@auth0/auth0-server-js 1.1.0 → 1.3.0

package/dist/index.js

@@ -34,26 +34,33 @@ var MissingSessionError = class extends Error {
     this.name = "MissingSessionError";
   }
 };
+var InvalidConfigurationError = class extends Error {
+  code = "invalid_configuration_error";
+  constructor(message) {
+    super(message);
+    this.name = "InvalidConfigurationError";
+  }
+};
 
 // src/state/utils.ts
-function updateStateData(audience, stateDate, tokenEndpointResponse) {
-  if (stateDate) {
-    const isNewTokenSet = !stateDate.tokenSets.some(
+var createUpdatedTokenSet = (audience, response) => ({
+  audience,
+  accessToken: response.accessToken,
+  scope: response.scope,
+  expiresAt: response.expiresAt
+});
+function updateStateData(audience, stateData, tokenEndpointResponse) {
+  if (stateData) {
+    const isNewTokenSet = !stateData.tokenSets.some(
       (tokenSet) => tokenSet.audience === audience && tokenSet.scope === tokenEndpointResponse.scope
     );
-    const createUpdatedTokenSet = (response) => ({
-      audience,
-      accessToken: response.accessToken,
-      scope: response.scope,
-      expiresAt: Math.floor(Date.now() / 1e3) + Number(response.expiresAt)
-    });
-    const tokenSets = isNewTokenSet ? [...stateDate.tokenSets, createUpdatedTokenSet(tokenEndpointResponse)] : stateDate.tokenSets.map(
-      (tokenSet) => tokenSet.audience === audience && tokenSet.scope === tokenEndpointResponse.scope ? createUpdatedTokenSet(tokenEndpointResponse) : tokenSet
+    const tokenSets = isNewTokenSet ? [...stateData.tokenSets, createUpdatedTokenSet(audience, tokenEndpointResponse)] : stateData.tokenSets.map(
+      (tokenSet) => tokenSet.audience === audience && tokenSet.scope === tokenEndpointResponse.scope ? createUpdatedTokenSet(audience, tokenEndpointResponse) : tokenSet
     );
     return {
-      ...stateDate,
-      idToken: tokenEndpointResponse.idToken,
-      refreshToken: tokenEndpointResponse.refreshToken ?? stateDate.refreshToken,
+      ...stateData,
+      idToken: tokenEndpointResponse.idToken ?? stateData.idToken,
+      refreshToken: tokenEndpointResponse.refreshToken ?? stateData.refreshToken,
       tokenSets
     };
   } else {
@@ -63,12 +70,7 @@ function updateStateData(audience, stateDate, tokenEndpointResponse) {
       idToken: tokenEndpointResponse.idToken,
       refreshToken: tokenEndpointResponse.refreshToken,
       tokenSets: [
-        {
-          audience,
-          accessToken: tokenEndpointResponse.accessToken,
-          scope: tokenEndpointResponse.scope,
-          expiresAt: tokenEndpointResponse.expiresAt
-        }
+        createUpdatedTokenSet(audience, tokenEndpointResponse)
       ],
       internal: {
         sid: user?.sid,
@@ -77,9 +79,9 @@ function updateStateData(audience, stateDate, tokenEndpointResponse) {
     };
   }
 }
-function updateStateDataForConnectionTokenSet(options, stateDate, tokenEndpointResponse) {
-  stateDate.connectionTokenSets = stateDate.connectionTokenSets || [];
-  const isNewTokenSet = !stateDate.connectionTokenSets.some(
+function updateStateDataForConnectionTokenSet(options, stateData, tokenEndpointResponse) {
+  stateData.connectionTokenSets = stateData.connectionTokenSets || [];
+  const isNewTokenSet = !stateData.connectionTokenSets.some(
     (tokenSet) => tokenSet.connection === options.connection && (!options.loginHint || tokenSet.loginHint === options.loginHint)
   );
   const connectionTokenSet = {
@@ -89,11 +91,11 @@ function updateStateDataForConnectionTokenSet(options, stateDate, tokenEndpointR
     scope: tokenEndpointResponse.scope,
     expiresAt: tokenEndpointResponse.expiresAt
   };
-  const connectionTokenSets = isNewTokenSet ? [...stateDate.connectionTokenSets, connectionTokenSet] : stateDate.connectionTokenSets.map(
+  const connectionTokenSets = isNewTokenSet ? [...stateData.connectionTokenSets, connectionTokenSet] : stateData.connectionTokenSets.map(
     (tokenSet) => tokenSet.connection === options.connection && (!options.loginHint || tokenSet.loginHint === options.loginHint) ? connectionTokenSet : tokenSet
   );
   return {
-    ...stateDate,
+    ...stateData,
     connectionTokenSets
   };
 }
@@ -118,7 +120,30 @@ var compareScopes = (scopes, requiredScopes) => {
   return requiredScopesArray.every((scope) => scopesSet.has(scope));
 };
 
+// src/telemetry.ts
+function getTelemetryConfig(config) {
+  if (config?.enabled === false) {
+    return config;
+  }
+  return {
+    enabled: true,
+    name: config?.name ?? "@auth0/auth0-server-js",
+    version: config?.version ?? "1.3.0"
+  };
+}
+
 // src/server-client.ts
+var DEFAULT_SCOPES = "openid profile email offline_access";
+function ensureOpenIdScope(scope) {
+  if (!scope) {
+    return DEFAULT_SCOPES;
+  }
+  const scopes = scope.split(" ");
+  if (!scopes.includes("openid")) {
+    scopes.unshift("openid");
+  }
+  return scopes.join(" ");
+}
 var ServerClient = class {
   #options;
   #transactionStore;
@@ -152,7 +177,8 @@ var ServerClient = class {
       clientAssertionSigningAlg: this.#options.clientAssertionSigningAlg,
       authorizationParams: this.#options.authorizationParams,
       customFetch: this.#options.customFetch,
-      useMtls: this.#options.useMtls
+      useMtls: this.#options.useMtls,
+      telemetry: getTelemetryConfig(this.#options.telemetry)
     });
   }
   /**
@@ -169,11 +195,13 @@ var ServerClient = class {
     if (!redirectUri) {
       throw new MissingRequiredArgumentError("authorizationParams.redirect_uri");
     }
+    const scope = ensureOpenIdScope(options?.authorizationParams?.scope ?? this.#options.authorizationParams?.scope);
     const { codeVerifier, authorizationUrl } = await this.authClient.buildAuthorizationUrl({
       pushedAuthorizationRequests: options?.pushedAuthorizationRequests,
       authorizationParams: {
         ...options?.authorizationParams,
-        redirect_uri: redirectUri
+        redirect_uri: redirectUri,
+        scope
       }
     });
     const transactionState = {
@@ -323,10 +351,14 @@ var ServerClient = class {
    * @returns A promise resolving to an object, containing the authorizationDetails (when RAR was used).
    */
   async loginBackchannel(options, storeOptions) {
+    const scope = ensureOpenIdScope(options.authorizationParams?.scope ?? this.#options.authorizationParams?.scope);
     const tokenEndpointResponse = await this.authClient.backchannelAuthentication({
       bindingMessage: options.bindingMessage,
       loginHint: options.loginHint,
-      authorizationParams: options.authorizationParams
+      authorizationParams: {
+        ...options.authorizationParams,
+        scope
+      }
     });
     const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
     const stateData = updateStateData(
@@ -363,16 +395,24 @@ var ServerClient = class {
   /**
    * Retrieves the access token from the store, or calls Auth0 when the access token is expired and a refresh token is available in the store.
    * Also updates the store when a new token was retrieved from Auth0.
+   *
+   * @param options Optional options for requesting specific audience/scope.
    * @param storeOptions Optional options used to pass to the Transaction and State Store.
    *
    * @throws {TokenByRefreshTokenError} If the refresh token was not found or there was an issue requesting the access token.
    *
    * @returns The Token Set, containing the access token, as well as additional information.
    */
-  async getAccessToken(storeOptions) {
-    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
-    const audience = this.#options.authorizationParams?.audience ?? "default";
-    const scope = this.#options.authorizationParams?.scope;
+  async getAccessToken(tokenOptionsOrStoreOptions, storeOptions) {
+    const hasTokenOptions = (
+      // If second arg exists, first arg must be GetAccessTokenOptions
+      storeOptions !== void 0 || // OR if first arg has audience/scope properties
+      tokenOptionsOrStoreOptions && typeof tokenOptionsOrStoreOptions === "object" && ("audience" in tokenOptionsOrStoreOptions || "scope" in tokenOptionsOrStoreOptions)
+    );
+    const [resolvedOptions, resolvedStoreOptions] = hasTokenOptions ? [tokenOptionsOrStoreOptions, storeOptions] : [void 0, tokenOptionsOrStoreOptions];
+    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, resolvedStoreOptions);
+    const audience = resolvedOptions?.audience ?? this.#options.authorizationParams?.audience ?? "default";
+    const scope = resolvedOptions?.scope ?? this.#options.authorizationParams?.scope;
     const tokenSet = stateData?.tokenSets.find(
       (tokenSet2) => tokenSet2.audience === audience && (!scope || compareScopes(tokenSet2.scope, scope))
     );
@@ -384,12 +424,14 @@ var ServerClient = class {
         "The access token has expired and a refresh token was not provided. The user needs to re-authenticate."
       );
     }
-    const tokenEndpointResponse = await this.authClient.getTokenByRefreshToken({
-      refreshToken: stateData.refreshToken
-    });
-    const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
+    const tokenByRefreshTokenOptions = {
+      refreshToken: stateData.refreshToken,
+      ...hasTokenOptions && { audience, scope }
+    };
+    const tokenEndpointResponse = await this.authClient.getTokenByRefreshToken(tokenByRefreshTokenOptions);
+    const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, resolvedStoreOptions);
     const updatedStateData = updateStateData(audience, existingStateData, tokenEndpointResponse);
-    await this.#stateStore.set(this.#stateStoreIdentifier, updatedStateData, false, storeOptions);
+    await this.#stateStore.set(this.#stateStoreIdentifier, updatedStateData, false, resolvedStoreOptions);
     return {
       accessToken: tokenEndpointResponse.accessToken,
       scope: tokenEndpointResponse.scope,
@@ -468,13 +510,16 @@ var ServerClient = class {
 };
 
 // src/encryption/index.ts
-import { EncryptJWT, jwtDecrypt } from "jose";
+import { EncryptJWT, jwtDecrypt, errors } from "jose";
 var ENC = "A256CBC-HS512";
 var ALG = "dir";
 var DIGEST = "SHA-256";
 var BIT_LENGTH = 512;
 var HKDF_INFO = "derived cookie encryption secret";
 var encoder;
+function isDecryptionError(e) {
+  return e instanceof errors.JWEDecryptionFailed || e instanceof errors.JWEInvalid;
+}
 async function deriveEncryptionSecret(secret, salt, kid) {
   encoder ||= new TextEncoder();
   const key = await crypto.subtle.importKey("raw", encoder.encode(secret), "HKDF", false, ["deriveBits"]);
@@ -491,12 +536,23 @@ async function deriveEncryptionSecret(secret, salt, kid) {
     )
   );
 }
-async function encrypt(payload, secret, salt, expiration) {
+async function _encrypt(payload, secret, salt, expiration) {
   const kid = crypto.randomUUID();
   const encryptionSecret = await deriveEncryptionSecret(secret, salt, kid);
   return await new EncryptJWT(payload).setProtectedHeader({ enc: ENC, alg: ALG, kid }).setExpirationTime(expiration).encrypt(encryptionSecret);
 }
-async function decrypt(value, secret, salt) {
+async function encrypt(payload, secret, salt, expiration) {
+  if (typeof secret === "string") {
+    return await _encrypt(payload, secret, salt, expiration);
+  } else {
+    const [newSecret] = secret;
+    if (!newSecret) {
+      throw new InvalidConfigurationError("At least one secret must be provided");
+    }
+    return await _encrypt(payload, newSecret, salt, expiration);
+  }
+}
+async function _decrypt(value, secret, salt) {
   const res = await jwtDecrypt(
     value,
     async (protectedHeader) => {
@@ -509,6 +565,35 @@ async function decrypt(value, secret, salt) {
   );
   return res.payload;
 }
+async function decrypt(value, secret, salt) {
+  if (typeof secret === "string") {
+    return await _decrypt(value, secret, salt);
+  } else {
+    const [newSecret, ...oldSecrets] = secret;
+    if (!newSecret) {
+      throw new InvalidConfigurationError("At least one secret must be provided");
+    }
+    let firstError;
+    try {
+      return await _decrypt(value, newSecret, salt);
+    } catch (err) {
+      firstError = err;
+      if (!isDecryptionError(err)) {
+        throw firstError;
+      }
+      for (const oldSecret of oldSecrets) {
+        try {
+          return await _decrypt(value, oldSecret, salt);
+        } catch (fallbackErr) {
+          if (!isDecryptionError(fallbackErr)) {
+            throw fallbackErr;
+          }
+        }
+      }
+      throw firstError;
+    }
+  }
+}
 
 // src/store/abstract-store.ts
 var AbstractStore = class {
@@ -520,7 +605,14 @@ var AbstractStore = class {
     return await encrypt(stateData, this.options.secret, identifier, expiration);
   }
   async decrypt(identifier, encryptedStateData) {
-    return await decrypt(encryptedStateData, this.options.secret, identifier);
+    try {
+      return await decrypt(encryptedStateData, this.options.secret, identifier);
+    } catch (e) {
+      if (isDecryptionError(e)) {
+        return;
+      }
+      throw e;
+    }
   }
 };
 
@@ -612,13 +704,9 @@ var StatefulStateStore = class extends AbstractSessionStore {
     }
     sessionId ??= generateId();
     const maxAge = this.calculateMaxAge(stateData.internal.createdAt);
-    const cookieOpts = {
-      httpOnly: true,
-      sameSite: this.#cookieOptions?.sameSite ?? "lax",
-      path: "/",
-      secure: this.#cookieOptions?.secure,
+    const cookieOpts = this.#getCookieOptions({
       maxAge
-    };
+    });
     const expiration = Date.now() / 1e3 + maxAge;
     const encryptedStateData = await this.encrypt(
       identifier,
@@ -635,7 +723,7 @@ var StatefulStateStore = class extends AbstractSessionStore {
     if (sessionId) {
       const stateData = await this.#store.get(sessionId);
       if (!stateData) {
-        this.#cookieHandler.deleteCookie(identifier, options);
+        this.#cookieHandler.deleteCookie(identifier, options, this.#getCookieOptions());
       }
       return stateData;
     }
@@ -645,18 +733,29 @@ var StatefulStateStore = class extends AbstractSessionStore {
     if (sessionId) {
       await this.#store.delete(sessionId);
     }
-    this.#cookieHandler.deleteCookie(identifier, options);
+    this.#cookieHandler.deleteCookie(identifier, options, this.#getCookieOptions());
   }
   async getSessionId(identifier, options) {
     const cookieValue = this.#cookieHandler.getCookie(identifier, options);
     if (cookieValue) {
       const sessionCookie = await this.decrypt(identifier, cookieValue);
-      return sessionCookie.id;
+      if (sessionCookie) {
+        return sessionCookie.id;
+      }
     }
   }
   deleteByLogoutToken(claims, options) {
     return this.#store.deleteByLogoutToken(claims, options);
   }
+  #getCookieOptions(partial) {
+    return {
+      httpOnly: true,
+      sameSite: this.#cookieOptions?.sameSite ?? "lax",
+      path: this.#cookieOptions?.path ?? "/",
+      secure: this.#cookieOptions?.secure ?? true,
+      ...partial
+    };
+  }
 };
 
 // src/store/stateless-state-store.ts
@@ -670,13 +769,9 @@ var StatelessStateStore = class extends AbstractSessionStore {
   }
   async set(identifier, stateData, removeIfExists, options) {
     const maxAge = this.calculateMaxAge(stateData.internal.createdAt);
-    const cookieOpts = {
-      httpOnly: true,
-      sameSite: this.#cookieOptions?.sameSite ?? "lax",
-      path: "/",
-      secure: this.#cookieOptions?.secure ?? true,
+    const cookieOpts = this.#getCookieOptions({
       maxAge
-    };
+    });
     const expiration = Math.floor(Date.now() / 1e3 + maxAge);
     const encryptedStateData = await this.encrypt(identifier, stateData, expiration);
     const chunkSize = 3072;
@@ -691,7 +786,7 @@ var StatelessStateStore = class extends AbstractSessionStore {
     const existingCookieKeys = this.getCookieKeys(identifier, options);
     const cookieKeysToRemove = existingCookieKeys.filter((key) => !chunks.some((chunk) => chunk.name === key));
     cookieKeysToRemove.forEach((key) => {
-      this.#cookieHandler.deleteCookie(key, options);
+      this.#cookieHandler.deleteCookie(key, options, cookieOpts);
     });
   }
   async get(identifier, options) {
@@ -707,7 +802,7 @@ var StatelessStateStore = class extends AbstractSessionStore {
   async delete(identifier, options) {
     const cookieKeys = this.getCookieKeys(identifier, options);
     for (const key of cookieKeys) {
-      this.#cookieHandler.deleteCookie(key, options);
+      this.#cookieHandler.deleteCookie(key, options, this.#getCookieOptions());
     }
   }
   deleteByLogoutToken() {
@@ -718,12 +813,22 @@ var StatelessStateStore = class extends AbstractSessionStore {
   getCookieKeys(identifier, options) {
     return Object.keys(this.#cookieHandler.getCookies(options)).filter((key) => key.startsWith(identifier));
   }
+  #getCookieOptions(partial) {
+    return {
+      httpOnly: true,
+      sameSite: this.#cookieOptions?.sameSite ?? "lax",
+      path: this.#cookieOptions?.path ?? "/",
+      secure: this.#cookieOptions?.secure ?? true,
+      ...partial
+    };
+  }
 };
 export {
   AbstractStateStore,
   AbstractTransactionStore,
   BackchannelLogoutError,
   CookieTransactionStore,
+  InvalidConfigurationError,
   MissingRequiredArgumentError,
   MissingSessionError,
   MissingTransactionError,