fix: Use generic "Incorrect username or password" error for login failures

[VIDIT45AGARWAL]

fix: Use generic "Incorrect username or password" error for login failures

Proposed changes

This PR updates the login error message override in apps/meteor/server/lib/loginErrorMessageOverride.ts (or equivalent file) to display a single generic message "Incorrect username or password" for all unauthorized login attempts.

Previously, any login failure (non-existent user or wrong password) was forcibly overridden to "User not found". This misled users when their account existed but the password was simply incorrect.

Changes:

• Replaced the forced "User not found" (401 error) with "Incorrect username or password".
• No functional behavior change beyond the displayed message—security against basic enumeration remains .

Issue(s)

Closes #37760

Steps to test or reproduce

1. Start Rocket.Chat locally (yarn dsv or meteor).
2. Complete initial setup and create a test user.
3. Log out.
4. Attempt login:
   • With a non-existent username/email → Should show "Incorrect username or password".
   • With an existing username/email + wrong password → Should show the same generic message.
   • With correct credentials → Login succeeds normally.
5. Verify no regressions in OAuth/LDAP if enabled.

Further comments

• Tests expecting the old "User not found" message have been updated.

Summary by CodeRabbit

• Bug Fixes
  • Updated login error message to display "Incorrect username or password" instead of "User not found" when authentication fails, providing clearer feedback during the login process.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[dionisio-bot]

Looks like this PR is not ready to merge, because of the following issues:

• This PR is missing the 'stat: QA assured' label
• This PR is missing the required milestone or project

Please fix the issues and try again

If you have any trouble, please check the PR guidelines

[changeset-bot]

⚠️ No Changeset found

Latest commit: 359295b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[CLAassistant]

All committers have signed the CLA.

[coderabbitai]

Walkthrough

A single file update modifies the login error message displayed when authentication fails from "User not found" to "Incorrect username or password," returning HTTP 401 status. No control flow or structural changes are introduced.

Changes

Cohort / File(s)	Summary
Login Error Message Update apps/meteor/app/lib/server/lib/loginErrorMessageOverride.ts	Updated error message on authentication failure from "User not found" to "Incorrect username or password" for improved security and user clarity

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

• Single-file change with no logic modifications
• Straightforward message string update
• No behavioral or control flow alterations

Poem

🐰 A password mistake, no more "User not found" cry,
Now "Incorrect username or password"—much more shy!
Security improved, no hints to give away,
Our hoppy friends rejoice in this better way! 🔐✨

Pre-merge checks and finishing touches

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: replacing the login error message with a generic 'Incorrect username or password' message, which is concise and specific to the primary objective.
Linked Issues check	✅ Passed	The PR directly addresses issue #37760 by replacing the misleading 'User not found' message with a generic 'Incorrect username or password' message for failed login attempts.
Out of Scope Changes check	✅ Passed	All changes are focused on the login error message override and related test updates; no extraneous modifications are present beyond the stated objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Jira integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between 095fcc0 and 3a71673.

📒 Files selected for processing (1)

• apps/meteor/app/lib/server/lib/loginErrorMessageOverride.ts (1 hunks)

🧰 Additional context used

📓 Path-based instructions (1)

**/*.{ts,tsx,js}

📄 CodeRabbit inference engine (.cursor/rules/playwright.mdc)

**/*.{ts,tsx,js}: Write concise, technical TypeScript/JavaScript with accurate typing in Playwright tests
Avoid code comments in the implementation

Files:

• apps/meteor/app/lib/server/lib/loginErrorMessageOverride.ts

🧬 Code graph analysis (1)

apps/meteor/app/lib/server/lib/loginErrorMessageOverride.ts (1)

apps/meteor/app/livechat/server/methods/changeLivechatStatus.ts (1)

• Meteor (18-72)

🔇 Additional comments (1)

apps/meteor/app/lib/server/lib/loginErrorMessageOverride.ts (1)

8-16: [rewritten comment]
[classification tag]

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}