@workos-inc/node 7.13.0 → 7.15.0

package/lib/common/interfaces/workos-options.interface.d.ts

@@ -6,4 +6,5 @@ export interface WorkOSOptions {
     config?: RequestInit;
     appInfo?: AppInfo;
     fetchFn?: typeof fetch;
+    clientId?: string;
 }

package/lib/common/net/node-client.d.ts

@@ -1,4 +1,3 @@
-/// <reference types="node" />
 import { HttpClient, HttpClientResponse } from './http-client';
 import { HttpClientInterface, HttpClientResponseInterface, RequestOptions } from '../interfaces/http-client.interface';
 import * as http_ from 'node:http';

package/lib/sso/interfaces/connection-type.enum.d.ts

@@ -1,6 +1,7 @@
 export declare enum ConnectionType {
     ADFSSAML = "ADFSSAML",
     AdpOidc = "AdpOidc",
+    AppleOAuth = "AppleOAuth",
     Auth0SAML = "Auth0SAML",
     AzureSAML = "AzureSAML",
     CasSAML = "CasSAML",
@@ -10,6 +11,7 @@ export declare enum ConnectionType {
     DuoSAML = "DuoSAML",
     GenericOIDC = "GenericOIDC",
     GenericSAML = "GenericSAML",
+    GitHubOAuth = "GitHubOAuth",
     GoogleOAuth = "GoogleOAuth",
     GoogleSAML = "GoogleSAML",
     JumpCloudSAML = "JumpCloudSAML",

package/lib/sso/interfaces/connection-type.enum.js

@@ -5,6 +5,7 @@ var ConnectionType;
 (function (ConnectionType) {
     ConnectionType["ADFSSAML"] = "ADFSSAML";
     ConnectionType["AdpOidc"] = "AdpOidc";
+    ConnectionType["AppleOAuth"] = "AppleOAuth";
     ConnectionType["Auth0SAML"] = "Auth0SAML";
     ConnectionType["AzureSAML"] = "AzureSAML";
     ConnectionType["CasSAML"] = "CasSAML";
@@ -14,6 +15,7 @@ var ConnectionType;
     ConnectionType["DuoSAML"] = "DuoSAML";
     ConnectionType["GenericOIDC"] = "GenericOIDC";
     ConnectionType["GenericSAML"] = "GenericSAML";
+    ConnectionType["GitHubOAuth"] = "GitHubOAuth";
     ConnectionType["GoogleOAuth"] = "GoogleOAuth";
     ConnectionType["GoogleSAML"] = "GoogleSAML";
     ConnectionType["JumpCloudSAML"] = "JumpCloudSAML";

package/lib/user-management/interfaces/authenticate-with-options-base.interface.d.ts

@@ -1,7 +1,12 @@
+export interface AuthenticateWithSessionOptions {
+    cookiePassword?: string;
+    sealSession: boolean;
+}
 export interface AuthenticateWithOptionsBase {
     clientId: string;
     ipAddress?: string;
     userAgent?: string;
+    session?: AuthenticateWithSessionOptions;
 }
 export interface SerializedAuthenticateWithOptionsBase {
     client_id: string;

package/lib/user-management/interfaces/authenticate-with-session-cookie.interface.d.ts

@@ -0,0 +1,24 @@
+import { AuthenticationResponse } from './authentication-response.interface';
+export interface AccessToken {
+    sid: string;
+    org_id?: string;
+    role?: string;
+    permissions?: string[];
+}
+export type SessionCookieData = Pick<AuthenticationResponse, 'accessToken' | 'impersonator' | 'organizationId' | 'refreshToken' | 'user'>;
+export declare enum AuthenticateWithSessionCookieFailureReason {
+    INVALID_JWT = "invalid_jwt",
+    INVALID_SESSION_COOKIE = "invalid_session_cookie",
+    NO_SESSION_COOKIE_PROVIDED = "no_session_cookie_provided"
+}
+export type AuthenticateWithSessionCookieFailedResponse = {
+    authenticated: false;
+    reason: AuthenticateWithSessionCookieFailureReason;
+};
+export type AuthenticateWithSessionCookieSuccessResponse = {
+    authenticated: true;
+    sessionId: string;
+    organizationId?: string;
+    role?: string;
+    permissions?: string[];
+};

package/lib/user-management/interfaces/authenticate-with-session-cookie.interface.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthenticateWithSessionCookieFailureReason = void 0;
+var AuthenticateWithSessionCookieFailureReason;
+(function (AuthenticateWithSessionCookieFailureReason) {
+    AuthenticateWithSessionCookieFailureReason["INVALID_JWT"] = "invalid_jwt";
+    AuthenticateWithSessionCookieFailureReason["INVALID_SESSION_COOKIE"] = "invalid_session_cookie";
+    AuthenticateWithSessionCookieFailureReason["NO_SESSION_COOKIE_PROVIDED"] = "no_session_cookie_provided";
+})(AuthenticateWithSessionCookieFailureReason || (exports.AuthenticateWithSessionCookieFailureReason = AuthenticateWithSessionCookieFailureReason = {}));

package/lib/user-management/interfaces/authentication-response.interface.d.ts

@@ -1,6 +1,6 @@
 import { Impersonator, ImpersonatorResponse } from './impersonator.interface';
 import { User, UserResponse } from './user.interface';
-type AuthenticationMethod = 'SSO' | 'Password' | 'GitHubOAuth' | 'GoogleOAuth' | 'MicrosoftOAuth' | 'MagicAuth' | 'Impersonation';
+type AuthenticationMethod = 'SSO' | 'Password' | 'AppleOAuth' | 'GitHubOAuth' | 'GoogleOAuth' | 'MicrosoftOAuth' | 'MagicAuth' | 'Impersonation';
 export interface AuthenticationResponse {
     user: User;
     organizationId?: string;
@@ -8,6 +8,7 @@ export interface AuthenticationResponse {
     refreshToken: string;
     impersonator?: Impersonator;
     authenticationMethod?: AuthenticationMethod;
+    sealedSession?: string;
 }
 export interface AuthenticationResponseResponse {
     user: UserResponse;

package/lib/user-management/interfaces/index.d.ts

@@ -7,6 +7,7 @@ export * from './authenticate-with-options-base.interface';
 export * from './authenticate-with-organization-selection.interface';
 export * from './authenticate-with-password-options.interface';
 export * from './authenticate-with-refresh-token-options.interface';
+export * from './authenticate-with-session-cookie.interface';
 export * from './authenticate-with-totp-options.interface';
 export * from './authentication-response.interface';
 export * from './create-magic-auth-options.interface';
@@ -25,6 +26,7 @@ export * from './list-users-options.interface';
 export * from './magic-auth.interface';
 export * from './organization-membership.interface';
 export * from './password-reset.interface';
+export * from './refresh-and-seal-session-data.interface';
 export * from './reset-password-options.interface';
 export * from './revoke-session-options.interface';
 export * from './send-invitation-options.interface';

package/lib/user-management/interfaces/index.js

@@ -23,6 +23,7 @@ __exportStar(require("./authenticate-with-options-base.interface"), exports);
 __exportStar(require("./authenticate-with-organization-selection.interface"), exports);
 __exportStar(require("./authenticate-with-password-options.interface"), exports);
 __exportStar(require("./authenticate-with-refresh-token-options.interface"), exports);
+__exportStar(require("./authenticate-with-session-cookie.interface"), exports);
 __exportStar(require("./authenticate-with-totp-options.interface"), exports);
 __exportStar(require("./authentication-response.interface"), exports);
 __exportStar(require("./create-magic-auth-options.interface"), exports);
@@ -41,6 +42,7 @@ __exportStar(require("./list-users-options.interface"), exports);
 __exportStar(require("./magic-auth.interface"), exports);
 __exportStar(require("./organization-membership.interface"), exports);
 __exportStar(require("./password-reset.interface"), exports);
+__exportStar(require("./refresh-and-seal-session-data.interface"), exports);
 __exportStar(require("./reset-password-options.interface"), exports);
 __exportStar(require("./revoke-session-options.interface"), exports);
 __exportStar(require("./send-invitation-options.interface"), exports);

package/lib/user-management/interfaces/refresh-and-seal-session-data.interface.d.ts

@@ -0,0 +1,16 @@
+export declare enum RefreshAndSealSessionDataFailureReason {
+    INVALID_SESSION_COOKE = "invalid_session_cookie",
+    NO_SESSION_COOKIE_PROVIDED = "no_session_cookie_provided",
+    INVALID_GRANT = "invalid_grant",
+    ORGANIZATION_NOT_AUTHORIZED = "organization_not_authorized"
+}
+type RefreshAndSealSessionDataFailedResponse = {
+    authenticated: false;
+    reason: RefreshAndSealSessionDataFailureReason;
+};
+type RefreshAndSealSessionDataSuccessResponse = {
+    authenticated: true;
+    sealedSession: string;
+};
+export type RefreshAndSealSessionDataResponse = RefreshAndSealSessionDataFailedResponse | RefreshAndSealSessionDataSuccessResponse;
+export {};

package/lib/user-management/interfaces/refresh-and-seal-session-data.interface.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RefreshAndSealSessionDataFailureReason = void 0;
+var RefreshAndSealSessionDataFailureReason;
+(function (RefreshAndSealSessionDataFailureReason) {
+    RefreshAndSealSessionDataFailureReason["INVALID_SESSION_COOKE"] = "invalid_session_cookie";
+    RefreshAndSealSessionDataFailureReason["NO_SESSION_COOKIE_PROVIDED"] = "no_session_cookie_provided";
+    // API OauthErrors for refresh tokens
+    RefreshAndSealSessionDataFailureReason["INVALID_GRANT"] = "invalid_grant";
+    RefreshAndSealSessionDataFailureReason["ORGANIZATION_NOT_AUTHORIZED"] = "organization_not_authorized";
+})(RefreshAndSealSessionDataFailureReason || (exports.RefreshAndSealSessionDataFailureReason = RefreshAndSealSessionDataFailureReason = {}));

package/lib/user-management/interfaces/session-handler-options.interface.d.ts

@@ -0,0 +1,4 @@
+export interface SessionHandlerOptions {
+    sessionData: string;
+    cookiePassword?: string;
+}

package/lib/user-management/interfaces/session-handler-options.interface.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/user-management/user-management.d.ts

@@ -1,22 +1,26 @@
-import { WorkOS } from '../workos';
 import { AutoPaginatable } from '../common/utils/pagination';
-import { AuthenticateWithCodeOptions, AuthenticateWithMagicAuthOptions, AuthenticateWithPasswordOptions, AuthenticateWithTotpOptions, AuthenticationResponse, ResetPasswordOptions, SendPasswordResetEmailOptions, CreateUserOptions, EnrollAuthFactorOptions, ListAuthFactorsOptions, ListUsersOptions, SendMagicAuthCodeOptions, SendVerificationEmailOptions, UpdateUserOptions, User, VerifyEmailOptions, AuthenticateWithRefreshTokenOptions, MagicAuth, CreateMagicAuthOptions, EmailVerification, PasswordReset, CreatePasswordResetOptions } from './interfaces';
 import { Challenge } from '../mfa/interfaces';
-import { OrganizationMembership } from './interfaces/organization-membership.interface';
-import { ListOrganizationMembershipsOptions } from './interfaces/list-organization-memberships-options.interface';
-import { CreateOrganizationMembershipOptions } from './interfaces/create-organization-membership-options.interface';
-import { Invitation } from './interfaces/invitation.interface';
-import { ListInvitationsOptions } from './interfaces/list-invitations-options.interface';
-import { SendInvitationOptions } from './interfaces/send-invitation-options.interface';
-import { AuthorizationURLOptions } from './interfaces/authorization-url-options.interface';
+import { WorkOS } from '../workos';
+import { AuthenticateWithCodeOptions, AuthenticateWithMagicAuthOptions, AuthenticateWithPasswordOptions, AuthenticateWithRefreshTokenOptions, AuthenticateWithTotpOptions, AuthenticationResponse, CreateMagicAuthOptions, CreatePasswordResetOptions, CreateUserOptions, EmailVerification, EnrollAuthFactorOptions, ListAuthFactorsOptions, ListUsersOptions, MagicAuth, PasswordReset, ResetPasswordOptions, SendMagicAuthCodeOptions, SendPasswordResetEmailOptions, SendVerificationEmailOptions, UpdateUserOptions, User, VerifyEmailOptions } from './interfaces';
 import { AuthenticateWithEmailVerificationOptions } from './interfaces/authenticate-with-email-verification-options.interface';
 import { AuthenticateWithOrganizationSelectionOptions } from './interfaces/authenticate-with-organization-selection.interface';
+import { AuthenticateWithSessionCookieFailedResponse, AuthenticateWithSessionCookieSuccessResponse, SessionCookieData } from './interfaces/authenticate-with-session-cookie.interface';
+import { AuthorizationURLOptions } from './interfaces/authorization-url-options.interface';
+import { CreateOrganizationMembershipOptions } from './interfaces/create-organization-membership-options.interface';
 import { Factor, FactorWithSecrets } from './interfaces/factor.interface';
+import { Identity } from './interfaces/identity.interface';
+import { Invitation } from './interfaces/invitation.interface';
+import { ListInvitationsOptions } from './interfaces/list-invitations-options.interface';
+import { ListOrganizationMembershipsOptions } from './interfaces/list-organization-memberships-options.interface';
+import { OrganizationMembership } from './interfaces/organization-membership.interface';
+import { RefreshAndSealSessionDataResponse } from './interfaces/refresh-and-seal-session-data.interface';
 import { RevokeSessionOptions } from './interfaces/revoke-session-options.interface';
+import { SendInvitationOptions } from './interfaces/send-invitation-options.interface';
+import { SessionHandlerOptions } from './interfaces/session-handler-options.interface';
 import { UpdateOrganizationMembershipOptions } from './interfaces/update-organization-membership-options.interface';
-import { Identity } from './interfaces/identity.interface';
 export declare class UserManagement {
     private readonly workos;
+    private jwks;
     constructor(workos: WorkOS);
     getUser(userId: string): Promise<User>;
     listUsers(options?: ListUsersOptions): Promise<AutoPaginatable<User>>;
@@ -28,6 +32,12 @@ export declare class UserManagement {
     authenticateWithTotp(payload: AuthenticateWithTotpOptions): Promise<AuthenticationResponse>;
     authenticateWithEmailVerification(payload: AuthenticateWithEmailVerificationOptions): Promise<AuthenticationResponse>;
     authenticateWithOrganizationSelection(payload: AuthenticateWithOrganizationSelectionOptions): Promise<AuthenticationResponse>;
+    authenticateWithSessionCookie({ sessionData, cookiePassword, }: SessionHandlerOptions): Promise<AuthenticateWithSessionCookieSuccessResponse | AuthenticateWithSessionCookieFailedResponse>;
+    private isValidJwt;
+    refreshAndSealSessionData({ sessionData, cookiePassword, }: SessionHandlerOptions): Promise<RefreshAndSealSessionDataResponse>;
+    private prepareAuthenticationResponse;
+    private sealSessionDataFromAuthenticationResponse;
+    getSessionFromCookie({ sessionData, cookiePassword, }: SessionHandlerOptions): Promise<SessionCookieData | undefined>;
     getEmailVerification(emailVerificationId: string): Promise<EmailVerification>;
     sendVerificationEmail({ userId, }: SendVerificationEmailOptions): Promise<{
         user: User;