mirror of
https://github.com/zitadel/zitadel.git
synced 2026-11-02 20:30:51 -06:00
Florian Forster
c5f272bb30
Second pass of the business-error-vs-500 cleanup: extend the
catchUserError pattern (user errors resolve to the `{ error }` shape the
forms render; genuine server faults keep throwing) to the flows the first
pass deferred.
- u2f: addU2F/verifyU2F no longer crash the action POST when the session
is gone or the WebAuthn attestation is rejected (InvalidArgument); all
error strings are translated now.
- passkeys: verifyPasskeyRegistration adopts the `{ error }` convention
(it previously only threw), registerPasskeyLink guards every service
call and stops contradicting its own return type with raw throws, and
sendPasskey no longer fails a completed passkey login because the
post-login settings lookup failed. The register-passkey component now
checks the verify response for an error instead of treating it as
success.
- device authorization: an expired or already-used device code returns a
translated error instead of a 500; the signedin page's dead error JSX
(returned from a discarded .catch) is now actually rendered, the
consent screen handles the new shape, and the consent page treats an
unknown user-supplied user_code as the existing no-device-request state
instead of crashing SSR.
- LDAP/IDP: wrong LDAP credentials — previously a 500 on every failed
LDAP login — return a check-your-credentials error;
redirectToIdp/startIDPFlow and createNewSessionFromIdpIntent guard
removed/misconfigured IDPs and expired intents, with messages
translated.
- password: resetPassword no longer leaks throws from users in
non-resettable states; sendPassword guards its post-auth user and
auth-method reads; the two getLockoutSettings calls inside catch
handlers can no longer escape the handler; and the bare catch that
swallowed *all* setSession errors now rethrows genuine server faults
instead of hiding outages behind a silent session-recreate retry.
- enrollment-guard: the authorization gate fails closed (never open) when
the user's auth methods cannot be read due to a user error, and keeps
throwing on server faults.
- oidc/saml: the invalid-session re-auth path degrades gracefully when
sendLoginname rejects with a user error.
- idp-intent: internal error messages no longer leak into the
user-visible failure-page URL; only classified user errors carry their
message through.
- Locales: 14 new keys (u2f/passkey.set/device/ldap/idp error messages)
across all 15 locale files, reusing each locale's existing sibling
translations where they exist.
Unit tests cover the new behaviors (attestation/LDAP/device-code user
errors resolve, server faults rethrow, guard fails closed); suite is at
877 tests across 57 files.