@workos-inc/node 8.0.0-beta.4 → 8.0.0-rc.10

package/README.md

@@ -11,7 +11,7 @@ See the [API Reference](https://workos.com/docs/reference/client-libraries) for
 
 ## Requirements
 
-Node 18 or higher.
+Node 20 or higher.
 
 ## Installation
 
@@ -37,6 +37,60 @@ import { WorkOS } from '@workos-inc/node';
 const workos = new WorkOS('sk_1234');
 ```
 
+## Public Client Mode (Browser/Mobile/CLI)
+
+For apps that can't securely store secrets, initialize with just a client ID:
+
+```ts
+import { WorkOS } from '@workos-inc/node';
+
+const workos = new WorkOS({ clientId: 'client_...' }); // No API key needed
+
+// Generate auth URL with automatic PKCE
+const { url, codeVerifier } =
+  await workos.userManagement.getAuthorizationUrlWithPKCE({
+    provider: 'authkit',
+    redirectUri: 'myapp://callback',
+    clientId: 'client_...',
+  });
+
+// After user authenticates, exchange code for tokens
+const { accessToken, refreshToken } =
+  await workos.userManagement.authenticateWithCode({
+    code: authorizationCode,
+    codeVerifier,
+    clientId: 'client_...',
+  });
+```
+
+> [!IMPORTANT]
+> Store `codeVerifier` securely on-device between generating the auth URL and handling the callback. For mobile apps, use platform secure storage (iOS Keychain, Android Keystore). For CLI apps, consider OS credential storage. The verifier must survive app restarts during the auth flow.
+
+See the [AuthKit documentation](https://workos.com/docs/authkit) for details on PKCE authentication.
+
+### PKCE with Confidential Clients
+
+Server-side apps can also use PKCE alongside the client secret for defense in depth (recommended by OAuth 2.1):
+
+```ts
+const workos = new WorkOS('sk_...'); // With API key
+
+// Use PKCE even with API key for additional security
+const { url, codeVerifier } =
+  await workos.userManagement.getAuthorizationUrlWithPKCE({
+    provider: 'authkit',
+    redirectUri: 'https://example.com/callback',
+    clientId: 'client_...',
+  });
+
+// Both client_secret AND code_verifier will be sent
+const { accessToken } = await workos.userManagement.authenticateWithCode({
+  code: authorizationCode,
+  codeVerifier,
+  clientId: 'client_...',
+});
+```
+
 ## SDK Versioning
 
 For our SDKs WorkOS follows a Semantic Versioning ([SemVer](https://semver.org/)) process where all releases will have a version X.Y.Z (like 1.0.0) pattern wherein Z would be a bug fix (e.g., 1.0.1), Y would be a minor release (1.1.0) and X would be a major release (2.0.0). We permit any breaking changes to only be released in major versions and strongly recommend reading changelogs before making any major version upgrades.

package/lib/access-token.interface-qb42DvMJ.d.cts

@@ -0,0 +1,18 @@
+//#region src/pipes/interfaces/access-token.interface.d.ts
+interface AccessToken {
+  object: 'access_token';
+  accessToken: string;
+  expiresAt: Date | null;
+  scopes: string[];
+  missingScopes: string[];
+}
+interface SerializedAccessToken {
+  object: 'access_token';
+  access_token: string;
+  expires_at: string | null;
+  scopes: string[];
+  missing_scopes: string[];
+}
+//#endregion
+export { SerializedAccessToken as n, AccessToken as t };
+//# sourceMappingURL=access-token.interface-qb42DvMJ.d.cts.map

package/lib/access-token.serializer-BTB3otha.cjs

@@ -0,0 +1,20 @@
+
+//#region src/pipes/serializers/access-token.serializer.ts
+function deserializeAccessToken(serialized) {
+	return {
+		object: "access_token",
+		accessToken: serialized.access_token,
+		expiresAt: serialized.expires_at ? new Date(Date.parse(serialized.expires_at)) : null,
+		scopes: serialized.scopes,
+		missingScopes: serialized.missing_scopes
+	};
+}
+
+//#endregion
+Object.defineProperty(exports, 'deserializeAccessToken', {
+  enumerable: true,
+  get: function () {
+    return deserializeAccessToken;
+  }
+});
+//# sourceMappingURL=access-token.serializer-BTB3otha.cjs.map

package/lib/access-token.serializer-BTB3otha.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-token.serializer-BTB3otha.cjs","names":[],"sources":["../src/pipes/serializers/access-token.serializer.ts"],"sourcesContent":["import {\n  AccessToken,\n  SerializedAccessToken,\n} from '../interfaces/access-token.interface';\n\nexport function deserializeAccessToken(\n  serialized: SerializedAccessToken,\n): AccessToken {\n  return {\n    object: 'access_token',\n    accessToken: serialized.access_token,\n    expiresAt: serialized.expires_at\n      ? new Date(Date.parse(serialized.expires_at))\n      : null,\n    scopes: serialized.scopes,\n    missingScopes: serialized.missing_scopes,\n  };\n}\n"],"mappings":";;AAKA,SAAgB,uBACd,YACa;AACb,QAAO;EACL,QAAQ;EACR,aAAa,WAAW;EACxB,WAAW,WAAW,aAClB,IAAI,KAAK,KAAK,MAAM,WAAW,WAAW,CAAC,GAC3C;EACJ,QAAQ,WAAW;EACnB,eAAe,WAAW;EAC3B"}

package/lib/action.interface-BLCbp-cT.d.cts

@@ -0,0 +1,63 @@
+import { n as UserResponse, t as User } from "./user.interface-Dw_0nNpw.cjs";
+import { i as InvitationResponse, t as Invitation } from "./invitation.interface-BQMsYCSZ.cjs";
+import { n as OrganizationMembershipResponse, t as OrganizationMembership } from "./organization-membership.interface-ERgG2p4e.cjs";
+import { n as OrganizationResponse, t as Organization } from "./organization.interface-i6mWA3uA.cjs";
+
+//#region src/actions/interfaces/action.interface.d.ts
+interface AuthenticationActionContext {
+  id: string;
+  object: 'authentication_action_context';
+  user: User;
+  organization?: Organization;
+  organizationMembership?: OrganizationMembership;
+  ipAddress?: string;
+  userAgent?: string;
+  deviceFingerprint?: string;
+  issuer?: string;
+}
+interface UserData {
+  object: 'user_data';
+  email: string;
+  firstName: string;
+  lastName: string;
+}
+interface UserRegistrationActionContext {
+  id: string;
+  object: 'user_registration_action_context';
+  userData: UserData;
+  invitation?: Invitation;
+  ipAddress?: string;
+  userAgent?: string;
+  deviceFingerprint?: string;
+}
+type ActionContext = AuthenticationActionContext | UserRegistrationActionContext;
+interface AuthenticationActionPayload {
+  id: string;
+  object: 'authentication_action_context';
+  user: UserResponse;
+  organization?: OrganizationResponse;
+  organization_membership?: OrganizationMembershipResponse;
+  ip_address?: string;
+  user_agent?: string;
+  device_fingerprint?: string;
+  issuer?: string;
+}
+interface UserDataPayload {
+  object: 'user_data';
+  email: string;
+  first_name: string;
+  last_name: string;
+}
+interface UserRegistrationActionPayload {
+  id: string;
+  object: 'user_registration_action_context';
+  user_data: UserDataPayload;
+  invitation?: InvitationResponse;
+  ip_address?: string;
+  user_agent?: string;
+  device_fingerprint?: string;
+}
+type ActionPayload = AuthenticationActionPayload | UserRegistrationActionPayload;
+//#endregion
+export { UserRegistrationActionPayload as a, UserDataPayload as i, ActionPayload as n, UserData as r, ActionContext as t };
+//# sourceMappingURL=action.interface-BLCbp-cT.d.cts.map

package/lib/action.serializer-CkMp2PpV.cjs

@@ -0,0 +1,47 @@
+const require_organization_serializer = require('./organization.serializer-DM6Xkk2V.cjs');
+const require_user_serializer = require('./user.serializer-Y5EM8MeK.cjs');
+const require_invitation_serializer = require('./invitation.serializer-BEVUkLP9.cjs');
+const require_organization_membership_serializer = require('./organization-membership.serializer-CYvdEErJ.cjs');
+
+//#region src/actions/serializers/action.serializer.ts
+const deserializeUserData = (userData) => {
+	return {
+		object: userData.object,
+		email: userData.email,
+		firstName: userData.first_name,
+		lastName: userData.last_name
+	};
+};
+const deserializeAction = (actionPayload) => {
+	switch (actionPayload.object) {
+		case "user_registration_action_context": return {
+			id: actionPayload.id,
+			object: actionPayload.object,
+			userData: deserializeUserData(actionPayload.user_data),
+			invitation: actionPayload.invitation ? require_invitation_serializer.deserializeInvitation(actionPayload.invitation) : void 0,
+			ipAddress: actionPayload.ip_address,
+			userAgent: actionPayload.user_agent,
+			deviceFingerprint: actionPayload.device_fingerprint
+		};
+		case "authentication_action_context": return {
+			id: actionPayload.id,
+			object: actionPayload.object,
+			user: require_user_serializer.deserializeUser(actionPayload.user),
+			organization: actionPayload.organization ? require_organization_serializer.deserializeOrganization(actionPayload.organization) : void 0,
+			organizationMembership: actionPayload.organization_membership ? require_organization_membership_serializer.deserializeOrganizationMembership(actionPayload.organization_membership) : void 0,
+			ipAddress: actionPayload.ip_address,
+			userAgent: actionPayload.user_agent,
+			deviceFingerprint: actionPayload.device_fingerprint,
+			issuer: actionPayload.issuer
+		};
+	}
+};
+
+//#endregion
+Object.defineProperty(exports, 'deserializeAction', {
+  enumerable: true,
+  get: function () {
+    return deserializeAction;
+  }
+});
+//# sourceMappingURL=action.serializer-CkMp2PpV.cjs.map

package/lib/action.serializer-CkMp2PpV.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"action.serializer-CkMp2PpV.cjs","names":["deserializeInvitation","deserializeUser","deserializeOrganization","deserializeOrganizationMembership"],"sources":["../src/actions/serializers/action.serializer.ts"],"sourcesContent":["import { deserializeOrganization } from '../../organizations/serializers/organization.serializer';\nimport {\n  deserializeInvitation,\n  deserializeUser,\n} from '../../user-management/serializers';\nimport { deserializeOrganizationMembership } from '../../user-management/serializers/organization-membership.serializer';\nimport {\n  ActionContext,\n  ActionPayload,\n  UserData,\n  UserDataPayload,\n} from '../interfaces/action.interface';\n\nconst deserializeUserData = (userData: UserDataPayload): UserData => {\n  return {\n    object: userData.object,\n    email: userData.email,\n    firstName: userData.first_name,\n    lastName: userData.last_name,\n  };\n};\n\nexport const deserializeAction = (\n  actionPayload: ActionPayload,\n): ActionContext => {\n  switch (actionPayload.object) {\n    case 'user_registration_action_context':\n      return {\n        id: actionPayload.id,\n        object: actionPayload.object,\n        userData: deserializeUserData(actionPayload.user_data),\n        invitation: actionPayload.invitation\n          ? deserializeInvitation(actionPayload.invitation)\n          : undefined,\n\n        ipAddress: actionPayload.ip_address,\n        userAgent: actionPayload.user_agent,\n        deviceFingerprint: actionPayload.device_fingerprint,\n      };\n    case 'authentication_action_context':\n      return {\n        id: actionPayload.id,\n        object: actionPayload.object,\n        user: deserializeUser(actionPayload.user),\n        organization: actionPayload.organization\n          ? deserializeOrganization(actionPayload.organization)\n          : undefined,\n        organizationMembership: actionPayload.organization_membership\n          ? deserializeOrganizationMembership(\n              actionPayload.organization_membership,\n            )\n          : undefined,\n        ipAddress: actionPayload.ip_address,\n        userAgent: actionPayload.user_agent,\n        deviceFingerprint: actionPayload.device_fingerprint,\n        issuer: actionPayload.issuer,\n      };\n  }\n};\n"],"mappings":";;;;;;AAaA,MAAM,uBAAuB,aAAwC;AACnE,QAAO;EACL,QAAQ,SAAS;EACjB,OAAO,SAAS;EAChB,WAAW,SAAS;EACpB,UAAU,SAAS;EACpB;;AAGH,MAAa,qBACX,kBACkB;AAClB,SAAQ,cAAc,QAAtB;EACE,KAAK,mCACH,QAAO;GACL,IAAI,cAAc;GAClB,QAAQ,cAAc;GACtB,UAAU,oBAAoB,cAAc,UAAU;GACtD,YAAY,cAAc,aACtBA,oDAAsB,cAAc,WAAW,GAC/C;GAEJ,WAAW,cAAc;GACzB,WAAW,cAAc;GACzB,mBAAmB,cAAc;GAClC;EACH,KAAK,gCACH,QAAO;GACL,IAAI,cAAc;GAClB,QAAQ,cAAc;GACtB,MAAMC,wCAAgB,cAAc,KAAK;GACzC,cAAc,cAAc,eACxBC,wDAAwB,cAAc,aAAa,GACnD;GACJ,wBAAwB,cAAc,0BAClCC,6EACE,cAAc,wBACf,GACD;GACJ,WAAW,cAAc;GACzB,WAAW,cAAc;GACzB,mBAAmB,cAAc;GACjC,QAAQ,cAAc;GACvB"}

package/lib/actions/actions.cjs

@@ -1,89 +1,3 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var actions_exports = {};
-__export(actions_exports, {
-  Actions: () => Actions
-});
-module.exports = __toCommonJS(actions_exports);
-var import_signature_provider = require("../common/crypto/signature-provider");
-var import_unreachable = require("../common/utils/unreachable");
-var import_action2 = require("./serializers/action.serializer");
-class Actions {
-  static {
-    __name(this, "Actions");
-  }
-  signatureProvider;
-  constructor(cryptoProvider) {
-    this.signatureProvider = new import_signature_provider.SignatureProvider(cryptoProvider);
-  }
-  get computeSignature() {
-    return this.signatureProvider.computeSignature.bind(this.signatureProvider);
-  }
-  get verifyHeader() {
-    return this.signatureProvider.verifyHeader.bind(this.signatureProvider);
-  }
-  serializeType(type) {
-    switch (type) {
-      case "authentication":
-        return "authentication_action_response";
-      case "user_registration":
-        return "user_registration_action_response";
-      default:
-        return (0, import_unreachable.unreachable)(type);
-    }
-  }
-  async signResponse(data, secret) {
-    let errorMessage;
-    const { verdict, type } = data;
-    if (verdict === "Deny" && data.errorMessage) {
-      errorMessage = data.errorMessage;
-    }
-    const responsePayload = {
-      timestamp: Date.now(),
-      verdict,
-      ...verdict === "Deny" && data.errorMessage && { error_message: errorMessage }
-    };
-    const response = {
-      object: this.serializeType(type),
-      payload: responsePayload,
-      signature: await this.computeSignature(
-        responsePayload.timestamp,
-        responsePayload,
-        secret
-      )
-    };
-    return response;
-  }
-  async constructAction({
-    payload,
-    sigHeader,
-    secret,
-    tolerance = 3e4
-  }) {
-    const options = { payload, sigHeader, secret, tolerance };
-    await this.verifyHeader(options);
-    return (0, import_action2.deserializeAction)(payload);
-  }
-}
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  Actions
-});
-//# sourceMappingURL=actions.cjs.map
+const require_actions = require('../actions-_-g7Idem.cjs');
+
+exports.Actions = require_actions.Actions;

package/lib/actions/actions.d.cts

@@ -1,35 +1,2 @@
-import { CryptoProvider } from '../common/crypto/crypto-provider.cjs';
-import { ActionContext } from './interfaces/action.interface.cjs';
-import { AuthenticationActionResponseData, UserRegistrationActionResponseData, ResponsePayload } from './interfaces/response-payload.interface.cjs';
-import '../user-management/interfaces/user.interface.cjs';
-import '../user-management/interfaces/invitation.interface.cjs';
-import '../user-management/interfaces/organization-membership.interface.cjs';
-import '../roles/interfaces/role.interface.cjs';
-import '../organizations/interfaces/organization.interface.cjs';
-import '../organization-domains/interfaces/organization-domain.interface.cjs';
-
-declare class Actions {
-    private signatureProvider;
-    constructor(cryptoProvider: CryptoProvider);
-    private get computeSignature();
-    get verifyHeader(): ({ payload, sigHeader, secret, tolerance, }: {
-        payload: any;
-        sigHeader: string;
-        secret: string;
-        tolerance?: number;
-    }) => Promise<boolean>;
-    serializeType(type: AuthenticationActionResponseData['type'] | UserRegistrationActionResponseData['type']): "authentication_action_response" | "user_registration_action_response";
-    signResponse(data: AuthenticationActionResponseData | UserRegistrationActionResponseData, secret: string): Promise<{
-        object: string;
-        payload: ResponsePayload;
-        signature: string;
-    }>;
-    constructAction({ payload, sigHeader, secret, tolerance, }: {
-        payload: unknown;
-        sigHeader: string;
-        secret: string;
-        tolerance?: number;
-    }): Promise<ActionContext>;
-}
-
-export { Actions };
+import { t as Actions } from "../actions-d_uq5P1L.cjs";
+export { Actions };

package/lib/actions/actions.d.ts

@@ -1,26 +1,41 @@
-import { CryptoProvider } from '../common/crypto/crypto-provider';
-import { ActionContext } from './interfaces/action.interface';
-import { AuthenticationActionResponseData, ResponsePayload, UserRegistrationActionResponseData } from './interfaces/response-payload.interface';
-export declare class Actions {
-    private signatureProvider;
-    constructor(cryptoProvider: CryptoProvider);
-    private get computeSignature();
-    get verifyHeader(): ({ payload, sigHeader, secret, tolerance, }: {
-        payload: any;
-        sigHeader: string;
-        secret: string;
-        tolerance?: number | undefined;
-    }) => Promise<boolean>;
-    serializeType(type: AuthenticationActionResponseData['type'] | UserRegistrationActionResponseData['type']): "authentication_action_response" | "user_registration_action_response";
-    signResponse(data: AuthenticationActionResponseData | UserRegistrationActionResponseData, secret: string): Promise<{
-        object: string;
-        payload: ResponsePayload;
-        signature: string;
-    }>;
-    constructAction({ payload, sigHeader, secret, tolerance, }: {
-        payload: unknown;
-        sigHeader: string;
-        secret: string;
-        tolerance?: number;
-    }): Promise<ActionContext>;
+import { CryptoProvider } from "../common/crypto/crypto-provider.js";
+import { ActionContext } from "./interfaces/action.interface.js";
+import { AuthenticationActionResponseData, ResponsePayload, UserRegistrationActionResponseData } from "./interfaces/response-payload.interface.js";
+
+//#region src/actions/actions.d.ts
+declare class Actions {
+  private signatureProvider;
+  constructor(cryptoProvider: CryptoProvider);
+  private get computeSignature();
+  get verifyHeader(): ({
+    payload,
+    sigHeader,
+    secret,
+    tolerance
+  }: {
+    payload: any;
+    sigHeader: string;
+    secret: string;
+    tolerance?: number;
+  }) => Promise<boolean>;
+  serializeType(type: AuthenticationActionResponseData['type'] | UserRegistrationActionResponseData['type']): "authentication_action_response" | "user_registration_action_response";
+  signResponse(data: AuthenticationActionResponseData | UserRegistrationActionResponseData, secret: string): Promise<{
+    object: string;
+    payload: ResponsePayload;
+    signature: string;
+  }>;
+  constructAction({
+    payload,
+    sigHeader,
+    secret,
+    tolerance
+  }: {
+    payload: unknown;
+    sigHeader: string;
+    secret: string;
+    tolerance?: number;
+  }): Promise<ActionContext>;
 }
+//#endregion
+export { Actions };
+//# sourceMappingURL=actions.d.ts.map

package/lib/actions/actions.js

@@ -1,61 +1,53 @@
-"use strict";
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
+import { SignatureProvider } from "../common/crypto/signature-provider.js";
+import { unreachable } from "../common/utils/unreachable.js";
+import { deserializeAction } from "./serializers/action.serializer.js";
+
+//#region src/actions/actions.ts
+var Actions = class {
+	signatureProvider;
+	constructor(cryptoProvider) {
+		this.signatureProvider = new SignatureProvider(cryptoProvider);
+	}
+	get computeSignature() {
+		return this.signatureProvider.computeSignature.bind(this.signatureProvider);
+	}
+	get verifyHeader() {
+		return this.signatureProvider.verifyHeader.bind(this.signatureProvider);
+	}
+	serializeType(type) {
+		switch (type) {
+			case "authentication": return "authentication_action_response";
+			case "user_registration": return "user_registration_action_response";
+			default: return unreachable(type);
+		}
+	}
+	async signResponse(data, secret) {
+		let errorMessage;
+		const { verdict, type } = data;
+		if (verdict === "Deny" && data.errorMessage) errorMessage = data.errorMessage;
+		const responsePayload = {
+			timestamp: Date.now(),
+			verdict,
+			...verdict === "Deny" && data.errorMessage && { error_message: errorMessage }
+		};
+		return {
+			object: this.serializeType(type),
+			payload: responsePayload,
+			signature: await this.computeSignature(responsePayload.timestamp, responsePayload, secret)
+		};
+	}
+	async constructAction({ payload, sigHeader, secret, tolerance = 3e4 }) {
+		const options = {
+			payload,
+			sigHeader,
+			secret,
+			tolerance
+		};
+		await this.verifyHeader(options);
+		return deserializeAction(payload);
+	}
 };
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.Actions = void 0;
-const signature_provider_1 = require("../common/crypto/signature-provider");
-const unreachable_1 = require("../common/utils/unreachable");
-const action_serializer_1 = require("./serializers/action.serializer");
-class Actions {
-    constructor(cryptoProvider) {
-        this.signatureProvider = new signature_provider_1.SignatureProvider(cryptoProvider);
-    }
-    get computeSignature() {
-        return this.signatureProvider.computeSignature.bind(this.signatureProvider);
-    }
-    get verifyHeader() {
-        return this.signatureProvider.verifyHeader.bind(this.signatureProvider);
-    }
-    serializeType(type) {
-        switch (type) {
-            case 'authentication':
-                return 'authentication_action_response';
-            case 'user_registration':
-                return 'user_registration_action_response';
-            default:
-                return (0, unreachable_1.unreachable)(type);
-        }
-    }
-    signResponse(data, secret) {
-        return __awaiter(this, void 0, void 0, function* () {
-            let errorMessage;
-            const { verdict, type } = data;
-            if (verdict === 'Deny' && data.errorMessage) {
-                errorMessage = data.errorMessage;
-            }
-            const responsePayload = Object.assign({ timestamp: Date.now(), verdict }, (verdict === 'Deny' &&
-                data.errorMessage && { error_message: errorMessage }));
-            const response = {
-                object: this.serializeType(type),
-                payload: responsePayload,
-                signature: yield this.computeSignature(responsePayload.timestamp, responsePayload, secret),
-            };
-            return response;
-        });
-    }
-    constructAction({ payload, sigHeader, secret, tolerance = 30000, }) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const options = { payload, sigHeader, secret, tolerance };
-            yield this.verifyHeader(options);
-            return (0, action_serializer_1.deserializeAction)(payload);
-        });
-    }
-}
-exports.Actions = Actions;
+
+//#endregion
+export { Actions };
+//# sourceMappingURL=actions.js.map

package/lib/actions/actions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/actions/actions.ts"],"sourcesContent":["import { CryptoProvider } from '../common/crypto/crypto-provider';\nimport { SignatureProvider } from '../common/crypto/signature-provider';\nimport { unreachable } from '../common/utils/unreachable';\nimport { ActionContext, ActionPayload } from './interfaces/action.interface';\nimport {\n  AuthenticationActionResponseData,\n  ResponsePayload,\n  UserRegistrationActionResponseData,\n} from './interfaces/response-payload.interface';\nimport { deserializeAction } from './serializers/action.serializer';\n\nexport class Actions {\n  private signatureProvider: SignatureProvider;\n\n  constructor(cryptoProvider: CryptoProvider) {\n    this.signatureProvider = new SignatureProvider(cryptoProvider);\n  }\n\n  private get computeSignature() {\n    return this.signatureProvider.computeSignature.bind(this.signatureProvider);\n  }\n\n  get verifyHeader() {\n    return this.signatureProvider.verifyHeader.bind(this.signatureProvider);\n  }\n\n  serializeType(\n    type:\n      | AuthenticationActionResponseData['type']\n      | UserRegistrationActionResponseData['type'],\n  ) {\n    switch (type) {\n      case 'authentication':\n        return 'authentication_action_response';\n      case 'user_registration':\n        return 'user_registration_action_response';\n      default:\n        return unreachable(type);\n    }\n  }\n\n  async signResponse(\n    data: AuthenticationActionResponseData | UserRegistrationActionResponseData,\n    secret: string,\n  ) {\n    let errorMessage: string | undefined;\n    const { verdict, type } = data;\n\n    if (verdict === 'Deny' && data.errorMessage) {\n      errorMessage = data.errorMessage;\n    }\n\n    const responsePayload: ResponsePayload = {\n      timestamp: Date.now(),\n      verdict,\n      ...(verdict === 'Deny' &&\n        data.errorMessage && { error_message: errorMessage }),\n    };\n\n    const response = {\n      object: this.serializeType(type),\n      payload: responsePayload,\n      signature: await this.computeSignature(\n        responsePayload.timestamp,\n        responsePayload,\n        secret,\n      ),\n    };\n\n    return response;\n  }\n\n  async constructAction({\n    payload,\n    sigHeader,\n    secret,\n    tolerance = 30000,\n  }: {\n    payload: unknown;\n    sigHeader: string;\n    secret: string;\n    tolerance?: number;\n  }): Promise<ActionContext> {\n    const options = { payload, sigHeader, secret, tolerance };\n    await this.verifyHeader(options);\n\n    return deserializeAction(payload as ActionPayload);\n  }\n}\n"],"mappings":";;AACA,SAAS,yBAAyB;AAClC,SAAS,mBAAmB;AAO5B,SAAS,yBAAyB;AAE3B,MAAM,QAAQ;AAAA,EAXrB,OAWqB;AAAA;AAAA;AAAA,EACX;AAAA,EAER,YAAY,gBAAgC;AAC1C,SAAK,oBAAoB,IAAI,kBAAkB,cAAc;AAAA,EAC/D;AAAA,EAEA,IAAY,mBAAmB;AAC7B,WAAO,KAAK,kBAAkB,iBAAiB,KAAK,KAAK,iBAAiB;AAAA,EAC5E;AAAA,EAEA,IAAI,eAAe;AACjB,WAAO,KAAK,kBAAkB,aAAa,KAAK,KAAK,iBAAiB;AAAA,EACxE;AAAA,EAEA,cACE,MAGA;AACA,YAAQ,MAAM;AAAA,MACZ,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT;AACE,eAAO,YAAY,IAAI;AAAA,IAC3B;AAAA,EACF;AAAA,EAEA,MAAM,aACJ,MACA,QACA;AACA,QAAI;AACJ,UAAM,EAAE,SAAS,KAAK,IAAI;AAE1B,QAAI,YAAY,UAAU,KAAK,cAAc;AAC3C,qBAAe,KAAK;AAAA,IACtB;AAEA,UAAM,kBAAmC;AAAA,MACvC,WAAW,KAAK,IAAI;AAAA,MACpB;AAAA,MACA,GAAI,YAAY,UACd,KAAK,gBAAgB,EAAE,eAAe,aAAa;AAAA,IACvD;AAEA,UAAM,WAAW;AAAA,MACf,QAAQ,KAAK,cAAc,IAAI;AAAA,MAC/B,SAAS;AAAA,MACT,WAAW,MAAM,KAAK;AAAA,QACpB,gBAAgB;AAAA,QAChB;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,gBAAgB;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY;AAAA,EACd,GAK2B;AACzB,UAAM,UAAU,EAAE,SAAS,WAAW,QAAQ,UAAU;AACxD,UAAM,KAAK,aAAa,OAAO;AAE/B,WAAO,kBAAkB,OAAwB;AAAA,EACnD;AACF;","names":[]}
+{"version":3,"file":"actions.js","names":["errorMessage: string | undefined","responsePayload: ResponsePayload"],"sources":["../../src/actions/actions.ts"],"sourcesContent":["import { CryptoProvider } from '../common/crypto/crypto-provider';\nimport { SignatureProvider } from '../common/crypto/signature-provider';\nimport { unreachable } from '../common/utils/unreachable';\nimport { ActionContext, ActionPayload } from './interfaces/action.interface';\nimport {\n  AuthenticationActionResponseData,\n  ResponsePayload,\n  UserRegistrationActionResponseData,\n} from './interfaces/response-payload.interface';\nimport { deserializeAction } from './serializers/action.serializer';\n\nexport class Actions {\n  private signatureProvider: SignatureProvider;\n\n  constructor(cryptoProvider: CryptoProvider) {\n    this.signatureProvider = new SignatureProvider(cryptoProvider);\n  }\n\n  private get computeSignature() {\n    return this.signatureProvider.computeSignature.bind(this.signatureProvider);\n  }\n\n  get verifyHeader() {\n    return this.signatureProvider.verifyHeader.bind(this.signatureProvider);\n  }\n\n  serializeType(\n    type:\n      | AuthenticationActionResponseData['type']\n      | UserRegistrationActionResponseData['type'],\n  ) {\n    switch (type) {\n      case 'authentication':\n        return 'authentication_action_response';\n      case 'user_registration':\n        return 'user_registration_action_response';\n      default:\n        return unreachable(type);\n    }\n  }\n\n  async signResponse(\n    data: AuthenticationActionResponseData | UserRegistrationActionResponseData,\n    secret: string,\n  ) {\n    let errorMessage: string | undefined;\n    const { verdict, type } = data;\n\n    if (verdict === 'Deny' && data.errorMessage) {\n      errorMessage = data.errorMessage;\n    }\n\n    const responsePayload: ResponsePayload = {\n      timestamp: Date.now(),\n      verdict,\n      ...(verdict === 'Deny' &&\n        data.errorMessage && { error_message: errorMessage }),\n    };\n\n    const response = {\n      object: this.serializeType(type),\n      payload: responsePayload,\n      signature: await this.computeSignature(\n        responsePayload.timestamp,\n        responsePayload,\n        secret,\n      ),\n    };\n\n    return response;\n  }\n\n  async constructAction({\n    payload,\n    sigHeader,\n    secret,\n    tolerance = 30000,\n  }: {\n    payload: unknown;\n    sigHeader: string;\n    secret: string;\n    tolerance?: number;\n  }): Promise<ActionContext> {\n    const options = { payload, sigHeader, secret, tolerance };\n    await this.verifyHeader(options);\n\n    return deserializeAction(payload as ActionPayload);\n  }\n}\n"],"mappings":";;;;;AAWA,IAAa,UAAb,MAAqB;CACnB,AAAQ;CAER,YAAY,gBAAgC;AAC1C,OAAK,oBAAoB,IAAI,kBAAkB,eAAe;;CAGhE,IAAY,mBAAmB;AAC7B,SAAO,KAAK,kBAAkB,iBAAiB,KAAK,KAAK,kBAAkB;;CAG7E,IAAI,eAAe;AACjB,SAAO,KAAK,kBAAkB,aAAa,KAAK,KAAK,kBAAkB;;CAGzE,cACE,MAGA;AACA,UAAQ,MAAR;GACE,KAAK,iBACH,QAAO;GACT,KAAK,oBACH,QAAO;GACT,QACE,QAAO,YAAY,KAAK;;;CAI9B,MAAM,aACJ,MACA,QACA;EACA,IAAIA;EACJ,MAAM,EAAE,SAAS,SAAS;AAE1B,MAAI,YAAY,UAAU,KAAK,aAC7B,gBAAe,KAAK;EAGtB,MAAMC,kBAAmC;GACvC,WAAW,KAAK,KAAK;GACrB;GACA,GAAI,YAAY,UACd,KAAK,gBAAgB,EAAE,eAAe,cAAc;GACvD;AAYD,SAViB;GACf,QAAQ,KAAK,cAAc,KAAK;GAChC,SAAS;GACT,WAAW,MAAM,KAAK,iBACpB,gBAAgB,WAChB,iBACA,OACD;GACF;;CAKH,MAAM,gBAAgB,EACpB,SACA,WACA,QACA,YAAY,OAMa;EACzB,MAAM,UAAU;GAAE;GAAS;GAAW;GAAQ;GAAW;AACzD,QAAM,KAAK,aAAa,QAAQ;AAEhC,SAAO,kBAAkB,QAAyB"}

package/lib/actions/interfaces/action.interface.cjs

@@ -1,17 +0,0 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var action_interface_exports = {};
-module.exports = __toCommonJS(action_interface_exports);
-//# sourceMappingURL=action.interface.cjs.map

package/lib/actions/interfaces/action.interface.d.cts

@@ -1,63 +1,2 @@
-import { User, UserResponse } from '../../user-management/interfaces/user.interface.cjs';
-import { Invitation, InvitationResponse } from '../../user-management/interfaces/invitation.interface.cjs';
-import { OrganizationMembership, OrganizationMembershipResponse } from '../../user-management/interfaces/organization-membership.interface.cjs';
-import { Organization, OrganizationResponse } from '../../organizations/interfaces/organization.interface.cjs';
-import '../../roles/interfaces/role.interface.cjs';
-import '../../organization-domains/interfaces/organization-domain.interface.cjs';
-
-interface AuthenticationActionContext {
-    id: string;
-    object: 'authentication_action_context';
-    user: User;
-    organization?: Organization;
-    organizationMembership?: OrganizationMembership;
-    ipAddress?: string;
-    userAgent?: string;
-    deviceFingerprint?: string;
-    issuer?: string;
-}
-interface UserData {
-    object: 'user_data';
-    email: string;
-    firstName: string;
-    lastName: string;
-}
-interface UserRegistrationActionContext {
-    id: string;
-    object: 'user_registration_action_context';
-    userData: UserData;
-    invitation?: Invitation;
-    ipAddress?: string;
-    userAgent?: string;
-    deviceFingerprint?: string;
-}
-type ActionContext = AuthenticationActionContext | UserRegistrationActionContext;
-interface AuthenticationActionPayload {
-    id: string;
-    object: 'authentication_action_context';
-    user: UserResponse;
-    organization?: OrganizationResponse;
-    organization_membership?: OrganizationMembershipResponse;
-    ip_address?: string;
-    user_agent?: string;
-    device_fingerprint?: string;
-    issuer?: string;
-}
-interface UserDataPayload {
-    object: 'user_data';
-    email: string;
-    first_name: string;
-    last_name: string;
-}
-interface UserRegistrationActionPayload {
-    id: string;
-    object: 'user_registration_action_context';
-    user_data: UserDataPayload;
-    invitation?: InvitationResponse;
-    ip_address?: string;
-    user_agent?: string;
-    device_fingerprint?: string;
-}
-type ActionPayload = AuthenticationActionPayload | UserRegistrationActionPayload;
-
-export type { ActionContext, ActionPayload, UserData, UserDataPayload, UserRegistrationActionPayload };
+import { a as UserRegistrationActionPayload, i as UserDataPayload, n as ActionPayload, r as UserData, t as ActionContext } from "../../action.interface-BLCbp-cT.cjs";
+export { ActionContext, ActionPayload, UserData, UserDataPayload, UserRegistrationActionPayload };