@wtfalch/auth 0.4.1 → 0.6.0

package/dist/namespace-session.js

@@ -0,0 +1,253 @@
+import * as client from 'openid-client';
+import { BrokerError } from './broker.js';
+import { contextDigest, digest, openHandle, openRecord, sealHandle, sealRecord, } from './cookies.js';
+import { AuthError } from './oidc.js';
+/** How long a binding status answer is trusted. The propagation bound for a suspension. */
+export const STATUS_FRESH_MS = 60_000;
+/** How long the last good answer carries on while the service cannot be asked. */
+export const STATUS_STALE_IF_ERROR_MS = 5 * 60_000;
+const STATUS_RETRY_MS = 5_000;
+/**
+ * Twice openid-client's 30 second request timeout, so a slow but live refresh
+ * is never mistaken for a dead one and taken over mid-flight.
+ */
+const LEASE_SECONDS = 60;
+const WAIT_STEP_MS = 100;
+const WAIT_STEPS = 50;
+const now = () => Math.floor(Date.now() / 1000);
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/**
+ * Server-side sessions for namespace mode. The cookie holds a random handle;
+ * the record holds the tokens. Refreshes are serialised across replicas by a
+ * lease on the record, so the issuer's refresh-token rotation cannot log a
+ * person out when two requests arrive together, and no refresh ever sets a
+ * cookie.
+ */
+export function namespaceSessions(deps) {
+    const options = deps.options;
+    const store = () => {
+        const s = options().sessionStore;
+        if (!s)
+            throw new Error('@wtfalch/auth: namespace mode needs a sessionStore');
+        return s;
+    };
+    // ---- binding status -----------------------------------------------------
+    let status = null;
+    let retryAt = 0;
+    let pending = null;
+    const askService = async () => {
+        const namespace = options().namespace;
+        if (!namespace)
+            return false;
+        try {
+            const routed = await deps.broker().binding();
+            return (routed.organizationId === namespace.organizationId &&
+                routed.clientIds.includes(namespace.clientId) &&
+                routed.origins.includes(namespace.appOrigin));
+        }
+        catch (error) {
+            // Suspension removes the binding's key, so the service no longer knows it.
+            if (error instanceof BrokerError && (error.status === 401 || error.status === 403))
+                return false;
+            throw error;
+        }
+    };
+    /**
+     * Whether the service still routes this binding. An answer is trusted for a
+     * minute from when it was asked, so a suspension reaches every request
+     * within that. While the service cannot be asked the last good answer
+     * carries on for five minutes, then this fails closed.
+     */
+    const bindingActive = async () => {
+        const asked = Date.now();
+        if (status && asked - status.at < STATUS_FRESH_MS)
+            return status.active;
+        if (asked >= retryAt) {
+            pending ??= askService().finally(() => {
+                pending = null;
+            });
+            try {
+                const active = await pending;
+                if (!status || status.at < asked)
+                    status = { active, at: asked };
+                return active;
+            }
+            catch (error) {
+                retryAt = Date.now() + STATUS_RETRY_MS;
+                console.error('@wtfalch/auth: could not confirm the namespace binding', error);
+            }
+        }
+        return status?.active === true && Date.now() - status.at < STATUS_STALE_IF_ERROR_MS;
+    };
+    // ---- records ------------------------------------------------------------
+    const load = async (key) => {
+        const record = await store().get(key);
+        if (!record ||
+            record.revokedAt !== null ||
+            record.expiresAt <= now() ||
+            record.context !== (await contextDigest(options())))
+            return null;
+        const tokens = await openRecord(options(), key, record.payload);
+        return tokens ? { key, record, tokens } : null;
+    };
+    const keyOf = async (value) => {
+        const sid = await openHandle(options(), value);
+        return sid ? digest(sid) : null;
+    };
+    const seal = (key, tokens) => sealRecord(options(), { k: key, idt: tokens.idToken, rt: tokens.refreshToken });
+    const revokeToken = (refreshToken) => {
+        if (refreshToken)
+            deps
+                .broker()
+                .revoke(refreshToken)
+                .catch(() => { });
+    };
+    /** A new record and the cookie that points at it. */
+    const create = async (tokens) => {
+        const sid = client.randomState();
+        const key = await digest(sid);
+        await store().create({
+            key,
+            context: await contextDigest(options()),
+            subject: String(tokens.claims.sub),
+            generation: 0,
+            leaseUntil: null,
+            payload: await seal(key, tokens),
+            expiresAt: now() + options().sessionMaxAge,
+            revokedAt: null,
+        });
+        return sealHandle(options(), sid);
+    };
+    /** Ends the record behind this cookie, if it is one of this binding's. */
+    const end = async (value) => {
+        if (!value)
+            return 'none';
+        const key = await keyOf(value);
+        if (!key)
+            return 'changed';
+        const loaded = await load(key);
+        await store().revoke(key, now());
+        revokeToken(loaded?.tokens.rt);
+        return 'ended';
+    };
+    const revokeSubject = async (subject) => store().revokeSubject(await contextDigest(options()), subject, now());
+    // ---- refresh ------------------------------------------------------------
+    const definitive = (error) => error instanceof AuthError ||
+        (error instanceof client.ResponseBodyError && error.error === 'invalid_grant');
+    /**
+     * Refresh under the lease. Resolves the freshest usable tokens: new ones,
+     * another request's, or null when the session is over. While another
+     * request holds the lease, a current token with time left is used as it is;
+     * without one, this waits a few seconds for that refresh to land, and takes
+     * the lease over if its holder has gone quiet past its expiry.
+     */
+    const refresh = async (loaded, stillValid) => {
+        const key = loaded.key;
+        let current = loaded;
+        for (let attempt = 0;; attempt++) {
+            const { record } = current;
+            if (attempt > 0 &&
+                record.generation !== loaded.record.generation &&
+                record.leaseUntil === null)
+                return current;
+            const leased = record.leaseUntil !== null && record.leaseUntil > now();
+            if (!leased &&
+                (await store().advance(key, record.generation, {
+                    payload: record.payload,
+                    expiresAt: record.expiresAt,
+                    leaseUntil: now() + LEASE_SECONDS,
+                })))
+                return refreshLeased(current, stillValid);
+            if (stillValid)
+                return current;
+            if (attempt >= WAIT_STEPS)
+                return null;
+            await sleep(WAIT_STEP_MS);
+            const latest = await load(key);
+            if (!latest)
+                return null;
+            current = latest;
+        }
+    };
+    const refreshLeased = async (leased, stillValid) => {
+        const { key, record, tokens } = leased;
+        const generation = record.generation + 1;
+        let fresh;
+        try {
+            fresh = await deps.oidc().refresh(tokens.rt);
+        }
+        catch (error) {
+            if (definitive(error)) {
+                // The lease means nobody else spent the token: the issuer has ended it.
+                await store().revoke(key, now());
+                return null;
+            }
+            await store()
+                .advance(key, generation, {
+                payload: record.payload,
+                expiresAt: record.expiresAt,
+                leaseUntil: null,
+            })
+                .catch(() => { });
+            return stillValid ? leased : null;
+        }
+        const committed = await store().advance(key, generation, {
+            payload: await seal(key, fresh),
+            expiresAt: now() + options().sessionMaxAge,
+            leaseUntil: null,
+        });
+        if (!committed) {
+            // Revoked while we asked, or our lease ran out and another request took
+            // over. These tokens are kept nowhere, so they are not left live.
+            if (fresh.refreshToken !== tokens.rt)
+                revokeToken(fresh.refreshToken);
+            return load(key);
+        }
+        return {
+            key,
+            record: { ...record, generation: generation + 1, leaseUntil: null },
+            tokens: { k: key, idt: fresh.idToken, rt: fresh.refreshToken },
+        };
+    };
+    /**
+     * The person behind this cookie. Never sets a cookie: a dead or revoked
+     * handle just reads as nobody until the next sign-in replaces it.
+     */
+    const read = async (value, force = false) => {
+        if (!value)
+            return { kind: 'none' };
+        const key = await keyOf(value);
+        if (!key)
+            return { kind: 'changed' };
+        if (!(await bindingActive()))
+            return { kind: 'unavailable' };
+        let loaded = await load(key);
+        if (!loaded)
+            return { kind: 'none' };
+        const exp = expiryOf(loaded.tokens.idt);
+        const valid = exp !== null && exp > now() - 60;
+        const due = force || exp === null || exp - options().refreshWindow <= now();
+        if (due && loaded.tokens.rt) {
+            loaded = await refresh(loaded, valid);
+            if (!loaded)
+                return { kind: 'none' };
+        }
+        try {
+            return { kind: 'user', claims: await deps.oidc().verify(loaded.tokens.idt) };
+        }
+        catch {
+            return { kind: 'none' };
+        }
+    };
+    return { bindingActive, create, end, read, revokeSubject, keyOf };
+}
+function expiryOf(idToken) {
+    try {
+        const [, payload] = idToken.split('.');
+        const json = JSON.parse(atob(payload.replace(/-/g, '+').replace(/_/g, '/')));
+        return typeof json.exp === 'number' ? json.exp : null;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/namespaces.d.ts

@@ -0,0 +1,118 @@
+/** Versioned server-owned configuration. URL/email input is a lookup key, never
+ * authority. Workspace membership and session/transaction binding remain the
+ * responsibility of the consumer; this module does not establish a session. */
+export type NamespaceStatus = 'pending' | 'active' | 'suspended' | 'failed';
+export interface NamespaceDomain {
+    domain: string;
+    purpose: 'account' | 'login';
+    status: 'pending' | 'active';
+    /** Operator-owned evidence reference; this is not an automated DNS verifier. */
+    verificationRef?: string;
+}
+export interface NamespaceService {
+    id: string;
+    serviceId: string;
+    deploymentId: string;
+    appOrigin: string;
+    redirectUris: string[];
+    postLogoutRedirectUris: string[];
+    credentialRef: string;
+    registration: boolean;
+}
+export interface NamespaceSpec {
+    id: string;
+    displayName: string;
+    revision: number;
+    status: Exclude<NamespaceStatus, 'failed'>;
+    loginOrigin: string;
+    domains: NamespaceDomain[];
+    mail: {
+        from: string;
+        productName: string;
+        locale: string;
+    };
+    services: NamespaceService[];
+}
+export interface NamespaceManifest {
+    version: 1;
+    issuer: string;
+    namespaces: NamespaceSpec[];
+}
+export interface NamespaceRecord extends Omit<NamespaceSpec, 'status' | 'services'> {
+    status: NamespaceStatus;
+    organizationId: string;
+    projectId: string;
+    services: (NamespaceService & {
+        appId: string;
+        clientId: string;
+    })[];
+}
+export interface NamespaceRegistry {
+    version: 1;
+    issuer: string;
+    namespaces: NamespaceRecord[];
+}
+export interface WorkspaceBinding {
+    serviceId: string;
+    workspaceId: string;
+    namespaceId: string;
+}
+export declare function parseNamespaceManifest(raw: unknown): NamespaceManifest;
+export declare function parseNamespaceRegistry(raw: unknown): NamespaceRegistry;
+/** Exact server-side configuration lookup. It grants no workspace membership. */
+export declare function resolveNamespaceBinding(registry: NamespaceRegistry, input: {
+    namespaceId: string;
+    serviceId: string;
+    deploymentId: string;
+    appOrigin: string;
+}): {
+    id: string;
+    serviceId: string;
+    deploymentId: string;
+    appOrigin: string;
+    redirectUris: string[];
+    postLogoutRedirectUris: string[];
+    credentialRef: string;
+    registration: boolean;
+    appId: string;
+    clientId: string;
+    issuer: string;
+    namespaceId: string;
+    organizationId: string;
+    revision: number;
+    loginOrigin: string;
+};
+/** Apps store these mappings themselves; email addresses are deliberately absent. */
+export declare function parseWorkspaceBindings(raw: unknown, registry: NamespaceRegistry): WorkspaceBinding[];
+/** Trusted server configuration, or its public projection for a browser client. */
+export interface NamespaceSelection {
+    registry: NamespaceRegistry;
+    namespaceId: string;
+    serviceId: string;
+    deploymentId: string;
+}
+/** A deterministic binding used inside protected cookies and browser transactions. */
+export declare function resolveNamespaceContext(selection: NamespaceSelection, options: {
+    issuer: string;
+    clientId: string;
+    appOrigin: string;
+    redirectUri: string;
+    organizationId?: string;
+}): {
+    context: string;
+    id: string;
+    serviceId: string;
+    deploymentId: string;
+    appOrigin: string;
+    redirectUris: string[];
+    postLogoutRedirectUris: string[];
+    credentialRef: string;
+    registration: boolean;
+    appId: string;
+    clientId: string;
+    issuer: string;
+    namespaceId: string;
+    organizationId: string;
+    revision: number;
+    loginOrigin: string;
+};

package/dist/namespaces.js

@@ -0,0 +1,244 @@
+function invalid(field) {
+    throw new Error(`Invalid namespace configuration: ${field}`);
+}
+function object(value, field) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        invalid(field);
+    return value;
+}
+function string(value, field) {
+    if (typeof value !== 'string' ||
+        !value ||
+        value.trim() !== value ||
+        value.length > 250 ||
+        [...value].some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127))
+        invalid(field);
+    return value;
+}
+function id(value, field) {
+    const result = string(value, field);
+    if (!/^[a-z0-9][a-z0-9_-]{0,63}$/.test(result) ||
+        ['constructor', 'prototype', '__proto__'].includes(result))
+        invalid(field);
+    return result;
+}
+function array(value, field) {
+    if (!Array.isArray(value) || value.length > 1000)
+        invalid(field);
+    return value;
+}
+function oneOf(value, choices, field) {
+    if (!choices.includes(value))
+        invalid(field);
+    return value;
+}
+function url(value, field, originOnly, allowLocal = false) {
+    const raw = string(value, field);
+    let result;
+    try {
+        result = new URL(raw);
+    }
+    catch {
+        return invalid(field);
+    }
+    const local = ['localhost', '127.0.0.1', '[::1]'].includes(result.hostname) ||
+        result.hostname.endsWith('.localhost');
+    if ((result.protocol !== 'https:' && !(allowLocal && local && result.protocol === 'http:')) ||
+        result.username ||
+        result.password ||
+        result.hash ||
+        result.hostname.endsWith('.'))
+        invalid(field);
+    if (originOnly && (result.pathname !== '/' || result.search))
+        invalid(field);
+    return originOnly ? result.origin : result.href;
+}
+function unique(values, field) {
+    if (new Set(values).size !== values.length)
+        invalid(`duplicate ${field}`);
+}
+function uris(value, origin, field) {
+    const result = array(value, field).map((v) => url(v, field, false, true));
+    if (!result.length || result.some((v) => new URL(v).origin !== origin || v.includes('*')))
+        invalid(field);
+    unique(result, field);
+    return result;
+}
+function domain(value) {
+    const d = object(value, 'domain');
+    const name = string(d.domain, 'domain').toLowerCase();
+    if (name.length > 253 ||
+        !name.split('.').every((label) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label)))
+        invalid('domain');
+    const purpose = oneOf(d.purpose, ['account', 'login'], 'domain purpose');
+    const status = oneOf(d.status, ['pending', 'active'], 'domain status');
+    const verificationRef = d.verificationRef === undefined ? undefined : string(d.verificationRef, 'verificationRef');
+    if (status === 'active' && !verificationRef)
+        invalid('active domain needs verificationRef');
+    return { domain: name, purpose, status, ...(verificationRef ? { verificationRef } : {}) };
+}
+function service(value) {
+    const s = object(value, 'service');
+    const appOrigin = url(s.appOrigin, 'appOrigin', true, true);
+    const credentialRef = string(s.credentialRef, 'credentialRef');
+    if (!/^[A-Z][A-Z0-9_]{2,100}$/.test(credentialRef) || credentialRef.endsWith('_PAT'))
+        invalid('credentialRef');
+    if (s.registration !== undefined && typeof s.registration !== 'boolean')
+        invalid('registration');
+    return {
+        id: id(s.id, 'binding id'),
+        serviceId: id(s.serviceId, 'serviceId'),
+        deploymentId: id(s.deploymentId, 'deploymentId'),
+        appOrigin,
+        redirectUris: uris(s.redirectUris, appOrigin, 'redirectUris'),
+        postLogoutRedirectUris: uris(s.postLogoutRedirectUris, appOrigin, 'postLogoutRedirectUris'),
+        credentialRef,
+        registration: s.registration === true,
+    };
+}
+function parse(raw, resolved) {
+    const input = object(raw, 'document');
+    if (input.version !== 1)
+        invalid('version');
+    const issuer = url(input.issuer, 'issuer', true);
+    const namespaces = array(input.namespaces, 'namespaces').map((value) => {
+        const n = object(value, 'namespace');
+        const mail = object(n.mail, 'mail');
+        if (!Number.isSafeInteger(n.revision) || n.revision < 1)
+            invalid('revision');
+        const loginOrigin = url(n.loginOrigin, 'loginOrigin', true);
+        const domains = array(n.domains, 'domains').map(domain);
+        unique(domains.map((d) => `${d.purpose}:${d.domain}`), 'domain purpose');
+        const status = oneOf(n.status, resolved
+            ? ['pending', 'active', 'suspended', 'failed']
+            : ['pending', 'active', 'suspended'], 'status');
+        const loginDomain = domains.find((d) => d.purpose === 'login' && d.domain === new URL(loginOrigin).hostname);
+        if (loginOrigin !== issuer && !loginDomain)
+            invalid('custom login origin needs a domain binding');
+        if (status === 'active' &&
+            (domains.some((d) => d.status !== 'active') ||
+                (loginOrigin !== issuer && loginDomain?.status !== 'active')))
+            invalid('active namespace has unverified domains');
+        const services = array(n.services, 'services').map((value) => {
+            const spec = service(value);
+            if (!resolved)
+                return spec;
+            const r = object(value, 'resolved service');
+            return { ...spec, appId: string(r.appId, 'appId'), clientId: string(r.clientId, 'clientId') };
+        });
+        if (!services.length)
+            invalid('namespace needs a service');
+        unique(services.map((s) => `${s.serviceId}:${s.deploymentId}`), 'namespace service/deployment');
+        const common = {
+            id: id(n.id, 'namespace id'),
+            displayName: string(n.displayName, 'displayName'),
+            revision: n.revision,
+            status,
+            loginOrigin,
+            domains,
+            services,
+            mail: {
+                from: string(mail.from, 'mail.from'),
+                productName: string(mail.productName, 'mail.productName'),
+                locale: string(mail.locale, 'mail.locale'),
+            },
+        };
+        return resolved
+            ? {
+                ...common,
+                organizationId: string(n.organizationId, 'organizationId'),
+                projectId: string(n.projectId, 'projectId'),
+            }
+            : common;
+    });
+    unique(namespaces.map((n) => n.id), 'namespace id');
+    unique(namespaces.flatMap((n) => n.services.map((s) => s.id)), 'binding id');
+    unique(namespaces.flatMap((n) => n.services.map((s) => s.credentialRef)), 'credential reference');
+    const domains = new Map();
+    for (const n of namespaces)
+        for (const d of n.domains) {
+            const owner = domains.get(d.domain);
+            // Pending and suspended claims also reserve ownership until an explicit
+            // migration releases them. A registry edit cannot silently reassign a domain.
+            if (owner && owner !== n.id)
+                invalid('domain belongs to multiple namespaces');
+            domains.set(d.domain, n.id);
+        }
+    if (resolved) {
+        const records = namespaces;
+        unique(records.map((n) => n.organizationId), 'organizationId');
+        unique(records.flatMap((n) => n.services.map((s) => s.clientId)), 'clientId');
+    }
+    return { version: 1, issuer, namespaces };
+}
+export function parseNamespaceManifest(raw) {
+    return parse(raw, false);
+}
+export function parseNamespaceRegistry(raw) {
+    return parse(raw, true);
+}
+/** Exact server-side configuration lookup. It grants no workspace membership. */
+export function resolveNamespaceBinding(registry, input) {
+    const validated = parseNamespaceRegistry(registry);
+    const namespace = validated.namespaces.find((n) => n.id === input.namespaceId);
+    if (!namespace || namespace.status !== 'active')
+        invalid('namespace unavailable');
+    const binding = namespace.services.find((s) => s.serviceId === input.serviceId && s.deploymentId === input.deploymentId);
+    if (!binding || binding.appOrigin !== url(input.appOrigin, 'appOrigin', true, true))
+        invalid('service binding mismatch');
+    return {
+        issuer: validated.issuer,
+        namespaceId: namespace.id,
+        organizationId: namespace.organizationId,
+        revision: namespace.revision,
+        loginOrigin: namespace.loginOrigin,
+        ...binding,
+    };
+}
+/** Apps store these mappings themselves; email addresses are deliberately absent. */
+export function parseWorkspaceBindings(raw, registry) {
+    const validated = parseNamespaceRegistry(registry);
+    const result = array(raw, 'workspace bindings').map((value) => {
+        const w = object(value, 'workspace binding');
+        const binding = {
+            serviceId: id(w.serviceId, 'serviceId'),
+            workspaceId: id(w.workspaceId, 'workspaceId'),
+            namespaceId: id(w.namespaceId, 'namespaceId'),
+        };
+        const namespace = validated.namespaces.find((n) => n.id === binding.namespaceId);
+        if (!namespace?.services.some((s) => s.serviceId === binding.serviceId))
+            invalid('workspace service/namespace mismatch');
+        return binding;
+    });
+    unique(result.map((w) => `${w.serviceId}:${w.workspaceId}`), 'workspace binding');
+    return result;
+}
+/** A deterministic binding used inside protected cookies and browser transactions. */
+export function resolveNamespaceContext(selection, options) {
+    const binding = resolveNamespaceBinding(selection.registry, {
+        ...selection,
+        appOrigin: options.appOrigin,
+    });
+    if (binding.issuer !== options.issuer ||
+        binding.clientId !== options.clientId ||
+        (options.organizationId !== undefined && binding.organizationId !== options.organizationId) ||
+        !binding.redirectUris.includes(options.redirectUri))
+        invalid('authentication options disagree with binding');
+    return {
+        ...binding,
+        context: JSON.stringify([
+            1,
+            binding.namespaceId,
+            binding.id,
+            binding.serviceId,
+            binding.deploymentId,
+            binding.revision,
+            binding.issuer,
+            binding.organizationId,
+            binding.clientId,
+            binding.appOrigin,
+            options.redirectUri,
+            binding.loginOrigin,
+        ]),
+    };
+}

package/dist/next.js

@@ -4,6 +4,7 @@ import { NextResponse } from 'next/server';
 import { createAuth, } from './auth.js';
 import { BrokerError } from './broker.js';
 import { withCookies } from './cookies.js';
+import { AuthError } from './oidc.js';
 /**
  * Which of the two failures it was, in the vocabulary `auth_error` already
  * uses. A refusal under 500 is about this request — the broker says unknown,
@@ -24,7 +25,13 @@ export function nextAuth(options) {
             response = NextResponse.redirect(gate.location, 303);
         }
         else if (gate.kind === 'deny') {
-            response = new NextResponse('Unauthorized', { status: 401 });
+            response = new NextResponse(gate.reason === 'account_changed'
+                ? 'Account changed; choose an account to continue'
+                : gate.reason === 'unavailable'
+                    ? 'Sign-in is unavailable for this workspace'
+                    : 'Unauthorized', {
+                status: gate.reason === 'account_changed' ? 409 : gate.reason === 'unavailable' ? 503 : 401,
+            });
         }
         else if (gate.cookies.length > 0) {
             const headers = new Headers(request.headers);
@@ -46,7 +53,12 @@ export function nextAuth(options) {
         return user;
     };
     const requireUser = async (next) => {
-        const user = await getUser();
+        const store = await cookies();
+        const { user, accountChanged, unavailable } = await auth.readCookie(store.get(auth.sessionCookieName)?.value, { refresh: false });
+        if (accountChanged)
+            throw new AuthError('account_changed', 'Choose an account to continue');
+        if (unavailable)
+            throw new AuthError('unavailable', 'Sign-in is unavailable for this workspace');
         if (!user)
             redirect(auth.startUrl(next));
         return user;

package/dist/oidc.d.ts

@@ -28,7 +28,7 @@ export declare class Oidc {
     verify(idToken: string): Promise<jose.JWTPayload>;
     private assertOrganization;
 }
-export type AuthErrorReason = 'expired' | 'state' | 'denied' | 'exchange' | 'organization' | 'cookie' | 'request';
+export type AuthErrorReason = 'expired' | 'state' | 'denied' | 'exchange' | 'organization' | 'cookie' | 'request' | 'account_changed' | 'unavailable';
 export declare class AuthError extends Error {
     readonly reason: AuthErrorReason;
     constructor(reason: AuthErrorReason, message: string);