@workos-inc/node 7.21.0 → 7.22.1

package/lib/index.d.ts

@@ -10,6 +10,7 @@ export * from './common/utils/pagination';
 export * from './directory-sync/interfaces';
 export * from './directory-sync/utils/get-primary-email';
 export * from './events/interfaces';
+export * from './fga/interfaces';
 export * from './organizations/interfaces';
 export * from './passwordless/interfaces';
 export * from './portal/interfaces';

package/lib/index.js

@@ -29,6 +29,7 @@ __exportStar(require("./common/utils/pagination"), exports);
 __exportStar(require("./directory-sync/interfaces"), exports);
 __exportStar(require("./directory-sync/utils/get-primary-email"), exports);
 __exportStar(require("./events/interfaces"), exports);
+__exportStar(require("./fga/interfaces"), exports);
 __exportStar(require("./organizations/interfaces"), exports);
 __exportStar(require("./passwordless/interfaces"), exports);
 __exportStar(require("./portal/interfaces"), exports);

package/lib/user-management/interfaces/authenticate-with-session-cookie.interface.d.ts

@@ -1,4 +1,8 @@
 import { AuthenticationResponse } from './authentication-response.interface';
+export interface AuthenticateWithSessionCookieOptions {
+    sessionData: string;
+    cookiePassword?: string;
+}
 export interface AccessToken {
     sid: string;
     org_id?: string;

package/lib/user-management/interfaces/refresh-and-seal-session-data.interface.d.ts

@@ -6,6 +6,11 @@ export declare enum RefreshAndSealSessionDataFailureReason {
     INVALID_SESSION_COOKIE = "invalid_session_cookie",
     NO_SESSION_COOKIE_PROVIDED = "no_session_cookie_provided",
     INVALID_GRANT = "invalid_grant",
+    MFA_ENROLLMENT = "mfa_enrollment",
+    SSO_REQUIRED = "sso_required",
+    /**
+     * @deprecated To be removed in a future major version.
+     */
     ORGANIZATION_NOT_AUTHORIZED = "organization_not_authorized"
 }
 type RefreshAndSealSessionDataFailedResponse = {

package/lib/user-management/interfaces/refresh-and-seal-session-data.interface.js

@@ -11,5 +11,10 @@ var RefreshAndSealSessionDataFailureReason;
     RefreshAndSealSessionDataFailureReason["NO_SESSION_COOKIE_PROVIDED"] = "no_session_cookie_provided";
     // API OauthErrors for refresh tokens
     RefreshAndSealSessionDataFailureReason["INVALID_GRANT"] = "invalid_grant";
+    RefreshAndSealSessionDataFailureReason["MFA_ENROLLMENT"] = "mfa_enrollment";
+    RefreshAndSealSessionDataFailureReason["SSO_REQUIRED"] = "sso_required";
+    /**
+     * @deprecated To be removed in a future major version.
+     */
     RefreshAndSealSessionDataFailureReason["ORGANIZATION_NOT_AUTHORIZED"] = "organization_not_authorized";
 })(RefreshAndSealSessionDataFailureReason || (exports.RefreshAndSealSessionDataFailureReason = RefreshAndSealSessionDataFailureReason = {}));

package/lib/user-management/interfaces/session-handler-options.interface.d.ts

@@ -1,4 +1,5 @@
 export interface SessionHandlerOptions {
     sessionData: string;
     cookiePassword?: string;
+    organizationId?: string;
 }

package/lib/user-management/user-management.d.ts

@@ -4,7 +4,7 @@ import { WorkOS } from '../workos';
 import { AuthenticateWithCodeOptions, AuthenticateWithMagicAuthOptions, AuthenticateWithPasswordOptions, AuthenticateWithRefreshTokenOptions, AuthenticateWithTotpOptions, AuthenticationResponse, CreateMagicAuthOptions, CreatePasswordResetOptions, CreateUserOptions, EmailVerification, EnrollAuthFactorOptions, ListAuthFactorsOptions, ListUsersOptions, MagicAuth, PasswordReset, ResetPasswordOptions, SendMagicAuthCodeOptions, SendPasswordResetEmailOptions, SendVerificationEmailOptions, UpdateUserOptions, User, VerifyEmailOptions } from './interfaces';
 import { AuthenticateWithEmailVerificationOptions } from './interfaces/authenticate-with-email-verification-options.interface';
 import { AuthenticateWithOrganizationSelectionOptions } from './interfaces/authenticate-with-organization-selection.interface';
-import { AuthenticateWithSessionCookieFailedResponse, AuthenticateWithSessionCookieSuccessResponse, SessionCookieData } from './interfaces/authenticate-with-session-cookie.interface';
+import { AuthenticateWithSessionCookieFailedResponse, AuthenticateWithSessionCookieOptions, AuthenticateWithSessionCookieSuccessResponse, SessionCookieData } from './interfaces/authenticate-with-session-cookie.interface';
 import { AuthorizationURLOptions } from './interfaces/authorization-url-options.interface';
 import { CreateOrganizationMembershipOptions } from './interfaces/create-organization-membership-options.interface';
 import { Factor, FactorWithSecrets } from './interfaces/factor.interface';
@@ -34,9 +34,9 @@ export declare class UserManagement {
     authenticateWithTotp(payload: AuthenticateWithTotpOptions): Promise<AuthenticationResponse>;
     authenticateWithEmailVerification(payload: AuthenticateWithEmailVerificationOptions): Promise<AuthenticationResponse>;
     authenticateWithOrganizationSelection(payload: AuthenticateWithOrganizationSelectionOptions): Promise<AuthenticationResponse>;
-    authenticateWithSessionCookie({ sessionData, cookiePassword, }: SessionHandlerOptions): Promise<AuthenticateWithSessionCookieSuccessResponse | AuthenticateWithSessionCookieFailedResponse>;
+    authenticateWithSessionCookie({ sessionData, cookiePassword, }: AuthenticateWithSessionCookieOptions): Promise<AuthenticateWithSessionCookieSuccessResponse | AuthenticateWithSessionCookieFailedResponse>;
     private isValidJwt;
-    refreshAndSealSessionData({ sessionData, cookiePassword, }: SessionHandlerOptions): Promise<RefreshAndSealSessionDataResponse>;
+    refreshAndSealSessionData({ sessionData, organizationId, cookiePassword, }: SessionHandlerOptions): Promise<RefreshAndSealSessionDataResponse>;
     private prepareAuthenticationResponse;
     private sealSessionDataFromAuthenticationResponse;
     getSessionFromCookie({ sessionData, cookiePassword, }: SessionHandlerOptions): Promise<SessionCookieData | undefined>;

package/lib/user-management/user-management.js

@@ -203,7 +203,7 @@ class UserManagement {
             }
         });
     }
-    refreshAndSealSessionData({ sessionData, cookiePassword = process.env.WORKOS_COOKIE_PASSWORD, }) {
+    refreshAndSealSessionData({ sessionData, organizationId, cookiePassword = process.env.WORKOS_COOKIE_PASSWORD, }) {
         return __awaiter(this, void 0, void 0, function* () {
             if (!cookiePassword) {
                 throw new Error('Cookie password is required');
@@ -223,10 +223,12 @@ class UserManagement {
                     reason: refresh_and_seal_session_data_interface_1.RefreshAndSealSessionDataFailureReason.INVALID_SESSION_COOKIE,
                 };
             }
+            const { org_id: organizationIdFromAccessToken } = (0, jose_1.decodeJwt)(session.accessToken);
             try {
                 const { sealedSession } = yield this.authenticateWithRefreshToken({
                     clientId: this.workos.clientId,
                     refreshToken: session.refreshToken,
+                    organizationId: organizationId !== null && organizationId !== void 0 ? organizationId : organizationIdFromAccessToken,
                     session: { sealSession: true, cookiePassword },
                 });
                 if (!sealedSession) {
@@ -242,7 +244,8 @@ class UserManagement {
                     // TODO: Add additional known errors and remove re-throw
                     (error.error === refresh_and_seal_session_data_interface_1.RefreshAndSealSessionDataFailureReason.INVALID_GRANT ||
                         error.error ===
-                            refresh_and_seal_session_data_interface_1.RefreshAndSealSessionDataFailureReason.ORGANIZATION_NOT_AUTHORIZED)) {
+                            refresh_and_seal_session_data_interface_1.RefreshAndSealSessionDataFailureReason.MFA_ENROLLMENT ||
+                        error.error === refresh_and_seal_session_data_interface_1.RefreshAndSealSessionDataFailureReason.SSO_REQUIRED)) {
                     return {
                         authenticated: false,
                         reason: error.error,

package/lib/workos.js

@@ -27,7 +27,7 @@ const bad_request_exception_1 = require("./common/exceptions/bad-request.excepti
 const http_client_1 = require("./common/net/http-client");
 const subtle_crypto_provider_1 = require("./common/crypto/subtle-crypto-provider");
 const fetch_client_1 = require("./common/net/fetch-client");
-const VERSION = '7.21.0';
+const VERSION = '7.22.1';
 const DEFAULT_HOSTNAME = 'api.workos.com';
 const HEADER_AUTHORIZATION = 'Authorization';
 const HEADER_IDEMPOTENCY_KEY = 'Idempotency-Key';

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "7.21.0",
+  "version": "7.22.1",
   "name": "@workos-inc/node",
   "author": "WorkOS",
   "description": "A Node wrapper for the WorkOS API",
@@ -58,7 +58,11 @@
   },
   "exports": {
     "types": "./lib/index.d.ts",
-    "worker": {
+    "workerd": {
+      "import": "./lib/index.worker.js",
+      "default": "./lib/index.worker.js"
+    },
+    "edge-light": {
       "import": "./lib/index.worker.js",
       "default": "./lib/index.worker.js"
     },