| 374 | } |
| 375 | |
| 376 | export class OAuthStartError |
| 377 | extends Schema.TaggedErrorClass<OAuthStartError>()("OAuthStartError", { |
| 378 | message: Schema.String, |
| 379 | /** True when an enterprise identity provider declined to authorize this |
| 380 | * connection under administrator policy. A console MUST branch on this |
| 381 | * rather than on the message: blocked-by-admin means the interactive |
| 382 | * per-server flow must NOT be offered as an alternative route, because |
| 383 | * taking it would walk the user around the policy the IdP just enforced. |
| 384 | * Every other start failure leaves that route open. */ |
| 385 | blockedByAdmin: Schema.optional(Schema.Boolean), |
| 386 | /** The authorization server's RFC 6749 §5.2 error code (`invalid_target`, |
| 387 | * `unauthorized_client`, `invalid_grant`, …), when the failure came from a |
| 388 | * token-endpoint refusal. A typed field rather than message text so |
| 389 | * telemetry and support tooling read the verdict structurally. */ |
| 390 | oauthErrorCode: Schema.optional(Schema.String), |
| 391 | }) |
| 392 | implements UserActionableError |
| 393 | { |
| 394 | readonly __executorUserActionable = true; |
| 395 | readonly code = "oauth_start_error"; |
| 396 | |
| 397 | get userMessage(): string { |
| 398 | return this.message; |
| 399 | } |
| 400 | } |
| 401 | |
| 402 | export class OAuthCompleteError |
| 403 | extends Schema.TaggedErrorClass<OAuthCompleteError>()("OAuthCompleteError", { |
nothing calls this directly
no outgoing calls
no test coverage detected