@truenas/api-client 10.0.0 → 11.0.0

package/dist/{chunk-Z5U5ZRKJ.js → chunk-ZH75OPDH.js}

@@ -2200,6 +2200,7 @@ var TrueNasAuthMechanism = /* @__PURE__ */ ((TrueNasAuthMechanism2) => {
 var AuthErrorCode = /* @__PURE__ */ ((AuthErrorCode2) => {
   AuthErrorCode2["PasswordAuthFailed"] = "PASSWORD_AUTH_FAILED";
   AuthErrorCode2["OtpAuthFailed"] = "OTP_AUTH_FAILED";
+  AuthErrorCode2["OtpLoginNotPending"] = "OTP_LOGIN_NOT_PENDING";
   AuthErrorCode2["ApiKeyAuthFailed"] = "API_KEY_AUTH_FAILED";
   AuthErrorCode2["TokenAuthFailed"] = "TOKEN_AUTH_FAILED";
   AuthErrorCode2["LoginSuperseded"] = "LOGIN_SUPERSEDED";
@@ -2213,11 +2214,12 @@ var AuthError = class _AuthError extends Error {
    * `AUTH_ERR`; the code alone says only which mechanism failed. Absent when the login
    * never got an answer of that kind (an error frame, or a superseded login).
    */
-  constructor(code, message, response) {
+  constructor(code, message, response, options = {}) {
     super(message);
     this.code = code;
     this.response = response;
     this.name = "AuthError";
+    this.loginPending = options.loginPending ?? false;
     Object.setPrototypeOf(this, _AuthError.prototype);
   }
 };
@@ -2758,6 +2760,7 @@ var throwOnAuthenticationFailure = (code, message) => switchMap((response) => {
   }
   return of(response);
 });
+var isOtpLoginNotPending = (error) => error.data?.errname === "EINVAL" && typeof error.data.reason === "string" && error.data.reason.includes("OTP_TOKEN: no authentication in progress");
 var TrueNasAuthenticator = class _TrueNasAuthenticator {
   constructor(connection, version) {
     this.connection = connection;
@@ -2941,6 +2944,19 @@ var TrueNasAuthenticator = class _TrueNasAuthenticator {
       take(1)
     );
   }
+  /**
+   * The second step of a two-factor login, after `loginWithUserPass` answered
+   * `OTP_REQUIRED`.
+   *
+   * Emits the answer when the code is accepted (`SUCCESS`), or when middleware
+   * refuses the account outright (`EXPIRED`, `DENIED`, `REDIRECT`); never
+   * `OTP_REQUIRED`. A refused code errors with `AuthError`, the same way on
+   * every release:
+   *
+   * - `OtpAuthFailed` with `loginPending: true`: ask for another code.
+   * - `OtpAuthFailed` with `loginPending: false`: start over with the password.
+   * - `OtpLoginNotPending`: no login was waiting for a code; start over.
+   */
   loginWithOtp(code) {
     const { sentDuring, callerInitiated } = this.beginLogin();
     let answered = false;
@@ -2960,6 +2976,12 @@ var TrueNasAuthenticator = class _TrueNasAuthenticator {
       }),
       map((msg) => {
         if (msg.error) {
+          if (isOtpLoginNotPending(msg.error)) {
+            throw new AuthError(
+              "OTP_LOGIN_NOT_PENDING" /* OtpLoginNotPending */,
+              "TrueNAS is no longer waiting for a one-time passcode for this login. Please sign in with your password again."
+            );
+          }
           const errorMessage = getApiErrorMessage(
             msg.error,
             "Authentication failed"
@@ -2968,6 +2990,23 @@ var TrueNasAuthenticator = class _TrueNasAuthenticator {
         }
         return msg.result;
       }),
+      // A wrong code is answered differently by release, and the API version
+      // does not say which: 25.10 answers `OTP_REQUIRED` and keeps the login
+      // for another code, 27+ answers `AUTH_ERR` and drops it. Both are the
+      // same failure to the caller, told apart only by `loginPending`, so no
+      // caller has to read `OTP_REQUIRED` as "wrong code".
+      map((res) => {
+        const loginPending = res?.response_type === "OTP_REQUIRED" /* OtpRequired */;
+        if (loginPending || res?.response_type === "AUTH_ERR" /* AuthErr */) {
+          throw new AuthError(
+            "OTP_AUTH_FAILED" /* OtpAuthFailed */,
+            loginPending ? "TrueNAS rejected the one-time passcode. Please verify it and try again." : "TrueNAS rejected the one-time passcode. Please sign in with your password again.",
+            res,
+            { loginPending }
+          );
+        }
+        return res;
+      }),
       tap((res) => {
         if (res?.response_type === "SUCCESS" /* Success */) {
           this.assertNotSuperseded(sentDuring);
@@ -2975,10 +3014,6 @@ var TrueNasAuthenticator = class _TrueNasAuthenticator {
           this.authenticated$.next(true);
         }
       }),
-      throwOnAuthenticationFailure(
-        "OTP_AUTH_FAILED" /* OtpAuthFailed */,
-        "TrueNAS authentication failed. Please verify your one-time passcode and try again."
-      ),
       finalize(() => {
         this.endLogin(sentDuring, callerInitiated, answered);
       }),
@@ -4800,5 +4835,5 @@ var UserRole = /* @__PURE__ */ ((UserRole2) => {
 })(UserRole || {});
 
 export { AppState, AuthError, AuthErrorCode, AuthResponseType, InvalidVersionResponseError, JobState, NoCompatibleVersionsError, SUPPORTED_API_VERSIONS, TrueNasApiClient, TrueNasApiClientV2510, TrueNasApiClientV27, TrueNasApiClientV28, TrueNasApiError, TrueNasAuthMechanism, TrueNasAuthenticator, TrueNasConnection, UserRole, VersionCompatibility, VersionDiscovery, VersionDiscoveryError, VersionDiscoveryNetworkError, VersionDiscoveryTimeoutError, VersionEndpointNotFoundError, VersionTooNewError, VersionTooOldError, clientClassFor, consoleLogger, createTrueNasClient, getApiErrorMessage, getCloseMessage, isJobFinished, noopLogger, parseApiVersion, policyViolationCloseCode, subscriptionName, v25_10_0_exports, v25_10_1_exports, v25_10_2_exports, v25_10_3_exports, v25_10_4_exports, v25_10_5_exports, v27_0_0_exports, v28_0_0_exports };
-//# sourceMappingURL=chunk-Z5U5ZRKJ.js.map
-//# sourceMappingURL=chunk-Z5U5ZRKJ.js.map
+//# sourceMappingURL=chunk-ZH75OPDH.js.map
+//# sourceMappingURL=chunk-ZH75OPDH.js.map