Cover magic-link and SAML failures on auth error page

Browser auth callbacks still returned JSON or used one-off pages
for several refusal reasons. Route OIDC email verification,
magic-link, and SAML ACS failures through /auth/error with stable
error codes so users always see an explanation.

Signed-off-by: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>

pkg/server/api/connect/v1/auth_error_test.go

@@ -21,12 +21,17 @@
 package connect_v1
 
 import (
+	"errors"
 	"net/http"
 	"net/http/httptest"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/iam/saml"
+	"go.probo.inc/probo/pkg/mail"
 )
 
 func TestRedirectAuthError(t *testing.T) {
@@ -43,3 +48,85 @@ func TestRedirectAuthError(t *testing.T) {
 	assert.Equal(t, "/auth/error", location.Path)
 	assert.Equal(t, authErrorPersonalAccountNotAllowed, location.Query().Get("error"))
 }
+
+func TestAuthErrorCodeFromSAML(t *testing.T) {
+	t.Parallel()
+
+	configID := gid.New(gid.TenantID(1), coredata.SAMLConfigurationEntityType)
+	email, err := mail.ParseAddr("user@example.com")
+	require.NoError(t, err)
+
+	tests := []struct {
+		name string
+		err  error
+		code string
+		ok   bool
+	}{
+		{
+			name: "disabled",
+			err:  saml.NewSAMLDisabledError(),
+			code: authErrorSAMLDisabled,
+			ok:   true,
+		},
+		{
+			name: "configuration not found",
+			err:  saml.NewSAMLConfigurationNotFoundError(configID),
+			code: authErrorSAMLConfigurationNotFound,
+			ok:   true,
+		},
+		{
+			name: "email domain mismatch",
+			err:  saml.NewEmailDomainMismatchError(email, "acme.com"),
+			code: authErrorSAMLEmailDomainMismatch,
+			ok:   true,
+		},
+		{
+			name: "auto signup disabled",
+			err:  saml.NewSAMLAutoSignupDisabledError(configID),
+			code: authErrorSAMLAutoSignupDisabled,
+			ok:   true,
+		},
+		{
+			name: "user inactive",
+			err:  saml.NewUserInactiveError(configID),
+			code: authErrorSAMLUserInactive,
+			ok:   true,
+		},
+		{
+			name: "subject already in use",
+			err:  saml.NewSAMLSubjectAlreadyInUseError("assertion-1"),
+			code: authErrorSAMLSubjectAlreadyInUse,
+			ok:   true,
+		},
+		{
+			name: "invalid assertion maps to generic failure",
+			err:  saml.NewInvalidAssertionError("assertion-1", errors.New("bad signature")),
+			code: authErrorAuthenticationFailed,
+			ok:   true,
+		},
+		{
+			name: "replay maps to generic failure",
+			err:  saml.NewReplayAttackDetectedError("assertion-1"),
+			code: authErrorAuthenticationFailed,
+			ok:   true,
+		},
+		{
+			name: "unknown error",
+			err:  errors.New("boom"),
+			ok:   false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(
+			tt.name,
+			func(t *testing.T) {
+				t.Parallel()
+
+				code, ok := authErrorCodeFromSAML(tt.err)
+				assert.Equal(t, tt.ok, ok)
+				assert.Equal(t, tt.code, code)
+			},
+		)
+	}
+}