@workos-inc/node 8.0.0-rc.2 → 8.0.0-rc.4

package/lib/user-management/session.js

@@ -0,0 +1,144 @@
+import { OauthException } from "../common/exceptions/oauth.exception.js";
+import { AuthenticateWithSessionCookieFailureReason } from "./interfaces/authenticate-with-session-cookie.interface.js";
+import { RefreshSessionFailureReason } from "./interfaces/refresh-and-seal-session-data.interface.js";
+import { getJose } from "../utils/jose.js";
+import { unsealData } from "iron-session";
+
+//#region src/user-management/session.ts
+var CookieSession = class {
+	userManagement;
+	cookiePassword;
+	sessionData;
+	constructor(userManagement, sessionData, cookiePassword) {
+		if (!cookiePassword) throw new Error("cookiePassword is required");
+		this.userManagement = userManagement;
+		this.cookiePassword = cookiePassword;
+		this.sessionData = sessionData;
+	}
+	/**
+	* Authenticates a user with a session cookie.
+	*
+	* @returns An object indicating whether the authentication was successful or not. If successful, it will include the user's session data.
+	*/
+	async authenticate() {
+		if (!this.sessionData) return {
+			authenticated: false,
+			reason: AuthenticateWithSessionCookieFailureReason.NO_SESSION_COOKIE_PROVIDED
+		};
+		let session;
+		try {
+			session = await unsealData(this.sessionData, { password: this.cookiePassword });
+		} catch (e) {
+			return {
+				authenticated: false,
+				reason: AuthenticateWithSessionCookieFailureReason.INVALID_SESSION_COOKIE
+			};
+		}
+		if (!session.accessToken) return {
+			authenticated: false,
+			reason: AuthenticateWithSessionCookieFailureReason.INVALID_SESSION_COOKIE
+		};
+		if (!await this.isValidJwt(session.accessToken)) return {
+			authenticated: false,
+			reason: AuthenticateWithSessionCookieFailureReason.INVALID_JWT
+		};
+		const { decodeJwt } = await getJose();
+		const { sid: sessionId, org_id: organizationId, role, roles, permissions, entitlements, feature_flags: featureFlags } = decodeJwt(session.accessToken);
+		return {
+			authenticated: true,
+			sessionId,
+			organizationId,
+			role,
+			roles,
+			permissions,
+			entitlements,
+			featureFlags,
+			user: session.user,
+			impersonator: session.impersonator,
+			accessToken: session.accessToken
+		};
+	}
+	/**
+	* Refreshes the user's session.
+	*
+	* @param options - Optional options for refreshing the session.
+	* @param options.cookiePassword - The password to use for the new session cookie.
+	* @param options.organizationId - The organization ID to use for the new session cookie.
+	* @returns An object indicating whether the refresh was successful or not. If successful, it will include the new sealed session data.
+	*/
+	async refresh(options = {}) {
+		const { decodeJwt } = await getJose();
+		const session = await unsealData(this.sessionData, { password: this.cookiePassword });
+		if (!session.refreshToken || !session.user) return {
+			authenticated: false,
+			reason: RefreshSessionFailureReason.INVALID_SESSION_COOKIE
+		};
+		const { org_id: organizationIdFromAccessToken } = decodeJwt(session.accessToken);
+		try {
+			const cookiePassword = options.cookiePassword ?? this.cookiePassword;
+			const authenticationResponse = await this.userManagement.authenticateWithRefreshToken({
+				clientId: this.userManagement.clientId,
+				refreshToken: session.refreshToken,
+				organizationId: options.organizationId ?? organizationIdFromAccessToken,
+				session: {
+					sealSession: true,
+					cookiePassword
+				}
+			});
+			if (options.cookiePassword) this.cookiePassword = options.cookiePassword;
+			this.sessionData = authenticationResponse.sealedSession;
+			const { sid: sessionId, org_id: organizationId, role, roles, permissions, entitlements, feature_flags: featureFlags } = decodeJwt(authenticationResponse.accessToken);
+			return {
+				authenticated: true,
+				sealedSession: authenticationResponse.sealedSession,
+				session: authenticationResponse,
+				sessionId,
+				organizationId,
+				role,
+				roles,
+				permissions,
+				entitlements,
+				featureFlags,
+				user: session.user,
+				impersonator: session.impersonator
+			};
+		} catch (error) {
+			if (error instanceof OauthException && (error.error === RefreshSessionFailureReason.INVALID_GRANT || error.error === RefreshSessionFailureReason.MFA_ENROLLMENT || error.error === RefreshSessionFailureReason.SSO_REQUIRED)) return {
+				authenticated: false,
+				reason: error.error
+			};
+			throw error;
+		}
+	}
+	/**
+	* Gets the URL to redirect the user to for logging out.
+	*
+	* @returns The URL to redirect the user to for logging out.
+	*/
+	async getLogoutUrl({ returnTo } = {}) {
+		const authenticationResponse = await this.authenticate();
+		if (!authenticationResponse.authenticated) {
+			const { reason } = authenticationResponse;
+			throw new Error(`Failed to extract session ID for logout URL: ${reason}`);
+		}
+		return this.userManagement.getLogoutUrl({
+			sessionId: authenticationResponse.sessionId,
+			returnTo
+		});
+	}
+	async isValidJwt(accessToken) {
+		const { jwtVerify } = await getJose();
+		const jwks = await this.userManagement.getJWKS();
+		if (!jwks) throw new Error("Missing client ID. Did you provide it when initializing WorkOS?");
+		try {
+			await jwtVerify(accessToken, jwks);
+			return true;
+		} catch (e) {
+			return false;
+		}
+	}
+};
+
+//#endregion
+export { CookieSession };
+//# sourceMappingURL=session.js.map

package/lib/user-management/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","names":["session: SessionCookieData"],"sources":["../../src/user-management/session.ts"],"sourcesContent":["import { OauthException } from '../common/exceptions/oauth.exception';\nimport {\n  AccessToken,\n  AuthenticateWithSessionCookieFailedResponse,\n  AuthenticateWithSessionCookieFailureReason,\n  AuthenticateWithSessionCookieSuccessResponse,\n  AuthenticationResponse,\n  RefreshSessionFailureReason,\n  RefreshSessionResponse,\n  SessionCookieData,\n} from './interfaces';\nimport { UserManagement } from './user-management';\nimport { unsealData } from 'iron-session';\nimport { getJose } from '../utils/jose';\n\ntype RefreshOptions = {\n  cookiePassword?: string;\n  organizationId?: string;\n};\n\nexport class CookieSession {\n  private userManagement: UserManagement;\n  private cookiePassword: string;\n  private sessionData: string;\n\n  constructor(\n    userManagement: UserManagement,\n    sessionData: string,\n    cookiePassword: string,\n  ) {\n    if (!cookiePassword) {\n      throw new Error('cookiePassword is required');\n    }\n\n    this.userManagement = userManagement;\n    this.cookiePassword = cookiePassword;\n    this.sessionData = sessionData;\n  }\n\n  /**\n   * Authenticates a user with a session cookie.\n   *\n   * @returns An object indicating whether the authentication was successful or not. If successful, it will include the user's session data.\n   */\n  async authenticate(): Promise<\n    | AuthenticateWithSessionCookieSuccessResponse\n    | AuthenticateWithSessionCookieFailedResponse\n  > {\n    if (!this.sessionData) {\n      return {\n        authenticated: false,\n        reason:\n          AuthenticateWithSessionCookieFailureReason.NO_SESSION_COOKIE_PROVIDED,\n      };\n    }\n\n    let session: SessionCookieData;\n\n    try {\n      session = await unsealData<SessionCookieData>(this.sessionData, {\n        password: this.cookiePassword,\n      });\n    } catch (e) {\n      return {\n        authenticated: false,\n        reason:\n          AuthenticateWithSessionCookieFailureReason.INVALID_SESSION_COOKIE,\n      };\n    }\n\n    if (!session.accessToken) {\n      return {\n        authenticated: false,\n        reason:\n          AuthenticateWithSessionCookieFailureReason.INVALID_SESSION_COOKIE,\n      };\n    }\n\n    if (!(await this.isValidJwt(session.accessToken))) {\n      return {\n        authenticated: false,\n        reason: AuthenticateWithSessionCookieFailureReason.INVALID_JWT,\n      };\n    }\n\n    const { decodeJwt } = await getJose();\n\n    const {\n      sid: sessionId,\n      org_id: organizationId,\n      role,\n      roles,\n      permissions,\n      entitlements,\n      feature_flags: featureFlags,\n    } = decodeJwt<AccessToken>(session.accessToken);\n\n    return {\n      authenticated: true,\n      sessionId,\n      organizationId,\n      role,\n      roles,\n      permissions,\n      entitlements,\n      featureFlags,\n      user: session.user,\n      impersonator: session.impersonator,\n      accessToken: session.accessToken,\n    };\n  }\n\n  /**\n   * Refreshes the user's session.\n   *\n   * @param options - Optional options for refreshing the session.\n   * @param options.cookiePassword - The password to use for the new session cookie.\n   * @param options.organizationId - The organization ID to use for the new session cookie.\n   * @returns An object indicating whether the refresh was successful or not. If successful, it will include the new sealed session data.\n   */\n  async refresh(options: RefreshOptions = {}): Promise<RefreshSessionResponse> {\n    const { decodeJwt } = await getJose();\n    const session = await unsealData<SessionCookieData>(this.sessionData, {\n      password: this.cookiePassword,\n    });\n\n    if (!session.refreshToken || !session.user) {\n      return {\n        authenticated: false,\n        reason: RefreshSessionFailureReason.INVALID_SESSION_COOKIE,\n      };\n    }\n\n    const { org_id: organizationIdFromAccessToken } = decodeJwt<AccessToken>(\n      session.accessToken,\n    );\n\n    try {\n      const cookiePassword = options.cookiePassword ?? this.cookiePassword;\n\n      const authenticationResponse =\n        await this.userManagement.authenticateWithRefreshToken({\n          clientId: this.userManagement.clientId as string,\n          refreshToken: session.refreshToken,\n          organizationId:\n            options.organizationId ?? organizationIdFromAccessToken,\n          session: {\n            // We want to store the new sealed session in this class instance, so this always needs to be true\n            sealSession: true,\n            cookiePassword,\n          },\n        });\n\n      // Update the password if a new one was provided\n      if (options.cookiePassword) {\n        this.cookiePassword = options.cookiePassword;\n      }\n\n      this.sessionData = authenticationResponse.sealedSession as string;\n\n      const {\n        sid: sessionId,\n        org_id: organizationId,\n        role,\n        roles,\n        permissions,\n        entitlements,\n        feature_flags: featureFlags,\n      } = decodeJwt<AccessToken>(authenticationResponse.accessToken);\n\n      // TODO: Returning `session` here means there's some duplicated data.\n      // Slim down the return type in a future major version.\n      return {\n        authenticated: true,\n        sealedSession: authenticationResponse.sealedSession,\n        session: authenticationResponse as AuthenticationResponse,\n        sessionId,\n        organizationId,\n        role,\n        roles,\n        permissions,\n        entitlements,\n        featureFlags,\n        user: session.user,\n        impersonator: session.impersonator,\n      };\n    } catch (error) {\n      if (\n        error instanceof OauthException &&\n        // TODO: Add additional known errors and remove re-throw\n        (error.error === RefreshSessionFailureReason.INVALID_GRANT ||\n          error.error === RefreshSessionFailureReason.MFA_ENROLLMENT ||\n          error.error === RefreshSessionFailureReason.SSO_REQUIRED)\n      ) {\n        return {\n          authenticated: false,\n          reason: error.error,\n        };\n      }\n\n      throw error;\n    }\n  }\n\n  /**\n   * Gets the URL to redirect the user to for logging out.\n   *\n   * @returns The URL to redirect the user to for logging out.\n   */\n  async getLogoutUrl({\n    returnTo,\n  }: { returnTo?: string } = {}): Promise<string> {\n    const authenticationResponse = await this.authenticate();\n\n    if (!authenticationResponse.authenticated) {\n      const { reason } = authenticationResponse;\n      throw new Error(`Failed to extract session ID for logout URL: ${reason}`);\n    }\n\n    return this.userManagement.getLogoutUrl({\n      sessionId: authenticationResponse.sessionId,\n      returnTo,\n    });\n  }\n\n  private async isValidJwt(accessToken: string): Promise<boolean> {\n    const { jwtVerify } = await getJose();\n    const jwks = await this.userManagement.getJWKS();\n    if (!jwks) {\n      throw new Error(\n        'Missing client ID. Did you provide it when initializing WorkOS?',\n      );\n    }\n\n    try {\n      await jwtVerify(accessToken, jwks);\n      return true;\n    } catch (e) {\n      return false;\n    }\n  }\n}\n"],"mappings":";;;;;;;AAoBA,IAAa,gBAAb,MAA2B;CACzB,AAAQ;CACR,AAAQ;CACR,AAAQ;CAER,YACE,gBACA,aACA,gBACA;AACA,MAAI,CAAC,eACH,OAAM,IAAI,MAAM,6BAA6B;AAG/C,OAAK,iBAAiB;AACtB,OAAK,iBAAiB;AACtB,OAAK,cAAc;;;;;;;CAQrB,MAAM,eAGJ;AACA,MAAI,CAAC,KAAK,YACR,QAAO;GACL,eAAe;GACf,QACE,2CAA2C;GAC9C;EAGH,IAAIA;AAEJ,MAAI;AACF,aAAU,MAAM,WAA8B,KAAK,aAAa,EAC9D,UAAU,KAAK,gBAChB,CAAC;WACK,GAAG;AACV,UAAO;IACL,eAAe;IACf,QACE,2CAA2C;IAC9C;;AAGH,MAAI,CAAC,QAAQ,YACX,QAAO;GACL,eAAe;GACf,QACE,2CAA2C;GAC9C;AAGH,MAAI,CAAE,MAAM,KAAK,WAAW,QAAQ,YAAY,CAC9C,QAAO;GACL,eAAe;GACf,QAAQ,2CAA2C;GACpD;EAGH,MAAM,EAAE,cAAc,MAAM,SAAS;EAErC,MAAM,EACJ,KAAK,WACL,QAAQ,gBACR,MACA,OACA,aACA,cACA,eAAe,iBACb,UAAuB,QAAQ,YAAY;AAE/C,SAAO;GACL,eAAe;GACf;GACA;GACA;GACA;GACA;GACA;GACA;GACA,MAAM,QAAQ;GACd,cAAc,QAAQ;GACtB,aAAa,QAAQ;GACtB;;;;;;;;;;CAWH,MAAM,QAAQ,UAA0B,EAAE,EAAmC;EAC3E,MAAM,EAAE,cAAc,MAAM,SAAS;EACrC,MAAM,UAAU,MAAM,WAA8B,KAAK,aAAa,EACpE,UAAU,KAAK,gBAChB,CAAC;AAEF,MAAI,CAAC,QAAQ,gBAAgB,CAAC,QAAQ,KACpC,QAAO;GACL,eAAe;GACf,QAAQ,4BAA4B;GACrC;EAGH,MAAM,EAAE,QAAQ,kCAAkC,UAChD,QAAQ,YACT;AAED,MAAI;GACF,MAAM,iBAAiB,QAAQ,kBAAkB,KAAK;GAEtD,MAAM,yBACJ,MAAM,KAAK,eAAe,6BAA6B;IACrD,UAAU,KAAK,eAAe;IAC9B,cAAc,QAAQ;IACtB,gBACE,QAAQ,kBAAkB;IAC5B,SAAS;KAEP,aAAa;KACb;KACD;IACF,CAAC;AAGJ,OAAI,QAAQ,eACV,MAAK,iBAAiB,QAAQ;AAGhC,QAAK,cAAc,uBAAuB;GAE1C,MAAM,EACJ,KAAK,WACL,QAAQ,gBACR,MACA,OACA,aACA,cACA,eAAe,iBACb,UAAuB,uBAAuB,YAAY;AAI9D,UAAO;IACL,eAAe;IACf,eAAe,uBAAuB;IACtC,SAAS;IACT;IACA;IACA;IACA;IACA;IACA;IACA;IACA,MAAM,QAAQ;IACd,cAAc,QAAQ;IACvB;WACM,OAAO;AACd,OACE,iBAAiB,mBAEhB,MAAM,UAAU,4BAA4B,iBAC3C,MAAM,UAAU,4BAA4B,kBAC5C,MAAM,UAAU,4BAA4B,cAE9C,QAAO;IACL,eAAe;IACf,QAAQ,MAAM;IACf;AAGH,SAAM;;;;;;;;CASV,MAAM,aAAa,EACjB,aACyB,EAAE,EAAmB;EAC9C,MAAM,yBAAyB,MAAM,KAAK,cAAc;AAExD,MAAI,CAAC,uBAAuB,eAAe;GACzC,MAAM,EAAE,WAAW;AACnB,SAAM,IAAI,MAAM,gDAAgD,SAAS;;AAG3E,SAAO,KAAK,eAAe,aAAa;GACtC,WAAW,uBAAuB;GAClC;GACD,CAAC;;CAGJ,MAAc,WAAW,aAAuC;EAC9D,MAAM,EAAE,cAAc,MAAM,SAAS;EACrC,MAAM,OAAO,MAAM,KAAK,eAAe,SAAS;AAChD,MAAI,CAAC,KACH,OAAM,IAAI,MACR,kEACD;AAGH,MAAI;AACF,SAAM,UAAU,aAAa,KAAK;AAClC,UAAO;WACA,GAAG;AACV,UAAO"}

package/lib/user-management/user-management.cjs

@@ -0,0 +1,376 @@
+const require_client_user_management = require('../client/user-management.cjs');
+const require_user_management_serializers_authenticate_with_code_options_serializer = require('./serializers/authenticate-with-code-options.serializer.cjs');
+const require_user_management_serializers_authenticate_with_code_and_verifier_options_serializer = require('./serializers/authenticate-with-code-and-verifier-options.serializer.cjs');
+const require_user_management_serializers_authenticate_with_magic_auth_options_serializer = require('./serializers/authenticate-with-magic-auth-options.serializer.cjs');
+const require_user_management_serializers_authenticate_with_password_options_serializer = require('./serializers/authenticate-with-password-options.serializer.cjs');
+const require_user_management_serializers_authenticate_with_refresh_token_options_serializer = require('./serializers/authenticate-with-refresh-token.options.serializer.cjs');
+const require_user_management_serializers_authenticate_with_totp_options_serializer = require('./serializers/authenticate-with-totp-options.serializer.cjs');
+const require_user_management_serializers_user_serializer = require('./serializers/user.serializer.cjs');
+const require_user_management_serializers_authentication_response_serializer = require('./serializers/authentication-response.serializer.cjs');
+const require_user_management_serializers_create_magic_auth_options_serializer = require('./serializers/create-magic-auth-options.serializer.cjs');
+const require_user_management_serializers_create_password_reset_options_serializer = require('./serializers/create-password-reset-options.serializer.cjs');
+const require_user_management_serializers_email_verification_serializer = require('./serializers/email-verification.serializer.cjs');
+const require_user_management_serializers_enroll_auth_factor_options_serializer = require('./serializers/enroll-auth-factor-options.serializer.cjs');
+const require_user_management_serializers_factor_serializer = require('./serializers/factor.serializer.cjs');
+const require_user_management_serializers_invitation_serializer = require('./serializers/invitation.serializer.cjs');
+const require_user_management_serializers_list_sessions_options_serializer = require('./serializers/list-sessions-options.serializer.cjs');
+const require_user_management_serializers_magic_auth_serializer = require('./serializers/magic-auth.serializer.cjs');
+const require_user_management_serializers_password_reset_serializer = require('./serializers/password-reset.serializer.cjs');
+const require_user_management_serializers_reset_password_options_serializer = require('./serializers/reset-password-options.serializer.cjs');
+const require_user_management_serializers_session_serializer = require('./serializers/session.serializer.cjs');
+const require_user_management_serializers_create_user_options_serializer = require('./serializers/create-user-options.serializer.cjs');
+const require_user_management_serializers_update_user_options_serializer = require('./serializers/update-user-options.serializer.cjs');
+const require_user_management_serializers_organization_membership_serializer = require('./serializers/organization-membership.serializer.cjs');
+const require_common_utils_pagination = require('../common/utils/pagination.cjs');
+const require_common_utils_fetch_and_deserialize = require('../common/utils/fetch-and-deserialize.cjs');
+const require_feature_flags_serializers_feature_flag_serializer = require('../feature-flags/serializers/feature-flag.serializer.cjs');
+const require_mfa_serializers_challenge_serializer = require('../mfa/serializers/challenge.serializer.cjs');
+const require_common_utils_env = require('../common/utils/env.cjs');
+const require_user_management_interfaces_authenticate_with_session_cookie_interface = require('./interfaces/authenticate-with-session-cookie.interface.cjs');
+const require_user_management_interfaces_revoke_session_options_interface = require('./interfaces/revoke-session-options.interface.cjs');
+const require_user_management_serializers_authenticate_with_email_verification_serializer = require('./serializers/authenticate-with-email-verification.serializer.cjs');
+const require_user_management_serializers_authenticate_with_organization_selection_options_serializer = require('./serializers/authenticate-with-organization-selection-options.serializer.cjs');
+const require_user_management_serializers_create_organization_membership_options_serializer = require('./serializers/create-organization-membership-options.serializer.cjs');
+const require_user_management_serializers_identity_serializer = require('./serializers/identity.serializer.cjs');
+const require_user_management_serializers_list_invitations_options_serializer = require('./serializers/list-invitations-options.serializer.cjs');
+const require_user_management_serializers_list_organization_memberships_options_serializer = require('./serializers/list-organization-memberships-options.serializer.cjs');
+const require_user_management_serializers_list_users_options_serializer = require('./serializers/list-users-options.serializer.cjs');
+const require_user_management_serializers_send_invitation_options_serializer = require('./serializers/send-invitation-options.serializer.cjs');
+const require_user_management_serializers_update_organization_membership_options_serializer = require('./serializers/update-organization-membership-options.serializer.cjs');
+const require_utils_jose = require('../utils/jose.cjs');
+const require_user_management_session = require('./session.cjs');
+let iron_session = require("iron-session");
+
+//#region src/user-management/user-management.ts
+var UserManagement = class {
+	_jwks;
+	clientId;
+	constructor(workos) {
+		this.workos = workos;
+		const { clientId } = workos.options;
+		this.clientId = clientId;
+	}
+	async getJWKS() {
+		const { createRemoteJWKSet } = await require_utils_jose.getJose();
+		if (!this.clientId) return;
+		this._jwks ??= createRemoteJWKSet(new URL(this.getJwksUrl(this.clientId)), { cooldownDuration: 1e3 * 60 * 5 });
+		return this._jwks;
+	}
+	/**
+	* Loads a sealed session using the provided session data and cookie password.
+	*
+	* @param options - The options for loading the sealed session.
+	* @param options.sessionData - The sealed session data.
+	* @param options.cookiePassword - The password used to encrypt the session data.
+	* @returns The session class.
+	*/
+	loadSealedSession(options) {
+		return new require_user_management_session.CookieSession(this, options.sessionData, options.cookiePassword);
+	}
+	async getUser(userId) {
+		const { data } = await this.workos.get(`/user_management/users/${userId}`);
+		return require_user_management_serializers_user_serializer.deserializeUser(data);
+	}
+	async getUserByExternalId(externalId) {
+		const { data } = await this.workos.get(`/user_management/users/external_id/${externalId}`);
+		return require_user_management_serializers_user_serializer.deserializeUser(data);
+	}
+	async listUsers(options) {
+		return new require_common_utils_pagination.AutoPaginatable(await require_common_utils_fetch_and_deserialize.fetchAndDeserialize(this.workos, "/user_management/users", require_user_management_serializers_user_serializer.deserializeUser, options ? require_user_management_serializers_list_users_options_serializer.serializeListUsersOptions(options) : void 0), (params) => require_common_utils_fetch_and_deserialize.fetchAndDeserialize(this.workos, "/user_management/users", require_user_management_serializers_user_serializer.deserializeUser, params), options ? require_user_management_serializers_list_users_options_serializer.serializeListUsersOptions(options) : void 0);
+	}
+	async createUser(payload) {
+		const { data } = await this.workos.post("/user_management/users", require_user_management_serializers_create_user_options_serializer.serializeCreateUserOptions(payload));
+		return require_user_management_serializers_user_serializer.deserializeUser(data);
+	}
+	async authenticateWithMagicAuth(payload) {
+		const { session, ...remainingPayload } = payload;
+		const { data } = await this.workos.post("/user_management/authenticate", require_user_management_serializers_authenticate_with_magic_auth_options_serializer.serializeAuthenticateWithMagicAuthOptions({
+			...remainingPayload,
+			clientSecret: this.workos.key
+		}));
+		return this.prepareAuthenticationResponse({
+			authenticationResponse: require_user_management_serializers_authentication_response_serializer.deserializeAuthenticationResponse(data),
+			session
+		});
+	}
+	async authenticateWithPassword(payload) {
+		const { session, ...remainingPayload } = payload;
+		const { data } = await this.workos.post("/user_management/authenticate", require_user_management_serializers_authenticate_with_password_options_serializer.serializeAuthenticateWithPasswordOptions({
+			...remainingPayload,
+			clientSecret: this.workos.key
+		}));
+		return this.prepareAuthenticationResponse({
+			authenticationResponse: require_user_management_serializers_authentication_response_serializer.deserializeAuthenticationResponse(data),
+			session
+		});
+	}
+	async authenticateWithCode(payload) {
+		const { session, ...remainingPayload } = payload;
+		const { data } = await this.workos.post("/user_management/authenticate", require_user_management_serializers_authenticate_with_code_options_serializer.serializeAuthenticateWithCodeOptions({
+			...remainingPayload,
+			clientSecret: this.workos.key
+		}));
+		return this.prepareAuthenticationResponse({
+			authenticationResponse: require_user_management_serializers_authentication_response_serializer.deserializeAuthenticationResponse(data),
+			session
+		});
+	}
+	async authenticateWithCodeAndVerifier(payload) {
+		const { session, ...remainingPayload } = payload;
+		const { data } = await this.workos.post("/user_management/authenticate", require_user_management_serializers_authenticate_with_code_and_verifier_options_serializer.serializeAuthenticateWithCodeAndVerifierOptions(remainingPayload));
+		return this.prepareAuthenticationResponse({
+			authenticationResponse: require_user_management_serializers_authentication_response_serializer.deserializeAuthenticationResponse(data),
+			session
+		});
+	}
+	async authenticateWithRefreshToken(payload) {
+		const { session, ...remainingPayload } = payload;
+		const { data } = await this.workos.post("/user_management/authenticate", require_user_management_serializers_authenticate_with_refresh_token_options_serializer.serializeAuthenticateWithRefreshTokenOptions({
+			...remainingPayload,
+			clientSecret: this.workos.key
+		}));
+		return this.prepareAuthenticationResponse({
+			authenticationResponse: require_user_management_serializers_authentication_response_serializer.deserializeAuthenticationResponse(data),
+			session
+		});
+	}
+	async authenticateWithTotp(payload) {
+		const { session, ...remainingPayload } = payload;
+		const { data } = await this.workos.post("/user_management/authenticate", require_user_management_serializers_authenticate_with_totp_options_serializer.serializeAuthenticateWithTotpOptions({
+			...remainingPayload,
+			clientSecret: this.workos.key
+		}));
+		return this.prepareAuthenticationResponse({
+			authenticationResponse: require_user_management_serializers_authentication_response_serializer.deserializeAuthenticationResponse(data),
+			session
+		});
+	}
+	async authenticateWithEmailVerification(payload) {
+		const { session, ...remainingPayload } = payload;
+		const { data } = await this.workos.post("/user_management/authenticate", require_user_management_serializers_authenticate_with_email_verification_serializer.serializeAuthenticateWithEmailVerificationOptions({
+			...remainingPayload,
+			clientSecret: this.workos.key
+		}));
+		return this.prepareAuthenticationResponse({
+			authenticationResponse: require_user_management_serializers_authentication_response_serializer.deserializeAuthenticationResponse(data),
+			session
+		});
+	}
+	async authenticateWithOrganizationSelection(payload) {
+		const { session, ...remainingPayload } = payload;
+		const { data } = await this.workos.post("/user_management/authenticate", require_user_management_serializers_authenticate_with_organization_selection_options_serializer.serializeAuthenticateWithOrganizationSelectionOptions({
+			...remainingPayload,
+			clientSecret: this.workos.key
+		}));
+		return this.prepareAuthenticationResponse({
+			authenticationResponse: require_user_management_serializers_authentication_response_serializer.deserializeAuthenticationResponse(data),
+			session
+		});
+	}
+	async authenticateWithSessionCookie({ sessionData, cookiePassword = require_common_utils_env.getEnv("WORKOS_COOKIE_PASSWORD") }) {
+		if (!cookiePassword) throw new Error("Cookie password is required");
+		if (!await this.getJWKS()) throw new Error("Must provide clientId to initialize JWKS");
+		const { decodeJwt } = await require_utils_jose.getJose();
+		if (!sessionData) return {
+			authenticated: false,
+			reason: require_user_management_interfaces_authenticate_with_session_cookie_interface.AuthenticateWithSessionCookieFailureReason.NO_SESSION_COOKIE_PROVIDED
+		};
+		const session = await (0, iron_session.unsealData)(sessionData, { password: cookiePassword });
+		if (!session.accessToken) return {
+			authenticated: false,
+			reason: require_user_management_interfaces_authenticate_with_session_cookie_interface.AuthenticateWithSessionCookieFailureReason.INVALID_SESSION_COOKIE
+		};
+		if (!await this.isValidJwt(session.accessToken)) return {
+			authenticated: false,
+			reason: require_user_management_interfaces_authenticate_with_session_cookie_interface.AuthenticateWithSessionCookieFailureReason.INVALID_JWT
+		};
+		const { sid: sessionId, org_id: organizationId, role, roles, permissions, entitlements, feature_flags: featureFlags } = decodeJwt(session.accessToken);
+		return {
+			authenticated: true,
+			sessionId,
+			organizationId,
+			role,
+			roles,
+			user: session.user,
+			permissions,
+			entitlements,
+			featureFlags,
+			accessToken: session.accessToken
+		};
+	}
+	async isValidJwt(accessToken) {
+		const jwks = await this.getJWKS();
+		const { jwtVerify } = await require_utils_jose.getJose();
+		if (!jwks) throw new Error("Must provide clientId to initialize JWKS");
+		try {
+			await jwtVerify(accessToken, jwks);
+			return true;
+		} catch (e) {
+			return false;
+		}
+	}
+	async prepareAuthenticationResponse({ authenticationResponse, session }) {
+		if (session?.sealSession) return {
+			...authenticationResponse,
+			sealedSession: await this.sealSessionDataFromAuthenticationResponse({
+				authenticationResponse,
+				cookiePassword: session.cookiePassword
+			})
+		};
+		return authenticationResponse;
+	}
+	async sealSessionDataFromAuthenticationResponse({ authenticationResponse, cookiePassword }) {
+		if (!cookiePassword) throw new Error("Cookie password is required");
+		const { decodeJwt } = await require_utils_jose.getJose();
+		const { org_id: organizationIdFromAccessToken } = decodeJwt(authenticationResponse.accessToken);
+		return (0, iron_session.sealData)({
+			organizationId: organizationIdFromAccessToken,
+			user: authenticationResponse.user,
+			accessToken: authenticationResponse.accessToken,
+			refreshToken: authenticationResponse.refreshToken,
+			impersonator: authenticationResponse.impersonator
+		}, { password: cookiePassword });
+	}
+	async getSessionFromCookie({ sessionData, cookiePassword = require_common_utils_env.getEnv("WORKOS_COOKIE_PASSWORD") }) {
+		if (!cookiePassword) throw new Error("Cookie password is required");
+		if (sessionData) return (0, iron_session.unsealData)(sessionData, { password: cookiePassword });
+	}
+	async getEmailVerification(emailVerificationId) {
+		const { data } = await this.workos.get(`/user_management/email_verification/${emailVerificationId}`);
+		return require_user_management_serializers_email_verification_serializer.deserializeEmailVerification(data);
+	}
+	async sendVerificationEmail({ userId }) {
+		const { data } = await this.workos.post(`/user_management/users/${userId}/email_verification/send`, {});
+		return { user: require_user_management_serializers_user_serializer.deserializeUser(data.user) };
+	}
+	async getMagicAuth(magicAuthId) {
+		const { data } = await this.workos.get(`/user_management/magic_auth/${magicAuthId}`);
+		return require_user_management_serializers_magic_auth_serializer.deserializeMagicAuth(data);
+	}
+	async createMagicAuth(options) {
+		const { data } = await this.workos.post("/user_management/magic_auth", require_user_management_serializers_create_magic_auth_options_serializer.serializeCreateMagicAuthOptions({ ...options }));
+		return require_user_management_serializers_magic_auth_serializer.deserializeMagicAuth(data);
+	}
+	async verifyEmail({ code, userId }) {
+		const { data } = await this.workos.post(`/user_management/users/${userId}/email_verification/confirm`, { code });
+		return { user: require_user_management_serializers_user_serializer.deserializeUser(data.user) };
+	}
+	async getPasswordReset(passwordResetId) {
+		const { data } = await this.workos.get(`/user_management/password_reset/${passwordResetId}`);
+		return require_user_management_serializers_password_reset_serializer.deserializePasswordReset(data);
+	}
+	async createPasswordReset(options) {
+		const { data } = await this.workos.post("/user_management/password_reset", require_user_management_serializers_create_password_reset_options_serializer.serializeCreatePasswordResetOptions({ ...options }));
+		return require_user_management_serializers_password_reset_serializer.deserializePasswordReset(data);
+	}
+	async resetPassword(payload) {
+		const { data } = await this.workos.post("/user_management/password_reset/confirm", require_user_management_serializers_reset_password_options_serializer.serializeResetPasswordOptions(payload));
+		return { user: require_user_management_serializers_user_serializer.deserializeUser(data.user) };
+	}
+	async updateUser(payload) {
+		const { data } = await this.workos.put(`/user_management/users/${payload.userId}`, require_user_management_serializers_update_user_options_serializer.serializeUpdateUserOptions(payload));
+		return require_user_management_serializers_user_serializer.deserializeUser(data);
+	}
+	async enrollAuthFactor(payload) {
+		const { data } = await this.workos.post(`/user_management/users/${payload.userId}/auth_factors`, require_user_management_serializers_enroll_auth_factor_options_serializer.serializeEnrollAuthFactorOptions(payload));
+		return {
+			authenticationFactor: require_user_management_serializers_factor_serializer.deserializeFactorWithSecrets(data.authentication_factor),
+			authenticationChallenge: require_mfa_serializers_challenge_serializer.deserializeChallenge(data.authentication_challenge)
+		};
+	}
+	async listAuthFactors(options) {
+		const { userId, ...restOfOptions } = options;
+		return new require_common_utils_pagination.AutoPaginatable(await require_common_utils_fetch_and_deserialize.fetchAndDeserialize(this.workos, `/user_management/users/${userId}/auth_factors`, require_user_management_serializers_factor_serializer.deserializeFactor, restOfOptions), (params) => require_common_utils_fetch_and_deserialize.fetchAndDeserialize(this.workos, `/user_management/users/${userId}/auth_factors`, require_user_management_serializers_factor_serializer.deserializeFactor, params), restOfOptions);
+	}
+	async listUserFeatureFlags(options) {
+		const { userId, ...paginationOptions } = options;
+		return new require_common_utils_pagination.AutoPaginatable(await require_common_utils_fetch_and_deserialize.fetchAndDeserialize(this.workos, `/user_management/users/${userId}/feature-flags`, require_feature_flags_serializers_feature_flag_serializer.deserializeFeatureFlag, paginationOptions), (params) => require_common_utils_fetch_and_deserialize.fetchAndDeserialize(this.workos, `/user_management/users/${userId}/feature-flags`, require_feature_flags_serializers_feature_flag_serializer.deserializeFeatureFlag, params), paginationOptions);
+	}
+	async listSessions(userId, options) {
+		return new require_common_utils_pagination.AutoPaginatable(await require_common_utils_fetch_and_deserialize.fetchAndDeserialize(this.workos, `/user_management/users/${userId}/sessions`, require_user_management_serializers_session_serializer.deserializeSession, options ? require_user_management_serializers_list_sessions_options_serializer.serializeListSessionsOptions(options) : void 0), (params) => require_common_utils_fetch_and_deserialize.fetchAndDeserialize(this.workos, `/user_management/users/${userId}/sessions`, require_user_management_serializers_session_serializer.deserializeSession, params), options ? require_user_management_serializers_list_sessions_options_serializer.serializeListSessionsOptions(options) : void 0);
+	}
+	async deleteUser(userId) {
+		await this.workos.delete(`/user_management/users/${userId}`);
+	}
+	async getUserIdentities(userId) {
+		if (!userId) throw new TypeError(`Incomplete arguments. Need to specify 'userId'.`);
+		const { data } = await this.workos.get(`/user_management/users/${userId}/identities`);
+		return require_user_management_serializers_identity_serializer.deserializeIdentities(data);
+	}
+	async getOrganizationMembership(organizationMembershipId) {
+		const { data } = await this.workos.get(`/user_management/organization_memberships/${organizationMembershipId}`);
+		return require_user_management_serializers_organization_membership_serializer.deserializeOrganizationMembership(data);
+	}
+	async listOrganizationMemberships(options) {
+		const serializedOptions = require_user_management_serializers_list_organization_memberships_options_serializer.serializeListOrganizationMembershipsOptions(options);
+		return new require_common_utils_pagination.AutoPaginatable(await require_common_utils_fetch_and_deserialize.fetchAndDeserialize(this.workos, "/user_management/organization_memberships", require_user_management_serializers_organization_membership_serializer.deserializeOrganizationMembership, serializedOptions), (params) => require_common_utils_fetch_and_deserialize.fetchAndDeserialize(this.workos, "/user_management/organization_memberships", require_user_management_serializers_organization_membership_serializer.deserializeOrganizationMembership, params), serializedOptions);
+	}
+	async createOrganizationMembership(options) {
+		const { data } = await this.workos.post("/user_management/organization_memberships", require_user_management_serializers_create_organization_membership_options_serializer.serializeCreateOrganizationMembershipOptions(options));
+		return require_user_management_serializers_organization_membership_serializer.deserializeOrganizationMembership(data);
+	}
+	async updateOrganizationMembership(organizationMembershipId, options) {
+		const { data } = await this.workos.put(`/user_management/organization_memberships/${organizationMembershipId}`, require_user_management_serializers_update_organization_membership_options_serializer.serializeUpdateOrganizationMembershipOptions(options));
+		return require_user_management_serializers_organization_membership_serializer.deserializeOrganizationMembership(data);
+	}
+	async deleteOrganizationMembership(organizationMembershipId) {
+		await this.workos.delete(`/user_management/organization_memberships/${organizationMembershipId}`);
+	}
+	async deactivateOrganizationMembership(organizationMembershipId) {
+		const { data } = await this.workos.put(`/user_management/organization_memberships/${organizationMembershipId}/deactivate`, {});
+		return require_user_management_serializers_organization_membership_serializer.deserializeOrganizationMembership(data);
+	}
+	async reactivateOrganizationMembership(organizationMembershipId) {
+		const { data } = await this.workos.put(`/user_management/organization_memberships/${organizationMembershipId}/reactivate`, {});
+		return require_user_management_serializers_organization_membership_serializer.deserializeOrganizationMembership(data);
+	}
+	async getInvitation(invitationId) {
+		const { data } = await this.workos.get(`/user_management/invitations/${invitationId}`);
+		return require_user_management_serializers_invitation_serializer.deserializeInvitation(data);
+	}
+	async findInvitationByToken(invitationToken) {
+		const { data } = await this.workos.get(`/user_management/invitations/by_token/${invitationToken}`);
+		return require_user_management_serializers_invitation_serializer.deserializeInvitation(data);
+	}
+	async listInvitations(options) {
+		return new require_common_utils_pagination.AutoPaginatable(await require_common_utils_fetch_and_deserialize.fetchAndDeserialize(this.workos, "/user_management/invitations", require_user_management_serializers_invitation_serializer.deserializeInvitation, options ? require_user_management_serializers_list_invitations_options_serializer.serializeListInvitationsOptions(options) : void 0), (params) => require_common_utils_fetch_and_deserialize.fetchAndDeserialize(this.workos, "/user_management/invitations", require_user_management_serializers_invitation_serializer.deserializeInvitation, params), options ? require_user_management_serializers_list_invitations_options_serializer.serializeListInvitationsOptions(options) : void 0);
+	}
+	async sendInvitation(payload) {
+		const { data } = await this.workos.post("/user_management/invitations", require_user_management_serializers_send_invitation_options_serializer.serializeSendInvitationOptions({ ...payload }));
+		return require_user_management_serializers_invitation_serializer.deserializeInvitation(data);
+	}
+	async acceptInvitation(invitationId) {
+		const { data } = await this.workos.post(`/user_management/invitations/${invitationId}/accept`, null);
+		return require_user_management_serializers_invitation_serializer.deserializeInvitation(data);
+	}
+	async revokeInvitation(invitationId) {
+		const { data } = await this.workos.post(`/user_management/invitations/${invitationId}/revoke`, null);
+		return require_user_management_serializers_invitation_serializer.deserializeInvitation(data);
+	}
+	async resendInvitation(invitationId) {
+		const { data } = await this.workos.post(`/user_management/invitations/${invitationId}/resend`, null);
+		return require_user_management_serializers_invitation_serializer.deserializeInvitation(data);
+	}
+	async revokeSession(payload) {
+		await this.workos.post("/user_management/sessions/revoke", require_user_management_interfaces_revoke_session_options_interface.serializeRevokeSessionOptions(payload));
+	}
+	getAuthorizationUrl(options) {
+		return require_client_user_management.getAuthorizationUrl({
+			...options,
+			baseURL: this.workos.baseURL
+		});
+	}
+	getLogoutUrl(options) {
+		return require_client_user_management.getLogoutUrl({
+			...options,
+			baseURL: this.workos.baseURL
+		});
+	}
+	getJwksUrl(clientId) {
+		return require_client_user_management.getJwksUrl(clientId, this.workos.baseURL);
+	}
+};
+
+//#endregion
+exports.UserManagement = UserManagement;
+//# sourceMappingURL=user-management.cjs.map