fix(auth): meaningful error when ClickHouse refuses an authenticated user

[BorisTyshkevich]

Problem

When a user signs in via the IdP successfully but ClickHouse won't authorize them — no matching CH user, missing grants, or a JWT it can't verify — the app showed "Session expired" and bounced to the login screen. The session wasn't expired, and re-authenticating never helped. The user just saw repeated 403s with an unhelpful message.

Root cause

authedFetch (src/net/ch-client.js) flagged any 401/403 as "auth expired." But by the time it POSTs, getToken() has already guaranteed a valid, non-expired bearer (it refreshes, or returns null and the caller signs out). So a 401/403 that survives the single refresh-retry means ClickHouse rejected a valid login — an authorization/identity problem, not expiry. The code nonetheless called onSignedOut() → renderLogin(app, 'Session expired').

Fix

Distinguish the two failure modes:

• CH rejects a valid login → show an accurate message naming the cause and appending ClickHouse's own reason, e.g.:

  ClickHouse denied your account (HTTP 403). You're signed in, but this server is not authorizing you — your identity may have no ClickHouse user or the required grants. Server: Code: 516. DB::Exception: Invalid authentication: Token could not be verified. (AUTHENTICATION_FAILED)

• Genuine expiry (no token, or expired + refresh failed) keeps its own path, reworded to "Your session expired — please sign in again."

Changes:

• core/stream.js — new pure authDeniedMessage(status, reason) (reuses parseExceptionText for the server reason)
• net/ch-client.js — classify a valid-token 401/403 as authorization denial, pass CH's reason to onSignedOut
• ui/app.js — onSignedOut(detail) renders the detail, else the expiry default

Tests

npm test green; per-file gate held — stream.js and ch-client.js at 100%. Added authDeniedMessage cases, updated the ch-client 403 test to assert the message + server reason, and added an app.js test for both onSignedOut message paths.

Verification

Built and deployed to antalya + otel. Reproduced live on antalya by injecting a non-expired but unverifiable JWT (so getToken() returns it and ClickHouse 403s it): the login screen shows the authorization message + the real AUTHENTICATION_FAILED reason instead of "Session expired" (screenshot below).

🤖 Generated with Claude Code

https://claude.ai/code/session_01QennTvGKAtJZrv9EpQagef