Adds proper handling of ID token validation errors

Author: NandanPrabhu

App/ContentView.swift

@@ -23,13 +23,11 @@ struct ContentView: View {
 
             Button {
                 Task {
-                    #if WEB_AUTH_PLATFORM
                     #if os(macOS)
                     await viewModel.webLogin(presentationWindow: currentWindow)
                     #else
                     await viewModel.webLogin(presentationWindow: window)
                     #endif
-                    #endif
                 }
             } label: {
                 VStack(spacing: 4) {
@@ -44,14 +42,11 @@ struct ContentView: View {
 
             Button {
                 Task {
-                    #if WEB_AUTH_PLATFORM
-
                     #if os(macOS)
                     await viewModel.logout(presentationWindow: currentWindow)
                     #else
                     await viewModel.logout(presentationWindow: window)
                     #endif
-                    #endif
                 }
             } label: {
                 Text("Logout")

App/ContentViewModel.swift

@@ -9,7 +9,6 @@ final class ContentViewModel: ObservableObject {
     @Published var isAuthenticated: Bool = false
     private let credentialsManager = CredentialsManager(authentication: Auth0.authentication())
 
-#if WEB_AUTH_PLATFORM
     func webLogin(presentationWindow window: Auth0WindowRepresentable? = nil) async {
         isLoading = true
         errorMessage = nil
@@ -66,9 +65,7 @@ final class ContentViewModel: ObservableObject {
 
         isLoading = false
     }
-    
-    #endif
-    
+
     func checkAuthentication() async {
         do {
             let credentials = try await credentialsManager.credentials()

Auth0/CredentialsManager.swift

@@ -904,8 +904,11 @@ public struct CredentialsManager: Sendable {
                         }
                     case .failure(let error):
                         complete()
+                        // ID token validation failures are deterministic — do not retry them
+                        if let cause = error.cause, isIDTokenValidationError(cause) {
+                            callback(.failure(CredentialsManagerError(code: .renewFailed, cause: cause)))
                         // Check if we should retry based on error type and retry count
-                        if self.shouldRetryRenewal(for: error, retryCount: retryCount) {
+                        } else if self.shouldRetryRenewal(for: error, retryCount: retryCount) {
                             // Calculate exponential backoff delay: 0.5s, 1s, 2s, etc.
                             let delay = pow(2.0, Double(retryCount)) * 0.5
                             DispatchQueue.global(qos: .utility).asyncAfter(deadline: .now() + delay) {
@@ -979,7 +982,11 @@ public struct CredentialsManager: Sendable {
                         }
                     case .failure(let error):
                         complete()
-                        callback(.failure(CredentialsManagerError(code: .ssoExchangeFailed, cause: error)))
+                        if let cause = error.cause, isIDTokenValidationError(cause) {
+                            callback(.failure(CredentialsManagerError(code: .ssoExchangeFailed, cause: cause)))
+                        } else {
+                            callback(.failure(CredentialsManagerError(code: .ssoExchangeFailed, cause: error)))
+                        }
                     }
                 }
         }

Auth0/IDTokenValidator.swift

@@ -46,6 +46,24 @@ enum IDTokenDecodingError: Auth0Error {
     }
 }
 
+/// Returns `true` if the given error is one of the known ID token validation error types.
+/// Use this instead of `cause is any Auth0Error` since many types (e.g. `AuthenticationError`,
+/// `CredentialsManagerError`) also conform to `Auth0Error` and would produce false positives.
+func isIDTokenValidationError(_ error: Error) -> Bool {
+    return error is IDTokenDecodingError
+        || error is IDTokenIssValidator.ValidationError
+        || error is IDTokenSubValidator.ValidationError
+        || error is IDTokenAudValidator.ValidationError
+        || error is IDTokenExpValidator.ValidationError
+        || error is IDTokenIatValidator.ValidationError
+        || error is IDTokenNonceValidator.ValidationError
+        || error is IDTokenAzpValidator.ValidationError
+        || error is IDTokenAuthTimeValidator.ValidationError
+        || error is IDTokenOrgIDValidator.ValidationError
+        || error is IDTokenOrgNameValidator.ValidationError
+        || error is IDTokenSignatureValidator.ValidationError
+}
+
 func validate(idToken: String,
               with context: IDTokenValidatorContext,
               signatureValidator: JWTAsyncValidator? = nil, // for testing

Auth0/MFA/Auth0MFAClient.swift

@@ -196,7 +196,17 @@ private extension Auth0MFAClient {
                                nonce: nonce,
                                organization: organization,
                                from: result,
-                               callback: callback
+                               callback: { (verifyResult: Result<T, MFAVerifyError>) in
+                                   switch verifyResult {
+                                   case .failure(let error):
+                                       if let cause = error.cause, isIDTokenValidationError(cause) {
+                                           return callback(.failure(MFAVerifyError(cause: cause)))
+                                       }
+                                       callback(.failure(error))
+                                   case .success(let value):
+                                       callback(.success(value))
+                                   }
+                               }
                            )
                        },
                        parameters: payload,

Auth0/OAuth2Grant.swift

@@ -91,7 +91,7 @@ struct PKCE: OAuth2Grant {
         case .failure(let error):
             // ID token validation failures are wrapped in AuthenticationError(cause:) where the
             // cause is an Auth0Error from the validator. Map these to .idTokenValidationFailed.
-            if let cause = error.cause, cause is any Auth0Error {
+            if let cause = error.cause, isIDTokenValidationError(cause) {
                 return callback(.failure(WebAuthError(code: .idTokenValidationFailed, cause: cause)))
             }
             return callback(.failure(WebAuthError(code: .codeExchangeFailed, cause: error)))