@structured-id/ui-core 4.14.2 → 4.15.1

package/src/profile/upstream.test.ts

@@ -1,4 +1,5 @@
 import { beforeEach, describe, expect, it } from "vitest";
+import { UpstreamProviderId } from "@structured-id/ids";
 import {
   UPSTREAM_CALLBACK_PATH,
   peekUpstream,
@@ -8,6 +9,7 @@ import {
   upstreamRequestOfPage,
 } from "./upstream";
 
+const P1 = UpstreamProviderId.parse("0192f3a4-7c1e-7b2a-9d4e-3f5a6b7c8d20");
 const RD =
   "https://sid.example.com/i/0123456789abcdef0123456789abcdef/oauth2/authorize?client_id=ops&request_uri=urn%3Aietf%3Aparams%3Aoauth%3Arequest_uri%3Ar";
 
@@ -35,25 +37,26 @@ describe("the kept return", () => {
   // The return to the callback page finds the provider and the request it
   // started with, under the provider's state.
   it("is found under its state", () => {
-    rememberUpstream(sessionStorage, "s1", { provider: "p1", rd: RD });
-    expect(peekUpstream(sessionStorage, "s1")).toEqual({
-      provider: "p1",
-      rd: RD,
-    });
+    rememberUpstream(sessionStorage, "s1", { provider: P1, rd: RD });
+    const kept = peekUpstream(sessionStorage, "s1");
+    expect(kept?.provider.toString()).toBe(P1.toString());
+    expect(kept?.rd).toBe(RD);
     expect(peekUpstream(sessionStorage, "s2")).toBeUndefined();
   });
 
   // A sign-in without an authorization request returns without one.
   it("keeps the absence of a request", () => {
-    rememberUpstream(sessionStorage, "s1", { provider: "p1", rd: null });
+    rememberUpstream(sessionStorage, "s1", { provider: P1, rd: null });
     expect(peekUpstream(sessionStorage, "s1")?.rd).toBeNull();
   });
 
   // A return completes once: taking it removes it, so a reloaded or replayed
   // callback finds nothing to continue.
   it("is taken once", () => {
-    rememberUpstream(sessionStorage, "s1", { provider: "p1", rd: RD });
-    expect(takeUpstream(sessionStorage, "s1")?.provider).toBe("p1");
+    rememberUpstream(sessionStorage, "s1", { provider: P1, rd: RD });
+    expect(takeUpstream(sessionStorage, "s1")?.provider.toString()).toBe(
+      P1.toString(),
+    );
     expect(takeUpstream(sessionStorage, "s1")).toBeUndefined();
   });
 
@@ -61,8 +64,13 @@ describe("the kept return", () => {
   it("ignores what it did not write", () => {
     sessionStorage.setItem("sid.upstream.s1", "not json");
     sessionStorage.setItem("sid.upstream.s2", JSON.stringify({ rd: RD }));
+    sessionStorage.setItem(
+      "sid.upstream.s3",
+      JSON.stringify({ provider: "not-an-id", rd: RD }),
+    );
     expect(peekUpstream(sessionStorage, "s1")).toBeUndefined();
     expect(peekUpstream(sessionStorage, "s2")).toBeUndefined();
+    expect(peekUpstream(sessionStorage, "s3")).toBeUndefined();
   });
 });
 
@@ -84,7 +92,7 @@ describe("upstreamRequestOfPage", () => {
   // provider's return does not carry; the entry stays for the page to take.
   // An rd in the callback's own query is never used.
   it("reads the callback's request only from its kept return", () => {
-    rememberUpstream(sessionStorage, "s1", { provider: "p1", rd: RD });
+    rememberUpstream(sessionStorage, "s1", { provider: P1, rd: RD });
     const callback = location(`${UPSTREAM_CALLBACK_PATH}?code=c&state=s1`);
     expect(upstreamRequestOfPage(callback, sessionStorage)).toBe(RD);
     expect(peekUpstream(sessionStorage, "s1")).toBeDefined();
@@ -106,7 +114,7 @@ describe("upstreamRequestOfPage", () => {
 
   // An app with its own callback path reads its own callback page.
   it("follows the app's callback path", () => {
-    rememberUpstream(sessionStorage, "s1", { provider: "p1", rd: RD });
+    rememberUpstream(sessionStorage, "s1", { provider: P1, rd: RD });
     expect(
       upstreamRequestOfPage(
         location("/upstream/return?state=s1"),

package/src/profile/upstream.ts

@@ -9,6 +9,7 @@
  * The kept entry is no credential: the issuer keeps the request's state,
  * PKCE verifier and nonce itself and checks `state` on completion.
  */
+import { UpstreamProviderId } from "@structured-id/ids";
 
 /** Where the provider returns the browser, unless the app names its own. */
 export const UPSTREAM_CALLBACK_PATH = "/account/upstream/callback";
@@ -27,20 +28,23 @@ export function upstreamCallbackUri(
 /** What the return to the callback page needs. */
 export interface PendingUpstream {
   /** The provider the sign-in started at. */
-  provider: string;
+  provider: UpstreamProviderId;
   /** The authorization request the sign-in completes, if one sent the user. */
   rd: string | null;
 }
 
 const PREFIX = "sid.upstream.";
 
-/** Keep `pending` for the return carrying `state`. */
+/** Keep `pending` for the return carrying `state`; the provider by its text form. */
 export function rememberUpstream(
   storage: Storage,
   state: string,
   pending: PendingUpstream,
 ): void {
-  storage.setItem(PREFIX + state, JSON.stringify(pending));
+  storage.setItem(
+    PREFIX + state,
+    JSON.stringify({ provider: pending.provider.toString(), rd: pending.rd }),
+  );
 }
 
 /** What was kept for `state`, left in place; `undefined` when nothing is. */
@@ -51,12 +55,11 @@ export function peekUpstream(
   const kept = storage.getItem(PREFIX + state);
   if (kept === null) return undefined;
   try {
-    const parsed = JSON.parse(kept) as Partial<PendingUpstream>;
-    if (typeof parsed.provider !== "string" || !parsed.provider) {
-      return undefined;
-    }
+    const parsed = JSON.parse(kept) as { provider?: unknown; rd?: unknown };
+    if (typeof parsed.provider !== "string") return undefined;
     return {
-      provider: parsed.provider,
+      // An entry whose provider is no identifier was not kept by this code.
+      provider: UpstreamProviderId.parse(parsed.provider),
       rd: typeof parsed.rd === "string" ? parsed.rd : null,
     };
   } catch {

package/src/utils/rpcRefusal.test.ts

@@ -14,6 +14,7 @@ import {
   refusalMessage,
   rpcReason,
   rpcRefusal,
+  SignInRefusedError,
 } from "./rpcRefusal";
 
 /** A refused call as the gRPC-Web transport raises it: the status in the trailer. */
@@ -143,6 +144,16 @@ describe("rpcRefusal", () => {
     );
   });
 
+  // A password the device refused reads as the server's refusal of a sign-in,
+  // never as the client's own wording, so a wrong password and an unknown
+  // account look alike.
+  it("shows a refused sign-in as the server's sign-in refusal", () => {
+    const refused = new Error("invalid login");
+    expect(
+      refusalMessage(new SignInRefusedError(refused), "Login failed"),
+    ).toBe(REFUSAL_TEXTS[ErrorReason.AUTHENTICATION_FAILED]);
+  });
+
   // A refusal that names the fields it concerns lets the form show each
   // text under its field: the server's text for people when it sent one,
   // else its description.

package/src/utils/rpcRefusal.ts

@@ -231,15 +231,31 @@ export const REFUSAL_TEXTS: Readonly<
   [ErrorReason.INTERNAL_ERROR]: "Something went wrong on the server.",
 };
 
+/**
+ * A password sign-in refused on this device: it did not verify (RFC 9807
+ * §6.4). It reads as the server's own refusal of a sign-in, so the text does
+ * not tell a wrong password from an unknown account.
+ */
+export class SignInRefusedError extends Error {
+  constructor(cause: unknown) {
+    super("The sign-in did not verify", { cause });
+    this.name = "SignInRefusedError";
+  }
+}
+
 /**
  * The text to show for a failed call: the server's text for people, else the
  * client's text for SID's reason, else `fallback`, the caller's context. A
- * client-side `Error` (no call refused) keeps its own message.
+ * client-side `Error` (no call refused) keeps its own message, except a
+ * refused sign-in, which reads as the server's refusal of one.
  */
 export function refusalMessage(
   err: unknown,
   fallback = "Request failed",
 ): string {
+  if (err instanceof SignInRefusedError) {
+    return REFUSAL_TEXTS[ErrorReason.AUTHENTICATION_FAILED];
+  }
   const refusal = rpcRefusal(err);
   if (refusal) {
     if (refusal.localized) return refusal.localized;