fix: add 'too_many_attempts' to error codes in logInError function

[ankita10119]

Changes

Fixes issue #2589 where the authorization_error event was not being emitted when users trigger rate limiting by attempting too many failed logins.

Problem

When Auth0's brute force protection triggers and returns a too_many_attempts error (HTTP 429), Lock was not emitting the authorization_error event. This prevented applications from handling rate limiting errors gracefully through the event listener.

The error code too_many_attempts was missing from the whitelist array that determines which error codes should trigger the authorization_error event.

Solution

Added 'too_many_attempts' to the errorCodesThatEmitAuthorizationErrorEvent array in src/core/actions.js

This ensures that when rate limiting is triggered, applications can now handle it properly:

lock.on('authorization_error', function(error) {
  if (error.error === 'too_many_attempts') {
    // Show custom message to user
  }
});

References

Closes #2589

Testing

• This change adds unit test coverage
• This change adds integration test coverage
• This change has been tested on the latest version of the platform/language

Checklist

• I have read the Auth0 general contribution guidelines
• I have read the Auth0 Code of Conduct
• All code quality tools/guidelines have been run/followed
• All relevant assets have been compiled

[ankita10119]

Before

Screen.Recording.2026-01-16.at.9.49.42.PM.mov

After

Screen.Recording.2026-01-16.at.9.52.29.PM.mov