@heyatom/bastion-client 0.9.0 → 1.0.0

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 1.0.0
+
+Reads both the current Bastion answers and the `{ data }` envelope Bastion 2.0 will send, so you can upgrade before Bastion does.
+
+### Breaking
+
+- `BastionHttp.call` (and so every `BastionApiClient`, `BastionService.call`, `ServiceTokenProvider` and `BastionHttpException` call) unwraps a success body whose only key is `data` and returns `data`. A page (`{ data, meta }`), an array, any other object and an empty body are returned unchanged. Three Bastion routes answer `{ data }` alone today (`GET /auth/me/tenants`, `GET /admin/apps/:slug/permissions`, `PUT /admin/apps/:slug/roles/:roleId/permissions`): through `call` they now give you the inner array. Read them as `Array.isArray(res) ? res : res.data`, which also works with any later Bastion.
+- `listMyEvents` returns `{ data, meta: { total, page, limit, totalPages } }` (new type `BastionPageMeta`). An older Bastion's `{ data, total, page, limit }` is converted to this shape.
+- `err.code` is the domain code for `PROVIDER_TAKEN`, `ALREADY_LINKED`, `OAUTH_EMAIL_TAKEN`, `AGE_ALREADY_VERIFIED` (previously `CONFLICT`), `AGE_GATE_NOT_CONFIGURED`, `CURRENT_PASSWORD_REQUIRED`, `TWO_FACTOR_CODE_REQUIRED`, `OAUTH_USER_INACTIVE`, `OAUTH_UNDER_MINIMUM_AGE` (previously `UPSTREAM`). `BastionHttpException` forwards that code to your client instead of `CONFLICT` / `BAD_REQUEST` / `FORBIDDEN`. When Bastion sends these codes in `code`, `upstreamCode` is no longer set for them.
+
+### Added
+
+- The error codes above in `BastionErrorCode`.
+- Bastion's `code` is used whenever it is a `BastionErrorCode` and `message` is not itself one, so the code survives a reworded `message`. Message-based classification stays as the fallback for a Bastion that sends no domain `code`.
+
 ## 0.9.0
 
 ### Added

package/README.md

@@ -1,3 +1,14 @@
+<p align="center">
+  <img src="https://raw.githubusercontent.com/heyatomdev/bastion-client/main/docs/brand/banner.png" width="500" alt="HeyAtom @heyatom/bastion-client" />
+</p>
+
+<p align="center">
+  <a href="https://www.npmjs.com/package/@heyatom/bastion-client"><img src="https://img.shields.io/npm/v/@heyatom/bastion-client" alt="npm version" /></a>
+  <a href="https://github.com/heyatomdev/bastion-client/actions/workflows/test.yml"><img src="https://github.com/heyatomdev/bastion-client/actions/workflows/test.yml/badge.svg?branch=main" alt="Test" /></a>
+  <img src="https://img.shields.io/node/v/@heyatom/bastion-client" alt="Node version" />
+  <img src="https://img.shields.io/npm/l/@heyatom/bastion-client" alt="License" />
+</p>
+
 # @heyatom/bastion-client
 
 Client SDK for [Bastion](https://github.com/heyatomdev/bastion), the HeyAtom identity provider.
@@ -136,6 +147,11 @@ export class AuthController {
   from one browser must collapse into one call. Use one client instance per process.
 - `logout` revokes the latest token in the rotation chain and never throws.
 
+## Responses
+
+Calls return Bastion's body. A body whose only key is `data` is unwrapped, so the same code reads
+Bastion with and without the `{ data }` envelope; pages keep their `{ data, meta }` shape.
+
 ## Errors
 
 Every failed call throws `BastionHttpError` (core) or `BastionHttpException` (Nest) with a stable
@@ -144,9 +160,11 @@ Every failed call throws `BastionHttpError` (core) or `BastionHttpException` (Ne
 `INVALID_CREDENTIALS`, `EMAIL_NOT_VERIFIED`, `NO_APP_ACCESS`, `ACCOUNT_INACTIVE`,
 `INVALID_APP_CONTEXT` (your configuration, not the user), `INVALID_REFRESH_TOKEN`,
 `INVALID_OAUTH_CODE`, `VALIDATION_FAILED`, `STEP_UP_FAILED` (wrong current password or 2FA
-code on a step-up route: the session is fine), `CONFLICT`, `RATE_LIMITED`, the age-gate codes
-(`BIRTH_DATE_REQUIRED`, `BIRTH_DATE_INVALID`, `UNDER_MINIMUM_AGE`), the OAuth flow codes
-(`OAUTH_*`), `UNAVAILABLE` (Bastion unreachable or timed out) and `UPSTREAM`.
+code on a step-up route: the session is fine), `CURRENT_PASSWORD_REQUIRED` and
+`TWO_FACTOR_CODE_REQUIRED` (a step-up field is missing: ask for it), `CONFLICT`,
+`PROVIDER_TAKEN`, `ALREADY_LINKED`, `RATE_LIMITED`, the age-gate codes (`BIRTH_DATE_REQUIRED`,
+`BIRTH_DATE_INVALID`, `UNDER_MINIMUM_AGE`, `AGE_ALREADY_VERIFIED`, `AGE_GATE_NOT_CONFIGURED`),
+the OAuth codes (`OAUTH_*`), `UNAVAILABLE` (Bastion unreachable or timed out) and `UPSTREAM`.
 
 - A 400 carries the field errors in `errors: string[]`. Show them: `message` is only
   "Validation failed".

package/dist/cjs/core/api-client.js

@@ -225,14 +225,20 @@ class BastionApiClient {
     }
     // ── GDPR ─────────────────────────────────────────────────────────────────
     /** The user's own audit trail (`GET /auth/me/events`), paginated. */
-    listMyEvents(accessToken, page = {}) {
+    async listMyEvents(accessToken, page = {}) {
         const params = new URLSearchParams();
         if (page.page !== undefined)
             params.set('page', String(page.page));
         if (page.limit !== undefined)
             params.set('limit', String(page.limit));
         const qs = params.toString();
-        return this.call('GET', `/auth/me/events${qs ? `?${qs}` : ''}`, undefined, { token: accessToken });
+        const res = await this.call('GET', `/auth/me/events${qs ? `?${qs}` : ''}`, undefined, { token: accessToken });
+        // No body (a proxy in between): nothing to normalise, same as every other method.
+        if (!res || typeof res !== 'object' || 'meta' in res)
+            return res;
+        // Bastion before 2.0: the page fields sit next to `data`.
+        const { data, total, page: current, limit } = res;
+        return { data, meta: { total, page: current, limit, totalPages: limit > 0 ? Math.ceil(total / limit) : 0 } };
     }
     exportData(accessToken) {
         return this.call('GET', '/auth/me/export', undefined, { token: accessToken });

package/dist/cjs/core/api-types.d.ts

@@ -136,9 +136,13 @@ export interface BastionUserAuditEvent {
     metadata: unknown;
     createdAt: string;
 }
-export interface BastionUserAuditEventsPage {
-    data: BastionUserAuditEvent[];
+export interface BastionPageMeta {
     total: number;
     page: number;
     limit: number;
+    totalPages: number;
+}
+export interface BastionUserAuditEventsPage {
+    data: BastionUserAuditEvent[];
+    meta: BastionPageMeta;
 }

package/dist/cjs/core/bastion-http.d.ts

@@ -11,6 +11,12 @@ export interface BastionHttpOptions {
      */
     requestId?: () => string | undefined;
 }
+/**
+ * Bastion answers `{ data }` (or `{ data, meta }` for a page) from 2.0; earlier builds answer the
+ * bare body. An object whose only key is `data` gives back `data`; a page, an array, a bare body
+ * or no body passes through unchanged, so every caller reads the same shape from both.
+ */
+export declare function unwrapData(body: unknown): unknown;
 export interface BastionRequestInit {
     token?: string;
     headers?: Record<string, string>;
@@ -24,9 +30,10 @@ export interface ClientAuthInput {
 /**
  * Outbound calls to Bastion. Nothing here verifies inbound tokens — that is
  * `JwksVerifier`. `call` is public so a service can reach any route with the
- * same error handling: a non-2xx answer becomes `BastionHttpError` with the
- * status and a stable `code`; Bastion unreachable or timed out is a 503
- * `UNAVAILABLE`. Pass the browser's IP as `X-Real-IP` on user-facing calls.
+ * same error handling and the same success shape (`unwrapData`): a non-2xx
+ * answer becomes `BastionHttpError` with the status and a stable `code`;
+ * Bastion unreachable or timed out is a 503 `UNAVAILABLE`. Pass the browser's
+ * IP as `X-Real-IP` on user-facing calls.
  */
 export declare class BastionHttp {
     private readonly baseUrl;

package/dist/cjs/core/bastion-http.js

@@ -1,14 +1,29 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BastionHttp = void 0;
+exports.unwrapData = unwrapData;
 const errors_js_1 = require("./errors.js");
 const REQUEST_ID_PATTERN = /^[A-Za-z0-9._-]{1,64}$/;
+/**
+ * Bastion answers `{ data }` (or `{ data, meta }` for a page) from 2.0; earlier builds answer the
+ * bare body. An object whose only key is `data` gives back `data`; a page, an array, a bare body
+ * or no body passes through unchanged, so every caller reads the same shape from both.
+ */
+function unwrapData(body) {
+    if (body && typeof body === 'object' && !Array.isArray(body)) {
+        const keys = Object.keys(body);
+        if (keys.length === 1 && keys[0] === 'data')
+            return body.data;
+    }
+    return body;
+}
 /**
  * Outbound calls to Bastion. Nothing here verifies inbound tokens — that is
  * `JwksVerifier`. `call` is public so a service can reach any route with the
- * same error handling: a non-2xx answer becomes `BastionHttpError` with the
- * status and a stable `code`; Bastion unreachable or timed out is a 503
- * `UNAVAILABLE`. Pass the browser's IP as `X-Real-IP` on user-facing calls.
+ * same error handling and the same success shape (`unwrapData`): a non-2xx
+ * answer becomes `BastionHttpError` with the status and a stable `code`;
+ * Bastion unreachable or timed out is a 503 `UNAVAILABLE`. Pass the browser's
+ * IP as `X-Real-IP` on user-facing calls.
  */
 class BastionHttp {
     baseUrl;
@@ -57,7 +72,9 @@ class BastionHttp {
                 : typeof parsed.message === 'string'
                     ? parsed.message
                     : `Bastion error ${res.status}`;
-            // A code Bastion still puts in `message` (UNDER_MINIMUM_AGE under `code: FORBIDDEN`) wins: classify reads it.
+            // A code in `message` wins: an older Bastion sends it under a generic `code` that is also one
+            // of ours (ALREADY_LINKED under `code: CONFLICT`); classify reads it. Otherwise Bastion's
+            // `code` wins when it is one of ours, so a cleaned-up `message` still carries its code.
             const code = (0, errors_js_1.isBastionErrorCode)(message)
                 ? undefined
                 : (0, errors_js_1.isBastionErrorCode)(parsed.code)
@@ -70,7 +87,7 @@ class BastionHttp {
         }
         if (res.status === 204)
             return undefined;
-        return (await res.json().catch(() => undefined));
+        return unwrapData(await res.json().catch(() => undefined));
     }
     clientAuth(input) {
         return this.call('POST', '/auth/client', input);

package/dist/cjs/core/errors.d.ts

@@ -6,9 +6,9 @@ export declare class BastionTokenError extends Error {
 }
 /**
  * Stable classification of a Bastion error answer, so an app can branch on a
- * code instead of on Bastion's message text. The age-gate codes are Bastion's
- * own (it returns them verbatim); the rest are derived from status + message
- * until Bastion carries a `code` field on every error.
+ * code instead of on Bastion's message text. Bastion's own `code` is used when
+ * it is one of these; for an older Bastion that sends none, the code is derived
+ * from status + message (`classifyBastionError`).
  */
 export declare const BastionErrorCode: {
     readonly EMAIL_NOT_VERIFIED: "EMAIL_NOT_VERIFIED";
@@ -36,6 +36,20 @@ export declare const BastionErrorCode: {
     readonly OAUTH_NO_ACCOUNT: "OAUTH_NO_ACCOUNT";
     /** `completeSocialAccountLink` called with a token that is not the link ticket's owner. The code is spent; start the link again. */
     readonly OAUTH_LINK_USER_MISMATCH: "OAUTH_LINK_USER_MISMATCH";
+    /** OAuth signup with an email that a verified account of the tenant already owns. */
+    readonly OAUTH_EMAIL_TAKEN: "OAUTH_EMAIL_TAKEN";
+    readonly OAUTH_USER_INACTIVE: "OAUTH_USER_INACTIVE";
+    readonly OAUTH_UNDER_MINIMUM_AGE: "OAUTH_UNDER_MINIMUM_AGE";
+    /** Linking a provider account that belongs to another user. */
+    readonly PROVIDER_TAKEN: "PROVIDER_TAKEN";
+    /** The user already has an account of this provider linked. */
+    readonly ALREADY_LINKED: "ALREADY_LINKED";
+    readonly AGE_ALREADY_VERIFIED: "AGE_ALREADY_VERIFIED";
+    readonly AGE_GATE_NOT_CONFIGURED: "AGE_GATE_NOT_CONFIGURED";
+    /** A step-up route was called without `currentPassword`. Ask for it; the session is fine. */
+    readonly CURRENT_PASSWORD_REQUIRED: "CURRENT_PASSWORD_REQUIRED";
+    /** A step-up route was called without `twoFactorCode`. Ask for it; the session is fine. */
+    readonly TWO_FACTOR_CODE_REQUIRED: "TWO_FACTOR_CODE_REQUIRED";
     readonly UNAVAILABLE: "UNAVAILABLE";
     readonly UPSTREAM: "UPSTREAM";
 };

package/dist/cjs/core/errors.js

@@ -15,9 +15,9 @@ class BastionTokenError extends Error {
 exports.BastionTokenError = BastionTokenError;
 /**
  * Stable classification of a Bastion error answer, so an app can branch on a
- * code instead of on Bastion's message text. The age-gate codes are Bastion's
- * own (it returns them verbatim); the rest are derived from status + message
- * until Bastion carries a `code` field on every error.
+ * code instead of on Bastion's message text. Bastion's own `code` is used when
+ * it is one of these; for an older Bastion that sends none, the code is derived
+ * from status + message (`classifyBastionError`).
  */
 exports.BastionErrorCode = {
     EMAIL_NOT_VERIFIED: 'EMAIL_NOT_VERIFIED',
@@ -45,6 +45,20 @@ exports.BastionErrorCode = {
     OAUTH_NO_ACCOUNT: 'OAUTH_NO_ACCOUNT',
     /** `completeSocialAccountLink` called with a token that is not the link ticket's owner. The code is spent; start the link again. */
     OAUTH_LINK_USER_MISMATCH: 'OAUTH_LINK_USER_MISMATCH',
+    /** OAuth signup with an email that a verified account of the tenant already owns. */
+    OAUTH_EMAIL_TAKEN: 'OAUTH_EMAIL_TAKEN',
+    OAUTH_USER_INACTIVE: 'OAUTH_USER_INACTIVE',
+    OAUTH_UNDER_MINIMUM_AGE: 'OAUTH_UNDER_MINIMUM_AGE',
+    /** Linking a provider account that belongs to another user. */
+    PROVIDER_TAKEN: 'PROVIDER_TAKEN',
+    /** The user already has an account of this provider linked. */
+    ALREADY_LINKED: 'ALREADY_LINKED',
+    AGE_ALREADY_VERIFIED: 'AGE_ALREADY_VERIFIED',
+    AGE_GATE_NOT_CONFIGURED: 'AGE_GATE_NOT_CONFIGURED',
+    /** A step-up route was called without `currentPassword`. Ask for it; the session is fine. */
+    CURRENT_PASSWORD_REQUIRED: 'CURRENT_PASSWORD_REQUIRED',
+    /** A step-up route was called without `twoFactorCode`. Ask for it; the session is fine. */
+    TWO_FACTOR_CODE_REQUIRED: 'TWO_FACTOR_CODE_REQUIRED',
     UNAVAILABLE: 'UNAVAILABLE',
     UPSTREAM: 'UPSTREAM',
 };
@@ -58,6 +72,15 @@ const CODE_MESSAGES = new Set([
     exports.BastionErrorCode.OAUTH_EMAIL_REQUIRED,
     exports.BastionErrorCode.OAUTH_NO_ACCOUNT,
     exports.BastionErrorCode.OAUTH_LINK_USER_MISMATCH,
+    exports.BastionErrorCode.OAUTH_EMAIL_TAKEN,
+    exports.BastionErrorCode.OAUTH_USER_INACTIVE,
+    exports.BastionErrorCode.OAUTH_UNDER_MINIMUM_AGE,
+    exports.BastionErrorCode.PROVIDER_TAKEN,
+    exports.BastionErrorCode.ALREADY_LINKED,
+    exports.BastionErrorCode.AGE_ALREADY_VERIFIED,
+    exports.BastionErrorCode.AGE_GATE_NOT_CONFIGURED,
+    exports.BastionErrorCode.CURRENT_PASSWORD_REQUIRED,
+    exports.BastionErrorCode.TWO_FACTOR_CODE_REQUIRED,
 ]);
 const APP_CONTEXT_RE = /app not found|tenant not found|tenant is inactive|no tenants configured|tenantslug is required/i;
 const OAUTH_CODE_RE = /already used code|code expired|code\/app mismatch/i;

package/dist/esm/core/api-client.js

@@ -222,14 +222,20 @@ export class BastionApiClient {
     }
     // ── GDPR ─────────────────────────────────────────────────────────────────
     /** The user's own audit trail (`GET /auth/me/events`), paginated. */
-    listMyEvents(accessToken, page = {}) {
+    async listMyEvents(accessToken, page = {}) {
         const params = new URLSearchParams();
         if (page.page !== undefined)
             params.set('page', String(page.page));
         if (page.limit !== undefined)
             params.set('limit', String(page.limit));
         const qs = params.toString();
-        return this.call('GET', `/auth/me/events${qs ? `?${qs}` : ''}`, undefined, { token: accessToken });
+        const res = await this.call('GET', `/auth/me/events${qs ? `?${qs}` : ''}`, undefined, { token: accessToken });
+        // No body (a proxy in between): nothing to normalise, same as every other method.
+        if (!res || typeof res !== 'object' || 'meta' in res)
+            return res;
+        // Bastion before 2.0: the page fields sit next to `data`.
+        const { data, total, page: current, limit } = res;
+        return { data, meta: { total, page: current, limit, totalPages: limit > 0 ? Math.ceil(total / limit) : 0 } };
     }
     exportData(accessToken) {
         return this.call('GET', '/auth/me/export', undefined, { token: accessToken });

package/dist/esm/core/api-types.d.ts

@@ -136,9 +136,13 @@ export interface BastionUserAuditEvent {
     metadata: unknown;
     createdAt: string;
 }
-export interface BastionUserAuditEventsPage {
-    data: BastionUserAuditEvent[];
+export interface BastionPageMeta {
     total: number;
     page: number;
     limit: number;
+    totalPages: number;
+}
+export interface BastionUserAuditEventsPage {
+    data: BastionUserAuditEvent[];
+    meta: BastionPageMeta;
 }

package/dist/esm/core/bastion-http.d.ts

@@ -11,6 +11,12 @@ export interface BastionHttpOptions {
      */
     requestId?: () => string | undefined;
 }
+/**
+ * Bastion answers `{ data }` (or `{ data, meta }` for a page) from 2.0; earlier builds answer the
+ * bare body. An object whose only key is `data` gives back `data`; a page, an array, a bare body
+ * or no body passes through unchanged, so every caller reads the same shape from both.
+ */
+export declare function unwrapData(body: unknown): unknown;
 export interface BastionRequestInit {
     token?: string;
     headers?: Record<string, string>;
@@ -24,9 +30,10 @@ export interface ClientAuthInput {
 /**
  * Outbound calls to Bastion. Nothing here verifies inbound tokens — that is
  * `JwksVerifier`. `call` is public so a service can reach any route with the
- * same error handling: a non-2xx answer becomes `BastionHttpError` with the
- * status and a stable `code`; Bastion unreachable or timed out is a 503
- * `UNAVAILABLE`. Pass the browser's IP as `X-Real-IP` on user-facing calls.
+ * same error handling and the same success shape (`unwrapData`): a non-2xx
+ * answer becomes `BastionHttpError` with the status and a stable `code`;
+ * Bastion unreachable or timed out is a 503 `UNAVAILABLE`. Pass the browser's
+ * IP as `X-Real-IP` on user-facing calls.
  */
 export declare class BastionHttp {
     private readonly baseUrl;

package/dist/esm/core/bastion-http.js

@@ -1,11 +1,25 @@
 import { BastionErrorCode, BastionHttpError, isBastionErrorCode } from './errors.js';
 const REQUEST_ID_PATTERN = /^[A-Za-z0-9._-]{1,64}$/;
+/**
+ * Bastion answers `{ data }` (or `{ data, meta }` for a page) from 2.0; earlier builds answer the
+ * bare body. An object whose only key is `data` gives back `data`; a page, an array, a bare body
+ * or no body passes through unchanged, so every caller reads the same shape from both.
+ */
+export function unwrapData(body) {
+    if (body && typeof body === 'object' && !Array.isArray(body)) {
+        const keys = Object.keys(body);
+        if (keys.length === 1 && keys[0] === 'data')
+            return body.data;
+    }
+    return body;
+}
 /**
  * Outbound calls to Bastion. Nothing here verifies inbound tokens — that is
  * `JwksVerifier`. `call` is public so a service can reach any route with the
- * same error handling: a non-2xx answer becomes `BastionHttpError` with the
- * status and a stable `code`; Bastion unreachable or timed out is a 503
- * `UNAVAILABLE`. Pass the browser's IP as `X-Real-IP` on user-facing calls.
+ * same error handling and the same success shape (`unwrapData`): a non-2xx
+ * answer becomes `BastionHttpError` with the status and a stable `code`;
+ * Bastion unreachable or timed out is a 503 `UNAVAILABLE`. Pass the browser's
+ * IP as `X-Real-IP` on user-facing calls.
  */
 export class BastionHttp {
     baseUrl;
@@ -54,7 +68,9 @@ export class BastionHttp {
                 : typeof parsed.message === 'string'
                     ? parsed.message
                     : `Bastion error ${res.status}`;
-            // A code Bastion still puts in `message` (UNDER_MINIMUM_AGE under `code: FORBIDDEN`) wins: classify reads it.
+            // A code in `message` wins: an older Bastion sends it under a generic `code` that is also one
+            // of ours (ALREADY_LINKED under `code: CONFLICT`); classify reads it. Otherwise Bastion's
+            // `code` wins when it is one of ours, so a cleaned-up `message` still carries its code.
             const code = isBastionErrorCode(message)
                 ? undefined
                 : isBastionErrorCode(parsed.code)
@@ -67,7 +83,7 @@ export class BastionHttp {
         }
         if (res.status === 204)
             return undefined;
-        return (await res.json().catch(() => undefined));
+        return unwrapData(await res.json().catch(() => undefined));
     }
     clientAuth(input) {
         return this.call('POST', '/auth/client', input);

package/dist/esm/core/errors.d.ts

@@ -6,9 +6,9 @@ export declare class BastionTokenError extends Error {
 }
 /**
  * Stable classification of a Bastion error answer, so an app can branch on a
- * code instead of on Bastion's message text. The age-gate codes are Bastion's
- * own (it returns them verbatim); the rest are derived from status + message
- * until Bastion carries a `code` field on every error.
+ * code instead of on Bastion's message text. Bastion's own `code` is used when
+ * it is one of these; for an older Bastion that sends none, the code is derived
+ * from status + message (`classifyBastionError`).
  */
 export declare const BastionErrorCode: {
     readonly EMAIL_NOT_VERIFIED: "EMAIL_NOT_VERIFIED";
@@ -36,6 +36,20 @@ export declare const BastionErrorCode: {
     readonly OAUTH_NO_ACCOUNT: "OAUTH_NO_ACCOUNT";
     /** `completeSocialAccountLink` called with a token that is not the link ticket's owner. The code is spent; start the link again. */
     readonly OAUTH_LINK_USER_MISMATCH: "OAUTH_LINK_USER_MISMATCH";
+    /** OAuth signup with an email that a verified account of the tenant already owns. */
+    readonly OAUTH_EMAIL_TAKEN: "OAUTH_EMAIL_TAKEN";
+    readonly OAUTH_USER_INACTIVE: "OAUTH_USER_INACTIVE";
+    readonly OAUTH_UNDER_MINIMUM_AGE: "OAUTH_UNDER_MINIMUM_AGE";
+    /** Linking a provider account that belongs to another user. */
+    readonly PROVIDER_TAKEN: "PROVIDER_TAKEN";
+    /** The user already has an account of this provider linked. */
+    readonly ALREADY_LINKED: "ALREADY_LINKED";
+    readonly AGE_ALREADY_VERIFIED: "AGE_ALREADY_VERIFIED";
+    readonly AGE_GATE_NOT_CONFIGURED: "AGE_GATE_NOT_CONFIGURED";
+    /** A step-up route was called without `currentPassword`. Ask for it; the session is fine. */
+    readonly CURRENT_PASSWORD_REQUIRED: "CURRENT_PASSWORD_REQUIRED";
+    /** A step-up route was called without `twoFactorCode`. Ask for it; the session is fine. */
+    readonly TWO_FACTOR_CODE_REQUIRED: "TWO_FACTOR_CODE_REQUIRED";
     readonly UNAVAILABLE: "UNAVAILABLE";
     readonly UPSTREAM: "UPSTREAM";
 };

package/dist/esm/core/errors.js

@@ -9,9 +9,9 @@ export class BastionTokenError extends Error {
 }
 /**
  * Stable classification of a Bastion error answer, so an app can branch on a
- * code instead of on Bastion's message text. The age-gate codes are Bastion's
- * own (it returns them verbatim); the rest are derived from status + message
- * until Bastion carries a `code` field on every error.
+ * code instead of on Bastion's message text. Bastion's own `code` is used when
+ * it is one of these; for an older Bastion that sends none, the code is derived
+ * from status + message (`classifyBastionError`).
  */
 export const BastionErrorCode = {
     EMAIL_NOT_VERIFIED: 'EMAIL_NOT_VERIFIED',
@@ -39,6 +39,20 @@ export const BastionErrorCode = {
     OAUTH_NO_ACCOUNT: 'OAUTH_NO_ACCOUNT',
     /** `completeSocialAccountLink` called with a token that is not the link ticket's owner. The code is spent; start the link again. */
     OAUTH_LINK_USER_MISMATCH: 'OAUTH_LINK_USER_MISMATCH',
+    /** OAuth signup with an email that a verified account of the tenant already owns. */
+    OAUTH_EMAIL_TAKEN: 'OAUTH_EMAIL_TAKEN',
+    OAUTH_USER_INACTIVE: 'OAUTH_USER_INACTIVE',
+    OAUTH_UNDER_MINIMUM_AGE: 'OAUTH_UNDER_MINIMUM_AGE',
+    /** Linking a provider account that belongs to another user. */
+    PROVIDER_TAKEN: 'PROVIDER_TAKEN',
+    /** The user already has an account of this provider linked. */
+    ALREADY_LINKED: 'ALREADY_LINKED',
+    AGE_ALREADY_VERIFIED: 'AGE_ALREADY_VERIFIED',
+    AGE_GATE_NOT_CONFIGURED: 'AGE_GATE_NOT_CONFIGURED',
+    /** A step-up route was called without `currentPassword`. Ask for it; the session is fine. */
+    CURRENT_PASSWORD_REQUIRED: 'CURRENT_PASSWORD_REQUIRED',
+    /** A step-up route was called without `twoFactorCode`. Ask for it; the session is fine. */
+    TWO_FACTOR_CODE_REQUIRED: 'TWO_FACTOR_CODE_REQUIRED',
     UNAVAILABLE: 'UNAVAILABLE',
     UPSTREAM: 'UPSTREAM',
 };
@@ -52,6 +66,15 @@ const CODE_MESSAGES = new Set([
     BastionErrorCode.OAUTH_EMAIL_REQUIRED,
     BastionErrorCode.OAUTH_NO_ACCOUNT,
     BastionErrorCode.OAUTH_LINK_USER_MISMATCH,
+    BastionErrorCode.OAUTH_EMAIL_TAKEN,
+    BastionErrorCode.OAUTH_USER_INACTIVE,
+    BastionErrorCode.OAUTH_UNDER_MINIMUM_AGE,
+    BastionErrorCode.PROVIDER_TAKEN,
+    BastionErrorCode.ALREADY_LINKED,
+    BastionErrorCode.AGE_ALREADY_VERIFIED,
+    BastionErrorCode.AGE_GATE_NOT_CONFIGURED,
+    BastionErrorCode.CURRENT_PASSWORD_REQUIRED,
+    BastionErrorCode.TWO_FACTOR_CODE_REQUIRED,
 ]);
 const APP_CONTEXT_RE = /app not found|tenant not found|tenant is inactive|no tenants configured|tenantslug is required/i;
 const OAUTH_CODE_RE = /already used code|code expired|code\/app mismatch/i;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heyatom/bastion-client",
-  "version": "0.9.0",
+  "version": "1.0.0",
   "description": "Consumer SDK for the Bastion identity provider: JWKS verification, service-client auth, audit writes, NestJS guards",
   "license": "MIT",
   "author": "Andrea Tombolato <hey@heyatom.dev> (https://heyatom.dev)",