-
-
Notifications
You must be signed in to change notification settings - Fork 3.7k
/
Copy patherrors.ts
510 lines (473 loc) · 18.6 KB
/
errors.ts
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
type ErrorOptions = Error | Record<string, unknown>
type ErrorType =
| "AccessDenied"
| "AdapterError"
| "CallbackRouteError"
| "ErrorPageLoop"
| "EventError"
| "InvalidCallbackUrl"
| "CredentialsSignin"
| "InvalidEndpoints"
| "InvalidCheck"
| "JWTSessionError"
| "MissingAdapter"
| "MissingAdapterMethods"
| "MissingAuthorize"
| "MissingSecret"
| "OAuthAccountNotLinked"
| "OAuthCallbackError"
| "OAuthProfileParseError"
| "SessionTokenError"
| "OAuthSignInError"
| "EmailSignInError"
| "SignOutError"
| "UnknownAction"
| "UnsupportedStrategy"
| "InvalidProvider"
| "UntrustedHost"
| "Verification"
| "MissingCSRF"
| "AccountNotLinked"
| "DuplicateConditionalUI"
| "MissingWebAuthnAutocomplete"
| "WebAuthnVerificationError"
| "ExperimentalFeatureNotEnabled"
/**
* Base error class for all Auth.js errors.
* It's optimized to be printed in the server logs in a nicely formatted way
* via the [`logger.error`](https://authjs.dev/reference/core#logger) option.
*/
export class AuthError extends Error {
/** The error type. Used to identify the error in the logs. */
type: ErrorType
/**
* Determines on which page an error should be handled. Typically `signIn` errors can be handled in-page.
* Default is `"error"`.
* @internal
*/
kind?: "signIn" | "error"
cause?: Record<string, unknown> & { err?: Error }
constructor(
message?: string | Error | ErrorOptions,
errorOptions?: ErrorOptions
) {
if (message instanceof Error) {
super(undefined, {
cause: { err: message, ...(message.cause as any), ...errorOptions },
})
} else if (typeof message === "string") {
if (errorOptions instanceof Error) {
errorOptions = { err: errorOptions, ...(errorOptions.cause as any) }
}
super(message, errorOptions)
} else {
super(undefined, message)
}
this.name = this.constructor.name
// @ts-expect-error https://github.com/microsoft/TypeScript/issues/3841
this.type = this.constructor.type ?? "AuthError"
// @ts-expect-error https://github.com/microsoft/TypeScript/issues/3841
this.kind = this.constructor.kind ?? "error"
Error.captureStackTrace?.(this, this.constructor)
const url = `https://errors.authjs.dev#${this.type.toLowerCase()}`
this.message += `${this.message ? ". " : ""}Read more at ${url}`
}
}
export class SignInError extends AuthError {
static kind = "signIn"
}
/**
* One of the database [`Adapter` methods](https://authjs.dev/reference/core/adapters#methods)
* failed during execution.
*
* :::tip
* If `debug: true` is set, you can check out `[auth][debug]` in the logs to learn more about the failed adapter method execution.
* @example
* ```sh
* [auth][debug]: adapter_getUserByEmail
* { "args": [undefined] }
* ```
* :::
*/
export class AdapterError extends AuthError {
static type = "AdapterError"
}
/**
* Thrown when the execution of the [`signIn` callback](https://authjs.dev/reference/core/types#signin) fails
* or if it returns `false`.
*/
export class AccessDenied extends AuthError {
static type = "AccessDenied"
}
/**
* This error occurs when the user cannot finish login.
* Depending on the provider type, this could have happened for multiple reasons.
*
* :::tip
* Check out `[auth][details]` in the logs to know which provider failed.
* @example
* ```sh
* [auth][details]: { "provider": "github" }
* ```
* :::
*
* For an [OAuth provider](https://authjs.dev/getting-started/authentication/oauth), possible causes are:
* - The user denied access to the application
* - There was an error parsing the OAuth Profile:
* Check out the provider's `profile` or `userinfo.request` method to make sure
* it correctly fetches the user's profile.
* - The `signIn` or `jwt` callback methods threw an uncaught error:
* Check the callback method implementations.
*
* For an [Email provider](https://authjs.dev/getting-started/authentication/email), possible causes are:
* - The provided email/token combination was invalid/missing:
* Check if the provider's `sendVerificationRequest` method correctly sends the email.
* - The provided email/token combination has expired:
* Ask the user to log in again.
* - There was an error with the database:
* Check the database logs.
*
* For a [Credentials provider](https://authjs.dev/getting-started/authentication/credentials), possible causes are:
* - The `authorize` method threw an uncaught error:
* Check the provider's `authorize` method.
* - The `signIn` or `jwt` callback methods threw an uncaught error:
* Check the callback method implementations.
*
* :::tip
* Check out `[auth][cause]` in the error message for more details.
* It will show the original stack trace.
* :::
*/
export class CallbackRouteError extends AuthError {
static type = "CallbackRouteError"
}
/**
* Thrown when Auth.js is misconfigured and accidentally tried to require authentication on a custom error page.
* To prevent an infinite loop, Auth.js will instead render its default error page.
*
* To fix this, make sure that the `error` page does not require authentication.
*
* Learn more at [Guide: Error pages](https://authjs.dev/guides/pages/error)
*/
export class ErrorPageLoop extends AuthError {
static type = "ErrorPageLoop"
}
/**
* One of the [`events` methods](https://authjs.dev/reference/core/types#eventcallbacks)
* failed during execution.
*
* Make sure that the `events` methods are implemented correctly and uncaught errors are handled.
*
* Learn more at [`events`](https://authjs.dev/reference/core/types#eventcallbacks)
*/
export class EventError extends AuthError {
static type = "EventError"
}
/**
* Thrown when Auth.js is unable to verify a `callbackUrl` value.
* The browser either disabled cookies or the `callbackUrl` is not a valid URL.
*
* Somebody might have tried to manipulate the callback URL that Auth.js uses to redirect the user back to the configured `callbackUrl`/page.
* This could be a malicious hacker trying to redirect the user to a phishing site.
* To prevent this, Auth.js checks if the callback URL is valid and throws this error if it is not.
*
* There is no action required, but it might be an indicator that somebody is trying to attack your application.
*/
export class InvalidCallbackUrl extends AuthError {
static type = "InvalidCallbackUrl"
}
/**
* Can be thrown from the `authorize` callback of the Credentials provider.
* When an error occurs during the `authorize` callback, two things can happen:
* 1. The user is redirected to the signin page, with `error=CredentialsSignin&code=credentials` in the URL. `code` is configurable.
* 2. If you throw this error in a framework that handles form actions server-side, this error is thrown, instead of redirecting the user, so you'll need to handle.
*/
export class CredentialsSignin extends SignInError {
static type = "CredentialsSignin"
/**
* The error code that is set in the `code` query parameter of the redirect URL.
*
*
* ⚠ NOTE: This property is going to be included in the URL, so make sure it does not hint at sensitive errors.
*
* The full error is always logged on the server, if you need to debug.
*
* Generally, we don't recommend hinting specifically if the user had either a wrong username or password specifically,
* try rather something like "Invalid credentials".
*/
code: string = "credentials"
}
/**
* One of the configured OAuth or OIDC providers is missing the `authorization`, `token` or `userinfo`, or `issuer` configuration.
* To perform OAuth or OIDC sign in, at least one of these endpoints is required.
*
* Learn more at [`OAuth2Config`](https://authjs.dev/reference/core/providers#oauth2configprofile) or [Guide: OAuth Provider](https://authjs.dev/guides/configuring-oauth-providers)
*/
export class InvalidEndpoints extends AuthError {
static type = "InvalidEndpoints"
}
/**
* Thrown when a PKCE, state or nonce OAuth check could not be performed.
* This could happen if the OAuth provider is configured incorrectly or if the browser is blocking cookies.
*
* Learn more at [`checks`](https://authjs.dev/reference/core/providers#checks)
*/
export class InvalidCheck extends AuthError {
static type = "InvalidCheck"
}
/**
* Logged on the server when Auth.js could not decode or encode a JWT-based (`strategy: "jwt"`) session.
*
* Possible causes are either a misconfigured `secret` or a malformed JWT or `encode/decode` methods.
*
* :::note
* When this error is logged, the session cookie is destroyed.
* :::
*
* Learn more at [`secret`](https://authjs.dev/reference/core#secret), [`jwt.encode`](https://authjs.dev/reference/core/jwt#encode-1) or [`jwt.decode`](https://authjs.dev/reference/core/jwt#decode-2) for more information.
*/
export class JWTSessionError extends AuthError {
static type = "JWTSessionError"
}
/**
* Thrown if Auth.js is misconfigured. This could happen if you configured an Email provider but did not set up a database adapter,
* or tried using a `strategy: "database"` session without a database adapter.
* In both cases, make sure you either remove the configuration or add the missing adapter.
*
* Learn more at [Database Adapters](https://authjs.dev/getting-started/database), [Email provider](https://authjs.dev/getting-started/authentication/email) or [Concept: Database session strategy](https://authjs.dev/concepts/session-strategies#database-session)
*/
export class MissingAdapter extends AuthError {
static type = "MissingAdapter"
}
/**
* Thrown similarily to [`MissingAdapter`](https://authjs.dev/reference/core/errors#missingadapter), but only some required methods were missing.
*
* Make sure you either remove the configuration or add the missing methods to the adapter.
*
* Learn more at [Database Adapters](https://authjs.dev/getting-started/database)
*/
export class MissingAdapterMethods extends AuthError {
static type = "MissingAdapterMethods"
}
/**
* Thrown when a Credentials provider is missing the `authorize` configuration.
* To perform credentials sign in, the `authorize` method is required.
*
* Learn more at [Credentials provider](https://authjs.dev/getting-started/authentication/credentials)
*/
export class MissingAuthorize extends AuthError {
static type = "MissingAuthorize"
}
/**
* Auth.js requires a secret or multiple secrets to be set, but none was not found. This is used to encrypt cookies, JWTs and other sensitive data.
*
* :::note
* If you are using a framework like Next.js, we try to automatically infer the secret from the `AUTH_SECRET`, `AUTH_SECRET_1`, etc. environment variables.
* Alternatively, you can also explicitly set the [`AuthConfig.secret`](https://authjs.dev/reference/core#secret) option.
* :::
*
*
* :::tip
* To generate a random string, you can use the Auth.js CLI: `npx auth secret`
* :::
*/
export class MissingSecret extends AuthError {
static type = "MissingSecret"
}
/**
* Thrown when an Email address is already associated with an account
* but the user is trying an OAuth account that is not linked to it.
*
* For security reasons, Auth.js does not automatically link OAuth accounts to existing accounts if the user is not signed in.
*
* :::tip
* If you trust the OAuth provider to have verified the user's email address,
* you can enable automatic account linking by setting [`allowDangerousEmailAccountLinking: true`](https://authjs.dev/reference/core/providers#allowdangerousemailaccountlinking)
* in the provider configuration.
* :::
*/
export class OAuthAccountNotLinked extends SignInError {
static type = "OAuthAccountNotLinked"
}
/**
* Thrown when an OAuth provider returns an error during the sign in process.
* This could happen for example if the user denied access to the application or there was a configuration error.
*
* For a full list of possible reasons, check out the specification [Authorization Code Grant: Error Response](https://www.rfc-editor.org/rfc/rfc6749#section-4.1.2.1)
*/
export class OAuthCallbackError extends SignInError {
static type = "OAuthCallbackError"
}
/**
* This error occurs during an OAuth sign in attempt when the provider's
* response could not be parsed. This could for example happen if the provider's API
* changed, or the [`OAuth2Config.profile`](https://authjs.dev/reference/core/providers#oauth2configprofile) method is not implemented correctly.
*/
export class OAuthProfileParseError extends AuthError {
static type = "OAuthProfileParseError"
}
/**
* Logged on the server when Auth.js could not retrieve a session from the database (`strategy: "database"`).
*
* The database adapter might be misconfigured or the database is not reachable.
*
* Learn more at [Concept: Database session strategy](https://authjs.dev/concepts/session-strategies#database)
*/
export class SessionTokenError extends AuthError {
static type = "SessionTokenError"
}
/**
* Happens when login by [OAuth](https://authjs.dev/getting-started/authentication/oauth) could not be started.
*
* Possible causes are:
* - The Authorization Server is not compliant with the [OAuth 2.0](https://www.ietf.org/rfc/rfc6749.html) or the [OIDC](https://openid.net/specs/openid-connect-core-1_0.html) specification.
* Check the details in the error message.
*
* :::tip
* Check out `[auth][details]` in the logs to know which provider failed.
* @example
* ```sh
* [auth][details]: { "provider": "github" }
* ```
* :::
*/
export class OAuthSignInError extends SignInError {
static type = "OAuthSignInError"
}
/**
* Happens when the login by an [Email provider](https://authjs.dev/getting-started/authentication/email) could not be started.
*
* Possible causes are:
* - The email sent from the client is invalid, could not be normalized by [`EmailConfig.normalizeIdentifier`](https://authjs.dev/reference/core/providers/email#normalizeidentifier)
* - The provided email/token combination has expired:
* Ask the user to log in again.
* - There was an error with the database:
* Check the database logs.
*/
export class EmailSignInError extends SignInError {
static type = "EmailSignInError"
}
/**
* Represents an error that occurs during the sign-out process. This error
* is logged when there are issues in terminating a user's session, either
* by failing to delete the session from the database (in database session
* strategies) or encountering issues during other parts of the sign-out
* process, such as emitting sign-out events or clearing session cookies.
*
* The session cookie(s) are emptied even if this error is logged.
*
*/
export class SignOutError extends AuthError {
static type = "SignOutError"
}
/**
* Auth.js was requested to handle an operation that it does not support.
*
* See [`AuthAction`](https://authjs.dev/reference/core/types#authaction) for the supported actions.
*/
export class UnknownAction extends AuthError {
static type = "UnknownAction"
}
/**
* Thrown when a Credentials provider is present but the JWT strategy (`strategy: "jwt"`) is not enabled.
*
* Learn more at [`strategy`](https://authjs.dev/reference/core#strategy) or [Credentials provider](https://authjs.dev/getting-started/authentication/credentials)
*/
export class UnsupportedStrategy extends AuthError {
static type = "UnsupportedStrategy"
}
/** Thrown when an endpoint was incorrectly called without a provider, or with an unsupported provider. */
export class InvalidProvider extends AuthError {
static type = "InvalidProvider"
}
/**
* Thrown when the `trustHost` option was not set to `true`.
*
* Auth.js requires the `trustHost` option to be set to `true` since it's relying on the request headers' `host` value.
*
* :::note
* Official Auth.js libraries might attempt to automatically set the `trustHost` option to `true` if the request is coming from a trusted host on a trusted platform.
* :::
*
* Learn more at [`trustHost`](https://authjs.dev/reference/core#trusthost) or [Guide: Deployment](https://authjs.dev/getting-started/deployment)
*/
export class UntrustedHost extends AuthError {
static type = "UntrustedHost"
}
/**
* The user's email/token combination was invalid.
* This could be because the email/token combination was not found in the database,
* or because the token has expired. Ask the user to log in again.
*/
export class Verification extends AuthError {
static type = "Verification"
}
/**
* Error for missing CSRF tokens in client-side actions (`signIn`, `signOut`, `useSession#update`).
* Thrown when actions lack the double submit cookie, essential for CSRF protection.
*
* CSRF ([Cross-Site Request Forgery](https://owasp.org/www-community/attacks/csrf))
* is an attack leveraging authenticated user credentials for unauthorized actions.
*
* Double submit cookie pattern, a CSRF defense, requires matching values in a cookie
* and request parameter. More on this at [MDN Web Docs](https://developer.mozilla.org/en-US/docs/Glossary/CSRF).
*/
export class MissingCSRF extends SignInError {
static type = "MissingCSRF"
}
const clientErrors = new Set<ErrorType>([
"CredentialsSignin",
"OAuthAccountNotLinked",
"OAuthCallbackError",
"AccessDenied",
"Verification",
"MissingCSRF",
"AccountNotLinked",
"WebAuthnVerificationError",
])
/**
* Used to only allow sending a certain subset of errors to the client.
* Errors are always logged on the server, but to prevent leaking sensitive information,
* only a subset of errors are sent to the client as-is.
* @internal
*/
export function isClientError(error: Error): error is AuthError {
if (error instanceof AuthError) return clientErrors.has(error.type)
return false
}
/**
* Thrown when multiple providers have `enableConditionalUI` set to `true`.
* Only one provider can have this option enabled at a time.
*/
export class DuplicateConditionalUI extends AuthError {
static type = "DuplicateConditionalUI"
}
/**
* Thrown when a WebAuthn provider has `enableConditionalUI` set to `true` but no formField has `webauthn` in its autocomplete param.
*
* The `webauthn` autocomplete param is required for conditional UI to work.
*/
export class MissingWebAuthnAutocomplete extends AuthError {
static type = "MissingWebAuthnAutocomplete"
}
/**
* Thrown when a WebAuthn provider fails to verify a client response.
*/
export class WebAuthnVerificationError extends AuthError {
static type = "WebAuthnVerificationError"
}
/**
* Thrown when an Email address is already associated with an account
* but the user is trying an account that is not linked to it.
*
* For security reasons, Auth.js does not automatically link accounts to existing accounts if the user is not signed in.
*/
export class AccountNotLinked extends SignInError {
static type = "AccountNotLinked"
}
/**
* Thrown when an experimental feature is used but not enabled.
*/
export class ExperimentalFeatureNotEnabled extends AuthError {
static type = "ExperimentalFeatureNotEnabled"
}