@jskit-ai/auth-core 0.1.83 → 0.1.85

package/package.descriptor.mjs

@@ -1,7 +1,7 @@
 export default Object.freeze({
   "packageVersion": 1,
   "packageId": "@jskit-ai/auth-core",
-  "version": "0.1.83",
+  "version": "0.1.85",
   "kind": "runtime",
   "dependsOn": [
     "@jskit-ai/value-app-config-shared"
@@ -69,7 +69,7 @@ export default Object.freeze({
   "mutations": {
     "dependencies": {
       "runtime": {
-        "@jskit-ai/kernel": "0.1.84",
+        "@jskit-ai/kernel": "0.1.86",
         "@fastify/cookie": "^11.0.2",
         "@fastify/csrf-protection": "^7.1.0",
         "@fastify/rate-limit": "^10.3.0"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/auth-core",
-  "version": "0.1.83",
+  "version": "0.1.85",
   "type": "module",
   "scripts": {
     "test": "node --test"
@@ -23,6 +23,7 @@
     "./shared": "./src/shared/index.js",
     "./shared/authApi": "./src/shared/authApi.js",
     "./shared/signOutFlow": "./src/shared/signOutFlow.js",
+    "./shared/authDenied": "./src/shared/authDenied.js",
     "./shared/authPaths": "./src/shared/authPaths.js",
     "./shared/authConstraints": "./src/shared/authConstraints.js",
     "./shared/authMethods": "./src/shared/authMethods.js",
@@ -46,7 +47,7 @@
     "./shared/commands/authSessionReadCommand": "./src/shared/commands/authSessionReadCommand.js"
   },
   "dependencies": {
-    "@jskit-ai/kernel": "0.1.84",
+    "@jskit-ai/kernel": "0.1.86",
     "@fastify/cookie": "^11.0.2",
     "@fastify/csrf-protection": "^7.1.0",
     "@fastify/rate-limit": "^10.3.0",

package/src/shared/authDenied.js

@@ -0,0 +1,70 @@
+const AUTH_DENIED_CODE_MAX_LENGTH = 80;
+const AUTH_DENIED_MESSAGE_MAX_LENGTH = 240;
+const AUTH_DENIED_CODE_PATTERN = "^[a-z][a-z0-9_.:-]{1,79}$";
+
+const AUTH_DENIED_CODES = Object.freeze({
+  NOT_ALLOWLISTED: "not_allowlisted",
+  BLOCKED: "blocked"
+});
+
+const AUTH_DENIED_DEFAULT_MESSAGES = Object.freeze({
+  [AUTH_DENIED_CODES.NOT_ALLOWLISTED]: "This account is not allowed to access this application.",
+  [AUTH_DENIED_CODES.BLOCKED]: "This account has been blocked from accessing this application."
+});
+
+const AUTH_DENIED_LOGIN_MESSAGES = Object.freeze({
+  [AUTH_DENIED_CODES.NOT_ALLOWLISTED]:
+    "Sign-in succeeded, but this account is not allowed to access this application.",
+  [AUTH_DENIED_CODES.BLOCKED]:
+    "Sign-in succeeded, but this account has been blocked from accessing this application."
+});
+
+function normalizeAuthDeniedCode(value = "") {
+  const code = String(value || "")
+    .trim()
+    .toLowerCase();
+  if (!code || code.length > AUTH_DENIED_CODE_MAX_LENGTH) {
+    return "";
+  }
+  return new RegExp(AUTH_DENIED_CODE_PATTERN).test(code) ? code : "";
+}
+
+function normalizeAuthDenied(input = null) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) {
+    return null;
+  }
+
+  const code = normalizeAuthDeniedCode(input.code);
+  if (!code) {
+    return null;
+  }
+
+  const explicitMessage = String(input.message || "").trim();
+  const message = explicitMessage || AUTH_DENIED_DEFAULT_MESSAGES[code] || "This account cannot access this application.";
+
+  return Object.freeze({
+    code,
+    message: message.slice(0, AUTH_DENIED_MESSAGE_MAX_LENGTH)
+  });
+}
+
+function resolveAuthDeniedLoginMessage(input = null) {
+  const authDenied = normalizeAuthDenied(input);
+  if (!authDenied) {
+    return "";
+  }
+
+  return AUTH_DENIED_LOGIN_MESSAGES[authDenied.code] || authDenied.message;
+}
+
+export {
+  AUTH_DENIED_CODE_MAX_LENGTH,
+  AUTH_DENIED_CODE_PATTERN,
+  AUTH_DENIED_CODES,
+  AUTH_DENIED_DEFAULT_MESSAGES,
+  AUTH_DENIED_LOGIN_MESSAGES,
+  AUTH_DENIED_MESSAGE_MAX_LENGTH,
+  normalizeAuthDenied,
+  normalizeAuthDeniedCode,
+  resolveAuthDeniedLoginMessage
+};

package/src/shared/commands/authCommandValidators.js

@@ -1,5 +1,10 @@
 import { createSchema } from "json-rest-schema";
 import { deepFreeze } from "@jskit-ai/kernel/shared/support/deepFreeze";
+import {
+  AUTH_DENIED_CODE_MAX_LENGTH,
+  AUTH_DENIED_CODE_PATTERN,
+  AUTH_DENIED_MESSAGE_MAX_LENGTH
+} from "../authDenied.js";
 import {
   AUTH_ACCESS_TOKEN_MAX_LENGTH,
   AUTH_EMAIL_MAX_LENGTH,
@@ -209,6 +214,22 @@ const oauthProviderCatalogEntryOutputValidator = deepFreeze({
   mode: "replace"
 });
 
+const authDeniedOutputSchema = createSchema({
+  code: {
+    type: "string",
+    required: true,
+    minLength: 2,
+    maxLength: AUTH_DENIED_CODE_MAX_LENGTH,
+    pattern: AUTH_DENIED_CODE_PATTERN
+  },
+  message: {
+    type: "string",
+    required: true,
+    minLength: 1,
+    maxLength: AUTH_DENIED_MESSAGE_MAX_LENGTH
+  }
+});
+
 const sessionOutputSchema = createSchema({
   authenticated: { type: "boolean", required: true },
   username: { type: "string", required: false, minLength: 1, maxLength: 120 },
@@ -222,6 +243,11 @@ const sessionOutputSchema = createSchema({
       maxLength: 200
     }
   },
+  authDenied: {
+    type: "object",
+    required: false,
+    schema: authDeniedOutputSchema
+  },
   csrfToken: { type: "string", required: true, minLength: 1 },
   oauthProviders: {
     type: "array",
@@ -306,6 +332,7 @@ export {
   devLoginAsOutputValidator,
   logoutOutputValidator,
   oauthProviderCatalogEntryOutputValidator,
+  authDeniedOutputSchema,
   sessionOutputValidator,
   sessionUnavailableOutputValidator,
   createCommandMessages

package/src/shared/index.js

@@ -1,3 +1,10 @@
 export { createApi } from "./authApi.js";
 export { runAuthSignOutFlow } from "./signOutFlow.js";
+export {
+  AUTH_DENIED_CODES,
+  AUTH_DENIED_DEFAULT_MESSAGES,
+  AUTH_DENIED_LOGIN_MESSAGES,
+  normalizeAuthDenied,
+  resolveAuthDeniedLoginMessage
+} from "./authDenied.js";
 export { AUTH_PATHS, buildAuthOauthStartPath } from "./authPaths.js";

package/test/authDenied.test.js

@@ -0,0 +1,45 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import {
+  AUTH_DENIED_CODES,
+  normalizeAuthDenied,
+  resolveAuthDeniedLoginMessage
+} from "../src/shared/authDenied.js";
+
+test("normalizeAuthDenied preserves stable denial codes and messages", () => {
+  assert.deepEqual(
+    normalizeAuthDenied({
+      code: "NOT_ALLOWLISTED",
+      message: "  Custom denial.  "
+    }),
+    {
+      code: AUTH_DENIED_CODES.NOT_ALLOWLISTED,
+      message: "Custom denial."
+    }
+  );
+
+  assert.deepEqual(
+    normalizeAuthDenied({
+      code: AUTH_DENIED_CODES.BLOCKED
+    }),
+    {
+      code: AUTH_DENIED_CODES.BLOCKED,
+      message: "This account has been blocked from accessing this application."
+    }
+  );
+
+  assert.equal(normalizeAuthDenied({ message: "Missing code" }), null);
+  assert.equal(normalizeAuthDenied({ code: "../bad" }), null);
+});
+
+test("resolveAuthDeniedLoginMessage maps default denial reasons to post-login messages", () => {
+  assert.equal(
+    resolveAuthDeniedLoginMessage({ code: AUTH_DENIED_CODES.NOT_ALLOWLISTED }),
+    "Sign-in succeeded, but this account is not allowed to access this application."
+  );
+  assert.equal(
+    resolveAuthDeniedLoginMessage({ code: AUTH_DENIED_CODES.BLOCKED }),
+    "Sign-in succeeded, but this account has been blocked from accessing this application."
+  );
+  assert.equal(resolveAuthDeniedLoginMessage(null), "");
+});

package/test/commandValidators.test.js

@@ -104,6 +104,9 @@ test("auth session and oauth start commands expose explicit nested response sche
   assert.equal(sessionResponseSchema.properties.oauthProviders.items["x-json-rest-schema"]?.castType, "object");
   assert.equal(Array.isArray(sessionResponseSchema.properties.oauthProviders.items.allOf), true);
   assert.match(sessionResponseSchema.properties.oauthProviders.items.allOf[0]?.$ref || "", /^#\/definitions\//);
+  assert.equal(sessionResponseSchema.properties.authDenied["x-json-rest-schema"]?.castType, "object");
+  assert.equal(Array.isArray(sessionResponseSchema.properties.authDenied.allOf), true);
+  assert.match(sessionResponseSchema.properties.authDenied.allOf[0]?.$ref || "", /^#\/definitions\//);
   assert.equal(Array.isArray(sessionUnavailableSchema.properties.oauthDefaultProvider.anyOf), true);
   assert.equal(oauthStartResponseSchema.properties.provider.type, "string");
   assert.equal(oauthStartResponseSchema.properties.returnTo.type, "string");