@auth0/auth0-server-js 1.2.0 → 1.4.0

package/README.md

@@ -49,7 +49,8 @@ const auth0 = new ServerClient<StoreOptions>({
 ```
 
 The `AUTH0_DOMAIN`, `AUTH0_CLIENT_ID`, and `AUTH0_CLIENT_SECRET` can be obtained from the [Auth0 Dashboard](https://manage.auth0.com) once you've created an application. **This application must be a `Regular Web Application`**.
-The `AUTH0_REDIRECT_URI` is needed to tell Auth0 what URL to redirect back to after successfull authentication, e.g. `http://localhost:3000/auth/callback`. (note, your application needs to handle this endpoint and call the SDK's `completeInteractiveLogin(url: string)` to finish the authentication process. See below for more information)
+The `AUTH0_REDIRECT_URI` is needed to tell Auth0 what URL to redirect back to after successful authentication, e.g. `http://localhost:3000/auth/callback`. Your application needs to handle this endpoint and call the SDK's `completeInteractiveLogin(url: string)` to finish the authentication process. See below for more information.
+
 
 ### 3. Configuring the Store
 
@@ -200,6 +201,10 @@ const auth0 = new ServerClient<StoreOptions>({
 });
 ```
 
+The `redirect_uri` must be an absolute URL.
+
+If you need to compute an absolute redirect URI per request (for example, in multi-domain deployments), pass `authorizationParams.redirect_uri` to `startInteractiveLogin` to override the configured default.
+
 > [!IMPORTANT]  
 > You will need to register the `AUTH0_REDIRECT_URI` in your Auth0 Application as an **Allowed Callback URLs** via the [Auth0 Dashboard](https://manage.auth0.com):
 

package/dist/index.cjs

@@ -24,6 +24,8 @@ __export(index_exports, {
   AbstractTransactionStore: () => AbstractTransactionStore,
   BackchannelLogoutError: () => BackchannelLogoutError,
   CookieTransactionStore: () => CookieTransactionStore,
+  InvalidConfigurationError: () => InvalidConfigurationError,
+  IssuerValidationError: () => IssuerValidationError,
   MissingRequiredArgumentError: () => MissingRequiredArgumentError,
   MissingSessionError: () => MissingSessionError,
   MissingTransactionError: () => MissingTransactionError,
@@ -70,6 +72,20 @@ var MissingSessionError = class extends Error {
     this.name = "MissingSessionError";
   }
 };
+var InvalidConfigurationError = class extends Error {
+  code = "invalid_configuration_error";
+  constructor(message) {
+    super(message);
+    this.name = "InvalidConfigurationError";
+  }
+};
+var IssuerValidationError = class extends Error {
+  code = "issuer_validation_error";
+  constructor(message) {
+    super(message);
+    this.name = "IssuerValidationError";
+  }
+};
 
 // src/state/utils.ts
 var createUpdatedTokenSet = (audience, response) => ({
@@ -78,19 +94,20 @@ var createUpdatedTokenSet = (audience, response) => ({
   scope: response.scope,
   expiresAt: response.expiresAt
 });
-function updateStateData(audience, stateDate, tokenEndpointResponse) {
-  if (stateDate) {
-    const isNewTokenSet = !stateDate.tokenSets.some(
+function updateStateData(audience, stateData, tokenEndpointResponse, context) {
+  if (stateData) {
+    const isNewTokenSet = !stateData.tokenSets.some(
       (tokenSet) => tokenSet.audience === audience && tokenSet.scope === tokenEndpointResponse.scope
     );
-    const tokenSets = isNewTokenSet ? [...stateDate.tokenSets, createUpdatedTokenSet(audience, tokenEndpointResponse)] : stateDate.tokenSets.map(
+    const tokenSets = isNewTokenSet ? [...stateData.tokenSets, createUpdatedTokenSet(audience, tokenEndpointResponse)] : stateData.tokenSets.map(
       (tokenSet) => tokenSet.audience === audience && tokenSet.scope === tokenEndpointResponse.scope ? createUpdatedTokenSet(audience, tokenEndpointResponse) : tokenSet
     );
     return {
-      ...stateDate,
-      idToken: tokenEndpointResponse.idToken,
-      refreshToken: tokenEndpointResponse.refreshToken ?? stateDate.refreshToken,
-      tokenSets
+      ...stateData,
+      idToken: tokenEndpointResponse.idToken ?? stateData.idToken,
+      refreshToken: tokenEndpointResponse.refreshToken ?? stateData.refreshToken,
+      tokenSets,
+      domain: context?.domain ?? stateData.domain
     };
   } else {
     const user = tokenEndpointResponse.claims;
@@ -98,9 +115,8 @@ function updateStateData(audience, stateDate, tokenEndpointResponse) {
       user,
       idToken: tokenEndpointResponse.idToken,
       refreshToken: tokenEndpointResponse.refreshToken,
-      tokenSets: [
-        createUpdatedTokenSet(audience, tokenEndpointResponse)
-      ],
+      tokenSets: [createUpdatedTokenSet(audience, tokenEndpointResponse)],
+      domain: context?.domain,
       internal: {
         sid: user?.sid,
         createdAt: Math.floor(Date.now() / 1e3)
@@ -108,9 +124,9 @@ function updateStateData(audience, stateDate, tokenEndpointResponse) {
     };
   }
 }
-function updateStateDataForConnectionTokenSet(options, stateDate, tokenEndpointResponse) {
-  stateDate.connectionTokenSets = stateDate.connectionTokenSets || [];
-  const isNewTokenSet = !stateDate.connectionTokenSets.some(
+function updateStateDataForConnectionTokenSet(options, stateData, tokenEndpointResponse) {
+  stateData.connectionTokenSets = stateData.connectionTokenSets || [];
+  const isNewTokenSet = !stateData.connectionTokenSets.some(
     (tokenSet) => tokenSet.connection === options.connection && (!options.loginHint || tokenSet.loginHint === options.loginHint)
   );
   const connectionTokenSet = {
@@ -120,11 +136,11 @@ function updateStateDataForConnectionTokenSet(options, stateDate, tokenEndpointR
     scope: tokenEndpointResponse.scope,
     expiresAt: tokenEndpointResponse.expiresAt
   };
-  const connectionTokenSets = isNewTokenSet ? [...stateDate.connectionTokenSets, connectionTokenSet] : stateDate.connectionTokenSets.map(
+  const connectionTokenSets = isNewTokenSet ? [...stateData.connectionTokenSets, connectionTokenSet] : stateData.connectionTokenSets.map(
     (tokenSet) => tokenSet.connection === options.connection && (!options.loginHint || tokenSet.loginHint === options.loginHint) ? connectionTokenSet : tokenSet
   );
   return {
-    ...stateDate,
+    ...stateData,
     connectionTokenSets
   };
 }
@@ -146,19 +162,70 @@ var compareScopes = (scopes, requiredScopes) => {
 };
 
 // src/server-client.ts
+var import_jose = require("jose");
+
+// src/telemetry.ts
+function getTelemetryConfig(config) {
+  if (config?.enabled === false) {
+    return config;
+  }
+  return {
+    enabled: true,
+    name: config?.name ?? "@auth0/auth0-server-js",
+    version: config?.version ?? "1.4.0"
+  };
+}
+
+// src/server-client.ts
+var DEFAULT_SCOPES = "openid profile email offline_access";
+var normalizeDomain = (value) => {
+  const trimmed = value.trim();
+  const parsed = trimmed.startsWith("http") ? new URL(trimmed) : new URL(`https://${trimmed}`);
+  return parsed.host.toLowerCase();
+};
+var decodeIssuer = (token) => {
+  try {
+    const { iss } = (0, import_jose.decodeJwt)(token);
+    return typeof iss === "string" ? iss : void 0;
+  } catch {
+    return void 0;
+  }
+};
+var ensureOpenIdScope = (scope) => {
+  if (!scope) {
+    return DEFAULT_SCOPES;
+  }
+  const scopes = scope.split(" ");
+  if (!scopes.includes("openid")) {
+    scopes.unshift("openid");
+  }
+  return scopes.join(" ");
+};
 var ServerClient = class {
   #options;
   #transactionStore;
   #transactionStoreIdentifier;
   #stateStore;
   #stateStoreIdentifier;
+  #authClientOptions;
+  #staticDomain;
+  #authClient;
   /**
    * The underlying `authClient` instance that can be used to interact with the Auth0 Authentication API.
    * Generally, you should prefer to use the higher-level methods exposed on the `ServerClient` instance.
-   * 
+   *
+   * This property can only be used when `domain` is configured as a static string.
+   * In resolver mode (`domain` as a function), the SDK resolves the domain per request,
+   * so use `ServerClient` methods instead.
+   *
    * Important: the methods exposed on the `authClient` instance do not handle any session or state management.
    */
-  authClient;
+  get authClient() {
+    if (!this.#authClient) {
+      throw new InvalidConfigurationError("authClient is only available when using a static domain configuration.");
+    }
+    return this.#authClient;
+  }
   constructor(options) {
     this.#options = options;
     this.#stateStoreIdentifier = this.#options.stateIdentifier || "__a0_session";
@@ -171,17 +238,77 @@ var ServerClient = class {
     if (!this.#options.transactionStore) {
       throw new MissingRequiredArgumentError("transactionStore");
     }
-    this.authClient = new import_auth0_auth_js.AuthClient({
-      domain: this.#options.domain,
+    if (typeof this.#options.domain !== "string" && typeof this.#options.domain !== "function") {
+      throw new InvalidConfigurationError("domain must be a string or resolver function");
+    }
+    this.#authClientOptions = {
       clientId: this.#options.clientId,
       clientSecret: this.#options.clientSecret,
       clientAssertionSigningKey: this.#options.clientAssertionSigningKey,
       clientAssertionSigningAlg: this.#options.clientAssertionSigningAlg,
       authorizationParams: this.#options.authorizationParams,
+      discoveryCache: this.#options.discoveryCache,
       customFetch: this.#options.customFetch,
       useMtls: this.#options.useMtls
+    };
+    if (typeof this.#options.domain === "string") {
+      const domain = normalizeDomain(this.#options.domain);
+      this.#staticDomain = domain;
+      this.#authClient = new import_auth0_auth_js.AuthClient({
+        domain,
+        ...this.#authClientOptions,
+        telemetry: getTelemetryConfig(this.#options.telemetry)
+      });
+    }
+  }
+  async #resolveDomain(storeOptions) {
+    if (typeof this.#options.domain === "function") {
+      const resolved = await this.#options.domain(storeOptions);
+      if (typeof resolved !== "string" || resolved.trim().length === 0) {
+        throw new InvalidConfigurationError("domainResolver returned no domain");
+      }
+      return normalizeDomain(resolved);
+    }
+    return normalizeDomain(this.#options.domain);
+  }
+  #createAuthClient(domain) {
+    return new import_auth0_auth_js.AuthClient({
+      domain,
+      ...this.#authClientOptions,
+      telemetry: getTelemetryConfig(this.#options.telemetry)
     });
   }
+  #getAuthClient(domain) {
+    const normalizedDomain = normalizeDomain(domain);
+    if (this.#authClient && this.#staticDomain === normalizedDomain) {
+      return this.#authClient;
+    }
+    return this.#createAuthClient(normalizedDomain);
+  }
+  #getSessionDomain(stateData) {
+    if (stateData.domain) {
+      return normalizeDomain(stateData.domain);
+    }
+    if (this.#staticDomain) {
+      return this.#staticDomain;
+    }
+    const issuerFromClaims = stateData.user?.iss;
+    if (typeof issuerFromClaims === "string" && issuerFromClaims.trim().length > 0) {
+      return normalizeDomain(issuerFromClaims);
+    }
+    return;
+  }
+  #isResolverMode() {
+    return typeof this.#options.domain === "function";
+  }
+  async #isSessionForCurrentDomain(stateData, storeOptions) {
+    const sessionDomain = this.#getSessionDomain(stateData);
+    if (!sessionDomain) {
+      return false;
+    }
+    const resolvedDomain = await this.#resolveDomain(storeOptions);
+    return sessionDomain === resolvedDomain;
+  }
   /**
    * Starts the interactive login process, and returns a URL to redirect the user-agent to to request authorization at Auth0.
    * @param options Optional options used to configure the interactive login process.
@@ -196,16 +323,21 @@ var ServerClient = class {
     if (!redirectUri) {
       throw new MissingRequiredArgumentError("authorizationParams.redirect_uri");
     }
-    const { codeVerifier, authorizationUrl } = await this.authClient.buildAuthorizationUrl({
+    const scope = ensureOpenIdScope(options?.authorizationParams?.scope ?? this.#options.authorizationParams?.scope);
+    const domain = await this.#resolveDomain(storeOptions);
+    const authClient = this.#getAuthClient(domain);
+    const { codeVerifier, authorizationUrl } = await authClient.buildAuthorizationUrl({
       pushedAuthorizationRequests: options?.pushedAuthorizationRequests,
       authorizationParams: {
         ...options?.authorizationParams,
-        redirect_uri: redirectUri
+        redirect_uri: redirectUri,
+        scope
       }
     });
     const transactionState = {
       audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,
-      codeVerifier
+      codeVerifier,
+      domain
     };
     if (options?.appState) {
       transactionState.appState = options.appState;
@@ -229,11 +361,15 @@ var ServerClient = class {
     if (!transactionData) {
       throw new MissingTransactionError();
     }
-    const tokenEndpointResponse = await this.authClient.getTokenByCode(url, {
+    const domain = transactionData.domain ?? await this.#resolveDomain(storeOptions);
+    const authClient = this.#getAuthClient(domain);
+    const tokenEndpointResponse = await authClient.getTokenByCode(url, {
       codeVerifier: transactionData.codeVerifier
     });
     const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
-    const stateData = updateStateData(transactionData.audience ?? "default", existingStateData, tokenEndpointResponse);
+    const stateData = updateStateData(transactionData.audience ?? "default", existingStateData, tokenEndpointResponse, {
+      domain
+    });
     await this.#stateStore.set(this.#stateStoreIdentifier, stateData, true, storeOptions);
     await this.#transactionStore.delete(this.#transactionStoreIdentifier, storeOptions);
     return { appState: transactionData.appState, authorizationDetails: tokenEndpointResponse.authorizationDetails };
@@ -255,7 +391,15 @@ var ServerClient = class {
         "Unable to start the user linking process without a logged in user. Ensure to login using the SDK before starting the user linking process."
       );
     }
-    const { linkUserUrl, codeVerifier } = await this.authClient.buildLinkUserUrl({
+    if (this.#isResolverMode()) {
+      const isCurrentDomain = await this.#isSessionForCurrentDomain(stateData, storeOptions);
+      if (!isCurrentDomain) {
+        throw new MissingSessionError("Session domain does not match the current domain.");
+      }
+    }
+    const domain = this.#getSessionDomain(stateData);
+    const authClient = this.#getAuthClient(domain);
+    const { linkUserUrl, codeVerifier } = await authClient.buildLinkUserUrl({
       connection: options.connection,
       connectionScope: options.connectionScope,
       idToken: stateData.idToken,
@@ -263,7 +407,8 @@ var ServerClient = class {
     });
     const transactionState = {
       audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,
-      codeVerifier
+      codeVerifier,
+      domain
     };
     if (options?.appState) {
       transactionState.appState = options.appState;
@@ -305,14 +450,23 @@ var ServerClient = class {
         "Unable to start the user unlinking process without a logged in user. Ensure to login using the SDK before starting the user unlinking process."
       );
     }
-    const { unlinkUserUrl, codeVerifier } = await this.authClient.buildUnlinkUserUrl({
+    if (this.#isResolverMode()) {
+      const isCurrentDomain = await this.#isSessionForCurrentDomain(stateData, storeOptions);
+      if (!isCurrentDomain) {
+        throw new MissingSessionError("Session domain does not match the current domain.");
+      }
+    }
+    const domain = this.#getSessionDomain(stateData);
+    const authClient = this.#getAuthClient(domain);
+    const { unlinkUserUrl, codeVerifier } = await authClient.buildUnlinkUserUrl({
       connection: options.connection,
       idToken: stateData.idToken,
       authorizationParams: options.authorizationParams
     });
     const transactionState = {
       audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,
-      codeVerifier
+      codeVerifier,
+      domain
     };
     if (options?.appState) {
       transactionState.appState = options.appState;
@@ -350,16 +504,23 @@ var ServerClient = class {
    * @returns A promise resolving to an object, containing the authorizationDetails (when RAR was used).
    */
   async loginBackchannel(options, storeOptions) {
-    const tokenEndpointResponse = await this.authClient.backchannelAuthentication({
+    const scope = ensureOpenIdScope(options.authorizationParams?.scope ?? this.#options.authorizationParams?.scope);
+    const domain = await this.#resolveDomain(storeOptions);
+    const authClient = this.#getAuthClient(domain);
+    const tokenEndpointResponse = await authClient.backchannelAuthentication({
       bindingMessage: options.bindingMessage,
       loginHint: options.loginHint,
-      authorizationParams: options.authorizationParams
+      authorizationParams: {
+        ...options.authorizationParams,
+        scope
+      }
     });
     const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
     const stateData = updateStateData(
       this.#options.authorizationParams?.audience ?? "default",
       existingStateData,
-      tokenEndpointResponse
+      tokenEndpointResponse,
+      { domain }
     );
     await this.#stateStore.set(this.#stateStoreIdentifier, stateData, true, storeOptions);
     return {
@@ -373,16 +534,31 @@ var ServerClient = class {
    */
   async getUser(storeOptions) {
     const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
-    return stateData?.user;
+    if (!stateData) {
+      return;
+    }
+    if (this.#isResolverMode()) {
+      const isCurrentDomain = await this.#isSessionForCurrentDomain(stateData, storeOptions);
+      if (!isCurrentDomain) {
+        return;
+      }
+    }
+    return stateData.user;
   }
   /**
    * Retrieve the user session from the store, or undefined if no session found.
    * @param storeOptions Optional options used to pass to the Transaction and State Store.
-   * @returns The sessionm or undefined if no session found in the store.
+   * @returns The session or undefined if no session found in the store.
    */
   async getSession(storeOptions) {
     const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
     if (stateData) {
+      if (this.#isResolverMode()) {
+        const isCurrentDomain = await this.#isSessionForCurrentDomain(stateData, storeOptions);
+        if (!isCurrentDomain) {
+          return;
+        }
+      }
       const { internal, ...sessionData } = stateData;
       return sessionData;
     }
@@ -400,6 +576,19 @@ var ServerClient = class {
     const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
     const audience = this.#options.authorizationParams?.audience ?? "default";
     const scope = this.#options.authorizationParams?.scope;
+    const sessionDomain = stateData ? this.#getSessionDomain(stateData) : this.#staticDomain;
+    if (this.#isResolverMode()) {
+      if (!stateData) {
+        throw new MissingSessionError("Unable to retrieve access token without a logged in user.");
+      }
+      if (!sessionDomain) {
+        throw new MissingSessionError("Session domain does not match the current domain.");
+      }
+      const resolvedDomain = await this.#resolveDomain(storeOptions);
+      if (sessionDomain !== resolvedDomain) {
+        throw new MissingSessionError("Session domain does not match the current domain.");
+      }
+    }
     const tokenSet = stateData?.tokenSets.find(
       (tokenSet2) => tokenSet2.audience === audience && (!scope || compareScopes(tokenSet2.scope, scope))
     );
@@ -411,11 +600,14 @@ var ServerClient = class {
         "The access token has expired and a refresh token was not provided. The user needs to re-authenticate."
       );
     }
-    const tokenEndpointResponse = await this.authClient.getTokenByRefreshToken({
+    const domainForSession = sessionDomain;
+    const tokenEndpointResponse = await this.#getAuthClient(domainForSession).getTokenByRefreshToken({
       refreshToken: stateData.refreshToken
     });
     const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
-    const updatedStateData = updateStateData(audience, existingStateData, tokenEndpointResponse);
+    const updatedStateData = updateStateData(audience, existingStateData, tokenEndpointResponse, {
+      domain: domainForSession
+    });
     await this.#stateStore.set(this.#stateStoreIdentifier, updatedStateData, false, storeOptions);
     return {
       accessToken: tokenEndpointResponse.accessToken,
@@ -441,6 +633,19 @@ var ServerClient = class {
    */
   async getAccessTokenForConnection(options, storeOptions) {
     const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
+    const sessionDomain = stateData ? this.#getSessionDomain(stateData) : this.#staticDomain;
+    if (this.#isResolverMode()) {
+      if (!stateData) {
+        throw new MissingSessionError("Unable to retrieve an access token for a connection without a logged in user.");
+      }
+      if (!sessionDomain) {
+        throw new MissingSessionError("Session domain does not match the current domain.");
+      }
+      const resolvedDomain = await this.#resolveDomain(storeOptions);
+      if (sessionDomain !== resolvedDomain) {
+        throw new MissingSessionError("Session domain does not match the current domain.");
+      }
+    }
     const connectionTokenSet = stateData?.connectionTokenSets?.find(
       (tokenSet) => tokenSet.connection === options.connection
     );
@@ -452,12 +657,20 @@ var ServerClient = class {
         "A refresh token was not found but is required to be able to retrieve an access token for a connection."
       );
     }
-    const tokenEndpointResponse = await this.authClient.getTokenForConnection({
+    const domainForSession = sessionDomain;
+    const tokenEndpointResponse = await this.#getAuthClient(domainForSession).getTokenForConnection({
       connection: options.connection,
       loginHint: options.loginHint,
       refreshToken: stateData.refreshToken
     });
-    const updatedStateData = updateStateDataForConnectionTokenSet(options, stateData, tokenEndpointResponse);
+    const updatedStateData = updateStateDataForConnectionTokenSet(
+      options,
+      {
+        ...stateData,
+        domain: stateData.domain ?? domainForSession
+      },
+      tokenEndpointResponse
+    );
     await this.#stateStore.set(this.#stateStoreIdentifier, updatedStateData, false, storeOptions);
     return {
       accessToken: tokenEndpointResponse.accessToken,
@@ -474,8 +687,21 @@ var ServerClient = class {
    * @returns {URL}
    */
   async logout(options, storeOptions) {
-    await this.#stateStore.delete(this.#stateStoreIdentifier, storeOptions);
-    return this.authClient.buildLogoutUrl(options);
+    if (!this.#isResolverMode()) {
+      await this.#stateStore.delete(this.#stateStoreIdentifier, storeOptions);
+      return this.authClient.buildLogoutUrl(options);
+    }
+    const resolvedDomain = await this.#resolveDomain(storeOptions);
+    const authClient = this.#getAuthClient(resolvedDomain);
+    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
+    const sessionDomain = stateData ? this.#getSessionDomain(stateData) : void 0;
+    if (!stateData) {
+      return authClient.buildLogoutUrl(options);
+    }
+    if (sessionDomain && sessionDomain === resolvedDomain) {
+      await this.#stateStore.delete(this.#stateStoreIdentifier, storeOptions);
+    }
+    return authClient.buildLogoutUrl(options);
   }
   /**
    * Handles the backchannel logout process by verifying the logout token and deleting the session from the store if the logout token was considered valid.
@@ -489,19 +715,37 @@ var ServerClient = class {
     if (!logoutToken) {
       throw new BackchannelLogoutError("Missing Logout Token");
     }
-    const logoutTokenClaims = await this.authClient.verifyLogoutToken({ logoutToken });
-    await this.#stateStore.deleteByLogoutToken(logoutTokenClaims, storeOptions);
+    if (!this.#isResolverMode()) {
+      const logoutTokenClaims2 = await this.authClient.verifyLogoutToken({ logoutToken });
+      await this.#stateStore.deleteByLogoutToken(logoutTokenClaims2, storeOptions);
+      return;
+    }
+    const issuer = decodeIssuer(logoutToken);
+    if (!issuer) {
+      throw new BackchannelLogoutError("Logout token is missing an issuer");
+    }
+    const resolvedDomain = await this.#resolveDomain(storeOptions);
+    const domain = normalizeDomain(issuer);
+    if (domain !== resolvedDomain) {
+      throw new BackchannelLogoutError("Logout token issuer does not match the resolved domain");
+    }
+    const authClient = this.#getAuthClient(domain);
+    const logoutTokenClaims = await authClient.verifyLogoutToken({ logoutToken });
+    await this.#stateStore.deleteByLogoutToken({ ...logoutTokenClaims, iss: issuer }, storeOptions);
   }
 };
 
 // src/encryption/index.ts
-var import_jose = require("jose");
+var import_jose2 = require("jose");
 var ENC = "A256CBC-HS512";
 var ALG = "dir";
 var DIGEST = "SHA-256";
 var BIT_LENGTH = 512;
 var HKDF_INFO = "derived cookie encryption secret";
 var encoder;
+function isDecryptionError(e) {
+  return e instanceof import_jose2.errors.JWEDecryptionFailed || e instanceof import_jose2.errors.JWEInvalid;
+}
 async function deriveEncryptionSecret(secret, salt, kid) {
   encoder ||= new TextEncoder();
   const key = await crypto.subtle.importKey("raw", encoder.encode(secret), "HKDF", false, ["deriveBits"]);
@@ -518,13 +762,24 @@ async function deriveEncryptionSecret(secret, salt, kid) {
     )
   );
 }
-async function encrypt(payload, secret, salt, expiration) {
+async function _encrypt(payload, secret, salt, expiration) {
   const kid = crypto.randomUUID();
   const encryptionSecret = await deriveEncryptionSecret(secret, salt, kid);
-  return await new import_jose.EncryptJWT(payload).setProtectedHeader({ enc: ENC, alg: ALG, kid }).setExpirationTime(expiration).encrypt(encryptionSecret);
+  return await new import_jose2.EncryptJWT(payload).setProtectedHeader({ enc: ENC, alg: ALG, kid }).setExpirationTime(expiration).encrypt(encryptionSecret);
 }
-async function decrypt(value, secret, salt) {
-  const res = await (0, import_jose.jwtDecrypt)(
+async function encrypt(payload, secret, salt, expiration) {
+  if (typeof secret === "string") {
+    return await _encrypt(payload, secret, salt, expiration);
+  } else {
+    const [newSecret] = secret;
+    if (!newSecret) {
+      throw new InvalidConfigurationError("At least one secret must be provided");
+    }
+    return await _encrypt(payload, newSecret, salt, expiration);
+  }
+}
+async function _decrypt(value, secret, salt) {
+  const res = await (0, import_jose2.jwtDecrypt)(
     value,
     async (protectedHeader) => {
       if (!protectedHeader.kid) {
@@ -536,6 +791,35 @@ async function decrypt(value, secret, salt) {
   );
   return res.payload;
 }
+async function decrypt(value, secret, salt) {
+  if (typeof secret === "string") {
+    return await _decrypt(value, secret, salt);
+  } else {
+    const [newSecret, ...oldSecrets] = secret;
+    if (!newSecret) {
+      throw new InvalidConfigurationError("At least one secret must be provided");
+    }
+    let firstError;
+    try {
+      return await _decrypt(value, newSecret, salt);
+    } catch (err) {
+      firstError = err;
+      if (!isDecryptionError(err)) {
+        throw firstError;
+      }
+      for (const oldSecret of oldSecrets) {
+        try {
+          return await _decrypt(value, oldSecret, salt);
+        } catch (fallbackErr) {
+          if (!isDecryptionError(fallbackErr)) {
+            throw fallbackErr;
+          }
+        }
+      }
+      throw firstError;
+    }
+  }
+}
 
 // src/store/abstract-store.ts
 var AbstractStore = class {
@@ -547,7 +831,14 @@ var AbstractStore = class {
     return await encrypt(stateData, this.options.secret, identifier, expiration);
   }
   async decrypt(identifier, encryptedStateData) {
-    return await decrypt(encryptedStateData, this.options.secret, identifier);
+    try {
+      return await decrypt(encryptedStateData, this.options.secret, identifier);
+    } catch (e) {
+      if (isDecryptionError(e)) {
+        return;
+      }
+      throw e;
+    }
   }
 };
 
@@ -674,7 +965,9 @@ var StatefulStateStore = class extends AbstractSessionStore {
     const cookieValue = this.#cookieHandler.getCookie(identifier, options);
     if (cookieValue) {
       const sessionCookie = await this.decrypt(identifier, cookieValue);
-      return sessionCookie.id;
+      if (sessionCookie) {
+        return sessionCookie.id;
+      }
     }
   }
   deleteByLogoutToken(claims, options) {
@@ -762,6 +1055,8 @@ var StatelessStateStore = class extends AbstractSessionStore {
   AbstractTransactionStore,
   BackchannelLogoutError,
   CookieTransactionStore,
+  InvalidConfigurationError,
+  IssuerValidationError,
   MissingRequiredArgumentError,
   MissingSessionError,
   MissingTransactionError,