@structured-id/ui-core 4.15.1 → 4.15.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@structured-id/ui-core",
-  "version": "4.15.1",
+  "version": "4.15.2",
   "type": "module",
   "publishConfig": {
     "access": "public",

package/src/index.ts

@@ -80,6 +80,7 @@ export {
   rpcRefusal,
   rpcReason,
   refusalMessage,
+  MFA_CONTINUATION_TEXTS,
   REFUSAL_TEXTS,
   SID_ERROR_DOMAIN,
   SignInRefusedError,

package/src/utils/rpcRefusal.test.ts

@@ -10,6 +10,7 @@ import {
 } from "@structured-id/proto/google/rpc/error_details";
 import { ErrorReason } from "@structured-id/proto/sid/v1/common/errors";
 import {
+  MFA_CONTINUATION_TEXTS,
   REFUSAL_TEXTS,
   refusalMessage,
   rpcReason,
@@ -195,6 +196,42 @@ describe("rpcRefusal", () => {
     expect(rpcRefusal(refused([info]))?.fieldViolations).toEqual([]);
   });
 
+  // Bug prevented: every MFA_REQUIRED read "Set up a second factor first.",
+  // so a session that was only too old was told to set up a factor it may
+  // already hold, and that setup was refused the same way. The text follows
+  // what the server asks for in `continuation`.
+  it("says what an MFA_REQUIRED refusal asks for", () => {
+    const mfa = (continuation?: string) =>
+      refused(
+        [
+          Any.pack(
+            ErrorInfo.create({
+              reason: "MFA_REQUIRED",
+              domain: "structured.id",
+              metadata: continuation ? { continuation } : {},
+            }),
+            ErrorInfo,
+          ),
+        ],
+        "a%20stronger%20authentication%20is%20required",
+      );
+    expect(refusalMessage(mfa("reauthenticate"))).toBe(
+      MFA_CONTINUATION_TEXTS.reauthenticate,
+    );
+    expect(refusalMessage(mfa("step_up"))).toBe(MFA_CONTINUATION_TEXTS.step_up);
+    expect(refusalMessage(mfa("authenticate"))).toBe(
+      MFA_CONTINUATION_TEXTS.authenticate,
+    );
+    expect(refusalMessage(mfa())).toBe(REFUSAL_TEXTS[ErrorReason.MFA_REQUIRED]);
+    // A continuation this client does not know keeps the reason's text.
+    expect(refusalMessage(mfa("later"))).toBe(
+      REFUSAL_TEXTS[ErrorReason.MFA_REQUIRED],
+    );
+    expect(MFA_CONTINUATION_TEXTS.reauthenticate).not.toBe(
+      REFUSAL_TEXTS[ErrorReason.MFA_REQUIRED],
+    );
+  });
+
   it("survives an unreadable trailer", () => {
     const err = new RpcError("m", "INTERNAL", {
       "grpc-status-details-bin": "!!!",

package/src/utils/rpcRefusal.ts

@@ -231,6 +231,17 @@ export const REFUSAL_TEXTS: Readonly<
   [ErrorReason.INTERNAL_ERROR]: "Something went wrong on the server.",
 };
 
+/**
+ * What an `MFA_REQUIRED` refusal asks of the user, by the `continuation` its
+ * `ErrorInfo` names. Without one (no second factor enrolled) the reason's own
+ * text stands.
+ */
+export const MFA_CONTINUATION_TEXTS = {
+  authenticate: "Sign in to your account first.",
+  step_up: "Confirm it's you with your second factor to continue.",
+  reauthenticate: "Sign in again to make this change.",
+} as const;
+
 /**
  * A password sign-in refused on this device: it did not verify (RFC 9807
  * §6.4). It reads as the server's own refusal of a sign-in, so the text does
@@ -259,6 +270,14 @@ export function refusalMessage(
   const refusal = rpcRefusal(err);
   if (refusal) {
     if (refusal.localized) return refusal.localized;
+    if (refusal.reasonCode === ErrorReason.MFA_REQUIRED) {
+      const asked = refusal.metadata["continuation"];
+      if (asked && Object.hasOwn(MFA_CONTINUATION_TEXTS, asked)) {
+        return MFA_CONTINUATION_TEXTS[
+          asked as keyof typeof MFA_CONTINUATION_TEXTS
+        ];
+      }
+    }
     if (
       refusal.reasonCode !== null &&
       refusal.reasonCode !== ErrorReason.ERROR_REASON_UNSPECIFIED