raystack / frontier / 33381454770

50%

main: 49%

Build Type

Pull #1915

github

Committed by rohanchkrabrty

Commit Message

feat(authenticate): map the gate and consent errors on both auth RPCs

The two request fields reach StartFlow, and the three rejections become
legible to a client instead of arriving as a 500.

Authenticate calls sessionutils.ExtractSessionMetadata itself for the IP.
Authenticate and AuthCallback are both on the authentication skip list, so
nothing puts session metadata on the context. That helper parses the user
agent into an OS and a browser family and drops the raw string, so what
reaches the consent record is the IP and nothing else, from when the user
accepted rather than from the callback.

ErrLoginUserNotFound maps to NotFound, ErrSignupUserExists to AlreadyExists
and ErrConsentRequired to FailedPrecondition, from both RPCs. All three had
to join the errors AuthCallback handles explicitly, which maps a fixed list
to a 4xx and everything else to Internal; they keep their own codes rather
than the InvalidArgument the rest of that list gets, because
FailedPrecondition is what lets a client separate a consent rejection from
a bad code or an expired flow.

Both RPCs answer with a code rather than a redirect. Frontier serves no
route for the callback URL: it points at a page the application hosts, and
that page is what calls AuthCallback over connect, so it already holds the
rejection and decides where the user goes next. Handing it a location
header instead would oblige every such page to be written to read one, and
a 2xx carrying that header reads as success to one that is not. The three
codes are distinct, so a client tells the rejections apart without a second
vocabulary alongside them.

StartFlow gains the consent half of the flow start gate, so a rejection
lands before an OTP is sent and before the browser leaves for an identity
provider. A signup intent runs ResolveAll there; an unspecified intent runs
Resolve, which still catches an unknown id before the redirect while
completeness waits for user creation; a login intent checks nothing,
becau... (continued)

Pull Request Pull Request #1915: feat(authenticate): map the gate and consent errors on both auth RPCs

Coverage Stats

85 of 89 new or added lines in 2 files covered. (95.51%)

153 existing lines in 2 files now uncovered.

20595 of 41079 relevant lines covered (50.14%)

15.97 hits per line