@genesislcap/foundation-auth 15.14.2-FUI-2603.1 → 15.14.2-FUI-2603.2

package/dist/dts/machine/dto.d.ts

@@ -0,0 +1,34 @@
+import type { EventObject } from 'xstate';
+import type { CredentialData } from '../credential';
+/**
+ * Unwrap a Genesis auth DTO from FetchMachine output or APIError.
+ * @public
+ */
+export declare function unwrapAuthDto(value: unknown): unknown;
+type AuthMachineEventLike = EventObject & {
+    data?: unknown;
+    error?: unknown;
+    output?: unknown;
+};
+/**
+ * Read the auth DTO from a fetch done/error event.
+ * @public
+ */
+export declare function authDtoFromMachineEvent(event: AuthMachineEventLike): unknown;
+/**
+ * True when a fetch done/error event carries a Genesis NACK / ERROR payload.
+ * @public
+ */
+export declare function isAuthNackEvent(event: AuthMachineEventLike): boolean;
+/**
+ * True when fetch completed in the failed final state without a Genesis NACK body.
+ * @public
+ */
+export declare function isFetchFailureOutput(event: AuthMachineEventLike): boolean;
+/**
+ * Fire-and-forget credential persistence so xstate does not hold pending on the Promise.
+ * @public
+ */
+export declare function persistCredentials(store: (data: CredentialData) => Promise<unknown> | unknown, data: CredentialData): void;
+export {};
+//# sourceMappingURL=dto.d.ts.map

package/dist/dts/machine/dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dto.d.ts","sourceRoot":"","sources":["../../../src/machine/dto.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAC1C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAMpD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAcrD;AAED,KAAK,oBAAoB,GAAG,WAAW,GAAG;IACxC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAMF;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAQ5E;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAEpE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CASzE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,CAAC,IAAI,EAAE,cAAc,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,EAC3D,IAAI,EAAE,cAAc,GACnB,IAAI,CASN"}

package/dist/dts/machine/dto.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=dto.test.d.ts.map

package/dist/dts/machine/dto.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dto.test.d.ts","sourceRoot":"","sources":["../../../src/machine/dto.test.ts"],"names":[],"mappings":""}

package/dist/dts/machine/machine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"machine.d.ts","sourceRoot":"","sources":["../../../src/machine/machine.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EAEf,YAAY,EACZ,iBAAiB,EAMjB,OAAO,EACR,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,8BAA8B,CAAC;AACpD,OAAO,EACL,IAAI,EAQL,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,QAAQ,CAAC;AAEjD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAEL,iBAAiB,EAIlB,MAAM,eAAe,CAAC;AAIvB,OAAO,EACL,iBAAiB,EAQlB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGhD,OAAO,KAAK,EAEV,kBAAkB,EAClB,gBAAgB,EAGhB,WAAW,EACX,WAAW,EAEZ,MAAM,SAAS,CAAC;AAGjB;;;GAGG;AACH,MAAM,WAAW,WAAY,SAAQ,OAAO,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;CAAG;AAErF;;;GAGG;AACH,qBAAa,kBACX,SAAQ,eAAe,CAAC,kBAAkB,EAAE,gBAAgB,CAC5D,YAAW,WAAW;IAGd,OAAO,CAAC,IAAI;IACJ,OAAO,CAAC,YAAY;IACf,OAAO,CAAC,EAAE;IACvB,OAAO,CAAC,IAAI;IACC,OAAO,CAAC,aAAa;IAC5B,OAAO,CAAC,MAAM;IACb,OAAO,CAAC,OAAO;gBANd,IAAI,EAAE,IAAI,EACF,YAAY,EAAE,YAAY,EACrB,EAAE,EAAE,iBAAiB,EAClC,IAAI,EAAE,IAAI,EACG,aAAa,EAAE,iBAAiB,EACvC,MAAM,EAAE,UAAU,EACjB,OAAO,EAAE,WAAW;IAyqB3C,KAAK,CACH,OAAO,GAAE,kBAAkB,CAAC,OAAO,IAAI,CAAC,OAAO,CAM9C;IAKH;;OAEG;IACH,gBAAgB,IAAI,IAAI;IAIxB,SAAS,CAAC,sBAAsB,IAAI,WAAW;IAQ/C,SAAS,CAAC,+BAA+B,CAAC,MAAM,EAAE,WAAW,GAAG,WAAW;IAuB3E,SAAS,CAAC,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,KAAK,GAAG,iBAAiB;IAgB3E,SAAS,CAAC,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;MA4BpB;IAEF,SAAS,CAAC,aAAa;;;MAGpB;CACJ;AAED;;;GAGG;AACH,eAAO,MAAM,WAAW,mEAA0E,CAAC;AAEnG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,cAAc,IAAI,WAAW,CAE5C"}
+{"version":3,"file":"machine.d.ts","sourceRoot":"","sources":["../../../src/machine/machine.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EAEf,YAAY,EACZ,iBAAiB,EAKjB,OAAO,EACR,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,8BAA8B,CAAC;AACpD,OAAO,EACL,IAAI,EAQL,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,QAAQ,CAAC;AAEjD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAEL,iBAAiB,EAIlB,MAAM,eAAe,CAAC;AAIvB,OAAO,EACL,iBAAiB,EAQlB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAShD,OAAO,KAAK,EAEV,kBAAkB,EAClB,gBAAgB,EAGhB,WAAW,EACX,WAAW,EAEZ,MAAM,SAAS,CAAC;AAGjB;;;GAGG;AACH,MAAM,WAAW,WAAY,SAAQ,OAAO,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;CAAG;AAErF;;;GAGG;AACH,qBAAa,kBACX,SAAQ,eAAe,CAAC,kBAAkB,EAAE,gBAAgB,CAC5D,YAAW,WAAW;IAGd,OAAO,CAAC,IAAI;IACJ,OAAO,CAAC,YAAY;IACf,OAAO,CAAC,EAAE;IACvB,OAAO,CAAC,IAAI;IACC,OAAO,CAAC,aAAa;IAC5B,OAAO,CAAC,MAAM;IACb,OAAO,CAAC,OAAO;gBANd,IAAI,EAAE,IAAI,EACF,YAAY,EAAE,YAAY,EACrB,EAAE,EAAE,iBAAiB,EAClC,IAAI,EAAE,IAAI,EACG,aAAa,EAAE,iBAAiB,EACvC,MAAM,EAAE,UAAU,EACjB,OAAO,EAAE,WAAW;IA4sB3C,KAAK,CACH,OAAO,GAAE,kBAAkB,CAAC,OAAO,IAAI,CAAC,OAAO,CAM9C;IAKH;;OAEG;IACH,gBAAgB,IAAI,IAAI;IAIxB,SAAS,CAAC,sBAAsB,IAAI,WAAW;IAQ/C,SAAS,CAAC,+BAA+B,CAAC,MAAM,EAAE,WAAW,GAAG,WAAW;IAuB3E,SAAS,CAAC,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,KAAK,GAAG,iBAAiB;IAgB3E,SAAS,CAAC,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;MA4BpB;IAEF,SAAS,CAAC,aAAa;;;MAGpB;CACJ;AAED;;;GAGG;AACH,eAAO,MAAM,WAAW,mEAA0E,CAAC;AAEnG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,cAAc,IAAI,WAAW,CAE5C"}

package/dist/dts/routes/base.d.ts

@@ -405,6 +405,11 @@ export declare class BaseRoute extends ConfigHostElement {
     store: AuthStore;
     routing: AuthRouting;
     connectedCallback(): void;
+    /**
+     * Skip dismiss while a request or MFA challenge is in flight so route
+     * (re)connect does not cancel the current auth step.
+     */
+    protected get shouldDismissOnConnect(): boolean;
     onBack: () => void;
     toLocalisedText(text: string): string;
 }

package/dist/dts/routes/base.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../src/routes/base.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,8BAA8B,CAAC;AAGpD,OAAO,EAEL,OAAO,EAQR,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAGvD,OAAO,EAAE,UAAU,EAAqB,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC;;GAEG;AACH,KAAK,QAAQ,GAAG,YAAY,GAAG,qBAAqB,GAAG,EAAE,CAAC;AAE1D;;GAEG;AACH,eAAO,MAAM,SAAS,yKAAiC,CAAC;AAExD;;GAEG;AACH,eAAO,MAAM,UAAU,yKAAkC,CAAC;AAE1D;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,MAAM,EAAE,UAAU,CAAC;CACpB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEF;;;;;GAKG;AACH,qBAAa,iBAAkB,SAAQ,sBAAoC,YAAW,UAAU;IACnF,SAAS,EAAE,SAAS,CAAC;IACpB,MAAM,EAAE,UAAU,CAAC;IAC/B;;;OAGG;IACM,OAAO,EAAG,OAAO,CAAC;IAE3B,iBAAiB;CAYlB;AAED;;;;GAIG;AACH,qBAAa,SAAU,SAAQ,iBAAiB;IACxC,IAAI,EAAE,IAAI,CAAC;IACN,KAAK,EAAE,SAAS,CAAC;IACf,OAAO,EAAE,WAAW,CAAC;IAElC,iBAAiB;IAMjB,MAAM,aAAsC;IAE5C,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;CAGtC;AAED;;GAEG;AACH,eAAO,MAAM,iBAAiB,GAAI,CAAC,SAAS,SAAS,6DAsBpD,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,aAAa,GAAI,CAAC,SAAS,SAAS,6DAmBhD,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,UAAU,GAAI,CAAC,SAAS,SAAS,6DAoB7C,CAAC;AAoBF;;GAEG;AACH,eAAO,MAAM,aAAa,GAAI,CAAC,SAAS,SAAS,EAAE,QAAQ,MAAM,2DAgBhE,CAAC;AAyBF;;GAEG;AACH,eAAO,MAAM,cAAc,GAAI,CAAC,SAAS,SAAS,EAChD,MAAM,KAAK,GAAG,cAAc,GAAG,YAAY,2DAkB5C,CAAC;AAoHF;;GAEG;AACH,eAAO,MAAM,UAAU,GAAI,CAAC,SAAS,UAAU,EAAE,SAAS,OAAO,EAAE,OAAO,MAAM,2DAU/E,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,YAAY,GAAI,CAAC,SAAS,UAAU,EAC/C,OAAO,MAAM,EACb,aAAY,MAAiB,EAC7B,WAAU,OAAe,2DAW1B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,wBAAwB,GAAI,CAAC,SAAS,SAAS,6DAO3D,CAAC"}
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../src/routes/base.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,8BAA8B,CAAC;AAGpD,OAAO,EAEL,OAAO,EAQR,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAGvD,OAAO,EAAE,UAAU,EAAqB,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC;;GAEG;AACH,KAAK,QAAQ,GAAG,YAAY,GAAG,qBAAqB,GAAG,EAAE,CAAC;AAE1D;;GAEG;AACH,eAAO,MAAM,SAAS,yKAAiC,CAAC;AAExD;;GAEG;AACH,eAAO,MAAM,UAAU,yKAAkC,CAAC;AAE1D;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,MAAM,EAAE,UAAU,CAAC;CACpB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEF;;;;;GAKG;AACH,qBAAa,iBAAkB,SAAQ,sBAAoC,YAAW,UAAU;IACnF,SAAS,EAAE,SAAS,CAAC;IACpB,MAAM,EAAE,UAAU,CAAC;IAC/B;;;OAGG;IACM,OAAO,EAAG,OAAO,CAAC;IAE3B,iBAAiB;CAYlB;AAED;;;;GAIG;AACH,qBAAa,SAAU,SAAQ,iBAAiB;IACxC,IAAI,EAAE,IAAI,CAAC;IACN,KAAK,EAAE,SAAS,CAAC;IACf,OAAO,EAAE,WAAW,CAAC;IAElC,iBAAiB;IAQjB;;;OAGG;IACH,SAAS,KAAK,sBAAsB,IAAI,OAAO,CAM9C;IAED,MAAM,aAAsC;IAE5C,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;CAGtC;AAED;;GAEG;AACH,eAAO,MAAM,iBAAiB,GAAI,CAAC,SAAS,SAAS,6DAsBpD,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,aAAa,GAAI,CAAC,SAAS,SAAS,6DAmBhD,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,UAAU,GAAI,CAAC,SAAS,SAAS,6DAoB7C,CAAC;AAoBF;;GAEG;AACH,eAAO,MAAM,aAAa,GAAI,CAAC,SAAS,SAAS,EAAE,QAAQ,MAAM,2DAgBhE,CAAC;AAyBF;;GAEG;AACH,eAAO,MAAM,cAAc,GAAI,CAAC,SAAS,SAAS,EAChD,MAAM,KAAK,GAAG,cAAc,GAAG,YAAY,2DAkB5C,CAAC;AAoHF;;GAEG;AACH,eAAO,MAAM,UAAU,GAAI,CAAC,SAAS,UAAU,EAAE,SAAS,OAAO,EAAE,OAAO,MAAM,2DAU/E,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,YAAY,GAAI,CAAC,SAAS,UAAU,EAC/C,OAAO,MAAM,EACb,aAAY,MAAiB,EAC7B,WAAU,OAAe,2DAW1B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,wBAAwB,GAAI,CAAC,SAAS,SAAS,6DAO3D,CAAC"}

package/dist/esm/machine/dto.js

@@ -0,0 +1,76 @@
+import { isAPIError, isDoneInvokeEvent, isErrorCustomEvent, isErrorEvent, } from '@genesislcap/foundation-state-machine';
+import { isFailedAuthDTO } from '../mapper/utils';
+const hasMessageType = (value) => typeof value === 'object' && value !== null && 'MESSAGE_TYPE' in value;
+/**
+ * Unwrap a Genesis auth DTO from FetchMachine output or APIError.
+ * @public
+ */
+export function unwrapAuthDto(value) {
+    if (value == null) {
+        return undefined;
+    }
+    if (isAPIError(value)) {
+        return unwrapAuthDto(value.data);
+    }
+    if (hasMessageType(value)) {
+        return value;
+    }
+    if (typeof value === 'object' && 'data' in value) {
+        return unwrapAuthDto(value.data);
+    }
+    return undefined;
+}
+function eventErrorPayload(event) {
+    var _a, _b;
+    return (_b = (_a = event.data) !== null && _a !== void 0 ? _a : event.error) !== null && _b !== void 0 ? _b : event.output;
+}
+/**
+ * Read the auth DTO from a fetch done/error event.
+ * @public
+ */
+export function authDtoFromMachineEvent(event) {
+    var _a;
+    if (isDoneInvokeEvent(event)) {
+        return unwrapAuthDto(event.output);
+    }
+    if (isErrorEvent(event) || isErrorCustomEvent(event)) {
+        return unwrapAuthDto(eventErrorPayload(event));
+    }
+    return unwrapAuthDto((_a = eventErrorPayload(event)) !== null && _a !== void 0 ? _a : event);
+}
+/**
+ * True when a fetch done/error event carries a Genesis NACK / ERROR payload.
+ * @public
+ */
+export function isAuthNackEvent(event) {
+    return isFailedAuthDTO(authDtoFromMachineEvent(event));
+}
+/**
+ * True when fetch completed in the failed final state without a Genesis NACK body.
+ * @public
+ */
+export function isFetchFailureOutput(event) {
+    if (!isDoneInvokeEvent(event)) {
+        return false;
+    }
+    const output = event.output;
+    if ((output === null || output === void 0 ? void 0 : output.error) == null) {
+        return false;
+    }
+    return !isAuthNackEvent(event);
+}
+/**
+ * Fire-and-forget credential persistence so xstate does not hold pending on the Promise.
+ * @public
+ */
+export function persistCredentials(store, data) {
+    try {
+        const result = store(data);
+        if (result && typeof result.then === 'function') {
+            void result.catch(() => undefined);
+        }
+    }
+    catch (_a) {
+        // Credential storage is best-effort.
+    }
+}

package/dist/esm/machine/dto.test.js

@@ -0,0 +1,88 @@
+import { __awaiter } from "tslib";
+import { APIError } from '@genesislcap/foundation-state-machine';
+import { assert, createLogicSuite } from '@genesislcap/foundation-testing';
+import { StatusCodes } from 'http-status-codes';
+import { authDtoFromMachineEvent, isAuthNackEvent, isFetchFailureOutput, persistCredentials, unwrapAuthDto, } from './dto';
+const Suite = createLogicSuite('authDtoFromMachineEvent');
+const mfaNack = {
+    ERROR: [
+        {
+            '@type': 'LoginError',
+            CODE: 'MFA_REQUIRED',
+            TEXT: 'Problem logging in',
+            STATUS_CODE: '403 Forbidden',
+        },
+    ],
+    WARNING: [],
+    MESSAGE_TYPE: 'EVENT_LOGIN_AUTH_NACK',
+    SOURCE_REF: 'ref',
+};
+const eventAck = {
+    MESSAGE_TYPE: 'EVENT_ACK',
+    SOURCE_REF: 'ack-ref',
+};
+Suite('unwraps DTO from FetchMachineOutput', () => {
+    const dto = unwrapAuthDto({ data: mfaNack, response: { ok: false } });
+    assert.is(dto.MESSAGE_TYPE, 'EVENT_LOGIN_AUTH_NACK');
+});
+Suite('unwraps DTO from APIError', () => {
+    const dto = unwrapAuthDto(new APIError(StatusCodes.FORBIDDEN, mfaNack));
+    assert.is(dto.MESSAGE_TYPE, 'EVENT_LOGIN_AUTH_NACK');
+});
+Suite('treats HTTP 403 MFA NACK as auth nack on error.platform', () => {
+    assert.ok(isAuthNackEvent({
+        type: 'error.platform.loginFetcher',
+        data: new APIError(StatusCodes.FORBIDDEN, mfaNack),
+    }));
+});
+Suite('treats HTTP 403 MFA NACK as auth nack on done.invoke wrapping APIError', () => {
+    assert.ok(isAuthNackEvent({
+        type: 'done.invoke.loginFetcher',
+        output: new APIError(StatusCodes.FORBIDDEN, mfaNack),
+    }));
+});
+Suite('does not treat EVENT_ACK as nack', () => {
+    assert.not.ok(isAuthNackEvent({
+        type: 'done.invoke.resetPasswordFetcher',
+        output: { data: eventAck, response: { ok: true } },
+    }));
+    assert.is(authDtoFromMachineEvent({
+        type: 'done.invoke.resetPasswordFetcher',
+        output: { data: eventAck, response: { ok: true } },
+    }).MESSAGE_TYPE, 'EVENT_ACK');
+});
+Suite('unwraps DTO from xstate error payload on error field', () => {
+    assert.ok(isAuthNackEvent({
+        type: 'xstate.error.actor.0',
+        error: new APIError(StatusCodes.FORBIDDEN, mfaNack),
+    }));
+});
+Suite('does not treat HTTP 403 MFA NACK as a generic fetch failure', () => {
+    assert.not.ok(isFetchFailureOutput({
+        type: 'done.invoke.loginFetcher',
+        output: {
+            data: mfaNack,
+            error: new APIError(StatusCodes.FORBIDDEN, mfaNack),
+        },
+    }));
+});
+Suite('treats network/API failure without NACK as fetch failure', () => {
+    assert.ok(isFetchFailureOutput({
+        type: 'done.invoke.loginFetcher',
+        output: {
+            data: undefined,
+            error: new APIError(StatusCodes.INTERNAL_SERVER_ERROR),
+        },
+    }));
+});
+Suite('persistCredentials does not return the storage Promise', () => __awaiter(void 0, void 0, void 0, function* () {
+    let stored;
+    const result = persistCredentials((data) => new Promise((resolve) => {
+        stored = data;
+        resolve(true);
+    }), { id: 'jane', name: 'jane', password: 'x' });
+    assert.is(result, undefined);
+    yield Promise.resolve();
+    assert.is(stored === null || stored === void 0 ? void 0 : stored.id, 'jane');
+}));
+Suite.run();

package/dist/esm/machine/machine.js

@@ -12,6 +12,7 @@ import { clearResetIdentity } from '../routes/reset-password/reset-identity';
 import { AuthRouting } from '../routes/routing';
 import { logger } from '../utils';
 import { clearAuthErrorState, setError } from './actions';
+import { authDtoFromMachineEvent, isAuthNackEvent as eventHasAuthNack, isFetchFailureOutput, persistCredentials, } from './dto';
 import { defaultAuthMachineContext, isLoginParams, isQueryParams } from './types';
 /**
  * Default AuthMachine.
@@ -127,7 +128,17 @@ let DefaultAuthMachine = class DefaultAuthMachine extends AbstractMachine {
                     invoke: {
                         id: 'loginDetailsFetcher',
                         src: fetchMachine.machine,
-                        onDone: this.dtoTransition(),
+                        onDone: [
+                            {
+                                guard: 'isUnauthorizedError',
+                                target: 'loggedOut',
+                            },
+                            {
+                                guard: 'isFetchFailureOutput',
+                                target: 'error.silentLogin',
+                            },
+                            this.dtoTransition(),
+                        ],
                         onError: [
                             {
                                 guard: 'isUnauthorizedError',
@@ -151,8 +162,23 @@ let DefaultAuthMachine = class DefaultAuthMachine extends AbstractMachine {
                     invoke: {
                         id: 'loginFetcher',
                         src: fetchMachine.machine,
-                        onDone: this.dtoTransition(),
-                        onError: 'error.login',
+                        onDone: [
+                            {
+                                guard: 'isFetchFailureOutput',
+                                target: 'error.login',
+                            },
+                            this.dtoTransition(),
+                        ],
+                        onError: [
+                            {
+                                guard: 'isAuthNackEvent',
+                                actions: ['setDTO'],
+                                target: 'mapEntity',
+                            },
+                            {
+                                target: 'error.login',
+                            },
+                        ],
                     },
                     entry: [
                         sendTo('loginFetcher', ({ context }) => {
@@ -210,7 +236,13 @@ let DefaultAuthMachine = class DefaultAuthMachine extends AbstractMachine {
                     invoke: {
                         id: 'logoutFetcher',
                         src: fetchMachine.machine,
-                        onDone: this.dtoTransition(),
+                        onDone: [
+                            {
+                                guard: 'isFetchFailureOutput',
+                                target: 'error.logout',
+                            },
+                            this.dtoTransition(),
+                        ],
                         onError: 'error.logout',
                     },
                     entry: [
@@ -246,6 +278,10 @@ let DefaultAuthMachine = class DefaultAuthMachine extends AbstractMachine {
                                 guard: 'is200NackDTO',
                                 target: 'error.forgotPassword',
                             },
+                            {
+                                guard: 'isFetchFailureOutput',
+                                target: 'error.forgotPassword',
+                            },
                             {
                                 target: 'feedback.forgotPassword',
                             },
@@ -274,11 +310,15 @@ let DefaultAuthMachine = class DefaultAuthMachine extends AbstractMachine {
                                 guard: 'is200NackDTO',
                                 target: 'error.changePassword',
                             },
+                            {
+                                guard: 'isFetchFailureOutput',
+                                target: 'error.changePassword',
+                            },
                             {
                                 actions: [
                                     ({ context }) => {
                                         const params = context.params;
-                                        this.cm.storeCredentials({
+                                        persistCredentials(this.cm.storeCredentials.bind(this.cm), {
                                             id: params.username,
                                             name: params.username,
                                             password: params.newPassword,
@@ -312,11 +352,15 @@ let DefaultAuthMachine = class DefaultAuthMachine extends AbstractMachine {
                                 guard: 'is200NackDTO',
                                 target: 'error.resetPassword',
                             },
+                            {
+                                guard: 'isFetchFailureOutput',
+                                target: 'error.resetPassword',
+                            },
                             {
                                 actions: [
                                     ({ context }) => {
                                         const params = context.params;
-                                        this.cm.storeCredentials({
+                                        persistCredentials(this.cm.storeCredentials.bind(this.cm), {
                                             id: params.username,
                                             name: params.username,
                                             password: params.newPassword,
@@ -469,17 +513,12 @@ let DefaultAuthMachine = class DefaultAuthMachine extends AbstractMachine {
                     ],
                 },
                 /**
-                 * Feedback states. These are transient and revert back to idle after a short delay.
-                 * These can help improve UX in when the backend nack text is lacking clarity, as with incorrect credentials.
+                 * Feedback states. Success paths auto-return after feedbackDelay.
+                 * Error paths stay put so the user can retry immediately (login is handled here).
                  */
                 feedback: {
                     initial: 'none',
-                    on: {
-                        dismiss: {
-                            actions: ['resetContext'],
-                            target: '#authMachine.idle',
-                        },
-                    },
+                    on: this.onIdleEvents(),
                     states: {
                         none: {
                             tags: ['feedback', 'none'],
@@ -522,17 +561,6 @@ let DefaultAuthMachine = class DefaultAuthMachine extends AbstractMachine {
                             meta: {
                                 content: 'MESSAGE_INCORRECT_CREDENTIALS',
                             },
-                            after: {
-                                feedbackDelay: [
-                                    {
-                                        guard: 'isMfaLoginParams',
-                                        target: '#authMachine.awaitingMfa',
-                                    },
-                                    {
-                                        target: '#authMachine.idle',
-                                    },
-                                ],
-                            },
                         },
                         mfaRequired: {
                             tags: ['feedback', 'mfaRequired'],
@@ -607,9 +635,10 @@ let DefaultAuthMachine = class DefaultAuthMachine extends AbstractMachine {
                     params: ({ context }) => this.convertQueryParamsToLoginParams(context.params),
                 }),
                 setDTO: assign(({ event }) => {
-                    if (isDoneInvokeEvent(event)) {
+                    const dto = authDtoFromMachineEvent(event);
+                    if (dto) {
                         return {
-                            dto: event.output.data,
+                            dto,
                         };
                     }
                 }),
@@ -657,7 +686,7 @@ let DefaultAuthMachine = class DefaultAuthMachine extends AbstractMachine {
                         password: loginParams.password,
                     };
                     if (this.cm.validateUserCredentialData(data, true)) {
-                        this.cm.storeCredentials(data);
+                        persistCredentials(this.cm.storeCredentials.bind(this.cm), data);
                     }
                 },
                 postLoginRedirect: this.config.postLoginRedirect,
@@ -678,7 +707,16 @@ let DefaultAuthMachine = class DefaultAuthMachine extends AbstractMachine {
                 hasSSOToken: ({ context }) => isQueryParams(context.params) && context.params.SSO_TOKEN !== undefined,
                 hasMFACode: ({ context }) => isQueryParams(context.params) && context.params.MFA_CODE !== undefined,
                 hasWindowOpener: () => window.opener,
-                isUnauthorizedError: ({ event }) => isErrorEvent(event) ? isUnauthorizedError(event.data) : false,
+                isUnauthorizedError: ({ event }) => {
+                    if (isErrorEvent(event)) {
+                        return isUnauthorizedError(event.data);
+                    }
+                    if (isDoneInvokeEvent(event)) {
+                        const output = event.output;
+                        return (output === null || output === void 0 ? void 0 : output.error) ? isUnauthorizedError(output.error) : false;
+                    }
+                    return false;
+                },
                 isAuthenticated: ({ context }) => { var _a; return (_a = context.user) === null || _a === void 0 ? void 0 : _a.isAuthenticated; },
                 isBanned: ({ context }) => { var _a; return (_a = context.user) === null || _a === void 0 ? void 0 : _a.isBanned(); },
                 isLoginAckEntity: ({ event }) => isDoneInvokeEvent(event) ? isLoginAckEntity(event.output) : false,
@@ -703,12 +741,9 @@ let DefaultAuthMachine = class DefaultAuthMachine extends AbstractMachine {
                  * Required until strict http status codes are enabled on the backend by default.
                  * Treats EVENT_NACK / ERROR payloads as failure regardless of HTTP status.
                  */
-                is200NackDTO: ({ event }) => {
-                    var _a;
-                    return isDoneInvokeEvent(event)
-                        ? isFailedAuthDTO((_a = event.output) === null || _a === void 0 ? void 0 : _a.data)
-                        : false;
-                },
+                is200NackDTO: ({ event }) => isFailedAuthDTO(authDtoFromMachineEvent(event)),
+                isAuthNackEvent: ({ event }) => eventHasAuthNack(event),
+                isFetchFailureOutput: ({ event }) => isFetchFailureOutput(event),
             },
             delays: {
                 feedbackDelay: this.config.feedbackDelay,

package/dist/esm/routes/base.js

@@ -57,7 +57,21 @@ export class BaseRoute extends ConfigHostElement {
         var _a, _b, _c, _d, _e;
         super.connectedCallback();
         (_c = (_b = (_a = this.store) === null || _a === void 0 ? void 0 : _a.formEntry) === null || _b === void 0 ? void 0 : _b.errors) === null || _c === void 0 ? void 0 : _c.clear();
-        (_e = (_d = this.store) === null || _d === void 0 ? void 0 : _d.authMachine) === null || _e === void 0 ? void 0 : _e.send({ type: 'dismiss' });
+        if (this.shouldDismissOnConnect) {
+            (_e = (_d = this.store) === null || _d === void 0 ? void 0 : _d.authMachine) === null || _e === void 0 ? void 0 : _e.send({ type: 'dismiss' });
+        }
+    }
+    /**
+     * Skip dismiss while a request or MFA challenge is in flight so route
+     * (re)connect does not cancel the current auth step.
+     */
+    get shouldDismissOnConnect() {
+        var _a;
+        const machine = (_a = this.store) === null || _a === void 0 ? void 0 : _a.authMachine;
+        if (!machine) {
+            return false;
+        }
+        return !machine.hasTag('pending') && !machine.hasTag('awaitingMfa');
     }
     toLocalisedText(text) {
         return this.i18next.t(`${defaultAuthConfig.name}:${text}`, { lng: this.i18next.language });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@genesislcap/foundation-auth",
   "description": "Genesis Foundation Auth",
-  "version": "15.14.2-FUI-2603.1",
+  "version": "15.14.2-FUI-2603.2",
   "license": "SEE LICENSE IN license.txt",
   "main": "dist/esm/index.js",
   "types": "dist/foundation-auth.d.ts",
@@ -134,25 +134,25 @@
     }
   },
   "devDependencies": {
-    "@genesislcap/foundation-testing": "15.14.2-FUI-2603.1",
-    "@genesislcap/genx": "15.14.2-FUI-2603.1",
-    "@genesislcap/rollup-builder": "15.14.2-FUI-2603.1",
-    "@genesislcap/ts-builder": "15.14.2-FUI-2603.1",
-    "@genesislcap/uvu-playwright-builder": "15.14.2-FUI-2603.1",
-    "@genesislcap/vite-builder": "15.14.2-FUI-2603.1",
-    "@genesislcap/webpack-builder": "15.14.2-FUI-2603.1"
+    "@genesislcap/foundation-testing": "15.14.2-FUI-2603.2",
+    "@genesislcap/genx": "15.14.2-FUI-2603.2",
+    "@genesislcap/rollup-builder": "15.14.2-FUI-2603.2",
+    "@genesislcap/ts-builder": "15.14.2-FUI-2603.2",
+    "@genesislcap/uvu-playwright-builder": "15.14.2-FUI-2603.2",
+    "@genesislcap/vite-builder": "15.14.2-FUI-2603.2",
+    "@genesislcap/webpack-builder": "15.14.2-FUI-2603.2"
   },
   "dependencies": {
-    "@genesislcap/foundation-comms": "15.14.2-FUI-2603.1",
-    "@genesislcap/foundation-events": "15.14.2-FUI-2603.1",
-    "@genesislcap/foundation-i18n": "15.14.2-FUI-2603.1",
-    "@genesislcap/foundation-logger": "15.14.2-FUI-2603.1",
-    "@genesislcap/foundation-state-machine": "15.14.2-FUI-2603.1",
-    "@genesislcap/foundation-store": "15.14.2-FUI-2603.1",
-    "@genesislcap/foundation-ui": "15.14.2-FUI-2603.1",
-    "@genesislcap/foundation-user": "15.14.2-FUI-2603.1",
-    "@genesislcap/foundation-utils": "15.14.2-FUI-2603.1",
-    "@genesislcap/foundation-zero": "15.14.2-FUI-2603.1",
+    "@genesislcap/foundation-comms": "15.14.2-FUI-2603.2",
+    "@genesislcap/foundation-events": "15.14.2-FUI-2603.2",
+    "@genesislcap/foundation-i18n": "15.14.2-FUI-2603.2",
+    "@genesislcap/foundation-logger": "15.14.2-FUI-2603.2",
+    "@genesislcap/foundation-state-machine": "15.14.2-FUI-2603.2",
+    "@genesislcap/foundation-store": "15.14.2-FUI-2603.2",
+    "@genesislcap/foundation-ui": "15.14.2-FUI-2603.2",
+    "@genesislcap/foundation-user": "15.14.2-FUI-2603.2",
+    "@genesislcap/foundation-utils": "15.14.2-FUI-2603.2",
+    "@genesislcap/foundation-zero": "15.14.2-FUI-2603.2",
     "@microsoft/fast-components": "2.30.6",
     "@microsoft/fast-element": "1.14.0",
     "@microsoft/fast-foundation": "2.50.0",
@@ -173,5 +173,5 @@
     "access": "public"
   },
   "customElements": "dist/custom-elements.json",
-  "gitHead": "cb4bc1f9c157dc1ea3200aaa35eadf8971fe683b"
+  "gitHead": "470d546163b507cfe4bc8335cdb5955c40aeb58a"
 }