@auth0/auth0-server-js 1.13.0 → 1.15.0

package/dist/index.cjs

@@ -23,38 +23,40 @@ __export(index_exports, {
   AbstractStateStore: () => AbstractStateStore,
   AbstractTransactionStore: () => AbstractTransactionStore,
   BackchannelLogoutError: () => BackchannelLogoutError,
-  ChangePasswordError: () => import_auth0_auth_js4.ChangePasswordError,
+  ChangePasswordError: () => import_auth0_auth_js5.ChangePasswordError,
   CookieTransactionStore: () => CookieTransactionStore,
+  EnterpriseConnectNotSupportedError: () => import_auth0_auth_js6.EnterpriseConnectNotSupportedError,
   InvalidConfigurationError: () => InvalidConfigurationError,
   IssuerValidationError: () => IssuerValidationError,
-  MfaChallengeError: () => import_auth0_auth_js2.MfaChallengeError,
-  MfaEnrollmentError: () => import_auth0_auth_js2.MfaEnrollmentError,
-  MfaListAuthenticatorsError: () => import_auth0_auth_js2.MfaListAuthenticatorsError,
-  MfaVerifyError: () => import_auth0_auth_js2.MfaVerifyError,
-  MissingClientAuthError: () => import_auth0_auth_js5.MissingClientAuthError,
+  MfaChallengeError: () => import_auth0_auth_js3.MfaChallengeError,
+  MfaEnrollmentError: () => import_auth0_auth_js3.MfaEnrollmentError,
+  MfaListAuthenticatorsError: () => import_auth0_auth_js3.MfaListAuthenticatorsError,
+  MfaVerifyError: () => import_auth0_auth_js3.MfaVerifyError,
+  MissingClientAuthError: () => import_auth0_auth_js6.MissingClientAuthError,
   MissingRequiredArgumentError: () => MissingRequiredArgumentError,
   MissingSessionError: () => MissingSessionError,
   MissingTransactionError: () => MissingTransactionError,
-  OrganizationValidationError: () => import_auth0_auth_js5.OrganizationValidationError,
-  PasskeyChallengeError: () => import_auth0_auth_js3.PasskeyChallengeError,
-  PasskeyGetTokenError: () => import_auth0_auth_js3.PasskeyGetTokenError,
-  PasskeyRegisterError: () => import_auth0_auth_js3.PasskeyRegisterError,
-  PasswordlessStartError: () => import_auth0_auth_js5.PasswordlessStartError,
-  PasswordlessVerifyError: () => import_auth0_auth_js5.PasswordlessVerifyError,
+  OrganizationValidationError: () => import_auth0_auth_js6.OrganizationValidationError,
+  PasskeyChallengeError: () => import_auth0_auth_js4.PasskeyChallengeError,
+  PasskeyGetTokenError: () => import_auth0_auth_js4.PasskeyGetTokenError,
+  PasskeyRegisterError: () => import_auth0_auth_js4.PasskeyRegisterError,
+  PasswordlessStartError: () => import_auth0_auth_js6.PasswordlessStartError,
+  PasswordlessVerifyError: () => import_auth0_auth_js6.PasswordlessVerifyError,
   ServerClient: () => ServerClient,
   ServerDatabaseClient: () => ServerDatabaseClient,
   ServerMfaClient: () => ServerMfaClient,
   ServerPasskeyClient: () => ServerPasskeyClient,
   SessionExpiredError: () => SessionExpiredError,
-  SignUpError: () => import_auth0_auth_js4.SignUpError,
+  SignUpError: () => import_auth0_auth_js5.SignUpError,
   StartLinkUserError: () => StartLinkUserError,
   StatefulStateStore: () => StatefulStateStore,
   StatelessStateStore: () => StatelessStateStore,
-  TokenExchangeError: () => import_auth0_auth_js5.TokenExchangeError,
+  TokenExchangeError: () => import_auth0_auth_js6.TokenExchangeError,
   TokenExchangeErrorCode: () => TokenExchangeErrorCode,
-  TokenRevocationError: () => import_auth0_auth_js5.TokenRevocationError,
-  UserInfoError: () => import_auth0_auth_js5.UserInfoError,
-  isMfaRequiredError: () => import_auth0_auth_js5.isMfaRequiredError
+  TokenRevocationError: () => import_auth0_auth_js6.TokenRevocationError,
+  UserInfoError: () => import_auth0_auth_js6.UserInfoError,
+  isFederatedDomain: () => import_auth0_auth_js6.isFederatedDomain,
+  isMfaRequiredError: () => import_auth0_auth_js6.isMfaRequiredError
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -225,7 +227,7 @@ function updateStateDataForConnectionTokenSet(options, stateData, tokenEndpointR
 }
 
 // src/server-client.ts
-var import_auth0_auth_js = require("@auth0/auth0-auth-js");
+var import_auth0_auth_js2 = require("@auth0/auth0-auth-js");
 
 // src/utils.ts
 var DEFAULT_SCOPES = "openid profile email offline_access";
@@ -263,7 +265,7 @@ function getTelemetryConfig(config) {
   return {
     enabled: true,
     name: config?.name ?? "@auth0/auth0-server-js",
-    version: config?.version ?? "1.13.0"
+    version: config?.version ?? "1.15.0"
   };
 }
 
@@ -498,6 +500,47 @@ var ServerDatabaseClient = class {
   }
 };
 
+// src/enterprise-connect.ts
+var import_auth0_auth_js = require("@auth0/auth0-auth-js");
+var EC_ALLOWED_METHODS = /* @__PURE__ */ new Set([
+  "startInteractiveLogin",
+  "startEnterpriseLogin",
+  "completeInteractiveLogin",
+  "logout",
+  "customTokenExchange",
+  "handleBackchannelLogout"
+]);
+var EC_ALLOWED_GETTERS = /* @__PURE__ */ new Set(["authClient"]);
+var NullStateStore = class {
+  async get() {
+    return void 0;
+  }
+  async set() {
+  }
+  async delete() {
+  }
+  async deleteByLogoutToken() {
+  }
+};
+function applyEnterpriseConnectRestrictions(instance) {
+  const proto = Object.getPrototypeOf(instance);
+  for (const [name, desc] of Object.entries(Object.getOwnPropertyDescriptors(proto))) {
+    if (name === "constructor") continue;
+    if (desc.get && !EC_ALLOWED_GETTERS.has(name)) {
+      Object.defineProperty(instance, name, {
+        get: () => {
+          throw new import_auth0_auth_js.EnterpriseConnectNotSupportedError(name);
+        },
+        configurable: true
+      });
+    } else if (typeof desc.value === "function" && !EC_ALLOWED_METHODS.has(name)) {
+      instance[name] = () => {
+        throw new import_auth0_auth_js.EnterpriseConnectNotSupportedError(name);
+      };
+    }
+  }
+}
+
 // src/server-client.ts
 var normalizeDomain = (value) => {
   const trimmed = value.trim();
@@ -515,7 +558,7 @@ var decodeIssuer = (token) => {
 var ID_TOKEN_TYPE = "urn:ietf:params:oauth:token-type:id_token";
 var ID_TOKEN_EXPIRY_SKEW_SECONDS = 30;
 var actorUnavailableError = (message) => {
-  const error = new import_auth0_auth_js.TokenExchangeError(message);
+  const error = new import_auth0_auth_js2.TokenExchangeError(message);
   error.code = TokenExchangeErrorCode.ACTOR_UNAVAILABLE;
   return error;
 };
@@ -536,6 +579,7 @@ var ServerClient = class {
   #transactionStoreIdentifier;
   #stateStore;
   #stateStoreIdentifier;
+  #enterpriseConnect;
   #authClientOptions;
   #staticDomain;
   #authClient;
@@ -606,16 +650,36 @@ var ServerClient = class {
   }
   constructor(options) {
     this.#options = options;
+    this.#enterpriseConnect = !!options.enterpriseConnect;
     this.#stateStoreIdentifier = this.#options.stateIdentifier || "__a0_session";
     this.#transactionStoreIdentifier = this.#options.transactionIdentifier || "__a0_tx";
     this.#transactionStore = options.transactionStore;
-    this.#stateStore = options.stateStore;
-    if (!this.#options.stateStore) {
+    if (!this.#enterpriseConnect && !this.#options.stateStore) {
       throw new MissingRequiredArgumentError("stateStore");
     }
+    this.#stateStore = this.#enterpriseConnect ? new NullStateStore() : this.#options.stateStore;
     if (!this.#options.transactionStore) {
       throw new MissingRequiredArgumentError("transactionStore");
     }
+    if (this.#enterpriseConnect) {
+      if (typeof this.#options.domain === "function") {
+        throw new InvalidConfigurationError(
+          "Enterprise Connect requires a static domain string. DomainResolver is not supported because isFederatedDomain needs a concrete domain."
+        );
+      }
+      const scope = this.#options.authorizationParams?.scope ?? "";
+      if (scope.includes("offline_access")) {
+        console.warn(
+          '[Auth0] Enterprise Connect: "offline_access" in scope has no effect. B2B Integration clients are not issued refresh tokens.'
+        );
+      }
+      if (this.#options.organization || this.#options.authorizationParams?.organization) {
+        console.warn(
+          '[Auth0] Enterprise Connect: static "organization" is set. The organization is resolved per login by HRD from the login_hint email domain. A static value routes all enterprise users to the same organization.'
+        );
+      }
+      applyEnterpriseConnectRestrictions(this);
+    }
     if (typeof this.#options.domain !== "string" && typeof this.#options.domain !== "function") {
       throw new InvalidConfigurationError("domain must be a string or resolver function");
     }
@@ -632,7 +696,7 @@ var ServerClient = class {
     if (typeof this.#options.domain === "string") {
       const domain = normalizeDomain(this.#options.domain);
       this.#staticDomain = domain;
-      this.#authClient = new import_auth0_auth_js.AuthClient({
+      this.#authClient = new import_auth0_auth_js2.AuthClient({
         domain,
         ...this.#authClientOptions,
         telemetry: getTelemetryConfig(this.#options.telemetry)
@@ -669,7 +733,7 @@ var ServerClient = class {
     return normalizeDomain(this.#options.domain);
   }
   #createAuthClient(domain) {
-    return new import_auth0_auth_js.AuthClient({
+    return new import_auth0_auth_js2.AuthClient({
       domain,
       ...this.#authClientOptions,
       telemetry: getTelemetryConfig(this.#options.telemetry)
@@ -706,6 +770,33 @@ var ServerClient = class {
     const resolvedDomain = await this.#resolveDomain(storeOptions);
     return sessionDomain === resolvedDomain;
   }
+  /**
+   * Starts the Enterprise Connect login flow. Performs WebFinger domain discovery
+   * and, if the email domain is federated, initiates an interactive login with `login_hint`.
+   *
+   * @param options Options including the user's email and optional returnTo URL.
+   * @param storeOptions Optional options passed to the Transaction Store.
+   *
+   * @returns A URL to redirect to (federated domain) or null (not federated / invalid email).
+   */
+  async startEnterpriseLogin(options, storeOptions) {
+    const parts = options.email.split("@");
+    if (parts.length !== 2 || !parts[0] || !parts[1]) return null;
+    const emailDomain = parts[1].toLowerCase();
+    const domain = await this.#resolveDomain(storeOptions);
+    const isFederated = await (0, import_auth0_auth_js2.isFederatedDomain)(domain, emailDomain, {
+      customFetch: this.#options.customFetch,
+      telemetry: getTelemetryConfig(this.#options.telemetry)
+    });
+    if (!isFederated) return null;
+    return this.startInteractiveLogin(
+      {
+        authorizationParams: { login_hint: options.email },
+        appState: options.returnTo ? { returnTo: options.returnTo } : void 0
+      },
+      storeOptions
+    );
+  }
   /**
    * Starts the interactive login process, and returns a URL to redirect the user-agent to to request authorization at Auth0.
    *
@@ -727,12 +818,13 @@ var ServerClient = class {
     if (!redirectUri) {
       throw new MissingRequiredArgumentError("authorizationParams.redirect_uri");
     }
-    const scope = ensureOpenIdScope(options?.authorizationParams?.scope ?? this.#options.authorizationParams?.scope);
+    const rawScope = ensureOpenIdScope(options?.authorizationParams?.scope ?? this.#options.authorizationParams?.scope);
+    const scope = this.#enterpriseConnect ? rawScope.split(" ").filter((s) => s !== "offline_access").join(" ") : rawScope;
     const perLoginAuthParamsOrganization = typeof options?.authorizationParams?.organization === "string" ? options.authorizationParams.organization : void 0;
     const clientAuthParamsOrganization = typeof this.#options.authorizationParams?.organization === "string" ? this.#options.authorizationParams.organization : void 0;
     const resolvedOrganization = options?.organization ?? perLoginAuthParamsOrganization ?? this.#options.organization ?? clientAuthParamsOrganization;
     if (resolvedOrganization !== void 0 && !resolvedOrganization.trim()) {
-      throw new import_auth0_auth_js.OrganizationValidationError("organization must not be blank");
+      throw new import_auth0_auth_js2.OrganizationValidationError("organization must not be blank");
     }
     const hasInvitation = !!(options?.invitation || options?.authorizationParams?.invitation);
     if (hasInvitation && !resolvedOrganization) {
@@ -777,6 +869,7 @@ var ServerClient = class {
    * @throws {SessionExpiredError} When the ID token's `session_expiry` is already in the past at login (the session is born expired); nothing is persisted.
    *
    * @returns A promise resolving to an object, containing the original appState (if present) and the authorizationDetails (when RAR was used).
+   * In Enterprise Connect mode, also includes `idTokenClaims` and `user`.
    *
    * @remarks
    * This method does not support the `fullResponse` opt-in in v1. It accepts
@@ -798,6 +891,16 @@ var ServerClient = class {
       organization: transactionData.organization
     }, requestOptions);
     await this.#transactionStore.delete(this.#transactionStoreIdentifier, storeOptions);
+    if (this.#enterpriseConnect) {
+      const claims = tokenEndpointResponse.claims;
+      const user = claims ? Object.fromEntries(Object.entries(claims).filter(([, v]) => v !== void 0)) : void 0;
+      return {
+        appState: transactionData.appState,
+        authorizationDetails: tokenEndpointResponse.authorizationDetails,
+        idTokenClaims: claims,
+        user
+      };
+    }
     const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
     const stateData = applySessionExpiryAtLogin(
       updateStateData(transactionData.audience ?? "default", existingStateData, tokenEndpointResponse, {
@@ -806,7 +909,10 @@ var ServerClient = class {
       tokenEndpointResponse.claims
     );
     await this.#stateStore.set(this.#stateStoreIdentifier, stateData, true, storeOptions);
-    return { appState: transactionData.appState, authorizationDetails: tokenEndpointResponse.authorizationDetails };
+    return {
+      appState: transactionData.appState,
+      authorizationDetails: tokenEndpointResponse.authorizationDetails
+    };
   }
   /**
    * Starts the user linking process, and returns a URL to redirect the user-agent to to request authorization at Auth0.
@@ -975,7 +1081,7 @@ var ServerClient = class {
     };
     if (options.fullResponse) {
       if (!response) {
-        throw new import_auth0_auth_js.MissingCapturedResponseError();
+        throw new import_auth0_auth_js2.MissingCapturedResponseError();
       }
       return { data: result, response };
     }
@@ -1044,7 +1150,7 @@ var ServerClient = class {
       return;
     }
     if (!options.redirectUri || typeof options.redirectUri !== "string") {
-      throw new import_auth0_auth_js.PasswordlessStartError("redirectUri is required to start a passwordless magic-link login.");
+      throw new import_auth0_auth_js2.PasswordlessStartError("redirectUri is required to start a passwordless magic-link login.");
     }
     const state = crypto.randomUUID();
     const scope = ensureOpenIdScope(options.scope ?? this.#options.authorizationParams?.scope);
@@ -1121,7 +1227,7 @@ var ServerClient = class {
     };
     if (options.fullResponse) {
       if (!response) {
-        throw new import_auth0_auth_js.MissingCapturedResponseError();
+        throw new import_auth0_auth_js2.MissingCapturedResponseError();
       }
       return { data: result, response };
     }
@@ -1156,7 +1262,7 @@ var ServerClient = class {
     const expectedState = typeof transactionData.state === "string" ? transactionData.state : void 0;
     const returnedState = url.searchParams.get("state");
     if (!returnedState || !expectedState || returnedState !== expectedState) {
-      throw new import_auth0_auth_js.PasswordlessVerifyError("State mismatch on magic-link callback");
+      throw new import_auth0_auth_js2.PasswordlessVerifyError("State mismatch on magic-link callback");
     }
     const domain = transactionData.domain ?? await this.#resolveDomain(storeOptions);
     const authClient = this.#getAuthClient(domain);
@@ -1313,7 +1419,7 @@ var ServerClient = class {
       }
     }
     if (!stateData?.refreshToken) {
-      throw new import_auth0_auth_js.TokenByRefreshTokenError(
+      throw new import_auth0_auth_js2.TokenByRefreshTokenError(
         "The access token has expired and a refresh token was not provided. The user needs to re-authenticate."
       );
     }
@@ -1352,7 +1458,7 @@ var ServerClient = class {
     };
     if (resolvedOptions?.fullResponse) {
       if (!response) {
-        throw new import_auth0_auth_js.MissingCapturedResponseError();
+        throw new import_auth0_auth_js2.MissingCapturedResponseError();
       }
       return { data: returnTokenSet, response };
     }
@@ -1382,7 +1488,7 @@ var ServerClient = class {
       }
     }
     if (!stateData?.refreshToken) {
-      throw new import_auth0_auth_js.TokenForConnectionError(
+      throw new import_auth0_auth_js2.TokenForConnectionError(
         "A refresh token was not found but is required to be able to retrieve an access token for a connection."
       );
     }
@@ -1423,7 +1529,7 @@ var ServerClient = class {
     };
     if (options.fullResponse) {
       if (!response) {
-        throw new import_auth0_auth_js.MissingCapturedResponseError();
+        throw new import_auth0_auth_js2.MissingCapturedResponseError();
       }
       return { data: returnConnectionTokenSet, response };
     }
@@ -1479,6 +1585,14 @@ var ServerClient = class {
    * @returns {URL}
    */
   async logout(options, storeOptions, requestOptions) {
+    if (this.#enterpriseConnect) {
+      if (options.federated === false) {
+        console.warn(
+          "[Auth0] Enterprise Connect: logout() called with federated=false. The enterprise IdP session will remain active; the user may silently re-authenticate on the next login."
+        );
+      }
+      return this.authClient.buildLogoutUrl({ returnTo: options.returnTo, federated: options.federated ?? true });
+    }
     if (!this.#isResolverMode()) {
       try {
         await this.revokeRefreshToken({}, storeOptions, requestOptions);
@@ -1537,7 +1651,7 @@ var ServerClient = class {
     };
     if (options.fullResponse) {
       if (!response) {
-        throw new import_auth0_auth_js.MissingCapturedResponseError();
+        throw new import_auth0_auth_js2.MissingCapturedResponseError();
       }
       return { data: result, response };
     }
@@ -1601,7 +1715,7 @@ var ServerClient = class {
       throw new MissingRequiredArgumentError("subjectTokenType");
     }
     if (options.organization !== void 0 && !options.organization.trim()) {
-      throw new import_auth0_auth_js.OrganizationValidationError("organization must not be blank");
+      throw new import_auth0_auth_js2.OrganizationValidationError("organization must not be blank");
     }
     const domain = await this.#resolveDomain(storeOptions);
     const actor = await this.#resolveSessionTransferActor(options.actor, domain, storeOptions);
@@ -1675,7 +1789,7 @@ var ServerClient = class {
     url.searchParams.set("session_transfer_token", result.sessionTransferToken);
     if (options?.organization !== void 0) {
       if (!options.organization.trim()) {
-        throw new import_auth0_auth_js.OrganizationValidationError("organization must not be blank");
+        throw new import_auth0_auth_js2.OrganizationValidationError("organization must not be blank");
       }
       url.searchParams.set("organization", options.organization);
     }
@@ -1900,7 +2014,7 @@ var AbstractTransactionStore = class extends AbstractStore {
 };
 
 // src/index.ts
-var import_auth0_auth_js5 = require("@auth0/auth0-auth-js");
+var import_auth0_auth_js6 = require("@auth0/auth0-auth-js");
 
 // src/store/cookie-transaction-store.ts
 var CookieTransactionStore = class extends AbstractTransactionStore {
@@ -2097,13 +2211,13 @@ var StatelessStateStore = class extends AbstractSessionStore {
 };
 
 // src/mfa/index.ts
-var import_auth0_auth_js2 = require("@auth0/auth0-auth-js");
+var import_auth0_auth_js3 = require("@auth0/auth0-auth-js");
 
 // src/passkey/index.ts
-var import_auth0_auth_js3 = require("@auth0/auth0-auth-js");
+var import_auth0_auth_js4 = require("@auth0/auth0-auth-js");
 
 // src/database/index.ts
-var import_auth0_auth_js4 = require("@auth0/auth0-auth-js");
+var import_auth0_auth_js5 = require("@auth0/auth0-auth-js");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AbstractStateStore,
@@ -2111,6 +2225,7 @@ var import_auth0_auth_js4 = require("@auth0/auth0-auth-js");
   BackchannelLogoutError,
   ChangePasswordError,
   CookieTransactionStore,
+  EnterpriseConnectNotSupportedError,
   InvalidConfigurationError,
   IssuerValidationError,
   MfaChallengeError,
@@ -2140,6 +2255,7 @@ var import_auth0_auth_js4 = require("@auth0/auth0-auth-js");
   TokenExchangeErrorCode,
   TokenRevocationError,
   UserInfoError,
+  isFederatedDomain,
   isMfaRequiredError
 });
 //# sourceMappingURL=index.cjs.map