@flytedesk/app-kit 3.2.3 → 4.0.0

package/dist/auth/client/useAuthSession.d.ts

@@ -1,5 +1,19 @@
+import { AuthUnavailableError } from "./httpClient.js";
 import { type AppSwitcherEntry } from "../shared-types.js";
-export type AuthStatus = "loading" | "authenticated" | "unauthenticated" | "error";
+export type AuthStatus = "loading" | "authenticated" | "unauthenticated" | "unavailable" | "error";
+/** First delay before re-verifying a session the server could not verify (AK-23). */
+export declare const UNAVAILABLE_RETRY_BASE_MS = 1000;
+/** The backoff's ceiling: an outage is retried every this-many ms at most. */
+export declare const UNAVAILABLE_RETRY_MAX_MS = 30000;
+/**
+ * Jittered exponential backoff for the `"unavailable"` state's automatic retries: the
+ * ceiling doubles per attempt (1s, 2s, 4s, … capped at UNAVAILABLE_RETRY_MAX_MS) and the
+ * delay is drawn uniformly from its upper half ("equal jitter", AK-23 L-c) — so every
+ * tab that saw the same outage does not retry in the same instant when it ends, while a
+ * retry never comes sooner than half the ceiling. `attempt` counts from 0; `random` is
+ * `Math.random` (a seam for tests).
+ */
+export declare function unavailableRetryDelayMs(attempt: number, random?: () => number): number;
 interface AuthSessionActions {
     /** Surfaces a failed sign-out as a rejection (fail loudly, AK-16) — local state is
      *  cleared once the api confirms it, OR once a `logout_store_failed` response proves
@@ -8,40 +22,74 @@ interface AuthSessionActions {
      *  promise (as a design system's AccountMenu typically does) gets an honest failure
      *  instead of silence. */
     signOut: () => Promise<void>;
-    /** Starts a new bootstrap load from scratch — e.g. a Retry action on the error state. */
+    /** Starts a new bootstrap load from scratch — e.g. a Retry action on the error state.
+     *  It supersedes any load (or pending retry) already in flight: that load's answer is
+     *  ignored, and the one `POST /refresh` it may be waiting on is joined, not repeated. */
     refetch: () => void;
 }
-export interface LoadingSessionState extends AuthSessionActions {
+/**
+ * The "All flytedesk apps" switcher feed is decoration, not the session (AK-23, N2): it
+ * never decides the status. When `GET {routePrefix}/apps` fails, `apps` is `[]` and
+ * `appsError` carries the failure (for an optional "couldn't load apps" hint); the session
+ * still becomes "authenticated". The next successful load clears it.
+ */
+interface AppsFeed {
+    apps: AppSwitcherEntry[];
+    appsError: Error | null;
+}
+export interface LoadingSessionState extends AuthSessionActions, AppsFeed {
     status: "loading";
     user: null;
-    apps: AppSwitcherEntry[];
+    appsError: null;
     error: null;
 }
 /** "authenticated" always carries a user — there is no way to construct this variant
  *  without one, unlike the pre-AK-18 `{ status: AuthStatus; user: TUser | null }` shape
  *  that forced every consumer to handle an impossible `authenticated && !user` state by
  *  hand (sms-app's App.tsx, before this card). */
-export interface AuthenticatedSessionState<TUser> extends AuthSessionActions {
+export interface AuthenticatedSessionState<TUser> extends AuthSessionActions, AppsFeed {
     status: "authenticated";
     user: TUser;
-    apps: AppSwitcherEntry[];
     error: null;
 }
-export interface UnauthenticatedSessionState extends AuthSessionActions {
+export interface UnauthenticatedSessionState extends AuthSessionActions, AppsFeed {
     status: "unauthenticated";
     user: null;
-    apps: AppSwitcherEntry[];
+    appsError: null;
     error: null;
 }
-/** Set only when loading the session failed for a reason OTHER than being signed out —
- *  the api errored, or a request it depends on missed its deadline. */
-export interface ErrorSessionState extends AuthSessionActions {
+/**
+ * AK-23: the server could not verify the session right now — flytedesk-id or the app's
+ * AuthStore is down (an `AuthUnavailableError`, a 503). NOT signed out: the session is
+ * kept (`user` is the last verified user, or null if none was verified yet) and the hook
+ * re-verifies it by itself, with exponential backoff (`retryInMs` until the next try,
+ * capped at UNAVAILABLE_RETRY_MAX_MS), until the server answers — then it moves to
+ * "authenticated", or to "unauthenticated" only if the server actually says so. Entered
+ * from the bootstrap, or from "authenticated" when any request made through this
+ * client hits the outage — including the automatic refresh reaching no decision at all
+ * (no answer, no answer in time, or an infrastructure 502/503/504: `AUTH_UNREACHABLE_CODE`).
+ * Render it as "reconnecting", never as a sign-in screen.
+ *
+ * `user` is DISPLAY-ONLY (AK-23, L-c): it is who was signed in when the outage began, kept
+ * so the page can keep showing them while it reconnects. It is not a verified identity
+ * right now — no authorization decision (showing an admin-only control, enabling a
+ * destructive action) may be based on it; the server re-checks every request anyway.
+ */
+export interface UnavailableSessionState<TUser> extends AuthSessionActions, AppsFeed {
+    status: "unavailable";
+    user: TUser | null;
+    error: AuthUnavailableError;
+    retryInMs: number;
+}
+/** Set only when loading the session failed for a reason OTHER than being signed out or
+ *  an auth outage — the api errored, or a request it depends on missed its deadline. */
+export interface ErrorSessionState extends AuthSessionActions, AppsFeed {
     status: "error";
     user: null;
-    apps: AppSwitcherEntry[];
+    appsError: null;
     error: Error;
 }
-export type AuthSessionState<TUser> = LoadingSessionState | AuthenticatedSessionState<TUser> | UnauthenticatedSessionState | ErrorSessionState;
+export type AuthSessionState<TUser> = LoadingSessionState | AuthenticatedSessionState<TUser> | UnauthenticatedSessionState | UnavailableSessionState<TUser> | ErrorSessionState;
 /**
  * `TUser` defaults to `unknown` deliberately: a consuming app almost always has its
  * own richer local type (or the exact shape @flytedesk/app-kit/auth's AuthedUser

package/dist/auth/client/useAuthSession.js

@@ -17,9 +17,24 @@
  * keeps SessionKit, just pointed at this module's apiRequest instead of its local copy.
  */
 import * as React from "react";
-import { apiRequest, ApiRequestError, setAccessToken } from "./httpClient.js";
+import { apiRequest, ApiRequestError, AuthUnavailableError, onAuthUnavailable, refreshAccessToken, setAccessToken, } from "./httpClient.js";
 import { AUTH_ROUTE_PREFIX, authRoutePath } from "../shared-types.js";
-const REFRESH_PATH = authRoutePath(AUTH_ROUTE_PREFIX, "refresh");
+/** First delay before re-verifying a session the server could not verify (AK-23). */
+export const UNAVAILABLE_RETRY_BASE_MS = 1_000;
+/** The backoff's ceiling: an outage is retried every this-many ms at most. */
+export const UNAVAILABLE_RETRY_MAX_MS = 30_000;
+/**
+ * Jittered exponential backoff for the `"unavailable"` state's automatic retries: the
+ * ceiling doubles per attempt (1s, 2s, 4s, … capped at UNAVAILABLE_RETRY_MAX_MS) and the
+ * delay is drawn uniformly from its upper half ("equal jitter", AK-23 L-c) — so every
+ * tab that saw the same outage does not retry in the same instant when it ends, while a
+ * retry never comes sooner than half the ceiling. `attempt` counts from 0; `random` is
+ * `Math.random` (a seam for tests).
+ */
+export function unavailableRetryDelayMs(attempt, random = Math.random) {
+    const ceiling = Math.min(UNAVAILABLE_RETRY_BASE_MS * 2 ** attempt, UNAVAILABLE_RETRY_MAX_MS);
+    return Math.round(ceiling / 2 + random() * (ceiling / 2));
+}
 const ME_PATH = authRoutePath(AUTH_ROUTE_PREFIX, "me");
 const APPS_PATH = authRoutePath(AUTH_ROUTE_PREFIX, "apps");
 const LOGOUT_PATH = authRoutePath(AUTH_ROUTE_PREFIX, "logout");
@@ -33,7 +48,9 @@ export function useAuthSession() {
     const [status, setStatus] = React.useState("loading");
     const [user, setUser] = React.useState(null);
     const [apps, setApps] = React.useState([]);
+    const [appsError, setAppsError] = React.useState(null);
     const [error, setError] = React.useState(null);
+    const [unavailable, setUnavailable] = React.useState(null);
     const [generation, setGeneration] = React.useState(0);
     // POST {routePrefix}/refresh ROTATES the refresh cookie on every call (reuse detection
     // — see @flytedesk/app-kit/auth's plugin.ts) — a second call presenting the same,
@@ -47,72 +64,198 @@ export function useAuthSession() {
     // flag — is what makes the second StrictMode invocation a no-op while still letting
     // `refetch()` (which bumps `generation`) start a genuinely new load.
     const startedGenerationRef = React.useRef(null);
+    // The load/retry machinery, created once per mounted hook (lazy useState initializer:
+    // guaranteed stable, unlike useMemo). It only touches state setters, which React keeps
+    // stable, and its own mutable fields.
+    const [session] = React.useState(() => {
+        const engine = {
+            /** Mirrors `status`, readable from outside a render (the outage listener). */
+            status: "loading",
+            /** Whether the hook is mounted — a retry never fires into an unmounted one. */
+            active: false,
+            retryTimer: null,
+            retryAttempt: 0,
+            /**
+             * AK-23 (L-a): which load may still change state. `signOut` and every fresh load
+             * (the bootstrap, `refetch`) bump it; a load that finds the epoch moved on since it
+             * started is stale and drops its answer — so a retry still in flight can neither
+             * put a signed-out session back into "unavailable" nor overwrite a newer load.
+             */
+            epoch: 0,
+            setStatus(next) {
+                engine.status = next;
+                setStatus(next);
+            },
+            clearRetry() {
+                if (engine.retryTimer !== null)
+                    clearTimeout(engine.retryTimer);
+                engine.retryTimer = null;
+            },
+            /** Ends every load in flight and any pending retry — their answers are ignored —
+             *  and returns the new epoch. */
+            supersede() {
+                engine.clearRetry();
+                engine.epoch += 1;
+                return engine.epoch;
+            },
+            /**
+             * Refresh -> me -> apps. `fresh` (a new bootstrap) supersedes any load in flight and
+             * shows "loading"; a retry keeps whatever the user is looking at until it has an
+             * answer.
+             *
+             * The refresh is httpClient's shared, single-flighted `refreshAccessToken`, so a
+             * load started while another one (or any 401-triggered refresh) is waiting on
+             * `POST /refresh` JOINS that request instead of presenting the same rotating cookie
+             * a second time. `/me` and `/apps` skip the 401 -> refresh -> recovery dance: right
+             * after a refresh, a 401 is the answer itself, and a load must never start the
+             * app's auth recovery (which could sign a user back in after `signOut`).
+             */
+            async load(fresh) {
+                const epoch = fresh ? engine.supersede() : engine.epoch;
+                const current = () => epoch === engine.epoch;
+                if (fresh) {
+                    engine.retryAttempt = 0;
+                    setError(null);
+                    setUnavailable(null);
+                    engine.setStatus("loading");
+                }
+                try {
+                    const accessToken = await refreshAccessToken();
+                    if (!current())
+                        return;
+                    if (accessToken === null) {
+                        engine.settleSignedOut();
+                        return;
+                    }
+                    const me = await apiRequest(ME_PATH, { skipAuthRetry: true });
+                    if (!current())
+                        return;
+                    const feed = await engine.loadApps();
+                    if (!current())
+                        return;
+                    setUser(me.user);
+                    setApps(feed.apps);
+                    setAppsError(feed.error);
+                    engine.retryAttempt = 0;
+                    setUnavailable(null);
+                    engine.setStatus("authenticated");
+                }
+                catch (err) {
+                    if (!current())
+                        return;
+                    if (err instanceof AuthUnavailableError) {
+                        engine.scheduleRetry(err);
+                        return;
+                    }
+                    if (err instanceof ApiRequestError && err.status === 401) {
+                        engine.settleSignedOut();
+                        return;
+                    }
+                    engine.retryAttempt = 0;
+                    setUnavailable(null);
+                    setError(err instanceof Error ? err : new Error(String(err)));
+                    engine.setStatus("error");
+                }
+            },
+            /** The switcher feed, non-blocking (AK-23, N2): a failure is `apps: []` plus the
+             *  error, never a failed load. */
+            async loadApps() {
+                try {
+                    const res = await apiRequest(APPS_PATH, { skipAuthRetry: true });
+                    return { apps: res.apps, error: null };
+                }
+                catch (err) {
+                    return { apps: [], error: err instanceof Error ? err : new Error(String(err)) };
+                }
+            },
+            /** The server said this browser has no session: local state follows. */
+            settleSignedOut() {
+                engine.clearRetry();
+                engine.retryAttempt = 0;
+                setAccessToken(null);
+                setUser(null);
+                setApps([]);
+                setAppsError(null);
+                setUnavailable(null);
+                engine.setStatus("unauthenticated");
+            },
+            /** Enters (or stays in) "unavailable" and re-verifies after the next backoff delay.
+             *  One pending retry at a time: a burst of failing requests schedules one. */
+            scheduleRetry(err) {
+                if (!engine.active || engine.retryTimer !== null)
+                    return;
+                const retryInMs = unavailableRetryDelayMs(engine.retryAttempt);
+                engine.retryAttempt += 1;
+                setUnavailable({ error: err, retryInMs });
+                engine.setStatus("unavailable");
+                engine.retryTimer = setTimeout(() => {
+                    engine.retryTimer = null;
+                    void engine.load(false);
+                }, retryInMs);
+            },
+        };
+        return engine;
+    });
+    React.useEffect(() => {
+        session.active = true;
+        // An ordinary request (anywhere in the app) hitting an outage while signed in: keep
+        // the user, show "unavailable", and re-verify — never treat it as a sign-out.
+        const unsubscribe = onAuthUnavailable((err) => {
+            if (session.status === "authenticated")
+                session.scheduleRetry(err);
+        });
+        return () => {
+            session.active = false;
+            session.clearRetry();
+            unsubscribe();
+        };
+    }, [session]);
     React.useEffect(() => {
         if (startedGenerationRef.current === generation)
             return;
         startedGenerationRef.current = generation;
-        async function load() {
-            setStatus("loading");
-            setError(null);
-            try {
-                const refreshed = await apiRequest(REFRESH_PATH, { method: "POST" });
-                setAccessToken(refreshed.accessToken);
-                const me = await apiRequest(ME_PATH);
-                setUser(me.user);
-                const appsRes = await apiRequest(APPS_PATH);
-                setApps(appsRes.apps);
-                setStatus("authenticated");
-            }
-            catch (err) {
-                if (err instanceof ApiRequestError && err.status === 401) {
-                    setStatus("unauthenticated");
-                }
-                else {
-                    setError(err instanceof Error ? err : new Error(String(err)));
-                    setStatus("error");
-                }
-            }
-        }
-        void load();
-    }, [generation]);
+        void session.load(true);
+    }, [generation, session]);
     const signOut = React.useCallback(async () => {
+        // Whatever load or retry is in flight belongs to the session being ended: its answer
+        // must never land after this one (AK-23, L-a).
+        session.supersede();
         try {
             await apiRequest(LOGOUT_PATH, { method: "POST" });
         }
         catch (err) {
             if (err instanceof ApiRequestError && err.code === "logout_store_failed") {
-                // The plugin revokes the refresh-token family FIRST and unconditionally, before
-                // it ever attempts the AuthStore cleanup that failed here (plugin.ts's POST
-                // {routePrefix}/logout) — so the server already has no valid session for this
-                // browser no matter how this one response is reported. Leaving local state at
+                // The plugin clears the refresh cookie on EVERY logout outcome (AK-23, in a
+                // `finally`) and attempts each AuthStore step independently, so this browser
+                // no longer holds a usable session no matter which step failed here (plugin.ts's
+                // POST {routePrefix}/logout). Leaving local state at
                 // "authenticated" here would be exactly the bug the SMS-5 gate found (the design
                 // system's AccountMenu swallowing this rejection and showing nothing): a UI
                 // claiming a live session the server has already revoked. Clearing local state
                 // mirrors the server's actual state; re-throwing still fails loudly so a caller
                 // can surface "sign-out did not fully complete" rather than reporting a clean one.
-                setAccessToken(null);
-                setUser(null);
-                setApps([]);
-                setStatus("unauthenticated");
+                session.settleSignedOut();
             }
             throw err;
         }
-        setAccessToken(null);
-        setUser(null);
-        setApps([]);
-        setStatus("unauthenticated");
-    }, []);
+        session.settleSignedOut();
+    }, [session]);
     const refetch = React.useCallback(() => setGeneration((g) => g + 1), []);
     const actions = { signOut, refetch };
     if (status === "authenticated") {
         // Invariant: the only place status flips to "authenticated" is the line right after
         // setUser(me.user) above, in the same synchronous pass — so by the time a render
         // observes status === "authenticated", `user` is never null.
-        return { ...actions, status, user: user, apps, error: null };
+        return { ...actions, status, user: user, apps, appsError, error: null };
+    }
+    if (status === "unavailable" && unavailable) {
+        return { ...actions, status, user, apps, appsError, error: unavailable.error, retryInMs: unavailable.retryInMs };
     }
     if (status === "error") {
-        return { ...actions, status, user: null, apps, error: error ?? new Error("unknown error") };
+        return { ...actions, status, user: null, apps, appsError: null, error: error ?? new Error("unknown error") };
     }
-    return { ...actions, status, user: null, apps, error: null };
+    if (status === "loading")
+        return { ...actions, status, user: null, apps, appsError: null, error: null };
+    return { ...actions, status: "unauthenticated", user: null, apps, appsError: null, error: null };
 }
 //# sourceMappingURL=useAuthSession.js.map

package/dist/auth/client/useAuthSession.js.map

@@ -1 +1 @@
-{"version":3,"file":"useAuthSession.js","sourceRoot":"","sources":["../../../src/auth/client/useAuthSession.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAyB,MAAM,oBAAoB,CAAC;AA6D7F,MAAM,YAAY,GAAG,aAAa,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;AACjE,MAAM,OAAO,GAAG,aAAa,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;AACvD,MAAM,SAAS,GAAG,aAAa,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;AAC3D,MAAM,WAAW,GAAG,aAAa,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAa,SAAS,CAAC,CAAC;IAClE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAe,IAAI,CAAC,CAAC;IAC3D,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAqB,EAAE,CAAC,CAAC;IAC/D,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAe,IAAI,CAAC,CAAC;IAC7D,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACtD,uFAAuF;IACvF,kFAAkF;IAClF,+EAA+E;IAC/E,oFAAoF;IACpF,mFAAmF;IACnF,8EAA8E;IAC9E,+EAA+E;IAC/E,+EAA+E;IAC/E,mFAAmF;IACnF,oFAAoF;IACpF,qEAAqE;IACrE,MAAM,oBAAoB,GAAG,KAAK,CAAC,MAAM,CAAgB,IAAI,CAAC,CAAC;IAE/D,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE;QACnB,IAAI,oBAAoB,CAAC,OAAO,KAAK,UAAU;YAAE,OAAO;QACxD,oBAAoB,CAAC,OAAO,GAAG,UAAU,CAAC;QAE1C,KAAK,UAAU,IAAI;YACjB,SAAS,CAAC,SAAS,CAAC,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,CAAC;YACf,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,UAAU,CAAkB,YAAY,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;gBACtF,cAAc,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;gBACtC,MAAM,EAAE,GAAG,MAAM,UAAU,CAAkB,OAAO,CAAC,CAAC;gBACtD,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;gBACjB,MAAM,OAAO,GAAG,MAAM,UAAU,CAA+B,SAAS,CAAC,CAAC;gBAC1E,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACtB,SAAS,CAAC,eAAe,CAAC,CAAC;YAC7B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,eAAe,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACzD,SAAS,CAAC,iBAAiB,CAAC,CAAC;gBAC/B,CAAC;qBAAM,CAAC;oBACN,QAAQ,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBAC9D,SAAS,CAAC,OAAO,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,IAAI,EAAE,CAAC;IACd,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAEjB,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE;QAC3C,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,eAAe,IAAI,GAAG,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;gBACzE,gFAAgF;gBAChF,4EAA4E;gBAC5E,8EAA8E;gBAC9E,8EAA8E;gBAC9E,iFAAiF;gBACjF,4EAA4E;gBAC5E,+EAA+E;gBAC/E,gFAAgF;gBAChF,mFAAmF;gBACnF,cAAc,CAAC,IAAI,CAAC,CAAC;gBACrB,OAAO,CAAC,IAAI,CAAC,CAAC;gBACd,OAAO,CAAC,EAAE,CAAC,CAAC;gBACZ,SAAS,CAAC,iBAAiB,CAAC,CAAC;YAC/B,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,cAAc,CAAC,IAAI,CAAC,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,CAAC,EAAE,CAAC,CAAC;QACZ,SAAS,CAAC,iBAAiB,CAAC,CAAC;IAC/B,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEzE,MAAM,OAAO,GAAuB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACzD,IAAI,MAAM,KAAK,eAAe,EAAE,CAAC;QAC/B,oFAAoF;QACpF,iFAAiF;QACjF,6DAA6D;QAC7D,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAa,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACxE,CAAC;IACD,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,IAAI,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;IAC9F,CAAC;IACD,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC/D,CAAC"}
+{"version":3,"file":"useAuthSession.js","sourceRoot":"","sources":["../../../src/auth/client/useAuthSession.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,EACL,UAAU,EACV,eAAe,EACf,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,GACf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAyB,MAAM,oBAAoB,CAAC;AAI7F,qFAAqF;AACrF,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC;AAC/C,8EAA8E;AAC9E,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAE/C;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe,EAAE,SAAuB,IAAI,CAAC,MAAM;IACzF,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,yBAAyB,GAAG,CAAC,IAAI,OAAO,EAAE,wBAAwB,CAAC,CAAC;IAC7F,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,GAAG,MAAM,EAAE,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AA2FD,MAAM,OAAO,GAAG,aAAa,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;AACvD,MAAM,SAAS,GAAG,aAAa,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;AAC3D,MAAM,WAAW,GAAG,aAAa,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAa,SAAS,CAAC,CAAC;IAClE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAe,IAAI,CAAC,CAAC;IAC3D,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAqB,EAAE,CAAC,CAAC;IAC/D,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAe,IAAI,CAAC,CAAC;IACrE,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAe,IAAI,CAAC,CAAC;IAC7D,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,KAAK,CAAC,QAAQ,CAClD,IAAI,CACL,CAAC;IACF,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACtD,uFAAuF;IACvF,kFAAkF;IAClF,+EAA+E;IAC/E,oFAAoF;IACpF,mFAAmF;IACnF,8EAA8E;IAC9E,+EAA+E;IAC/E,+EAA+E;IAC/E,mFAAmF;IACnF,oFAAoF;IACpF,qEAAqE;IACrE,MAAM,oBAAoB,GAAG,KAAK,CAAC,MAAM,CAAgB,IAAI,CAAC,CAAC;IAE/D,sFAAsF;IACtF,uFAAuF;IACvF,sCAAsC;IACtC,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE;QACpC,MAAM,MAAM,GAAG;YACb,8EAA8E;YAC9E,MAAM,EAAE,SAAuB;YAC/B,+EAA+E;YAC/E,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,IAA4C;YACxD,YAAY,EAAE,CAAC;YACf;;;;;eAKG;YACH,KAAK,EAAE,CAAC;YAER,SAAS,CAAC,IAAgB;gBACxB,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;gBACrB,SAAS,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC;YAED,UAAU;gBACR,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI;oBAAE,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBAChE,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;YAC3B,CAAC;YAED;6CACiC;YACjC,SAAS;gBACP,MAAM,CAAC,UAAU,EAAE,CAAC;gBACpB,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;gBAClB,OAAO,MAAM,CAAC,KAAK,CAAC;YACtB,CAAC;YAED;;;;;;;;;;;eAWG;YACH,KAAK,CAAC,IAAI,CAAC,KAAc;gBACvB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBACxD,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC;gBAC7C,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC;oBACxB,QAAQ,CAAC,IAAI,CAAC,CAAC;oBACf,cAAc,CAAC,IAAI,CAAC,CAAC;oBACrB,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;gBAC9B,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,WAAW,GAAG,MAAM,kBAAkB,EAAE,CAAC;oBAC/C,IAAI,CAAC,OAAO,EAAE;wBAAE,OAAO;oBACvB,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;wBACzB,MAAM,CAAC,eAAe,EAAE,CAAC;wBACzB,OAAO;oBACT,CAAC;oBACD,MAAM,EAAE,GAAG,MAAM,UAAU,CAAkB,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC/E,IAAI,CAAC,OAAO,EAAE;wBAAE,OAAO;oBACvB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;oBACrC,IAAI,CAAC,OAAO,EAAE;wBAAE,OAAO;oBACvB,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;oBACjB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACnB,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACzB,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC;oBACxB,cAAc,CAAC,IAAI,CAAC,CAAC;oBACrB,MAAM,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;gBACpC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,CAAC,OAAO,EAAE;wBAAE,OAAO;oBACvB,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;wBACxC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;wBAC1B,OAAO;oBACT,CAAC;oBACD,IAAI,GAAG,YAAY,eAAe,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;wBACzD,MAAM,CAAC,eAAe,EAAE,CAAC;wBACzB,OAAO;oBACT,CAAC;oBACD,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC;oBACxB,cAAc,CAAC,IAAI,CAAC,CAAC;oBACrB,QAAQ,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBAC9D,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBAC5B,CAAC;YACH,CAAC;YAED;8CACkC;YAClC,KAAK,CAAC,QAAQ;gBACZ,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAA+B,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC/F,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;gBACzC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBAClF,CAAC;YACH,CAAC;YAED,wEAAwE;YACxE,eAAe;gBACb,MAAM,CAAC,UAAU,EAAE,CAAC;gBACpB,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC;gBACxB,cAAc,CAAC,IAAI,CAAC,CAAC;gBACrB,OAAO,CAAC,IAAI,CAAC,CAAC;gBACd,OAAO,CAAC,EAAE,CAAC,CAAC;gBACZ,YAAY,CAAC,IAAI,CAAC,CAAC;gBACnB,cAAc,CAAC,IAAI,CAAC,CAAC;gBACrB,MAAM,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;YACtC,CAAC;YAED;0FAC8E;YAC9E,aAAa,CAAC,GAAyB;gBACrC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI;oBAAE,OAAO;gBACzD,MAAM,SAAS,GAAG,uBAAuB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBAC/D,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC;gBACzB,cAAc,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC1C,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;gBAChC,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE;oBAClC,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;oBACzB,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC1B,CAAC,EAAE,SAAS,CAAC,CAAC;YAChB,CAAC;SACF,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE;QACnB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;QACtB,oFAAoF;QACpF,8EAA8E;QAC9E,MAAM,WAAW,GAAG,iBAAiB,CAAC,CAAC,GAAG,EAAE,EAAE;YAC5C,IAAI,OAAO,CAAC,MAAM,KAAK,eAAe;gBAAE,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;QACH,OAAO,GAAG,EAAE;YACV,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC;YACvB,OAAO,CAAC,UAAU,EAAE,CAAC;YACrB,WAAW,EAAE,CAAC;QAChB,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAEd,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE;QACnB,IAAI,oBAAoB,CAAC,OAAO,KAAK,UAAU;YAAE,OAAO;QACxD,oBAAoB,CAAC,OAAO,GAAG,UAAU,CAAC;QAC1C,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IAE1B,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE;QAC3C,qFAAqF;QACrF,+CAA+C;QAC/C,OAAO,CAAC,SAAS,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,eAAe,IAAI,GAAG,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;gBACzE,4EAA4E;gBAC5E,6EAA6E;gBAC7E,iFAAiF;gBACjF,qDAAqD;gBACrD,iFAAiF;gBACjF,4EAA4E;gBAC5E,+EAA+E;gBAC/E,gFAAgF;gBAChF,mFAAmF;gBACnF,OAAO,CAAC,eAAe,EAAE,CAAC;YAC5B,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,CAAC,eAAe,EAAE,CAAC;IAC5B,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAEd,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEzE,MAAM,OAAO,GAAuB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACzD,IAAI,MAAM,KAAK,eAAe,EAAE,CAAC;QAC/B,oFAAoF;QACpF,iFAAiF;QACjF,6DAA6D;QAC7D,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAa,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,MAAM,KAAK,aAAa,IAAI,WAAW,EAAE,CAAC;QAC5C,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAAC;IACnH,CAAC;IACD,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,IAAI,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;IAC/G,CAAC;IACD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACxG,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACnG,CAAC"}

package/dist/auth/errors.d.ts

@@ -41,19 +41,42 @@ export declare class AuthStoreError extends Error {
     readonly cause?: unknown | undefined;
     constructor(message: string, cause?: unknown | undefined);
 }
-/** Thrown by ./oidc-client.ts for any non-2xx HTTP response from flytedesk-id, carrying
- *  the real status code so classifyIdpError (below) can tell an outage (5xx, network
- *  failure) apart from a revocation (401/403) without parsing response text. */
+/** Thrown by ./oidc-client.ts for any non-2xx HTTP response from a flytedesk-id
+ *  RESOURCE endpoint (userinfo, authorization, `/me/apps`), carrying the real status
+ *  code so classifyIdpError (below) can tell an outage (5xx, network failure) apart from
+ *  a revocation (401/403) without parsing response text. */
 export declare class OidcHttpError extends Error {
     readonly status: number;
     readonly cause?: unknown | undefined;
     constructor(message: string, status: number, cause?: unknown | undefined);
 }
+/**
+ * A non-2xx answer from flytedesk-id's `/token` endpoint (AK-23), carrying the OAuth
+ * `error` code from its body (RFC 6749 §5.2) when there is one. Its own type because
+ * /token's status codes mean something different from a resource endpoint's: a 401
+ * there is `invalid_client` — THIS APP's credentials were refused (a bad or rotated
+ * client secret) — which says nothing about any user's session.
+ */
+export declare class OidcTokenError extends OidcHttpError {
+    readonly oauthError: string | undefined;
+    constructor(message: string, status: number, oauthError: string | undefined);
+}
 /**
  * Normalizes anything a flytedesk-id call in ./oidc-client.ts can throw/reject with
- * into an IdpUnavailableError or IdpAccessRevokedError. 401/403 means flytedesk-id
- * actively rejected the token (revoked/expired/forbidden); anything else — a 5xx, a
- * network failure, a timeout — is treated as an outage. Never throws itself; always
- * returns an Error to `throw`/log at the call site.
+ * into an IdpUnavailableError or IdpAccessRevokedError — the difference between a
+ * session being revoked and answering 503 (AK-23), so it must be exact:
+ *
+ *  - `/token` (`OidcTokenError`): ONLY `error=invalid_grant` is a revocation — RFC 6749
+ *    §5.2's answer for a refresh token that is "invalid, expired, revoked". Every other
+ *    /token error — `invalid_client` (a 401: a bad or rotated client secret),
+ *    `unauthorized_client`, `invalid_request`, a 5xx — is this app's configuration or
+ *    flytedesk-id itself failing, true for every session at once: an outage. Treating
+ *    `invalid_client` as a revocation would revoke every family that refreshed while
+ *    the secret was wrong.
+ *  - A resource endpoint (`OidcHttpError`): 401/403 means flytedesk-id refused this
+ *    session's access token — a revocation. Anything else is an outage.
+ *  - Anything else (a network failure, a timeout) is an outage.
+ *
+ * Never throws itself; always returns an Error to `throw`/log at the call site.
  */
 export declare function classifyIdpError(err: unknown): IdpUnavailableError | IdpAccessRevokedError;

package/dist/auth/errors.js

@@ -58,9 +58,10 @@ export class AuthStoreError extends Error {
         this.name = "AuthStoreError";
     }
 }
-/** Thrown by ./oidc-client.ts for any non-2xx HTTP response from flytedesk-id, carrying
- *  the real status code so classifyIdpError (below) can tell an outage (5xx, network
- *  failure) apart from a revocation (401/403) without parsing response text. */
+/** Thrown by ./oidc-client.ts for any non-2xx HTTP response from a flytedesk-id
+ *  RESOURCE endpoint (userinfo, authorization, `/me/apps`), carrying the real status
+ *  code so classifyIdpError (below) can tell an outage (5xx, network failure) apart from
+ *  a revocation (401/403) without parsing response text. */
 export class OidcHttpError extends Error {
     status;
     cause;
@@ -71,17 +72,46 @@ export class OidcHttpError extends Error {
         this.name = "OidcHttpError";
     }
 }
+/**
+ * A non-2xx answer from flytedesk-id's `/token` endpoint (AK-23), carrying the OAuth
+ * `error` code from its body (RFC 6749 §5.2) when there is one. Its own type because
+ * /token's status codes mean something different from a resource endpoint's: a 401
+ * there is `invalid_client` — THIS APP's credentials were refused (a bad or rotated
+ * client secret) — which says nothing about any user's session.
+ */
+export class OidcTokenError extends OidcHttpError {
+    oauthError;
+    constructor(message, status, oauthError) {
+        super(message, status);
+        this.oauthError = oauthError;
+        this.name = "OidcTokenError";
+    }
+}
 /**
  * Normalizes anything a flytedesk-id call in ./oidc-client.ts can throw/reject with
- * into an IdpUnavailableError or IdpAccessRevokedError. 401/403 means flytedesk-id
- * actively rejected the token (revoked/expired/forbidden); anything else — a 5xx, a
- * network failure, a timeout — is treated as an outage. Never throws itself; always
- * returns an Error to `throw`/log at the call site.
+ * into an IdpUnavailableError or IdpAccessRevokedError — the difference between a
+ * session being revoked and answering 503 (AK-23), so it must be exact:
+ *
+ *  - `/token` (`OidcTokenError`): ONLY `error=invalid_grant` is a revocation — RFC 6749
+ *    §5.2's answer for a refresh token that is "invalid, expired, revoked". Every other
+ *    /token error — `invalid_client` (a 401: a bad or rotated client secret),
+ *    `unauthorized_client`, `invalid_request`, a 5xx — is this app's configuration or
+ *    flytedesk-id itself failing, true for every session at once: an outage. Treating
+ *    `invalid_client` as a revocation would revoke every family that refreshed while
+ *    the secret was wrong.
+ *  - A resource endpoint (`OidcHttpError`): 401/403 means flytedesk-id refused this
+ *    session's access token — a revocation. Anything else is an outage.
+ *  - Anything else (a network failure, a timeout) is an outage.
+ *
+ * Never throws itself; always returns an Error to `throw`/log at the call site.
  */
 export function classifyIdpError(err) {
     if (err instanceof IdpAccessRevokedError || err instanceof IdpUnavailableError)
         return err;
-    if (err instanceof OidcHttpError && (err.status === 401 || err.status === 403)) {
+    const revoked = err instanceof OidcTokenError
+        ? err.oauthError === "invalid_grant"
+        : err instanceof OidcHttpError && (err.status === 401 || err.status === 403);
+    if (revoked) {
         return new IdpAccessRevokedError(err.message, err);
     }
     const message = err instanceof Error ? err.message : String(err);

package/dist/auth/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/auth/errors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,mFAAmF;AACnF,MAAM,OAAO,QAAS,SAAQ,KAAK;IAGf;IAFlB,YACE,OAAe,EACC,KAAe;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,UAAK,GAAL,KAAK,CAAU;QAG/B,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF;AAED;;sBAEsB;AACtB,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,OAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,eAAgB,SAAQ,mBAAmB;IACtD,YAAY,OAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED;;+DAE+D;AAC/D,MAAM,OAAO,qBAAsB,SAAQ,QAAQ;IACjD,YAAY,OAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;uFAEuF;AACvF,MAAM,OAAO,cAAe,SAAQ,KAAK;IAGrB;IAFlB,YACE,OAAe,EACC,KAAe;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,UAAK,GAAL,KAAK,CAAU;QAG/B,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED;;gFAEgF;AAChF,MAAM,OAAO,aAAc,SAAQ,KAAK;IAGpB;IACA;IAHlB,YACE,OAAe,EACC,MAAc,EACd,KAAe;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAQ;QACd,UAAK,GAAL,KAAK,CAAU;QAG/B,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,IAAI,GAAG,YAAY,qBAAqB,IAAI,GAAG,YAAY,mBAAmB;QAAE,OAAO,GAAG,CAAC;IAE3F,IAAI,GAAG,YAAY,aAAa,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;QAC/E,OAAO,IAAI,qBAAqB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,OAAO,IAAI,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/auth/errors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,mFAAmF;AACnF,MAAM,OAAO,QAAS,SAAQ,KAAK;IAGf;IAFlB,YACE,OAAe,EACC,KAAe;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,UAAK,GAAL,KAAK,CAAU;QAG/B,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF;AAED;;sBAEsB;AACtB,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,OAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,eAAgB,SAAQ,mBAAmB;IACtD,YAAY,OAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED;;+DAE+D;AAC/D,MAAM,OAAO,qBAAsB,SAAQ,QAAQ;IACjD,YAAY,OAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;uFAEuF;AACvF,MAAM,OAAO,cAAe,SAAQ,KAAK;IAGrB;IAFlB,YACE,OAAe,EACC,KAAe;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,UAAK,GAAL,KAAK,CAAU;QAG/B,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED;;;4DAG4D;AAC5D,MAAM,OAAO,aAAc,SAAQ,KAAK;IAGpB;IACA;IAHlB,YACE,OAAe,EACC,MAAc,EACd,KAAe;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAQ;QACd,UAAK,GAAL,KAAK,CAAU;QAG/B,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,cAAe,SAAQ,aAAa;IAI7B;IAHlB,YACE,OAAe,EACf,MAAc,EACE,UAA8B;QAE9C,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAFP,eAAU,GAAV,UAAU,CAAoB;QAG9C,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,IAAI,GAAG,YAAY,qBAAqB,IAAI,GAAG,YAAY,mBAAmB;QAAE,OAAO,GAAG,CAAC;IAE3F,MAAM,OAAO,GACX,GAAG,YAAY,cAAc;QAC3B,CAAC,CAAC,GAAG,CAAC,UAAU,KAAK,eAAe;QACpC,CAAC,CAAC,GAAG,YAAY,aAAa,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC;IACjF,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,IAAI,qBAAqB,CAAE,GAAa,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,OAAO,IAAI,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAC/C,CAAC"}

package/dist/auth/guards.d.ts

@@ -1,4 +1,16 @@
 import type { FastifyReply, FastifyRequest } from "fastify";
+/**
+ * Answers the request when it carries no authorized user, and returns whether it did.
+ * AK-23: when the plugin could not DECIDE (flytedesk-id or the AuthStore unavailable,
+ * `onAuthorizeUser` threw — `request.authUnavailable`), that is a 503 with the cause
+ * code, never the 401 that tells a client its session is over.
+ *
+ * The ONE authentication guard: `requireAuth`/`requirePermission` below and the
+ * `@flytedesk/app-kit/flags` and `@flytedesk/app-kit/profile` routes all answer
+ * through it. It reads only the request decorations (`authUser`, `authUnavailable`),
+ * so a consumer that populates them some other way still works.
+ */
+export declare function rejectUnauthenticated(request: FastifyRequest, reply: FastifyReply): boolean;
 export declare function requireAuth(request: FastifyRequest, reply: FastifyReply, done: () => void): void;
 /** Every route re-checks permissions server-side. 403s name the missing permission(s)
  *  in `detail`, so a caller (or its UI) can tell exactly what was missing. */

package/dist/auth/guards.js

@@ -1,18 +1,36 @@
+import { sendAuthUnavailable } from "./unavailable.js";
+/**
+ * Answers the request when it carries no authorized user, and returns whether it did.
+ * AK-23: when the plugin could not DECIDE (flytedesk-id or the AuthStore unavailable,
+ * `onAuthorizeUser` threw — `request.authUnavailable`), that is a 503 with the cause
+ * code, never the 401 that tells a client its session is over.
+ *
+ * The ONE authentication guard: `requireAuth`/`requirePermission` below and the
+ * `@flytedesk/app-kit/flags` and `@flytedesk/app-kit/profile` routes all answer
+ * through it. It reads only the request decorations (`authUser`, `authUnavailable`),
+ * so a consumer that populates them some other way still works.
+ */
+export function rejectUnauthenticated(request, reply) {
+    if (request.authUser)
+        return false;
+    if (request.authUnavailable) {
+        sendAuthUnavailable(reply, request.authUnavailable);
+        return true;
+    }
+    reply.code(401).send({ error: "Authentication required", code: "unauthenticated" });
+    return true;
+}
 export function requireAuth(request, reply, done) {
-    if (!request.authUser) {
-        reply.code(401).send({ error: "Authentication required", code: "unauthenticated" });
+    if (rejectUnauthenticated(request, reply))
         return;
-    }
     done();
 }
 /** Every route re-checks permissions server-side. 403s name the missing permission(s)
  *  in `detail`, so a caller (or its UI) can tell exactly what was missing. */
 export function requirePermission(...permission) {
     return function permissionPreHandler(request, reply, done) {
-        if (!request.authUser) {
-            reply.code(401).send({ error: "Authentication required", code: "unauthenticated" });
+        if (rejectUnauthenticated(request, reply))
             return;
-        }
         const missing = permission.filter((p) => !request.authUser.permissions.includes(p));
         if (missing.length) {
             reply.code(403).send({

package/dist/auth/guards.js.map

@@ -1 +1 @@
-{"version":3,"file":"guards.js","sourceRoot":"","sources":["../../src/auth/guards.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,WAAW,CAAC,OAAuB,EAAE,KAAmB,EAAE,IAAgB;IACxF,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACpF,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC;AAED;8EAC8E;AAC9E,MAAM,UAAU,iBAAiB,CAAC,GAAG,UAAoB;IACvD,OAAO,SAAS,oBAAoB,CAClC,OAAuB,EACvB,KAAmB,EACnB,IAAgB;QAEhB,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACpF,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAS,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACrF,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,oBAAoB;gBAC3B,IAAI,EAAE,WAAW;gBACjB,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;aAC3B,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"guards.js","sourceRoot":"","sources":["../../src/auth/guards.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAuB,EAAE,KAAmB;IAChF,IAAI,OAAO,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACpF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAAuB,EAAE,KAAmB,EAAE,IAAgB;IACxF,IAAI,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC;QAAE,OAAO;IAClD,IAAI,EAAE,CAAC;AACT,CAAC;AAED;8EAC8E;AAC9E,MAAM,UAAU,iBAAiB,CAAC,GAAG,UAAoB;IACvD,OAAO,SAAS,oBAAoB,CAClC,OAAuB,EACvB,KAAmB,EACnB,IAAgB;QAEhB,IAAI,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC;YAAE,OAAO;QAClD,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAS,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACrF,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,oBAAoB;gBAC3B,IAAI,EAAE,WAAW;gBACjB,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;aAC3B,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}