From 5b9fd1695f0b326742a5d702b63cf23d2264b9de Mon Sep 17 00:00:00 2001
From: Konsti Wohlwend <n2d4xc@gmail.com>
Date: Mon, 22 Jun 2026 17:29:08 -0700
Subject: [PATCH] fix: return 409 instead of 500 when signing up with duplicate
 email (#1637)

---
 .../latest/auth/password/sign-up/route.tsx    |  2 +-
 .../route-handlers/smart-route-handler.tsx    |  1 +
 .../api/v1/auth/email-normalization.test.ts   |  9 ++++---
 .../api/v1/auth/password/sign-up.test.ts      |  9 ++++---
 .../backend/endpoints/api/v1/users.test.ts    | 27 ++++++++++---------
 5 files changed, 27 insertions(+), 21 deletions(-)

diff --git a/apps/backend/src/app/api/latest/auth/password/sign-up/route.tsx b/apps/backend/src/app/api/latest/auth/password/sign-up/route.tsx
index 419f8a7f7..2c96e4bfd 100644
--- a/apps/backend/src/app/api/latest/auth/password/sign-up/route.tsx
+++ b/apps/backend/src/app/api/latest/auth/password/sign-up/route.tsx
@@ -69,7 +69,7 @@ export const POST = createSmartRouteHandler({
         primary_email_auth_enabled: true,
         password,
       },
-      [KnownErrors.UserWithEmailAlreadyExists],
+      [KnownErrors.UserWithEmailAlreadyExists, KnownErrors.ContactChannelAlreadyUsedForAuthBySomeoneElse],
       buildSignUpRuleOptions({
         authMethod: 'password',
         oauthProvider: null,
diff --git a/apps/backend/src/route-handlers/smart-route-handler.tsx b/apps/backend/src/route-handlers/smart-route-handler.tsx
index 712a60e0c..4c954cb3a 100644
--- a/apps/backend/src/route-handlers/smart-route-handler.tsx
+++ b/apps/backend/src/route-handlers/smart-route-handler.tsx
@@ -49,6 +49,7 @@ function catchError(error: unknown, requestId: string): StatusError {
   }
 
   if (StatusError.isStatusError(error)) return error;
+
   captureError(`route-handler`, error);
   return new InternalServerError(error, requestId);
 }
diff --git a/apps/e2e/tests/backend/endpoints/api/v1/auth/email-normalization.test.ts b/apps/e2e/tests/backend/endpoints/api/v1/auth/email-normalization.test.ts
index c423b1376..e96cb8699 100644
--- a/apps/e2e/tests/backend/endpoints/api/v1/auth/email-normalization.test.ts
+++ b/apps/e2e/tests/backend/endpoints/api/v1/auth/email-normalization.test.ts
@@ -321,15 +321,16 @@ it("should not allow duplicate accounts with same normalized email", async ({ ex
     NiceResponse {
       "status": 409,
       "body": {
-        "code": "USER_EMAIL_ALREADY_EXISTS",
+        "code": "CONTACT_CHANNEL_ALREADY_USED_FOR_AUTH_BY_SOMEONE_ELSE",
         "details": {
-          "email": "duplicate.test-<stripped UUID>@example.com",
+          "contact_channel_value": "duplicate.test-<stripped UUID>@example.com",
+          "type": "email",
           "would_work_if_email_was_verified": false,
         },
-        "error": "A user with email \\"duplicate.test-<stripped UUID>@example.com\\" already exists.",
+        "error": "This email \\"(duplicate.test-<stripped UUID>@example.com)\\" is already used for authentication by another account.",
       },
       "headers": Headers {
-        "x-stack-known-error": "USER_EMAIL_ALREADY_EXISTS",
+        "x-stack-known-error": "CONTACT_CHANNEL_ALREADY_USED_FOR_AUTH_BY_SOMEONE_ELSE",
         <some fields may have been hidden>,
       },
     }
diff --git a/apps/e2e/tests/backend/endpoints/api/v1/auth/password/sign-up.test.ts b/apps/e2e/tests/backend/endpoints/api/v1/auth/password/sign-up.test.ts
index e29c8ad6b..e9a1ee1be 100644
--- a/apps/e2e/tests/backend/endpoints/api/v1/auth/password/sign-up.test.ts
+++ b/apps/e2e/tests/backend/endpoints/api/v1/auth/password/sign-up.test.ts
@@ -140,15 +140,16 @@ it("should not allow signing up with an e-mail that already exists", async ({ ex
     NiceResponse {
       "status": 409,
       "body": {
-        "code": "USER_EMAIL_ALREADY_EXISTS",
+        "code": "CONTACT_CHANNEL_ALREADY_USED_FOR_AUTH_BY_SOMEONE_ELSE",
         "details": {
-          "email": "default-mailbox--<stripped UUID>@stack-generated.example.com",
+          "contact_channel_value": "default-mailbox--<stripped UUID>@stack-generated.example.com",
+          "type": "email",
           "would_work_if_email_was_verified": false,
         },
-        "error": "A user with email \\"default-mailbox--<stripped UUID>@stack-generated.example.com\\" already exists.",
+        "error": "This email \\"(default-mailbox--<stripped UUID>@stack-generated.example.com)\\" is already used for authentication by another account.",
       },
       "headers": Headers {
-        "x-stack-known-error": "USER_EMAIL_ALREADY_EXISTS",
+        "x-stack-known-error": "CONTACT_CHANNEL_ALREADY_USED_FOR_AUTH_BY_SOMEONE_ELSE",
         <some fields may have been hidden>,
       },
     }
diff --git a/apps/e2e/tests/backend/endpoints/api/v1/users.test.ts b/apps/e2e/tests/backend/endpoints/api/v1/users.test.ts
index b918448a4..1e825f58f 100644
--- a/apps/e2e/tests/backend/endpoints/api/v1/users.test.ts
+++ b/apps/e2e/tests/backend/endpoints/api/v1/users.test.ts
@@ -1642,15 +1642,16 @@ describe("with server access", () => {
       NiceResponse {
         "status": 409,
         "body": {
-          "code": "USER_EMAIL_ALREADY_EXISTS",
+          "code": "CONTACT_CHANNEL_ALREADY_USED_FOR_AUTH_BY_SOMEONE_ELSE",
           "details": {
-            "email": "default-mailbox--<stripped UUID>@stack-generated.example.com",
+            "contact_channel_value": "default-mailbox--<stripped UUID>@stack-generated.example.com",
+            "type": "email",
             "would_work_if_email_was_verified": false,
           },
-          "error": "A user with email \\"default-mailbox--<stripped UUID>@stack-generated.example.com\\" already exists.",
+          "error": "This email \\"(default-mailbox--<stripped UUID>@stack-generated.example.com)\\" is already used for authentication by another account.",
         },
         "headers": Headers {
-          "x-stack-known-error": "USER_EMAIL_ALREADY_EXISTS",
+          "x-stack-known-error": "CONTACT_CHANNEL_ALREADY_USED_FOR_AUTH_BY_SOMEONE_ELSE",
           <some fields may have been hidden>,
         },
       }
@@ -2395,15 +2396,16 @@ describe("with server access", () => {
       NiceResponse {
         "status": 409,
         "body": {
-          "code": "USER_EMAIL_ALREADY_EXISTS",
+          "code": "CONTACT_CHANNEL_ALREADY_USED_FOR_AUTH_BY_SOMEONE_ELSE",
           "details": {
-            "email": "default-mailbox--<stripped UUID>@stack-generated.example.com",
+            "contact_channel_value": "default-mailbox--<stripped UUID>@stack-generated.example.com",
+            "type": "email",
             "would_work_if_email_was_verified": false,
           },
-          "error": "A user with email \\"default-mailbox--<stripped UUID>@stack-generated.example.com\\" already exists.",
+          "error": "This email \\"(default-mailbox--<stripped UUID>@stack-generated.example.com)\\" is already used for authentication by another account.",
         },
         "headers": Headers {
-          "x-stack-known-error": "USER_EMAIL_ALREADY_EXISTS",
+          "x-stack-known-error": "CONTACT_CHANNEL_ALREADY_USED_FOR_AUTH_BY_SOMEONE_ELSE",
           <some fields may have been hidden>,
         },
       }
@@ -2458,15 +2460,16 @@ describe("with server access", () => {
       NiceResponse {
         "status": 409,
         "body": {
-          "code": "USER_EMAIL_ALREADY_EXISTS",
+          "code": "CONTACT_CHANNEL_ALREADY_USED_FOR_AUTH_BY_SOMEONE_ELSE",
           "details": {
-            "email": "default-mailbox--<stripped UUID>@stack-generated.example.com",
+            "contact_channel_value": "default-mailbox--<stripped UUID>@stack-generated.example.com",
+            "type": "email",
             "would_work_if_email_was_verified": false,
           },
-          "error": "A user with email \\"default-mailbox--<stripped UUID>@stack-generated.example.com\\" already exists.",
+          "error": "This email \\"(default-mailbox--<stripped UUID>@stack-generated.example.com)\\" is already used for authentication by another account.",
         },
         "headers": Headers {
-          "x-stack-known-error": "USER_EMAIL_ALREADY_EXISTS",
+          "x-stack-known-error": "CONTACT_CHANNEL_ALREADY_USED_FOR_AUTH_BY_SOMEONE_ELSE",
           <some fields may have been hidden>,
         },
       }