| 436 | } |
| 437 | |
| 438 | export class OAuthStartError |
| 439 | extends Schema.TaggedErrorClass<OAuthStartError>()("OAuthStartError", { |
| 440 | message: Schema.String, |
| 441 | /** True when an enterprise identity provider declined to authorize this |
| 442 | * connection under administrator policy. A console MUST branch on this |
| 443 | * rather than on the message: blocked-by-admin means the interactive |
| 444 | * per-server flow must NOT be offered as an alternative route, because |
| 445 | * taking it would walk the user around the policy the IdP just enforced. |
| 446 | * Every other start failure leaves that route open. */ |
| 447 | blockedByAdmin: Schema.optional(Schema.Boolean), |
| 448 | /** The authorization server's RFC 6749 §5.2 error code (`invalid_target`, |
| 449 | * `unauthorized_client`, `invalid_grant`, …), when the failure came from a |
| 450 | * token-endpoint refusal. A typed field rather than message text so |
| 451 | * telemetry and support tooling read the verdict structurally. */ |
| 452 | oauthErrorCode: Schema.optional(Schema.String), |
| 453 | }) |
| 454 | implements UserActionableError |
| 455 | { |
| 456 | readonly __executorUserActionable = true; |
| 457 | readonly code = "oauth_start_error"; |
| 458 | |
| 459 | get userMessage(): string { |
| 460 | return this.message; |
| 461 | } |
| 462 | } |
| 463 | |
| 464 | export class OAuthCompleteError |
| 465 | extends Schema.TaggedErrorClass<OAuthCompleteError>()("OAuthCompleteError", { |
nothing calls this directly
no outgoing calls
no test coverage detected