@noresponse/node 6.0.2 → 7.0.0

package/dist/commonjs/late-results.js

@@ -1,28 +1,22 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ProviderActionError = exports.DEFAULT_LATE_RESULT_POLICY = void 0;
-exports.lateResultAction = lateResultAction;
-exports.handleLateResult = handleLateResult;
-exports.clerkActions = clerkActions;
-exports.workosActions = workosActions;
-exports.auth0Actions = auth0Actions;
-exports.logOnlyActions = logOnlyActions;
+exports.ProviderActionError = void 0;
+exports.handleRiskChange = handleRiskChange;
+exports.enforceAccount = enforceAccount;
+exports.identityProvider = identityProvider;
+exports.customProvider = customProvider;
+const not_found_error_js_1 = require("./models/errors/not-found-error.js");
 const webhooks_js_1 = require("./webhooks.js");
-/** Revoke sessions on review and block; do nothing on allow or step_up. Banning is opt-in. */
-exports.DEFAULT_LATE_RESULT_POLICY = Object.freeze({
-    allow: "none",
-    step_up: "none",
-    review: "revoke_sessions",
-    block: "revoke_sessions",
-});
-/**
- * Thrown when the provider's admin API refuses a call. Answer the webhook with a 5xx so NoResponse retries it.
- * A 404 is never thrown: the user or session is already gone, so the action is done.
- */
+const TABLE = { "lifecycle": { "onboarding": { "flow": "account_creation", "on": { "review": ["fail_onboarding", "revoke_sessions"], "block": ["fail_onboarding", "revoke_sessions"] } }, "provisional": { "flow": "account_creation", "on": { "review": ["reject_activation", "revoke_sessions"], "block": ["reject_activation", "revoke_sessions"] } }, "active": { "flow": "login", "on": { "review": ["revoke_sessions"], "block": ["restrict", "revoke_sessions"] } }, "restricted": { "flow": "login", "on": {}, "reinstate": { "allow": ["unrestrict"] } }, "rejected": { "flow": "account_creation", "on": {} } }, "providers": { "clerk": { "base_url": "https://api.clerk.com/v1", "actions": { "fail_onboarding": [{ "call": { "method": "POST", "path": "/users/{user}/ban" } }], "reject_activation": [{ "call": { "method": "POST", "path": "/users/{user}/ban" } }], "restrict": [{ "call": { "method": "POST", "path": "/users/{user}/ban" } }], "unrestrict": [{ "call": { "method": "POST", "path": "/users/{user}/unban" } }], "revoke_sessions": [{ "each": { "list": { "method": "GET", "path": "/sessions", "query": { "user_id": "{user}", "status": "active", "limit": "100" } }, "page": { "kind": "offset", "param": "offset", "size": 100 }, "where": { "status": "active" } }, "call": { "method": "POST", "path": "/sessions/{item}/revoke" } }] } }, "workos": { "base_url": "https://api.workos.com", "actions": { "fail_onboarding": [{ "call": { "method": "PUT", "path": "/user_management/users/{user}", "body": { "metadata": { "noresponse_state": "onboarding_failed" } } } }], "reject_activation": [{ "call": { "method": "PUT", "path": "/user_management/users/{user}", "body": { "metadata": { "noresponse_state": "activation_rejected" } } } }], "restrict": [{ "call": { "method": "PUT", "path": "/user_management/users/{user}", "body": { "metadata": { "noresponse_state": "restricted" } } } }], "unrestrict": [{ "call": { "method": "PUT", "path": "/user_management/users/{user}", "body": { "metadata": { "noresponse_state": null } } } }], "revoke_sessions": [{ "each": { "list": { "method": "GET", "path": "/user_management/users/{user}/sessions", "query": { "limit": "100" } }, "page": { "kind": "cursor", "param": "after", "next": ["list_metadata", "after"] }, "where": { "status": "active" } }, "call": { "method": "POST", "path": "/user_management/sessions/revoke", "body": { "session_id": "{item}" } } }] } }, "auth0": { "base_url": "https://{domain}/api/v2", "actions": { "fail_onboarding": [{ "call": { "method": "PATCH", "path": "/users/{user}", "body": { "blocked": true } } }], "reject_activation": [{ "call": { "method": "PATCH", "path": "/users/{user}", "body": { "blocked": true } } }], "restrict": [{ "call": { "method": "PATCH", "path": "/users/{user}", "body": { "blocked": true } } }], "unrestrict": [{ "call": { "method": "PATCH", "path": "/users/{user}", "body": { "blocked": false } } }], "revoke_sessions": [{ "call": { "method": "DELETE", "path": "/users/{user}/sessions" }, "fallback": { "status": 403, "code": "feature_not_enabled", "reports": "restrict", "steps": [{ "call": { "method": "PATCH", "path": "/users/{user}", "body": { "blocked": true } } }] } }, { "call": { "method": "DELETE", "path": "/users/{user}/refresh-tokens" }, "fallback": { "status": 403, "code": "feature_not_enabled", "steps": [{ "each": { "list": { "method": "GET", "path": "/device-credentials", "query": { "user_id": "{user}", "type": "refresh_token", "per_page": "100" } }, "page": { "kind": "index", "param": "page", "size": 100 } }, "call": { "method": "DELETE", "path": "/device-credentials/{item}" } }, { "each": { "list": { "method": "GET", "path": "/device-credentials", "query": { "user_id": "{user}", "type": "rotating_refresh_token", "per_page": "100" } }, "page": { "kind": "index", "param": "page", "size": 100 } }, "call": { "method": "DELETE", "path": "/device-credentials/{item}" } }] } }] } } }, "limits": { "retries": 4, "budget_ms": 3000, "backoff_ms": 250, "max_pages": 100 } };
+/** Every action a provider runs, as the table names them. */
+const ACTIONS = new Set(Object.values(TABLE.providers).flatMap((provider) => Object.keys(provider.actions)));
+/** Each admin API call gives up after this long; the provider then counts as unreachable. */
+const REQUEST_TIMEOUT_MS = 10000;
+/** The provider refused an action or could not be reached (status 0). Answer the webhook with a 5xx so it is delivered again. */
 class ProviderActionError extends Error {
     provider;
     status;
-    /** The provider's error code from the response body, such as Auth0's errorCode "insufficient_scope", when it sent one. */
+    /** The provider's error code, such as Auth0's errorCode "insufficient_scope", when it sent one. */
     code;
     constructor(provider, status, message, code) {
         super(message);
@@ -33,86 +27,200 @@ class ProviderActionError extends Error {
     }
 }
 exports.ProviderActionError = ProviderActionError;
-const ACTIONS = ["none", "revoke_sessions", "ban"];
 /**
- * The action your policy names for a verified event's account.risk.decision. Only a complete or partial
- * assessment whose account has a decision can act; a pending one and a test event from
- * webhookEndpoints.sendTestEvent never do.
+ * Verify an account.risk_changed delivery and enforce the account's current
+ * risk. A delivery that fails verification throws WebhookVerificationError
+ * before anything is read; any other event, and a test event, does nothing.
  */
-function lateResultAction(event, policy = exports.DEFAULT_LATE_RESULT_POLICY) {
-    if (event.type !== "assessment.updated" && event.type !== "account.risk_changed")
-        return "none";
-    if (event.type === "assessment.updated" && event.data.status === "expired")
-        return "none";
-    if (event.type === "assessment.updated" && event.test === true)
-        return "none";
-    const data = event.data;
-    // A pending answer carries an earlier assessment's decision; acting on it would repeat that action.
-    if (event.type === "assessment.updated" && data.status === "pending")
-        return "none";
-    if (event.type === "account.risk_changed") {
-        // The event is sent when any flow's decision changes; sessions are about the login
-        // decision, so an unchanged login decision acts on nothing.
-        const changed = event.data;
-        if (changed.previousDecisionsByFlow.login === changed.account.decisionsByFlow.login)
-            return "none";
+async function handleRiskChange(client, payload, headers, secrets, options) {
+    const { provider: _provider, getAccountState: _getAccountState, flows: _flows, ...verify } = options;
+    const event = await (0, webhooks_js_1.constructEvent)(payload, headers, secrets, verify);
+    if (event.type !== "account.risk_changed" || event.test === true) {
+        return { event, skipped: "not_actionable", enforcements: [] };
     }
-    const decision = event.type === "account.risk_changed"
-        ? event.data.account.decisionsByFlow.login
-        : data.account?.risk.decision;
-    if (decision !== "allow" && decision !== "step_up" && decision !== "review" && decision !== "block")
-        return "none";
-    const action = Object.prototype.hasOwnProperty.call(policy, decision) ? policy[decision] : undefined;
-    if (action === undefined)
-        return "none";
-    if (!ACTIONS.includes(action))
-        throw new TypeError(`unknown late result action ${String(action)}`);
-    return action;
+    let account;
+    try {
+        account = await client.accounts.get(event.data.account.id);
+    }
+    catch (error) {
+        if (error instanceof not_found_error_js_1.NotFoundError)
+            return { event, skipped: "account_gone", enforcements: [] };
+        throw error;
+    }
+    return { event, ...(await enforceAccount(client, account, options)) };
 }
+const FLOW_KEYS = { account_creation: "accountCreation", login: "login", purchase: "purchase" };
 /**
- * Verify a webhook delivery and apply your policy to it.
- *
- * `payload`, `headers`, `secrets` and the tolerance options are exactly what
- * constructEvent takes; a delivery that fails verification throws
- * WebhookVerificationError before any provider call. A test event acts on
- * nothing. Revoke and ban are safe to repeat, but deduplicate on
- * `result.event.id` and ignore versions older than one you have acted on.
+ * Enforce one account as read: the account a handler fetched, or one from
+ * accounts.listChanged({ unenforced: true }) when catching up.
  */
-async function handleLateResult(payload, headers, secrets, provider, options = {}) {
-    const { policy, userId: resolve, ...verify } = options;
-    const event = await (0, webhooks_js_1.constructEvent)(payload, headers, secrets, verify);
-    const action = lateResultAction(event, policy);
-    if (action === "none")
-        return { event, action: "none" };
-    const accountId = event.type === "account.risk_changed"
-        ? event.data.account.id
-        : event.data.detail.accountId;
-    const userId = resolve ? await resolve(accountId, event) : accountId;
-    if (userId === null || userId === undefined || userId === "")
-        return { event, action: "none" };
-    let ran = action;
-    if (provider.act)
-        ran = await provider.act(action, userId);
-    else if (action === "ban")
-        await provider.ban(userId);
-    else
-        await provider.revokeSessions(userId);
-    return { event, action: ran, userId };
+async function enforceAccount(client, account, options) {
+    const answer = await options.getAccountState(account);
+    if (!answer)
+        return { account, skipped: "unknown_user", enforcements: [] };
+    const { state } = answer;
+    const rule = TABLE.lifecycle[state];
+    if (!rule)
+        throw new TypeError(`unknown account state ${String(state)}`);
+    const riskVersion = account.riskVersion;
+    if (answer.enforcedRiskVersion !== undefined && riskVersion <= answer.enforcedRiskVersion) {
+        return { account, state, riskVersion, skipped: "already_enforced", enforcements: [] };
+    }
+    const { flow } = rule;
+    const decision = account.decisionsByFlow[FLOW_KEYS[flow]];
+    const actions = rule.on[decision] ?? (options.flows?.[flow]?.reinstate ? rule.reinstate?.[decision] : undefined) ?? [];
+    const provider = options.provider;
+    const enforcements = [];
+    const record = async (action, status, errorCode) => {
+        const body = { riskVersion, flow, action, stateBefore: state, status, provider: provider.name, ...(errorCode ? { errorCode } : {}) };
+        await client.accounts.recordEnforcement(account.id, body);
+        enforcements.push({ flow, action, status, ...(errorCode ? { errorCode } : {}) });
+    };
+    if (actions.length === 0) {
+        // An adverse or step_up decision that needs nothing still counts as handled.
+        if (decision !== "allow")
+            await record("none", "applied");
+        return { account, state, riskVersion, enforcements };
+    }
+    const recorded = new Set();
+    for (const action of actions) {
+        let alsoRan;
+        try {
+            alsoRan = await provider.run(action, answer.userId || account.id);
+        }
+        catch (error) {
+            await record(action, "failed", failureCode(provider.name, error));
+            throw error;
+        }
+        for (const ran of [...alsoRan, action]) {
+            if (recorded.has(ran))
+                continue;
+            recorded.add(ran);
+            await record(ran, "applied");
+        }
+    }
+    return { account, state, riskVersion, enforcements };
 }
-/**
- * Rate limits. Auth0 answers 429 when the Management API rate limit is hit,
- * and a 429 means it did not act, so the call is safe to send again, a DELETE
- * included. One revoke or ban waits at most RATE_LIMIT_BUDGET_MS in all, and
- * each call retries at most RATE_LIMIT_RETRIES times: it waits Retry-After
- * seconds, else until X-RateLimit-Reset (Unix seconds), else 250 ms, 500 ms,
- * 1 s, 2 s. A wait that would pass the budget is not started: the 429 throws
- * at once as ProviderActionError, the webhook answers 5xx and NoResponse
- * delivers it again later. The budget keeps the handler inside the 5 s a
- * delivery has to be answered.
- */
-const RATE_LIMIT_RETRIES = 4;
-const RATE_LIMIT_BUDGET_MS = 3000;
-const RATE_LIMIT_BACKOFF_MS = 250;
+const SLUG = /^[a-z0-9_.-]+$/;
+/** The error_code of a failed action: the provider's code, else its HTTP status, as <provider>.<code>. */
+function failureCode(provider, error) {
+    const code = error?.code;
+    const status = error instanceof ProviderActionError ? error.status : undefined;
+    const suffix = typeof code === "string" && SLUG.test(code.toLowerCase())
+        ? code.toLowerCase()
+        : status === 0 ? "unreachable" : status !== undefined ? `http_${status}` : "error";
+    return `${provider}.${suffix}`.slice(0, 128);
+}
+/** Clerk, WorkOS or Auth0, run from the shared action table. */
+function identityProvider(name, options) {
+    const spec = TABLE.providers[name];
+    if (!spec)
+        throw new TypeError(`unknown identity provider ${String(name)}`);
+    if (!options?.token)
+        throw new TypeError(`${name} needs token`);
+    let base = options.baseUrl ?? spec.base_url;
+    if (base.includes("{domain}")) {
+        if (!options.domain)
+            throw new TypeError(`${name} needs domain or baseUrl`);
+        base = base.replace("{domain}", options.domain);
+    }
+    const http = { name, base: base.replace(/\/+$/, ""), authorization: `Bearer ${options.token}`, fetch: options.fetch ?? globalThis.fetch };
+    return {
+        name,
+        async run(action, userId) {
+            if (typeof userId !== "string" || userId === "")
+                throw new TypeError("user id must be a non-empty string");
+            const steps = spec.actions[action];
+            if (!steps)
+                throw new TypeError(`unknown action ${String(action)}`);
+            return runSteps(steps, { ...http, user: userId, waitedMs: 0 });
+        },
+    };
+}
+/** Your own user store: one function per action you support. An action without one fails. */
+function customProvider(handlers) {
+    return {
+        name: "custom",
+        async run(action, userId) {
+            const handler = handlers[action];
+            if (!handler)
+                throw new TypeError(`customProvider has no ${action} handler`);
+            const alsoRan = await handler(userId);
+            // Only a list of action names counts; any other return value is no extra action.
+            return Array.isArray(alsoRan) ? alsoRan.filter((name) => typeof name === "string" && ACTIONS.has(name)) : [];
+        },
+    };
+}
+async function runSteps(steps, ctx) {
+    const alsoRan = [];
+    for (const step of steps) {
+        if (step.each) {
+            for (const item of await collect(step.each, ctx))
+                await send(step.call, ctx, item);
+            continue;
+        }
+        try {
+            await send(step.call, ctx);
+        }
+        catch (error) {
+            const fallback = step.fallback;
+            if (!fallback || !(error instanceof ProviderActionError) || error.status !== fallback.status || error.code !== fallback.code)
+                throw error;
+            alsoRan.push(...(await runSteps(fallback.steps, ctx)));
+            if (fallback.reports)
+                alsoRan.push(fallback.reports);
+        }
+    }
+    return alsoRan;
+}
+/** Every matching item id across the list's pages, collected before any is acted on. */
+async function collect(each, ctx) {
+    const { list, page, where } = each;
+    const ids = [];
+    let cursor;
+    for (let index = 0; index < TABLE.limits.max_pages; index++) {
+        const query = { ...list.query };
+        if (page.kind === "offset")
+            query[page.param] = String(index * (page.size ?? 0));
+        else if (page.kind === "index")
+            query[page.param] = String(index);
+        else if (cursor !== undefined)
+            query[page.param] = cursor;
+        const body = await send({ ...list, query }, ctx);
+        const data = body?.data;
+        const items = Array.isArray(body) ? body : Array.isArray(data) ? data : [];
+        for (const item of items) {
+            const record = item;
+            const id = record?.["id"];
+            if (typeof id !== "string" || id === "")
+                continue;
+            if (Object.entries(where ?? {}).every(([key, value]) => record?.[key] === value))
+                ids.push(id);
+        }
+        if (page.kind === "cursor") {
+            let next = body;
+            for (const key of page.next ?? [])
+                next = next?.[key];
+            if (typeof next !== "string" || next === "")
+                break;
+            cursor = next;
+        }
+        else if (items.length < (page.size ?? 0))
+            break;
+    }
+    return ids;
+}
+function fill(value, user, item) {
+    if (typeof value === "string")
+        return value.replaceAll("{user}", user).replaceAll("{item}", item ?? "");
+    if (Array.isArray(value))
+        return value.map((entry) => fill(entry, user, item));
+    if (value !== null && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, fill(entry, user, item)]));
+    }
+    return value;
+}
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 /** How long a 429 asks to wait, in milliseconds. */
 function rateLimitWaitMs(headers, retry) {
     const after = headers.get("retry-after")?.trim();
@@ -127,261 +235,64 @@ function rateLimitWaitMs(headers, retry) {
         if (Number.isFinite(at))
             return Math.max(0, at * 1000 - Date.now());
     }
-    return RATE_LIMIT_BACKOFF_MS * 2 ** retry;
-}
-const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-function caller(name, baseUrl, authorization, fetcher, rateLimit) {
-    const base = baseUrl.replace(/\/+$/, "");
-    const run = fetcher ?? globalThis.fetch;
-    // Every call names a user or a session. A 404 means it is already gone, so
-    // revoke and ban count it as done and a repeated delivery does not fail.
-    return async ({ method, path, query, body }) => {
-        const url = new URL(base + path);
-        for (const [key, value] of Object.entries(query ?? {}))
-            url.searchParams.set(key, value);
-        const headers = { authorization, accept: "application/json" };
-        if (body !== undefined)
-            headers["content-type"] = "application/json";
-        for (let retry = 0;; retry++) {
-            const response = await run(url, { method, headers, ...(body !== undefined ? { body: JSON.stringify(body) } : {}) });
-            const text = await response.text();
-            if (response.status === 429 && rateLimit && retry < RATE_LIMIT_RETRIES) {
-                const wait = rateLimitWaitMs(response.headers, retry);
-                if (rateLimit.waitedMs + wait <= RATE_LIMIT_BUDGET_MS) {
-                    rateLimit.waitedMs += wait;
-                    await sleep(wait);
-                    continue;
-                }
-            }
-            if (response.status === 404)
-                return undefined;
-            if (!response.ok)
-                throw new ProviderActionError(name, response.status, `${name} ${method} ${path} answered ${response.status}`, errorCode(text));
-            if (!text)
-                return undefined;
-            try {
-                return JSON.parse(text);
-            }
-            catch {
-                return undefined;
-            }
-        }
-    };
+    return TABLE.limits.backoff_ms * 2 ** retry;
 }
-/** The error code in a provider's error body: Auth0's errorCode, or a top-level code. */
+/** The provider's error code: Auth0's errorCode, WorkOS's code or Clerk's errors[0].code. */
 function errorCode(text) {
     try {
         const body = JSON.parse(text);
-        const code = body?.errorCode ?? body?.code;
+        const code = body?.errorCode ?? body?.code ?? body?.errors?.[0]?.code;
         return typeof code === "string" && code !== "" ? code : undefined;
     }
     catch {
         return undefined;
     }
 }
-const segment = (id) => {
-    if (typeof id !== "string" || id === "")
-        throw new TypeError("user id must be a non-empty string");
-    return encodeURIComponent(id);
-};
-function sessions(body) {
-    if (Array.isArray(body))
-        return body;
-    const data = body?.data;
-    return Array.isArray(data) ? data : [];
-}
-/**
- * Clerk Backend API. revokeSessions lists the user's active sessions
- * (GET /sessions?user_id&status=active) and revokes each
- * (POST /sessions/{id}/revoke). ban is POST /users/{id}/ban, which revokes
- * every session and blocks sign-in.
- */
-function clerkActions(options) {
-    if (!options?.secretKey)
-        throw new TypeError("clerkActions needs secretKey");
-    const call = caller("clerk", options.baseUrl ?? "https://api.clerk.com/v1", `Bearer ${options.secretKey}`, options.fetch);
-    const PAGE = 100;
-    return {
-        name: "clerk",
-        async revokeSessions(userId) {
-            segment(userId);
-            const active = [];
-            for (let offset = 0; offset < PAGE * 1000; offset += PAGE) {
-                const page = sessions(await call({ method: "GET", path: "/sessions", query: { user_id: userId, status: "active", limit: String(PAGE), offset: String(offset) } }));
-                for (const s of page)
-                    if (s.status === "active" && typeof s.id === "string" && s.id)
-                        active.push(s.id);
-                if (page.length < PAGE)
-                    break;
-            }
-            for (const id of active)
-                await call({ method: "POST", path: `/sessions/${encodeURIComponent(id)}/revoke` });
-        },
-        async ban(userId) {
-            await call({ method: "POST", path: `/users/${segment(userId)}/ban` });
-        },
-    };
-}
-/**
- * WorkOS User Management. revokeSessions pages through
- * GET /user_management/users/{id}/sessions and revokes each active one with
- * POST /user_management/sessions/revoke. WorkOS has no block or ban, so ban
- * revokes the sessions and then deletes the user
- * (DELETE /user_management/users/{id}); deletion is permanent.
- */
-function workosActions(options) {
-    if (!options?.apiKey)
-        throw new TypeError("workosActions needs apiKey");
-    const call = caller("workos", options.baseUrl ?? "https://api.workos.com", `Bearer ${options.apiKey}`, options.fetch);
-    const revokeSessions = async (userId) => {
-        const user = segment(userId);
-        const active = [];
-        let after;
-        for (let round = 0; round < 1000; round++) {
-            const query = { limit: "100" };
-            if (after)
-                query["after"] = after;
-            const body = (await call({ method: "GET", path: `/user_management/users/${user}/sessions`, query }));
-            for (const s of sessions(body))
-                if (s.status === "active" && typeof s.id === "string" && s.id)
-                    active.push(s.id);
-            const next = body?.list_metadata?.after;
-            if (typeof next !== "string" || next === "")
-                break;
-            after = next;
-        }
-        for (const id of active)
-            await call({ method: "POST", path: "/user_management/sessions/revoke", body: { session_id: id } });
-    };
-    return {
-        name: "workos",
-        revokeSessions,
-        async ban(userId) {
-            await revokeSessions(userId);
-            await call({ method: "DELETE", path: `/user_management/users/${segment(userId)}` });
-        },
-    };
-}
-/** Auth0 answers 403 with errorCode feature_not_enabled when the tenant's plan does not include an endpoint. */
-const notOnPlan = (error) => error instanceof ProviderActionError && error.status === 403 && error.code === "feature_not_enabled";
-/**
- * Auth0 Management API.
- *
- * revokeSessions deletes every session (DELETE /users/{id}/sessions) and
- * every refresh token (DELETE /users/{id}/refresh-tokens). ban first sets
- * blocked: true (PATCH /users/{id}), then does the same.
- *
- * Auth0 offers the sessions and refresh-token endpoints on Enterprise plans
- * only; on other plans they answer 403 feature_not_enabled. Then:
- * - refresh tokens are deleted one by one through
- *   /device-credentials (types refresh_token and rotating_refresh_token),
- *   which every plan has;
- * - a login session cannot be ended, so revokeSessions blocks the user
- *   (PATCH blocked: true) before deleting the refresh tokens, and act
- *   reports "ban". Unblock the user in the dashboard to undo it.
- * Any other refusal, such as 403 insufficient_scope, throws.
- *
- * A 429 from the Management API is waited out and retried: Retry-After, else
- * X-RateLimit-Reset, else 250 ms doubling, at most 4 retries a call and 3 s of
- * waiting a revoke or ban. Past that the 429 throws as ProviderActionError.
- */
-function auth0Actions(options) {
-    if (!options?.token)
-        throw new TypeError("auth0Actions needs token");
-    const base = options.baseUrl ?? (options.domain ? `https://${options.domain}/api/v2` : undefined);
-    if (!base)
-        throw new TypeError("auth0Actions needs domain or baseUrl");
-    // A fresh caller per action, so each revoke or ban has its own rate-limit budget.
-    const session = () => caller("auth0", base, `Bearer ${options.token}`, options.fetch, { waitedMs: 0 });
-    const block = (call, user) => call({ method: "PATCH", path: `/users/${user}`, body: { blocked: true } });
-    /** End every session; false when the plan has no sessions API. */
-    const deleteSessions = async (call, user) => {
+/** One admin API call. A 404 is done (undefined); a 429 is waited out inside the action's budget; any other failure throws. */
+async function send(request, ctx, item) {
+    const path = request.path.replaceAll("{user}", encodeURIComponent(ctx.user)).replaceAll("{item}", encodeURIComponent(item ?? ""));
+    const url = new URL(ctx.base + path);
+    for (const [key, value] of Object.entries(request.query ?? {}))
+        url.searchParams.set(key, fill(value, ctx.user, item));
+    const headers = { authorization: ctx.authorization, accept: "application/json" };
+    const body = request.body === undefined ? undefined : JSON.stringify(fill(request.body, ctx.user, item));
+    if (body !== undefined)
+        headers["content-type"] = "application/json";
+    const label = `${ctx.name} ${request.method} ${request.path}`;
+    for (let retry = 0;; retry++) {
+        let response;
         try {
-            await call({ method: "DELETE", path: `/users/${user}/sessions` });
-            return true;
+            response = await ctx.fetch(url, {
+                method: request.method,
+                headers,
+                signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+                ...(body !== undefined ? { body } : {}),
+            });
         }
         catch (error) {
-            if (notOnPlan(error))
-                return false;
-            throw error;
+            throw new ProviderActionError(ctx.name, 0, `${label} failed: ${error?.message ?? String(error)}`);
         }
-    };
-    const deleteRefreshTokens = async (call, userId, user) => {
-        try {
-            await call({ method: "DELETE", path: `/users/${user}/refresh-tokens` });
-            return;
+        const text = await response.text();
+        if (response.status === 429 && retry < TABLE.limits.retries) {
+            const wait = rateLimitWaitMs(response.headers, retry);
+            if (ctx.waitedMs + wait <= TABLE.limits.budget_ms) {
+                ctx.waitedMs += wait;
+                await sleep(wait);
+                continue;
+            }
         }
-        catch (error) {
-            if (!notOnPlan(error))
-                throw error;
+        if (response.status === 404)
+            return undefined;
+        if (!response.ok)
+            throw new ProviderActionError(ctx.name, response.status, `${label} answered ${response.status}`, errorCode(text));
+        if (!text)
+            return undefined;
+        try {
+            return JSON.parse(text);
         }
-        // Collect every id before deleting any, so the pages do not shift underneath.
-        const ids = [];
-        for (const type of ["refresh_token", "rotating_refresh_token"]) {
-            for (let page = 0; page < 10; page++) {
-                const body = await call({ method: "GET", path: "/device-credentials", query: { user_id: userId, type, page: String(page), per_page: "100" } });
-                const list = Array.isArray(body) ? body : [];
-                for (const credential of list)
-                    if (typeof credential?.id === "string" && credential.id)
-                        ids.push(credential.id);
-                if (list.length < 100)
-                    break;
-            }
+        catch {
+            return undefined;
         }
-        for (const id of ids)
-            await call({ method: "DELETE", path: `/device-credentials/${encodeURIComponent(id)}` });
-    };
-    const revoke = async (userId) => {
-        const user = segment(userId);
-        const call = session();
-        const ended = await deleteSessions(call, user);
-        // Without the sessions API a login session survives; blocking is the only way to end it.
-        if (!ended)
-            await block(call, user);
-        await deleteRefreshTokens(call, userId, user);
-        return ended ? "revoke_sessions" : "ban";
-    };
-    const ban = async (userId) => {
-        const user = segment(userId);
-        const call = session();
-        await block(call, user);
-        // The block already ends a session the plan cannot delete.
-        await deleteSessions(call, user);
-        await deleteRefreshTokens(call, userId, user);
-    };
-    return {
-        name: "auth0",
-        async revokeSessions(userId) {
-            await revoke(userId);
-        },
-        ban,
-        async act(action, userId) {
-            if (action === "ban") {
-                await ban(userId);
-                return "ban";
-            }
-            return revoke(userId);
-        },
-    };
-}
-/**
- * A provider for an app with its own login, or for trying the handler before
- * you wire up a real one. revokeSessions and ban each log what they would do
- * and call nothing: no request leaves your process. Replace it with your own
- * LateResultProvider once you know what revoking and banning mean in your app.
- */
-function logOnlyActions(options = {}) {
-    const log = options.log ?? ((message) => console.info(message));
-    return {
-        name: "log_only",
-        async revokeSessions(userId) {
-            segment(userId);
-            log(`NoResponse late result (log only): would revoke every session of user ${userId}`, { action: "revoke_sessions", userId });
-        },
-        async ban(userId) {
-            segment(userId);
-            log(`NoResponse late result (log only): would ban user ${userId} and end their sessions`, { action: "ban", userId });
-        },
-    };
+    }
 }
 //# sourceMappingURL=late-results.js.map