auth0 2.36.2 → 2.39.0

package/src/auth/OAuthAuthenticator.js

@@ -1,11 +1,8 @@
-var extend = require('util')._extend;
-var sanitizeArguments = require('../utils').sanitizeArguments;
-
-var ArgumentError = require('rest-facade').ArgumentError;
-var RestClient = require('rest-facade').Client;
-
-var SanitizedError = require('../errors').SanitizedError;
-var OAUthWithIDTokenValidation = require('./OAUthWithIDTokenValidation');
+const { sanitizeArguments } = require('../utils');
+const { ArgumentError } = require('rest-facade');
+const RestClient = require('rest-facade').Client;
+const { SanitizedError } = require('../errors');
+const OAUthWithIDTokenValidation = require('./OAUthWithIDTokenValidation');
 
 function getParamsFromOptions(options) {
   const params = {};
@@ -13,7 +10,7 @@ function getParamsFromOptions(options) {
     return params;
   }
   if (options.forwardedFor) {
-    params._requestCustomizer = function(req) {
+    params._requestCustomizer = function (req) {
       req.set('auth0-forwarded-for', options.forwardedFor);
     };
   }
@@ -24,387 +21,371 @@ function getParamsFromOptions(options) {
 }
 
 /**
- * @class
  * Abstracts the sign-in, sign-up and change-password processes for Database &
  * Active Directory authentication services.
- * @constructor
- * @memberOf module:auth
- *
- * @param  {Object}              options                             Authenticator options.
- * @param  {String}              options.baseUrl                     The Auth0 account URL.
- * @param  {String}              options.domain                      AuthenticationClient server domain
- * @param  {String}              [options.clientId]                  Default client ID.
- * @param  {String}              [options.clientSecret]              Default client Secret.
- * @param  {Boolean}             [options.__bypassIdTokenValidation] Whether the id_token should be validated or not
  */
-var OAuthAuthenticator = function(options) {
-  if (!options) {
-    throw new ArgumentError('Missing authenticator options');
-  }
+class OAuthAuthenticator {
+  /**
+   * @param  {object}              options                             Authenticator options.
+   * @param  {string}              options.baseUrl                     The Auth0 account URL.
+   * @param  {string}              options.domain                      AuthenticationClient server domain
+   * @param  {string}              [options.clientId]                  Default client ID.
+   * @param  {string}              [options.clientSecret]              Default client Secret.
+   * @param  {boolean}             [options.__bypassIdTokenValidation] Whether the id_token should be validated or not
+   */
+  constructor(options) {
+    if (!options) {
+      throw new ArgumentError('Missing authenticator options');
+    }
+
+    if (typeof options !== 'object') {
+      throw new ArgumentError('The authenticator options must be an object');
+    }
+
+    /**
+     * Options object for the Rest Client instance.
+     *
+     * @type {object}
+     */
+    const clientOptions = {
+      errorCustomizer: SanitizedError,
+      errorFormatter: { message: 'message', name: 'error' },
+      headers: options.headers,
+    };
 
-  if (typeof options !== 'object') {
-    throw new ArgumentError('The authenticator options must be an object');
+    this.oauth = new RestClient(`${options.baseUrl}/oauth/:type`, clientOptions);
+    this.oauthWithIDTokenValidation = new OAUthWithIDTokenValidation(this.oauth, options);
+    this.clientId = options.clientId;
+    this.clientSecret = options.clientSecret;
   }
 
   /**
-   * Options object for the Rest Client instance.
+   * Sign in using a username and password.
+   *
+   * @example <caption>
+   *   Given the user's credentials and the connection specified, it
+   *   will return a JSON with the access_token and id_token.
+   *   More information in the
+   *
+   *   <a href="https://auth0.com/docs/api/authentication#database-ad-ldap-active-">
+   *     API Docs
+   *   </a>.
+   * </caption>
+   *
+   * var data = {
+   *   client_id: '{CLIENT_ID}',  // Optional field.
+   *   username: '{USERNAME}',
+   *   password: '{PASSWORD}',
+   *   connection: '{CONNECTION_NAME}',
+   *   scope: 'openid'  // Optional field.
+   * };
+   *
+   * auth0.oauth.signIn(data, function (err, userData) {
+   *   if (err) {
+   *     // Handle error.
+   *   }
    *
-   * @type {Object}
+   *   console.log(userData);
+   * });
+   * @param   {object}    userData               User credentials object.
+   * @param   {string}    userData.username      Username.
+   * @param   {string}    userData.password      User password.
+   * @param   {string}    userData.connection    The identity provider in use.
+   * @param   {object}    [options]              Additional options.
+   * @param   {string}    [options.forwardedFor] Value to be used for auth0-forwarded-for header
+   * @param {Function} cb                        Callback
+   * @returns  {Promise|undefined}
    */
-  var clientOptions = {
-    errorCustomizer: SanitizedError,
-    errorFormatter: { message: 'message', name: 'error' },
-    headers: options.headers
-  };
-
-  this.oauth = new RestClient(options.baseUrl + '/oauth/:type', clientOptions);
-  this.oauthWithIDTokenValidation = new OAUthWithIDTokenValidation(this.oauth, options);
-  this.clientId = options.clientId;
-  this.clientSecret = options.clientSecret;
-};
-
-/**
- * Sign in using a username and password.
- *
- * @method    signIn
- * @memberOf  module:auth.OAuthAuthenticator.prototype
- *
- * @example <caption>
- *   Given the user's credentials and the connection specified, it
- *   will return a JSON with the access_token and id_token.
- *   More information in the
- *   <a href="https://auth0.com/docs/api/authentication#database-ad-ldap-active-">
- *     API Docs
- *   </a>.
- * </caption>
- *
- * var data = {
- *   client_id: '{CLIENT_ID}',  // Optional field.
- *   username: '{USERNAME}',
- *   password: '{PASSWORD}',
- *   connection: '{CONNECTION_NAME}',
- *   scope: 'openid'  // Optional field.
- * };
- *
- * auth0.oauth.signIn(data, function (err, userData) {
- *   if (err) {
- *     // Handle error.
- *   }
- *
- *   console.log(userData);
- * });
- *
- * @param   {Object}    userData               User credentials object.
- * @param   {String}    userData.username      Username.
- * @param   {String}    userData.password      User password.
- * @param   {String}    userData.connection    The identity provider in use.
- * @param   {Object}    [options]              Additional options.
- * @param   {String}    [options.forwardedFor] Value to be used for auth0-forwarded-for header
- *
- * @return  {Promise|undefined}
- */
-OAuthAuthenticator.prototype.signIn = function(userData, options, cb) {
-  var { options, cb } = sanitizeArguments(options, cb);
-  var defaultParams = {
-    type: 'ro'
-  };
-  var params = extend(defaultParams, getParamsFromOptions(options));
-  var defaultFields = {
-    client_id: this.clientId,
-    grant_type: 'password',
-    scope: 'openid'
-  };
-  var data = extend(defaultFields, userData);
-
-  if (!userData || typeof userData !== 'object') {
-    throw new ArgumentError('Missing user data object');
-  }
-
-  if (
-    params.type === 'ro' &&
-    (typeof data.connection !== 'string' || data.connection.split().length === 0)
-  ) {
-    throw new ArgumentError('connection field is required');
-  }
+  signIn(userData, options, cb) {
+    if (!userData || typeof userData !== 'object') {
+      throw new ArgumentError('Missing user data object');
+    }
+
+    const { options: sanitizedOptions, cb: sanitizedCb } = sanitizeArguments(options, cb);
+    const params = {
+      type: 'ro',
+      ...getParamsFromOptions(sanitizedOptions),
+    };
 
-  if (cb && cb instanceof Function) {
-    return this.oauthWithIDTokenValidation.create(params, data, cb);
-  }
+    const data = {
+      client_id: this.clientId,
+      grant_type: 'password',
+      scope: 'openid',
+      ...userData,
+    };
 
-  return this.oauthWithIDTokenValidation.create(params, data);
-};
+    if (
+      params.type === 'ro' &&
+      (typeof data.connection !== 'string' || data.connection.split().length === 0)
+    ) {
+      throw new ArgumentError('connection field is required');
+    }
 
-/**
- * Sign in using a username and password
- *
- * @method    passwordGrant
- * @memberOf  module:auth.OAuthAuthenticator.prototype
- *
- * @example <caption>
- *   Given the user's credentials perform the OAuth password grant
- *   or Password Realm grant if a realm is provided,
- *   it will return a JSON with the access_token and id_token.
- *   More information in the
- *   <a href="https://auth0.com/docs/api/authentication#resource-owner-password">
- *     API Docs
- *   </a>.
- * </caption>
- *
- * var data = {
- *   client_id: '{CLIENT_ID}',  // Optional field.
- *   username: '{USERNAME}',
- *   password: '{PASSWORD}',
- *   realm: '{CONNECTION_NAME}', // Optional field.
- *   scope: 'openid'  // Optional field.
- * };
- *
- * auth0.oauth.passwordGrant(data, function (err, userData) {
- *   if (err) {
- *     // Handle error.
- *   }
- *
- *   console.log(userData);
- * });
- *
- * @param   {Object}    userData               User credentials object.
- * @param   {String}    userData.username      Username.
- * @param   {String}    userData.password      User password.
- * @param   {String}    [userData.realm]       Name of the realm to use to authenticate or the connection name
- * @param   {Object}    [options]              Additional options.
- * @param   {String}    [options.forwardedFor] Value to be used for auth0-forwarded-for header
- *
- * @return  {Promise|undefined}
- */
-OAuthAuthenticator.prototype.passwordGrant = function(userData, options, cb) {
-  var { options, cb } = sanitizeArguments(options, cb);
-  var defaultParams = {
-    type: 'token'
-  };
-  var params = extend(defaultParams, getParamsFromOptions(options));
-  var defaultFields = {
-    client_id: this.clientId,
-    client_secret: this.clientSecret,
-    grant_type: 'password'
-  };
-  var data = extend(defaultFields, userData);
-
-  if (!userData || typeof userData !== 'object') {
-    throw new ArgumentError('Missing user data object');
-  }
+    if (sanitizedCb && sanitizedCb instanceof Function) {
+      return this.oauthWithIDTokenValidation.create(params, data, sanitizedCb);
+    }
 
-  if (typeof data.username !== 'string' || data.username.split().length === 0) {
-    throw new ArgumentError('username field is required');
+    return this.oauthWithIDTokenValidation.create(params, data);
   }
 
-  if (typeof data.password !== 'string' || data.password.split().length === 0) {
-    throw new ArgumentError('password field is required');
-  }
+  /**
+   * Sign in using a username and password
+   *
+   * @example <caption>
+   *   Given the user's credentials perform the OAuth password grant
+   *   or Password Realm grant if a realm is provided,
+   *   it will return a JSON with the access_token and id_token.
+   *
+   *   More information in the
+   *   <a href="https://auth0.com/docs/api/authentication#resource-owner-password">
+   *     API Docs
+   *   </a>.
+   * </caption>
+   *
+   * var data = {
+   *   client_id: '{CLIENT_ID}',  // Optional field.
+   *   username: '{USERNAME}',
+   *   password: '{PASSWORD}',
+   *   realm: '{CONNECTION_NAME}', // Optional field.
+   *   scope: 'openid'  // Optional field.
+   * };
+   *
+   * auth0.oauth.passwordGrant(data, function (err, userData) {
+   *   if (err) {
+   *     // Handle error.
+   *   }
+   *
+   *   console.log(userData);
+   * });
+   * @param   {object}    userData               User credentials object.
+   * @param   {string}    userData.username      Username.
+   * @param   {string}    userData.password      User password.
+   * @param   {string}    [userData.realm]       Name of the realm to use to authenticate or the connection name
+   * @param   {object}    [options]              Additional options.
+   * @param   {string}    [options.forwardedFor] Value to be used for auth0-forwarded-for header
+   * @param {Function} cb                        Callback
+   * @returns  {Promise|undefined}
+   */
+  passwordGrant(userData, options, cb) {
+    const { options: sanitizedOptions, cb: sanitizedCb } = sanitizeArguments(options, cb);
+
+    if (!userData || typeof userData !== 'object') {
+      throw new ArgumentError('Missing user data object');
+    }
+
+    const data = {
+      client_id: this.clientId,
+      client_secret: this.clientSecret,
+      grant_type: 'password',
+      ...userData,
+    };
 
-  if (typeof data.realm === 'string' && data.realm.split().length !== 0) {
-    data.grant_type = 'http://auth0.com/oauth/grant-type/password-realm';
-  }
+    if (typeof data.username !== 'string' || data.username.split().length === 0) {
+      throw new ArgumentError('username field is required');
+    }
 
-  if (cb && cb instanceof Function) {
-    return this.oauthWithIDTokenValidation.create(params, data, cb);
-  }
+    if (typeof data.password !== 'string' || data.password.split().length === 0) {
+      throw new ArgumentError('password field is required');
+    }
 
-  return this.oauthWithIDTokenValidation.create(params, data);
-};
+    if (typeof data.realm === 'string' && data.realm.split().length !== 0) {
+      data.grant_type = 'http://auth0.com/oauth/grant-type/password-realm';
+    }
 
-/**
- * Exchange a refresh token
- *
- * @method    refreshToken
- * @memberOf  module:auth.OAuthAuthenticator.prototype
- *
- * @example <caption>
- *   Given a refresh token from a previous authentication request
- *   it will return a JSON with the access_token and id_token if
- *   the openid scope was originally included.
- *   More information in the
- *   <a href="https://auth0.com/docs/api/authentication#refresh-token">
- *     API Docs
- *   </a>.
- * </caption>
- *
- * var data = {
- *   refresh_token: '{REFRESH_TOKEN}',
- * };
- *
- * auth0.oauth.refreshToken(data, function (err, data) {
- *   if (err) {
- *     // Handle error.
- *   }
- *
- *   console.log(data);
- * });
- *
- * @param   {Object}    data                Data object.
- * @param   {String}    data.refresh_token  Refresh token.
- *
- * @return  {Promise|undefined}
- */
-OAuthAuthenticator.prototype.refreshToken = function(data, cb) {
-  if (!data || typeof data !== 'object') {
-    throw new ArgumentError('Missing data object');
-  }
+    const params = {
+      type: 'token',
+      ...getParamsFromOptions(sanitizedOptions),
+    };
 
-  var defaultFields = {
-    client_id: this.clientId,
-    client_secret: this.clientSecret,
-    grant_type: 'refresh_token'
-  };
+    if (sanitizedCb && sanitizedCb instanceof Function) {
+      return this.oauthWithIDTokenValidation.create(params, data, sanitizedCb);
+    }
 
-  var data = extend(defaultFields, data);
-  if (typeof data.refresh_token !== 'string' || data.refresh_token.split().length === 0) {
-    throw new ArgumentError('refresh_token is required');
+    return this.oauthWithIDTokenValidation.create(params, data);
   }
 
-  var params = {
-    type: 'token'
-  };
+  /**
+   * Exchange a refresh token
+   *
+   * @example <caption>
+   *   Given a refresh token from a previous authentication request
+   *   it will return a JSON with the access_token and id_token if
+   *   the openid scope was originally included.
+   *   More information in the
+   *   <a href="https://auth0.com/docs/api/authentication#refresh-token">
+   *     API Docs
+   *   </a>.
+   * </caption>
+   *
+   * var data = {
+   *   refresh_token: '{REFRESH_TOKEN}',
+   * };
+   *
+   * auth0.oauth.refreshToken(data, function (err, data) {
+   *   if (err) {
+   *     // Handle error.
+   *   }
+   *
+   *   console.log(data);
+   * });
+   * @param   {object}    data                Data object.
+   * @param   {string}    data.refresh_token  Refresh token.
+   * @param  {Function}  cb Callback
+   * @returns  {Promise|undefined}
+   */
+  refreshToken(data, cb) {
+    if (!data || typeof data !== 'object') {
+      throw new ArgumentError('Missing data object');
+    }
+
+    data = {
+      client_id: this.clientId,
+      client_secret: this.clientSecret,
+      grant_type: 'refresh_token',
+      ...data,
+    };
 
-  if (cb && cb instanceof Function) {
-    return this.oauth.create(params, data, cb);
-  }
-  return this.oauth.create(params, data);
-};
+    if (typeof data.refresh_token !== 'string' || data.refresh_token.split().length === 0) {
+      throw new ArgumentError('refresh_token is required');
+    }
 
-/**
- * Sign in using a social provider access token.
- *
- * @method    socialSignIn
- * @memberOf  module:auth.OAuthAuthenticator.prototype
- *
- * @param   {Object}    data                User credentials object.
- * @param   {String}    data.access_token   User access token.
- * @param   {String}    data.connection     Identity provider.
- *
- * @return  {Promise|undefined}
- */
-OAuthAuthenticator.prototype.socialSignIn = function(data, cb) {
-  var params = {
-    type: 'access_token'
-  };
+    const params = {
+      type: 'token',
+    };
 
-  if (typeof data !== 'object') {
-    throw new ArgumentError('Missing user credential objects');
+    if (cb && cb instanceof Function) {
+      return this.oauth.create(params, data, cb);
+    }
+    return this.oauth.create(params, data);
   }
 
-  if (typeof data.access_token !== 'string' || data.access_token.trim().length === 0) {
-    throw new ArgumentError('access_token field is required');
-  }
+  /**
+   * Sign in using a social provider access token.
+   *
+   * @param   {object}    data                User credentials object.
+   * @param   {string}    data.access_token   User access token.
+   * @param   {string}    data.connection     Identity provider.
+   * @param   {Function}    cb     Callback
+   * @returns  {Promise|undefined}
+   */
+  socialSignIn(data, cb) {
+    const params = {
+      type: 'access_token',
+    };
 
-  if (typeof data.connection !== 'string' || data.connection.trim().length === 0) {
-    throw new ArgumentError('connection field is required');
-  }
+    if (typeof data !== 'object') {
+      throw new ArgumentError('Missing user credential objects');
+    }
 
-  if (cb && cb instanceof Function) {
-    return this.oauth.create(params, data, cb);
-  }
+    if (typeof data.access_token !== 'string' || data.access_token.trim().length === 0) {
+      throw new ArgumentError('access_token field is required');
+    }
 
-  return this.oauth.create(params, data);
-};
+    if (typeof data.connection !== 'string' || data.connection.trim().length === 0) {
+      throw new ArgumentError('connection field is required');
+    }
 
-OAuthAuthenticator.prototype.clientCredentialsGrant = function(options, cb) {
-  var params = {
-    type: 'token'
-  };
+    if (cb && cb instanceof Function) {
+      return this.oauth.create(params, data, cb);
+    }
 
-  var defaultFields = {
-    grant_type: 'client_credentials',
-    client_id: this.clientId,
-    client_secret: this.clientSecret
-  };
+    return this.oauth.create(params, data);
+  }
 
-  var data = extend(defaultFields, options);
+  clientCredentialsGrant(options, cb) {
+    if (!options || typeof options !== 'object') {
+      throw new ArgumentError('Missing options object');
+    }
 
-  if (!options || typeof options !== 'object') {
-    throw new ArgumentError('Missing options object');
-  }
+    const data = {
+      grant_type: 'client_credentials',
+      client_id: this.clientId,
+      client_secret: this.clientSecret,
+      ...options,
+    };
 
-  if (!data.client_id || data.client_id.trim().length === 0) {
-    throw new ArgumentError('client_id field is required');
-  }
+    if (!data.client_id || data.client_id.trim().length === 0) {
+      throw new ArgumentError('client_id field is required');
+    }
 
-  if (!data.client_secret || data.client_secret.trim().length === 0) {
-    throw new ArgumentError('client_secret field is required');
-  }
+    if (!data.client_secret || data.client_secret.trim().length === 0) {
+      throw new ArgumentError('client_secret field is required');
+    }
 
-  if (cb && cb instanceof Function) {
-    return this.oauth.create(params, data, cb);
-  }
+    const params = {
+      type: 'token',
+    };
 
-  return this.oauth.create(params, data);
-};
+    if (cb && cb instanceof Function) {
+      return this.oauth.create(params, data, cb);
+    }
 
-/**
- * Sign in using an authorization code
- *
- * @method    authorizationCodeGrant
- * @memberOf  module:auth.OAuthAuthenticator.prototype
- *
- * @example <caption>
- *   Given the code returned in the URL params after the redirect
- *   from successful authentication, exchange the code for auth0
- *   credentials. It will return JSON with the access_token and id_token.
- *   More information in the
- *   <a href="https://auth0.com/docs/api/authentication#authorization-code-grant">
- *     API Docs
- *   </a>.
- * </caption>
- *
- * var options = {
- *   code: '{CODE}',
- *   redirect_uri: '{REDIRECT_URI}',
- *   organization: '{ORGANIZATION_ID}' // Optiional field.
- * };
- *
- * auth0.oauth.authorizationCodeGrant(options, function (err, userData) {
- *   if (err) {
- *     // Handle error.
- *   }
- *
- *   console.log(userData);
- * });
- *
- * @param   {Object}    options                  Authorization code payload
- * @param   {String}    options.organization     Organization ID
- * @param   {String}    options.code             Code in URL returned after authentication
- * @param   {String}    options.redirect_uri     The URL to which Auth0 will redirect the browser after authorization has been granted by the user.
- *
- * @return  {Promise|undefined}
- */
-OAuthAuthenticator.prototype.authorizationCodeGrant = function(options, cb) {
-  var params = {
-    type: 'token'
-  };
+    return this.oauth.create(params, data);
+  }
 
-  var defaultFields = {
-    grant_type: 'authorization_code',
-    client_id: this.clientId,
-    client_secret: this.clientSecret
-  };
+  /**
+   * Sign in using an authorization code
+   *
+   * @example <caption>
+   *   Given the code returned in the URL params after the redirect
+   *   from successful authentication, exchange the code for auth0
+   *   credentials. It will return JSON with the access_token and id_token.
+   *   More information in the
+   *   <a href="https://auth0.com/docs/api/authentication#authorization-code-grant">
+   *     API Docs
+   *   </a>.
+   * </caption>
+   *
+   * var options = {
+   *   code: '{CODE}',
+   *   redirect_uri: '{REDIRECT_URI}',
+   *   organization: '{ORGANIZATION_ID}' // Optiional field.
+   * };
+   *
+   * auth0.oauth.authorizationCodeGrant(options, function (err, userData) {
+   *   if (err) {
+   *     // Handle error.
+   *   }
+   *
+   *   console.log(userData);
+   * });
+   * @param   {object}    options                  Authorization code payload
+   * @param   {string}    options.organization     Organization ID
+   * @param   {string}    options.code             Code in URL returned after authentication
+   * @param   {string}    options.redirect_uri     The URL to which Auth0 will redirect the browser after authorization has been granted by the user.
+   * @param {Function} cb Callback
+   * @returns  {Promise|undefined}
+   */
+  authorizationCodeGrant(options, cb) {
+    if (!options || typeof options !== 'object') {
+      throw new ArgumentError('Missing options object');
+    }
+
+    const data = {
+      grant_type: 'authorization_code',
+      client_id: this.clientId,
+      client_secret: this.clientSecret,
+      ...options,
+    };
 
-  var data = extend(defaultFields, options);
+    if (!data.code || data.code.trim().length === 0) {
+      throw new ArgumentError('code field is required');
+    }
 
-  if (!options || typeof options !== 'object') {
-    throw new ArgumentError('Missing options object');
-  }
+    if (!data.redirect_uri || data.redirect_uri.trim().length === 0) {
+      throw new ArgumentError('redirect_uri field is required');
+    }
 
-  if (!data.code || data.code.trim().length === 0) {
-    throw new ArgumentError('code field is required');
-  }
+    const params = {
+      type: 'token',
+    };
 
-  if (!data.redirect_uri || data.redirect_uri.trim().length === 0) {
-    throw new ArgumentError('redirect_uri field is required');
-  }
+    if (cb && cb instanceof Function) {
+      return this.oauthWithIDTokenValidation.create(params, data, cb);
+    }
 
-  if (cb && cb instanceof Function) {
-    return this.oauthWithIDTokenValidation.create(params, data, cb);
+    return this.oauthWithIDTokenValidation.create(params, data);
   }
-
-  return this.oauthWithIDTokenValidation.create(params, data);
-};
+}
 
 module.exports = OAuthAuthenticator;