@structured-id/ui-core 4.0.0 → 4.2.0

package/src/utils/normalizePrincipal.test.ts

@@ -17,10 +17,18 @@ describe("detectLoginInputType", () => {
     expect(detectLoginInputType("alice")).toBe("username");
     expect(detectLoginInputType("bob_smith")).toBe("username");
     expect(detectLoginInputType("dev42")).toBe("username");
-    // Uppercase accepted in detection (will be lowercased on normalize)
+    // Uppercase accepted; the server derives the key.
     expect(detectLoginInputType("Admin123")).toBe("username");
   });
 
+  it("detects a username in any script, counted in code points", () => {
+    expect(detectLoginInputType("Иван")).toBe("username");
+    expect(detectLoginInputType("Иван_Петров", 6)).toBe("username");
+    expect(detectLoginInputType("Щукин", 6)).toBe("unknown"); // 5 < 6
+    expect(detectLoginInputType("ЩЩ")).toBe("unknown"); // 2 < 3
+    expect(detectLoginInputType("Иван Петров")).toBe("unknown"); // a space
+  });
+
   it("detects username with minLength=6 (registration)", () => {
     expect(detectLoginInputType("alice", 6)).toBe("unknown"); // too short
     expect(detectLoginInputType("alicew", 6)).toBe("username"); // exactly 6
@@ -126,13 +134,42 @@ describe("normalizePrincipal", () => {
     expect(result.display).toBe("+380501234567");
   });
 
-  it("normalizes username: value=lowercase, display=original casing", () => {
+  // Regression: the client lowercased a username before sending it, so the
+  // server never saw the spelling the user typed and could not keep it as
+  // the display form. The server derives the key, as it does for email.
+  it("sends a username as typed, case kept", () => {
     const result = normalizePrincipal("Alice_Bob");
     expect(result.type).toBe("username");
-    expect(result.value).toBe("alice_bob");
+    expect(result.value).toBe("Alice_Bob");
     expect(result.display).toBe("Alice_Bob");
   });
 
+  // Whitespace is never part of a name and is not repaired: a username with
+  // surrounding spaces is refused, not trimmed into another name.
+  it("refuses a username with surrounding whitespace", () => {
+    for (const input of ["  Alice_Bob ", "Alice_Bob ", "\tAlice_Bob"]) {
+      expect(() => normalizePrincipal(input)).toThrow("Cannot determine");
+    }
+  });
+
+  // Regression: a letter outside a-z made the name no type at all, so the
+  // field refused it before the server could apply its repertoire.
+  it("sends a username in any script as typed", () => {
+    for (const name of ["Иван_Петров", "Ωmega42", "Jürgen"]) {
+      const result = normalizePrincipal(name);
+      expect(result.type).toBe("username");
+      expect(result.value).toBe(name);
+    }
+  });
+
+  it("sends a username unnormalized and counts it after NFC", () => {
+    // "Jürgen" with ü as u + combining diaeresis: 7 code points, 6 in NFC.
+    const decomposed = "Jürgen";
+    const result = normalizePrincipal(decomposed, 6);
+    expect(result.value).toBe(decomposed);
+    expect(() => normalizePrincipal("Щукин", 6)).toThrow("Cannot determine");
+  });
+
   it("rejects username with leading/trailing underscore (detected as unknown)", () => {
     // Leading/trailing _ blocked at detection level → "Cannot determine"
     expect(() => normalizePrincipal("_alice_bob")).toThrow("Cannot determine");

package/src/utils/normalizePrincipal.ts

@@ -14,17 +14,18 @@ export interface NormalizedPrincipal {
 }
 
 /**
- * Global username rules:
- *   Display:    ^[a-zA-Z0-9_]{3,32}$ — user's original input, mixed case preserved
- *   Normalized: ^[a-z0-9_]{3,32}$    — lowercase, for storage + uniqueness + login
- *   - cannot start or end with underscore
- *   - no consecutive underscores (__)
- *
- * For detection (prematch) we use a relaxed version:
- *   - accepts minLength (3 for login, 6 for registration)
- *   - case-insensitive (will be lowercased on normalization)
+ * A global username as the user types it: letters of any script, combining
+ * marks, digits and `_`, at most 32 code points in NFC, no `_` at either
+ * end. It is sent exactly as typed (nothing trimmed or normalized); the
+ * server applies its repertoire and minimum and derives the lookup key.
  */
 const USERNAME_MAX_LENGTH = 32;
+const USERNAME_SHAPE = /^[\p{L}\p{M}\p{N}_]+$/u;
+
+/** The length of `name` in code points of its NFC form. */
+function codePoints(name: string): number {
+  return [...name.normalize("NFC")].length;
+}
 
 /**
  * Detect principal type from user input.
@@ -63,11 +64,16 @@ export function detectLoginInputType(
     return "unknown";
   }
 
-  // Global username: no #, no @, no +
-  const re = new RegExp(
-    `^[a-zA-Z0-9_]{${minUsernameLength},${USERNAME_MAX_LENGTH}}$`,
-  );
-  if (re.test(trimmed) && !trimmed.startsWith("_") && !trimmed.endsWith("_")) {
+  // Global username: no #, no @, no +. Judged on the input itself, not the
+  // trimmed form: whitespace is never part of a name and is never repaired.
+  const length = codePoints(input);
+  if (
+    USERNAME_SHAPE.test(input) &&
+    length >= minUsernameLength &&
+    length <= USERNAME_MAX_LENGTH &&
+    !input.startsWith("_") &&
+    !input.endsWith("_")
+  ) {
     return "username";
   }
 
@@ -79,7 +85,7 @@ export function detectLoginInputType(
  *
  * - Email: as typed (trimmed); the server applies the email policy
  * - Phone: E.164 format via libphonenumber-js
- * - Username: lowercase, validate per arch rules
+ * - Username: exactly as typed; a federated one trimmed and lowercased
  *
  * @param minUsernameLength - minimum chars for username (3 for login, 6 for register)
  * Throws if value doesn't pass validation for detected type.
@@ -89,7 +95,7 @@ export function normalizePrincipal(
   minUsernameLength = 3,
 ): NormalizedPrincipal {
   const trimmed = input.trim();
-  const type = detectLoginInputType(trimmed, minUsernameLength);
+  const type = detectLoginInputType(input, minUsernameLength);
 
   switch (type) {
     case "email": {
@@ -135,20 +141,13 @@ export function normalizePrincipal(
         return { value: normalized, display: trimmed, type: "username" };
       }
 
-      // Global username
-      const normalized = trimmed.toLowerCase();
-      const re = new RegExp(
-        `^[a-z0-9_]{${minUsernameLength},${USERNAME_MAX_LENGTH}}$`,
-      );
-      if (
-        !re.test(normalized) ||
-        normalized.startsWith("_") ||
-        normalized.endsWith("_") ||
-        normalized.includes("__")
-      ) {
+      // Global username: detection checked its shape and length on the
+      // input itself; sent exactly as typed, the server normalizes it and
+      // derives the key.
+      if (input.includes("__")) {
         throw new Error("Invalid username");
       }
-      return { value: normalized, display: trimmed, type: "username" };
+      return { value: input, display: input, type: "username" };
     }
 
     default:

package/src/utils/rpcRefusal.test.ts

@@ -4,6 +4,7 @@ import { base64encode } from "@protobuf-ts/runtime";
 import { Any } from "@structured-id/proto/google/protobuf/any";
 import { Status } from "@structured-id/proto/google/rpc/status";
 import {
+  BadRequest,
   ErrorInfo,
   LocalizedMessage,
 } from "@structured-id/proto/google/rpc/error_details";
@@ -142,6 +143,47 @@ describe("rpcRefusal", () => {
     );
   });
 
+  // A refusal that names the fields it concerns lets the form show each
+  // text under its field: the server's text for people when it sent one,
+  // else its description.
+  it("reads the field violations", () => {
+    const bad = Any.pack(
+      BadRequest.create({
+        fieldViolations: [
+          {
+            field: "principal",
+            description: "registration here accepts: email",
+            reason: "PRINCIPAL_TYPE_NOT_ACCEPTED",
+          },
+          {
+            field: "claim_token",
+            description: "not the installation's token",
+            reason: "",
+            localizedMessage: LocalizedMessage.create({
+              locale: "en",
+              message: "This claim token is not valid.",
+            }),
+          },
+        ],
+      }),
+      BadRequest,
+    );
+    const refusal = rpcRefusal(refused([info, bad]));
+    expect(refusal?.fieldViolations).toEqual([
+      {
+        field: "principal",
+        reason: "PRINCIPAL_TYPE_NOT_ACCEPTED",
+        text: "registration here accepts: email",
+      },
+      {
+        field: "claim_token",
+        reason: null,
+        text: "This claim token is not valid.",
+      },
+    ]);
+    expect(rpcRefusal(refused([info]))?.fieldViolations).toEqual([]);
+  });
+
   it("survives an unreadable trailer", () => {
     const err = new RpcError("m", "INTERNAL", {
       "grpc-status-details-bin": "!!!",

package/src/utils/rpcRefusal.ts

@@ -8,6 +8,7 @@ import { base64decode } from "@protobuf-ts/runtime";
 import { Any } from "@structured-id/proto/google/protobuf/any";
 import { Status } from "@structured-id/proto/google/rpc/status";
 import {
+  BadRequest,
   ErrorInfo,
   LocalizedMessage,
 } from "@structured-id/proto/google/rpc/error_details";
@@ -28,6 +29,18 @@ export interface RpcRefusal {
   message: string;
   /** The server's text for people (`LocalizedMessage`), when it sent one. */
   localized: string | null;
+  /** The request fields the refusal names (`BadRequest`), in the server's order. */
+  fieldViolations: FieldViolation[];
+}
+
+/** One request field a refusal names. */
+export interface FieldViolation {
+  /** The field's path in the request, as the proto names it (`principal`). */
+  field: string;
+  /** The field-level reason, when the server gave one. */
+  reason: string | null;
+  /** What to show under the field: the server's text for people, else its description. */
+  text: string;
 }
 
 /**
@@ -50,6 +63,7 @@ export function rpcRefusal(err: unknown): RpcRefusal | null {
     metadata: {},
     message: decodeStatusMessage(err.message),
     localized: null,
+    fieldViolations: [],
   };
   for (const detail of statusDetails(err.meta[DETAILS_KEY])) {
     if (Any.contains(detail, ErrorInfo)) {
@@ -61,6 +75,14 @@ export function rpcRefusal(err: unknown): RpcRefusal | null {
         info.domain === SID_ERROR_DOMAIN ? sidReason(info.reason) : null;
     } else if (Any.contains(detail, LocalizedMessage)) {
       refusal.localized = Any.unpack(detail, LocalizedMessage).message;
+    } else if (Any.contains(detail, BadRequest)) {
+      for (const v of Any.unpack(detail, BadRequest).fieldViolations) {
+        refusal.fieldViolations.push({
+          field: v.field,
+          reason: v.reason || null,
+          text: v.localizedMessage?.message || v.description,
+        });
+      }
     }
   }
   return refusal;