@workos-inc/node 7.14.0 → 7.15.0

package/lib/common/interfaces/workos-options.interface.d.ts

@@ -6,4 +6,5 @@ export interface WorkOSOptions {
     config?: RequestInit;
     appInfo?: AppInfo;
     fetchFn?: typeof fetch;
+    clientId?: string;
 }

package/lib/common/net/node-client.d.ts

@@ -1,4 +1,3 @@
-/// <reference types="node" />
 import { HttpClient, HttpClientResponse } from './http-client';
 import { HttpClientInterface, HttpClientResponseInterface, RequestOptions } from '../interfaces/http-client.interface';
 import * as http_ from 'node:http';

package/lib/user-management/interfaces/authenticate-with-options-base.interface.d.ts

@@ -1,7 +1,12 @@
+export interface AuthenticateWithSessionOptions {
+    cookiePassword?: string;
+    sealSession: boolean;
+}
 export interface AuthenticateWithOptionsBase {
     clientId: string;
     ipAddress?: string;
     userAgent?: string;
+    session?: AuthenticateWithSessionOptions;
 }
 export interface SerializedAuthenticateWithOptionsBase {
     client_id: string;

package/lib/user-management/interfaces/authenticate-with-session-cookie.interface.d.ts

@@ -0,0 +1,24 @@
+import { AuthenticationResponse } from './authentication-response.interface';
+export interface AccessToken {
+    sid: string;
+    org_id?: string;
+    role?: string;
+    permissions?: string[];
+}
+export type SessionCookieData = Pick<AuthenticationResponse, 'accessToken' | 'impersonator' | 'organizationId' | 'refreshToken' | 'user'>;
+export declare enum AuthenticateWithSessionCookieFailureReason {
+    INVALID_JWT = "invalid_jwt",
+    INVALID_SESSION_COOKIE = "invalid_session_cookie",
+    NO_SESSION_COOKIE_PROVIDED = "no_session_cookie_provided"
+}
+export type AuthenticateWithSessionCookieFailedResponse = {
+    authenticated: false;
+    reason: AuthenticateWithSessionCookieFailureReason;
+};
+export type AuthenticateWithSessionCookieSuccessResponse = {
+    authenticated: true;
+    sessionId: string;
+    organizationId?: string;
+    role?: string;
+    permissions?: string[];
+};

package/lib/user-management/interfaces/authenticate-with-session-cookie.interface.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthenticateWithSessionCookieFailureReason = void 0;
+var AuthenticateWithSessionCookieFailureReason;
+(function (AuthenticateWithSessionCookieFailureReason) {
+    AuthenticateWithSessionCookieFailureReason["INVALID_JWT"] = "invalid_jwt";
+    AuthenticateWithSessionCookieFailureReason["INVALID_SESSION_COOKIE"] = "invalid_session_cookie";
+    AuthenticateWithSessionCookieFailureReason["NO_SESSION_COOKIE_PROVIDED"] = "no_session_cookie_provided";
+})(AuthenticateWithSessionCookieFailureReason || (exports.AuthenticateWithSessionCookieFailureReason = AuthenticateWithSessionCookieFailureReason = {}));

package/lib/user-management/interfaces/authentication-response.interface.d.ts

@@ -8,6 +8,7 @@ export interface AuthenticationResponse {
     refreshToken: string;
     impersonator?: Impersonator;
     authenticationMethod?: AuthenticationMethod;
+    sealedSession?: string;
 }
 export interface AuthenticationResponseResponse {
     user: UserResponse;

package/lib/user-management/interfaces/index.d.ts

@@ -7,6 +7,7 @@ export * from './authenticate-with-options-base.interface';
 export * from './authenticate-with-organization-selection.interface';
 export * from './authenticate-with-password-options.interface';
 export * from './authenticate-with-refresh-token-options.interface';
+export * from './authenticate-with-session-cookie.interface';
 export * from './authenticate-with-totp-options.interface';
 export * from './authentication-response.interface';
 export * from './create-magic-auth-options.interface';
@@ -25,6 +26,7 @@ export * from './list-users-options.interface';
 export * from './magic-auth.interface';
 export * from './organization-membership.interface';
 export * from './password-reset.interface';
+export * from './refresh-and-seal-session-data.interface';
 export * from './reset-password-options.interface';
 export * from './revoke-session-options.interface';
 export * from './send-invitation-options.interface';

package/lib/user-management/interfaces/index.js

@@ -23,6 +23,7 @@ __exportStar(require("./authenticate-with-options-base.interface"), exports);
 __exportStar(require("./authenticate-with-organization-selection.interface"), exports);
 __exportStar(require("./authenticate-with-password-options.interface"), exports);
 __exportStar(require("./authenticate-with-refresh-token-options.interface"), exports);
+__exportStar(require("./authenticate-with-session-cookie.interface"), exports);
 __exportStar(require("./authenticate-with-totp-options.interface"), exports);
 __exportStar(require("./authentication-response.interface"), exports);
 __exportStar(require("./create-magic-auth-options.interface"), exports);
@@ -41,6 +42,7 @@ __exportStar(require("./list-users-options.interface"), exports);
 __exportStar(require("./magic-auth.interface"), exports);
 __exportStar(require("./organization-membership.interface"), exports);
 __exportStar(require("./password-reset.interface"), exports);
+__exportStar(require("./refresh-and-seal-session-data.interface"), exports);
 __exportStar(require("./reset-password-options.interface"), exports);
 __exportStar(require("./revoke-session-options.interface"), exports);
 __exportStar(require("./send-invitation-options.interface"), exports);

package/lib/user-management/interfaces/refresh-and-seal-session-data.interface.d.ts

@@ -0,0 +1,16 @@
+export declare enum RefreshAndSealSessionDataFailureReason {
+    INVALID_SESSION_COOKE = "invalid_session_cookie",
+    NO_SESSION_COOKIE_PROVIDED = "no_session_cookie_provided",
+    INVALID_GRANT = "invalid_grant",
+    ORGANIZATION_NOT_AUTHORIZED = "organization_not_authorized"
+}
+type RefreshAndSealSessionDataFailedResponse = {
+    authenticated: false;
+    reason: RefreshAndSealSessionDataFailureReason;
+};
+type RefreshAndSealSessionDataSuccessResponse = {
+    authenticated: true;
+    sealedSession: string;
+};
+export type RefreshAndSealSessionDataResponse = RefreshAndSealSessionDataFailedResponse | RefreshAndSealSessionDataSuccessResponse;
+export {};

package/lib/user-management/interfaces/refresh-and-seal-session-data.interface.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RefreshAndSealSessionDataFailureReason = void 0;
+var RefreshAndSealSessionDataFailureReason;
+(function (RefreshAndSealSessionDataFailureReason) {
+    RefreshAndSealSessionDataFailureReason["INVALID_SESSION_COOKE"] = "invalid_session_cookie";
+    RefreshAndSealSessionDataFailureReason["NO_SESSION_COOKIE_PROVIDED"] = "no_session_cookie_provided";
+    // API OauthErrors for refresh tokens
+    RefreshAndSealSessionDataFailureReason["INVALID_GRANT"] = "invalid_grant";
+    RefreshAndSealSessionDataFailureReason["ORGANIZATION_NOT_AUTHORIZED"] = "organization_not_authorized";
+})(RefreshAndSealSessionDataFailureReason || (exports.RefreshAndSealSessionDataFailureReason = RefreshAndSealSessionDataFailureReason = {}));

package/lib/user-management/interfaces/session-handler-options.interface.d.ts

@@ -0,0 +1,4 @@
+export interface SessionHandlerOptions {
+    sessionData: string;
+    cookiePassword?: string;
+}

package/lib/user-management/interfaces/session-handler-options.interface.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/user-management/user-management.d.ts

@@ -1,22 +1,26 @@
-import { WorkOS } from '../workos';
 import { AutoPaginatable } from '../common/utils/pagination';
-import { AuthenticateWithCodeOptions, AuthenticateWithMagicAuthOptions, AuthenticateWithPasswordOptions, AuthenticateWithTotpOptions, AuthenticationResponse, ResetPasswordOptions, SendPasswordResetEmailOptions, CreateUserOptions, EnrollAuthFactorOptions, ListAuthFactorsOptions, ListUsersOptions, SendMagicAuthCodeOptions, SendVerificationEmailOptions, UpdateUserOptions, User, VerifyEmailOptions, AuthenticateWithRefreshTokenOptions, MagicAuth, CreateMagicAuthOptions, EmailVerification, PasswordReset, CreatePasswordResetOptions } from './interfaces';
 import { Challenge } from '../mfa/interfaces';
-import { OrganizationMembership } from './interfaces/organization-membership.interface';
-import { ListOrganizationMembershipsOptions } from './interfaces/list-organization-memberships-options.interface';
-import { CreateOrganizationMembershipOptions } from './interfaces/create-organization-membership-options.interface';
-import { Invitation } from './interfaces/invitation.interface';
-import { ListInvitationsOptions } from './interfaces/list-invitations-options.interface';
-import { SendInvitationOptions } from './interfaces/send-invitation-options.interface';
-import { AuthorizationURLOptions } from './interfaces/authorization-url-options.interface';
+import { WorkOS } from '../workos';
+import { AuthenticateWithCodeOptions, AuthenticateWithMagicAuthOptions, AuthenticateWithPasswordOptions, AuthenticateWithRefreshTokenOptions, AuthenticateWithTotpOptions, AuthenticationResponse, CreateMagicAuthOptions, CreatePasswordResetOptions, CreateUserOptions, EmailVerification, EnrollAuthFactorOptions, ListAuthFactorsOptions, ListUsersOptions, MagicAuth, PasswordReset, ResetPasswordOptions, SendMagicAuthCodeOptions, SendPasswordResetEmailOptions, SendVerificationEmailOptions, UpdateUserOptions, User, VerifyEmailOptions } from './interfaces';
 import { AuthenticateWithEmailVerificationOptions } from './interfaces/authenticate-with-email-verification-options.interface';
 import { AuthenticateWithOrganizationSelectionOptions } from './interfaces/authenticate-with-organization-selection.interface';
+import { AuthenticateWithSessionCookieFailedResponse, AuthenticateWithSessionCookieSuccessResponse, SessionCookieData } from './interfaces/authenticate-with-session-cookie.interface';
+import { AuthorizationURLOptions } from './interfaces/authorization-url-options.interface';
+import { CreateOrganizationMembershipOptions } from './interfaces/create-organization-membership-options.interface';
 import { Factor, FactorWithSecrets } from './interfaces/factor.interface';
+import { Identity } from './interfaces/identity.interface';
+import { Invitation } from './interfaces/invitation.interface';
+import { ListInvitationsOptions } from './interfaces/list-invitations-options.interface';
+import { ListOrganizationMembershipsOptions } from './interfaces/list-organization-memberships-options.interface';
+import { OrganizationMembership } from './interfaces/organization-membership.interface';
+import { RefreshAndSealSessionDataResponse } from './interfaces/refresh-and-seal-session-data.interface';
 import { RevokeSessionOptions } from './interfaces/revoke-session-options.interface';
+import { SendInvitationOptions } from './interfaces/send-invitation-options.interface';
+import { SessionHandlerOptions } from './interfaces/session-handler-options.interface';
 import { UpdateOrganizationMembershipOptions } from './interfaces/update-organization-membership-options.interface';
-import { Identity } from './interfaces/identity.interface';
 export declare class UserManagement {
     private readonly workos;
+    private jwks;
     constructor(workos: WorkOS);
     getUser(userId: string): Promise<User>;
     listUsers(options?: ListUsersOptions): Promise<AutoPaginatable<User>>;
@@ -28,6 +32,12 @@ export declare class UserManagement {
     authenticateWithTotp(payload: AuthenticateWithTotpOptions): Promise<AuthenticationResponse>;
     authenticateWithEmailVerification(payload: AuthenticateWithEmailVerificationOptions): Promise<AuthenticationResponse>;
     authenticateWithOrganizationSelection(payload: AuthenticateWithOrganizationSelectionOptions): Promise<AuthenticationResponse>;
+    authenticateWithSessionCookie({ sessionData, cookiePassword, }: SessionHandlerOptions): Promise<AuthenticateWithSessionCookieSuccessResponse | AuthenticateWithSessionCookieFailedResponse>;
+    private isValidJwt;
+    refreshAndSealSessionData({ sessionData, cookiePassword, }: SessionHandlerOptions): Promise<RefreshAndSealSessionDataResponse>;
+    private prepareAuthenticationResponse;
+    private sealSessionDataFromAuthenticationResponse;
+    getSessionFromCookie({ sessionData, cookiePassword, }: SessionHandlerOptions): Promise<SessionCookieData | undefined>;
     getEmailVerification(emailVerificationId: string): Promise<EmailVerification>;
     sendVerificationEmail({ userId, }: SendVerificationEmailOptions): Promise<{
         user: User;

package/lib/user-management/user-management.js

@@ -21,23 +21,28 @@ var __rest = (this && this.__rest) || function (s, e) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.UserManagement = void 0;
-const pagination_1 = require("../common/utils/pagination");
-const serializers_1 = require("./serializers");
+const iron_session_1 = require("iron-session");
+const jose_1 = require("jose");
+const oauth_exception_1 = require("../common/exceptions/oauth.exception");
 const fetch_and_deserialize_1 = require("../common/utils/fetch-and-deserialize");
-const serializers_2 = require("../mfa/serializers");
-const organization_membership_serializer_1 = require("./serializers/organization-membership.serializer");
-const list_organization_memberships_options_serializer_1 = require("./serializers/list-organization-memberships-options.serializer");
+const pagination_1 = require("../common/utils/pagination");
+const serializers_1 = require("../mfa/serializers");
+const authenticate_with_session_cookie_interface_1 = require("./interfaces/authenticate-with-session-cookie.interface");
+const refresh_and_seal_session_data_interface_1 = require("./interfaces/refresh-and-seal-session-data.interface");
+const revoke_session_options_interface_1 = require("./interfaces/revoke-session-options.interface");
+const serializers_2 = require("./serializers");
+const authenticate_with_email_verification_serializer_1 = require("./serializers/authenticate-with-email-verification.serializer");
+const authenticate_with_organization_selection_options_serializer_1 = require("./serializers/authenticate-with-organization-selection-options.serializer");
 const create_organization_membership_options_serializer_1 = require("./serializers/create-organization-membership-options.serializer");
+const factor_serializer_1 = require("./serializers/factor.serializer");
+const identity_serializer_1 = require("./serializers/identity.serializer");
 const invitation_serializer_1 = require("./serializers/invitation.serializer");
 const list_invitations_options_serializer_1 = require("./serializers/list-invitations-options.serializer");
-const send_invitation_options_serializer_1 = require("./serializers/send-invitation-options.serializer");
+const list_organization_memberships_options_serializer_1 = require("./serializers/list-organization-memberships-options.serializer");
 const list_users_options_serializer_1 = require("./serializers/list-users-options.serializer");
-const authenticate_with_email_verification_serializer_1 = require("./serializers/authenticate-with-email-verification.serializer");
-const authenticate_with_organization_selection_options_serializer_1 = require("./serializers/authenticate-with-organization-selection-options.serializer");
-const factor_serializer_1 = require("./serializers/factor.serializer");
-const revoke_session_options_interface_1 = require("./interfaces/revoke-session-options.interface");
+const organization_membership_serializer_1 = require("./serializers/organization-membership.serializer");
+const send_invitation_options_serializer_1 = require("./serializers/send-invitation-options.serializer");
 const update_organization_membership_options_serializer_1 = require("./serializers/update-organization-membership-options.serializer");
-const identity_serializer_1 = require("./serializers/identity.serializer");
 const toQueryString = (options) => {
     const searchParams = new URLSearchParams();
     const keys = Object.keys(options).sort();
@@ -52,88 +57,261 @@ const toQueryString = (options) => {
 class UserManagement {
     constructor(workos) {
         this.workos = workos;
+        const { clientId } = workos.options;
+        // Set the JWKS URL. This is used to verify if the JWT is still valid
+        this.jwks = clientId
+            ? (0, jose_1.createRemoteJWKSet)(new URL(this.getJwksUrl(clientId)))
+            : undefined;
     }
     getUser(userId) {
         return __awaiter(this, void 0, void 0, function* () {
             const { data } = yield this.workos.get(`/user_management/users/${userId}`);
-            return (0, serializers_1.deserializeUser)(data);
+            return (0, serializers_2.deserializeUser)(data);
         });
     }
     listUsers(options) {
         return __awaiter(this, void 0, void 0, function* () {
-            return new pagination_1.AutoPaginatable(yield (0, fetch_and_deserialize_1.fetchAndDeserialize)(this.workos, '/user_management/users', serializers_1.deserializeUser, options ? (0, list_users_options_serializer_1.serializeListUsersOptions)(options) : undefined), (params) => (0, fetch_and_deserialize_1.fetchAndDeserialize)(this.workos, '/user_management/users', serializers_1.deserializeUser, params), options ? (0, list_users_options_serializer_1.serializeListUsersOptions)(options) : undefined);
+            return new pagination_1.AutoPaginatable(yield (0, fetch_and_deserialize_1.fetchAndDeserialize)(this.workos, '/user_management/users', serializers_2.deserializeUser, options ? (0, list_users_options_serializer_1.serializeListUsersOptions)(options) : undefined), (params) => (0, fetch_and_deserialize_1.fetchAndDeserialize)(this.workos, '/user_management/users', serializers_2.deserializeUser, params), options ? (0, list_users_options_serializer_1.serializeListUsersOptions)(options) : undefined);
         });
     }
     createUser(payload) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { data } = yield this.workos.post('/user_management/users', (0, serializers_1.serializeCreateUserOptions)(payload));
-            return (0, serializers_1.deserializeUser)(data);
+            const { data } = yield this.workos.post('/user_management/users', (0, serializers_2.serializeCreateUserOptions)(payload));
+            return (0, serializers_2.deserializeUser)(data);
         });
     }
     authenticateWithMagicAuth(payload) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { data } = yield this.workos.post('/user_management/authenticate', (0, serializers_1.serializeAuthenticateWithMagicAuthOptions)(Object.assign(Object.assign({}, payload), { clientSecret: this.workos.key })));
-            return (0, serializers_1.deserializeAuthenticationResponse)(data);
+            const { session } = payload, remainingPayload = __rest(payload, ["session"]);
+            const { data } = yield this.workos.post('/user_management/authenticate', (0, serializers_2.serializeAuthenticateWithMagicAuthOptions)(Object.assign(Object.assign({}, remainingPayload), { clientSecret: this.workos.key })));
+            return this.prepareAuthenticationResponse({
+                authenticationResponse: (0, serializers_2.deserializeAuthenticationResponse)(data),
+                session,
+            });
         });
     }
     authenticateWithPassword(payload) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { data } = yield this.workos.post('/user_management/authenticate', (0, serializers_1.serializeAuthenticateWithPasswordOptions)(Object.assign(Object.assign({}, payload), { clientSecret: this.workos.key })));
-            return (0, serializers_1.deserializeAuthenticationResponse)(data);
+            const { session } = payload, remainingPayload = __rest(payload, ["session"]);
+            const { data } = yield this.workos.post('/user_management/authenticate', (0, serializers_2.serializeAuthenticateWithPasswordOptions)(Object.assign(Object.assign({}, remainingPayload), { clientSecret: this.workos.key })));
+            return this.prepareAuthenticationResponse({
+                authenticationResponse: (0, serializers_2.deserializeAuthenticationResponse)(data),
+                session,
+            });
         });
     }
     authenticateWithCode(payload) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { data } = yield this.workos.post('/user_management/authenticate', (0, serializers_1.serializeAuthenticateWithCodeOptions)(Object.assign(Object.assign({}, payload), { clientSecret: this.workos.key })));
-            return (0, serializers_1.deserializeAuthenticationResponse)(data);
+            const { session } = payload, remainingPayload = __rest(payload, ["session"]);
+            const { data } = yield this.workos.post('/user_management/authenticate', (0, serializers_2.serializeAuthenticateWithCodeOptions)(Object.assign(Object.assign({}, remainingPayload), { clientSecret: this.workos.key })));
+            return this.prepareAuthenticationResponse({
+                authenticationResponse: (0, serializers_2.deserializeAuthenticationResponse)(data),
+                session,
+            });
         });
     }
     authenticateWithRefreshToken(payload) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { data } = yield this.workos.post('/user_management/authenticate', (0, serializers_1.serializeAuthenticateWithRefreshTokenOptions)(Object.assign(Object.assign({}, payload), { clientSecret: this.workos.key })));
-            return (0, serializers_1.deserializeAuthenticationResponse)(data);
+            const { session } = payload, remainingPayload = __rest(payload, ["session"]);
+            const { data } = yield this.workos.post('/user_management/authenticate', (0, serializers_2.serializeAuthenticateWithRefreshTokenOptions)(Object.assign(Object.assign({}, remainingPayload), { clientSecret: this.workos.key })));
+            return this.prepareAuthenticationResponse({
+                authenticationResponse: (0, serializers_2.deserializeAuthenticationResponse)(data),
+                session,
+            });
         });
     }
     authenticateWithTotp(payload) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { data } = yield this.workos.post('/user_management/authenticate', (0, serializers_1.serializeAuthenticateWithTotpOptions)(Object.assign(Object.assign({}, payload), { clientSecret: this.workos.key })));
-            return (0, serializers_1.deserializeAuthenticationResponse)(data);
+            const { session } = payload, remainingPayload = __rest(payload, ["session"]);
+            const { data } = yield this.workos.post('/user_management/authenticate', (0, serializers_2.serializeAuthenticateWithTotpOptions)(Object.assign(Object.assign({}, remainingPayload), { clientSecret: this.workos.key })));
+            return this.prepareAuthenticationResponse({
+                authenticationResponse: (0, serializers_2.deserializeAuthenticationResponse)(data),
+                session,
+            });
         });
     }
     authenticateWithEmailVerification(payload) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { data } = yield this.workos.post('/user_management/authenticate', (0, authenticate_with_email_verification_serializer_1.serializeAuthenticateWithEmailVerificationOptions)(Object.assign(Object.assign({}, payload), { clientSecret: this.workos.key })));
-            return (0, serializers_1.deserializeAuthenticationResponse)(data);
+            const { session } = payload, remainingPayload = __rest(payload, ["session"]);
+            const { data } = yield this.workos.post('/user_management/authenticate', (0, authenticate_with_email_verification_serializer_1.serializeAuthenticateWithEmailVerificationOptions)(Object.assign(Object.assign({}, remainingPayload), { clientSecret: this.workos.key })));
+            return this.prepareAuthenticationResponse({
+                authenticationResponse: (0, serializers_2.deserializeAuthenticationResponse)(data),
+                session,
+            });
         });
     }
     authenticateWithOrganizationSelection(payload) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { data } = yield this.workos.post('/user_management/authenticate', (0, authenticate_with_organization_selection_options_serializer_1.serializeAuthenticateWithOrganizationSelectionOptions)(Object.assign(Object.assign({}, payload), { clientSecret: this.workos.key })));
-            return (0, serializers_1.deserializeAuthenticationResponse)(data);
+            const { session } = payload, remainingPayload = __rest(payload, ["session"]);
+            const { data } = yield this.workos.post('/user_management/authenticate', (0, authenticate_with_organization_selection_options_serializer_1.serializeAuthenticateWithOrganizationSelectionOptions)(Object.assign(Object.assign({}, remainingPayload), { clientSecret: this.workos.key })));
+            return this.prepareAuthenticationResponse({
+                authenticationResponse: (0, serializers_2.deserializeAuthenticationResponse)(data),
+                session,
+            });
+        });
+    }
+    authenticateWithSessionCookie({ sessionData, cookiePassword = process.env.WORKOS_COOKIE_PASSWORD, }) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!cookiePassword) {
+                throw new Error('Cookie password is required');
+            }
+            if (!this.jwks) {
+                throw new Error('Must provide clientId to initialize JWKS');
+            }
+            if (!sessionData) {
+                return {
+                    authenticated: false,
+                    reason: authenticate_with_session_cookie_interface_1.AuthenticateWithSessionCookieFailureReason.NO_SESSION_COOKIE_PROVIDED,
+                };
+            }
+            const session = yield (0, iron_session_1.unsealData)(sessionData, {
+                password: cookiePassword,
+            });
+            if (!session.accessToken) {
+                return {
+                    authenticated: false,
+                    reason: authenticate_with_session_cookie_interface_1.AuthenticateWithSessionCookieFailureReason.INVALID_SESSION_COOKIE,
+                };
+            }
+            if (!(yield this.isValidJwt(session.accessToken))) {
+                return {
+                    authenticated: false,
+                    reason: authenticate_with_session_cookie_interface_1.AuthenticateWithSessionCookieFailureReason.INVALID_JWT,
+                };
+            }
+            const { sid: sessionId, org_id: organizationId, role, permissions, } = (0, jose_1.decodeJwt)(session.accessToken);
+            return {
+                authenticated: true,
+                sessionId,
+                organizationId,
+                role,
+                permissions,
+            };
+        });
+    }
+    isValidJwt(accessToken) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!this.jwks) {
+                throw new Error('Must provide clientId to initialize JWKS');
+            }
+            try {
+                yield (0, jose_1.jwtVerify)(accessToken, this.jwks);
+                return true;
+            }
+            catch (e) {
+                return false;
+            }
+        });
+    }
+    refreshAndSealSessionData({ sessionData, cookiePassword = process.env.WORKOS_COOKIE_PASSWORD, }) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!cookiePassword) {
+                throw new Error('Cookie password is required');
+            }
+            if (!sessionData) {
+                return {
+                    authenticated: false,
+                    reason: refresh_and_seal_session_data_interface_1.RefreshAndSealSessionDataFailureReason.NO_SESSION_COOKIE_PROVIDED,
+                };
+            }
+            const session = yield (0, iron_session_1.unsealData)(sessionData, {
+                password: cookiePassword,
+            });
+            if (!session.refreshToken || !session.user) {
+                return {
+                    authenticated: false,
+                    reason: refresh_and_seal_session_data_interface_1.RefreshAndSealSessionDataFailureReason.INVALID_SESSION_COOKE,
+                };
+            }
+            try {
+                const { sealedSession } = yield this.authenticateWithRefreshToken({
+                    clientId: this.workos.clientId,
+                    refreshToken: session.refreshToken,
+                    session: { sealSession: true, cookiePassword },
+                });
+                if (!sealedSession) {
+                    return {
+                        authenticated: false,
+                        reason: refresh_and_seal_session_data_interface_1.RefreshAndSealSessionDataFailureReason.INVALID_SESSION_COOKE,
+                    };
+                }
+                return { authenticated: true, sealedSession };
+            }
+            catch (error) {
+                if (error instanceof oauth_exception_1.OauthException &&
+                    // TODO: Add additional known errors and remove re-throw
+                    (error.error === refresh_and_seal_session_data_interface_1.RefreshAndSealSessionDataFailureReason.INVALID_GRANT ||
+                        error.error ===
+                            refresh_and_seal_session_data_interface_1.RefreshAndSealSessionDataFailureReason.ORGANIZATION_NOT_AUTHORIZED)) {
+                    return {
+                        authenticated: false,
+                        reason: error.error,
+                    };
+                }
+                throw error;
+            }
+        });
+    }
+    prepareAuthenticationResponse({ authenticationResponse, session, }) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (session) {
+                return Object.assign(Object.assign({}, authenticationResponse), { sealedSession: yield this.sealSessionDataFromAuthenticationResponse({
+                        authenticationResponse,
+                        cookiePassword: session.cookiePassword,
+                    }) });
+            }
+            return authenticationResponse;
+        });
+    }
+    sealSessionDataFromAuthenticationResponse({ authenticationResponse, cookiePassword, }) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!cookiePassword) {
+                throw new Error('Cookie password is required');
+            }
+            const sessionData = {
+                user: authenticationResponse.user,
+                accessToken: authenticationResponse.accessToken,
+                refreshToken: authenticationResponse.refreshToken,
+                impersonator: authenticationResponse.impersonator,
+            };
+            return (0, iron_session_1.sealData)(sessionData, { password: cookiePassword });
+        });
+    }
+    getSessionFromCookie({ sessionData, cookiePassword = process.env.WORKOS_COOKIE_PASSWORD, }) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!cookiePassword) {
+                throw new Error('Cookie password is required');
+            }
+            if (sessionData) {
+                return (0, iron_session_1.unsealData)(sessionData, {
+                    password: cookiePassword,
+                });
+            }
+            return undefined;
         });
     }
     getEmailVerification(emailVerificationId) {
         return __awaiter(this, void 0, void 0, function* () {
             const { data } = yield this.workos.get(`/user_management/email_verification/${emailVerificationId}`);
-            return (0, serializers_1.deserializeEmailVerification)(data);
+            return (0, serializers_2.deserializeEmailVerification)(data);
         });
     }
     sendVerificationEmail({ userId, }) {
         return __awaiter(this, void 0, void 0, function* () {
             const { data } = yield this.workos.post(`/user_management/users/${userId}/email_verification/send`, {});
-            return { user: (0, serializers_1.deserializeUser)(data.user) };
+            return { user: (0, serializers_2.deserializeUser)(data.user) };
         });
     }
     getMagicAuth(magicAuthId) {
         return __awaiter(this, void 0, void 0, function* () {
             const { data } = yield this.workos.get(`/user_management/magic_auth/${magicAuthId}`);
-            return (0, serializers_1.deserializeMagicAuth)(data);
+            return (0, serializers_2.deserializeMagicAuth)(data);
         });
     }
     createMagicAuth(options) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { data } = yield this.workos.post('/user_management/magic_auth', (0, serializers_1.serializeCreateMagicAuthOptions)(Object.assign({}, options)));
-            return (0, serializers_1.deserializeMagicAuth)(data);
+            const { data } = yield this.workos.post('/user_management/magic_auth', (0, serializers_2.serializeCreateMagicAuthOptions)(Object.assign({}, options)));
+            return (0, serializers_2.deserializeMagicAuth)(data);
         });
     }
     /**
@@ -141,7 +319,7 @@ class UserManagement {
      */
     sendMagicAuthCode(options) {
         return __awaiter(this, void 0, void 0, function* () {
-            yield this.workos.post('/user_management/magic_auth/send', (0, serializers_1.serializeSendMagicAuthCodeOptions)(options));
+            yield this.workos.post('/user_management/magic_auth/send', (0, serializers_2.serializeSendMagicAuthCodeOptions)(options));
         });
     }
     verifyEmail({ code, userId, }) {
@@ -149,19 +327,19 @@ class UserManagement {
             const { data } = yield this.workos.post(`/user_management/users/${userId}/email_verification/confirm`, {
                 code,
             });
-            return { user: (0, serializers_1.deserializeUser)(data.user) };
+            return { user: (0, serializers_2.deserializeUser)(data.user) };
         });
     }
     getPasswordReset(passwordResetId) {
         return __awaiter(this, void 0, void 0, function* () {
             const { data } = yield this.workos.get(`/user_management/password_reset/${passwordResetId}`);
-            return (0, serializers_1.deserializePasswordReset)(data);
+            return (0, serializers_2.deserializePasswordReset)(data);
         });
     }
     createPasswordReset(options) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { data } = yield this.workos.post('/user_management/password_reset', (0, serializers_1.serializeCreatePasswordResetOptions)(Object.assign({}, options)));
-            return (0, serializers_1.deserializePasswordReset)(data);
+            const { data } = yield this.workos.post('/user_management/password_reset', (0, serializers_2.serializeCreatePasswordResetOptions)(Object.assign({}, options)));
+            return (0, serializers_2.deserializePasswordReset)(data);
         });
     }
     /**
@@ -169,27 +347,27 @@ class UserManagement {
      */
     sendPasswordResetEmail(payload) {
         return __awaiter(this, void 0, void 0, function* () {
-            yield this.workos.post('/user_management/password_reset/send', (0, serializers_1.serializeSendPasswordResetEmailOptions)(payload));
+            yield this.workos.post('/user_management/password_reset/send', (0, serializers_2.serializeSendPasswordResetEmailOptions)(payload));
         });
     }
     resetPassword(payload) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { data } = yield this.workos.post('/user_management/password_reset/confirm', (0, serializers_1.serializeResetPasswordOptions)(payload));
-            return { user: (0, serializers_1.deserializeUser)(data.user) };
+            const { data } = yield this.workos.post('/user_management/password_reset/confirm', (0, serializers_2.serializeResetPasswordOptions)(payload));
+            return { user: (0, serializers_2.deserializeUser)(data.user) };
         });
     }
     updateUser(payload) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { data } = yield this.workos.put(`/user_management/users/${payload.userId}`, (0, serializers_1.serializeUpdateUserOptions)(payload));
-            return (0, serializers_1.deserializeUser)(data);
+            const { data } = yield this.workos.put(`/user_management/users/${payload.userId}`, (0, serializers_2.serializeUpdateUserOptions)(payload));
+            return (0, serializers_2.deserializeUser)(data);
         });
     }
     enrollAuthFactor(payload) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { data } = yield this.workos.post(`/user_management/users/${payload.userId}/auth_factors`, (0, serializers_1.serializeEnrollAuthFactorOptions)(payload));
+            const { data } = yield this.workos.post(`/user_management/users/${payload.userId}/auth_factors`, (0, serializers_2.serializeEnrollAuthFactorOptions)(payload));
             return {
-                authenticationFactor: (0, serializers_1.deserializeFactorWithSecrets)(data.authentication_factor),
-                authenticationChallenge: (0, serializers_2.deserializeChallenge)(data.authentication_challenge),
+                authenticationFactor: (0, serializers_2.deserializeFactorWithSecrets)(data.authentication_factor),
+                authenticationChallenge: (0, serializers_1.deserializeChallenge)(data.authentication_challenge),
             };
         });
     }

package/lib/user-management/user-management.spec.js

@@ -1,4 +1,27 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
     return new (P || (P = Promise))(function (resolve, reject) {
@@ -27,7 +50,8 @@ const organization_membership_json_1 = __importDefault(require("./fixtures/organ
 const password_reset_json_1 = __importDefault(require("./fixtures/password_reset.json"));
 const user_json_1 = __importDefault(require("./fixtures/user.json"));
 const identity_json_1 = __importDefault(require("./fixtures/identity.json"));
-const workos = new workos_1.WorkOS('sk_test_Sz3IQjepeSWaI4cMS4ms4sMuU');
+const jose = __importStar(require("jose"));
+const iron_session_1 = require("iron-session");
 const userId = 'user_01H5JQDV7R7ATEYZDEG0W5PRYS';
 const organizationMembershipId = 'om_01H5JQDV7R7ATEYZDEG0W5PRYS';
 const emailVerificationId = 'email_verification_01H5JQDV7R7ATEYZDEG0W5PRYS';
@@ -36,6 +60,13 @@ const invitationToken = 'Z1uX3RbwcIl5fIGJJJCXXisdI';
 const magicAuthId = 'magic_auth_01H5JQDV7R7ATEYZDEG0W5PRYS';
 const passwordResetId = 'password_reset_01H5JQDV7R7ATEYZDEG0W5PRYS';
 describe('UserManagement', () => {
+    let workos;
+    beforeAll(() => {
+        workos = new workos_1.WorkOS('sk_test_Sz3IQjepeSWaI4cMS4ms4sMuU', {
+            apiHostname: 'api.workos.test',
+            clientId: 'proj_123',
+        });
+    });
     beforeEach(() => jest_fetch_mock_1.default.resetMocks());
     describe('getUser', () => {
         it('sends a Get User request', () => __awaiter(void 0, void 0, void 0, function* () {
@@ -127,8 +158,45 @@ describe('UserManagement', () => {
                 },
             });
         }));
+        describe('when sealSession = true', () => {
+            beforeEach(() => {
+                (0, test_utils_1.fetchOnce)({ user: user_json_1.default });
+            });
+            describe('when the cookie password is undefined', () => {
+                it('throws an error', () => __awaiter(void 0, void 0, void 0, function* () {
+                    yield expect(workos.userManagement.authenticateWithMagicAuth({
+                        clientId: 'proj_whatever',
+                        code: '123456',
+                        email: user_json_1.default.email,
+                        session: { sealSession: true },
+                    })).rejects.toThrow('Cookie password is required');
+                }));
+            });
+            describe('when successfully authenticated', () => {
+                it('returns the sealed session data', () => __awaiter(void 0, void 0, void 0, function* () {
+                    const cookiePassword = 'alongcookiesecretmadefortestingsessions';
+                    const response = yield workos.userManagement.authenticateWithMagicAuth({
+                        clientId: 'proj_whatever',
+                        code: '123456',
+                        email: user_json_1.default.email,
+                        session: { sealSession: true, cookiePassword },
+                    });
+                    expect(response).toEqual({
+                        sealedSession: expect.any(String),
+                        accessToken: undefined,
+                        authenticationMethod: undefined,
+                        impersonator: undefined,
+                        organizationId: undefined,
+                        refreshToken: undefined,
+                        user: expect.objectContaining({
+                            email: 'test01@example.com',
+                        }),
+                    });
+                }));
+            });
+        });
     });
-    describe('authenticateUserWithPassword', () => {
+    describe('authenticateWithPassword', () => {
         it('sends an password authentication request', () => __awaiter(void 0, void 0, void 0, function* () {
             (0, test_utils_1.fetchOnce)({ user: user_json_1.default });
             const resp = yield workos.userManagement.authenticateWithPassword({
@@ -143,8 +211,45 @@ describe('UserManagement', () => {
                 },
             });
         }));
+        describe('when sealSession = true', () => {
+            beforeEach(() => {
+                (0, test_utils_1.fetchOnce)({ user: user_json_1.default });
+            });
+            describe('when the cookie password is undefined', () => {
+                it('throws an error', () => __awaiter(void 0, void 0, void 0, function* () {
+                    yield expect(workos.userManagement.authenticateWithPassword({
+                        clientId: 'proj_whatever',
+                        email: 'test01@example.com',
+                        password: 'extra-secure',
+                        session: { sealSession: true },
+                    })).rejects.toThrow('Cookie password is required');
+                }));
+            });
+            describe('when successfully authenticated', () => {
+                it('returns the sealed session data', () => __awaiter(void 0, void 0, void 0, function* () {
+                    const cookiePassword = 'alongcookiesecretmadefortestingsessions';
+                    const response = yield workos.userManagement.authenticateWithPassword({
+                        clientId: 'proj_whatever',
+                        email: 'test01@example.com',
+                        password: 'extra-secure',
+                        session: { sealSession: true, cookiePassword },
+                    });
+                    expect(response).toEqual({
+                        sealedSession: expect.any(String),
+                        accessToken: undefined,
+                        authenticationMethod: undefined,
+                        impersonator: undefined,
+                        organizationId: undefined,
+                        refreshToken: undefined,
+                        user: expect.objectContaining({
+                            email: 'test01@example.com',
+                        }),
+                    });
+                }));
+            });
+        });
     });
-    describe('authenticateUserWithCode', () => {
+    describe('authenticateWithCode', () => {
         it('sends a token authentication request', () => __awaiter(void 0, void 0, void 0, function* () {
             (0, test_utils_1.fetchOnce)({ user: user_json_1.default });
             const resp = yield workos.userManagement.authenticateWithCode({
@@ -225,6 +330,41 @@ describe('UserManagement', () => {
                 });
             }));
         });
+        describe('when sealSession = true', () => {
+            beforeEach(() => {
+                (0, test_utils_1.fetchOnce)({ user: user_json_1.default });
+            });
+            describe('when the cookie password is undefined', () => {
+                it('throws an error', () => __awaiter(void 0, void 0, void 0, function* () {
+                    yield expect(workos.userManagement.authenticateWithCode({
+                        clientId: 'proj_whatever',
+                        code: 'or this',
+                        session: { sealSession: true },
+                    })).rejects.toThrow('Cookie password is required');
+                }));
+            });
+            describe('when successfully authenticated', () => {
+                it('returns the sealed session data', () => __awaiter(void 0, void 0, void 0, function* () {
+                    const cookiePassword = 'alongcookiesecretmadefortestingsessions';
+                    const response = yield workos.userManagement.authenticateWithCode({
+                        clientId: 'proj_whatever',
+                        code: 'or this',
+                        session: { sealSession: true, cookiePassword },
+                    });
+                    expect(response).toEqual({
+                        sealedSession: expect.any(String),
+                        accessToken: undefined,
+                        authenticationMethod: undefined,
+                        impersonator: undefined,
+                        organizationId: undefined,
+                        refreshToken: undefined,
+                        user: expect.objectContaining({
+                            email: 'test01@example.com',
+                        }),
+                    });
+                }));
+            });
+        });
     });
     describe('authenticateWithRefreshToken', () => {
         it('sends a refresh_token authentication request', () => __awaiter(void 0, void 0, void 0, function* () {
@@ -249,8 +389,43 @@ describe('UserManagement', () => {
                 refreshToken: 'refreshToken2',
             });
         }));
+        describe('when sealSession = true', () => {
+            beforeEach(() => {
+                (0, test_utils_1.fetchOnce)({ user: user_json_1.default });
+            });
+            describe('when the cookie password is undefined', () => {
+                it('throws an error', () => __awaiter(void 0, void 0, void 0, function* () {
+                    yield expect(workos.userManagement.authenticateWithRefreshToken({
+                        clientId: 'proj_whatever',
+                        refreshToken: 'refresh_token1',
+                        session: { sealSession: true },
+                    })).rejects.toThrow('Cookie password is required');
+                }));
+            });
+            describe('when successfully authenticated', () => {
+                it('returns the sealed session data', () => __awaiter(void 0, void 0, void 0, function* () {
+                    const cookiePassword = 'alongcookiesecretmadefortestingsessions';
+                    const response = yield workos.userManagement.authenticateWithRefreshToken({
+                        clientId: 'proj_whatever',
+                        refreshToken: 'refresh_token1',
+                        session: { sealSession: true, cookiePassword },
+                    });
+                    expect(response).toEqual({
+                        sealedSession: expect.any(String),
+                        accessToken: undefined,
+                        authenticationMethod: undefined,
+                        impersonator: undefined,
+                        organizationId: undefined,
+                        refreshToken: undefined,
+                        user: expect.objectContaining({
+                            email: 'test01@example.com',
+                        }),
+                    });
+                }));
+            });
+        });
     });
-    describe('authenticateUserWithTotp', () => {
+    describe('authenticateWithTotp', () => {
         it('sends a token authentication request', () => __awaiter(void 0, void 0, void 0, function* () {
             (0, test_utils_1.fetchOnce)({ user: user_json_1.default });
             const resp = yield workos.userManagement.authenticateWithTotp({
@@ -274,8 +449,47 @@ describe('UserManagement', () => {
                 },
             });
         }));
+        describe('when sealSession = true', () => {
+            beforeEach(() => {
+                (0, test_utils_1.fetchOnce)({ user: user_json_1.default });
+            });
+            describe('when the cookie password is undefined', () => {
+                it('throws an error', () => __awaiter(void 0, void 0, void 0, function* () {
+                    yield expect(workos.userManagement.authenticateWithTotp({
+                        clientId: 'proj_whatever',
+                        code: 'or this',
+                        authenticationChallengeId: 'auth_challenge_01H96FETXGTW1QMBSBT2T36PW0',
+                        pendingAuthenticationToken: 'cTDQJTTkTkkVYxQUlKBIxEsFs',
+                        session: { sealSession: true },
+                    })).rejects.toThrow('Cookie password is required');
+                }));
+            });
+            describe('when successfully authenticated', () => {
+                it('returns the sealed session data', () => __awaiter(void 0, void 0, void 0, function* () {
+                    const cookiePassword = 'alongcookiesecretmadefortestingsessions';
+                    const response = yield workos.userManagement.authenticateWithTotp({
+                        clientId: 'proj_whatever',
+                        code: 'or this',
+                        authenticationChallengeId: 'auth_challenge_01H96FETXGTW1QMBSBT2T36PW0',
+                        pendingAuthenticationToken: 'cTDQJTTkTkkVYxQUlKBIxEsFs',
+                        session: { sealSession: true, cookiePassword },
+                    });
+                    expect(response).toEqual({
+                        sealedSession: expect.any(String),
+                        accessToken: undefined,
+                        authenticationMethod: undefined,
+                        impersonator: undefined,
+                        organizationId: undefined,
+                        refreshToken: undefined,
+                        user: expect.objectContaining({
+                            email: 'test01@example.com',
+                        }),
+                    });
+                }));
+            });
+        });
     });
-    describe('authenticateUserWithEmailVerification', () => {
+    describe('authenticateWithEmailVerification', () => {
         it('sends an email verification authentication request', () => __awaiter(void 0, void 0, void 0, function* () {
             (0, test_utils_1.fetchOnce)({ user: user_json_1.default });
             const resp = yield workos.userManagement.authenticateWithEmailVerification({
@@ -297,6 +511,43 @@ describe('UserManagement', () => {
                 },
             });
         }));
+        describe('when sealSession = true', () => {
+            beforeEach(() => {
+                (0, test_utils_1.fetchOnce)({ user: user_json_1.default });
+            });
+            describe('when the cookie password is undefined', () => {
+                it('throws an error', () => __awaiter(void 0, void 0, void 0, function* () {
+                    yield expect(workos.userManagement.authenticateWithEmailVerification({
+                        clientId: 'proj_whatever',
+                        code: 'or this',
+                        pendingAuthenticationToken: 'cTDQJTTkTkkVYxQUlKBIxEsFs',
+                        session: { sealSession: true },
+                    })).rejects.toThrow('Cookie password is required');
+                }));
+            });
+            describe('when successfully authenticated', () => {
+                it('returns the sealed session data', () => __awaiter(void 0, void 0, void 0, function* () {
+                    const cookiePassword = 'alongcookiesecretmadefortestingsessions';
+                    const response = yield workos.userManagement.authenticateWithEmailVerification({
+                        clientId: 'proj_whatever',
+                        code: 'or this',
+                        pendingAuthenticationToken: 'cTDQJTTkTkkVYxQUlKBIxEsFs',
+                        session: { sealSession: true, cookiePassword },
+                    });
+                    expect(response).toEqual({
+                        sealedSession: expect.any(String),
+                        accessToken: undefined,
+                        authenticationMethod: undefined,
+                        impersonator: undefined,
+                        organizationId: undefined,
+                        refreshToken: undefined,
+                        user: expect.objectContaining({
+                            email: 'test01@example.com',
+                        }),
+                    });
+                }));
+            });
+        });
     });
     describe('authenticateWithOrganizationSelection', () => {
         it('sends an Organization Selection Authentication request', () => __awaiter(void 0, void 0, void 0, function* () {
@@ -320,6 +571,253 @@ describe('UserManagement', () => {
                 },
             });
         }));
+        describe('when sealSession = true', () => {
+            beforeEach(() => {
+                (0, test_utils_1.fetchOnce)({ user: user_json_1.default });
+            });
+            describe('when the cookie password is undefined', () => {
+                it('throws an error', () => __awaiter(void 0, void 0, void 0, function* () {
+                    yield expect(workos.userManagement.authenticateWithOrganizationSelection({
+                        clientId: 'proj_whatever',
+                        pendingAuthenticationToken: 'cTDQJTTkTkkVYxQUlKBIxEsFs',
+                        organizationId: 'org_01H5JQDV7R7ATEYZDEG0W5PRYS',
+                        session: { sealSession: true },
+                    })).rejects.toThrow('Cookie password is required');
+                }));
+            });
+            describe('when successfully authenticated', () => {
+                it('returns the sealed session data', () => __awaiter(void 0, void 0, void 0, function* () {
+                    const cookiePassword = 'alongcookiesecretmadefortestingsessions';
+                    const response = yield workos.userManagement.authenticateWithOrganizationSelection({
+                        clientId: 'proj_whatever',
+                        pendingAuthenticationToken: 'cTDQJTTkTkkVYxQUlKBIxEsFs',
+                        organizationId: 'org_01H5JQDV7R7ATEYZDEG0W5PRYS',
+                        session: { sealSession: true, cookiePassword },
+                    });
+                    expect(response).toEqual({
+                        sealedSession: expect.any(String),
+                        accessToken: undefined,
+                        authenticationMethod: undefined,
+                        impersonator: undefined,
+                        organizationId: undefined,
+                        refreshToken: undefined,
+                        user: expect.objectContaining({
+                            email: 'test01@example.com',
+                        }),
+                    });
+                }));
+            });
+        });
+    });
+    describe('authenticateWithSessionCookie', () => {
+        beforeEach(() => {
+            // Mock createRemoteJWKSet
+            jest
+                .spyOn(jose, 'createRemoteJWKSet')
+                .mockImplementation((_url, _options) => {
+                // This function simulates the token verification process
+                const verifyFunction = (_protectedHeader, _token) => {
+                    return Promise.resolve({
+                        type: 'public',
+                    });
+                };
+                // Return an object that includes the verify function and the additional expected properties
+                return {
+                    __call__: verifyFunction,
+                    coolingDown: false,
+                    fresh: false,
+                    reloading: false,
+                    reload: jest.fn().mockResolvedValue(undefined),
+                    jwks: () => undefined,
+                };
+            });
+        });
+        it('throws an error when the cookie password is undefined', () => __awaiter(void 0, void 0, void 0, function* () {
+            yield expect(workos.userManagement.authenticateWithSessionCookie({
+                sessionData: 'session_cookie',
+            })).rejects.toThrow('Cookie password is required');
+        }));
+        it('returns authenticated = false when the session cookie is empty', () => __awaiter(void 0, void 0, void 0, function* () {
+            yield expect(workos.userManagement.authenticateWithSessionCookie({
+                sessionData: '',
+                cookiePassword: 'secret',
+            })).resolves.toEqual({
+                authenticated: false,
+                reason: 'no_session_cookie_provided',
+            });
+        }));
+        it('returns authenticated = false when session cookie is invalid', () => __awaiter(void 0, void 0, void 0, function* () {
+            yield expect(workos.userManagement.authenticateWithSessionCookie({
+                sessionData: 'thisisacookie',
+                cookiePassword: 'secret',
+            })).resolves.toEqual({
+                authenticated: false,
+                reason: 'invalid_session_cookie',
+            });
+        }));
+        it('returns authenticated = false when session cookie cannot be unsealed', () => __awaiter(void 0, void 0, void 0, function* () {
+            const cookiePassword = 'alongcookiesecretmadefortestingsessions';
+            const sessionData = yield (0, iron_session_1.sealData)({
+                accessToken: 'abc123',
+                refreshToken: 'def456',
+                user: {
+                    object: 'user',
+                    id: 'user_01H5JQDV7R7ATEYZDEG0W5PRYS',
+                    email: 'test@example.com',
+                },
+            }, { password: cookiePassword });
+            yield expect(workos.userManagement.authenticateWithSessionCookie({
+                sessionData,
+                cookiePassword: 'secretpasswordwhichisalsolongbutnottherightone',
+            })).resolves.toEqual({
+                authenticated: false,
+                reason: 'invalid_session_cookie',
+            });
+        }));
+        it('returns authenticated = false when the JWT is invalid', () => __awaiter(void 0, void 0, void 0, function* () {
+            jest.spyOn(jose, 'jwtVerify').mockImplementationOnce(() => {
+                throw new Error('Invalid JWT');
+            });
+            const cookiePassword = 'alongcookiesecretmadefortestingsessions';
+            const sessionData = yield (0, iron_session_1.sealData)({
+                accessToken: 'abc123',
+                refreshToken: 'def456',
+                user: {
+                    object: 'user',
+                    id: 'user_01H5JQDV7R7ATEYZDEG0W5PRYS',
+                    email: 'test@example.com',
+                },
+            }, { password: cookiePassword });
+            yield expect(workos.userManagement.authenticateWithSessionCookie({
+                sessionData,
+                cookiePassword,
+            })).resolves.toEqual({ authenticated: false, reason: 'invalid_jwt' });
+        }));
+        it('returns the JWT claims when provided a valid JWT', () => __awaiter(void 0, void 0, void 0, function* () {
+            jest
+                .spyOn(jose, 'jwtVerify')
+                .mockResolvedValue({});
+            const cookiePassword = 'alongcookiesecretmadefortestingsessions';
+            const sessionData = yield (0, iron_session_1.sealData)({
+                accessToken: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.ewogICJzdWIiOiAiMTIzNDU2Nzg5MCIsCiAgIm5hbWUiOiAiSm9obiBEb2UiLAogICJpYXQiOiAxNTE2MjM5MDIyLAogICJzaWQiOiAic2Vzc2lvbl8xMjMiLAogICJvcmdfaWQiOiAib3JnXzEyMyIsCiAgInJvbGUiOiAibWVtYmVyIiwKICAicGVybWlzc2lvbnMiOiBbInBvc3RzOmNyZWF0ZSIsICJwb3N0czpkZWxldGUiXQp9.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c',
+                refreshToken: 'def456',
+                user: {
+                    object: 'user',
+                    id: 'user_01H5JQDV7R7ATEYZDEG0W5PRYS',
+                    email: 'test@example.com',
+                },
+            }, { password: cookiePassword });
+            yield expect(workos.userManagement.authenticateWithSessionCookie({
+                sessionData,
+                cookiePassword,
+            })).resolves.toEqual({
+                authenticated: true,
+                sessionId: 'session_123',
+                organizationId: 'org_123',
+                role: 'member',
+                permissions: ['posts:create', 'posts:delete'],
+            });
+        }));
+    });
+    describe('refreshAndSealSessionData', () => {
+        it('throws an error when the cookie password is undefined', () => __awaiter(void 0, void 0, void 0, function* () {
+            yield expect(workos.userManagement.refreshAndSealSessionData({
+                sessionData: 'session_cookie',
+            })).rejects.toThrow('Cookie password is required');
+        }));
+        it('returns authenticated = false when the session cookie is empty', () => __awaiter(void 0, void 0, void 0, function* () {
+            yield expect(workos.userManagement.refreshAndSealSessionData({
+                sessionData: '',
+                cookiePassword: 'secret',
+            })).resolves.toEqual({
+                authenticated: false,
+                reason: 'no_session_cookie_provided',
+            });
+        }));
+        it('returns authenticated = false when session cookie is invalid', () => __awaiter(void 0, void 0, void 0, function* () {
+            yield expect(workos.userManagement.refreshAndSealSessionData({
+                sessionData: 'thisisacookie',
+                cookiePassword: 'secret',
+            })).resolves.toEqual({
+                authenticated: false,
+                reason: 'invalid_session_cookie',
+            });
+        }));
+        it('returns authenticated = false when session cookie cannot be unsealed', () => __awaiter(void 0, void 0, void 0, function* () {
+            const cookiePassword = 'alongcookiesecretmadefortestingsessions';
+            const sessionData = yield (0, iron_session_1.sealData)({
+                accessToken: 'abc123',
+                refreshToken: 'def456',
+                user: {
+                    object: 'user',
+                    id: 'user_01H5JQDV7R7ATEYZDEG0W5PRYS',
+                    email: 'test@example.com',
+                },
+            }, { password: cookiePassword });
+            yield expect(workos.userManagement.refreshAndSealSessionData({
+                sessionData,
+                cookiePassword: 'secretpasswordwhichisalsolongbutnottherightone',
+            })).resolves.toEqual({
+                authenticated: false,
+                reason: 'invalid_session_cookie',
+            });
+        }));
+        it('returns the sealed refreshed session cookie when provided a valid existing session cookie', () => __awaiter(void 0, void 0, void 0, function* () {
+            (0, test_utils_1.fetchOnce)({
+                user: user_json_1.default,
+                access_token: 'access_token',
+                refresh_token: 'refresh_token',
+            });
+            const cookiePassword = 'alongcookiesecretmadefortestingsessions';
+            const sessionData = yield (0, iron_session_1.sealData)({
+                accessToken: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.ewogICJzdWIiOiAiMTIzNDU2Nzg5MCIsCiAgIm5hbWUiOiAiSm9obiBEb2UiLAogICJpYXQiOiAxNTE2MjM5MDIyLAogICJzaWQiOiAic2Vzc2lvbl8xMjMiLAogICJvcmdfaWQiOiAib3JnXzEyMyIsCiAgInJvbGUiOiAibWVtYmVyIiwKICAicGVybWlzc2lvbnMiOiBbInBvc3RzOmNyZWF0ZSIsICJwb3N0czpkZWxldGUiXQp9.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c',
+                refreshToken: 'def456',
+                user: {
+                    object: 'user',
+                    id: 'user_01H5JQDV7R7ATEYZDEG0W5PRYS',
+                    email: 'test@example.com',
+                },
+            }, { password: cookiePassword });
+            yield expect(workos.userManagement.refreshAndSealSessionData({
+                sessionData,
+                cookiePassword,
+            })).resolves.toEqual({
+                sealedSession: expect.any(String),
+                authenticated: true,
+            });
+        }));
+    });
+    describe('getSessionFromCookie', () => {
+        it('throws an error when the cookie password is undefined', () => __awaiter(void 0, void 0, void 0, function* () {
+            yield expect(workos.userManagement.getSessionFromCookie({
+                sessionData: 'session_cookie',
+            })).rejects.toThrow('Cookie password is required');
+        }));
+        it('returns undefined when the session cookie cannot be unsealed', () => __awaiter(void 0, void 0, void 0, function* () {
+            yield expect(workos.userManagement.getSessionFromCookie({
+                sessionData: '',
+                cookiePassword: 'secret',
+            })).resolves.toBeUndefined();
+        }));
+        it('returns the unsealed session cookie data when provided a valid session cookie', () => __awaiter(void 0, void 0, void 0, function* () {
+            const cookiePassword = 'alongcookiesecretmadefortestingsessions';
+            const sessionCookieData = {
+                accessToken: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.ewogICJzdWIiOiAiMTIzNDU2Nzg5MCIsCiAgIm5hbWUiOiAiSm9obiBEb2UiLAogICJpYXQiOiAxNTE2MjM5MDIyLAogICJzaWQiOiAic2Vzc2lvbl8xMjMiLAogICJvcmdfaWQiOiAib3JnXzEyMyIsCiAgInJvbGUiOiAibWVtYmVyIiwKICAicGVybWlzc2lvbnMiOiBbInBvc3RzOmNyZWF0ZSIsICJwb3N0czpkZWxldGUiXQp9.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c',
+                refreshToken: 'def456',
+                user: {
+                    object: 'user',
+                    id: 'user_01H5JQDV7R7ATEYZDEG0W5PRYS',
+                    email: 'test@example.com',
+                },
+            };
+            const sessionData = yield (0, iron_session_1.sealData)(sessionCookieData, {
+                password: cookiePassword,
+            });
+            yield expect(workos.userManagement.getSessionFromCookie({
+                sessionData,
+                cookiePassword,
+            })).resolves.toEqual(sessionCookieData);
+        }));
     });
     describe('getEmailVerification', () => {
         it('sends a Get EmailVerification request', () => __awaiter(void 0, void 0, void 0, function* () {

package/lib/workos.d.ts

@@ -16,6 +16,7 @@ export declare class WorkOS {
     readonly options: WorkOSOptions;
     readonly baseURL: string;
     readonly client: HttpClient;
+    readonly clientId?: string;
     readonly auditLogs: AuditLogs;
     readonly directorySync: DirectorySync;
     readonly organizations: Organizations;

package/lib/workos.js

@@ -26,10 +26,11 @@ const bad_request_exception_1 = require("./common/exceptions/bad-request.excepti
 const http_client_1 = require("./common/net/http-client");
 const subtle_crypto_provider_1 = require("./common/crypto/subtle-crypto-provider");
 const fetch_client_1 = require("./common/net/fetch-client");
-const VERSION = '7.14.0';
+const VERSION = '7.15.0';
 const DEFAULT_HOSTNAME = 'api.workos.com';
 class WorkOS {
     constructor(key, options = {}) {
+        var _a;
         this.key = key;
         this.options = options;
         this.auditLogs = new audit_logs_1.AuditLogs(this);
@@ -41,7 +42,6 @@ class WorkOS {
         this.sso = new sso_1.SSO(this);
         this.mfa = new mfa_1.Mfa(this);
         this.events = new events_1.Events(this);
-        this.userManagement = new user_management_1.UserManagement(this);
         if (!key) {
             // process might be undefined in some environments
             this.key = process === null || process === void 0 ? void 0 : process.env.WORKOS_API_KEY;
@@ -52,6 +52,7 @@ class WorkOS {
         if (this.options.https === undefined) {
             this.options.https = true;
         }
+        this.clientId = (_a = this.options.clientId) !== null && _a !== void 0 ? _a : process === null || process === void 0 ? void 0 : process.env.WORKOS_CLIENT_ID;
         const protocol = this.options.https ? 'https' : 'http';
         const apiHostname = this.options.apiHostname || DEFAULT_HOSTNAME;
         const port = this.options.port;
@@ -65,6 +66,8 @@ class WorkOS {
             userAgent += ` ${name}: ${version}`;
         }
         this.webhooks = this.createWebhookClient();
+        // Must initialize UserManagement after baseURL is configured
+        this.userManagement = new user_management_1.UserManagement(this);
         this.client = this.createHttpClient(options, userAgent);
     }
     createWebhookClient() {

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "7.14.0",
+  "version": "7.15.0",
   "name": "@workos-inc/node",
   "author": "WorkOS",
   "description": "A Node wrapper for the WorkOS API",
@@ -37,6 +37,8 @@
     "prepublishOnly": "yarn run build"
   },
   "dependencies": {
+    "iron-session": "~6.3.1",
+    "jose": "~5.6.3",
     "pluralize": "8.0.0"
   },
   "devDependencies": {
@@ -63,4 +65,4 @@
       "default": "./lib/index.js"
     }
   }
-}
+}