@voltro/plugin-auth-workos 0.85.0 → 0.87.0

package/dist/index.js

@@ -1,200 +1,4 @@
-import { jwtBearerStrategy as e } from "@voltro/protocol/jwt";
-import { createHash as t, randomBytes as n } from "node:crypto";
-import { timingSafeStringEqual as r } from "@voltro/protocol/session";
-//#region src/strategy.ts
-var i = "https://api.workos.com", a = "wos-session", o = (t) => {
-	if (!t.clientId) throw Error("workosStrategy: `clientId` is required");
-	let n = t.scopesFromClaims;
-	return e({
-		id: "workos",
-		jwksUrl: t.jwksUrl ?? `${i}/sso/jwks/${t.clientId}`,
-		issuer: t.issuer ?? i,
-		audience: t.clientId,
-		algorithms: ["RS256", "ES256"],
-		cookieName: t.cookieName === void 0 ? a : t.cookieName,
-		tenantIdFromClaims: (e) => t.tenantIdFromClaims?.(e) ?? (typeof e.org_id == "string" ? e.org_id : void 0) ?? t.defaultTenantId ?? null,
-		...n === void 0 ? {} : { scopesFromClaims: (e) => n(e) }
-	});
-}, s = "https://api.workos.com", c = (e) => e.toString("base64url"), l = () => c(n(32)), u = (e) => c(t("sha256").update(e, "ascii").digest()), d = (e) => {
-	if (!e.clientId) throw Error("workosBeginLogin: `clientId` is required");
-	if (!e.redirectUri) throw Error("workosBeginLogin: `redirectUri` is required");
-	let t = e.randomness?.state ?? l(), n = e.randomness?.codeVerifier ?? l(), r = new URLSearchParams({
-		client_id: e.clientId,
-		redirect_uri: e.redirectUri,
-		response_type: "code",
-		provider: e.provider ?? "authkit",
-		state: t,
-		code_challenge: u(n),
-		code_challenge_method: "S256"
-	});
-	return e.loginHint && r.set("login_hint", e.loginHint), {
-		url: `${e.apiBase ?? s}/user_management/authorize?${r.toString()}`,
-		state: t,
-		codeVerifier: n
-	};
-}, f = class extends Error {
-	status;
-	constructor(e, t) {
-		super(t), this.status = e, this.name = "WorkosExchangeError";
-	}
-}, p = class extends f {
-	constructor(e) {
-		super(400, e), this.name = "WorkosStateMismatchError";
-	}
-}, m = async (e) => {
-	if (!e.ok) {
-		let t = await e.text().catch(() => "");
-		throw new f(e.status, `WorkOS authenticate failed (${e.status}): ${t.slice(0, 200)}`);
-	}
-	let t = await e.json(), n = t.user;
-	if (!n?.id || !n.email) throw new f(e.status, "WorkOS authenticate response missing user id/email");
-	return {
-		workosUserId: n.id,
-		email: n.email,
-		emailVerified: n.email_verified === !0,
-		firstName: n.first_name ?? null,
-		lastName: n.last_name ?? null,
-		organizationId: t.organization_id ?? null,
-		sessionId: h(t.access_token)
-	};
-}, h = (e) => {
-	let t = e?.split(".")[1];
-	if (!t) return null;
-	try {
-		let e = JSON.parse(Buffer.from(t, "base64url").toString("utf8"));
-		return typeof e.sid == "string" && e.sid !== "" ? e.sid : null;
-	} catch {
-		return null;
-	}
-}, g = (e) => {
-	if (!e.sessionId) throw Error("workosLogoutUrl: `sessionId` is required");
-	let t = new URLSearchParams({ session_id: e.sessionId });
-	return e.returnTo && t.set("return_to", e.returnTo), `${e.apiBase ?? s}/user_management/sessions/logout?${t.toString()}`;
-}, _ = async (e) => {
-	if (!e.code) throw new f(400, "workosAuthenticateWithCode: missing `code`");
-	if (!e.expectedState) throw new p("workosAuthenticateWithCode: no `expectedState` — the login was never started by this server, or the state cookie expired. Refusing to exchange the code.");
-	if (!e.state || !r(e.state, e.expectedState)) throw new p("workosAuthenticateWithCode: `state` does not match the value minted for this browser (possible CSRF).");
-	if (!e.codeVerifier) throw new f(400, "workosAuthenticateWithCode: missing `codeVerifier` (PKCE)");
-	return m(await (e.fetchImpl ?? fetch)(`${e.apiBase ?? s}/user_management/authenticate`, {
-		method: "POST",
-		headers: { "content-type": "application/json" },
-		body: JSON.stringify({
-			client_id: e.clientId,
-			client_secret: e.apiKey,
-			grant_type: "authorization_code",
-			code: e.code,
-			code_verifier: e.codeVerifier
-		})
-	}));
-}, v = async (e) => {
-	if (!e.email) throw new f(400, "workosSendMagicAuthCode: missing `email`");
-	let t = await (e.fetchImpl ?? fetch)(`${e.apiBase ?? s}/user_management/magic_auth`, {
-		method: "POST",
-		headers: {
-			"content-type": "application/json",
-			authorization: `Bearer ${e.apiKey}`
-		},
-		body: JSON.stringify({ email: e.email })
-	});
-	if (!t.ok) {
-		let e = await t.text().catch(() => "");
-		throw new f(t.status, `WorkOS magic-auth send failed (${t.status}): ${e.slice(0, 200)}`);
-	}
-}, y = async (e) => {
-	if (!e.code) throw new f(400, "workosAuthenticateWithMagicAuth: missing `code`");
-	if (!e.email) throw new f(400, "workosAuthenticateWithMagicAuth: missing `email`");
-	return m(await (e.fetchImpl ?? fetch)(`${e.apiBase ?? s}/user_management/authenticate`, {
-		method: "POST",
-		headers: { "content-type": "application/json" },
-		body: JSON.stringify({
-			client_id: e.clientId,
-			client_secret: e.apiKey,
-			grant_type: "urn:workos:oauth:grant-type:magic-auth:code",
-			code: e.code,
-			email: e.email
-		})
-	}));
-}, b = "https://api.workos.com", x = async (e, t, n, r) => {
-	let i = await (e.fetchImpl ?? fetch)(`${e.apiBase ?? b}${n}`, {
-		method: t,
-		headers: {
-			authorization: `Bearer ${e.apiKey}`,
-			...r === void 0 ? {} : { "content-type": "application/json" }
-		},
-		...r === void 0 ? {} : { body: JSON.stringify(r) }
-	});
-	if (!i.ok) {
-		let e = await i.text().catch(() => "");
-		throw new f(i.status, `WorkOS ${t} ${n} failed (${i.status}): ${e.slice(0, 200)}`);
-	}
-	if (i.status !== 204) return await i.json();
-}, S = (e) => {
-	if (!e.id) throw new f(502, "WorkOS organization response missing id");
-	return {
-		id: e.id,
-		name: e.name ?? ""
-	};
-}, C = async (e) => {
-	if (!e.name) throw new f(400, "workosCreateOrganization: missing `name`");
-	let t = await (e.fetchImpl ?? fetch)(`${e.apiBase ?? b}/organizations`, {
-		method: "POST",
-		headers: {
-			authorization: `Bearer ${e.apiKey}`,
-			"content-type": "application/json",
-			...e.idempotencyKey ? { "idempotency-key": e.idempotencyKey } : {}
-		},
-		body: JSON.stringify({ name: e.name })
-	});
-	if (!t.ok) {
-		let e = await t.text().catch(() => "");
-		throw new f(t.status, `WorkOS create organization failed (${t.status}): ${e.slice(0, 200)}`);
-	}
-	return S(await t.json());
-}, w = async (e) => S(await x(e, "GET", `/organizations/${encodeURIComponent(e.organizationId)}`)), T = async (e) => S(await x(e, "PUT", `/organizations/${encodeURIComponent(e.organizationId)}`, { name: e.name })), E = (e) => {
-	if (!e.id || !e.user_id || !e.organization_id) throw new f(502, "WorkOS membership response missing id/user_id/organization_id");
-	return {
-		id: e.id,
-		userId: e.user_id,
-		organizationId: e.organization_id,
-		roleSlug: e.role?.slug ?? null,
-		status: e.status ?? "active"
-	};
-}, D = async (e) => E(await x(e, "POST", "/user_management/organization_memberships", {
-	user_id: e.userId,
-	organization_id: e.organizationId,
-	...e.roleSlug ? { role_slug: e.roleSlug } : {}
-})), O = async (e) => {
-	let t = [], n;
-	for (let r = 0; r < 100; r++) {
-		let r = new URLSearchParams({
-			user_id: e.userId,
-			limit: "100"
-		});
-		n && r.set("after", n);
-		let i = await x(e, "GET", `/user_management/organization_memberships?${r.toString()}`);
-		for (let e of i.data ?? []) t.push(E(e));
-		let a = i.list_metadata?.after;
-		if (!a) break;
-		n = a;
-	}
-	return t;
-}, k = async (e) => {
-	await x(e, "DELETE", `/user_management/organization_memberships/${encodeURIComponent(e.membershipId)}`);
-}, A = async (e) => {
-	if (!e.email) throw new f(400, "workosCreateInvitation: missing `email`");
-	let t = await x(e, "POST", "/user_management/invitations", {
-		email: e.email,
-		organization_id: e.organizationId,
-		...e.roleSlug ? { role_slug: e.roleSlug } : {},
-		...e.inviterUserId ? { inviter_user_id: e.inviterUserId } : {}
-	});
-	if (!t.id || !t.email) throw new f(502, "WorkOS invitation response missing id/email");
-	return {
-		id: t.id,
-		email: t.email,
-		organizationId: t.organization_id ?? null,
-		state: t.state ?? "pending"
-	};
-};
-//#endregion
-export { f as WorkosExchangeError, p as WorkosStateMismatchError, _ as workosAuthenticateWithCode, y as workosAuthenticateWithMagicAuth, d as workosBeginLogin, A as workosCreateInvitation, D as workosCreateMembership, C as workosCreateOrganization, k as workosDeleteMembership, w as workosGetOrganization, O as workosListUserMemberships, g as workosLogoutUrl, v as workosSendMagicAuthCode, o as workosStrategy, T as workosUpdateOrganization };
+import { workosStrategy as e } from "./strategy.js";
+import { WorkosExchangeError as t, WorkosStateMismatchError as n, workosAuthenticateWithCode as r, workosAuthenticateWithMagicAuth as i, workosBeginLogin as a, workosLogoutUrl as o, workosSendMagicAuthCode as s } from "./oauth.js";
+import { workosCreateInvitation as c, workosCreateMembership as l, workosCreateOrganization as u, workosDeleteMembership as d, workosGetOrganization as f, workosListUserMemberships as p, workosUpdateOrganization as m } from "./organizations.js";
+export { t as WorkosExchangeError, n as WorkosStateMismatchError, r as workosAuthenticateWithCode, i as workosAuthenticateWithMagicAuth, a as workosBeginLogin, c as workosCreateInvitation, l as workosCreateMembership, u as workosCreateOrganization, d as workosDeleteMembership, f as workosGetOrganization, p as workosListUserMemberships, o as workosLogoutUrl, s as workosSendMagicAuthCode, e as workosStrategy, m as workosUpdateOrganization };

package/dist/oauth.js

@@ -0,0 +1,105 @@
+import { createHash as e, randomBytes as t } from "node:crypto";
+import { timingSafeStringEqual as n } from "@voltro/protocol/session";
+//#region src/oauth.ts
+var r = "https://api.workos.com", i = (e) => e.toString("base64url"), a = () => i(t(32)), o = (t) => i(e("sha256").update(t, "ascii").digest()), s = (e) => {
+	if (!e.clientId) throw Error("workosBeginLogin: `clientId` is required");
+	if (!e.redirectUri) throw Error("workosBeginLogin: `redirectUri` is required");
+	let t = e.randomness?.state ?? a(), n = e.randomness?.codeVerifier ?? a(), i = new URLSearchParams({
+		client_id: e.clientId,
+		redirect_uri: e.redirectUri,
+		response_type: "code",
+		provider: e.provider ?? "authkit",
+		state: t,
+		code_challenge: o(n),
+		code_challenge_method: "S256"
+	});
+	return e.loginHint && i.set("login_hint", e.loginHint), {
+		url: `${e.apiBase ?? r}/user_management/authorize?${i.toString()}`,
+		state: t,
+		codeVerifier: n
+	};
+}, c = class extends Error {
+	status;
+	constructor(e, t) {
+		super(t), this.status = e, this.name = "WorkosExchangeError";
+	}
+}, l = class extends c {
+	constructor(e) {
+		super(400, e), this.name = "WorkosStateMismatchError";
+	}
+}, u = async (e) => {
+	if (!e.ok) {
+		let t = await e.text().catch(() => "");
+		throw new c(e.status, `WorkOS authenticate failed (${e.status}): ${t.slice(0, 200)}`);
+	}
+	let t = await e.json(), n = t.user;
+	if (!n?.id || !n.email) throw new c(e.status, "WorkOS authenticate response missing user id/email");
+	return {
+		workosUserId: n.id,
+		email: n.email,
+		emailVerified: n.email_verified === !0,
+		firstName: n.first_name ?? null,
+		lastName: n.last_name ?? null,
+		organizationId: t.organization_id ?? null,
+		sessionId: d(t.access_token)
+	};
+}, d = (e) => {
+	let t = e?.split(".")[1];
+	if (!t) return null;
+	try {
+		let e = JSON.parse(Buffer.from(t, "base64url").toString("utf8"));
+		return typeof e.sid == "string" && e.sid !== "" ? e.sid : null;
+	} catch {
+		return null;
+	}
+}, f = (e) => {
+	if (!e.sessionId) throw Error("workosLogoutUrl: `sessionId` is required");
+	let t = new URLSearchParams({ session_id: e.sessionId });
+	return e.returnTo && t.set("return_to", e.returnTo), `${e.apiBase ?? r}/user_management/sessions/logout?${t.toString()}`;
+}, p = async (e) => {
+	if (!e.code) throw new c(400, "workosAuthenticateWithCode: missing `code`");
+	if (!e.expectedState) throw new l("workosAuthenticateWithCode: no `expectedState` — the login was never started by this server, or the state cookie expired. Refusing to exchange the code.");
+	if (!e.state || !n(e.state, e.expectedState)) throw new l("workosAuthenticateWithCode: `state` does not match the value minted for this browser (possible CSRF).");
+	if (!e.codeVerifier) throw new c(400, "workosAuthenticateWithCode: missing `codeVerifier` (PKCE)");
+	return u(await (e.fetchImpl ?? fetch)(`${e.apiBase ?? r}/user_management/authenticate`, {
+		method: "POST",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify({
+			client_id: e.clientId,
+			client_secret: e.apiKey,
+			grant_type: "authorization_code",
+			code: e.code,
+			code_verifier: e.codeVerifier
+		})
+	}));
+}, m = async (e) => {
+	if (!e.email) throw new c(400, "workosSendMagicAuthCode: missing `email`");
+	let t = await (e.fetchImpl ?? fetch)(`${e.apiBase ?? r}/user_management/magic_auth`, {
+		method: "POST",
+		headers: {
+			"content-type": "application/json",
+			authorization: `Bearer ${e.apiKey}`
+		},
+		body: JSON.stringify({ email: e.email })
+	});
+	if (!t.ok) {
+		let e = await t.text().catch(() => "");
+		throw new c(t.status, `WorkOS magic-auth send failed (${t.status}): ${e.slice(0, 200)}`);
+	}
+}, h = async (e) => {
+	if (!e.code) throw new c(400, "workosAuthenticateWithMagicAuth: missing `code`");
+	if (!e.email) throw new c(400, "workosAuthenticateWithMagicAuth: missing `email`");
+	return u(await (e.fetchImpl ?? fetch)(`${e.apiBase ?? r}/user_management/authenticate`, {
+		method: "POST",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify({
+			client_id: e.clientId,
+			client_secret: e.apiKey,
+			grant_type: "urn:workos:oauth:grant-type:magic-auth:code",
+			code: e.code,
+			email: e.email
+		})
+	}));
+};
+//#endregion
+export { c as WorkosExchangeError, l as WorkosStateMismatchError, p as workosAuthenticateWithCode, h as workosAuthenticateWithMagicAuth, s as workosBeginLogin, f as workosLogoutUrl, m as workosSendMagicAuthCode };

package/dist/organizations.js

@@ -0,0 +1,86 @@
+import { WorkosExchangeError as e } from "./oauth.js";
+//#region src/organizations.ts
+var t = "https://api.workos.com", n = async (n, r, i, a) => {
+	let o = await (n.fetchImpl ?? fetch)(`${n.apiBase ?? t}${i}`, {
+		method: r,
+		headers: {
+			authorization: `Bearer ${n.apiKey}`,
+			...a === void 0 ? {} : { "content-type": "application/json" }
+		},
+		...a === void 0 ? {} : { body: JSON.stringify(a) }
+	});
+	if (!o.ok) {
+		let t = await o.text().catch(() => "");
+		throw new e(o.status, `WorkOS ${r} ${i} failed (${o.status}): ${t.slice(0, 200)}`);
+	}
+	if (o.status !== 204) return await o.json();
+}, r = (t) => {
+	if (!t.id) throw new e(502, "WorkOS organization response missing id");
+	return {
+		id: t.id,
+		name: t.name ?? ""
+	};
+}, i = async (n) => {
+	if (!n.name) throw new e(400, "workosCreateOrganization: missing `name`");
+	let i = await (n.fetchImpl ?? fetch)(`${n.apiBase ?? t}/organizations`, {
+		method: "POST",
+		headers: {
+			authorization: `Bearer ${n.apiKey}`,
+			"content-type": "application/json",
+			...n.idempotencyKey ? { "idempotency-key": n.idempotencyKey } : {}
+		},
+		body: JSON.stringify({ name: n.name })
+	});
+	if (!i.ok) {
+		let t = await i.text().catch(() => "");
+		throw new e(i.status, `WorkOS create organization failed (${i.status}): ${t.slice(0, 200)}`);
+	}
+	return r(await i.json());
+}, a = async (e) => r(await n(e, "GET", `/organizations/${encodeURIComponent(e.organizationId)}`)), o = async (e) => r(await n(e, "PUT", `/organizations/${encodeURIComponent(e.organizationId)}`, { name: e.name })), s = (t) => {
+	if (!t.id || !t.user_id || !t.organization_id) throw new e(502, "WorkOS membership response missing id/user_id/organization_id");
+	return {
+		id: t.id,
+		userId: t.user_id,
+		organizationId: t.organization_id,
+		roleSlug: t.role?.slug ?? null,
+		status: t.status ?? "active"
+	};
+}, c = async (e) => s(await n(e, "POST", "/user_management/organization_memberships", {
+	user_id: e.userId,
+	organization_id: e.organizationId,
+	...e.roleSlug ? { role_slug: e.roleSlug } : {}
+})), l = async (e) => {
+	let t = [], r;
+	for (let i = 0; i < 100; i++) {
+		let i = new URLSearchParams({
+			user_id: e.userId,
+			limit: "100"
+		});
+		r && i.set("after", r);
+		let a = await n(e, "GET", `/user_management/organization_memberships?${i.toString()}`);
+		for (let e of a.data ?? []) t.push(s(e));
+		let o = a.list_metadata?.after;
+		if (!o) break;
+		r = o;
+	}
+	return t;
+}, u = async (e) => {
+	await n(e, "DELETE", `/user_management/organization_memberships/${encodeURIComponent(e.membershipId)}`);
+}, d = async (t) => {
+	if (!t.email) throw new e(400, "workosCreateInvitation: missing `email`");
+	let r = await n(t, "POST", "/user_management/invitations", {
+		email: t.email,
+		organization_id: t.organizationId,
+		...t.roleSlug ? { role_slug: t.roleSlug } : {},
+		...t.inviterUserId ? { inviter_user_id: t.inviterUserId } : {}
+	});
+	if (!r.id || !r.email) throw new e(502, "WorkOS invitation response missing id/email");
+	return {
+		id: r.id,
+		email: r.email,
+		organizationId: r.organization_id ?? null,
+		state: r.state ?? "pending"
+	};
+};
+//#endregion
+export { d as workosCreateInvitation, c as workosCreateMembership, i as workosCreateOrganization, u as workosDeleteMembership, a as workosGetOrganization, l as workosListUserMemberships, o as workosUpdateOrganization };

package/dist/strategy.js

@@ -0,0 +1,18 @@
+import { jwtBearerStrategy as e } from "@voltro/protocol/jwt";
+//#region src/strategy.ts
+var t = "https://api.workos.com", n = "wos-session", r = (r) => {
+	if (!r.clientId) throw Error("workosStrategy: `clientId` is required");
+	let i = r.scopesFromClaims;
+	return e({
+		id: "workos",
+		jwksUrl: r.jwksUrl ?? `${t}/sso/jwks/${r.clientId}`,
+		issuer: r.issuer ?? t,
+		audience: r.clientId,
+		algorithms: ["RS256", "ES256"],
+		cookieName: r.cookieName === void 0 ? n : r.cookieName,
+		tenantIdFromClaims: (e) => r.tenantIdFromClaims?.(e) ?? (typeof e.org_id == "string" ? e.org_id : void 0) ?? r.defaultTenantId ?? null,
+		...i === void 0 ? {} : { scopesFromClaims: (e) => i(e) }
+	});
+};
+//#endregion
+export { r as workosStrategy };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-auth-workos",
-  "version": "0.85.0",
+  "version": "0.87.0",
   "description": "WorkOS-backed AuthStrategy for the Voltro framework. Verifies WorkOS AuthKit/SSO JWTs via JWKS and maps `org_id`→tenant. Composes via @voltro/protocol AuthStrategy alongside other IdP plugins.",
   "keywords": [
     "voltro",
@@ -33,7 +33,7 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@voltro/protocol": "0.85.0"
+    "@voltro/protocol": "0.87.0"
   },
   "peerDependencies": {
     "effect": "4.0.1"