sanitizeAuthErrorCode function

String sanitizeAuthErrorCode(
  1. String? code, {
  2. String fallback = 'auth_error',
})

Returns a bounded, identifier-shaped error code for HTTP responses.

code is trimmed and accepted only when it matches ^[a-z][a-z0-9_]{0,63}$. Invalid or missing values return fallback unchanged, so callers should provide a safe fallback. Provider callbacks may produce arbitrary diagnostic strings; this helper prevents them from becoming public response data.

Implementation

String sanitizeAuthErrorCode(String? code, {String fallback = 'auth_error'}) {
  final candidate = code?.trim();
  if (candidate == null || !_publicAuthErrorCode.hasMatch(candidate)) {
    return fallback;
  }
  return candidate;
}