feat: handle rejection when login via auth code

Author: EchoEllet

l10n/app_en.arb

@@ -247,5 +247,21 @@
     "@minecraftOwnershipRequiredError": {
         "description": "Shown when the Microsoft account is valid and a Minecraft profile may exist, but no active license for Minecraft is found. This may occur if the game has not been purchased or redeemed. Users can resolve this at https://www.minecraft.net/redeem or https://www.minecraft.net/store/minecraft-deluxe-collection-pc."
     },
-    "loginDeviceCodeRejected": "The login attempt was rejected."
+    "loginAttemptRejected": "The login attempt was rejected.",
+    "authCodeLoginUnknownError": "An unknown error occurred while logging in: {errorCode}, {errorDescription}",
+    "@authCodeLoginUnknownError": {
+        "description": "Shown when an unknown error occurs while logging in with Microsoft via auth code. The user login using in the browser and then Microsoft redirects the user to a minimal and local HTTP server to handles the result. This message is used when the error code is unknown.",
+        "placeholders": {
+            "errorCode": {
+                "type": "String",
+                "example": "access_denied",
+                "description": "The error code returned from the API during Microsoft sign-in failure."
+            },
+            "errorDescription": {
+                "type": "String",
+                "example": "Internal server error.",
+                "description": "The message returned from the API describing the error."
+            }
+        }
+    }
 }

l10n/untranslated.json

@@ -11,7 +11,8 @@
     "createXboxAccount",
     "minecraftAccountNotFoundError",
     "minecraftOwnershipRequiredError",
-    "loginDeviceCodeRejected"
+    "loginAttemptRejected",
+    "authCodeLoginUnknownError"
   ],
 
   "de": [
@@ -26,7 +27,8 @@
     "createXboxAccount",
     "minecraftAccountNotFoundError",
     "minecraftOwnershipRequiredError",
-    "loginDeviceCodeRejected"
+    "loginAttemptRejected",
+    "authCodeLoginUnknownError"
   ],
 
   "zh": [
@@ -41,6 +43,7 @@
     "createXboxAccount",
     "minecraftAccountNotFoundError",
     "minecraftOwnershipRequiredError",
-    "loginDeviceCodeRejected"
+    "loginAttemptRejected",
+    "authCodeLoginUnknownError"
   ]
 }

lib/account/data/minecraft_account.dart

@@ -140,6 +140,8 @@ class MicrosoftAccountInfo {
         ),
       );
 
+  // TODO: Store more data related to Xbox and Microsoft just in case even if it's not needed?
+
   final ExpirableToken microsoftOAuthAccessToken;
 
   // It's unknown when the OAuth refresh token expires. See https://learn.microsoft.com/en-us/entra/identity-platform/refresh-tokens#token-lifetime

lib/account/data/minecraft_accounts.dart

@@ -6,11 +6,7 @@ import 'minecraft_account.dart';
 
 @immutable
 class MinecraftAccounts {
-  const MinecraftAccounts({
-    required this.all,
-    // TODO: Use id for both selected and default account instead of index?
-    required this.defaultAccountId,
-  });
+  const MinecraftAccounts({required this.all, required this.defaultAccountId});
 
   factory MinecraftAccounts.empty() =>
       const MinecraftAccounts(all: [], defaultAccountId: null);

lib/account/data/minecraft_api/minecraft_api.dart

@@ -87,6 +87,8 @@ class MinecraftProfileSkin {
       );
 
   final String id;
+  // TODO: Store this as enum since, it's duplicated in MinecraftProfileCape, values are either ACTIVE or INACTIVE
+  //  and do the same in MinecraftAccount
   final String state;
   final String url;
   final String textureKey;
@@ -128,8 +130,6 @@ abstract class MinecraftApi {
 
   Future<bool> checkMinecraftJavaOwnership(String minecraftAccessToken);
 
-  // TODO: Handle the case where user don't have Microsoft account, account_creation_required will be thrown when calling: "https://xsts.auth.xboxlive.com/xsts/authorize", cover all cases
-  // TODO: Create exception for an invalid skin file which is possible. Also enforce file size (accept only small image files)
   Future<MinecraftProfileResponse> uploadSkin(
     File skinFile, {
     required MinecraftSkinVariant skinVariant,

lib/account/logic/account_manager/minecraft_account_manager.dart

@@ -107,7 +107,7 @@ class MinecraftAccountManager {
   Future<AccountResult?> loginWithMicrosoftAuthCode({
     required OnAuthProgressUpdateAuthCodeCallback onProgressUpdate,
     // The page content is not hardcoded for localization.
-    required AuthCodeSuccessLoginPageContent successLoginPageContent,
+    required MicrosoftAuthCodeResponsePageVariants authCodeResponsePageVariants,
   }) => _transformExceptions(() async {
     final server = httpServer ?? await startServer();
 
@@ -131,19 +131,66 @@ class MinecraftAccountManager {
       return null;
     }
 
+    Future<void> respondAndStopServer(String html) async {
+      request.response
+        ..statusCode = HttpStatus.ok
+        ..headers.contentType = ContentType.html
+        ..write(html);
+      await request.response.close();
+      await stopServer();
+    }
+
     final code =
         request.uri.queryParameters[MicrosoftConstants
-            .loginRedirectCodeQueryParamName];
+            .loginRedirectAuthCodeQueryParamName];
+
+    final error =
+        request.uri.queryParameters[MicrosoftConstants
+            .loginRedirectErrorQueryParamName];
+    final errorDescription =
+        request.uri.queryParameters[MicrosoftConstants
+            .loginRedirectErrorDescriptionQueryParamName];
+
+    if (error != null) {
+      if (error == MicrosoftConstants.loginRedirectAccessDeniedErrorCode) {
+        await respondAndStopServer(
+          buildAuthCodeResultHtmlPage(
+            authCodeResponsePageVariants.accessDenied,
+            isSuccess: false,
+          ),
+        );
+        throw AccountManagerException.microsoftAuthCodeDenied();
+      }
+
+      await respondAndStopServer(
+        buildAuthCodeResultHtmlPage(
+          authCodeResponsePageVariants.unknownError(
+            error,
+            errorDescription.toString(),
+          ),
+          isSuccess: false,
+        ),
+      );
+      throw AccountManagerException.microsoftAuthCodeRedirect(
+        error: error,
+        errorDescription: errorDescription.toString(),
+      );
+    }
     if (code == null) {
-      await stopServer();
-      throw AccountManagerException.missingAuthCode();
+      await respondAndStopServer(
+        buildAuthCodeResultHtmlPage(
+          authCodeResponsePageVariants.missingAuthCode,
+          isSuccess: false,
+        ),
+      );
+      throw AccountManagerException.microsoftMissingAuthCode();
     }
-    request.response
-      ..statusCode = HttpStatus.ok
-      ..headers.contentType = ContentType.html
-      ..write(buildAuthCodeSuccessPageHtml(successLoginPageContent));
-    await request.response.close();
-    await stopServer();
+    await respondAndStopServer(
+      buildAuthCodeResultHtmlPage(
+        authCodeResponsePageVariants.approved,
+        isSuccess: true,
+      ),
+    );
 
     onProgressUpdate(MicrosoftAuthProgress.exchangingAuthCode);
 
@@ -518,8 +565,8 @@ class MinecraftAccountManager {
 }
 
 @immutable
-class AuthCodeSuccessLoginPageContent {
-  const AuthCodeSuccessLoginPageContent({
+class MicrosoftAuthCodeResponsePageContent {
+  const MicrosoftAuthCodeResponsePageContent({
     required this.pageTitle,
     required this.title,
     required this.subtitle,
@@ -533,12 +580,33 @@ class AuthCodeSuccessLoginPageContent {
   final String pageDir;
 }
 
+@immutable
+class MicrosoftAuthCodeResponsePageVariants {
+  const MicrosoftAuthCodeResponsePageVariants({
+    required this.approved,
+    required this.accessDenied,
+    required this.missingAuthCode,
+    required this.unknownError,
+  });
+
+  final MicrosoftAuthCodeResponsePageContent approved;
+  final MicrosoftAuthCodeResponsePageContent accessDenied;
+  final MicrosoftAuthCodeResponsePageContent missingAuthCode;
+  final MicrosoftAuthCodeResponsePageContent Function(
+    String errorCode,
+    String errorDescription,
+  )
+  unknownError;
+}
+
 // Since the authorization code flow requires a redirect URI,
 // the app temporarily starts a local server to handle the redirect request,
 // which contains the authorization code needed to complete login.
 @visibleForTesting
-String buildAuthCodeSuccessPageHtml(AuthCodeSuccessLoginPageContent content) =>
-    '''
+String buildAuthCodeResultHtmlPage(
+  MicrosoftAuthCodeResponsePageContent content, {
+  required bool isSuccess,
+}) => '''
 <!DOCTYPE html>
 <html lang="${content.pageLangCode}" dir="${content.pageDir}">
 <head>
@@ -575,7 +643,7 @@ String buildAuthCodeSuccessPageHtml(AuthCodeSuccessLoginPageContent content) =>
 </head>
 <body>
   <div class="box">
-    <h1>✅ ${content.title}</h1>
+    <h1>${isSuccess ? '✅' : '❌'} ${content.title}</h1>
     <p>${content.subtitle}</p>
   </div>
 </body>

lib/account/logic/account_manager/minecraft_account_manager_exceptions.dart

@@ -7,8 +7,19 @@ import '../../data/minecraft_api/minecraft_api_exceptions.dart';
 sealed class AccountManagerException implements Exception {
   const AccountManagerException(this.message);
 
-  factory AccountManagerException.missingAuthCode() =>
-      const MissingAuthCodeAccountManagerException();
+  factory AccountManagerException.microsoftMissingAuthCode() =>
+      const MicrosoftMissingAuthCodeAccountManagerException();
+
+  factory AccountManagerException.microsoftAuthCodeRedirect({
+    required String error,
+    required String errorDescription,
+  }) => MicrosoftAuthCodeRedirectAccountManagerException(
+    error: error,
+    errorDescription: errorDescription,
+  );
+
+  factory AccountManagerException.microsoftAuthCodeDenied() =>
+      const MicrosoftAuthCodeDeniedAccountManagerException();
 
   factory AccountManagerException.microsoftAuthApiException(
     MicrosoftAuthException authApiException,
@@ -29,11 +40,32 @@ sealed class AccountManagerException implements Exception {
   String toString() => message;
 }
 
-final class MissingAuthCodeAccountManagerException
+final class MicrosoftMissingAuthCodeAccountManagerException
+    extends AccountManagerException {
+  const MicrosoftMissingAuthCodeAccountManagerException()
+    : super(
+        'The Microsoft auth code query parameter should be passed to the redirect URL but was not found.',
+      );
+}
+
+final class MicrosoftAuthCodeRedirectAccountManagerException
+    extends AccountManagerException {
+  const MicrosoftAuthCodeRedirectAccountManagerException({
+    required this.error,
+    required this.errorDescription,
+  }) : super(
+         'While logging via auth code, Microsoft redirected the result which is an unknown error: "$error", description: "$errorDescription".',
+       );
+
+  final String error;
+  final String errorDescription;
+}
+
+final class MicrosoftAuthCodeDeniedAccountManagerException
     extends AccountManagerException {
-  const MissingAuthCodeAccountManagerException()
+  const MicrosoftAuthCodeDeniedAccountManagerException()
     : super(
-        'The auth code query parameter should be passed to the redirect URL but was not found.',
+        'While logging with Microsoft via auth code, the user has denied the authorization request.',
       );
 }
 

lib/account/logic/microsoft/cubit/microsoft_account_handler_cubit.dart

@@ -43,7 +43,8 @@ class MicrosoftAccountHandlerCubit extends Cubit<MicrosoftAccountHandlerState> {
   }
 
   Future<void> loginWithMicrosoftAuthCode({
-    required AuthCodeSuccessLoginPageContent successLoginPageContent,
+    // The page content is not hardcoded for localization.
+    required MicrosoftAuthCodeResponsePageVariants authCodeResponsePageVariants,
   }) => _handleErrors(() async {
     await minecraftAccountManager.startServer();
     final result = await minecraftAccountManager.loginWithMicrosoftAuthCode(
@@ -55,7 +56,7 @@ class MicrosoftAccountHandlerCubit extends Cubit<MicrosoftAccountHandlerState> {
               authCodeLoginUrl: authCodeLoginUrl,
             ),
           ),
-      successLoginPageContent: successLoginPageContent,
+      authCodeResponsePageVariants: authCodeResponsePageVariants,
     );
     if (result == null) {
       // The user closed the login dialog without completing the login.

lib/account/ui/login_with_microsoft_dialog.dart

@@ -162,10 +162,20 @@ class _LoginWithMicrosoftDialogState extends State<LoginWithMicrosoftDialog> {
                 children: [
                   const SizedBox(height: 6),
                   FilledButton.icon(
-                    onPressed:
-                        () => _microsoftAccountHandlerCubit.loginWithMicrosoftAuthCode(
-                          successLoginPageContent:
-                              AuthCodeSuccessLoginPageContent(
+                    onPressed: () {
+                      final pageDir = Directionality.of(context).name;
+                      final pageLangCode =
+                          context
+                              .read<SettingsCubit>()
+                              .state
+                              .settings
+                              .general
+                              .appLanguage
+                              .localeCode;
+                      _microsoftAccountHandlerCubit.loginWithMicrosoftAuthCode(
+                        authCodeResponsePageVariants:
+                            MicrosoftAuthCodeResponsePageVariants(
+                              approved: MicrosoftAuthCodeResponsePageContent(
                                 pageTitle:
                                     context
                                         .loc
@@ -178,17 +188,41 @@ class _LoginWithMicrosoftDialogState extends State<LoginWithMicrosoftDialog> {
                                     .authCodeRedirectPageLoginSuccessMessage(
                                       ProjectInfoConstants.displayName,
                                     ),
-                                pageDir: Directionality.of(context).name,
-                                pageLangCode:
-                                    context
-                                        .read<SettingsCubit>()
-                                        .state
-                                        .settings
-                                        .general
-                                        .appLanguage
-                                        .localeCode,
+                                pageDir: pageDir,
+                                pageLangCode: pageLangCode,
                               ),
-                        ),
+                              accessDenied:
+                                  MicrosoftAuthCodeResponsePageContent(
+                                    pageTitle: context.loc.errorOccurred,
+                                    title: context.loc.errorOccurred,
+                                    subtitle: context.loc.loginAttemptRejected,
+                                    pageLangCode: pageLangCode,
+                                    pageDir: pageDir,
+                                  ),
+                              missingAuthCode:
+                                  MicrosoftAuthCodeResponsePageContent(
+                                    pageTitle: context.loc.errorOccurred,
+                                    title: context.loc.errorOccurred,
+                                    subtitle: context.loc.missingAuthCodeError,
+                                    pageLangCode: pageLangCode,
+                                    pageDir: pageDir,
+                                  ),
+                              unknownError:
+                                  (errorCode, errorDescription) =>
+                                      MicrosoftAuthCodeResponsePageContent(
+                                        pageTitle: context.loc.errorOccurred,
+                                        title: context.loc.errorOccurred,
+                                        subtitle: context.loc
+                                            .authCodeLoginUnknownError(
+                                              errorCode,
+                                              errorDescription,
+                                            ),
+                                        pageLangCode: pageLangCode,
+                                        pageDir: pageDir,
+                                      ),
+                            ),
+                      );
+                    },
                     label: Text(context.loc.signInWithMicrosoft),
                     icon: const Icon(Icons.open_in_browser),
                   ),
@@ -272,7 +306,7 @@ class _LoginWithMicrosoftDialogState extends State<LoginWithMicrosoftDialog> {
                           spacing: 8,
                           children: [
                             Text(
-                              context.loc.loginDeviceCodeRejected,
+                              context.loc.loginAttemptRejected,
                               style: context.theme.textTheme.titleMedium,
                             ),
                             ElevatedButton.icon(