konnosauth-error-codes.ts250 lines · main
| 1 | export const AUTH_ERROR_CODES = { |
| 2 | anonymous_provider_disabled: { |
| 3 | description: 'Anonymous sign-ins are disabled.', |
| 4 | }, |
| 5 | bad_code_verifier: { |
| 6 | description: |
| 7 | 'Returned from the PKCE flow where the provided code verifier does not match the expected one. Indicates a bug in the implementation of the client library.', |
| 8 | }, |
| 9 | bad_json: { |
| 10 | description: 'Usually used when the HTTP body of the request is not valid JSON.', |
| 11 | }, |
| 12 | bad_oauth_callback: { |
| 13 | description: |
| 14 | 'OAuth callback from provider to Auth does not have all the required attributes (state). Indicates an issue with the OAuth provider or client library implementation.', |
| 15 | }, |
| 16 | bad_oauth_state: { |
| 17 | description: |
| 18 | 'OAuth state (data echoed back by the OAuth provider to Briven Auth) is not in the correct format. Indicates an issue with the OAuth provider integration.', |
| 19 | }, |
| 20 | captcha_failed: { |
| 21 | description: |
| 22 | 'CAPTCHA challenge could not be verified with the CAPTCHA provider. Check your CAPTCHA integration.', |
| 23 | }, |
| 24 | conflict: { |
| 25 | description: |
| 26 | 'General database conflict, such as concurrent requests on resources that should not be modified concurrently. Can often occur when you have too many session refresh requests firing off at the same time for a user.', |
| 27 | }, |
| 28 | email_address_invalid: { |
| 29 | description: |
| 30 | 'Example and test domains are currently not supported. Use a different email address.', |
| 31 | }, |
| 32 | email_address_not_authorized: { |
| 33 | description: |
| 34 | 'Email sending is not allowed for this address as your project is using the default SMTP service. Set up a custom SMTP provider to send to external addresses.', |
| 35 | }, |
| 36 | email_conflict_identity_not_deletable: { |
| 37 | description: |
| 38 | "Unlinking this identity causes the user's account to change to an email address which is already used by another user account.", |
| 39 | }, |
| 40 | email_not_confirmed: { |
| 41 | description: 'Signing in is not allowed for this user as the email address is not confirmed.', |
| 42 | }, |
| 43 | email_provider_disabled: { |
| 44 | description: 'Signups are disabled for email and password.', |
| 45 | }, |
| 46 | flow_state_expired: { |
| 47 | description: |
| 48 | 'PKCE flow state to which the API request relates has expired. Ask the user to sign in again.', |
| 49 | }, |
| 50 | flow_state_not_found: { |
| 51 | description: |
| 52 | 'PKCE flow state no longer exists or was destroyed by a previous request. Ask the user to sign in again.', |
| 53 | }, |
| 54 | hook_payload_invalid_content_type: { |
| 55 | description: 'Payload from Auth does not have a valid Content-Type header.', |
| 56 | }, |
| 57 | hook_payload_over_size_limit: { |
| 58 | description: 'Payload from Auth exceeds maximum size limit.', |
| 59 | }, |
| 60 | hook_timeout: { |
| 61 | description: 'Unable to reach hook within maximum time allocated.', |
| 62 | }, |
| 63 | hook_timeout_after_retry: { |
| 64 | description: 'Unable to reach hook after maximum number of retries.', |
| 65 | }, |
| 66 | identity_already_exists: { |
| 67 | description: 'The identity to which the API relates is already linked to a user.', |
| 68 | }, |
| 69 | identity_not_found: { |
| 70 | description: |
| 71 | 'Identity to which the API call relates does not exist, such as when an identity is unlinked or deleted.', |
| 72 | }, |
| 73 | insufficient_aal: { |
| 74 | description: |
| 75 | 'The user must have a higher Authenticator Assurance Level to call this API. Ask them to solve an MFA challenge.', |
| 76 | }, |
| 77 | invalid_credentials: { |
| 78 | description: 'Login credentials or grant type not recognized.', |
| 79 | }, |
| 80 | manual_linking_disabled: { |
| 81 | description: |
| 82 | 'Calling the briven.auth.linkUser() and related APIs is not enabled on the Auth server.', |
| 83 | }, |
| 84 | mfa_challenge_expired: { |
| 85 | description: 'Responding to an MFA challenge took too long. Request a new challenge.', |
| 86 | }, |
| 87 | mfa_factor_name_conflict: { |
| 88 | description: 'MFA factors for a single user should not have the same friendly name.', |
| 89 | }, |
| 90 | mfa_factor_not_found: { |
| 91 | description: 'MFA factor no longer exists.', |
| 92 | }, |
| 93 | mfa_ip_address_mismatch: { |
| 94 | description: |
| 95 | 'The enrollment process for MFA factors must begin and end with the same IP address.', |
| 96 | }, |
| 97 | mfa_phone_enroll_not_enabled: { |
| 98 | description: 'Enrollment of MFA Phone factors is disabled.', |
| 99 | }, |
| 100 | mfa_phone_verify_not_enabled: { |
| 101 | description: 'Login via Phone factors and verification of new Phone factors is disabled.', |
| 102 | }, |
| 103 | mfa_totp_enroll_not_enabled: { |
| 104 | description: 'Enrollment of MFA TOTP factors is disabled.', |
| 105 | }, |
| 106 | mfa_totp_verify_not_enabled: { |
| 107 | description: 'Login via TOTP factors and verification of new TOTP factors is disabled.', |
| 108 | }, |
| 109 | mfa_verification_failed: { |
| 110 | description: 'MFA challenge could not be verified due to a wrong TOTP code.', |
| 111 | }, |
| 112 | mfa_verification_rejected: { |
| 113 | description: 'Further MFA verification is rejected due to a hook decision.', |
| 114 | }, |
| 115 | mfa_verified_factor_exists: { |
| 116 | description: 'Verified phone factor already exists for a user. Unenroll it to continue.', |
| 117 | }, |
| 118 | mfa_web_authn_enroll_not_enabled: { |
| 119 | description: 'Enrollment of MFA Web Authn factors is disabled.', |
| 120 | }, |
| 121 | mfa_web_authn_verify_not_enabled: { |
| 122 | description: 'Login via WebAuthn factors and verification of new WebAuthn factors is disabled.', |
| 123 | }, |
| 124 | no_authorization: { |
| 125 | description: 'This HTTP request requires an Authorization header, which is missing.', |
| 126 | }, |
| 127 | oauth_provider_not_supported: { |
| 128 | description: 'Using an OAuth provider which is disabled on the Auth server.', |
| 129 | }, |
| 130 | otp_disabled: { |
| 131 | description: 'Sign in with OTPs (magic link, email OTP) is disabled.', |
| 132 | }, |
| 133 | otp_expired: { |
| 134 | description: 'OTP code has expired. Ask the user to sign in again.', |
| 135 | }, |
| 136 | over_email_send_rate_limit: { |
| 137 | description: 'Too many emails have been sent to this address. Ask the user to wait.', |
| 138 | }, |
| 139 | over_request_rate_limit: { |
| 140 | description: |
| 141 | 'Too many requests have been sent by this client. Ask the user to try again later.', |
| 142 | }, |
| 143 | over_sms_send_rate_limit: { |
| 144 | description: 'Too many SMS messages have been sent to this phone number. Ask the user to wait.', |
| 145 | }, |
| 146 | phone_not_confirmed: { |
| 147 | description: 'Signing in is not allowed for this user as the phone number is not confirmed.', |
| 148 | }, |
| 149 | phone_provider_disabled: { |
| 150 | description: 'Signups are disabled for phone and password.', |
| 151 | }, |
| 152 | provider_disabled: { |
| 153 | description: 'OAuth provider is disabled for use. Check configuration.', |
| 154 | }, |
| 155 | provider_email_needs_verification: { |
| 156 | description: 'OAuth provider does not verify emails. A verification email has been sent.', |
| 157 | }, |
| 158 | reauthentication_needed: { |
| 159 | description: 'A user must reauthenticate to change their password.', |
| 160 | }, |
| 161 | reauthentication_not_valid: { |
| 162 | description: 'Reauthentication failed. The code is incorrect.', |
| 163 | }, |
| 164 | refresh_token_already_used: { |
| 165 | description: 'Refresh token has been revoked and is outside the reuse interval.', |
| 166 | }, |
| 167 | refresh_token_not_found: { |
| 168 | description: 'Session containing the refresh token not found.', |
| 169 | }, |
| 170 | request_timeout: { |
| 171 | description: 'Processing the request took too long. Retry the request.', |
| 172 | }, |
| 173 | same_password: { |
| 174 | description: 'New password must be different from the current password.', |
| 175 | }, |
| 176 | saml_assertion_no_email: { |
| 177 | description: 'SAML assertion did not contain an email address.', |
| 178 | }, |
| 179 | saml_assertion_no_user_id: { |
| 180 | description: 'SAML assertion did not contain a required user ID (NameID).', |
| 181 | }, |
| 182 | saml_entity_id_mismatch: { |
| 183 | description: |
| 184 | 'Entity ID in SAML update does not match the database. Create a new provider instead.', |
| 185 | }, |
| 186 | saml_idp_already_exists: { |
| 187 | description: 'SAML identity provider already exists.', |
| 188 | }, |
| 189 | saml_idp_not_found: { |
| 190 | description: 'SAML identity provider not found.', |
| 191 | }, |
| 192 | saml_metadata_fetch_failed: { |
| 193 | description: 'Failed to fetch metadata from the provided URL for SAML provider.', |
| 194 | }, |
| 195 | saml_provider_disabled: { |
| 196 | description: 'Enterprise SSO with SAML 2.0 is not enabled on the Auth server.', |
| 197 | }, |
| 198 | saml_relay_state_expired: { |
| 199 | description: 'SAML relay state expired. Ask the user to sign in again.', |
| 200 | }, |
| 201 | saml_relay_state_not_found: { |
| 202 | description: 'SAML relay state no longer exists. Ask the user to sign in again.', |
| 203 | }, |
| 204 | session_expired: { |
| 205 | description: 'Session has expired due to inactivity or time limit.', |
| 206 | }, |
| 207 | session_not_found: { |
| 208 | description: 'Session no longer exists. Possibly deleted or user signed out.', |
| 209 | }, |
| 210 | signup_disabled: { |
| 211 | description: 'Sign ups (new account creation) are disabled on the server.', |
| 212 | }, |
| 213 | single_identity_not_deletable: { |
| 214 | description: |
| 215 | 'Every user must have at least one identity attached. Cannot delete the only identity.', |
| 216 | }, |
| 217 | sms_send_failed: { |
| 218 | description: 'Sending an SMS message failed. Check SMS provider configuration.', |
| 219 | }, |
| 220 | sso_domain_already_exists: { |
| 221 | description: 'Only one SSO domain can be registered per identity provider.', |
| 222 | }, |
| 223 | sso_provider_not_found: { |
| 224 | description: 'SSO provider not found. Check the signInWithSSO arguments.', |
| 225 | }, |
| 226 | too_many_enrolled_mfa_factors: { |
| 227 | description: 'A user can only have a limited number of enrolled MFA factors.', |
| 228 | }, |
| 229 | unexpected_audience: { |
| 230 | description: "The request's X-JWT-AUD claim does not match the JWT's audience.", |
| 231 | }, |
| 232 | unexpected_failure: { |
| 233 | description: 'Auth service is degraded or a bug occurred without a specific reason.', |
| 234 | }, |
| 235 | user_already_exists: { |
| 236 | description: 'User with this email or phone cannot be created again as it already exists.', |
| 237 | }, |
| 238 | user_banned: { |
| 239 | description: 'User is banned until the banned_until field is cleared.', |
| 240 | }, |
| 241 | user_sso_managed: { |
| 242 | description: 'Certain fields of an SSO user cannot be updated, like email.', |
| 243 | }, |
| 244 | validation_failed: { |
| 245 | description: 'Provided parameters are not in the expected format.', |
| 246 | }, |
| 247 | weak_password: { |
| 248 | description: 'Password does not meet the required strength criteria.', |
| 249 | }, |
| 250 | } |