@descope/node-sdk 1.0.4-alpha.6 → 1.0.4-alpha.7

package/dist/index.esm.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.esm.js","sources":["../lib/constants.ts","../lib/helpers.ts","../lib/index.ts"],"sourcesContent":["// eslint-disable-next-line import/prefer-default-export\nexport const refreshTokenCookieName = 'DSR'\nexport const sessionTokenCookieName = 'DS'\n","import type { SdkResponse } from '@descope/core-js-sdk'\nimport { refreshTokenCookieName, sessionTokenCookieName } from './constants'\n\nconst generateCookie = (name: string, value: string, options?: any) =>\n  `${name}=${value}; Domain=${options?.cookieDomain || ''}; Max-Age=${\n    options?.cookieMaxAge || ''\n  }; Path=${options?.cookiePath || '/'}; HttpOnly; SameSite=Strict`\n\nconst getCookieValue = (cookie: string | null | undefined, name: string) => {\n  const match = cookie?.match(RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`))\n  return match ? match[1] : null\n}\n\n// eslint-disable-next-line import/prefer-default-export\nexport const withCookie =\n  <T extends Array<any>, U extends Promise<SdkResponse>>(fn: (...args: T) => U) =>\n  async (...args: T): Promise<SdkResponse> => {\n    const resp = await fn(...args)\n\n    if (!resp.data) {\n      return resp\n    }\n\n    // eslint-disable-next-line prefer-const\n    let { sessionJwt, refreshJwt, ...rest } = resp.data\n    const cookies = [generateCookie(sessionTokenCookieName, sessionJwt, rest)]\n\n    if (!refreshJwt) {\n      if (resp.response?.headers.get('set-cookie')) {\n        refreshJwt = getCookieValue(\n          resp.response?.headers.get('set-cookie'),\n          refreshTokenCookieName,\n        )\n        cookies.push(resp.response?.headers.get('set-cookie')!)\n      }\n    } else {\n      cookies.push(generateCookie(refreshTokenCookieName, refreshJwt, rest))\n    }\n\n    return { ...resp, data: { ...resp.data, refreshJwt, cookies } }\n  }\n\nexport const wrapWith = <T extends Record<string, any>>(\n  obj: T,\n  path: string | string[],\n  wrappingFn: Function,\n  // eslint-disable-next-line consistent-return\n): void => {\n  if (!obj) return\n\n  const pathSections = typeof path === 'string' ? path.split('.') : path\n  const section = pathSections.shift() || ('' as keyof T)\n\n  if (pathSections.length === 0 || section === '*') {\n    const wrap = (key: keyof T) => {\n      if (key && typeof obj[key] === 'function') {\n        // eslint-disable-next-line no-param-reassign\n        obj[key] = wrappingFn(obj[key])\n      } else {\n        throw Error(`cannot wrap value at key \"${key.toString()}\"`)\n      }\n    }\n    if (section === '*') {\n      Object.keys(obj).forEach(wrap)\n    } else {\n      wrap(section)\n    }\n  } else {\n    wrapWith(obj[section], pathSections, wrappingFn)\n  }\n}\n\nexport const bulkWrapWith = (\n  obj: Parameters<typeof wrapWith>[0],\n  paths: string[],\n  wrappingFn: Parameters<typeof wrapWith>[2],\n) => paths.forEach((path: string) => wrapWith(obj, path, wrappingFn))\n","import createSdk from '@descope/core-js-sdk'\nimport { KeyLike, jwtVerify, JWK, JWTHeaderParameters, importJWK } from 'jose'\nimport fetch, { Headers, Response, Request } from 'node-fetch'\nimport { bulkWrapWith, withCookie } from './helpers'\nimport { AuthenticationInfo } from './types'\nimport { refreshTokenCookieName, sessionTokenCookieName } from './constants'\n\nif (!globalThis.fetch) {\n  // @ts-ignore\n  globalThis.fetch = fetch\n  // @ts-ignore\n  globalThis.Headers = Headers\n  // @ts-ignore\n  globalThis.Request = Request\n  // @ts-ignore\n  globalThis.Response = Response\n}\n\nconst sdk = (...args: Parameters<typeof createSdk>) => {\n  const coreSdk = createSdk(...args)\n\n  bulkWrapWith(\n    coreSdk,\n    [\n      'otp.verify.*',\n      'magicLink.verify',\n      'magicLink.crossDevice.signUp.*',\n      'magicLink.crossDevice.signIn.*',\n      'oauth.exchange',\n      'saml.exchange',\n      'totp.verify',\n      'webauthn.signIn.finish',\n      'webauthn.signUp.finish',\n      'refresh',\n    ],\n    withCookie,\n  )\n\n  const { projectId, logger } = args[0]\n\n  const keys: Record<string, KeyLike | Uint8Array> = {}\n\n  const fetchKeys = async () => {\n    const publicKeys: JWK[] = await coreSdk.httpClient\n      .get(`v1/keys/${projectId}`)\n      .then((resp) => resp.json())\n    if (!Array.isArray(publicKeys)) return {}\n    const kidJwksPairs = await Promise.all(\n      publicKeys.map(async (key) => [key.kid, await importJWK(key)]),\n    )\n\n    return kidJwksPairs.reduce(\n      (acc, [kid, jwk]) => (kid ? { ...acc, [kid.toString()]: jwk } : acc),\n      {},\n    )\n  }\n\n  return {\n    ...coreSdk,\n\n    async getKey(header: JWTHeaderParameters): Promise<KeyLike | Uint8Array> {\n      if (!header?.kid) throw Error('header.kid must not be empty')\n\n      if (keys[header.kid]) return keys[header.kid]\n\n      // do we need to fetch once or every time?\n      Object.assign(keys, await fetchKeys())\n\n      if (!keys[header.kid]) throw Error('failed to fetch matching key')\n\n      return keys[header.kid]\n    },\n\n    async validateToken(token: string): Promise<AuthenticationInfo> {\n      const res = await jwtVerify(token, this.getKey, { algorithms: ['ES384'] })\n\n      return { token: res.payload }\n    },\n\n    async validateSession(\n      sessionToken: string,\n      refreshToken: string,\n    ): Promise<AuthenticationInfo | undefined> {\n      if (!sessionToken) throw Error('session token must not be empty')\n\n      try {\n        const token = await this.validateToken(sessionToken)\n        return token\n      } catch (error) {\n        try {\n          await this.validateToken(refreshToken)\n\n          return (await this.refresh(refreshToken)).data\n        } catch (refreshTokenErr) {\n          logger?.error('failed to validate refresh token', refreshTokenErr)\n\n          throw Error('could not validate tokens')\n        }\n      }\n    },\n  }\n}\n\nconst sdkWithAttributes = sdk as typeof sdk & {\n  DeliveryMethods: typeof createSdk.DeliveryMethods\n  RefreshTokenCookieName: typeof refreshTokenCookieName\n  SessionTokenCookieName: typeof sessionTokenCookieName\n}\n\nsdkWithAttributes.DeliveryMethods = createSdk.DeliveryMethods\nsdkWithAttributes.RefreshTokenCookieName = refreshTokenCookieName\nsdkWithAttributes.SessionTokenCookieName = sessionTokenCookieName\n\nexport default sdkWithAttributes\n\nexport type { DeliveryMethod, OAuthProvider } from '@descope/core-js-sdk'\n"],"names":["generateCookie","name","value","options","cookieDomain","cookieMaxAge","cookiePath","withCookie","fn","async","args","resp","data","_d","sessionJwt","refreshJwt","rest","__rest","cookies","push","_a","response","headers","get","cookie","match","RegExp","getCookieValue","_b","_c","Object","assign","wrapWith","obj","path","wrappingFn","pathSections","split","section","shift","length","wrap","key","Error","toString","keys","forEach","globalThis","fetch","Headers","Request","Response","sdkWithAttributes","coreSdk","createSdk","projectId","logger","header","kid","publicKeys","httpClient","then","json","Array","isArray","Promise","all","map","importJWK","reduce","acc","jwk","fetchKeys","token","jwtVerify","this","getKey","algorithms","payload","sessionToken","refreshToken","validateToken","error","refresh","refreshTokenErr","DeliveryMethods","RefreshTokenCookieName","SessionTokenCookieName"],"mappings":"sLACO,MCEDA,EAAiB,CAACC,EAAcC,EAAeC,IACnD,GAAGF,KAAQC,cAAiBC,aAAA,EAAAA,EAASC,eAAgB,gBACnDD,aAAA,EAAAA,EAASE,eAAgB,aACjBF,aAAA,EAAAA,EAASG,aAAc,iCAQtBC,EAC4CC,GACvDC,SAAUC,eACR,MAAMC,QAAaH,KAAME,GAEzB,IAAKC,EAAKC,KACR,OAAOD,EAIT,IAAIE,EAAsCF,EAAKC,MAA3CE,WAAEA,EAAUC,WAAEA,KAAeC,EAA7BC,EAAAJ,EAAA,CAAA,aAAA,eACJ,MAAMK,EAAU,CAAClB,EDvBiB,KCuBsBc,EAAYE,IAcpE,OAZKD,EASHG,EAAQC,KAAKnB,EDnCmB,MCmCoBe,EAAYC,KAR/C,QAAbI,EAAAT,EAAKU,gBAAQ,IAAAD,OAAA,EAAAA,EAAEE,QAAQC,IAAI,iBAC7BR,EArBe,EAACS,EAAmCvB,KACzD,MAAMwB,EAAQD,eAAAA,EAAQC,MAAMC,OAAO,cAAczB,cACjD,OAAOwB,EAAQA,EAAM,GAAK,IAAI,EAmBXE,CACE,QAAbC,EAAAjB,EAAKU,gBAAQ,IAAAO,OAAA,EAAAA,EAAEN,QAAQC,IAAI,cD7BC,OCgC9BL,EAAQC,KAAoB,QAAfU,EAAAlB,EAAKU,gBAAU,IAAAQ,OAAA,EAAAA,EAAAP,QAAQC,IAAI,gBAMhCO,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAApB,GAAM,CAAAC,KAAWkB,OAAAC,OAAAD,OAAAC,OAAA,GAAApB,EAAKC,MAAM,CAAAG,aAAYG,aAAW,EAGtDc,EAAW,CACtBC,EACAC,EACAC,KAGA,IAAKF,EAAK,OAEV,MAAMG,EAA+B,iBAATF,EAAoBA,EAAKG,MAAM,KAAOH,EAC5DI,EAAUF,EAAaG,SAAY,GAEzC,GAA4B,IAAxBH,EAAaI,QAA4B,MAAZF,EAAiB,CAChD,MAAMG,EAAQC,IACZ,IAAIA,GAA2B,mBAAbT,EAAIS,GAIpB,MAAMC,MAAM,6BAA6BD,EAAIE,eAF7CX,EAAIS,GAAOP,EAAWF,EAAIS,GAG3B,EAEa,MAAZJ,EACFR,OAAOe,KAAKZ,GAAKa,QAAQL,GAEzBA,EAAKH,EAER,MACCN,EAASC,EAAIK,GAAUF,EAAcD,EACtC,EC9DEY,WAAWC,QAEdD,WAAWC,MAAQA,EAEnBD,WAAWE,QAAUA,EAErBF,WAAWG,QAAUA,EAErBH,WAAWI,SAAWA,GAGxB,MAqFMC,EArFM,IAAI1C,KACd,MAAM2C,EAAUC,KAAa5C,GDqDH,IAC1BuB,EAEAE,EAFAF,ECnDEoB,EDqDFlB,ECxCE5B,EAZA,CACE,eACA,mBACA,iCACA,iCACA,iBACA,gBACA,cACA,yBACA,yBACA,WD2CKuC,SAASZ,GAAiBF,EAASC,EAAKC,EAAMC,KCtCvD,MAAMoB,UAAEA,EAASC,OAAEA,GAAW9C,EAAK,GAE7BmC,EAA6C,CAAA,EAiBnD,OAAAf,OAAAC,OAAAD,OAAAC,OAAA,GACKsB,GAEH,CAAA5C,aAAagD,GACX,KAAKA,aAAA,EAAAA,EAAQC,KAAK,MAAMf,MAAM,gCAE9B,GAAIE,EAAKY,EAAOC,KAAM,OAAOb,EAAKY,EAAOC,KAKzC,GAFA5B,OAAOC,OAAOc,OAxBApC,WAChB,MAAMkD,QAA0BN,EAAQO,WACrCrC,IAAI,WAAWgC,KACfM,MAAMlD,GAASA,EAAKmD,SACvB,OAAKC,MAAMC,QAAQL,UACQM,QAAQC,IACjCP,EAAWQ,KAAI1D,MAAOiC,GAAQ,CAACA,EAAIgB,UAAWU,EAAU1B,QAGtC2B,QAClB,CAACC,GAAMZ,EAAKa,KAAUb,EAAW5B,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAuC,IAAK,CAACZ,EAAId,YAAa2B,IAAQD,GAChE,CAAE,GAPmC,EAQtC,EAY2BE,KAErB3B,EAAKY,EAAOC,KAAM,MAAMf,MAAM,gCAEnC,OAAOE,EAAKY,EAAOC,IACpB,EAEDjD,oBAAoBgE,GAGlB,MAAO,CAAEA,aAFSC,EAAUD,EAAOE,KAAKC,OAAQ,CAAEC,WAAY,CAAC,YAE3CC,QACrB,EAEDrE,sBACEsE,EACAC,GAEA,IAAKD,EAAc,MAAMpC,MAAM,mCAE/B,IAEE,aADoBgC,KAAKM,cAAcF,EAYxC,CAVC,MAAOG,GACP,IAGE,aAFMP,KAAKM,cAAcD,UAEXL,KAAKQ,QAAQH,IAAepE,IAK3C,CAJC,MAAOwE,GAGP,MAFA5B,SAAAA,EAAQ0B,MAAM,mCAAoCE,GAE5CzC,MAAM,4BACb,CACF,CACF,GACF,EASHS,EAAkBiC,gBAAkB/B,EAAU+B,gBAC9CjC,EAAkBkC,uBF7GoB,ME8GtClC,EAAkBmC,uBF7GoB"}
+{"version":3,"file":"index.esm.js","sources":["../lib/constants.ts","../lib/helpers.ts","../lib/index.ts"],"sourcesContent":["// eslint-disable-next-line import/prefer-default-export\n/** Refresh JWT cookie name */\nexport const refreshTokenCookieName = 'DSR';\n/** Session JWT cookie name */\nexport const sessionTokenCookieName = 'DS';\n/** The key of the tenants claims in the claims map */\nexport const authorizedTenantsClaimName = 'tenants';\n/** The key of the permissions claims in the claims map either under tenant or top level */\nexport const permissionsClaimName = 'permissions';\n/** The key of the roles claims in the claims map either under tenant or top level */\nexport const rolesClaimName = 'roles';\n","import type { ResponseData, SdkResponse } from '@descope/core-js-sdk';\nimport { AuthenticationInfo } from './types';\nimport {\n  refreshTokenCookieName,\n  sessionTokenCookieName,\n  authorizedTenantsClaimName,\n} from './constants';\n\n/**\n * Generate a cookie string from given parameters\n * @param name name of the cookie\n * @param value value of cookie that must be already encoded\n * @param options any options to put on the cookie like cookieDomain, cookieMaxAge, cookiePath\n * @returns Cookie string with all options on the string\n */\nconst generateCookie = (name: string, value: string, options?: Record<string, string | number>) =>\n  `${name}=${value}; Domain=${options?.cookieDomain || ''}; Max-Age=${\n    options?.cookieMaxAge || ''\n  }; Path=${options?.cookiePath || '/'}; HttpOnly; SameSite=Strict`;\n\n/**\n * Parse the cookie string and return the value of the cookie\n * @param cookie the raw cookie string\n * @param name the name of the cookie to get value for\n * @returns the value of the given cookie\n */\nconst getCookieValue = (cookie: string | null | undefined, name: string) => {\n  const match = cookie?.match(RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`));\n  return match ? match[1] : null;\n};\n\n// eslint-disable-next-line import/prefer-default-export\n/**\n * Add cookie generation to core-js functions.\n * @param fn the function we are wrapping\n * @returns Wrapped function with cookie generation\n */\nexport const withCookie =\n  <T extends Array<any>, U extends Promise<SdkResponse<ResponseData>>>(fn: (...args: T) => U) =>\n  async (...args: T): Promise<SdkResponse<ResponseData>> => {\n    const resp = await fn(...args);\n\n    // istanbul ignore next\n    if (!resp.data) {\n      return resp;\n    }\n\n    // eslint-disable-next-line prefer-const\n    let { sessionJwt, refreshJwt, ...rest } = resp.data;\n    const cookies = [generateCookie(sessionTokenCookieName, sessionJwt, rest)];\n\n    if (!refreshJwt) {\n      if (resp.response?.headers.get('set-cookie')) {\n        refreshJwt = getCookieValue(\n          resp.response?.headers.get('set-cookie'),\n          refreshTokenCookieName,\n        );\n        cookies.push(resp.response?.headers.get('set-cookie')!);\n      }\n    } else {\n      cookies.push(generateCookie(refreshTokenCookieName, refreshJwt, rest));\n    }\n\n    return { ...resp, data: { ...resp.data, refreshJwt, cookies } };\n  };\n\n/**\n * Wrap given object internal functions (can be deep inside the object) with the given wrapping function\n * @param obj we will deep wrap functions inside this object based on the given path\n * @param path the path of internal objects to walk before wrapping the final result. Path is collection of parts separated by '.' that support '*' to say all of the keys for the part.\n * @param wrappingFn function to wrap with\n * @returns void, we update the functions in place\n */\nexport const wrapWith = <T extends Record<string, any>>(\n  obj: T,\n  path: string | string[],\n  wrappingFn: Function,\n  // eslint-disable-next-line consistent-return\n): void => {\n  if (!obj) return;\n\n  const pathSections = typeof path === 'string' ? path.split('.') : path;\n  const section = pathSections.shift() || ('' as keyof T);\n\n  if (pathSections.length === 0 || section === '*') {\n    const wrap = (key: keyof T) => {\n      if (key && typeof obj[key] === 'function') {\n        // eslint-disable-next-line no-param-reassign\n        obj[key] = wrappingFn(obj[key]);\n      } else {\n        // istanbul ignore next\n        throw Error(`cannot wrap value at key \"${key.toString()}\"`);\n      }\n    };\n    if (section === '*') {\n      Object.keys(obj).forEach(wrap);\n    } else {\n      wrap(section);\n    }\n  } else {\n    wrapWith(obj[section], pathSections, wrappingFn);\n  }\n};\n\n/**\n * Wrap given object internal functions (can be deep inside the object) with the given wrapping function based on multiple paths.\n * @param obj we will deep wrap functions inside this object based on the given paths\n * @param paths multiple paths of internal objects to walk before wrapping the final result. Path is collection of parts separated by '.' that support '*' to say all of the keys for the part.\n * @param wrappingFn function to wrap with\n * @returns void, we update the functions in place\n */\nexport const bulkWrapWith = (\n  obj: Parameters<typeof wrapWith>[0],\n  paths: string[],\n  wrappingFn: Parameters<typeof wrapWith>[2],\n) => paths.forEach((path: string) => wrapWith(obj, path, wrappingFn));\n\n/**\n * Get the claim (used for permissions or roles) for a given tenant or top level if tenant is empty\n * @param authInfo The parsed authentication info from the JWT\n * @param claim name of the claim\n * @param tenant tenant to retrieve the claim for\n * @returns\n */\nexport function getAuthorizationClaimItems(\n  authInfo: AuthenticationInfo,\n  claim: string,\n  tenant?: string,\n): string[] {\n  const value = tenant\n    ? authInfo.token[authorizedTenantsClaimName]?.[tenant]?.[claim]\n    : authInfo.token[claim];\n  return Array.isArray(value) ? value : [];\n}\n","import createSdk, {\n  SdkResponse,\n  ExchangeAccessKeyResponse,\n  RequestConfig,\n} from '@descope/core-js-sdk';\nimport { KeyLike, jwtVerify, JWK, JWTHeaderParameters, importJWK } from 'jose';\nimport fetch, { Headers, Response, Request } from 'node-fetch';\nimport { bulkWrapWith, withCookie, getAuthorizationClaimItems } from './helpers';\nimport { AuthenticationInfo } from './types';\nimport {\n  refreshTokenCookieName,\n  sessionTokenCookieName,\n  permissionsClaimName,\n  rolesClaimName,\n} from './constants';\n\ndeclare const BUILD_VERSION: string;\n\n/* istanbul ignore next */\nif (!globalThis.fetch) {\n  // @ts-ignore\n  globalThis.fetch = fetch;\n  // @ts-ignore\n  globalThis.Headers = Headers;\n  // @ts-ignore\n  globalThis.Request = Request;\n  // @ts-ignore\n  globalThis.Response = Response;\n}\n\nconst nodeSdk = (...args: Parameters<typeof createSdk>) => {\n  const funcArgs: typeof args = [...args];\n  funcArgs[0].hooks = funcArgs[0].hooks || {};\n  const origBeforeRequest = funcArgs[0].hooks.beforeRequest;\n  funcArgs[0].hooks.beforeRequest = (config: RequestConfig) => {\n    const conf = config;\n    conf.headers = {\n      ...conf.headers,\n      'x-descope-sdk-name': 'nodejs',\n      'x-descope-sdk-node-version': process?.versions?.node || '',\n      'x-descope-sdk-version': BUILD_VERSION,\n    };\n    return origBeforeRequest?.(conf) || conf;\n  };\n  const coreSdk = createSdk(...funcArgs);\n\n  bulkWrapWith(\n    coreSdk,\n    [\n      'otp.verify.*',\n      'magicLink.verify',\n      'magicLink.crossDevice.signUp.*',\n      'magicLink.crossDevice.signIn.*',\n      'oauth.exchange',\n      'saml.exchange',\n      'totp.verify',\n      'webauthn.signIn.finish',\n      'webauthn.signUp.finish',\n      'refresh',\n    ],\n    withCookie,\n  );\n\n  const { projectId, logger } = args[0];\n\n  const keys: Record<string, KeyLike | Uint8Array> = {};\n\n  /** Fetch the public keys (JWKs) from Descope for the configured project */\n  const fetchKeys = async () => {\n    const publicKeys: JWK[] = await coreSdk.httpClient\n      .get(`v1/keys/${projectId}`)\n      .then((resp) => resp.json());\n    if (!Array.isArray(publicKeys)) return {};\n    const kidJwksPairs = await Promise.all(\n      publicKeys.map(async (key) => [key.kid, await importJWK(key)]),\n    );\n\n    return kidJwksPairs.reduce(\n      (acc, [kid, jwk]) => (kid ? { ...acc, [kid.toString()]: jwk } : acc),\n      {},\n    );\n  };\n\n  const sdk = {\n    ...coreSdk,\n\n    /** Get the key that can validate the given JWT KID in the header. Can retrieve the public key from local cache or from Descope. */\n    async getKey(header: JWTHeaderParameters): Promise<KeyLike | Uint8Array> {\n      if (!header?.kid) throw Error('header.kid must not be empty');\n\n      if (keys[header.kid]) return keys[header.kid];\n\n      // do we need to fetch once or every time?\n      Object.assign(keys, await fetchKeys());\n\n      if (!keys[header.kid]) throw Error('failed to fetch matching key');\n\n      return keys[header.kid];\n    },\n\n    /**\n     * Validate the given JWT with the right key and make sure the issuer is correct\n     * @param jwt the JWT string to parse and validate\n     * @returns AuthenticationInfo with the parsed token and JWT. Will throw an error if validation fails.\n     */\n    async validateJwt(jwt: string): Promise<AuthenticationInfo> {\n      // Do not hard-code the algo because library does not support `None` so all are valid\n      const res = await jwtVerify(jwt, sdk.getKey, { issuer: projectId, clockTolerance: 5 });\n\n      return { jwt, token: res.payload };\n    },\n\n    /**\n     * Validate session based on at least one of session and refresh JWTs. You must provide at least one of them.\n     *\n     * @param sessionToken session JWT\n     * @param refreshToken refresh JWT\n     * @returns AuthenticationInfo promise or throws Error if there is an issue with JWTs\n     */\n    async validateSession(\n      sessionToken?: string,\n      refreshToken?: string,\n    ): Promise<AuthenticationInfo> {\n      if (!sessionToken && !refreshToken)\n        throw Error('both refresh token and session token are empty');\n\n      if (sessionToken) {\n        try {\n          const token = await sdk.validateJwt(sessionToken);\n          return token;\n        } catch (error) {\n          if (!refreshToken) {\n            logger?.error('failed to validate session token and no refresh token provided', error);\n            throw Error('could not validate tokens');\n          }\n        }\n      }\n      if (refreshToken) {\n        try {\n          await sdk.validateJwt(refreshToken);\n          const jwtResp = await sdk.refresh(refreshToken);\n          if (jwtResp.ok) {\n            const token = await sdk.validateJwt(jwtResp.data?.sessionJwt);\n            return token;\n          }\n          throw Error(jwtResp.error?.message);\n        } catch (refreshTokenErr) {\n          logger?.error('failed to validate refresh token', refreshTokenErr);\n          throw Error('could not validate tokens');\n        }\n      }\n      /* istanbul ignore next */\n      throw Error('could not validate token');\n    },\n\n    /**\n     * Exchange API key (access key) for a session key\n     * @param accessKey access key to exchange for a session JWT\n     * @returns AuthneticationInfo with session JWT data\n     */\n    async exchangeAccessKey(accessKey: string): Promise<AuthenticationInfo> {\n      if (!accessKey) throw Error('access key must not be empty');\n\n      let resp: SdkResponse<ExchangeAccessKeyResponse>;\n      try {\n        resp = await sdk.accessKey.exchange(accessKey);\n      } catch (error) {\n        logger?.error('failed to exchange access key', error);\n        throw Error('could not exchange access key');\n      }\n\n      const { sessionJwt } = resp.data;\n      if (!sessionJwt) {\n        logger?.error('failed to parse exchange access key response');\n        throw Error('could not exchange access key');\n      }\n\n      try {\n        const token = await sdk.validateJwt(sessionJwt);\n        return token;\n      } catch (error) {\n        logger?.error('failed to parse jwt from access key', error);\n        throw Error('could not exchange access key');\n      }\n    },\n\n    /**\n     * Make sure that all given permissions exist on the parsed JWT top level claims\n     * @param authInfo JWT parsed info\n     * @param permissions list of permissions to make sure they exist on te JWT claims\n     * @returns true if all permissions exist, false otherwise\n     */\n    validatePermissions(authInfo: AuthenticationInfo, permissions: string[]): boolean {\n      return sdk.validateTenantPermissions(authInfo, null, permissions);\n    },\n\n    /**\n     * Make sure that all given permissions exist on the parsed JWT tenant claims\n     * @param authInfo JWT parsed info\n     * @param permissions list of permissions to make sure they exist on te JWT claims\n     * @returns true if all permissions exist, false otherwise\n     */\n    validateTenantPermissions(\n      authInfo: AuthenticationInfo,\n      tenant: string,\n      permissions: string[],\n    ): boolean {\n      const granted = getAuthorizationClaimItems(authInfo, permissionsClaimName, tenant);\n      return permissions.every((perm) => granted.includes(perm));\n    },\n\n    /**\n     * Make sure that all given roles exist on the parsed JWT top level claims\n     * @param authInfo JWT parsed info\n     * @param roles list of roles to make sure they exist on te JWT claims\n     * @returns true if all roles exist, false otherwise\n     */\n    validateRoles(authInfo: AuthenticationInfo, roles: string[]): boolean {\n      return sdk.validateTenantRoles(authInfo, null, roles);\n    },\n\n    /**\n     * Make sure that all given roles exist on the parsed JWT tenant claims\n     * @param authInfo JWT parsed info\n     * @param roles list of roles to make sure they exist on te JWT claims\n     * @returns true if all roles exist, false otherwise\n     */\n    validateTenantRoles(authInfo: AuthenticationInfo, tenant: string, roles: string[]): boolean {\n      const membership = getAuthorizationClaimItems(authInfo, rolesClaimName, tenant);\n      return roles.every((role) => membership.includes(role));\n    },\n  };\n\n  return sdk;\n};\n\n/** Descope SDK client with delivery methods enum.\n *\n * Please see full documentation at {@link https://docs.descope.com/guides Descope Docs}\n * @example Usage\n *\n * ```js\n * import descopeSdk from '@descope/node-sdk';\n *\n * const myProjectId = 'xxx';\n * const sdk = descopeSdk({ projectId: myProjectId });\n *\n * const userIdentifier = 'identifier';\n * sdk.otp.signIn.email(userIdentifier);\n * const jwtResponse = sdk.otp.verify.email(userIdentifier, codeFromEmail);\n * ```\n */\nconst sdkWithAttributes = nodeSdk as typeof nodeSdk & {\n  DeliveryMethods: typeof createSdk.DeliveryMethods;\n  RefreshTokenCookieName: typeof refreshTokenCookieName;\n  SessionTokenCookieName: typeof sessionTokenCookieName;\n};\n\nsdkWithAttributes.DeliveryMethods = createSdk.DeliveryMethods;\nsdkWithAttributes.RefreshTokenCookieName = refreshTokenCookieName;\nsdkWithAttributes.SessionTokenCookieName = sessionTokenCookieName;\n\nexport default sdkWithAttributes;\n\nexport type { DeliveryMethod, OAuthProvider } from '@descope/core-js-sdk';\n"],"names":["generateCookie","name","value","options","cookieDomain","cookieMaxAge","cookiePath","withCookie","fn","async","args","resp","data","_d","sessionJwt","refreshJwt","rest","__rest","cookies","push","_a","response","headers","get","cookie","match","RegExp","getCookieValue","_b","_c","Object","assign","wrapWith","obj","path","wrappingFn","pathSections","split","section","shift","length","wrap","key","Error","toString","keys","forEach","getAuthorizationClaimItems","authInfo","claim","tenant","token","Array","isArray","globalThis","fetch","Headers","Request","Response","sdkWithAttributes","funcArgs","hooks","origBeforeRequest","beforeRequest","config","conf","process","versions","node","coreSdk","createSdk","projectId","logger","sdk","header","kid","publicKeys","httpClient","then","json","Promise","all","map","importJWK","reduce","acc","jwk","fetchKeys","jwt","jwtVerify","getKey","issuer","clockTolerance","payload","sessionToken","refreshToken","validateJwt","error","jwtResp","refresh","ok","message","refreshTokenErr","accessKey","exchange","validatePermissions","permissions","validateTenantPermissions","granted","every","perm","includes","validateRoles","roles","validateTenantRoles","membership","role","DeliveryMethods","RefreshTokenCookieName","SessionTokenCookieName"],"mappings":"sLAEO,MCaDA,EAAiB,CAACC,EAAcC,EAAeC,IACnD,GAAGF,KAAQC,cAAiBC,aAAA,EAAAA,EAASC,eAAgB,gBACnDD,aAAA,EAAAA,EAASE,eAAgB,aACjBF,aAAA,EAAAA,EAASG,aAAc,iCAmBtBC,EAC0DC,GACrEC,SAAUC,eACR,MAAMC,QAAaH,KAAME,GAGzB,IAAKC,EAAKC,KACR,OAAOD,EAIT,IAAIE,EAAsCF,EAAKC,MAA3CE,WAAEA,EAAUC,WAAEA,KAAeC,EAA7BC,EAAAJ,EAAA,CAAA,aAAA,eACJ,MAAMK,EAAU,CAAClB,ED7CiB,KC6CsBc,EAAYE,IAcpE,OAZKD,EASHG,EAAQC,KAAKnB,ED1DmB,MC0DoBe,EAAYC,KAR/C,QAAbI,EAAAT,EAAKU,gBAAQ,IAAAD,OAAA,EAAAA,EAAEE,QAAQC,IAAI,iBAC7BR,EA3Be,EAACS,EAAmCvB,KACzD,MAAMwB,EAAQD,eAAAA,EAAQC,MAAMC,OAAO,cAAczB,cACjD,OAAOwB,EAAQA,EAAM,GAAK,IAAI,EAyBXE,CACE,QAAbC,EAAAjB,EAAKU,gBAAQ,IAAAO,OAAA,EAAAA,EAAEN,QAAQC,IAAI,cDpDC,OCuD9BL,EAAQC,KAAoB,QAAfU,EAAAlB,EAAKU,gBAAU,IAAAQ,OAAA,EAAAA,EAAAP,QAAQC,IAAI,gBAMhCO,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAApB,GAAM,CAAAC,KAAWkB,OAAAC,OAAAD,OAAAC,OAAA,GAAApB,EAAKC,MAAM,CAAAG,aAAYG,aAAY,EAUvDc,EAAW,CACtBC,EACAC,EACAC,KAGA,IAAKF,EAAK,OAEV,MAAMG,EAA+B,iBAATF,EAAoBA,EAAKG,MAAM,KAAOH,EAC5DI,EAAUF,EAAaG,SAAY,GAEzC,GAA4B,IAAxBH,EAAaI,QAA4B,MAAZF,EAAiB,CAChD,MAAMG,EAAQC,IACZ,IAAIA,GAA2B,mBAAbT,EAAIS,GAKpB,MAAMC,MAAM,6BAA6BD,EAAIE,eAH7CX,EAAIS,GAAOP,EAAWF,EAAIS,GAI3B,EAEa,MAAZJ,EACFR,OAAOe,KAAKZ,GAAKa,QAAQL,GAEzBA,EAAKH,EAER,MACCN,EAASC,EAAIK,GAAUF,EAAcD,EACtC,WAuBaY,EACdC,EACAC,EACAC,WAEA,MAAMhD,EAAQgD,EAC0C,QAApDtB,EAA6C,QAA7CR,EAAA4B,EAASG,MAAgC,eAAI,IAAA/B,OAAA,EAAAA,EAAA8B,UAAO,IAAAtB,OAAA,EAAAA,EAAGqB,GACvDD,EAASG,MAAMF,GACnB,OAAOG,MAAMC,QAAQnD,GAASA,EAAQ,EACxC,CClHKoD,WAAWC,QAEdD,WAAWC,MAAQA,EAEnBD,WAAWE,QAAUA,EAErBF,WAAWG,QAAUA,EAErBH,WAAWI,SAAWA,GAGxB,MA8NMC,EA9NU,IAAIjD,KAClB,MAAMkD,EAAwB,IAAIlD,GAClCkD,EAAS,GAAGC,MAAQD,EAAS,GAAGC,OAAS,GACzC,MAAMC,EAAoBF,EAAS,GAAGC,MAAME,cAC5CH,EAAS,GAAGC,MAAME,cAAiBC,UACjC,MAAMC,EAAOD,EAOb,OANAC,EAAK3C,QACAQ,OAAAC,OAAAD,OAAAC,OAAA,GAAAkC,EAAK3C,SACR,CAAA,qBAAsB,SACtB,8BAAiD,QAAnBF,EAAO,OAAP8C,cAAO,IAAPA,aAAO,EAAPA,QAASC,gBAAU,IAAA/C,OAAA,EAAAA,EAAAgD,OAAQ,GACzD,wBAAyB,mBAEpBN,aAAiB,EAAjBA,EAAoBG,KAASA,CAAI,EAE1C,MAAMI,EAAUC,KAAaV,GDmEH,IAC1B3B,EAEAE,EAFAF,ECjEEoC,EDmEFlC,ECtDE5B,EAZA,CACE,eACA,mBACA,iCACA,iCACA,iBACA,gBACA,cACA,yBACA,yBACA,WDyDKuC,SAASZ,GAAiBF,EAASC,EAAKC,EAAMC,KCpDvD,MAAMoC,UAAEA,EAASC,OAAEA,GAAW9D,EAAK,GAE7BmC,EAA6C,CAAA,EAkB7C4B,iCACDJ,GAAO,CAGV5D,aAAaiE,GACX,KAAKA,aAAA,EAAAA,EAAQC,KAAK,MAAMhC,MAAM,gCAE9B,GAAIE,EAAK6B,EAAOC,KAAM,OAAO9B,EAAK6B,EAAOC,KAKzC,GAFA7C,OAAOC,OAAOc,OAzBApC,WAChB,MAAMmE,QAA0BP,EAAQQ,WACrCtD,IAAI,WAAWgD,KACfO,MAAMnE,GAASA,EAAKoE,SACvB,OAAK3B,MAAMC,QAAQuB,UACQI,QAAQC,IACjCL,EAAWM,KAAIzE,MAAOiC,GAAQ,CAACA,EAAIiC,UAAWQ,EAAUzC,QAGtC0C,QAClB,CAACC,GAAMV,EAAKW,KAAUX,EAAW7C,OAAAC,OAAAD,OAAAC,OAAA,CAAA,EAAAsD,IAAK,CAACV,EAAI/B,YAAa0C,IAAQD,GAChE,CAAE,GAPmC,EAQtC,EAa2BE,KAErB1C,EAAK6B,EAAOC,KAAM,MAAMhC,MAAM,gCAEnC,OAAOE,EAAK6B,EAAOC,IACpB,EAODlE,YAAiB,MAAC+E,IAIT,CAAEA,MAAKrC,aAFIsC,EAAUD,EAAKf,EAAIiB,OAAQ,CAAEC,OAAQpB,EAAWqB,eAAgB,KAEzDC,UAU3BpF,sBACEqF,EACAC,WAEA,IAAKD,IAAiBC,EACpB,MAAMpD,MAAM,kDAEd,GAAImD,EACF,IAEE,aADoBrB,EAAIuB,YAAYF,EAOrC,CALC,MAAOG,GACP,IAAKF,EAEH,MADAvB,SAAAA,EAAQyB,MAAM,iEAAkEA,GAC1EtD,MAAM,4BAEf,CAEH,GAAIoD,EACF,UACQtB,EAAIuB,YAAYD,GACtB,MAAMG,QAAgBzB,EAAI0B,QAAQJ,GAClC,GAAIG,EAAQE,GAAI,CAEd,aADoB3B,EAAIuB,YAA0B,QAAd5E,EAAA8E,EAAQtF,YAAM,IAAAQ,OAAA,EAAAA,EAAAN,WAEnD,CACD,MAAM6B,MAAmB,QAAbf,EAAAsE,EAAQD,aAAK,IAAArE,OAAA,EAAAA,EAAEyE,QAI5B,CAHC,MAAOC,GAEP,MADA9B,SAAAA,EAAQyB,MAAM,mCAAoCK,GAC5C3D,MAAM,4BACb,CAGH,MAAMA,MAAM,2BACb,EAODlC,wBAAwB8F,GACtB,IAAKA,EAAW,MAAM5D,MAAM,gCAE5B,IAAIhC,EACJ,IACEA,QAAa8D,EAAI8B,UAAUC,SAASD,EAIrC,CAHC,MAAON,GAEP,MADAzB,SAAAA,EAAQyB,MAAM,gCAAiCA,GACzCtD,MAAM,gCACb,CAED,MAAM7B,WAAEA,GAAeH,EAAKC,KAC5B,IAAKE,EAEH,MADA0D,SAAAA,EAAQyB,MAAM,gDACRtD,MAAM,iCAGd,IAEE,aADoB8B,EAAIuB,YAAYlF,EAKrC,CAHC,MAAOmF,GAEP,MADAzB,SAAAA,EAAQyB,MAAM,sCAAuCA,GAC/CtD,MAAM,gCACb,CACF,EAQD8D,oBAAmB,CAACzD,EAA8B0D,IACzCjC,EAAIkC,0BAA0B3D,EAAU,KAAM0D,GASvDC,0BACE3D,EACAE,EACAwD,GAEA,MAAME,EAAU7D,EAA2BC,EFvMb,cEuM6CE,GAC3E,OAAOwD,EAAYG,OAAOC,GAASF,EAAQG,SAASD,IACrD,EAQDE,cAAa,CAAChE,EAA8BiE,IACnCxC,EAAIyC,oBAAoBlE,EAAU,KAAMiE,GASjDC,oBAAoBlE,EAA8BE,EAAgB+D,GAChE,MAAME,EAAapE,EAA2BC,EF1NtB,QE0NgDE,GACxE,OAAO+D,EAAMJ,OAAOO,GAASD,EAAWJ,SAASK,IAClD,IAGH,OAAO3C,CAAG,EAyBZd,EAAkB0D,gBAAkB/C,EAAU+C,gBAC9C1D,EAAkB2D,uBFjQoB,MEkQtC3D,EAAkB4D,uBFhQoB"}