@structured-id/ui-core 4.15.0 → 4.15.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@structured-id/ui-core",
-  "version": "4.15.0",
+  "version": "4.15.1",
   "type": "module",
   "publishConfig": {
     "access": "public",

package/src/index.ts

@@ -82,6 +82,7 @@ export {
   refusalMessage,
   REFUSAL_TEXTS,
   SID_ERROR_DOMAIN,
+  SignInRefusedError,
   type FieldViolation,
   type RpcRefusal,
 } from "./utils/rpcRefusal";

package/src/profile/composables/useAuth.test.ts

@@ -7,6 +7,7 @@ import {
   type PasswordOperationProgress,
   WrongCurrentPasswordError,
 } from "./useAuth";
+import { SignInRefusedError } from "../../utils/rpcRefusal";
 
 // Mock the gRPC wrappers
 vi.mock("./useAuthApi", () => ({
@@ -747,14 +748,26 @@ describe("createAuth login", () => {
     expect(result.pending).toEqual(pending);
   });
 
-  it("propagates a wrong password (the client cannot finish)", async () => {
-    vi.mocked(client.loginFinish).mockRejectedValue(
-      new Error("login finish: InvalidLoginError"),
-    );
+  // A wrong password showed the client's own "invalid login" to the user; it
+  // is the sign-in's refusal, and nothing more is sent.
+  it("reports a wrong password as a refused sign-in", async () => {
+    const refused = new Error("invalid login");
+    refused.name = "ZkppInvalidLoginError";
+    vi.mocked(client.loginFinish).mockRejectedValue(refused);
     const { login } = createAuth(loader);
-    await expect(login("alice@test.com", "wrong")).rejects.toThrow(
-      "InvalidLoginError",
-    );
+    const failure = await login("alice@test.com", "wrong").catch((e) => e);
+    expect(failure).toBeInstanceOf(SignInRefusedError);
+    expect((failure as SignInRefusedError).cause).toBe(refused);
+    expect(api.loginFinish).not.toHaveBeenCalled();
+  });
+
+  // Only the client's refusal judged the password: a malformed response or
+  // another fault comes through as itself.
+  it("reports a sign-in failure other than a refusal as itself", async () => {
+    const fault = new Error("response: invalid length");
+    vi.mocked(client.loginFinish).mockRejectedValue(fault);
+    const { login } = createAuth(loader);
+    await expect(login("alice@test.com", "pw")).rejects.toBe(fault);
     expect(api.loginFinish).not.toHaveBeenCalled();
   });
 });

package/src/profile/composables/useAuth.ts

@@ -16,6 +16,7 @@
  */
 import type { CredentialId, SessionId } from "@structured-id/ids";
 import type { PendingSignIn } from "../pendingSignIn";
+import { SignInRefusedError } from "../../utils/rpcRefusal";
 import {
   completePasswordReset,
   evaluatePasswordHistory,
@@ -533,12 +534,20 @@ export function createAuth(loadClient: ZkppClientLoader) {
     const started = await opaqueLoginStart(identifier, start.request);
     onStep?.(3);
     // An ordinary sign-in runs under the empty context.
-    const finalization = await c.loginFinish(
-      password,
-      start.state,
-      started.credentialResponse,
-      new Uint8Array(),
-    );
+    let finalization: Uint8Array;
+    try {
+      finalization = await c.loginFinish(
+        password,
+        start.state,
+        started.credentialResponse,
+        new Uint8Array(),
+      );
+    } catch (e) {
+      // The client's refusal is the sign-in's answer; any other failure (a
+      // stopped client, a malformed response) is itself.
+      if (isRefusedSignIn(e)) throw new SignInRefusedError(e);
+      throw e;
+    }
     const finished = await opaqueLoginFinish(
       identifier,
       finalization,

package/src/utils/rpcRefusal.test.ts

@@ -14,6 +14,7 @@ import {
   refusalMessage,
   rpcReason,
   rpcRefusal,
+  SignInRefusedError,
 } from "./rpcRefusal";
 
 /** A refused call as the gRPC-Web transport raises it: the status in the trailer. */
@@ -143,6 +144,16 @@ describe("rpcRefusal", () => {
     );
   });
 
+  // A password the device refused reads as the server's refusal of a sign-in,
+  // never as the client's own wording, so a wrong password and an unknown
+  // account look alike.
+  it("shows a refused sign-in as the server's sign-in refusal", () => {
+    const refused = new Error("invalid login");
+    expect(
+      refusalMessage(new SignInRefusedError(refused), "Login failed"),
+    ).toBe(REFUSAL_TEXTS[ErrorReason.AUTHENTICATION_FAILED]);
+  });
+
   // A refusal that names the fields it concerns lets the form show each
   // text under its field: the server's text for people when it sent one,
   // else its description.

package/src/utils/rpcRefusal.ts

@@ -231,15 +231,31 @@ export const REFUSAL_TEXTS: Readonly<
   [ErrorReason.INTERNAL_ERROR]: "Something went wrong on the server.",
 };
 
+/**
+ * A password sign-in refused on this device: it did not verify (RFC 9807
+ * §6.4). It reads as the server's own refusal of a sign-in, so the text does
+ * not tell a wrong password from an unknown account.
+ */
+export class SignInRefusedError extends Error {
+  constructor(cause: unknown) {
+    super("The sign-in did not verify", { cause });
+    this.name = "SignInRefusedError";
+  }
+}
+
 /**
  * The text to show for a failed call: the server's text for people, else the
  * client's text for SID's reason, else `fallback`, the caller's context. A
- * client-side `Error` (no call refused) keeps its own message.
+ * client-side `Error` (no call refused) keeps its own message, except a
+ * refused sign-in, which reads as the server's refusal of one.
  */
 export function refusalMessage(
   err: unknown,
   fallback = "Request failed",
 ): string {
+  if (err instanceof SignInRefusedError) {
+    return REFUSAL_TEXTS[ErrorReason.AUTHENTICATION_FAILED];
+  }
   const refusal = rpcRefusal(err);
   if (refusal) {
     if (refusal.localized) return refusal.localized;