auth0 3.3.0 → 4.0.0-beta.0

package/src/Auth0RestClient.js

@@ -1,123 +0,0 @@
-const RestClient = require('rest-facade').Client;
-const { ArgumentError } = require('rest-facade');
-
-const utils = require('./utils');
-const { SanitizedError } = require('./errors');
-
-class Auth0RestClient {
-  constructor(resourceUrl, options, provider) {
-    if (resourceUrl === null || resourceUrl === undefined) {
-      throw new ArgumentError('Must provide a Resource Url');
-    }
-
-    if ('string' !== typeof resourceUrl || resourceUrl.length === 0) {
-      throw new ArgumentError('The provided Resource Url is invalid');
-    }
-
-    if (options === null || typeof options !== 'object') {
-      throw new ArgumentError('Must provide options');
-    }
-
-    options.errorCustomizer = options.errorCustomizer || SanitizedError;
-    options.errorFormatter = options.errorFormatter || { message: 'message', name: 'error' };
-
-    this.options = options;
-    this.provider = provider;
-    this.restClient = new RestClient(resourceUrl, options);
-
-    this.wrappedProvider = function (method, args) {
-      if (!this.provider) {
-        return this._request(method, args);
-      }
-
-      let callback;
-      if (args && args[args.length - 1] instanceof Function) {
-        callback = args[args.length - 1];
-      }
-
-      return this.provider
-        .getAccessToken()
-        .then((access_token) => {
-          this.restClient.options.headers['Authorization'] = `Bearer ${access_token}`;
-          return this._request(method, args);
-        })
-        .catch((err) => {
-          if (callback) {
-            return callback(err);
-          }
-          throw err;
-        });
-    };
-  }
-
-  _request(method, args) {
-    if (!this.options.includeResponseHeaders) {
-      return this.restClient[method](...args);
-    }
-
-    let callback;
-    // Handle the case where the promise variant is called without any args
-    // client.get() -> client.get({}, callback)
-    if (!args || !args.length) {
-      args = [{}];
-    }
-    // Handle the case where an undefined placeholder is defined for callback
-    // client.get(params, undefined) -> client.get(params, callback)
-    if (typeof args[args.length - 1] === 'undefined') {
-      args.pop();
-    }
-    if (typeof args[args.length - 1] === 'function') {
-      callback = args.pop();
-    }
-    return new Promise((resolve, reject) => {
-      this.restClient[method](...args, (err, data, headers) => {
-        const payload = { data, headers };
-        if (err) {
-          if (callback) callback(err);
-          else reject(err);
-          return;
-        }
-        if (callback) callback(null, payload);
-        else resolve(payload);
-      });
-    });
-  }
-
-  getAll(...args) {
-    return this.wrappedProvider('getAll', args);
-  }
-
-  get(params, callback) {
-    if (typeof params === 'object' && params.id) {
-      params.id = utils.maybeDecode(`${params.id}`);
-    }
-    return this.wrappedProvider('get', [...[params, callback].filter(Boolean)]);
-  }
-
-  create(...args) {
-    return this.wrappedProvider('create', args);
-  }
-
-  patch(params, ...restOfArgs) {
-    if (typeof params === 'object' && params.id) {
-      params.id = utils.maybeDecode(`${params.id}`);
-    }
-    return this.wrappedProvider('patch', [params, ...restOfArgs]);
-  }
-
-  update(params, ...restOfArgs) {
-    if (typeof params === 'object' && params.id) {
-      params.id = utils.maybeDecode(`${params.id}`);
-    }
-    return this.wrappedProvider('update', [params, ...restOfArgs]);
-  }
-
-  delete(params, ...restOfArgs) {
-    if (typeof params === 'object' && params.id) {
-      params.id = utils.maybeDecode(`${params.id}`);
-    }
-    return this.wrappedProvider('delete', [params, ...restOfArgs]);
-  }
-}
-
-module.exports = Auth0RestClient;

package/src/RetryRestClient.js

@@ -1,105 +0,0 @@
-const retry = require('retry');
-const { ArgumentError } = require('rest-facade');
-
-const DEFAULT_OPTIONS = {
-  maxRetries: 3,
-  enabled: true,
-  randomize: true,
-};
-
-/**
- * Wrapper Rest Client that adds Retry functionality when requests are failing due to rate limiting (status code 429).
- */
-class RetryRestClient {
-  /**
-   * @param {object}  restClient                   RestClient.
-   * @param {object}  [options]                    Options for the RetryRestClient. It includes all properties from https://github.com/tim-kos/node-retry#retryoperationoptions
-   * @param {object}  [options.enabled=true]       Enabled or Disable Retry Policy functionality.
-   * @param {number}  [options.maxRetries=3]       The maximum amount of times to retry the operation.
-   */
-  constructor(restClient, options) {
-    if (restClient === null || typeof restClient !== 'object') {
-      throw new ArgumentError('Must provide RestClient');
-    }
-
-    const params = Object.assign({}, DEFAULT_OPTIONS, options);
-
-    if (typeof params.enabled !== 'boolean') {
-      throw new ArgumentError('Must provide enabled boolean value');
-    }
-
-    if (typeof params.maxRetries !== 'number' || params.maxRetries <= 0) {
-      throw new ArgumentError('Must provide maxRetries as a positive number');
-    }
-
-    this.restClient = restClient;
-    this.enabled = params.enabled;
-    this.retryOptions = Object.assign({ retries: params.maxRetries }, params);
-  }
-
-  getAll(...args) {
-    return this.invoke('getAll', args);
-  }
-
-  get(...args) {
-    return this.invoke('get', args);
-  }
-
-  create(...args) {
-    return this.invoke('create', args);
-  }
-
-  patch(...args) {
-    return this.invoke('patch', args);
-  }
-
-  update(...args) {
-    return this.invoke('update', args);
-  }
-
-  delete(...args) {
-    return this.invoke('delete', args);
-  }
-
-  invoke(method, args) {
-    let cb;
-    if (args && args[args.length - 1] instanceof Function) {
-      cb = args[args.length - 1];
-      args.pop(); // Remove the callback
-    }
-
-    const promise = this.handleRetry(method, args);
-
-    if (cb instanceof Function) {
-      promise.then(cb.bind(null, null)).catch(cb);
-      return;
-    }
-
-    return promise;
-  }
-
-  handleRetry(method, args) {
-    if (!this.enabled) {
-      return this.restClient[method](...args);
-    }
-
-    return new Promise((resolve, reject) => {
-      const operation = retry.operation(this.retryOptions);
-
-      operation.attempt(() => {
-        this.restClient[method](...args)
-          .then((body) => {
-            resolve(body);
-          })
-          .catch((err) => {
-            if (err && err.statusCode === 429 && operation.retry(err)) {
-              return;
-            }
-            reject(err);
-          });
-      });
-    });
-  }
-}
-
-module.exports = RetryRestClient;

package/src/auth/DatabaseAuthenticator.js

@@ -1,282 +0,0 @@
-const { ArgumentError } = require('rest-facade');
-const RestClient = require('rest-facade').Client;
-
-/**
- * Abstracts the sign-in, sign-up and change-password processes for Database &
- * Active Directory authentication services.
- */
-class DatabaseAuthenticator {
-  /**
-   * @param  {object}              options            Authenticator options.
-   * @param  {string}              options.baseUrl    The auth0 account URL.
-   * @param  {string}              [options.clientId] Default client ID.
-   * @param   {string}             [options.proxy]    Add the `superagent-proxy` dependency and specify a proxy url eg 'https://myproxy.com:1234'
-   * @param  {OAuthAuthenticator}  oauth              OAuthAuthenticator instance.
-   */
-  constructor(options, oauth) {
-    if (!options) {
-      throw new ArgumentError('Missing authenticator options');
-    }
-
-    if (typeof options !== 'object') {
-      throw new ArgumentError('The authenticator options must be an object');
-    }
-
-    /**
-     * Options object for the Rest Client instance.
-     *
-     * @type {object}
-     */
-    const clientOptions = {
-      errorFormatter: { message: 'message', name: 'error' },
-      headers: options.headers,
-      proxy: options.proxy,
-    };
-
-    this.oauth = oauth;
-    this.dbConnections = new RestClient(`${options.baseUrl}/dbconnections/:type`, clientOptions);
-    this.clientId = options.clientId;
-  }
-
-  /**
-   * Sign in using a database or active directory service.
-   *
-   * @example <caption>
-   *   Given the user credentials and the connection specified, it will do the
-   *   authentication on the provider and return a JSON with the `access_token`
-   *   and `id_token`. Find more information about the structure of the data
-   *   object in the <a href="https://auth0.com/docs/auth-api#!#post--oauth-ro">
-   *   API docs</a>.
-   * </caption>
-   *
-   * var data = {
-   *   username: '{USERNAME}',
-   *   password: '{PASSWORD}',
-   *   connection: 'Username-Password-Authentication' // Optional field.
-   * };
-   *
-   * auth0.database.signIn(data, function (err, userData) {
-   *   if (err) {
-   *     // Handle error.
-   *   }
-   *
-   *   console.log(userData);
-   * });
-   * @param   {object}    userData              User credentials object.
-   * @param   {string}    userData.username     Username.
-   * @param   {string}    userData.password     User password.
-   * @param   {string}    userData.connection   Identity provider in use.
-   * @param   {Function}  [cb]              Method callback.
-   * @returns  {Promise|undefined}
-   */
-  signIn(userData, cb) {
-    if (!userData || typeof userData !== 'object') {
-      throw new ArgumentError('Missing user data object');
-    }
-
-    const data = {
-      connection: 'Username-Password-Authentication',
-      ...userData,
-    };
-
-    if (typeof data.username !== 'string' || data.username.trim().length === 0) {
-      throw new ArgumentError('username field is required');
-    }
-
-    if (typeof data.password !== 'string' || data.password.trim().length === 0) {
-      throw new ArgumentError('password field is required');
-    }
-
-    return this.oauth.signIn(data, cb);
-  }
-
-  /**
-   * Sign up using a database or active directory service.
-   *
-   * @example <caption>
-   *   Given the user credentials, the connection specified and (optionally) the
-   *   client ID, it will create a new user. Find more information in the
-   *   <a href="https://auth0.com/docs/auth-api#!#post--dbconnections-signup">
-   *   API Docs</a>.
-   * </caption>
-   *
-   * var data = {
-   *   email: '{EMAIL}',
-   *   password: '{PASSWORD}',
-   *   connection: 'Username-Password-Authentication' // Optional field.
-   * };
-   *
-   * auth0.database.signUp(data, function (err, userData) {
-   *   if (err) {
-   *     // Handle error.
-   *   }
-   *
-   *   console.log(userData);
-   * });
-   * @param   {object}    userData              User credentials object.
-   * @param   {string}    userData.email        User email address.
-   * @param   {string}    userData.password     User password.
-   * @param   {string}    userData.connection   Identity provider in use.
-   * @param   {Function}  [cb]              Method callback.
-   * @returns  {Promise|undefined}
-   */
-  signUp(userData, cb) {
-    if (!userData || typeof userData !== 'object') {
-      throw new ArgumentError('Missing user data object');
-    }
-
-    const data = {
-      client_id: this.clientId,
-      ...userData,
-    };
-
-    if (typeof data.email !== 'string' || data.email.trim().length === 0) {
-      throw new ArgumentError('email field is required');
-    }
-
-    if (typeof data.password !== 'string' || data.password.trim().length === 0) {
-      throw new ArgumentError('password field is required');
-    }
-
-    if (typeof data.connection !== 'string' || data.connection.trim().length === 0) {
-      throw new ArgumentError('connection field is required');
-    }
-
-    const params = {
-      type: 'signup',
-    };
-
-    if (cb && cb instanceof Function) {
-      return this.dbConnections.create(params, data, cb);
-    }
-
-    return this.dbConnections.create(params, data);
-  }
-
-  /**
-   * Change password using a database or active directory service.
-   *
-   * @example <caption>
-   *   Given the user email, the connection specified and the new password to
-   *   use, Auth0 will send a forgot password email. Once the user clicks on the
-   *   confirm password change link, the new password specified in this POST will
-   *   be set to this user. Find more information in the
-   *   <a href="https://auth0.com/docs/auth-api#!#post--dbconnections-change_password>
-   *   API Docs</a>.
-   * </caption>
-   *
-   * var data = {
-   *   email: '{EMAIL}',
-   *   password: '{PASSWORD}',
-   *   connection: 'Username-Password-Authentication'
-   * };
-   *
-   * auth0.database.changePassword(data, function (err, message) {
-   *   if (err) {
-   *     // Handle error.
-   *   }
-   *
-   *   console.log(message);
-   * });
-   * @param   {object}    userData              User credentials object.
-   * @param   {string}    userData.email        User email address.
-   * @param   {string}    userData.password     New password.
-   * @param   {string}    userData.connection   Identity provider in use.
-   * @param   {Function}  [cb]              Method callback.
-   * @returns  {Promise|undefined}
-   */
-  changePassword(userData, cb) {
-    if (!userData || typeof userData !== 'object') {
-      throw new ArgumentError('Missing user data object');
-    }
-
-    const data = {
-      client_id: this.clientId,
-      ...userData,
-    };
-
-    if (typeof data.email !== 'string' || data.email.trim().length === 0) {
-      throw new ArgumentError('email field is required');
-    }
-
-    if (typeof data.password !== 'string' || data.password.trim().length === 0) {
-      throw new ArgumentError('password field is required');
-    }
-
-    if (typeof data.connection !== 'string' || data.connection.trim().length === 0) {
-      throw new ArgumentError('connection field is required');
-    }
-
-    const params = {
-      type: 'change_password',
-    };
-
-    if (cb && cb instanceof Function) {
-      return this.dbConnections.create(params, data, cb);
-    }
-
-    return this.dbConnections.create(params, data);
-  }
-
-  /**
-   * Request a change password email using a database or active directory service.
-   *
-   * @example <caption>
-   *   Given the user email, the connection specified, Auth0 will send a change
-   *   password email. once the user clicks on the confirm password change link,
-   *   the new password specified in this POST will be set to this user. Find more
-   *   information in the <a href="https://auth0.com/docs/auth-api#!#post--dbconnections-change_password>
-   *   API Docs</a>.
-   * </caption>
-   *
-   * var data = {
-   *   email: '{EMAIL}',
-   *   connection: 'Username-Password-Authentication',
-   *   client_id: 'OS1VzKTVjizL0VCc9Hx2ae2aTPXWy6BD'
-   * };
-   *
-   * auth0.database.requestChangePasswordEmail(data, function (err, message) {
-   *   if (err) {
-   *     // Handle error.
-   *   }
-   *
-   *   console.log(message);
-   * });
-   * @param   {object}    userData              User credentials object.
-   * @param   {string}    userData.email        User email address.
-   * @param   {string}    userData.connection   Identity provider in use.
-   * @param   {string}    userData.client_id    Client ID of the Application requesting the password change, to be included in the email template.
-   * @param   {Function}  [cb]              Method callback.
-   * @returns  {Promise|undefined}
-   */
-  requestChangePasswordEmail(userData, cb) {
-    if (!userData || typeof userData !== 'object') {
-      throw new ArgumentError('Missing user data object');
-    }
-
-    const data = {
-      client_id: this.clientId,
-      ...userData,
-    };
-
-    if (typeof data.email !== 'string' || data.email.trim().length === 0) {
-      throw new ArgumentError('email field is required');
-    }
-
-    if (typeof data.connection !== 'string' || data.connection.trim().length === 0) {
-      throw new ArgumentError('connection field is required');
-    }
-
-    const params = {
-      type: 'change_password',
-    };
-
-    if (cb && cb instanceof Function) {
-      return this.dbConnections.create(params, data, cb);
-    }
-
-    return this.dbConnections.create(params, data);
-  }
-}
-
-module.exports = DatabaseAuthenticator;

package/src/auth/OAUthWithIDTokenValidation.js

@@ -1,124 +0,0 @@
-const jwt = require('jsonwebtoken');
-const jwksClient = require('jwks-rsa');
-const { ArgumentError } = require('rest-facade');
-const validateIdToken = require('./idToken').validate;
-
-const HS256_IGNORE_VALIDATION_MESSAGE =
-  'Validation of `id_token` requires a `clientSecret` when using the HS256 algorithm. To ensure tokens are validated, please switch the signing algorithm to RS256 or provide a `clientSecret` in the constructor.';
-
-/**
- * Abstracts the `oauth.create` method with additional id_token validation
- */
-class OAUthWithIDTokenValidation {
-  /**
-   * @param  {object}              oauth                               An instance of @type {OAuthAuthenticator}
-   * @param  {object}              options                             Authenticator options.
-   * @param  {string}              options.domain                      AuthenticationClient server domain
-   * @param  {string}              [options.clientId]                  Default client ID.
-   * @param  {string}              [options.clientSecret]              Default client Secret.
-   * @param  {string}              [options.supportedAlgorithms]       Algorithms that your application expects to receive
-   * @param  {boolean}             [options.__bypassIdTokenValidation] Whether the id_token should be validated or not
-   */
-  constructor(oauth, options) {
-    if (!oauth) {
-      throw new ArgumentError('Missing OAuthAuthenticator param');
-    }
-
-    if (!options) {
-      throw new ArgumentError('Missing authenticator options');
-    }
-
-    if (typeof options !== 'object') {
-      throw new ArgumentError('The authenticator options must be an object');
-    }
-
-    this.oauth = oauth;
-    this.__bypassIdTokenValidation = options.__bypassIdTokenValidation;
-    this.clientId = options.clientId;
-    this.clientSecret = options.clientSecret;
-    this.domain = options.domain;
-    this.supportedAlgorithms = options.supportedAlgorithms || ['HS256', 'RS256'];
-    this._jwksClient = jwksClient({
-      jwksUri: `https://${options.domain}/.well-known/jwks.json`,
-    });
-  }
-
-  /**
-   * Creates an oauth request and validates the id_token (if any)
-   *
-   * @param   {object}    params            OAuth parameters that are passed through
-   * @param   {object}    data              Custom parameters sent to the OAuth endpoint
-   * @param   {Function}  [cb]              Callback function
-   * @returns  {Promise|undefined}
-   */
-  create(params, data, cb) {
-    const _this = this;
-    function getKey(header, callback) {
-      if (header.alg === 'HS256') {
-        if (!_this.clientSecret) {
-          return callback({ message: HS256_IGNORE_VALIDATION_MESSAGE });
-        }
-        return callback(null, Buffer.from(_this.clientSecret, 'base64'));
-      }
-      _this._jwksClient.getSigningKey(header.kid, (err, key) => {
-        if (err) {
-          return callback(err);
-        }
-        const signingKey = key.publicKey || key.rsaPublicKey;
-        return callback(null, signingKey);
-      });
-    }
-    const createAndValidate = this.oauth.create(params, data).then((r) => {
-      if (_this.__bypassIdTokenValidation) {
-        return r;
-      }
-
-      if (r.id_token) {
-        return new Promise((resolve, reject) => {
-          const options = {
-            algorithms: this.supportedAlgorithms,
-            audience: this.clientId,
-            issuer: `https://${this.domain}/`,
-          };
-
-          if (data.organization) {
-            options.organization = data.organization;
-          }
-
-          if (data.nonce) {
-            options.nonce = data.nonce;
-          }
-
-          if (data.maxAge) {
-            options.maxAge = data.maxAge;
-          }
-
-          jwt.verify(r.id_token, getKey, options, (err) => {
-            if (err) {
-              if (err.message && err.message.includes(HS256_IGNORE_VALIDATION_MESSAGE)) {
-                console.warn(HS256_IGNORE_VALIDATION_MESSAGE);
-              } else {
-                return reject(err);
-              }
-            }
-
-            try {
-              validateIdToken(r.id_token, options);
-            } catch (idTokenError) {
-              return reject(idTokenError);
-            }
-
-            return resolve(r);
-          });
-        });
-      }
-      return r;
-    });
-    if (!cb) {
-      return createAndValidate;
-    }
-    createAndValidate.then((r) => cb(null, r)).catch((e) => cb(e));
-  }
-}
-
-module.exports = OAUthWithIDTokenValidation;