fix

apps/api/internal/auth/errors.go

@@ -20,6 +20,8 @@ func ClientError(err error) (msg string, ok bool) {
 	switch {
 	case err == nil:
 		return "", false
+	case errors.Is(err, ErrSyntheticEmail):
+		return "this email cannot receive invites", true
 	case errors.Is(err, ErrRegisterFieldsRequired),
 		errors.Is(err, ErrPasswordTooShort),
 		errors.Is(err, ErrPasswordAlreadySet),
@@ -32,7 +34,6 @@ func ClientError(err error) (msg string, ok bool) {
 		errors.Is(err, ErrInviteNotFound),
 		errors.Is(err, ErrTokenInvalid),
 		errors.Is(err, ErrEmailRequired),
-		errors.Is(err, ErrSyntheticEmail),
 		errors.Is(err, ErrNotEligibleSetPassword),
 		errors.Is(err, ErrEmailMismatch),
 		errors.Is(err, ErrNotCompanyOwner),

apps/api/internal/auth/ownership_test.go

@@ -1,6 +1,7 @@
 package auth
 
 import (
+	"strings"
 	"testing"
 )
 
@@ -18,3 +19,17 @@ func TestOwnershipErrorClientFacing(t *testing.T) {
 		}
 	}
 }
+
+func TestClientError_syntheticEmailPublicString(t *testing.T) {
+	t.Parallel()
+	msg, ok := ClientError(ErrSyntheticEmail)
+	if !ok {
+		t.Fatal("ErrSyntheticEmail should be a client error")
+	}
+	if msg != "this email cannot receive invites" {
+		t.Fatalf("public msg=%q", msg)
+	}
+	if strings.Contains(msg, "synthetic") || strings.Contains(msg, "migration") {
+		t.Fatalf("internal wording leaked: %q", msg)
+	}
+}