@workos-inc/node 8.0.0-rc.9 → 8.0.0

package/lib/session-9omTtyoD.cjs

@@ -0,0 +1,144 @@
+const require_oauth_exception = require('./oauth.exception-BJAv3tg-.cjs');
+const require_seal = require('./seal-Dl5Et6Vv.cjs');
+const require_authenticate_with_session_cookie_interface = require('./authenticate-with-session-cookie.interface-wRJr18ep.cjs');
+const require_refresh_and_seal_session_data_interface = require('./refresh-and-seal-session-data.interface-CseekR4v.cjs');
+const require_jose = require('./jose-D0f0CVnA.cjs');
+
+//#region src/user-management/session.ts
+var CookieSession = class {
+	userManagement;
+	cookiePassword;
+	sessionData;
+	constructor(userManagement, sessionData, cookiePassword) {
+		if (!cookiePassword) throw new Error("cookiePassword is required");
+		this.userManagement = userManagement;
+		this.cookiePassword = cookiePassword;
+		this.sessionData = sessionData;
+	}
+	/**
+	* Authenticates a user with a session cookie.
+	*
+	* @returns An object indicating whether the authentication was successful or not. If successful, it will include the user's session data.
+	*/
+	async authenticate() {
+		if (!this.sessionData) return {
+			authenticated: false,
+			reason: require_authenticate_with_session_cookie_interface.AuthenticateWithSessionCookieFailureReason.NO_SESSION_COOKIE_PROVIDED
+		};
+		const session = await require_seal.unsealData(this.sessionData, { password: this.cookiePassword });
+		if (!session.accessToken) return {
+			authenticated: false,
+			reason: require_authenticate_with_session_cookie_interface.AuthenticateWithSessionCookieFailureReason.INVALID_SESSION_COOKIE
+		};
+		if (!await this.isValidJwt(session.accessToken)) return {
+			authenticated: false,
+			reason: require_authenticate_with_session_cookie_interface.AuthenticateWithSessionCookieFailureReason.INVALID_JWT
+		};
+		const { decodeJwt } = await require_jose.getJose();
+		const { sid: sessionId, org_id: organizationId, role, roles, permissions, entitlements, feature_flags: featureFlags } = decodeJwt(session.accessToken);
+		return {
+			authenticated: true,
+			sessionId,
+			organizationId,
+			role,
+			roles,
+			permissions,
+			entitlements,
+			featureFlags,
+			user: session.user,
+			authenticationMethod: session.authenticationMethod,
+			impersonator: session.impersonator,
+			accessToken: session.accessToken
+		};
+	}
+	/**
+	* Refreshes the user's session.
+	*
+	* @param options - Optional options for refreshing the session.
+	* @param options.cookiePassword - The password to use for the new session cookie.
+	* @param options.organizationId - The organization ID to use for the new session cookie.
+	* @returns An object indicating whether the refresh was successful or not. If successful, it will include the new sealed session data.
+	*/
+	async refresh(options = {}) {
+		const { decodeJwt } = await require_jose.getJose();
+		const session = await require_seal.unsealData(this.sessionData, { password: this.cookiePassword });
+		if (!session.refreshToken || !session.user) return {
+			authenticated: false,
+			reason: require_refresh_and_seal_session_data_interface.RefreshSessionFailureReason.INVALID_SESSION_COOKIE
+		};
+		const { org_id: organizationIdFromAccessToken } = decodeJwt(session.accessToken);
+		try {
+			const cookiePassword = options.cookiePassword ?? this.cookiePassword;
+			const authenticationResponse = await this.userManagement.authenticateWithRefreshToken({
+				clientId: this.userManagement.clientId,
+				refreshToken: session.refreshToken,
+				organizationId: options.organizationId ?? organizationIdFromAccessToken,
+				session: {
+					sealSession: true,
+					cookiePassword
+				}
+			});
+			if (options.cookiePassword) this.cookiePassword = options.cookiePassword;
+			this.sessionData = authenticationResponse.sealedSession;
+			const { sid: sessionId, org_id: organizationId, role, roles, permissions, entitlements, feature_flags: featureFlags } = decodeJwt(authenticationResponse.accessToken);
+			return {
+				authenticated: true,
+				sealedSession: authenticationResponse.sealedSession,
+				session: authenticationResponse,
+				authenticationMethod: authenticationResponse.authenticationMethod,
+				sessionId,
+				organizationId,
+				role,
+				roles,
+				permissions,
+				entitlements,
+				featureFlags,
+				user: session.user,
+				impersonator: session.impersonator
+			};
+		} catch (error) {
+			if (error instanceof require_oauth_exception.OauthException && (error.error === require_refresh_and_seal_session_data_interface.RefreshSessionFailureReason.INVALID_GRANT || error.error === require_refresh_and_seal_session_data_interface.RefreshSessionFailureReason.MFA_ENROLLMENT || error.error === require_refresh_and_seal_session_data_interface.RefreshSessionFailureReason.SSO_REQUIRED)) return {
+				authenticated: false,
+				reason: error.error
+			};
+			throw error;
+		}
+	}
+	/**
+	* Gets the URL to redirect the user to for logging out.
+	*
+	* @returns The URL to redirect the user to for logging out.
+	*/
+	async getLogoutUrl({ returnTo } = {}) {
+		const authenticationResponse = await this.authenticate();
+		if (!authenticationResponse.authenticated) {
+			const { reason } = authenticationResponse;
+			throw new Error(`Failed to extract session ID for logout URL: ${reason}`);
+		}
+		return this.userManagement.getLogoutUrl({
+			sessionId: authenticationResponse.sessionId,
+			returnTo
+		});
+	}
+	async isValidJwt(accessToken) {
+		const { jwtVerify } = await require_jose.getJose();
+		const jwks = await this.userManagement.getJWKS();
+		if (!jwks) throw new Error("Missing client ID. Did you provide it when initializing WorkOS?");
+		try {
+			await jwtVerify(accessToken, jwks);
+			return true;
+		} catch (e) {
+			if (e instanceof Error && "code" in e && typeof e.code === "string" && (e.code.startsWith("ERR_JWT_") || e.code.startsWith("ERR_JWS_"))) return false;
+			throw e;
+		}
+	}
+};
+
+//#endregion
+Object.defineProperty(exports, 'CookieSession', {
+  enumerable: true,
+  get: function () {
+    return CookieSession;
+  }
+});
+//# sourceMappingURL=session-9omTtyoD.cjs.map

package/lib/session-9omTtyoD.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-9omTtyoD.cjs","names":["AuthenticateWithSessionCookieFailureReason","unsealData","getJose","RefreshSessionFailureReason","OauthException"],"sources":["../src/user-management/session.ts"],"sourcesContent":["import { OauthException } from '../common/exceptions/oauth.exception';\nimport {\n  AccessToken,\n  AuthenticateWithSessionCookieFailedResponse,\n  AuthenticateWithSessionCookieFailureReason,\n  AuthenticateWithSessionCookieSuccessResponse,\n  AuthenticationResponse,\n  RefreshSessionFailureReason,\n  RefreshSessionResponse,\n  SessionCookieData,\n} from './interfaces';\nimport { UserManagement } from './user-management';\nimport { unsealData } from '../common/crypto/seal';\nimport { getJose } from '../utils/jose';\n\ntype RefreshOptions = {\n  cookiePassword?: string;\n  organizationId?: string;\n};\n\nexport class CookieSession {\n  private userManagement: UserManagement;\n  private cookiePassword: string;\n  private sessionData: string;\n\n  constructor(\n    userManagement: UserManagement,\n    sessionData: string,\n    cookiePassword: string,\n  ) {\n    if (!cookiePassword) {\n      throw new Error('cookiePassword is required');\n    }\n\n    this.userManagement = userManagement;\n    this.cookiePassword = cookiePassword;\n    this.sessionData = sessionData;\n  }\n\n  /**\n   * Authenticates a user with a session cookie.\n   *\n   * @returns An object indicating whether the authentication was successful or not. If successful, it will include the user's session data.\n   */\n  async authenticate(): Promise<\n    | AuthenticateWithSessionCookieSuccessResponse\n    | AuthenticateWithSessionCookieFailedResponse\n  > {\n    if (!this.sessionData) {\n      return {\n        authenticated: false,\n        reason:\n          AuthenticateWithSessionCookieFailureReason.NO_SESSION_COOKIE_PROVIDED,\n      };\n    }\n\n    // unsealData returns {} for known seal errors (expired, bad hmac, etc.)\n    // Unknown errors propagate - don't catch them as \"invalid session\"\n    const session = await unsealData<SessionCookieData>(this.sessionData, {\n      password: this.cookiePassword,\n    });\n\n    if (!session.accessToken) {\n      return {\n        authenticated: false,\n        reason:\n          AuthenticateWithSessionCookieFailureReason.INVALID_SESSION_COOKIE,\n      };\n    }\n\n    if (!(await this.isValidJwt(session.accessToken))) {\n      return {\n        authenticated: false,\n        reason: AuthenticateWithSessionCookieFailureReason.INVALID_JWT,\n      };\n    }\n\n    const { decodeJwt } = await getJose();\n\n    const {\n      sid: sessionId,\n      org_id: organizationId,\n      role,\n      roles,\n      permissions,\n      entitlements,\n      feature_flags: featureFlags,\n    } = decodeJwt<AccessToken>(session.accessToken);\n\n    return {\n      authenticated: true,\n      sessionId,\n      organizationId,\n      role,\n      roles,\n      permissions,\n      entitlements,\n      featureFlags,\n      user: session.user,\n      authenticationMethod: session.authenticationMethod,\n      impersonator: session.impersonator,\n      accessToken: session.accessToken,\n    };\n  }\n\n  /**\n   * Refreshes the user's session.\n   *\n   * @param options - Optional options for refreshing the session.\n   * @param options.cookiePassword - The password to use for the new session cookie.\n   * @param options.organizationId - The organization ID to use for the new session cookie.\n   * @returns An object indicating whether the refresh was successful or not. If successful, it will include the new sealed session data.\n   */\n  async refresh(options: RefreshOptions = {}): Promise<RefreshSessionResponse> {\n    const { decodeJwt } = await getJose();\n    const session = await unsealData<SessionCookieData>(this.sessionData, {\n      password: this.cookiePassword,\n    });\n\n    if (!session.refreshToken || !session.user) {\n      return {\n        authenticated: false,\n        reason: RefreshSessionFailureReason.INVALID_SESSION_COOKIE,\n      };\n    }\n\n    const { org_id: organizationIdFromAccessToken } = decodeJwt<AccessToken>(\n      session.accessToken,\n    );\n\n    try {\n      const cookiePassword = options.cookiePassword ?? this.cookiePassword;\n\n      const authenticationResponse =\n        await this.userManagement.authenticateWithRefreshToken({\n          clientId: this.userManagement.clientId as string,\n          refreshToken: session.refreshToken,\n          organizationId:\n            options.organizationId ?? organizationIdFromAccessToken,\n          session: {\n            // We want to store the new sealed session in this class instance, so this always needs to be true\n            sealSession: true,\n            cookiePassword,\n          },\n        });\n\n      // Update the password if a new one was provided\n      if (options.cookiePassword) {\n        this.cookiePassword = options.cookiePassword;\n      }\n\n      this.sessionData = authenticationResponse.sealedSession as string;\n\n      const {\n        sid: sessionId,\n        org_id: organizationId,\n        role,\n        roles,\n        permissions,\n        entitlements,\n        feature_flags: featureFlags,\n      } = decodeJwt<AccessToken>(authenticationResponse.accessToken);\n\n      // TODO: Returning `session` here means there's some duplicated data.\n      // Slim down the return type in a future major version.\n      return {\n        authenticated: true,\n        sealedSession: authenticationResponse.sealedSession,\n        session: authenticationResponse as AuthenticationResponse,\n        authenticationMethod: authenticationResponse.authenticationMethod,\n        sessionId,\n        organizationId,\n        role,\n        roles,\n        permissions,\n        entitlements,\n        featureFlags,\n        user: session.user,\n        impersonator: session.impersonator,\n      };\n    } catch (error) {\n      if (\n        error instanceof OauthException &&\n        // TODO: Add additional known errors and remove re-throw\n        (error.error === RefreshSessionFailureReason.INVALID_GRANT ||\n          error.error === RefreshSessionFailureReason.MFA_ENROLLMENT ||\n          error.error === RefreshSessionFailureReason.SSO_REQUIRED)\n      ) {\n        return {\n          authenticated: false,\n          reason: error.error,\n        };\n      }\n\n      throw error;\n    }\n  }\n\n  /**\n   * Gets the URL to redirect the user to for logging out.\n   *\n   * @returns The URL to redirect the user to for logging out.\n   */\n  async getLogoutUrl({\n    returnTo,\n  }: { returnTo?: string } = {}): Promise<string> {\n    const authenticationResponse = await this.authenticate();\n\n    if (!authenticationResponse.authenticated) {\n      const { reason } = authenticationResponse;\n      throw new Error(`Failed to extract session ID for logout URL: ${reason}`);\n    }\n\n    return this.userManagement.getLogoutUrl({\n      sessionId: authenticationResponse.sessionId,\n      returnTo,\n    });\n  }\n\n  private async isValidJwt(accessToken: string): Promise<boolean> {\n    const { jwtVerify } = await getJose();\n    const jwks = await this.userManagement.getJWKS();\n    if (!jwks) {\n      throw new Error(\n        'Missing client ID. Did you provide it when initializing WorkOS?',\n      );\n    }\n\n    try {\n      await jwtVerify(accessToken, jwks);\n      return true;\n    } catch (e) {\n      // Only treat as invalid JWT if it's an actual JWT/JWS error from jose\n      // Network errors, crypto failures, etc. should propagate\n      if (\n        e instanceof Error &&\n        'code' in e &&\n        typeof e.code === 'string' &&\n        (e.code.startsWith('ERR_JWT_') || e.code.startsWith('ERR_JWS_'))\n      ) {\n        return false;\n      }\n      throw e;\n    }\n  }\n}\n"],"mappings":";;;;;;;AAoBA,IAAa,gBAAb,MAA2B;CACzB,AAAQ;CACR,AAAQ;CACR,AAAQ;CAER,YACE,gBACA,aACA,gBACA;AACA,MAAI,CAAC,eACH,OAAM,IAAI,MAAM,6BAA6B;AAG/C,OAAK,iBAAiB;AACtB,OAAK,iBAAiB;AACtB,OAAK,cAAc;;;;;;;CAQrB,MAAM,eAGJ;AACA,MAAI,CAAC,KAAK,YACR,QAAO;GACL,eAAe;GACf,QACEA,8FAA2C;GAC9C;EAKH,MAAM,UAAU,MAAMC,wBAA8B,KAAK,aAAa,EACpE,UAAU,KAAK,gBAChB,CAAC;AAEF,MAAI,CAAC,QAAQ,YACX,QAAO;GACL,eAAe;GACf,QACED,8FAA2C;GAC9C;AAGH,MAAI,CAAE,MAAM,KAAK,WAAW,QAAQ,YAAY,CAC9C,QAAO;GACL,eAAe;GACf,QAAQA,8FAA2C;GACpD;EAGH,MAAM,EAAE,cAAc,MAAME,sBAAS;EAErC,MAAM,EACJ,KAAK,WACL,QAAQ,gBACR,MACA,OACA,aACA,cACA,eAAe,iBACb,UAAuB,QAAQ,YAAY;AAE/C,SAAO;GACL,eAAe;GACf;GACA;GACA;GACA;GACA;GACA;GACA;GACA,MAAM,QAAQ;GACd,sBAAsB,QAAQ;GAC9B,cAAc,QAAQ;GACtB,aAAa,QAAQ;GACtB;;;;;;;;;;CAWH,MAAM,QAAQ,UAA0B,EAAE,EAAmC;EAC3E,MAAM,EAAE,cAAc,MAAMA,sBAAS;EACrC,MAAM,UAAU,MAAMD,wBAA8B,KAAK,aAAa,EACpE,UAAU,KAAK,gBAChB,CAAC;AAEF,MAAI,CAAC,QAAQ,gBAAgB,CAAC,QAAQ,KACpC,QAAO;GACL,eAAe;GACf,QAAQE,4EAA4B;GACrC;EAGH,MAAM,EAAE,QAAQ,kCAAkC,UAChD,QAAQ,YACT;AAED,MAAI;GACF,MAAM,iBAAiB,QAAQ,kBAAkB,KAAK;GAEtD,MAAM,yBACJ,MAAM,KAAK,eAAe,6BAA6B;IACrD,UAAU,KAAK,eAAe;IAC9B,cAAc,QAAQ;IACtB,gBACE,QAAQ,kBAAkB;IAC5B,SAAS;KAEP,aAAa;KACb;KACD;IACF,CAAC;AAGJ,OAAI,QAAQ,eACV,MAAK,iBAAiB,QAAQ;AAGhC,QAAK,cAAc,uBAAuB;GAE1C,MAAM,EACJ,KAAK,WACL,QAAQ,gBACR,MACA,OACA,aACA,cACA,eAAe,iBACb,UAAuB,uBAAuB,YAAY;AAI9D,UAAO;IACL,eAAe;IACf,eAAe,uBAAuB;IACtC,SAAS;IACT,sBAAsB,uBAAuB;IAC7C;IACA;IACA;IACA;IACA;IACA;IACA;IACA,MAAM,QAAQ;IACd,cAAc,QAAQ;IACvB;WACM,OAAO;AACd,OACE,iBAAiBC,2CAEhB,MAAM,UAAUD,4EAA4B,iBAC3C,MAAM,UAAUA,4EAA4B,kBAC5C,MAAM,UAAUA,4EAA4B,cAE9C,QAAO;IACL,eAAe;IACf,QAAQ,MAAM;IACf;AAGH,SAAM;;;;;;;;CASV,MAAM,aAAa,EACjB,aACyB,EAAE,EAAmB;EAC9C,MAAM,yBAAyB,MAAM,KAAK,cAAc;AAExD,MAAI,CAAC,uBAAuB,eAAe;GACzC,MAAM,EAAE,WAAW;AACnB,SAAM,IAAI,MAAM,gDAAgD,SAAS;;AAG3E,SAAO,KAAK,eAAe,aAAa;GACtC,WAAW,uBAAuB;GAClC;GACD,CAAC;;CAGJ,MAAc,WAAW,aAAuC;EAC9D,MAAM,EAAE,cAAc,MAAMD,sBAAS;EACrC,MAAM,OAAO,MAAM,KAAK,eAAe,SAAS;AAChD,MAAI,CAAC,KACH,OAAM,IAAI,MACR,kEACD;AAGH,MAAI;AACF,SAAM,UAAU,aAAa,KAAK;AAClC,UAAO;WACA,GAAG;AAGV,OACE,aAAa,SACb,UAAU,KACV,OAAO,EAAE,SAAS,aACjB,EAAE,KAAK,WAAW,WAAW,IAAI,EAAE,KAAK,WAAW,WAAW,EAE/D,QAAO;AAET,SAAM"}

package/lib/session-handler-options.interface-DxF6E6ug.d.cts

@@ -0,0 +1,9 @@
+//#region src/user-management/interfaces/session-handler-options.interface.d.ts
+interface SessionHandlerOptions {
+  sessionData: string;
+  cookiePassword?: string;
+  organizationId?: string;
+}
+//#endregion
+export { SessionHandlerOptions as t };
+//# sourceMappingURL=session-handler-options.interface-DxF6E6ug.d.cts.map

package/lib/session.interface-BL6GFmCP.d.cts

@@ -0,0 +1,38 @@
+import { t as Impersonator } from "./impersonator.interface-Vr4-B1pz.cjs";
+
+//#region src/user-management/interfaces/session.interface.d.ts
+type AuthMethod = 'external_auth' | 'impersonation' | 'magic_code' | 'migrated_session' | 'oauth' | 'passkey' | 'password' | 'sso' | 'unknown';
+type SessionStatus = 'active' | 'expired' | 'revoked';
+interface Session {
+  object: 'session';
+  id: string;
+  userId: string;
+  ipAddress: string | null;
+  userAgent: string | null;
+  organizationId?: string;
+  impersonator?: Impersonator;
+  authMethod: AuthMethod;
+  status: SessionStatus;
+  expiresAt: string;
+  endedAt: string | null;
+  createdAt: string;
+  updatedAt: string;
+}
+interface SessionResponse {
+  object: 'session';
+  id: string;
+  user_id: string;
+  ip_address: string | null;
+  user_agent: string | null;
+  organization_id?: string;
+  impersonator?: Impersonator;
+  auth_method: AuthMethod;
+  status: SessionStatus;
+  expires_at: string;
+  ended_at: string | null;
+  created_at: string;
+  updated_at: string;
+}
+//#endregion
+export { SessionStatus as i, Session as n, SessionResponse as r, AuthMethod as t };
+//# sourceMappingURL=session.interface-BL6GFmCP.d.cts.map

package/lib/session.serializer-DfnhKR5i.d.cts

@@ -0,0 +1,7 @@
+import { n as Session, r as SessionResponse } from "./session.interface-BL6GFmCP.cjs";
+
+//#region src/user-management/serializers/session.serializer.d.ts
+declare const deserializeSession: (session: SessionResponse) => Session;
+//#endregion
+export { deserializeSession as t };
+//# sourceMappingURL=session.serializer-DfnhKR5i.d.cts.map

package/lib/session.serializer-Dmj9Hm3q.cjs

@@ -0,0 +1,26 @@
+
+//#region src/user-management/serializers/session.serializer.ts
+const deserializeSession = (session) => ({
+	object: "session",
+	id: session.id,
+	userId: session.user_id,
+	ipAddress: session.ip_address,
+	userAgent: session.user_agent,
+	organizationId: session.organization_id,
+	impersonator: session.impersonator,
+	authMethod: session.auth_method,
+	status: session.status,
+	expiresAt: session.expires_at,
+	endedAt: session.ended_at,
+	createdAt: session.created_at,
+	updatedAt: session.updated_at
+});
+
+//#endregion
+Object.defineProperty(exports, 'deserializeSession', {
+  enumerable: true,
+  get: function () {
+    return deserializeSession;
+  }
+});
+//# sourceMappingURL=session.serializer-Dmj9Hm3q.cjs.map

package/lib/session.serializer-Dmj9Hm3q.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.serializer-Dmj9Hm3q.cjs","names":[],"sources":["../src/user-management/serializers/session.serializer.ts"],"sourcesContent":["import { Session, SessionResponse } from '../interfaces';\n\nexport const deserializeSession = (session: SessionResponse): Session => ({\n  object: 'session',\n  id: session.id,\n  userId: session.user_id,\n  ipAddress: session.ip_address,\n  userAgent: session.user_agent,\n  organizationId: session.organization_id,\n  impersonator: session.impersonator,\n  authMethod: session.auth_method,\n  status: session.status,\n  expiresAt: session.expires_at,\n  endedAt: session.ended_at,\n  createdAt: session.created_at,\n  updatedAt: session.updated_at,\n});\n"],"mappings":";;AAEA,MAAa,sBAAsB,aAAuC;CACxE,QAAQ;CACR,IAAI,QAAQ;CACZ,QAAQ,QAAQ;CAChB,WAAW,QAAQ;CACnB,WAAW,QAAQ;CACnB,gBAAgB,QAAQ;CACxB,cAAc,QAAQ;CACtB,YAAY,QAAQ;CACpB,QAAQ,QAAQ;CAChB,WAAW,QAAQ;CACnB,SAAS,QAAQ;CACjB,WAAW,QAAQ;CACnB,WAAW,QAAQ;CACpB"}

package/lib/signature-provider-Dx4cy5vI.cjs

@@ -0,0 +1,38 @@
+const require_signature_verification_exception = require('./signature-verification.exception-Dc1gSCYD.cjs');
+
+//#region src/common/crypto/signature-provider.ts
+var SignatureProvider = class {
+	cryptoProvider;
+	constructor(cryptoProvider) {
+		this.cryptoProvider = cryptoProvider;
+	}
+	async verifyHeader({ payload, sigHeader, secret, tolerance = 18e4 }) {
+		const [timestamp, signatureHash] = this.getTimestampAndSignatureHash(sigHeader);
+		if (!signatureHash || Object.keys(signatureHash).length === 0) throw new require_signature_verification_exception.SignatureVerificationException("No signature hash found with expected scheme v1");
+		if (parseInt(timestamp, 10) < Date.now() - tolerance) throw new require_signature_verification_exception.SignatureVerificationException("Timestamp outside the tolerance zone");
+		const expectedSig = await this.computeSignature(timestamp, payload, secret);
+		if (await this.cryptoProvider.secureCompare(expectedSig, signatureHash) === false) throw new require_signature_verification_exception.SignatureVerificationException("Signature hash does not match the expected signature hash for payload");
+		return true;
+	}
+	getTimestampAndSignatureHash(sigHeader) {
+		const [t, v1] = sigHeader.split(",");
+		if (typeof t === "undefined" || typeof v1 === "undefined") throw new require_signature_verification_exception.SignatureVerificationException("Signature or timestamp missing");
+		const { 1: timestamp } = t.split("=");
+		const { 1: signatureHash } = v1.split("=");
+		return [timestamp, signatureHash];
+	}
+	async computeSignature(timestamp, payload, secret) {
+		payload = JSON.stringify(payload);
+		const signedPayload = `${timestamp}.${payload}`;
+		return await this.cryptoProvider.computeHMACSignatureAsync(signedPayload, secret);
+	}
+};
+
+//#endregion
+Object.defineProperty(exports, 'SignatureProvider', {
+  enumerable: true,
+  get: function () {
+    return SignatureProvider;
+  }
+});
+//# sourceMappingURL=signature-provider-Dx4cy5vI.cjs.map

package/lib/signature-provider-Dx4cy5vI.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature-provider-Dx4cy5vI.cjs","names":["SignatureVerificationException"],"sources":["../src/common/crypto/signature-provider.ts"],"sourcesContent":["import { SignatureVerificationException } from '../exceptions';\nimport { CryptoProvider } from './crypto-provider';\n\nexport class SignatureProvider {\n  private cryptoProvider: CryptoProvider;\n\n  constructor(cryptoProvider: CryptoProvider) {\n    this.cryptoProvider = cryptoProvider;\n  }\n\n  async verifyHeader({\n    payload,\n    sigHeader,\n    secret,\n    tolerance = 180000,\n  }: {\n    payload: any;\n    sigHeader: string;\n    secret: string;\n    tolerance?: number;\n  }): Promise<boolean> {\n    const [timestamp, signatureHash] =\n      this.getTimestampAndSignatureHash(sigHeader);\n\n    if (!signatureHash || Object.keys(signatureHash).length === 0) {\n      throw new SignatureVerificationException(\n        'No signature hash found with expected scheme v1',\n      );\n    }\n\n    if (parseInt(timestamp, 10) < Date.now() - tolerance) {\n      throw new SignatureVerificationException(\n        'Timestamp outside the tolerance zone',\n      );\n    }\n\n    const expectedSig = await this.computeSignature(timestamp, payload, secret);\n    if (\n      (await this.cryptoProvider.secureCompare(expectedSig, signatureHash)) ===\n      false\n    ) {\n      throw new SignatureVerificationException(\n        'Signature hash does not match the expected signature hash for payload',\n      );\n    }\n    return true;\n  }\n\n  getTimestampAndSignatureHash(sigHeader: string): [string, string] {\n    const signature = sigHeader;\n    const [t, v1] = signature.split(',');\n    if (typeof t === 'undefined' || typeof v1 === 'undefined') {\n      throw new SignatureVerificationException(\n        'Signature or timestamp missing',\n      );\n    }\n    const { 1: timestamp } = t.split('=');\n    const { 1: signatureHash } = v1.split('=');\n\n    return [timestamp, signatureHash];\n  }\n\n  async computeSignature(\n    timestamp: any,\n    payload: any,\n    secret: string,\n  ): Promise<string> {\n    payload = JSON.stringify(payload);\n    const signedPayload = `${timestamp}.${payload}`;\n\n    return await this.cryptoProvider.computeHMACSignatureAsync(\n      signedPayload,\n      secret,\n    );\n  }\n}\n"],"mappings":";;;AAGA,IAAa,oBAAb,MAA+B;CAC7B,AAAQ;CAER,YAAY,gBAAgC;AAC1C,OAAK,iBAAiB;;CAGxB,MAAM,aAAa,EACjB,SACA,WACA,QACA,YAAY,QAMO;EACnB,MAAM,CAAC,WAAW,iBAChB,KAAK,6BAA6B,UAAU;AAE9C,MAAI,CAAC,iBAAiB,OAAO,KAAK,cAAc,CAAC,WAAW,EAC1D,OAAM,IAAIA,wEACR,kDACD;AAGH,MAAI,SAAS,WAAW,GAAG,GAAG,KAAK,KAAK,GAAG,UACzC,OAAM,IAAIA,wEACR,uCACD;EAGH,MAAM,cAAc,MAAM,KAAK,iBAAiB,WAAW,SAAS,OAAO;AAC3E,MACG,MAAM,KAAK,eAAe,cAAc,aAAa,cAAc,KACpE,MAEA,OAAM,IAAIA,wEACR,wEACD;AAEH,SAAO;;CAGT,6BAA6B,WAAqC;EAEhE,MAAM,CAAC,GAAG,MADQ,UACQ,MAAM,IAAI;AACpC,MAAI,OAAO,MAAM,eAAe,OAAO,OAAO,YAC5C,OAAM,IAAIA,wEACR,iCACD;EAEH,MAAM,EAAE,GAAG,cAAc,EAAE,MAAM,IAAI;EACrC,MAAM,EAAE,GAAG,kBAAkB,GAAG,MAAM,IAAI;AAE1C,SAAO,CAAC,WAAW,cAAc;;CAGnC,MAAM,iBACJ,WACA,SACA,QACiB;AACjB,YAAU,KAAK,UAAU,QAAQ;EACjC,MAAM,gBAAgB,GAAG,UAAU,GAAG;AAEtC,SAAO,MAAM,KAAK,eAAe,0BAC/B,eACA,OACD"}

package/lib/signature-verification.exception-Bdz2blO4.d.cts

@@ -0,0 +1,8 @@
+//#region src/common/exceptions/signature-verification.exception.d.ts
+declare class SignatureVerificationException extends Error {
+  readonly name = "SignatureVerificationException";
+  constructor(message: string);
+}
+//#endregion
+export { SignatureVerificationException as t };
+//# sourceMappingURL=signature-verification.exception-Bdz2blO4.d.cts.map

package/lib/signature-verification.exception-Dc1gSCYD.cjs

@@ -0,0 +1,17 @@
+
+//#region src/common/exceptions/signature-verification.exception.ts
+var SignatureVerificationException = class extends Error {
+	name = "SignatureVerificationException";
+	constructor(message) {
+		super(message || "Signature verification failed.");
+	}
+};
+
+//#endregion
+Object.defineProperty(exports, 'SignatureVerificationException', {
+  enumerable: true,
+  get: function () {
+    return SignatureVerificationException;
+  }
+});
+//# sourceMappingURL=signature-verification.exception-Dc1gSCYD.cjs.map

package/lib/signature-verification.exception-Dc1gSCYD.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature-verification.exception-Dc1gSCYD.cjs","names":[],"sources":["../src/common/exceptions/signature-verification.exception.ts"],"sourcesContent":["export class SignatureVerificationException extends Error {\n  readonly name = 'SignatureVerificationException';\n\n  constructor(message: string) {\n    super(message || 'Signature verification failed.');\n  }\n}\n"],"mappings":";;AAAA,IAAa,iCAAb,cAAoD,MAAM;CACxD,AAAS,OAAO;CAEhB,YAAY,SAAiB;AAC3B,QAAM,WAAW,iCAAiC"}

package/lib/sms.interface-CCvvcYpl.d.cts

@@ -0,0 +1,10 @@
+//#region src/mfa/interfaces/sms.interface.d.ts
+interface Sms {
+  phoneNumber: string;
+}
+interface SmsResponse {
+  phone_number: string;
+}
+//#endregion
+export { SmsResponse as n, Sms as t };
+//# sourceMappingURL=sms.interface-CCvvcYpl.d.cts.map

package/lib/sms.serializer-X3xntG8l.cjs

@@ -0,0 +1,12 @@
+
+//#region src/mfa/serializers/sms.serializer.ts
+const deserializeSms = (sms) => ({ phoneNumber: sms.phone_number });
+
+//#endregion
+Object.defineProperty(exports, 'deserializeSms', {
+  enumerable: true,
+  get: function () {
+    return deserializeSms;
+  }
+});
+//# sourceMappingURL=sms.serializer-X3xntG8l.cjs.map

package/lib/sms.serializer-X3xntG8l.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sms.serializer-X3xntG8l.cjs","names":[],"sources":["../src/mfa/serializers/sms.serializer.ts"],"sourcesContent":["import { Sms, SmsResponse } from '../interfaces';\n\nexport const deserializeSms = (sms: SmsResponse): Sms => ({\n  phoneNumber: sms.phone_number,\n});\n"],"mappings":";;AAEA,MAAa,kBAAkB,SAA2B,EACxD,aAAa,IAAI,cAClB"}

package/lib/sso/interfaces/authorization-url-options.interface.d.cts

@@ -1,55 +1,2 @@
-//#region src/sso/interfaces/authorization-url-options.interface.d.ts
-/**
- * PKCE fields must be provided together or not at all.
- * Use workos.pkce.generate() to create a valid pair.
- */
-type PKCEFields = {
-  codeChallenge?: never;
-  codeChallengeMethod?: never;
-} | {
-  codeChallenge: string;
-  codeChallengeMethod: 'S256';
-};
-interface SSOAuthorizationURLBaseFields {
-  clientId: string;
-  domainHint?: string;
-  loginHint?: string;
-  providerQueryParams?: Record<string, string | boolean | number>;
-  providerScopes?: string[];
-  redirectUri: string;
-  state?: string;
-}
-/**
- * Result of getAuthorizationUrlWithPKCE() containing the URL,
- * state, and PKCE code verifier.
- *
- * The codeVerifier must be stored securely and passed to
- * getProfileAndToken() during token exchange.
- */
-interface SSOPKCEAuthorizationURLResult {
-  /** The complete authorization URL to redirect the user to */
-  url: string;
-  /** The state parameter (auto-generated) */
-  state: string;
-  /** The PKCE code verifier. Store securely and pass to getProfileAndToken(). */
-  codeVerifier: string;
-}
-type SSOWithConnection = SSOAuthorizationURLBaseFields & PKCEFields & {
-  connection: string;
-  organization?: never;
-  provider?: never;
-};
-type SSOWithOrganization = SSOAuthorizationURLBaseFields & PKCEFields & {
-  organization: string;
-  connection?: never;
-  provider?: never;
-};
-type SSOWithProvider = SSOAuthorizationURLBaseFields & PKCEFields & {
-  provider: string;
-  connection?: never;
-  organization?: never;
-};
-type SSOAuthorizationURLOptions = SSOWithConnection | SSOWithOrganization | SSOWithProvider;
-//#endregion
-export { SSOAuthorizationURLOptions, SSOPKCEAuthorizationURLResult };
-//# sourceMappingURL=authorization-url-options.interface.d.cts.map
+import { n as SSOPKCEAuthorizationURLResult, t as SSOAuthorizationURLOptions } from "../../authorization-url-options.interface-ZrBipUt2.cjs";
+export { SSOAuthorizationURLOptions, SSOPKCEAuthorizationURLResult };

package/lib/sso/interfaces/connection-type.enum.cjs

@@ -1,44 +1,3 @@
+const require_connection_type_enum = require('../../connection-type.enum-CZfRWY9b.cjs');
 
-//#region src/sso/interfaces/connection-type.enum.ts
-let ConnectionType = /* @__PURE__ */ function(ConnectionType$1) {
-	ConnectionType$1["ADFSSAML"] = "ADFSSAML";
-	ConnectionType$1["AdpOidc"] = "AdpOidc";
-	ConnectionType$1["AppleOAuth"] = "AppleOAuth";
-	ConnectionType$1["Auth0SAML"] = "Auth0SAML";
-	ConnectionType$1["AzureSAML"] = "AzureSAML";
-	ConnectionType$1["CasSAML"] = "CasSAML";
-	ConnectionType$1["ClassLinkSAML"] = "ClassLinkSAML";
-	ConnectionType$1["CloudflareSAML"] = "CloudflareSAML";
-	ConnectionType$1["CyberArkSAML"] = "CyberArkSAML";
-	ConnectionType$1["DuoSAML"] = "DuoSAML";
-	ConnectionType$1["GenericOIDC"] = "GenericOIDC";
-	ConnectionType$1["GenericSAML"] = "GenericSAML";
-	ConnectionType$1["GitHubOAuth"] = "GitHubOAuth";
-	ConnectionType$1["GoogleOAuth"] = "GoogleOAuth";
-	ConnectionType$1["GoogleSAML"] = "GoogleSAML";
-	ConnectionType$1["JumpCloudSAML"] = "JumpCloudSAML";
-	ConnectionType$1["KeycloakSAML"] = "KeycloakSAML";
-	ConnectionType$1["LastPassSAML"] = "LastPassSAML";
-	ConnectionType$1["LoginGovOidc"] = "LoginGovOidc";
-	ConnectionType$1["MagicLink"] = "MagicLink";
-	ConnectionType$1["MicrosoftOAuth"] = "MicrosoftOAuth";
-	ConnectionType$1["MiniOrangeSAML"] = "MiniOrangeSAML";
-	ConnectionType$1["NetIqSAML"] = "NetIqSAML";
-	ConnectionType$1["OktaSAML"] = "OktaSAML";
-	ConnectionType$1["OneLoginSAML"] = "OneLoginSAML";
-	ConnectionType$1["OracleSAML"] = "OracleSAML";
-	ConnectionType$1["PingFederateSAML"] = "PingFederateSAML";
-	ConnectionType$1["PingOneSAML"] = "PingOneSAML";
-	ConnectionType$1["RipplingSAML"] = "RipplingSAML";
-	ConnectionType$1["SalesforceOAuth"] = "SalesforceOAuth";
-	ConnectionType$1["SalesforceSAML"] = "SalesforceSAML";
-	ConnectionType$1["ShibbolethGenericSAML"] = "ShibbolethGenericSAML";
-	ConnectionType$1["ShibbolethSAML"] = "ShibbolethSAML";
-	ConnectionType$1["SimpleSamlPhpSAML"] = "SimpleSamlPhpSAML";
-	ConnectionType$1["VMwareSAML"] = "VMwareSAML";
-	return ConnectionType$1;
-}({});
-
-//#endregion
-exports.ConnectionType = ConnectionType;
-//# sourceMappingURL=connection-type.enum.cjs.map
+exports.ConnectionType = require_connection_type_enum.ConnectionType;

package/lib/sso/interfaces/connection-type.enum.d.cts

@@ -1,41 +1,2 @@
-//#region src/sso/interfaces/connection-type.enum.d.ts
-declare enum ConnectionType {
-  ADFSSAML = "ADFSSAML",
-  AdpOidc = "AdpOidc",
-  AppleOAuth = "AppleOAuth",
-  Auth0SAML = "Auth0SAML",
-  AzureSAML = "AzureSAML",
-  CasSAML = "CasSAML",
-  ClassLinkSAML = "ClassLinkSAML",
-  CloudflareSAML = "CloudflareSAML",
-  CyberArkSAML = "CyberArkSAML",
-  DuoSAML = "DuoSAML",
-  GenericOIDC = "GenericOIDC",
-  GenericSAML = "GenericSAML",
-  GitHubOAuth = "GitHubOAuth",
-  GoogleOAuth = "GoogleOAuth",
-  GoogleSAML = "GoogleSAML",
-  JumpCloudSAML = "JumpCloudSAML",
-  KeycloakSAML = "KeycloakSAML",
-  LastPassSAML = "LastPassSAML",
-  LoginGovOidc = "LoginGovOidc",
-  MagicLink = "MagicLink",
-  MicrosoftOAuth = "MicrosoftOAuth",
-  MiniOrangeSAML = "MiniOrangeSAML",
-  NetIqSAML = "NetIqSAML",
-  OktaSAML = "OktaSAML",
-  OneLoginSAML = "OneLoginSAML",
-  OracleSAML = "OracleSAML",
-  PingFederateSAML = "PingFederateSAML",
-  PingOneSAML = "PingOneSAML",
-  RipplingSAML = "RipplingSAML",
-  SalesforceOAuth = "SalesforceOAuth",
-  SalesforceSAML = "SalesforceSAML",
-  ShibbolethGenericSAML = "ShibbolethGenericSAML",
-  ShibbolethSAML = "ShibbolethSAML",
-  SimpleSamlPhpSAML = "SimpleSamlPhpSAML",
-  VMwareSAML = "VMwareSAML",
-}
-//#endregion
-export { ConnectionType };
-//# sourceMappingURL=connection-type.enum.d.cts.map
+import { t as ConnectionType } from "../../connection-type.enum-CjWDQ5dq.cjs";
+export { ConnectionType };

package/lib/sso/interfaces/connection.interface.d.cts

@@ -1,33 +1,2 @@
-import { ConnectionType } from "./connection-type.enum.cjs";
-
-//#region src/sso/interfaces/connection.interface.d.ts
-interface ConnectionDomain {
-  object: 'connection_domain';
-  id: string;
-  domain: string;
-}
-interface Connection {
-  object: 'connection';
-  id: string;
-  organizationId?: string;
-  name: string;
-  state: 'draft' | 'active' | 'inactive' | 'validating';
-  domains: ConnectionDomain[];
-  type: ConnectionType;
-  createdAt: string;
-  updatedAt: string;
-}
-interface ConnectionResponse {
-  object: 'connection';
-  id: string;
-  organization_id?: string;
-  name: string;
-  connection_type: ConnectionType;
-  state: 'draft' | 'active' | 'inactive' | 'validating';
-  domains: ConnectionDomain[];
-  created_at: string;
-  updated_at: string;
-}
-//#endregion
-export { Connection, ConnectionDomain, ConnectionResponse };
-//# sourceMappingURL=connection.interface.d.cts.map
+import { n as ConnectionDomain, r as ConnectionResponse, t as Connection } from "../../connection.interface-DV7VmsKj.cjs";
+export { Connection, ConnectionDomain, ConnectionResponse };

package/lib/sso/interfaces/get-profile-and-token-options.interface.d.cts

@@ -1,14 +1,2 @@
-//#region src/sso/interfaces/get-profile-and-token-options.interface.d.ts
-interface GetProfileAndTokenOptions {
-  clientId: string;
-  code: string;
-  /**
-   * PKCE code verifier for public clients.
-   * Pass the codeVerifier that was generated with getAuthorizationUrlWithPKCE().
-   * When provided, client_secret is not sent (public client mode).
-   */
-  codeVerifier?: string;
-}
-//#endregion
-export { GetProfileAndTokenOptions };
-//# sourceMappingURL=get-profile-and-token-options.interface.d.cts.map
+import { t as GetProfileAndTokenOptions } from "../../get-profile-and-token-options.interface-CgiTXQNg.cjs";
+export { GetProfileAndTokenOptions };

package/lib/sso/interfaces/get-profile-options.interface.d.cts

@@ -1,7 +1,2 @@
-//#region src/sso/interfaces/get-profile-options.interface.d.ts
-interface GetProfileOptions {
-  accessToken: string;
-}
-//#endregion
-export { GetProfileOptions };
-//# sourceMappingURL=get-profile-options.interface.d.cts.map
+import { t as GetProfileOptions } from "../../get-profile-options.interface-CF_TcBM6.cjs";
+export { GetProfileOptions };

package/lib/sso/interfaces/index.cjs

@@ -1,3 +1,3 @@
-const require_sso_interfaces_connection_type_enum = require('./connection-type.enum.cjs');
+const require_connection_type_enum = require('../../connection-type.enum-CZfRWY9b.cjs');
 
-exports.ConnectionType = require_sso_interfaces_connection_type_enum.ConnectionType;
+exports.ConnectionType = require_connection_type_enum.ConnectionType;

package/lib/sso/interfaces/index.d.cts

@@ -1,9 +1,9 @@
-import { SSOAuthorizationURLOptions, SSOPKCEAuthorizationURLResult } from "./authorization-url-options.interface.cjs";
-import { ConnectionType } from "./connection-type.enum.cjs";
-import { Connection, ConnectionDomain, ConnectionResponse } from "./connection.interface.cjs";
-import { GetProfileOptions } from "./get-profile-options.interface.cjs";
-import { GetProfileAndTokenOptions } from "./get-profile-and-token-options.interface.cjs";
-import { ListConnectionsOptions, SerializedListConnectionsOptions } from "./list-connections-options.interface.cjs";
-import { Profile, ProfileResponse } from "./profile.interface.cjs";
-import { ProfileAndToken, ProfileAndTokenResponse } from "./profile-and-token.interface.cjs";
-export { Connection, ConnectionDomain, ConnectionResponse, ConnectionType, GetProfileAndTokenOptions, GetProfileOptions, ListConnectionsOptions, Profile, ProfileAndToken, ProfileAndTokenResponse, ProfileResponse, SSOAuthorizationURLOptions, type SSOPKCEAuthorizationURLResult, SerializedListConnectionsOptions };
+import { n as SSOPKCEAuthorizationURLResult, t as SSOAuthorizationURLOptions } from "../../authorization-url-options.interface-ZrBipUt2.cjs";
+import { t as ConnectionType } from "../../connection-type.enum-CjWDQ5dq.cjs";
+import { n as ConnectionDomain, r as ConnectionResponse, t as Connection } from "../../connection.interface-DV7VmsKj.cjs";
+import { t as GetProfileOptions } from "../../get-profile-options.interface-CF_TcBM6.cjs";
+import { t as GetProfileAndTokenOptions } from "../../get-profile-and-token-options.interface-CgiTXQNg.cjs";
+import { n as SerializedListConnectionsOptions, t as ListConnectionsOptions } from "../../list-connections-options.interface-C_4eo9BU.cjs";
+import { n as ProfileResponse, t as Profile } from "../../profile.interface-CPseQwyu.cjs";
+import { n as ProfileAndTokenResponse, t as ProfileAndToken } from "../../profile-and-token.interface-ZhaI1B_G.cjs";
+export { Connection, ConnectionDomain, ConnectionResponse, ConnectionType, GetProfileAndTokenOptions, GetProfileOptions, ListConnectionsOptions, Profile, ProfileAndToken, ProfileAndTokenResponse, ProfileResponse, SSOAuthorizationURLOptions, SSOPKCEAuthorizationURLResult, SerializedListConnectionsOptions };

package/lib/sso/interfaces/list-connections-options.interface.d.cts

@@ -1,17 +1,2 @@
-import { PaginationOptions } from "../../common/interfaces/pagination-options.interface.cjs";
-import { ConnectionType } from "./connection-type.enum.cjs";
-
-//#region src/sso/interfaces/list-connections-options.interface.d.ts
-interface ListConnectionsOptions extends PaginationOptions {
-  connectionType?: ConnectionType;
-  domain?: string;
-  organizationId?: string;
-}
-interface SerializedListConnectionsOptions extends PaginationOptions {
-  connection_type?: ConnectionType;
-  domain?: string;
-  organization_id?: string;
-}
-//#endregion
-export { ListConnectionsOptions, SerializedListConnectionsOptions };
-//# sourceMappingURL=list-connections-options.interface.d.cts.map
+import { n as SerializedListConnectionsOptions, t as ListConnectionsOptions } from "../../list-connections-options.interface-C_4eo9BU.cjs";
+export { ListConnectionsOptions, SerializedListConnectionsOptions };