@tutti-os/auth-bridge 0.0.205 → 0.0.207

package/README.md

@@ -38,6 +38,7 @@ The Node bridge starts a loopback HTTP server for desktop sign-in. New desktop O
 
 - `GET /oauth/callback?state=<base64url>&transfer_code=<code>`
 - `GET /oauth/callback?state=<base64url>&error=<providerError>`
+- `GET /oauth/callback?state=<base64url>&error=user_cancelled`
 
 The callback validates the signed login state, redeems the desktop transfer code through the account service, writes `auth.json`, fetches user info, and redirects the browser back to the web result page:
 
@@ -48,4 +49,10 @@ The callback validates the signed login state, redeems the desktop transfer code
 
 `openAppUrl` is only used to focus or reopen Tutti. It is sanitized to the allowed app schemes and must not carry `transfer_code`, sessions, or tokens.
 
+An explicit `user_cancelled` callback is preserved as a typed cancellation for
+Node/Go consumers and returns the safe Web result code `userCancelled`.
+Cancellation results intentionally omit `openAppUrl`, so the Web result page
+can keep the user in the browser. Other callback errors continue to use the
+safe `providerError` result code.
+
 `/oauth/health` and `POST /oauth/complete` remain available for compatibility with older web clients, but the current web flow redirects the browser to `/oauth/callback` instead of fetching the local bridge.

package/dist/browser.js

@@ -5,7 +5,7 @@ import {
   buildAccountUrl,
   mapUserInfo,
   readEnvelopeError
-} from "./chunk-M2P3SN64.js";
+} from "./chunk-HC77YJ7C.js";
 
 // src/browser.ts
 function defaultOpenUrl(url) {

package/dist/{chunk-M2P3SN64.js → chunk-HC77YJ7C.js}

@@ -1,3 +1,7 @@
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+
 // src/shared.ts
 var DEFAULT_APP_ID = "nextop";
 var DEFAULT_ACCOUNT_BASE_URL = "https://tutti.sh/api/account";
@@ -41,6 +45,7 @@ function mapUserInfo(data) {
 }
 
 export {
+  __publicField,
   DEFAULT_APP_ID,
   DEFAULT_ACCOUNT_BASE_URL,
   DEFAULT_AUTH_LOGIN_URL,

package/dist/node.d.ts

@@ -1,5 +1,12 @@
 import { T as TuttiAuthSession, a as TuttiUserInfo } from './shared-CPA5wTKA.js';
 
+type TuttiAuthErrorCode = "user_cancelled";
+declare class TuttiAuthError extends Error {
+    readonly code: TuttiAuthErrorCode;
+    constructor(code: TuttiAuthErrorCode, message?: "user_cancelled");
+}
+declare function isTuttiAuthUserCancelledError(error: unknown): error is TuttiAuthError;
+
 interface TuttiNodeAuthClientOptions {
     authJsonPath: string;
     appCallbackUrl: string;
@@ -29,4 +36,4 @@ declare function createTuttiNodeAuthClient(options: TuttiNodeAuthClientOptions):
 declare function readAuthJson(authJsonPath: string): Promise<TuttiAuthSession | null>;
 declare function writeAuthJson(authJsonPath: string, session: TuttiAuthSession): Promise<void>;
 
-export { TuttiAuthSession, type TuttiNodeAuthClient, type TuttiNodeAuthClientOptions, TuttiUserInfo, createTuttiNodeAuthClient, readAuthJson, writeAuthJson };
+export { TuttiAuthError, type TuttiAuthErrorCode, TuttiAuthSession, type TuttiNodeAuthClient, type TuttiNodeAuthClientOptions, TuttiUserInfo, createTuttiNodeAuthClient, isTuttiAuthUserCancelledError, readAuthJson, writeAuthJson };

package/dist/node.js

@@ -7,12 +7,13 @@ import {
   DEFAULT_AUTH_LOGIN_URL,
   DEFAULT_LOGIN_IDLE_TIMEOUT_MS,
   DEFAULT_LOGIN_MAX_TIMEOUT_MS,
+  __publicField,
   buildAccountUrl,
   buildSessionCookie,
   mapUserInfo,
   readEnvelopeError,
   trimString
-} from "./chunk-M2P3SN64.js";
+} from "./chunk-HC77YJ7C.js";
 
 // src/node.ts
 import { spawn } from "child_process";
@@ -24,6 +25,63 @@ import {
 import { createServer as createNetServer } from "net";
 import { hostname } from "os";
 import { dirname } from "path";
+
+// src/node-login-result.ts
+var USER_CANCELLED_CALLBACK_ERROR = "user_cancelled";
+var USER_CANCELLED_RESULT_ERROR = "userCancelled";
+var TuttiAuthError = class extends Error {
+  constructor(code, message = code) {
+    super(message);
+    __publicField(this, "code");
+    this.name = "TuttiAuthError";
+    this.code = code;
+  }
+};
+function isTuttiAuthUserCancelledError(error) {
+  return error instanceof TuttiAuthError && error.code === USER_CANCELLED_CALLBACK_ERROR;
+}
+function callbackErrorToError(callbackError) {
+  return callbackError === USER_CANCELLED_CALLBACK_ERROR ? new TuttiAuthError(USER_CANCELLED_CALLBACK_ERROR) : new Error(callbackError);
+}
+function callbackErrorToSafeResultCode(callbackError) {
+  return callbackError === USER_CANCELLED_CALLBACK_ERROR ? USER_CANCELLED_RESULT_ERROR : "providerError";
+}
+function buildBridgeResultUrl(input, status, safeErrorCode) {
+  const url = new URL("/auth/login/callback", input.authOrigin);
+  url.searchParams.set("desktopBridgeStatus", status);
+  if (safeErrorCode) {
+    url.searchParams.set("desktopBridgeError", safeErrorCode);
+  }
+  const openAppUrl = safeErrorCode === USER_CANCELLED_RESULT_ERROR ? null : buildSafeOpenAppUrl(input.appCallbackUrl, status, safeErrorCode);
+  if (openAppUrl) {
+    url.searchParams.set("openAppUrl", openAppUrl);
+  }
+  return url.toString();
+}
+function buildSafeOpenAppUrl(rawUrl, status, safeErrorCode) {
+  try {
+    const url = new URL(rawUrl.trim());
+    if (!isAllowedAppCallbackProtocol(url.protocol)) {
+      return null;
+    }
+    url.search = "";
+    url.hash = "";
+    url.searchParams.set("desktopBridgeStatus", status);
+    if (safeErrorCode) {
+      url.searchParams.set("desktopBridgeError", safeErrorCode);
+    }
+    return url.toString();
+  } catch {
+    return null;
+  }
+}
+function isAllowedAppCallbackProtocol(protocol) {
+  const legacyProtocol = `${DEFAULT_APP_ID}:`;
+  const legacyDevProtocol = `${DEFAULT_APP_ID}-dev:`;
+  return protocol === "tutti:" || protocol === "tutti-dev:" || protocol === legacyProtocol || protocol === legacyDevProtocol;
+}
+
+// src/node.ts
 var BRIDGE_SERVER_FORCE_CLOSE_TIMEOUT_MS = 1e3;
 function createTuttiNodeAuthClient(options) {
   const authJsonPath = options.authJsonPath.trim();
@@ -279,11 +337,15 @@ async function createLoginBridgeServer(input, port) {
         return;
       }
       if (callbackError) {
-        const error = new Error(callbackError);
+        const error = callbackErrorToError(callbackError);
         complete(() => rejectCompletion(error));
         sendRedirect(
           res,
-          buildBridgeResultUrl(input, "error", "providerError")
+          buildBridgeResultUrl(
+            input,
+            "error",
+            callbackErrorToSafeResultCode(callbackError)
+          )
         );
         return;
       }
@@ -332,10 +394,13 @@ async function createLoginBridgeServer(input, port) {
         return;
       }
       if (callbackError) {
-        const error = new Error(callbackError);
+        const error = callbackErrorToError(callbackError);
         sendJson(res, 400, {
           ok: false,
-          error: { code: "PROVIDER_CALLBACK_ERROR", message: error.message }
+          error: {
+            code: isTuttiAuthUserCancelledError(error) ? "USER_CANCELLED" : "PROVIDER_CALLBACK_ERROR",
+            message: error.message
+          }
         });
         complete(() => rejectCompletion(error));
         return;
@@ -534,44 +599,6 @@ function sendRedirect(res, location) {
   res.writeHead(302, { Location: location, Connection: "close" });
   res.end();
 }
-function buildBridgeResultUrl(input, status, safeErrorCode) {
-  const url = new URL("/auth/login/callback", input.authOrigin);
-  url.searchParams.set("desktopBridgeStatus", status);
-  if (safeErrorCode) {
-    url.searchParams.set("desktopBridgeError", safeErrorCode);
-  }
-  const openAppUrl = buildSafeOpenAppUrl(
-    input.appCallbackUrl,
-    status,
-    safeErrorCode
-  );
-  if (openAppUrl) {
-    url.searchParams.set("openAppUrl", openAppUrl);
-  }
-  return url.toString();
-}
-function buildSafeOpenAppUrl(rawUrl, status, safeErrorCode) {
-  try {
-    const url = new URL(rawUrl.trim());
-    if (!isAllowedAppCallbackProtocol(url.protocol)) {
-      return null;
-    }
-    url.search = "";
-    url.hash = "";
-    url.searchParams.set("desktopBridgeStatus", status);
-    if (safeErrorCode) {
-      url.searchParams.set("desktopBridgeError", safeErrorCode);
-    }
-    return url.toString();
-  } catch {
-    return null;
-  }
-}
-function isAllowedAppCallbackProtocol(protocol) {
-  const legacyProtocol = `${DEFAULT_APP_ID}:`;
-  const legacyDevProtocol = `${DEFAULT_APP_ID}-dev:`;
-  return protocol === "tutti:" || protocol === "tutti-dev:" || protocol === legacyProtocol || protocol === legacyDevProtocol;
-}
 function closeServer(server) {
   return new Promise((resolve) => {
     const forceCloseTimer = setTimeout(() => {
@@ -602,7 +629,9 @@ function openUrlWithDefaultBrowser(url) {
   });
 }
 export {
+  TuttiAuthError,
   createTuttiNodeAuthClient,
+  isTuttiAuthUserCancelledError,
   readAuthJson,
   writeAuthJson
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tutti-os/auth-bridge",
-  "version": "0.0.205",
+  "version": "0.0.207",
   "private": false,
   "repository": {
     "type": "git",