Distinguish Between Invalid Credentials and Unverified Accounts During Login

Summary Currently, the Directus login API returns a generic INVALID_CREDENTIALS error for both incorrect credentials and unverified accounts (where email verification is enabled but not completed). This makes it impossible to provide accurate feedback to users. I propose adding a distinct ACCOUNT_UNVERIFIED error response. Basic Example Current behavior: Proposed behavior for unverified accounts: Motivation • User Experience: Users currently have no way to know if they entered wrong credentials or just need to verify their email • Reduced Support Requests: Clear messaging reduces "I can't login" support tickets • Compliance: Some industries require clear communication about account status • Conversion Optimization: Allows apps to resend verification emails proactively Detailed Design 1. Modify the authentication service to complete password verification first, then check verification status. The status check m…