@descope/node-sdk 1.6.1 → 1.6.2

package/dist/index.d.ts

@@ -1,8 +1,23 @@
 import * as _descope_core_js_sdk from '@descope/core-js-sdk';
-import _descope_core_js_sdk__default, { UserResponse, SdkResponse, ExchangeAccessKeyResponse } from '@descope/core-js-sdk';
+import _descope_core_js_sdk__default, { DeliveryMethod, UserResponse, SdkResponse, ExchangeAccessKeyResponse } from '@descope/core-js-sdk';
 export { DeliveryMethod, JWTResponse, OAuthProvider, ResponseData, SdkResponse } from '@descope/core-js-sdk';
 import { JWTHeaderParameters, KeyLike } from 'jose';
 
+/** Parsed JWT token */
+interface Token {
+    sub?: string;
+    exp?: number;
+    iss?: string;
+    [claim: string]: unknown;
+}
+/** All information regarding token including the raw JWT, parsed JWT and cookies */
+interface AuthenticationInfo {
+    jwt: string;
+    token: Token;
+    cookies?: string[];
+}
+declare type DeliveryMethodForTestUser = DeliveryMethod | 'Embedded';
+
 /** Represents a tenant association for a User or Access Key. The tenantId is required to denote
  * which tenant the user or access key belongs to. The roleNames array is an optional list of
  * roles for the user or access key in this specific tenant.
@@ -152,6 +167,7 @@ declare type User = {
     verifiedEmail?: boolean;
     verifiedPhone?: boolean;
     test?: boolean;
+    additionalLoginIds?: string[];
 };
 declare type UserMapping = {
     name: string;
@@ -180,6 +196,7 @@ declare type SSOSettingsResponse = {
     userMapping: UserMapping;
     groupsMapping: GroupsMapping[];
     redirectUrl: string;
+    domains: string[];
     domain: string;
 };
 declare type ProviderTokenResponse = {
@@ -325,19 +342,17 @@ declare type NewProjectResponse = {
     tag?: string;
 };
 
-/** Parsed JWT token */
-interface Token {
-    sub?: string;
-    exp?: number;
-    iss?: string;
-    [claim: string]: unknown;
-}
-/** All information regarding token including the raw JWT, parsed JWT and cookies */
-interface AuthenticationInfo {
-    jwt: string;
-    token: Token;
-    cookies?: string[];
-}
+/** Common Error Codes */
+declare const descopeErrors: {
+    badRequest: string;
+    missingArguments: string;
+    invalidRequest: string;
+    invalidArguments: string;
+    wrongOTPCode: string;
+    tooManyOTPAttempts: string;
+    enchantedLinkPending: string;
+    userNotFound: string;
+};
 
 /** Configuration arguments which include the Descope core SDK args and an optional management key */
 declare type NodeSdkArgs = Parameters<typeof _descope_core_js_sdk__default>[0] & {
@@ -348,11 +363,11 @@ declare const nodeSdk: {
     ({ managementKey, publicKey, ...config }: NodeSdkArgs): {
         management: {
             user: {
-                create: (loginId: string, email?: string, phone?: string, displayName?: string, roles?: string[], userTenants?: AssociatedTenant[], customAttributes?: Record<string, AttributesTypes>, picture?: string, verifiedEmail?: boolean, verifiedPhone?: boolean) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
-                createTestUser: (loginId: string, email?: string, phone?: string, displayName?: string, roles?: string[], userTenants?: AssociatedTenant[], customAttributes?: Record<string, AttributesTypes>, picture?: string, verifiedEmail?: boolean, verifiedPhone?: boolean) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
-                invite: (loginId: string, email?: string, phone?: string, displayName?: string, roles?: string[], userTenants?: AssociatedTenant[], customAttributes?: Record<string, AttributesTypes>, picture?: string, verifiedEmail?: boolean, verifiedPhone?: boolean, inviteUrl?: string, sendMail?: boolean, sendSMS?: boolean) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
+                create: (loginId: string, email?: string, phone?: string, displayName?: string, roles?: string[], userTenants?: AssociatedTenant[], customAttributes?: Record<string, AttributesTypes>, picture?: string, verifiedEmail?: boolean, verifiedPhone?: boolean, givenName?: string, middleName?: string, familyName?: string, additionalLoginIds?: string[]) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
+                createTestUser: (loginId: string, email?: string, phone?: string, displayName?: string, roles?: string[], userTenants?: AssociatedTenant[], customAttributes?: Record<string, AttributesTypes>, picture?: string, verifiedEmail?: boolean, verifiedPhone?: boolean, givenName?: string, middleName?: string, familyName?: string, additionalLoginIds?: string[]) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
+                invite: (loginId: string, email?: string, phone?: string, displayName?: string, roles?: string[], userTenants?: AssociatedTenant[], customAttributes?: Record<string, AttributesTypes>, picture?: string, verifiedEmail?: boolean, verifiedPhone?: boolean, inviteUrl?: string, sendMail?: boolean, sendSMS?: boolean, givenName?: string, middleName?: string, familyName?: string, additionalLoginIds?: string[]) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                 inviteBatch: (users: User[], inviteUrl?: string, sendMail?: boolean, sendSMS?: boolean) => Promise<SdkResponse<InviteBatchResponse>>;
-                update: (loginId: string, email?: string, phone?: string, displayName?: string, roles?: string[], userTenants?: AssociatedTenant[], customAttributes?: Record<string, AttributesTypes>, picture?: string, verifiedEmail?: boolean, verifiedPhone?: boolean) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
+                update: (loginId: string, email?: string, phone?: string, displayName?: string, roles?: string[], userTenants?: AssociatedTenant[], customAttributes?: Record<string, AttributesTypes>, picture?: string, verifiedEmail?: boolean, verifiedPhone?: boolean, givenName?: string, middleName?: string, familyName?: string, additionalLoginIds?: string[]) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                 delete: (loginId: string) => Promise<SdkResponse<never>>;
                 deleteAllTestUsers: () => Promise<SdkResponse<never>>;
                 load: (loginId: string) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
@@ -366,18 +381,20 @@ declare const nodeSdk: {
                 updateLoginId: (loginId: string, newLoginId?: string) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                 updateEmail: (loginId: string, email: string, isVerified: boolean) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                 updatePhone: (loginId: string, phone: string, isVerified: boolean) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
-                updateDisplayName: (loginId: string, displayName: string) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
+                updateDisplayName: (loginId: string, displayName?: string, givenName?: string, middleName?: string, familyName?: string) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                 updatePicture: (loginId: string, picture: string) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                 updateCustomAttribute: (loginId: string, attributeKey: string, attributeValue: AttributesTypes) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
+                setRoles: (loginId: string, roles: string[]) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                 addRoles: (loginId: string, roles: string[]) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                 removeRoles: (loginId: string, roles: string[]) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                 addTenant: (loginId: string, tenantId: string) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                 removeTenant: (loginId: string, tenantId: string) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
+                setTenantRoles: (loginId: string, tenantId: string, roles: string[]) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                 addTenantRoles: (loginId: string, tenantId: string, roles: string[]) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                 removeTenantRoles: (loginId: string, tenantId: string, roles: string[]) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
-                generateOTPForTestUser: (deliveryMethod: "email" | "sms" | "whatsapp", loginId: string) => Promise<SdkResponse<GenerateOTPForTestResponse>>;
-                generateMagicLinkForTestUser: (deliveryMethod: "email" | "sms" | "whatsapp", loginId: string, uri: string) => Promise<SdkResponse<GenerateMagicLinkForTestResponse>>;
-                generateEnchantedLinkForTestUser: (loginId: string, uri: string) => Promise<SdkResponse<GenerateEnchantedLinkForTestResponse>>;
+                generateOTPForTestUser: (deliveryMethod: DeliveryMethodForTestUser, loginId: string, loginOptions?: _descope_core_js_sdk.LoginOptions) => Promise<SdkResponse<GenerateOTPForTestResponse>>;
+                generateMagicLinkForTestUser: (deliveryMethod: DeliveryMethodForTestUser, loginId: string, uri: string, loginOptions?: _descope_core_js_sdk.LoginOptions) => Promise<SdkResponse<GenerateMagicLinkForTestResponse>>;
+                generateEnchantedLinkForTestUser: (loginId: string, uri: string, loginOptions?: _descope_core_js_sdk.LoginOptions) => Promise<SdkResponse<GenerateEnchantedLinkForTestResponse>>;
                 generateEmbeddedLink: (loginId: string, customClaims?: Record<string, any>) => Promise<SdkResponse<GenerateEmbeddedLinkResponse>>;
                 setPassword: (loginId: string, password: string) => Promise<SdkResponse<never>>;
                 expirePassword: (loginId: string) => Promise<SdkResponse<never>>;
@@ -407,8 +424,8 @@ declare const nodeSdk: {
             sso: {
                 getSettings: (tenantId: string) => Promise<SdkResponse<SSOSettingsResponse>>;
                 deleteSettings: (tenantId: string) => Promise<SdkResponse<never>>;
-                configureSettings: (tenantId: string, idpURL: string, idpCert: string, entityId: string, redirectURL: string, domain: string) => Promise<SdkResponse<never>>;
-                configureMetadata: (tenantId: string, idpMetadataURL: string, redirectURL: string, domain: string) => Promise<SdkResponse<never>>;
+                configureSettings: (tenantId: string, idpURL: string, idpCert: string, entityId: string, redirectURL: string, domains: string[]) => Promise<SdkResponse<never>>;
+                configureMetadata: (tenantId: string, idpMetadataURL: string, redirectURL: string, domains: string[]) => Promise<SdkResponse<never>>;
                 configureMapping: (tenantId: string, roleMappings?: RoleMappings, attributeMapping?: AttributeMapping) => Promise<SdkResponse<never>>;
             };
             jwt: {
@@ -468,9 +485,13 @@ declare const nodeSdk: {
         validateAndRefreshSession: (sessionToken?: string, refreshToken?: string) => Promise<AuthenticationInfo>;
         exchangeAccessKey: (accessKey: string) => Promise<AuthenticationInfo>;
         validatePermissions: (authInfo: AuthenticationInfo, permissions: string[]) => boolean;
+        getMatchedPermissions: (authInfo: AuthenticationInfo, permissions: string[]) => string[];
         validateTenantPermissions: (authInfo: AuthenticationInfo, tenant: string, permissions: string[]) => boolean;
+        getMatchedTenantPermissions: (authInfo: AuthenticationInfo, tenant: string, permissions: string[]) => string[];
         validateRoles: (authInfo: AuthenticationInfo, roles: string[]) => boolean;
+        getMatchedRoles: (authInfo: AuthenticationInfo, roles: string[]) => string[];
         validateTenantRoles: (authInfo: AuthenticationInfo, tenant: string, roles: string[]) => boolean;
+        getMatchedTenantRoles: (authInfo: AuthenticationInfo, tenant: string, roles: string[]) => string[];
         accessKey: {
             exchange: (accessKey: string) => Promise<SdkResponse<ExchangeAccessKeyResponse>>;
         };
@@ -504,6 +525,9 @@ declare const nodeSdk: {
                 sms: (loginId: string, user?: {
                     email?: string;
                     name?: string;
+                    givenName?: string;
+                    middleName?: string;
+                    familyName?: string;
                     phone?: string;
                 }) => Promise<SdkResponse<{
                     maskedPhone: string;
@@ -511,6 +535,9 @@ declare const nodeSdk: {
                 whatsapp: (loginId: string, user?: {
                     email?: string;
                     name?: string;
+                    givenName?: string;
+                    middleName?: string;
+                    familyName?: string;
                     phone?: string;
                 }) => Promise<SdkResponse<{
                     maskedPhone: string;
@@ -518,6 +545,9 @@ declare const nodeSdk: {
                 email: (loginId: string, user?: {
                     email?: string;
                     name?: string;
+                    givenName?: string;
+                    middleName?: string;
+                    familyName?: string;
                     phone?: string;
                 }) => Promise<SdkResponse<{
                     maskedEmail: string;
@@ -577,6 +607,9 @@ declare const nodeSdk: {
                 sms: (loginId: string, uri: string, user?: {
                     email?: string;
                     name?: string;
+                    givenName?: string;
+                    middleName?: string;
+                    familyName?: string;
                     phone?: string;
                 }) => Promise<SdkResponse<{
                     maskedPhone: string;
@@ -584,6 +617,9 @@ declare const nodeSdk: {
                 whatsapp: (loginId: string, uri: string, user?: {
                     email?: string;
                     name?: string;
+                    givenName?: string;
+                    middleName?: string;
+                    familyName?: string;
                     phone?: string;
                 }) => Promise<SdkResponse<{
                     maskedPhone: string;
@@ -591,6 +627,9 @@ declare const nodeSdk: {
                 email: (loginId: string, uri: string, user?: {
                     email?: string;
                     name?: string;
+                    givenName?: string;
+                    middleName?: string;
+                    familyName?: string;
                     phone?: string;
                 }) => Promise<SdkResponse<{
                     maskedEmail: string;
@@ -640,6 +679,9 @@ declare const nodeSdk: {
             signUp: (loginId: string, uri: string, user?: {
                 email?: string;
                 name?: string;
+                givenName?: string;
+                middleName?: string;
+                familyName?: string;
                 phone?: string;
             }) => Promise<SdkResponse<_descope_core_js_sdk.EnchantedLinkResponse & {
                 refreshJwt?: string;
@@ -657,56 +699,16 @@ declare const nodeSdk: {
             };
         };
         oauth: {
-            start: ((provider: string, redirectUrl?: string, loginOptions?: {
-                stepup?: boolean;
-                mfa?: boolean;
-                customClaims?: Record<string, any>;
-            }, token?: string) => Promise<SdkResponse<_descope_core_js_sdk.ResponseData>>) & {
-                facebook: (redirectURL?: string, loginOptions?: {
-                    stepup?: boolean;
-                    mfa?: boolean;
-                    customClaims?: Record<string, any>;
-                }, token?: string) => Promise<SdkResponse<_descope_core_js_sdk.URLResponse>>;
-                github: (redirectURL?: string, loginOptions?: {
-                    stepup?: boolean;
-                    mfa?: boolean;
-                    customClaims?: Record<string, any>;
-                }, token?: string) => Promise<SdkResponse<_descope_core_js_sdk.URLResponse>>;
-                google: (redirectURL?: string, loginOptions?: {
-                    stepup?: boolean;
-                    mfa?: boolean;
-                    customClaims?: Record<string, any>;
-                }, token?: string) => Promise<SdkResponse<_descope_core_js_sdk.URLResponse>>;
-                microsoft: (redirectURL?: string, loginOptions?: {
-                    stepup?: boolean;
-                    mfa?: boolean;
-                    customClaims?: Record<string, any>;
-                }, token?: string) => Promise<SdkResponse<_descope_core_js_sdk.URLResponse>>;
-                gitlab: (redirectURL?: string, loginOptions?: {
-                    stepup?: boolean;
-                    mfa?: boolean;
-                    customClaims?: Record<string, any>;
-                }, token?: string) => Promise<SdkResponse<_descope_core_js_sdk.URLResponse>>;
-                apple: (redirectURL?: string, loginOptions?: {
-                    stepup?: boolean;
-                    mfa?: boolean;
-                    customClaims?: Record<string, any>;
-                }, token?: string) => Promise<SdkResponse<_descope_core_js_sdk.URLResponse>>;
-                discord: (redirectURL?: string, loginOptions?: {
-                    stepup?: boolean;
-                    mfa?: boolean;
-                    customClaims?: Record<string, any>;
-                }, token?: string) => Promise<SdkResponse<_descope_core_js_sdk.URLResponse>>;
-                linkedin: (redirectURL?: string, loginOptions?: {
-                    stepup?: boolean;
-                    mfa?: boolean;
-                    customClaims?: Record<string, any>;
-                }, token?: string) => Promise<SdkResponse<_descope_core_js_sdk.URLResponse>>;
-                slack: (redirectURL?: string, loginOptions?: {
-                    stepup?: boolean;
-                    mfa?: boolean;
-                    customClaims?: Record<string, any>;
-                }, token?: string) => Promise<SdkResponse<_descope_core_js_sdk.URLResponse>>;
+            start: ((provider: string, redirectUrl?: string, loginOptions?: _descope_core_js_sdk.LoginOptions, token?: string) => Promise<SdkResponse<_descope_core_js_sdk.ResponseData>>) & {
+                facebook: (redirectURL?: string, loginOptions?: _descope_core_js_sdk.LoginOptions, token?: string) => Promise<SdkResponse<_descope_core_js_sdk.URLResponse>>;
+                github: (redirectURL?: string, loginOptions?: _descope_core_js_sdk.LoginOptions, token?: string) => Promise<SdkResponse<_descope_core_js_sdk.URLResponse>>;
+                google: (redirectURL?: string, loginOptions?: _descope_core_js_sdk.LoginOptions, token?: string) => Promise<SdkResponse<_descope_core_js_sdk.URLResponse>>;
+                microsoft: (redirectURL?: string, loginOptions?: _descope_core_js_sdk.LoginOptions, token?: string) => Promise<SdkResponse<_descope_core_js_sdk.URLResponse>>;
+                gitlab: (redirectURL?: string, loginOptions?: _descope_core_js_sdk.LoginOptions, token?: string) => Promise<SdkResponse<_descope_core_js_sdk.URLResponse>>;
+                apple: (redirectURL?: string, loginOptions?: _descope_core_js_sdk.LoginOptions, token?: string) => Promise<SdkResponse<_descope_core_js_sdk.URLResponse>>;
+                discord: (redirectURL?: string, loginOptions?: _descope_core_js_sdk.LoginOptions, token?: string) => Promise<SdkResponse<_descope_core_js_sdk.URLResponse>>;
+                linkedin: (redirectURL?: string, loginOptions?: _descope_core_js_sdk.LoginOptions, token?: string) => Promise<SdkResponse<_descope_core_js_sdk.URLResponse>>;
+                slack: (redirectURL?: string, loginOptions?: _descope_core_js_sdk.LoginOptions, token?: string) => Promise<SdkResponse<_descope_core_js_sdk.URLResponse>>;
             };
             exchange: (code: string) => Promise<SdkResponse<_descope_core_js_sdk.JWTResponse & {
                 refreshJwt?: string;
@@ -714,11 +716,7 @@ declare const nodeSdk: {
             }>>;
         };
         saml: {
-            start: (tenantIdOrEmail: string, redirectUrl?: string, loginOptions?: {
-                stepup?: boolean;
-                mfa?: boolean;
-                customClaims?: Record<string, any>;
-            }, token?: string) => Promise<SdkResponse<_descope_core_js_sdk.URLResponse>>;
+            start: (tenantIdOrEmail: string, redirectUrl?: string, loginOptions?: _descope_core_js_sdk.LoginOptions, token?: string) => Promise<SdkResponse<_descope_core_js_sdk.URLResponse>>;
             exchange: (code: string) => Promise<SdkResponse<_descope_core_js_sdk.JWTResponse & {
                 refreshJwt?: string;
                 cookies?: string[];
@@ -728,13 +726,12 @@ declare const nodeSdk: {
             signUp: (loginId: string, user?: {
                 email?: string;
                 name?: string;
+                givenName?: string;
+                middleName?: string;
+                familyName?: string;
                 phone?: string;
             }) => Promise<SdkResponse<_descope_core_js_sdk.TOTPResponse>>;
-            verify: (loginId: string, code: string, loginOptions?: {
-                stepup?: boolean;
-                mfa?: boolean;
-                customClaims?: Record<string, any>;
-            }, token?: string) => Promise<SdkResponse<_descope_core_js_sdk.JWTResponse & {
+            verify: (loginId: string, code: string, loginOptions?: _descope_core_js_sdk.LoginOptions, token?: string) => Promise<SdkResponse<_descope_core_js_sdk.JWTResponse & {
                 refreshJwt?: string;
                 cookies?: string[];
             }>>;
@@ -753,11 +750,7 @@ declare const nodeSdk: {
                 }>>;
             };
             signIn: {
-                start: (loginId: string, origin: string, loginOptions?: {
-                    stepup?: boolean;
-                    mfa?: boolean;
-                    customClaims?: Record<string, any>;
-                }, token?: string) => Promise<SdkResponse<{
+                start: (loginId: string, origin: string, loginOptions?: _descope_core_js_sdk.LoginOptions, token?: string) => Promise<SdkResponse<{
                     transactionId: string;
                     options: string;
                     create: boolean;
@@ -787,6 +780,9 @@ declare const nodeSdk: {
             signUp: (loginId: string, password: string, user?: {
                 email?: string;
                 name?: string;
+                givenName?: string;
+                middleName?: string;
+                familyName?: string;
                 phone?: string;
             }) => Promise<SdkResponse<_descope_core_js_sdk.JWTResponse>>;
             signIn: (loginId: string, password: string) => Promise<SdkResponse<_descope_core_js_sdk.JWTResponse>>;
@@ -800,11 +796,7 @@ declare const nodeSdk: {
             replace: (loginId: string, oldPassword: string, newPassword: string) => Promise<SdkResponse<_descope_core_js_sdk.JWTResponse>>;
             policy: () => Promise<SdkResponse<{
                 minLength: number;
-                lowercase: boolean; /**
-                 * Validate the given JWT with the right key and make sure the issuer is correct
-                 * @param jwt the JWT string to parse and validate
-                 * @returns AuthenticationInfo with the parsed token and JWT. Will throw an error if validation fails.
-                 */
+                lowercase: boolean;
                 uppercase: boolean;
                 number: boolean;
                 nonAlphanumeric: boolean;
@@ -834,6 +826,8 @@ declare const nodeSdk: {
                 samlIdpUsername?: string;
                 ssoAppId?: string;
                 abTestingKey?: number;
+                startOptionsVersion?: number;
+                client?: Record<string, any>;
             }, conditionInteractionId?: string, interactionId?: string, version?: number, componentsVersion?: string, input?: {
                 [x: string]: string | number | boolean | (string | number | boolean | (string | number | boolean | (string | number | boolean | (string | number | boolean | (string | number | boolean | (string | number | boolean | (string | number | boolean | (string | number | boolean | (string | number | boolean | (string | number | boolean | (string | number | boolean | any)[])[])[])[])[])[])[])[])[])[])[];
             }) => Promise<SdkResponse<_descope_core_js_sdk.FlowResponse>>;
@@ -908,4 +902,4 @@ declare const nodeSdk: {
     SessionTokenCookieName: string;
 };
 
-export { AuthenticationInfo, nodeSdk as default };
+export { AuthenticationInfo, nodeSdk as default, descopeErrors };

package/dist/index.esm.js

@@ -1,2 +1,2 @@
-import{__rest as e}from"tslib";import t,{transformResponse as a,wrapWith as s}from"@descope/core-js-sdk";import{jwtVerify as o,errors as n,importJWK as r}from"jose";import i,{Headers as l}from"node-fetch-commonjs";const d=t=>async(...a)=>{var s,o,n;const r=await t(...a);if(!r.data)return r;let i=r.data,{refreshJwt:l}=i,d=e(i,["refreshJwt"]);const p=[];var m;return l?p.push(`${"DSR"}=${l}; Domain=${(null==(m=d)?void 0:m.cookieDomain)||""}; Max-Age=${(null==m?void 0:m.cookieMaxAge)||""}; Path=${(null==m?void 0:m.cookiePath)||"/"}; HttpOnly; SameSite=Strict`):(null===(s=r.response)||void 0===s?void 0:s.headers.get("set-cookie"))&&(l=((e,t)=>{const a=null==e?void 0:e.match(RegExp(`(?:^|;\\s*)${t}=([^;]*)`));return a?a[1]:null})(null===(o=r.response)||void 0===o?void 0:o.headers.get("set-cookie"),"DSR"),p.push(null===(n=r.response)||void 0===n?void 0:n.headers.get("set-cookie"))),Object.assign(Object.assign({},r),{data:Object.assign(Object.assign({},r.data),{refreshJwt:l,cookies:p})})};function p(e,t,a){var s,o;const n=a?null===(o=null===(s=e.token.tenants)||void 0===s?void 0:s[a])||void 0===o?void 0:o[t]:e.token[t];return Array.isArray(n)?n:[]}function m(e,t){var a;return!!(null===(a=e.token.tenants)||void 0===a?void 0:a[t])}var u={create:"/v1/mgmt/user/create",createBatch:"/v1/mgmt/user/create/batch",update:"/v1/mgmt/user/update",delete:"/v1/mgmt/user/delete",deleteAllTestUsers:"/v1/mgmt/user/test/delete/all",load:"/v1/mgmt/user",logout:"/v1/mgmt/user/logout",search:"/v1/mgmt/user/search",getProviderToken:"/v1/mgmt/user/provider/token",updateStatus:"/v1/mgmt/user/update/status",updateLoginId:"/v1/mgmt/user/update/loginid",updateEmail:"/v1/mgmt/user/update/email",updatePhone:"/v1/mgmt/user/update/phone",updateDisplayName:"/v1/mgmt/user/update/name",updatePicture:"/v1/mgmt/user/update/picture",updateCustomAttribute:"/v1/mgmt/user/update/customAttribute",addRole:"/v1/mgmt/user/update/role/add",removeRole:"/v1/mgmt/user/update/role/remove",addTenant:"/v1/mgmt/user/update/tenant/add",removeTenant:"/v1/mgmt/user/update/tenant/remove",setPassword:"/v1/mgmt/user/password/set",expirePassword:"/v1/mgmt/user/password/expire",generateOTPForTest:"/v1/mgmt/tests/generate/otp",generateMagicLinkForTest:"/v1/mgmt/tests/generate/magiclink",generateEnchantedLinkForTest:"/v1/mgmt/tests/generate/enchantedlink",generateEmbeddedLink:"/v1/mgmt/user/signin/embeddedlink"},c={updateName:"/v1/mgmt/project/update/name",clone:"/v1/mgmt/project/clone"},h={create:"/v1/mgmt/accesskey/create",load:"/v1/mgmt/accesskey",search:"/v1/mgmt/accesskey/search",update:"/v1/mgmt/accesskey/update",deactivate:"/v1/mgmt/accesskey/deactivate",activate:"/v1/mgmt/accesskey/activate",delete:"/v1/mgmt/accesskey/delete"},g={create:"/v1/mgmt/tenant/create",update:"/v1/mgmt/tenant/update",delete:"/v1/mgmt/tenant/delete",load:"/v1/mgmt/tenant",loadAll:"/v1/mgmt/tenant/all",searchAll:"/v1/mgmt/tenant/search"},v={settings:"/v1/mgmt/sso/settings",metadata:"/v1/mgmt/sso/metadata",mapping:"/v1/mgmt/sso/mapping"},k={update:"/v1/mgmt/jwt/update"},C={create:"/v1/mgmt/permission/create",update:"/v1/mgmt/permission/update",delete:"/v1/mgmt/permission/delete",loadAll:"/v1/mgmt/permission/all"},f={create:"/v1/mgmt/role/create",update:"/v1/mgmt/role/update",delete:"/v1/mgmt/role/delete",loadAll:"/v1/mgmt/role/all"},y={list:"/v1/mgmt/flow/list",export:"/v1/mgmt/flow/export",import:"/v1/mgmt/flow/import"},w={export:"/v1/mgmt/theme/export",import:"/v1/mgmt/theme/import"},I={loadAllGroups:"/v1/mgmt/group/all",loadAllGroupsForMember:"/v1/mgmt/group/member/all",loadAllGroupMembers:"/v1/mgmt/group/members"},b={search:"/v1/mgmt/audit/search"},A={schemaSave:"/v1/mgmt/authz/schema/save",schemaDelete:"/v1/mgmt/authz/schema/delete",schemaLoad:"/v1/mgmt/authz/schema/load",nsSave:"/v1/mgmt/authz/ns/save",nsDelete:"/v1/mgmt/authz/ns/delete",rdSave:"/v1/mgmt/authz/rd/save",rdDelete:"/v1/mgmt/authz/rd/delete",reCreate:"/v1/mgmt/authz/re/create",reDelete:"/v1/mgmt/authz/re/delete",reDeleteResources:"/v1/mgmt/authz/re/deleteresources",hasRelations:"/v1/mgmt/authz/re/has",who:"/v1/mgmt/authz/re/who",resource:"/v1/mgmt/authz/re/resource",targets:"/v1/mgmt/authz/re/targets",targetAll:"/v1/mgmt/authz/re/targetall"};const T=(e,t)=>({create:(s,o,n,r,i,l,d,p,m,c)=>a(e.httpClient.post(u.create,{loginId:s,email:o,phone:n,displayName:r,roleNames:i,userTenants:l,customAttributes:d,picture:p,verifiedEmail:m,verifiedPhone:c},{token:t}),(e=>e.user)),createTestUser:(s,o,n,r,i,l,d,p,m,c)=>a(e.httpClient.post(u.create,{loginId:s,email:o,phone:n,displayName:r,roleNames:i,userTenants:l,test:!0,customAttributes:d,picture:p,verifiedEmail:m,verifiedPhone:c},{token:t}),(e=>e.user)),invite:(s,o,n,r,i,l,d,p,m,c,h,g,v)=>a(e.httpClient.post(u.create,{loginId:s,email:o,phone:n,displayName:r,roleNames:i,userTenants:l,invite:!0,customAttributes:d,picture:p,verifiedEmail:m,verifiedPhone:c,inviteUrl:h,sendMail:g,sendSMS:v},{token:t}),(e=>e.user)),inviteBatch:(s,o,n,r)=>a(e.httpClient.post(u.createBatch,{users:s,invite:!0,inviteUrl:o,sendMail:n,sendSMS:r},{token:t}),(e=>e)),update:(s,o,n,r,i,l,d,p,m,c)=>a(e.httpClient.post(u.update,{loginId:s,email:o,phone:n,displayName:r,roleNames:i,userTenants:l,customAttributes:d,picture:p,verifiedEmail:m,verifiedPhone:c},{token:t}),(e=>e.user)),delete:s=>a(e.httpClient.post(u.delete,{loginId:s},{token:t})),deleteAllTestUsers:()=>a(e.httpClient.delete(u.deleteAllTestUsers,{token:t})),load:s=>a(e.httpClient.get(u.load,{queryParams:{loginId:s},token:t}),(e=>e.user)),loadByUserId:s=>a(e.httpClient.get(u.load,{queryParams:{userId:s},token:t}),(e=>e.user)),logoutUser:s=>a(e.httpClient.post(u.logout,{loginId:s},{token:t})),logoutUserByUserId:s=>a(e.httpClient.post(u.logout,{userId:s},{token:t})),searchAll:(s,o,n,r,i,l,d,p,m,c)=>a(e.httpClient.post(u.search,{tenantIds:s,roleNames:o,limit:n,page:r,testUsersOnly:i,withTestUser:l,customAttributes:d,statuses:p,emails:m,phones:c},{token:t}),(e=>e.users)),getProviderToken:(s,o)=>a(e.httpClient.get(u.getProviderToken,{queryParams:{loginId:s,provider:o},token:t}),(e=>e)),activate:s=>a(e.httpClient.post(u.updateStatus,{loginId:s,status:"enabled"},{token:t}),(e=>e.user)),deactivate:s=>a(e.httpClient.post(u.updateStatus,{loginId:s,status:"disabled"},{token:t}),(e=>e.user)),updateLoginId:(s,o)=>a(e.httpClient.post(u.updateLoginId,{loginId:s,newLoginId:o},{token:t}),(e=>e.user)),updateEmail:(s,o,n)=>a(e.httpClient.post(u.updateEmail,{loginId:s,email:o,verified:n},{token:t}),(e=>e.user)),updatePhone:(s,o,n)=>a(e.httpClient.post(u.updatePhone,{loginId:s,phone:o,verified:n},{token:t}),(e=>e.user)),updateDisplayName:(s,o)=>a(e.httpClient.post(u.updateDisplayName,{loginId:s,displayName:o},{token:t}),(e=>e.user)),updatePicture:(s,o)=>a(e.httpClient.post(u.updatePicture,{loginId:s,picture:o},{token:t}),(e=>e.user)),updateCustomAttribute:(s,o,n)=>a(e.httpClient.post(u.updateCustomAttribute,{loginId:s,attributeKey:o,attributeValue:n},{token:t}),(e=>e.user)),addRoles:(s,o)=>a(e.httpClient.post(u.addRole,{loginId:s,roleNames:o},{token:t}),(e=>e.user)),removeRoles:(s,o)=>a(e.httpClient.post(u.removeRole,{loginId:s,roleNames:o},{token:t}),(e=>e.user)),addTenant:(s,o)=>a(e.httpClient.post(u.addTenant,{loginId:s,tenantId:o},{token:t}),(e=>e.user)),removeTenant:(s,o)=>a(e.httpClient.post(u.removeTenant,{loginId:s,tenantId:o},{token:t}),(e=>e.user)),addTenantRoles:(s,o,n)=>a(e.httpClient.post(u.addRole,{loginId:s,tenantId:o,roleNames:n},{token:t}),(e=>e.user)),removeTenantRoles:(s,o,n)=>a(e.httpClient.post(u.removeRole,{loginId:s,tenantId:o,roleNames:n},{token:t}),(e=>e.user)),generateOTPForTestUser:(s,o)=>a(e.httpClient.post(u.generateOTPForTest,{deliveryMethod:s,loginId:o},{token:t}),(e=>e)),generateMagicLinkForTestUser:(s,o,n)=>a(e.httpClient.post(u.generateMagicLinkForTest,{deliveryMethod:s,loginId:o,URI:n},{token:t}),(e=>e)),generateEnchantedLinkForTestUser:(s,o)=>a(e.httpClient.post(u.generateEnchantedLinkForTest,{loginId:s,URI:o},{token:t}),(e=>e)),generateEmbeddedLink:(s,o)=>a(e.httpClient.post(u.generateEmbeddedLink,{loginId:s,customClaims:o},{token:t}),(e=>e)),setPassword:(s,o)=>a(e.httpClient.post(u.setPassword,{loginId:s,password:o},{token:t}),(e=>e)),expirePassword:s=>a(e.httpClient.post(u.expirePassword,{loginId:s},{token:t}),(e=>e))}),P=(e,t)=>({updateName:s=>a(e.httpClient.post(c.updateName,{name:s},{token:t})),clone:(s,o)=>a(e.httpClient.post(c.clone,{name:s,tag:o},{token:t}))}),R=(e,t)=>({create:(s,o,n)=>a(e.httpClient.post(g.create,{name:s,selfProvisioningDomains:o,customAttributes:n},{token:t})),createWithId:(s,o,n,r)=>a(e.httpClient.post(g.create,{id:s,name:o,selfProvisioningDomains:n,customAttributes:r},{token:t})),update:(s,o,n,r)=>a(e.httpClient.post(g.update,{id:s,name:o,selfProvisioningDomains:n,customAttributes:r},{token:t})),delete:s=>a(e.httpClient.post(g.delete,{id:s},{token:t})),load:s=>a(e.httpClient.get(g.load,{queryParams:{id:s},token:t}),(e=>e)),loadAll:()=>a(e.httpClient.get(g.loadAll,{token:t}),(e=>e.tenants)),searchAll:(s,o,n,r)=>a(e.httpClient.post(g.searchAll,{tenantIds:s,tenantNames:o,tenantSelfProvisioningDomains:n,customAttributes:r},{token:t}),(e=>e.tenants))}),N=(e,t)=>({update:(s,o)=>a(e.httpClient.post(k.update,{jwt:s,customClaims:o},{token:t}))}),S=(e,t)=>({create:(s,o)=>a(e.httpClient.post(C.create,{name:s,description:o},{token:t})),update:(s,o,n)=>a(e.httpClient.post(C.update,{name:s,newName:o,description:n},{token:t})),delete:s=>a(e.httpClient.post(C.delete,{name:s},{token:t})),loadAll:()=>a(e.httpClient.get(C.loadAll,{token:t}),(e=>e.permissions))}),x=(e,t)=>({create:(s,o,n)=>a(e.httpClient.post(f.create,{name:s,description:o,permissionNames:n},{token:t})),update:(s,o,n,r)=>a(e.httpClient.post(f.update,{name:s,newName:o,description:n,permissionNames:r},{token:t})),delete:s=>a(e.httpClient.post(f.delete,{name:s},{token:t})),loadAll:()=>a(e.httpClient.get(f.loadAll,{token:t}),(e=>e.roles))}),E=(e,t)=>({loadAllGroups:s=>a(e.httpClient.post(I.loadAllGroups,{tenantId:s},{token:t})),loadAllGroupsForMember:(s,o,n)=>a(e.httpClient.post(I.loadAllGroupsForMember,{tenantId:s,loginIds:n,userIds:o},{token:t})),loadAllGroupMembers:(s,o)=>a(e.httpClient.post(I.loadAllGroupMembers,{tenantId:s,groupId:o},{token:t}))}),j=(e,t)=>({getSettings:s=>a(e.httpClient.get(v.settings,{queryParams:{tenantId:s},token:t}),(e=>e)),deleteSettings:s=>a(e.httpClient.delete(v.settings,{queryParams:{tenantId:s},token:t})),configureSettings:(s,o,n,r,i,l)=>a(e.httpClient.post(v.settings,{tenantId:s,idpURL:o,entityId:r,idpCert:n,redirectURL:i,domain:l},{token:t})),configureMetadata:(s,o,n,r)=>a(e.httpClient.post(v.metadata,{tenantId:s,idpMetadataURL:o,redirectURL:n,domain:r},{token:t})),configureMapping:(s,o,n)=>a(e.httpClient.post(v.mapping,{tenantId:s,roleMappings:o,attributeMapping:n},{token:t}))}),D=(e,t)=>({create:(s,o,n,r)=>a(e.httpClient.post(h.create,{name:s,expireTime:o,roleNames:n,keyTenants:r},{token:t})),load:s=>a(e.httpClient.get(h.load,{queryParams:{id:s},token:t}),(e=>e.key)),searchAll:s=>a(e.httpClient.post(h.search,{tenantIds:s},{token:t}),(e=>e.keys)),update:(s,o)=>a(e.httpClient.post(h.update,{id:s,name:o},{token:t}),(e=>e.key)),deactivate:s=>a(e.httpClient.post(h.deactivate,{id:s},{token:t})),activate:s=>a(e.httpClient.post(h.activate,{id:s},{token:t})),delete:s=>a(e.httpClient.post(h.delete,{id:s},{token:t}))}),M=(e,t)=>({list:()=>a(e.httpClient.post(y.list,{},{token:t})),export:s=>a(e.httpClient.post(y.export,{flowId:s},{token:t})),import:(s,o,n)=>a(e.httpClient.post(y.import,{flowId:s,flow:o,screens:n},{token:t}))}),O=(e,t)=>({export:()=>a(e.httpClient.post(w.export,{},{token:t})),import:s=>a(e.httpClient.post(w.import,{theme:s},{token:t}))}),U=(e,t)=>({search:s=>{const o=Object.assign(Object.assign({},s),{externalIds:s.loginIds});return delete o.loginIds,a(e.httpClient.post(b.search,o,{token:t}),(e=>null==e?void 0:e.audits.map((e=>{const t=Object.assign(Object.assign({},e),{occurred:parseFloat(e.occurred),loginIds:e.externalIds});return delete t.externalIds,t}))))}}),L=(e,t)=>({saveSchema:(s,o)=>a(e.httpClient.post(A.schemaSave,{schema:s,upgrade:o},{token:t})),deleteSchema:()=>a(e.httpClient.post(A.schemaDelete,{},{token:t})),loadSchema:()=>a(e.httpClient.post(A.schemaLoad,{},{token:t}),(e=>e.schema)),saveNamespace:(s,o,n)=>a(e.httpClient.post(A.nsSave,{namespace:s,oldName:o,schemaName:n},{token:t})),deleteNamespace:(s,o)=>a(e.httpClient.post(A.nsDelete,{name:s,schemaName:o},{token:t})),saveRelationDefinition:(s,o,n,r)=>a(e.httpClient.post(A.rdSave,{relationDefinition:s,namespace:o,oldName:n,schemaName:r},{token:t})),deleteRelationDefinition:(s,o,n)=>a(e.httpClient.post(A.rdDelete,{name:s,namespace:o,schemaName:n},{token:t})),createRelations:s=>a(e.httpClient.post(A.reCreate,{relations:s},{token:t})),deleteRelations:s=>a(e.httpClient.post(A.reDelete,{relations:s},{token:t})),deleteRelationsForResources:s=>a(e.httpClient.post(A.reDeleteResources,{resources:s},{token:t})),hasRelations:s=>a(e.httpClient.post(A.hasRelations,{relationQueries:s},{token:t}),(e=>e.relationQueries)),whoCanAccess:(s,o,n)=>a(e.httpClient.post(A.who,{resource:s,relationDefinition:o,namespace:n},{token:t}),(e=>e.targets)),resourceRelations:s=>a(e.httpClient.post(A.resource,{resource:s},{token:t}),(e=>e.relations)),targetsRelations:s=>a(e.httpClient.post(A.targets,{targets:s},{token:t}),(e=>e.relations)),whatCanTargetAccess:s=>a(e.httpClient.post(A.targetAll,{target:s},{token:t}),(e=>e.relations))});var F;null!==(F=globalThis.Headers)&&void 0!==F||(globalThis.Headers=l);const z=(...e)=>(e.forEach((e=>{var t,a;e&&(null!==(t=(a=e).highWaterMark)&&void 0!==t||(a.highWaterMark=31457280))})),i(...e)),$=a=>{var i,{managementKey:l,publicKey:u}=a,c=e(a,["managementKey","publicKey"]);const h=t(Object.assign(Object.assign({fetch:z},c),{baseHeaders:Object.assign(Object.assign({},c.baseHeaders),{"x-descope-sdk-name":"nodejs","x-descope-sdk-node-version":(null===(i=null===process||void 0===process?void 0:process.versions)||void 0===i?void 0:i.node)||"","x-descope-sdk-version":"1.6.1"})})),{projectId:g,logger:v}=c,k={},C=((e,t)=>({user:T(e,t),project:P(e,t),accessKey:D(e,t),tenant:R(e,t),sso:j(e,t),jwt:N(e,t),permission:S(e,t),role:x(e,t),group:E(e,t),flow:M(e,t),theme:O(e,t),audit:U(e,t),authz:L(e,t)}))(h,l),f=Object.assign(Object.assign({},h),{management:C,async getKey(e){if(!(null==e?void 0:e.kid))throw Error("header.kid must not be empty");if(k[e.kid])return k[e.kid];if(Object.assign(k,await(async()=>{if(u)try{const e=JSON.parse(u),t=await r(e);return{[e.kid]:t}}catch(e){throw null==v||v.error("Failed to parse the provided public key",e),new Error(`Failed to parse public key. Error: ${e}`)}const e=(await h.httpClient.get(`v2/keys/${g}`).then((e=>e.json()))).keys;return Array.isArray(e)?(await Promise.all(e.map((async e=>[e.kid,await r(e)])))).reduce(((e,[t,a])=>t?Object.assign(Object.assign({},e),{[t.toString()]:a}):e),{}):{}})()),!k[e.kid])throw Error("failed to fetch matching key");return k[e.kid]},async validateJwt(e){var t;const a=(await o(e,f.getKey,{clockTolerance:5})).payload;if(a&&(a.iss=null===(t=a.iss)||void 0===t?void 0:t.split("/").pop(),a.iss!==g))throw new n.JWTClaimValidationFailed('unexpected "iss" claim value',"iss","check_failed");return{jwt:e,token:a}},async validateSession(e){if(!e)throw Error("session token is required for validation");try{return await f.validateJwt(e)}catch(e){throw null==v||v.error("session validation failed",e),Error(`session validation failed. Error: ${e}`)}},async refreshSession(e){var t,a;if(!e)throw Error("refresh token is required to refresh a session");try{await f.validateJwt(e);const s=await f.refresh(e);if(s.ok){return await f.validateJwt(null===(t=s.data)||void 0===t?void 0:t.sessionJwt)}throw Error(null===(a=s.error)||void 0===a?void 0:a.errorMessage)}catch(e){throw null==v||v.error("refresh token validation failed",e),Error(`refresh token validation failed, Error: ${e}`)}},async validateAndRefreshSession(e,t){if(!e&&!t)throw Error("both session and refresh tokens are empty");try{return await f.validateSession(e)}catch(e){null==v||v.log(`session validation failed with error ${e} - trying to refresh it`)}return f.refreshSession(t)},async exchangeAccessKey(e){if(!e)throw Error("access key must not be empty");let t;try{t=await f.accessKey.exchange(e)}catch(e){throw null==v||v.error("failed to exchange access key",e),Error(`could not exchange access key - Failed to exchange. Error: ${e}`)}const{sessionJwt:a}=t.data;if(!a)throw null==v||v.error("failed to parse exchange access key response"),Error("could not exchange access key");try{return await f.validateJwt(a)}catch(e){throw null==v||v.error("failed to parse jwt from access key",e),Error(`could not exchange access key - failed to validate jwt. Error: ${e}`)}},validatePermissions:(e,t)=>f.validateTenantPermissions(e,null,t),validateTenantPermissions(e,t,a){if(t&&!m(e,t))return!1;const s=p(e,"permissions",t);return a.every((e=>s.includes(e)))},validateRoles:(e,t)=>f.validateTenantRoles(e,null,t),validateTenantRoles(e,t,a){if(t&&!m(e,t))return!1;const s=p(e,"roles",t);return a.every((e=>s.includes(e)))}});return s(f,["otp.verify.email","otp.verify.sms","otp.verify.whatsapp","magicLink.verify","enchantedLink.signUp","enchantedLink.signIn","oauth.exchange","saml.exchange","totp.verify","webauthn.signIn.finish","webauthn.signUp.finish","refresh"],d)};$.RefreshTokenCookieName="DSR",$.SessionTokenCookieName="DS";export{$ as default};
+import{__rest as e}from"tslib";import t,{transformResponse as a,wrapWith as s}from"@descope/core-js-sdk";import{jwtVerify as n,errors as o,importJWK as r}from"jose";import{Headers as i,fetch as l}from"cross-fetch";const d=t=>async(...a)=>{var s,n,o;const r=await t(...a);if(!r.data)return r;let i=r.data,{refreshJwt:l}=i,d=e(i,["refreshJwt"]);const m=[];var p;return l?m.push(`${"DSR"}=${l}; Domain=${(null==(p=d)?void 0:p.cookieDomain)||""}; Max-Age=${(null==p?void 0:p.cookieMaxAge)||""}; Path=${(null==p?void 0:p.cookiePath)||"/"}; HttpOnly; SameSite=Strict`):(null===(s=r.response)||void 0===s?void 0:s.headers.get("set-cookie"))&&(l=((e,t)=>{const a=null==e?void 0:e.match(RegExp(`(?:^|;\\s*)${t}=([^;]*)`));return a?a[1]:null})(null===(n=r.response)||void 0===n?void 0:n.headers.get("set-cookie"),"DSR"),m.push(null===(o=r.response)||void 0===o?void 0:o.headers.get("set-cookie"))),Object.assign(Object.assign({},r),{data:Object.assign(Object.assign({},r.data),{refreshJwt:l,cookies:m})})};function m(e,t,a){var s,n;const o=a?null===(n=null===(s=e.token.tenants)||void 0===s?void 0:s[a])||void 0===n?void 0:n[t]:e.token[t];return Array.isArray(o)?o:[]}function p(e,t){var a;return!!(null===(a=e.token.tenants)||void 0===a?void 0:a[t])}var u={create:"/v1/mgmt/user/create",createBatch:"/v1/mgmt/user/create/batch",update:"/v1/mgmt/user/update",delete:"/v1/mgmt/user/delete",deleteAllTestUsers:"/v1/mgmt/user/test/delete/all",load:"/v1/mgmt/user",logout:"/v1/mgmt/user/logout",search:"/v1/mgmt/user/search",getProviderToken:"/v1/mgmt/user/provider/token",updateStatus:"/v1/mgmt/user/update/status",updateLoginId:"/v1/mgmt/user/update/loginid",updateEmail:"/v1/mgmt/user/update/email",updatePhone:"/v1/mgmt/user/update/phone",updateDisplayName:"/v1/mgmt/user/update/name",updatePicture:"/v1/mgmt/user/update/picture",updateCustomAttribute:"/v1/mgmt/user/update/customAttribute",setRole:"/v1/mgmt/user/update/role/set",addRole:"/v1/mgmt/user/update/role/add",removeRole:"/v1/mgmt/user/update/role/remove",addTenant:"/v1/mgmt/user/update/tenant/add",removeTenant:"/v1/mgmt/user/update/tenant/remove",setPassword:"/v1/mgmt/user/password/set",expirePassword:"/v1/mgmt/user/password/expire",generateOTPForTest:"/v1/mgmt/tests/generate/otp",generateMagicLinkForTest:"/v1/mgmt/tests/generate/magiclink",generateEnchantedLinkForTest:"/v1/mgmt/tests/generate/enchantedlink",generateEmbeddedLink:"/v1/mgmt/user/signin/embeddedlink"},c={updateName:"/v1/mgmt/project/update/name",clone:"/v1/mgmt/project/clone"},g={create:"/v1/mgmt/accesskey/create",load:"/v1/mgmt/accesskey",search:"/v1/mgmt/accesskey/search",update:"/v1/mgmt/accesskey/update",deactivate:"/v1/mgmt/accesskey/deactivate",activate:"/v1/mgmt/accesskey/activate",delete:"/v1/mgmt/accesskey/delete"},h={create:"/v1/mgmt/tenant/create",update:"/v1/mgmt/tenant/update",delete:"/v1/mgmt/tenant/delete",load:"/v1/mgmt/tenant",loadAll:"/v1/mgmt/tenant/all",searchAll:"/v1/mgmt/tenant/search"},v={settings:"/v1/mgmt/sso/settings",metadata:"/v1/mgmt/sso/metadata",mapping:"/v1/mgmt/sso/mapping"},k={update:"/v1/mgmt/jwt/update"},C={create:"/v1/mgmt/permission/create",update:"/v1/mgmt/permission/update",delete:"/v1/mgmt/permission/delete",loadAll:"/v1/mgmt/permission/all"},f={create:"/v1/mgmt/role/create",update:"/v1/mgmt/role/update",delete:"/v1/mgmt/role/delete",loadAll:"/v1/mgmt/role/all"},y={list:"/v1/mgmt/flow/list",export:"/v1/mgmt/flow/export",import:"/v1/mgmt/flow/import"},w={export:"/v1/mgmt/theme/export",import:"/v1/mgmt/theme/import"},I={loadAllGroups:"/v1/mgmt/group/all",loadAllGroupsForMember:"/v1/mgmt/group/member/all",loadAllGroupMembers:"/v1/mgmt/group/members"},b={search:"/v1/mgmt/audit/search"},N={schemaSave:"/v1/mgmt/authz/schema/save",schemaDelete:"/v1/mgmt/authz/schema/delete",schemaLoad:"/v1/mgmt/authz/schema/load",nsSave:"/v1/mgmt/authz/ns/save",nsDelete:"/v1/mgmt/authz/ns/delete",rdSave:"/v1/mgmt/authz/rd/save",rdDelete:"/v1/mgmt/authz/rd/delete",reCreate:"/v1/mgmt/authz/re/create",reDelete:"/v1/mgmt/authz/re/delete",reDeleteResources:"/v1/mgmt/authz/re/deleteresources",hasRelations:"/v1/mgmt/authz/re/has",who:"/v1/mgmt/authz/re/who",resource:"/v1/mgmt/authz/re/resource",targets:"/v1/mgmt/authz/re/targets",targetAll:"/v1/mgmt/authz/re/targetall"};const A=(e,t)=>({create:(s,n,o,r,i,l,d,m,p,c,g,h,v,k)=>a(e.httpClient.post(u.create,{loginId:s,email:n,phone:o,displayName:r,givenName:g,middleName:h,familyName:v,roleNames:i,userTenants:l,customAttributes:d,picture:m,verifiedEmail:p,verifiedPhone:c,additionalLoginIds:k},{token:t}),(e=>e.user)),createTestUser:(s,n,o,r,i,l,d,m,p,c,g,h,v,k)=>a(e.httpClient.post(u.create,{loginId:s,email:n,phone:o,displayName:r,givenName:g,middleName:h,familyName:v,roleNames:i,userTenants:l,test:!0,customAttributes:d,picture:m,verifiedEmail:p,verifiedPhone:c,additionalLoginIds:k},{token:t}),(e=>e.user)),invite:(s,n,o,r,i,l,d,m,p,c,g,h,v,k,C,f,y)=>a(e.httpClient.post(u.create,{loginId:s,email:n,phone:o,displayName:r,givenName:k,middleName:C,familyName:f,roleNames:i,userTenants:l,invite:!0,customAttributes:d,picture:m,verifiedEmail:p,verifiedPhone:c,inviteUrl:g,sendMail:h,sendSMS:v,additionalLoginIds:y},{token:t}),(e=>e.user)),inviteBatch:(s,n,o,r)=>a(e.httpClient.post(u.createBatch,{users:s,invite:!0,inviteUrl:n,sendMail:o,sendSMS:r},{token:t}),(e=>e)),update:(s,n,o,r,i,l,d,m,p,c,g,h,v,k)=>a(e.httpClient.post(u.update,{loginId:s,email:n,phone:o,displayName:r,givenName:g,middleName:h,familyName:v,roleNames:i,userTenants:l,customAttributes:d,picture:m,verifiedEmail:p,verifiedPhone:c,additionalLoginIds:k},{token:t}),(e=>e.user)),delete:s=>a(e.httpClient.post(u.delete,{loginId:s},{token:t})),deleteAllTestUsers:()=>a(e.httpClient.delete(u.deleteAllTestUsers,{token:t})),load:s=>a(e.httpClient.get(u.load,{queryParams:{loginId:s},token:t}),(e=>e.user)),loadByUserId:s=>a(e.httpClient.get(u.load,{queryParams:{userId:s},token:t}),(e=>e.user)),logoutUser:s=>a(e.httpClient.post(u.logout,{loginId:s},{token:t})),logoutUserByUserId:s=>a(e.httpClient.post(u.logout,{userId:s},{token:t})),searchAll:(s,n,o,r,i,l,d,m,p,c)=>a(e.httpClient.post(u.search,{tenantIds:s,roleNames:n,limit:o,page:r,testUsersOnly:i,withTestUser:l,customAttributes:d,statuses:m,emails:p,phones:c},{token:t}),(e=>e.users)),getProviderToken:(s,n)=>a(e.httpClient.get(u.getProviderToken,{queryParams:{loginId:s,provider:n},token:t}),(e=>e)),activate:s=>a(e.httpClient.post(u.updateStatus,{loginId:s,status:"enabled"},{token:t}),(e=>e.user)),deactivate:s=>a(e.httpClient.post(u.updateStatus,{loginId:s,status:"disabled"},{token:t}),(e=>e.user)),updateLoginId:(s,n)=>a(e.httpClient.post(u.updateLoginId,{loginId:s,newLoginId:n},{token:t}),(e=>e.user)),updateEmail:(s,n,o)=>a(e.httpClient.post(u.updateEmail,{loginId:s,email:n,verified:o},{token:t}),(e=>e.user)),updatePhone:(s,n,o)=>a(e.httpClient.post(u.updatePhone,{loginId:s,phone:n,verified:o},{token:t}),(e=>e.user)),updateDisplayName:(s,n,o,r,i)=>a(e.httpClient.post(u.updateDisplayName,{loginId:s,displayName:n,givenName:o,middleName:r,familyName:i},{token:t}),(e=>e.user)),updatePicture:(s,n)=>a(e.httpClient.post(u.updatePicture,{loginId:s,picture:n},{token:t}),(e=>e.user)),updateCustomAttribute:(s,n,o)=>a(e.httpClient.post(u.updateCustomAttribute,{loginId:s,attributeKey:n,attributeValue:o},{token:t}),(e=>e.user)),setRoles:(s,n)=>a(e.httpClient.post(u.setRole,{loginId:s,roleNames:n},{token:t}),(e=>e.user)),addRoles:(s,n)=>a(e.httpClient.post(u.addRole,{loginId:s,roleNames:n},{token:t}),(e=>e.user)),removeRoles:(s,n)=>a(e.httpClient.post(u.removeRole,{loginId:s,roleNames:n},{token:t}),(e=>e.user)),addTenant:(s,n)=>a(e.httpClient.post(u.addTenant,{loginId:s,tenantId:n},{token:t}),(e=>e.user)),removeTenant:(s,n)=>a(e.httpClient.post(u.removeTenant,{loginId:s,tenantId:n},{token:t}),(e=>e.user)),setTenantRoles:(s,n,o)=>a(e.httpClient.post(u.setRole,{loginId:s,tenantId:n,roleNames:o},{token:t}),(e=>e.user)),addTenantRoles:(s,n,o)=>a(e.httpClient.post(u.addRole,{loginId:s,tenantId:n,roleNames:o},{token:t}),(e=>e.user)),removeTenantRoles:(s,n,o)=>a(e.httpClient.post(u.removeRole,{loginId:s,tenantId:n,roleNames:o},{token:t}),(e=>e.user)),generateOTPForTestUser:(s,n,o)=>a(e.httpClient.post(u.generateOTPForTest,{deliveryMethod:s,loginId:n,loginOptions:o},{token:t}),(e=>e)),generateMagicLinkForTestUser:(s,n,o,r)=>a(e.httpClient.post(u.generateMagicLinkForTest,{deliveryMethod:s,loginId:n,URI:o,loginOptions:r},{token:t}),(e=>e)),generateEnchantedLinkForTestUser:(s,n,o)=>a(e.httpClient.post(u.generateEnchantedLinkForTest,{loginId:s,URI:n,loginOptions:o},{token:t}),(e=>e)),generateEmbeddedLink:(s,n)=>a(e.httpClient.post(u.generateEmbeddedLink,{loginId:s,customClaims:n},{token:t}),(e=>e)),setPassword:(s,n)=>a(e.httpClient.post(u.setPassword,{loginId:s,password:n},{token:t}),(e=>e)),expirePassword:s=>a(e.httpClient.post(u.expirePassword,{loginId:s},{token:t}),(e=>e))}),T=(e,t)=>({updateName:s=>a(e.httpClient.post(c.updateName,{name:s},{token:t})),clone:(s,n)=>a(e.httpClient.post(c.clone,{name:s,tag:n},{token:t}))}),R=(e,t)=>({create:(s,n,o)=>a(e.httpClient.post(h.create,{name:s,selfProvisioningDomains:n,customAttributes:o},{token:t})),createWithId:(s,n,o,r)=>a(e.httpClient.post(h.create,{id:s,name:n,selfProvisioningDomains:o,customAttributes:r},{token:t})),update:(s,n,o,r)=>a(e.httpClient.post(h.update,{id:s,name:n,selfProvisioningDomains:o,customAttributes:r},{token:t})),delete:s=>a(e.httpClient.post(h.delete,{id:s},{token:t})),load:s=>a(e.httpClient.get(h.load,{queryParams:{id:s},token:t}),(e=>e)),loadAll:()=>a(e.httpClient.get(h.loadAll,{token:t}),(e=>e.tenants)),searchAll:(s,n,o,r)=>a(e.httpClient.post(h.searchAll,{tenantIds:s,tenantNames:n,tenantSelfProvisioningDomains:o,customAttributes:r},{token:t}),(e=>e.tenants))}),P=(e,t)=>({update:(s,n)=>a(e.httpClient.post(k.update,{jwt:s,customClaims:n},{token:t}))}),E=(e,t)=>({create:(s,n)=>a(e.httpClient.post(C.create,{name:s,description:n},{token:t})),update:(s,n,o)=>a(e.httpClient.post(C.update,{name:s,newName:n,description:o},{token:t})),delete:s=>a(e.httpClient.post(C.delete,{name:s},{token:t})),loadAll:()=>a(e.httpClient.get(C.loadAll,{token:t}),(e=>e.permissions))}),S=(e,t)=>({create:(s,n,o)=>a(e.httpClient.post(f.create,{name:s,description:n,permissionNames:o},{token:t})),update:(s,n,o,r)=>a(e.httpClient.post(f.update,{name:s,newName:n,description:o,permissionNames:r},{token:t})),delete:s=>a(e.httpClient.post(f.delete,{name:s},{token:t})),loadAll:()=>a(e.httpClient.get(f.loadAll,{token:t}),(e=>e.roles))}),x=(e,t)=>({loadAllGroups:s=>a(e.httpClient.post(I.loadAllGroups,{tenantId:s},{token:t})),loadAllGroupsForMember:(s,n,o)=>a(e.httpClient.post(I.loadAllGroupsForMember,{tenantId:s,loginIds:o,userIds:n},{token:t})),loadAllGroupMembers:(s,n)=>a(e.httpClient.post(I.loadAllGroupMembers,{tenantId:s,groupId:n},{token:t}))}),M=(e,t)=>({getSettings:s=>a(e.httpClient.get(v.settings,{queryParams:{tenantId:s},token:t}),(e=>e)),deleteSettings:s=>a(e.httpClient.delete(v.settings,{queryParams:{tenantId:s},token:t})),configureSettings:(s,n,o,r,i,l)=>a(e.httpClient.post(v.settings,{tenantId:s,idpURL:n,entityId:r,idpCert:o,redirectURL:i,domains:l},{token:t})),configureMetadata:(s,n,o,r)=>a(e.httpClient.post(v.metadata,{tenantId:s,idpMetadataURL:n,redirectURL:o,domains:r},{token:t})),configureMapping:(s,n,o)=>a(e.httpClient.post(v.mapping,{tenantId:s,roleMappings:n,attributeMapping:o},{token:t}))}),j=(e,t)=>({create:(s,n,o,r)=>a(e.httpClient.post(g.create,{name:s,expireTime:n,roleNames:o,keyTenants:r},{token:t})),load:s=>a(e.httpClient.get(g.load,{queryParams:{id:s},token:t}),(e=>e.key)),searchAll:s=>a(e.httpClient.post(g.search,{tenantIds:s},{token:t}),(e=>e.keys)),update:(s,n)=>a(e.httpClient.post(g.update,{id:s,name:n},{token:t}),(e=>e.key)),deactivate:s=>a(e.httpClient.post(g.deactivate,{id:s},{token:t})),activate:s=>a(e.httpClient.post(g.activate,{id:s},{token:t})),delete:s=>a(e.httpClient.post(g.delete,{id:s},{token:t}))}),O=(e,t)=>({list:()=>a(e.httpClient.post(y.list,{},{token:t})),export:s=>a(e.httpClient.post(y.export,{flowId:s},{token:t})),import:(s,n,o)=>a(e.httpClient.post(y.import,{flowId:s,flow:n,screens:o},{token:t}))}),D=(e,t)=>({export:()=>a(e.httpClient.post(w.export,{},{token:t})),import:s=>a(e.httpClient.post(w.import,{theme:s},{token:t}))}),L=(e,t)=>({search:s=>{const n=Object.assign(Object.assign({},s),{externalIds:s.loginIds});return delete n.loginIds,a(e.httpClient.post(b.search,n,{token:t}),(e=>null==e?void 0:e.audits.map((e=>{const t=Object.assign(Object.assign({},e),{occurred:parseFloat(e.occurred),loginIds:e.externalIds});return delete t.externalIds,t}))))}}),U=(e,t)=>({saveSchema:(s,n)=>a(e.httpClient.post(N.schemaSave,{schema:s,upgrade:n},{token:t})),deleteSchema:()=>a(e.httpClient.post(N.schemaDelete,{},{token:t})),loadSchema:()=>a(e.httpClient.post(N.schemaLoad,{},{token:t}),(e=>e.schema)),saveNamespace:(s,n,o)=>a(e.httpClient.post(N.nsSave,{namespace:s,oldName:n,schemaName:o},{token:t})),deleteNamespace:(s,n)=>a(e.httpClient.post(N.nsDelete,{name:s,schemaName:n},{token:t})),saveRelationDefinition:(s,n,o,r)=>a(e.httpClient.post(N.rdSave,{relationDefinition:s,namespace:n,oldName:o,schemaName:r},{token:t})),deleteRelationDefinition:(s,n,o)=>a(e.httpClient.post(N.rdDelete,{name:s,namespace:n,schemaName:o},{token:t})),createRelations:s=>a(e.httpClient.post(N.reCreate,{relations:s},{token:t})),deleteRelations:s=>a(e.httpClient.post(N.reDelete,{relations:s},{token:t})),deleteRelationsForResources:s=>a(e.httpClient.post(N.reDeleteResources,{resources:s},{token:t})),hasRelations:s=>a(e.httpClient.post(N.hasRelations,{relationQueries:s},{token:t}),(e=>e.relationQueries)),whoCanAccess:(s,n,o)=>a(e.httpClient.post(N.who,{resource:s,relationDefinition:n,namespace:o},{token:t}),(e=>e.targets)),resourceRelations:s=>a(e.httpClient.post(N.resource,{resource:s},{token:t}),(e=>e.relations)),targetsRelations:s=>a(e.httpClient.post(N.targets,{targets:s},{token:t}),(e=>e.relations)),whatCanTargetAccess:s=>a(e.httpClient.post(N.targetAll,{target:s},{token:t}),(e=>e.relations))});var F;null!==(F=globalThis.Headers)&&void 0!==F||(globalThis.Headers=i);const z=(...e)=>(e.forEach((e=>{var t,a;e&&(null!==(t=(a=e).highWaterMark)&&void 0!==t||(a.highWaterMark=31457280))})),l(...e)),$={badRequest:"E011001",missingArguments:"E011002",invalidRequest:"E011003",invalidArguments:"E011004",wrongOTPCode:"E061102",tooManyOTPAttempts:"E061103",enchantedLinkPending:"E062503",userNotFound:"E062108"},J=a=>{var i,{managementKey:l,publicKey:u}=a,c=e(a,["managementKey","publicKey"]);const g=t(Object.assign(Object.assign({fetch:z},c),{baseHeaders:Object.assign(Object.assign({},c.baseHeaders),{"x-descope-sdk-name":"nodejs","x-descope-sdk-node-version":(null===(i=null===process||void 0===process?void 0:process.versions)||void 0===i?void 0:i.node)||"","x-descope-sdk-version":"1.6.2"})})),{projectId:h,logger:v}=c,k={},C=((e,t)=>({user:A(e,t),project:T(e,t),accessKey:j(e,t),tenant:R(e,t),sso:M(e,t),jwt:P(e,t),permission:E(e,t),role:S(e,t),group:x(e,t),flow:O(e,t),theme:D(e,t),audit:L(e,t),authz:U(e,t)}))(g,l),f=Object.assign(Object.assign({},g),{management:C,async getKey(e){if(!(null==e?void 0:e.kid))throw Error("header.kid must not be empty");if(k[e.kid])return k[e.kid];if(Object.assign(k,await(async()=>{if(u)try{const e=JSON.parse(u),t=await r(e);return{[e.kid]:t}}catch(e){throw null==v||v.error("Failed to parse the provided public key",e),new Error(`Failed to parse public key. Error: ${e}`)}const e=(await g.httpClient.get(`v2/keys/${h}`).then((e=>e.json()))).keys;return Array.isArray(e)?(await Promise.all(e.map((async e=>[e.kid,await r(e)])))).reduce(((e,[t,a])=>t?Object.assign(Object.assign({},e),{[t.toString()]:a}):e),{}):{}})()),!k[e.kid])throw Error("failed to fetch matching key");return k[e.kid]},async validateJwt(e){var t;const a=(await n(e,f.getKey,{clockTolerance:5})).payload;if(a&&(a.iss=null===(t=a.iss)||void 0===t?void 0:t.split("/").pop(),a.iss!==h))throw new o.JWTClaimValidationFailed('unexpected "iss" claim value',"iss","check_failed");return{jwt:e,token:a}},async validateSession(e){if(!e)throw Error("session token is required for validation");try{return await f.validateJwt(e)}catch(e){throw null==v||v.error("session validation failed",e),Error(`session validation failed. Error: ${e}`)}},async refreshSession(e){var t,a;if(!e)throw Error("refresh token is required to refresh a session");try{await f.validateJwt(e);const s=await f.refresh(e);if(s.ok){return await f.validateJwt(null===(t=s.data)||void 0===t?void 0:t.sessionJwt)}throw Error(null===(a=s.error)||void 0===a?void 0:a.errorMessage)}catch(e){throw null==v||v.error("refresh token validation failed",e),Error(`refresh token validation failed, Error: ${e}`)}},async validateAndRefreshSession(e,t){if(!e&&!t)throw Error("both session and refresh tokens are empty");try{return await f.validateSession(e)}catch(e){null==v||v.log(`session validation failed with error ${e} - trying to refresh it`)}return f.refreshSession(t)},async exchangeAccessKey(e){if(!e)throw Error("access key must not be empty");let t;try{t=await f.accessKey.exchange(e)}catch(e){throw null==v||v.error("failed to exchange access key",e),Error(`could not exchange access key - Failed to exchange. Error: ${e}`)}const{sessionJwt:a}=t.data;if(!a)throw null==v||v.error("failed to parse exchange access key response"),Error("could not exchange access key");try{return await f.validateJwt(a)}catch(e){throw null==v||v.error("failed to parse jwt from access key",e),Error(`could not exchange access key - failed to validate jwt. Error: ${e}`)}},validatePermissions:(e,t)=>f.validateTenantPermissions(e,"",t),getMatchedPermissions:(e,t)=>f.getMatchedTenantPermissions(e,"",t),validateTenantPermissions(e,t,a){if(t&&!p(e,t))return!1;const s=m(e,"permissions",t);return a.every((e=>s.includes(e)))},getMatchedTenantPermissions(e,t,a){if(t&&!p(e,t))return[];const s=m(e,"permissions",t);return a.filter((e=>s.includes(e)))},validateRoles:(e,t)=>f.validateTenantRoles(e,"",t),getMatchedRoles:(e,t)=>f.getMatchedTenantRoles(e,"",t),validateTenantRoles(e,t,a){if(t&&!p(e,t))return!1;const s=m(e,"roles",t);return a.every((e=>s.includes(e)))},getMatchedTenantRoles(e,t,a){if(t&&!p(e,t))return[];const s=m(e,"roles",t);return a.filter((e=>s.includes(e)))}});return s(f,["otp.verify.email","otp.verify.sms","otp.verify.whatsapp","magicLink.verify","enchantedLink.signUp","enchantedLink.signIn","oauth.exchange","saml.exchange","totp.verify","webauthn.signIn.finish","webauthn.signUp.finish","refresh"],d)};J.RefreshTokenCookieName="DSR",J.SessionTokenCookieName="DS";export{J as default,$ as descopeErrors};
 //# sourceMappingURL=index.esm.js.map