@structured-id/ui-core 4.15.0 → 4.15.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@structured-id/ui-core",
-  "version": "4.15.0",
+  "version": "4.15.2",
   "type": "module",
   "publishConfig": {
     "access": "public",

package/src/index.ts

@@ -80,8 +80,10 @@ export {
   rpcRefusal,
   rpcReason,
   refusalMessage,
+  MFA_CONTINUATION_TEXTS,
   REFUSAL_TEXTS,
   SID_ERROR_DOMAIN,
+  SignInRefusedError,
   type FieldViolation,
   type RpcRefusal,
 } from "./utils/rpcRefusal";

package/src/profile/composables/useAuth.test.ts

@@ -7,6 +7,7 @@ import {
   type PasswordOperationProgress,
   WrongCurrentPasswordError,
 } from "./useAuth";
+import { SignInRefusedError } from "../../utils/rpcRefusal";
 
 // Mock the gRPC wrappers
 vi.mock("./useAuthApi", () => ({
@@ -747,14 +748,26 @@ describe("createAuth login", () => {
     expect(result.pending).toEqual(pending);
   });
 
-  it("propagates a wrong password (the client cannot finish)", async () => {
-    vi.mocked(client.loginFinish).mockRejectedValue(
-      new Error("login finish: InvalidLoginError"),
-    );
+  // A wrong password showed the client's own "invalid login" to the user; it
+  // is the sign-in's refusal, and nothing more is sent.
+  it("reports a wrong password as a refused sign-in", async () => {
+    const refused = new Error("invalid login");
+    refused.name = "ZkppInvalidLoginError";
+    vi.mocked(client.loginFinish).mockRejectedValue(refused);
     const { login } = createAuth(loader);
-    await expect(login("alice@test.com", "wrong")).rejects.toThrow(
-      "InvalidLoginError",
-    );
+    const failure = await login("alice@test.com", "wrong").catch((e) => e);
+    expect(failure).toBeInstanceOf(SignInRefusedError);
+    expect((failure as SignInRefusedError).cause).toBe(refused);
+    expect(api.loginFinish).not.toHaveBeenCalled();
+  });
+
+  // Only the client's refusal judged the password: a malformed response or
+  // another fault comes through as itself.
+  it("reports a sign-in failure other than a refusal as itself", async () => {
+    const fault = new Error("response: invalid length");
+    vi.mocked(client.loginFinish).mockRejectedValue(fault);
+    const { login } = createAuth(loader);
+    await expect(login("alice@test.com", "pw")).rejects.toBe(fault);
     expect(api.loginFinish).not.toHaveBeenCalled();
   });
 });

package/src/profile/composables/useAuth.ts

@@ -16,6 +16,7 @@
  */
 import type { CredentialId, SessionId } from "@structured-id/ids";
 import type { PendingSignIn } from "../pendingSignIn";
+import { SignInRefusedError } from "../../utils/rpcRefusal";
 import {
   completePasswordReset,
   evaluatePasswordHistory,
@@ -533,12 +534,20 @@ export function createAuth(loadClient: ZkppClientLoader) {
     const started = await opaqueLoginStart(identifier, start.request);
     onStep?.(3);
     // An ordinary sign-in runs under the empty context.
-    const finalization = await c.loginFinish(
-      password,
-      start.state,
-      started.credentialResponse,
-      new Uint8Array(),
-    );
+    let finalization: Uint8Array;
+    try {
+      finalization = await c.loginFinish(
+        password,
+        start.state,
+        started.credentialResponse,
+        new Uint8Array(),
+      );
+    } catch (e) {
+      // The client's refusal is the sign-in's answer; any other failure (a
+      // stopped client, a malformed response) is itself.
+      if (isRefusedSignIn(e)) throw new SignInRefusedError(e);
+      throw e;
+    }
     const finished = await opaqueLoginFinish(
       identifier,
       finalization,

package/src/utils/rpcRefusal.test.ts

@@ -10,10 +10,12 @@ import {
 } from "@structured-id/proto/google/rpc/error_details";
 import { ErrorReason } from "@structured-id/proto/sid/v1/common/errors";
 import {
+  MFA_CONTINUATION_TEXTS,
   REFUSAL_TEXTS,
   refusalMessage,
   rpcReason,
   rpcRefusal,
+  SignInRefusedError,
 } from "./rpcRefusal";
 
 /** A refused call as the gRPC-Web transport raises it: the status in the trailer. */
@@ -143,6 +145,16 @@ describe("rpcRefusal", () => {
     );
   });
 
+  // A password the device refused reads as the server's refusal of a sign-in,
+  // never as the client's own wording, so a wrong password and an unknown
+  // account look alike.
+  it("shows a refused sign-in as the server's sign-in refusal", () => {
+    const refused = new Error("invalid login");
+    expect(
+      refusalMessage(new SignInRefusedError(refused), "Login failed"),
+    ).toBe(REFUSAL_TEXTS[ErrorReason.AUTHENTICATION_FAILED]);
+  });
+
   // A refusal that names the fields it concerns lets the form show each
   // text under its field: the server's text for people when it sent one,
   // else its description.
@@ -184,6 +196,42 @@ describe("rpcRefusal", () => {
     expect(rpcRefusal(refused([info]))?.fieldViolations).toEqual([]);
   });
 
+  // Bug prevented: every MFA_REQUIRED read "Set up a second factor first.",
+  // so a session that was only too old was told to set up a factor it may
+  // already hold, and that setup was refused the same way. The text follows
+  // what the server asks for in `continuation`.
+  it("says what an MFA_REQUIRED refusal asks for", () => {
+    const mfa = (continuation?: string) =>
+      refused(
+        [
+          Any.pack(
+            ErrorInfo.create({
+              reason: "MFA_REQUIRED",
+              domain: "structured.id",
+              metadata: continuation ? { continuation } : {},
+            }),
+            ErrorInfo,
+          ),
+        ],
+        "a%20stronger%20authentication%20is%20required",
+      );
+    expect(refusalMessage(mfa("reauthenticate"))).toBe(
+      MFA_CONTINUATION_TEXTS.reauthenticate,
+    );
+    expect(refusalMessage(mfa("step_up"))).toBe(MFA_CONTINUATION_TEXTS.step_up);
+    expect(refusalMessage(mfa("authenticate"))).toBe(
+      MFA_CONTINUATION_TEXTS.authenticate,
+    );
+    expect(refusalMessage(mfa())).toBe(REFUSAL_TEXTS[ErrorReason.MFA_REQUIRED]);
+    // A continuation this client does not know keeps the reason's text.
+    expect(refusalMessage(mfa("later"))).toBe(
+      REFUSAL_TEXTS[ErrorReason.MFA_REQUIRED],
+    );
+    expect(MFA_CONTINUATION_TEXTS.reauthenticate).not.toBe(
+      REFUSAL_TEXTS[ErrorReason.MFA_REQUIRED],
+    );
+  });
+
   it("survives an unreadable trailer", () => {
     const err = new RpcError("m", "INTERNAL", {
       "grpc-status-details-bin": "!!!",

package/src/utils/rpcRefusal.ts

@@ -231,18 +231,53 @@ export const REFUSAL_TEXTS: Readonly<
   [ErrorReason.INTERNAL_ERROR]: "Something went wrong on the server.",
 };
 
+/**
+ * What an `MFA_REQUIRED` refusal asks of the user, by the `continuation` its
+ * `ErrorInfo` names. Without one (no second factor enrolled) the reason's own
+ * text stands.
+ */
+export const MFA_CONTINUATION_TEXTS = {
+  authenticate: "Sign in to your account first.",
+  step_up: "Confirm it's you with your second factor to continue.",
+  reauthenticate: "Sign in again to make this change.",
+} as const;
+
+/**
+ * A password sign-in refused on this device: it did not verify (RFC 9807
+ * §6.4). It reads as the server's own refusal of a sign-in, so the text does
+ * not tell a wrong password from an unknown account.
+ */
+export class SignInRefusedError extends Error {
+  constructor(cause: unknown) {
+    super("The sign-in did not verify", { cause });
+    this.name = "SignInRefusedError";
+  }
+}
+
 /**
  * The text to show for a failed call: the server's text for people, else the
  * client's text for SID's reason, else `fallback`, the caller's context. A
- * client-side `Error` (no call refused) keeps its own message.
+ * client-side `Error` (no call refused) keeps its own message, except a
+ * refused sign-in, which reads as the server's refusal of one.
  */
 export function refusalMessage(
   err: unknown,
   fallback = "Request failed",
 ): string {
+  if (err instanceof SignInRefusedError) {
+    return REFUSAL_TEXTS[ErrorReason.AUTHENTICATION_FAILED];
+  }
   const refusal = rpcRefusal(err);
   if (refusal) {
     if (refusal.localized) return refusal.localized;
+    if (refusal.reasonCode === ErrorReason.MFA_REQUIRED) {
+      const asked = refusal.metadata["continuation"];
+      if (asked && Object.hasOwn(MFA_CONTINUATION_TEXTS, asked)) {
+        return MFA_CONTINUATION_TEXTS[
+          asked as keyof typeof MFA_CONTINUATION_TEXTS
+        ];
+      }
+    }
     if (
       refusal.reasonCode !== null &&
       refusal.reasonCode !== ErrorReason.ERROR_REASON_UNSPECIFIED