@auth0/auth0-server-js 1.1.0 → 1.3.0

package/dist/index.cjs

@@ -24,6 +24,7 @@ __export(index_exports, {
   AbstractTransactionStore: () => AbstractTransactionStore,
   BackchannelLogoutError: () => BackchannelLogoutError,
   CookieTransactionStore: () => CookieTransactionStore,
+  InvalidConfigurationError: () => InvalidConfigurationError,
   MissingRequiredArgumentError: () => MissingRequiredArgumentError,
   MissingSessionError: () => MissingSessionError,
   MissingTransactionError: () => MissingTransactionError,
@@ -70,26 +71,33 @@ var MissingSessionError = class extends Error {
     this.name = "MissingSessionError";
   }
 };
+var InvalidConfigurationError = class extends Error {
+  code = "invalid_configuration_error";
+  constructor(message) {
+    super(message);
+    this.name = "InvalidConfigurationError";
+  }
+};
 
 // src/state/utils.ts
-function updateStateData(audience, stateDate, tokenEndpointResponse) {
-  if (stateDate) {
-    const isNewTokenSet = !stateDate.tokenSets.some(
+var createUpdatedTokenSet = (audience, response) => ({
+  audience,
+  accessToken: response.accessToken,
+  scope: response.scope,
+  expiresAt: response.expiresAt
+});
+function updateStateData(audience, stateData, tokenEndpointResponse) {
+  if (stateData) {
+    const isNewTokenSet = !stateData.tokenSets.some(
       (tokenSet) => tokenSet.audience === audience && tokenSet.scope === tokenEndpointResponse.scope
     );
-    const createUpdatedTokenSet = (response) => ({
-      audience,
-      accessToken: response.accessToken,
-      scope: response.scope,
-      expiresAt: Math.floor(Date.now() / 1e3) + Number(response.expiresAt)
-    });
-    const tokenSets = isNewTokenSet ? [...stateDate.tokenSets, createUpdatedTokenSet(tokenEndpointResponse)] : stateDate.tokenSets.map(
-      (tokenSet) => tokenSet.audience === audience && tokenSet.scope === tokenEndpointResponse.scope ? createUpdatedTokenSet(tokenEndpointResponse) : tokenSet
+    const tokenSets = isNewTokenSet ? [...stateData.tokenSets, createUpdatedTokenSet(audience, tokenEndpointResponse)] : stateData.tokenSets.map(
+      (tokenSet) => tokenSet.audience === audience && tokenSet.scope === tokenEndpointResponse.scope ? createUpdatedTokenSet(audience, tokenEndpointResponse) : tokenSet
     );
     return {
-      ...stateDate,
-      idToken: tokenEndpointResponse.idToken,
-      refreshToken: tokenEndpointResponse.refreshToken ?? stateDate.refreshToken,
+      ...stateData,
+      idToken: tokenEndpointResponse.idToken ?? stateData.idToken,
+      refreshToken: tokenEndpointResponse.refreshToken ?? stateData.refreshToken,
       tokenSets
     };
   } else {
@@ -99,12 +107,7 @@ function updateStateData(audience, stateDate, tokenEndpointResponse) {
       idToken: tokenEndpointResponse.idToken,
       refreshToken: tokenEndpointResponse.refreshToken,
       tokenSets: [
-        {
-          audience,
-          accessToken: tokenEndpointResponse.accessToken,
-          scope: tokenEndpointResponse.scope,
-          expiresAt: tokenEndpointResponse.expiresAt
-        }
+        createUpdatedTokenSet(audience, tokenEndpointResponse)
       ],
       internal: {
         sid: user?.sid,
@@ -113,9 +116,9 @@ function updateStateData(audience, stateDate, tokenEndpointResponse) {
     };
   }
 }
-function updateStateDataForConnectionTokenSet(options, stateDate, tokenEndpointResponse) {
-  stateDate.connectionTokenSets = stateDate.connectionTokenSets || [];
-  const isNewTokenSet = !stateDate.connectionTokenSets.some(
+function updateStateDataForConnectionTokenSet(options, stateData, tokenEndpointResponse) {
+  stateData.connectionTokenSets = stateData.connectionTokenSets || [];
+  const isNewTokenSet = !stateData.connectionTokenSets.some(
     (tokenSet) => tokenSet.connection === options.connection && (!options.loginHint || tokenSet.loginHint === options.loginHint)
   );
   const connectionTokenSet = {
@@ -125,11 +128,11 @@ function updateStateDataForConnectionTokenSet(options, stateDate, tokenEndpointR
     scope: tokenEndpointResponse.scope,
     expiresAt: tokenEndpointResponse.expiresAt
   };
-  const connectionTokenSets = isNewTokenSet ? [...stateDate.connectionTokenSets, connectionTokenSet] : stateDate.connectionTokenSets.map(
+  const connectionTokenSets = isNewTokenSet ? [...stateData.connectionTokenSets, connectionTokenSet] : stateData.connectionTokenSets.map(
     (tokenSet) => tokenSet.connection === options.connection && (!options.loginHint || tokenSet.loginHint === options.loginHint) ? connectionTokenSet : tokenSet
   );
   return {
-    ...stateDate,
+    ...stateData,
     connectionTokenSets
   };
 }
@@ -150,7 +153,30 @@ var compareScopes = (scopes, requiredScopes) => {
   return requiredScopesArray.every((scope) => scopesSet.has(scope));
 };
 
+// src/telemetry.ts
+function getTelemetryConfig(config) {
+  if (config?.enabled === false) {
+    return config;
+  }
+  return {
+    enabled: true,
+    name: config?.name ?? "@auth0/auth0-server-js",
+    version: config?.version ?? "1.3.0"
+  };
+}
+
 // src/server-client.ts
+var DEFAULT_SCOPES = "openid profile email offline_access";
+function ensureOpenIdScope(scope) {
+  if (!scope) {
+    return DEFAULT_SCOPES;
+  }
+  const scopes = scope.split(" ");
+  if (!scopes.includes("openid")) {
+    scopes.unshift("openid");
+  }
+  return scopes.join(" ");
+}
 var ServerClient = class {
   #options;
   #transactionStore;
@@ -184,7 +210,8 @@ var ServerClient = class {
       clientAssertionSigningAlg: this.#options.clientAssertionSigningAlg,
       authorizationParams: this.#options.authorizationParams,
       customFetch: this.#options.customFetch,
-      useMtls: this.#options.useMtls
+      useMtls: this.#options.useMtls,
+      telemetry: getTelemetryConfig(this.#options.telemetry)
     });
   }
   /**
@@ -201,11 +228,13 @@ var ServerClient = class {
     if (!redirectUri) {
       throw new MissingRequiredArgumentError("authorizationParams.redirect_uri");
     }
+    const scope = ensureOpenIdScope(options?.authorizationParams?.scope ?? this.#options.authorizationParams?.scope);
     const { codeVerifier, authorizationUrl } = await this.authClient.buildAuthorizationUrl({
       pushedAuthorizationRequests: options?.pushedAuthorizationRequests,
       authorizationParams: {
         ...options?.authorizationParams,
-        redirect_uri: redirectUri
+        redirect_uri: redirectUri,
+        scope
       }
     });
     const transactionState = {
@@ -355,10 +384,14 @@ var ServerClient = class {
    * @returns A promise resolving to an object, containing the authorizationDetails (when RAR was used).
    */
   async loginBackchannel(options, storeOptions) {
+    const scope = ensureOpenIdScope(options.authorizationParams?.scope ?? this.#options.authorizationParams?.scope);
     const tokenEndpointResponse = await this.authClient.backchannelAuthentication({
       bindingMessage: options.bindingMessage,
       loginHint: options.loginHint,
-      authorizationParams: options.authorizationParams
+      authorizationParams: {
+        ...options.authorizationParams,
+        scope
+      }
     });
     const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
     const stateData = updateStateData(
@@ -395,16 +428,24 @@ var ServerClient = class {
   /**
    * Retrieves the access token from the store, or calls Auth0 when the access token is expired and a refresh token is available in the store.
    * Also updates the store when a new token was retrieved from Auth0.
+   *
+   * @param options Optional options for requesting specific audience/scope.
    * @param storeOptions Optional options used to pass to the Transaction and State Store.
    *
    * @throws {TokenByRefreshTokenError} If the refresh token was not found or there was an issue requesting the access token.
    *
    * @returns The Token Set, containing the access token, as well as additional information.
    */
-  async getAccessToken(storeOptions) {
-    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
-    const audience = this.#options.authorizationParams?.audience ?? "default";
-    const scope = this.#options.authorizationParams?.scope;
+  async getAccessToken(tokenOptionsOrStoreOptions, storeOptions) {
+    const hasTokenOptions = (
+      // If second arg exists, first arg must be GetAccessTokenOptions
+      storeOptions !== void 0 || // OR if first arg has audience/scope properties
+      tokenOptionsOrStoreOptions && typeof tokenOptionsOrStoreOptions === "object" && ("audience" in tokenOptionsOrStoreOptions || "scope" in tokenOptionsOrStoreOptions)
+    );
+    const [resolvedOptions, resolvedStoreOptions] = hasTokenOptions ? [tokenOptionsOrStoreOptions, storeOptions] : [void 0, tokenOptionsOrStoreOptions];
+    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, resolvedStoreOptions);
+    const audience = resolvedOptions?.audience ?? this.#options.authorizationParams?.audience ?? "default";
+    const scope = resolvedOptions?.scope ?? this.#options.authorizationParams?.scope;
     const tokenSet = stateData?.tokenSets.find(
       (tokenSet2) => tokenSet2.audience === audience && (!scope || compareScopes(tokenSet2.scope, scope))
     );
@@ -416,12 +457,14 @@ var ServerClient = class {
         "The access token has expired and a refresh token was not provided. The user needs to re-authenticate."
       );
     }
-    const tokenEndpointResponse = await this.authClient.getTokenByRefreshToken({
-      refreshToken: stateData.refreshToken
-    });
-    const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
+    const tokenByRefreshTokenOptions = {
+      refreshToken: stateData.refreshToken,
+      ...hasTokenOptions && { audience, scope }
+    };
+    const tokenEndpointResponse = await this.authClient.getTokenByRefreshToken(tokenByRefreshTokenOptions);
+    const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, resolvedStoreOptions);
     const updatedStateData = updateStateData(audience, existingStateData, tokenEndpointResponse);
-    await this.#stateStore.set(this.#stateStoreIdentifier, updatedStateData, false, storeOptions);
+    await this.#stateStore.set(this.#stateStoreIdentifier, updatedStateData, false, resolvedStoreOptions);
     return {
       accessToken: tokenEndpointResponse.accessToken,
       scope: tokenEndpointResponse.scope,
@@ -507,6 +550,9 @@ var DIGEST = "SHA-256";
 var BIT_LENGTH = 512;
 var HKDF_INFO = "derived cookie encryption secret";
 var encoder;
+function isDecryptionError(e) {
+  return e instanceof import_jose.errors.JWEDecryptionFailed || e instanceof import_jose.errors.JWEInvalid;
+}
 async function deriveEncryptionSecret(secret, salt, kid) {
   encoder ||= new TextEncoder();
   const key = await crypto.subtle.importKey("raw", encoder.encode(secret), "HKDF", false, ["deriveBits"]);
@@ -523,12 +569,23 @@ async function deriveEncryptionSecret(secret, salt, kid) {
     )
   );
 }
-async function encrypt(payload, secret, salt, expiration) {
+async function _encrypt(payload, secret, salt, expiration) {
   const kid = crypto.randomUUID();
   const encryptionSecret = await deriveEncryptionSecret(secret, salt, kid);
   return await new import_jose.EncryptJWT(payload).setProtectedHeader({ enc: ENC, alg: ALG, kid }).setExpirationTime(expiration).encrypt(encryptionSecret);
 }
-async function decrypt(value, secret, salt) {
+async function encrypt(payload, secret, salt, expiration) {
+  if (typeof secret === "string") {
+    return await _encrypt(payload, secret, salt, expiration);
+  } else {
+    const [newSecret] = secret;
+    if (!newSecret) {
+      throw new InvalidConfigurationError("At least one secret must be provided");
+    }
+    return await _encrypt(payload, newSecret, salt, expiration);
+  }
+}
+async function _decrypt(value, secret, salt) {
   const res = await (0, import_jose.jwtDecrypt)(
     value,
     async (protectedHeader) => {
@@ -541,6 +598,35 @@ async function decrypt(value, secret, salt) {
   );
   return res.payload;
 }
+async function decrypt(value, secret, salt) {
+  if (typeof secret === "string") {
+    return await _decrypt(value, secret, salt);
+  } else {
+    const [newSecret, ...oldSecrets] = secret;
+    if (!newSecret) {
+      throw new InvalidConfigurationError("At least one secret must be provided");
+    }
+    let firstError;
+    try {
+      return await _decrypt(value, newSecret, salt);
+    } catch (err) {
+      firstError = err;
+      if (!isDecryptionError(err)) {
+        throw firstError;
+      }
+      for (const oldSecret of oldSecrets) {
+        try {
+          return await _decrypt(value, oldSecret, salt);
+        } catch (fallbackErr) {
+          if (!isDecryptionError(fallbackErr)) {
+            throw fallbackErr;
+          }
+        }
+      }
+      throw firstError;
+    }
+  }
+}
 
 // src/store/abstract-store.ts
 var AbstractStore = class {
@@ -552,7 +638,14 @@ var AbstractStore = class {
     return await encrypt(stateData, this.options.secret, identifier, expiration);
   }
   async decrypt(identifier, encryptedStateData) {
-    return await decrypt(encryptedStateData, this.options.secret, identifier);
+    try {
+      return await decrypt(encryptedStateData, this.options.secret, identifier);
+    } catch (e) {
+      if (isDecryptionError(e)) {
+        return;
+      }
+      throw e;
+    }
   }
 };
 
@@ -644,13 +737,9 @@ var StatefulStateStore = class extends AbstractSessionStore {
     }
     sessionId ??= generateId();
     const maxAge = this.calculateMaxAge(stateData.internal.createdAt);
-    const cookieOpts = {
-      httpOnly: true,
-      sameSite: this.#cookieOptions?.sameSite ?? "lax",
-      path: "/",
-      secure: this.#cookieOptions?.secure,
+    const cookieOpts = this.#getCookieOptions({
       maxAge
-    };
+    });
     const expiration = Date.now() / 1e3 + maxAge;
     const encryptedStateData = await this.encrypt(
       identifier,
@@ -667,7 +756,7 @@ var StatefulStateStore = class extends AbstractSessionStore {
     if (sessionId) {
       const stateData = await this.#store.get(sessionId);
       if (!stateData) {
-        this.#cookieHandler.deleteCookie(identifier, options);
+        this.#cookieHandler.deleteCookie(identifier, options, this.#getCookieOptions());
       }
       return stateData;
     }
@@ -677,18 +766,29 @@ var StatefulStateStore = class extends AbstractSessionStore {
     if (sessionId) {
       await this.#store.delete(sessionId);
     }
-    this.#cookieHandler.deleteCookie(identifier, options);
+    this.#cookieHandler.deleteCookie(identifier, options, this.#getCookieOptions());
   }
   async getSessionId(identifier, options) {
     const cookieValue = this.#cookieHandler.getCookie(identifier, options);
     if (cookieValue) {
       const sessionCookie = await this.decrypt(identifier, cookieValue);
-      return sessionCookie.id;
+      if (sessionCookie) {
+        return sessionCookie.id;
+      }
     }
   }
   deleteByLogoutToken(claims, options) {
     return this.#store.deleteByLogoutToken(claims, options);
   }
+  #getCookieOptions(partial) {
+    return {
+      httpOnly: true,
+      sameSite: this.#cookieOptions?.sameSite ?? "lax",
+      path: this.#cookieOptions?.path ?? "/",
+      secure: this.#cookieOptions?.secure ?? true,
+      ...partial
+    };
+  }
 };
 
 // src/store/stateless-state-store.ts
@@ -702,13 +802,9 @@ var StatelessStateStore = class extends AbstractSessionStore {
   }
   async set(identifier, stateData, removeIfExists, options) {
     const maxAge = this.calculateMaxAge(stateData.internal.createdAt);
-    const cookieOpts = {
-      httpOnly: true,
-      sameSite: this.#cookieOptions?.sameSite ?? "lax",
-      path: "/",
-      secure: this.#cookieOptions?.secure ?? true,
+    const cookieOpts = this.#getCookieOptions({
       maxAge
-    };
+    });
     const expiration = Math.floor(Date.now() / 1e3 + maxAge);
     const encryptedStateData = await this.encrypt(identifier, stateData, expiration);
     const chunkSize = 3072;
@@ -723,7 +819,7 @@ var StatelessStateStore = class extends AbstractSessionStore {
     const existingCookieKeys = this.getCookieKeys(identifier, options);
     const cookieKeysToRemove = existingCookieKeys.filter((key) => !chunks.some((chunk) => chunk.name === key));
     cookieKeysToRemove.forEach((key) => {
-      this.#cookieHandler.deleteCookie(key, options);
+      this.#cookieHandler.deleteCookie(key, options, cookieOpts);
     });
   }
   async get(identifier, options) {
@@ -739,7 +835,7 @@ var StatelessStateStore = class extends AbstractSessionStore {
   async delete(identifier, options) {
     const cookieKeys = this.getCookieKeys(identifier, options);
     for (const key of cookieKeys) {
-      this.#cookieHandler.deleteCookie(key, options);
+      this.#cookieHandler.deleteCookie(key, options, this.#getCookieOptions());
     }
   }
   deleteByLogoutToken() {
@@ -750,6 +846,15 @@ var StatelessStateStore = class extends AbstractSessionStore {
   getCookieKeys(identifier, options) {
     return Object.keys(this.#cookieHandler.getCookies(options)).filter((key) => key.startsWith(identifier));
   }
+  #getCookieOptions(partial) {
+    return {
+      httpOnly: true,
+      sameSite: this.#cookieOptions?.sameSite ?? "lax",
+      path: this.#cookieOptions?.path ?? "/",
+      secure: this.#cookieOptions?.secure ?? true,
+      ...partial
+    };
+  }
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
@@ -757,6 +862,7 @@ var StatelessStateStore = class extends AbstractSessionStore {
   AbstractTransactionStore,
   BackchannelLogoutError,
   CookieTransactionStore,
+  InvalidConfigurationError,
   MissingRequiredArgumentError,
   MissingSessionError,
   MissingTransactionError,