[DT-4012] Handle the full consent /api/user/me contract and B2C authorization-response errors

[rushtong]

Addresses

DT-4012

Security risk: low — sign-in error paths change how a refusal is presented; no change to who is admitted.

Summary

Consent now answers GET /api/user/me with distinct statuses (DT-3997 #3021, DT-4011 #3032): 401 rejected token, 404 authenticated but unregistered, 409 Sam sub-provider conflict with an actionable message. The BFF and client now map that contract instead of the old conflated handling:

• server/src/auth/me.ts: 401 destroys the session (the profileSeen disambiguator is dead machinery and is removed, along with its once-per-session store write); 404 keeps the "authenticated, no user" answer that routes new users into registration; 409 forwards the upstream message as { error: 'provider_conflict', message } after destroying the session — the account lives under the other provider, so the session cannot become usable.
• src/libs/auth/session.ts: the probe treats 409 as an authoritative signed-out answer and shows the message (sign in with the other provider, plus the support link) instead of failing sign-in generically.
• src/libs/auth/postSignIn.ts: a 409 from getMe signs the user out with the message instead of attempting a registration that cannot succeed. The legacy "azureb2c authentication error" substring check stays for older consent builds.

A second edge case is outside consent entirely: B2C can answer the authorization request itself with an error instead of a code — the user's own cancel, or a B2C-side failure. The observed case is AADB2C90289/invalid_client: the non-prod B2C tenant's federation client secret to the upstream Microsoft provider has expired, which fails every Microsoft sign-in in those environments (secret rotation is tracked separately). authorizationCodeGrant throws AuthorizationResponseError, and the resulting 500 answered the browser's top-level /auth/callback navigation with raw JSON, stranding the user:

• server/src/auth/callback.ts: catch AuthorizationResponseError; a cancel (access_denied) redirects home silently, anything else logs the B2C error and redirects to /?signInError=provider. State-mismatch and token-validation failures still throw.
• src/App.tsx: a fixed toast for the signInError marker, then the marker is stripped from the URL. The marker is a key, never reflected text, so the toast cannot echo attacker-supplied content.

Deployment note: the 401 tightening assumes every environment runs a consent build with both fixes above. An old consent behind this BFF would destroy a brand-new user's session on the first probe and block registration.

Testing

pnpm run lint, pnpm run type-check, pnpm test (368 files, 4312 tests), and the server suite (327 tests) pass. New coverage: 401 destroys the session (including a failing session store); 409 forwards the upstream message, falls back on an unusable body, and overwrites the probe's held signed-in answer; the bootstrap signs out on a 409 without a registration attempt; the callback's authorization-error redirects run against the real openid-client grant (fake B2C), alongside the unchanged security rejections; the App toast renders once and the marker is stripped.

The Microsoft sign-in repro was observed manually and produced the exact error this PR handles.

404 User Not Found -> New User Registration Case

409 Sam AzureB2C Error Case

500 Auth Provider Error

---

Have you read Terra's Contributing Guide lately? If not, do that first.

• Label PR with a Jira ticket number and include a link to the ticket
• Label PR with a security risk modifier [no, low, medium, high]
• PR describes scope of changes
• Get a minimum of one thumbs worth of review, preferably two if enough team members are available
• Get PO sign-off for all non-trivial UI or workflow changes
• Verify all tests go green
• Test this change deployed correctly and works on dev environment after deployment

🤖 Generated with Claude Code

[github-actions]

Coverage Report for DUOS Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	89.51%	11452 / 12794
🔵	Statements	88.89%	12177 / 13699
🔵	Functions	86.23%	3337 / 3870
🔵	Branches	81.6%	7160 / 8774

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Changed Files
src/App.tsx	100%	94.11%	100%	100%
src/libs/auth/postSignIn.ts	95.74%	88.88%	100%	100%	106, 129, 159, 164
src/libs/auth/session.ts	100%	92.3%	100%	100%
server/src/auth/callback.ts	100%	100%	100%	100%
server/src/auth/me.ts	100%	95.45%	100%	100%
server/src/types/session.ts	100%	100%	100%	100%

Generated in workflow #6889 for commit 2396d50 by the Vitest Coverage Report Action

[Copilot]

Pull request overview

Updates DUOS UI + BFF sign-in/session handling to match Consent’s expanded /api/user/me contract (401/404/409) and to gracefully handle Azure B2C authorization-response errors during /auth/callback, surfacing actionable user guidance instead of generic failures.

Changes:

• Map Consent/BFF 409 provider_conflict to a signed-out session with a user-facing actionable toast, and prevent impossible registration attempts.
• Treat upstream 401 as a terminal rejected-session response (destroy session) while preserving the “authenticated but unregistered” flow for 404.
• Catch openid-client AuthorizationResponseError in /auth/callback and redirect back to the SPA with a stable signInError marker that the SPA turns into a toast and then strips.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
test/libs/auth/session.spec.ts	Adds probe-level coverage for 409 provider-conflict behavior and caching semantics.
test/libs/auth/postSignIn.spec.ts	Adds coverage to ensure 409 from getMe signs out and does not attempt registration; keeps legacy substring path.
test/components/App.spec.tsx	Adds coverage for SPA toast + URL marker stripping when landing with ?signInError=provider.
src/libs/auth/session.ts	Implements 409 handling in the BFF session probe and shows an actionable toast once per attempt.
src/libs/auth/postSignIn.ts	Treats 409 from getMe as terminal conflict: show message + sign out rather than register.
src/App.tsx	Adds a boot-time handler for signInError marker to show a fixed toast and strip the marker from the URL.
server/test/me.test.ts	Updates server-side contract tests for 401 destroy behavior and new 409 forwarding + fallback.
server/test/authCrypto.test.ts	Adds coverage for callback redirects when B2C returns authorization-response errors (server_error/access_denied).
server/src/types/session.ts	Removes profileSeen from the session type (no longer needed with the new contract).
server/src/auth/me.ts	Reworks /auth/me mapping for 401/404/409 and removes profileSeen-based behavior.
server/src/auth/callback.ts	Catches AuthorizationResponseError and redirects to SPA rather than returning raw JSON errors.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[fboulnois]

👍