@descope/node-sdk 1.6.3 → 1.6.5

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import * as _descope_core_js_sdk from '@descope/core-js-sdk';
-import _descope_core_js_sdk__default, { DeliveryMethod, UserResponse, SdkResponse, ExchangeAccessKeyResponse } from '@descope/core-js-sdk';
+import _descope_core_js_sdk__default, { DeliveryMethod, UserResponse, SdkResponse, AccessKeyLoginOptions, ExchangeAccessKeyResponse } from '@descope/core-js-sdk';
 export { DeliveryMethod, JWTResponse, OAuthProvider, ResponseData, SdkResponse } from '@descope/core-js-sdk';
 import { JWTHeaderParameters, KeyLike } from 'jose';
 
@@ -18,7 +18,9 @@ interface AuthenticationInfo {
 }
 declare type DeliveryMethodForTestUser = DeliveryMethod | 'Embedded';
 
-/** Represents a tenant association for a User or Access Key. The tenantId is required to denote
+declare type ExpirationUnit = 'minutes' | 'hours' | 'days' | 'weeks';
+/**
+ * Represents a tenant association for a User or Access Key. The tenantId is required to denote
  * which tenant the user or access key belongs to. The roleNames array is an optional list of
  * roles for the user or access key in this specific tenant.
  */
@@ -30,6 +32,71 @@ declare type AssociatedTenant = {
 declare type CreateTenantResponse = {
     id: string;
 };
+/**
+ * Options to create or update an OIDC application.
+ *
+ * **Note:** When updating, `id` will be required to perform the operation
+ */
+declare type OidcApplicationOptions = {
+    name: string;
+    loginPageUrl: string;
+    id?: string;
+    description?: string;
+    logo?: string;
+    enabled?: boolean;
+};
+/**
+ * Options to create or update a SAML application.
+ *
+ * **Note:** When updating, `id` will be required to perform the operation
+ */
+declare type SamlApplicationOptions = {
+    name: string;
+    loginPageUrl: string;
+    id?: string;
+    description?: string;
+    logo?: string;
+    enabled?: boolean;
+    useMetadataInfo?: boolean;
+    metadataUrl?: string;
+    entityId?: string;
+    acsUrl?: string;
+    certificate?: string;
+    attributeMapping?: SamlIdpAttributeMappingInfo[];
+    groupsMapping?: SamlIdpGroupsMappingInfo[];
+    acsAllowedCallbacks?: string[];
+    subjectNameIdType?: string;
+    subjectNameIdFormat?: string;
+};
+/**
+ * Represents a SAML IDP attribute mapping object. Use this class for mapping Descope attribute
+ * to the relevant SAML Assertion attributes matching your expected SP attributes names.
+ */
+declare type SamlIdpAttributeMappingInfo = {
+    name: string;
+    type: string;
+    value: string;
+};
+/** Represents a SAML IDP Role Group mapping object. */
+declare type SAMLIDPRoleGroupMappingInfo = {
+    id: string;
+    name: string;
+};
+/**
+ * Represents a SAML IDP groups mapping object. Use this class for mapping Descope roles
+ * to the relevant SAML Assertion groups attributes that matching your expected SP groups attributes names.
+ */
+declare type SamlIdpGroupsMappingInfo = {
+    name: string;
+    type: string;
+    filterType: string;
+    value: string;
+    roles: SAMLIDPRoleGroupMappingInfo[];
+};
+/** The ID of a newly created SSO application */
+declare type CreateSSOApplicationResponse = {
+    id: string;
+};
 /** An access key that can be used to access descope */
 declare type AccessKey = {
     id: string;
@@ -42,6 +109,7 @@ declare type AccessKey = {
     expiresTime: number;
     createdBy: string;
     clientId: string;
+    boundUserId?: string;
 };
 /** Access Key extended details including created key cleartext */
 declare type CreatedAccessKeyResponse = {
@@ -73,6 +141,77 @@ declare type Tenant = {
     name: string;
     selfProvisioningDomains: string[];
     customAttributes?: Record<string, string | number | boolean>;
+    domains?: string[];
+    authType?: 'none' | 'saml' | 'oidc';
+};
+/** Represents settings of a tenant in a project. It has an id, a name and an array of
+ * self provisioning domains used to associate users with that tenant.
+ */
+declare type TenantSettings = {
+    selfProvisioningDomains: string[];
+    domains?: string[];
+    authType?: 'none' | 'saml' | 'oidc';
+    sessionSettingsEnabled?: boolean;
+    refreshTokenExpiration?: number;
+    refreshTokenExpirationUnit?: ExpirationUnit;
+    sessionTokenExpiration?: number;
+    sessionTokenExpirationUnit?: ExpirationUnit;
+    stepupTokenExpiration?: number;
+    stepupTokenExpirationUnit?: ExpirationUnit;
+    enableInactivity?: boolean;
+    InactivityTime?: number;
+    InactivityTimeUnit?: ExpirationUnit;
+    JITDisabled?: boolean;
+};
+/** Represents password settings of a tenant in a project. It has the password policy details. */
+declare type PasswordSettings = {
+    enabled: boolean;
+    minLength: number;
+    lowercase: boolean;
+    uppercase: boolean;
+    number: boolean;
+    nonAlphaNumeric: boolean;
+    expiration: boolean;
+    expirationWeeks: number;
+    reuse: boolean;
+    reuseAmount: number;
+    lock: boolean;
+    lockAttempts: number;
+};
+/** Represents OIDC settings of an SSO application in a project. */
+declare type SSOApplicationOIDCSettings = {
+    loginPageUrl: string;
+    issuer: string;
+    discoveryUrl: string;
+};
+/** Represents SAML settings of an SSO application in a project. */
+declare type SSOApplicationSAMLSettings = {
+    loginPageUrl: string;
+    idpCert: string;
+    useMetadataInfo: boolean;
+    metadataUrl: string;
+    entityId: string;
+    acsUrl: string;
+    certificate: string;
+    attributeMapping: SamlIdpAttributeMappingInfo[];
+    groupsMapping: SamlIdpGroupsMappingInfo[];
+    idpMetadataUrl: string;
+    idpEntityId: string;
+    idpSsoUrl: string;
+    acsAllowedCallbacks: string[];
+    subjectNameIdType: string;
+    subjectNameIdFormat: string;
+};
+/** Represents an SSO application in a project. */
+declare type SSOApplication = {
+    id: string;
+    name: string;
+    description: string;
+    enabled: boolean;
+    logo: string;
+    appType: string;
+    samlSettings: SSOApplicationSAMLSettings;
+    oidcSettings: SSOApplicationOIDCSettings;
 };
 /** Represents a permission in a project. It has a name and optionally a description.
  * It also has a flag indicating whether it is system default or not.
@@ -90,6 +229,14 @@ declare type Role = {
     description?: string;
     permissionNames: string[];
     createdTime: number;
+    tenantId?: string;
+};
+/** Search roles based on the parameters */
+declare type RoleSearchOptions = {
+    tenantIds?: string[];
+    roleNames?: string[];
+    roleNameLike?: string;
+    permissionNames?: string[];
 };
 /** Represents a group in a project. It has an id and display name and a list of group members. */
 declare type Group = {
@@ -169,6 +316,34 @@ declare type User = {
     verifiedPhone?: boolean;
     test?: boolean;
     additionalLoginIds?: string[];
+    password?: string;
+    hashedPassword?: UserPasswordHashed;
+};
+declare type UserPasswordHashed = {
+    bcrypt?: UserPasswordBcrypt;
+    pbkdf2?: UserPasswordPbkdf2;
+    firebase?: UserPasswordFirebase;
+    django?: UserPasswordDjango;
+};
+declare type UserPasswordBcrypt = {
+    hash: string;
+};
+declare type UserPasswordPbkdf2 = {
+    hash: string;
+    salt: string;
+    iterations: number;
+    type: 'sha1' | 'sha256' | 'sha512';
+};
+declare type UserPasswordFirebase = {
+    hash: string;
+    salt: string;
+    saltSeparator: string;
+    signerKey: string;
+    memory: number;
+    rounds: number;
+};
+declare type UserPasswordDjango = {
+    hash: string;
 };
 declare type UserMapping = {
     name: string;
@@ -200,6 +375,66 @@ declare type SSOSettingsResponse = {
     domains: string[];
     domain: string;
 };
+declare type SSOSAMLSettingsResponse = {
+    idpEntityId: string;
+    idpSSOUrl: string;
+    idpCertificate: string;
+    idpMetadataUrl: string;
+    spEntityId: string;
+    spACSUrl: string;
+    spCertificate: string;
+    attributeMapping: AttributeMapping;
+    groupsMapping: RoleMappings;
+    redirectUrl: string;
+};
+declare type SSOSettings = {
+    tenant: Tenant;
+    saml?: SSOSAMLSettingsResponse;
+    oidc?: SSOOIDCSettings;
+};
+declare type OIDCAttributeMapping = {
+    loginId?: string;
+    name?: string;
+    givenName?: string;
+    middleName?: string;
+    familyName?: string;
+    email?: string;
+    verifiedEmail?: string;
+    username?: string;
+    phoneNumber?: string;
+    verifiedPhone?: string;
+    picture?: string;
+};
+declare type Prompt = 'none' | 'login' | 'consent' | 'select_account';
+declare type SSOOIDCSettings = {
+    name: string;
+    clientId: string;
+    clientSecret?: string;
+    redirectUrl?: string;
+    authUrl?: string;
+    tokenUrl?: string;
+    userDataUrl?: string;
+    scope?: string[];
+    JWKsUrl?: string;
+    attributeMapping?: OIDCAttributeMapping;
+    manageProviderTokens?: boolean;
+    callbackDomain?: string;
+    prompt?: Prompt[];
+    grantType?: 'authorization_code' | 'implicit';
+    issuer?: string;
+};
+declare type SSOSAMLSettings = {
+    idpUrl: string;
+    idpCert: string;
+    entityId: string;
+    roleMappings?: RoleMappings;
+    attributeMapping?: AttributeMapping;
+};
+declare type SSOSAMLByMetadataSettings = {
+    idpMetadataUrl: string;
+    roleMappings?: RoleMappings;
+    attributeMapping?: AttributeMapping;
+};
 declare type ProviderTokenResponse = {
     provider: string;
     providerUserId: string;
@@ -353,6 +588,7 @@ interface UserOptions {
     middleName?: string;
     familyName?: string;
     additionalLoginIds?: string[];
+    ssoAppIds?: string[];
 }
 
 /** Common Error Codes */
@@ -391,12 +627,7 @@ declare const nodeSdk: {
                         sendSMS?: boolean;
                     }): Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                     (loginId: string, email?: string, phone?: string, displayName?: string, roles?: string[], userTenants?: AssociatedTenant[], customAttributes?: Record<string, AttributesTypes>, picture?: string, verifiedEmail?: boolean, verifiedPhone?: boolean, inviteUrl?: string, sendMail?: boolean, sendSMS?: boolean, givenName?: string, middleName?: string, familyName?: string, additionalLoginIds?: string[]): Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
-                }; /**
-                 * Retrieves the roles from JWT top level claims that match the specified roles list
-                 * @param authInfo JWT parsed info containing the roles
-                 * @param roles List of roles to match against the JWT claims
-                 * @returns An array of roles that are both in the JWT claims and the specified list. Returns an empty array if no matches are found
-                 */
+                };
                 inviteBatch: (users: User[], inviteUrl?: string, sendMail?: boolean, sendSMS?: boolean) => Promise<SdkResponse<InviteBatchResponse>>;
                 update: {
                     (loginId: string, options?: UserOptions): Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
@@ -426,6 +657,7 @@ declare const nodeSdk: {
                     customAttributes?: Record<string, AttributesTypes>;
                     withTestUser?: boolean;
                     testUsersOnly?: boolean;
+                    ssoAppIds?: string[];
                 }) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse[]>>;
                 getProviderToken: (loginId: string, provider: string) => Promise<SdkResponse<ProviderTokenResponse>>;
                 activate: (loginId: string) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
@@ -444,20 +676,28 @@ declare const nodeSdk: {
                 setTenantRoles: (loginId: string, tenantId: string, roles: string[]) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                 addTenantRoles: (loginId: string, tenantId: string, roles: string[]) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                 removeTenantRoles: (loginId: string, tenantId: string, roles: string[]) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
+                addSSOapps: (loginId: string, ssoAppIds: string[]) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
+                setSSOapps: (loginId: string, ssoAppIds: string[]) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
+                removeSSOapps: (loginId: string, ssoAppIds: string[]) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
                 generateOTPForTestUser: (deliveryMethod: DeliveryMethodForTestUser, loginId: string, loginOptions?: _descope_core_js_sdk.LoginOptions) => Promise<SdkResponse<GenerateOTPForTestResponse>>;
                 generateMagicLinkForTestUser: (deliveryMethod: DeliveryMethodForTestUser, loginId: string, uri: string, loginOptions?: _descope_core_js_sdk.LoginOptions) => Promise<SdkResponse<GenerateMagicLinkForTestResponse>>;
                 generateEnchantedLinkForTestUser: (loginId: string, uri: string, loginOptions?: _descope_core_js_sdk.LoginOptions) => Promise<SdkResponse<GenerateEnchantedLinkForTestResponse>>;
                 generateEmbeddedLink: (loginId: string, customClaims?: Record<string, any>) => Promise<SdkResponse<GenerateEmbeddedLinkResponse>>;
+                setTemporaryPassword: (loginId: string, password: string) => Promise<SdkResponse<never>>;
+                setActivePassword: (loginId: string, password: string) => Promise<SdkResponse<never>>;
                 setPassword: (loginId: string, password: string) => Promise<SdkResponse<never>>;
                 expirePassword: (loginId: string) => Promise<SdkResponse<never>>;
                 removeAllPasskeys: (loginId: string) => Promise<SdkResponse<never>>;
+                history: (userIds: string[]) => Promise<SdkResponse<_descope_core_js_sdk.UserHistoryResponse[]>>;
             };
             project: {
                 updateName: (name: string) => Promise<SdkResponse<never>>;
                 clone: (name: string, tag?: "production") => Promise<SdkResponse<CloneProjectResponse>>;
+                export: () => Promise<SdkResponse<Record<string, any>>>;
+                import: (files: Record<string, any>) => Promise<SdkResponse<never>>;
             };
             accessKey: {
-                create: (name: string, expireTime: number, roles?: string[], keyTenants?: AssociatedTenant[]) => Promise<SdkResponse<CreatedAccessKeyResponse>>;
+                create: (name: string, expireTime: number, roles?: string[], keyTenants?: AssociatedTenant[], userId?: string, customClaims?: Record<string, any>) => Promise<SdkResponse<CreatedAccessKeyResponse>>;
                 load: (id: string) => Promise<SdkResponse<AccessKey>>;
                 searchAll: (tenantIds?: string[]) => Promise<SdkResponse<AccessKey[]>>;
                 update: (id: string, name: string) => Promise<SdkResponse<AccessKey>>;
@@ -473,6 +713,21 @@ declare const nodeSdk: {
                 load: (id: string) => Promise<SdkResponse<Tenant>>;
                 loadAll: () => Promise<SdkResponse<Tenant[]>>;
                 searchAll: (ids?: string[], names?: string[], selfProvisioningDomains?: string[], customAttributes?: Record<string, AttributesTypes>) => Promise<SdkResponse<Tenant[]>>;
+                getSettings: (tenantId: string) => Promise<SdkResponse<TenantSettings>>;
+                configureSettings: (tenantId: string, settings: TenantSettings) => Promise<SdkResponse<never>>;
+            };
+            ssoApplication: {
+                createOidcApplication: (options: OidcApplicationOptions) => Promise<SdkResponse<CreateSSOApplicationResponse>>;
+                createSamlApplication: (options: SamlApplicationOptions) => Promise<SdkResponse<CreateSSOApplicationResponse>>;
+                updateOidcApplication: (options: OidcApplicationOptions & {
+                    id: string;
+                }) => Promise<SdkResponse<never>>;
+                updateSamlApplication: (options: SamlApplicationOptions & {
+                    id: string;
+                }) => Promise<SdkResponse<never>>;
+                delete: (id: string) => Promise<SdkResponse<never>>;
+                load: (id: string) => Promise<SdkResponse<SSOApplication>>;
+                loadAll: () => Promise<SdkResponse<SSOApplication[]>>;
             };
             sso: {
                 getSettings: (tenantId: string) => Promise<SdkResponse<SSOSettingsResponse>>;
@@ -480,9 +735,14 @@ declare const nodeSdk: {
                 configureSettings: (tenantId: string, idpURL: string, idpCert: string, entityId: string, redirectURL: string, domains: string[]) => Promise<SdkResponse<never>>;
                 configureMetadata: (tenantId: string, idpMetadataURL: string, redirectURL: string, domains: string[]) => Promise<SdkResponse<never>>;
                 configureMapping: (tenantId: string, roleMappings?: RoleMappings, attributeMapping?: AttributeMapping) => Promise<SdkResponse<never>>;
+                configureOIDCSettings: (tenantId: string, settings: SSOOIDCSettings, domains?: string[]) => Promise<SdkResponse<never>>;
+                configureSAMLSettings: (tenantId: string, settings: SSOSAMLSettings, redirectUrl?: string, domains?: string[]) => Promise<SdkResponse<never>>;
+                configureSAMLByMetadata: (tenantId: string, settings: SSOSAMLByMetadataSettings, redirectUrl?: string, domains?: string[]) => Promise<SdkResponse<never>>;
+                loadSettings: (tenantId: string) => Promise<SdkResponse<SSOSettings>>;
             };
             jwt: {
                 update: (jwt: string, customClaims?: Record<string, any>) => Promise<SdkResponse<UpdateJWTResponse>>;
+                impersonate: (impersonatorId: string, loginId: string, validateConsent: boolean) => Promise<SdkResponse<UpdateJWTResponse>>;
             };
             permission: {
                 create: (name: string, description?: string) => Promise<SdkResponse<never>>;
@@ -490,11 +750,16 @@ declare const nodeSdk: {
                 delete: (name: string) => Promise<SdkResponse<never>>;
                 loadAll: () => Promise<SdkResponse<Permission[]>>;
             };
+            password: {
+                getSettings: (tenantId: string) => Promise<SdkResponse<PasswordSettings>>;
+                configureSettings: (tenantId: string, settings: PasswordSettings) => Promise<SdkResponse<never>>;
+            };
             role: {
-                create: (name: string, description?: string, permissionNames?: string[]) => Promise<SdkResponse<never>>;
-                update: (name: string, newName: string, description?: string, permissionNames?: string[]) => Promise<SdkResponse<never>>;
-                delete: (name: string) => Promise<SdkResponse<never>>;
+                create: (name: string, description?: string, permissionNames?: string[], tenantId?: string) => Promise<SdkResponse<never>>;
+                update: (name: string, newName: string, description?: string, permissionNames?: string[], tenantId?: string) => Promise<SdkResponse<never>>;
+                delete: (name: string, tenantId?: string) => Promise<SdkResponse<never>>;
                 loadAll: () => Promise<SdkResponse<Role[]>>;
+                search: (options: RoleSearchOptions) => Promise<SdkResponse<Role[]>>;
             };
             group: {
                 loadAllGroups: (tenantId: string) => Promise<SdkResponse<Group[]>>;
@@ -538,7 +803,7 @@ declare const nodeSdk: {
         validateSession: (sessionToken: string) => Promise<AuthenticationInfo>;
         refreshSession: (refreshToken: string) => Promise<AuthenticationInfo>;
         validateAndRefreshSession: (sessionToken?: string, refreshToken?: string) => Promise<AuthenticationInfo>;
-        exchangeAccessKey: (accessKey: string) => Promise<AuthenticationInfo>;
+        exchangeAccessKey: (accessKey: string, loginOptions?: AccessKeyLoginOptions) => Promise<AuthenticationInfo>;
         validatePermissions: (authInfo: AuthenticationInfo, permissions: string[]) => boolean;
         getMatchedPermissions: (authInfo: AuthenticationInfo, permissions: string[]) => string[];
         validateTenantPermissions: (authInfo: AuthenticationInfo, tenant: string, permissions: string[]) => boolean;
@@ -548,7 +813,7 @@ declare const nodeSdk: {
         validateTenantRoles: (authInfo: AuthenticationInfo, tenant: string, roles: string[]) => boolean;
         getMatchedTenantRoles: (authInfo: AuthenticationInfo, tenant: string, roles: string[]) => string[];
         accessKey: {
-            exchange: (accessKey: string) => Promise<SdkResponse<ExchangeAccessKeyResponse>>;
+            exchange: (accessKey: string, loginOptions?: AccessKeyLoginOptions) => Promise<SdkResponse<ExchangeAccessKeyResponse>>;
         };
         otp: {
             verify: {
@@ -845,6 +1110,8 @@ declare const nodeSdk: {
                 refreshJwt?: string;
                 cookies?: string[];
             }>>;
+            startNative: (provider: string, loginOptions?: _descope_core_js_sdk.LoginOptions) => Promise<SdkResponse<_descope_core_js_sdk.ResponseData>>;
+            finishNative: (provider: string, stateId: string, user?: string, code?: string, idToken?: string) => Promise<SdkResponse<_descope_core_js_sdk.ResponseData>>;
         };
         saml: {
             start: (tenantIdOrEmail: string, redirectUrl?: string, loginOptions?: _descope_core_js_sdk.LoginOptions, token?: string) => Promise<SdkResponse<_descope_core_js_sdk.URLResponse>>;
@@ -944,7 +1211,7 @@ declare const nodeSdk: {
                     webAuthnSupport?: boolean;
                 };
                 lastAuth?: {
-                    authMethod?: "otp" | "oauth" | "saml" | "totp" | "webauthn" | "magiclink" | "enchantedlink";
+                    authMethod?: "saml" | "otp" | "oauth" | "totp" | "webauthn" | "magiclink" | "enchantedlink";
                     oauthProvider?: string;
                     name?: string;
                     loginId?: string;
@@ -977,6 +1244,7 @@ declare const nodeSdk: {
         logout: (token?: string) => Promise<SdkResponse<never>>;
         logoutAll: (token?: string) => Promise<SdkResponse<never>>;
         me: (token?: string) => Promise<SdkResponse<_descope_core_js_sdk.UserResponse>>;
+        history: (token?: string) => Promise<SdkResponse<_descope_core_js_sdk.UserHistoryResponse>>;
         isJwtExpired: (token: string) => boolean;
         getTenants: (token: string) => string[];
         getJwtPermissions: (token: string, tenant?: string) => string[];

package/dist/index.esm.js

@@ -1,2 +1,2 @@
-import{__rest as e}from"tslib";import t,{transformResponse as s,wrapWith as a}from"@descope/core-js-sdk";import{jwtVerify as n,errors as o,importJWK as r}from"jose";import{deprecate as i}from"util";import{Headers as l,fetch as d}from"cross-fetch";const m=t=>async(...s)=>{var a,n,o;const r=await t(...s);if(!r.data)return r;let i=r.data,{refreshJwt:l}=i,d=e(i,["refreshJwt"]);const m=[];var p;return l?m.push(`${"DSR"}=${l}; Domain=${(null==(p=d)?void 0:p.cookieDomain)||""}; Max-Age=${(null==p?void 0:p.cookieMaxAge)||""}; Path=${(null==p?void 0:p.cookiePath)||"/"}; HttpOnly; SameSite=Strict`):(null===(a=r.response)||void 0===a?void 0:a.headers.get("set-cookie"))&&(l=((e,t)=>{const s=null==e?void 0:e.match(RegExp(`(?:^|;\\s*)${t}=([^;]*)`));return s?s[1]:null})(null===(n=r.response)||void 0===n?void 0:n.headers.get("set-cookie"),"DSR"),m.push(null===(o=r.response)||void 0===o?void 0:o.headers.get("set-cookie"))),Object.assign(Object.assign({},r),{data:Object.assign(Object.assign({},r.data),{refreshJwt:l,cookies:m})})};function p(e,t,s){var a,n;const o=s?null===(n=null===(a=e.token.tenants)||void 0===a?void 0:a[s])||void 0===n?void 0:n[t]:e.token[t];return Array.isArray(o)?o:[]}function c(e,t){var s;return!!(null===(s=e.token.tenants)||void 0===s?void 0:s[t])}var u={create:"/v1/mgmt/user/create",createBatch:"/v1/mgmt/user/create/batch",update:"/v1/mgmt/user/update",delete:"/v1/mgmt/user/delete",deleteAllTestUsers:"/v1/mgmt/user/test/delete/all",load:"/v1/mgmt/user",logout:"/v1/mgmt/user/logout",search:"/v1/mgmt/user/search",getProviderToken:"/v1/mgmt/user/provider/token",updateStatus:"/v1/mgmt/user/update/status",updateLoginId:"/v1/mgmt/user/update/loginid",updateEmail:"/v1/mgmt/user/update/email",updatePhone:"/v1/mgmt/user/update/phone",updateDisplayName:"/v1/mgmt/user/update/name",updatePicture:"/v1/mgmt/user/update/picture",updateCustomAttribute:"/v1/mgmt/user/update/customAttribute",setRole:"/v1/mgmt/user/update/role/set",addRole:"/v1/mgmt/user/update/role/add",removeRole:"/v1/mgmt/user/update/role/remove",addTenant:"/v1/mgmt/user/update/tenant/add",removeTenant:"/v1/mgmt/user/update/tenant/remove",setPassword:"/v1/mgmt/user/password/set",expirePassword:"/v1/mgmt/user/password/expire",removeAllPasskeys:"/v1/mgmt/user/passkeys/delete",generateOTPForTest:"/v1/mgmt/tests/generate/otp",generateMagicLinkForTest:"/v1/mgmt/tests/generate/magiclink",generateEnchantedLinkForTest:"/v1/mgmt/tests/generate/enchantedlink",generateEmbeddedLink:"/v1/mgmt/user/signin/embeddedlink"},g={updateName:"/v1/mgmt/project/update/name",clone:"/v1/mgmt/project/clone"},h={create:"/v1/mgmt/accesskey/create",load:"/v1/mgmt/accesskey",search:"/v1/mgmt/accesskey/search",update:"/v1/mgmt/accesskey/update",deactivate:"/v1/mgmt/accesskey/deactivate",activate:"/v1/mgmt/accesskey/activate",delete:"/v1/mgmt/accesskey/delete"},v={create:"/v1/mgmt/tenant/create",update:"/v1/mgmt/tenant/update",delete:"/v1/mgmt/tenant/delete",load:"/v1/mgmt/tenant",loadAll:"/v1/mgmt/tenant/all",searchAll:"/v1/mgmt/tenant/search"},k={settings:"/v1/mgmt/sso/settings",metadata:"/v1/mgmt/sso/metadata",mapping:"/v1/mgmt/sso/mapping"},f={update:"/v1/mgmt/jwt/update"},C={create:"/v1/mgmt/permission/create",update:"/v1/mgmt/permission/update",delete:"/v1/mgmt/permission/delete",loadAll:"/v1/mgmt/permission/all"},y={create:"/v1/mgmt/role/create",update:"/v1/mgmt/role/update",delete:"/v1/mgmt/role/delete",loadAll:"/v1/mgmt/role/all"},I={list:"/v1/mgmt/flow/list",delete:"/v1/mgmt/flow/delete",export:"/v1/mgmt/flow/export",import:"/v1/mgmt/flow/import"},w={export:"/v1/mgmt/theme/export",import:"/v1/mgmt/theme/import"},b={loadAllGroups:"/v1/mgmt/group/all",loadAllGroupsForMember:"/v1/mgmt/group/member/all",loadAllGroupMembers:"/v1/mgmt/group/members"},N={search:"/v1/mgmt/audit/search"},A={schemaSave:"/v1/mgmt/authz/schema/save",schemaDelete:"/v1/mgmt/authz/schema/delete",schemaLoad:"/v1/mgmt/authz/schema/load",nsSave:"/v1/mgmt/authz/ns/save",nsDelete:"/v1/mgmt/authz/ns/delete",rdSave:"/v1/mgmt/authz/rd/save",rdDelete:"/v1/mgmt/authz/rd/delete",reCreate:"/v1/mgmt/authz/re/create",reDelete:"/v1/mgmt/authz/re/delete",reDeleteResources:"/v1/mgmt/authz/re/deleteresources",hasRelations:"/v1/mgmt/authz/re/has",who:"/v1/mgmt/authz/re/who",resource:"/v1/mgmt/authz/re/resource",targets:"/v1/mgmt/authz/re/targets",targetAll:"/v1/mgmt/authz/re/targetall",getModified:"/v1/mgmt/authz/getmodified"};const T=(e,t)=>({create:function(a,n,o,r,i,l,d,m,p,c,g,h,v,k){const f="string"==typeof n?{loginId:a,email:n,phone:o,displayName:r,givenName:g,middleName:h,familyName:v,roleNames:i,userTenants:l,customAttributes:d,picture:m,verifiedEmail:p,verifiedPhone:c,additionalLoginIds:k}:Object.assign(Object.assign({loginId:a},n),{roleNames:n.roles,roles:void 0});return s(e.httpClient.post(u.create,f,{token:t}),(e=>e.user))},createTestUser:function(a,n,o,r,i,l,d,m,p,c,g,h,v,k){const f="string"==typeof n?{loginId:a,email:n,phone:o,displayName:r,givenName:g,middleName:h,familyName:v,roleNames:i,userTenants:l,customAttributes:d,picture:m,verifiedEmail:p,verifiedPhone:c,additionalLoginIds:k,test:!0}:Object.assign(Object.assign({loginId:a},n),{roleNames:n.roles,roles:void 0,test:!0});return s(e.httpClient.post(u.create,f,{token:t}),(e=>e.user))},invite:function(a,n,o,r,i,l,d,m,p,c,g,h,v,k,f,C,y){const I="string"==typeof n?{loginId:a,email:n,phone:o,displayName:r,givenName:k,middleName:f,familyName:C,roleNames:i,userTenants:l,invite:!0,customAttributes:d,picture:m,verifiedEmail:p,verifiedPhone:c,inviteUrl:g,sendMail:h,sendSMS:v,additionalLoginIds:y}:Object.assign(Object.assign({loginId:a},n),{roleNames:n.roles,roles:void 0,invite:!0});return s(e.httpClient.post(u.create,I,{token:t}),(e=>e.user))},inviteBatch:(a,n,o,r)=>s(e.httpClient.post(u.createBatch,{users:a,invite:!0,inviteUrl:n,sendMail:o,sendSMS:r},{token:t}),(e=>e)),update:function(a,n,o,r,i,l,d,m,p,c,g,h,v,k){const f="string"==typeof n?{loginId:a,email:n,phone:o,displayName:r,givenName:g,middleName:h,familyName:v,roleNames:i,userTenants:l,customAttributes:d,picture:m,verifiedEmail:p,verifiedPhone:c,additionalLoginIds:k}:Object.assign(Object.assign({loginId:a},n),{roleNames:n.roles,roles:void 0});return s(e.httpClient.post(u.update,f,{token:t}),(e=>e.user))},delete:a=>s(e.httpClient.post(u.delete,{loginId:a},{token:t})),deleteByUserId:a=>s(e.httpClient.post(u.delete,{userId:a},{token:t})),deleteAllTestUsers:()=>s(e.httpClient.delete(u.deleteAllTestUsers,{token:t})),load:a=>s(e.httpClient.get(u.load,{queryParams:{loginId:a},token:t}),(e=>e.user)),loadByUserId:a=>s(e.httpClient.get(u.load,{queryParams:{userId:a},token:t}),(e=>e.user)),logoutUser:a=>s(e.httpClient.post(u.logout,{loginId:a},{token:t})),logoutUserByUserId:a=>s(e.httpClient.post(u.logout,{userId:a},{token:t})),searchAll:i(((a,n,o,r,i,l,d,m,p,c)=>s(e.httpClient.post(u.search,{tenantIds:a,roleNames:n,limit:o,page:r,testUsersOnly:i,withTestUser:l,customAttributes:d,statuses:m,emails:p,phones:c},{token:t}),(e=>e.users))),"searchAll is deprecated please use search() instead"),search:a=>s(e.httpClient.post(u.search,Object.assign(Object.assign({},a),{roleNames:a.roles,roles:void 0}),{token:t}),(e=>e.users)),getProviderToken:(a,n)=>s(e.httpClient.get(u.getProviderToken,{queryParams:{loginId:a,provider:n},token:t}),(e=>e)),activate:a=>s(e.httpClient.post(u.updateStatus,{loginId:a,status:"enabled"},{token:t}),(e=>e.user)),deactivate:a=>s(e.httpClient.post(u.updateStatus,{loginId:a,status:"disabled"},{token:t}),(e=>e.user)),updateLoginId:(a,n)=>s(e.httpClient.post(u.updateLoginId,{loginId:a,newLoginId:n},{token:t}),(e=>e.user)),updateEmail:(a,n,o)=>s(e.httpClient.post(u.updateEmail,{loginId:a,email:n,verified:o},{token:t}),(e=>e.user)),updatePhone:(a,n,o)=>s(e.httpClient.post(u.updatePhone,{loginId:a,phone:n,verified:o},{token:t}),(e=>e.user)),updateDisplayName:(a,n,o,r,i)=>s(e.httpClient.post(u.updateDisplayName,{loginId:a,displayName:n,givenName:o,middleName:r,familyName:i},{token:t}),(e=>e.user)),updatePicture:(a,n)=>s(e.httpClient.post(u.updatePicture,{loginId:a,picture:n},{token:t}),(e=>e.user)),updateCustomAttribute:(a,n,o)=>s(e.httpClient.post(u.updateCustomAttribute,{loginId:a,attributeKey:n,attributeValue:o},{token:t}),(e=>e.user)),setRoles:(a,n)=>s(e.httpClient.post(u.setRole,{loginId:a,roleNames:n},{token:t}),(e=>e.user)),addRoles:(a,n)=>s(e.httpClient.post(u.addRole,{loginId:a,roleNames:n},{token:t}),(e=>e.user)),removeRoles:(a,n)=>s(e.httpClient.post(u.removeRole,{loginId:a,roleNames:n},{token:t}),(e=>e.user)),addTenant:(a,n)=>s(e.httpClient.post(u.addTenant,{loginId:a,tenantId:n},{token:t}),(e=>e.user)),removeTenant:(a,n)=>s(e.httpClient.post(u.removeTenant,{loginId:a,tenantId:n},{token:t}),(e=>e.user)),setTenantRoles:(a,n,o)=>s(e.httpClient.post(u.setRole,{loginId:a,tenantId:n,roleNames:o},{token:t}),(e=>e.user)),addTenantRoles:(a,n,o)=>s(e.httpClient.post(u.addRole,{loginId:a,tenantId:n,roleNames:o},{token:t}),(e=>e.user)),removeTenantRoles:(a,n,o)=>s(e.httpClient.post(u.removeRole,{loginId:a,tenantId:n,roleNames:o},{token:t}),(e=>e.user)),generateOTPForTestUser:(a,n,o)=>s(e.httpClient.post(u.generateOTPForTest,{deliveryMethod:a,loginId:n,loginOptions:o},{token:t}),(e=>e)),generateMagicLinkForTestUser:(a,n,o,r)=>s(e.httpClient.post(u.generateMagicLinkForTest,{deliveryMethod:a,loginId:n,URI:o,loginOptions:r},{token:t}),(e=>e)),generateEnchantedLinkForTestUser:(a,n,o)=>s(e.httpClient.post(u.generateEnchantedLinkForTest,{loginId:a,URI:n,loginOptions:o},{token:t}),(e=>e)),generateEmbeddedLink:(a,n)=>s(e.httpClient.post(u.generateEmbeddedLink,{loginId:a,customClaims:n},{token:t}),(e=>e)),setPassword:(a,n)=>s(e.httpClient.post(u.setPassword,{loginId:a,password:n},{token:t}),(e=>e)),expirePassword:a=>s(e.httpClient.post(u.expirePassword,{loginId:a},{token:t}),(e=>e)),removeAllPasskeys:a=>s(e.httpClient.post(u.removeAllPasskeys,{loginId:a},{token:t}),(e=>e))}),P=(e,t)=>({updateName:a=>s(e.httpClient.post(g.updateName,{name:a},{token:t})),clone:(a,n)=>s(e.httpClient.post(g.clone,{name:a,tag:n},{token:t}))}),R=(e,t)=>({create:(a,n,o)=>s(e.httpClient.post(v.create,{name:a,selfProvisioningDomains:n,customAttributes:o},{token:t})),createWithId:(a,n,o,r)=>s(e.httpClient.post(v.create,{id:a,name:n,selfProvisioningDomains:o,customAttributes:r},{token:t})),update:(a,n,o,r)=>s(e.httpClient.post(v.update,{id:a,name:n,selfProvisioningDomains:o,customAttributes:r},{token:t})),delete:a=>s(e.httpClient.post(v.delete,{id:a},{token:t})),load:a=>s(e.httpClient.get(v.load,{queryParams:{id:a},token:t}),(e=>e)),loadAll:()=>s(e.httpClient.get(v.loadAll,{token:t}),(e=>e.tenants)),searchAll:(a,n,o,r)=>s(e.httpClient.post(v.searchAll,{tenantIds:a,tenantNames:n,tenantSelfProvisioningDomains:o,customAttributes:r},{token:t}),(e=>e.tenants))}),j=(e,t)=>({update:(a,n)=>s(e.httpClient.post(f.update,{jwt:a,customClaims:n},{token:t}))}),E=(e,t)=>({create:(a,n)=>s(e.httpClient.post(C.create,{name:a,description:n},{token:t})),update:(a,n,o)=>s(e.httpClient.post(C.update,{name:a,newName:n,description:o},{token:t})),delete:a=>s(e.httpClient.post(C.delete,{name:a},{token:t})),loadAll:()=>s(e.httpClient.get(C.loadAll,{token:t}),(e=>e.permissions))}),O=(e,t)=>({create:(a,n,o)=>s(e.httpClient.post(y.create,{name:a,description:n,permissionNames:o},{token:t})),update:(a,n,o,r)=>s(e.httpClient.post(y.update,{name:a,newName:n,description:o,permissionNames:r},{token:t})),delete:a=>s(e.httpClient.post(y.delete,{name:a},{token:t})),loadAll:()=>s(e.httpClient.get(y.loadAll,{token:t}),(e=>e.roles))}),M=(e,t)=>({loadAllGroups:a=>s(e.httpClient.post(b.loadAllGroups,{tenantId:a},{token:t})),loadAllGroupsForMember:(a,n,o)=>s(e.httpClient.post(b.loadAllGroupsForMember,{tenantId:a,loginIds:o,userIds:n},{token:t})),loadAllGroupMembers:(a,n)=>s(e.httpClient.post(b.loadAllGroupMembers,{tenantId:a,groupId:n},{token:t}))}),S=(e,t)=>({getSettings:a=>s(e.httpClient.get(k.settings,{queryParams:{tenantId:a},token:t}),(e=>e)),deleteSettings:a=>s(e.httpClient.delete(k.settings,{queryParams:{tenantId:a},token:t})),configureSettings:(a,n,o,r,i,l)=>s(e.httpClient.post(k.settings,{tenantId:a,idpURL:n,entityId:r,idpCert:o,redirectURL:i,domains:l},{token:t})),configureMetadata:(a,n,o,r)=>s(e.httpClient.post(k.metadata,{tenantId:a,idpMetadataURL:n,redirectURL:o,domains:r},{token:t})),configureMapping:(a,n,o)=>s(e.httpClient.post(k.mapping,{tenantId:a,roleMappings:n,attributeMapping:o},{token:t}))}),x=(e,t)=>({create:(a,n,o,r)=>s(e.httpClient.post(h.create,{name:a,expireTime:n,roleNames:o,keyTenants:r},{token:t})),load:a=>s(e.httpClient.get(h.load,{queryParams:{id:a},token:t}),(e=>e.key)),searchAll:a=>s(e.httpClient.post(h.search,{tenantIds:a},{token:t}),(e=>e.keys)),update:(a,n)=>s(e.httpClient.post(h.update,{id:a,name:n},{token:t}),(e=>e.key)),deactivate:a=>s(e.httpClient.post(h.deactivate,{id:a},{token:t})),activate:a=>s(e.httpClient.post(h.activate,{id:a},{token:t})),delete:a=>s(e.httpClient.post(h.delete,{id:a},{token:t}))}),D=(e,t)=>({list:()=>s(e.httpClient.post(I.list,{},{token:t})),delete:a=>s(e.httpClient.post(I.delete,{ids:a},{token:t})),export:a=>s(e.httpClient.post(I.export,{flowId:a},{token:t})),import:(a,n,o)=>s(e.httpClient.post(I.import,{flowId:a,flow:n,screens:o},{token:t}))}),L=(e,t)=>({export:()=>s(e.httpClient.post(w.export,{},{token:t})),import:a=>s(e.httpClient.post(w.import,{theme:a},{token:t}))}),U=(e,t)=>({search:a=>{const n=Object.assign(Object.assign({},a),{externalIds:a.loginIds});return delete n.loginIds,s(e.httpClient.post(N.search,n,{token:t}),(e=>null==e?void 0:e.audits.map((e=>{const t=Object.assign(Object.assign({},e),{occurred:parseFloat(e.occurred),loginIds:e.externalIds});return delete t.externalIds,t}))))}}),F=(e,t)=>({saveSchema:(a,n)=>s(e.httpClient.post(A.schemaSave,{schema:a,upgrade:n},{token:t})),deleteSchema:()=>s(e.httpClient.post(A.schemaDelete,{},{token:t})),loadSchema:()=>s(e.httpClient.post(A.schemaLoad,{},{token:t}),(e=>e.schema)),saveNamespace:(a,n,o)=>s(e.httpClient.post(A.nsSave,{namespace:a,oldName:n,schemaName:o},{token:t})),deleteNamespace:(a,n)=>s(e.httpClient.post(A.nsDelete,{name:a,schemaName:n},{token:t})),saveRelationDefinition:(a,n,o,r)=>s(e.httpClient.post(A.rdSave,{relationDefinition:a,namespace:n,oldName:o,schemaName:r},{token:t})),deleteRelationDefinition:(a,n,o)=>s(e.httpClient.post(A.rdDelete,{name:a,namespace:n,schemaName:o},{token:t})),createRelations:a=>s(e.httpClient.post(A.reCreate,{relations:a},{token:t})),deleteRelations:a=>s(e.httpClient.post(A.reDelete,{relations:a},{token:t})),deleteRelationsForResources:a=>s(e.httpClient.post(A.reDeleteResources,{resources:a},{token:t})),hasRelations:a=>s(e.httpClient.post(A.hasRelations,{relationQueries:a},{token:t}),(e=>e.relationQueries)),whoCanAccess:(a,n,o)=>s(e.httpClient.post(A.who,{resource:a,relationDefinition:n,namespace:o},{token:t}),(e=>e.targets)),resourceRelations:a=>s(e.httpClient.post(A.resource,{resource:a},{token:t}),(e=>e.relations)),targetsRelations:a=>s(e.httpClient.post(A.targets,{targets:a},{token:t}),(e=>e.relations)),whatCanTargetAccess:a=>s(e.httpClient.post(A.targetAll,{target:a},{token:t}),(e=>e.relations)),getModified:a=>s(e.httpClient.post(A.getModified,{since:a?a.getTime():0},{token:t}),(e=>e))});var z;null!==(z=globalThis.Headers)&&void 0!==z||(globalThis.Headers=l);const $=(...e)=>(e.forEach((e=>{var t,s;e&&(null!==(t=(s=e).highWaterMark)&&void 0!==t||(s.highWaterMark=31457280))})),d(...e)),J={badRequest:"E011001",missingArguments:"E011002",invalidRequest:"E011003",invalidArguments:"E011004",wrongOTPCode:"E061102",tooManyOTPAttempts:"E061103",enchantedLinkPending:"E062503",userNotFound:"E062108"},q=s=>{var i,{managementKey:l,publicKey:d}=s,u=e(s,["managementKey","publicKey"]);const g=t(Object.assign(Object.assign({fetch:$},u),{baseHeaders:Object.assign(Object.assign({},u.baseHeaders),{"x-descope-sdk-name":"nodejs","x-descope-sdk-node-version":(null===(i=null===process||void 0===process?void 0:process.versions)||void 0===i?void 0:i.node)||"","x-descope-sdk-version":"1.6.3"})})),{projectId:h,logger:v}=u,k={},f=((e,t)=>({user:T(e,t),project:P(e,t),accessKey:x(e,t),tenant:R(e,t),sso:S(e,t),jwt:j(e,t),permission:E(e,t),role:O(e,t),group:M(e,t),flow:D(e,t),theme:L(e,t),audit:U(e,t),authz:F(e,t)}))(g,l),C=Object.assign(Object.assign({},g),{management:f,async getKey(e){if(!(null==e?void 0:e.kid))throw Error("header.kid must not be empty");if(k[e.kid])return k[e.kid];if(Object.assign(k,await(async()=>{if(d)try{const e=JSON.parse(d),t=await r(e);return{[e.kid]:t}}catch(e){throw null==v||v.error("Failed to parse the provided public key",e),new Error(`Failed to parse public key. Error: ${e}`)}const e=(await g.httpClient.get(`v2/keys/${h}`).then((e=>e.json()))).keys;return Array.isArray(e)?(await Promise.all(e.map((async e=>[e.kid,await r(e)])))).reduce(((e,[t,s])=>t?Object.assign(Object.assign({},e),{[t.toString()]:s}):e),{}):{}})()),!k[e.kid])throw Error("failed to fetch matching key");return k[e.kid]},async validateJwt(e){var t;const s=(await n(e,C.getKey,{clockTolerance:5})).payload;if(s&&(s.iss=null===(t=s.iss)||void 0===t?void 0:t.split("/").pop(),s.iss!==h))throw new o.JWTClaimValidationFailed('unexpected "iss" claim value',"iss","check_failed");return{jwt:e,token:s}},async validateSession(e){if(!e)throw Error("session token is required for validation");try{return await C.validateJwt(e)}catch(e){throw null==v||v.error("session validation failed",e),Error(`session validation failed. Error: ${e}`)}},async refreshSession(e){var t,s;if(!e)throw Error("refresh token is required to refresh a session");try{await C.validateJwt(e);const a=await C.refresh(e);if(a.ok){return await C.validateJwt(null===(t=a.data)||void 0===t?void 0:t.sessionJwt)}throw Error(null===(s=a.error)||void 0===s?void 0:s.errorMessage)}catch(e){throw null==v||v.error("refresh token validation failed",e),Error(`refresh token validation failed, Error: ${e}`)}},async validateAndRefreshSession(e,t){if(!e&&!t)throw Error("both session and refresh tokens are empty");try{return await C.validateSession(e)}catch(e){null==v||v.log(`session validation failed with error ${e} - trying to refresh it`)}return C.refreshSession(t)},async exchangeAccessKey(e){if(!e)throw Error("access key must not be empty");let t;try{t=await C.accessKey.exchange(e)}catch(e){throw null==v||v.error("failed to exchange access key",e),Error(`could not exchange access key - Failed to exchange. Error: ${e}`)}const{sessionJwt:s}=t.data;if(!s)throw null==v||v.error("failed to parse exchange access key response"),Error("could not exchange access key");try{return await C.validateJwt(s)}catch(e){throw null==v||v.error("failed to parse jwt from access key",e),Error(`could not exchange access key - failed to validate jwt. Error: ${e}`)}},validatePermissions:(e,t)=>C.validateTenantPermissions(e,"",t),getMatchedPermissions:(e,t)=>C.getMatchedTenantPermissions(e,"",t),validateTenantPermissions(e,t,s){if(t&&!c(e,t))return!1;const a=p(e,"permissions",t);return s.every((e=>a.includes(e)))},getMatchedTenantPermissions(e,t,s){if(t&&!c(e,t))return[];const a=p(e,"permissions",t);return s.filter((e=>a.includes(e)))},validateRoles:(e,t)=>C.validateTenantRoles(e,"",t),getMatchedRoles:(e,t)=>C.getMatchedTenantRoles(e,"",t),validateTenantRoles(e,t,s){if(t&&!c(e,t))return!1;const a=p(e,"roles",t);return s.every((e=>a.includes(e)))},getMatchedTenantRoles(e,t,s){if(t&&!c(e,t))return[];const a=p(e,"roles",t);return s.filter((e=>a.includes(e)))}});return a(C,["otp.verify.email","otp.verify.sms","otp.verify.whatsapp","magicLink.verify","enchantedLink.signUp","enchantedLink.signIn","oauth.exchange","saml.exchange","totp.verify","webauthn.signIn.finish","webauthn.signUp.finish","refresh"],m)};q.RefreshTokenCookieName="DSR",q.SessionTokenCookieName="DS";export{q as default,J as descopeErrors};
+import{__rest as e}from"tslib";import t,{transformResponse as s,wrapWith as a}from"@descope/core-js-sdk";import{jwtVerify as n,errors as o,importJWK as i}from"jose";import{deprecate as r}from"util";import{Headers as l,fetch as d}from"cross-fetch";const p=t=>async(...s)=>{var a,n,o;const i=await t(...s);if(!i.data)return i;let r=i.data,{refreshJwt:l}=r,d=e(r,["refreshJwt"]);const p=[];var m;return l?p.push(`${"DSR"}=${l}; Domain=${(null==(m=d)?void 0:m.cookieDomain)||""}; Max-Age=${(null==m?void 0:m.cookieMaxAge)||""}; Path=${(null==m?void 0:m.cookiePath)||"/"}; HttpOnly; SameSite=Strict`):(null===(a=i.response)||void 0===a?void 0:a.headers.get("set-cookie"))&&(l=((e,t)=>{const s=null==e?void 0:e.match(RegExp(`(?:^|;\\s*)${t}=([^;]*)`));return s?s[1]:null})(null===(n=i.response)||void 0===n?void 0:n.headers.get("set-cookie"),"DSR"),p.push(null===(o=i.response)||void 0===o?void 0:o.headers.get("set-cookie"))),Object.assign(Object.assign({},i),{data:Object.assign(Object.assign({},i.data),{refreshJwt:l,cookies:p})})};function m(e,t,s){var a,n;const o=s?null===(n=null===(a=e.token.tenants)||void 0===a?void 0:a[s])||void 0===n?void 0:n[t]:e.token[t];return Array.isArray(o)?o:[]}function g(e,t){var s;return!!(null===(s=e.token.tenants)||void 0===s?void 0:s[t])}var c={create:"/v1/mgmt/user/create",createBatch:"/v1/mgmt/user/create/batch",update:"/v1/mgmt/user/update",delete:"/v1/mgmt/user/delete",deleteAllTestUsers:"/v1/mgmt/user/test/delete/all",load:"/v1/mgmt/user",logout:"/v1/mgmt/user/logout",search:"/v1/mgmt/user/search",getProviderToken:"/v1/mgmt/user/provider/token",updateStatus:"/v1/mgmt/user/update/status",updateLoginId:"/v1/mgmt/user/update/loginid",updateEmail:"/v1/mgmt/user/update/email",updatePhone:"/v1/mgmt/user/update/phone",updateDisplayName:"/v1/mgmt/user/update/name",updatePicture:"/v1/mgmt/user/update/picture",updateCustomAttribute:"/v1/mgmt/user/update/customAttribute",setRole:"/v1/mgmt/user/update/role/set",addRole:"/v1/mgmt/user/update/role/add",removeRole:"/v1/mgmt/user/update/role/remove",setSSOApps:"/v1/mgmt/user/update/ssoapp/set",addSSOApps:"/v1/mgmt/user/update/ssoapp/add",removeSSOApps:"/v1/mgmt/user/update/ssoapp/remove",addTenant:"/v1/mgmt/user/update/tenant/add",removeTenant:"/v1/mgmt/user/update/tenant/remove",setPassword:"/v1/mgmt/user/password/set",setTemporaryPassword:"/v1/mgmt/user/password/set/temporary",setActivePassword:"/v1/mgmt/user/password/set/active",expirePassword:"/v1/mgmt/user/password/expire",removeAllPasskeys:"/v1/mgmt/user/passkeys/delete",generateOTPForTest:"/v1/mgmt/tests/generate/otp",generateMagicLinkForTest:"/v1/mgmt/tests/generate/magiclink",generateEnchantedLinkForTest:"/v1/mgmt/tests/generate/enchantedlink",generateEmbeddedLink:"/v1/mgmt/user/signin/embeddedlink",history:"/v1/mgmt/user/history"},u={updateName:"/v1/mgmt/project/update/name",clone:"/v1/mgmt/project/clone",export:"/v1/mgmt/project/export",import:"/v1/mgmt/project/import"},h={create:"/v1/mgmt/accesskey/create",load:"/v1/mgmt/accesskey",search:"/v1/mgmt/accesskey/search",update:"/v1/mgmt/accesskey/update",deactivate:"/v1/mgmt/accesskey/deactivate",activate:"/v1/mgmt/accesskey/activate",delete:"/v1/mgmt/accesskey/delete"},v={create:"/v1/mgmt/tenant/create",update:"/v1/mgmt/tenant/update",delete:"/v1/mgmt/tenant/delete",load:"/v1/mgmt/tenant",settings:"/v1/mgmt/tenant/settings",loadAll:"/v1/mgmt/tenant/all",searchAll:"/v1/mgmt/tenant/search"},k={oidcCreate:"/v1/mgmt/sso/idp/app/oidc/create",samlCreate:"/v1/mgmt/sso/idp/app/saml/create",oidcUpdate:"/v1/mgmt/sso/idp/app/oidc/update",samlUpdate:"/v1/mgmt/sso/idp/app/saml/update",delete:"/v1/mgmt/sso/idp/app/delete",load:"/v1/mgmt/sso/idp/app/load",loadAll:"/v1/mgmt/sso/idp/apps/load"},C={settings:"/v1/mgmt/sso/settings",metadata:"/v1/mgmt/sso/metadata",mapping:"/v1/mgmt/sso/mapping",settingsv2:"/v2/mgmt/sso/settings",oidc:{configure:"/v1/mgmt/sso/oidc"},saml:{configure:"/v1/mgmt/sso/saml",metadata:"/v1/mgmt/sso/saml/metadata"}},f={update:"/v1/mgmt/jwt/update",impersonate:"/v1/mgmt/impersonate"},y={settings:"/v1/mgmt/password/settings"},I={create:"/v1/mgmt/permission/create",update:"/v1/mgmt/permission/update",delete:"/v1/mgmt/permission/delete",loadAll:"/v1/mgmt/permission/all"},b={create:"/v1/mgmt/role/create",update:"/v1/mgmt/role/update",delete:"/v1/mgmt/role/delete",loadAll:"/v1/mgmt/role/all",search:"/v1/mgmt/role/search"},w={list:"/v1/mgmt/flow/list",delete:"/v1/mgmt/flow/delete",export:"/v1/mgmt/flow/export",import:"/v1/mgmt/flow/import"},A={export:"/v1/mgmt/theme/export",import:"/v1/mgmt/theme/import"},S={loadAllGroups:"/v1/mgmt/group/all",loadAllGroupsForMember:"/v1/mgmt/group/member/all",loadAllGroupMembers:"/v1/mgmt/group/members"},O={search:"/v1/mgmt/audit/search"},N={schemaSave:"/v1/mgmt/authz/schema/save",schemaDelete:"/v1/mgmt/authz/schema/delete",schemaLoad:"/v1/mgmt/authz/schema/load",nsSave:"/v1/mgmt/authz/ns/save",nsDelete:"/v1/mgmt/authz/ns/delete",rdSave:"/v1/mgmt/authz/rd/save",rdDelete:"/v1/mgmt/authz/rd/delete",reCreate:"/v1/mgmt/authz/re/create",reDelete:"/v1/mgmt/authz/re/delete",reDeleteResources:"/v1/mgmt/authz/re/deleteresources",hasRelations:"/v1/mgmt/authz/re/has",who:"/v1/mgmt/authz/re/who",resource:"/v1/mgmt/authz/re/resource",targets:"/v1/mgmt/authz/re/targets",targetAll:"/v1/mgmt/authz/re/targetall",getModified:"/v1/mgmt/authz/getmodified"};const P=(e,t)=>({create:function(a,n,o,i,r,l,d,p,m,g,u,h,v,k){const C="string"==typeof n?{loginId:a,email:n,phone:o,displayName:i,givenName:u,middleName:h,familyName:v,roleNames:r,userTenants:l,customAttributes:d,picture:p,verifiedEmail:m,verifiedPhone:g,additionalLoginIds:k}:Object.assign(Object.assign({loginId:a},n),{roleNames:null==n?void 0:n.roles,roles:void 0});return s(e.httpClient.post(c.create,C,{token:t}),(e=>e.user))},createTestUser:function(a,n,o,i,r,l,d,p,m,g,u,h,v,k){const C="string"==typeof n?{loginId:a,email:n,phone:o,displayName:i,givenName:u,middleName:h,familyName:v,roleNames:r,userTenants:l,customAttributes:d,picture:p,verifiedEmail:m,verifiedPhone:g,additionalLoginIds:k,test:!0}:Object.assign(Object.assign({loginId:a},n),{roleNames:null==n?void 0:n.roles,roles:void 0,test:!0});return s(e.httpClient.post(c.create,C,{token:t}),(e=>e.user))},invite:function(a,n,o,i,r,l,d,p,m,g,u,h,v,k,C,f,y){const I="string"==typeof n?{loginId:a,email:n,phone:o,displayName:i,givenName:k,middleName:C,familyName:f,roleNames:r,userTenants:l,invite:!0,customAttributes:d,picture:p,verifiedEmail:m,verifiedPhone:g,inviteUrl:u,sendMail:h,sendSMS:v,additionalLoginIds:y}:Object.assign(Object.assign({loginId:a},n),{roleNames:null==n?void 0:n.roles,roles:void 0,invite:!0});return s(e.httpClient.post(c.create,I,{token:t}),(e=>e.user))},inviteBatch:(a,n,o,i)=>s(e.httpClient.post(c.createBatch,{users:a,invite:!0,inviteUrl:n,sendMail:o,sendSMS:i},{token:t}),(e=>e)),update:function(a,n,o,i,r,l,d,p,m,g,u,h,v,k){const C="string"==typeof n?{loginId:a,email:n,phone:o,displayName:i,givenName:u,middleName:h,familyName:v,roleNames:r,userTenants:l,customAttributes:d,picture:p,verifiedEmail:m,verifiedPhone:g,additionalLoginIds:k}:Object.assign(Object.assign({loginId:a},n),{roleNames:null==n?void 0:n.roles,roles:void 0});return s(e.httpClient.post(c.update,C,{token:t}),(e=>e.user))},delete:a=>s(e.httpClient.post(c.delete,{loginId:a},{token:t})),deleteByUserId:a=>s(e.httpClient.post(c.delete,{userId:a},{token:t})),deleteAllTestUsers:()=>s(e.httpClient.delete(c.deleteAllTestUsers,{token:t})),load:a=>s(e.httpClient.get(c.load,{queryParams:{loginId:a},token:t}),(e=>e.user)),loadByUserId:a=>s(e.httpClient.get(c.load,{queryParams:{userId:a},token:t}),(e=>e.user)),logoutUser:a=>s(e.httpClient.post(c.logout,{loginId:a},{token:t})),logoutUserByUserId:a=>s(e.httpClient.post(c.logout,{userId:a},{token:t})),searchAll:r(((a,n,o,i,r,l,d,p,m,g)=>s(e.httpClient.post(c.search,{tenantIds:a,roleNames:n,limit:o,page:i,testUsersOnly:r,withTestUser:l,customAttributes:d,statuses:p,emails:m,phones:g},{token:t}),(e=>e.users))),"searchAll is deprecated please use search() instead"),search:a=>s(e.httpClient.post(c.search,Object.assign(Object.assign({},a),{roleNames:a.roles,roles:void 0}),{token:t}),(e=>e.users)),getProviderToken:(a,n)=>s(e.httpClient.get(c.getProviderToken,{queryParams:{loginId:a,provider:n},token:t}),(e=>e)),activate:a=>s(e.httpClient.post(c.updateStatus,{loginId:a,status:"enabled"},{token:t}),(e=>e.user)),deactivate:a=>s(e.httpClient.post(c.updateStatus,{loginId:a,status:"disabled"},{token:t}),(e=>e.user)),updateLoginId:(a,n)=>s(e.httpClient.post(c.updateLoginId,{loginId:a,newLoginId:n},{token:t}),(e=>e.user)),updateEmail:(a,n,o)=>s(e.httpClient.post(c.updateEmail,{loginId:a,email:n,verified:o},{token:t}),(e=>e.user)),updatePhone:(a,n,o)=>s(e.httpClient.post(c.updatePhone,{loginId:a,phone:n,verified:o},{token:t}),(e=>e.user)),updateDisplayName:(a,n,o,i,r)=>s(e.httpClient.post(c.updateDisplayName,{loginId:a,displayName:n,givenName:o,middleName:i,familyName:r},{token:t}),(e=>e.user)),updatePicture:(a,n)=>s(e.httpClient.post(c.updatePicture,{loginId:a,picture:n},{token:t}),(e=>e.user)),updateCustomAttribute:(a,n,o)=>s(e.httpClient.post(c.updateCustomAttribute,{loginId:a,attributeKey:n,attributeValue:o},{token:t}),(e=>e.user)),setRoles:(a,n)=>s(e.httpClient.post(c.setRole,{loginId:a,roleNames:n},{token:t}),(e=>e.user)),addRoles:(a,n)=>s(e.httpClient.post(c.addRole,{loginId:a,roleNames:n},{token:t}),(e=>e.user)),removeRoles:(a,n)=>s(e.httpClient.post(c.removeRole,{loginId:a,roleNames:n},{token:t}),(e=>e.user)),addTenant:(a,n)=>s(e.httpClient.post(c.addTenant,{loginId:a,tenantId:n},{token:t}),(e=>e.user)),removeTenant:(a,n)=>s(e.httpClient.post(c.removeTenant,{loginId:a,tenantId:n},{token:t}),(e=>e.user)),setTenantRoles:(a,n,o)=>s(e.httpClient.post(c.setRole,{loginId:a,tenantId:n,roleNames:o},{token:t}),(e=>e.user)),addTenantRoles:(a,n,o)=>s(e.httpClient.post(c.addRole,{loginId:a,tenantId:n,roleNames:o},{token:t}),(e=>e.user)),removeTenantRoles:(a,n,o)=>s(e.httpClient.post(c.removeRole,{loginId:a,tenantId:n,roleNames:o},{token:t}),(e=>e.user)),addSSOapps:(a,n)=>s(e.httpClient.post(c.addSSOApps,{loginId:a,ssoAppIds:n},{token:t}),(e=>e.user)),setSSOapps:(a,n)=>s(e.httpClient.post(c.setSSOApps,{loginId:a,ssoAppIds:n},{token:t}),(e=>e.user)),removeSSOapps:(a,n)=>s(e.httpClient.post(c.removeSSOApps,{loginId:a,ssoAppIds:n},{token:t}),(e=>e.user)),generateOTPForTestUser:(a,n,o)=>s(e.httpClient.post(c.generateOTPForTest,{deliveryMethod:a,loginId:n,loginOptions:o},{token:t}),(e=>e)),generateMagicLinkForTestUser:(a,n,o,i)=>s(e.httpClient.post(c.generateMagicLinkForTest,{deliveryMethod:a,loginId:n,URI:o,loginOptions:i},{token:t}),(e=>e)),generateEnchantedLinkForTestUser:(a,n,o)=>s(e.httpClient.post(c.generateEnchantedLinkForTest,{loginId:a,URI:n,loginOptions:o},{token:t}),(e=>e)),generateEmbeddedLink:(a,n)=>s(e.httpClient.post(c.generateEmbeddedLink,{loginId:a,customClaims:n},{token:t}),(e=>e)),setTemporaryPassword:(a,n)=>s(e.httpClient.post(c.setTemporaryPassword,{loginId:a,password:n},{token:t}),(e=>e)),setActivePassword:(a,n)=>s(e.httpClient.post(c.setActivePassword,{loginId:a,password:n},{token:t}),(e=>e)),setPassword:(a,n)=>s(e.httpClient.post(c.setPassword,{loginId:a,password:n},{token:t}),(e=>e)),expirePassword:a=>s(e.httpClient.post(c.expirePassword,{loginId:a},{token:t}),(e=>e)),removeAllPasskeys:a=>s(e.httpClient.post(c.removeAllPasskeys,{loginId:a},{token:t}),(e=>e)),history:a=>s(e.httpClient.post(c.history,a,{token:t}),(e=>e))}),j=(e,t)=>({updateName:a=>s(e.httpClient.post(u.updateName,{name:a},{token:t})),clone:(a,n)=>s(e.httpClient.post(u.clone,{name:a,tag:n},{token:t})),export:()=>s(e.httpClient.post(u.export,{},{token:t}),(e=>e.files)),import:a=>s(e.httpClient.post(u.export,{files:a},{token:t}))}),T=(e,t)=>({create:(a,n,o)=>s(e.httpClient.post(v.create,{name:a,selfProvisioningDomains:n,customAttributes:o},{token:t})),createWithId:(a,n,o,i)=>s(e.httpClient.post(v.create,{id:a,name:n,selfProvisioningDomains:o,customAttributes:i},{token:t})),update:(a,n,o,i)=>s(e.httpClient.post(v.update,{id:a,name:n,selfProvisioningDomains:o,customAttributes:i},{token:t})),delete:a=>s(e.httpClient.post(v.delete,{id:a},{token:t})),load:a=>s(e.httpClient.get(v.load,{queryParams:{id:a},token:t}),(e=>e)),loadAll:()=>s(e.httpClient.get(v.loadAll,{token:t}),(e=>e.tenants)),searchAll:(a,n,o,i)=>s(e.httpClient.post(v.searchAll,{tenantIds:a,tenantNames:n,tenantSelfProvisioningDomains:o,customAttributes:i},{token:t}),(e=>e.tenants)),getSettings:a=>s(e.httpClient.get(v.settings,{queryParams:{id:a},token:t}),(e=>e)),configureSettings:(a,n)=>s(e.httpClient.post(v.settings,Object.assign(Object.assign({},n),{tenantId:a}),{token:t}))}),M=(e,t)=>({update:(a,n)=>s(e.httpClient.post(f.update,{jwt:a,customClaims:n},{token:t})),impersonate:(a,n,o)=>s(e.httpClient.post(f.impersonate,{impersonatorId:a,loginId:n,validateConsent:o},{token:t}))}),R=(e,t)=>({create:(a,n)=>s(e.httpClient.post(I.create,{name:a,description:n},{token:t})),update:(a,n,o)=>s(e.httpClient.post(I.update,{name:a,newName:n,description:o},{token:t})),delete:a=>s(e.httpClient.post(I.delete,{name:a},{token:t})),loadAll:()=>s(e.httpClient.get(I.loadAll,{token:t}),(e=>e.permissions))}),E=(e,t)=>({create:(a,n,o,i)=>s(e.httpClient.post(b.create,{name:a,description:n,permissionNames:o,tenantId:i},{token:t})),update:(a,n,o,i,r)=>s(e.httpClient.post(b.update,{name:a,newName:n,description:o,permissionNames:i,tenantId:r},{token:t})),delete:(a,n)=>s(e.httpClient.post(b.delete,{name:a,tenantId:n},{token:t})),loadAll:()=>s(e.httpClient.get(b.loadAll,{token:t}),(e=>e.roles)),search:a=>s(e.httpClient.post(b.search,a,{token:t}),(e=>e.roles))}),x=(e,t)=>({loadAllGroups:a=>s(e.httpClient.post(S.loadAllGroups,{tenantId:a},{token:t})),loadAllGroupsForMember:(a,n,o)=>s(e.httpClient.post(S.loadAllGroupsForMember,{tenantId:a,loginIds:o,userIds:n},{token:t})),loadAllGroupMembers:(a,n)=>s(e.httpClient.post(S.loadAllGroupMembers,{tenantId:a,groupId:n},{token:t}))}),L=(e,t)=>({getSettings:r((a=>s(e.httpClient.get(C.settings,{queryParams:{tenantId:a},token:t}),(e=>e))),"getSettings is deprecated, please use loadSettings instead"),deleteSettings:a=>s(e.httpClient.delete(C.settings,{queryParams:{tenantId:a},token:t})),configureSettings:r(((a,n,o,i,r,l)=>s(e.httpClient.post(C.settings,{tenantId:a,idpURL:n,entityId:i,idpCert:o,redirectURL:r,domains:l},{token:t}))),"configureSettings is deprecated, please use configureSAMLSettings instead "),configureMetadata:r(((a,n,o,i)=>s(e.httpClient.post(C.metadata,{tenantId:a,idpMetadataURL:n,redirectURL:o,domains:i},{token:t}))),"configureMetadata is deprecated, please use configureSAMLByMetadata instead"),configureMapping:(a,n,o)=>s(e.httpClient.post(C.mapping,{tenantId:a,roleMappings:n,attributeMapping:o},{token:t})),configureOIDCSettings:(a,n,o)=>{const i=Object.assign(Object.assign({},n),{userAttrMapping:n.attributeMapping});return delete i.attributeMapping,s(e.httpClient.post(C.oidc.configure,{tenantId:a,settings:i,domains:o},{token:t}))},configureSAMLSettings:(a,n,o,i)=>s(e.httpClient.post(C.saml.configure,{tenantId:a,settings:n,redirectUrl:o,domains:i},{token:t})),configureSAMLByMetadata:(a,n,o,i)=>s(e.httpClient.post(C.saml.metadata,{tenantId:a,settings:n,redirectUrl:o,domains:i},{token:t})),loadSettings:a=>s(e.httpClient.get(C.settingsv2,{queryParams:{tenantId:a},token:t}),(e=>{var t,s;const a=e;return a.oidc&&(a.oidc=Object.assign(Object.assign({},a.oidc),{attributeMapping:a.oidc.userAttrMapping}),delete a.oidc.userAttrMapping),(null===(t=a.saml)||void 0===t?void 0:t.groupsMapping)&&(a.saml.groupsMapping=null===(s=a.saml)||void 0===s?void 0:s.groupsMapping.map((e=>{const t=e;return t.roleName=t.role.name,delete t.role,t}))),a}))}),U=(e,t)=>({create:(a,n,o,i,r,l)=>s(e.httpClient.post(h.create,{name:a,expireTime:n,roleNames:o,keyTenants:i,userId:r,customClaims:l},{token:t})),load:a=>s(e.httpClient.get(h.load,{queryParams:{id:a},token:t}),(e=>e.key)),searchAll:a=>s(e.httpClient.post(h.search,{tenantIds:a},{token:t}),(e=>e.keys)),update:(a,n)=>s(e.httpClient.post(h.update,{id:a,name:n},{token:t}),(e=>e.key)),deactivate:a=>s(e.httpClient.post(h.deactivate,{id:a},{token:t})),activate:a=>s(e.httpClient.post(h.activate,{id:a},{token:t})),delete:a=>s(e.httpClient.post(h.delete,{id:a},{token:t}))}),D=(e,t)=>({list:()=>s(e.httpClient.post(w.list,{},{token:t})),delete:a=>s(e.httpClient.post(w.delete,{ids:a},{token:t})),export:a=>s(e.httpClient.post(w.export,{flowId:a},{token:t})),import:(a,n,o)=>s(e.httpClient.post(w.import,{flowId:a,flow:n,screens:o},{token:t}))}),F=(e,t)=>({export:()=>s(e.httpClient.post(A.export,{},{token:t})),import:a=>s(e.httpClient.post(A.import,{theme:a},{token:t}))}),z=(e,t)=>({search:a=>{const n=Object.assign(Object.assign({},a),{externalIds:a.loginIds});return delete n.loginIds,s(e.httpClient.post(O.search,n,{token:t}),(e=>null==e?void 0:e.audits.map((e=>{const t=Object.assign(Object.assign({},e),{occurred:parseFloat(e.occurred),loginIds:e.externalIds});return delete t.externalIds,t}))))}}),q=(e,t)=>({saveSchema:(a,n)=>s(e.httpClient.post(N.schemaSave,{schema:a,upgrade:n},{token:t})),deleteSchema:()=>s(e.httpClient.post(N.schemaDelete,{},{token:t})),loadSchema:()=>s(e.httpClient.post(N.schemaLoad,{},{token:t}),(e=>e.schema)),saveNamespace:(a,n,o)=>s(e.httpClient.post(N.nsSave,{namespace:a,oldName:n,schemaName:o},{token:t})),deleteNamespace:(a,n)=>s(e.httpClient.post(N.nsDelete,{name:a,schemaName:n},{token:t})),saveRelationDefinition:(a,n,o,i)=>s(e.httpClient.post(N.rdSave,{relationDefinition:a,namespace:n,oldName:o,schemaName:i},{token:t})),deleteRelationDefinition:(a,n,o)=>s(e.httpClient.post(N.rdDelete,{name:a,namespace:n,schemaName:o},{token:t})),createRelations:a=>s(e.httpClient.post(N.reCreate,{relations:a},{token:t})),deleteRelations:a=>s(e.httpClient.post(N.reDelete,{relations:a},{token:t})),deleteRelationsForResources:a=>s(e.httpClient.post(N.reDeleteResources,{resources:a},{token:t})),hasRelations:a=>s(e.httpClient.post(N.hasRelations,{relationQueries:a},{token:t}),(e=>e.relationQueries)),whoCanAccess:(a,n,o)=>s(e.httpClient.post(N.who,{resource:a,relationDefinition:n,namespace:o},{token:t}),(e=>e.targets)),resourceRelations:a=>s(e.httpClient.post(N.resource,{resource:a},{token:t}),(e=>e.relations)),targetsRelations:a=>s(e.httpClient.post(N.targets,{targets:a},{token:t}),(e=>e.relations)),whatCanTargetAccess:a=>s(e.httpClient.post(N.targetAll,{target:a},{token:t}),(e=>e.relations)),getModified:a=>s(e.httpClient.post(N.getModified,{since:a?a.getTime():0},{token:t}),(e=>e))}),$=(e,t)=>({createOidcApplication:a=>{var n;return s(e.httpClient.post(k.oidcCreate,Object.assign(Object.assign({},a),{enabled:null===(n=a.enabled)||void 0===n||n}),{token:t}))},createSamlApplication:a=>{var n;return s(e.httpClient.post(k.samlCreate,Object.assign(Object.assign({},a),{enabled:null===(n=a.enabled)||void 0===n||n}),{token:t}))},updateOidcApplication:a=>s(e.httpClient.post(k.oidcUpdate,Object.assign({},a),{token:t})),updateSamlApplication:a=>s(e.httpClient.post(k.samlUpdate,Object.assign({},a),{token:t})),delete:a=>s(e.httpClient.post(k.delete,{id:a},{token:t})),load:a=>s(e.httpClient.get(k.load,{queryParams:{id:a},token:t}),(e=>e)),loadAll:()=>s(e.httpClient.get(k.loadAll,{token:t}),(e=>e.apps))}),J=(e,t)=>({getSettings:a=>s(e.httpClient.get(y.settings,{queryParams:{tenantId:a},token:t}),(e=>e)),configureSettings:(a,n)=>s(e.httpClient.post(y.settings,Object.assign(Object.assign({},n),{tenantId:a}),{token:t}))});var K;null!==(K=globalThis.Headers)&&void 0!==K||(globalThis.Headers=l);const G=(...e)=>(e.forEach((e=>{var t,s;e&&(null!==(t=(s=e).highWaterMark)&&void 0!==t||(s.highWaterMark=31457280))})),d(...e)),B={badRequest:"E011001",missingArguments:"E011002",invalidRequest:"E011003",invalidArguments:"E011004",wrongOTPCode:"E061102",tooManyOTPAttempts:"E061103",enchantedLinkPending:"E062503",userNotFound:"E062108"},H=s=>{var r,{managementKey:l,publicKey:d}=s,c=e(s,["managementKey","publicKey"]);const u=t(Object.assign(Object.assign({fetch:G},c),{baseHeaders:Object.assign(Object.assign({},c.baseHeaders),{"x-descope-sdk-name":"nodejs","x-descope-sdk-node-version":(null===(r=null===process||void 0===process?void 0:process.versions)||void 0===r?void 0:r.node)||"","x-descope-sdk-version":"1.6.5"})})),{projectId:h,logger:v}=c,k={},C=((e,t)=>({user:P(e,t),project:j(e,t),accessKey:U(e,t),tenant:T(e,t),ssoApplication:$(e,t),sso:L(e,t),jwt:M(e,t),permission:R(e,t),password:J(e,t),role:E(e,t),group:x(e,t),flow:D(e,t),theme:F(e,t),audit:z(e,t),authz:q(e,t)}))(u,l),f=Object.assign(Object.assign({},u),{management:C,async getKey(e){if(!(null==e?void 0:e.kid))throw Error("header.kid must not be empty");if(k[e.kid])return k[e.kid];if(Object.assign(k,await(async()=>{if(d)try{const e=JSON.parse(d),t=await i(e);return{[e.kid]:t}}catch(e){throw null==v||v.error("Failed to parse the provided public key",e),new Error(`Failed to parse public key. Error: ${e}`)}const e=(await u.httpClient.get(`v2/keys/${h}`).then((e=>e.json()))).keys;return Array.isArray(e)?(await Promise.all(e.map((async e=>[e.kid,await i(e)])))).reduce(((e,[t,s])=>t?Object.assign(Object.assign({},e),{[t.toString()]:s}):e),{}):{}})()),!k[e.kid])throw Error("failed to fetch matching key");return k[e.kid]},async validateJwt(e){var t;const s=(await n(e,f.getKey,{clockTolerance:5})).payload;if(s&&(s.iss=null===(t=s.iss)||void 0===t?void 0:t.split("/").pop(),s.iss!==h))throw new o.JWTClaimValidationFailed('unexpected "iss" claim value',"iss","check_failed");return{jwt:e,token:s}},async validateSession(e){if(!e)throw Error("session token is required for validation");try{return await f.validateJwt(e)}catch(e){throw null==v||v.error("session validation failed",e),Error(`session validation failed. Error: ${e}`)}},async refreshSession(e){var t,s;if(!e)throw Error("refresh token is required to refresh a session");try{await f.validateJwt(e);const a=await f.refresh(e);if(a.ok){return await f.validateJwt(null===(t=a.data)||void 0===t?void 0:t.sessionJwt)}throw Error(null===(s=a.error)||void 0===s?void 0:s.errorMessage)}catch(e){throw null==v||v.error("refresh token validation failed",e),Error(`refresh token validation failed, Error: ${e}`)}},async validateAndRefreshSession(e,t){if(!e&&!t)throw Error("both session and refresh tokens are empty");try{return await f.validateSession(e)}catch(e){null==v||v.log(`session validation failed with error ${e} - trying to refresh it`)}return f.refreshSession(t)},async exchangeAccessKey(e,t){if(!e)throw Error("access key must not be empty");let s;try{s=await f.accessKey.exchange(e,t)}catch(e){throw null==v||v.error("failed to exchange access key",e),Error(`could not exchange access key - Failed to exchange. Error: ${e}`)}const{sessionJwt:a}=s.data;if(!a)throw null==v||v.error("failed to parse exchange access key response"),Error("could not exchange access key");try{return await f.validateJwt(a)}catch(e){throw null==v||v.error("failed to parse jwt from access key",e),Error(`could not exchange access key - failed to validate jwt. Error: ${e}`)}},validatePermissions:(e,t)=>f.validateTenantPermissions(e,"",t),getMatchedPermissions:(e,t)=>f.getMatchedTenantPermissions(e,"",t),validateTenantPermissions(e,t,s){if(t&&!g(e,t))return!1;const a=m(e,"permissions",t);return s.every((e=>a.includes(e)))},getMatchedTenantPermissions(e,t,s){if(t&&!g(e,t))return[];const a=m(e,"permissions",t);return s.filter((e=>a.includes(e)))},validateRoles:(e,t)=>f.validateTenantRoles(e,"",t),getMatchedRoles:(e,t)=>f.getMatchedTenantRoles(e,"",t),validateTenantRoles(e,t,s){if(t&&!g(e,t))return!1;const a=m(e,"roles",t);return s.every((e=>a.includes(e)))},getMatchedTenantRoles(e,t,s){if(t&&!g(e,t))return[];const a=m(e,"roles",t);return s.filter((e=>a.includes(e)))}});return a(f,["otp.verify.email","otp.verify.sms","otp.verify.whatsapp","magicLink.verify","enchantedLink.signUp","enchantedLink.signIn","oauth.exchange","saml.exchange","totp.verify","webauthn.signIn.finish","webauthn.signUp.finish","refresh"],p)};H.RefreshTokenCookieName="DSR",H.SessionTokenCookieName="DS";export{H as default,B as descopeErrors};
 //# sourceMappingURL=index.esm.js.map