From bbd9f627f53b874deacc42cddeaa0158c38a8880 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Francisco=20Ign=C3=A1cio=20Fontoura=20Solla?= <fsolla@pm.me>
Date: Mon, 20 Jul 2026 18:23:23 -0300
Subject: [PATCH] Show a distinct message when campaign login is temporarily
 locked.

Users hitting Payload maxLoginAttempts now see lockout guidance instead of the generic invalid-credentials copy.
---
 src/app/(campaign)/campanha/actions/auth.ts | 19 ++++++++++++++++---
 src/lib/campaignAuthCopy.ts                 |  6 ++++++
 tests/unit/campaignLoginAction.unit.spec.ts | 16 ++++++++++++++++
 3 files changed, 38 insertions(+), 3 deletions(-)

diff --git a/src/app/(campaign)/campanha/actions/auth.ts b/src/app/(campaign)/campanha/actions/auth.ts
index ff06cbc4..8b6865d2 100644
--- a/src/app/(campaign)/campanha/actions/auth.ts
+++ b/src/app/(campaign)/campanha/actions/auth.ts
@@ -5,6 +5,10 @@ import { cookies } from 'next/headers'
 import { redirect } from 'next/navigation'
 import { getPayload } from 'payload'
 
+import {
+  CAMPAIGN_ACCOUNT_LOCKED_MESSAGE,
+  CAMPAIGN_LOGIN_INVALID_CREDENTIALS_MESSAGE,
+} from '@/lib/campaignAuthCopy'
 import { requiredFormSecret, requiredFormText } from '@/lib/formData'
 import { campaignLoginSchema, type CampaignLoginInput } from '@/lib/schemas/campaign-login'
 import {
@@ -15,6 +19,12 @@ import {
 
 export type LoginResult = { error?: string }
 
+const isLockedAuthError = (error: unknown): boolean =>
+  typeof error === 'object' &&
+  error !== null &&
+  'name' in error &&
+  (error as { name: unknown }).name === 'LockedAuth'
+
 export const loginCampaign = async (input: CampaignLoginInput): Promise<LoginResult> => {
   const parsed = campaignLoginSchema.safeParse(input)
 
@@ -38,12 +48,15 @@ export const loginCampaign = async (input: CampaignLoginInput): Promise<LoginRes
     })
 
     token = result.token
-  } catch {
-    return { error: 'E-mail, celular ou senha inválidos.' }
+  } catch (error) {
+    if (isLockedAuthError(error)) {
+      return { error: CAMPAIGN_ACCOUNT_LOCKED_MESSAGE }
+    }
+    return { error: CAMPAIGN_LOGIN_INVALID_CREDENTIALS_MESSAGE }
   }
 
   if (!token) {
-    return { error: 'E-mail, celular ou senha inválidos.' }
+    return { error: CAMPAIGN_LOGIN_INVALID_CREDENTIALS_MESSAGE }
   }
 
   await setCampaignAuthCookie(token, payload)
diff --git a/src/lib/campaignAuthCopy.ts b/src/lib/campaignAuthCopy.ts
index d708dea9..b2f5211c 100644
--- a/src/lib/campaignAuthCopy.ts
+++ b/src/lib/campaignAuthCopy.ts
@@ -11,6 +11,12 @@ export const CAMPAIGN_FIRST_ACCESS_HINT =
 
 export const CAMPAIGN_LOGIN_SUBTITLE = 'Use o e-mail ou o celular cadastrado na sua conta.'
 
+/** Shown when Payload locks the account after maxLoginAttempts (default: 5 / 10 min). */
+export const CAMPAIGN_ACCOUNT_LOCKED_MESSAGE =
+  'Conta temporariamente bloqueada após várias tentativas. Aguarde alguns minutos e tente de novo.'
+
+export const CAMPAIGN_LOGIN_INVALID_CREDENTIALS_MESSAGE = 'E-mail, celular ou senha inválidos.'
+
 /**
  * Card titles on public campaign auth screens (login / forgot / reset).
  * `!text-center` beats `[data-theme='campaign'] h1 { text-align: left }` (app shell).
diff --git a/tests/unit/campaignLoginAction.unit.spec.ts b/tests/unit/campaignLoginAction.unit.spec.ts
index 70d32478..a0b742e3 100644
--- a/tests/unit/campaignLoginAction.unit.spec.ts
+++ b/tests/unit/campaignLoginAction.unit.spec.ts
@@ -123,4 +123,20 @@ describe('loginCampaign credential mapping', () => {
       error: 'E-mail, celular ou senha inválidos.',
     })
   })
+
+  it('returns a distinct message when Payload locks the account', async () => {
+    const locked = new Error('This user is locked due to having too many failed login attempts.')
+    locked.name = 'LockedAuth'
+    mocks.login.mockRejectedValueOnce(locked)
+
+    await expect(
+      loginCampaign({
+        identifier: 'staff@example.com',
+        password: 'any-password',
+      }),
+    ).resolves.toEqual({
+      error:
+        'Conta temporariamente bloqueada após várias tentativas. Aguarde alguns minutos e tente de novo.',
+    })
+  })
 })