@workos-inc/node 8.0.0-beta.2 → 8.0.0-beta.3

package/lib/cjs/user-management/serializers/send-invitation-options.serializer.cjs

@@ -0,0 +1,36 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var send_invitation_options_serializer_exports = {};
+__export(send_invitation_options_serializer_exports, {
+  serializeSendInvitationOptions: () => serializeSendInvitationOptions
+});
+module.exports = __toCommonJS(send_invitation_options_serializer_exports);
+const serializeSendInvitationOptions = /* @__PURE__ */ __name((options) => ({
+  email: options.email,
+  organization_id: options.organizationId,
+  expires_in_days: options.expiresInDays,
+  inviter_user_id: options.inviterUserId,
+  role_slug: options.roleSlug
+}), "serializeSendInvitationOptions");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  serializeSendInvitationOptions
+});
+//# sourceMappingURL=send-invitation-options.serializer.cjs.map

package/lib/cjs/user-management/serializers/send-invitation-options.serializer.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/user-management/serializers/send-invitation-options.serializer.ts"],"sourcesContent":["import {} from '../interfaces';\nimport {\n  SendInvitationOptions,\n  SerializedSendInvitationOptions,\n} from '../interfaces/send-invitation-options.interface';\n\nexport const serializeSendInvitationOptions = (\n  options: SendInvitationOptions,\n): SerializedSendInvitationOptions => ({\n  email: options.email,\n  organization_id: options.organizationId,\n  expires_in_days: options.expiresInDays,\n  inviter_user_id: options.inviterUserId,\n  role_slug: options.roleSlug,\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAMO,MAAM,iCAAiC,wBAC5C,aACqC;AAAA,EACrC,OAAO,QAAQ;AAAA,EACf,iBAAiB,QAAQ;AAAA,EACzB,iBAAiB,QAAQ;AAAA,EACzB,iBAAiB,QAAQ;AAAA,EACzB,WAAW,QAAQ;AACrB,IAR8C;","names":[]}

package/lib/cjs/user-management/serializers/send-invitation-options.serializer.d.cts

@@ -0,0 +1,5 @@
+import { SendInvitationOptions, SerializedSendInvitationOptions } from '../interfaces/send-invitation-options.interface.cjs';
+
+declare const serializeSendInvitationOptions: (options: SendInvitationOptions) => SerializedSendInvitationOptions;
+
+export { serializeSendInvitationOptions };

package/lib/cjs/user-management/serializers/session.serializer.cjs

@@ -0,0 +1,44 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var session_serializer_exports = {};
+__export(session_serializer_exports, {
+  deserializeSession: () => deserializeSession
+});
+module.exports = __toCommonJS(session_serializer_exports);
+const deserializeSession = /* @__PURE__ */ __name((session) => ({
+  object: "session",
+  id: session.id,
+  userId: session.user_id,
+  ipAddress: session.ip_address,
+  userAgent: session.user_agent,
+  organizationId: session.organization_id,
+  impersonator: session.impersonator,
+  authMethod: session.auth_method,
+  status: session.status,
+  expiresAt: session.expires_at,
+  endedAt: session.ended_at,
+  createdAt: session.created_at,
+  updatedAt: session.updated_at
+}), "deserializeSession");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  deserializeSession
+});
+//# sourceMappingURL=session.serializer.cjs.map

package/lib/cjs/user-management/serializers/session.serializer.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/user-management/serializers/session.serializer.ts"],"sourcesContent":["import { Session, SessionResponse } from '../interfaces';\n\nexport const deserializeSession = (session: SessionResponse): Session => ({\n  object: 'session',\n  id: session.id,\n  userId: session.user_id,\n  ipAddress: session.ip_address,\n  userAgent: session.user_agent,\n  organizationId: session.organization_id,\n  impersonator: session.impersonator,\n  authMethod: session.auth_method,\n  status: session.status,\n  expiresAt: session.expires_at,\n  endedAt: session.ended_at,\n  createdAt: session.created_at,\n  updatedAt: session.updated_at,\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAEO,MAAM,qBAAqB,wBAAC,aAAuC;AAAA,EACxE,QAAQ;AAAA,EACR,IAAI,QAAQ;AAAA,EACZ,QAAQ,QAAQ;AAAA,EAChB,WAAW,QAAQ;AAAA,EACnB,WAAW,QAAQ;AAAA,EACnB,gBAAgB,QAAQ;AAAA,EACxB,cAAc,QAAQ;AAAA,EACtB,YAAY,QAAQ;AAAA,EACpB,QAAQ,QAAQ;AAAA,EAChB,WAAW,QAAQ;AAAA,EACnB,SAAS,QAAQ;AAAA,EACjB,WAAW,QAAQ;AAAA,EACnB,WAAW,QAAQ;AACrB,IAdkC;","names":[]}

package/lib/cjs/user-management/serializers/session.serializer.d.cts

@@ -0,0 +1,6 @@
+import { SessionResponse, Session } from '../interfaces/session.interface.cjs';
+import '../interfaces/impersonator.interface.cjs';
+
+declare const deserializeSession: (session: SessionResponse) => Session;
+
+export { deserializeSession };

package/lib/cjs/user-management/serializers/update-organization-membership-options.serializer.cjs

@@ -0,0 +1,32 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var update_organization_membership_options_serializer_exports = {};
+__export(update_organization_membership_options_serializer_exports, {
+  serializeUpdateOrganizationMembershipOptions: () => serializeUpdateOrganizationMembershipOptions
+});
+module.exports = __toCommonJS(update_organization_membership_options_serializer_exports);
+const serializeUpdateOrganizationMembershipOptions = /* @__PURE__ */ __name((options) => ({
+  role_slug: options.roleSlug
+}), "serializeUpdateOrganizationMembershipOptions");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  serializeUpdateOrganizationMembershipOptions
+});
+//# sourceMappingURL=update-organization-membership-options.serializer.cjs.map

package/lib/cjs/user-management/serializers/update-organization-membership-options.serializer.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/user-management/serializers/update-organization-membership-options.serializer.ts"],"sourcesContent":["import {\n  UpdateOrganizationMembershipOptions,\n  SerializedUpdateOrganizationMembershipOptions,\n} from '../interfaces/update-organization-membership-options.interface';\n\nexport const serializeUpdateOrganizationMembershipOptions = (\n  options: UpdateOrganizationMembershipOptions,\n): SerializedUpdateOrganizationMembershipOptions => ({\n  role_slug: options.roleSlug,\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAKO,MAAM,+CAA+C,wBAC1D,aACmD;AAAA,EACnD,WAAW,QAAQ;AACrB,IAJ4D;","names":[]}

package/lib/cjs/user-management/serializers/update-organization-membership-options.serializer.d.cts

@@ -0,0 +1,5 @@
+import { UpdateOrganizationMembershipOptions, SerializedUpdateOrganizationMembershipOptions } from '../interfaces/update-organization-membership-options.interface.cjs';
+
+declare const serializeUpdateOrganizationMembershipOptions: (options: UpdateOrganizationMembershipOptions) => SerializedUpdateOrganizationMembershipOptions;
+
+export { serializeUpdateOrganizationMembershipOptions };

package/lib/cjs/user-management/serializers/update-user-options.serializer.cjs

@@ -0,0 +1,40 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var update_user_options_serializer_exports = {};
+__export(update_user_options_serializer_exports, {
+  serializeUpdateUserOptions: () => serializeUpdateUserOptions
+});
+module.exports = __toCommonJS(update_user_options_serializer_exports);
+const serializeUpdateUserOptions = /* @__PURE__ */ __name((options) => ({
+  email: options.email,
+  email_verified: options.emailVerified,
+  first_name: options.firstName,
+  last_name: options.lastName,
+  password: options.password,
+  password_hash: options.passwordHash,
+  password_hash_type: options.passwordHashType,
+  external_id: options.externalId,
+  metadata: options.metadata
+}), "serializeUpdateUserOptions");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  serializeUpdateUserOptions
+});
+//# sourceMappingURL=update-user-options.serializer.cjs.map

package/lib/cjs/user-management/serializers/update-user-options.serializer.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/user-management/serializers/update-user-options.serializer.ts"],"sourcesContent":["import { SerializedUpdateUserOptions, UpdateUserOptions } from '../interfaces';\n\nexport const serializeUpdateUserOptions = (\n  options: UpdateUserOptions,\n): SerializedUpdateUserOptions => ({\n  email: options.email,\n  email_verified: options.emailVerified,\n  first_name: options.firstName,\n  last_name: options.lastName,\n  password: options.password,\n  password_hash: options.passwordHash,\n  password_hash_type: options.passwordHashType,\n  external_id: options.externalId,\n  metadata: options.metadata,\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAEO,MAAM,6BAA6B,wBACxC,aACiC;AAAA,EACjC,OAAO,QAAQ;AAAA,EACf,gBAAgB,QAAQ;AAAA,EACxB,YAAY,QAAQ;AAAA,EACpB,WAAW,QAAQ;AAAA,EACnB,UAAU,QAAQ;AAAA,EAClB,eAAe,QAAQ;AAAA,EACvB,oBAAoB,QAAQ;AAAA,EAC5B,aAAa,QAAQ;AAAA,EACrB,UAAU,QAAQ;AACpB,IAZ0C;","names":[]}

package/lib/cjs/user-management/serializers/update-user-options.serializer.d.cts

@@ -0,0 +1,6 @@
+import { UpdateUserOptions, SerializedUpdateUserOptions } from '../interfaces/update-user-options.interface.cjs';
+import '../interfaces/password-hash-type.interface.cjs';
+
+declare const serializeUpdateUserOptions: (options: UpdateUserOptions) => SerializedUpdateUserOptions;
+
+export { serializeUpdateUserOptions };

package/lib/cjs/user-management/serializers/update-user-password-options.serializer.cjs

@@ -0,0 +1,32 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var update_user_password_options_serializer_exports = {};
+__export(update_user_password_options_serializer_exports, {
+  serializeUpdateUserPasswordOptions: () => serializeUpdateUserPasswordOptions
+});
+module.exports = __toCommonJS(update_user_password_options_serializer_exports);
+const serializeUpdateUserPasswordOptions = /* @__PURE__ */ __name((options) => ({
+  password: options.password
+}), "serializeUpdateUserPasswordOptions");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  serializeUpdateUserPasswordOptions
+});
+//# sourceMappingURL=update-user-password-options.serializer.cjs.map

package/lib/cjs/user-management/serializers/update-user-password-options.serializer.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/user-management/serializers/update-user-password-options.serializer.ts"],"sourcesContent":["import {\n  SerializedUpdateUserPasswordOptions,\n  UpdateUserPasswordOptions,\n} from '../interfaces';\n\nexport const serializeUpdateUserPasswordOptions = (\n  options: UpdateUserPasswordOptions,\n): SerializedUpdateUserPasswordOptions => ({\n  password: options.password,\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAKO,MAAM,qCAAqC,wBAChD,aACyC;AAAA,EACzC,UAAU,QAAQ;AACpB,IAJkD;","names":[]}

package/lib/cjs/user-management/serializers/update-user-password-options.serializer.d.cts

@@ -0,0 +1,5 @@
+import { UpdateUserPasswordOptions, SerializedUpdateUserPasswordOptions } from '../interfaces/update-user-password-options.interface.cjs';
+
+declare const serializeUpdateUserPasswordOptions: (options: UpdateUserPasswordOptions) => SerializedUpdateUserPasswordOptions;
+
+export { serializeUpdateUserPasswordOptions };

package/lib/cjs/user-management/serializers/user.serializer.cjs

@@ -0,0 +1,43 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var user_serializer_exports = {};
+__export(user_serializer_exports, {
+  deserializeUser: () => deserializeUser
+});
+module.exports = __toCommonJS(user_serializer_exports);
+const deserializeUser = /* @__PURE__ */ __name((user) => ({
+  object: user.object,
+  id: user.id,
+  email: user.email,
+  emailVerified: user.email_verified,
+  firstName: user.first_name,
+  profilePictureUrl: user.profile_picture_url,
+  lastName: user.last_name,
+  lastSignInAt: user.last_sign_in_at,
+  createdAt: user.created_at,
+  updatedAt: user.updated_at,
+  externalId: user.external_id ?? null,
+  metadata: user.metadata ?? {}
+}), "deserializeUser");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  deserializeUser
+});
+//# sourceMappingURL=user.serializer.cjs.map

package/lib/cjs/user-management/serializers/user.serializer.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/user-management/serializers/user.serializer.ts"],"sourcesContent":["import { User, UserResponse } from '../interfaces';\n\nexport const deserializeUser = (user: UserResponse): User => ({\n  object: user.object,\n  id: user.id,\n  email: user.email,\n  emailVerified: user.email_verified,\n  firstName: user.first_name,\n  profilePictureUrl: user.profile_picture_url,\n  lastName: user.last_name,\n  lastSignInAt: user.last_sign_in_at,\n  createdAt: user.created_at,\n  updatedAt: user.updated_at,\n  externalId: user.external_id ?? null,\n  metadata: user.metadata ?? {},\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAEO,MAAM,kBAAkB,wBAAC,UAA8B;AAAA,EAC5D,QAAQ,KAAK;AAAA,EACb,IAAI,KAAK;AAAA,EACT,OAAO,KAAK;AAAA,EACZ,eAAe,KAAK;AAAA,EACpB,WAAW,KAAK;AAAA,EAChB,mBAAmB,KAAK;AAAA,EACxB,UAAU,KAAK;AAAA,EACf,cAAc,KAAK;AAAA,EACnB,WAAW,KAAK;AAAA,EAChB,WAAW,KAAK;AAAA,EAChB,YAAY,KAAK,eAAe;AAAA,EAChC,UAAU,KAAK,YAAY,CAAC;AAC9B,IAb+B;","names":[]}

package/lib/cjs/user-management/serializers/user.serializer.d.cts

@@ -0,0 +1,5 @@
+import { UserResponse, User } from '../interfaces/user.interface.cjs';
+
+declare const deserializeUser: (user: UserResponse) => User;
+
+export { deserializeUser };

package/lib/cjs/user-management/session.cjs

@@ -0,0 +1,207 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var session_exports = {};
+__export(session_exports, {
+  CookieSession: () => CookieSession
+});
+module.exports = __toCommonJS(session_exports);
+var import_jose = require("jose");
+var import_oauth = require('../common/exceptions/oauth.exception.cjs');
+var import_interfaces = require('./interfaces/index.cjs');
+var import_iron_session = require("iron-session");
+class CookieSession {
+  static {
+    __name(this, "CookieSession");
+  }
+  jwks;
+  userManagement;
+  cookiePassword;
+  sessionData;
+  constructor(userManagement, sessionData, cookiePassword) {
+    if (!cookiePassword) {
+      throw new Error("cookiePassword is required");
+    }
+    this.userManagement = userManagement;
+    this.cookiePassword = cookiePassword;
+    this.sessionData = sessionData;
+    this.jwks = this.userManagement.jwks;
+  }
+  /**
+   * Authenticates a user with a session cookie.
+   *
+   * @returns An object indicating whether the authentication was successful or not. If successful, it will include the user's session data.
+   */
+  async authenticate() {
+    if (!this.sessionData) {
+      return {
+        authenticated: false,
+        reason: import_interfaces.AuthenticateWithSessionCookieFailureReason.NO_SESSION_COOKIE_PROVIDED
+      };
+    }
+    let session;
+    try {
+      session = await (0, import_iron_session.unsealData)(this.sessionData, {
+        password: this.cookiePassword
+      });
+    } catch (e) {
+      return {
+        authenticated: false,
+        reason: import_interfaces.AuthenticateWithSessionCookieFailureReason.INVALID_SESSION_COOKIE
+      };
+    }
+    if (!session.accessToken) {
+      return {
+        authenticated: false,
+        reason: import_interfaces.AuthenticateWithSessionCookieFailureReason.INVALID_SESSION_COOKIE
+      };
+    }
+    if (!await this.isValidJwt(session.accessToken)) {
+      return {
+        authenticated: false,
+        reason: import_interfaces.AuthenticateWithSessionCookieFailureReason.INVALID_JWT
+      };
+    }
+    const {
+      sid: sessionId,
+      org_id: organizationId,
+      role,
+      permissions,
+      entitlements,
+      feature_flags: featureFlags
+    } = (0, import_jose.decodeJwt)(session.accessToken);
+    return {
+      authenticated: true,
+      sessionId,
+      organizationId,
+      role,
+      permissions,
+      entitlements,
+      featureFlags,
+      user: session.user,
+      impersonator: session.impersonator,
+      accessToken: session.accessToken
+    };
+  }
+  /**
+   * Refreshes the user's session.
+   *
+   * @param options - Optional options for refreshing the session.
+   * @param options.cookiePassword - The password to use for the new session cookie.
+   * @param options.organizationId - The organization ID to use for the new session cookie.
+   * @returns An object indicating whether the refresh was successful or not. If successful, it will include the new sealed session data.
+   */
+  async refresh(options = {}) {
+    const session = await (0, import_iron_session.unsealData)(this.sessionData, {
+      password: this.cookiePassword
+    });
+    if (!session.refreshToken || !session.user) {
+      return {
+        authenticated: false,
+        reason: import_interfaces.RefreshSessionFailureReason.INVALID_SESSION_COOKIE
+      };
+    }
+    const { org_id: organizationIdFromAccessToken } = (0, import_jose.decodeJwt)(
+      session.accessToken
+    );
+    try {
+      const cookiePassword = options.cookiePassword ?? this.cookiePassword;
+      const authenticationResponse = await this.userManagement.authenticateWithRefreshToken({
+        clientId: this.userManagement.clientId,
+        refreshToken: session.refreshToken,
+        organizationId: options.organizationId ?? organizationIdFromAccessToken,
+        session: {
+          // We want to store the new sealed session in this class instance, so this always needs to be true
+          sealSession: true,
+          cookiePassword
+        }
+      });
+      if (options.cookiePassword) {
+        this.cookiePassword = options.cookiePassword;
+      }
+      this.sessionData = authenticationResponse.sealedSession;
+      const {
+        sid: sessionId,
+        org_id: organizationId,
+        role,
+        permissions,
+        entitlements,
+        feature_flags: featureFlags
+      } = (0, import_jose.decodeJwt)(authenticationResponse.accessToken);
+      return {
+        authenticated: true,
+        sealedSession: authenticationResponse.sealedSession,
+        session: authenticationResponse,
+        sessionId,
+        organizationId,
+        role,
+        permissions,
+        entitlements,
+        featureFlags,
+        user: session.user,
+        impersonator: session.impersonator
+      };
+    } catch (error) {
+      if (error instanceof import_oauth.OauthException && // TODO: Add additional known errors and remove re-throw
+      (error.error === import_interfaces.RefreshSessionFailureReason.INVALID_GRANT || error.error === import_interfaces.RefreshSessionFailureReason.MFA_ENROLLMENT || error.error === import_interfaces.RefreshSessionFailureReason.SSO_REQUIRED)) {
+        return {
+          authenticated: false,
+          reason: error.error
+        };
+      }
+      throw error;
+    }
+  }
+  /**
+   * Gets the URL to redirect the user to for logging out.
+   *
+   * @returns The URL to redirect the user to for logging out.
+   */
+  async getLogoutUrl({
+    returnTo
+  } = {}) {
+    const authenticationResponse = await this.authenticate();
+    if (!authenticationResponse.authenticated) {
+      const { reason } = authenticationResponse;
+      throw new Error(`Failed to extract session ID for logout URL: ${reason}`);
+    }
+    return this.userManagement.getLogoutUrl({
+      sessionId: authenticationResponse.sessionId,
+      returnTo
+    });
+  }
+  async isValidJwt(accessToken) {
+    if (!this.jwks) {
+      throw new Error(
+        "Missing client ID. Did you provide it when initializing WorkOS?"
+      );
+    }
+    try {
+      await (0, import_jose.jwtVerify)(accessToken, this.jwks);
+      return true;
+    } catch (e) {
+      return false;
+    }
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  CookieSession
+});
+//# sourceMappingURL=session.cjs.map

package/lib/cjs/user-management/session.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/user-management/session.ts"],"sourcesContent":["import { createRemoteJWKSet, decodeJwt, jwtVerify } from 'jose';\nimport { OauthException } from '../common/exceptions/oauth.exception';\nimport {\n  AccessToken,\n  AuthenticateWithSessionCookieFailedResponse,\n  AuthenticateWithSessionCookieFailureReason,\n  AuthenticateWithSessionCookieSuccessResponse,\n  AuthenticationResponse,\n  RefreshSessionFailureReason,\n  RefreshSessionResponse,\n  SessionCookieData,\n} from './interfaces';\nimport { UserManagement } from './user-management';\nimport { unsealData } from 'iron-session';\n\ntype RefreshOptions = {\n  cookiePassword?: string;\n  organizationId?: string;\n};\n\nexport class CookieSession {\n  private jwks: ReturnType<typeof createRemoteJWKSet> | undefined;\n  private userManagement: UserManagement;\n  private cookiePassword: string;\n  private sessionData: string;\n\n  constructor(\n    userManagement: UserManagement,\n    sessionData: string,\n    cookiePassword: string,\n  ) {\n    if (!cookiePassword) {\n      throw new Error('cookiePassword is required');\n    }\n\n    this.userManagement = userManagement;\n    this.cookiePassword = cookiePassword;\n    this.sessionData = sessionData;\n\n    this.jwks = this.userManagement.jwks;\n  }\n\n  /**\n   * Authenticates a user with a session cookie.\n   *\n   * @returns An object indicating whether the authentication was successful or not. If successful, it will include the user's session data.\n   */\n  async authenticate(): Promise<\n    | AuthenticateWithSessionCookieSuccessResponse\n    | AuthenticateWithSessionCookieFailedResponse\n  > {\n    if (!this.sessionData) {\n      return {\n        authenticated: false,\n        reason:\n          AuthenticateWithSessionCookieFailureReason.NO_SESSION_COOKIE_PROVIDED,\n      };\n    }\n\n    let session: SessionCookieData;\n\n    try {\n      session = await unsealData<SessionCookieData>(this.sessionData, {\n        password: this.cookiePassword,\n      });\n    } catch (e) {\n      return {\n        authenticated: false,\n        reason:\n          AuthenticateWithSessionCookieFailureReason.INVALID_SESSION_COOKIE,\n      };\n    }\n\n    if (!session.accessToken) {\n      return {\n        authenticated: false,\n        reason:\n          AuthenticateWithSessionCookieFailureReason.INVALID_SESSION_COOKIE,\n      };\n    }\n\n    if (!(await this.isValidJwt(session.accessToken))) {\n      return {\n        authenticated: false,\n        reason: AuthenticateWithSessionCookieFailureReason.INVALID_JWT,\n      };\n    }\n\n    const {\n      sid: sessionId,\n      org_id: organizationId,\n      role,\n      permissions,\n      entitlements,\n      feature_flags: featureFlags,\n    } = decodeJwt<AccessToken>(session.accessToken);\n\n    return {\n      authenticated: true,\n      sessionId,\n      organizationId,\n      role,\n      permissions,\n      entitlements,\n      featureFlags,\n      user: session.user,\n      impersonator: session.impersonator,\n      accessToken: session.accessToken,\n    };\n  }\n\n  /**\n   * Refreshes the user's session.\n   *\n   * @param options - Optional options for refreshing the session.\n   * @param options.cookiePassword - The password to use for the new session cookie.\n   * @param options.organizationId - The organization ID to use for the new session cookie.\n   * @returns An object indicating whether the refresh was successful or not. If successful, it will include the new sealed session data.\n   */\n  async refresh(options: RefreshOptions = {}): Promise<RefreshSessionResponse> {\n    const session = await unsealData<SessionCookieData>(this.sessionData, {\n      password: this.cookiePassword,\n    });\n\n    if (!session.refreshToken || !session.user) {\n      return {\n        authenticated: false,\n        reason: RefreshSessionFailureReason.INVALID_SESSION_COOKIE,\n      };\n    }\n\n    const { org_id: organizationIdFromAccessToken } = decodeJwt<AccessToken>(\n      session.accessToken,\n    );\n\n    try {\n      const cookiePassword = options.cookiePassword ?? this.cookiePassword;\n\n      const authenticationResponse =\n        await this.userManagement.authenticateWithRefreshToken({\n          clientId: this.userManagement.clientId as string,\n          refreshToken: session.refreshToken,\n          organizationId:\n            options.organizationId ?? organizationIdFromAccessToken,\n          session: {\n            // We want to store the new sealed session in this class instance, so this always needs to be true\n            sealSession: true,\n            cookiePassword,\n          },\n        });\n\n      // Update the password if a new one was provided\n      if (options.cookiePassword) {\n        this.cookiePassword = options.cookiePassword;\n      }\n\n      this.sessionData = authenticationResponse.sealedSession as string;\n\n      const {\n        sid: sessionId,\n        org_id: organizationId,\n        role,\n        permissions,\n        entitlements,\n        feature_flags: featureFlags,\n      } = decodeJwt<AccessToken>(authenticationResponse.accessToken);\n\n      // TODO: Returning `session` here means there's some duplicated data.\n      // Slim down the return type in a future major version.\n      return {\n        authenticated: true,\n        sealedSession: authenticationResponse.sealedSession,\n        session: authenticationResponse as AuthenticationResponse,\n        sessionId,\n        organizationId,\n        role,\n        permissions,\n        entitlements,\n        featureFlags,\n        user: session.user,\n        impersonator: session.impersonator,\n      };\n    } catch (error) {\n      if (\n        error instanceof OauthException &&\n        // TODO: Add additional known errors and remove re-throw\n        (error.error === RefreshSessionFailureReason.INVALID_GRANT ||\n          error.error === RefreshSessionFailureReason.MFA_ENROLLMENT ||\n          error.error === RefreshSessionFailureReason.SSO_REQUIRED)\n      ) {\n        return {\n          authenticated: false,\n          reason: error.error,\n        };\n      }\n\n      throw error;\n    }\n  }\n\n  /**\n   * Gets the URL to redirect the user to for logging out.\n   *\n   * @returns The URL to redirect the user to for logging out.\n   */\n  async getLogoutUrl({\n    returnTo,\n  }: { returnTo?: string } = {}): Promise<string> {\n    const authenticationResponse = await this.authenticate();\n\n    if (!authenticationResponse.authenticated) {\n      const { reason } = authenticationResponse;\n      throw new Error(`Failed to extract session ID for logout URL: ${reason}`);\n    }\n\n    return this.userManagement.getLogoutUrl({\n      sessionId: authenticationResponse.sessionId,\n      returnTo,\n    });\n  }\n\n  private async isValidJwt(accessToken: string): Promise<boolean> {\n    if (!this.jwks) {\n      throw new Error(\n        'Missing client ID. Did you provide it when initializing WorkOS?',\n      );\n    }\n\n    try {\n      await jwtVerify(accessToken, this.jwks);\n      return true;\n    } catch (e) {\n      return false;\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kBAAyD;AACzD,mBAA+B;AAC/B,wBASO;AAEP,0BAA2B;AAOpB,MAAM,cAAc;AAAA,EApB3B,OAoB2B;AAAA;AAAA;AAAA,EACjB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAER,YACE,gBACA,aACA,gBACA;AACA,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,MAAM,4BAA4B;AAAA,IAC9C;AAEA,SAAK,iBAAiB;AACtB,SAAK,iBAAiB;AACtB,SAAK,cAAc;AAEnB,SAAK,OAAO,KAAK,eAAe;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,eAGJ;AACA,QAAI,CAAC,KAAK,aAAa;AACrB,aAAO;AAAA,QACL,eAAe;AAAA,QACf,QACE,6DAA2C;AAAA,MAC/C;AAAA,IACF;AAEA,QAAI;AAEJ,QAAI;AACF,gBAAU,UAAM,gCAA8B,KAAK,aAAa;AAAA,QAC9D,UAAU,KAAK;AAAA,MACjB,CAAC;AAAA,IACH,SAAS,GAAG;AACV,aAAO;AAAA,QACL,eAAe;AAAA,QACf,QACE,6DAA2C;AAAA,MAC/C;AAAA,IACF;AAEA,QAAI,CAAC,QAAQ,aAAa;AACxB,aAAO;AAAA,QACL,eAAe;AAAA,QACf,QACE,6DAA2C;AAAA,MAC/C;AAAA,IACF;AAEA,QAAI,CAAE,MAAM,KAAK,WAAW,QAAQ,WAAW,GAAI;AACjD,aAAO;AAAA,QACL,eAAe;AAAA,QACf,QAAQ,6DAA2C;AAAA,MACrD;AAAA,IACF;AAEA,UAAM;AAAA,MACJ,KAAK;AAAA,MACL,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA,eAAe;AAAA,IACjB,QAAI,uBAAuB,QAAQ,WAAW;AAE9C,WAAO;AAAA,MACL,eAAe;AAAA,MACf;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,MAAM,QAAQ;AAAA,MACd,cAAc,QAAQ;AAAA,MACtB,aAAa,QAAQ;AAAA,IACvB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,QAAQ,UAA0B,CAAC,GAAoC;AAC3E,UAAM,UAAU,UAAM,gCAA8B,KAAK,aAAa;AAAA,MACpE,UAAU,KAAK;AAAA,IACjB,CAAC;AAED,QAAI,CAAC,QAAQ,gBAAgB,CAAC,QAAQ,MAAM;AAC1C,aAAO;AAAA,QACL,eAAe;AAAA,QACf,QAAQ,8CAA4B;AAAA,MACtC;AAAA,IACF;AAEA,UAAM,EAAE,QAAQ,8BAA8B,QAAI;AAAA,MAChD,QAAQ;AAAA,IACV;AAEA,QAAI;AACF,YAAM,iBAAiB,QAAQ,kBAAkB,KAAK;AAEtD,YAAM,yBACJ,MAAM,KAAK,eAAe,6BAA6B;AAAA,QACrD,UAAU,KAAK,eAAe;AAAA,QAC9B,cAAc,QAAQ;AAAA,QACtB,gBACE,QAAQ,kBAAkB;AAAA,QAC5B,SAAS;AAAA;AAAA,UAEP,aAAa;AAAA,UACb;AAAA,QACF;AAAA,MACF,CAAC;AAGH,UAAI,QAAQ,gBAAgB;AAC1B,aAAK,iBAAiB,QAAQ;AAAA,MAChC;AAEA,WAAK,cAAc,uBAAuB;AAE1C,YAAM;AAAA,QACJ,KAAK;AAAA,QACL,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA,eAAe;AAAA,MACjB,QAAI,uBAAuB,uBAAuB,WAAW;AAI7D,aAAO;AAAA,QACL,eAAe;AAAA,QACf,eAAe,uBAAuB;AAAA,QACtC,SAAS;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,MAAM,QAAQ;AAAA,QACd,cAAc,QAAQ;AAAA,MACxB;AAAA,IACF,SAAS,OAAO;AACd,UACE,iBAAiB;AAAA,OAEhB,MAAM,UAAU,8CAA4B,iBAC3C,MAAM,UAAU,8CAA4B,kBAC5C,MAAM,UAAU,8CAA4B,eAC9C;AACA,eAAO;AAAA,UACL,eAAe;AAAA,UACf,QAAQ,MAAM;AAAA,QAChB;AAAA,MACF;AAEA,YAAM;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,aAAa;AAAA,IACjB;AAAA,EACF,IAA2B,CAAC,GAAoB;AAC9C,UAAM,yBAAyB,MAAM,KAAK,aAAa;AAEvD,QAAI,CAAC,uBAAuB,eAAe;AACzC,YAAM,EAAE,OAAO,IAAI;AACnB,YAAM,IAAI,MAAM,gDAAgD,MAAM,EAAE;AAAA,IAC1E;AAEA,WAAO,KAAK,eAAe,aAAa;AAAA,MACtC,WAAW,uBAAuB;AAAA,MAClC;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,WAAW,aAAuC;AAC9D,QAAI,CAAC,KAAK,MAAM;AACd,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,gBAAM,uBAAU,aAAa,KAAK,IAAI;AACtC,aAAO;AAAA,IACT,SAAS,GAAG;AACV,aAAO;AAAA,IACT;AAAA,EACF;AACF;","names":[]}