@owlmeans/client-auth 0.1.19-rc.0 → 0.1.20-alpha.0

package/src/login/failure-view.tsx

@@ -0,0 +1,35 @@
+import type { FC } from 'react'
+import { loginFailureHelper } from './failure.js'
+import { box, failureAction, page } from './consts.local.js'
+import type { LoginFailureViewProps } from './failure/types.js'
+
+/**
+ * The end state of a sign-in that did not complete: one phrased sentence, the incident reference of
+ * a failure, and the way on — back to the sign-in choice for a refusal, the same attempt again
+ * otherwise.
+ *
+ * Plain like `FallbackLoginScreen` — raw elements, inline styles, no class a consumer's stylesheet
+ * must scan for — so any OwlMeans surface can end on it, whatever UI family it belongs to. Hooks for
+ * tests and styling: `[data-login-failure="<kind>"]`, `[data-login-failure-message]`,
+ * `[data-login-failure-incident]`, `[data-login-failure-action]`.
+ */
+export const LoginFailureView: FC<LoginFailureViewProps> = ({ failure, translate, onAction, page: full, style }) => {
+  const phrase = loginFailureHelper.phrase(failure, translate)
+
+  const notice = <div
+    role="alert"
+    data-login-failure={failure.kind}
+    data-login-refused={failure.refused ? 'true' : undefined}
+    style={{ ...box, ...style }}
+  >
+    <p data-login-failure-message style={{ margin: 0 }}>{phrase.message}</p>
+    {phrase.incident != null && <p data-login-failure-incident style={{ marginTop: '.5rem', fontSize: '.75rem', opacity: .7 }}>
+      {phrase.incident}
+    </p>}
+    {onAction != null && <button type="button" data-login-failure-action style={failureAction} onClick={onAction}>
+      {phrase.action}
+    </button>}
+  </div>
+
+  return full === true ? <div data-login-failure-page style={page}>{notice}</div> : notice
+}

package/src/login/failure.ts

@@ -0,0 +1,67 @@
+import { AuthRefused } from '@owlmeans/auth'
+import { apiStatusHelper } from '@owlmeans/api/status'
+import { LoginFailureKind } from './failure/consts.js'
+import {
+  BACK_COPY, FAILURE_COPY, INCIDENT_COPY, INCIDENT_PLACEHOLDER, REFUSAL_CODES, RETRY_COPY,
+} from './failure/consts.local.js'
+import type { LoginFailure, LoginFailureHelper, LoginFailurePhrase } from './failure/types.js'
+import type { LoginTranslate } from './types.js'
+
+export const createLoginFailureHelper = (): LoginFailureHelper => {
+  const english: LoginTranslate = (_key, defaultValue) => defaultValue
+
+  /** The message and type a caught value carries — a non-object carries none. */
+  const textOf = (error: unknown): string => {
+    if (error == null || typeof error !== 'object') {
+      return typeof error === 'string' ? error : ''
+    }
+    const { message, type } = error as { message?: unknown, type?: unknown }
+
+    return [message, type].filter((part): part is string => typeof part === 'string').join(' ')
+  }
+
+  const codeOf = (error: unknown): LoginFailureKind | null => {
+    const text = textOf(error)
+
+    return REFUSAL_CODES.find(([marker]) => marker.test(text))?.[1] ?? null
+  }
+
+  /** `AuthRefused` of this or another module copy: `instanceof` answers across copies by type name. */
+  const isRefusedClass = (error: unknown): boolean =>
+    error instanceof AuthRefused
+    || (error != null && typeof error === 'object' && (error as { type?: unknown }).type === AuthRefused.typeName)
+
+  const failureOf = (error: unknown): LoginFailure => {
+    const kind = codeOf(error)
+      ?? (isRefusedClass(error) || apiStatusHelper.isAccessDenied(error) ? LoginFailureKind.Refused : LoginFailureKind.Failed)
+    const [key, fallback] = FAILURE_COPY[kind]
+
+    return {
+      kind,
+      refused: kind !== LoginFailureKind.Failed,
+      key,
+      fallback,
+      incidentId: apiStatusHelper.incidentIdOf(error),
+    }
+  }
+
+  const isRefusal = (error: unknown): boolean => failureOf(error).refused
+
+  const phrase = (failure: LoginFailure, translate: LoginTranslate = english): LoginFailurePhrase => {
+    const [actionKey, actionFallback] = failure.refused ? BACK_COPY : RETRY_COPY
+    // A refusal is the person's condition, not an incident to report: no reference line.
+    const incident = !failure.refused && failure.incidentId != null
+      ? translate(INCIDENT_COPY[0], INCIDENT_COPY[1]).split(INCIDENT_PLACEHOLDER).join(failure.incidentId)
+      : null
+
+    return {
+      message: translate(failure.key, failure.fallback),
+      incident,
+      action: translate(actionKey, actionFallback),
+    }
+  }
+
+  return { failureOf, isRefusal, phrase }
+}
+
+export const loginFailureHelper = createLoginFailureHelper()

package/src/login/i18n/be.json

@@ -34,7 +34,13 @@
     },
     "error": {
       "failed": "Уваход не завершаны. Паспрабуйце яшчэ раз.",
-      "blocked": "Акно ўваходу заблакавана. Націсніце значок заблакаванага ўсплывальнага акна ў адрасным радку браўзера, каб адкрыць яго."
+      "blocked": "Акно ўваходу заблакавана. Націсніце значок заблакаванага ўсплывальнага акна ў адрасным радку браўзера, каб адкрыць яго.",
+      "refused": "З гэтым акаўнтам тут увайсці нельга.",
+      "account-disabled": "Гэты акаўнт адключаны, таму ўвайсці з ім тут нельга.",
+      "profile-disabled": "Доступ гэтага акаўнта да праграмы заблакаваны, таму ўвайсці з ім тут нельга.",
+      "retry": "Паспрабаваць зноў",
+      "back": "Вярнуцца да ўваходу",
+      "incident": "Код звароту: {{incident}}"
     },
     "orphaned": "Уваход выкананы. Можаце закрыць гэтае акно і вярнуцца ў праграму."
   }

package/src/login/i18n/de.json

@@ -34,7 +34,13 @@
     },
     "error": {
       "failed": "Die Anmeldung wurde nicht abgeschlossen. Bitte versuchen Sie es erneut.",
-      "blocked": "Das Anmeldefenster wurde blockiert. Klicken Sie auf das Symbol für blockierte Pop-ups in der Adressleiste Ihres Browsers, um es zu öffnen."
+      "blocked": "Das Anmeldefenster wurde blockiert. Klicken Sie auf das Symbol für blockierte Pop-ups in der Adressleiste Ihres Browsers, um es zu öffnen.",
+      "refused": "Mit diesem Konto ist hier keine Anmeldung möglich.",
+      "account-disabled": "Dieses Konto wurde deaktiviert; eine Anmeldung ist hier nicht möglich.",
+      "profile-disabled": "Der Zugang dieses Kontos zu dieser Anwendung wurde gesperrt; eine Anmeldung ist hier nicht möglich.",
+      "retry": "Erneut versuchen",
+      "back": "Zurück zur Anmeldung",
+      "incident": "Referenz: {{incident}}"
     },
     "orphaned": "Angemeldet. Sie können dieses Fenster schließen und in der Anwendung fortfahren."
   }

package/src/login/i18n/en.json

@@ -34,7 +34,13 @@
     },
     "error": {
       "failed": "Sign-in did not complete. Please try again.",
-      "blocked": "The sign-in window was blocked. Click the blocked pop-up icon in your browser's address bar to open it."
+      "blocked": "The sign-in window was blocked. Click the blocked pop-up icon in your browser's address bar to open it.",
+      "refused": "This account cannot sign in here.",
+      "account-disabled": "This account has been disabled and cannot sign in here.",
+      "profile-disabled": "This account’s access to this application has been blocked, so it cannot sign in here.",
+      "retry": "Try again",
+      "back": "Back to sign-in",
+      "incident": "Reference: {{incident}}"
     },
     "orphaned": "Signed in. You can close this window and continue in the application."
   }

package/src/login/i18n/es.json

@@ -34,7 +34,13 @@
     },
     "error": {
       "failed": "El inicio de sesión no se completó. Inténtalo de nuevo.",
-      "blocked": "Se bloqueó la ventana de inicio de sesión. Haz clic en el icono de ventana emergente bloqueada en la barra de direcciones del navegador para abrirla."
+      "blocked": "Se bloqueó la ventana de inicio de sesión. Haz clic en el icono de ventana emergente bloqueada en la barra de direcciones del navegador para abrirla.",
+      "refused": "Esta cuenta no puede iniciar sesión aquí.",
+      "account-disabled": "Esta cuenta ha sido desactivada y no puede iniciar sesión aquí.",
+      "profile-disabled": "El acceso de esta cuenta a esta aplicación ha sido bloqueado, por lo que no puede iniciar sesión aquí.",
+      "retry": "Intentar de nuevo",
+      "back": "Volver al inicio de sesión",
+      "incident": "Referencia: {{incident}}"
     },
     "orphaned": "Sesión iniciada. Puedes cerrar esta ventana y continuar en la aplicación."
   }

package/src/login/i18n/fr.json

@@ -34,7 +34,13 @@
     },
     "error": {
       "failed": "La connexion n’a pas abouti. Réessayez.",
-      "blocked": "La fenêtre de connexion a été bloquée. Cliquez sur l’icône de fenêtre contextuelle bloquée dans la barre d’adresse pour l’ouvrir."
+      "blocked": "La fenêtre de connexion a été bloquée. Cliquez sur l’icône de fenêtre contextuelle bloquée dans la barre d’adresse pour l’ouvrir.",
+      "refused": "Ce compte ne peut pas se connecter ici.",
+      "account-disabled": "Ce compte a été désactivé et ne peut pas se connecter ici.",
+      "profile-disabled": "L’accès de ce compte à cette application a été bloqué ; il ne peut donc pas se connecter ici.",
+      "retry": "Réessayer",
+      "back": "Retour à la connexion",
+      "incident": "Référence : {{incident}}"
     },
     "orphaned": "Vous êtes connecté. Vous pouvez fermer cette fenêtre et continuer dans l’application."
   }

package/src/login/i18n/pl.json

@@ -34,7 +34,13 @@
     },
     "error": {
       "failed": "Logowanie nie zostało ukończone. Spróbuj ponownie.",
-      "blocked": "Okno logowania zostało zablokowane. Kliknij ikonę zablokowanego okienka w pasku adresu przeglądarki, aby je otworzyć."
+      "blocked": "Okno logowania zostało zablokowane. Kliknij ikonę zablokowanego okienka w pasku adresu przeglądarki, aby je otworzyć.",
+      "refused": "To konto nie może się tutaj zalogować.",
+      "account-disabled": "To konto zostało wyłączone i nie może się tutaj zalogować.",
+      "profile-disabled": "Dostęp tego konta do tej aplikacji został zablokowany, więc nie może się ono tutaj zalogować.",
+      "retry": "Spróbuj ponownie",
+      "back": "Wróć do logowania",
+      "incident": "Kod zgłoszenia: {{incident}}"
     },
     "orphaned": "Zalogowano. Możesz zamknąć to okno i kontynuować w aplikacji."
   }

package/src/login/i18n/ru.json

@@ -34,7 +34,13 @@
     },
     "error": {
       "failed": "Вход не завершён. Попробуйте ещё раз.",
-      "blocked": "Окно входа заблокировано. Нажмите на значок заблокированного всплывающего окна в адресной строке браузера, чтобы открыть его."
+      "blocked": "Окно входа заблокировано. Нажмите на значок заблокированного всплывающего окна в адресной строке браузера, чтобы открыть его.",
+      "refused": "С этим аккаунтом здесь войти нельзя.",
+      "account-disabled": "Этот аккаунт отключён, поэтому войти с ним здесь нельзя.",
+      "profile-disabled": "Доступ этого аккаунта к приложению заблокирован, поэтому войти с ним здесь нельзя.",
+      "retry": "Попробовать снова",
+      "back": "Вернуться ко входу",
+      "incident": "Код обращения: {{incident}}"
     },
     "orphaned": "Вход выполнен. Можете закрыть это окно и вернуться в приложение."
   }

package/src/login/i18n/uk.json

@@ -34,7 +34,13 @@
     },
     "error": {
       "failed": "Вхід не завершено. Спробуйте ще раз.",
-      "blocked": "Вікно входу заблоковано. Натисніть значок заблокованого спливаючого вікна в адресному рядку браузера, щоб відкрити його."
+      "blocked": "Вікно входу заблоковано. Натисніть значок заблокованого спливаючого вікна в адресному рядку браузера, щоб відкрити його.",
+      "refused": "З цим обліковим записом тут увійти не можна.",
+      "account-disabled": "Цей обліковий запис вимкнено, тому увійти з ним тут не можна.",
+      "profile-disabled": "Доступ цього облікового запису до застосунку заблоковано, тому увійти з ним тут не можна.",
+      "retry": "Спробувати ще раз",
+      "back": "Повернутися до входу",
+      "incident": "Код звернення: {{incident}}"
     },
     "orphaned": "Вхід виконано. Можете закрити це вікно й повернутися до застосунку."
   }

package/src/login/index.ts

@@ -11,6 +11,11 @@ export type * from './credit/types.js'
 export type * from './surrogate/types.js'
 export type * from './land/types.js'
 export type * from './start/types.js'
+export type * from './failure/types.js'
+export * from './failure/consts.js'
+export * from './failure.js'
+export * from './failure-view.js'
+export * from './translate.js'
 export * from './env.js'
 export * from './adopt.js'
 export * from './methods.js'

package/src/login/screen.tsx

@@ -8,6 +8,9 @@ import { loginMethodsHelper } from './methods.js'
 import { loginTermsHelper } from './terms.js'
 import { resolveCredit } from './credit.js'
 import { box, page } from './consts.local.js'
+import { loginFailureHelper } from './failure.js'
+import { LoginFailureView } from './failure-view.js'
+import type { LoginFailure } from './failure/types.js'
 
 const renderParts = (parts: TermsSentencePart[]): ReactNode =>
   parts.map((part, index) => part.href != null
@@ -49,6 +52,8 @@ export const FallbackLoginScreen: FC<LoginScreenProps> = props => {
 
   const [accepted, setAccepted] = useState(() => loginTermsHelper.termsAccepted(resolved))
   const [attempted, setAttempted] = useState(false)
+  // A start that rejected — phrased, never the raw message; the method buttons are the retry.
+  const [failure, setFailure] = useState<LoginFailure | null>(null)
 
   const all = login.methods({ context, env })
   const methods = typeof props.methods === 'function'
@@ -63,7 +68,10 @@ export const FallbackLoginScreen: FC<LoginScreenProps> = props => {
       setAttempted(true)
       return
     }
-    void method.start({ context, env })
+    setFailure(null)
+    void method.start({ context, env }).catch((error: unknown) => {
+      setFailure(loginFailureHelper.failureOf(error))
+    })
   }, [blocked, context, env])
 
   const onAccept = useCallback((value: boolean) => {
@@ -131,6 +139,10 @@ export const FallbackLoginScreen: FC<LoginScreenProps> = props => {
       ))}
     </p>}
 
+    {failure != null && <LoginFailureView
+      failure={failure} translate={t} style={{ padding: 0, marginTop: '1rem', color: '#b00', fontSize: '.875rem' }}
+    />}
+
     {props.footer ?? <p style={{ marginTop: '2rem', fontSize: '.75rem', opacity: .7 }}>
       {credit.poweredBy && <span>{t('login.credit.powered', 'Powered by OwlMeans')}</span>}
       {credit.poweredBy && credit.line != null && ' · '}

package/src/login/translate.ts

@@ -0,0 +1,32 @@
+import type { ClientConfig } from '@owlmeans/client-context'
+import { DEFAULT_LNG, LIB_NAMESPACE, i18nHelper } from '@owlmeans/i18n'
+import { i18nInstanceHelper } from '@owlmeans/client-i18n/utils'
+import { LOGIN_I18N_RESOURCE } from './consts.local.js'
+import type { LoginTranslate } from './types.js'
+
+/**
+ * A translate over the `auth` library resource that reads no React context.
+ *
+ * For a sign-in surface that renders outside any screen binding a `translate` — a dispatcher's
+ * failed exchange, a plugin's own form — where a hook that reaches for an i18n provider would throw
+ * inside render in an app mounted without one. It reads the app's one i18next instance
+ * (`i18nInstanceHelper.getI18nInstance`, the same instance `useI18nLib` drives) and drains the
+ * `auth` bundle into it when no component has yet: `initI18nResource` is one-shot per slot, so
+ * whichever of the two runs first loads it and the other no-ops. App-tier overrides of the `auth`
+ * keys (`addI18nApp(lng, 'auth', …, { ns: LIB_NAMESPACE })`) resolve here as everywhere else.
+ */
+export const makeAuthTranslate = (cfg: ClientConfig): LoginTranslate => {
+  const i18n = i18nInstanceHelper.getI18nInstance(cfg)
+  const fallback = typeof i18n.options?.fallbackLng === 'string' ? i18n.options.fallbackLng : DEFAULT_LNG
+  for (const lng of new Set([i18n.language, fallback])) {
+    if (lng == null) {
+      continue
+    }
+    i18nHelper.initI18nResource(lng, LOGIN_I18N_RESOURCE, LIB_NAMESPACE)?.forEach(resource => i18n.addResourceBundle(
+      lng, LIB_NAMESPACE, { [LOGIN_I18N_RESOURCE]: resource.data }, true, true
+    ))
+  }
+
+  return (key, defaultValue) =>
+    i18n.t(`${LOGIN_I18N_RESOURCE}.${key}`, { ns: LIB_NAMESPACE, defaultValue })
+}

package/src/login/types.ts

@@ -177,6 +177,14 @@ export interface LoginMethodSource {
   list: (ctx: LoginMethodContext) => LoginMethod[]
 }
 
+/**
+ * `(key, defaultValue) => string` over the `auth` library resource — the one translate contract
+ * every sign-in renderer shares. Placeholders (`{{incident}}`) are filled after it answers.
+ */
+export interface LoginTranslate {
+  (key: string, defaultValue: string): string
+}
+
 /** What every rendering of the sign-in screen accepts, whatever its UI family. */
 export interface LoginScreenProps {
   /** The one thing a consuming application is expected to supply. */

package/src/manager/README.md

@@ -37,7 +37,7 @@ Comprehensive error handling for authentication scenarios:
 This manager is part of the `@owlmeans/client-auth` package:
 
 ```bash
-npm install @owlmeans/client-auth@^0.1.19-rc.0
+npm install @owlmeans/client-auth@0.1.20-alpha.0
 ```
 
 ## API Reference

package/tests/failure.spec.tsx

@@ -0,0 +1,176 @@
+import { describe, expect, test } from 'bun:test'
+import { randomUUID } from 'node:crypto'
+import { renderToStaticMarkup } from 'react-dom/server'
+import { ACCESS_DENIED_KIND, ApiClientError, ServerCrashedError } from '@owlmeans/api'
+import type { ResponseStatusCarrier } from '@owlmeans/api'
+import { AuthenFailed, AuthForbidden, AuthRefused, AuthenticationStage } from '@owlmeans/auth'
+import { AppType } from '@owlmeans/context'
+import { ResilientError } from '@owlmeans/error'
+import { LIB_NAMESPACE, i18nHelper } from '@owlmeans/i18n'
+import type { ClientConfig } from '@owlmeans/client-context'
+import type { ClientContext } from '@owlmeans/client'
+import {
+  LoginFailureKind, LoginFailureView, loginFailureHelper, makeAuthTranslate,
+} from '../src/login/index.js'
+import type { LoginTranslate } from '../src/login/index.js'
+import { makeControl } from '../src/manager/components/authentication/control.js'
+import { makeTestContext } from './context.js'
+
+/** A failed call as the API client rejects it: the error, stamped with the status and denial kind. */
+const answered = <T extends Error>(error: T, status: number, denialKind?: string): T =>
+  Object.assign(error, { responseStatus: status, denialKind } satisfies ResponseStatusCarrier)
+
+/** A development body rebuilt into its class on the far side, as `@owlmeans/api` rebuilds it. */
+const rebuilt = (error: ResilientError, status: number, denialKind?: string): ResilientError =>
+  answered(ResilientError.ensure(ResilientError.marshal(error)), status, denialKind)
+
+/** The registered `auth` bundle of a language, resolved the way i18next resolves a dotted key. */
+const translateOf = (lng: string): LoginTranslate => {
+  const bundle = i18nHelper.resolveI18nResource(lng, 'auth', LIB_NAMESPACE) ?? {}
+
+  return (key, defaultValue) => {
+    const found = key.split('.').reduce<unknown>(
+      (node, part) => (node != null && typeof node === 'object' ? (node as Record<string, unknown>)[part] : undefined),
+      bundle,
+    )
+
+    return typeof found === 'string' ? found : defaultValue
+  }
+}
+
+describe('loginFailureHelper — a refused sign-in', () => {
+  // Production exposure: the body is the incident id alone, the status and the marker are the refusal.
+  test('the labelled 403 is a refusal, phrased "This account cannot sign in here."', () => {
+    const incident = randomUUID()
+    const failure = loginFailureHelper.failureOf(answered(new ApiClientError(`forbidden:${incident}`), 403, ACCESS_DENIED_KIND))
+
+    expect(failure).toMatchObject({ kind: LoginFailureKind.Refused, refused: true, key: 'login.error.refused' })
+    expect(loginFailureHelper.phrase(failure)).toEqual({
+      message: 'This account cannot sign in here.', incident: null, action: 'Back to sign-in',
+    })
+    // Development exposure rebuilds the class itself; a deployment's own refusal reads the same.
+    expect(loginFailureHelper.failureOf(rebuilt(new AuthRefused('operator:refused'), 403, ACCESS_DENIED_KIND)).kind)
+      .toBe(LoginFailureKind.Refused)
+    expect(loginFailureHelper.isRefusal(new AuthRefused('operator:unknown-account'))).toBe(true)
+  })
+
+  test('a visible refusal code gets its precise sentence', () => {
+    const account = loginFailureHelper.failureOf(rebuilt(new AuthRefused('account:disabled'), 403, ACCESS_DENIED_KIND))
+    const profile = loginFailureHelper.failureOf(rebuilt(new AuthRefused('profile:disabled'), 403, ACCESS_DENIED_KIND))
+
+    expect(account).toMatchObject({ kind: LoginFailureKind.AccountDisabled, refused: true })
+    expect(loginFailureHelper.phrase(account).message).toBe('This account has been disabled and cannot sign in here.')
+    expect(profile).toMatchObject({ kind: LoginFailureKind.ProfileDisabled, refused: true })
+    expect(loginFailureHelper.phrase(profile).message).toContain('access to this application has been blocked')
+    // A server still on `AuthenFailed`, and the integrated IAM finalizer's ban, name the same codes.
+    expect(loginFailureHelper.failureOf(rebuilt(new AuthenFailed('account:disabled'), 500)).kind)
+      .toBe(LoginFailureKind.AccountDisabled)
+    expect(loginFailureHelper.failureOf(rebuilt(new AuthForbidden('account:disabled'), 403, ACCESS_DENIED_KIND)).kind)
+      .toBe(LoginFailureKind.AccountDisabled)
+  })
+})
+
+describe('loginFailureHelper — any other failure', () => {
+  test('is worth a retry and carries the incident a person reports', () => {
+    const incident = randomUUID()
+    const crashed = loginFailureHelper.failureOf(answered(new ServerCrashedError(incident), 500))
+
+    expect(crashed).toMatchObject({ kind: LoginFailureKind.Failed, refused: false, key: 'login.error.failed', incidentId: incident })
+    expect(loginFailureHelper.phrase(crashed)).toEqual({
+      message: 'Sign-in did not complete. Please try again.', incident: `Reference: ${incident}`, action: 'Try again',
+    })
+  })
+
+  // Plan and entitlement refusals use 403 too, and a proxy's 403 carries no marker at all.
+  test('a 403 without the marker, a failed challenge, a network error or nothing are no refusals', () => {
+    for (const error of [
+      answered(new ApiClientError('forbidden'), 403),
+      rebuilt(new AuthenFailed('challenge'), 500),
+      new AuthenFailed('account:disabled-later'),
+      new Error('Network Error'),
+      null,
+      'forbidden',
+    ]) {
+      expect(loginFailureHelper.failureOf(error)).toMatchObject({ kind: LoginFailureKind.Failed, refused: false })
+    }
+  })
+
+  test('phrases through the translate it is given — every shipped language has the keys', () => {
+    const incident = randomUUID()
+    const refused = loginFailureHelper.failureOf(new AuthRefused())
+    const failed = loginFailureHelper.failureOf(answered(new ServerCrashedError(incident), 500))
+
+    expect(loginFailureHelper.phrase(refused, translateOf('fr'))).toEqual({
+      message: 'Ce compte ne peut pas se connecter ici.', incident: null, action: 'Retour à la connexion',
+    })
+    expect(loginFailureHelper.phrase(failed, translateOf('de')).incident).toBe(`Referenz: ${incident}`)
+    for (const lng of ['en', 'pl', 'ru', 'be', 'uk', 'es', 'de', 'fr']) {
+      const translate = translateOf(lng)
+      for (const key of ['refused', 'account-disabled', 'profile-disabled', 'failed', 'retry', 'back', 'incident']) {
+        expect({ lng, key, found: translate(`login.error.${key}`, '') !== '' }).toEqual({ lng, key, found: true })
+      }
+    }
+  })
+})
+
+describe('makeAuthTranslate — the `auth` keys with no React context', () => {
+  test('reads the app\'s i18next instance, and an app override of a key wins', () => {
+    // Registered before the slot is first drained — exactly how an application overrides it.
+    i18nHelper.addI18nApp('en', 'auth', { login: { error: { refused: 'Not with this account.' } } }, { ns: LIB_NAMESPACE })
+    const cfg = { ready: false, service: 'client-auth-tests', type: AppType.Frontend, services: {} } as unknown as ClientConfig
+    const translate = makeAuthTranslate(cfg)
+
+    expect(loginFailureHelper.phrase(loginFailureHelper.failureOf(new AuthRefused()), translate))
+      .toEqual({ message: 'Not with this account.', incident: null, action: 'Back to sign-in' })
+    expect(translate('login.error.failed', 'missing')).toBe('Sign-in did not complete. Please try again.')
+  })
+})
+
+describe('LoginFailureView — the end state of a failed sign-in', () => {
+  const html = (node: unknown): string => renderToStaticMarkup(<>{node as never}</>)
+
+  test('a refusal: one phrased sentence and the way back, no reference', () => {
+    const out = html(<LoginFailureView
+      failure={loginFailureHelper.failureOf(rebuilt(new AuthRefused('account:disabled'), 403, ACCESS_DENIED_KIND))}
+      onAction={() => {}}
+    />)
+
+    expect(out).toContain('role="alert"')
+    expect(out).toContain('data-login-failure="account-disabled"')
+    expect(out).toContain('data-login-refused="true"')
+    expect(out).toContain('This account has been disabled and cannot sign in here.')
+    expect(out).toContain('>Back to sign-in</button>')
+    expect(out).not.toContain('data-login-failure-incident')
+    expect(out).not.toContain('auth:manager')
+  })
+
+  test('a failure: the generic sentence, its reference and a retry — a button only with an action', () => {
+    const incident = randomUUID()
+    const failure = loginFailureHelper.failureOf(answered(new ServerCrashedError(incident), 500))
+
+    const out = html(<LoginFailureView failure={failure} onAction={() => {}} page />)
+    expect(out).toContain('data-login-failure-page')
+    expect(out).toContain('data-login-failure="failed"')
+    expect(out).toContain('Sign-in did not complete. Please try again.')
+    expect(out).toContain(`Reference: ${incident}`)
+    expect(out).toContain('>Try again</button>')
+
+    expect(html(<LoginFailureView failure={failure} />)).not.toContain('<button')
+  })
+})
+
+describe('the authentication control keeps what a failure view reads', () => {
+  // The Google callback and the supervisor form end in `setError`: the stage moves to Error, and
+  // the stamped status and marker of the API client's rejection survive `ResilientError.ensure`.
+  test('setError moves to the Error stage with the refusal intact', async () => {
+    const stages: AuthenticationStage[] = []
+    const control = makeControl(makeTestContext() as unknown as ClientContext<ClientConfig>)
+    control.setStage = stage => { stages.push(stage) }
+
+    await control.setError(answered(new ApiClientError(`forbidden:${randomUUID()}`), 403, ACCESS_DENIED_KIND))
+
+    expect(control.stage).toBe(AuthenticationStage.Error)
+    expect(stages).toEqual([AuthenticationStage.Error])
+    expect(loginFailureHelper.failureOf(control.error).kind).toBe(LoginFailureKind.Refused)
+  })
+})