@workos-inc/node 8.0.0-beta.3 → 8.0.0-rc.1

package/lib/esm/user-management/interfaces/update-user-options.interface.d.ts

@@ -10,6 +10,7 @@ interface UpdateUserOptions {
     passwordHash?: string;
     passwordHashType?: PasswordHashType;
     externalId?: string;
+    locale?: string;
     metadata?: Record<string, string | null>;
 }
 interface SerializedUpdateUserOptions {
@@ -21,6 +22,7 @@ interface SerializedUpdateUserOptions {
     password_hash?: string;
     password_hash_type?: PasswordHashType;
     external_id?: string;
+    locale?: string;
     metadata?: Record<string, string | null>;
 }
 

package/lib/esm/user-management/interfaces/user.interface.d.ts

@@ -7,6 +7,7 @@ interface User {
     firstName: string | null;
     lastName: string | null;
     lastSignInAt: string | null;
+    locale: string | null;
     createdAt: string;
     updatedAt: string;
     externalId: string | null;
@@ -21,6 +22,7 @@ interface UserResponse {
     first_name: string | null;
     last_name: string | null;
     last_sign_in_at: string | null;
+    locale: string | null;
     created_at: string;
     updated_at: string;
     external_id?: string;

package/lib/esm/user-management/serializers/create-organization-membership-options.serializer.js

@@ -3,7 +3,8 @@ var __name = (target, value) => __defProp(target, "name", { value, configurable:
 const serializeCreateOrganizationMembershipOptions = /* @__PURE__ */ __name((options) => ({
   organization_id: options.organizationId,
   user_id: options.userId,
-  role_slug: options.roleSlug
+  role_slug: options.roleSlug,
+  role_slugs: options.roleSlugs
 }), "serializeCreateOrganizationMembershipOptions");
 export {
   serializeCreateOrganizationMembershipOptions

package/lib/esm/user-management/serializers/create-organization-membership-options.serializer.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/user-management/serializers/create-organization-membership-options.serializer.ts"],"sourcesContent":["import {\n  CreateOrganizationMembershipOptions,\n  SerializedCreateOrganizationMembershipOptions,\n} from '../interfaces/create-organization-membership-options.interface';\n\nexport const serializeCreateOrganizationMembershipOptions = (\n  options: CreateOrganizationMembershipOptions,\n): SerializedCreateOrganizationMembershipOptions => ({\n  organization_id: options.organizationId,\n  user_id: options.userId,\n  role_slug: options.roleSlug,\n});\n"],"mappings":";;AAKO,MAAM,+CAA+C,wBAC1D,aACmD;AAAA,EACnD,iBAAiB,QAAQ;AAAA,EACzB,SAAS,QAAQ;AAAA,EACjB,WAAW,QAAQ;AACrB,IAN4D;","names":[]}
+{"version":3,"sources":["../../../../src/user-management/serializers/create-organization-membership-options.serializer.ts"],"sourcesContent":["import {\n  CreateOrganizationMembershipOptions,\n  SerializedCreateOrganizationMembershipOptions,\n} from '../interfaces/create-organization-membership-options.interface';\n\nexport const serializeCreateOrganizationMembershipOptions = (\n  options: CreateOrganizationMembershipOptions,\n): SerializedCreateOrganizationMembershipOptions => ({\n  organization_id: options.organizationId,\n  user_id: options.userId,\n  role_slug: options.roleSlug,\n  role_slugs: options.roleSlugs,\n});\n"],"mappings":";;AAKO,MAAM,+CAA+C,wBAC1D,aACmD;AAAA,EACnD,iBAAiB,QAAQ;AAAA,EACzB,SAAS,QAAQ;AAAA,EACjB,WAAW,QAAQ;AAAA,EACnB,YAAY,QAAQ;AACtB,IAP4D;","names":[]}

package/lib/esm/user-management/serializers/organization-membership.serializer.js

@@ -9,7 +9,8 @@ const deserializeOrganizationMembership = /* @__PURE__ */ __name((organizationMe
   status: organizationMembership.status,
   createdAt: organizationMembership.created_at,
   updatedAt: organizationMembership.updated_at,
-  role: organizationMembership.role
+  role: organizationMembership.role,
+  ...organizationMembership.roles && { roles: organizationMembership.roles }
 }), "deserializeOrganizationMembership");
 export {
   deserializeOrganizationMembership

package/lib/esm/user-management/serializers/organization-membership.serializer.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/user-management/serializers/organization-membership.serializer.ts"],"sourcesContent":["import {\n  OrganizationMembership,\n  OrganizationMembershipResponse,\n} from '../interfaces/organization-membership.interface';\n\nexport const deserializeOrganizationMembership = (\n  organizationMembership: OrganizationMembershipResponse,\n): OrganizationMembership => ({\n  object: organizationMembership.object,\n  id: organizationMembership.id,\n  userId: organizationMembership.user_id,\n  organizationId: organizationMembership.organization_id,\n  organizationName: organizationMembership.organization_name,\n  status: organizationMembership.status,\n  createdAt: organizationMembership.created_at,\n  updatedAt: organizationMembership.updated_at,\n  role: organizationMembership.role,\n});\n"],"mappings":";;AAKO,MAAM,oCAAoC,wBAC/C,4BAC4B;AAAA,EAC5B,QAAQ,uBAAuB;AAAA,EAC/B,IAAI,uBAAuB;AAAA,EAC3B,QAAQ,uBAAuB;AAAA,EAC/B,gBAAgB,uBAAuB;AAAA,EACvC,kBAAkB,uBAAuB;AAAA,EACzC,QAAQ,uBAAuB;AAAA,EAC/B,WAAW,uBAAuB;AAAA,EAClC,WAAW,uBAAuB;AAAA,EAClC,MAAM,uBAAuB;AAC/B,IAZiD;","names":[]}
+{"version":3,"sources":["../../../../src/user-management/serializers/organization-membership.serializer.ts"],"sourcesContent":["import {\n  OrganizationMembership,\n  OrganizationMembershipResponse,\n} from '../interfaces/organization-membership.interface';\n\nexport const deserializeOrganizationMembership = (\n  organizationMembership: OrganizationMembershipResponse,\n): OrganizationMembership => ({\n  object: organizationMembership.object,\n  id: organizationMembership.id,\n  userId: organizationMembership.user_id,\n  organizationId: organizationMembership.organization_id,\n  organizationName: organizationMembership.organization_name,\n  status: organizationMembership.status,\n  createdAt: organizationMembership.created_at,\n  updatedAt: organizationMembership.updated_at,\n  role: organizationMembership.role,\n  ...(organizationMembership.roles && { roles: organizationMembership.roles }),\n});\n"],"mappings":";;AAKO,MAAM,oCAAoC,wBAC/C,4BAC4B;AAAA,EAC5B,QAAQ,uBAAuB;AAAA,EAC/B,IAAI,uBAAuB;AAAA,EAC3B,QAAQ,uBAAuB;AAAA,EAC/B,gBAAgB,uBAAuB;AAAA,EACvC,kBAAkB,uBAAuB;AAAA,EACzC,QAAQ,uBAAuB;AAAA,EAC/B,WAAW,uBAAuB;AAAA,EAClC,WAAW,uBAAuB;AAAA,EAClC,MAAM,uBAAuB;AAAA,EAC7B,GAAI,uBAAuB,SAAS,EAAE,OAAO,uBAAuB,MAAM;AAC5E,IAbiD;","names":[]}

package/lib/esm/user-management/serializers/update-organization-membership-options.serializer.js

@@ -1,7 +1,8 @@
 var __defProp = Object.defineProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 const serializeUpdateOrganizationMembershipOptions = /* @__PURE__ */ __name((options) => ({
-  role_slug: options.roleSlug
+  role_slug: options.roleSlug,
+  role_slugs: options.roleSlugs
 }), "serializeUpdateOrganizationMembershipOptions");
 export {
   serializeUpdateOrganizationMembershipOptions

package/lib/esm/user-management/serializers/update-organization-membership-options.serializer.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/user-management/serializers/update-organization-membership-options.serializer.ts"],"sourcesContent":["import {\n  UpdateOrganizationMembershipOptions,\n  SerializedUpdateOrganizationMembershipOptions,\n} from '../interfaces/update-organization-membership-options.interface';\n\nexport const serializeUpdateOrganizationMembershipOptions = (\n  options: UpdateOrganizationMembershipOptions,\n): SerializedUpdateOrganizationMembershipOptions => ({\n  role_slug: options.roleSlug,\n});\n"],"mappings":";;AAKO,MAAM,+CAA+C,wBAC1D,aACmD;AAAA,EACnD,WAAW,QAAQ;AACrB,IAJ4D;","names":[]}
+{"version":3,"sources":["../../../../src/user-management/serializers/update-organization-membership-options.serializer.ts"],"sourcesContent":["import {\n  UpdateOrganizationMembershipOptions,\n  SerializedUpdateOrganizationMembershipOptions,\n} from '../interfaces/update-organization-membership-options.interface';\n\nexport const serializeUpdateOrganizationMembershipOptions = (\n  options: UpdateOrganizationMembershipOptions,\n): SerializedUpdateOrganizationMembershipOptions => ({\n  role_slug: options.roleSlug,\n  role_slugs: options.roleSlugs,\n});\n"],"mappings":";;AAKO,MAAM,+CAA+C,wBAC1D,aACmD;AAAA,EACnD,WAAW,QAAQ;AAAA,EACnB,YAAY,QAAQ;AACtB,IAL4D;","names":[]}

package/lib/esm/user-management/serializers/update-user-options.serializer.js

@@ -9,6 +9,7 @@ const serializeUpdateUserOptions = /* @__PURE__ */ __name((options) => ({
   password_hash: options.passwordHash,
   password_hash_type: options.passwordHashType,
   external_id: options.externalId,
+  locale: options.locale,
   metadata: options.metadata
 }), "serializeUpdateUserOptions");
 export {

package/lib/esm/user-management/serializers/update-user-options.serializer.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/user-management/serializers/update-user-options.serializer.ts"],"sourcesContent":["import { SerializedUpdateUserOptions, UpdateUserOptions } from '../interfaces';\n\nexport const serializeUpdateUserOptions = (\n  options: UpdateUserOptions,\n): SerializedUpdateUserOptions => ({\n  email: options.email,\n  email_verified: options.emailVerified,\n  first_name: options.firstName,\n  last_name: options.lastName,\n  password: options.password,\n  password_hash: options.passwordHash,\n  password_hash_type: options.passwordHashType,\n  external_id: options.externalId,\n  metadata: options.metadata,\n});\n"],"mappings":";;AAEO,MAAM,6BAA6B,wBACxC,aACiC;AAAA,EACjC,OAAO,QAAQ;AAAA,EACf,gBAAgB,QAAQ;AAAA,EACxB,YAAY,QAAQ;AAAA,EACpB,WAAW,QAAQ;AAAA,EACnB,UAAU,QAAQ;AAAA,EAClB,eAAe,QAAQ;AAAA,EACvB,oBAAoB,QAAQ;AAAA,EAC5B,aAAa,QAAQ;AAAA,EACrB,UAAU,QAAQ;AACpB,IAZ0C;","names":[]}
+{"version":3,"sources":["../../../../src/user-management/serializers/update-user-options.serializer.ts"],"sourcesContent":["import { SerializedUpdateUserOptions, UpdateUserOptions } from '../interfaces';\n\nexport const serializeUpdateUserOptions = (\n  options: UpdateUserOptions,\n): SerializedUpdateUserOptions => ({\n  email: options.email,\n  email_verified: options.emailVerified,\n  first_name: options.firstName,\n  last_name: options.lastName,\n  password: options.password,\n  password_hash: options.passwordHash,\n  password_hash_type: options.passwordHashType,\n  external_id: options.externalId,\n  locale: options.locale,\n  metadata: options.metadata,\n});\n"],"mappings":";;AAEO,MAAM,6BAA6B,wBACxC,aACiC;AAAA,EACjC,OAAO,QAAQ;AAAA,EACf,gBAAgB,QAAQ;AAAA,EACxB,YAAY,QAAQ;AAAA,EACpB,WAAW,QAAQ;AAAA,EACnB,UAAU,QAAQ;AAAA,EAClB,eAAe,QAAQ;AAAA,EACvB,oBAAoB,QAAQ;AAAA,EAC5B,aAAa,QAAQ;AAAA,EACrB,QAAQ,QAAQ;AAAA,EAChB,UAAU,QAAQ;AACpB,IAb0C;","names":[]}

package/lib/esm/user-management/serializers/user.serializer.js

@@ -9,6 +9,7 @@ const deserializeUser = /* @__PURE__ */ __name((user) => ({
   profilePictureUrl: user.profile_picture_url,
   lastName: user.last_name,
   lastSignInAt: user.last_sign_in_at,
+  locale: user.locale,
   createdAt: user.created_at,
   updatedAt: user.updated_at,
   externalId: user.external_id ?? null,

package/lib/esm/user-management/serializers/user.serializer.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/user-management/serializers/user.serializer.ts"],"sourcesContent":["import { User, UserResponse } from '../interfaces';\n\nexport const deserializeUser = (user: UserResponse): User => ({\n  object: user.object,\n  id: user.id,\n  email: user.email,\n  emailVerified: user.email_verified,\n  firstName: user.first_name,\n  profilePictureUrl: user.profile_picture_url,\n  lastName: user.last_name,\n  lastSignInAt: user.last_sign_in_at,\n  createdAt: user.created_at,\n  updatedAt: user.updated_at,\n  externalId: user.external_id ?? null,\n  metadata: user.metadata ?? {},\n});\n"],"mappings":";;AAEO,MAAM,kBAAkB,wBAAC,UAA8B;AAAA,EAC5D,QAAQ,KAAK;AAAA,EACb,IAAI,KAAK;AAAA,EACT,OAAO,KAAK;AAAA,EACZ,eAAe,KAAK;AAAA,EACpB,WAAW,KAAK;AAAA,EAChB,mBAAmB,KAAK;AAAA,EACxB,UAAU,KAAK;AAAA,EACf,cAAc,KAAK;AAAA,EACnB,WAAW,KAAK;AAAA,EAChB,WAAW,KAAK;AAAA,EAChB,YAAY,KAAK,eAAe;AAAA,EAChC,UAAU,KAAK,YAAY,CAAC;AAC9B,IAb+B;","names":[]}
+{"version":3,"sources":["../../../../src/user-management/serializers/user.serializer.ts"],"sourcesContent":["import { User, UserResponse } from '../interfaces';\n\nexport const deserializeUser = (user: UserResponse): User => ({\n  object: user.object,\n  id: user.id,\n  email: user.email,\n  emailVerified: user.email_verified,\n  firstName: user.first_name,\n  profilePictureUrl: user.profile_picture_url,\n  lastName: user.last_name,\n  lastSignInAt: user.last_sign_in_at,\n  locale: user.locale,\n  createdAt: user.created_at,\n  updatedAt: user.updated_at,\n  externalId: user.external_id ?? null,\n  metadata: user.metadata ?? {},\n});\n"],"mappings":";;AAEO,MAAM,kBAAkB,wBAAC,UAA8B;AAAA,EAC5D,QAAQ,KAAK;AAAA,EACb,IAAI,KAAK;AAAA,EACT,OAAO,KAAK;AAAA,EACZ,eAAe,KAAK;AAAA,EACpB,WAAW,KAAK;AAAA,EAChB,mBAAmB,KAAK;AAAA,EACxB,UAAU,KAAK;AAAA,EACf,cAAc,KAAK;AAAA,EACnB,QAAQ,KAAK;AAAA,EACb,WAAW,KAAK;AAAA,EAChB,WAAW,KAAK;AAAA,EAChB,YAAY,KAAK,eAAe;AAAA,EAChC,UAAU,KAAK,YAAY,CAAC;AAC9B,IAd+B;","names":[]}

package/lib/esm/user-management/session.d.ts

@@ -1,6 +1,6 @@
 import './interfaces/authenticate-with-session-cookie.interface.js';
 import './interfaces/refresh-and-seal-session-data.interface.js';
-export { C as CookieSession } from '../workos-DGRMJ65Z.js';
+export { C as CookieSession } from '../workos-e5MfmByv.js';
 import './interfaces/authentication-response.interface.js';
 import './interfaces/impersonator.interface.js';
 import './interfaces/oauth-tokens.interface.js';
@@ -33,10 +33,10 @@ import '../common/utils/pagination.js';
 import '../common/interfaces/pagination-options.interface.js';
 import '../organizations/interfaces/create-organization-options.interface.js';
 import '../organizations/interfaces/domain-data.interface.js';
-import '../organizations/interfaces/feature-flag.interface.js';
 import '../organizations/interfaces/list-organization-feature-flags-options.interface.js';
 import '../organizations/interfaces/list-organizations-options.interface.js';
 import '../organizations/interfaces/update-organization-options.interface.js';
+import '../feature-flags/interfaces/feature-flag.interface.js';
 import '../organizations/interfaces/list-organization-roles-options.interface.js';
 import '../organization-domains/interfaces/create-organization-domain-options.interface.js';
 import '../passwordless/interfaces/passwordless-session.interface.js';
@@ -65,6 +65,7 @@ import '../audit-logs/interfaces/audit-log-export.interface.js';
 import '../audit-logs/interfaces/create-audit-log-event-options.interface.js';
 import '../audit-logs/interfaces/create-audit-log-schema-options.interface.js';
 import 'jose';
+import '../user-management-qKHMGyQi.js';
 import './interfaces/authenticate-with-code-options.interface.js';
 import './interfaces/authenticate-with-options-base.interface.js';
 import './interfaces/authenticate-with-code-and-verifier-options.interface.js';
@@ -87,6 +88,7 @@ import './interfaces/list-auth-factors-options.interface.js';
 import './interfaces/list-invitations-options.interface.js';
 import './interfaces/list-organization-memberships-options.interface.js';
 import './interfaces/list-sessions-options.interface.js';
+import './interfaces/list-user-feature-flags-options.interface.js';
 import './interfaces/list-users-options.interface.js';
 import './interfaces/reset-password-options.interface.js';
 import './interfaces/revoke-session-options.interface.js';

package/lib/esm/user-management/session.js

@@ -63,6 +63,7 @@ class CookieSession {
       sid: sessionId,
       org_id: organizationId,
       role,
+      roles,
       permissions,
       entitlements,
       feature_flags: featureFlags
@@ -72,6 +73,7 @@ class CookieSession {
       sessionId,
       organizationId,
       role,
+      roles,
       permissions,
       entitlements,
       featureFlags,
@@ -121,6 +123,7 @@ class CookieSession {
         sid: sessionId,
         org_id: organizationId,
         role,
+        roles,
         permissions,
         entitlements,
         feature_flags: featureFlags
@@ -132,6 +135,7 @@ class CookieSession {
         sessionId,
         organizationId,
         role,
+        roles,
         permissions,
         entitlements,
         featureFlags,

package/lib/esm/user-management/session.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/user-management/session.ts"],"sourcesContent":["import { createRemoteJWKSet, decodeJwt, jwtVerify } from 'jose';\nimport { OauthException } from '../common/exceptions/oauth.exception';\nimport {\n  AccessToken,\n  AuthenticateWithSessionCookieFailedResponse,\n  AuthenticateWithSessionCookieFailureReason,\n  AuthenticateWithSessionCookieSuccessResponse,\n  AuthenticationResponse,\n  RefreshSessionFailureReason,\n  RefreshSessionResponse,\n  SessionCookieData,\n} from './interfaces';\nimport { UserManagement } from './user-management';\nimport { unsealData } from 'iron-session';\n\ntype RefreshOptions = {\n  cookiePassword?: string;\n  organizationId?: string;\n};\n\nexport class CookieSession {\n  private jwks: ReturnType<typeof createRemoteJWKSet> | undefined;\n  private userManagement: UserManagement;\n  private cookiePassword: string;\n  private sessionData: string;\n\n  constructor(\n    userManagement: UserManagement,\n    sessionData: string,\n    cookiePassword: string,\n  ) {\n    if (!cookiePassword) {\n      throw new Error('cookiePassword is required');\n    }\n\n    this.userManagement = userManagement;\n    this.cookiePassword = cookiePassword;\n    this.sessionData = sessionData;\n\n    this.jwks = this.userManagement.jwks;\n  }\n\n  /**\n   * Authenticates a user with a session cookie.\n   *\n   * @returns An object indicating whether the authentication was successful or not. If successful, it will include the user's session data.\n   */\n  async authenticate(): Promise<\n    | AuthenticateWithSessionCookieSuccessResponse\n    | AuthenticateWithSessionCookieFailedResponse\n  > {\n    if (!this.sessionData) {\n      return {\n        authenticated: false,\n        reason:\n          AuthenticateWithSessionCookieFailureReason.NO_SESSION_COOKIE_PROVIDED,\n      };\n    }\n\n    let session: SessionCookieData;\n\n    try {\n      session = await unsealData<SessionCookieData>(this.sessionData, {\n        password: this.cookiePassword,\n      });\n    } catch (e) {\n      return {\n        authenticated: false,\n        reason:\n          AuthenticateWithSessionCookieFailureReason.INVALID_SESSION_COOKIE,\n      };\n    }\n\n    if (!session.accessToken) {\n      return {\n        authenticated: false,\n        reason:\n          AuthenticateWithSessionCookieFailureReason.INVALID_SESSION_COOKIE,\n      };\n    }\n\n    if (!(await this.isValidJwt(session.accessToken))) {\n      return {\n        authenticated: false,\n        reason: AuthenticateWithSessionCookieFailureReason.INVALID_JWT,\n      };\n    }\n\n    const {\n      sid: sessionId,\n      org_id: organizationId,\n      role,\n      permissions,\n      entitlements,\n      feature_flags: featureFlags,\n    } = decodeJwt<AccessToken>(session.accessToken);\n\n    return {\n      authenticated: true,\n      sessionId,\n      organizationId,\n      role,\n      permissions,\n      entitlements,\n      featureFlags,\n      user: session.user,\n      impersonator: session.impersonator,\n      accessToken: session.accessToken,\n    };\n  }\n\n  /**\n   * Refreshes the user's session.\n   *\n   * @param options - Optional options for refreshing the session.\n   * @param options.cookiePassword - The password to use for the new session cookie.\n   * @param options.organizationId - The organization ID to use for the new session cookie.\n   * @returns An object indicating whether the refresh was successful or not. If successful, it will include the new sealed session data.\n   */\n  async refresh(options: RefreshOptions = {}): Promise<RefreshSessionResponse> {\n    const session = await unsealData<SessionCookieData>(this.sessionData, {\n      password: this.cookiePassword,\n    });\n\n    if (!session.refreshToken || !session.user) {\n      return {\n        authenticated: false,\n        reason: RefreshSessionFailureReason.INVALID_SESSION_COOKIE,\n      };\n    }\n\n    const { org_id: organizationIdFromAccessToken } = decodeJwt<AccessToken>(\n      session.accessToken,\n    );\n\n    try {\n      const cookiePassword = options.cookiePassword ?? this.cookiePassword;\n\n      const authenticationResponse =\n        await this.userManagement.authenticateWithRefreshToken({\n          clientId: this.userManagement.clientId as string,\n          refreshToken: session.refreshToken,\n          organizationId:\n            options.organizationId ?? organizationIdFromAccessToken,\n          session: {\n            // We want to store the new sealed session in this class instance, so this always needs to be true\n            sealSession: true,\n            cookiePassword,\n          },\n        });\n\n      // Update the password if a new one was provided\n      if (options.cookiePassword) {\n        this.cookiePassword = options.cookiePassword;\n      }\n\n      this.sessionData = authenticationResponse.sealedSession as string;\n\n      const {\n        sid: sessionId,\n        org_id: organizationId,\n        role,\n        permissions,\n        entitlements,\n        feature_flags: featureFlags,\n      } = decodeJwt<AccessToken>(authenticationResponse.accessToken);\n\n      // TODO: Returning `session` here means there's some duplicated data.\n      // Slim down the return type in a future major version.\n      return {\n        authenticated: true,\n        sealedSession: authenticationResponse.sealedSession,\n        session: authenticationResponse as AuthenticationResponse,\n        sessionId,\n        organizationId,\n        role,\n        permissions,\n        entitlements,\n        featureFlags,\n        user: session.user,\n        impersonator: session.impersonator,\n      };\n    } catch (error) {\n      if (\n        error instanceof OauthException &&\n        // TODO: Add additional known errors and remove re-throw\n        (error.error === RefreshSessionFailureReason.INVALID_GRANT ||\n          error.error === RefreshSessionFailureReason.MFA_ENROLLMENT ||\n          error.error === RefreshSessionFailureReason.SSO_REQUIRED)\n      ) {\n        return {\n          authenticated: false,\n          reason: error.error,\n        };\n      }\n\n      throw error;\n    }\n  }\n\n  /**\n   * Gets the URL to redirect the user to for logging out.\n   *\n   * @returns The URL to redirect the user to for logging out.\n   */\n  async getLogoutUrl({\n    returnTo,\n  }: { returnTo?: string } = {}): Promise<string> {\n    const authenticationResponse = await this.authenticate();\n\n    if (!authenticationResponse.authenticated) {\n      const { reason } = authenticationResponse;\n      throw new Error(`Failed to extract session ID for logout URL: ${reason}`);\n    }\n\n    return this.userManagement.getLogoutUrl({\n      sessionId: authenticationResponse.sessionId,\n      returnTo,\n    });\n  }\n\n  private async isValidJwt(accessToken: string): Promise<boolean> {\n    if (!this.jwks) {\n      throw new Error(\n        'Missing client ID. Did you provide it when initializing WorkOS?',\n      );\n    }\n\n    try {\n      await jwtVerify(accessToken, this.jwks);\n      return true;\n    } catch (e) {\n      return false;\n    }\n  }\n}\n"],"mappings":";;AAAA,SAA6B,WAAW,iBAAiB;AACzD,SAAS,sBAAsB;AAC/B;AAAA,EAGE;AAAA,EAGA;AAAA,OAGK;AAEP,SAAS,kBAAkB;AAOpB,MAAM,cAAc;AAAA,EApB3B,OAoB2B;AAAA;AAAA;AAAA,EACjB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAER,YACE,gBACA,aACA,gBACA;AACA,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,MAAM,4BAA4B;AAAA,IAC9C;AAEA,SAAK,iBAAiB;AACtB,SAAK,iBAAiB;AACtB,SAAK,cAAc;AAEnB,SAAK,OAAO,KAAK,eAAe;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,eAGJ;AACA,QAAI,CAAC,KAAK,aAAa;AACrB,aAAO;AAAA,QACL,eAAe;AAAA,QACf,QACE,2CAA2C;AAAA,MAC/C;AAAA,IACF;AAEA,QAAI;AAEJ,QAAI;AACF,gBAAU,MAAM,WAA8B,KAAK,aAAa;AAAA,QAC9D,UAAU,KAAK;AAAA,MACjB,CAAC;AAAA,IACH,SAAS,GAAG;AACV,aAAO;AAAA,QACL,eAAe;AAAA,QACf,QACE,2CAA2C;AAAA,MAC/C;AAAA,IACF;AAEA,QAAI,CAAC,QAAQ,aAAa;AACxB,aAAO;AAAA,QACL,eAAe;AAAA,QACf,QACE,2CAA2C;AAAA,MAC/C;AAAA,IACF;AAEA,QAAI,CAAE,MAAM,KAAK,WAAW,QAAQ,WAAW,GAAI;AACjD,aAAO;AAAA,QACL,eAAe;AAAA,QACf,QAAQ,2CAA2C;AAAA,MACrD;AAAA,IACF;AAEA,UAAM;AAAA,MACJ,KAAK;AAAA,MACL,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA,eAAe;AAAA,IACjB,IAAI,UAAuB,QAAQ,WAAW;AAE9C,WAAO;AAAA,MACL,eAAe;AAAA,MACf;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,MAAM,QAAQ;AAAA,MACd,cAAc,QAAQ;AAAA,MACtB,aAAa,QAAQ;AAAA,IACvB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,QAAQ,UAA0B,CAAC,GAAoC;AAC3E,UAAM,UAAU,MAAM,WAA8B,KAAK,aAAa;AAAA,MACpE,UAAU,KAAK;AAAA,IACjB,CAAC;AAED,QAAI,CAAC,QAAQ,gBAAgB,CAAC,QAAQ,MAAM;AAC1C,aAAO;AAAA,QACL,eAAe;AAAA,QACf,QAAQ,4BAA4B;AAAA,MACtC;AAAA,IACF;AAEA,UAAM,EAAE,QAAQ,8BAA8B,IAAI;AAAA,MAChD,QAAQ;AAAA,IACV;AAEA,QAAI;AACF,YAAM,iBAAiB,QAAQ,kBAAkB,KAAK;AAEtD,YAAM,yBACJ,MAAM,KAAK,eAAe,6BAA6B;AAAA,QACrD,UAAU,KAAK,eAAe;AAAA,QAC9B,cAAc,QAAQ;AAAA,QACtB,gBACE,QAAQ,kBAAkB;AAAA,QAC5B,SAAS;AAAA;AAAA,UAEP,aAAa;AAAA,UACb;AAAA,QACF;AAAA,MACF,CAAC;AAGH,UAAI,QAAQ,gBAAgB;AAC1B,aAAK,iBAAiB,QAAQ;AAAA,MAChC;AAEA,WAAK,cAAc,uBAAuB;AAE1C,YAAM;AAAA,QACJ,KAAK;AAAA,QACL,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA,eAAe;AAAA,MACjB,IAAI,UAAuB,uBAAuB,WAAW;AAI7D,aAAO;AAAA,QACL,eAAe;AAAA,QACf,eAAe,uBAAuB;AAAA,QACtC,SAAS;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,MAAM,QAAQ;AAAA,QACd,cAAc,QAAQ;AAAA,MACxB;AAAA,IACF,SAAS,OAAO;AACd,UACE,iBAAiB;AAAA,OAEhB,MAAM,UAAU,4BAA4B,iBAC3C,MAAM,UAAU,4BAA4B,kBAC5C,MAAM,UAAU,4BAA4B,eAC9C;AACA,eAAO;AAAA,UACL,eAAe;AAAA,UACf,QAAQ,MAAM;AAAA,QAChB;AAAA,MACF;AAEA,YAAM;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,aAAa;AAAA,IACjB;AAAA,EACF,IAA2B,CAAC,GAAoB;AAC9C,UAAM,yBAAyB,MAAM,KAAK,aAAa;AAEvD,QAAI,CAAC,uBAAuB,eAAe;AACzC,YAAM,EAAE,OAAO,IAAI;AACnB,YAAM,IAAI,MAAM,gDAAgD,MAAM,EAAE;AAAA,IAC1E;AAEA,WAAO,KAAK,eAAe,aAAa;AAAA,MACtC,WAAW,uBAAuB;AAAA,MAClC;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,WAAW,aAAuC;AAC9D,QAAI,CAAC,KAAK,MAAM;AACd,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,YAAM,UAAU,aAAa,KAAK,IAAI;AACtC,aAAO;AAAA,IACT,SAAS,GAAG;AACV,aAAO;AAAA,IACT;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../../src/user-management/session.ts"],"sourcesContent":["import { createRemoteJWKSet, decodeJwt, jwtVerify } from 'jose';\nimport { OauthException } from '../common/exceptions/oauth.exception';\nimport {\n  AccessToken,\n  AuthenticateWithSessionCookieFailedResponse,\n  AuthenticateWithSessionCookieFailureReason,\n  AuthenticateWithSessionCookieSuccessResponse,\n  AuthenticationResponse,\n  RefreshSessionFailureReason,\n  RefreshSessionResponse,\n  SessionCookieData,\n} from './interfaces';\nimport { UserManagement } from './user-management';\nimport { unsealData } from 'iron-session';\n\ntype RefreshOptions = {\n  cookiePassword?: string;\n  organizationId?: string;\n};\n\nexport class CookieSession {\n  private jwks: ReturnType<typeof createRemoteJWKSet> | undefined;\n  private userManagement: UserManagement;\n  private cookiePassword: string;\n  private sessionData: string;\n\n  constructor(\n    userManagement: UserManagement,\n    sessionData: string,\n    cookiePassword: string,\n  ) {\n    if (!cookiePassword) {\n      throw new Error('cookiePassword is required');\n    }\n\n    this.userManagement = userManagement;\n    this.cookiePassword = cookiePassword;\n    this.sessionData = sessionData;\n\n    this.jwks = this.userManagement.jwks;\n  }\n\n  /**\n   * Authenticates a user with a session cookie.\n   *\n   * @returns An object indicating whether the authentication was successful or not. If successful, it will include the user's session data.\n   */\n  async authenticate(): Promise<\n    | AuthenticateWithSessionCookieSuccessResponse\n    | AuthenticateWithSessionCookieFailedResponse\n  > {\n    if (!this.sessionData) {\n      return {\n        authenticated: false,\n        reason:\n          AuthenticateWithSessionCookieFailureReason.NO_SESSION_COOKIE_PROVIDED,\n      };\n    }\n\n    let session: SessionCookieData;\n\n    try {\n      session = await unsealData<SessionCookieData>(this.sessionData, {\n        password: this.cookiePassword,\n      });\n    } catch (e) {\n      return {\n        authenticated: false,\n        reason:\n          AuthenticateWithSessionCookieFailureReason.INVALID_SESSION_COOKIE,\n      };\n    }\n\n    if (!session.accessToken) {\n      return {\n        authenticated: false,\n        reason:\n          AuthenticateWithSessionCookieFailureReason.INVALID_SESSION_COOKIE,\n      };\n    }\n\n    if (!(await this.isValidJwt(session.accessToken))) {\n      return {\n        authenticated: false,\n        reason: AuthenticateWithSessionCookieFailureReason.INVALID_JWT,\n      };\n    }\n\n    const {\n      sid: sessionId,\n      org_id: organizationId,\n      role,\n      roles,\n      permissions,\n      entitlements,\n      feature_flags: featureFlags,\n    } = decodeJwt<AccessToken>(session.accessToken);\n\n    return {\n      authenticated: true,\n      sessionId,\n      organizationId,\n      role,\n      roles,\n      permissions,\n      entitlements,\n      featureFlags,\n      user: session.user,\n      impersonator: session.impersonator,\n      accessToken: session.accessToken,\n    };\n  }\n\n  /**\n   * Refreshes the user's session.\n   *\n   * @param options - Optional options for refreshing the session.\n   * @param options.cookiePassword - The password to use for the new session cookie.\n   * @param options.organizationId - The organization ID to use for the new session cookie.\n   * @returns An object indicating whether the refresh was successful or not. If successful, it will include the new sealed session data.\n   */\n  async refresh(options: RefreshOptions = {}): Promise<RefreshSessionResponse> {\n    const session = await unsealData<SessionCookieData>(this.sessionData, {\n      password: this.cookiePassword,\n    });\n\n    if (!session.refreshToken || !session.user) {\n      return {\n        authenticated: false,\n        reason: RefreshSessionFailureReason.INVALID_SESSION_COOKIE,\n      };\n    }\n\n    const { org_id: organizationIdFromAccessToken } = decodeJwt<AccessToken>(\n      session.accessToken,\n    );\n\n    try {\n      const cookiePassword = options.cookiePassword ?? this.cookiePassword;\n\n      const authenticationResponse =\n        await this.userManagement.authenticateWithRefreshToken({\n          clientId: this.userManagement.clientId as string,\n          refreshToken: session.refreshToken,\n          organizationId:\n            options.organizationId ?? organizationIdFromAccessToken,\n          session: {\n            // We want to store the new sealed session in this class instance, so this always needs to be true\n            sealSession: true,\n            cookiePassword,\n          },\n        });\n\n      // Update the password if a new one was provided\n      if (options.cookiePassword) {\n        this.cookiePassword = options.cookiePassword;\n      }\n\n      this.sessionData = authenticationResponse.sealedSession as string;\n\n      const {\n        sid: sessionId,\n        org_id: organizationId,\n        role,\n        roles,\n        permissions,\n        entitlements,\n        feature_flags: featureFlags,\n      } = decodeJwt<AccessToken>(authenticationResponse.accessToken);\n\n      // TODO: Returning `session` here means there's some duplicated data.\n      // Slim down the return type in a future major version.\n      return {\n        authenticated: true,\n        sealedSession: authenticationResponse.sealedSession,\n        session: authenticationResponse as AuthenticationResponse,\n        sessionId,\n        organizationId,\n        role,\n        roles,\n        permissions,\n        entitlements,\n        featureFlags,\n        user: session.user,\n        impersonator: session.impersonator,\n      };\n    } catch (error) {\n      if (\n        error instanceof OauthException &&\n        // TODO: Add additional known errors and remove re-throw\n        (error.error === RefreshSessionFailureReason.INVALID_GRANT ||\n          error.error === RefreshSessionFailureReason.MFA_ENROLLMENT ||\n          error.error === RefreshSessionFailureReason.SSO_REQUIRED)\n      ) {\n        return {\n          authenticated: false,\n          reason: error.error,\n        };\n      }\n\n      throw error;\n    }\n  }\n\n  /**\n   * Gets the URL to redirect the user to for logging out.\n   *\n   * @returns The URL to redirect the user to for logging out.\n   */\n  async getLogoutUrl({\n    returnTo,\n  }: { returnTo?: string } = {}): Promise<string> {\n    const authenticationResponse = await this.authenticate();\n\n    if (!authenticationResponse.authenticated) {\n      const { reason } = authenticationResponse;\n      throw new Error(`Failed to extract session ID for logout URL: ${reason}`);\n    }\n\n    return this.userManagement.getLogoutUrl({\n      sessionId: authenticationResponse.sessionId,\n      returnTo,\n    });\n  }\n\n  private async isValidJwt(accessToken: string): Promise<boolean> {\n    if (!this.jwks) {\n      throw new Error(\n        'Missing client ID. Did you provide it when initializing WorkOS?',\n      );\n    }\n\n    try {\n      await jwtVerify(accessToken, this.jwks);\n      return true;\n    } catch (e) {\n      return false;\n    }\n  }\n}\n"],"mappings":";;AAAA,SAA6B,WAAW,iBAAiB;AACzD,SAAS,sBAAsB;AAC/B;AAAA,EAGE;AAAA,EAGA;AAAA,OAGK;AAEP,SAAS,kBAAkB;AAOpB,MAAM,cAAc;AAAA,EApB3B,OAoB2B;AAAA;AAAA;AAAA,EACjB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAER,YACE,gBACA,aACA,gBACA;AACA,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,MAAM,4BAA4B;AAAA,IAC9C;AAEA,SAAK,iBAAiB;AACtB,SAAK,iBAAiB;AACtB,SAAK,cAAc;AAEnB,SAAK,OAAO,KAAK,eAAe;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,eAGJ;AACA,QAAI,CAAC,KAAK,aAAa;AACrB,aAAO;AAAA,QACL,eAAe;AAAA,QACf,QACE,2CAA2C;AAAA,MAC/C;AAAA,IACF;AAEA,QAAI;AAEJ,QAAI;AACF,gBAAU,MAAM,WAA8B,KAAK,aAAa;AAAA,QAC9D,UAAU,KAAK;AAAA,MACjB,CAAC;AAAA,IACH,SAAS,GAAG;AACV,aAAO;AAAA,QACL,eAAe;AAAA,QACf,QACE,2CAA2C;AAAA,MAC/C;AAAA,IACF;AAEA,QAAI,CAAC,QAAQ,aAAa;AACxB,aAAO;AAAA,QACL,eAAe;AAAA,QACf,QACE,2CAA2C;AAAA,MAC/C;AAAA,IACF;AAEA,QAAI,CAAE,MAAM,KAAK,WAAW,QAAQ,WAAW,GAAI;AACjD,aAAO;AAAA,QACL,eAAe;AAAA,QACf,QAAQ,2CAA2C;AAAA,MACrD;AAAA,IACF;AAEA,UAAM;AAAA,MACJ,KAAK;AAAA,MACL,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,eAAe;AAAA,IACjB,IAAI,UAAuB,QAAQ,WAAW;AAE9C,WAAO;AAAA,MACL,eAAe;AAAA,MACf;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,MAAM,QAAQ;AAAA,MACd,cAAc,QAAQ;AAAA,MACtB,aAAa,QAAQ;AAAA,IACvB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,QAAQ,UAA0B,CAAC,GAAoC;AAC3E,UAAM,UAAU,MAAM,WAA8B,KAAK,aAAa;AAAA,MACpE,UAAU,KAAK;AAAA,IACjB,CAAC;AAED,QAAI,CAAC,QAAQ,gBAAgB,CAAC,QAAQ,MAAM;AAC1C,aAAO;AAAA,QACL,eAAe;AAAA,QACf,QAAQ,4BAA4B;AAAA,MACtC;AAAA,IACF;AAEA,UAAM,EAAE,QAAQ,8BAA8B,IAAI;AAAA,MAChD,QAAQ;AAAA,IACV;AAEA,QAAI;AACF,YAAM,iBAAiB,QAAQ,kBAAkB,KAAK;AAEtD,YAAM,yBACJ,MAAM,KAAK,eAAe,6BAA6B;AAAA,QACrD,UAAU,KAAK,eAAe;AAAA,QAC9B,cAAc,QAAQ;AAAA,QACtB,gBACE,QAAQ,kBAAkB;AAAA,QAC5B,SAAS;AAAA;AAAA,UAEP,aAAa;AAAA,UACb;AAAA,QACF;AAAA,MACF,CAAC;AAGH,UAAI,QAAQ,gBAAgB;AAC1B,aAAK,iBAAiB,QAAQ;AAAA,MAChC;AAEA,WAAK,cAAc,uBAAuB;AAE1C,YAAM;AAAA,QACJ,KAAK;AAAA,QACL,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,eAAe;AAAA,MACjB,IAAI,UAAuB,uBAAuB,WAAW;AAI7D,aAAO;AAAA,QACL,eAAe;AAAA,QACf,eAAe,uBAAuB;AAAA,QACtC,SAAS;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,MAAM,QAAQ;AAAA,QACd,cAAc,QAAQ;AAAA,MACxB;AAAA,IACF,SAAS,OAAO;AACd,UACE,iBAAiB;AAAA,OAEhB,MAAM,UAAU,4BAA4B,iBAC3C,MAAM,UAAU,4BAA4B,kBAC5C,MAAM,UAAU,4BAA4B,eAC9C;AACA,eAAO;AAAA,UACL,eAAe;AAAA,UACf,QAAQ,MAAM;AAAA,QAChB;AAAA,MACF;AAEA,YAAM;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,aAAa;AAAA,IACjB;AAAA,EACF,IAA2B,CAAC,GAAoB;AAC9C,UAAM,yBAAyB,MAAM,KAAK,aAAa;AAEvD,QAAI,CAAC,uBAAuB,eAAe;AACzC,YAAM,EAAE,OAAO,IAAI;AACnB,YAAM,IAAI,MAAM,gDAAgD,MAAM,EAAE;AAAA,IAC1E;AAEA,WAAO,KAAK,eAAe,aAAa;AAAA,MACtC,WAAW,uBAAuB;AAAA,MAClC;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,WAAW,aAAuC;AAC9D,QAAI,CAAC,KAAK,MAAM;AACd,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,YAAM,UAAU,aAAa,KAAK,IAAI;AACtC,aAAO;AAAA,IACT,SAAS,GAAG;AACV,aAAO;AAAA,IACT;AAAA,EACF;AACF;","names":[]}

package/lib/esm/user-management/user-management.d.ts

@@ -1,8 +1,10 @@
 import 'jose';
+import '../user-management-qKHMGyQi.js';
 import '../common/interfaces/pagination-options.interface.js';
 import '../common/utils/pagination.js';
 import '../mfa/interfaces/challenge.interface.js';
-export { U as UserManagement } from '../workos-DGRMJ65Z.js';
+import '../feature-flags/interfaces/feature-flag.interface.js';
+export { U as UserManagement } from '../workos-e5MfmByv.js';
 import './interfaces/authenticate-with-code-options.interface.js';
 import './interfaces/authenticate-with-code-and-verifier-options.interface.js';
 import './interfaces/authenticate-with-email-verification-options.interface.js';
@@ -27,6 +29,7 @@ import './interfaces/list-auth-factors-options.interface.js';
 import './interfaces/list-invitations-options.interface.js';
 import './interfaces/list-organization-memberships-options.interface.js';
 import './interfaces/list-sessions-options.interface.js';
+import './interfaces/list-user-feature-flags-options.interface.js';
 import './interfaces/list-users-options.interface.js';
 import './interfaces/magic-auth.interface.js';
 import './interfaces/organization-membership.interface.js';
@@ -62,7 +65,6 @@ import './interfaces/authentication-radar-risk-detected-event.interface.js';
 import './interfaces/impersonator.interface.js';
 import '../organizations/interfaces/create-organization-options.interface.js';
 import '../organizations/interfaces/domain-data.interface.js';
-import '../organizations/interfaces/feature-flag.interface.js';
 import '../organizations/interfaces/list-organization-feature-flags-options.interface.js';
 import '../organizations/interfaces/list-organizations-options.interface.js';
 import '../organizations/interfaces/update-organization-options.interface.js';
@@ -78,6 +80,7 @@ import '../sso/interfaces/get-profile-options.interface.js';
 import '../sso/interfaces/get-profile-and-token-options.interface.js';
 import '../sso/interfaces/list-connections-options.interface.js';
 import '../sso/interfaces/profile-and-token.interface.js';
+import './interfaces/oauth-tokens.interface.js';
 import '../sso/interfaces/profile.interface.js';
 import '../webhooks/webhooks.js';
 import '../common/crypto/crypto-provider.js';
@@ -93,7 +96,6 @@ import '../audit-logs/interfaces/audit-log-export.interface.js';
 import '../audit-logs/interfaces/create-audit-log-event-options.interface.js';
 import '../audit-logs/interfaces/create-audit-log-schema-options.interface.js';
 import './interfaces/refresh-and-seal-session-data.interface.js';
-import './interfaces/oauth-tokens.interface.js';
 import '../fga/interfaces/check.interface.js';
 import '../fga/interfaces/resource.interface.js';
 import '../fga/interfaces/resource-op.enum.js';

package/lib/esm/user-management/user-management.js

@@ -2,11 +2,12 @@ var __defProp = Object.defineProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 import { sealData, unsealData } from "iron-session";
 import { createRemoteJWKSet, decodeJwt, jwtVerify } from "jose";
-import qs from "qs";
+import * as clientUserManagement from "../client/user-management.js";
 import { fetchAndDeserialize } from "../common/utils/fetch-and-deserialize.js";
 import { AutoPaginatable } from "../common/utils/pagination.js";
 import { getEnv } from "../common/utils/env.js";
 import { deserializeChallenge } from "../mfa/serializers/index.js";
+import { deserializeFeatureFlag } from "../feature-flags/serializers/feature-flag.serializer.js";
 import {
   AuthenticateWithSessionCookieFailureReason
 } from "./interfaces/authenticate-with-session-cookie.interface.js";
@@ -48,15 +49,6 @@ import { deserializeOrganizationMembership } from "./serializers/organization-me
 import { serializeSendInvitationOptions } from "./serializers/send-invitation-options.serializer.js";
 import { serializeUpdateOrganizationMembershipOptions } from "./serializers/update-organization-membership-options.serializer.js";
 import { CookieSession } from "./session.js";
-const toQueryString = /* @__PURE__ */ __name((options) => {
-  return qs.stringify(options, {
-    arrayFormat: "repeat",
-    // sorts the keys alphabetically to maintain backwards compatibility
-    sort: /* @__PURE__ */ __name((a, b) => a.localeCompare(b), "sort"),
-    // encodes space as + instead of %20 to maintain backwards compatibility
-    format: "RFC1738"
-  });
-}, "toQueryString");
 class UserManagement {
   constructor(workos) {
     this.workos = workos;
@@ -265,6 +257,7 @@ class UserManagement {
       sid: sessionId,
       org_id: organizationId,
       role,
+      roles,
       permissions,
       entitlements,
       feature_flags: featureFlags
@@ -274,6 +267,7 @@ class UserManagement {
       sessionId,
       organizationId,
       role,
+      roles,
       user: session.user,
       permissions,
       entitlements,
@@ -442,6 +436,24 @@ class UserManagement {
       restOfOptions
     );
   }
+  async listUserFeatureFlags(options) {
+    const { userId, ...paginationOptions } = options;
+    return new AutoPaginatable(
+      await fetchAndDeserialize(
+        this.workos,
+        `/user_management/users/${userId}/feature-flags`,
+        deserializeFeatureFlag,
+        paginationOptions
+      ),
+      (params) => fetchAndDeserialize(
+        this.workos,
+        `/user_management/users/${userId}/feature-flags`,
+        deserializeFeatureFlag,
+        params
+      ),
+      paginationOptions
+    );
+  }
   async listSessions(userId, options) {
     return new AutoPaginatable(
       await fetchAndDeserialize(
@@ -586,81 +598,20 @@ class UserManagement {
       serializeRevokeSessionOptions(payload)
     );
   }
-  getAuthorizationUrl({
-    connectionId,
-    codeChallenge,
-    codeChallengeMethod,
-    context,
-    clientId,
-    domainHint,
-    loginHint,
-    organizationId,
-    provider,
-    providerQueryParams,
-    providerScopes,
-    prompt,
-    redirectUri,
-    state,
-    screenHint
-  }) {
-    if (!provider && !connectionId && !organizationId) {
-      throw new TypeError(
-        `Incomplete arguments. Need to specify either a 'connectionId', 'organizationId', or 'provider'.`
-      );
-    }
-    if (provider !== "authkit" && screenHint) {
-      throw new TypeError(
-        `'screenHint' is only supported for 'authkit' provider`
-      );
-    }
-    if (context) {
-      this.workos.emitWarning(
-        `\`context\` is deprecated. We previously required initiate login endpoints to return the
-\`context\` query parameter when getting the authorization URL. This is no longer necessary.`
-      );
-    }
-    const query = toQueryString({
-      connection_id: connectionId,
-      code_challenge: codeChallenge,
-      code_challenge_method: codeChallengeMethod,
-      context,
-      organization_id: organizationId,
-      domain_hint: domainHint,
-      login_hint: loginHint,
-      provider,
-      provider_query_params: providerQueryParams,
-      provider_scopes: providerScopes,
-      prompt,
-      client_id: clientId,
-      redirect_uri: redirectUri,
-      response_type: "code",
-      state,
-      screen_hint: screenHint
+  getAuthorizationUrl(options) {
+    return clientUserManagement.getAuthorizationUrl({
+      ...options,
+      baseURL: this.workos.baseURL
     });
-    return `${this.workos.baseURL}/user_management/authorize?${query}`;
   }
-  getLogoutUrl({
-    sessionId,
-    returnTo
-  }) {
-    if (!sessionId) {
-      throw new TypeError(`Incomplete arguments. Need to specify 'sessionId'.`);
-    }
-    const url = new URL(
-      "/user_management/sessions/logout",
-      this.workos.baseURL
-    );
-    url.searchParams.set("session_id", sessionId);
-    if (returnTo) {
-      url.searchParams.set("return_to", returnTo);
-    }
-    return url.toString();
+  getLogoutUrl(options) {
+    return clientUserManagement.getLogoutUrl({
+      ...options,
+      baseURL: this.workos.baseURL
+    });
   }
   getJwksUrl(clientId) {
-    if (!clientId) {
-      throw TypeError("clientId must be a valid clientId");
-    }
-    return `${this.workos.baseURL}/sso/jwks/${clientId}`;
+    return clientUserManagement.getJwksUrl(clientId, this.workos.baseURL);
   }
 }
 export {