@auth0/auth0-server-js 1.11.0 → 1.12.1

package/dist/index.cjs

@@ -262,7 +262,7 @@ function getTelemetryConfig(config) {
   return {
     enabled: true,
     name: config?.name ?? "@auth0/auth0-server-js",
-    version: config?.version ?? "1.11.0"
+    version: config?.version ?? "1.12.1"
   };
 }
 
@@ -368,6 +368,12 @@ var ServerPasskeyClient = class {
    *
    * This method does not create a session; no state is persisted.
    *
+   * On a confidential client this endpoint accepts `client_secret` as its only
+   * credential, so configure `clientSecret` on the `ServerClient`. It does not
+   * accept a private key JWT and is not served on the mTLS endpoint aliases, so a
+   * client configured with only `clientAssertionSigningKey` or only `useMtls` is
+   * rejected by Auth0. Public clients authenticate with `clientId` alone.
+   *
    * @param options User profile data and optional realm/organization.
    * @param storeOptions Optional options used to resolve the domain (resolver mode).
    *
@@ -390,6 +396,9 @@ var ServerPasskeyClient = class {
    *
    * This method does not create a session; no state is persisted.
    *
+   * Client authentication works the same way as {@link ServerPasskeyClient.register}:
+   * on a confidential client, only a `clientSecret` is accepted here.
+   *
    * @param options Optional realm/organization configuration.
    * @param storeOptions Optional options used to resolve the domain (resolver mode).
    *
@@ -1455,16 +1464,24 @@ var ServerClient = class {
    * on the result — it only appears on the target session's tokens once the STT is redeemed.
    *
    * An actor is mandatory for an STT (this is what makes it auditable impersonation). It is
-   * resolved in this order: an explicit `options.actor` wins; otherwise the current agent
-   * session's ID token is used, refreshed when it has expired; if neither is available the method
-   * throws before any network call.
+   * resolved in this order: an explicit `options.actor` wins, in which case the session is not
+   * read at all; otherwise the current agent session's ID token is used, refreshed when it has
+   * expired; if neither is available the method throws before any network call. An explicit actor
+   * token carrying the default ID token type must satisfy Auth0's own validation — see
+   * {@link SessionTransferActor.token}.
+   *
+   * When `organization` is provided it is sent on the exchange, so the tenant validates it while
+   * minting. This is a separate parameter from the `organization` passed to
+   * {@link ServerClient.buildSessionTransferRedirect}, which is forwarded to the target's
+   * `/authorize` on the redirect.
    *
    * @param options Options including the developer-supplied `subjectToken`/`subjectTokenType` and an optional explicit `actor`.
    * @param storeOptions Optional options used to read the agent session (for the actor) and resolve the request domain.
    *
-   * @throws {TokenExchangeError} With code `actor_unavailable` when no explicit actor is given and no usable session ID token can be resolved — no logged-in agent, a session that belongs to a different domain in resolver mode, or an expired ID token that cannot be refreshed (raised client-side, before any network call). With the default code when the exchange itself fails; a server-side `setactor_required` or `session_transfer_disabled` condition is surfaced via `cause.error` / `cause.error_description`.
+   * @throws {TokenExchangeError} With code `actor_unavailable` when no explicit actor is given and no usable session ID token can be resolved — no logged-in agent, a session that belongs to a different domain in resolver mode, or an expired ID token that cannot be refreshed (raised client-side, before any network call). With the default code when the exchange itself fails; a server-side `setactor_required` or `session_transfer_disabled` condition is surfaced via `cause.error` / `cause.error_description`. An organization the tenant rejects also surfaces here.
    * @throws {MissingClientAuthError} When client credentials are not configured (STT requires a confidential client).
    * @throws {MissingRequiredArgumentError} When `subjectToken` or `subjectTokenType` is missing or blank (raised before any session read or network call).
+   * @throws {OrganizationValidationError} When `organization` is provided but blank (raised before any session read or network call).
    *
    * @returns A promise resolving to a {@link SessionTransferTokenResult} containing the STT and its metadata.
    */
@@ -1475,6 +1492,9 @@ var ServerClient = class {
     if (!options.subjectTokenType || !options.subjectTokenType.trim()) {
       throw new MissingRequiredArgumentError("subjectTokenType");
     }
+    if (options.organization !== void 0 && !options.organization.trim()) {
+      throw new import_auth0_auth_js.OrganizationValidationError("organization must not be blank");
+    }
     const domain = await this.#resolveDomain(storeOptions);
     const actor = await this.#resolveSessionTransferActor(options.actor, domain, storeOptions);
     const authClient = this.#getAuthClient(domain);
@@ -1485,6 +1505,11 @@ var ServerClient = class {
       scope: options.scope,
       actorToken: actor.token,
       actorTokenType: actor.type,
+      // Forwarded so the tenant validates the organization against the client's organization
+      // settings while minting, rather than the STT being issued without it. Separate from the
+      // `organization` on `buildSessionTransferRedirect`, which goes to the target's
+      // `/authorize`; neither implies the other.
+      organization: options.organization,
       extra: options.extra
     });
     return {