@aglyn/shared-data-enums 1.0.0-beta.262 → 1.0.0-beta.263

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aglyn/shared-data-enums",
-  "version": "1.0.0-beta.262",
+  "version": "1.0.0-beta.263",
   "license": "Apache-2.0",
   "homepage": "https://aglyn.com",
   "repository": {
@@ -25,8 +25,8 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@aglyn/shared-data-mdi": "1.0.0-beta.262",
-    "@aglyn/shared-util-tools": "1.0.0-beta.262",
+    "@aglyn/shared-data-mdi": "1.0.0-beta.263",
+    "@aglyn/shared-util-tools": "1.0.0-beta.263",
     "@swc/helpers": "0.5.23"
   },
   "peerDependencies": {

package/src/lib/firebase-auth.d.ts

@@ -47,6 +47,11 @@ export declare const AuthAppErrorCodes: {
     readonly PASSKEY_NOT_COMPLETED: "auth/passkey-not-completed";
     /** The ceremony ran but the server refused the assertion. */
     readonly PASSKEY_SIGNIN_FAILED: "auth/passkey-signin-failed";
+    /**
+     * The address is on a domain that must sign in through its SSO tenant, and
+     * the account-creation blocking function refused it (AGL-1993).
+     */
+    readonly SSO_DOMAIN_REQUIRED: "auth/sso-domain-required";
 };
 export type AuthAppCode = (typeof AuthAppErrorCodes)[keyof typeof AuthAppErrorCodes];
 export type AuthCode = IndexOf<typeof AuthErrorCodes> | AuthAppCode | 'general';
@@ -68,6 +73,21 @@ export declare const AuthErrorNotice: {
     "auth/sso-input-required": boolean;
     "auth/sso-incomplete": boolean;
     "auth/passkey-not-completed": boolean;
+    "auth/sso-domain-required": boolean;
 };
 export declare const AuthErrorMessage: Partial<Record<AuthCode, string>>;
+/**
+ * The text `cloud/functions` puts in its SSO-domain refusal (AGL-1993).
+ * Identity Platform reports every blocking-function error as
+ * `auth/internal-error`, so this marker is the only way to tell that refusal
+ * from a real outage.
+ */
+export declare const SSO_DOMAIN_REQUIRED_MARKER = "sso-domain-required";
+/**
+ * The error as a person should see it. A blocking-function refusal arrives as
+ * `auth/internal-error` with Identity Platform's raw JSON for a message;
+ * the SSO-domain one is given its own code and sentence, and every other
+ * error is returned unchanged.
+ */
+export declare function normalizeAuthError<T extends AuthResultError | null | undefined>(error: T): T;
 export declare const COOKIE_KEY_USER_TOKEN = "aglyn-user-token";

package/src/lib/firebase-auth.js

@@ -1,3 +1,4 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
 var _process_env_NEXT_PUBLIC_OPERATOR_SUPPORT_EMAIL, _process_env;
 /**
  * @license
@@ -75,7 +76,11 @@ export const AuthAppErrorCodes = {
    * cannot probe for a credential's existence. Naming this "cancelled" is
    * what let "you have no passkey on this device" render as nothing at all.
    */ PASSKEY_NOT_COMPLETED: 'auth/passkey-not-completed',
-    /** The ceremony ran but the server refused the assertion. */ PASSKEY_SIGNIN_FAILED: 'auth/passkey-signin-failed'
+    /** The ceremony ran but the server refused the assertion. */ PASSKEY_SIGNIN_FAILED: 'auth/passkey-signin-failed',
+    /**
+   * The address is on a domain that must sign in through its SSO tenant, and
+   * the account-creation blocking function refused it (AGL-1993).
+   */ SSO_DOMAIN_REQUIRED: 'auth/sso-domain-required'
 };
 export const AuthErrorIgnore = {
     [AuthErrorCodes.USER_CANCELLED]: true,
@@ -91,7 +96,8 @@ export const AuthErrorNotice = {
     [AuthAppErrorCodes.SSO_NOT_CONFIGURED]: true,
     [AuthAppErrorCodes.SSO_INPUT_REQUIRED]: true,
     [AuthAppErrorCodes.SSO_INCOMPLETE]: true,
-    [AuthAppErrorCodes.PASSKEY_NOT_COMPLETED]: true
+    [AuthAppErrorCodes.PASSKEY_NOT_COMPLETED]: true,
+    [AuthAppErrorCodes.SSO_DOMAIN_REQUIRED]: true
 };
 export const AuthErrorMessage = {
     // "the system administrator" is nobody a person signing up can find. The
@@ -173,8 +179,30 @@ export const AuthErrorMessage = {
     // AGL-1417. Both readings, because the browser deliberately refuses to say
     // which one happened — and the far more common one is the first.
     [AuthAppErrorCodes.PASSKEY_NOT_COMPLETED]: 'If you have not set one up on this device yet, sign in another way and ' + 'add one from Manage account → Security. If you closed the prompt, try ' + 'again.',
-    [AuthAppErrorCodes.PASSKEY_SIGNIN_FAILED]: 'Your other sign-in methods still work — password, Google, or single ' + 'sign-on.'
+    [AuthAppErrorCodes.PASSKEY_SIGNIN_FAILED]: 'Your other sign-in methods still work — password, Google, or single ' + 'sign-on.',
+    [AuthAppErrorCodes.SSO_DOMAIN_REQUIRED]: 'No account was created. Choose Single sign-on (SSO) on the sign-in ' + 'page and enter this address.'
 };
+/**
+ * The text `cloud/functions` puts in its SSO-domain refusal (AGL-1993).
+ * Identity Platform reports every blocking-function error as
+ * `auth/internal-error`, so this marker is the only way to tell that refusal
+ * from a real outage.
+ */ export const SSO_DOMAIN_REQUIRED_MARKER = 'sso-domain-required';
+/**
+ * The error as a person should see it. A blocking-function refusal arrives as
+ * `auth/internal-error` with Identity Platform's raw JSON for a message;
+ * the SSO-domain one is given its own code and sentence, and every other
+ * error is returned unchanged.
+ */ export function normalizeAuthError(error) {
+    var _error_message;
+    if ((error == null ? void 0 : error.code) === AuthErrorCodes.INTERNAL_ERROR && String((_error_message = error.message) != null ? _error_message : '').includes(SSO_DOMAIN_REQUIRED_MARKER)) {
+        return _extends({}, error, {
+            code: AuthAppErrorCodes.SSO_DOMAIN_REQUIRED,
+            message: 'This address signs in with single sign-on.'
+        });
+    }
+    return error;
+}
 export const COOKIE_KEY_USER_TOKEN = 'aglyn-user-token';
 
 //# sourceMappingURL=firebase-auth.js.map

package/src/lib/firebase-auth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/shared/data/enums/src/lib/firebase-auth.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2023 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  type AuthError,\n  AuthErrorCodes,\n  type OAuthCredential,\n  type UserCredential,\n} from 'firebase/auth'\n\n/**\n * Codes the console raises itself, for failures Firebase has no code for\n * (AGL-1416).\n *\n * These exist because `AuthErrorAlertComponent` renders NOTHING unless the\n * error carries a `code` — an error built as `{ message }` alone is silently\n * dropped, which is how the SSO page's own messages never reached anyone.\n * Giving each failure a real code is what makes it visible, and registering a\n * caption below is what stops it falling back to the generic \"contact the\n * system administrator\" line — the single worst thing to tell someone whose\n * actual problem is that they have another Google account in session.\n */\n/**\n * Who a locked-out user is told to contact (AGL-2196).\n *\n * This string was `support@aglyn.com`, rendered on the sign-in screen of every\n * deployment — including a self-hosted one, where the only person who can\n * re-enable the account is the local operator and Aglyn's support desk has\n * never heard of the user. An unauthenticated dead end pointed at the wrong\n * company.\n *\n * Read straight from the environment rather than through\n * `operatorIdentity()`, and that is not laziness: `@aglyn/aglyn` already\n * imports this library, so importing it back would be a project cycle. The\n * same reasoning is written down in `platform-brand.ts`, which re-reads this\n * exact variable for the same reason.\n *\n * Unset, the sentence names no address at all rather than the wrong one —\n * Aglyn's own deployment sets `NEXT_PUBLIC_OPERATOR_SUPPORT_EMAIL`\n * (`.env.example`), so its copy is unchanged. Dot notation is load-bearing:\n * Next substitutes `process.env.NAME` textually and never the bracket form.\n *\n * Used by every sentence that ends a person's journey: a disabled account,\n * and the two failures they cannot act on at all — the generic fallback and\n * an internal error. Those last two are the ones a stranger meets at the\n * signup form, where a dead end with no address is indistinguishable from\n * the product being broken on purpose.\n */\nconst OPERATOR_CONTACT: string =\n  (typeof process !== 'undefined' &&\n    process.env?.NEXT_PUBLIC_OPERATOR_SUPPORT_EMAIL?.trim()) ||\n  'your administrator'\n\nexport const AuthAppErrorCodes = {\n  /** Google resolved SSO against the wrong signed-in account. */\n  SSO_ACCOUNT_MISMATCH: 'auth/sso-account-mismatch',\n  /** No SSO configured for the email domain the user typed. */\n  SSO_NOT_CONFIGURED: 'auth/sso-not-configured',\n  /** The user submitted the SSO gate without a usable email. */\n  SSO_INPUT_REQUIRED: 'auth/sso-input-required',\n  /** Authenticated with the IdP, but not a member of the organization. */\n  SSO_NOT_AUTHORIZED: 'auth/sso-not-authorized',\n  /**\n   * The IdP window closed without a result. On the SSO path this is NOT the\n   * plain cancel it is elsewhere: when Google refuses the SAML request it\n   * renders its own error page inside that window, so the user closing it\n   * looks identical to a cancel. Suppressing it — as the shared\n   * `AuthErrorIgnore` list does for popup-closed — is what left the desktop\n   * flow with Google's raw error and nothing from us.\n   */\n  SSO_INCOMPLETE: 'auth/sso-incomplete',\n  /** SSO failed for a reason we could not classify. */\n  SSO_FAILED: 'auth/sso-failed',\n  /**\n   * The WebAuthn ceremony ended without an assertion (AGL-1417).\n   *\n   * Deliberately NOT called \"cancelled\". The spec overloads\n   * `NotAllowedError` to cover a dismissed prompt, a timeout, AND no\n   * discoverable credential for the RP ID — the last on purpose, so a site\n   * cannot probe for a credential's existence. Naming this \"cancelled\" is\n   * what let \"you have no passkey on this device\" render as nothing at all.\n   */\n  PASSKEY_NOT_COMPLETED: 'auth/passkey-not-completed',\n  /** The ceremony ran but the server refused the assertion. */\n  PASSKEY_SIGNIN_FAILED: 'auth/passkey-signin-failed',\n} as const\n\nexport type AuthAppCode =\n  (typeof AuthAppErrorCodes)[keyof typeof AuthAppErrorCodes]\n\nexport type AuthCode = IndexOf<typeof AuthErrorCodes> | AuthAppCode | 'general'\nexport type AuthResultError = AuthError //& {credential?: OAuthCredential}\nexport type AuthResultUser = UserCredential & { credential?: OAuthCredential }\nexport type AuthCallbackResult = Promise<UserCredential>\n\nexport const AuthErrorIgnore = {\n  [AuthErrorCodes.USER_CANCELLED]: true,\n  [AuthErrorCodes.REDIRECT_CANCELLED_BY_USER]: true,\n  [AuthErrorCodes.POPUP_CLOSED_BY_USER]: true,\n}\n\nexport const AuthErrorNotice = {\n  [AuthErrorCodes.USER_SIGNED_OUT]: true,\n  [AuthErrorCodes.CREDENTIAL_TOO_OLD_LOGIN_AGAIN]: true,\n  // Situations the person can fix themselves in one step. Rendering these as\n  // red errors invites a support ticket for something that is not broken.\n  [AuthAppErrorCodes.SSO_ACCOUNT_MISMATCH]: true,\n  [AuthAppErrorCodes.SSO_NOT_CONFIGURED]: true,\n  [AuthAppErrorCodes.SSO_INPUT_REQUIRED]: true,\n  [AuthAppErrorCodes.SSO_INCOMPLETE]: true,\n  [AuthAppErrorCodes.PASSKEY_NOT_COMPLETED]: true,\n}\n\nexport const AuthErrorMessage: Partial<Record<AuthCode, string>> = {\n  // \"the system administrator\" is nobody a person signing up can find. The\n  // fallback sentence is the last thing they read before giving up, so it\n  // names a reachable address and says the attempt is safe to repeat.\n  general: `An error has occurred. Please try again — if it keeps happening, contact ${OPERATOR_CONTACT}.`,\n  [AuthErrorCodes.ADMIN_ONLY_OPERATION]:\n    'You are not authorized to perform this action.',\n  [AuthErrorCodes.ALREADY_INITIALIZED]:\n    'Failed to initialize authenticator. Already initialized.',\n  [AuthErrorCodes.ARGUMENT_ERROR]: 'Failed to provide valid arguments.',\n  [AuthErrorCodes.CAPTCHA_CHECK_FAILED]: 'CAPTCHA check failed. Try again.',\n  [AuthErrorCodes.CODE_EXPIRED]:\n    'Authentication code has expired. Request a new code and try again.',\n  [AuthErrorCodes.CREDENTIAL_ALREADY_IN_USE]:\n    'Authentication credential already in use.',\n  [AuthErrorCodes.CREDENTIAL_MISMATCH]:\n    'Unable to perform action. Authentication token mismatch.',\n  [AuthErrorCodes.CREDENTIAL_TOO_OLD_LOGIN_AGAIN]:\n    'You have been signed out. Sign in again to continue.',\n  [AuthErrorCodes.EMAIL_CHANGE_NEEDS_VERIFICATION]:\n    'New email is not verified. Check your email to verify.',\n  [AuthErrorCodes.EMAIL_EXISTS]:\n    'Account with email already exists. Sign in instead.',\n  [AuthErrorCodes.EXPIRED_OOB_CODE]:\n    'This link has expired. Request a new password reset link and try again.',\n  [AuthErrorCodes.EXPIRED_POPUP_REQUEST]: 'Request timeout. Try again.',\n  [AuthErrorCodes.INVALID_OOB_CODE]:\n    'This link is invalid or has already been used. Request a new password reset link.',\n  // A server-side failure, and the only Auth code a person can do nothing\n  // about. It is also where a refusing `beforeUserCreated` blocking function\n  // surfaces, so this exact sentence is what a stranger sees when signup is\n  // broken platform-side. Say the fault is ours, that their details were not\n  // kept, and who to tell.\n  [AuthErrorCodes.INTERNAL_ERROR]: `Something went wrong on our end — no account was created and nothing you entered was saved. Please try again, and if it keeps happening contact ${OPERATOR_CONTACT}.`,\n  [AuthErrorCodes.INVALID_API_KEY]: 'Invalid API key.',\n  [AuthErrorCodes.INVALID_AUTH]:\n    'Unable to perform action. Invalid authentication token.',\n  [AuthErrorCodes.INVALID_AUTH_EVENT]: 'Invalid authentication event.',\n  [AuthErrorCodes.INVALID_CERT_HASH]:\n    'Multi-factor authentication is required.',\n  [AuthErrorCodes.INVALID_CODE]:\n    'Invalid verification code. Try again with a different code.',\n  [AuthErrorCodes.INVALID_CUSTOM_TOKEN]:\n    'Unable to perform action. Invalid authentication token.',\n  [AuthErrorCodes.INVALID_EMAIL]:\n    'Unable to perform action. Email provided is invalid.',\n  [AuthErrorCodes.INVALID_IDP_RESPONSE]:\n    'Unable to perform action. Invalid authentication credential.',\n  [AuthErrorCodes.INVALID_MESSAGE_PAYLOAD]:\n    'Unable to perform action. Invalid message payload.',\n  [AuthErrorCodes.INVALID_MFA_SESSION]:\n    'Unable to perform action. Invalid multi-factor authentication.',\n  [AuthErrorCodes.INVALID_ORIGIN]:\n    'This domain is unauthorized to perform this action.',\n  [AuthErrorCodes.INVALID_PASSWORD]:\n    'No account matches the credentials provided.',\n  [AuthErrorCodes.INVALID_PHONE_NUMBER]:\n    'No account matches the credentials provided.',\n  [AuthErrorCodes.INVALID_RECIPIENT_EMAIL]:\n    'Unable to perform action. Invalid recipient email.',\n  [AuthErrorCodes.INVALID_SENDER]:\n    'Unable to perform action. Invalid sender email.',\n  [AuthErrorCodes.INVALID_SESSION_INFO]:\n    'Unable to perform action. Invalid verification ID.',\n  [AuthErrorCodes.INVALID_TENANT_ID]:\n    'Unable to perform action. Invalid tenant ID.',\n  [AuthErrorCodes.MFA_INFO_NOT_FOUND]:\n    'Unable to perform action. Multi-factor authentication info not found.',\n  [AuthErrorCodes.MFA_REQUIRED]: 'Multi-factor authentication is required.',\n  [AuthErrorCodes.MISSING_CODE]: 'Verification code is missing.',\n  [AuthErrorCodes.MISSING_OR_INVALID_NONCE]:\n    'Unable to perform action. Missing or invalid nonce.',\n  [AuthErrorCodes.MISSING_PHONE_NUMBER]:\n    'Unable to perform action. Missing phone number.',\n  [AuthErrorCodes.MODULE_DESTROYED]:\n    'Unable to perform action. App has been destroyed.',\n  [AuthErrorCodes.NEED_CONFIRMATION]:\n    'Authentication credential already in use with different credential.',\n  [AuthErrorCodes.NETWORK_REQUEST_FAILED]:\n    'Unable to connect. Check your internet connection and try again.',\n  [AuthErrorCodes.NULL_USER]: 'No account matches the credentials provided.',\n  [AuthErrorCodes.POPUP_BLOCKED]:\n    'Popups blocked. Allow popups in your browser and try again.',\n  [AuthErrorCodes.PROVIDER_ALREADY_LINKED]:\n    'Unable to perform action. Provider is linked to another account.',\n  [AuthErrorCodes.QUOTA_EXCEEDED]:\n    'Unable to perform action. Usage quota has been exceeded.',\n  [AuthErrorCodes.REJECTED_CREDENTIAL]:\n    'Unable to perform action. Rejected credential.',\n  [AuthErrorCodes.TENANT_ID_MISMATCH]:\n    'Unable to perform action. Authentication tenant ID mismatch.',\n  [AuthErrorCodes.TIMEOUT]: 'Unable to perform action. Timeout.',\n  [AuthErrorCodes.TOKEN_EXPIRED]: 'Your authentication token has expired.',\n  [AuthErrorCodes.TOO_MANY_ATTEMPTS_TRY_LATER]:\n    'Account blocked from too many attempts. Try again later.',\n  [AuthErrorCodes.UNVERIFIED_EMAIL]:\n    'Email is not verified. Check your email to verify.',\n  [AuthErrorCodes.USER_DELETED]: 'No account matches the credentials provided.',\n  // Lockdown (AGL-1501): a user-scope lock disables the Firebase account, so\n  // this is the notice a locked-out person actually sees at sign-in. The\n  // copy is the action, not the diagnosis — the reason lives with support.\n  // It is also where a BANNED account learns it may appeal (AGL-3420): the\n  // sign-in form cannot know why an account is disabled, so it names both.\n  [AuthErrorCodes.USER_DISABLED]:\n    `This account is currently disabled. Contact ${OPERATOR_CONTACT} to restore access, or to appeal the decision.`,\n  [AuthErrorCodes.USER_SIGNED_OUT]:\n    'You have been signed out. Sign in again to continue.',\n  [AuthErrorCodes.WEAK_PASSWORD]:\n    'Password is too weak. Enter a stronger password and try again.',\n  // AGL-1416. The captions carry the ACTION, because the headline above them\n  // is the diagnosis and a diagnosis with no next step is what sends people\n  // to their IT admin for a problem only they can fix.\n  [AuthAppErrorCodes.SSO_ACCOUNT_MISMATCH]:\n    'Your browser is signed in to another Google account, and single ' +\n    'sign-on was resolved against that one. Sign out of the other account, ' +\n    'or open this page in a private window, then try again.',\n  [AuthAppErrorCodes.SSO_NOT_CONFIGURED]:\n    'Check the spelling of your work email, or sign in with your password ' +\n    'or Google instead.',\n  [AuthAppErrorCodes.SSO_INPUT_REQUIRED]:\n    'Enter the full work email address your organization uses.',\n  [AuthAppErrorCodes.SSO_NOT_AUTHORIZED]:\n    'Ask an administrator of that organization to invite you, then sign in ' +\n    'again.',\n  [AuthAppErrorCodes.SSO_INCOMPLETE]:\n    'If you closed the window, just try again. If it showed an error about ' +\n    'the app not being configured for your account, you are signed in to a ' +\n    'different Google account — open this page in a private window and ' +\n    'enter your work email.',\n  [AuthAppErrorCodes.SSO_FAILED]:\n    'Single sign-on could not be completed. Try again, and if it keeps ' +\n    'happening contact an administrator of your organization.',\n  // AGL-1417. Both readings, because the browser deliberately refuses to say\n  // which one happened — and the far more common one is the first.\n  [AuthAppErrorCodes.PASSKEY_NOT_COMPLETED]:\n    'If you have not set one up on this device yet, sign in another way and ' +\n    'add one from Manage account → Security. If you closed the prompt, try ' +\n    'again.',\n  [AuthAppErrorCodes.PASSKEY_SIGNIN_FAILED]:\n    'Your other sign-in methods still work — password, Google, or single ' +\n    'sign-on.',\n}\n\nexport const COOKIE_KEY_USER_TOKEN = 'aglyn-user-token'\n"],"names":["process","AuthErrorCodes","OPERATOR_CONTACT","env","NEXT_PUBLIC_OPERATOR_SUPPORT_EMAIL","trim","AuthAppErrorCodes","SSO_ACCOUNT_MISMATCH","SSO_NOT_CONFIGURED","SSO_INPUT_REQUIRED","SSO_NOT_AUTHORIZED","SSO_INCOMPLETE","SSO_FAILED","PASSKEY_NOT_COMPLETED","PASSKEY_SIGNIN_FAILED","AuthErrorIgnore","USER_CANCELLED","REDIRECT_CANCELLED_BY_USER","POPUP_CLOSED_BY_USER","AuthErrorNotice","USER_SIGNED_OUT","CREDENTIAL_TOO_OLD_LOGIN_AGAIN","AuthErrorMessage","general","ADMIN_ONLY_OPERATION","ALREADY_INITIALIZED","ARGUMENT_ERROR","CAPTCHA_CHECK_FAILED","CODE_EXPIRED","CREDENTIAL_ALREADY_IN_USE","CREDENTIAL_MISMATCH","EMAIL_CHANGE_NEEDS_VERIFICATION","EMAIL_EXISTS","EXPIRED_OOB_CODE","EXPIRED_POPUP_REQUEST","INVALID_OOB_CODE","INTERNAL_ERROR","INVALID_API_KEY","INVALID_AUTH","INVALID_AUTH_EVENT","INVALID_CERT_HASH","INVALID_CODE","INVALID_CUSTOM_TOKEN","INVALID_EMAIL","INVALID_IDP_RESPONSE","INVALID_MESSAGE_PAYLOAD","INVALID_MFA_SESSION","INVALID_ORIGIN","INVALID_PASSWORD","INVALID_PHONE_NUMBER","INVALID_RECIPIENT_EMAIL","INVALID_SENDER","INVALID_SESSION_INFO","INVALID_TENANT_ID","MFA_INFO_NOT_FOUND","MFA_REQUIRED","MISSING_CODE","MISSING_OR_INVALID_NONCE","MISSING_PHONE_NUMBER","MODULE_DESTROYED","NEED_CONFIRMATION","NETWORK_REQUEST_FAILED","NULL_USER","POPUP_BLOCKED","PROVIDER_ALREADY_LINKED","QUOTA_EXCEEDED","REJECTED_CREDENTIAL","TENANT_ID_MISMATCH","TIMEOUT","TOKEN_EXPIRED","TOO_MANY_ATTEMPTS_TRY_LATER","UNVERIFIED_EMAIL","USER_DELETED","USER_DISABLED","WEAK_PASSWORD","COOKIE_KEY_USER_TOKEN"],"mappings":"IAgEIA,iDAAAA;AAhEJ;;;;;;;;;;;;;;;CAeC,GAED,SAEEC,cAAc,QAGT,gBAAe;AAEtB;;;;;;;;;;;CAWC,GACD;;;;;;;;;;;;;;;;;;;;;;;;;CAyBC,GACD,MAAMC,mBACJ,AAAC,OAAOF,YAAY,iBAClBA,eAAAA,QAAQG,GAAG,sBAAXH,kDAAAA,aAAaI,kCAAkC,qBAA/CJ,gDAAiDK,IAAI,OACvD;AAEF,OAAO,MAAMC,oBAAoB;IAC/B,6DAA6D,GAC7DC,sBAAsB;IACtB,2DAA2D,GAC3DC,oBAAoB;IACpB,4DAA4D,GAC5DC,oBAAoB;IACpB,sEAAsE,GACtEC,oBAAoB;IACpB;;;;;;;GAOC,GACDC,gBAAgB;IAChB,mDAAmD,GACnDC,YAAY;IACZ;;;;;;;;GAQC,GACDC,uBAAuB;IACvB,2DAA2D,GAC3DC,uBAAuB;AACzB,EAAU;AAUV,OAAO,MAAMC,kBAAkB;IAC7B,CAACd,eAAee,cAAc,CAAC,EAAE;IACjC,CAACf,eAAegB,0BAA0B,CAAC,EAAE;IAC7C,CAAChB,eAAeiB,oBAAoB,CAAC,EAAE;AACzC,EAAC;AAED,OAAO,MAAMC,kBAAkB;IAC7B,CAAClB,eAAemB,eAAe,CAAC,EAAE;IAClC,CAACnB,eAAeoB,8BAA8B,CAAC,EAAE;IACjD,2EAA2E;IAC3E,wEAAwE;IACxE,CAACf,kBAAkBC,oBAAoB,CAAC,EAAE;IAC1C,CAACD,kBAAkBE,kBAAkB,CAAC,EAAE;IACxC,CAACF,kBAAkBG,kBAAkB,CAAC,EAAE;IACxC,CAACH,kBAAkBK,cAAc,CAAC,EAAE;IACpC,CAACL,kBAAkBO,qBAAqB,CAAC,EAAE;AAC7C,EAAC;AAED,OAAO,MAAMS,mBAAsD;IACjE,yEAAyE;IACzE,wEAAwE;IACxE,oEAAoE;IACpEC,SAAS,CAAC,yEAAyE,EAAErB,iBAAiB,CAAC,CAAC;IACxG,CAACD,eAAeuB,oBAAoB,CAAC,EACnC;IACF,CAACvB,eAAewB,mBAAmB,CAAC,EAClC;IACF,CAACxB,eAAeyB,cAAc,CAAC,EAAE;IACjC,CAACzB,eAAe0B,oBAAoB,CAAC,EAAE;IACvC,CAAC1B,eAAe2B,YAAY,CAAC,EAC3B;IACF,CAAC3B,eAAe4B,yBAAyB,CAAC,EACxC;IACF,CAAC5B,eAAe6B,mBAAmB,CAAC,EAClC;IACF,CAAC7B,eAAeoB,8BAA8B,CAAC,EAC7C;IACF,CAACpB,eAAe8B,+BAA+B,CAAC,EAC9C;IACF,CAAC9B,eAAe+B,YAAY,CAAC,EAC3B;IACF,CAAC/B,eAAegC,gBAAgB,CAAC,EAC/B;IACF,CAAChC,eAAeiC,qBAAqB,CAAC,EAAE;IACxC,CAACjC,eAAekC,gBAAgB,CAAC,EAC/B;IACF,wEAAwE;IACxE,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,yBAAyB;IACzB,CAAClC,eAAemC,cAAc,CAAC,EAAE,CAAC,gJAAgJ,EAAElC,iBAAiB,CAAC,CAAC;IACvM,CAACD,eAAeoC,eAAe,CAAC,EAAE;IAClC,CAACpC,eAAeqC,YAAY,CAAC,EAC3B;IACF,CAACrC,eAAesC,kBAAkB,CAAC,EAAE;IACrC,CAACtC,eAAeuC,iBAAiB,CAAC,EAChC;IACF,CAACvC,eAAewC,YAAY,CAAC,EAC3B;IACF,CAACxC,eAAeyC,oBAAoB,CAAC,EACnC;IACF,CAACzC,eAAe0C,aAAa,CAAC,EAC5B;IACF,CAAC1C,eAAe2C,oBAAoB,CAAC,EACnC;IACF,CAAC3C,eAAe4C,uBAAuB,CAAC,EACtC;IACF,CAAC5C,eAAe6C,mBAAmB,CAAC,EAClC;IACF,CAAC7C,eAAe8C,cAAc,CAAC,EAC7B;IACF,CAAC9C,eAAe+C,gBAAgB,CAAC,EAC/B;IACF,CAAC/C,eAAegD,oBAAoB,CAAC,EACnC;IACF,CAAChD,eAAeiD,uBAAuB,CAAC,EACtC;IACF,CAACjD,eAAekD,cAAc,CAAC,EAC7B;IACF,CAAClD,eAAemD,oBAAoB,CAAC,EACnC;IACF,CAACnD,eAAeoD,iBAAiB,CAAC,EAChC;IACF,CAACpD,eAAeqD,kBAAkB,CAAC,EACjC;IACF,CAACrD,eAAesD,YAAY,CAAC,EAAE;IAC/B,CAACtD,eAAeuD,YAAY,CAAC,EAAE;IAC/B,CAACvD,eAAewD,wBAAwB,CAAC,EACvC;IACF,CAACxD,eAAeyD,oBAAoB,CAAC,EACnC;IACF,CAACzD,eAAe0D,gBAAgB,CAAC,EAC/B;IACF,CAAC1D,eAAe2D,iBAAiB,CAAC,EAChC;IACF,CAAC3D,eAAe4D,sBAAsB,CAAC,EACrC;IACF,CAAC5D,eAAe6D,SAAS,CAAC,EAAE;IAC5B,CAAC7D,eAAe8D,aAAa,CAAC,EAC5B;IACF,CAAC9D,eAAe+D,uBAAuB,CAAC,EACtC;IACF,CAAC/D,eAAegE,cAAc,CAAC,EAC7B;IACF,CAAChE,eAAeiE,mBAAmB,CAAC,EAClC;IACF,CAACjE,eAAekE,kBAAkB,CAAC,EACjC;IACF,CAAClE,eAAemE,OAAO,CAAC,EAAE;IAC1B,CAACnE,eAAeoE,aAAa,CAAC,EAAE;IAChC,CAACpE,eAAeqE,2BAA2B,CAAC,EAC1C;IACF,CAACrE,eAAesE,gBAAgB,CAAC,EAC/B;IACF,CAACtE,eAAeuE,YAAY,CAAC,EAAE;IAC/B,2EAA2E;IAC3E,uEAAuE;IACvE,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,CAACvE,eAAewE,aAAa,CAAC,EAC5B,CAAC,4CAA4C,EAAEvE,iBAAiB,8CAA8C,CAAC;IACjH,CAACD,eAAemB,eAAe,CAAC,EAC9B;IACF,CAACnB,eAAeyE,aAAa,CAAC,EAC5B;IACF,2EAA2E;IAC3E,0EAA0E;IAC1E,qDAAqD;IACrD,CAACpE,kBAAkBC,oBAAoB,CAAC,EACtC,qEACA,2EACA;IACF,CAACD,kBAAkBE,kBAAkB,CAAC,EACpC,0EACA;IACF,CAACF,kBAAkBG,kBAAkB,CAAC,EACpC;IACF,CAACH,kBAAkBI,kBAAkB,CAAC,EACpC,2EACA;IACF,CAACJ,kBAAkBK,cAAc,CAAC,EAChC,2EACA,2EACA,uEACA;IACF,CAACL,kBAAkBM,UAAU,CAAC,EAC5B,uEACA;IACF,2EAA2E;IAC3E,iEAAiE;IACjE,CAACN,kBAAkBO,qBAAqB,CAAC,EACvC,4EACA,2EACA;IACF,CAACP,kBAAkBQ,qBAAqB,CAAC,EACvC,yEACA;AACJ,EAAC;AAED,OAAO,MAAM6D,wBAAwB,mBAAkB"}
+{"version":3,"sources":["../../../../../../../libs/shared/data/enums/src/lib/firebase-auth.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2023 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  type AuthError,\n  AuthErrorCodes,\n  type OAuthCredential,\n  type UserCredential,\n} from 'firebase/auth'\n\n/**\n * Codes the console raises itself, for failures Firebase has no code for\n * (AGL-1416).\n *\n * These exist because `AuthErrorAlertComponent` renders NOTHING unless the\n * error carries a `code` — an error built as `{ message }` alone is silently\n * dropped, which is how the SSO page's own messages never reached anyone.\n * Giving each failure a real code is what makes it visible, and registering a\n * caption below is what stops it falling back to the generic \"contact the\n * system administrator\" line — the single worst thing to tell someone whose\n * actual problem is that they have another Google account in session.\n */\n/**\n * Who a locked-out user is told to contact (AGL-2196).\n *\n * This string was `support@aglyn.com`, rendered on the sign-in screen of every\n * deployment — including a self-hosted one, where the only person who can\n * re-enable the account is the local operator and Aglyn's support desk has\n * never heard of the user. An unauthenticated dead end pointed at the wrong\n * company.\n *\n * Read straight from the environment rather than through\n * `operatorIdentity()`, and that is not laziness: `@aglyn/aglyn` already\n * imports this library, so importing it back would be a project cycle. The\n * same reasoning is written down in `platform-brand.ts`, which re-reads this\n * exact variable for the same reason.\n *\n * Unset, the sentence names no address at all rather than the wrong one —\n * Aglyn's own deployment sets `NEXT_PUBLIC_OPERATOR_SUPPORT_EMAIL`\n * (`.env.example`), so its copy is unchanged. Dot notation is load-bearing:\n * Next substitutes `process.env.NAME` textually and never the bracket form.\n *\n * Used by every sentence that ends a person's journey: a disabled account,\n * and the two failures they cannot act on at all — the generic fallback and\n * an internal error. Those last two are the ones a stranger meets at the\n * signup form, where a dead end with no address is indistinguishable from\n * the product being broken on purpose.\n */\nconst OPERATOR_CONTACT: string =\n  (typeof process !== 'undefined' &&\n    process.env?.NEXT_PUBLIC_OPERATOR_SUPPORT_EMAIL?.trim()) ||\n  'your administrator'\n\nexport const AuthAppErrorCodes = {\n  /** Google resolved SSO against the wrong signed-in account. */\n  SSO_ACCOUNT_MISMATCH: 'auth/sso-account-mismatch',\n  /** No SSO configured for the email domain the user typed. */\n  SSO_NOT_CONFIGURED: 'auth/sso-not-configured',\n  /** The user submitted the SSO gate without a usable email. */\n  SSO_INPUT_REQUIRED: 'auth/sso-input-required',\n  /** Authenticated with the IdP, but not a member of the organization. */\n  SSO_NOT_AUTHORIZED: 'auth/sso-not-authorized',\n  /**\n   * The IdP window closed without a result. On the SSO path this is NOT the\n   * plain cancel it is elsewhere: when Google refuses the SAML request it\n   * renders its own error page inside that window, so the user closing it\n   * looks identical to a cancel. Suppressing it — as the shared\n   * `AuthErrorIgnore` list does for popup-closed — is what left the desktop\n   * flow with Google's raw error and nothing from us.\n   */\n  SSO_INCOMPLETE: 'auth/sso-incomplete',\n  /** SSO failed for a reason we could not classify. */\n  SSO_FAILED: 'auth/sso-failed',\n  /**\n   * The WebAuthn ceremony ended without an assertion (AGL-1417).\n   *\n   * Deliberately NOT called \"cancelled\". The spec overloads\n   * `NotAllowedError` to cover a dismissed prompt, a timeout, AND no\n   * discoverable credential for the RP ID — the last on purpose, so a site\n   * cannot probe for a credential's existence. Naming this \"cancelled\" is\n   * what let \"you have no passkey on this device\" render as nothing at all.\n   */\n  PASSKEY_NOT_COMPLETED: 'auth/passkey-not-completed',\n  /** The ceremony ran but the server refused the assertion. */\n  PASSKEY_SIGNIN_FAILED: 'auth/passkey-signin-failed',\n  /**\n   * The address is on a domain that must sign in through its SSO tenant, and\n   * the account-creation blocking function refused it (AGL-1993).\n   */\n  SSO_DOMAIN_REQUIRED: 'auth/sso-domain-required',\n} as const\n\nexport type AuthAppCode =\n  (typeof AuthAppErrorCodes)[keyof typeof AuthAppErrorCodes]\n\nexport type AuthCode = IndexOf<typeof AuthErrorCodes> | AuthAppCode | 'general'\nexport type AuthResultError = AuthError //& {credential?: OAuthCredential}\nexport type AuthResultUser = UserCredential & { credential?: OAuthCredential }\nexport type AuthCallbackResult = Promise<UserCredential>\n\nexport const AuthErrorIgnore = {\n  [AuthErrorCodes.USER_CANCELLED]: true,\n  [AuthErrorCodes.REDIRECT_CANCELLED_BY_USER]: true,\n  [AuthErrorCodes.POPUP_CLOSED_BY_USER]: true,\n}\n\nexport const AuthErrorNotice = {\n  [AuthErrorCodes.USER_SIGNED_OUT]: true,\n  [AuthErrorCodes.CREDENTIAL_TOO_OLD_LOGIN_AGAIN]: true,\n  // Situations the person can fix themselves in one step. Rendering these as\n  // red errors invites a support ticket for something that is not broken.\n  [AuthAppErrorCodes.SSO_ACCOUNT_MISMATCH]: true,\n  [AuthAppErrorCodes.SSO_NOT_CONFIGURED]: true,\n  [AuthAppErrorCodes.SSO_INPUT_REQUIRED]: true,\n  [AuthAppErrorCodes.SSO_INCOMPLETE]: true,\n  [AuthAppErrorCodes.PASSKEY_NOT_COMPLETED]: true,\n  [AuthAppErrorCodes.SSO_DOMAIN_REQUIRED]: true,\n}\n\nexport const AuthErrorMessage: Partial<Record<AuthCode, string>> = {\n  // \"the system administrator\" is nobody a person signing up can find. The\n  // fallback sentence is the last thing they read before giving up, so it\n  // names a reachable address and says the attempt is safe to repeat.\n  general: `An error has occurred. Please try again — if it keeps happening, contact ${OPERATOR_CONTACT}.`,\n  [AuthErrorCodes.ADMIN_ONLY_OPERATION]:\n    'You are not authorized to perform this action.',\n  [AuthErrorCodes.ALREADY_INITIALIZED]:\n    'Failed to initialize authenticator. Already initialized.',\n  [AuthErrorCodes.ARGUMENT_ERROR]: 'Failed to provide valid arguments.',\n  [AuthErrorCodes.CAPTCHA_CHECK_FAILED]: 'CAPTCHA check failed. Try again.',\n  [AuthErrorCodes.CODE_EXPIRED]:\n    'Authentication code has expired. Request a new code and try again.',\n  [AuthErrorCodes.CREDENTIAL_ALREADY_IN_USE]:\n    'Authentication credential already in use.',\n  [AuthErrorCodes.CREDENTIAL_MISMATCH]:\n    'Unable to perform action. Authentication token mismatch.',\n  [AuthErrorCodes.CREDENTIAL_TOO_OLD_LOGIN_AGAIN]:\n    'You have been signed out. Sign in again to continue.',\n  [AuthErrorCodes.EMAIL_CHANGE_NEEDS_VERIFICATION]:\n    'New email is not verified. Check your email to verify.',\n  [AuthErrorCodes.EMAIL_EXISTS]:\n    'Account with email already exists. Sign in instead.',\n  [AuthErrorCodes.EXPIRED_OOB_CODE]:\n    'This link has expired. Request a new password reset link and try again.',\n  [AuthErrorCodes.EXPIRED_POPUP_REQUEST]: 'Request timeout. Try again.',\n  [AuthErrorCodes.INVALID_OOB_CODE]:\n    'This link is invalid or has already been used. Request a new password reset link.',\n  // A server-side failure, and the only Auth code a person can do nothing\n  // about. It is also where a refusing `beforeUserCreated` blocking function\n  // surfaces, so this exact sentence is what a stranger sees when signup is\n  // broken platform-side. Say the fault is ours, that their details were not\n  // kept, and who to tell.\n  [AuthErrorCodes.INTERNAL_ERROR]: `Something went wrong on our end — no account was created and nothing you entered was saved. Please try again, and if it keeps happening contact ${OPERATOR_CONTACT}.`,\n  [AuthErrorCodes.INVALID_API_KEY]: 'Invalid API key.',\n  [AuthErrorCodes.INVALID_AUTH]:\n    'Unable to perform action. Invalid authentication token.',\n  [AuthErrorCodes.INVALID_AUTH_EVENT]: 'Invalid authentication event.',\n  [AuthErrorCodes.INVALID_CERT_HASH]:\n    'Multi-factor authentication is required.',\n  [AuthErrorCodes.INVALID_CODE]:\n    'Invalid verification code. Try again with a different code.',\n  [AuthErrorCodes.INVALID_CUSTOM_TOKEN]:\n    'Unable to perform action. Invalid authentication token.',\n  [AuthErrorCodes.INVALID_EMAIL]:\n    'Unable to perform action. Email provided is invalid.',\n  [AuthErrorCodes.INVALID_IDP_RESPONSE]:\n    'Unable to perform action. Invalid authentication credential.',\n  [AuthErrorCodes.INVALID_MESSAGE_PAYLOAD]:\n    'Unable to perform action. Invalid message payload.',\n  [AuthErrorCodes.INVALID_MFA_SESSION]:\n    'Unable to perform action. Invalid multi-factor authentication.',\n  [AuthErrorCodes.INVALID_ORIGIN]:\n    'This domain is unauthorized to perform this action.',\n  [AuthErrorCodes.INVALID_PASSWORD]:\n    'No account matches the credentials provided.',\n  [AuthErrorCodes.INVALID_PHONE_NUMBER]:\n    'No account matches the credentials provided.',\n  [AuthErrorCodes.INVALID_RECIPIENT_EMAIL]:\n    'Unable to perform action. Invalid recipient email.',\n  [AuthErrorCodes.INVALID_SENDER]:\n    'Unable to perform action. Invalid sender email.',\n  [AuthErrorCodes.INVALID_SESSION_INFO]:\n    'Unable to perform action. Invalid verification ID.',\n  [AuthErrorCodes.INVALID_TENANT_ID]:\n    'Unable to perform action. Invalid tenant ID.',\n  [AuthErrorCodes.MFA_INFO_NOT_FOUND]:\n    'Unable to perform action. Multi-factor authentication info not found.',\n  [AuthErrorCodes.MFA_REQUIRED]: 'Multi-factor authentication is required.',\n  [AuthErrorCodes.MISSING_CODE]: 'Verification code is missing.',\n  [AuthErrorCodes.MISSING_OR_INVALID_NONCE]:\n    'Unable to perform action. Missing or invalid nonce.',\n  [AuthErrorCodes.MISSING_PHONE_NUMBER]:\n    'Unable to perform action. Missing phone number.',\n  [AuthErrorCodes.MODULE_DESTROYED]:\n    'Unable to perform action. App has been destroyed.',\n  [AuthErrorCodes.NEED_CONFIRMATION]:\n    'Authentication credential already in use with different credential.',\n  [AuthErrorCodes.NETWORK_REQUEST_FAILED]:\n    'Unable to connect. Check your internet connection and try again.',\n  [AuthErrorCodes.NULL_USER]: 'No account matches the credentials provided.',\n  [AuthErrorCodes.POPUP_BLOCKED]:\n    'Popups blocked. Allow popups in your browser and try again.',\n  [AuthErrorCodes.PROVIDER_ALREADY_LINKED]:\n    'Unable to perform action. Provider is linked to another account.',\n  [AuthErrorCodes.QUOTA_EXCEEDED]:\n    'Unable to perform action. Usage quota has been exceeded.',\n  [AuthErrorCodes.REJECTED_CREDENTIAL]:\n    'Unable to perform action. Rejected credential.',\n  [AuthErrorCodes.TENANT_ID_MISMATCH]:\n    'Unable to perform action. Authentication tenant ID mismatch.',\n  [AuthErrorCodes.TIMEOUT]: 'Unable to perform action. Timeout.',\n  [AuthErrorCodes.TOKEN_EXPIRED]: 'Your authentication token has expired.',\n  [AuthErrorCodes.TOO_MANY_ATTEMPTS_TRY_LATER]:\n    'Account blocked from too many attempts. Try again later.',\n  [AuthErrorCodes.UNVERIFIED_EMAIL]:\n    'Email is not verified. Check your email to verify.',\n  [AuthErrorCodes.USER_DELETED]: 'No account matches the credentials provided.',\n  // Lockdown (AGL-1501): a user-scope lock disables the Firebase account, so\n  // this is the notice a locked-out person actually sees at sign-in. The\n  // copy is the action, not the diagnosis — the reason lives with support.\n  // It is also where a BANNED account learns it may appeal (AGL-3420): the\n  // sign-in form cannot know why an account is disabled, so it names both.\n  [AuthErrorCodes.USER_DISABLED]:\n    `This account is currently disabled. Contact ${OPERATOR_CONTACT} to restore access, or to appeal the decision.`,\n  [AuthErrorCodes.USER_SIGNED_OUT]:\n    'You have been signed out. Sign in again to continue.',\n  [AuthErrorCodes.WEAK_PASSWORD]:\n    'Password is too weak. Enter a stronger password and try again.',\n  // AGL-1416. The captions carry the ACTION, because the headline above them\n  // is the diagnosis and a diagnosis with no next step is what sends people\n  // to their IT admin for a problem only they can fix.\n  [AuthAppErrorCodes.SSO_ACCOUNT_MISMATCH]:\n    'Your browser is signed in to another Google account, and single ' +\n    'sign-on was resolved against that one. Sign out of the other account, ' +\n    'or open this page in a private window, then try again.',\n  [AuthAppErrorCodes.SSO_NOT_CONFIGURED]:\n    'Check the spelling of your work email, or sign in with your password ' +\n    'or Google instead.',\n  [AuthAppErrorCodes.SSO_INPUT_REQUIRED]:\n    'Enter the full work email address your organization uses.',\n  [AuthAppErrorCodes.SSO_NOT_AUTHORIZED]:\n    'Ask an administrator of that organization to invite you, then sign in ' +\n    'again.',\n  [AuthAppErrorCodes.SSO_INCOMPLETE]:\n    'If you closed the window, just try again. If it showed an error about ' +\n    'the app not being configured for your account, you are signed in to a ' +\n    'different Google account — open this page in a private window and ' +\n    'enter your work email.',\n  [AuthAppErrorCodes.SSO_FAILED]:\n    'Single sign-on could not be completed. Try again, and if it keeps ' +\n    'happening contact an administrator of your organization.',\n  // AGL-1417. Both readings, because the browser deliberately refuses to say\n  // which one happened — and the far more common one is the first.\n  [AuthAppErrorCodes.PASSKEY_NOT_COMPLETED]:\n    'If you have not set one up on this device yet, sign in another way and ' +\n    'add one from Manage account → Security. If you closed the prompt, try ' +\n    'again.',\n  [AuthAppErrorCodes.PASSKEY_SIGNIN_FAILED]:\n    'Your other sign-in methods still work — password, Google, or single ' +\n    'sign-on.',\n  [AuthAppErrorCodes.SSO_DOMAIN_REQUIRED]:\n    'No account was created. Choose Single sign-on (SSO) on the sign-in ' +\n    'page and enter this address.',\n}\n\n/**\n * The text `cloud/functions` puts in its SSO-domain refusal (AGL-1993).\n * Identity Platform reports every blocking-function error as\n * `auth/internal-error`, so this marker is the only way to tell that refusal\n * from a real outage.\n */\nexport const SSO_DOMAIN_REQUIRED_MARKER = 'sso-domain-required'\n\n/**\n * The error as a person should see it. A blocking-function refusal arrives as\n * `auth/internal-error` with Identity Platform's raw JSON for a message;\n * the SSO-domain one is given its own code and sentence, and every other\n * error is returned unchanged.\n */\nexport function normalizeAuthError<T extends AuthResultError | null | undefined>(\n  error: T,\n): T {\n  if (\n    error?.code === AuthErrorCodes.INTERNAL_ERROR &&\n    String(error.message ?? '').includes(SSO_DOMAIN_REQUIRED_MARKER)\n  ) {\n    return {\n      ...error,\n      code: AuthAppErrorCodes.SSO_DOMAIN_REQUIRED,\n      message: 'This address signs in with single sign-on.',\n    } as T\n  }\n  return error\n}\n\nexport const COOKIE_KEY_USER_TOKEN = 'aglyn-user-token'\n"],"names":["process","AuthErrorCodes","OPERATOR_CONTACT","env","NEXT_PUBLIC_OPERATOR_SUPPORT_EMAIL","trim","AuthAppErrorCodes","SSO_ACCOUNT_MISMATCH","SSO_NOT_CONFIGURED","SSO_INPUT_REQUIRED","SSO_NOT_AUTHORIZED","SSO_INCOMPLETE","SSO_FAILED","PASSKEY_NOT_COMPLETED","PASSKEY_SIGNIN_FAILED","SSO_DOMAIN_REQUIRED","AuthErrorIgnore","USER_CANCELLED","REDIRECT_CANCELLED_BY_USER","POPUP_CLOSED_BY_USER","AuthErrorNotice","USER_SIGNED_OUT","CREDENTIAL_TOO_OLD_LOGIN_AGAIN","AuthErrorMessage","general","ADMIN_ONLY_OPERATION","ALREADY_INITIALIZED","ARGUMENT_ERROR","CAPTCHA_CHECK_FAILED","CODE_EXPIRED","CREDENTIAL_ALREADY_IN_USE","CREDENTIAL_MISMATCH","EMAIL_CHANGE_NEEDS_VERIFICATION","EMAIL_EXISTS","EXPIRED_OOB_CODE","EXPIRED_POPUP_REQUEST","INVALID_OOB_CODE","INTERNAL_ERROR","INVALID_API_KEY","INVALID_AUTH","INVALID_AUTH_EVENT","INVALID_CERT_HASH","INVALID_CODE","INVALID_CUSTOM_TOKEN","INVALID_EMAIL","INVALID_IDP_RESPONSE","INVALID_MESSAGE_PAYLOAD","INVALID_MFA_SESSION","INVALID_ORIGIN","INVALID_PASSWORD","INVALID_PHONE_NUMBER","INVALID_RECIPIENT_EMAIL","INVALID_SENDER","INVALID_SESSION_INFO","INVALID_TENANT_ID","MFA_INFO_NOT_FOUND","MFA_REQUIRED","MISSING_CODE","MISSING_OR_INVALID_NONCE","MISSING_PHONE_NUMBER","MODULE_DESTROYED","NEED_CONFIRMATION","NETWORK_REQUEST_FAILED","NULL_USER","POPUP_BLOCKED","PROVIDER_ALREADY_LINKED","QUOTA_EXCEEDED","REJECTED_CREDENTIAL","TENANT_ID_MISMATCH","TIMEOUT","TOKEN_EXPIRED","TOO_MANY_ATTEMPTS_TRY_LATER","UNVERIFIED_EMAIL","USER_DELETED","USER_DISABLED","WEAK_PASSWORD","SSO_DOMAIN_REQUIRED_MARKER","normalizeAuthError","error","code","String","message","includes","COOKIE_KEY_USER_TOKEN"],"mappings":";IAgEIA,iDAAAA;AAhEJ;;;;;;;;;;;;;;;CAeC,GAED,SAEEC,cAAc,QAGT,gBAAe;AAEtB;;;;;;;;;;;CAWC,GACD;;;;;;;;;;;;;;;;;;;;;;;;;CAyBC,GACD,MAAMC,mBACJ,AAAC,OAAOF,YAAY,iBAClBA,eAAAA,QAAQG,GAAG,sBAAXH,kDAAAA,aAAaI,kCAAkC,qBAA/CJ,gDAAiDK,IAAI,OACvD;AAEF,OAAO,MAAMC,oBAAoB;IAC/B,6DAA6D,GAC7DC,sBAAsB;IACtB,2DAA2D,GAC3DC,oBAAoB;IACpB,4DAA4D,GAC5DC,oBAAoB;IACpB,sEAAsE,GACtEC,oBAAoB;IACpB;;;;;;;GAOC,GACDC,gBAAgB;IAChB,mDAAmD,GACnDC,YAAY;IACZ;;;;;;;;GAQC,GACDC,uBAAuB;IACvB,2DAA2D,GAC3DC,uBAAuB;IACvB;;;GAGC,GACDC,qBAAqB;AACvB,EAAU;AAUV,OAAO,MAAMC,kBAAkB;IAC7B,CAACf,eAAegB,cAAc,CAAC,EAAE;IACjC,CAAChB,eAAeiB,0BAA0B,CAAC,EAAE;IAC7C,CAACjB,eAAekB,oBAAoB,CAAC,EAAE;AACzC,EAAC;AAED,OAAO,MAAMC,kBAAkB;IAC7B,CAACnB,eAAeoB,eAAe,CAAC,EAAE;IAClC,CAACpB,eAAeqB,8BAA8B,CAAC,EAAE;IACjD,2EAA2E;IAC3E,wEAAwE;IACxE,CAAChB,kBAAkBC,oBAAoB,CAAC,EAAE;IAC1C,CAACD,kBAAkBE,kBAAkB,CAAC,EAAE;IACxC,CAACF,kBAAkBG,kBAAkB,CAAC,EAAE;IACxC,CAACH,kBAAkBK,cAAc,CAAC,EAAE;IACpC,CAACL,kBAAkBO,qBAAqB,CAAC,EAAE;IAC3C,CAACP,kBAAkBS,mBAAmB,CAAC,EAAE;AAC3C,EAAC;AAED,OAAO,MAAMQ,mBAAsD;IACjE,yEAAyE;IACzE,wEAAwE;IACxE,oEAAoE;IACpEC,SAAS,CAAC,yEAAyE,EAAEtB,iBAAiB,CAAC,CAAC;IACxG,CAACD,eAAewB,oBAAoB,CAAC,EACnC;IACF,CAACxB,eAAeyB,mBAAmB,CAAC,EAClC;IACF,CAACzB,eAAe0B,cAAc,CAAC,EAAE;IACjC,CAAC1B,eAAe2B,oBAAoB,CAAC,EAAE;IACvC,CAAC3B,eAAe4B,YAAY,CAAC,EAC3B;IACF,CAAC5B,eAAe6B,yBAAyB,CAAC,EACxC;IACF,CAAC7B,eAAe8B,mBAAmB,CAAC,EAClC;IACF,CAAC9B,eAAeqB,8BAA8B,CAAC,EAC7C;IACF,CAACrB,eAAe+B,+BAA+B,CAAC,EAC9C;IACF,CAAC/B,eAAegC,YAAY,CAAC,EAC3B;IACF,CAAChC,eAAeiC,gBAAgB,CAAC,EAC/B;IACF,CAACjC,eAAekC,qBAAqB,CAAC,EAAE;IACxC,CAAClC,eAAemC,gBAAgB,CAAC,EAC/B;IACF,wEAAwE;IACxE,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,yBAAyB;IACzB,CAACnC,eAAeoC,cAAc,CAAC,EAAE,CAAC,gJAAgJ,EAAEnC,iBAAiB,CAAC,CAAC;IACvM,CAACD,eAAeqC,eAAe,CAAC,EAAE;IAClC,CAACrC,eAAesC,YAAY,CAAC,EAC3B;IACF,CAACtC,eAAeuC,kBAAkB,CAAC,EAAE;IACrC,CAACvC,eAAewC,iBAAiB,CAAC,EAChC;IACF,CAACxC,eAAeyC,YAAY,CAAC,EAC3B;IACF,CAACzC,eAAe0C,oBAAoB,CAAC,EACnC;IACF,CAAC1C,eAAe2C,aAAa,CAAC,EAC5B;IACF,CAAC3C,eAAe4C,oBAAoB,CAAC,EACnC;IACF,CAAC5C,eAAe6C,uBAAuB,CAAC,EACtC;IACF,CAAC7C,eAAe8C,mBAAmB,CAAC,EAClC;IACF,CAAC9C,eAAe+C,cAAc,CAAC,EAC7B;IACF,CAAC/C,eAAegD,gBAAgB,CAAC,EAC/B;IACF,CAAChD,eAAeiD,oBAAoB,CAAC,EACnC;IACF,CAACjD,eAAekD,uBAAuB,CAAC,EACtC;IACF,CAAClD,eAAemD,cAAc,CAAC,EAC7B;IACF,CAACnD,eAAeoD,oBAAoB,CAAC,EACnC;IACF,CAACpD,eAAeqD,iBAAiB,CAAC,EAChC;IACF,CAACrD,eAAesD,kBAAkB,CAAC,EACjC;IACF,CAACtD,eAAeuD,YAAY,CAAC,EAAE;IAC/B,CAACvD,eAAewD,YAAY,CAAC,EAAE;IAC/B,CAACxD,eAAeyD,wBAAwB,CAAC,EACvC;IACF,CAACzD,eAAe0D,oBAAoB,CAAC,EACnC;IACF,CAAC1D,eAAe2D,gBAAgB,CAAC,EAC/B;IACF,CAAC3D,eAAe4D,iBAAiB,CAAC,EAChC;IACF,CAAC5D,eAAe6D,sBAAsB,CAAC,EACrC;IACF,CAAC7D,eAAe8D,SAAS,CAAC,EAAE;IAC5B,CAAC9D,eAAe+D,aAAa,CAAC,EAC5B;IACF,CAAC/D,eAAegE,uBAAuB,CAAC,EACtC;IACF,CAAChE,eAAeiE,cAAc,CAAC,EAC7B;IACF,CAACjE,eAAekE,mBAAmB,CAAC,EAClC;IACF,CAAClE,eAAemE,kBAAkB,CAAC,EACjC;IACF,CAACnE,eAAeoE,OAAO,CAAC,EAAE;IAC1B,CAACpE,eAAeqE,aAAa,CAAC,EAAE;IAChC,CAACrE,eAAesE,2BAA2B,CAAC,EAC1C;IACF,CAACtE,eAAeuE,gBAAgB,CAAC,EAC/B;IACF,CAACvE,eAAewE,YAAY,CAAC,EAAE;IAC/B,2EAA2E;IAC3E,uEAAuE;IACvE,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,CAACxE,eAAeyE,aAAa,CAAC,EAC5B,CAAC,4CAA4C,EAAExE,iBAAiB,8CAA8C,CAAC;IACjH,CAACD,eAAeoB,eAAe,CAAC,EAC9B;IACF,CAACpB,eAAe0E,aAAa,CAAC,EAC5B;IACF,2EAA2E;IAC3E,0EAA0E;IAC1E,qDAAqD;IACrD,CAACrE,kBAAkBC,oBAAoB,CAAC,EACtC,qEACA,2EACA;IACF,CAACD,kBAAkBE,kBAAkB,CAAC,EACpC,0EACA;IACF,CAACF,kBAAkBG,kBAAkB,CAAC,EACpC;IACF,CAACH,kBAAkBI,kBAAkB,CAAC,EACpC,2EACA;IACF,CAACJ,kBAAkBK,cAAc,CAAC,EAChC,2EACA,2EACA,uEACA;IACF,CAACL,kBAAkBM,UAAU,CAAC,EAC5B,uEACA;IACF,2EAA2E;IAC3E,iEAAiE;IACjE,CAACN,kBAAkBO,qBAAqB,CAAC,EACvC,4EACA,2EACA;IACF,CAACP,kBAAkBQ,qBAAqB,CAAC,EACvC,yEACA;IACF,CAACR,kBAAkBS,mBAAmB,CAAC,EACrC,wEACA;AACJ,EAAC;AAED;;;;;CAKC,GACD,OAAO,MAAM6D,6BAA6B,sBAAqB;AAE/D;;;;;CAKC,GACD,OAAO,SAASC,mBACdC,KAAQ;QAICA;IAFT,IACEA,CAAAA,yBAAAA,MAAOC,IAAI,MAAK9E,eAAeoC,cAAc,IAC7C2C,QAAOF,iBAAAA,MAAMG,OAAO,YAAbH,iBAAiB,IAAII,QAAQ,CAACN,6BACrC;QACA,OAAO,aACFE;YACHC,MAAMzE,kBAAkBS,mBAAmB;YAC3CkE,SAAS;;IAEb;IACA,OAAOH;AACT;AAEA,OAAO,MAAMK,wBAAwB,mBAAkB"}