P0: fix(auth): preserve the request URI in recovery links

[aspiers]

Summary

Carry the active PAR request_uri into account recovery instead of using a placeholder. Successful recovery can then return the user to the authorization request that initiated sign-in.

Changes

• Render recovery links with the active request URI
• Thread the value through regular and preview render paths
• Cover the round trip with unit and Cucumber assertions

Testing

• pnpm format:check
• pnpm lint
• pnpm typecheck
• pnpm test
• pnpm test:coverage

Before/after evidence

Before: the recovery link used a placeholder request_uri. Clicking Back to sign in therefore could not return to the active authorization request or restore its OTP form.

After: the browser scenario now captures the live request_uri, follows the recovery link, clicks Back to sign in, verifies the same URI is restored, and asserts that a usable sign-in form is visible instead of an OAuth error. This is a navigation/state fix with no meaningful static visual difference; the complete behavioral round trip is covered in account-recovery.feature.

Notes

• The earlier PR-attached E2E attempt could not find the delayed deployment for the final amendment. After Railway recovered, the required check was rerun and the current SHA passed the full deployed suite in run 30561186061.

• Current-branch deployed E2E: run 30561478453.

• Focused extraction and review of work originally proposed in [WIP] many usability fixes (needs untangling) #165.

• The deployed E2E suite passed.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
epds-demo	Ready	Preview	Jul 30, 2026 4:23pm

[coderabbitai]

Warning

Review limit reached

@aspiers, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 59 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 8feb1c45-68df-47d8-a9e0-b99f2938143b

📥 Commits

Reviewing files that changed from the base of the PR and between 7bce175 and 79ca2e2.

📒 Files selected for processing (7)

• .changeset/recovery-link-uses-real-request-uri.md
• e2e/step-definitions/account-recovery.steps.ts
• features/account-recovery.feature
• packages/auth-service/src/__tests__/heartbeat-toggle.test.ts
• packages/auth-service/src/__tests__/login-page.test.ts
• packages/auth-service/src/routes/login-page.ts
• packages/auth-service/src/routes/preview.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[changeset-bot]

🦋 Changeset detected

Latest commit: 79ca2e2

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[railway-app]

🚅 Deployed to the ePDS-pr-218 environment in ePDS

Service	Status	Web	Updated (UTC)
@certified-app/demo untrusted	✅ Success (View Logs)	Web	Jul 30, 2026 at 4:55 pm
@certified-app/auth-service	✅ Success (View Logs)	Web	Jul 30, 2026 at 4:55 pm
@certified-app/demo	✅ Success (View Logs)	Web	Jul 30, 2026 at 4:54 pm
@certified-app/pds-core	✅ Success (View Logs)	Web	Jul 30, 2026 at 4:54 pm

[coveralls-official]

Coverage Report for CI Build 30561185967

Coverage remained the same at 57.281%

Details

• Coverage remained the same as the base build.
• Patch coverage: No coverable lines changed in this PR.
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	3069
Covered Lines:	1753
Line Coverage:	57.12%
Relevant Branches:	1910
Covered Branches:	1099
Branch Coverage:	57.54%
Branches in Coverage %:	Yes
Coverage Strength:	6.06 hits per line

---

💛 - Coveralls

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud