# CLOCK-021: [Authentication] Improve Login Error Message – Do Not Expose Firebase Error Codes

**Status:** open
**Priority:** P0 (High)
**Reporter:** Zel
**Created:** 2026-02-18
**Environment:** PROD – https://clocklane.com/app

## Description
When attempting to log in using a wrong password or a non-existent email, the system displays a raw Firebase error message (e.g., `Firebase: Error (auth/invalid-credential)`), which is too technical and not user-friendly.

## Expected Behavior
Error message should be replaced with a clean, generic validation message such as:
> "Invalid email or password. Please try again."

## Why This Matters
- Prevents exposing internal authentication details
- Improves UX clarity
- Maintains security best practices (don't reveal which field is wrong)

## Affected Areas
- Login page error handling
- Sign up error handling (likely same issue)

## Technical Notes
- Need to catch Firebase auth errors and map to user-friendly messages
- Common errors to handle:
  - `auth/invalid-credential` → "Invalid email or password"
  - `auth/user-not-found` → "Invalid email or password" (same message for security)
  - `auth/wrong-password` → "Invalid email or password"
  - `auth/too-many-requests` → "Too many attempts. Please try again later."

## Notes
- Do NOT fix yet - waiting for Zel's confirmation to batch fix
