@workos-inc/node 7.32.0 → 7.33.1

package/lib/actions/actions.d.ts

@@ -0,0 +1,19 @@
+import { CryptoProvider } from '../common/crypto/crypto-provider';
+import { AuthenticationActionResponseData, ResponsePayload, UserRegistrationActionResponseData } from './interfaces/response-payload';
+export declare class Actions {
+    private signatureProvider;
+    constructor(cryptoProvider: CryptoProvider);
+    private get computeSignature();
+    get verifyHeader(): ({ payload, sigHeader, secret, tolerance, }: {
+        payload: any;
+        sigHeader: string;
+        secret: string;
+        tolerance?: number | undefined;
+    }) => Promise<boolean>;
+    serializeType(type: AuthenticationActionResponseData['type'] | UserRegistrationActionResponseData['type']): "authentication_action_response" | "user_registration_action_response";
+    signResponse(data: AuthenticationActionResponseData | UserRegistrationActionResponseData, secret: string): Promise<{
+        object: string;
+        payload: ResponsePayload;
+        signature: string;
+    }>;
+}

package/lib/actions/actions.js

@@ -0,0 +1,53 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Actions = void 0;
+const crypto_1 = require("../common/crypto");
+const unreachable_1 = require("../common/utils/unreachable");
+class Actions {
+    constructor(cryptoProvider) {
+        this.signatureProvider = new crypto_1.SignatureProvider(cryptoProvider);
+    }
+    get computeSignature() {
+        return this.signatureProvider.computeSignature.bind(this.signatureProvider);
+    }
+    get verifyHeader() {
+        return this.signatureProvider.verifyHeader.bind(this.signatureProvider);
+    }
+    serializeType(type) {
+        switch (type) {
+            case 'authentication':
+                return 'authentication_action_response';
+            case 'user_registration':
+                return 'user_registration_action_response';
+            default:
+                return (0, unreachable_1.unreachable)(type);
+        }
+    }
+    signResponse(data, secret) {
+        return __awaiter(this, void 0, void 0, function* () {
+            let errorMessage;
+            const { verdict, type } = data;
+            if (verdict === 'Deny' && data.errorMessage) {
+                errorMessage = data.errorMessage;
+            }
+            const responsePayload = Object.assign({ timestamp: Date.now(), verdict }, (verdict === 'Deny' &&
+                data.errorMessage && { error_message: errorMessage }));
+            const response = {
+                object: this.serializeType(type),
+                payload: responsePayload,
+                signature: yield this.computeSignature(responsePayload.timestamp, responsePayload, secret),
+            };
+            return response;
+        });
+    }
+}
+exports.Actions = Actions;

package/lib/actions/actions.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/actions/actions.spec.js

@@ -0,0 +1,78 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const crypto_1 = __importDefault(require("crypto"));
+const workos_1 = require("../workos");
+const action_context_json_1 = __importDefault(require("./fixtures/action-context.json"));
+const workos = new workos_1.WorkOS('sk_test_Sz3IQjepeSWaI4cMS4ms4sMuU');
+const crypto_2 = require("../common/crypto");
+describe('Actions', () => {
+    let secret;
+    beforeEach(() => {
+        secret = 'secret';
+    });
+    describe('signResponse', () => {
+        describe('type: authentication', () => {
+            it('returns a signed response', () => __awaiter(void 0, void 0, void 0, function* () {
+                const nodeCryptoProvider = new crypto_2.NodeCryptoProvider();
+                const response = yield workos.actions.signResponse({
+                    type: 'authentication',
+                    verdict: 'Allow',
+                }, secret);
+                const signedPayload = `${response.payload.timestamp}.${JSON.stringify(response.payload)}`;
+                const expectedSig = yield nodeCryptoProvider.computeHMACSignatureAsync(signedPayload, secret);
+                expect(response.object).toEqual('authentication_action_response');
+                expect(response.payload.verdict).toEqual('Allow');
+                expect(response.payload.timestamp).toBeGreaterThan(0);
+                expect(response.signature).toEqual(expectedSig);
+            }));
+        });
+        describe('type: user_registration', () => {
+            it('returns a signed response', () => __awaiter(void 0, void 0, void 0, function* () {
+                const nodeCryptoProvider = new crypto_2.NodeCryptoProvider();
+                const response = yield workos.actions.signResponse({
+                    type: 'user_registration',
+                    verdict: 'Deny',
+                    errorMessage: 'User already exists',
+                }, secret);
+                const signedPayload = `${response.payload.timestamp}.${JSON.stringify(response.payload)}`;
+                const expectedSig = yield nodeCryptoProvider.computeHMACSignatureAsync(signedPayload, secret);
+                expect(response.object).toEqual('user_registration_action_response');
+                expect(response.payload.verdict).toEqual('Deny');
+                expect(response.payload.timestamp).toBeGreaterThan(0);
+                expect(response.signature).toEqual(expectedSig);
+            }));
+        });
+    });
+    describe('verifyHeader', () => {
+        it('aliases to the signature provider', () => __awaiter(void 0, void 0, void 0, function* () {
+            const spy = jest.spyOn(
+            // tslint:disable-next-line
+            workos.actions['signatureProvider'], 'verifyHeader');
+            const timestamp = Date.now() * 1000;
+            const unhashedString = `${timestamp}.${JSON.stringify(action_context_json_1.default)}`;
+            const signatureHash = crypto_1.default
+                .createHmac('sha256', secret)
+                .update(unhashedString)
+                .digest()
+                .toString('hex');
+            yield workos.actions.verifyHeader({
+                payload: action_context_json_1.default,
+                sigHeader: `t=${timestamp}, v1=${signatureHash}`,
+                secret,
+            });
+            expect(spy).toHaveBeenCalled();
+        }));
+    });
+});

package/lib/actions/fixtures/action-context.json

@@ -0,0 +1,39 @@
+{
+    "user": {
+        "object": "user",
+        "id": "01JATCHZVEC5EPANDPEZVM68Y9",
+        "email": "jane@foocorp.com",
+        "first_name": "Jane",
+        "last_name": "Doe",
+        "email_verified": true,
+        "profile_picture_url": "https://example.com/jane.jpg",
+        "created_at": "2024-10-22T17:12:50.746Z",
+        "updated_at": "2024-10-22T17:12:50.746Z"
+    },
+    "ip_address": "50.141.123.10",
+    "user_agent": "Mozilla/5.0",
+    "issuer": "test",
+    "object": "authentication_action_context",
+    "organization": {
+        "object": "organization",
+        "id": "01JATCMZJY26PQ59XT9BNT0FNN",
+        "name": "Foo Corp",
+        "allow_profiles_outside_organization": false,
+        "domains": [],
+        "lookup_key": "my-key",
+        "created_at": "2024-10-22T17:12:50.746Z",
+        "updated_at": "2024-10-22T17:12:50.746Z"
+    },
+    "organization_membership": {
+        "object": "organization_membership",
+        "id": "01JATCNVYCHT1SZGENR4QTXKRK",
+        "user_id": "01JATCHZVEC5EPANDPEZVM68Y9",
+        "organization_id": "01JATCMZJY26PQ59XT9BNT0FNN",
+        "role": {
+            "slug": "member"
+        },
+        "status": "active",
+        "created_at": "2024-10-22T17:12:50.746Z",
+        "updated_at": "2024-10-22T17:12:50.746Z"
+    }
+}

package/lib/actions/interfaces/response-payload.d.ts

@@ -0,0 +1,23 @@
+export interface ResponsePayload {
+    timestamp: number;
+    verdict?: 'Allow' | 'Deny';
+    errorMessage?: string;
+}
+interface AllowResponseData {
+    verdict: 'Allow';
+}
+interface DenyResponseData {
+    verdict: 'Deny';
+    errorMessage?: string;
+}
+export type AuthenticationActionResponseData = (AllowResponseData & {
+    type: 'authentication';
+}) | (DenyResponseData & {
+    type: 'authentication';
+});
+export type UserRegistrationActionResponseData = (AllowResponseData & {
+    type: 'user_registration';
+}) | (DenyResponseData & {
+    type: 'user_registration';
+});
+export {};

package/lib/actions/interfaces/response-payload.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/audit-logs/audit-logs.spec.js

@@ -61,6 +61,7 @@ const schema = {
         baz: 'boolean',
     },
 };
+const schemaWithoutMetadata = Object.assign(Object.assign({}, schema), { metadata: undefined });
 describe('AuditLogs', () => {
     beforeEach(() => jest_fetch_mock_1.default.resetMocks());
     describe('createEvent', () => {
@@ -328,6 +329,63 @@ describe('AuditLogs', () => {
                 expect(workosSpy).toHaveBeenCalledWith('/audit_logs/actions/user.logged_in/schemas', (0, serializers_1.serializeCreateAuditLogSchemaOptions)(schema), { idempotencyKey: 'the-idempotency-key' });
             }));
         });
+        describe('without metadata', () => {
+            it('does not include metadata with the request', () => __awaiter(void 0, void 0, void 0, function* () {
+                const workosSpy = jest.spyOn(workos_1.WorkOS.prototype, 'post');
+                const time = new Date().toISOString();
+                const createSchemaResult = {
+                    object: 'audit_log_schema',
+                    version: 1,
+                    targets: [
+                        {
+                            type: 'user',
+                            metadata: {
+                                user_id: 'string',
+                            },
+                        },
+                    ],
+                    actor: {
+                        metadata: {
+                            actor_id: 'string',
+                        },
+                    },
+                    metadata: undefined,
+                    createdAt: time,
+                };
+                const createSchemaResponse = {
+                    object: 'audit_log_schema',
+                    version: 1,
+                    targets: [
+                        {
+                            type: 'user',
+                            metadata: {
+                                type: 'object',
+                                properties: {
+                                    user_id: {
+                                        type: 'string',
+                                    },
+                                },
+                            },
+                        },
+                    ],
+                    actor: {
+                        metadata: {
+                            type: 'object',
+                            properties: {
+                                actor_id: {
+                                    type: 'string',
+                                },
+                            },
+                        },
+                    },
+                    created_at: time,
+                };
+                workosSpy.mockResolvedValueOnce((0, workos_mock_response_1.mockWorkOsResponse)(201, createSchemaResponse));
+                const workos = new workos_1.WorkOS('sk_test_Sz3IQjepeSWaI4cMS4ms4sMuU');
+                yield expect(workos.auditLogs.createSchema(schemaWithoutMetadata)).resolves.toEqual(createSchemaResult);
+                expect(workosSpy).toHaveBeenCalledWith('/audit_logs/actions/user.logged_in/schemas', (0, serializers_1.serializeCreateAuditLogSchemaOptions)(schemaWithoutMetadata), {});
+            }));
+        });
         describe('when the api responds with a 201', () => {
             it('returns `audit_log_schema`', () => __awaiter(void 0, void 0, void 0, function* () {
                 const workosSpy = jest.spyOn(workos_1.WorkOS.prototype, 'post');

package/lib/audit-logs/interfaces/create-audit-log-schema-options.interface.d.ts

@@ -53,7 +53,7 @@ export interface CreateAuditLogSchemaResponse {
             properties: AuditLogSchemaMetadata;
         };
     };
-    metadata: {
+    metadata?: {
         type: 'object';
         properties: AuditLogSchemaMetadata;
     };

package/lib/audit-logs/serializers/create-audit-log-schema-options.serializer.js

@@ -33,10 +33,12 @@ const serializeCreateAuditLogSchemaOptions = (schema) => {
                     : undefined,
             };
         }),
-        metadata: {
-            type: 'object',
-            properties: serializeMetadata(schema.metadata),
-        },
+        metadata: schema.metadata
+            ? {
+                type: 'object',
+                properties: serializeMetadata(schema.metadata),
+            }
+            : undefined,
     });
 };
 exports.serializeCreateAuditLogSchemaOptions = serializeCreateAuditLogSchemaOptions;

package/lib/audit-logs/serializers/create-audit-log-schema.serializer.js

@@ -29,7 +29,9 @@ const deserializeAuditLogSchema = (auditLogSchema) => {
         actor: {
             metadata: deserializeMetadata((_a = auditLogSchema.actor) === null || _a === void 0 ? void 0 : _a.metadata),
         },
-        metadata: deserializeMetadata(auditLogSchema.metadata),
+        metadata: auditLogSchema.metadata
+            ? deserializeMetadata(auditLogSchema.metadata)
+            : undefined,
         createdAt: auditLogSchema.created_at,
     });
 };

package/lib/common/crypto/CryptoProvider.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Interface encapsulating the various crypto computations used by the library,
+ * allowing pluggable underlying crypto implementations.
+ */
+export declare abstract class CryptoProvider {
+    encoder: TextEncoder;
+    /**
+     * Computes a SHA-256 HMAC given a secret and a payload (encoded in UTF-8).
+     * The output HMAC should be encoded in hexadecimal.
+     *
+     * Sample values for implementations:
+     * - computeHMACSignature('', 'test_secret') => 'f7f9bd47fb987337b5796fdc1fdb9ba221d0d5396814bfcaf9521f43fd8927fd'
+     * - computeHMACSignature('\ud83d\ude00', 'test_secret') => '837da296d05c4fe31f61d5d7ead035099d9585a5bcde87de952012a78f0b0c43
+     */
+    abstract computeHMACSignature(payload: string, secret: string): string;
+    /**
+     * Asynchronous version of `computeHMACSignature`. Some implementations may
+     * only allow support async signature computation.
+     *
+     * Computes a SHA-256 HMAC given a secret and a payload (encoded in UTF-8).
+     * The output HMAC should be encoded in hexadecimal.
+     *
+     * Sample values for implementations:
+     * - computeHMACSignature('', 'test_secret') => 'f7f9bd47fb987337b5796fdc1fdb9ba221d0d5396814bfcaf9521f43fd8927fd'
+     * - computeHMACSignature('\ud83d\ude00', 'test_secret') => '837da296d05c4fe31f61d5d7ead035099d9585a5bcde87de952012a78f0b0c43
+     */
+    abstract computeHMACSignatureAsync(payload: string, secret: string): Promise<string>;
+    /**
+     * Cryptographically determine whether two signatures are equal
+     */
+    abstract secureCompare(stringA: string, stringB: string): Promise<boolean>;
+}

package/lib/common/crypto/CryptoProvider.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CryptoProvider = void 0;
+/**
+ * Interface encapsulating the various crypto computations used by the library,
+ * allowing pluggable underlying crypto implementations.
+ */
+class CryptoProvider {
+    constructor() {
+        this.encoder = new TextEncoder();
+    }
+}
+exports.CryptoProvider = CryptoProvider;

package/lib/common/crypto/CryptoProvider.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/common/crypto/CryptoProvider.spec.js

@@ -0,0 +1,57 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const crypto_1 = __importDefault(require("crypto"));
+const NodeCryptoProvider_1 = require("./NodeCryptoProvider");
+const SubtleCryptoProvider_1 = require("./SubtleCryptoProvider");
+const webhook_json_1 = __importDefault(require("../../webhooks/fixtures/webhook.json"));
+const SignatureProvider_1 = require("./SignatureProvider");
+describe('CryptoProvider', () => {
+    let payload;
+    let secret;
+    let timestamp;
+    let signatureHash;
+    beforeEach(() => {
+        payload = webhook_json_1.default;
+        secret = 'secret';
+        timestamp = Date.now() * 1000;
+        const unhashedString = `${timestamp}.${JSON.stringify(payload)}`;
+        signatureHash = crypto_1.default
+            .createHmac('sha256', secret)
+            .update(unhashedString)
+            .digest()
+            .toString('hex');
+    });
+    describe('when computing HMAC signature', () => {
+        it('returns the same for the Node crypto and Web Crypto versions', () => __awaiter(void 0, void 0, void 0, function* () {
+            const nodeCryptoProvider = new NodeCryptoProvider_1.NodeCryptoProvider();
+            const subtleCryptoProvider = new SubtleCryptoProvider_1.SubtleCryptoProvider();
+            const stringifiedPayload = JSON.stringify(payload);
+            const payloadHMAC = `${timestamp}.${stringifiedPayload}`;
+            const nodeCompare = yield nodeCryptoProvider.computeHMACSignatureAsync(payloadHMAC, secret);
+            const subtleCompare = yield subtleCryptoProvider.computeHMACSignatureAsync(payloadHMAC, secret);
+            expect(nodeCompare).toEqual(subtleCompare);
+        }));
+    });
+    describe('when securely comparing', () => {
+        it('returns the same for the Node crypto and Web Crypto versions', () => __awaiter(void 0, void 0, void 0, function* () {
+            const nodeCryptoProvider = new NodeCryptoProvider_1.NodeCryptoProvider();
+            const subtleCryptoProvider = new SubtleCryptoProvider_1.SubtleCryptoProvider();
+            const signatureProvider = new SignatureProvider_1.SignatureProvider(subtleCryptoProvider);
+            const signature = yield signatureProvider.computeSignature(timestamp, payload, secret);
+            expect(nodeCryptoProvider.secureCompare(signature, signatureHash)).toEqual(subtleCryptoProvider.secureCompare(signature, signatureHash));
+            expect(nodeCryptoProvider.secureCompare(signature, 'foo')).toEqual(subtleCryptoProvider.secureCompare(signature, 'foo'));
+        }));
+    });
+});

package/lib/common/crypto/NodeCryptoProvider.d.ts

@@ -0,0 +1,12 @@
+import { CryptoProvider } from './CryptoProvider';
+/**
+ * `CryptoProvider which uses the Node `crypto` package for its computations.
+ */
+export declare class NodeCryptoProvider extends CryptoProvider {
+    /** @override */
+    computeHMACSignature(payload: string, secret: string): string;
+    /** @override */
+    computeHMACSignatureAsync(payload: string, secret: string): Promise<string>;
+    /** @override */
+    secureCompare(stringA: string, stringB: string): Promise<boolean>;
+}

package/lib/common/crypto/NodeCryptoProvider.js

@@ -0,0 +1,73 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NodeCryptoProvider = void 0;
+const crypto = __importStar(require("crypto"));
+const CryptoProvider_1 = require("./CryptoProvider");
+/**
+ * `CryptoProvider which uses the Node `crypto` package for its computations.
+ */
+class NodeCryptoProvider extends CryptoProvider_1.CryptoProvider {
+    /** @override */
+    computeHMACSignature(payload, secret) {
+        return crypto
+            .createHmac('sha256', secret)
+            .update(payload, 'utf8')
+            .digest('hex');
+    }
+    /** @override */
+    computeHMACSignatureAsync(payload, secret) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const signature = yield this.computeHMACSignature(payload, secret);
+            return signature;
+        });
+    }
+    /** @override */
+    secureCompare(stringA, stringB) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const bufferA = this.encoder.encode(stringA);
+            const bufferB = this.encoder.encode(stringB);
+            if (bufferA.length !== bufferB.length) {
+                return false;
+            }
+            // Generate a random key for HMAC
+            const key = crypto.randomBytes(32); // Generates a 256-bit key
+            const hmacA = crypto.createHmac('sha256', key).update(bufferA).digest();
+            const hmacB = crypto.createHmac('sha256', key).update(bufferB).digest();
+            // Perform a constant time comparison
+            return crypto.timingSafeEqual(hmacA, hmacB);
+        });
+    }
+}
+exports.NodeCryptoProvider = NodeCryptoProvider;

package/lib/common/crypto/SignatureProvider.d.ts

@@ -0,0 +1,13 @@
+import { CryptoProvider } from './CryptoProvider';
+export declare class SignatureProvider {
+    private cryptoProvider;
+    constructor(cryptoProvider: CryptoProvider);
+    verifyHeader({ payload, sigHeader, secret, tolerance, }: {
+        payload: any;
+        sigHeader: string;
+        secret: string;
+        tolerance?: number;
+    }): Promise<boolean>;
+    getTimestampAndSignatureHash(sigHeader: string): [string, string];
+    computeSignature(timestamp: any, payload: any, secret: string): Promise<string>;
+}

package/lib/common/crypto/SignatureProvider.js

@@ -0,0 +1,53 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SignatureProvider = void 0;
+const exceptions_1 = require("../exceptions");
+class SignatureProvider {
+    constructor(cryptoProvider) {
+        this.cryptoProvider = cryptoProvider;
+    }
+    verifyHeader({ payload, sigHeader, secret, tolerance = 180000, }) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const [timestamp, signatureHash] = this.getTimestampAndSignatureHash(sigHeader);
+            if (!signatureHash || Object.keys(signatureHash).length === 0) {
+                throw new exceptions_1.SignatureVerificationException('No signature hash found with expected scheme v1');
+            }
+            if (parseInt(timestamp, 10) < Date.now() - tolerance) {
+                throw new exceptions_1.SignatureVerificationException('Timestamp outside the tolerance zone');
+            }
+            const expectedSig = yield this.computeSignature(timestamp, payload, secret);
+            if ((yield this.cryptoProvider.secureCompare(expectedSig, signatureHash)) ===
+                false) {
+                throw new exceptions_1.SignatureVerificationException('Signature hash does not match the expected signature hash for payload');
+            }
+            return true;
+        });
+    }
+    getTimestampAndSignatureHash(sigHeader) {
+        const signature = sigHeader;
+        const [t, v1] = signature.split(',');
+        if (typeof t === 'undefined' || typeof v1 === 'undefined') {
+            throw new exceptions_1.SignatureVerificationException('Signature or timestamp missing');
+        }
+        const { 1: timestamp } = t.split('=');
+        const { 1: signatureHash } = v1.split('=');
+        return [timestamp, signatureHash];
+    }
+    computeSignature(timestamp, payload, secret) {
+        return __awaiter(this, void 0, void 0, function* () {
+            payload = JSON.stringify(payload);
+            const signedPayload = `${timestamp}.${payload}`;
+            return yield this.cryptoProvider.computeHMACSignatureAsync(signedPayload, secret);
+        });
+    }
+}
+exports.SignatureProvider = SignatureProvider;

package/lib/common/crypto/SignatureProvider.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/common/crypto/SignatureProvider.spec.js

@@ -0,0 +1,66 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const crypto_1 = __importDefault(require("crypto"));
+const SubtleCryptoProvider_1 = require("./SubtleCryptoProvider");
+const webhook_json_1 = __importDefault(require("../../webhooks/fixtures/webhook.json"));
+const SignatureProvider_1 = require("./SignatureProvider");
+describe('SignatureProvider', () => {
+    let payload;
+    let secret;
+    let timestamp;
+    let signatureHash;
+    const signatureProvider = new SignatureProvider_1.SignatureProvider(new SubtleCryptoProvider_1.SubtleCryptoProvider());
+    beforeEach(() => {
+        payload = webhook_json_1.default;
+        secret = 'secret';
+        timestamp = Date.now() * 1000;
+        const unhashedString = `${timestamp}.${JSON.stringify(payload)}`;
+        signatureHash = crypto_1.default
+            .createHmac('sha256', secret)
+            .update(unhashedString)
+            .digest()
+            .toString('hex');
+    });
+    describe('verifyHeader', () => {
+        it('returns true when the signature is valid', () => __awaiter(void 0, void 0, void 0, function* () {
+            const sigHeader = `t=${timestamp}, v1=${signatureHash}`;
+            const options = { payload, sigHeader, secret };
+            const result = yield signatureProvider.verifyHeader(options);
+            expect(result).toBeTruthy();
+        }));
+    });
+    describe('getTimestampAndSignatureHash', () => {
+        it('returns the timestamp and signature when the signature is valid', () => {
+            const sigHeader = `t=${timestamp}, v1=${signatureHash}`;
+            const timestampAndSignature = signatureProvider.getTimestampAndSignatureHash(sigHeader);
+            expect(timestampAndSignature).toEqual([
+                timestamp.toString(),
+                signatureHash,
+            ]);
+        });
+    });
+    describe('computeSignature', () => {
+        it('returns the computed signature', () => __awaiter(void 0, void 0, void 0, function* () {
+            const signature = yield signatureProvider.computeSignature(timestamp, payload, secret);
+            expect(signature).toEqual(signatureHash);
+        }));
+    });
+    describe('when in an environment that supports SubtleCrypto', () => {
+        it('automatically uses the subtle crypto library', () => {
+            // tslint:disable-next-line
+            expect(signatureProvider['cryptoProvider']).toBeInstanceOf(SubtleCryptoProvider_1.SubtleCryptoProvider);
+        });
+    });
+});

package/lib/common/crypto/SubtleCryptoProvider.d.ts

@@ -0,0 +1,15 @@
+import { CryptoProvider } from './CryptoProvider';
+/**
+ * `CryptoProvider which uses the SubtleCrypto interface of the Web Crypto API.
+ *
+ * This only supports asynchronous operations.
+ */
+export declare class SubtleCryptoProvider extends CryptoProvider {
+    subtleCrypto: SubtleCrypto;
+    constructor(subtleCrypto?: SubtleCrypto);
+    computeHMACSignature(_payload: string, _secret: string): string;
+    /** @override */
+    computeHMACSignatureAsync(payload: string, secret: string): Promise<string>;
+    /** @override */
+    secureCompare(stringA: string, stringB: string): Promise<boolean>;
+}

package/lib/common/crypto/SubtleCryptoProvider.js

@@ -0,0 +1,75 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SubtleCryptoProvider = void 0;
+const CryptoProvider_1 = require("./CryptoProvider");
+/**
+ * `CryptoProvider which uses the SubtleCrypto interface of the Web Crypto API.
+ *
+ * This only supports asynchronous operations.
+ */
+class SubtleCryptoProvider extends CryptoProvider_1.CryptoProvider {
+    constructor(subtleCrypto) {
+        super();
+        // If no subtle crypto is interface, default to the global namespace. This
+        // is to allow custom interfaces (eg. using the Node webcrypto interface in
+        // tests).
+        this.subtleCrypto = subtleCrypto || crypto.subtle;
+    }
+    computeHMACSignature(_payload, _secret) {
+        throw new Error('SubleCryptoProvider cannot be used in a synchronous context.');
+    }
+    /** @override */
+    computeHMACSignatureAsync(payload, secret) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const encoder = new TextEncoder();
+            const key = yield this.subtleCrypto.importKey('raw', encoder.encode(secret), {
+                name: 'HMAC',
+                hash: { name: 'SHA-256' },
+            }, false, ['sign']);
+            const signatureBuffer = yield this.subtleCrypto.sign('hmac', key, encoder.encode(payload));
+            // crypto.subtle returns the signature in base64 format. This must be
+            // encoded in hex to match the CryptoProvider contract. We map each byte in
+            // the buffer to its corresponding hex octet and then combine into a string.
+            const signatureBytes = new Uint8Array(signatureBuffer);
+            const signatureHexCodes = new Array(signatureBytes.length);
+            for (let i = 0; i < signatureBytes.length; i++) {
+                signatureHexCodes[i] = byteHexMapping[signatureBytes[i]];
+            }
+            return signatureHexCodes.join('');
+        });
+    }
+    /** @override */
+    secureCompare(stringA, stringB) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const bufferA = this.encoder.encode(stringA);
+            const bufferB = this.encoder.encode(stringB);
+            if (bufferA.length !== bufferB.length) {
+                return false;
+            }
+            const algorithm = { name: 'HMAC', hash: 'SHA-256' };
+            const key = (yield crypto.subtle.generateKey(algorithm, false, [
+                'sign',
+                'verify',
+            ]));
+            const hmac = yield crypto.subtle.sign(algorithm, key, bufferA);
+            const equal = yield crypto.subtle.verify(algorithm, key, hmac, bufferB);
+            return equal;
+        });
+    }
+}
+exports.SubtleCryptoProvider = SubtleCryptoProvider;
+// Cached mapping of byte to hex representation. We do this once to avoid re-
+// computing every time we need to convert the result of a signature to hex.
+const byteHexMapping = new Array(256);
+for (let i = 0; i < byteHexMapping.length; i++) {
+    byteHexMapping[i] = i.toString(16).padStart(2, '0');
+}

package/lib/common/crypto/index.d.ts

@@ -0,0 +1,4 @@
+export * from './NodeCryptoProvider';
+export * from './SubtleCryptoProvider';
+export * from './CryptoProvider';
+export * from './SignatureProvider';

package/lib/common/crypto/index.js

@@ -0,0 +1,20 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./NodeCryptoProvider"), exports);
+__exportStar(require("./SubtleCryptoProvider"), exports);
+__exportStar(require("./CryptoProvider"), exports);
+__exportStar(require("./SignatureProvider"), exports);

package/lib/common/net/index.d.ts

@@ -0,0 +1,5 @@
+import { HttpClient } from './http-client';
+export declare function createHttpClient(baseURL: string, options: RequestInit, fetchFn?: typeof fetch): HttpClient;
+export * from './fetch-client';
+export * from './node-client';
+export * from './http-client';

package/lib/common/net/index.js

@@ -0,0 +1,31 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createHttpClient = void 0;
+const fetch_client_1 = require("./fetch-client");
+const node_client_1 = require("./node-client");
+function createHttpClient(baseURL, options, fetchFn) {
+    if (typeof fetch !== 'undefined' || typeof fetchFn !== 'undefined') {
+        return new fetch_client_1.FetchHttpClient(baseURL, options, fetchFn);
+    }
+    else {
+        return new node_client_1.NodeHttpClient(baseURL, options);
+    }
+}
+exports.createHttpClient = createHttpClient;
+__exportStar(require("./fetch-client"), exports);
+__exportStar(require("./node-client"), exports);
+__exportStar(require("./http-client"), exports);

package/lib/common/utils/unreachable.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Indicates that code is unreachable.
+ *
+ * This can be used for exhaustiveness checks in situations where the compiler
+ * would not otherwise check for exhaustiveness.
+ *
+ * If the determination that the code is unreachable proves incorrect, an
+ * exception is thrown.
+ */
+export declare const unreachable: (condition: never, message?: string) => never;

package/lib/common/utils/unreachable.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.unreachable = void 0;
+/**
+ * Indicates that code is unreachable.
+ *
+ * This can be used for exhaustiveness checks in situations where the compiler
+ * would not otherwise check for exhaustiveness.
+ *
+ * If the determination that the code is unreachable proves incorrect, an
+ * exception is thrown.
+ */
+const unreachable = (condition, 
+// eslint-disable-next-line @typescript-eslint/restrict-template-expressions
+message = `Entered unreachable code. Received '${condition}'.`) => {
+    throw new TypeError(message);
+};
+exports.unreachable = unreachable;

package/lib/index.d.ts

@@ -1,4 +1,5 @@
 import { HttpClient } from './common/net/http-client';
+import { Actions } from './actions/actions';
 import { Webhooks } from './webhooks/webhooks';
 import { WorkOS } from './workos';
 import { WorkOSOptions } from './common/interfaces';
@@ -23,6 +24,8 @@ declare class WorkOSNode extends WorkOS {
     /** @override */
     createWebhookClient(): Webhooks;
     /** @override */
+    createActionsClient(): Actions;
+    /** @override */
     createIronSessionProvider(): IronSessionProvider;
     /** @override */
     emitWarning(warning: string): void;

package/lib/index.js

@@ -19,6 +19,7 @@ const node_crypto_provider_1 = require("./common/crypto/node-crypto-provider");
 const subtle_crypto_provider_1 = require("./common/crypto/subtle-crypto-provider");
 const fetch_client_1 = require("./common/net/fetch-client");
 const node_client_1 = require("./common/net/node-client");
+const actions_1 = require("./actions/actions");
 const webhooks_1 = require("./webhooks/webhooks");
 const workos_1 = require("./workos");
 const web_iron_session_provider_1 = require("./common/iron-session/web-iron-session-provider");
@@ -61,6 +62,17 @@ class WorkOSNode extends workos_1.WorkOS {
         return new webhooks_1.Webhooks(cryptoProvider);
     }
     /** @override */
+    createActionsClient() {
+        let cryptoProvider;
+        if (typeof crypto !== 'undefined' && typeof crypto.subtle !== 'undefined') {
+            cryptoProvider = new subtle_crypto_provider_1.SubtleCryptoProvider();
+        }
+        else {
+            cryptoProvider = new node_crypto_provider_1.NodeCryptoProvider();
+        }
+        return new actions_1.Actions(cryptoProvider);
+    }
+    /** @override */
     createIronSessionProvider() {
         return new web_iron_session_provider_1.WebIronSessionProvider();
     }

package/lib/index.worker.d.ts

@@ -1,3 +1,4 @@
+import { Actions } from './actions/actions';
 import { IronSessionProvider } from './common/iron-session/iron-session-provider';
 import { HttpClient } from './common/net/http-client';
 import { WorkOSOptions } from './index.worker';
@@ -21,6 +22,8 @@ declare class WorkOSWorker extends WorkOS {
     /** @override */
     createWebhookClient(): Webhooks;
     /** @override */
+    createActionsClient(): Actions;
+    /** @override */
     createIronSessionProvider(): IronSessionProvider;
     /** @override */
     emitWarning(warning: string): void;

package/lib/index.worker.js

@@ -15,6 +15,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.WorkOS = void 0;
+const actions_1 = require("./actions/actions");
 const subtle_crypto_provider_1 = require("./common/crypto/subtle-crypto-provider");
 const edge_iron_session_provider_1 = require("./common/iron-session/edge-iron-session-provider");
 const fetch_client_1 = require("./common/net/fetch-client");
@@ -44,6 +45,11 @@ class WorkOSWorker extends workos_1.WorkOS {
         return new webhooks_1.Webhooks(cryptoProvider);
     }
     /** @override */
+    createActionsClient() {
+        const cryptoProvider = new subtle_crypto_provider_1.SubtleCryptoProvider();
+        return new actions_1.Actions(cryptoProvider);
+    }
+    /** @override */
     createIronSessionProvider() {
         return new edge_iron_session_provider_1.EdgeIronSessionProvider();
     }

package/lib/webhooks/webhooks.d.ts

@@ -1,20 +1,20 @@
 import { Event } from '../common/interfaces';
 import { CryptoProvider } from '../common/crypto/crypto-provider';
 export declare class Webhooks {
-    private cryptoProvider;
+    private signatureProvider;
     constructor(cryptoProvider: CryptoProvider);
+    get verifyHeader(): ({ payload, sigHeader, secret, tolerance, }: {
+        payload: any;
+        sigHeader: string;
+        secret: string;
+        tolerance?: number | undefined;
+    }) => Promise<boolean>;
+    get computeSignature(): (timestamp: any, payload: any, secret: string) => Promise<string>;
+    get getTimestampAndSignatureHash(): (sigHeader: string) => [string, string];
     constructEvent({ payload, sigHeader, secret, tolerance, }: {
         payload: unknown;
         sigHeader: string;
         secret: string;
         tolerance?: number;
     }): Promise<Event>;
-    verifyHeader({ payload, sigHeader, secret, tolerance, }: {
-        payload: any;
-        sigHeader: string;
-        secret: string;
-        tolerance?: number;
-    }): Promise<boolean>;
-    getTimestampAndSignatureHash(sigHeader: string): [string, string];
-    computeSignature(timestamp: any, payload: any, secret: string): Promise<string>;
 }

package/lib/webhooks/webhooks.js

@@ -10,11 +10,20 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Webhooks = void 0;
-const exceptions_1 = require("../common/exceptions");
 const serializers_1 = require("../common/serializers");
+const SignatureProvider_1 = require("../common/crypto/SignatureProvider");
 class Webhooks {
     constructor(cryptoProvider) {
-        this.cryptoProvider = cryptoProvider;
+        this.signatureProvider = new SignatureProvider_1.SignatureProvider(cryptoProvider);
+    }
+    get verifyHeader() {
+        return this.signatureProvider.verifyHeader.bind(this.signatureProvider);
+    }
+    get computeSignature() {
+        return this.signatureProvider.computeSignature.bind(this.signatureProvider);
+    }
+    get getTimestampAndSignatureHash() {
+        return this.signatureProvider.getTimestampAndSignatureHash.bind(this.signatureProvider);
     }
     constructEvent({ payload, sigHeader, secret, tolerance = 180000, }) {
         return __awaiter(this, void 0, void 0, function* () {
@@ -24,39 +33,5 @@ class Webhooks {
             return (0, serializers_1.deserializeEvent)(webhookPayload);
         });
     }
-    verifyHeader({ payload, sigHeader, secret, tolerance = 180000, }) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const [timestamp, signatureHash] = this.getTimestampAndSignatureHash(sigHeader);
-            if (!signatureHash || Object.keys(signatureHash).length === 0) {
-                throw new exceptions_1.SignatureVerificationException('No signature hash found with expected scheme v1');
-            }
-            if (parseInt(timestamp, 10) < Date.now() - tolerance) {
-                throw new exceptions_1.SignatureVerificationException('Timestamp outside the tolerance zone');
-            }
-            const expectedSig = yield this.computeSignature(timestamp, payload, secret);
-            if ((yield this.cryptoProvider.secureCompare(expectedSig, signatureHash)) ===
-                false) {
-                throw new exceptions_1.SignatureVerificationException('Signature hash does not match the expected signature hash for payload');
-            }
-            return true;
-        });
-    }
-    getTimestampAndSignatureHash(sigHeader) {
-        const signature = sigHeader;
-        const [t, v1] = signature.split(',');
-        if (typeof t === 'undefined' || typeof v1 === 'undefined') {
-            throw new exceptions_1.SignatureVerificationException('Signature or timestamp missing');
-        }
-        const { 1: timestamp } = t.split('=');
-        const { 1: signatureHash } = v1.split('=');
-        return [timestamp, signatureHash];
-    }
-    computeSignature(timestamp, payload, secret) {
-        return __awaiter(this, void 0, void 0, function* () {
-            payload = JSON.stringify(payload);
-            const signedPayload = `${timestamp}.${payload}`;
-            return yield this.cryptoProvider.computeHMACSignatureAsync(signedPayload, secret);
-        });
-    }
 }
 exports.Webhooks = Webhooks;

package/lib/webhooks/webhooks.spec.js

@@ -17,8 +17,6 @@ const workos_1 = require("../workos");
 const webhook_json_1 = __importDefault(require("./fixtures/webhook.json"));
 const workos = new workos_1.WorkOS('sk_test_Sz3IQjepeSWaI4cMS4ms4sMuU');
 const exceptions_1 = require("../common/exceptions");
-const node_crypto_provider_1 = require("../common/crypto/node-crypto-provider");
-const subtle_crypto_provider_1 = require("../common/crypto/subtle-crypto-provider");
 describe('Webhooks', () => {
     let payload;
     let secret;
@@ -166,55 +164,34 @@ describe('Webhooks', () => {
         });
     });
     describe('verifyHeader', () => {
-        it('returns true when the signature is valid', () => __awaiter(void 0, void 0, void 0, function* () {
-            const sigHeader = `t=${timestamp}, v1=${signatureHash}`;
-            const options = { payload, sigHeader, secret };
-            const result = yield workos.webhooks.verifyHeader(options);
-            expect(result).toBeTruthy();
+        it('aliases to the signature provider', () => __awaiter(void 0, void 0, void 0, function* () {
+            const spy = jest.spyOn(
+            // tslint:disable-next-line
+            workos.webhooks['signatureProvider'], 'verifyHeader');
+            yield workos.webhooks.verifyHeader({
+                payload,
+                sigHeader: `t=${timestamp}, v1=${signatureHash}`,
+                secret,
+            });
+            expect(spy).toHaveBeenCalled();
         }));
     });
-    describe('getTimestampAndSignatureHash', () => {
-        it('returns the timestamp and signature when the signature is valid', () => {
-            const sigHeader = `t=${timestamp}, v1=${signatureHash}`;
-            const timestampAndSignature = workos.webhooks.getTimestampAndSignatureHash(sigHeader);
-            expect(timestampAndSignature).toEqual([
-                timestamp.toString(),
-                signatureHash,
-            ]);
-        });
-    });
     describe('computeSignature', () => {
-        it('returns the computed signature', () => __awaiter(void 0, void 0, void 0, function* () {
-            const signature = yield workos.webhooks.computeSignature(timestamp, payload, secret);
-            expect(signature).toEqual(signatureHash);
+        it('aliases to the signature provider', () => __awaiter(void 0, void 0, void 0, function* () {
+            const spy = jest.spyOn(
+            // tslint:disable-next-line
+            workos.webhooks['signatureProvider'], 'computeSignature');
+            yield workos.webhooks.computeSignature(timestamp, payload, secret);
+            expect(spy).toHaveBeenCalled();
         }));
     });
-    describe('when in an environment that supports SubtleCrypto', () => {
-        it('automatically uses the subtle crypto library', () => {
+    describe('getTimestampAndSignatureHash', () => {
+        it('aliases to the signature provider', () => __awaiter(void 0, void 0, void 0, function* () {
+            const spy = jest.spyOn(
             // tslint:disable-next-line
-            expect(workos.webhooks['cryptoProvider']).toBeInstanceOf(subtle_crypto_provider_1.SubtleCryptoProvider);
-        });
-    });
-    describe('CryptoProvider', () => {
-        describe('when computing HMAC signature', () => {
-            it('returns the same for the Node crypto and Web Crypto versions', () => __awaiter(void 0, void 0, void 0, function* () {
-                const nodeCryptoProvider = new node_crypto_provider_1.NodeCryptoProvider();
-                const subtleCryptoProvider = new subtle_crypto_provider_1.SubtleCryptoProvider();
-                const stringifiedPayload = JSON.stringify(payload);
-                const payloadHMAC = `${timestamp}.${stringifiedPayload}`;
-                const nodeCompare = yield nodeCryptoProvider.computeHMACSignatureAsync(payloadHMAC, secret);
-                const subtleCompare = yield subtleCryptoProvider.computeHMACSignatureAsync(payloadHMAC, secret);
-                expect(nodeCompare).toEqual(subtleCompare);
-            }));
-        });
-        describe('when securely comparing', () => {
-            it('returns the same for the Node crypto and Web Crypto versions', () => __awaiter(void 0, void 0, void 0, function* () {
-                const nodeCryptoProvider = new node_crypto_provider_1.NodeCryptoProvider();
-                const subtleCryptoProvider = new subtle_crypto_provider_1.SubtleCryptoProvider();
-                const signature = yield workos.webhooks.computeSignature(timestamp, payload, secret);
-                expect(nodeCryptoProvider.secureCompare(signature, signatureHash)).toEqual(subtleCryptoProvider.secureCompare(signature, signatureHash));
-                expect(nodeCryptoProvider.secureCompare(signature, 'foo')).toEqual(subtleCryptoProvider.secureCompare(signature, 'foo'));
-            }));
-        });
+            workos.webhooks['signatureProvider'], 'getTimestampAndSignatureHash');
+            workos.webhooks.getTimestampAndSignatureHash(`t=${timestamp}, v1=${signatureHash}`);
+            expect(spy).toHaveBeenCalled();
+        }));
     });
 });

package/lib/workos.d.ts

@@ -14,12 +14,14 @@ import { FGA } from './fga/fga';
 import { HttpClient } from './common/net/http-client';
 import { IronSessionProvider } from './common/iron-session/iron-session-provider';
 import { Widgets } from './widgets/widgets';
+import { Actions } from './actions/actions';
 export declare class WorkOS {
     readonly key?: string | undefined;
     readonly options: WorkOSOptions;
     readonly baseURL: string;
     readonly client: HttpClient;
     readonly clientId?: string;
+    readonly actions: Actions;
     readonly auditLogs: AuditLogs;
     readonly directorySync: DirectorySync;
     readonly organizations: Organizations;
@@ -35,6 +37,7 @@ export declare class WorkOS {
     readonly widgets: Widgets;
     constructor(key?: string | undefined, options?: WorkOSOptions);
     createWebhookClient(): Webhooks;
+    createActionsClient(): Actions;
     createHttpClient(options: WorkOSOptions, userAgent: string): HttpClient;
     createIronSessionProvider(): IronSessionProvider;
     get version(): string;

package/lib/workos.js

@@ -28,7 +28,8 @@ const http_client_1 = require("./common/net/http-client");
 const subtle_crypto_provider_1 = require("./common/crypto/subtle-crypto-provider");
 const fetch_client_1 = require("./common/net/fetch-client");
 const widgets_1 = require("./widgets/widgets");
-const VERSION = '7.32.0';
+const actions_1 = require("./actions/actions");
+const VERSION = '7.33.1';
 const DEFAULT_HOSTNAME = 'api.workos.com';
 const HEADER_AUTHORIZATION = 'Authorization';
 const HEADER_IDEMPOTENCY_KEY = 'Idempotency-Key';
@@ -78,6 +79,7 @@ class WorkOS {
             userAgent += ` ${name}: ${version}`;
         }
         this.webhooks = this.createWebhookClient();
+        this.actions = this.createActionsClient();
         // Must initialize UserManagement after baseURL is configured
         this.userManagement = new user_management_1.UserManagement(this, this.createIronSessionProvider());
         this.client = this.createHttpClient(options, userAgent);
@@ -85,6 +87,9 @@ class WorkOS {
     createWebhookClient() {
         return new webhooks_1.Webhooks(new subtle_crypto_provider_1.SubtleCryptoProvider());
     }
+    createActionsClient() {
+        return new actions_1.Actions(new subtle_crypto_provider_1.SubtleCryptoProvider());
+    }
     createHttpClient(options, userAgent) {
         var _a;
         return new fetch_client_1.FetchHttpClient(this.baseURL, Object.assign(Object.assign({}, options.config), { headers: Object.assign(Object.assign({}, (_a = options.config) === null || _a === void 0 ? void 0 : _a.headers), { Authorization: `Bearer ${this.key}`, 'User-Agent': userAgent }) }));

package/lib/workos.spec.js

@@ -246,8 +246,12 @@ describe('WorkOS', () => {
             const workos = new index_worker_1.WorkOS('sk_test_key');
             // tslint:disable-next-line
             expect(workos['client']).toBeInstanceOf(fetch_client_1.FetchHttpClient);
+            expect(
             // tslint:disable-next-line
-            expect(workos.webhooks['cryptoProvider']).toBeInstanceOf(subtle_crypto_provider_1.SubtleCryptoProvider);
+            workos.webhooks['signatureProvider']['cryptoProvider']).toBeInstanceOf(subtle_crypto_provider_1.SubtleCryptoProvider);
+            expect(
+            // tslint:disable-next-line
+            workos.actions['signatureProvider']['cryptoProvider']).toBeInstanceOf(subtle_crypto_provider_1.SubtleCryptoProvider);
         });
         it('uses console.warn to emit warnings', () => {
             const workos = new index_worker_1.WorkOS('sk_test_key');

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "7.32.0",
+  "version": "7.33.1",
   "name": "@workos-inc/node",
   "author": "WorkOS",
   "description": "A Node wrapper for the WorkOS API",
@@ -72,4 +72,4 @@
       "default": "./lib/index.js"
     }
   }
-}
+}