@uipath/auth 1.198.0 → 1.199.0-preview.104

package/dist/config.d.ts

@@ -52,6 +52,7 @@ interface ResolveConfigProps {
     customAuthority?: string;
     customClientId?: string;
     customClientSecret?: string;
+    customClientAssertion?: string;
     customScopes?: string[];
 }
 /**
@@ -69,5 +70,5 @@ interface ResolveConfigProps {
  * Throws {@link InvalidBaseUrlError} on any failure.
  */
 export declare const normalizeAndValidateBaseUrl: (rawUrl: string) => string;
-export declare const resolveConfigAsync: ({ customAuthority, customClientId, customClientSecret, customScopes, }?: ResolveConfigProps) => Promise<EndpointsConfig>;
+export declare const resolveConfigAsync: ({ customAuthority, customClientId, customClientSecret, customClientAssertion, customScopes, }?: ResolveConfigProps) => Promise<EndpointsConfig>;
 export {};

package/dist/federatedCredentials.d.ts

@@ -0,0 +1,20 @@
+import type { BaseCredentials } from "./types";
+/**
+ * OAuth 2.0 client-assertion type for a JWT bearer token (RFC 7523). The
+ * external identity provider's OIDC token is presented under this type in
+ * place of a client secret.
+ */
+export declare const JWT_BEARER_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
+interface FederatedCredentialsLoginProps {
+    clientId: string;
+    /** The OIDC JWT issued by the external provider (GitHub Actions, etc.). */
+    clientAssertion: string;
+    scope?: string[];
+    authority?: string;
+}
+export declare class FederatedCredentialsAuthenticationError extends Error {
+    readonly status: number;
+    constructor(message: string, status: number);
+}
+export declare const federatedCredentialsLogin: ({ clientId, clientAssertion, scope, authority, }: FederatedCredentialsLoginProps) => Promise<BaseCredentials>;
+export {};

package/dist/index.browser.d.ts

@@ -8,4 +8,5 @@ export { fetchTenantsAndOrganizations, type Tenant, type TenantsAndOrganizations
 export * from "./tokenRefresh";
 export { AUTH_FLOW_ENV_VAR, type AuthFlow, type BaseCredentials, } from "./types";
 export { DEFAULT_AUTH_FILENAME, DEFAULT_ENV_FILENAME, type EnvFileErrorCode, type EnvFileLocation, type EnvFileSource, type EnvFileUnusable, type EnvFileUnusableReason, loadEnvFileAsync, resolveEnvFileLocationAsync, resolveEnvFilePathAsync, saveEnvFileAsync, } from "./utils/envFile";
+export { parseJWT } from "./utils/jwt";
 export { isBrowser, isNode } from "./utils/platform";

package/dist/index.browser.js

@@ -18335,6 +18335,7 @@ var resolveConfigAsync = async ({
   customAuthority,
   customClientId,
   customClientSecret,
+  customClientAssertion,
   customScopes
 } = {}) => {
   const fileAuth = getAuthFileConfig();
@@ -18360,7 +18361,7 @@ var resolveConfigAsync = async ({
   if (!clientSecret && fileAuth.clientSecret) {
     clientSecret = fileAuth.clientSecret;
   }
-  const isExternalAppAuth = clientId !== DEFAULT_CLIENT_ID && Boolean(clientSecret);
+  const isExternalAppAuth = clientId !== DEFAULT_CLIENT_ID && (Boolean(clientSecret) || Boolean(customClientAssertion));
   const scopes = resolveScopes(isExternalAppAuth, customScopes, fileAuth.scopes);
   return {
     clientId,
@@ -19446,6 +19447,49 @@ var getAuthEnv = async (options = {}) => {
   }
   return { authEnv, loginStatus: status };
 };
+// src/tokenGrant.ts
+var requestClientCredentialsToken = async ({
+  tokenEndpoint,
+  baseUrl,
+  params,
+  buildError
+}) => {
+  const tokenResponse = await fetch(tokenEndpoint, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded"
+    },
+    body: new URLSearchParams(params)
+  });
+  const [parseError, tokenData] = await catchError(tokenResponse.json());
+  if (!tokenResponse.ok) {
+    const data = parseError ? {} : tokenData ?? {};
+    throw buildError({
+      status: tokenResponse.status,
+      errorType: data.error || "authentication_failed",
+      errorDesc: data.error_description || "Unknown error"
+    });
+  }
+  if (parseError || !tokenData) {
+    throw buildError({
+      status: tokenResponse.status,
+      errorType: "invalid_response",
+      errorDesc: "Token endpoint returned a non-JSON response."
+    });
+  }
+  if (!tokenData.access_token) {
+    throw buildError({
+      status: tokenResponse.status,
+      errorType: "invalid_response",
+      errorDesc: "Token endpoint response did not include an access_token."
+    });
+  }
+  return {
+    UIPATH_ACCESS_TOKEN: tokenData.access_token,
+    UIPATH_URL: baseUrl
+  };
+};
+
 // src/clientCredentials.ts
 class ClientCredentialsAuthenticationError extends Error {
   status;
@@ -19455,6 +19499,31 @@ class ClientCredentialsAuthenticationError extends Error {
     this.status = status;
   }
 }
+var buildClientCredentialsError = ({
+  status,
+  errorType,
+  errorDesc
+}) => {
+  let troubleshooting = "";
+  if (errorType === "invalid_client" || status === 401) {
+    troubleshooting = `
+
+Troubleshooting:` + `
+  • Verify your Client ID is correct` + `
+  • Ensure your Client Secret hasn't expired` + `
+  • Check that the external application is enabled in UiPath` + `
+  • Confirm you're using the correct authority URL`;
+  } else if (errorType === "invalid_scope") {
+    troubleshooting = `
+
+Troubleshooting:` + `
+  • The requested scopes may not be available for your account` + `
+  • Try using default scopes or contact your UiPath administrator`;
+  }
+  return new ClientCredentialsAuthenticationError(`Client Credentials authentication failed (${status})
+` + `Error: ${errorType}
+` + `Details: ${errorDesc}${troubleshooting}`, status);
+};
 var clientCredentialsLogin = async ({
   clientId,
   clientSecret,
@@ -19475,41 +19544,12 @@ var clientCredentialsLogin = async ({
   if (config.scopes.length > 0) {
     params.scope = config.scopes.join(" ");
   }
-  const tokenResponse = await fetch(config.tokenEndpoint, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded"
-    },
-    body: new URLSearchParams(params)
+  return await requestClientCredentialsToken({
+    tokenEndpoint: config.tokenEndpoint,
+    baseUrl: config.baseUrl,
+    params,
+    buildError: buildClientCredentialsError
   });
-  const tokenData = await tokenResponse.json();
-  if (!tokenResponse.ok) {
-    const errorType = tokenData.error || "authentication_failed";
-    const errorDesc = tokenData.error_description || "Unknown error";
-    let troubleshooting = "";
-    if (errorType === "invalid_client" || tokenResponse.status === 401) {
-      troubleshooting = `
-
-Troubleshooting:` + `
-  • Verify your Client ID is correct` + `
-  • Ensure your Client Secret hasn't expired` + `
-  • Check that the external application is enabled in UiPath` + `
-  • Confirm you're using the correct authority URL`;
-    } else if (errorType === "invalid_scope") {
-      troubleshooting = `
-
-Troubleshooting:` + `
-  • The requested scopes may not be available for your account` + `
-  • Try using default scopes or contact your UiPath administrator`;
-    }
-    throw new ClientCredentialsAuthenticationError(`Client Credentials authentication failed (${tokenResponse.status})
-` + `Error: ${errorType}
-` + `Details: ${errorDesc}${troubleshooting}`, tokenResponse.status);
-  }
-  return {
-    UIPATH_ACCESS_TOKEN: tokenData.access_token,
-    UIPATH_URL: config.baseUrl
-  };
 };
 // src/logout.ts
 import { getFileSystem as getFileSystem6 } from "@uipath/filesystem";
@@ -19583,6 +19623,7 @@ export {
   resolveEnvFileLocationAsync,
   resolveAuthProfileFilePath,
   refreshAccessToken,
+  parseJWT,
   normalizeAuthProfileName,
   logoutWithDeps,
   logout,
@@ -19610,4 +19651,4 @@ export {
   AUTH_FLOW_ENV_VAR
 };
 
-//# debugId=08C6C8374F27923B64756E2164756E21
+//# debugId=34E22CDEA296620564756E2164756E21

package/dist/index.d.ts

@@ -4,6 +4,7 @@ export * from "./clientCredentials";
 export { type AuthFileConfig, InvalidBaseUrlError, setAuthFileConfig, } from "./config";
 export { AUTH_CANCELLED_ERROR_CODE } from "./constants";
 export { ENFORCE_ROBOT_AUTH_VAR, ENV_AUTH_ENABLE_VAR, ENV_AUTH_VARS, EnvAuthConfigError, isEnvAuthEnabled, isRobotAuthEnforced, readAuthFromEnv, } from "./envAuth";
+export { FederatedCredentialsAuthenticationError, federatedCredentialsLogin, JWT_BEARER_ASSERTION_TYPE, } from "./federatedCredentials";
 export * from "./interactive";
 export * from "./loginStatus";
 export * from "./logout";

package/dist/index.js

@@ -19647,6 +19647,7 @@ var resolveConfigAsync = async ({
   customAuthority,
   customClientId,
   customClientSecret,
+  customClientAssertion,
   customScopes
 } = {}) => {
   const fileAuth = getAuthFileConfig();
@@ -19672,7 +19673,7 @@ var resolveConfigAsync = async ({
   if (!clientSecret && fileAuth.clientSecret) {
     clientSecret = fileAuth.clientSecret;
   }
-  const isExternalAppAuth = clientId !== DEFAULT_CLIENT_ID && Boolean(clientSecret);
+  const isExternalAppAuth = clientId !== DEFAULT_CLIENT_ID && (Boolean(clientSecret) || Boolean(customClientAssertion));
   const scopes = resolveScopes(isExternalAppAuth, customScopes, fileAuth.scopes);
   return {
     clientId,
@@ -21486,6 +21487,49 @@ var getAuthEnv = async (options = {}) => {
   }
   return { authEnv, loginStatus: status };
 };
+// src/tokenGrant.ts
+var requestClientCredentialsToken = async ({
+  tokenEndpoint,
+  baseUrl,
+  params,
+  buildError
+}) => {
+  const tokenResponse = await fetch(tokenEndpoint, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded"
+    },
+    body: new URLSearchParams(params)
+  });
+  const [parseError, tokenData] = await catchError(tokenResponse.json());
+  if (!tokenResponse.ok) {
+    const data = parseError ? {} : tokenData ?? {};
+    throw buildError({
+      status: tokenResponse.status,
+      errorType: data.error || "authentication_failed",
+      errorDesc: data.error_description || "Unknown error"
+    });
+  }
+  if (parseError || !tokenData) {
+    throw buildError({
+      status: tokenResponse.status,
+      errorType: "invalid_response",
+      errorDesc: "Token endpoint returned a non-JSON response."
+    });
+  }
+  if (!tokenData.access_token) {
+    throw buildError({
+      status: tokenResponse.status,
+      errorType: "invalid_response",
+      errorDesc: "Token endpoint response did not include an access_token."
+    });
+  }
+  return {
+    UIPATH_ACCESS_TOKEN: tokenData.access_token,
+    UIPATH_URL: baseUrl
+  };
+};
+
 // src/clientCredentials.ts
 class ClientCredentialsAuthenticationError extends Error {
   status;
@@ -21495,6 +21539,31 @@ class ClientCredentialsAuthenticationError extends Error {
     this.status = status;
   }
 }
+var buildClientCredentialsError = ({
+  status,
+  errorType,
+  errorDesc
+}) => {
+  let troubleshooting = "";
+  if (errorType === "invalid_client" || status === 401) {
+    troubleshooting = `
+
+Troubleshooting:` + `
+  • Verify your Client ID is correct` + `
+  • Ensure your Client Secret hasn't expired` + `
+  • Check that the external application is enabled in UiPath` + `
+  • Confirm you're using the correct authority URL`;
+  } else if (errorType === "invalid_scope") {
+    troubleshooting = `
+
+Troubleshooting:` + `
+  • The requested scopes may not be available for your account` + `
+  • Try using default scopes or contact your UiPath administrator`;
+  }
+  return new ClientCredentialsAuthenticationError(`Client Credentials authentication failed (${status})
+` + `Error: ${errorType}
+` + `Details: ${errorDesc}${troubleshooting}`, status);
+};
 var clientCredentialsLogin = async ({
   clientId,
   clientSecret,
@@ -21515,46 +21584,83 @@ var clientCredentialsLogin = async ({
   if (config.scopes.length > 0) {
     params.scope = config.scopes.join(" ");
   }
-  const tokenResponse = await fetch(config.tokenEndpoint, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded"
-    },
-    body: new URLSearchParams(params)
+  return await requestClientCredentialsToken({
+    tokenEndpoint: config.tokenEndpoint,
+    baseUrl: config.baseUrl,
+    params,
+    buildError: buildClientCredentialsError
   });
-  const tokenData = await tokenResponse.json();
-  if (!tokenResponse.ok) {
-    const errorType = tokenData.error || "authentication_failed";
-    const errorDesc = tokenData.error_description || "Unknown error";
-    let troubleshooting = "";
-    if (errorType === "invalid_client" || tokenResponse.status === 401) {
-      troubleshooting = `
+};
+
+// src/index.ts
+init_constants();
+
+// src/federatedCredentials.ts
+var JWT_BEARER_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
+
+class FederatedCredentialsAuthenticationError extends Error {
+  status;
+  constructor(message, status) {
+    super(message);
+    this.name = "FederatedCredentialsAuthenticationError";
+    this.status = status;
+  }
+}
+var buildFederatedError = ({
+  status,
+  errorType,
+  errorDesc
+}) => {
+  let troubleshooting = "";
+  if (errorType === "invalid_client" || errorType === "invalid_grant" || errorType === "invalid_request" || status === 401) {
+    troubleshooting = `
 
 Troubleshooting:` + `
-  • Verify your Client ID is correct` + `
-  • Ensure your Client Secret hasn't expired` + `
-  • Check that the external application is enabled in UiPath` + `
+  • Verify your Client ID matches the external application` + `
+  • Confirm a federated credential is registered on the app whose` + `
+    issuer, audience, and subject exactly match the token's claims` + `
+    (list them: uip admin external-apps federated-credentials list <client-id>)` + `
+  • Check the token was issued by the expected provider and has not expired` + `
   • Confirm you're using the correct authority URL`;
-    } else if (errorType === "invalid_scope") {
-      troubleshooting = `
+  } else if (errorType === "invalid_scope") {
+    troubleshooting = `
 
 Troubleshooting:` + `
-  • The requested scopes may not be available for your account` + `
+  • The requested scopes may not be available for your application` + `
   • Try using default scopes or contact your UiPath administrator`;
-    }
-    throw new ClientCredentialsAuthenticationError(`Client Credentials authentication failed (${tokenResponse.status})
-` + `Error: ${errorType}
-` + `Details: ${errorDesc}${troubleshooting}`, tokenResponse.status);
   }
-  return {
-    UIPATH_ACCESS_TOKEN: tokenData.access_token,
-    UIPATH_URL: config.baseUrl
+  return new FederatedCredentialsAuthenticationError(`Federated Credentials authentication failed (${status})
+` + `Error: ${errorType}
+` + `Details: ${errorDesc}${troubleshooting}`, status);
+};
+var federatedCredentialsLogin = async ({
+  clientId,
+  clientAssertion,
+  scope,
+  authority
+}) => {
+  const config = await resolveConfigAsync({
+    customAuthority: authority,
+    customClientId: clientId,
+    customClientAssertion: clientAssertion,
+    customScopes: scope
+  });
+  const params = {
+    grant_type: "client_credentials",
+    client_id: config.clientId,
+    client_assertion: clientAssertion,
+    client_assertion_type: JWT_BEARER_ASSERTION_TYPE
   };
+  if (config.scopes.length > 0) {
+    params.scope = config.scopes.join(" ");
+  }
+  return await requestClientCredentialsToken({
+    tokenEndpoint: config.tokenEndpoint,
+    baseUrl: config.baseUrl,
+    params,
+    buildError: buildFederatedError
+  });
 };
-
-// src/index.ts
-init_constants();
-
 // src/interactive.ts
 init_src();
 
@@ -21660,6 +21766,7 @@ var interactiveLoginWithDeps = async (options, deps) => {
   const {
     resolveConfig = resolveConfigAsync,
     clientCredentials = clientCredentialsLogin,
+    federatedCredentials = federatedCredentialsLogin,
     auth = authenticate,
     saveEnvFile = saveEnvFileAsync,
     loadEnvFile = loadEnvFileAsync,
@@ -21674,6 +21781,7 @@ var interactiveLoginWithDeps = async (options, deps) => {
     authority,
     clientId,
     clientSecret,
+    clientAssertion,
     tenant,
     organization,
     interactive,
@@ -21699,14 +21807,22 @@ var interactiveLoginWithDeps = async (options, deps) => {
   const config = await resolveConfig({
     customAuthority: authority,
     customClientId: clientId,
-    customClientSecret: clientSecret
+    customClientSecret: clientSecret,
+    customClientAssertion: clientAssertion
   });
   const { clientSecret: resolvedSecret } = config;
-  if (noBrowser && !resolvedSecret && !onEvent) {
+  if (noBrowser && !resolvedSecret && !clientAssertion && !onEvent) {
     throw new Error("noBrowser login requires an onEvent subscriber to receive the " + "auth-url event — the authorize URL is delivered through it.");
   }
-  const authFlow = resolvedSecret ? "client_credentials" : "authorization_code";
-  const authPromise = resolvedSecret ? (async () => {
+  const authFlow = clientAssertion ? "federated_credentials" : resolvedSecret ? "client_credentials" : "authorization_code";
+  const authPromise = clientAssertion ? (async () => {
+    return await federatedCredentials({
+      clientId: config.clientId,
+      clientAssertion,
+      authority: config.baseUrl,
+      scope
+    });
+  })() : resolvedSecret ? (async () => {
     return await clientCredentials({
       clientId: config.clientId,
       clientSecret: resolvedSecret,
@@ -21740,6 +21856,9 @@ var interactiveLoginWithDeps = async (options, deps) => {
     UIPATH_URL: config.baseUrl,
     [AUTH_FLOW_ENV_VAR]: authFlow
   };
+  if (authFlow !== "authorization_code") {
+    credentials.UIPATH_REFRESH_TOKEN = undefined;
+  }
   try {
     const tokenData = jwtParser(tokens.UIPATH_ACCESS_TOKEN);
     const orgId = tokenData.prtId || tokenData.organizationId || tokenData.prt_id;
@@ -21975,6 +22094,7 @@ export {
   getActiveAuthProfileFilePath,
   getActiveAuthProfile,
   fetchTenantsAndOrganizations,
+  federatedCredentialsLogin,
   clientCredentialsLogin,
   clearRefreshBreaker,
   clearActiveAuthProfile,
@@ -21984,9 +22104,11 @@ export {
   TenantSelectionError,
   TENANT_SELECTION_REQUIRED_CODE,
   LoginStatusSource,
+  JWT_BEARER_ASSERTION_TYPE,
   InvalidTenantError,
   InvalidBaseUrlError,
   INVALID_TENANT_CODE,
+  FederatedCredentialsAuthenticationError,
   EnvAuthConfigError,
   ENV_AUTH_VARS,
   ENV_AUTH_ENABLE_VAR,
@@ -22001,4 +22123,4 @@ export {
   AUTH_CANCELLED_ERROR_CODE
 };
 
-//# debugId=C5F963336170300664756E2164756E21
+//# debugId=66CC81FE55A926CF64756E2164756E21

package/dist/interactive.d.ts

@@ -1,6 +1,7 @@
 import { getFileSystem } from "@uipath/filesystem";
 import { clientCredentialsLogin } from "./clientCredentials";
 import { resolveConfigAsync } from "./config";
+import { federatedCredentialsLogin } from "./federatedCredentials";
 import { authenticate } from "./index";
 import { type SelectFromList } from "./selectTenant";
 import { type BaseCredentials } from "./types";
@@ -34,6 +35,13 @@ interface InteractiveLoginOptions {
     authority?: string;
     clientId?: string;
     clientSecret?: string;
+    /**
+     * OIDC token (client assertion) for workload identity federation. When
+     * set, the federated flow is used instead of client credentials or the
+     * browser flow — the token is exchanged for a UiPath access token and is
+     * never persisted. Mutually exclusive with `clientSecret`.
+     */
+    clientAssertion?: string;
     tenant?: string;
     organization?: string;
     interactive?: boolean;
@@ -74,6 +82,7 @@ interface InteractiveLoginOptions {
 export interface InteractiveLoginDependencies {
     resolveConfig?: typeof resolveConfigAsync;
     clientCredentials?: typeof clientCredentialsLogin;
+    federatedCredentials?: typeof federatedCredentialsLogin;
     auth?: typeof authenticate;
     saveEnvFile?: typeof saveEnvFileAsync;
     loadEnvFile?: typeof loadEnvFileAsync;

package/dist/tokenGrant.d.ts

@@ -0,0 +1,28 @@
+import type { BaseCredentials } from "./types";
+interface RequestTokenProps {
+    tokenEndpoint: string;
+    baseUrl: string;
+    params: Record<string, string>;
+    /**
+     * Flow-specific error factory. Receives the HTTP status and the parsed
+     * OAuth `error` / `error_description` (defaulted) so each flow can render
+     * its own message and troubleshooting while sharing the request plumbing.
+     */
+    buildError: (args: {
+        status: number;
+        errorType: string;
+        errorDesc: string;
+    }) => Error;
+}
+/**
+ * POST an OAuth 2.0 `client_credentials` token request and return
+ * {@link BaseCredentials}. Shared by the secret-based client-credentials flow
+ * and the federated (jwt-bearer client-assertion) flow — the only differences
+ * are the POST parameters and the error message, both injected by the caller.
+ *
+ * Parses the response body defensively: a non-JSON body (proxy/WAF HTML, empty
+ * body) or a 2xx response missing `access_token` surfaces the flow's friendly
+ * error instead of a raw `SyntaxError` or an undefined token leaking downstream.
+ */
+export declare const requestClientCredentialsToken: ({ tokenEndpoint, baseUrl, params, buildError, }: RequestTokenProps) => Promise<BaseCredentials>;
+export {};

package/dist/types.d.ts

@@ -1,5 +1,5 @@
 export declare const AUTH_FLOW_ENV_VAR = "UIPATH_AUTH_FLOW";
-export type AuthFlow = "authorization_code" | "client_credentials";
+export type AuthFlow = "authorization_code" | "client_credentials" | "federated_credentials";
 export interface BaseCredentials {
     UIPATH_ACCESS_TOKEN: string;
     UIPATH_REFRESH_TOKEN?: string;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@uipath/auth",
   "license": "MIT",
-  "version": "1.198.0",
+  "version": "1.199.0-preview.104",
   "repository": {
     "type": "git",
     "url": "https://github.com/UiPath/cli.git",
@@ -37,5 +37,5 @@
     "mihaigirleanu",
     "vlad-uipath"
   ],
-  "gitHead": "1fadf03d7a8dd102742571dff569fdac11808afb"
+  "gitHead": "829a8ab8a25bce5b62c284bd1ddc674d2947f647"
 }