@memberjunction/auth-providers 6.1.0-edge.2 → 6.1.0-edge.3

package/src/providers/Auth0Provider.ts

@@ -12,6 +12,28 @@ export class Auth0Provider extends BaseAuthProvider {
     super(config);
   }
 
+  /**
+   * Configures Auth0 from AUTH0_DOMAIN + AUTH0_CLIENT_ID (AUTH0_CLIENT_SECRET optional).
+   *
+   * Mapping preserved byte-for-byte from the env block that previously lived in MJServer's
+   * config, so a deployment upgrading to the hook-based discovery sees no change.
+   */
+  static ConfigFromEnvironment(env: NodeJS.ProcessEnv): AuthProviderConfig | null {
+    if (!env.AUTH0_DOMAIN || !env.AUTH0_CLIENT_ID) {
+      return null;
+    }
+    return {
+      name: 'auth0',
+      type: 'auth0',
+      issuer: `https://${env.AUTH0_DOMAIN}/`,
+      audience: env.AUTH0_CLIENT_ID,
+      jwksUri: `https://${env.AUTH0_DOMAIN}/.well-known/jwks.json`,
+      clientId: env.AUTH0_CLIENT_ID,
+      clientSecret: env.AUTH0_CLIENT_SECRET,
+      domain: env.AUTH0_DOMAIN
+    };
+  }
+
   /**
    * Extracts user information from Auth0 JWT payload
    */

package/src/providers/CognitoProvider.ts

@@ -13,6 +13,27 @@ export class CognitoProvider extends BaseAuthProvider {
     super(config);
   }
 
+  /**
+   * Configures Amazon Cognito from COGNITO_USER_POOL_ID + COGNITO_CLIENT_ID + AWS_REGION.
+   *
+   * Mapping preserved byte-for-byte from the env block that previously lived in MJServer's config.
+   */
+  static ConfigFromEnvironment(env: NodeJS.ProcessEnv): AuthProviderConfig | null {
+    if (!env.COGNITO_USER_POOL_ID || !env.COGNITO_CLIENT_ID || !env.AWS_REGION) {
+      return null;
+    }
+    return {
+      name: 'cognito',
+      type: 'cognito',
+      issuer: `https://cognito-idp.${env.AWS_REGION}.amazonaws.com/${env.COGNITO_USER_POOL_ID}`,
+      audience: env.COGNITO_CLIENT_ID,
+      jwksUri: `https://cognito-idp.${env.AWS_REGION}.amazonaws.com/${env.COGNITO_USER_POOL_ID}/.well-known/jwks.json`,
+      clientId: env.COGNITO_CLIENT_ID,
+      region: env.AWS_REGION,
+      userPoolId: env.COGNITO_USER_POOL_ID
+    };
+  }
+
   /**
    * Extracts user information from Cognito JWT payload
    */

package/src/providers/MSALProvider.ts

@@ -12,6 +12,28 @@ export class MSALProvider extends BaseAuthProvider {
     super(config);
   }
 
+  /**
+   * Configures Microsoft Entra ID from TENANT_ID + WEB_CLIENT_ID.
+   *
+   * Mapping preserved byte-for-byte from the env block that previously lived in MJServer's
+   * config — including the provider name 'azure', which predates the Entra rename and is kept
+   * so existing deployments' registered provider names do not shift.
+   */
+  static ConfigFromEnvironment(env: NodeJS.ProcessEnv): AuthProviderConfig | null {
+    if (!env.TENANT_ID || !env.WEB_CLIENT_ID) {
+      return null;
+    }
+    return {
+      name: 'azure',
+      type: 'msal',
+      issuer: `https://login.microsoftonline.com/${env.TENANT_ID}/v2.0`,
+      audience: env.WEB_CLIENT_ID,
+      jwksUri: `https://login.microsoftonline.com/${env.TENANT_ID}/discovery/v2.0/keys`,
+      clientId: env.WEB_CLIENT_ID,
+      tenantId: env.TENANT_ID
+    };
+  }
+
   /**
    * Extracts user information from MSAL/Azure AD JWT payload
    */

package/src/providers/OktaProvider.ts

@@ -13,6 +13,29 @@ export class OktaProvider extends BaseAuthProvider {
     super(config);
   }
 
+  /**
+   * Configures Okta from OKTA_DOMAIN + OKTA_CLIENT_ID, with OKTA_ISSUER overriding the issuer
+   * for orgs that use a custom authorization server rather than the default one.
+   *
+   * NEW capability: Okta had no env-var form before the discovery hook existed — it was one of
+   * the providers the old hard-coded block did not cover, so it required a config-file entry.
+   */
+  static ConfigFromEnvironment(env: NodeJS.ProcessEnv): AuthProviderConfig | null {
+    if (!env.OKTA_DOMAIN || !env.OKTA_CLIENT_ID) {
+      return null;
+    }
+    const issuer = env.OKTA_ISSUER || `https://${env.OKTA_DOMAIN}/oauth2/default`;
+    return {
+      name: 'okta',
+      type: 'okta',
+      issuer,
+      audience: env.OKTA_AUDIENCE || env.OKTA_CLIENT_ID,
+      jwksUri: `${issuer.replace(/\/$/, '')}/v1/keys`,
+      clientId: env.OKTA_CLIENT_ID,
+      domain: env.OKTA_DOMAIN
+    };
+  }
+
   /**
    * Extracts user information from Okta JWT payload
    */

package/src/providers/WorkOSProvider.ts

@@ -34,6 +34,33 @@ export class WorkOSProvider extends BaseAuthProvider {
     super(config);
   }
 
+  /**
+   * Configures WorkOS AuthKit from WORKOS_CLIENT_ID.
+   *
+   * Issuer and JWKS are both derived from the client ID — AuthKit's issuer is
+   * https://api.workos.com/user_management/<clientId> and its JWKS lives at
+   * https://api.workos.com/sso/jwks/<clientId> — so a single variable is enough.
+   * WORKOS_AUDIENCE overrides the audience when a Resource Indicator is configured.
+   *
+   * NEW capability: WorkOS had no env-var form before the discovery hook existed.
+   *
+   * Remember the AuthKit email caveat: access tokens omit `email` unless a JWT Template adds it,
+   * and MJ resolves users by email. See WORKOS.md.
+   */
+  static ConfigFromEnvironment(env: NodeJS.ProcessEnv): AuthProviderConfig | null {
+    if (!env.WORKOS_CLIENT_ID) {
+      return null;
+    }
+    return {
+      name: 'workos',
+      type: 'workos',
+      issuer: `https://api.workos.com/user_management/${env.WORKOS_CLIENT_ID}`,
+      audience: env.WORKOS_AUDIENCE || env.WORKOS_CLIENT_ID,
+      jwksUri: `https://api.workos.com/sso/jwks/${env.WORKOS_CLIENT_ID}`,
+      clientId: env.WORKOS_CLIENT_ID
+    };
+  }
+
   /**
    * Extracts user information from a WorkOS AuthKit JWT payload.
    *