@workos-inc/node 10.9.0 → 10.11.0

package/lib/{factory-Bd19upQB.cjs → factory-JdOhqH28.cjs}

@@ -1180,6 +1180,7 @@ const deserializeAction = (actionPayload) => {
 			object: actionPayload.object,
 			userData: deserializeUserData(actionPayload.user_data),
 			invitation: actionPayload.invitation ? deserializeInvitation(actionPayload.invitation) : void 0,
+			authenticationMethod: actionPayload.authentication_method,
 			ipAddress: actionPayload.ip_address,
 			userAgent: actionPayload.user_agent,
 			deviceFingerprint: actionPayload.device_fingerprint
@@ -1190,6 +1191,7 @@ const deserializeAction = (actionPayload) => {
 			user: deserializeUser(actionPayload.user),
 			organization: actionPayload.organization ? deserializeOrganization(actionPayload.organization) : void 0,
 			organizationMembership: actionPayload.organization_membership ? deserializeOrganizationMembership(actionPayload.organization_membership) : void 0,
+			authenticationMethod: actionPayload.authentication_method,
 			ipAddress: actionPayload.ip_address,
 			userAgent: actionPayload.user_agent,
 			deviceFingerprint: actionPayload.device_fingerprint,
@@ -1240,7 +1242,8 @@ var Actions = class {
 			tolerance
 		};
 		await this.verifyHeader(options);
-		return deserializeAction(typeof payload === "string" || isBinaryPayload(payload) ? JSON.parse(decodePayloadToString(payload)) : payload);
+		const parsed = typeof payload === "string" || isBinaryPayload(payload) ? JSON.parse(decodePayloadToString(payload)) : payload;
+		return deserializeAction(parsed);
 	}
 };
 //#endregion
@@ -2055,7 +2058,8 @@ var Webhooks = class {
 			tolerance
 		};
 		await this.verifyHeader(options);
-		return deserializeEvent(this.parseVerifiedPayload(payload));
+		const webhookPayload = this.parseVerifiedPayload(payload);
+		return deserializeEvent(webhookPayload);
 	}
 	parseVerifiedPayload(payload) {
 		if (typeof payload === "object" && !isBinaryPayload(payload)) return payload;
@@ -2128,7 +2132,7 @@ let _josePromise;
 * @returns Promise that resolves to the jose module
 */
 function getJose() {
-	return _josePromise ??= Promise.resolve().then(() => require("./webapi-BzGFatFp.cjs"));
+	return _josePromise ??= Promise.resolve().then(() => require("./webapi-D3QZrB15.cjs"));
 }
 //#endregion
 //#region src/agents/serializers/agent-registration.serializer.ts
@@ -2346,7 +2350,7 @@ var Agents = class {
 		const { clientId } = this.workos;
 		if (!clientId) throw new Error("Missing client ID. Did you provide it when initializing WorkOS?");
 		const { createRemoteJWKSet } = await getJose();
-		this._jwks ??= createRemoteJWKSet(new URL(`${this.workos.baseURL}/sso/jwks/${clientId}`), { cooldownDuration: 1e3 * 60 * 5 });
+		this._jwks ??= createRemoteJWKSet(new URL(`${this.workos.baseURL}/sso/jwks/${clientId}`), { cooldownDuration: 3e5 });
 		return this._jwks;
 	}
 };
@@ -5035,7 +5039,7 @@ var UserManagement = class {
 	async getJWKS() {
 		const { createRemoteJWKSet } = await getJose();
 		if (!this.clientId) return;
-		this._jwks ??= createRemoteJWKSet(new URL(this.getJwksUrl(this.clientId)), { cooldownDuration: 1e3 * 60 * 5 });
+		this._jwks ??= createRemoteJWKSet(new URL(this.getJwksUrl(this.clientId)), { cooldownDuration: 3e5 });
 		return this._jwks;
 	}
 	/**
@@ -5945,31 +5949,91 @@ var InMemoryStore = class {
 };
 //#endregion
 //#region src/feature-flags/evaluator.ts
+const TARGET_TYPE_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/;
+const TARGET_ID_PATTERN = /^[A-Za-z0-9._:-]{1,255}$/;
+const LEGACY_KEY_TO_TARGET_TYPE = /* @__PURE__ */ new Map([["userId", "user"], ["organizationId", "organization"]]);
+const isEvaluationResource = (value) => typeof value === "object" && value !== null && "id" in value && typeof value.id === "string";
 var Evaluator = class {
 	store;
-	constructor(store) {
+	logger;
+	constructor(store, logger) {
 		this.store = store;
+		this.logger = logger;
 	}
 	isEnabled(flagKey, context = {}, defaultValue = false) {
-		const entry = this.store.get(flagKey);
-		if (!entry) return defaultValue;
-		if (!entry.enabled) return false;
-		if (context.userId) {
-			const userTarget = entry.targets.users.find((t) => t.id === context.userId);
-			if (userTarget) return userTarget.enabled;
-		}
-		if (context.organizationId) {
-			const orgTarget = entry.targets.organizations.find((t) => t.id === context.organizationId);
-			if (orgTarget) return orgTarget.enabled;
-		}
-		return entry.default_value;
+		return this.evaluate(this.store.get(flagKey), this.normalizeContext(context), defaultValue);
 	}
 	getAllFlags(context = {}) {
+		const normalizedContext = this.normalizeContext(context);
 		const flags = this.store.getAll();
 		const result = {};
-		for (const slug of Object.keys(flags)) result[slug] = this.isEnabled(slug, context);
+		for (const slug of Object.keys(flags)) result[slug] = this.evaluate(flags[slug], normalizedContext, false);
 		return result;
 	}
+	evaluate(entry, normalizedContext, defaultValue) {
+		if (!entry) return defaultValue;
+		if (!entry.enabled) return false;
+		for (const [targetType, targetId] of normalizedContext) if (this.hasEnabledTarget(entry, targetType, targetId)) return true;
+		return entry.default_value;
+	}
+	/**
+	* Reduces either context form to target type → ID pairs. Evaluation must
+	* never throw in application code, so every invalid piece of context
+	* degrades to "matches no targets" with a logged warning instead of an
+	* error.
+	*/
+	normalizeContext(context) {
+		const normalized = /* @__PURE__ */ new Map();
+		const record = context;
+		const legacyEntries = [];
+		const typedKeys = [];
+		for (const [key, value] of Object.entries(record)) {
+			if (value === void 0 || value === null) continue;
+			const legacyTargetType = LEGACY_KEY_TO_TARGET_TYPE.get(key);
+			if (legacyTargetType) {
+				if (typeof value === "string" && value !== "") legacyEntries.push([legacyTargetType, value]);
+				continue;
+			}
+			typedKeys.push(key);
+		}
+		const resourceShapedKeys = typedKeys.filter((key) => typeof record[key] === "object");
+		if (legacyEntries.length > 0 && resourceShapedKeys.length > 0) {
+			this.logger?.warn("Evaluation context mixes legacy keys (userId/organizationId) with typed target keys; no targets will match", { keys: Object.keys(record) });
+			return normalized;
+		}
+		if (legacyEntries.length > 0) {
+			for (const [targetType, targetId] of legacyEntries) normalized.set(targetType, targetId);
+			return normalized;
+		}
+		for (const key of typedKeys) {
+			if (!TARGET_TYPE_PATTERN.test(key)) {
+				this.logger?.warn(`Ignoring invalid target type in evaluation context: ${key}`);
+				continue;
+			}
+			const value = record[key];
+			if (!isEvaluationResource(value)) {
+				this.logger?.warn(`Ignoring target type with a missing or invalid resource id in evaluation context: ${key}`);
+				continue;
+			}
+			const { id } = value;
+			if (!TARGET_ID_PATTERN.test(id) || id === "." || id === "..") {
+				this.logger?.warn(`Ignoring invalid target id in evaluation context for type: ${key}`);
+				continue;
+			}
+			normalized.set(key, id);
+		}
+		return normalized;
+	}
+	/**
+	* A target participates in evaluation only while its `enabled` is true. A
+	* `false` value is reserved for future disabled overrides and is treated
+	* as if the target were absent.
+	*/
+	hasEnabledTarget(entry, targetType, targetId) {
+		if (targetType === "user") return entry.targets.users.some((t) => t.id === targetId && t.enabled);
+		if (targetType === "organization") return entry.targets.organizations.some((t) => t.id === targetId && t.enabled);
+		return (entry.targets.custom_targets ?? []).some((t) => t.type === targetType && t.id === targetId && t.enabled);
+	}
 };
 //#endregion
 //#region src/feature-flags/runtime-client.ts
@@ -6011,7 +6075,7 @@ var FeatureFlagsRuntimeClient = class extends EventEmitter {
 		this.requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
 		this.logger = options.logger;
 		this.store = new InMemoryStore();
-		this.evaluator = new Evaluator(this.store);
+		this.evaluator = new Evaluator(this.store, this.logger);
 		this.readyPromise = new Promise((resolve, reject) => {
 			this.readyResolve = resolve;
 			this.readyReject = reject;
@@ -6156,7 +6220,12 @@ var FeatureFlagsRuntimeClient = class extends EventEmitter {
 			const map = new Map(ys.map((t) => [t.id, t.enabled]));
 			return xs.some((t) => map.get(t.id) !== t.enabled);
 		};
-		return targetsChanged(a.targets.users, b.targets.users) || targetsChanged(a.targets.organizations, b.targets.organizations);
+		const customTargetsChanged = (xs, ys) => {
+			if (xs.length !== ys.length) return true;
+			const map = new Map(ys.map((t) => [`${t.type}:${t.id}`, t.enabled]));
+			return xs.some((t) => map.get(`${t.type}:${t.id}`) !== t.enabled);
+		};
+		return targetsChanged(a.targets.users, b.targets.users) || targetsChanged(a.targets.organizations, b.targets.organizations) || customTargetsChanged(a.targets.custom_targets ?? [], b.targets.custom_targets ?? []);
 	}
 };
 //#endregion
@@ -8069,7 +8138,7 @@ var Vault = class {
 };
 //#endregion
 //#region package.json
-var version = "10.9.0";
+var version = "10.11.0";
 //#endregion
 //#region src/workos.ts
 const DEFAULT_HOSTNAME = "api.workos.com";
@@ -8606,4 +8675,4 @@ Object.defineProperty(exports, "serializeRevokeSessionOptions", {
 	}
 });
 
-//# sourceMappingURL=factory-Bd19upQB.cjs.map
+//# sourceMappingURL=factory-JdOhqH28.cjs.map