@voltro/plugin-auth-workos 0.81.0 → 0.82.0

package/dist/index.d.ts

@@ -179,6 +179,22 @@ export declare interface WorkosLoginHandoff {
     readonly codeVerifier: string;
 }
 
+export declare interface WorkosLogoutOptions {
+    /** {@link WorkosProfile.sessionId} of the sign-in being ended. */
+    readonly sessionId: string;
+    /** Where WorkOS sends the browser afterwards. Register it as a logout
+     *  redirect of the WorkOS application. */
+    readonly returnTo?: string;
+    readonly apiBase?: string;
+}
+
+/**
+ * The URL that ends a WorkOS session — redirect the browser there at
+ * sign-out, after clearing your own session. Every application sharing that
+ * WorkOS session is signed out with it; the next sign-in asks again.
+ */
+export declare const workosLogoutUrl: (o: WorkosLogoutOptions) => string;
+
 export declare interface WorkosMagicAuthSendOptions {
     /** WorkOS API key (`sk_…`) — sent as a Bearer token. Server-only. */
     readonly apiKey: string;
@@ -219,11 +235,23 @@ export declare interface WorkosOrganization {
 export declare interface WorkosProfile {
     readonly workosUserId: string;
     readonly email: string;
+    /** Whether WorkOS has verified that the person controls `email`. An app
+     *  that finds or links an existing account BY EMAIL must refuse when this
+     *  is false: an identity provider that hands out unverified addresses would
+     *  otherwise let anyone claim another person's account. Read from WorkOS's
+     *  `email_verified`; absent counts as unverified. */
+    readonly emailVerified: boolean;
     readonly firstName: string | null;
     readonly lastName: string | null;
     /** The WorkOS organization the user authenticated into, when SSO/org
      *  membership applies. Null for a plain AuthKit user. */
     readonly organizationId: string | null;
+    /** The WorkOS session this sign-in opened — the `sid` claim of the access
+     *  token WorkOS returned. Keep it (server-side, e.g. an HttpOnly cookie) to
+     *  end that session at sign-out with {@link workosLogoutUrl}; without it,
+     *  signing out of your app leaves the WorkOS session — and every other app
+     *  sharing it — signed in. Null when WorkOS returned no access token. */
+    readonly sessionId: string | null;
 }
 
 /**

package/dist/index.js

@@ -51,11 +51,26 @@ var i = "https://api.workos.com", a = "wos-session", o = (t) => {
 	return {
 		workosUserId: n.id,
 		email: n.email,
+		emailVerified: n.email_verified === !0,
 		firstName: n.first_name ?? null,
 		lastName: n.last_name ?? null,
-		organizationId: t.organization_id ?? null
+		organizationId: t.organization_id ?? null,
+		sessionId: h(t.access_token)
 	};
-}, h = async (e) => {
+}, h = (e) => {
+	let t = e?.split(".")[1];
+	if (!t) return null;
+	try {
+		let e = JSON.parse(Buffer.from(t, "base64url").toString("utf8"));
+		return typeof e.sid == "string" && e.sid !== "" ? e.sid : null;
+	} catch {
+		return null;
+	}
+}, g = (e) => {
+	if (!e.sessionId) throw Error("workosLogoutUrl: `sessionId` is required");
+	let t = new URLSearchParams({ session_id: e.sessionId });
+	return e.returnTo && t.set("return_to", e.returnTo), `${e.apiBase ?? s}/user_management/sessions/logout?${t.toString()}`;
+}, _ = async (e) => {
 	if (!e.code) throw new f(400, "workosAuthenticateWithCode: missing `code`");
 	if (!e.expectedState) throw new p("workosAuthenticateWithCode: no `expectedState` — the login was never started by this server, or the state cookie expired. Refusing to exchange the code.");
 	if (!e.state || !r(e.state, e.expectedState)) throw new p("workosAuthenticateWithCode: `state` does not match the value minted for this browser (possible CSRF).");
@@ -71,7 +86,7 @@ var i = "https://api.workos.com", a = "wos-session", o = (t) => {
 			code_verifier: e.codeVerifier
 		})
 	}));
-}, g = async (e) => {
+}, v = async (e) => {
 	if (!e.email) throw new f(400, "workosSendMagicAuthCode: missing `email`");
 	let t = await (e.fetchImpl ?? fetch)(`${e.apiBase ?? s}/user_management/magic_auth`, {
 		method: "POST",
@@ -85,7 +100,7 @@ var i = "https://api.workos.com", a = "wos-session", o = (t) => {
 		let e = await t.text().catch(() => "");
 		throw new f(t.status, `WorkOS magic-auth send failed (${t.status}): ${e.slice(0, 200)}`);
 	}
-}, _ = async (e) => {
+}, y = async (e) => {
 	if (!e.code) throw new f(400, "workosAuthenticateWithMagicAuth: missing `code`");
 	if (!e.email) throw new f(400, "workosAuthenticateWithMagicAuth: missing `email`");
 	return m(await (e.fetchImpl ?? fetch)(`${e.apiBase ?? s}/user_management/authenticate`, {
@@ -99,8 +114,8 @@ var i = "https://api.workos.com", a = "wos-session", o = (t) => {
 			email: e.email
 		})
 	}));
-}, v = "https://api.workos.com", y = async (e, t, n, r) => {
-	let i = await (e.fetchImpl ?? fetch)(`${e.apiBase ?? v}${n}`, {
+}, b = "https://api.workos.com", x = async (e, t, n, r) => {
+	let i = await (e.fetchImpl ?? fetch)(`${e.apiBase ?? b}${n}`, {
 		method: t,
 		headers: {
 			authorization: `Bearer ${e.apiKey}`,
@@ -113,15 +128,15 @@ var i = "https://api.workos.com", a = "wos-session", o = (t) => {
 		throw new f(i.status, `WorkOS ${t} ${n} failed (${i.status}): ${e.slice(0, 200)}`);
 	}
 	if (i.status !== 204) return await i.json();
-}, b = (e) => {
+}, S = (e) => {
 	if (!e.id) throw new f(502, "WorkOS organization response missing id");
 	return {
 		id: e.id,
 		name: e.name ?? ""
 	};
-}, x = async (e) => {
+}, C = async (e) => {
 	if (!e.name) throw new f(400, "workosCreateOrganization: missing `name`");
-	let t = await (e.fetchImpl ?? fetch)(`${e.apiBase ?? v}/organizations`, {
+	let t = await (e.fetchImpl ?? fetch)(`${e.apiBase ?? b}/organizations`, {
 		method: "POST",
 		headers: {
 			authorization: `Bearer ${e.apiKey}`,
@@ -134,8 +149,8 @@ var i = "https://api.workos.com", a = "wos-session", o = (t) => {
 		let e = await t.text().catch(() => "");
 		throw new f(t.status, `WorkOS create organization failed (${t.status}): ${e.slice(0, 200)}`);
 	}
-	return b(await t.json());
-}, S = async (e) => b(await y(e, "GET", `/organizations/${encodeURIComponent(e.organizationId)}`)), C = async (e) => b(await y(e, "PUT", `/organizations/${encodeURIComponent(e.organizationId)}`, { name: e.name })), w = (e) => {
+	return S(await t.json());
+}, w = async (e) => S(await x(e, "GET", `/organizations/${encodeURIComponent(e.organizationId)}`)), T = async (e) => S(await x(e, "PUT", `/organizations/${encodeURIComponent(e.organizationId)}`, { name: e.name })), E = (e) => {
 	if (!e.id || !e.user_id || !e.organization_id) throw new f(502, "WorkOS membership response missing id/user_id/organization_id");
 	return {
 		id: e.id,
@@ -144,11 +159,11 @@ var i = "https://api.workos.com", a = "wos-session", o = (t) => {
 		roleSlug: e.role?.slug ?? null,
 		status: e.status ?? "active"
 	};
-}, T = async (e) => w(await y(e, "POST", "/user_management/organization_memberships", {
+}, D = async (e) => E(await x(e, "POST", "/user_management/organization_memberships", {
 	user_id: e.userId,
 	organization_id: e.organizationId,
 	...e.roleSlug ? { role_slug: e.roleSlug } : {}
-})), E = async (e) => {
+})), O = async (e) => {
 	let t = [], n;
 	for (let r = 0; r < 100; r++) {
 		let r = new URLSearchParams({
@@ -156,18 +171,18 @@ var i = "https://api.workos.com", a = "wos-session", o = (t) => {
 			limit: "100"
 		});
 		n && r.set("after", n);
-		let i = await y(e, "GET", `/user_management/organization_memberships?${r.toString()}`);
-		for (let e of i.data ?? []) t.push(w(e));
+		let i = await x(e, "GET", `/user_management/organization_memberships?${r.toString()}`);
+		for (let e of i.data ?? []) t.push(E(e));
 		let a = i.list_metadata?.after;
 		if (!a) break;
 		n = a;
 	}
 	return t;
-}, D = async (e) => {
-	await y(e, "DELETE", `/user_management/organization_memberships/${encodeURIComponent(e.membershipId)}`);
-}, O = async (e) => {
+}, k = async (e) => {
+	await x(e, "DELETE", `/user_management/organization_memberships/${encodeURIComponent(e.membershipId)}`);
+}, A = async (e) => {
 	if (!e.email) throw new f(400, "workosCreateInvitation: missing `email`");
-	let t = await y(e, "POST", "/user_management/invitations", {
+	let t = await x(e, "POST", "/user_management/invitations", {
 		email: e.email,
 		organization_id: e.organizationId,
 		...e.roleSlug ? { role_slug: e.roleSlug } : {},
@@ -182,4 +197,4 @@ var i = "https://api.workos.com", a = "wos-session", o = (t) => {
 	};
 };
 //#endregion
-export { f as WorkosExchangeError, p as WorkosStateMismatchError, h as workosAuthenticateWithCode, _ as workosAuthenticateWithMagicAuth, d as workosBeginLogin, O as workosCreateInvitation, T as workosCreateMembership, x as workosCreateOrganization, D as workosDeleteMembership, S as workosGetOrganization, E as workosListUserMemberships, g as workosSendMagicAuthCode, o as workosStrategy, C as workosUpdateOrganization };
+export { f as WorkosExchangeError, p as WorkosStateMismatchError, _ as workosAuthenticateWithCode, y as workosAuthenticateWithMagicAuth, d as workosBeginLogin, A as workosCreateInvitation, D as workosCreateMembership, C as workosCreateOrganization, k as workosDeleteMembership, w as workosGetOrganization, O as workosListUserMemberships, g as workosLogoutUrl, v as workosSendMagicAuthCode, o as workosStrategy, T as workosUpdateOrganization };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-auth-workos",
-  "version": "0.81.0",
+  "version": "0.82.0",
   "description": "WorkOS-backed AuthStrategy for the Voltro framework. Verifies WorkOS AuthKit/SSO JWTs via JWKS and maps `org_id`→tenant. Composes via @voltro/protocol AuthStrategy alongside other IdP plugins.",
   "keywords": [
     "voltro",
@@ -33,7 +33,7 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@voltro/protocol": "0.81.0"
+    "@voltro/protocol": "0.82.0"
   },
   "peerDependencies": {
     "effect": "^3.22.2"