@workos-inc/node 8.7.0 → 8.9.0

package/lib/user-management/session.js

@@ -1,139 +0,0 @@
-import { OauthException } from "../common/exceptions/oauth.exception.js";
-import { unsealData } from "../common/crypto/seal.js";
-import { AuthenticateWithSessionCookieFailureReason } from "./interfaces/authenticate-with-session-cookie.interface.js";
-import { RefreshSessionFailureReason } from "./interfaces/refresh-and-seal-session-data.interface.js";
-import { getJose } from "../utils/jose.js";
-
-//#region src/user-management/session.ts
-var CookieSession = class {
-	userManagement;
-	cookiePassword;
-	sessionData;
-	constructor(userManagement, sessionData, cookiePassword) {
-		if (!cookiePassword) throw new Error("cookiePassword is required");
-		this.userManagement = userManagement;
-		this.cookiePassword = cookiePassword;
-		this.sessionData = sessionData;
-	}
-	/**
-	* Authenticates a user with a session cookie.
-	*
-	* @returns An object indicating whether the authentication was successful or not. If successful, it will include the user's session data.
-	*/
-	async authenticate() {
-		if (!this.sessionData) return {
-			authenticated: false,
-			reason: AuthenticateWithSessionCookieFailureReason.NO_SESSION_COOKIE_PROVIDED
-		};
-		const session = await unsealData(this.sessionData, { password: this.cookiePassword });
-		if (!session.accessToken) return {
-			authenticated: false,
-			reason: AuthenticateWithSessionCookieFailureReason.INVALID_SESSION_COOKIE
-		};
-		if (!await this.isValidJwt(session.accessToken)) return {
-			authenticated: false,
-			reason: AuthenticateWithSessionCookieFailureReason.INVALID_JWT
-		};
-		const { decodeJwt } = await getJose();
-		const { sid: sessionId, org_id: organizationId, role, roles, permissions, entitlements, feature_flags: featureFlags } = decodeJwt(session.accessToken);
-		return {
-			authenticated: true,
-			sessionId,
-			organizationId,
-			role,
-			roles,
-			permissions,
-			entitlements,
-			featureFlags,
-			user: session.user,
-			authenticationMethod: session.authenticationMethod,
-			impersonator: session.impersonator,
-			accessToken: session.accessToken
-		};
-	}
-	/**
-	* Refreshes the user's session.
-	*
-	* @param options - Optional options for refreshing the session.
-	* @param options.cookiePassword - The password to use for the new session cookie.
-	* @param options.organizationId - The organization ID to use for the new session cookie.
-	* @returns An object indicating whether the refresh was successful or not. If successful, it will include the new sealed session data.
-	*/
-	async refresh(options = {}) {
-		const { decodeJwt } = await getJose();
-		const session = await unsealData(this.sessionData, { password: this.cookiePassword });
-		if (!session.refreshToken || !session.user) return {
-			authenticated: false,
-			reason: RefreshSessionFailureReason.INVALID_SESSION_COOKIE
-		};
-		const { org_id: organizationIdFromAccessToken } = decodeJwt(session.accessToken);
-		try {
-			const cookiePassword = options.cookiePassword ?? this.cookiePassword;
-			const authenticationResponse = await this.userManagement.authenticateWithRefreshToken({
-				clientId: this.userManagement.clientId,
-				refreshToken: session.refreshToken,
-				organizationId: options.organizationId ?? organizationIdFromAccessToken,
-				session: {
-					sealSession: true,
-					cookiePassword
-				}
-			});
-			if (options.cookiePassword) this.cookiePassword = options.cookiePassword;
-			this.sessionData = authenticationResponse.sealedSession;
-			const { sid: sessionId, org_id: organizationId, role, roles, permissions, entitlements, feature_flags: featureFlags } = decodeJwt(authenticationResponse.accessToken);
-			return {
-				authenticated: true,
-				sealedSession: authenticationResponse.sealedSession,
-				session: authenticationResponse,
-				authenticationMethod: authenticationResponse.authenticationMethod,
-				sessionId,
-				organizationId,
-				role,
-				roles,
-				permissions,
-				entitlements,
-				featureFlags,
-				user: session.user,
-				impersonator: session.impersonator
-			};
-		} catch (error) {
-			if (error instanceof OauthException && (error.error === RefreshSessionFailureReason.INVALID_GRANT || error.error === RefreshSessionFailureReason.MFA_ENROLLMENT || error.error === RefreshSessionFailureReason.SSO_REQUIRED)) return {
-				authenticated: false,
-				reason: error.error
-			};
-			throw error;
-		}
-	}
-	/**
-	* Gets the URL to redirect the user to for logging out.
-	*
-	* @returns The URL to redirect the user to for logging out.
-	*/
-	async getLogoutUrl({ returnTo } = {}) {
-		const authenticationResponse = await this.authenticate();
-		if (!authenticationResponse.authenticated) {
-			const { reason } = authenticationResponse;
-			throw new Error(`Failed to extract session ID for logout URL: ${reason}`);
-		}
-		return this.userManagement.getLogoutUrl({
-			sessionId: authenticationResponse.sessionId,
-			returnTo
-		});
-	}
-	async isValidJwt(accessToken) {
-		const { jwtVerify } = await getJose();
-		const jwks = await this.userManagement.getJWKS();
-		if (!jwks) throw new Error("Missing client ID. Did you provide it when initializing WorkOS?");
-		try {
-			await jwtVerify(accessToken, jwks);
-			return true;
-		} catch (e) {
-			if (e instanceof Error && "code" in e && typeof e.code === "string" && (e.code.startsWith("ERR_JWT_") || e.code.startsWith("ERR_JWS_"))) return false;
-			throw e;
-		}
-	}
-};
-
-//#endregion
-export { CookieSession };
-//# sourceMappingURL=session.js.map

package/lib/user-management/session.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"session.js","names":[],"sources":["../../src/user-management/session.ts"],"sourcesContent":["import { OauthException } from '../common/exceptions/oauth.exception';\nimport {\n  AccessToken,\n  AuthenticateWithSessionCookieFailedResponse,\n  AuthenticateWithSessionCookieFailureReason,\n  AuthenticateWithSessionCookieSuccessResponse,\n  AuthenticationResponse,\n  RefreshSessionFailureReason,\n  RefreshSessionResponse,\n  SessionCookieData,\n} from './interfaces';\nimport { UserManagement } from './user-management';\nimport { unsealData } from '../common/crypto/seal';\nimport { getJose } from '../utils/jose';\n\ntype RefreshOptions = {\n  cookiePassword?: string;\n  organizationId?: string;\n};\n\nexport class CookieSession {\n  private userManagement: UserManagement;\n  private cookiePassword: string;\n  private sessionData: string;\n\n  constructor(\n    userManagement: UserManagement,\n    sessionData: string,\n    cookiePassword: string,\n  ) {\n    if (!cookiePassword) {\n      throw new Error('cookiePassword is required');\n    }\n\n    this.userManagement = userManagement;\n    this.cookiePassword = cookiePassword;\n    this.sessionData = sessionData;\n  }\n\n  /**\n   * Authenticates a user with a session cookie.\n   *\n   * @returns An object indicating whether the authentication was successful or not. If successful, it will include the user's session data.\n   */\n  async authenticate(): Promise<\n    | AuthenticateWithSessionCookieSuccessResponse\n    | AuthenticateWithSessionCookieFailedResponse\n  > {\n    if (!this.sessionData) {\n      return {\n        authenticated: false,\n        reason:\n          AuthenticateWithSessionCookieFailureReason.NO_SESSION_COOKIE_PROVIDED,\n      };\n    }\n\n    // unsealData returns {} for known seal errors (expired, bad hmac, etc.)\n    // Unknown errors propagate - don't catch them as \"invalid session\"\n    const session = await unsealData<SessionCookieData>(this.sessionData, {\n      password: this.cookiePassword,\n    });\n\n    if (!session.accessToken) {\n      return {\n        authenticated: false,\n        reason:\n          AuthenticateWithSessionCookieFailureReason.INVALID_SESSION_COOKIE,\n      };\n    }\n\n    if (!(await this.isValidJwt(session.accessToken))) {\n      return {\n        authenticated: false,\n        reason: AuthenticateWithSessionCookieFailureReason.INVALID_JWT,\n      };\n    }\n\n    const { decodeJwt } = await getJose();\n\n    const {\n      sid: sessionId,\n      org_id: organizationId,\n      role,\n      roles,\n      permissions,\n      entitlements,\n      feature_flags: featureFlags,\n    } = decodeJwt<AccessToken>(session.accessToken);\n\n    return {\n      authenticated: true,\n      sessionId,\n      organizationId,\n      role,\n      roles,\n      permissions,\n      entitlements,\n      featureFlags,\n      user: session.user,\n      authenticationMethod: session.authenticationMethod,\n      impersonator: session.impersonator,\n      accessToken: session.accessToken,\n    };\n  }\n\n  /**\n   * Refreshes the user's session.\n   *\n   * @param options - Optional options for refreshing the session.\n   * @param options.cookiePassword - The password to use for the new session cookie.\n   * @param options.organizationId - The organization ID to use for the new session cookie.\n   * @returns An object indicating whether the refresh was successful or not. If successful, it will include the new sealed session data.\n   */\n  async refresh(options: RefreshOptions = {}): Promise<RefreshSessionResponse> {\n    const { decodeJwt } = await getJose();\n    const session = await unsealData<SessionCookieData>(this.sessionData, {\n      password: this.cookiePassword,\n    });\n\n    if (!session.refreshToken || !session.user) {\n      return {\n        authenticated: false,\n        reason: RefreshSessionFailureReason.INVALID_SESSION_COOKIE,\n      };\n    }\n\n    const { org_id: organizationIdFromAccessToken } = decodeJwt<AccessToken>(\n      session.accessToken,\n    );\n\n    try {\n      const cookiePassword = options.cookiePassword ?? this.cookiePassword;\n\n      const authenticationResponse =\n        await this.userManagement.authenticateWithRefreshToken({\n          clientId: this.userManagement.clientId as string,\n          refreshToken: session.refreshToken,\n          organizationId:\n            options.organizationId ?? organizationIdFromAccessToken,\n          session: {\n            // We want to store the new sealed session in this class instance, so this always needs to be true\n            sealSession: true,\n            cookiePassword,\n          },\n        });\n\n      // Update the password if a new one was provided\n      if (options.cookiePassword) {\n        this.cookiePassword = options.cookiePassword;\n      }\n\n      this.sessionData = authenticationResponse.sealedSession as string;\n\n      const {\n        sid: sessionId,\n        org_id: organizationId,\n        role,\n        roles,\n        permissions,\n        entitlements,\n        feature_flags: featureFlags,\n      } = decodeJwt<AccessToken>(authenticationResponse.accessToken);\n\n      // TODO: Returning `session` here means there's some duplicated data.\n      // Slim down the return type in a future major version.\n      return {\n        authenticated: true,\n        sealedSession: authenticationResponse.sealedSession,\n        session: authenticationResponse as AuthenticationResponse,\n        authenticationMethod: authenticationResponse.authenticationMethod,\n        sessionId,\n        organizationId,\n        role,\n        roles,\n        permissions,\n        entitlements,\n        featureFlags,\n        user: session.user,\n        impersonator: session.impersonator,\n      };\n    } catch (error) {\n      if (\n        error instanceof OauthException &&\n        // TODO: Add additional known errors and remove re-throw\n        (error.error === RefreshSessionFailureReason.INVALID_GRANT ||\n          error.error === RefreshSessionFailureReason.MFA_ENROLLMENT ||\n          error.error === RefreshSessionFailureReason.SSO_REQUIRED)\n      ) {\n        return {\n          authenticated: false,\n          reason: error.error,\n        };\n      }\n\n      throw error;\n    }\n  }\n\n  /**\n   * Gets the URL to redirect the user to for logging out.\n   *\n   * @returns The URL to redirect the user to for logging out.\n   */\n  async getLogoutUrl({\n    returnTo,\n  }: { returnTo?: string } = {}): Promise<string> {\n    const authenticationResponse = await this.authenticate();\n\n    if (!authenticationResponse.authenticated) {\n      const { reason } = authenticationResponse;\n      throw new Error(`Failed to extract session ID for logout URL: ${reason}`);\n    }\n\n    return this.userManagement.getLogoutUrl({\n      sessionId: authenticationResponse.sessionId,\n      returnTo,\n    });\n  }\n\n  private async isValidJwt(accessToken: string): Promise<boolean> {\n    const { jwtVerify } = await getJose();\n    const jwks = await this.userManagement.getJWKS();\n    if (!jwks) {\n      throw new Error(\n        'Missing client ID. Did you provide it when initializing WorkOS?',\n      );\n    }\n\n    try {\n      await jwtVerify(accessToken, jwks);\n      return true;\n    } catch (e) {\n      // Only treat as invalid JWT if it's an actual JWT/JWS error from jose\n      // Network errors, crypto failures, etc. should propagate\n      if (\n        e instanceof Error &&\n        'code' in e &&\n        typeof e.code === 'string' &&\n        (e.code.startsWith('ERR_JWT_') || e.code.startsWith('ERR_JWS_'))\n      ) {\n        return false;\n      }\n      throw e;\n    }\n  }\n}\n"],"mappings":";;;;;;;AAoBA,IAAa,gBAAb,MAA2B;CACzB,AAAQ;CACR,AAAQ;CACR,AAAQ;CAER,YACE,gBACA,aACA,gBACA;AACA,MAAI,CAAC,eACH,OAAM,IAAI,MAAM,6BAA6B;AAG/C,OAAK,iBAAiB;AACtB,OAAK,iBAAiB;AACtB,OAAK,cAAc;;;;;;;CAQrB,MAAM,eAGJ;AACA,MAAI,CAAC,KAAK,YACR,QAAO;GACL,eAAe;GACf,QACE,2CAA2C;GAC9C;EAKH,MAAM,UAAU,MAAM,WAA8B,KAAK,aAAa,EACpE,UAAU,KAAK,gBAChB,CAAC;AAEF,MAAI,CAAC,QAAQ,YACX,QAAO;GACL,eAAe;GACf,QACE,2CAA2C;GAC9C;AAGH,MAAI,CAAE,MAAM,KAAK,WAAW,QAAQ,YAAY,CAC9C,QAAO;GACL,eAAe;GACf,QAAQ,2CAA2C;GACpD;EAGH,MAAM,EAAE,cAAc,MAAM,SAAS;EAErC,MAAM,EACJ,KAAK,WACL,QAAQ,gBACR,MACA,OACA,aACA,cACA,eAAe,iBACb,UAAuB,QAAQ,YAAY;AAE/C,SAAO;GACL,eAAe;GACf;GACA;GACA;GACA;GACA;GACA;GACA;GACA,MAAM,QAAQ;GACd,sBAAsB,QAAQ;GAC9B,cAAc,QAAQ;GACtB,aAAa,QAAQ;GACtB;;;;;;;;;;CAWH,MAAM,QAAQ,UAA0B,EAAE,EAAmC;EAC3E,MAAM,EAAE,cAAc,MAAM,SAAS;EACrC,MAAM,UAAU,MAAM,WAA8B,KAAK,aAAa,EACpE,UAAU,KAAK,gBAChB,CAAC;AAEF,MAAI,CAAC,QAAQ,gBAAgB,CAAC,QAAQ,KACpC,QAAO;GACL,eAAe;GACf,QAAQ,4BAA4B;GACrC;EAGH,MAAM,EAAE,QAAQ,kCAAkC,UAChD,QAAQ,YACT;AAED,MAAI;GACF,MAAM,iBAAiB,QAAQ,kBAAkB,KAAK;GAEtD,MAAM,yBACJ,MAAM,KAAK,eAAe,6BAA6B;IACrD,UAAU,KAAK,eAAe;IAC9B,cAAc,QAAQ;IACtB,gBACE,QAAQ,kBAAkB;IAC5B,SAAS;KAEP,aAAa;KACb;KACD;IACF,CAAC;AAGJ,OAAI,QAAQ,eACV,MAAK,iBAAiB,QAAQ;AAGhC,QAAK,cAAc,uBAAuB;GAE1C,MAAM,EACJ,KAAK,WACL,QAAQ,gBACR,MACA,OACA,aACA,cACA,eAAe,iBACb,UAAuB,uBAAuB,YAAY;AAI9D,UAAO;IACL,eAAe;IACf,eAAe,uBAAuB;IACtC,SAAS;IACT,sBAAsB,uBAAuB;IAC7C;IACA;IACA;IACA;IACA;IACA;IACA;IACA,MAAM,QAAQ;IACd,cAAc,QAAQ;IACvB;WACM,OAAO;AACd,OACE,iBAAiB,mBAEhB,MAAM,UAAU,4BAA4B,iBAC3C,MAAM,UAAU,4BAA4B,kBAC5C,MAAM,UAAU,4BAA4B,cAE9C,QAAO;IACL,eAAe;IACf,QAAQ,MAAM;IACf;AAGH,SAAM;;;;;;;;CASV,MAAM,aAAa,EACjB,aACyB,EAAE,EAAmB;EAC9C,MAAM,yBAAyB,MAAM,KAAK,cAAc;AAExD,MAAI,CAAC,uBAAuB,eAAe;GACzC,MAAM,EAAE,WAAW;AACnB,SAAM,IAAI,MAAM,gDAAgD,SAAS;;AAG3E,SAAO,KAAK,eAAe,aAAa;GACtC,WAAW,uBAAuB;GAClC;GACD,CAAC;;CAGJ,MAAc,WAAW,aAAuC;EAC9D,MAAM,EAAE,cAAc,MAAM,SAAS;EACrC,MAAM,OAAO,MAAM,KAAK,eAAe,SAAS;AAChD,MAAI,CAAC,KACH,OAAM,IAAI,MACR,kEACD;AAGH,MAAI;AACF,SAAM,UAAU,aAAa,KAAK;AAClC,UAAO;WACA,GAAG;AAGV,OACE,aAAa,SACb,UAAU,KACV,OAAO,EAAE,SAAS,aACjB,EAAE,KAAK,WAAW,WAAW,IAAI,EAAE,KAAK,WAAW,WAAW,EAE/D,QAAO;AAET,SAAM"}

package/lib/user-management/user-management.cjs

@@ -1,5 +0,0 @@
-require('../jose-BhyqkBqW.cjs');
-require('../session-Beigw6Nc.cjs');
-const require_user_management = require('../user-management-CJj1rMco.cjs');
-
-exports.UserManagement = require_user_management.UserManagement;

package/lib/user-management/user-management.d.cts

@@ -1,2 +0,0 @@
-import { h as UserManagement } from "../api-keys-FoD7rQEa.cjs";
-export { UserManagement };

package/lib/user-management/user-management.d.ts

@@ -1,211 +0,0 @@
-import { PaginationOptions } from "../common/interfaces/pagination-options.interface.js";
-import { AuthenticateWithCodeOptions } from "./interfaces/authenticate-with-code-options.interface.js";
-import { AuthenticateWithCodeAndVerifierOptions } from "./interfaces/authenticate-with-code-and-verifier-options.interface.js";
-import { AuthenticateWithEmailVerificationOptions } from "./interfaces/authenticate-with-email-verification-options.interface.js";
-import { AuthenticateWithMagicAuthOptions } from "./interfaces/authenticate-with-magic-auth-options.interface.js";
-import { AuthenticateWithOrganizationSelectionOptions } from "./interfaces/authenticate-with-organization-selection.interface.js";
-import { AuthenticateWithPasswordOptions } from "./interfaces/authenticate-with-password-options.interface.js";
-import { AuthenticateWithRefreshTokenOptions } from "./interfaces/authenticate-with-refresh-token-options.interface.js";
-import { User } from "./interfaces/user.interface.js";
-import { AuthenticationResponse } from "./interfaces/authentication-response.interface.js";
-import { AuthenticateWithSessionCookieFailedResponse, AuthenticateWithSessionCookieOptions, AuthenticateWithSessionCookieSuccessResponse, SessionCookieData } from "./interfaces/authenticate-with-session-cookie.interface.js";
-import { AuthenticateWithTotpOptions } from "./interfaces/authenticate-with-totp-options.interface.js";
-import { PKCEAuthorizationURLResult, UserManagementAuthorizationURLOptions } from "./interfaces/authorization-url-options.interface.js";
-import { CreateMagicAuthOptions } from "./interfaces/create-magic-auth-options.interface.js";
-import { CreateOrganizationMembershipOptions } from "./interfaces/create-organization-membership-options.interface.js";
-import { CreatePasswordResetOptions } from "./interfaces/create-password-reset-options.interface.js";
-import { CreateUserOptions } from "./interfaces/create-user-options.interface.js";
-import { EmailVerification } from "./interfaces/email-verification.interface.js";
-import { EnrollAuthFactorOptions } from "./interfaces/enroll-auth-factor.interface.js";
-import { Factor, FactorWithSecrets } from "./interfaces/factor.interface.js";
-import { Identity } from "./interfaces/identity.interface.js";
-import { Invitation } from "./interfaces/invitation.interface.js";
-import { ListAuthFactorsOptions } from "./interfaces/list-auth-factors-options.interface.js";
-import { ListInvitationsOptions, SerializedListInvitationsOptions } from "./interfaces/list-invitations-options.interface.js";
-import { OrganizationMembership } from "./interfaces/organization-membership.interface.js";
-import { ListOrganizationMembershipsOptions, SerializedListOrganizationMembershipsOptions } from "./interfaces/list-organization-memberships-options.interface.js";
-import { ListSessionsOptions, SerializedListSessionsOptions } from "./interfaces/list-sessions-options.interface.js";
-import { ListUserFeatureFlagsOptions } from "./interfaces/list-user-feature-flags-options.interface.js";
-import { ListUsersOptions, SerializedListUsersOptions } from "./interfaces/list-users-options.interface.js";
-import { LogoutURLOptions } from "./interfaces/logout-url-options.interface.js";
-import { MagicAuth } from "./interfaces/magic-auth.interface.js";
-import { PasswordReset } from "./interfaces/password-reset.interface.js";
-import { ResendInvitationOptions } from "./interfaces/resend-invitation-options.interface.js";
-import { ResetPasswordOptions } from "./interfaces/reset-password-options.interface.js";
-import { RevokeSessionOptions } from "./interfaces/revoke-session-options.interface.js";
-import { SendInvitationOptions } from "./interfaces/send-invitation-options.interface.js";
-import { SendVerificationEmailOptions } from "./interfaces/send-verification-email-options.interface.js";
-import { Session } from "./interfaces/session.interface.js";
-import { UpdateOrganizationMembershipOptions } from "./interfaces/update-organization-membership-options.interface.js";
-import { UpdateUserOptions } from "./interfaces/update-user-options.interface.js";
-import { VerifyEmailOptions } from "./interfaces/verify-email-options.interface.js";
-import { FeatureFlag } from "../feature-flags/interfaces/feature-flag.interface.js";
-import { AutoPaginatable } from "../common/utils/pagination.js";
-import { Challenge } from "../mfa/interfaces/challenge.interface.js";
-import { SessionHandlerOptions } from "./interfaces/session-handler-options.interface.js";
-import { CookieSession } from "./session.js";
-import { WorkOS } from "../workos.js";
-import * as jose0 from "jose";
-
-//#region src/user-management/user-management.d.ts
-declare class UserManagement {
-  private readonly workos;
-  private _jwks;
-  clientId: string | undefined;
-  constructor(workos: WorkOS);
-  /**
-   * Resolve clientId from method options or fall back to constructor-provided value.
-   * @throws TypeError if clientId is not available from either source
-   */
-  private resolveClientId;
-  getJWKS(): Promise<ReturnType<typeof jose0.createRemoteJWKSet> | undefined>;
-  /**
-   * Loads a sealed session using the provided session data and cookie password.
-   *
-   * @param options - The options for loading the sealed session.
-   * @param options.sessionData - The sealed session data.
-   * @param options.cookiePassword - The password used to encrypt the session data.
-   * @returns The session class.
-   */
-  loadSealedSession(options: {
-    sessionData: string;
-    cookiePassword: string;
-  }): CookieSession;
-  getUser(userId: string): Promise<User>;
-  getUserByExternalId(externalId: string): Promise<User>;
-  listUsers(options?: ListUsersOptions): Promise<AutoPaginatable<User, SerializedListUsersOptions>>;
-  createUser(payload: CreateUserOptions): Promise<User>;
-  authenticateWithMagicAuth(payload: AuthenticateWithMagicAuthOptions): Promise<AuthenticationResponse>;
-  authenticateWithPassword(payload: AuthenticateWithPasswordOptions): Promise<AuthenticationResponse>;
-  /**
-   * Exchange an authorization code for tokens.
-   *
-   * Auto-detects public vs confidential client mode:
-   * - If codeVerifier is provided: Uses PKCE flow (public client)
-   * - If no codeVerifier: Uses client_secret from API key (confidential client)
-   * - If both: Uses both client_secret AND codeVerifier (confidential client with PKCE)
-   *
-   * Using PKCE with confidential clients is recommended by OAuth 2.1 for defense
-   * in depth and provides additional CSRF protection on the authorization flow.
-   *
-   * @throws Error if neither codeVerifier nor API key is available
-   */
-  authenticateWithCode(payload: AuthenticateWithCodeOptions): Promise<AuthenticationResponse>;
-  /**
-   * Exchange an authorization code for tokens using PKCE (public client flow).
-   * Use this instead of authenticateWithCode() when the client cannot securely
-   * store a client_secret (browser, mobile, CLI, desktop apps).
-   *
-   * @param payload.clientId - Your WorkOS client ID
-   * @param payload.code - The authorization code from the OAuth callback
-   * @param payload.codeVerifier - The PKCE code verifier used to generate the code challenge
-   */
-  authenticateWithCodeAndVerifier(payload: AuthenticateWithCodeAndVerifierOptions): Promise<AuthenticationResponse>;
-  /**
-   * Refresh an access token using a refresh token.
-   * Automatically detects public client mode - if no API key is configured,
-   * omits client_secret from the request.
-   */
-  authenticateWithRefreshToken(payload: AuthenticateWithRefreshTokenOptions): Promise<AuthenticationResponse>;
-  authenticateWithTotp(payload: AuthenticateWithTotpOptions): Promise<AuthenticationResponse>;
-  authenticateWithEmailVerification(payload: AuthenticateWithEmailVerificationOptions): Promise<AuthenticationResponse>;
-  authenticateWithOrganizationSelection(payload: AuthenticateWithOrganizationSelectionOptions): Promise<AuthenticationResponse>;
-  authenticateWithSessionCookie({
-    sessionData,
-    cookiePassword
-  }: AuthenticateWithSessionCookieOptions): Promise<AuthenticateWithSessionCookieSuccessResponse | AuthenticateWithSessionCookieFailedResponse>;
-  private isValidJwt;
-  private prepareAuthenticationResponse;
-  private sealSessionDataFromAuthenticationResponse;
-  getSessionFromCookie({
-    sessionData,
-    cookiePassword
-  }: SessionHandlerOptions): Promise<SessionCookieData | undefined>;
-  getEmailVerification(emailVerificationId: string): Promise<EmailVerification>;
-  sendVerificationEmail({
-    userId
-  }: SendVerificationEmailOptions): Promise<{
-    user: User;
-  }>;
-  getMagicAuth(magicAuthId: string): Promise<MagicAuth>;
-  createMagicAuth(options: CreateMagicAuthOptions): Promise<MagicAuth>;
-  verifyEmail({
-    code,
-    userId
-  }: VerifyEmailOptions): Promise<{
-    user: User;
-  }>;
-  getPasswordReset(passwordResetId: string): Promise<PasswordReset>;
-  createPasswordReset(options: CreatePasswordResetOptions): Promise<PasswordReset>;
-  resetPassword(payload: ResetPasswordOptions): Promise<{
-    user: User;
-  }>;
-  updateUser(payload: UpdateUserOptions): Promise<User>;
-  enrollAuthFactor(payload: EnrollAuthFactorOptions): Promise<{
-    authenticationFactor: FactorWithSecrets;
-    authenticationChallenge: Challenge;
-  }>;
-  listAuthFactors(options: ListAuthFactorsOptions): Promise<AutoPaginatable<Factor, PaginationOptions>>;
-  listUserFeatureFlags(options: ListUserFeatureFlagsOptions): Promise<AutoPaginatable<FeatureFlag>>;
-  listSessions(userId: string, options?: ListSessionsOptions): Promise<AutoPaginatable<Session, SerializedListSessionsOptions>>;
-  deleteUser(userId: string): Promise<void>;
-  getUserIdentities(userId: string): Promise<Identity[]>;
-  getOrganizationMembership(organizationMembershipId: string): Promise<OrganizationMembership>;
-  listOrganizationMemberships(options: ListOrganizationMembershipsOptions): Promise<AutoPaginatable<OrganizationMembership, SerializedListOrganizationMembershipsOptions>>;
-  createOrganizationMembership(options: CreateOrganizationMembershipOptions): Promise<OrganizationMembership>;
-  updateOrganizationMembership(organizationMembershipId: string, options: UpdateOrganizationMembershipOptions): Promise<OrganizationMembership>;
-  deleteOrganizationMembership(organizationMembershipId: string): Promise<void>;
-  deactivateOrganizationMembership(organizationMembershipId: string): Promise<OrganizationMembership>;
-  reactivateOrganizationMembership(organizationMembershipId: string): Promise<OrganizationMembership>;
-  getInvitation(invitationId: string): Promise<Invitation>;
-  findInvitationByToken(invitationToken: string): Promise<Invitation>;
-  listInvitations(options: ListInvitationsOptions): Promise<AutoPaginatable<Invitation, SerializedListInvitationsOptions>>;
-  sendInvitation(payload: SendInvitationOptions): Promise<Invitation>;
-  acceptInvitation(invitationId: string): Promise<Invitation>;
-  revokeInvitation(invitationId: string): Promise<Invitation>;
-  resendInvitation(invitationId: string, options?: ResendInvitationOptions): Promise<Invitation>;
-  revokeSession(payload: RevokeSessionOptions): Promise<void>;
-  /**
-   * Generate an OAuth 2.0 authorization URL.
-   *
-   * For public clients (browser, mobile, CLI), include PKCE parameters:
-   * - Generate PKCE using workos.pkce.generate()
-   * - Pass codeChallenge and codeChallengeMethod here
-   * - Store codeVerifier and pass to authenticateWithCode() later
-   *
-   * Or use getAuthorizationUrlWithPKCE() which handles PKCE automatically.
-   */
-  getAuthorizationUrl(options: UserManagementAuthorizationURLOptions): string;
-  /**
-   * Generate an OAuth 2.0 authorization URL with automatic PKCE.
-   *
-   * This method generates PKCE parameters internally and returns them along with
-   * the authorization URL. Use this for public clients (CLI apps, Electron, mobile)
-   * that cannot securely store a client secret.
-   *
-   * @returns Object containing url, state, and codeVerifier
-   *
-   * @example
-   * ```typescript
-   * const { url, state, codeVerifier } = await workos.userManagement.getAuthorizationUrlWithPKCE({
-   *   provider: 'authkit',
-   *   clientId: 'client_123',
-   *   redirectUri: 'myapp://callback',
-   * });
-   *
-   * // Store state and codeVerifier securely, then redirect user to url
-   * // After callback, exchange the code:
-   * const response = await workos.userManagement.authenticateWithCode({
-   *   code: authorizationCode,
-   *   codeVerifier,
-   *   clientId: 'client_123',
-   * });
-   * ```
-   */
-  getAuthorizationUrlWithPKCE(options: Omit<UserManagementAuthorizationURLOptions, 'codeChallenge' | 'codeChallengeMethod' | 'state'>): Promise<PKCEAuthorizationURLResult>;
-  getLogoutUrl(options: LogoutURLOptions): string;
-  getJwksUrl(clientId: string): string;
-}
-//#endregion
-export { UserManagement };
-//# sourceMappingURL=user-management.d.ts.map