs/auth/src/lib/utils/fayda-session.ts
+++ b/libs/auth/src/lib/utils/fayda-session.ts
@@ -24,6 +24,9 @@ export interface FaydaPrefill {
   /** Shown for context only — the signup form has no field for these. */
   gender?: string;
   address?: string;
+  birthdate?: string;
+  nationality?: string;
+  faydaNumber?: string;
 }
 
 /** Shape of `POST /auth/register-with-fayda` with `action: "verify"`. */
@@ -34,6 +37,11 @@ export interface FaydaResult {
   verifiedFields: string[];
   /** Prefilled fields already taken by another account. */
   conflicts: string[];
+  /**
+   * Encrypted proof of the verification, presented to POST /profiles/me/fayda
+   * after signup so the account and profile record what Fayda vouched for.
+   */
+  verificationToken: string;
 }
 
 // Private browsing and locked-down browsers can throw on access, and a failure