@auth0/auth0-server-js 1.16.0 → 1.16.1

package/dist/index.cjs

@@ -23,47 +23,47 @@ __export(index_exports, {
   AbstractAnonymousStore: () => AbstractAnonymousStore,
   AbstractStateStore: () => AbstractStateStore,
   AbstractTransactionStore: () => AbstractTransactionStore,
-  AnonymousSessionError: () => import_auth0_auth_js6.AnonymousSessionError,
+  AnonymousSessionError: () => import_auth0_auth_js7.AnonymousSessionError,
   AnonymousSessionExpiredError: () => AnonymousSessionExpiredError,
   BackchannelLogoutError: () => BackchannelLogoutError,
-  ChangePasswordError: () => import_auth0_auth_js5.ChangePasswordError,
+  ChangePasswordError: () => import_auth0_auth_js6.ChangePasswordError,
   CookieTransactionStore: () => CookieTransactionStore,
   DEFAULT_ANONYMOUS_SESSION_LIFETIME: () => DEFAULT_ANONYMOUS_SESSION_LIFETIME,
-  EnterpriseConnectNotSupportedError: () => import_auth0_auth_js7.EnterpriseConnectNotSupportedError,
+  EnterpriseConnectNotSupportedError: () => import_auth0_auth_js8.EnterpriseConnectNotSupportedError,
   InvalidConfigurationError: () => InvalidConfigurationError,
   IssuerValidationError: () => IssuerValidationError,
-  MfaChallengeError: () => import_auth0_auth_js3.MfaChallengeError,
-  MfaEnrollmentError: () => import_auth0_auth_js3.MfaEnrollmentError,
-  MfaListAuthenticatorsError: () => import_auth0_auth_js3.MfaListAuthenticatorsError,
-  MfaVerifyError: () => import_auth0_auth_js3.MfaVerifyError,
+  MfaChallengeError: () => import_auth0_auth_js4.MfaChallengeError,
+  MfaEnrollmentError: () => import_auth0_auth_js4.MfaEnrollmentError,
+  MfaListAuthenticatorsError: () => import_auth0_auth_js4.MfaListAuthenticatorsError,
+  MfaVerifyError: () => import_auth0_auth_js4.MfaVerifyError,
   MissingAnonymousSessionError: () => MissingAnonymousSessionError,
-  MissingClientAuthError: () => import_auth0_auth_js7.MissingClientAuthError,
+  MissingClientAuthError: () => import_auth0_auth_js8.MissingClientAuthError,
   MissingRequiredArgumentError: () => MissingRequiredArgumentError,
   MissingSessionError: () => MissingSessionError,
   MissingTransactionError: () => MissingTransactionError,
-  OrganizationValidationError: () => import_auth0_auth_js7.OrganizationValidationError,
-  PasskeyChallengeError: () => import_auth0_auth_js4.PasskeyChallengeError,
-  PasskeyGetTokenError: () => import_auth0_auth_js4.PasskeyGetTokenError,
-  PasskeyRegisterError: () => import_auth0_auth_js4.PasskeyRegisterError,
-  PasswordlessStartError: () => import_auth0_auth_js7.PasswordlessStartError,
-  PasswordlessVerifyError: () => import_auth0_auth_js7.PasswordlessVerifyError,
+  OrganizationValidationError: () => import_auth0_auth_js8.OrganizationValidationError,
+  PasskeyChallengeError: () => import_auth0_auth_js5.PasskeyChallengeError,
+  PasskeyGetTokenError: () => import_auth0_auth_js5.PasskeyGetTokenError,
+  PasskeyRegisterError: () => import_auth0_auth_js5.PasskeyRegisterError,
+  PasswordlessStartError: () => import_auth0_auth_js8.PasswordlessStartError,
+  PasswordlessVerifyError: () => import_auth0_auth_js8.PasswordlessVerifyError,
   ServerAnonymousClient: () => ServerAnonymousClient,
   ServerClient: () => ServerClient,
   ServerDatabaseClient: () => ServerDatabaseClient,
   ServerMfaClient: () => ServerMfaClient,
   ServerPasskeyClient: () => ServerPasskeyClient,
   SessionExpiredError: () => SessionExpiredError,
-  SignUpError: () => import_auth0_auth_js5.SignUpError,
+  SignUpError: () => import_auth0_auth_js6.SignUpError,
   StartLinkUserError: () => StartLinkUserError,
   StatefulStateStore: () => StatefulStateStore,
   StatelessAnonymousStore: () => StatelessAnonymousStore,
   StatelessStateStore: () => StatelessStateStore,
-  TokenExchangeError: () => import_auth0_auth_js7.TokenExchangeError,
+  TokenExchangeError: () => import_auth0_auth_js8.TokenExchangeError,
   TokenExchangeErrorCode: () => TokenExchangeErrorCode,
-  TokenRevocationError: () => import_auth0_auth_js7.TokenRevocationError,
-  UserInfoError: () => import_auth0_auth_js7.UserInfoError,
-  isFederatedDomain: () => import_auth0_auth_js7.isFederatedDomain,
-  isMfaRequiredError: () => import_auth0_auth_js7.isMfaRequiredError
+  TokenRevocationError: () => import_auth0_auth_js8.TokenRevocationError,
+  UserInfoError: () => import_auth0_auth_js8.UserInfoError,
+  isFederatedDomain: () => import_auth0_auth_js8.isFederatedDomain,
+  isMfaRequiredError: () => import_auth0_auth_js8.isMfaRequiredError
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -250,7 +250,7 @@ function updateStateDataForConnectionTokenSet(options, stateData, tokenEndpointR
 }
 
 // src/server-client.ts
-var import_auth0_auth_js2 = require("@auth0/auth0-auth-js");
+var import_auth0_auth_js3 = require("@auth0/auth0-auth-js");
 
 // src/utils.ts
 var DEFAULT_SCOPES = "openid profile email offline_access";
@@ -288,7 +288,7 @@ function getTelemetryConfig(config) {
   return {
     enabled: true,
     name: config?.name ?? "@auth0/auth0-server-js",
-    version: config?.version ?? "1.16.0"
+    version: config?.version ?? "1.16.1"
   };
 }
 
@@ -568,6 +568,7 @@ function applyEnterpriseConnectRestrictions(instance) {
 
 // src/anonymous/server-anonymous-client.ts
 var import_jose = require("jose");
+var import_auth0_auth_js2 = require("@auth0/auth0-auth-js");
 var DEFAULT_AUDIENCE_CACHE_KEY = "default";
 var readAnonymousSub = (accessToken) => {
   try {
@@ -699,14 +700,22 @@ var ServerAnonymousClient = class {
     if (cachedTokenSet && cachedTokenSet.expiresAt > Date.now() / 1e3) {
       return cachedTokenSet;
     }
-    const renewed = await this.#options.getAuthClient(domain).anonymous.getAccessToken({
-      sessionToken: stateData.sessionToken,
-      ...requestedAudience && { audience: requestedAudience },
-      ...scope && { scope }
-    });
-    if (renewed.sessionReplaced) {
-      await this.#options.anonymousStore.delete(this.#options.anonymousStoreIdentifier, storeOptions);
-      throw new AnonymousSessionExpiredError();
+    let renewed;
+    try {
+      renewed = await this.#options.getAuthClient(domain).anonymous.getAccessToken({
+        sessionToken: stateData.sessionToken,
+        ...requestedAudience && { audience: requestedAudience },
+        ...scope && { scope }
+      });
+    } catch (e) {
+      if (e instanceof import_auth0_auth_js2.AnonymousSessionError && e.code === "session_expired") {
+        await this.#options.anonymousStore.delete(this.#options.anonymousStoreIdentifier, storeOptions);
+        throw new AnonymousSessionExpiredError();
+      }
+      if (e instanceof import_auth0_auth_js2.AnonymousSessionError && e.code === "invalid_session_token") {
+        await this.#options.anonymousStore.delete(this.#options.anonymousStoreIdentifier, storeOptions);
+      }
+      throw e;
     }
     const tokenSet = {
       audience,
@@ -802,7 +811,7 @@ var decodeIssuer = (token) => {
 var ID_TOKEN_TYPE = "urn:ietf:params:oauth:token-type:id_token";
 var ID_TOKEN_EXPIRY_SKEW_SECONDS = 30;
 var actorUnavailableError = (message) => {
-  const error = new import_auth0_auth_js2.TokenExchangeError(message);
+  const error = new import_auth0_auth_js3.TokenExchangeError(message);
   error.code = TokenExchangeErrorCode.ACTOR_UNAVAILABLE;
   return error;
 };
@@ -977,7 +986,7 @@ var ServerClient = class {
     if (typeof this.#options.domain === "string") {
       const domain = normalizeDomain(this.#options.domain);
       this.#staticDomain = domain;
-      this.#authClient = new import_auth0_auth_js2.AuthClient({
+      this.#authClient = new import_auth0_auth_js3.AuthClient({
         domain,
         ...this.#authClientOptions,
         telemetry: getTelemetryConfig(this.#options.telemetry)
@@ -1029,7 +1038,7 @@ var ServerClient = class {
     return normalizeDomain(this.#options.domain);
   }
   #createAuthClient(domain) {
-    return new import_auth0_auth_js2.AuthClient({
+    return new import_auth0_auth_js3.AuthClient({
       domain,
       ...this.#authClientOptions,
       telemetry: getTelemetryConfig(this.#options.telemetry)
@@ -1080,7 +1089,7 @@ var ServerClient = class {
     if (parts.length !== 2 || !parts[0] || !parts[1]) return null;
     const emailDomain = parts[1].toLowerCase();
     const domain = await this.#resolveDomain(storeOptions);
-    const isFederated = await (0, import_auth0_auth_js2.isFederatedDomain)(domain, emailDomain, {
+    const isFederated = await (0, import_auth0_auth_js3.isFederatedDomain)(domain, emailDomain, {
       customFetch: this.#options.customFetch,
       telemetry: getTelemetryConfig(this.#options.telemetry)
     });
@@ -1168,7 +1177,7 @@ var ServerClient = class {
     const clientAuthParamsOrganization = typeof this.#options.authorizationParams?.organization === "string" ? this.#options.authorizationParams.organization : void 0;
     const resolvedOrganization = options?.organization ?? perLoginAuthParamsOrganization ?? this.#options.organization ?? clientAuthParamsOrganization;
     if (resolvedOrganization !== void 0 && !resolvedOrganization.trim()) {
-      throw new import_auth0_auth_js2.OrganizationValidationError("organization must not be blank");
+      throw new import_auth0_auth_js3.OrganizationValidationError("organization must not be blank");
     }
     const hasInvitation = !!(options?.invitation || options?.authorizationParams?.invitation);
     if (hasInvitation && !resolvedOrganization) {
@@ -1439,7 +1448,7 @@ var ServerClient = class {
     };
     if (options.fullResponse) {
       if (!response) {
-        throw new import_auth0_auth_js2.MissingCapturedResponseError();
+        throw new import_auth0_auth_js3.MissingCapturedResponseError();
       }
       return { data: result, response };
     }
@@ -1508,7 +1517,7 @@ var ServerClient = class {
       return;
     }
     if (!options.redirectUri || typeof options.redirectUri !== "string") {
-      throw new import_auth0_auth_js2.PasswordlessStartError("redirectUri is required to start a passwordless magic-link login.");
+      throw new import_auth0_auth_js3.PasswordlessStartError("redirectUri is required to start a passwordless magic-link login.");
     }
     const state = crypto.randomUUID();
     const scope = ensureOpenIdScope(options.scope ?? this.#options.authorizationParams?.scope);
@@ -1586,7 +1595,7 @@ var ServerClient = class {
     };
     if (options.fullResponse) {
       if (!response) {
-        throw new import_auth0_auth_js2.MissingCapturedResponseError();
+        throw new import_auth0_auth_js3.MissingCapturedResponseError();
       }
       return { data: result, response };
     }
@@ -1621,7 +1630,7 @@ var ServerClient = class {
     const expectedState = typeof transactionData.state === "string" ? transactionData.state : void 0;
     const returnedState = url.searchParams.get("state");
     if (!returnedState || !expectedState || returnedState !== expectedState) {
-      throw new import_auth0_auth_js2.PasswordlessVerifyError("State mismatch on magic-link callback");
+      throw new import_auth0_auth_js3.PasswordlessVerifyError("State mismatch on magic-link callback");
     }
     const domain = transactionData.domain ?? await this.#resolveDomain(storeOptions);
     const authClient = this.#getAuthClient(domain);
@@ -1779,7 +1788,7 @@ var ServerClient = class {
       }
     }
     if (!stateData?.refreshToken) {
-      throw new import_auth0_auth_js2.TokenByRefreshTokenError(
+      throw new import_auth0_auth_js3.TokenByRefreshTokenError(
         "The access token has expired and a refresh token was not provided. The user needs to re-authenticate."
       );
     }
@@ -1818,7 +1827,7 @@ var ServerClient = class {
     };
     if (resolvedOptions?.fullResponse) {
       if (!response) {
-        throw new import_auth0_auth_js2.MissingCapturedResponseError();
+        throw new import_auth0_auth_js3.MissingCapturedResponseError();
       }
       return { data: returnTokenSet, response };
     }
@@ -1848,7 +1857,7 @@ var ServerClient = class {
       }
     }
     if (!stateData?.refreshToken) {
-      throw new import_auth0_auth_js2.TokenForConnectionError(
+      throw new import_auth0_auth_js3.TokenForConnectionError(
         "A refresh token was not found but is required to be able to retrieve an access token for a connection."
       );
     }
@@ -1889,7 +1898,7 @@ var ServerClient = class {
     };
     if (options.fullResponse) {
       if (!response) {
-        throw new import_auth0_auth_js2.MissingCapturedResponseError();
+        throw new import_auth0_auth_js3.MissingCapturedResponseError();
       }
       return { data: returnConnectionTokenSet, response };
     }
@@ -2038,7 +2047,7 @@ var ServerClient = class {
     };
     if (options.fullResponse) {
       if (!response) {
-        throw new import_auth0_auth_js2.MissingCapturedResponseError();
+        throw new import_auth0_auth_js3.MissingCapturedResponseError();
       }
       return { data: result, response };
     }
@@ -2102,7 +2111,7 @@ var ServerClient = class {
       throw new MissingRequiredArgumentError("subjectTokenType");
     }
     if (options.organization !== void 0 && !options.organization.trim()) {
-      throw new import_auth0_auth_js2.OrganizationValidationError("organization must not be blank");
+      throw new import_auth0_auth_js3.OrganizationValidationError("organization must not be blank");
     }
     const domain = await this.#resolveDomain(storeOptions);
     const actor = await this.#resolveSessionTransferActor(options.actor, domain, storeOptions);
@@ -2176,7 +2185,7 @@ var ServerClient = class {
     url.searchParams.set("session_transfer_token", result.sessionTransferToken);
     if (options?.organization !== void 0) {
       if (!options.organization.trim()) {
-        throw new import_auth0_auth_js2.OrganizationValidationError("organization must not be blank");
+        throw new import_auth0_auth_js3.OrganizationValidationError("organization must not be blank");
       }
       url.searchParams.set("organization", options.organization);
     }
@@ -2401,7 +2410,7 @@ var AbstractTransactionStore = class extends AbstractStore {
 };
 
 // src/index.ts
-var import_auth0_auth_js7 = require("@auth0/auth0-auth-js");
+var import_auth0_auth_js8 = require("@auth0/auth0-auth-js");
 
 // src/store/cookie-transaction-store.ts
 var CookieTransactionStore = class extends AbstractTransactionStore {
@@ -2680,16 +2689,16 @@ var StatelessAnonymousStore = class extends AbstractAnonymousStore {
 };
 
 // src/mfa/index.ts
-var import_auth0_auth_js3 = require("@auth0/auth0-auth-js");
+var import_auth0_auth_js4 = require("@auth0/auth0-auth-js");
 
 // src/passkey/index.ts
-var import_auth0_auth_js4 = require("@auth0/auth0-auth-js");
+var import_auth0_auth_js5 = require("@auth0/auth0-auth-js");
 
 // src/database/index.ts
-var import_auth0_auth_js5 = require("@auth0/auth0-auth-js");
+var import_auth0_auth_js6 = require("@auth0/auth0-auth-js");
 
 // src/anonymous/index.ts
-var import_auth0_auth_js6 = require("@auth0/auth0-auth-js");
+var import_auth0_auth_js7 = require("@auth0/auth0-auth-js");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AbstractAnonymousStore,