@truenas/api-client 10.0.0 → 11.0.0

package/README.md

@@ -84,6 +84,22 @@ errors with an `AuthError` carrying an `AuthErrorCode`, plus the refusing
 `response` when middleware answered with one (`response.response_type` tells
 `EXPIRED`, `DENIED` and `REDIRECT` apart from `AUTH_ERR`).
 
+A wrong one-time code errors from `loginWithOtp(code)`; it never emits
+`OTP_REQUIRED`. Releases differ on whether the login survives a wrong code
+(25.10 keeps it for up to three tries, 27 and later drop it), and the API
+version does not tell them apart, so read `loginPending` off the error instead:
+
+```typescript
+client.authenticator.loginWithOtp(code).subscribe({
+  next: () => { /* signed in */ },
+  error: (err: unknown) => {
+    if (!(err instanceof AuthError)) throw err;
+    if (err.loginPending) askForAnotherCode();  // OtpAuthFailed, login still open
+    else startOverWithPassword();               // OtpAuthFailed or OtpLoginNotPending
+  },
+});
+```
+
 ## Calls
 
 ```typescript

package/dist/{chunk-PWRUBUVD.cjs → chunk-MQAS7GKB.cjs}

@@ -2202,6 +2202,7 @@ var TrueNasAuthMechanism = /* @__PURE__ */ ((TrueNasAuthMechanism2) => {
 var AuthErrorCode = /* @__PURE__ */ ((AuthErrorCode2) => {
   AuthErrorCode2["PasswordAuthFailed"] = "PASSWORD_AUTH_FAILED";
   AuthErrorCode2["OtpAuthFailed"] = "OTP_AUTH_FAILED";
+  AuthErrorCode2["OtpLoginNotPending"] = "OTP_LOGIN_NOT_PENDING";
   AuthErrorCode2["ApiKeyAuthFailed"] = "API_KEY_AUTH_FAILED";
   AuthErrorCode2["TokenAuthFailed"] = "TOKEN_AUTH_FAILED";
   AuthErrorCode2["LoginSuperseded"] = "LOGIN_SUPERSEDED";
@@ -2215,11 +2216,12 @@ var AuthError = class _AuthError extends Error {
    * `AUTH_ERR`; the code alone says only which mechanism failed. Absent when the login
    * never got an answer of that kind (an error frame, or a superseded login).
    */
-  constructor(code, message, response) {
+  constructor(code, message, response, options = {}) {
     super(message);
     this.code = code;
     this.response = response;
     this.name = "AuthError";
+    this.loginPending = options.loginPending ?? false;
     Object.setPrototypeOf(this, _AuthError.prototype);
   }
 };
@@ -2760,6 +2762,7 @@ var throwOnAuthenticationFailure = (code, message) => rxjs.switchMap((response)
   }
   return rxjs.of(response);
 });
+var isOtpLoginNotPending = (error) => error.data?.errname === "EINVAL" && typeof error.data.reason === "string" && error.data.reason.includes("OTP_TOKEN: no authentication in progress");
 var TrueNasAuthenticator = class _TrueNasAuthenticator {
   constructor(connection, version) {
     this.connection = connection;
@@ -2943,6 +2946,19 @@ var TrueNasAuthenticator = class _TrueNasAuthenticator {
       rxjs.take(1)
     );
   }
+  /**
+   * The second step of a two-factor login, after `loginWithUserPass` answered
+   * `OTP_REQUIRED`.
+   *
+   * Emits the answer when the code is accepted (`SUCCESS`), or when middleware
+   * refuses the account outright (`EXPIRED`, `DENIED`, `REDIRECT`); never
+   * `OTP_REQUIRED`. A refused code errors with `AuthError`, the same way on
+   * every release:
+   *
+   * - `OtpAuthFailed` with `loginPending: true`: ask for another code.
+   * - `OtpAuthFailed` with `loginPending: false`: start over with the password.
+   * - `OtpLoginNotPending`: no login was waiting for a code; start over.
+   */
   loginWithOtp(code) {
     const { sentDuring, callerInitiated } = this.beginLogin();
     let answered = false;
@@ -2962,6 +2978,12 @@ var TrueNasAuthenticator = class _TrueNasAuthenticator {
       }),
       rxjs.map((msg) => {
         if (msg.error) {
+          if (isOtpLoginNotPending(msg.error)) {
+            throw new AuthError(
+              "OTP_LOGIN_NOT_PENDING" /* OtpLoginNotPending */,
+              "TrueNAS is no longer waiting for a one-time passcode for this login. Please sign in with your password again."
+            );
+          }
           const errorMessage = getApiErrorMessage(
             msg.error,
             "Authentication failed"
@@ -2970,6 +2992,23 @@ var TrueNasAuthenticator = class _TrueNasAuthenticator {
         }
         return msg.result;
       }),
+      // A wrong code is answered differently by release, and the API version
+      // does not say which: 25.10 answers `OTP_REQUIRED` and keeps the login
+      // for another code, 27+ answers `AUTH_ERR` and drops it. Both are the
+      // same failure to the caller, told apart only by `loginPending`, so no
+      // caller has to read `OTP_REQUIRED` as "wrong code".
+      rxjs.map((res) => {
+        const loginPending = res?.response_type === "OTP_REQUIRED" /* OtpRequired */;
+        if (loginPending || res?.response_type === "AUTH_ERR" /* AuthErr */) {
+          throw new AuthError(
+            "OTP_AUTH_FAILED" /* OtpAuthFailed */,
+            loginPending ? "TrueNAS rejected the one-time passcode. Please verify it and try again." : "TrueNAS rejected the one-time passcode. Please sign in with your password again.",
+            res,
+            { loginPending }
+          );
+        }
+        return res;
+      }),
       rxjs.tap((res) => {
         if (res?.response_type === "SUCCESS" /* Success */) {
           this.assertNotSuperseded(sentDuring);
@@ -2977,10 +3016,6 @@ var TrueNasAuthenticator = class _TrueNasAuthenticator {
           this.authenticated$.next(true);
         }
       }),
-      throwOnAuthenticationFailure(
-        "OTP_AUTH_FAILED" /* OtpAuthFailed */,
-        "TrueNAS authentication failed. Please verify your one-time passcode and try again."
-      ),
       rxjs.finalize(() => {
         this.endLogin(sentDuring, callerInitiated, answered);
       }),
@@ -4844,5 +4879,5 @@ exports.v25_10_4_exports = v25_10_4_exports;
 exports.v25_10_5_exports = v25_10_5_exports;
 exports.v27_0_0_exports = v27_0_0_exports;
 exports.v28_0_0_exports = v28_0_0_exports;
-//# sourceMappingURL=chunk-PWRUBUVD.cjs.map
-//# sourceMappingURL=chunk-PWRUBUVD.cjs.map
+//# sourceMappingURL=chunk-MQAS7GKB.cjs.map
+//# sourceMappingURL=chunk-MQAS7GKB.cjs.map