@workos-inc/node 8.0.0-beta.2 → 8.0.0-beta.3

package/lib/esm/user-management/user-management.js

@@ -0,0 +1,669 @@
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+import { sealData, unsealData } from "iron-session";
+import { createRemoteJWKSet, decodeJwt, jwtVerify } from "jose";
+import qs from "qs";
+import { fetchAndDeserialize } from "../common/utils/fetch-and-deserialize.js";
+import { AutoPaginatable } from "../common/utils/pagination.js";
+import { getEnv } from "../common/utils/env.js";
+import { deserializeChallenge } from "../mfa/serializers/index.js";
+import {
+  AuthenticateWithSessionCookieFailureReason
+} from "./interfaces/authenticate-with-session-cookie.interface.js";
+import {
+  serializeRevokeSessionOptions
+} from "./interfaces/revoke-session-options.interface.js";
+import {
+  deserializeAuthenticationResponse,
+  deserializeEmailVerification,
+  deserializeFactorWithSecrets,
+  deserializeMagicAuth,
+  deserializePasswordReset,
+  deserializeSession,
+  deserializeUser,
+  serializeAuthenticateWithCodeAndVerifierOptions,
+  serializeAuthenticateWithCodeOptions,
+  serializeAuthenticateWithMagicAuthOptions,
+  serializeAuthenticateWithPasswordOptions,
+  serializeAuthenticateWithRefreshTokenOptions,
+  serializeAuthenticateWithTotpOptions,
+  serializeCreateMagicAuthOptions,
+  serializeCreatePasswordResetOptions,
+  serializeCreateUserOptions,
+  serializeEnrollAuthFactorOptions,
+  serializeListSessionsOptions,
+  serializeResetPasswordOptions,
+  serializeUpdateUserOptions
+} from "./serializers/index.js";
+import { serializeAuthenticateWithEmailVerificationOptions } from "./serializers/authenticate-with-email-verification.serializer.js";
+import { serializeAuthenticateWithOrganizationSelectionOptions } from "./serializers/authenticate-with-organization-selection-options.serializer.js";
+import { serializeCreateOrganizationMembershipOptions } from "./serializers/create-organization-membership-options.serializer.js";
+import { deserializeFactor } from "./serializers/factor.serializer.js";
+import { deserializeIdentities } from "./serializers/identity.serializer.js";
+import { deserializeInvitation } from "./serializers/invitation.serializer.js";
+import { serializeListInvitationsOptions } from "./serializers/list-invitations-options.serializer.js";
+import { serializeListOrganizationMembershipsOptions } from "./serializers/list-organization-memberships-options.serializer.js";
+import { serializeListUsersOptions } from "./serializers/list-users-options.serializer.js";
+import { deserializeOrganizationMembership } from "./serializers/organization-membership.serializer.js";
+import { serializeSendInvitationOptions } from "./serializers/send-invitation-options.serializer.js";
+import { serializeUpdateOrganizationMembershipOptions } from "./serializers/update-organization-membership-options.serializer.js";
+import { CookieSession } from "./session.js";
+const toQueryString = /* @__PURE__ */ __name((options) => {
+  return qs.stringify(options, {
+    arrayFormat: "repeat",
+    // sorts the keys alphabetically to maintain backwards compatibility
+    sort: /* @__PURE__ */ __name((a, b) => a.localeCompare(b), "sort"),
+    // encodes space as + instead of %20 to maintain backwards compatibility
+    format: "RFC1738"
+  });
+}, "toQueryString");
+class UserManagement {
+  constructor(workos) {
+    this.workos = workos;
+    const { clientId } = workos.options;
+    this.clientId = clientId;
+  }
+  static {
+    __name(this, "UserManagement");
+  }
+  _jwks;
+  clientId;
+  get jwks() {
+    if (!this.clientId) {
+      return;
+    }
+    this._jwks ??= createRemoteJWKSet(new URL(this.getJwksUrl(this.clientId)), {
+      cooldownDuration: 1e3 * 60 * 5
+    });
+    return this._jwks;
+  }
+  /**
+   * Loads a sealed session using the provided session data and cookie password.
+   *
+   * @param options - The options for loading the sealed session.
+   * @param options.sessionData - The sealed session data.
+   * @param options.cookiePassword - The password used to encrypt the session data.
+   * @returns The session class.
+   */
+  loadSealedSession(options) {
+    return new CookieSession(this, options.sessionData, options.cookiePassword);
+  }
+  async getUser(userId) {
+    const { data } = await this.workos.get(
+      `/user_management/users/${userId}`
+    );
+    return deserializeUser(data);
+  }
+  async getUserByExternalId(externalId) {
+    const { data } = await this.workos.get(
+      `/user_management/users/external_id/${externalId}`
+    );
+    return deserializeUser(data);
+  }
+  async listUsers(options) {
+    return new AutoPaginatable(
+      await fetchAndDeserialize(
+        this.workos,
+        "/user_management/users",
+        deserializeUser,
+        options ? serializeListUsersOptions(options) : void 0
+      ),
+      (params) => fetchAndDeserialize(
+        this.workos,
+        "/user_management/users",
+        deserializeUser,
+        params
+      ),
+      options ? serializeListUsersOptions(options) : void 0
+    );
+  }
+  async createUser(payload) {
+    const { data } = await this.workos.post("/user_management/users", serializeCreateUserOptions(payload));
+    return deserializeUser(data);
+  }
+  async authenticateWithMagicAuth(payload) {
+    const { session, ...remainingPayload } = payload;
+    const { data } = await this.workos.post(
+      "/user_management/authenticate",
+      serializeAuthenticateWithMagicAuthOptions({
+        ...remainingPayload,
+        clientSecret: this.workos.key
+      })
+    );
+    return this.prepareAuthenticationResponse({
+      authenticationResponse: deserializeAuthenticationResponse(data),
+      session
+    });
+  }
+  async authenticateWithPassword(payload) {
+    const { session, ...remainingPayload } = payload;
+    const { data } = await this.workos.post(
+      "/user_management/authenticate",
+      serializeAuthenticateWithPasswordOptions({
+        ...remainingPayload,
+        clientSecret: this.workos.key
+      })
+    );
+    return this.prepareAuthenticationResponse({
+      authenticationResponse: deserializeAuthenticationResponse(data),
+      session
+    });
+  }
+  async authenticateWithCode(payload) {
+    const { session, ...remainingPayload } = payload;
+    const { data } = await this.workos.post(
+      "/user_management/authenticate",
+      serializeAuthenticateWithCodeOptions({
+        ...remainingPayload,
+        clientSecret: this.workos.key
+      })
+    );
+    return this.prepareAuthenticationResponse({
+      authenticationResponse: deserializeAuthenticationResponse(data),
+      session
+    });
+  }
+  async authenticateWithCodeAndVerifier(payload) {
+    const { session, ...remainingPayload } = payload;
+    const { data } = await this.workos.post(
+      "/user_management/authenticate",
+      serializeAuthenticateWithCodeAndVerifierOptions(remainingPayload)
+    );
+    return this.prepareAuthenticationResponse({
+      authenticationResponse: deserializeAuthenticationResponse(data),
+      session
+    });
+  }
+  async authenticateWithRefreshToken(payload) {
+    const { session, ...remainingPayload } = payload;
+    const { data } = await this.workos.post(
+      "/user_management/authenticate",
+      serializeAuthenticateWithRefreshTokenOptions({
+        ...remainingPayload,
+        clientSecret: this.workos.key
+      })
+    );
+    return this.prepareAuthenticationResponse({
+      authenticationResponse: deserializeAuthenticationResponse(data),
+      session
+    });
+  }
+  async authenticateWithTotp(payload) {
+    const { session, ...remainingPayload } = payload;
+    const { data } = await this.workos.post(
+      "/user_management/authenticate",
+      serializeAuthenticateWithTotpOptions({
+        ...remainingPayload,
+        clientSecret: this.workos.key
+      })
+    );
+    return this.prepareAuthenticationResponse({
+      authenticationResponse: deserializeAuthenticationResponse(data),
+      session
+    });
+  }
+  async authenticateWithEmailVerification(payload) {
+    const { session, ...remainingPayload } = payload;
+    const { data } = await this.workos.post(
+      "/user_management/authenticate",
+      serializeAuthenticateWithEmailVerificationOptions({
+        ...remainingPayload,
+        clientSecret: this.workos.key
+      })
+    );
+    return this.prepareAuthenticationResponse({
+      authenticationResponse: deserializeAuthenticationResponse(data),
+      session
+    });
+  }
+  async authenticateWithOrganizationSelection(payload) {
+    const { session, ...remainingPayload } = payload;
+    const { data } = await this.workos.post(
+      "/user_management/authenticate",
+      serializeAuthenticateWithOrganizationSelectionOptions({
+        ...remainingPayload,
+        clientSecret: this.workos.key
+      })
+    );
+    return this.prepareAuthenticationResponse({
+      authenticationResponse: deserializeAuthenticationResponse(data),
+      session
+    });
+  }
+  async authenticateWithSessionCookie({
+    sessionData,
+    cookiePassword = getEnv("WORKOS_COOKIE_PASSWORD")
+  }) {
+    if (!cookiePassword) {
+      throw new Error("Cookie password is required");
+    }
+    if (!this.jwks) {
+      throw new Error("Must provide clientId to initialize JWKS");
+    }
+    if (!sessionData) {
+      return {
+        authenticated: false,
+        reason: AuthenticateWithSessionCookieFailureReason.NO_SESSION_COOKIE_PROVIDED
+      };
+    }
+    const session = await unsealData(sessionData, {
+      password: cookiePassword
+    });
+    if (!session.accessToken) {
+      return {
+        authenticated: false,
+        reason: AuthenticateWithSessionCookieFailureReason.INVALID_SESSION_COOKIE
+      };
+    }
+    if (!await this.isValidJwt(session.accessToken)) {
+      return {
+        authenticated: false,
+        reason: AuthenticateWithSessionCookieFailureReason.INVALID_JWT
+      };
+    }
+    const {
+      sid: sessionId,
+      org_id: organizationId,
+      role,
+      permissions,
+      entitlements,
+      feature_flags: featureFlags
+    } = decodeJwt(session.accessToken);
+    return {
+      authenticated: true,
+      sessionId,
+      organizationId,
+      role,
+      user: session.user,
+      permissions,
+      entitlements,
+      featureFlags,
+      accessToken: session.accessToken
+    };
+  }
+  async isValidJwt(accessToken) {
+    if (!this.jwks) {
+      throw new Error("Must provide clientId to initialize JWKS");
+    }
+    try {
+      await jwtVerify(accessToken, this.jwks);
+      return true;
+    } catch (e) {
+      return false;
+    }
+  }
+  async prepareAuthenticationResponse({
+    authenticationResponse,
+    session
+  }) {
+    if (session?.sealSession) {
+      return {
+        ...authenticationResponse,
+        sealedSession: await this.sealSessionDataFromAuthenticationResponse({
+          authenticationResponse,
+          cookiePassword: session.cookiePassword
+        })
+      };
+    }
+    return authenticationResponse;
+  }
+  async sealSessionDataFromAuthenticationResponse({
+    authenticationResponse,
+    cookiePassword
+  }) {
+    if (!cookiePassword) {
+      throw new Error("Cookie password is required");
+    }
+    const { org_id: organizationIdFromAccessToken } = decodeJwt(
+      authenticationResponse.accessToken
+    );
+    const sessionData = {
+      organizationId: organizationIdFromAccessToken,
+      user: authenticationResponse.user,
+      accessToken: authenticationResponse.accessToken,
+      refreshToken: authenticationResponse.refreshToken,
+      impersonator: authenticationResponse.impersonator
+    };
+    return sealData(sessionData, {
+      password: cookiePassword
+    });
+  }
+  async getSessionFromCookie({
+    sessionData,
+    cookiePassword = getEnv("WORKOS_COOKIE_PASSWORD")
+  }) {
+    if (!cookiePassword) {
+      throw new Error("Cookie password is required");
+    }
+    if (sessionData) {
+      return unsealData(sessionData, {
+        password: cookiePassword
+      });
+    }
+    return void 0;
+  }
+  async getEmailVerification(emailVerificationId) {
+    const { data } = await this.workos.get(
+      `/user_management/email_verification/${emailVerificationId}`
+    );
+    return deserializeEmailVerification(data);
+  }
+  async sendVerificationEmail({
+    userId
+  }) {
+    const { data } = await this.workos.post(
+      `/user_management/users/${userId}/email_verification/send`,
+      {}
+    );
+    return { user: deserializeUser(data.user) };
+  }
+  async getMagicAuth(magicAuthId) {
+    const { data } = await this.workos.get(
+      `/user_management/magic_auth/${magicAuthId}`
+    );
+    return deserializeMagicAuth(data);
+  }
+  async createMagicAuth(options) {
+    const { data } = await this.workos.post(
+      "/user_management/magic_auth",
+      serializeCreateMagicAuthOptions({
+        ...options
+      })
+    );
+    return deserializeMagicAuth(data);
+  }
+  async verifyEmail({
+    code,
+    userId
+  }) {
+    const { data } = await this.workos.post(`/user_management/users/${userId}/email_verification/confirm`, {
+      code
+    });
+    return { user: deserializeUser(data.user) };
+  }
+  async getPasswordReset(passwordResetId) {
+    const { data } = await this.workos.get(
+      `/user_management/password_reset/${passwordResetId}`
+    );
+    return deserializePasswordReset(data);
+  }
+  async createPasswordReset(options) {
+    const { data } = await this.workos.post(
+      "/user_management/password_reset",
+      serializeCreatePasswordResetOptions({
+        ...options
+      })
+    );
+    return deserializePasswordReset(data);
+  }
+  async resetPassword(payload) {
+    const { data } = await this.workos.post(
+      "/user_management/password_reset/confirm",
+      serializeResetPasswordOptions(payload)
+    );
+    return { user: deserializeUser(data.user) };
+  }
+  async updateUser(payload) {
+    const { data } = await this.workos.put(
+      `/user_management/users/${payload.userId}`,
+      serializeUpdateUserOptions(payload)
+    );
+    return deserializeUser(data);
+  }
+  async enrollAuthFactor(payload) {
+    const { data } = await this.workos.post(
+      `/user_management/users/${payload.userId}/auth_factors`,
+      serializeEnrollAuthFactorOptions(payload)
+    );
+    return {
+      authenticationFactor: deserializeFactorWithSecrets(
+        data.authentication_factor
+      ),
+      authenticationChallenge: deserializeChallenge(
+        data.authentication_challenge
+      )
+    };
+  }
+  async listAuthFactors(options) {
+    const { userId, ...restOfOptions } = options;
+    return new AutoPaginatable(
+      await fetchAndDeserialize(
+        this.workos,
+        `/user_management/users/${userId}/auth_factors`,
+        deserializeFactor,
+        restOfOptions
+      ),
+      (params) => fetchAndDeserialize(
+        this.workos,
+        `/user_management/users/${userId}/auth_factors`,
+        deserializeFactor,
+        params
+      ),
+      restOfOptions
+    );
+  }
+  async listSessions(userId, options) {
+    return new AutoPaginatable(
+      await fetchAndDeserialize(
+        this.workos,
+        `/user_management/users/${userId}/sessions`,
+        deserializeSession,
+        options ? serializeListSessionsOptions(options) : void 0
+      ),
+      (params) => fetchAndDeserialize(
+        this.workos,
+        `/user_management/users/${userId}/sessions`,
+        deserializeSession,
+        params
+      ),
+      options ? serializeListSessionsOptions(options) : void 0
+    );
+  }
+  async deleteUser(userId) {
+    await this.workos.delete(`/user_management/users/${userId}`);
+  }
+  async getUserIdentities(userId) {
+    if (!userId) {
+      throw new TypeError(`Incomplete arguments. Need to specify 'userId'.`);
+    }
+    const { data } = await this.workos.get(
+      `/user_management/users/${userId}/identities`
+    );
+    return deserializeIdentities(data);
+  }
+  async getOrganizationMembership(organizationMembershipId) {
+    const { data } = await this.workos.get(
+      `/user_management/organization_memberships/${organizationMembershipId}`
+    );
+    return deserializeOrganizationMembership(data);
+  }
+  async listOrganizationMemberships(options) {
+    const serializedOptions = serializeListOrganizationMembershipsOptions(options);
+    return new AutoPaginatable(
+      await fetchAndDeserialize(
+        this.workos,
+        "/user_management/organization_memberships",
+        deserializeOrganizationMembership,
+        serializedOptions
+      ),
+      (params) => fetchAndDeserialize(
+        this.workos,
+        "/user_management/organization_memberships",
+        deserializeOrganizationMembership,
+        params
+      ),
+      serializedOptions
+    );
+  }
+  async createOrganizationMembership(options) {
+    const { data } = await this.workos.post(
+      "/user_management/organization_memberships",
+      serializeCreateOrganizationMembershipOptions(options)
+    );
+    return deserializeOrganizationMembership(data);
+  }
+  async updateOrganizationMembership(organizationMembershipId, options) {
+    const { data } = await this.workos.put(
+      `/user_management/organization_memberships/${organizationMembershipId}`,
+      serializeUpdateOrganizationMembershipOptions(options)
+    );
+    return deserializeOrganizationMembership(data);
+  }
+  async deleteOrganizationMembership(organizationMembershipId) {
+    await this.workos.delete(
+      `/user_management/organization_memberships/${organizationMembershipId}`
+    );
+  }
+  async deactivateOrganizationMembership(organizationMembershipId) {
+    const { data } = await this.workos.put(
+      `/user_management/organization_memberships/${organizationMembershipId}/deactivate`,
+      {}
+    );
+    return deserializeOrganizationMembership(data);
+  }
+  async reactivateOrganizationMembership(organizationMembershipId) {
+    const { data } = await this.workos.put(
+      `/user_management/organization_memberships/${organizationMembershipId}/reactivate`,
+      {}
+    );
+    return deserializeOrganizationMembership(data);
+  }
+  async getInvitation(invitationId) {
+    const { data } = await this.workos.get(
+      `/user_management/invitations/${invitationId}`
+    );
+    return deserializeInvitation(data);
+  }
+  async findInvitationByToken(invitationToken) {
+    const { data } = await this.workos.get(
+      `/user_management/invitations/by_token/${invitationToken}`
+    );
+    return deserializeInvitation(data);
+  }
+  async listInvitations(options) {
+    return new AutoPaginatable(
+      await fetchAndDeserialize(
+        this.workos,
+        "/user_management/invitations",
+        deserializeInvitation,
+        options ? serializeListInvitationsOptions(options) : void 0
+      ),
+      (params) => fetchAndDeserialize(
+        this.workos,
+        "/user_management/invitations",
+        deserializeInvitation,
+        params
+      ),
+      options ? serializeListInvitationsOptions(options) : void 0
+    );
+  }
+  async sendInvitation(payload) {
+    const { data } = await this.workos.post(
+      "/user_management/invitations",
+      serializeSendInvitationOptions({
+        ...payload
+      })
+    );
+    return deserializeInvitation(data);
+  }
+  async acceptInvitation(invitationId) {
+    const { data } = await this.workos.post(
+      `/user_management/invitations/${invitationId}/accept`,
+      null
+    );
+    return deserializeInvitation(data);
+  }
+  async revokeInvitation(invitationId) {
+    const { data } = await this.workos.post(
+      `/user_management/invitations/${invitationId}/revoke`,
+      null
+    );
+    return deserializeInvitation(data);
+  }
+  async revokeSession(payload) {
+    await this.workos.post(
+      "/user_management/sessions/revoke",
+      serializeRevokeSessionOptions(payload)
+    );
+  }
+  getAuthorizationUrl({
+    connectionId,
+    codeChallenge,
+    codeChallengeMethod,
+    context,
+    clientId,
+    domainHint,
+    loginHint,
+    organizationId,
+    provider,
+    providerQueryParams,
+    providerScopes,
+    prompt,
+    redirectUri,
+    state,
+    screenHint
+  }) {
+    if (!provider && !connectionId && !organizationId) {
+      throw new TypeError(
+        `Incomplete arguments. Need to specify either a 'connectionId', 'organizationId', or 'provider'.`
+      );
+    }
+    if (provider !== "authkit" && screenHint) {
+      throw new TypeError(
+        `'screenHint' is only supported for 'authkit' provider`
+      );
+    }
+    if (context) {
+      this.workos.emitWarning(
+        `\`context\` is deprecated. We previously required initiate login endpoints to return the
+\`context\` query parameter when getting the authorization URL. This is no longer necessary.`
+      );
+    }
+    const query = toQueryString({
+      connection_id: connectionId,
+      code_challenge: codeChallenge,
+      code_challenge_method: codeChallengeMethod,
+      context,
+      organization_id: organizationId,
+      domain_hint: domainHint,
+      login_hint: loginHint,
+      provider,
+      provider_query_params: providerQueryParams,
+      provider_scopes: providerScopes,
+      prompt,
+      client_id: clientId,
+      redirect_uri: redirectUri,
+      response_type: "code",
+      state,
+      screen_hint: screenHint
+    });
+    return `${this.workos.baseURL}/user_management/authorize?${query}`;
+  }
+  getLogoutUrl({
+    sessionId,
+    returnTo
+  }) {
+    if (!sessionId) {
+      throw new TypeError(`Incomplete arguments. Need to specify 'sessionId'.`);
+    }
+    const url = new URL(
+      "/user_management/sessions/logout",
+      this.workos.baseURL
+    );
+    url.searchParams.set("session_id", sessionId);
+    if (returnTo) {
+      url.searchParams.set("return_to", returnTo);
+    }
+    return url.toString();
+  }
+  getJwksUrl(clientId) {
+    if (!clientId) {
+      throw TypeError("clientId must be a valid clientId");
+    }
+    return `${this.workos.baseURL}/sso/jwks/${clientId}`;
+  }
+}
+export {
+  UserManagement
+};
+//# sourceMappingURL=user-management.js.map