@owlmeans/web-auth 0.1.18 → 0.1.19

package/README.md

@@ -13,7 +13,7 @@ package by the `web-auth` skill.
 ## Installation
 
 ```bash
-bun add @owlmeans/web-auth@^0.1.18
+bun add @owlmeans/web-auth@^0.1.19
 ```
 
 `react` is a peer dependency.
@@ -166,7 +166,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18
+npx @owlmeans/agent-skills@^0.1.19
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 3,
   "package": "@owlmeans/web-auth",
-  "version": "0.1.18",
-  "generatedAt": "2026-10-28T00:31:34.730Z",
+  "version": "0.1.19",
+  "generatedAt": "2026-11-01T22:22:22.298Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/web-auth/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/web-auth
 
 **Layer:** Web
-**Install:** `"@owlmeans/web-auth": "^0.1.18"` in `dependencies`
+**Install:** `"@owlmeans/web-auth": "^0.1.19"` in `dependencies`
 
 Web-side auth UI plugins registering into the shared `@owlmeans/client-auth/manager` plugin registry
 (mirroring `@owlmeans/web-oidc-rp`). It ships the **PK supervisor** login form.
@@ -57,10 +57,17 @@ On submit the form requests a fresh allowance, signs `buildSupervisorPayload(cha
 salt)` with the entered private key, packs `{ salt, signature }` as the credential, exchanges the
 resulting token through the client `AuthService`, and navigates via `landAfterLogin` +
 `landingUrl` (`@owlmeans/client-auth/login`) — a pending post-login step, then a screen suspended
-in `@owlmeans/client-flow` (an OAuth consent screen reached signed out, say), else `HOME`. It no
-longer imports `@owlmeans/client-flow` or `@owlmeans/web-client` directly; `landAfterLogin` is the
+in `@owlmeans/client-flow` (an OAuth consent screen reached signed out, say), else `HOME`. The form
+imports neither `@owlmeans/client-flow` nor `@owlmeans/web-client` for that; `landAfterLogin` is the
 whole decision.
 
+A failed submit is the control's Error stage (`control.setError(e)`), rendered phrased at
+`supervisor-error` through `loginFailureHelper` + `makeAuthTranslate` (`@owlmeans/client-auth/login`,
+context-free — no i18n provider needed): a refusal of the account (an `AuthRefused` such as an
+unknown or banned account, or a 403 with the access-denied marker) reads as a refusal and is logged
+at `warn` (`auth.refused`), anything else as a failure with its incident reference, logged at
+`error`. The next submit asks for a fresh allowance, which clears the stage.
+
 See the **supervisor-auth** skill for the whole feature — the server append, its options, the
 security boundary and the `@owlmeans/test-ui` helpers.
 
@@ -69,3 +76,4 @@ security boundary and the `@owlmeans/test-ui` helpers.
 - `@owlmeans/auth` — `AuthenticationType.Supervisor`, `buildSupervisorPayload`
 - `@owlmeans/auth-common` — the client `AuthService` type
 - `@owlmeans/basic-keys` (signing), `@owlmeans/basic-ids` (the salt), `@owlmeans/config`
+- `@owlmeans/log` — the refused/failed sign-in lines

package/build/auth/plugins/supervisor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../../../src/auth/plugins/supervisor.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAA;AAUjF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,EAAE,oBA+EpC,CAAA"}
+{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../../../src/auth/plugins/supervisor.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAA;AAajF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,EAAE,oBA8FpC,CAAA"}

package/build/auth/plugins/supervisor.js

@@ -1,11 +1,13 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { useState } from 'react';
-import { AuthenticationType, buildSupervisorPayload } from '@owlmeans/auth';
+import { AuthenticationStage, AuthenticationType, buildSupervisorPayload } from '@owlmeans/auth';
 import { DEFAULT_ALIAS as AUTH_SERVICE } from '@owlmeans/client-auth';
 import { useContext } from '@owlmeans/client';
-import { loginLandingOf } from '@owlmeans/client-auth/login';
+import { loginFailureHelper, loginLandingOf, makeAuthTranslate } from '@owlmeans/client-auth/login';
+import { logger } from '@owlmeans/log';
 import { makeKeyPairModel } from '@owlmeans/basic-keys';
 import { createIdOfLength } from '@owlmeans/basic-ids';
+const log = logger('web-auth:supervisor');
 /**
  * PK-based supervisor login form (development-only). The operator (or an e2e
  * test) enters a target user id / email and one of the project's trusted private
@@ -24,15 +26,19 @@ export const supervisorClientPlugin = {
     // screen of a production application — the configuration has to name it. Last in the order and
     // rendered as a link, because it is a tool, not a way in.
     method: { order: 900, icon: 'key', emphasis: 'link', restricted: true },
-    Implementation: () => ({ type, control }) => {
+    Implementation: () => ({ type, stage, control }) => {
         const context = useContext();
         const [userId, setUserId] = useState('');
         const [pk, setPk] = useState('');
-        const [error, setError] = useState(null);
         const [busy, setBusy] = useState(false);
+        // A failed attempt is the control's Error stage (`control.setError`), phrased — never the raw
+        // message. The next submit asks for a new allowance, which leaves that stage and clears it.
+        const failure = stage === AuthenticationStage.Error && control.error != null
+            ? loginFailureHelper.failureOf(control.error) : null;
+        // Context-free: the form must not depend on the app mounting an i18n provider.
+        const phrase = failure != null ? loginFailureHelper.phrase(failure, makeAuthTranslate(context.cfg)) : null;
         const onSubmit = async (event) => {
             event.preventDefault();
-            setError(null);
             setBusy(true);
             try {
                 // Fetch a fresh server challenge right before signing so the allowance is
@@ -51,11 +57,20 @@ export const supervisorClientPlugin = {
                 window.location.href = await landings.landingUrl(landing);
             }
             catch (e) {
-                setError(e instanceof Error ? e.message : String(e));
+                const failed = loginFailureHelper.failureOf(e);
+                if (failed.refused) {
+                    log.warn('Supervisor sign-in refused', { kind: failed.kind, incidentId: failed.incidentId }, { event: 'auth.refused' });
+                }
+                else {
+                    log.error('Supervisor sign-in failed', e, { event: 'auth.refused' });
+                }
+                await control.setError(e);
                 setBusy(false);
             }
         };
-        return (_jsxs("form", { onSubmit: onSubmit, "data-testid": "supervisor-auth-form", style: { display: 'flex', flexDirection: 'column', gap: 12, maxWidth: 420, margin: '0 auto' }, children: [_jsx("h3", { children: "Supervisor sign-in (development)" }), _jsxs("label", { style: { display: 'flex', flexDirection: 'column', gap: 4 }, children: ["User id / email", _jsx("input", { name: "userId", type: "text", autoComplete: "off", value: userId, "data-testid": "supervisor-user-id", onChange: e => setUserId(e.target.value), required: true })] }), _jsxs("label", { style: { display: 'flex', flexDirection: 'column', gap: 4 }, children: ["Primary key", _jsx("input", { name: "pk", type: "password", autoComplete: "off", value: pk, "data-testid": "supervisor-pk", onChange: e => setPk(e.target.value), required: true })] }), _jsx("button", { type: "submit", "data-testid": "supervisor-submit", disabled: busy || userId === '' || pk === '', children: busy ? 'Signing in…' : 'Sign in as supervisor' }), error != null ? _jsx("p", { role: "alert", "data-testid": "supervisor-error", style: { color: 'crimson' }, children: error }) : null] }));
+        return (_jsxs("form", { onSubmit: onSubmit, "data-testid": "supervisor-auth-form", style: { display: 'flex', flexDirection: 'column', gap: 12, maxWidth: 420, margin: '0 auto' }, children: [_jsx("h3", { children: "Supervisor sign-in (development)" }), _jsxs("label", { style: { display: 'flex', flexDirection: 'column', gap: 4 }, children: ["User id / email", _jsx("input", { name: "userId", type: "text", autoComplete: "off", value: userId, "data-testid": "supervisor-user-id", onChange: e => setUserId(e.target.value), required: true })] }), _jsxs("label", { style: { display: 'flex', flexDirection: 'column', gap: 4 }, children: ["Primary key", _jsx("input", { name: "pk", type: "password", autoComplete: "off", value: pk, "data-testid": "supervisor-pk", onChange: e => setPk(e.target.value), required: true })] }), _jsx("button", { type: "submit", "data-testid": "supervisor-submit", disabled: busy || userId === '' || pk === '', children: busy ? 'Signing in…' : 'Sign in as supervisor' }), failure != null && phrase != null
+                    ? _jsx("p", { role: "alert", "data-testid": "supervisor-error", "data-login-failure": failure.kind, style: { color: 'crimson' }, children: phrase.incident != null ? `${phrase.message} ${phrase.incident}` : phrase.message })
+                    : null] }));
     },
     // Sign the supervisor payload with the entered private key and pack the salt +
     // signature into `credential`. `credentials.challenge` here is the unwrapped,

package/build/auth/plugins/supervisor.js.map

@@ -1 +1 @@
-{"version":3,"file":"supervisor.js","sourceRoot":"","sources":["../../../src/auth/plugins/supervisor.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAGhC,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AAE3E,OAAO,EAAE,aAAa,IAAI,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAErE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAyB;IAC1D,IAAI,EAAE,kBAAkB,CAAC,UAAU;IAEnC,gGAAgG;IAChG,+FAA+F;IAC/F,0DAA0D;IAC1D,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE;IAEvE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;QAC1C,MAAM,OAAO,GAAG,UAAU,EAAE,CAAA;QAC5B,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;QACxC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;QAChC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;QACvD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAEvC,MAAM,QAAQ,GAAG,KAAK,EAAE,KAAgB,EAAE,EAAE;YAC1C,KAAK,CAAC,cAAc,EAAE,CAAA;YACtB,QAAQ,CAAC,IAAI,CAAC,CAAA;YACd,OAAO,CAAC,IAAI,CAAC,CAAA;YACb,IAAI,CAAC;gBACH,0EAA0E;gBAC1E,uEAAuE;gBACvE,MAAM,OAAO,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;gBAExC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAA;gBAEpE,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;oBACvB,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAc,YAAY,CAAC,CAAA;oBAC9D,MAAM,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,CAAA;gBACvC,CAAC;gBAED,oFAAoF;gBACpF,oFAAoF;gBACpF,6EAA6E;gBAC7E,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;gBACxC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,cAAc,EAAE,CAAA;gBAC/C,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;YAC3D,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,QAAQ,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;gBACpD,OAAO,CAAC,KAAK,CAAC,CAAA;YAChB,CAAC;QACH,CAAC,CAAA;QAED,OAAO,CACL,gBAAM,QAAQ,EAAE,QAAQ,iBAAc,sBAAsB,EAC1D,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,aAC7F,4DAAyC,EACzC,iBAAO,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,gCAEhE,gBAAO,IAAI,EAAC,QAAQ,EAAC,IAAI,EAAC,MAAM,EAAC,YAAY,EAAC,KAAK,EAAC,KAAK,EAAE,MAAM,iBACnD,oBAAoB,EAChC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,SAAG,IACjD,EACR,iBAAO,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,4BAEhE,gBAAO,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,UAAU,EAAC,YAAY,EAAC,KAAK,EAAC,KAAK,EAAE,EAAE,iBAC/C,eAAe,EAC3B,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,SAAG,IAC7C,EACR,iBAAQ,IAAI,EAAC,QAAQ,iBAAa,mBAAmB,EAAC,QAAQ,EAAE,IAAI,IAAI,MAAM,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,YAC/F,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,uBAAuB,GACxC,EACR,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,YAAG,IAAI,EAAC,OAAO,iBAAa,kBAAkB,EAAC,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,YAAG,KAAK,GAAK,CAAC,CAAC,CAAC,IAAI,IAC1G,CACR,CAAA;IACH,CAAC;IAED,+EAA+E;IAC/E,8EAA8E;IAC9E,0EAA0E;IAC1E,YAAY,EAAE,KAAK,EAAE,WAAW,EAAsB,EAAE;QACtD,MAAM,GAAG,GAAG,gBAAgB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;QACpD,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAA;QACjC,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,SAAS,IAAI,EAAE,EAAE,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;QAC/G,WAAW,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;QAE5D,8EAA8E;QAC9E,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;IACtB,CAAC;CACF,CAAA"}
+{"version":3,"file":"supervisor.js","sourceRoot":"","sources":["../../../src/auth/plugins/supervisor.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAGhC,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AAEhG,OAAO,EAAE,aAAa,IAAI,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAErE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AACnG,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AACtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD,MAAM,GAAG,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAA;AAEzC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAyB;IAC1D,IAAI,EAAE,kBAAkB,CAAC,UAAU;IAEnC,gGAAgG;IAChG,+FAA+F;IAC/F,0DAA0D;IAC1D,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE;IAEvE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;QACjD,MAAM,OAAO,GAAG,UAAU,EAAE,CAAA;QAC5B,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;QACxC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;QAChC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAEvC,8FAA8F;QAC9F,4FAA4F;QAC5F,MAAM,OAAO,GAAG,KAAK,KAAK,mBAAmB,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,IAAI,IAAI;YAC1E,CAAC,CAAC,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACtD,+EAA+E;QAC/E,MAAM,MAAM,GAAG,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAE1G,MAAM,QAAQ,GAAG,KAAK,EAAE,KAAgB,EAAE,EAAE;YAC1C,KAAK,CAAC,cAAc,EAAE,CAAA;YACtB,OAAO,CAAC,IAAI,CAAC,CAAA;YACb,IAAI,CAAC;gBACH,0EAA0E;gBAC1E,uEAAuE;gBACvE,MAAM,OAAO,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;gBAExC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAA;gBAEpE,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;oBACvB,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAc,YAAY,CAAC,CAAA;oBAC9D,MAAM,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,CAAA;gBACvC,CAAC;gBAED,oFAAoF;gBACpF,oFAAoF;gBACpF,6EAA6E;gBAC7E,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;gBACxC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,cAAc,EAAE,CAAA;gBAC/C,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;YAC3D,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;gBAC9C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBACnB,GAAG,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAA;gBACzH,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,KAAK,CAAC,2BAA2B,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAA;gBACtE,CAAC;gBACD,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;gBACzB,OAAO,CAAC,KAAK,CAAC,CAAA;YAChB,CAAC;QACH,CAAC,CAAA;QAED,OAAO,CACL,gBAAM,QAAQ,EAAE,QAAQ,iBAAc,sBAAsB,EAC1D,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,aAC7F,4DAAyC,EACzC,iBAAO,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,gCAEhE,gBAAO,IAAI,EAAC,QAAQ,EAAC,IAAI,EAAC,MAAM,EAAC,YAAY,EAAC,KAAK,EAAC,KAAK,EAAE,MAAM,iBACnD,oBAAoB,EAChC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,SAAG,IACjD,EACR,iBAAO,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,4BAEhE,gBAAO,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,UAAU,EAAC,YAAY,EAAC,KAAK,EAAC,KAAK,EAAE,EAAE,iBAC/C,eAAe,EAC3B,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,SAAG,IAC7C,EACR,iBAAQ,IAAI,EAAC,QAAQ,iBAAa,mBAAmB,EAAC,QAAQ,EAAE,IAAI,IAAI,MAAM,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,YAC/F,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,uBAAuB,GACxC,EACR,OAAO,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI;oBAChC,CAAC,CAAC,YAAG,IAAI,EAAC,OAAO,iBAAa,kBAAkB,wBAAqB,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,YAC3G,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,GAChF;oBACJ,CAAC,CAAC,IAAI,IACH,CACR,CAAA;IACH,CAAC;IAED,+EAA+E;IAC/E,8EAA8E;IAC9E,0EAA0E;IAC1E,YAAY,EAAE,KAAK,EAAE,WAAW,EAAsB,EAAE;QACtD,MAAM,GAAG,GAAG,gBAAgB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;QACpD,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAA;QACjC,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,SAAS,IAAI,EAAE,EAAE,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;QAC/G,WAAW,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;QAE5D,8EAA8E;QAC9E,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;IACtB,CAAC;CACF,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/web-auth",
-  "version": "0.1.18",
+  "version": "0.1.19",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -29,25 +29,29 @@
     }
   },
   "dependencies": {
-    "@owlmeans/auth": "^0.1.18",
-    "@owlmeans/auth-common": "^0.1.18",
-    "@owlmeans/basic-ids": "^0.1.18",
-    "@owlmeans/basic-keys": "^0.1.18",
-    "@owlmeans/client": "^0.1.18",
-    "@owlmeans/client-auth": "^0.1.18",
-    "@owlmeans/client-flow": "^0.1.18",
-    "@owlmeans/config": "^0.1.18",
-    "@owlmeans/context": "^0.1.18",
-    "@owlmeans/web-client": "^0.1.18"
+    "@owlmeans/auth": "^0.1.19",
+    "@owlmeans/auth-common": "^0.1.19",
+    "@owlmeans/basic-ids": "^0.1.19",
+    "@owlmeans/basic-keys": "^0.1.19",
+    "@owlmeans/client": "^0.1.19",
+    "@owlmeans/client-auth": "^0.1.19",
+    "@owlmeans/client-flow": "^0.1.19",
+    "@owlmeans/config": "^0.1.19",
+    "@owlmeans/context": "^0.1.19",
+    "@owlmeans/log": "^0.1.19",
+    "@owlmeans/web-client": "^0.1.19"
   },
   "peerDependencies": {
     "react": "*"
   },
   "devDependencies": {
-    "@owlmeans/dep-config": "^0.1.18",
-    "@types/bun": "^1.4.2",
+    "@owlmeans/api": "^0.1.19",
+    "@owlmeans/dep-config": "^0.1.19",
+    "@owlmeans/error": "^0.1.19",
+    "@types/bun": "^1.4.4",
     "@types/react": "^19.3.0",
     "nodemon": "^3.1.14",
+    "react-dom": "^19.3.0",
     "typescript": "^7.0.2"
   },
   "publishConfig": {

package/src/auth/plugins/supervisor.tsx

@@ -1,15 +1,18 @@
 import { useState } from 'react'
 import type { FormEvent } from 'react'
 import type { AuthenticationPlugin } from '@owlmeans/client-auth/manager/plugins'
-import { AuthenticationType, buildSupervisorPayload } from '@owlmeans/auth'
+import { AuthenticationStage, AuthenticationType, buildSupervisorPayload } from '@owlmeans/auth'
 import type { AuthToken } from '@owlmeans/auth'
 import { DEFAULT_ALIAS as AUTH_SERVICE } from '@owlmeans/client-auth'
 import type { AuthService } from '@owlmeans/auth-common'
 import { useContext } from '@owlmeans/client'
-import { loginLandingOf } from '@owlmeans/client-auth/login'
+import { loginFailureHelper, loginLandingOf, makeAuthTranslate } from '@owlmeans/client-auth/login'
+import { logger } from '@owlmeans/log'
 import { makeKeyPairModel } from '@owlmeans/basic-keys'
 import { createIdOfLength } from '@owlmeans/basic-ids'
 
+const log = logger('web-auth:supervisor')
+
 /**
  * PK-based supervisor login form (development-only). The operator (or an e2e
  * test) enters a target user id / email and one of the project's trusted private
@@ -30,16 +33,21 @@ export const supervisorClientPlugin: AuthenticationPlugin = {
   // rendered as a link, because it is a tool, not a way in.
   method: { order: 900, icon: 'key', emphasis: 'link', restricted: true },
 
-  Implementation: () => ({ type, control }) => {
+  Implementation: () => ({ type, stage, control }) => {
     const context = useContext()
     const [userId, setUserId] = useState('')
     const [pk, setPk] = useState('')
-    const [error, setError] = useState<string | null>(null)
     const [busy, setBusy] = useState(false)
 
+    // A failed attempt is the control's Error stage (`control.setError`), phrased — never the raw
+    // message. The next submit asks for a new allowance, which leaves that stage and clears it.
+    const failure = stage === AuthenticationStage.Error && control.error != null
+      ? loginFailureHelper.failureOf(control.error) : null
+    // Context-free: the form must not depend on the app mounting an i18n provider.
+    const phrase = failure != null ? loginFailureHelper.phrase(failure, makeAuthTranslate(context.cfg)) : null
+
     const onSubmit = async (event: FormEvent) => {
       event.preventDefault()
-      setError(null)
       setBusy(true)
       try {
         // Fetch a fresh server challenge right before signing so the allowance is
@@ -60,7 +68,13 @@ export const supervisorClientPlugin: AuthenticationPlugin = {
         const landing = await landings.landAfterLogin()
         window.location.href = await landings.landingUrl(landing)
       } catch (e) {
-        setError(e instanceof Error ? e.message : String(e))
+        const failed = loginFailureHelper.failureOf(e)
+        if (failed.refused) {
+          log.warn('Supervisor sign-in refused', { kind: failed.kind, incidentId: failed.incidentId }, { event: 'auth.refused' })
+        } else {
+          log.error('Supervisor sign-in failed', e, { event: 'auth.refused' })
+        }
+        await control.setError(e)
         setBusy(false)
       }
     }
@@ -84,7 +98,11 @@ export const supervisorClientPlugin: AuthenticationPlugin = {
         <button type="submit" data-testid="supervisor-submit" disabled={busy || userId === '' || pk === ''}>
           {busy ? 'Signing in…' : 'Sign in as supervisor'}
         </button>
-        {error != null ? <p role="alert" data-testid="supervisor-error" style={{ color: 'crimson' }}>{error}</p> : null}
+        {failure != null && phrase != null
+          ? <p role="alert" data-testid="supervisor-error" data-login-failure={failure.kind} style={{ color: 'crimson' }}>
+            {phrase.incident != null ? `${phrase.message} ${phrase.incident}` : phrase.message}
+          </p>
+          : null}
       </form>
     )
   },

package/tests/supervisor-failure.spec.tsx

@@ -0,0 +1,73 @@
+import { describe, expect, test } from 'bun:test'
+import { randomUUID } from 'node:crypto'
+import { renderToStaticMarkup } from 'react-dom/server'
+import type { FC } from 'react'
+import { ACCESS_DENIED_KIND, ApiClientError, ServerCrashedError } from '@owlmeans/api'
+import type { ResponseStatusCarrier } from '@owlmeans/api'
+import { AuthenticationStage, AuthenticationType, AuthRefused } from '@owlmeans/auth'
+import { AppType } from '@owlmeans/context'
+import { ResilientError } from '@owlmeans/error'
+import { Context, makeClientContext } from '@owlmeans/client'
+import type { ClientConfig } from '@owlmeans/client-context'
+import { makeControl } from '@owlmeans/client-auth/manager'
+import type { AuthenticationRendererProps } from '@owlmeans/client-auth/manager'
+import { supervisorClientPlugin } from '../src/index.js'
+
+/** A failed call as the API client rejects it: the error, stamped with the status and denial kind. */
+const answered = <T extends Error>(error: T, status: number, denialKind?: string): T =>
+  Object.assign(error, { responseStatus: status, denialKind } satisfies ResponseStatusCarrier)
+
+const context = makeClientContext({
+  ready: false, service: 'web-auth-tests', type: AppType.Frontend, services: {}, debug: {},
+} as unknown as ClientConfig)
+
+const Form = supervisorClientPlugin.Implementation() as FC<AuthenticationRendererProps>
+
+/** The form as the authentication screen renders it after a submit that ended in `error`. */
+const renderFailed = async (error?: unknown, stage = AuthenticationStage.Error): Promise<string> => {
+  const control = makeControl(context)
+  control.type = AuthenticationType.Supervisor
+  if (error !== undefined) {
+    await control.setError(error)
+  }
+  control.stage = stage
+
+  return renderToStaticMarkup(<Context value={context}>
+    <Form type={AuthenticationType.Supervisor} stage={stage} control={control} params={{}} />
+  </Context>)
+}
+
+describe('supervisorClientPlugin — a failed submit ends phrased', () => {
+  test('a refusal reads "This account cannot sign in here.", never the raw message', async () => {
+    const out = await renderFailed(answered(new ApiClientError(`forbidden:${randomUUID()}`), 403, ACCESS_DENIED_KIND))
+
+    expect(out).toContain('data-testid="supervisor-error"')
+    expect(out).toContain('data-login-failure="refused"')
+    expect(out).toContain('This account cannot sign in here.')
+    expect(out).not.toContain('api:client')
+  })
+
+  test('a visible refusal code gets its precise sentence', async () => {
+    const rebuilt = answered(ResilientError.ensure(ResilientError.marshal(new AuthRefused('profile:disabled'))), 403, ACCESS_DENIED_KIND)
+    const out = await renderFailed(rebuilt)
+
+    expect(out).toContain('data-login-failure="profile-disabled"')
+    expect(out).toContain('access to this application has been blocked')
+    expect(out).not.toContain('auth:manager:authen')
+  })
+
+  test('anything else is the generic sentence with its reference, and the form stays to retry', async () => {
+    const incident = randomUUID()
+    const out = await renderFailed(answered(new ServerCrashedError(incident), 500))
+
+    expect(out).toContain('data-login-failure="failed"')
+    expect(out).toContain(`Sign-in did not complete. Please try again. Reference: ${incident}`)
+    expect(out).toContain('Sign in as supervisor')
+    expect(out).not.toContain('Signing in…')
+  })
+
+  test('no failure line outside the Error stage', async () => {
+    expect(await renderFailed(undefined, AuthenticationStage.Init)).not.toContain('supervisor-error')
+    expect(await renderFailed(new Error('stale'), AuthenticationStage.Allowence)).not.toContain('supervisor-error')
+  })
+})