@tinycloud/operations 0.7.0-beta.32 → 0.7.0-beta.34

package/dist/index.js

@@ -5860,10 +5860,37 @@ var init_rules_generated = __esm({
   }
 });
 
+// src/revoked-grant.ts
+import { authorizationVerdictOf } from "@tinycloud/sdk-services";
+function isRevokedGrantRefusal(error) {
+  if (authorizationVerdictOf(error) !== "unauthenticated") return false;
+  const seen = /* @__PURE__ */ new Set();
+  let node = error;
+  for (let depth = 0; depth < MAX_CAUSE_DEPTH && typeof node === "object" && node !== null && !seen.has(node); depth += 1) {
+    seen.add(node);
+    const { code, message, cause } = node;
+    if (REVOKED_GRANT_CODES.has(code)) return true;
+    if (typeof message === "string" && REVOKED_GRANT_BODY.test(message)) return true;
+    node = cause;
+  }
+  return false;
+}
+var MAX_CAUSE_DEPTH, REVOKED_GRANT_BODY, REVOKED_GRANT_CODES, REVOKED_GRANT_MESSAGE;
+var init_revoked_grant = __esm({
+  "src/revoked-grant.ts"() {
+    "use strict";
+    init_cli_name();
+    MAX_CAUSE_DEPTH = 8;
+    REVOKED_GRANT_BODY = /\b401 - (?:Invalid invocation: )?delegation-(?:revoked: [A-Za-z0-9]+|ancestor-revoked: ancestor=[A-Za-z0-9]+ invoked=[A-Za-z0-9]+)\s*$/;
+    REVOKED_GRANT_CODES = /* @__PURE__ */ new Set(["AUTH_DELEGATION_REVOKED", "AUTH_DELEGATION_ANCESTOR_REVOKED"]);
+    REVOKED_GRANT_MESSAGE = `This grant was revoked. Ask the owner for a new grant (\`${CLI_NAME} auth request ...\`).`;
+  }
+});
+
 // src/kv-failure.ts
-import { authorizationVerdictOf, validatedCapabilityOf } from "@tinycloud/sdk-services";
+import { authorizationVerdictOf as authorizationVerdictOf2, validatedCapabilityOf } from "@tinycloud/sdk-services";
 function kvRefusal(error) {
-  const verdict = authorizationVerdictOf(error);
+  const verdict = authorizationVerdictOf2(error);
   if (verdict === "unauthenticated") {
     return validatedCapabilityOf(error) === void 0 ? "auth_required" : "permission_denied";
   }
@@ -5872,6 +5899,9 @@ function kvRefusal(error) {
 function authorizationFailure(error, action) {
   switch (kvRefusal(error)) {
     case "auth_required":
+      if (isRevokedGrantRefusal(error)) {
+        return { status: "error", error: operationError("AUTH_REQUIRED", REVOKED_GRANT_MESSAGE) };
+      }
       return { status: "error", error: operationError("AUTH_REQUIRED", `Authentication is required to ${action}.`) };
     case "permission_denied":
       return { status: "error", error: operationError("PERMISSION_DENIED", `Permission is denied to ${action}.`) };
@@ -5883,6 +5913,7 @@ var init_kv_failure = __esm({
   "src/kv-failure.ts"() {
     "use strict";
     init_errors2();
+    init_revoked_grant();
   }
 });