| 393 | } |
| 394 | |
| 395 | export class OAuthStartError |
| 396 | extends Schema.TaggedErrorClass<OAuthStartError>()("OAuthStartError", { |
| 397 | message: Schema.String, |
| 398 | /** True when an enterprise identity provider declined to authorize this |
| 399 | * connection under administrator policy. A console MUST branch on this |
| 400 | * rather than on the message: blocked-by-admin means the interactive |
| 401 | * per-server flow must NOT be offered as an alternative route, because |
| 402 | * taking it would walk the user around the policy the IdP just enforced. |
| 403 | * Every other start failure leaves that route open. */ |
| 404 | blockedByAdmin: Schema.optional(Schema.Boolean), |
| 405 | /** The authorization server's RFC 6749 §5.2 error code (`invalid_target`, |
| 406 | * `unauthorized_client`, `invalid_grant`, …), when the failure came from a |
| 407 | * token-endpoint refusal. A typed field rather than message text so |
| 408 | * telemetry and support tooling read the verdict structurally. */ |
| 409 | oauthErrorCode: Schema.optional(Schema.String), |
| 410 | }) |
| 411 | implements UserActionableError |
| 412 | { |
| 413 | readonly __executorUserActionable = true; |
| 414 | readonly code = "oauth_start_error"; |
| 415 | |
| 416 | get userMessage(): string { |
| 417 | return this.message; |
| 418 | } |
| 419 | } |
| 420 | |
| 421 | export class OAuthCompleteError |
| 422 | extends Schema.TaggedErrorClass<OAuthCompleteError>()("OAuthCompleteError", { |
nothing calls this directly
no outgoing calls
no test coverage detected