691 lines
31 KiB
JavaScript
691 lines
31 KiB
JavaScript
/*! firebase-admin v14.0.0 */
|
|
"use strict";
|
|
/*!
|
|
* Copyright 2026 Google LLC
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
exports.FirebaseAuthError = exports.authClientErrorCode = exports.AuthErrorCode = void 0;
|
|
const error_1 = require("../utils/error");
|
|
const deep_copy_1 = require("../utils/deep-copy");
|
|
/**
|
|
* The constant mapping for valid Auth client error codes.
|
|
*/
|
|
exports.AuthErrorCode = {
|
|
AUTH_BLOCKING_TOKEN_EXPIRED: 'auth-blocking-token-expired',
|
|
BILLING_NOT_ENABLED: 'billing-not-enabled',
|
|
CLAIMS_TOO_LARGE: 'claims-too-large',
|
|
CONFIGURATION_EXISTS: 'configuration-exists',
|
|
CONFIGURATION_NOT_FOUND: 'configuration-not-found',
|
|
ID_TOKEN_EXPIRED: 'id-token-expired',
|
|
INVALID_ARGUMENT: 'argument-error',
|
|
INVALID_CONFIG: 'invalid-config',
|
|
EMAIL_ALREADY_EXISTS: 'email-already-exists',
|
|
EMAIL_NOT_FOUND: 'email-not-found',
|
|
FORBIDDEN_CLAIM: 'reserved-claim',
|
|
INVALID_ID_TOKEN: 'invalid-id-token',
|
|
ID_TOKEN_REVOKED: 'id-token-revoked',
|
|
INTERNAL_ERROR: 'internal-error',
|
|
INVALID_CLAIMS: 'invalid-claims',
|
|
INVALID_CONTINUE_URI: 'invalid-continue-uri',
|
|
INVALID_CREATION_TIME: 'invalid-creation-time',
|
|
INVALID_CREDENTIAL: 'invalid-credential',
|
|
INVALID_DISABLED_FIELD: 'invalid-disabled-field',
|
|
INVALID_DISPLAY_NAME: 'invalid-display-name',
|
|
INVALID_DYNAMIC_LINK_DOMAIN: 'invalid-dynamic-link-domain',
|
|
INVALID_HOSTING_LINK_DOMAIN: 'invalid-hosting-link-domain',
|
|
INVALID_EMAIL_VERIFIED: 'invalid-email-verified',
|
|
INVALID_EMAIL: 'invalid-email',
|
|
INVALID_NEW_EMAIL: 'invalid-new-email',
|
|
INVALID_ENROLLED_FACTORS: 'invalid-enrolled-factors',
|
|
INVALID_ENROLLMENT_TIME: 'invalid-enrollment-time',
|
|
INVALID_HASH_ALGORITHM: 'invalid-hash-algorithm',
|
|
INVALID_HASH_BLOCK_SIZE: 'invalid-hash-block-size',
|
|
INVALID_HASH_DERIVED_KEY_LENGTH: 'invalid-hash-derived-key-length',
|
|
INVALID_HASH_KEY: 'invalid-hash-key',
|
|
INVALID_HASH_MEMORY_COST: 'invalid-hash-memory-cost',
|
|
INVALID_HASH_PARALLELIZATION: 'invalid-hash-parallelization',
|
|
INVALID_HASH_ROUNDS: 'invalid-hash-rounds',
|
|
INVALID_HASH_SALT_SEPARATOR: 'invalid-hash-salt-separator',
|
|
INVALID_LAST_SIGN_IN_TIME: 'invalid-last-sign-in-time',
|
|
INVALID_NAME: 'invalid-name',
|
|
INVALID_OAUTH_CLIENT_ID: 'invalid-oauth-client-id',
|
|
INVALID_PAGE_TOKEN: 'invalid-page-token',
|
|
INVALID_PASSWORD: 'invalid-password',
|
|
INVALID_PASSWORD_HASH: 'invalid-password-hash',
|
|
INVALID_PASSWORD_SALT: 'invalid-password-salt',
|
|
INVALID_PHONE_NUMBER: 'invalid-phone-number',
|
|
INVALID_PHOTO_URL: 'invalid-photo-url',
|
|
INVALID_PROJECT_ID: 'invalid-project-id',
|
|
INVALID_PROVIDER_DATA: 'invalid-provider-data',
|
|
INVALID_PROVIDER_ID: 'invalid-provider-id',
|
|
INVALID_PROVIDER_UID: 'invalid-provider-uid',
|
|
INVALID_OAUTH_RESPONSETYPE: 'invalid-oauth-responsetype',
|
|
INVALID_SESSION_COOKIE_DURATION: 'invalid-session-cookie-duration',
|
|
INVALID_TENANT_ID: 'invalid-tenant-id',
|
|
INVALID_TENANT_TYPE: 'invalid-tenant-type',
|
|
INVALID_TESTING_PHONE_NUMBER: 'invalid-testing-phone-number',
|
|
INVALID_UID: 'invalid-uid',
|
|
INVALID_USER_IMPORT: 'invalid-user-import',
|
|
INVALID_TOKENS_VALID_AFTER_TIME: 'invalid-tokens-valid-after-time',
|
|
MISMATCHING_TENANT_ID: 'mismatching-tenant-id',
|
|
MISSING_ANDROID_PACKAGE_NAME: 'missing-android-package-name',
|
|
MISSING_CONFIG: 'missing-config',
|
|
MISSING_CONTINUE_URI: 'missing-continue-uri',
|
|
MISSING_DISPLAY_NAME: 'missing-display-name',
|
|
MISSING_EMAIL: 'missing-email',
|
|
MISSING_IOS_BUNDLE_ID: 'missing-ios-bundle-id',
|
|
MISSING_ISSUER: 'missing-issuer',
|
|
MISSING_HASH_ALGORITHM: 'missing-hash-algorithm',
|
|
MISSING_OAUTH_CLIENT_ID: 'missing-oauth-client-id',
|
|
MISSING_OAUTH_CLIENT_SECRET: 'missing-oauth-client-secret',
|
|
MISSING_PROVIDER_ID: 'missing-provider-id',
|
|
MISSING_SAML_RELYING_PARTY_CONFIG: 'missing-saml-relying-party-config',
|
|
MAXIMUM_TEST_PHONE_NUMBER_EXCEEDED: 'test-phone-number-limit-exceeded',
|
|
MAXIMUM_USER_COUNT_EXCEEDED: 'maximum-user-count-exceeded',
|
|
MISSING_UID: 'missing-uid',
|
|
OPERATION_NOT_ALLOWED: 'operation-not-allowed',
|
|
PHONE_NUMBER_ALREADY_EXISTS: 'phone-number-already-exists',
|
|
PROJECT_NOT_FOUND: 'project-not-found',
|
|
INSUFFICIENT_PERMISSION: 'insufficient-permission',
|
|
QUOTA_EXCEEDED: 'quota-exceeded',
|
|
SECOND_FACTOR_LIMIT_EXCEEDED: 'second-factor-limit-exceeded',
|
|
SECOND_FACTOR_UID_ALREADY_EXISTS: 'second-factor-uid-already-exists',
|
|
SESSION_COOKIE_EXPIRED: 'session-cookie-expired',
|
|
SESSION_COOKIE_REVOKED: 'session-cookie-revoked',
|
|
TENANT_NOT_FOUND: 'tenant-not-found',
|
|
UID_ALREADY_EXISTS: 'uid-already-exists',
|
|
UNAUTHORIZED_DOMAIN: 'unauthorized-continue-uri',
|
|
UNSUPPORTED_FIRST_FACTOR: 'unsupported-first-factor',
|
|
UNSUPPORTED_SECOND_FACTOR: 'unsupported-second-factor',
|
|
UNSUPPORTED_TENANT_OPERATION: 'unsupported-tenant-operation',
|
|
UNVERIFIED_EMAIL: 'unverified-email',
|
|
USER_NOT_FOUND: 'user-not-found',
|
|
NOT_FOUND: 'not-found',
|
|
USER_DISABLED: 'user-disabled',
|
|
USER_NOT_DISABLED: 'user-not-disabled',
|
|
INVALID_RECAPTCHA_ACTION: 'invalid-recaptcha-action',
|
|
INVALID_RECAPTCHA_ENFORCEMENT_STATE: 'invalid-recaptcha-enforcement-state',
|
|
RECAPTCHA_NOT_ENABLED: 'recaptcha-not-enabled',
|
|
};
|
|
/**
|
|
* Internal Auth client error code mapping used to construct ErrorInfo.
|
|
*/
|
|
exports.authClientErrorCode = {
|
|
AUTH_BLOCKING_TOKEN_EXPIRED: {
|
|
code: exports.AuthErrorCode.AUTH_BLOCKING_TOKEN_EXPIRED,
|
|
message: 'The provided Firebase Auth Blocking token is expired.',
|
|
},
|
|
BILLING_NOT_ENABLED: {
|
|
code: exports.AuthErrorCode.BILLING_NOT_ENABLED,
|
|
message: 'Feature requires billing to be enabled.',
|
|
},
|
|
CLAIMS_TOO_LARGE: {
|
|
code: exports.AuthErrorCode.CLAIMS_TOO_LARGE,
|
|
message: 'Developer claims maximum payload size exceeded.',
|
|
},
|
|
CONFIGURATION_EXISTS: {
|
|
code: exports.AuthErrorCode.CONFIGURATION_EXISTS,
|
|
message: 'A configuration already exists with the provided identifier.',
|
|
},
|
|
CONFIGURATION_NOT_FOUND: {
|
|
code: exports.AuthErrorCode.CONFIGURATION_NOT_FOUND,
|
|
message: 'There is no configuration corresponding to the provided identifier.',
|
|
},
|
|
ID_TOKEN_EXPIRED: {
|
|
code: exports.AuthErrorCode.ID_TOKEN_EXPIRED,
|
|
message: 'The provided Firebase ID token is expired.',
|
|
},
|
|
INVALID_ARGUMENT: {
|
|
code: exports.AuthErrorCode.INVALID_ARGUMENT,
|
|
message: 'Invalid argument provided.',
|
|
},
|
|
INVALID_CONFIG: {
|
|
code: exports.AuthErrorCode.INVALID_CONFIG,
|
|
message: 'The provided configuration is invalid.',
|
|
},
|
|
EMAIL_ALREADY_EXISTS: {
|
|
code: exports.AuthErrorCode.EMAIL_ALREADY_EXISTS,
|
|
message: 'The email address is already in use by another account.',
|
|
},
|
|
EMAIL_NOT_FOUND: {
|
|
code: exports.AuthErrorCode.EMAIL_NOT_FOUND,
|
|
message: 'There is no user record corresponding to the provided email.',
|
|
},
|
|
FORBIDDEN_CLAIM: {
|
|
code: exports.AuthErrorCode.FORBIDDEN_CLAIM,
|
|
message: 'The specified developer claim is reserved and cannot be specified.',
|
|
},
|
|
INVALID_ID_TOKEN: {
|
|
code: exports.AuthErrorCode.INVALID_ID_TOKEN,
|
|
message: 'The provided ID token is not a valid Firebase ID token.',
|
|
},
|
|
ID_TOKEN_REVOKED: {
|
|
code: exports.AuthErrorCode.ID_TOKEN_REVOKED,
|
|
message: 'The Firebase ID token has been revoked.',
|
|
},
|
|
INTERNAL_ERROR: {
|
|
code: exports.AuthErrorCode.INTERNAL_ERROR,
|
|
message: 'An internal error has occurred.',
|
|
},
|
|
INVALID_CLAIMS: {
|
|
code: exports.AuthErrorCode.INVALID_CLAIMS,
|
|
message: 'The provided custom claim attributes are invalid.',
|
|
},
|
|
INVALID_CONTINUE_URI: {
|
|
code: exports.AuthErrorCode.INVALID_CONTINUE_URI,
|
|
message: 'The continue URL must be a valid URL string.',
|
|
},
|
|
INVALID_CREATION_TIME: {
|
|
code: exports.AuthErrorCode.INVALID_CREATION_TIME,
|
|
message: 'The creation time must be a valid UTC date string.',
|
|
},
|
|
INVALID_CREDENTIAL: {
|
|
code: exports.AuthErrorCode.INVALID_CREDENTIAL,
|
|
message: 'Invalid credential object provided.',
|
|
},
|
|
INVALID_DISABLED_FIELD: {
|
|
code: exports.AuthErrorCode.INVALID_DISABLED_FIELD,
|
|
message: 'The disabled field must be a boolean.',
|
|
},
|
|
INVALID_DISPLAY_NAME: {
|
|
code: exports.AuthErrorCode.INVALID_DISPLAY_NAME,
|
|
message: 'The displayName field must be a valid string.',
|
|
},
|
|
INVALID_DYNAMIC_LINK_DOMAIN: {
|
|
code: exports.AuthErrorCode.INVALID_DYNAMIC_LINK_DOMAIN,
|
|
message: 'The provided dynamic link domain is not configured or authorized for the current project.',
|
|
},
|
|
INVALID_HOSTING_LINK_DOMAIN: {
|
|
code: exports.AuthErrorCode.INVALID_HOSTING_LINK_DOMAIN,
|
|
message: 'The provided hosting link domain is not configured in Firebase Hosting or ' +
|
|
'is not owned by the current project.',
|
|
},
|
|
INVALID_EMAIL_VERIFIED: {
|
|
code: exports.AuthErrorCode.INVALID_EMAIL_VERIFIED,
|
|
message: 'The emailVerified field must be a boolean.',
|
|
},
|
|
INVALID_EMAIL: {
|
|
code: exports.AuthErrorCode.INVALID_EMAIL,
|
|
message: 'The email address is improperly formatted.',
|
|
},
|
|
INVALID_NEW_EMAIL: {
|
|
code: exports.AuthErrorCode.INVALID_NEW_EMAIL,
|
|
message: 'The new email address is improperly formatted.',
|
|
},
|
|
INVALID_ENROLLED_FACTORS: {
|
|
code: exports.AuthErrorCode.INVALID_ENROLLED_FACTORS,
|
|
message: 'The enrolled factors must be a valid array of MultiFactorInfo objects.',
|
|
},
|
|
INVALID_ENROLLMENT_TIME: {
|
|
code: exports.AuthErrorCode.INVALID_ENROLLMENT_TIME,
|
|
message: 'The second factor enrollment time must be a valid UTC date string.',
|
|
},
|
|
INVALID_HASH_ALGORITHM: {
|
|
code: exports.AuthErrorCode.INVALID_HASH_ALGORITHM,
|
|
message: 'The hash algorithm must match one of the strings in the list of supported algorithms.',
|
|
},
|
|
INVALID_HASH_BLOCK_SIZE: {
|
|
code: exports.AuthErrorCode.INVALID_HASH_BLOCK_SIZE,
|
|
message: 'The hash block size must be a valid number.',
|
|
},
|
|
INVALID_HASH_DERIVED_KEY_LENGTH: {
|
|
code: exports.AuthErrorCode.INVALID_HASH_DERIVED_KEY_LENGTH,
|
|
message: 'The hash derived key length must be a valid number.',
|
|
},
|
|
INVALID_HASH_KEY: {
|
|
code: exports.AuthErrorCode.INVALID_HASH_KEY,
|
|
message: 'The hash key must a valid byte buffer.',
|
|
},
|
|
INVALID_HASH_MEMORY_COST: {
|
|
code: exports.AuthErrorCode.INVALID_HASH_MEMORY_COST,
|
|
message: 'The hash memory cost must be a valid number.',
|
|
},
|
|
INVALID_HASH_PARALLELIZATION: {
|
|
code: exports.AuthErrorCode.INVALID_HASH_PARALLELIZATION,
|
|
message: 'The hash parallelization must be a valid number.',
|
|
},
|
|
INVALID_HASH_ROUNDS: {
|
|
code: exports.AuthErrorCode.INVALID_HASH_ROUNDS,
|
|
message: 'The hash rounds must be a valid number.',
|
|
},
|
|
INVALID_HASH_SALT_SEPARATOR: {
|
|
code: exports.AuthErrorCode.INVALID_HASH_SALT_SEPARATOR,
|
|
message: 'The hashing algorithm salt separator field must be a valid byte buffer.',
|
|
},
|
|
INVALID_LAST_SIGN_IN_TIME: {
|
|
code: exports.AuthErrorCode.INVALID_LAST_SIGN_IN_TIME,
|
|
message: 'The last sign-in time must be a valid UTC date string.',
|
|
},
|
|
INVALID_NAME: {
|
|
code: exports.AuthErrorCode.INVALID_NAME,
|
|
message: 'The resource name provided is invalid.',
|
|
},
|
|
INVALID_OAUTH_CLIENT_ID: {
|
|
code: exports.AuthErrorCode.INVALID_OAUTH_CLIENT_ID,
|
|
message: 'The provided OAuth client ID is invalid.',
|
|
},
|
|
INVALID_PAGE_TOKEN: {
|
|
code: exports.AuthErrorCode.INVALID_PAGE_TOKEN,
|
|
message: 'The page token must be a valid non-empty string.',
|
|
},
|
|
INVALID_PASSWORD: {
|
|
code: exports.AuthErrorCode.INVALID_PASSWORD,
|
|
message: 'The password must be a string with at least 6 characters.',
|
|
},
|
|
INVALID_PASSWORD_HASH: {
|
|
code: exports.AuthErrorCode.INVALID_PASSWORD_HASH,
|
|
message: 'The password hash must be a valid byte buffer.',
|
|
},
|
|
INVALID_PASSWORD_SALT: {
|
|
code: exports.AuthErrorCode.INVALID_PASSWORD_SALT,
|
|
message: 'The password salt must be a valid byte buffer.',
|
|
},
|
|
INVALID_PHONE_NUMBER: {
|
|
code: exports.AuthErrorCode.INVALID_PHONE_NUMBER,
|
|
message: 'The phone number must be a non-empty E.164 standard compliant identifier string.',
|
|
},
|
|
INVALID_PHOTO_URL: {
|
|
code: exports.AuthErrorCode.INVALID_PHOTO_URL,
|
|
message: 'The photoURL field must be a valid URL.',
|
|
},
|
|
INVALID_PROJECT_ID: {
|
|
code: exports.AuthErrorCode.INVALID_PROJECT_ID,
|
|
message: 'Invalid parent project. Either parent project doesn\'t exist or didn\'t enable multi-tenancy.',
|
|
},
|
|
INVALID_PROVIDER_DATA: {
|
|
code: exports.AuthErrorCode.INVALID_PROVIDER_DATA,
|
|
message: 'The providerData must be a valid array of UserInfo objects.',
|
|
},
|
|
INVALID_PROVIDER_ID: {
|
|
code: exports.AuthErrorCode.INVALID_PROVIDER_ID,
|
|
message: 'The providerId must be a valid supported provider identifier string.',
|
|
},
|
|
INVALID_PROVIDER_UID: {
|
|
code: exports.AuthErrorCode.INVALID_PROVIDER_UID,
|
|
message: 'The providerUid must be a valid provider uid string.',
|
|
},
|
|
INVALID_OAUTH_RESPONSETYPE: {
|
|
code: exports.AuthErrorCode.INVALID_OAUTH_RESPONSETYPE,
|
|
message: 'Only exactly one OAuth responseType should be set to true.',
|
|
},
|
|
INVALID_SESSION_COOKIE_DURATION: {
|
|
code: exports.AuthErrorCode.INVALID_SESSION_COOKIE_DURATION,
|
|
message: 'The session cookie duration must be a valid number in milliseconds between 5 minutes and 2 weeks.',
|
|
},
|
|
INVALID_TENANT_ID: {
|
|
code: exports.AuthErrorCode.INVALID_TENANT_ID,
|
|
message: 'The tenant ID must be a valid non-empty string.',
|
|
},
|
|
INVALID_TENANT_TYPE: {
|
|
code: exports.AuthErrorCode.INVALID_TENANT_TYPE,
|
|
message: 'Tenant type must be either "full_service" or "lightweight".',
|
|
},
|
|
INVALID_TESTING_PHONE_NUMBER: {
|
|
code: exports.AuthErrorCode.INVALID_TESTING_PHONE_NUMBER,
|
|
message: 'Invalid testing phone number or invalid test code provided.',
|
|
},
|
|
INVALID_UID: {
|
|
code: exports.AuthErrorCode.INVALID_UID,
|
|
message: 'The uid must be a non-empty string with at most 128 characters.',
|
|
},
|
|
INVALID_USER_IMPORT: {
|
|
code: exports.AuthErrorCode.INVALID_USER_IMPORT,
|
|
message: 'The user record to import is invalid.',
|
|
},
|
|
INVALID_TOKENS_VALID_AFTER_TIME: {
|
|
code: exports.AuthErrorCode.INVALID_TOKENS_VALID_AFTER_TIME,
|
|
message: 'The tokensValidAfterTime must be a valid UTC number in seconds.',
|
|
},
|
|
MISMATCHING_TENANT_ID: {
|
|
code: exports.AuthErrorCode.MISMATCHING_TENANT_ID,
|
|
message: 'User tenant ID does not match with the current TenantAwareAuth tenant ID.',
|
|
},
|
|
MISSING_ANDROID_PACKAGE_NAME: {
|
|
code: exports.AuthErrorCode.MISSING_ANDROID_PACKAGE_NAME,
|
|
message: 'An Android Package Name must be provided if the Android App is required to be installed.',
|
|
},
|
|
MISSING_CONFIG: {
|
|
code: exports.AuthErrorCode.MISSING_CONFIG,
|
|
message: 'The provided configuration is missing required attributes.',
|
|
},
|
|
MISSING_CONTINUE_URI: {
|
|
code: exports.AuthErrorCode.MISSING_CONTINUE_URI,
|
|
message: 'A valid continue URL must be provided in the request.',
|
|
},
|
|
MISSING_DISPLAY_NAME: {
|
|
code: exports.AuthErrorCode.MISSING_DISPLAY_NAME,
|
|
message: 'The resource being created or edited is missing a valid display name.',
|
|
},
|
|
MISSING_EMAIL: {
|
|
code: exports.AuthErrorCode.MISSING_EMAIL,
|
|
message: 'The email is required for the specified action. For example, a multi-factor ' +
|
|
'user requires a verified email.',
|
|
},
|
|
MISSING_IOS_BUNDLE_ID: {
|
|
code: exports.AuthErrorCode.MISSING_IOS_BUNDLE_ID,
|
|
message: 'The request is missing an iOS Bundle ID.',
|
|
},
|
|
MISSING_ISSUER: {
|
|
code: exports.AuthErrorCode.MISSING_ISSUER,
|
|
message: 'The OAuth/OIDC configuration issuer must not be empty.',
|
|
},
|
|
MISSING_HASH_ALGORITHM: {
|
|
code: exports.AuthErrorCode.MISSING_HASH_ALGORITHM,
|
|
message: 'Importing users with password hashes requires that the hashing algorithm and its parameters be provided.',
|
|
},
|
|
MISSING_OAUTH_CLIENT_ID: {
|
|
code: exports.AuthErrorCode.MISSING_OAUTH_CLIENT_ID,
|
|
message: 'The OAuth/OIDC configuration client ID must not be empty.',
|
|
},
|
|
MISSING_OAUTH_CLIENT_SECRET: {
|
|
code: exports.AuthErrorCode.MISSING_OAUTH_CLIENT_SECRET,
|
|
message: 'The OAuth configuration client secret is required to enable OIDC code flow.',
|
|
},
|
|
MISSING_PROVIDER_ID: {
|
|
code: exports.AuthErrorCode.MISSING_PROVIDER_ID,
|
|
message: 'A valid provider ID must be provided in the request.',
|
|
},
|
|
MISSING_SAML_RELYING_PARTY_CONFIG: {
|
|
code: exports.AuthErrorCode.MISSING_SAML_RELYING_PARTY_CONFIG,
|
|
message: 'The SAML configuration provided is missing a relying party configuration.',
|
|
},
|
|
MAXIMUM_TEST_PHONE_NUMBER_EXCEEDED: {
|
|
code: exports.AuthErrorCode.MAXIMUM_TEST_PHONE_NUMBER_EXCEEDED,
|
|
message: 'The maximum allowed number of test phone number / code pairs has been exceeded.',
|
|
},
|
|
MAXIMUM_USER_COUNT_EXCEEDED: {
|
|
code: exports.AuthErrorCode.MAXIMUM_USER_COUNT_EXCEEDED,
|
|
message: 'The maximum allowed number of users to import has been exceeded.',
|
|
},
|
|
MISSING_UID: {
|
|
code: exports.AuthErrorCode.MISSING_UID,
|
|
message: 'A uid identifier is required for the current operation.',
|
|
},
|
|
OPERATION_NOT_ALLOWED: {
|
|
code: exports.AuthErrorCode.OPERATION_NOT_ALLOWED,
|
|
message: 'The given sign-in provider is disabled for this Firebase project. Enable it in the ' +
|
|
'Firebase console, under the sign-in method tab of the Auth section.',
|
|
},
|
|
PHONE_NUMBER_ALREADY_EXISTS: {
|
|
code: exports.AuthErrorCode.PHONE_NUMBER_ALREADY_EXISTS,
|
|
message: 'The user with the provided phone number already exists.',
|
|
},
|
|
PROJECT_NOT_FOUND: {
|
|
code: exports.AuthErrorCode.PROJECT_NOT_FOUND,
|
|
message: 'No Firebase project was found for the provided credential.',
|
|
},
|
|
INSUFFICIENT_PERMISSION: {
|
|
code: exports.AuthErrorCode.INSUFFICIENT_PERMISSION,
|
|
message: 'Credential implementation provided to initializeApp() via the "credential" property has insufficient permission to access the requested resource. See https://firebase.google.com/docs/admin/setup for details on how to authenticate this SDK with appropriate permissions.',
|
|
},
|
|
QUOTA_EXCEEDED: {
|
|
code: exports.AuthErrorCode.QUOTA_EXCEEDED,
|
|
message: 'The project quota for the specified operation has been exceeded.',
|
|
},
|
|
SECOND_FACTOR_LIMIT_EXCEEDED: {
|
|
code: exports.AuthErrorCode.SECOND_FACTOR_LIMIT_EXCEEDED,
|
|
message: 'The maximum number of allowed second factors on a user has been exceeded.',
|
|
},
|
|
SECOND_FACTOR_UID_ALREADY_EXISTS: {
|
|
code: exports.AuthErrorCode.SECOND_FACTOR_UID_ALREADY_EXISTS,
|
|
message: 'The specified second factor "uid" already exists.',
|
|
},
|
|
SESSION_COOKIE_EXPIRED: {
|
|
code: exports.AuthErrorCode.SESSION_COOKIE_EXPIRED,
|
|
message: 'The Firebase session cookie is expired.',
|
|
},
|
|
SESSION_COOKIE_REVOKED: {
|
|
code: exports.AuthErrorCode.SESSION_COOKIE_REVOKED,
|
|
message: 'The Firebase session cookie has been revoked.',
|
|
},
|
|
TENANT_NOT_FOUND: {
|
|
code: exports.AuthErrorCode.TENANT_NOT_FOUND,
|
|
message: 'There is no tenant corresponding to the provided identifier.',
|
|
},
|
|
UID_ALREADY_EXISTS: {
|
|
code: exports.AuthErrorCode.UID_ALREADY_EXISTS,
|
|
message: 'The user with the provided uid already exists.',
|
|
},
|
|
UNAUTHORIZED_DOMAIN: {
|
|
code: exports.AuthErrorCode.UNAUTHORIZED_DOMAIN,
|
|
message: 'The domain of the continue URL is not whitelisted. Whitelist the domain in the Firebase console.',
|
|
},
|
|
UNSUPPORTED_FIRST_FACTOR: {
|
|
code: exports.AuthErrorCode.UNSUPPORTED_FIRST_FACTOR,
|
|
message: 'A multi-factor user requires a supported first factor.',
|
|
},
|
|
UNSUPPORTED_SECOND_FACTOR: {
|
|
code: exports.AuthErrorCode.UNSUPPORTED_SECOND_FACTOR,
|
|
message: 'The request specified an unsupported type of second factor.',
|
|
},
|
|
UNSUPPORTED_TENANT_OPERATION: {
|
|
code: exports.AuthErrorCode.UNSUPPORTED_TENANT_OPERATION,
|
|
message: 'This operation is not supported in a multi-tenant context.',
|
|
},
|
|
UNVERIFIED_EMAIL: {
|
|
code: exports.AuthErrorCode.UNVERIFIED_EMAIL,
|
|
message: 'A verified email is required for the specified action. For example, a ' +
|
|
'multi-factor user requires a verified email.',
|
|
},
|
|
USER_NOT_FOUND: {
|
|
code: exports.AuthErrorCode.USER_NOT_FOUND,
|
|
message: 'There is no user record corresponding to the provided identifier.',
|
|
},
|
|
NOT_FOUND: {
|
|
code: exports.AuthErrorCode.NOT_FOUND,
|
|
message: 'The requested resource was not found.',
|
|
},
|
|
USER_DISABLED: {
|
|
code: exports.AuthErrorCode.USER_DISABLED,
|
|
message: 'The user record is disabled.',
|
|
},
|
|
USER_NOT_DISABLED: {
|
|
code: exports.AuthErrorCode.USER_NOT_DISABLED,
|
|
message: 'The user must be disabled in order to bulk delete it (or you must pass force=true).',
|
|
},
|
|
INVALID_RECAPTCHA_ACTION: {
|
|
code: exports.AuthErrorCode.INVALID_RECAPTCHA_ACTION,
|
|
message: 'reCAPTCHA action must be "BLOCK".',
|
|
},
|
|
INVALID_RECAPTCHA_ENFORCEMENT_STATE: {
|
|
code: exports.AuthErrorCode.INVALID_RECAPTCHA_ENFORCEMENT_STATE,
|
|
message: 'reCAPTCHA enforcement state must be either "OFF", "AUDIT" or "ENFORCE".',
|
|
},
|
|
RECAPTCHA_NOT_ENABLED: {
|
|
code: exports.AuthErrorCode.RECAPTCHA_NOT_ENABLED,
|
|
message: 'reCAPTCHA enterprise is not enabled.',
|
|
},
|
|
};
|
|
/** @const {Record<string, keyof typeof AuthErrorCode>} Auth server to client enum error codes. */
|
|
const AUTH_SERVER_TO_CLIENT_CODE = {
|
|
// Feature being configured or used requires a billing account.
|
|
BILLING_NOT_ENABLED: 'BILLING_NOT_ENABLED',
|
|
// Claims payload is too large.
|
|
CLAIMS_TOO_LARGE: 'CLAIMS_TOO_LARGE',
|
|
// Configuration being added already exists.
|
|
CONFIGURATION_EXISTS: 'CONFIGURATION_EXISTS',
|
|
// Configuration not found.
|
|
CONFIGURATION_NOT_FOUND: 'CONFIGURATION_NOT_FOUND',
|
|
// Provided credential has insufficient permissions.
|
|
INSUFFICIENT_PERMISSION: 'INSUFFICIENT_PERMISSION',
|
|
// Provided configuration has invalid fields.
|
|
INVALID_CONFIG: 'INVALID_CONFIG',
|
|
// Provided configuration identifier is invalid.
|
|
INVALID_CONFIG_ID: 'INVALID_PROVIDER_ID',
|
|
// ActionCodeSettings missing continue URL.
|
|
INVALID_CONTINUE_URI: 'INVALID_CONTINUE_URI',
|
|
// Dynamic link domain in provided ActionCodeSettings is not authorized.
|
|
INVALID_DYNAMIC_LINK_DOMAIN: 'INVALID_DYNAMIC_LINK_DOMAIN',
|
|
// Hosting link domain in provided ActionCodeSettings is not owned by the current project.
|
|
INVALID_HOSTING_LINK_DOMAIN: 'INVALID_HOSTING_LINK_DOMAIN',
|
|
// uploadAccount provides an email that already exists.
|
|
DUPLICATE_EMAIL: 'EMAIL_ALREADY_EXISTS',
|
|
// uploadAccount provides a localId that already exists.
|
|
DUPLICATE_LOCAL_ID: 'UID_ALREADY_EXISTS',
|
|
// Request specified a multi-factor enrollment ID that already exists.
|
|
DUPLICATE_MFA_ENROLLMENT_ID: 'SECOND_FACTOR_UID_ALREADY_EXISTS',
|
|
// setAccountInfo email already exists.
|
|
EMAIL_EXISTS: 'EMAIL_ALREADY_EXISTS',
|
|
// /accounts:sendOobCode for password reset when user is not found.
|
|
EMAIL_NOT_FOUND: 'EMAIL_NOT_FOUND',
|
|
// Reserved claim name.
|
|
FORBIDDEN_CLAIM: 'FORBIDDEN_CLAIM',
|
|
// Invalid claims provided.
|
|
INVALID_CLAIMS: 'INVALID_CLAIMS',
|
|
// Invalid session cookie duration.
|
|
INVALID_DURATION: 'INVALID_SESSION_COOKIE_DURATION',
|
|
// Invalid email provided.
|
|
INVALID_EMAIL: 'INVALID_EMAIL',
|
|
// Invalid new email provided.
|
|
INVALID_NEW_EMAIL: 'INVALID_NEW_EMAIL',
|
|
// Invalid tenant display name. This can be thrown on CreateTenant and UpdateTenant.
|
|
INVALID_DISPLAY_NAME: 'INVALID_DISPLAY_NAME',
|
|
// Invalid ID token provided.
|
|
INVALID_ID_TOKEN: 'INVALID_ID_TOKEN',
|
|
// Invalid tenant/parent resource name.
|
|
INVALID_NAME: 'INVALID_NAME',
|
|
// OIDC configuration has an invalid OAuth client ID.
|
|
INVALID_OAUTH_CLIENT_ID: 'INVALID_OAUTH_CLIENT_ID',
|
|
// Invalid page token.
|
|
INVALID_PAGE_SELECTION: 'INVALID_PAGE_TOKEN',
|
|
// Invalid phone number.
|
|
INVALID_PHONE_NUMBER: 'INVALID_PHONE_NUMBER',
|
|
// Invalid agent project. Either agent project doesn't exist or didn't enable multi-tenancy.
|
|
INVALID_PROJECT_ID: 'INVALID_PROJECT_ID',
|
|
// Invalid provider ID.
|
|
INVALID_PROVIDER_ID: 'INVALID_PROVIDER_ID',
|
|
// Invalid service account.
|
|
INVALID_SERVICE_ACCOUNT: 'INVALID_CREDENTIAL',
|
|
// Invalid testing phone number.
|
|
INVALID_TESTING_PHONE_NUMBER: 'INVALID_TESTING_PHONE_NUMBER',
|
|
// Invalid tenant type.
|
|
INVALID_TENANT_TYPE: 'INVALID_TENANT_TYPE',
|
|
// Missing Android package name.
|
|
MISSING_ANDROID_PACKAGE_NAME: 'MISSING_ANDROID_PACKAGE_NAME',
|
|
// Missing configuration.
|
|
MISSING_CONFIG: 'MISSING_CONFIG',
|
|
// Missing configuration identifier.
|
|
MISSING_CONFIG_ID: 'MISSING_PROVIDER_ID',
|
|
// Missing tenant display name: This can be thrown on CreateTenant and UpdateTenant.
|
|
MISSING_DISPLAY_NAME: 'MISSING_DISPLAY_NAME',
|
|
// Email is required for the specified action. For example a multi-factor user requires
|
|
// a verified email.
|
|
MISSING_EMAIL: 'MISSING_EMAIL',
|
|
// Missing iOS bundle ID.
|
|
MISSING_IOS_BUNDLE_ID: 'MISSING_IOS_BUNDLE_ID',
|
|
// Missing OIDC issuer.
|
|
MISSING_ISSUER: 'MISSING_ISSUER',
|
|
// No localId provided (deleteAccount missing localId).
|
|
MISSING_LOCAL_ID: 'MISSING_UID',
|
|
// OIDC configuration is missing an OAuth client ID.
|
|
MISSING_OAUTH_CLIENT_ID: 'MISSING_OAUTH_CLIENT_ID',
|
|
// Missing provider ID.
|
|
MISSING_PROVIDER_ID: 'MISSING_PROVIDER_ID',
|
|
// Missing SAML RP config.
|
|
MISSING_SAML_RELYING_PARTY_CONFIG: 'MISSING_SAML_RELYING_PARTY_CONFIG',
|
|
// Empty user list in uploadAccount.
|
|
MISSING_USER_ACCOUNT: 'MISSING_UID',
|
|
// Password auth disabled in console.
|
|
OPERATION_NOT_ALLOWED: 'OPERATION_NOT_ALLOWED',
|
|
// Provided credential has insufficient permissions.
|
|
PERMISSION_DENIED: 'INSUFFICIENT_PERMISSION',
|
|
// Phone number already exists.
|
|
PHONE_NUMBER_EXISTS: 'PHONE_NUMBER_ALREADY_EXISTS',
|
|
// Project not found.
|
|
PROJECT_NOT_FOUND: 'PROJECT_NOT_FOUND',
|
|
// In multi-tenancy context: project creation quota exceeded.
|
|
QUOTA_EXCEEDED: 'QUOTA_EXCEEDED',
|
|
// Currently only 5 second factors can be set on the same user.
|
|
SECOND_FACTOR_LIMIT_EXCEEDED: 'SECOND_FACTOR_LIMIT_EXCEEDED',
|
|
// Tenant not found.
|
|
TENANT_NOT_FOUND: 'TENANT_NOT_FOUND',
|
|
// Tenant ID mismatch.
|
|
TENANT_ID_MISMATCH: 'MISMATCHING_TENANT_ID',
|
|
// Token expired error.
|
|
TOKEN_EXPIRED: 'ID_TOKEN_EXPIRED',
|
|
// Continue URL provided in ActionCodeSettings has a domain that is not whitelisted.
|
|
UNAUTHORIZED_DOMAIN: 'UNAUTHORIZED_DOMAIN',
|
|
// A multi-factor user requires a supported first factor.
|
|
UNSUPPORTED_FIRST_FACTOR: 'UNSUPPORTED_FIRST_FACTOR',
|
|
// The request specified an unsupported type of second factor.
|
|
UNSUPPORTED_SECOND_FACTOR: 'UNSUPPORTED_SECOND_FACTOR',
|
|
// Operation is not supported in a multi-tenant context.
|
|
UNSUPPORTED_TENANT_OPERATION: 'UNSUPPORTED_TENANT_OPERATION',
|
|
// A verified email is required for the specified action. For example a multi-factor user
|
|
// requires a verified email.
|
|
UNVERIFIED_EMAIL: 'UNVERIFIED_EMAIL',
|
|
// User on which action is to be performed is not found.
|
|
USER_NOT_FOUND: 'USER_NOT_FOUND',
|
|
// User record is disabled.
|
|
USER_DISABLED: 'USER_DISABLED',
|
|
// Password provided is too weak.
|
|
WEAK_PASSWORD: 'INVALID_PASSWORD',
|
|
// Unrecognized reCAPTCHA action.
|
|
INVALID_RECAPTCHA_ACTION: 'INVALID_RECAPTCHA_ACTION',
|
|
// Unrecognized reCAPTCHA enforcement state.
|
|
INVALID_RECAPTCHA_ENFORCEMENT_STATE: 'INVALID_RECAPTCHA_ENFORCEMENT_STATE',
|
|
// reCAPTCHA is not enabled for account defender.
|
|
RECAPTCHA_NOT_ENABLED: 'RECAPTCHA_NOT_ENABLED'
|
|
};
|
|
/**
|
|
* Firebase Auth error code structure. This extends `FirebaseError`.
|
|
*/
|
|
class FirebaseAuthError extends error_1.FirebaseError {
|
|
/**
|
|
* Creates the developer-facing error corresponding to the backend error code.
|
|
*
|
|
* @param serverErrorCode - The server error code.
|
|
* @param [message] The error message. The default message is used
|
|
* if not provided.
|
|
* @param [serverError] The error's raw server response.
|
|
* @returns The corresponding developer-facing error.
|
|
* @internal
|
|
*/
|
|
static fromServerError(serverErrorCode, message, serverError) {
|
|
// serverErrorCode could contain additional details:
|
|
// ERROR_CODE : Detailed message which can also contain colons
|
|
const colonSeparator = (serverErrorCode || '').indexOf(':');
|
|
let customMessage = null;
|
|
if (colonSeparator !== -1) {
|
|
customMessage = serverErrorCode.substring(colonSeparator + 1).trim();
|
|
serverErrorCode = serverErrorCode.substring(0, colonSeparator).trim();
|
|
}
|
|
// If not found, default to internal error.
|
|
const clientCodeKey = AUTH_SERVER_TO_CLIENT_CODE[serverErrorCode] || 'INTERNAL_ERROR';
|
|
const error = (0, deep_copy_1.deepCopy)(exports.authClientErrorCode[clientCodeKey]);
|
|
// Server detailed message should have highest priority.
|
|
error.message = customMessage || message || error.message;
|
|
error.cause = serverError;
|
|
error.httpResponse = serverError?.response ? (0, error_1.toHttpResponse)(serverError.response) : undefined;
|
|
return new FirebaseAuthError(error);
|
|
}
|
|
/**
|
|
* @param info - The error code info.
|
|
* @param message - The error message. This will override the default message if provided.
|
|
*/
|
|
constructor(info, message) {
|
|
// Override default message if custom message provided.
|
|
super({
|
|
code: `auth/${info.code}`,
|
|
message: message || info.message,
|
|
httpResponse: info.httpResponse,
|
|
cause: info.cause,
|
|
});
|
|
/** @internal */
|
|
this.codePrefix = 'auth';
|
|
}
|
|
}
|
|
exports.FirebaseAuthError = FirebaseAuthError;
|