@auth0/auth0-server-js 1.8.0 → 1.10.0

package/dist/index.js

@@ -163,6 +163,7 @@ function updateStateDataForConnectionTokenSet(options, stateData, tokenEndpointR
 import {
   TokenForConnectionError,
   AuthClient,
+  OrganizationValidationError,
   PasswordlessStartError,
   PasswordlessVerifyError,
   TokenByRefreshTokenError
@@ -204,7 +205,7 @@ function getTelemetryConfig(config) {
   return {
     enabled: true,
     name: config?.name ?? "@auth0/auth0-server-js",
-    version: config?.version ?? "1.8.0"
+    version: config?.version ?? "1.10.0"
   };
 }
 
@@ -383,6 +384,53 @@ var ServerPasskeyClient = class {
   }
 };
 
+// src/database/server-database-client.ts
+var ServerDatabaseClient = class {
+  #options;
+  /**
+   * @internal
+   */
+  constructor(options) {
+    this.#options = options;
+  }
+  /**
+   * Registers a new user in a database connection.
+   *
+   * Delegates to the underlying `AuthClient.database.signUp` without any session
+   * state modification. The caller is responsible for handling the returned user
+   * data as needed.
+   *
+   * @param options The signup options (email, password, connection, etc.).
+   * @param storeOptions Optional options used to resolve the domain (resolver mode).
+   *
+   * @throws {SignUpError} If there was an issue signing the user up.
+   *
+   * @returns A promise resolving to the created user result with a normalized `id` field.
+   */
+  async signUp(options, storeOptions) {
+    const domain = await this.#options.resolveDomain(storeOptions);
+    return this.#options.getAuthClient(domain).database.signUp(options);
+  }
+  /**
+   * Requests a password-change email for a database connection user.
+   *
+   * Delegates to the underlying `AuthClient.database.changePassword` without any
+   * session state modification. The caller is responsible for informing the user
+   * of the sent email as needed.
+   *
+   * @param options The password change options (email, connection, organization, etc.).
+   * @param storeOptions Optional options used to resolve the domain (resolver mode).
+   *
+   * @throws {ChangePasswordError} If there was an issue requesting the password change.
+   *
+   * @returns A promise resolving to the server's plain-text confirmation message.
+   */
+  async changePassword(options, storeOptions) {
+    const domain = await this.#options.resolveDomain(storeOptions);
+    return this.#options.getAuthClient(domain).database.changePassword(options);
+  }
+};
+
 // src/server-client.ts
 var normalizeDomain = (value) => {
   const trimmed = value.trim();
@@ -408,6 +456,7 @@ var ServerClient = class {
   #authClient;
   #mfaClient;
   #passkeyClient;
+  #databaseClient;
   /**
    * The underlying `authClient` instance that can be used to interact with the Auth0 Authentication API.
    * Generally, you should prefer to use the higher-level methods exposed on the `ServerClient` instance.
@@ -455,6 +504,21 @@ var ServerClient = class {
   get passkey() {
     return this.#passkeyClient;
   }
+  /**
+   * The database client for self-service sign-up and password-change requests
+   * against an Auth0 database connection.
+   *
+   * Provides `signUp()` to register a user and `changePassword()` to request a
+   * password-reset email. Both are pure passthrough operations to the Auth0
+   * Authentication API — they never read or write the session/state store.
+   *
+   * Like `passkey`, this property is available in both static and resolver
+   * (multi-tenant) domain modes. In resolver mode, pass `storeOptions` so the
+   * request resolves the intended tenant.
+   */
+  get database() {
+    return this.#databaseClient;
+  }
   constructor(options) {
     this.#options = options;
     this.#stateStoreIdentifier = this.#options.stateIdentifier || "__a0_session";
@@ -504,6 +568,10 @@ var ServerClient = class {
       defaultScope: this.#options.authorizationParams?.scope,
       defaultAudience: this.#options.authorizationParams?.audience
     });
+    this.#databaseClient = new ServerDatabaseClient({
+      resolveDomain: (storeOptions) => this.#resolveDomain(storeOptions),
+      getAuthClient: (domain) => this.#getAuthClient(domain)
+    });
   }
   async #resolveDomain(storeOptions) {
     if (typeof this.#options.domain === "function") {
@@ -555,9 +623,16 @@ var ServerClient = class {
   }
   /**
    * Starts the interactive login process, and returns a URL to redirect the user-agent to to request authorization at Auth0.
+   *
+   * When `organization` is provided (per-login option, client-level default, or via
+   * `authorizationParams.organization`), it is forwarded to `/authorize` and remembered so the
+   * returned ID token's organization claim can be validated in `completeInteractiveLogin`.
+   *
    * @param options Optional options used to configure the interactive login process.
    * @param storeOptions Optional options used to pass to the Transaction and State Store.
    *
+   * @throws {OrganizationValidationError} If the resolved `organization` is blank.
+   * @throws {InvalidConfigurationError} If `invitation` is provided without an `organization`.
    * @throws {BuildAuthorizationUrlError} If there was an issue when building the Authorization URL.
    *
    * @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.
@@ -568,6 +643,16 @@ var ServerClient = class {
       throw new MissingRequiredArgumentError("authorizationParams.redirect_uri");
     }
     const scope = ensureOpenIdScope(options?.authorizationParams?.scope ?? this.#options.authorizationParams?.scope);
+    const perLoginAuthParamsOrganization = typeof options?.authorizationParams?.organization === "string" ? options.authorizationParams.organization : void 0;
+    const clientAuthParamsOrganization = typeof this.#options.authorizationParams?.organization === "string" ? this.#options.authorizationParams.organization : void 0;
+    const resolvedOrganization = options?.organization ?? perLoginAuthParamsOrganization ?? this.#options.organization ?? clientAuthParamsOrganization;
+    if (resolvedOrganization !== void 0 && !resolvedOrganization.trim()) {
+      throw new OrganizationValidationError("organization must not be blank");
+    }
+    const hasInvitation = !!(options?.invitation || options?.authorizationParams?.invitation);
+    if (hasInvitation && !resolvedOrganization) {
+      throw new InvalidConfigurationError("organization is required when invitation is provided.");
+    }
     const domain = await this.#resolveDomain(storeOptions);
     const authClient = this.#getAuthClient(domain);
     const { codeVerifier, authorizationUrl } = await authClient.buildAuthorizationUrl({
@@ -575,7 +660,9 @@ var ServerClient = class {
       authorizationParams: {
         ...options?.authorizationParams,
         redirect_uri: redirectUri,
-        scope
+        scope,
+        ...resolvedOrganization ? { organization: resolvedOrganization } : {},
+        ...options?.invitation ? { invitation: options.invitation } : {}
       }
     });
     const transactionState = {
@@ -583,6 +670,9 @@ var ServerClient = class {
       codeVerifier,
       domain
     };
+    if (resolvedOrganization) {
+      transactionState.organization = resolvedOrganization;
+    }
     if (options?.appState) {
       transactionState.appState = options.appState;
     }
@@ -597,6 +687,7 @@ var ServerClient = class {
    *
    * @throws {MissingTransactionError} When no transaction was found.
    * @throws {TokenByCodeError} If there was an issue requesting the access token.
+   * @throws {OrganizationValidationError} When an organization was requested at login and the returned ID token's organization claim is missing or does not match; nothing is persisted.
    * @throws {SessionExpiredError} When the ID token's `session_expiry` is already in the past at login (the session is born expired); nothing is persisted.
    *
    * @returns A promise resolving to an object, containing the original appState (if present) and the authorizationDetails (when RAR was used).
@@ -610,7 +701,8 @@ var ServerClient = class {
     const authClient = this.#getAuthClient(domain);
     const tokenEndpointResponse = await authClient.getTokenByCode(url, {
       // TransactionData.codeVerifier is optional only to accommodate magic-link transactions.
-      codeVerifier: transactionData.codeVerifier
+      codeVerifier: transactionData.codeVerifier,
+      organization: transactionData.organization
     });
     await this.#transactionStore.delete(this.#transactionStoreIdentifier, storeOptions);
     const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
@@ -1145,6 +1237,47 @@ var ServerClient = class {
       loginHint: options.loginHint
     };
   }
+  /**
+   * Revokes the refresh token stored in the current session, or an explicitly supplied token.
+   *
+   * In resolver mode, revocation only occurs when the session domain matches the domain resolved
+   * for the current request. If the domains differ (or the session has no stored domain), the call
+   * returns without revoking to avoid sending a token to the wrong tenant. This guard applies even
+   * when a token is passed explicitly via `options.token`.
+   *
+   * @param options Optionally supply a token to revoke instead of reading from the session.
+   * @param storeOptions Optional options passed to the StateStore.
+   *
+   * @throws {MissingRequiredArgumentError} If `options.token` is an empty string.
+   * @throws {MissingSessionError} If no refresh token is found in the session and none was provided.
+   * @throws {TokenRevocationError} If the revocation request fails.
+   */
+  async revokeRefreshToken(options = {}, storeOptions) {
+    if (options.token !== void 0 && options.token.length === 0) {
+      throw new MissingRequiredArgumentError("options.token must not be an empty string.");
+    }
+    let refreshToken = options.token;
+    const needsStateData = !refreshToken || this.#isResolverMode();
+    const stateData = needsStateData ? await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions) : void 0;
+    if (!refreshToken) {
+      refreshToken = stateData?.refreshToken;
+    }
+    if (!refreshToken) {
+      throw new MissingSessionError("Unable to revoke refresh token: no refresh token found in session.");
+    }
+    let authClient;
+    if (this.#isResolverMode()) {
+      const resolvedDomain = await this.#resolveDomain(storeOptions);
+      const sessionDomain = stateData ? this.#getSessionDomain(stateData) : void 0;
+      if (stateData && sessionDomain !== resolvedDomain) {
+        return;
+      }
+      authClient = this.#getAuthClient(sessionDomain ?? resolvedDomain);
+    } else {
+      authClient = this.authClient;
+    }
+    await authClient.revokeToken({ token: refreshToken, tokenTypeHint: "refresh_token" });
+  }
   /**
    * Logs the user out and returns a URL to redirect the user-agent to after they log out.
    * @param options Options used to configure the logout process.
@@ -1153,17 +1286,26 @@ var ServerClient = class {
    */
   async logout(options, storeOptions) {
     if (!this.#isResolverMode()) {
+      try {
+        await this.revokeRefreshToken({}, storeOptions);
+      } catch {
+      }
       await this.#stateStore.delete(this.#stateStoreIdentifier, storeOptions);
       return this.authClient.buildLogoutUrl(options);
     }
     const resolvedDomain = await this.#resolveDomain(storeOptions);
     const authClient = this.#getAuthClient(resolvedDomain);
     const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
-    const sessionDomain = stateData ? this.#getSessionDomain(stateData) : void 0;
     if (!stateData) {
       return authClient.buildLogoutUrl(options);
     }
-    if (sessionDomain && sessionDomain === resolvedDomain) {
+    const sessionDomain = this.#getSessionDomain(stateData);
+    const domainMatches = sessionDomain === resolvedDomain;
+    if (domainMatches) {
+      try {
+        await this.revokeRefreshToken({}, storeOptions);
+      } catch {
+      }
       await this.#stateStore.delete(this.#stateStoreIdentifier, storeOptions);
     }
     return authClient.buildLogoutUrl(options);
@@ -1381,7 +1523,7 @@ var AbstractTransactionStore = class extends AbstractStore {
 };
 
 // src/index.ts
-import { TokenExchangeError, MissingClientAuthError } from "@auth0/auth0-auth-js";
+import { TokenExchangeError, TokenRevocationError, MissingClientAuthError, OrganizationValidationError as OrganizationValidationError3 } from "@auth0/auth0-auth-js";
 
 // src/store/cookie-transaction-store.ts
 var CookieTransactionStore = class extends AbstractTransactionStore {
@@ -1591,12 +1733,16 @@ import {
   PasskeyRegisterError,
   PasskeyChallengeError,
   PasskeyGetTokenError,
-  OrganizationValidationError
+  OrganizationValidationError as OrganizationValidationError2
 } from "@auth0/auth0-auth-js";
+
+// src/database/index.ts
+import { SignUpError, ChangePasswordError } from "@auth0/auth0-auth-js";
 export {
   AbstractStateStore,
   AbstractTransactionStore,
   BackchannelLogoutError,
+  ChangePasswordError,
   CookieTransactionStore,
   InvalidConfigurationError,
   IssuerValidationError,
@@ -1608,18 +1754,21 @@ export {
   MissingRequiredArgumentError,
   MissingSessionError,
   MissingTransactionError,
-  OrganizationValidationError,
+  OrganizationValidationError3 as OrganizationValidationError,
   PasskeyChallengeError,
   PasskeyGetTokenError,
   PasskeyRegisterError,
   ServerClient,
+  ServerDatabaseClient,
   ServerMfaClient,
   ServerPasskeyClient,
   SessionExpiredError,
+  SignUpError,
   StartLinkUserError,
   StatefulStateStore,
   StatelessStateStore,
   TokenExchangeError,
+  TokenRevocationError,
   isMfaRequiredError
 };
 //# sourceMappingURL=index.js.map