@asgardeo/javascript 0.22.0 → 0.23.0

package/dist/edge/index.js

@@ -3950,12 +3950,6 @@ var FlowMode = /* @__PURE__ */ ((FlowMode2) => {
   return FlowMode2;
 })(FlowMode || {});
 
-// src/models/agent.ts
-var AgentConfig;
-((AgentConfig2) => {
-  AgentConfig2.DEFAULT_AUTHENTICATOR_NAME = "Username & Password";
-})(AgentConfig || (AgentConfig = {}));
-
 // src/models/scim2-schema.ts
 var WellKnownSchemaIds = /* @__PURE__ */ ((WellKnownSchemaIds2) => {
   WellKnownSchemaIds2["Core"] = "urn:ietf:params:scim:schemas:core:2.0";
@@ -4056,24 +4050,54 @@ var DefaultCrypto = class {
   }
 };
 
+// src/models/agent.ts
+var AgentConfig;
+((AgentConfig2) => {
+  AgentConfig2.DEFAULT_AUTHENTICATOR_NAME = "Username & Password";
+})(AgentConfig || (AgentConfig = {}));
+
 // src/AsgardeoJavaScriptClient.ts
-var AsgardeoJavaScriptClient = class {
+var RESERVED_AUTH_KEYS = /* @__PURE__ */ new Set([
+  "client_id",
+  "redirect_uri",
+  "scope",
+  "state",
+  "response_type",
+  "resource",
+  "fidp",
+  "requested_actor",
+  "orgId",
+  "orgHandle",
+  "org",
+  "login_hint",
+  "orgDiscoveryType",
+  "code_challenge",
+  "code_challenge_method"
+]);
+var AsgardeoJavaScriptClient = class _AsgardeoJavaScriptClient {
   constructor(config, cacheStore, cryptoUtils) {
     __publicField(this, "cacheStore");
     __publicField(this, "cryptoUtils");
     __publicField(this, "auth");
     __publicField(this, "storageManager");
     __publicField(this, "baseURL");
+    __publicField(this, "initPromise");
     this.cacheStore = cacheStore ?? new DefaultCacheStore();
     this.cryptoUtils = cryptoUtils ?? new DefaultCrypto();
     this.auth = new AsgardeoAuthClient();
     if (config) {
-      this.auth.initialize(config, this.cacheStore, this.cryptoUtils);
+      this.initPromise = this.auth.initialize(config, this.cacheStore, this.cryptoUtils);
       this.storageManager = this.auth.getStorageManager();
     }
     this.baseURL = config?.baseUrl ?? "";
   }
+  async ensureInitialized() {
+    if (this.initPromise) {
+      await this.initPromise;
+    }
+  }
   async getDiscoveryResponse() {
+    await this.ensureInitialized();
     if (!this.storageManager) {
       return null;
     }
@@ -4148,6 +4172,15 @@ var AsgardeoJavaScriptClient = class {
   }
   /* eslint-enable class-methods-use-this, @typescript-eslint/no-unused-vars */
   async getAgentToken(agentConfig) {
+    await this.ensureInitialized();
+    if (!agentConfig?.agentID) {
+      throw new Error("agentConfig.agentID is required for getAgentToken().");
+    }
+    if (!agentConfig.agentSecret) {
+      throw new Error(
+        "agentConfig.agentSecret is required for getAgentToken(). The agent must authenticate against the token endpoint."
+      );
+    }
     const customParam = {
       response_mode: "direct"
     };
@@ -4187,6 +4220,7 @@ var AsgardeoJavaScriptClient = class {
     );
   }
   async getOBOSignInURL(agentConfig) {
+    await this.ensureInitialized();
     const customParam = {
       requested_actor: agentConfig.agentID
     };
@@ -4211,6 +4245,200 @@ var AsgardeoJavaScriptClient = class {
       tokenRequestConfig
     );
   }
+  /**
+   * Builds a `/oauth2/authorize` URL targeting a specific child organization.
+   *
+   * The target organization can be identified by its UUID (`orgID`), handle
+   * (`orgHandle`), display name (`org`) or via email-domain based discovery
+   * (`emailDomain`).
+   *
+   * @param orgDiscoveryType - The organization discovery strategy to use.
+   * @param discoveryInput   - The identifier whose meaning depends on
+   *                            `orgDiscoveryType` (UUID, handle, name or email).
+   * @param options          - Optional state, resource, agent delegation and
+   *                            additional query parameters.
+   * @returns The fully-built authorization URL.
+   */
+  async getOrgAuthorizationUrl(orgDiscoveryType, discoveryInput, options = {}) {
+    await this.ensureInitialized();
+    const customParam = _AsgardeoJavaScriptClient.buildOrgAuthorizationParams(
+      orgDiscoveryType,
+      discoveryInput,
+      options
+    );
+    const authURL = await this.auth.getSignInUrl(customParam);
+    if (!authURL) {
+      throw new Error("Could not build organization authorization URL");
+    }
+    return authURL.toString();
+  }
+  /**
+   * Exchanges an existing access token for one scoped to a target organization,
+   * using the `organization_switch` grant type.
+   *
+   * Unlike {@link AsgardeoJavaScriptClient.exchangeToken} this method does
+   * not require an active SDK session — the caller supplies the source
+   * access token directly. This makes it safe to use from server-side agent
+   * flows where there is no user session yet.
+   *
+   * @param token                  - The current access token to be switched.
+   * @param switchingOrganization  - The ID/UUID of the target organization.
+   * @param scopes                 - Optional list of scopes to request for the switched token.
+   * @returns A normalized {@link TokenResponse} for the switched organization.
+   */
+  async switchTokenToOrganization(token, switchingOrganization, scopes) {
+    await this.ensureInitialized();
+    if (!token) {
+      throw new Error("Token is required for organization switch.");
+    }
+    if (!switchingOrganization) {
+      throw new Error("switchingOrganization is required.");
+    }
+    if (!this.storageManager) {
+      throw new Error("Client is not initialized. Call initialize() before switching organizations.");
+    }
+    const configData = await this.storageManager.getConfigData();
+    if (!configData) {
+      throw new Error("Client configuration is unavailable. Initialize the client before switching organizations.");
+    }
+    const tokenEndpoint = await this.resolveTokenEndpoint();
+    const body = new URLSearchParams();
+    const { clientId, clientSecret } = configData;
+    if (!clientId || clientId.trim().length === 0) {
+      throw new Error("clientId is required in the client configuration for organization switch.");
+    }
+    const hasSecret = Boolean(clientSecret && clientSecret.trim().length > 0);
+    body.set("grant_type", "organization_switch");
+    body.set("token", token);
+    body.set("switching_organization", switchingOrganization);
+    body.set("client_id", clientId);
+    if (hasSecret) {
+      body.set("client_secret", clientSecret);
+    }
+    if (scopes && scopes.length > 0) {
+      body.set("scope", scopes.join(" "));
+    }
+    let response;
+    try {
+      response = await fetch(tokenEndpoint, {
+        body,
+        headers: {
+          Accept: "application/json",
+          "Content-Type": "application/x-www-form-urlencoded"
+        },
+        method: "POST"
+      });
+    } catch (error2) {
+      throw new Error(`Organization switch request failed: ${error2?.message ?? String(error2)}`);
+    }
+    if (!response.ok) {
+      let errorBody;
+      try {
+        errorBody = JSON.stringify(await response.json());
+      } catch {
+        errorBody = response.statusText;
+      }
+      throw new Error(`Organization switch failed (${response.status}): ${errorBody}`);
+    }
+    const parsed = await response.json();
+    return {
+      accessToken: parsed.access_token,
+      createdAt: parsed.created_at ?? Date.now(),
+      expiresIn: parsed.expires_in,
+      idToken: parsed.id_token,
+      refreshToken: parsed.refresh_token,
+      scope: parsed.scope,
+      tokenType: parsed.token_type
+    };
+  }
+  /**
+   * Resolves the OAuth2 token endpoint URL.
+   *
+   * Prefers the value advertised by the OIDC well-known document (when it
+   * has already been loaded into the storage manager) and falls back to
+   * `${baseURL}/oauth2/token` derived from the SDK configuration.
+   */
+  async resolveTokenEndpoint() {
+    const discovery = this.storageManager ? await this.storageManager.loadOpenIDProviderConfiguration() : null;
+    const discovered = discovery?.token_endpoint;
+    if (discovered && discovered.trim().length > 0) {
+      return discovered;
+    }
+    if (this.baseURL && this.baseURL.trim().length > 0) {
+      return `${this.baseURL.replace(/\/$/, "")}/oauth2/token`;
+    }
+    throw new Error(
+      "Unable to resolve the token endpoint. Provide a baseUrl in the client configuration or ensure OIDC discovery has been performed."
+    );
+  }
+  /**
+   * Authenticates as the agent and switches the issued agent token into a
+   * target child organization in a single call.
+   *
+   * @param agentConfig            - Agent credentials used to obtain the parent-org agent token.
+   * @param switchingOrganization  - The ID/UUID of the target organization.
+   * @param orgScopes              - Optional scopes to request for the organization-scoped token.
+   * @returns A normalized {@link TokenResponse} scoped to the target organization.
+   */
+  async getOrganizationAgentToken(agentConfig, switchingOrganization, orgScopes) {
+    if (!switchingOrganization) {
+      throw new Error("switchingOrganization is required.");
+    }
+    const agentToken = await this.getAgentToken(agentConfig);
+    return this.switchTokenToOrganization(agentToken.accessToken, switchingOrganization, orgScopes);
+  }
+  /**
+   * Builds the custom query-parameter map for an organization-scoped authorization request.
+   */
+  static buildOrgAuthorizationParams(orgDiscoveryType, discoveryInput, options) {
+    const trimmedValue = (discoveryInput ?? "").trim();
+    if (!trimmedValue) {
+      throw new Error("discoveryInput is required.");
+    }
+    const customParam = {};
+    if (!options.isEnhancedOrgAuth) {
+      customParam["fidp"] = "OrganizationSSO";
+    }
+    switch (orgDiscoveryType) {
+      case "orgID":
+        customParam["orgId"] = trimmedValue;
+        break;
+      case "orgHandle":
+        customParam["orgHandle"] = trimmedValue;
+        break;
+      case "org":
+        customParam["org"] = trimmedValue;
+        break;
+      case "emailDomain":
+        customParam["login_hint"] = trimmedValue;
+        customParam["orgDiscoveryType"] = "emailDomain";
+        break;
+      default:
+        throw new Error(`Unsupported orgDiscoveryType: ${orgDiscoveryType}`);
+    }
+    if (options.resource) {
+      customParam["resource"] = options.resource;
+    }
+    if (options.state) {
+      customParam["state"] = options.state;
+    }
+    if (options.agentConfig) {
+      if (!options.agentConfig.agentID || options.agentConfig.agentID.trim().length === 0) {
+        throw new Error("agentConfig.agentID is required when agentConfig is provided.");
+      }
+      customParam["requested_actor"] = options.agentConfig.agentID;
+    }
+    if (options.additionalParams) {
+      const conflicts = Object.keys(options.additionalParams).filter(
+        (key) => RESERVED_AUTH_KEYS.has(key)
+      );
+      if (conflicts.length > 0) {
+        throw new Error(`Reserved authorization parameters cannot be overridden: ${conflicts.sort().join(", ")}`);
+      }
+      Object.assign(customParam, options.additionalParams);
+    }
+    return customParam;
+  }
 };
 var AsgardeoJavaScriptClient_default = AsgardeoJavaScriptClient;
 
@@ -5544,7 +5772,6 @@ var _HttpClient = class _HttpClient {
 __publicField(_HttpClient, "DEFAULT_HANDLER_DISABLE_TIMEOUT", 1e3);
 var HttpClient = _HttpClient;
 export {
-  AgentConfig,
   ApplicationNativeAuthenticationConstants_default as ApplicationNativeAuthenticationConstants,
   AsgardeoAPIError,
   AsgardeoAuthClient,