@auth0/auth0-server-js 1.8.0 → 1.9.0

package/dist/index.cjs

@@ -34,7 +34,7 @@ __export(index_exports, {
   MissingRequiredArgumentError: () => MissingRequiredArgumentError,
   MissingSessionError: () => MissingSessionError,
   MissingTransactionError: () => MissingTransactionError,
-  OrganizationValidationError: () => import_auth0_auth_js3.OrganizationValidationError,
+  OrganizationValidationError: () => import_auth0_auth_js4.OrganizationValidationError,
   PasskeyChallengeError: () => import_auth0_auth_js3.PasskeyChallengeError,
   PasskeyGetTokenError: () => import_auth0_auth_js3.PasskeyGetTokenError,
   PasskeyRegisterError: () => import_auth0_auth_js3.PasskeyRegisterError,
@@ -250,7 +250,7 @@ function getTelemetryConfig(config) {
   return {
     enabled: true,
     name: config?.name ?? "@auth0/auth0-server-js",
-    version: config?.version ?? "1.8.0"
+    version: config?.version ?? "1.9.0"
   };
 }
 
@@ -601,9 +601,16 @@ var ServerClient = class {
   }
   /**
    * Starts the interactive login process, and returns a URL to redirect the user-agent to to request authorization at Auth0.
+   *
+   * When `organization` is provided (per-login option, client-level default, or via
+   * `authorizationParams.organization`), it is forwarded to `/authorize` and remembered so the
+   * returned ID token's organization claim can be validated in `completeInteractiveLogin`.
+   *
    * @param options Optional options used to configure the interactive login process.
    * @param storeOptions Optional options used to pass to the Transaction and State Store.
    *
+   * @throws {OrganizationValidationError} If the resolved `organization` is blank.
+   * @throws {InvalidConfigurationError} If `invitation` is provided without an `organization`.
    * @throws {BuildAuthorizationUrlError} If there was an issue when building the Authorization URL.
    *
    * @returns A promise resolving to a URL object, representing the URL to redirect the user-agent to to request authorization at Auth0.
@@ -614,6 +621,16 @@ var ServerClient = class {
       throw new MissingRequiredArgumentError("authorizationParams.redirect_uri");
     }
     const scope = ensureOpenIdScope(options?.authorizationParams?.scope ?? this.#options.authorizationParams?.scope);
+    const perLoginAuthParamsOrganization = typeof options?.authorizationParams?.organization === "string" ? options.authorizationParams.organization : void 0;
+    const clientAuthParamsOrganization = typeof this.#options.authorizationParams?.organization === "string" ? this.#options.authorizationParams.organization : void 0;
+    const resolvedOrganization = options?.organization ?? perLoginAuthParamsOrganization ?? this.#options.organization ?? clientAuthParamsOrganization;
+    if (resolvedOrganization !== void 0 && !resolvedOrganization.trim()) {
+      throw new import_auth0_auth_js.OrganizationValidationError("organization must not be blank");
+    }
+    const hasInvitation = !!(options?.invitation || options?.authorizationParams?.invitation);
+    if (hasInvitation && !resolvedOrganization) {
+      throw new InvalidConfigurationError("organization is required when invitation is provided.");
+    }
     const domain = await this.#resolveDomain(storeOptions);
     const authClient = this.#getAuthClient(domain);
     const { codeVerifier, authorizationUrl } = await authClient.buildAuthorizationUrl({
@@ -621,7 +638,9 @@ var ServerClient = class {
       authorizationParams: {
         ...options?.authorizationParams,
         redirect_uri: redirectUri,
-        scope
+        scope,
+        ...resolvedOrganization ? { organization: resolvedOrganization } : {},
+        ...options?.invitation ? { invitation: options.invitation } : {}
       }
     });
     const transactionState = {
@@ -629,6 +648,9 @@ var ServerClient = class {
       codeVerifier,
       domain
     };
+    if (resolvedOrganization) {
+      transactionState.organization = resolvedOrganization;
+    }
     if (options?.appState) {
       transactionState.appState = options.appState;
     }
@@ -643,6 +665,7 @@ var ServerClient = class {
    *
    * @throws {MissingTransactionError} When no transaction was found.
    * @throws {TokenByCodeError} If there was an issue requesting the access token.
+   * @throws {OrganizationValidationError} When an organization was requested at login and the returned ID token's organization claim is missing or does not match; nothing is persisted.
    * @throws {SessionExpiredError} When the ID token's `session_expiry` is already in the past at login (the session is born expired); nothing is persisted.
    *
    * @returns A promise resolving to an object, containing the original appState (if present) and the authorizationDetails (when RAR was used).
@@ -656,7 +679,8 @@ var ServerClient = class {
     const authClient = this.#getAuthClient(domain);
     const tokenEndpointResponse = await authClient.getTokenByCode(url, {
       // TransactionData.codeVerifier is optional only to accommodate magic-link transactions.
-      codeVerifier: transactionData.codeVerifier
+      codeVerifier: transactionData.codeVerifier,
+      organization: transactionData.organization
     });
     await this.#transactionStore.delete(this.#transactionStoreIdentifier, storeOptions);
     const existingStateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);