| 429 | } |
| 430 | |
| 431 | export class OAuthStartError |
| 432 | extends Schema.TaggedErrorClass<OAuthStartError>()("OAuthStartError", { |
| 433 | message: Schema.String, |
| 434 | /** True when an enterprise identity provider declined to authorize this |
| 435 | * connection under administrator policy. A console MUST branch on this |
| 436 | * rather than on the message: blocked-by-admin means the interactive |
| 437 | * per-server flow must NOT be offered as an alternative route, because |
| 438 | * taking it would walk the user around the policy the IdP just enforced. |
| 439 | * Every other start failure leaves that route open. */ |
| 440 | blockedByAdmin: Schema.optional(Schema.Boolean), |
| 441 | /** The authorization server's RFC 6749 §5.2 error code (`invalid_target`, |
| 442 | * `unauthorized_client`, `invalid_grant`, …), when the failure came from a |
| 443 | * token-endpoint refusal. A typed field rather than message text so |
| 444 | * telemetry and support tooling read the verdict structurally. */ |
| 445 | oauthErrorCode: Schema.optional(Schema.String), |
| 446 | }) |
| 447 | implements UserActionableError |
| 448 | { |
| 449 | readonly __executorUserActionable = true; |
| 450 | readonly code = "oauth_start_error"; |
| 451 | |
| 452 | get userMessage(): string { |
| 453 | return this.message; |
| 454 | } |
| 455 | } |
| 456 | |
| 457 | export class OAuthCompleteError |
| 458 | extends Schema.TaggedErrorClass<OAuthCompleteError>()("OAuthCompleteError", { |
nothing calls this directly
no outgoing calls
no test coverage detected