@workos-inc/node 7.14.0 → 7.16.0

package/lib/user-management/user-management.spec.js

@@ -1,4 +1,27 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
     return new (P || (P = Promise))(function (resolve, reject) {
@@ -27,7 +50,8 @@ const organization_membership_json_1 = __importDefault(require("./fixtures/organ
 const password_reset_json_1 = __importDefault(require("./fixtures/password_reset.json"));
 const user_json_1 = __importDefault(require("./fixtures/user.json"));
 const identity_json_1 = __importDefault(require("./fixtures/identity.json"));
-const workos = new workos_1.WorkOS('sk_test_Sz3IQjepeSWaI4cMS4ms4sMuU');
+const jose = __importStar(require("jose"));
+const iron_session_1 = require("iron-session");
 const userId = 'user_01H5JQDV7R7ATEYZDEG0W5PRYS';
 const organizationMembershipId = 'om_01H5JQDV7R7ATEYZDEG0W5PRYS';
 const emailVerificationId = 'email_verification_01H5JQDV7R7ATEYZDEG0W5PRYS';
@@ -36,6 +60,13 @@ const invitationToken = 'Z1uX3RbwcIl5fIGJJJCXXisdI';
 const magicAuthId = 'magic_auth_01H5JQDV7R7ATEYZDEG0W5PRYS';
 const passwordResetId = 'password_reset_01H5JQDV7R7ATEYZDEG0W5PRYS';
 describe('UserManagement', () => {
+    let workos;
+    beforeAll(() => {
+        workos = new workos_1.WorkOS('sk_test_Sz3IQjepeSWaI4cMS4ms4sMuU', {
+            apiHostname: 'api.workos.test',
+            clientId: 'proj_123',
+        });
+    });
     beforeEach(() => jest_fetch_mock_1.default.resetMocks());
     describe('getUser', () => {
         it('sends a Get User request', () => __awaiter(void 0, void 0, void 0, function* () {
@@ -127,8 +158,45 @@ describe('UserManagement', () => {
                 },
             });
         }));
+        describe('when sealSession = true', () => {
+            beforeEach(() => {
+                (0, test_utils_1.fetchOnce)({ user: user_json_1.default });
+            });
+            describe('when the cookie password is undefined', () => {
+                it('throws an error', () => __awaiter(void 0, void 0, void 0, function* () {
+                    yield expect(workos.userManagement.authenticateWithMagicAuth({
+                        clientId: 'proj_whatever',
+                        code: '123456',
+                        email: user_json_1.default.email,
+                        session: { sealSession: true },
+                    })).rejects.toThrow('Cookie password is required');
+                }));
+            });
+            describe('when successfully authenticated', () => {
+                it('returns the sealed session data', () => __awaiter(void 0, void 0, void 0, function* () {
+                    const cookiePassword = 'alongcookiesecretmadefortestingsessions';
+                    const response = yield workos.userManagement.authenticateWithMagicAuth({
+                        clientId: 'proj_whatever',
+                        code: '123456',
+                        email: user_json_1.default.email,
+                        session: { sealSession: true, cookiePassword },
+                    });
+                    expect(response).toEqual({
+                        sealedSession: expect.any(String),
+                        accessToken: undefined,
+                        authenticationMethod: undefined,
+                        impersonator: undefined,
+                        organizationId: undefined,
+                        refreshToken: undefined,
+                        user: expect.objectContaining({
+                            email: 'test01@example.com',
+                        }),
+                    });
+                }));
+            });
+        });
     });
-    describe('authenticateUserWithPassword', () => {
+    describe('authenticateWithPassword', () => {
         it('sends an password authentication request', () => __awaiter(void 0, void 0, void 0, function* () {
             (0, test_utils_1.fetchOnce)({ user: user_json_1.default });
             const resp = yield workos.userManagement.authenticateWithPassword({
@@ -143,8 +211,45 @@ describe('UserManagement', () => {
                 },
             });
         }));
+        describe('when sealSession = true', () => {
+            beforeEach(() => {
+                (0, test_utils_1.fetchOnce)({ user: user_json_1.default });
+            });
+            describe('when the cookie password is undefined', () => {
+                it('throws an error', () => __awaiter(void 0, void 0, void 0, function* () {
+                    yield expect(workos.userManagement.authenticateWithPassword({
+                        clientId: 'proj_whatever',
+                        email: 'test01@example.com',
+                        password: 'extra-secure',
+                        session: { sealSession: true },
+                    })).rejects.toThrow('Cookie password is required');
+                }));
+            });
+            describe('when successfully authenticated', () => {
+                it('returns the sealed session data', () => __awaiter(void 0, void 0, void 0, function* () {
+                    const cookiePassword = 'alongcookiesecretmadefortestingsessions';
+                    const response = yield workos.userManagement.authenticateWithPassword({
+                        clientId: 'proj_whatever',
+                        email: 'test01@example.com',
+                        password: 'extra-secure',
+                        session: { sealSession: true, cookiePassword },
+                    });
+                    expect(response).toEqual({
+                        sealedSession: expect.any(String),
+                        accessToken: undefined,
+                        authenticationMethod: undefined,
+                        impersonator: undefined,
+                        organizationId: undefined,
+                        refreshToken: undefined,
+                        user: expect.objectContaining({
+                            email: 'test01@example.com',
+                        }),
+                    });
+                }));
+            });
+        });
     });
-    describe('authenticateUserWithCode', () => {
+    describe('authenticateWithCode', () => {
         it('sends a token authentication request', () => __awaiter(void 0, void 0, void 0, function* () {
             (0, test_utils_1.fetchOnce)({ user: user_json_1.default });
             const resp = yield workos.userManagement.authenticateWithCode({
@@ -225,6 +330,41 @@ describe('UserManagement', () => {
                 });
             }));
         });
+        describe('when sealSession = true', () => {
+            beforeEach(() => {
+                (0, test_utils_1.fetchOnce)({ user: user_json_1.default });
+            });
+            describe('when the cookie password is undefined', () => {
+                it('throws an error', () => __awaiter(void 0, void 0, void 0, function* () {
+                    yield expect(workos.userManagement.authenticateWithCode({
+                        clientId: 'proj_whatever',
+                        code: 'or this',
+                        session: { sealSession: true },
+                    })).rejects.toThrow('Cookie password is required');
+                }));
+            });
+            describe('when successfully authenticated', () => {
+                it('returns the sealed session data', () => __awaiter(void 0, void 0, void 0, function* () {
+                    const cookiePassword = 'alongcookiesecretmadefortestingsessions';
+                    const response = yield workos.userManagement.authenticateWithCode({
+                        clientId: 'proj_whatever',
+                        code: 'or this',
+                        session: { sealSession: true, cookiePassword },
+                    });
+                    expect(response).toEqual({
+                        sealedSession: expect.any(String),
+                        accessToken: undefined,
+                        authenticationMethod: undefined,
+                        impersonator: undefined,
+                        organizationId: undefined,
+                        refreshToken: undefined,
+                        user: expect.objectContaining({
+                            email: 'test01@example.com',
+                        }),
+                    });
+                }));
+            });
+        });
     });
     describe('authenticateWithRefreshToken', () => {
         it('sends a refresh_token authentication request', () => __awaiter(void 0, void 0, void 0, function* () {
@@ -249,8 +389,43 @@ describe('UserManagement', () => {
                 refreshToken: 'refreshToken2',
             });
         }));
+        describe('when sealSession = true', () => {
+            beforeEach(() => {
+                (0, test_utils_1.fetchOnce)({ user: user_json_1.default });
+            });
+            describe('when the cookie password is undefined', () => {
+                it('throws an error', () => __awaiter(void 0, void 0, void 0, function* () {
+                    yield expect(workos.userManagement.authenticateWithRefreshToken({
+                        clientId: 'proj_whatever',
+                        refreshToken: 'refresh_token1',
+                        session: { sealSession: true },
+                    })).rejects.toThrow('Cookie password is required');
+                }));
+            });
+            describe('when successfully authenticated', () => {
+                it('returns the sealed session data', () => __awaiter(void 0, void 0, void 0, function* () {
+                    const cookiePassword = 'alongcookiesecretmadefortestingsessions';
+                    const response = yield workos.userManagement.authenticateWithRefreshToken({
+                        clientId: 'proj_whatever',
+                        refreshToken: 'refresh_token1',
+                        session: { sealSession: true, cookiePassword },
+                    });
+                    expect(response).toEqual({
+                        sealedSession: expect.any(String),
+                        accessToken: undefined,
+                        authenticationMethod: undefined,
+                        impersonator: undefined,
+                        organizationId: undefined,
+                        refreshToken: undefined,
+                        user: expect.objectContaining({
+                            email: 'test01@example.com',
+                        }),
+                    });
+                }));
+            });
+        });
     });
-    describe('authenticateUserWithTotp', () => {
+    describe('authenticateWithTotp', () => {
         it('sends a token authentication request', () => __awaiter(void 0, void 0, void 0, function* () {
             (0, test_utils_1.fetchOnce)({ user: user_json_1.default });
             const resp = yield workos.userManagement.authenticateWithTotp({
@@ -274,8 +449,47 @@ describe('UserManagement', () => {
                 },
             });
         }));
+        describe('when sealSession = true', () => {
+            beforeEach(() => {
+                (0, test_utils_1.fetchOnce)({ user: user_json_1.default });
+            });
+            describe('when the cookie password is undefined', () => {
+                it('throws an error', () => __awaiter(void 0, void 0, void 0, function* () {
+                    yield expect(workos.userManagement.authenticateWithTotp({
+                        clientId: 'proj_whatever',
+                        code: 'or this',
+                        authenticationChallengeId: 'auth_challenge_01H96FETXGTW1QMBSBT2T36PW0',
+                        pendingAuthenticationToken: 'cTDQJTTkTkkVYxQUlKBIxEsFs',
+                        session: { sealSession: true },
+                    })).rejects.toThrow('Cookie password is required');
+                }));
+            });
+            describe('when successfully authenticated', () => {
+                it('returns the sealed session data', () => __awaiter(void 0, void 0, void 0, function* () {
+                    const cookiePassword = 'alongcookiesecretmadefortestingsessions';
+                    const response = yield workos.userManagement.authenticateWithTotp({
+                        clientId: 'proj_whatever',
+                        code: 'or this',
+                        authenticationChallengeId: 'auth_challenge_01H96FETXGTW1QMBSBT2T36PW0',
+                        pendingAuthenticationToken: 'cTDQJTTkTkkVYxQUlKBIxEsFs',
+                        session: { sealSession: true, cookiePassword },
+                    });
+                    expect(response).toEqual({
+                        sealedSession: expect.any(String),
+                        accessToken: undefined,
+                        authenticationMethod: undefined,
+                        impersonator: undefined,
+                        organizationId: undefined,
+                        refreshToken: undefined,
+                        user: expect.objectContaining({
+                            email: 'test01@example.com',
+                        }),
+                    });
+                }));
+            });
+        });
     });
-    describe('authenticateUserWithEmailVerification', () => {
+    describe('authenticateWithEmailVerification', () => {
         it('sends an email verification authentication request', () => __awaiter(void 0, void 0, void 0, function* () {
             (0, test_utils_1.fetchOnce)({ user: user_json_1.default });
             const resp = yield workos.userManagement.authenticateWithEmailVerification({
@@ -297,6 +511,43 @@ describe('UserManagement', () => {
                 },
             });
         }));
+        describe('when sealSession = true', () => {
+            beforeEach(() => {
+                (0, test_utils_1.fetchOnce)({ user: user_json_1.default });
+            });
+            describe('when the cookie password is undefined', () => {
+                it('throws an error', () => __awaiter(void 0, void 0, void 0, function* () {
+                    yield expect(workos.userManagement.authenticateWithEmailVerification({
+                        clientId: 'proj_whatever',
+                        code: 'or this',
+                        pendingAuthenticationToken: 'cTDQJTTkTkkVYxQUlKBIxEsFs',
+                        session: { sealSession: true },
+                    })).rejects.toThrow('Cookie password is required');
+                }));
+            });
+            describe('when successfully authenticated', () => {
+                it('returns the sealed session data', () => __awaiter(void 0, void 0, void 0, function* () {
+                    const cookiePassword = 'alongcookiesecretmadefortestingsessions';
+                    const response = yield workos.userManagement.authenticateWithEmailVerification({
+                        clientId: 'proj_whatever',
+                        code: 'or this',
+                        pendingAuthenticationToken: 'cTDQJTTkTkkVYxQUlKBIxEsFs',
+                        session: { sealSession: true, cookiePassword },
+                    });
+                    expect(response).toEqual({
+                        sealedSession: expect.any(String),
+                        accessToken: undefined,
+                        authenticationMethod: undefined,
+                        impersonator: undefined,
+                        organizationId: undefined,
+                        refreshToken: undefined,
+                        user: expect.objectContaining({
+                            email: 'test01@example.com',
+                        }),
+                    });
+                }));
+            });
+        });
     });
     describe('authenticateWithOrganizationSelection', () => {
         it('sends an Organization Selection Authentication request', () => __awaiter(void 0, void 0, void 0, function* () {
@@ -320,6 +571,253 @@ describe('UserManagement', () => {
                 },
             });
         }));
+        describe('when sealSession = true', () => {
+            beforeEach(() => {
+                (0, test_utils_1.fetchOnce)({ user: user_json_1.default });
+            });
+            describe('when the cookie password is undefined', () => {
+                it('throws an error', () => __awaiter(void 0, void 0, void 0, function* () {
+                    yield expect(workos.userManagement.authenticateWithOrganizationSelection({
+                        clientId: 'proj_whatever',
+                        pendingAuthenticationToken: 'cTDQJTTkTkkVYxQUlKBIxEsFs',
+                        organizationId: 'org_01H5JQDV7R7ATEYZDEG0W5PRYS',
+                        session: { sealSession: true },
+                    })).rejects.toThrow('Cookie password is required');
+                }));
+            });
+            describe('when successfully authenticated', () => {
+                it('returns the sealed session data', () => __awaiter(void 0, void 0, void 0, function* () {
+                    const cookiePassword = 'alongcookiesecretmadefortestingsessions';
+                    const response = yield workos.userManagement.authenticateWithOrganizationSelection({
+                        clientId: 'proj_whatever',
+                        pendingAuthenticationToken: 'cTDQJTTkTkkVYxQUlKBIxEsFs',
+                        organizationId: 'org_01H5JQDV7R7ATEYZDEG0W5PRYS',
+                        session: { sealSession: true, cookiePassword },
+                    });
+                    expect(response).toEqual({
+                        sealedSession: expect.any(String),
+                        accessToken: undefined,
+                        authenticationMethod: undefined,
+                        impersonator: undefined,
+                        organizationId: undefined,
+                        refreshToken: undefined,
+                        user: expect.objectContaining({
+                            email: 'test01@example.com',
+                        }),
+                    });
+                }));
+            });
+        });
+    });
+    describe('authenticateWithSessionCookie', () => {
+        beforeEach(() => {
+            // Mock createRemoteJWKSet
+            jest
+                .spyOn(jose, 'createRemoteJWKSet')
+                .mockImplementation((_url, _options) => {
+                // This function simulates the token verification process
+                const verifyFunction = (_protectedHeader, _token) => {
+                    return Promise.resolve({
+                        type: 'public',
+                    });
+                };
+                // Return an object that includes the verify function and the additional expected properties
+                return {
+                    __call__: verifyFunction,
+                    coolingDown: false,
+                    fresh: false,
+                    reloading: false,
+                    reload: jest.fn().mockResolvedValue(undefined),
+                    jwks: () => undefined,
+                };
+            });
+        });
+        it('throws an error when the cookie password is undefined', () => __awaiter(void 0, void 0, void 0, function* () {
+            yield expect(workos.userManagement.authenticateWithSessionCookie({
+                sessionData: 'session_cookie',
+            })).rejects.toThrow('Cookie password is required');
+        }));
+        it('returns authenticated = false when the session cookie is empty', () => __awaiter(void 0, void 0, void 0, function* () {
+            yield expect(workos.userManagement.authenticateWithSessionCookie({
+                sessionData: '',
+                cookiePassword: 'secret',
+            })).resolves.toEqual({
+                authenticated: false,
+                reason: 'no_session_cookie_provided',
+            });
+        }));
+        it('returns authenticated = false when session cookie is invalid', () => __awaiter(void 0, void 0, void 0, function* () {
+            yield expect(workos.userManagement.authenticateWithSessionCookie({
+                sessionData: 'thisisacookie',
+                cookiePassword: 'secret',
+            })).resolves.toEqual({
+                authenticated: false,
+                reason: 'invalid_session_cookie',
+            });
+        }));
+        it('returns authenticated = false when session cookie cannot be unsealed', () => __awaiter(void 0, void 0, void 0, function* () {
+            const cookiePassword = 'alongcookiesecretmadefortestingsessions';
+            const sessionData = yield (0, iron_session_1.sealData)({
+                accessToken: 'abc123',
+                refreshToken: 'def456',
+                user: {
+                    object: 'user',
+                    id: 'user_01H5JQDV7R7ATEYZDEG0W5PRYS',
+                    email: 'test@example.com',
+                },
+            }, { password: cookiePassword });
+            yield expect(workos.userManagement.authenticateWithSessionCookie({
+                sessionData,
+                cookiePassword: 'secretpasswordwhichisalsolongbutnottherightone',
+            })).resolves.toEqual({
+                authenticated: false,
+                reason: 'invalid_session_cookie',
+            });
+        }));
+        it('returns authenticated = false when the JWT is invalid', () => __awaiter(void 0, void 0, void 0, function* () {
+            jest.spyOn(jose, 'jwtVerify').mockImplementationOnce(() => {
+                throw new Error('Invalid JWT');
+            });
+            const cookiePassword = 'alongcookiesecretmadefortestingsessions';
+            const sessionData = yield (0, iron_session_1.sealData)({
+                accessToken: 'abc123',
+                refreshToken: 'def456',
+                user: {
+                    object: 'user',
+                    id: 'user_01H5JQDV7R7ATEYZDEG0W5PRYS',
+                    email: 'test@example.com',
+                },
+            }, { password: cookiePassword });
+            yield expect(workos.userManagement.authenticateWithSessionCookie({
+                sessionData,
+                cookiePassword,
+            })).resolves.toEqual({ authenticated: false, reason: 'invalid_jwt' });
+        }));
+        it('returns the JWT claims when provided a valid JWT', () => __awaiter(void 0, void 0, void 0, function* () {
+            jest
+                .spyOn(jose, 'jwtVerify')
+                .mockResolvedValue({});
+            const cookiePassword = 'alongcookiesecretmadefortestingsessions';
+            const sessionData = yield (0, iron_session_1.sealData)({
+                accessToken: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.ewogICJzdWIiOiAiMTIzNDU2Nzg5MCIsCiAgIm5hbWUiOiAiSm9obiBEb2UiLAogICJpYXQiOiAxNTE2MjM5MDIyLAogICJzaWQiOiAic2Vzc2lvbl8xMjMiLAogICJvcmdfaWQiOiAib3JnXzEyMyIsCiAgInJvbGUiOiAibWVtYmVyIiwKICAicGVybWlzc2lvbnMiOiBbInBvc3RzOmNyZWF0ZSIsICJwb3N0czpkZWxldGUiXQp9.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c',
+                refreshToken: 'def456',
+                user: {
+                    object: 'user',
+                    id: 'user_01H5JQDV7R7ATEYZDEG0W5PRYS',
+                    email: 'test@example.com',
+                },
+            }, { password: cookiePassword });
+            yield expect(workos.userManagement.authenticateWithSessionCookie({
+                sessionData,
+                cookiePassword,
+            })).resolves.toEqual({
+                authenticated: true,
+                sessionId: 'session_123',
+                organizationId: 'org_123',
+                role: 'member',
+                permissions: ['posts:create', 'posts:delete'],
+            });
+        }));
+    });
+    describe('refreshAndSealSessionData', () => {
+        it('throws an error when the cookie password is undefined', () => __awaiter(void 0, void 0, void 0, function* () {
+            yield expect(workos.userManagement.refreshAndSealSessionData({
+                sessionData: 'session_cookie',
+            })).rejects.toThrow('Cookie password is required');
+        }));
+        it('returns authenticated = false when the session cookie is empty', () => __awaiter(void 0, void 0, void 0, function* () {
+            yield expect(workos.userManagement.refreshAndSealSessionData({
+                sessionData: '',
+                cookiePassword: 'secret',
+            })).resolves.toEqual({
+                authenticated: false,
+                reason: 'no_session_cookie_provided',
+            });
+        }));
+        it('returns authenticated = false when session cookie is invalid', () => __awaiter(void 0, void 0, void 0, function* () {
+            yield expect(workos.userManagement.refreshAndSealSessionData({
+                sessionData: 'thisisacookie',
+                cookiePassword: 'secret',
+            })).resolves.toEqual({
+                authenticated: false,
+                reason: 'invalid_session_cookie',
+            });
+        }));
+        it('returns authenticated = false when session cookie cannot be unsealed', () => __awaiter(void 0, void 0, void 0, function* () {
+            const cookiePassword = 'alongcookiesecretmadefortestingsessions';
+            const sessionData = yield (0, iron_session_1.sealData)({
+                accessToken: 'abc123',
+                refreshToken: 'def456',
+                user: {
+                    object: 'user',
+                    id: 'user_01H5JQDV7R7ATEYZDEG0W5PRYS',
+                    email: 'test@example.com',
+                },
+            }, { password: cookiePassword });
+            yield expect(workos.userManagement.refreshAndSealSessionData({
+                sessionData,
+                cookiePassword: 'secretpasswordwhichisalsolongbutnottherightone',
+            })).resolves.toEqual({
+                authenticated: false,
+                reason: 'invalid_session_cookie',
+            });
+        }));
+        it('returns the sealed refreshed session cookie when provided a valid existing session cookie', () => __awaiter(void 0, void 0, void 0, function* () {
+            (0, test_utils_1.fetchOnce)({
+                user: user_json_1.default,
+                access_token: 'access_token',
+                refresh_token: 'refresh_token',
+            });
+            const cookiePassword = 'alongcookiesecretmadefortestingsessions';
+            const sessionData = yield (0, iron_session_1.sealData)({
+                accessToken: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.ewogICJzdWIiOiAiMTIzNDU2Nzg5MCIsCiAgIm5hbWUiOiAiSm9obiBEb2UiLAogICJpYXQiOiAxNTE2MjM5MDIyLAogICJzaWQiOiAic2Vzc2lvbl8xMjMiLAogICJvcmdfaWQiOiAib3JnXzEyMyIsCiAgInJvbGUiOiAibWVtYmVyIiwKICAicGVybWlzc2lvbnMiOiBbInBvc3RzOmNyZWF0ZSIsICJwb3N0czpkZWxldGUiXQp9.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c',
+                refreshToken: 'def456',
+                user: {
+                    object: 'user',
+                    id: 'user_01H5JQDV7R7ATEYZDEG0W5PRYS',
+                    email: 'test@example.com',
+                },
+            }, { password: cookiePassword });
+            yield expect(workos.userManagement.refreshAndSealSessionData({
+                sessionData,
+                cookiePassword,
+            })).resolves.toEqual({
+                sealedSession: expect.any(String),
+                authenticated: true,
+            });
+        }));
+    });
+    describe('getSessionFromCookie', () => {
+        it('throws an error when the cookie password is undefined', () => __awaiter(void 0, void 0, void 0, function* () {
+            yield expect(workos.userManagement.getSessionFromCookie({
+                sessionData: 'session_cookie',
+            })).rejects.toThrow('Cookie password is required');
+        }));
+        it('returns undefined when the session cookie cannot be unsealed', () => __awaiter(void 0, void 0, void 0, function* () {
+            yield expect(workos.userManagement.getSessionFromCookie({
+                sessionData: '',
+                cookiePassword: 'secret',
+            })).resolves.toBeUndefined();
+        }));
+        it('returns the unsealed session cookie data when provided a valid session cookie', () => __awaiter(void 0, void 0, void 0, function* () {
+            const cookiePassword = 'alongcookiesecretmadefortestingsessions';
+            const sessionCookieData = {
+                accessToken: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.ewogICJzdWIiOiAiMTIzNDU2Nzg5MCIsCiAgIm5hbWUiOiAiSm9obiBEb2UiLAogICJpYXQiOiAxNTE2MjM5MDIyLAogICJzaWQiOiAic2Vzc2lvbl8xMjMiLAogICJvcmdfaWQiOiAib3JnXzEyMyIsCiAgInJvbGUiOiAibWVtYmVyIiwKICAicGVybWlzc2lvbnMiOiBbInBvc3RzOmNyZWF0ZSIsICJwb3N0czpkZWxldGUiXQp9.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c',
+                refreshToken: 'def456',
+                user: {
+                    object: 'user',
+                    id: 'user_01H5JQDV7R7ATEYZDEG0W5PRYS',
+                    email: 'test@example.com',
+                },
+            };
+            const sessionData = yield (0, iron_session_1.sealData)(sessionCookieData, {
+                password: cookiePassword,
+            });
+            yield expect(workos.userManagement.getSessionFromCookie({
+                sessionData,
+                cookiePassword,
+            })).resolves.toEqual(sessionCookieData);
+        }));
     });
     describe('getEmailVerification', () => {
         it('sends a Get EmailVerification request', () => __awaiter(void 0, void 0, void 0, function* () {

package/lib/workos.d.ts

@@ -16,6 +16,7 @@ export declare class WorkOS {
     readonly options: WorkOSOptions;
     readonly baseURL: string;
     readonly client: HttpClient;
+    readonly clientId?: string;
     readonly auditLogs: AuditLogs;
     readonly directorySync: DirectorySync;
     readonly organizations: Organizations;

package/lib/workos.js

@@ -26,10 +26,11 @@ const bad_request_exception_1 = require("./common/exceptions/bad-request.excepti
 const http_client_1 = require("./common/net/http-client");
 const subtle_crypto_provider_1 = require("./common/crypto/subtle-crypto-provider");
 const fetch_client_1 = require("./common/net/fetch-client");
-const VERSION = '7.14.0';
+const VERSION = '7.16.0';
 const DEFAULT_HOSTNAME = 'api.workos.com';
 class WorkOS {
     constructor(key, options = {}) {
+        var _a;
         this.key = key;
         this.options = options;
         this.auditLogs = new audit_logs_1.AuditLogs(this);
@@ -41,7 +42,6 @@ class WorkOS {
         this.sso = new sso_1.SSO(this);
         this.mfa = new mfa_1.Mfa(this);
         this.events = new events_1.Events(this);
-        this.userManagement = new user_management_1.UserManagement(this);
         if (!key) {
             // process might be undefined in some environments
             this.key = process === null || process === void 0 ? void 0 : process.env.WORKOS_API_KEY;
@@ -52,6 +52,7 @@ class WorkOS {
         if (this.options.https === undefined) {
             this.options.https = true;
         }
+        this.clientId = (_a = this.options.clientId) !== null && _a !== void 0 ? _a : process === null || process === void 0 ? void 0 : process.env.WORKOS_CLIENT_ID;
         const protocol = this.options.https ? 'https' : 'http';
         const apiHostname = this.options.apiHostname || DEFAULT_HOSTNAME;
         const port = this.options.port;
@@ -65,6 +66,8 @@ class WorkOS {
             userAgent += ` ${name}: ${version}`;
         }
         this.webhooks = this.createWebhookClient();
+        // Must initialize UserManagement after baseURL is configured
+        this.userManagement = new user_management_1.UserManagement(this);
         this.client = this.createHttpClient(options, userAgent);
     }
     createWebhookClient() {

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "7.14.0",
+  "version": "7.16.0",
   "name": "@workos-inc/node",
   "author": "WorkOS",
   "description": "A Node wrapper for the WorkOS API",
@@ -37,6 +37,8 @@
     "prepublishOnly": "yarn run build"
   },
   "dependencies": {
+    "iron-session": "~6.3.1",
+    "jose": "~5.6.3",
     "pluralize": "8.0.0"
   },
   "devDependencies": {
@@ -63,4 +65,4 @@
       "default": "./lib/index.js"
     }
   }
-}
+}