From fc4a2f5508cd72e03a82db10371b4914a1d27270 Mon Sep 17 00:00:00 2001
From: Kian Cross <kian@kiancross.co.uk>
Date: Mon, 6 Jul 2026 15:59:59 +0100
Subject: [PATCH] Customer SSO: Improve one-time token error message (#5841)

* Improve SSO one-time token error message

Replace the generic 'invalid one-time token' message shown after failed
SSO login attempts with a clearer, user-facing explanation of what went
wrong and how to recover.

* Remove unneeded classes from headings

Co-authored-by: Raphael Michel <mail@raphaelmichel.de>

* Apply suggestions from code review

Added `trimmed` to translation blocks

Co-authored-by: Raphael Michel <mail@raphaelmichel.de>

* Reword SSO error template for improved translation clarity

---------

Co-authored-by: Raphael Michel <mail@raphaelmichel.de>
---
 .../customer_login_interrupted_message.html   | 64 +++++++++++++++++++
 src/pretix/presale/views/customer.py          |  6 +-
 2 files changed, 67 insertions(+), 3 deletions(-)
 create mode 100644 src/pretix/presale/templates/pretixpresale/organizers/customer_login_interrupted_message.html

diff --git a/src/pretix/presale/templates/pretixpresale/organizers/customer_login_interrupted_message.html b/src/pretix/presale/templates/pretixpresale/organizers/customer_login_interrupted_message.html
new file mode 100644
index 000000000..faf44a566
--- /dev/null
+++ b/src/pretix/presale/templates/pretixpresale/organizers/customer_login_interrupted_message.html
@@ -0,0 +1,64 @@
+{% load i18n %}
+
+<h4>{% trans "Login could not be completed" %}</h4>
+
+<p>
+    {% blocktrans %}
+        We couldn't complete your login because something interrupted the process.
+    {% endblocktrans %}
+</p>
+
+<h5><b>{% trans "Possible reasons for this:" %}</b></h5>
+
+<ul>
+    <li>
+        {% blocktrans trimmed %}
+            You started logging in from a link opened inside an app (such as Instagram
+            or an email app), and then continued the login in your main browser.
+        {% endblocktrans %}
+    </li>
+    <li>
+        {% blocktrans trimmed %}
+            You refreshed the page or used the back button during login.
+        {% endblocktrans %}
+    </li>
+    <li>
+        {% blocktrans trimmed %}
+            The site was opened in more than one tab or window at the same time.
+        {% endblocktrans %}
+    </li>
+    <li>
+        {% blocktrans trimmed %}
+            There was a long delay between starting and completing the login process.
+        {% endblocktrans %}
+    </li>
+</ul>
+
+<h5><strong>{% trans "How to fix this:" %}</strong></h5>
+
+<ol>
+    <li>
+        {% trans "Close this page." %}
+    </li>
+    <li>
+        {% blocktrans trimmed %}
+            Open this website again directly in your main browser (for example
+            Safari or Chrome).
+        {% endblocktrans %}
+    </li>
+    <li>
+        {% blocktrans trimmed %}
+            Begin the checkout or login process again and complete it in the same
+            browser window, without refreshing the page, opening new tabs, or
+            switching apps part-way through.
+        {% endblocktrans %}
+    </li>
+</ol>
+
+<p>
+    {% blocktrans trimmed %}
+        If the problem continues, closing all browser windows and clearing cookies
+        before retrying can help. As a last step, try using a different browser or
+        another device (for example, a desktop or laptop computer).
+    {% endblocktrans %}
+</p>
diff --git a/src/pretix/presale/views/customer.py b/src/pretix/presale/views/customer.py
index 5e15cfe44..9cafb72b5 100644
--- a/src/pretix/presale/views/customer.py
+++ b/src/pretix/presale/views/customer.py
@@ -36,10 +36,12 @@ from django.db.models import (
 )
 from django.http import Http404, HttpResponseRedirect
 from django.shortcuts import get_object_or_404, render
+from django.template.loader import render_to_string
 from django.utils.crypto import get_random_string
 from django.utils.decorators import method_decorator
 from django.utils.functional import cached_property
 from django.utils.http import url_has_allowed_host_and_scheme
+from django.utils.safestring import mark_safe
 from django.utils.translation import gettext_lazy as _
 from django.views.decorators.cache import never_cache
 from django.views.decorators.csrf import csrf_protect
@@ -774,9 +776,7 @@ class SSOLoginReturnView(RedirectBackMixin, View):
 
             if nonce != request.session.get(f'pretix_customerauth_{self.provider.pk}_nonce'):
                 return self._fail(
-                    _('Login was not successful. Error message: "{error}".').format(
-                        error='invalid one-time token',
-                    ),
+                    mark_safe(render_to_string("pretixpresale/organizers/customer_login_interrupted_message.html")),
                     popup_origin,
                 )
             redirect_uri = eventreverse_absolute(