Nothing asserted the defining behavior of the direct login path, so reverting the short-circuit in connectWithConnectionString would have gone unnoticed. The listener filters on the connectionstring route so it covers both generatetoken and accessinputmetadata, and leaves the account restriction check alone since that still runs for every API.
SQL, Tables, and Gremlin logins probed the account before signing in, so a user whose key was wrong or whose account was unreachable was blocked at the connect form. The probe is now gone: the connection string is accepted as-is and any bad key surfaces on the data-plane requests made from inside the explorer.
Removes validateDirectConnectionStringConnectivity, isAuthorizationError, and the connectExplorer.errors.connectFailed string along with their tests.
Also takes documentEndpoint straight from the AccountEndpoint in SQL and Gremlin connection strings instead of rebuilding it from the account name and a hardcoded DNS zone. Tables still derives it, since a Tables connection string only carries the table endpoint.
- Lift the login error state into HostedExplorer so failures from the connect form and from a postMessage login share one source of truth
- Show the message returned by the service instead of falling back to a generic unreachable message
- Move isAuthorizationError into AuthorizationUtils alongside the other shared auth helpers
- Widen getErrorMessage to accept unknown so catch variables no longer need a cast
- Show the connect screen error tooltip beside the icon and widen it so long service messages fit
- Consolidate the repeated account lookup and login steps in the SQL connection string spec
Add TestAuthType and fold connection-string account resolution into getAccountName; seed and target the dedicated *-connstring accounts in CI while falling back to the standard per-API account locally.
Asier Isayas