@auth0/auth0-server-js 1.3.0 → 1.4.0

package/dist/index.js

@@ -41,6 +41,13 @@ var InvalidConfigurationError = class extends Error {
     this.name = "InvalidConfigurationError";
   }
 };
+var IssuerValidationError = class extends Error {
+  code = "issuer_validation_error";
+  constructor(message) {
+    super(message);
+    this.name = "IssuerValidationError";
+  }
+};
 
 // src/state/utils.ts
 var createUpdatedTokenSet = (audience, response) => ({
@@ -49,7 +56,7 @@ var createUpdatedTokenSet = (audience, response) => ({
   scope: response.scope,
   expiresAt: response.expiresAt
 });
-function updateStateData(audience, stateData, tokenEndpointResponse) {
+function updateStateData(audience, stateData, tokenEndpointResponse, context) {
   if (stateData) {
     const isNewTokenSet = !stateData.tokenSets.some(
       (tokenSet) => tokenSet.audience === audience && tokenSet.scope === tokenEndpointResponse.scope
@@ -61,7 +68,8 @@ function updateStateData(audience, stateData, tokenEndpointResponse) {
       ...stateData,
       idToken: tokenEndpointResponse.idToken ?? stateData.idToken,
       refreshToken: tokenEndpointResponse.refreshToken ?? stateData.refreshToken,
-      tokenSets
+      tokenSets,
+      domain: context?.domain ?? stateData.domain
     };
   } else {
     const user = tokenEndpointResponse.claims;
@@ -69,9 +77,8 @@ function updateStateData(audience, stateData, tokenEndpointResponse) {
       user,
       idToken: tokenEndpointResponse.idToken,
       refreshToken: tokenEndpointResponse.refreshToken,
-      tokenSets: [
-        createUpdatedTokenSet(audience, tokenEndpointResponse)
-      ],
+      tokenSets: [createUpdatedTokenSet(audience, tokenEndpointResponse)],
+      domain: context?.domain,
       internal: {
         sid: user?.sid,
         createdAt: Math.floor(Date.now() / 1e3)
@@ -120,6 +127,9 @@ var compareScopes = (scopes, requiredScopes) => {
   return requiredScopesArray.every((scope) => scopesSet.has(scope));
 };
 
+// src/server-client.ts
+import { decodeJwt } from "jose";
+
 // src/telemetry.ts
 function getTelemetryConfig(config) {
   if (config?.enabled === false) {
@@ -128,13 +138,26 @@ function getTelemetryConfig(config) {
   return {
     enabled: true,
     name: config?.name ?? "@auth0/auth0-server-js",
-    version: config?.version ?? "1.3.0"
+    version: config?.version ?? "1.4.0"
   };
 }
 
 // src/server-client.ts
 var DEFAULT_SCOPES = "openid profile email offline_access";
-function ensureOpenIdScope(scope) {
+var normalizeDomain = (value) => {
+  const trimmed = value.trim();
+  const parsed = trimmed.startsWith("http") ? new URL(trimmed) : new URL(`https://${trimmed}`);
+  return parsed.host.toLowerCase();
+};
+var decodeIssuer = (token) => {
+  try {
+    const { iss } = decodeJwt(token);
+    return typeof iss === "string" ? iss : void 0;
+  } catch {
+    return void 0;
+  }
+};
+var ensureOpenIdScope = (scope) => {
   if (!scope) {
     return DEFAULT_SCOPES;
   }
@@ -143,20 +166,32 @@ function ensureOpenIdScope(scope) {
     scopes.unshift("openid");
   }
   return scopes.join(" ");
-}
+};
 var ServerClient = class {
   #options;
   #transactionStore;
   #transactionStoreIdentifier;
   #stateStore;
   #stateStoreIdentifier;
+  #authClientOptions;
+  #staticDomain;
+  #authClient;
   /**
    * The underlying `authClient` instance that can be used to interact with the Auth0 Authentication API.
    * Generally, you should prefer to use the higher-level methods exposed on the `ServerClient` instance.
-   * 
+   *
+   * This property can only be used when `domain` is configured as a static string.
+   * In resolver mode (`domain` as a function), the SDK resolves the domain per request,
+   * so use `ServerClient` methods instead.
+   *
    * Important: the methods exposed on the `authClient` instance do not handle any session or state management.
    */
-  authClient;
+  get authClient() {
+    if (!this.#authClient) {
+      throw new InvalidConfigurationError("authClient is only available when using a static domain configuration.");
+    }
+    return this.#authClient;
+  }
   constructor(options) {
     this.#options = options;
     this.#stateStoreIdentifier = this.#options.stateIdentifier || "__a0_session";
@@ -169,18 +204,77 @@ var ServerClient = class {
     if (!this.#options.transactionStore) {
       throw new MissingRequiredArgumentError("transactionStore");
     }
-    this.authClient = new AuthClient({
-      domain: this.#options.domain,
+    if (typeof this.#options.domain !== "string" && typeof this.#options.domain !== "function") {
+      throw new InvalidConfigurationError("domain must be a string or resolver function");
+    }
+    this.#authClientOptions = {
       clientId: this.#options.clientId,
       clientSecret: this.#options.clientSecret,
       clientAssertionSigningKey: this.#options.clientAssertionSigningKey,
       clientAssertionSigningAlg: this.#options.clientAssertionSigningAlg,
       authorizationParams: this.#options.authorizationParams,
+      discoveryCache: this.#options.discoveryCache,
       customFetch: this.#options.customFetch,
-      useMtls: this.#options.useMtls,
+      useMtls: this.#options.useMtls
+    };
+    if (typeof this.#options.domain === "string") {
+      const domain = normalizeDomain(this.#options.domain);
+      this.#staticDomain = domain;
+      this.#authClient = new AuthClient({
+        domain,
+        ...this.#authClientOptions,
+        telemetry: getTelemetryConfig(this.#options.telemetry)
+      });
+    }
+  }
+  async #resolveDomain(storeOptions) {
+    if (typeof this.#options.domain === "function") {
+      const resolved = await this.#options.domain(storeOptions);
+      if (typeof resolved !== "string" || resolved.trim().length === 0) {
+        throw new InvalidConfigurationError("domainResolver returned no domain");
+      }
+      return normalizeDomain(resolved);
+    }
+    return normalizeDomain(this.#options.domain);
+  }
+  #createAuthClient(domain) {
+    return new AuthClient({
+      domain,
+      ...this.#authClientOptions,
       telemetry: getTelemetryConfig(this.#options.telemetry)
     });
   }
+  #getAuthClient(domain) {
+    const normalizedDomain = normalizeDomain(domain);
+    if (this.#authClient && this.#staticDomain === normalizedDomain) {
+      return this.#authClient;
+    }
+    return this.#createAuthClient(normalizedDomain);
+  }
+  #getSessionDomain(stateData) {
+    if (stateData.domain) {
+      return normalizeDomain(stateData.domain);
+    }
+    if (this.#staticDomain) {
+      return this.#staticDomain;
+    }
+    const issuerFromClaims = stateData.user?.iss;
+    if (typeof issuerFromClaims === "string" && issuerFromClaims.trim().length > 0) {
+      return normalizeDomain(issuerFromClaims);
+    }
+    return;
+  }
+  #isResolverMode() {
+    return typeof this.#options.domain === "function";
+  }
+  async #isSessionForCurrentDomain(stateData, storeOptions) {
+    const sessionDomain = this.#getSessionDomain(stateData);
+    if (!sessionDomain) {
+      return false;
+    }
+    const resolvedDomain = await this.#resolveDomain(storeOptions);
+    return sessionDomain === resolvedDomain;
+  }
   /**
    * Starts the interactive login process, and returns a URL to redirect the user-agent to to request authorization at Auth0.
    * @param options Optional options used to configure the interactive login process.
@@ -196,7 +290,9 @@ var ServerClient = class {
       throw new MissingRequiredArgumentError("authorizationParams.redirect_uri");
     }
     const scope = ensureOpenIdScope(options?.authorizationParams?.scope ?? this.#options.authorizationParams?.scope);
-    const { codeVerifier, authorizationUrl } = await this.authClient.buildAuthorizationUrl({
+    const domain = await this.#resolveDomain(storeOptions);
+    const authClient = this.#getAuthClient(domain);
+    const { codeVerifier, authorizationUrl } = await authClient.buildAuthorizationUrl({
       pushedAuthorizationRequests: options?.pushedAuthorizationRequests,
       authorizationParams: {
         ...options?.authorizationParams,
@@ -206,7 +302,8 @@ var ServerClient = class {
     });
     const transactionState = {
       audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,
-      codeVerifier
+      codeVerifier,
+      domain
     };
     if (options?.appState) {
       transactionState.appState = options.appState;
@@ -230,11 +327,15 @@ var ServerClient = class {
     if (!transactionData) {
       throw new MissingTransactionError();
     }
-    const tokenEndpointResponse = await this.authClient.getTokenByCode(url, {
+    const domain = transactionData.domain ?? await this.#resolveDomain(storeOptions);
+    const authClient = this.#getAuthClient(domain);
+    const tokenEndpointResponse = await authClient.getTokenByCode(url, {
       codeVerifier: transactionData.codeVerifier
     });
     const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
-    const stateData = updateStateData(transactionData.audience ?? "default", existingStateData, tokenEndpointResponse);
+    const stateData = updateStateData(transactionData.audience ?? "default", existingStateData, tokenEndpointResponse, {
+      domain
+    });
     await this.#stateStore.set(this.#stateStoreIdentifier, stateData, true, storeOptions);
     await this.#transactionStore.delete(this.#transactionStoreIdentifier, storeOptions);
     return { appState: transactionData.appState, authorizationDetails: tokenEndpointResponse.authorizationDetails };
@@ -256,7 +357,15 @@ var ServerClient = class {
         "Unable to start the user linking process without a logged in user. Ensure to login using the SDK before starting the user linking process."
       );
     }
-    const { linkUserUrl, codeVerifier } = await this.authClient.buildLinkUserUrl({
+    if (this.#isResolverMode()) {
+      const isCurrentDomain = await this.#isSessionForCurrentDomain(stateData, storeOptions);
+      if (!isCurrentDomain) {
+        throw new MissingSessionError("Session domain does not match the current domain.");
+      }
+    }
+    const domain = this.#getSessionDomain(stateData);
+    const authClient = this.#getAuthClient(domain);
+    const { linkUserUrl, codeVerifier } = await authClient.buildLinkUserUrl({
       connection: options.connection,
       connectionScope: options.connectionScope,
       idToken: stateData.idToken,
@@ -264,7 +373,8 @@ var ServerClient = class {
     });
     const transactionState = {
       audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,
-      codeVerifier
+      codeVerifier,
+      domain
     };
     if (options?.appState) {
       transactionState.appState = options.appState;
@@ -306,14 +416,23 @@ var ServerClient = class {
         "Unable to start the user unlinking process without a logged in user. Ensure to login using the SDK before starting the user unlinking process."
       );
     }
-    const { unlinkUserUrl, codeVerifier } = await this.authClient.buildUnlinkUserUrl({
+    if (this.#isResolverMode()) {
+      const isCurrentDomain = await this.#isSessionForCurrentDomain(stateData, storeOptions);
+      if (!isCurrentDomain) {
+        throw new MissingSessionError("Session domain does not match the current domain.");
+      }
+    }
+    const domain = this.#getSessionDomain(stateData);
+    const authClient = this.#getAuthClient(domain);
+    const { unlinkUserUrl, codeVerifier } = await authClient.buildUnlinkUserUrl({
       connection: options.connection,
       idToken: stateData.idToken,
       authorizationParams: options.authorizationParams
     });
     const transactionState = {
       audience: options?.authorizationParams?.audience ?? this.#options.authorizationParams?.audience,
-      codeVerifier
+      codeVerifier,
+      domain
     };
     if (options?.appState) {
       transactionState.appState = options.appState;
@@ -352,7 +471,9 @@ var ServerClient = class {
    */
   async loginBackchannel(options, storeOptions) {
     const scope = ensureOpenIdScope(options.authorizationParams?.scope ?? this.#options.authorizationParams?.scope);
-    const tokenEndpointResponse = await this.authClient.backchannelAuthentication({
+    const domain = await this.#resolveDomain(storeOptions);
+    const authClient = this.#getAuthClient(domain);
+    const tokenEndpointResponse = await authClient.backchannelAuthentication({
       bindingMessage: options.bindingMessage,
       loginHint: options.loginHint,
       authorizationParams: {
@@ -364,7 +485,8 @@ var ServerClient = class {
     const stateData = updateStateData(
       this.#options.authorizationParams?.audience ?? "default",
       existingStateData,
-      tokenEndpointResponse
+      tokenEndpointResponse,
+      { domain }
     );
     await this.#stateStore.set(this.#stateStoreIdentifier, stateData, true, storeOptions);
     return {
@@ -378,16 +500,31 @@ var ServerClient = class {
    */
   async getUser(storeOptions) {
     const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
-    return stateData?.user;
+    if (!stateData) {
+      return;
+    }
+    if (this.#isResolverMode()) {
+      const isCurrentDomain = await this.#isSessionForCurrentDomain(stateData, storeOptions);
+      if (!isCurrentDomain) {
+        return;
+      }
+    }
+    return stateData.user;
   }
   /**
    * Retrieve the user session from the store, or undefined if no session found.
    * @param storeOptions Optional options used to pass to the Transaction and State Store.
-   * @returns The sessionm or undefined if no session found in the store.
+   * @returns The session or undefined if no session found in the store.
    */
   async getSession(storeOptions) {
     const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
     if (stateData) {
+      if (this.#isResolverMode()) {
+        const isCurrentDomain = await this.#isSessionForCurrentDomain(stateData, storeOptions);
+        if (!isCurrentDomain) {
+          return;
+        }
+      }
       const { internal, ...sessionData } = stateData;
       return sessionData;
     }
@@ -395,24 +532,29 @@ var ServerClient = class {
   /**
    * Retrieves the access token from the store, or calls Auth0 when the access token is expired and a refresh token is available in the store.
    * Also updates the store when a new token was retrieved from Auth0.
-   *
-   * @param options Optional options for requesting specific audience/scope.
    * @param storeOptions Optional options used to pass to the Transaction and State Store.
    *
    * @throws {TokenByRefreshTokenError} If the refresh token was not found or there was an issue requesting the access token.
    *
    * @returns The Token Set, containing the access token, as well as additional information.
    */
-  async getAccessToken(tokenOptionsOrStoreOptions, storeOptions) {
-    const hasTokenOptions = (
-      // If second arg exists, first arg must be GetAccessTokenOptions
-      storeOptions !== void 0 || // OR if first arg has audience/scope properties
-      tokenOptionsOrStoreOptions && typeof tokenOptionsOrStoreOptions === "object" && ("audience" in tokenOptionsOrStoreOptions || "scope" in tokenOptionsOrStoreOptions)
-    );
-    const [resolvedOptions, resolvedStoreOptions] = hasTokenOptions ? [tokenOptionsOrStoreOptions, storeOptions] : [void 0, tokenOptionsOrStoreOptions];
-    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, resolvedStoreOptions);
-    const audience = resolvedOptions?.audience ?? this.#options.authorizationParams?.audience ?? "default";
-    const scope = resolvedOptions?.scope ?? this.#options.authorizationParams?.scope;
+  async getAccessToken(storeOptions) {
+    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
+    const audience = this.#options.authorizationParams?.audience ?? "default";
+    const scope = this.#options.authorizationParams?.scope;
+    const sessionDomain = stateData ? this.#getSessionDomain(stateData) : this.#staticDomain;
+    if (this.#isResolverMode()) {
+      if (!stateData) {
+        throw new MissingSessionError("Unable to retrieve access token without a logged in user.");
+      }
+      if (!sessionDomain) {
+        throw new MissingSessionError("Session domain does not match the current domain.");
+      }
+      const resolvedDomain = await this.#resolveDomain(storeOptions);
+      if (sessionDomain !== resolvedDomain) {
+        throw new MissingSessionError("Session domain does not match the current domain.");
+      }
+    }
     const tokenSet = stateData?.tokenSets.find(
       (tokenSet2) => tokenSet2.audience === audience && (!scope || compareScopes(tokenSet2.scope, scope))
     );
@@ -424,14 +566,15 @@ var ServerClient = class {
         "The access token has expired and a refresh token was not provided. The user needs to re-authenticate."
       );
     }
-    const tokenByRefreshTokenOptions = {
-      refreshToken: stateData.refreshToken,
-      ...hasTokenOptions && { audience, scope }
-    };
-    const tokenEndpointResponse = await this.authClient.getTokenByRefreshToken(tokenByRefreshTokenOptions);
-    const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, resolvedStoreOptions);
-    const updatedStateData = updateStateData(audience, existingStateData, tokenEndpointResponse);
-    await this.#stateStore.set(this.#stateStoreIdentifier, updatedStateData, false, resolvedStoreOptions);
+    const domainForSession = sessionDomain;
+    const tokenEndpointResponse = await this.#getAuthClient(domainForSession).getTokenByRefreshToken({
+      refreshToken: stateData.refreshToken
+    });
+    const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
+    const updatedStateData = updateStateData(audience, existingStateData, tokenEndpointResponse, {
+      domain: domainForSession
+    });
+    await this.#stateStore.set(this.#stateStoreIdentifier, updatedStateData, false, storeOptions);
     return {
       accessToken: tokenEndpointResponse.accessToken,
       scope: tokenEndpointResponse.scope,
@@ -456,6 +599,19 @@ var ServerClient = class {
    */
   async getAccessTokenForConnection(options, storeOptions) {
     const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
+    const sessionDomain = stateData ? this.#getSessionDomain(stateData) : this.#staticDomain;
+    if (this.#isResolverMode()) {
+      if (!stateData) {
+        throw new MissingSessionError("Unable to retrieve an access token for a connection without a logged in user.");
+      }
+      if (!sessionDomain) {
+        throw new MissingSessionError("Session domain does not match the current domain.");
+      }
+      const resolvedDomain = await this.#resolveDomain(storeOptions);
+      if (sessionDomain !== resolvedDomain) {
+        throw new MissingSessionError("Session domain does not match the current domain.");
+      }
+    }
     const connectionTokenSet = stateData?.connectionTokenSets?.find(
       (tokenSet) => tokenSet.connection === options.connection
     );
@@ -467,12 +623,20 @@ var ServerClient = class {
         "A refresh token was not found but is required to be able to retrieve an access token for a connection."
       );
     }
-    const tokenEndpointResponse = await this.authClient.getTokenForConnection({
+    const domainForSession = sessionDomain;
+    const tokenEndpointResponse = await this.#getAuthClient(domainForSession).getTokenForConnection({
       connection: options.connection,
       loginHint: options.loginHint,
       refreshToken: stateData.refreshToken
     });
-    const updatedStateData = updateStateDataForConnectionTokenSet(options, stateData, tokenEndpointResponse);
+    const updatedStateData = updateStateDataForConnectionTokenSet(
+      options,
+      {
+        ...stateData,
+        domain: stateData.domain ?? domainForSession
+      },
+      tokenEndpointResponse
+    );
     await this.#stateStore.set(this.#stateStoreIdentifier, updatedStateData, false, storeOptions);
     return {
       accessToken: tokenEndpointResponse.accessToken,
@@ -489,8 +653,21 @@ var ServerClient = class {
    * @returns {URL}
    */
   async logout(options, storeOptions) {
-    await this.#stateStore.delete(this.#stateStoreIdentifier, storeOptions);
-    return this.authClient.buildLogoutUrl(options);
+    if (!this.#isResolverMode()) {
+      await this.#stateStore.delete(this.#stateStoreIdentifier, storeOptions);
+      return this.authClient.buildLogoutUrl(options);
+    }
+    const resolvedDomain = await this.#resolveDomain(storeOptions);
+    const authClient = this.#getAuthClient(resolvedDomain);
+    const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
+    const sessionDomain = stateData ? this.#getSessionDomain(stateData) : void 0;
+    if (!stateData) {
+      return authClient.buildLogoutUrl(options);
+    }
+    if (sessionDomain && sessionDomain === resolvedDomain) {
+      await this.#stateStore.delete(this.#stateStoreIdentifier, storeOptions);
+    }
+    return authClient.buildLogoutUrl(options);
   }
   /**
    * Handles the backchannel logout process by verifying the logout token and deleting the session from the store if the logout token was considered valid.
@@ -504,8 +681,23 @@ var ServerClient = class {
     if (!logoutToken) {
       throw new BackchannelLogoutError("Missing Logout Token");
     }
-    const logoutTokenClaims = await this.authClient.verifyLogoutToken({ logoutToken });
-    await this.#stateStore.deleteByLogoutToken(logoutTokenClaims, storeOptions);
+    if (!this.#isResolverMode()) {
+      const logoutTokenClaims2 = await this.authClient.verifyLogoutToken({ logoutToken });
+      await this.#stateStore.deleteByLogoutToken(logoutTokenClaims2, storeOptions);
+      return;
+    }
+    const issuer = decodeIssuer(logoutToken);
+    if (!issuer) {
+      throw new BackchannelLogoutError("Logout token is missing an issuer");
+    }
+    const resolvedDomain = await this.#resolveDomain(storeOptions);
+    const domain = normalizeDomain(issuer);
+    if (domain !== resolvedDomain) {
+      throw new BackchannelLogoutError("Logout token issuer does not match the resolved domain");
+    }
+    const authClient = this.#getAuthClient(domain);
+    const logoutTokenClaims = await authClient.verifyLogoutToken({ logoutToken });
+    await this.#stateStore.deleteByLogoutToken({ ...logoutTokenClaims, iss: issuer }, storeOptions);
   }
 };
 
@@ -829,6 +1021,7 @@ export {
   BackchannelLogoutError,
   CookieTransactionStore,
   InvalidConfigurationError,
+  IssuerValidationError,
   MissingRequiredArgumentError,
   MissingSessionError,
   MissingTransactionError,