| | | 1 | | using ArturRios.Util.Http; |
| | | 2 | | |
| | | 3 | | namespace ArturRios.Heimdall.Shared.Messages; |
| | | 4 | | |
| | | 5 | | /// <summary> |
| | | 6 | | /// Maps each <see cref="AuthMessages" /> value to its HTTP status code, following the UC-11, |
| | | 7 | | /// UC-12, UC-13, UC-14, UC-15, UC-25, and UC-26 flows. Passed to the response resolver. |
| | | 8 | | /// </summary> |
| | | 9 | | public static class AuthMessageMap |
| | | 10 | | { |
| | 4 | 11 | | public static readonly IReadOnlyDictionary<string, int> StatusCodes = |
| | 4 | 12 | | DataAccessMessageMap.CombinedWith(new Dictionary<string, int> |
| | 4 | 13 | | { |
| | 4 | 14 | | // UC-11 main flow — authenticated, token issued. |
| | 4 | 15 | | [AuthMessages.LoginSuccessful] = HttpStatusCodes.Ok, |
| | 4 | 16 | | // AF-11g — password check passed, a UC-38 challenge token was issued instead. |
| | 4 | 17 | | [AuthMessages.TwoFactorRequired] = HttpStatusCodes.Ok, |
| | 4 | 18 | | // UC-11 and UC-25 for a restricted identity (NFR-24) — a subject-rights-only token. |
| | 4 | 19 | | [AuthMessages.SubjectRightsOnlySignIn] = HttpStatusCodes.Ok, |
| | 4 | 20 | | // AF-11a…AF-11e — every rejection answers alike, so none of them is distinguishable. |
| | 4 | 21 | | [AuthMessages.InvalidCredentials] = HttpStatusCodes.Unauthorized, |
| | 4 | 22 | | // AF-11f — malformed request. UC-12's validator reuses the two email messages. |
| | 4 | 23 | | [AuthMessages.EmailRequired] = HttpStatusCodes.BadRequest, |
| | 4 | 24 | | [AuthMessages.EmailInvalid] = HttpStatusCodes.BadRequest, |
| | 4 | 25 | | [AuthMessages.PasswordRequired] = HttpStatusCodes.BadRequest, |
| | 4 | 26 | | // UC-12 main flow and AF-12a — both answer 200 with the same message. |
| | 4 | 27 | | [AuthMessages.PasswordRecoveryRequested] = HttpStatusCodes.Ok, |
| | 4 | 28 | | // UC-13 main flow — the password was changed. |
| | 4 | 29 | | [AuthMessages.PasswordResetSuccessful] = HttpStatusCodes.Ok, |
| | 4 | 30 | | // UC-14 main flow — the address was confirmed. |
| | 4 | 31 | | [AuthMessages.EmailVerifiedSuccessfully] = HttpStatusCodes.Ok, |
| | 4 | 32 | | // UC-15 main flow — a fresh verification link was issued and mailed. |
| | 4 | 33 | | [AuthMessages.VerificationEmailSent] = HttpStatusCodes.Ok, |
| | 4 | 34 | | // AF-15a — the address is already verified, so no link is worth sending. |
| | 4 | 35 | | [AuthMessages.EmailAlreadyVerified] = HttpStatusCodes.BadRequest, |
| | 4 | 36 | | // AF-15b, AF-15c — the person's account-email budget refused the send (FR-PE-16): the |
| | 4 | 37 | | // cooldown, or the day's limit. The status UC-51's AF-51e answers with. |
| | 4 | 38 | | [AuthMessages.EmailSentRecently] = HttpStatusCodes.TooManyRequests, |
| | 4 | 39 | | [AuthMessages.AccountEmailLimitReached] = HttpStatusCodes.TooManyRequests, |
| | 4 | 40 | | // UC-15 — the caller's own token names a person who no longer exists (ClaimsOnly outlives a |
| | 4 | 41 | | // hard deletion). The same answer UC-07 AF-07a gives for the same fact. |
| | 4 | 42 | | [AuthMessages.PersonNotFound] = HttpStatusCodes.NotFound, |
| | 4 | 43 | | // AF-13a…AF-13c, and AF-14a…AF-14c — each token rejection is named, and all of them are bad |
| | 4 | 44 | | // requests. The two use cases specify the same three messages, so they share these entries. |
| | 4 | 45 | | [AuthMessages.TokenInvalid] = HttpStatusCodes.BadRequest, |
| | 4 | 46 | | [AuthMessages.TokenExpired] = HttpStatusCodes.BadRequest, |
| | 4 | 47 | | [AuthMessages.TokenAlreadyUsed] = HttpStatusCodes.BadRequest, |
| | 4 | 48 | | // AF-13d, and UC-14's input validation — malformed request. The password messages are shared |
| | 4 | 49 | | // with AF-11f. |
| | 4 | 50 | | [AuthMessages.TokenRequired] = HttpStatusCodes.BadRequest, |
| | 4 | 51 | | [AuthMessages.PasswordTooShort] = HttpStatusCodes.BadRequest, |
| | 4 | 52 | | // UC-25 main flow — the Google account was signed up or signed in and a token issued. |
| | 4 | 53 | | [AuthMessages.GoogleSignInSuccessful] = HttpStatusCodes.Ok, |
| | 4 | 54 | | // AF-25a and AF-25d — an unverifiable token and a deleted Google User answer alike, as |
| | 4 | 55 | | // UC-11's rejections do. Shared with UC-26 AF-26a, whose refusals are the same fact. |
| | 4 | 56 | | [AuthMessages.GoogleAuthenticationFailed] = HttpStatusCodes.Unauthorized, |
| | 4 | 57 | | // UC-26 main flow — the Google session ended and the client should drop the token. |
| | 4 | 58 | | [AuthMessages.GoogleSignOutSuccessful] = HttpStatusCodes.Ok, |
| | 4 | 59 | | // AF-25b — the scope is missing, deleted, or has the setting off. 403 rather than 404: the |
| | 4 | 60 | | // use case refuses the operation without saying which of the three is the reason. |
| | 4 | 61 | | [AuthMessages.GoogleSignInUnavailable] = HttpStatusCodes.Forbidden, |
| | 4 | 62 | | // AF-25f — a sign-up whose address Google does not vouch for. 403, as AF-25b: the caller |
| | 4 | 63 | | // is who the token says, and is refused the operation. |
| | 4 | 64 | | [AuthMessages.GoogleEmailNotVerified] = HttpStatusCodes.Forbidden, |
| | 4 | 65 | | // AF-25c — the verified address is already taken within the scope. |
| | 4 | 66 | | [AuthMessages.EmailAlreadyExists] = HttpStatusCodes.Conflict, |
| | 4 | 67 | | // UC-47 main flow and AF-47b — queued, answered alike for every address. |
| | 4 | 68 | | [AuthMessages.RegistrationRequested] = HttpStatusCodes.Accepted, |
| | 4 | 69 | | // AF-47a — closed, missing and deleted scopes alike; says nothing about any address. |
| | 4 | 70 | | [AuthMessages.RegistrationUnavailable] = HttpStatusCodes.Forbidden, |
| | 4 | 71 | | // UC-47 confirmation — the link is followed without the sign-up password; nothing was consumed. |
| | 4 | 72 | | [AuthMessages.ConfirmationPasswordRequired] = HttpStatusCodes.UnprocessableEntity, |
| | 4 | 73 | | // UC-47 confirmation — the password is not the one chosen at sign-up; nothing was consumed. |
| | 4 | 74 | | [AuthMessages.ConfirmationPasswordIncorrect] = HttpStatusCodes.Unauthorized, |
| | 4 | 75 | | // AF-47c — malformed request. Email and password messages share their text with the |
| | 4 | 76 | | // AF-11f entries above; the name messages are UC-47's own. |
| | 4 | 77 | | [AuthMessages.ScopeRequired] = HttpStatusCodes.BadRequest, |
| | 4 | 78 | | [PersonMessages.NameRequired] = HttpStatusCodes.BadRequest, |
| | 4 | 79 | | [PersonMessages.NameTooLong] = HttpStatusCodes.BadRequest, |
| | 4 | 80 | | [PersonMessages.EmailRequired] = HttpStatusCodes.BadRequest, |
| | 4 | 81 | | [PersonMessages.EmailInvalid] = HttpStatusCodes.BadRequest, |
| | 4 | 82 | | [PersonMessages.EmailTooLong] = HttpStatusCodes.BadRequest, |
| | 4 | 83 | | [PersonMessages.PasswordRequired] = HttpStatusCodes.BadRequest, |
| | 4 | 84 | | [PersonMessages.PasswordTooShort] = HttpStatusCodes.BadRequest |
| | 4 | 85 | | }); |
| | | 86 | | } |