Publish release-5edbadb22804 filtered source

Private source: 5edbadb2280419cf2cb42b5237835304ad7040e0

Public tree identity: sha256:e0d4d5e1c8693959e69448684a71582edfc13e9b18d7f1e733034fea5ce62cda

crates/clusterflux-client/src/lib.rs

@@ -109,6 +109,21 @@ impl ClusterfluxClient {
         }
     }
 
+    pub async fn cancel_browser_login(
+        &self,
+        transaction_id: impl Into<String>,
+    ) -> Result<(), ClientError> {
+        match self
+            .send_login(LoginRequest::CancelWebBrowserLogin {
+                transaction_id: transaction_id.into(),
+            })
+            .await?
+        {
+            WireResponse::WebBrowserLoginCancelled {} => Ok(()),
+            _ => Err(unexpected_response("web_browser_login_cancelled")),
+        }
+    }
+
     pub async fn account_status(&self) -> Result<AccountStatus, ClientError> {
         match self
             .send_authenticated(AuthenticatedRequest::AuthStatus)

crates/clusterflux-client/src/protocol.rs

@@ -122,6 +122,9 @@ pub(crate) enum AuthenticatedRequest {
 #[serde(tag = "type", rename_all = "snake_case")]
 pub(crate) enum LoginRequest {
     BeginWebBrowserLogin {},
+    CancelWebBrowserLogin {
+        transaction_id: String,
+    },
     ExchangeWebLoginHandoff {
         transaction_id: String,
         handoff_code: String,
@@ -297,6 +300,7 @@ pub(crate) enum WireResponse {
         authorization_url: String,
         expires_at_epoch_seconds: u64,
     },
+    WebBrowserLoginCancelled {},
     WebBrowserSession {
         session: WireBrowserSession,
     },
@@ -334,6 +338,7 @@ mod tests {
             "abort_process",
             "auth_status",
             "begin_web_browser_login",
+            "cancel_web_browser_login",
             "cancel_process",
             "create_artifact_download_link",
             "create_debug_epoch",

crates/clusterflux-client/tests/client_contract.rs

@@ -6,7 +6,7 @@ use clusterflux_client::{
     ClusterfluxClient, ControlTransport, MockTransport, ProjectId, SessionCredential, TenantId,
     UserId, CLIENT_API_VERSION,
 };
-use clusterflux_control::CONTROL_API_PATH;
+use clusterflux_control::{CONTROL_API_PATH, LOGIN_API_PATH};
 use clusterflux_coordinator::service::CoordinatorService;
 use serde_json::{json, Value};
 
@@ -64,6 +64,32 @@ async fn structured_errors_retain_machine_fields_and_originating_request_id() {
     assert!(!error.retryable);
 }
 
+#[tokio::test]
+async fn browser_login_cancellation_uses_the_login_boundary_and_exact_transaction() {
+    let transport = MockTransport::from_json_responses([
+        json!({ "type": "web_browser_login_cancelled" }).to_string(),
+    ]);
+    let client = ClusterfluxClient::with_transport(transport.clone());
+
+    client
+        .cancel_browser_login("login-transaction")
+        .await
+        .unwrap();
+
+    let requests = transport.requests();
+    assert_eq!(requests.len(), 1);
+    assert_eq!(requests[0].api_path, LOGIN_API_PATH);
+    let envelope: Value = serde_json::from_slice(&requests[0].body).unwrap();
+    assert_eq!(envelope["operation"], "cancel_web_browser_login");
+    assert_eq!(
+        envelope["payload"],
+        json!({
+            "type": "cancel_web_browser_login",
+            "transaction_id": "login-transaction"
+        })
+    );
+}
+
 #[tokio::test]
 async fn a_mismatched_error_request_id_is_rejected_as_a_protocol_error() {
     let transport = MockTransport::from_json_responses([json!({

crates/clusterflux-client/tests/fixtures/web_operations.json

@@ -5,6 +5,12 @@
     "request": { "type": "begin_web_browser_login" },
     "response": { "type": "web_browser_login_started", "transaction_id": "login-transaction", "authorization_url": "https://auth.clusterflux.lesstuff.com/authorize?state=opaque", "expires_at_epoch_seconds": 1000 }
   },
+  {
+    "operation": "cancel_web_browser_login",
+    "boundary": "login",
+    "request": { "type": "cancel_web_browser_login", "transaction_id": "login-transaction" },
+    "response": { "type": "web_browser_login_cancelled" }
+  },
   {
     "operation": "exchange_web_login_handoff",
     "boundary": "login",