From 2f381d8407c17be68a9026719df6c4f6ef0e3f5a Mon Sep 17 00:00:00 2001
From: Sluijsens <bdslop@gmail.com>
Date: Mon, 22 Jun 2026 11:17:20 +0200
Subject: [PATCH] fix(frontend): Strip confirmPassword before API calls; add
 pointer cursor

- Destructure confirmPassword out of form values in SetupPage and
  InviteCompletePage so it is never sent to the backend
- Add global cursor:pointer rule for buttons, selects, labels and links

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
---
 frontend/src/index.css                    | 4 ++++
 frontend/src/pages/InviteCompletePage.tsx | 6 ++----
 frontend/src/pages/SetupPage.tsx          | 3 ++-
 3 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/frontend/src/index.css b/frontend/src/index.css
index 2be15f2..01fac57 100644
--- a/frontend/src/index.css
+++ b/frontend/src/index.css
@@ -110,6 +110,10 @@
         -moz-osx-font-smoothing: grayscale;
     }
 
+    button, [role="button"], select, label[for], a[href], [tabindex]:not([tabindex="-1"]) {
+        cursor: pointer;
+    }
+
     /* Visible focus ring for keyboard navigation (NFR-U1-02 / Q2-A). */
     :focus-visible {
         outline: 2px solid var(--color-ring);
diff --git a/frontend/src/pages/InviteCompletePage.tsx b/frontend/src/pages/InviteCompletePage.tsx
index d9352d6..b4e579f 100644
--- a/frontend/src/pages/InviteCompletePage.tsx
+++ b/frontend/src/pages/InviteCompletePage.tsx
@@ -68,10 +68,8 @@ export function InviteCompletePage() {
                 setLoadingState('error');
                 return;
             }
-            await completeMutation.mutateAsync({
-                token,
-                ...values
-            });
+            const { confirmPassword: _, ...fields } = values;
+            await completeMutation.mutateAsync({ token, ...fields });
             setLoadingState('success');
             setTimeout(() => {
                 navigate({ to: '/login' });
diff --git a/frontend/src/pages/SetupPage.tsx b/frontend/src/pages/SetupPage.tsx
index 596a8d5..dd174db 100644
--- a/frontend/src/pages/SetupPage.tsx
+++ b/frontend/src/pages/SetupPage.tsx
@@ -45,7 +45,8 @@ export function SetupPage() {
     const onSubmit = handleSubmit(async (values) => {
         setServerError(null);
         try {
-            await setupMutation.mutateAsync(values);
+            const { confirmPassword: _, ...payload } = values;
+            await setupMutation.mutateAsync(payload);
             setSuccessMessage(true);
             setTimeout(() => {
                 navigate({ to: '/login' });