thunderbird_accounts.authentication.exceptions

Exceptions

AuthenticationUnavailable	Used in AccountsOIDCBackend to indicate we need to show a service unavailable page.
DeleteUserError(error[, oidc_id])
GetUserError(error[, oidc_id])
ImportUserError(error[, username, ...])
InvalidDomainError(username, *args, **kwargs)
KeycloakError(details, *args, **kwargs)	Generic error
MfaCredentialError(error_code, *args, **kwargs)	Raised when the keycloak-mfa-rest provider rejects a credential operation with a client error (e.g. an invalid TOTP code, or an authenticator that is already configured).
MfaSessionExpiredError(*args, **kwargs)	Raised when the keycloak-mfa-rest provider rejects a request with a plain 401 (no step_up_required marker): the forwarded user OIDC access token is missing, invalid, or expired.
MfaStepUpRequiredError(*args, **kwargs)	Raised when the keycloak-mfa-rest provider rejects a sensitive mutation with 401 step_up_required: the forwarded user token does not prove a recent second-factor authentication.
SendExecuteActionsEmailError(error[, ...])
UpdateUserError(error[, username])
UpdateUserPlanInfoError(error[, oidc_id])

exception thunderbird_accounts.authentication.exceptions.KeycloakError(details, *args, **kwargs)

Bases: RuntimeError

Generic error

__init__(details, *args, **kwargs)

exception thunderbird_accounts.authentication.exceptions.InvalidDomainError(username, *args, **kwargs)

Bases: KeycloakError

__init__(username, *args, **kwargs)

exception thunderbird_accounts.authentication.exceptions.ImportUserError(error, username: str | None = None, error_code: str | None = None, error_desc: str | None = None, status_code: int | None = None, *args, **kwargs)

Bases: KeycloakError

__init__(error, username: str | None = None, error_code: str | None = None, error_desc: str | None = None, status_code: int | None = None, *args, **kwargs)

error: str

Format an error usefully if the user already exists in Keycloak

exception thunderbird_accounts.authentication.exceptions.UpdateUserError(error, username: str | None = None, *args, **kwargs)

Bases: KeycloakError

__init__(error, username: str | None = None, *args, **kwargs)

exception thunderbird_accounts.authentication.exceptions.UpdateUserPlanInfoError(error, oidc_id: str | None = None, *args, **kwargs)

Bases: KeycloakError

__init__(error, oidc_id: str | None = None, *args, **kwargs)

exception thunderbird_accounts.authentication.exceptions.GetUserError(error, oidc_id: str | None = None, *args, **kwargs)

Bases: KeycloakError

__init__(error, oidc_id: str | None = None, *args, **kwargs)

exception thunderbird_accounts.authentication.exceptions.DeleteUserError(error, oidc_id: str | None = None, *args, **kwargs)

Bases: KeycloakError

__init__(error, oidc_id: str | None = None, *args, **kwargs)

exception thunderbird_accounts.authentication.exceptions.SendExecuteActionsEmailError(error, action: str | None = None, oidc_id: str | None = None, *args, **kwargs)

Bases: KeycloakError

__init__(error, action: str | None = None, oidc_id: str | None = None, *args, **kwargs)

exception thunderbird_accounts.authentication.exceptions.MfaCredentialError(error_code, *args, **kwargs)

Bases: KeycloakError

Raised when the keycloak-mfa-rest provider rejects a credential operation with a client error (e.g. an invalid TOTP code, or an authenticator that is already configured). Carries the machine error code returned by the provider so callers can map it to a user-facing message.

__init__(error_code, *args, **kwargs)

exception thunderbird_accounts.authentication.exceptions.MfaStepUpRequiredError(*args, **kwargs)

Bases: KeycloakError

Raised when the keycloak-mfa-rest provider rejects a sensitive mutation with 401 step_up_required: the forwarded user token does not prove a recent second-factor authentication. Callers should respond with the MFA reauthentication (step-up) redirect so the user can re-verify.

__init__(*args, **kwargs)

exception thunderbird_accounts.authentication.exceptions.MfaSessionExpiredError(*args, **kwargs)

Bases: KeycloakError

Raised when the keycloak-mfa-rest provider rejects a request with a plain 401 (no step_up_required marker): the forwarded user OIDC access token is missing, invalid, or expired. This is distinct from a step-up demand — the access token’s short lifetime can lapse while a user lingers in the setup flow. Callers should ask the user to sign in again rather than surfacing a generic upstream failure.

__init__(*args, **kwargs)

exception thunderbird_accounts.authentication.exceptions.AuthenticationUnavailable

Bases: RuntimeError

Used in AccountsOIDCBackend to indicate we need to show a service unavailable page.