fix: feedback

Author: coratgerl

spec/ParseUser.spec.js

@@ -368,6 +368,34 @@ describe('Parse.User testing', () => {
         .find({ useMasterKey: true });
       expect(sessions.length).toBe(0);
     });
+
+    it('should not auto-signup when password is wrong for existing user', async () => {
+      await reconfigureServer({ autoSignupOnLogin: true });
+      
+      // Create an existing user
+      const existingUser = new Parse.User();
+      existingUser.setUsername('existing-user');
+      existingUser.setPassword('correct-password');
+      await existingUser.signUp();
+      
+      // Try to login with wrong password
+      await expectAsync(
+        Parse.User.logIn('existing-user', 'wrong-password')
+      ).toBeRejectedWith(
+        jasmine.objectContaining({ code: Parse.Error.OBJECT_NOT_FOUND })
+      );
+      
+      // Ensure no new user was created
+      const count = await new Parse.Query(Parse.User)
+        .equalTo('username', 'existing-user')
+        .count({ useMasterKey: true });
+      expect(count).toBe(1);
+      
+      // Ensure the existing user is still the only one
+      const users = await new Parse.Query(Parse.User)
+        .find({ useMasterKey: true });
+      expect(users.length).toBe(1);
+    });
   });
 
   it('should respect ACL without locking user out', done => {

src/Routers/UsersRouter.js

@@ -151,7 +151,9 @@ export class UsersRouter extends ClassesRouter {
         .find('_User', query, {}, Auth.maintenance(req.config))
         .then(results => {
           if (!results.length) {
-            throw new Parse.Error(Parse.Error.OBJECT_NOT_FOUND, 'Invalid username/password.');
+            const error = new Parse.Error(Parse.Error.OBJECT_NOT_FOUND, 'Invalid username/password.');
+            error.userNotFound = true;
+            throw error;
           }
 
           if (results.length > 1) {
@@ -326,7 +328,8 @@ export class UsersRouter extends ClassesRouter {
       if (
         req.config.autoSignupOnLogin &&
         error &&
-        error.code === Parse.Error.OBJECT_NOT_FOUND
+        error.code === Parse.Error.OBJECT_NOT_FOUND &&
+        error.userNotFound === true
       ) {
         autoSignupResult = await this._autoSignupOnLogin(req);
         user = autoSignupResult.user;