@workos-inc/node 7.13.0 → 7.15.0

package/lib/user-management/user-management.js

@@ -21,23 +21,28 @@ var __rest = (this && this.__rest) || function (s, e) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.UserManagement = void 0;
-const pagination_1 = require("../common/utils/pagination");
-const serializers_1 = require("./serializers");
+const iron_session_1 = require("iron-session");
+const jose_1 = require("jose");
+const oauth_exception_1 = require("../common/exceptions/oauth.exception");
 const fetch_and_deserialize_1 = require("../common/utils/fetch-and-deserialize");
-const serializers_2 = require("../mfa/serializers");
-const organization_membership_serializer_1 = require("./serializers/organization-membership.serializer");
-const list_organization_memberships_options_serializer_1 = require("./serializers/list-organization-memberships-options.serializer");
+const pagination_1 = require("../common/utils/pagination");
+const serializers_1 = require("../mfa/serializers");
+const authenticate_with_session_cookie_interface_1 = require("./interfaces/authenticate-with-session-cookie.interface");
+const refresh_and_seal_session_data_interface_1 = require("./interfaces/refresh-and-seal-session-data.interface");
+const revoke_session_options_interface_1 = require("./interfaces/revoke-session-options.interface");
+const serializers_2 = require("./serializers");
+const authenticate_with_email_verification_serializer_1 = require("./serializers/authenticate-with-email-verification.serializer");
+const authenticate_with_organization_selection_options_serializer_1 = require("./serializers/authenticate-with-organization-selection-options.serializer");
 const create_organization_membership_options_serializer_1 = require("./serializers/create-organization-membership-options.serializer");
+const factor_serializer_1 = require("./serializers/factor.serializer");
+const identity_serializer_1 = require("./serializers/identity.serializer");
 const invitation_serializer_1 = require("./serializers/invitation.serializer");
 const list_invitations_options_serializer_1 = require("./serializers/list-invitations-options.serializer");
-const send_invitation_options_serializer_1 = require("./serializers/send-invitation-options.serializer");
+const list_organization_memberships_options_serializer_1 = require("./serializers/list-organization-memberships-options.serializer");
 const list_users_options_serializer_1 = require("./serializers/list-users-options.serializer");
-const authenticate_with_email_verification_serializer_1 = require("./serializers/authenticate-with-email-verification.serializer");
-const authenticate_with_organization_selection_options_serializer_1 = require("./serializers/authenticate-with-organization-selection-options.serializer");
-const factor_serializer_1 = require("./serializers/factor.serializer");
-const revoke_session_options_interface_1 = require("./interfaces/revoke-session-options.interface");
+const organization_membership_serializer_1 = require("./serializers/organization-membership.serializer");
+const send_invitation_options_serializer_1 = require("./serializers/send-invitation-options.serializer");
 const update_organization_membership_options_serializer_1 = require("./serializers/update-organization-membership-options.serializer");
-const identity_serializer_1 = require("./serializers/identity.serializer");
 const toQueryString = (options) => {
     const searchParams = new URLSearchParams();
     const keys = Object.keys(options).sort();
@@ -52,88 +57,261 @@ const toQueryString = (options) => {
 class UserManagement {
     constructor(workos) {
         this.workos = workos;
+        const { clientId } = workos.options;
+        // Set the JWKS URL. This is used to verify if the JWT is still valid
+        this.jwks = clientId
+            ? (0, jose_1.createRemoteJWKSet)(new URL(this.getJwksUrl(clientId)))
+            : undefined;
     }
     getUser(userId) {
         return __awaiter(this, void 0, void 0, function* () {
             const { data } = yield this.workos.get(`/user_management/users/${userId}`);
-            return (0, serializers_1.deserializeUser)(data);
+            return (0, serializers_2.deserializeUser)(data);
         });
     }
     listUsers(options) {
         return __awaiter(this, void 0, void 0, function* () {
-            return new pagination_1.AutoPaginatable(yield (0, fetch_and_deserialize_1.fetchAndDeserialize)(this.workos, '/user_management/users', serializers_1.deserializeUser, options ? (0, list_users_options_serializer_1.serializeListUsersOptions)(options) : undefined), (params) => (0, fetch_and_deserialize_1.fetchAndDeserialize)(this.workos, '/user_management/users', serializers_1.deserializeUser, params), options ? (0, list_users_options_serializer_1.serializeListUsersOptions)(options) : undefined);
+            return new pagination_1.AutoPaginatable(yield (0, fetch_and_deserialize_1.fetchAndDeserialize)(this.workos, '/user_management/users', serializers_2.deserializeUser, options ? (0, list_users_options_serializer_1.serializeListUsersOptions)(options) : undefined), (params) => (0, fetch_and_deserialize_1.fetchAndDeserialize)(this.workos, '/user_management/users', serializers_2.deserializeUser, params), options ? (0, list_users_options_serializer_1.serializeListUsersOptions)(options) : undefined);
         });
     }
     createUser(payload) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { data } = yield this.workos.post('/user_management/users', (0, serializers_1.serializeCreateUserOptions)(payload));
-            return (0, serializers_1.deserializeUser)(data);
+            const { data } = yield this.workos.post('/user_management/users', (0, serializers_2.serializeCreateUserOptions)(payload));
+            return (0, serializers_2.deserializeUser)(data);
         });
     }
     authenticateWithMagicAuth(payload) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { data } = yield this.workos.post('/user_management/authenticate', (0, serializers_1.serializeAuthenticateWithMagicAuthOptions)(Object.assign(Object.assign({}, payload), { clientSecret: this.workos.key })));
-            return (0, serializers_1.deserializeAuthenticationResponse)(data);
+            const { session } = payload, remainingPayload = __rest(payload, ["session"]);
+            const { data } = yield this.workos.post('/user_management/authenticate', (0, serializers_2.serializeAuthenticateWithMagicAuthOptions)(Object.assign(Object.assign({}, remainingPayload), { clientSecret: this.workos.key })));
+            return this.prepareAuthenticationResponse({
+                authenticationResponse: (0, serializers_2.deserializeAuthenticationResponse)(data),
+                session,
+            });
         });
     }
     authenticateWithPassword(payload) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { data } = yield this.workos.post('/user_management/authenticate', (0, serializers_1.serializeAuthenticateWithPasswordOptions)(Object.assign(Object.assign({}, payload), { clientSecret: this.workos.key })));
-            return (0, serializers_1.deserializeAuthenticationResponse)(data);
+            const { session } = payload, remainingPayload = __rest(payload, ["session"]);
+            const { data } = yield this.workos.post('/user_management/authenticate', (0, serializers_2.serializeAuthenticateWithPasswordOptions)(Object.assign(Object.assign({}, remainingPayload), { clientSecret: this.workos.key })));
+            return this.prepareAuthenticationResponse({
+                authenticationResponse: (0, serializers_2.deserializeAuthenticationResponse)(data),
+                session,
+            });
         });
     }
     authenticateWithCode(payload) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { data } = yield this.workos.post('/user_management/authenticate', (0, serializers_1.serializeAuthenticateWithCodeOptions)(Object.assign(Object.assign({}, payload), { clientSecret: this.workos.key })));
-            return (0, serializers_1.deserializeAuthenticationResponse)(data);
+            const { session } = payload, remainingPayload = __rest(payload, ["session"]);
+            const { data } = yield this.workos.post('/user_management/authenticate', (0, serializers_2.serializeAuthenticateWithCodeOptions)(Object.assign(Object.assign({}, remainingPayload), { clientSecret: this.workos.key })));
+            return this.prepareAuthenticationResponse({
+                authenticationResponse: (0, serializers_2.deserializeAuthenticationResponse)(data),
+                session,
+            });
         });
     }
     authenticateWithRefreshToken(payload) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { data } = yield this.workos.post('/user_management/authenticate', (0, serializers_1.serializeAuthenticateWithRefreshTokenOptions)(Object.assign(Object.assign({}, payload), { clientSecret: this.workos.key })));
-            return (0, serializers_1.deserializeAuthenticationResponse)(data);
+            const { session } = payload, remainingPayload = __rest(payload, ["session"]);
+            const { data } = yield this.workos.post('/user_management/authenticate', (0, serializers_2.serializeAuthenticateWithRefreshTokenOptions)(Object.assign(Object.assign({}, remainingPayload), { clientSecret: this.workos.key })));
+            return this.prepareAuthenticationResponse({
+                authenticationResponse: (0, serializers_2.deserializeAuthenticationResponse)(data),
+                session,
+            });
         });
     }
     authenticateWithTotp(payload) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { data } = yield this.workos.post('/user_management/authenticate', (0, serializers_1.serializeAuthenticateWithTotpOptions)(Object.assign(Object.assign({}, payload), { clientSecret: this.workos.key })));
-            return (0, serializers_1.deserializeAuthenticationResponse)(data);
+            const { session } = payload, remainingPayload = __rest(payload, ["session"]);
+            const { data } = yield this.workos.post('/user_management/authenticate', (0, serializers_2.serializeAuthenticateWithTotpOptions)(Object.assign(Object.assign({}, remainingPayload), { clientSecret: this.workos.key })));
+            return this.prepareAuthenticationResponse({
+                authenticationResponse: (0, serializers_2.deserializeAuthenticationResponse)(data),
+                session,
+            });
         });
     }
     authenticateWithEmailVerification(payload) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { data } = yield this.workos.post('/user_management/authenticate', (0, authenticate_with_email_verification_serializer_1.serializeAuthenticateWithEmailVerificationOptions)(Object.assign(Object.assign({}, payload), { clientSecret: this.workos.key })));
-            return (0, serializers_1.deserializeAuthenticationResponse)(data);
+            const { session } = payload, remainingPayload = __rest(payload, ["session"]);
+            const { data } = yield this.workos.post('/user_management/authenticate', (0, authenticate_with_email_verification_serializer_1.serializeAuthenticateWithEmailVerificationOptions)(Object.assign(Object.assign({}, remainingPayload), { clientSecret: this.workos.key })));
+            return this.prepareAuthenticationResponse({
+                authenticationResponse: (0, serializers_2.deserializeAuthenticationResponse)(data),
+                session,
+            });
         });
     }
     authenticateWithOrganizationSelection(payload) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { data } = yield this.workos.post('/user_management/authenticate', (0, authenticate_with_organization_selection_options_serializer_1.serializeAuthenticateWithOrganizationSelectionOptions)(Object.assign(Object.assign({}, payload), { clientSecret: this.workos.key })));
-            return (0, serializers_1.deserializeAuthenticationResponse)(data);
+            const { session } = payload, remainingPayload = __rest(payload, ["session"]);
+            const { data } = yield this.workos.post('/user_management/authenticate', (0, authenticate_with_organization_selection_options_serializer_1.serializeAuthenticateWithOrganizationSelectionOptions)(Object.assign(Object.assign({}, remainingPayload), { clientSecret: this.workos.key })));
+            return this.prepareAuthenticationResponse({
+                authenticationResponse: (0, serializers_2.deserializeAuthenticationResponse)(data),
+                session,
+            });
+        });
+    }
+    authenticateWithSessionCookie({ sessionData, cookiePassword = process.env.WORKOS_COOKIE_PASSWORD, }) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!cookiePassword) {
+                throw new Error('Cookie password is required');
+            }
+            if (!this.jwks) {
+                throw new Error('Must provide clientId to initialize JWKS');
+            }
+            if (!sessionData) {
+                return {
+                    authenticated: false,
+                    reason: authenticate_with_session_cookie_interface_1.AuthenticateWithSessionCookieFailureReason.NO_SESSION_COOKIE_PROVIDED,
+                };
+            }
+            const session = yield (0, iron_session_1.unsealData)(sessionData, {
+                password: cookiePassword,
+            });
+            if (!session.accessToken) {
+                return {
+                    authenticated: false,
+                    reason: authenticate_with_session_cookie_interface_1.AuthenticateWithSessionCookieFailureReason.INVALID_SESSION_COOKIE,
+                };
+            }
+            if (!(yield this.isValidJwt(session.accessToken))) {
+                return {
+                    authenticated: false,
+                    reason: authenticate_with_session_cookie_interface_1.AuthenticateWithSessionCookieFailureReason.INVALID_JWT,
+                };
+            }
+            const { sid: sessionId, org_id: organizationId, role, permissions, } = (0, jose_1.decodeJwt)(session.accessToken);
+            return {
+                authenticated: true,
+                sessionId,
+                organizationId,
+                role,
+                permissions,
+            };
+        });
+    }
+    isValidJwt(accessToken) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!this.jwks) {
+                throw new Error('Must provide clientId to initialize JWKS');
+            }
+            try {
+                yield (0, jose_1.jwtVerify)(accessToken, this.jwks);
+                return true;
+            }
+            catch (e) {
+                return false;
+            }
+        });
+    }
+    refreshAndSealSessionData({ sessionData, cookiePassword = process.env.WORKOS_COOKIE_PASSWORD, }) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!cookiePassword) {
+                throw new Error('Cookie password is required');
+            }
+            if (!sessionData) {
+                return {
+                    authenticated: false,
+                    reason: refresh_and_seal_session_data_interface_1.RefreshAndSealSessionDataFailureReason.NO_SESSION_COOKIE_PROVIDED,
+                };
+            }
+            const session = yield (0, iron_session_1.unsealData)(sessionData, {
+                password: cookiePassword,
+            });
+            if (!session.refreshToken || !session.user) {
+                return {
+                    authenticated: false,
+                    reason: refresh_and_seal_session_data_interface_1.RefreshAndSealSessionDataFailureReason.INVALID_SESSION_COOKE,
+                };
+            }
+            try {
+                const { sealedSession } = yield this.authenticateWithRefreshToken({
+                    clientId: this.workos.clientId,
+                    refreshToken: session.refreshToken,
+                    session: { sealSession: true, cookiePassword },
+                });
+                if (!sealedSession) {
+                    return {
+                        authenticated: false,
+                        reason: refresh_and_seal_session_data_interface_1.RefreshAndSealSessionDataFailureReason.INVALID_SESSION_COOKE,
+                    };
+                }
+                return { authenticated: true, sealedSession };
+            }
+            catch (error) {
+                if (error instanceof oauth_exception_1.OauthException &&
+                    // TODO: Add additional known errors and remove re-throw
+                    (error.error === refresh_and_seal_session_data_interface_1.RefreshAndSealSessionDataFailureReason.INVALID_GRANT ||
+                        error.error ===
+                            refresh_and_seal_session_data_interface_1.RefreshAndSealSessionDataFailureReason.ORGANIZATION_NOT_AUTHORIZED)) {
+                    return {
+                        authenticated: false,
+                        reason: error.error,
+                    };
+                }
+                throw error;
+            }
+        });
+    }
+    prepareAuthenticationResponse({ authenticationResponse, session, }) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (session) {
+                return Object.assign(Object.assign({}, authenticationResponse), { sealedSession: yield this.sealSessionDataFromAuthenticationResponse({
+                        authenticationResponse,
+                        cookiePassword: session.cookiePassword,
+                    }) });
+            }
+            return authenticationResponse;
+        });
+    }
+    sealSessionDataFromAuthenticationResponse({ authenticationResponse, cookiePassword, }) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!cookiePassword) {
+                throw new Error('Cookie password is required');
+            }
+            const sessionData = {
+                user: authenticationResponse.user,
+                accessToken: authenticationResponse.accessToken,
+                refreshToken: authenticationResponse.refreshToken,
+                impersonator: authenticationResponse.impersonator,
+            };
+            return (0, iron_session_1.sealData)(sessionData, { password: cookiePassword });
+        });
+    }
+    getSessionFromCookie({ sessionData, cookiePassword = process.env.WORKOS_COOKIE_PASSWORD, }) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!cookiePassword) {
+                throw new Error('Cookie password is required');
+            }
+            if (sessionData) {
+                return (0, iron_session_1.unsealData)(sessionData, {
+                    password: cookiePassword,
+                });
+            }
+            return undefined;
         });
     }
     getEmailVerification(emailVerificationId) {
         return __awaiter(this, void 0, void 0, function* () {
             const { data } = yield this.workos.get(`/user_management/email_verification/${emailVerificationId}`);
-            return (0, serializers_1.deserializeEmailVerification)(data);
+            return (0, serializers_2.deserializeEmailVerification)(data);
         });
     }
     sendVerificationEmail({ userId, }) {
         return __awaiter(this, void 0, void 0, function* () {
             const { data } = yield this.workos.post(`/user_management/users/${userId}/email_verification/send`, {});
-            return { user: (0, serializers_1.deserializeUser)(data.user) };
+            return { user: (0, serializers_2.deserializeUser)(data.user) };
         });
     }
     getMagicAuth(magicAuthId) {
         return __awaiter(this, void 0, void 0, function* () {
             const { data } = yield this.workos.get(`/user_management/magic_auth/${magicAuthId}`);
-            return (0, serializers_1.deserializeMagicAuth)(data);
+            return (0, serializers_2.deserializeMagicAuth)(data);
         });
     }
     createMagicAuth(options) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { data } = yield this.workos.post('/user_management/magic_auth', (0, serializers_1.serializeCreateMagicAuthOptions)(Object.assign({}, options)));
-            return (0, serializers_1.deserializeMagicAuth)(data);
+            const { data } = yield this.workos.post('/user_management/magic_auth', (0, serializers_2.serializeCreateMagicAuthOptions)(Object.assign({}, options)));
+            return (0, serializers_2.deserializeMagicAuth)(data);
         });
     }
     /**
@@ -141,7 +319,7 @@ class UserManagement {
      */
     sendMagicAuthCode(options) {
         return __awaiter(this, void 0, void 0, function* () {
-            yield this.workos.post('/user_management/magic_auth/send', (0, serializers_1.serializeSendMagicAuthCodeOptions)(options));
+            yield this.workos.post('/user_management/magic_auth/send', (0, serializers_2.serializeSendMagicAuthCodeOptions)(options));
         });
     }
     verifyEmail({ code, userId, }) {
@@ -149,19 +327,19 @@ class UserManagement {
             const { data } = yield this.workos.post(`/user_management/users/${userId}/email_verification/confirm`, {
                 code,
             });
-            return { user: (0, serializers_1.deserializeUser)(data.user) };
+            return { user: (0, serializers_2.deserializeUser)(data.user) };
         });
     }
     getPasswordReset(passwordResetId) {
         return __awaiter(this, void 0, void 0, function* () {
             const { data } = yield this.workos.get(`/user_management/password_reset/${passwordResetId}`);
-            return (0, serializers_1.deserializePasswordReset)(data);
+            return (0, serializers_2.deserializePasswordReset)(data);
         });
     }
     createPasswordReset(options) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { data } = yield this.workos.post('/user_management/password_reset', (0, serializers_1.serializeCreatePasswordResetOptions)(Object.assign({}, options)));
-            return (0, serializers_1.deserializePasswordReset)(data);
+            const { data } = yield this.workos.post('/user_management/password_reset', (0, serializers_2.serializeCreatePasswordResetOptions)(Object.assign({}, options)));
+            return (0, serializers_2.deserializePasswordReset)(data);
         });
     }
     /**
@@ -169,27 +347,27 @@ class UserManagement {
      */
     sendPasswordResetEmail(payload) {
         return __awaiter(this, void 0, void 0, function* () {
-            yield this.workos.post('/user_management/password_reset/send', (0, serializers_1.serializeSendPasswordResetEmailOptions)(payload));
+            yield this.workos.post('/user_management/password_reset/send', (0, serializers_2.serializeSendPasswordResetEmailOptions)(payload));
         });
     }
     resetPassword(payload) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { data } = yield this.workos.post('/user_management/password_reset/confirm', (0, serializers_1.serializeResetPasswordOptions)(payload));
-            return { user: (0, serializers_1.deserializeUser)(data.user) };
+            const { data } = yield this.workos.post('/user_management/password_reset/confirm', (0, serializers_2.serializeResetPasswordOptions)(payload));
+            return { user: (0, serializers_2.deserializeUser)(data.user) };
         });
     }
     updateUser(payload) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { data } = yield this.workos.put(`/user_management/users/${payload.userId}`, (0, serializers_1.serializeUpdateUserOptions)(payload));
-            return (0, serializers_1.deserializeUser)(data);
+            const { data } = yield this.workos.put(`/user_management/users/${payload.userId}`, (0, serializers_2.serializeUpdateUserOptions)(payload));
+            return (0, serializers_2.deserializeUser)(data);
         });
     }
     enrollAuthFactor(payload) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { data } = yield this.workos.post(`/user_management/users/${payload.userId}/auth_factors`, (0, serializers_1.serializeEnrollAuthFactorOptions)(payload));
+            const { data } = yield this.workos.post(`/user_management/users/${payload.userId}/auth_factors`, (0, serializers_2.serializeEnrollAuthFactorOptions)(payload));
             return {
-                authenticationFactor: (0, serializers_1.deserializeFactorWithSecrets)(data.authentication_factor),
-                authenticationChallenge: (0, serializers_2.deserializeChallenge)(data.authentication_challenge),
+                authenticationFactor: (0, serializers_2.deserializeFactorWithSecrets)(data.authentication_factor),
+                authenticationChallenge: (0, serializers_1.deserializeChallenge)(data.authentication_challenge),
             };
         });
     }