auth0 3.3.0 → 4.0.0-beta.0

package/src/auth/OAuthAuthenticator.js

@@ -1,405 +0,0 @@
-const { sanitizeArguments } = require('../utils');
-const { ArgumentError } = require('rest-facade');
-const RestClient = require('rest-facade').Client;
-const { SanitizedError } = require('../errors');
-const OAUthWithIDTokenValidation = require('./OAUthWithIDTokenValidation');
-const { addClientAuthentication } = require('./clientAuthentication');
-
-function getParamsFromOptions(options) {
-  const params = {};
-  if (!options || typeof options !== 'object') {
-    return params;
-  }
-  if (options.forwardedFor) {
-    params._requestCustomizer = function (req) {
-      req.set('auth0-forwarded-for', options.forwardedFor);
-    };
-  }
-  if (options.type) {
-    params.type = options.type;
-  }
-  return params;
-}
-
-/**
- * Abstracts the sign-in, sign-up and change-password processes for Database &
- * Active Directory authentication services.
- */
-class OAuthAuthenticator {
-  /**
-   * @param  {object}              options                             Authenticator options.
-   * @param  {string}              options.baseUrl                     The Auth0 account URL.
-   * @param  {string}              options.domain                      AuthenticationClient server domain
-   * @param  {string}              [options.clientId]                  Default client ID.
-   * @param  {string}              [options.clientSecret]              Default client Secret.
-   * @param  {string}              [options.clientAssertionSigningKey] Private key used to sign the client assertion JWT.
-   * @param  {string}              [options.clientAssertionSigningAlg] Default 'RS256'.
-   * @param  {boolean}             [options.__bypassIdTokenValidation] Whether the id_token should be validated or not
-   * @param   {string}             [options.proxy]                     Add the `superagent-proxy` dependency and specify a proxy url eg 'https://myproxy.com:1234'
-   */
-  constructor(options) {
-    if (!options) {
-      throw new ArgumentError('Missing authenticator options');
-    }
-
-    if (typeof options !== 'object') {
-      throw new ArgumentError('The authenticator options must be an object');
-    }
-
-    /**
-     * Options object for the Rest Client instance.
-     *
-     * @type {object}
-     */
-    const clientOptions = {
-      errorCustomizer: SanitizedError,
-      errorFormatter: { message: 'message', name: 'error' },
-      headers: options.headers,
-      proxy: options.proxy,
-    };
-
-    this.oauth = new RestClient(`${options.baseUrl}/oauth/:type`, clientOptions);
-    this.oauthWithIDTokenValidation = new OAUthWithIDTokenValidation(this.oauth, options);
-    this.domain = options.domain;
-    this.clientId = options.clientId;
-    this.clientSecret = options.clientSecret;
-    this.clientAssertionSigningKey = options.clientAssertionSigningKey;
-    this.clientAssertionSigningAlg = options.clientAssertionSigningAlg;
-  }
-
-  _addClientAuthentication(payload, required) {
-    return addClientAuthentication({
-      payload,
-      required,
-      domain: this.domain,
-      clientSecret: this.clientSecret,
-      clientAssertionSigningKey: this.clientAssertionSigningKey,
-      clientAssertionSigningAlg: this.clientAssertionSigningAlg,
-    });
-  }
-
-  /**
-   * Sign in using a username and password.
-   *
-   * @example <caption>
-   *   Given the user's credentials and the connection specified, it
-   *   will return a JSON with the access_token and id_token.
-   *   More information in the
-   *
-   *   <a href="https://auth0.com/docs/api/authentication#database-ad-ldap-active-">
-   *     API Docs
-   *   </a>.
-   * </caption>
-   *
-   * var data = {
-   *   client_id: '{CLIENT_ID}',  // Optional field.
-   *   username: '{USERNAME}',
-   *   password: '{PASSWORD}',
-   *   connection: '{CONNECTION_NAME}',
-   *   scope: 'openid'  // Optional field.
-   * };
-   *
-   * auth0.oauth.signIn(data, function (err, userData) {
-   *   if (err) {
-   *     // Handle error.
-   *   }
-   *
-   *   console.log(userData);
-   * });
-   * @param   {object}    userData               User credentials object.
-   * @param   {string}    userData.username      Username.
-   * @param   {string}    userData.password      User password.
-   * @param   {string}    userData.connection    The identity provider in use.
-   * @param   {object}    [options]              Additional options.
-   * @param   {string}    [options.forwardedFor] Value to be used for auth0-forwarded-for header
-   * @param {Function} cb                        Callback
-   * @returns  {Promise|undefined}
-   */
-  signIn(userData, options, cb) {
-    if (!userData || typeof userData !== 'object') {
-      throw new ArgumentError('Missing user data object');
-    }
-
-    const { options: sanitizedOptions, cb: sanitizedCb } = sanitizeArguments(options, cb);
-    const params = {
-      type: 'ro',
-      ...getParamsFromOptions(sanitizedOptions),
-    };
-
-    const data = {
-      client_id: this.clientId,
-      grant_type: 'password',
-      scope: 'openid',
-      ...userData,
-    };
-
-    if (
-      params.type === 'ro' &&
-      (typeof data.connection !== 'string' || data.connection.split().length === 0)
-    ) {
-      throw new ArgumentError('connection field is required');
-    }
-
-    if (sanitizedCb && sanitizedCb instanceof Function) {
-      return this.oauthWithIDTokenValidation.create(params, data, sanitizedCb);
-    }
-
-    return this.oauthWithIDTokenValidation.create(params, data);
-  }
-
-  /**
-   * Sign in using a username and password
-   *
-   * @example <caption>
-   *   Given the user's credentials perform the OAuth password grant
-   *   or Password Realm grant if a realm is provided,
-   *   it will return a JSON with the access_token and id_token.
-   *
-   *   More information in the
-   *   <a href="https://auth0.com/docs/api/authentication#resource-owner-password">
-   *     API Docs
-   *   </a>.
-   * </caption>
-   *
-   * var data = {
-   *   client_id: '{CLIENT_ID}',  // Optional field.
-   *   username: '{USERNAME}',
-   *   password: '{PASSWORD}',
-   *   realm: '{CONNECTION_NAME}', // Optional field.
-   *   scope: 'openid'  // Optional field.
-   * };
-   *
-   * auth0.oauth.passwordGrant(data, function (err, userData) {
-   *   if (err) {
-   *     // Handle error.
-   *   }
-   *
-   *   console.log(userData);
-   * });
-   * @param   {object}    userData               User credentials object.
-   * @param   {string}    userData.username      Username.
-   * @param   {string}    userData.password      User password.
-   * @param   {string}    [userData.realm]       Name of the realm to use to authenticate or the connection name
-   * @param   {object}    [options]              Additional options.
-   * @param   {string}    [options.forwardedFor] Value to be used for auth0-forwarded-for header
-   * @param {Function} cb                        Callback
-   * @returns  {Promise|undefined}
-   */
-  passwordGrant(userData, options, cb) {
-    const { options: sanitizedOptions, cb: sanitizedCb } = sanitizeArguments(options, cb);
-
-    if (!userData || typeof userData !== 'object') {
-      throw new ArgumentError('Missing user data object');
-    }
-
-    const data = this._addClientAuthentication({
-      client_id: this.clientId,
-      grant_type: 'password',
-      ...userData,
-    });
-
-    if (typeof data.username !== 'string' || data.username.split().length === 0) {
-      throw new ArgumentError('username field is required');
-    }
-
-    if (typeof data.password !== 'string' || data.password.split().length === 0) {
-      throw new ArgumentError('password field is required');
-    }
-
-    if (typeof data.realm === 'string' && data.realm.split().length !== 0) {
-      data.grant_type = 'http://auth0.com/oauth/grant-type/password-realm';
-    }
-
-    const params = {
-      type: 'token',
-      ...getParamsFromOptions(sanitizedOptions),
-    };
-
-    if (sanitizedCb && sanitizedCb instanceof Function) {
-      return this.oauthWithIDTokenValidation.create(params, data, sanitizedCb);
-    }
-
-    return this.oauthWithIDTokenValidation.create(params, data);
-  }
-
-  /**
-   * Exchange a refresh token
-   *
-   * @example <caption>
-   *   Given a refresh token from a previous authentication request
-   *   it will return a JSON with the access_token and id_token if
-   *   the openid scope was originally included.
-   *   More information in the
-   *   <a href="https://auth0.com/docs/api/authentication#refresh-token">
-   *     API Docs
-   *   </a>.
-   * </caption>
-   *
-   * var data = {
-   *   refresh_token: '{REFRESH_TOKEN}',
-   * };
-   *
-   * auth0.oauth.refreshToken(data, function (err, data) {
-   *   if (err) {
-   *     // Handle error.
-   *   }
-   *
-   *   console.log(data);
-   * });
-   * @param   {object}    data                Data object.
-   * @param   {string}    data.refresh_token  Refresh token.
-   * @param  {Function}  cb Callback
-   * @returns  {Promise|undefined}
-   */
-  refreshToken(data, cb) {
-    if (!data || typeof data !== 'object') {
-      throw new ArgumentError('Missing data object');
-    }
-
-    data = this._addClientAuthentication({
-      client_id: this.clientId,
-      grant_type: 'refresh_token',
-      ...data,
-    });
-
-    if (typeof data.refresh_token !== 'string' || data.refresh_token.split().length === 0) {
-      throw new ArgumentError('refresh_token is required');
-    }
-
-    const params = {
-      type: 'token',
-    };
-
-    if (cb && cb instanceof Function) {
-      return this.oauth.create(params, data, cb);
-    }
-    return this.oauth.create(params, data);
-  }
-
-  /**
-   * Sign in using a social provider access token.
-   *
-   * @param   {object}    data                User credentials object.
-   * @param   {string}    data.access_token   User access token.
-   * @param   {string}    data.connection     Identity provider.
-   * @param   {Function}    cb     Callback
-   * @returns  {Promise|undefined}
-   */
-  socialSignIn(data, cb) {
-    const params = {
-      type: 'access_token',
-    };
-
-    if (typeof data !== 'object') {
-      throw new ArgumentError('Missing user credential objects');
-    }
-
-    if (typeof data.access_token !== 'string' || data.access_token.trim().length === 0) {
-      throw new ArgumentError('access_token field is required');
-    }
-
-    if (typeof data.connection !== 'string' || data.connection.trim().length === 0) {
-      throw new ArgumentError('connection field is required');
-    }
-
-    if (cb && cb instanceof Function) {
-      return this.oauth.create(params, data, cb);
-    }
-
-    return this.oauth.create(params, data);
-  }
-
-  clientCredentialsGrant(options, cb) {
-    if (!options || typeof options !== 'object') {
-      throw new ArgumentError('Missing options object');
-    }
-
-    const data = this._addClientAuthentication(
-      {
-        grant_type: 'client_credentials',
-        client_id: this.clientId,
-        ...options,
-      },
-      true
-    );
-
-    if (!data.client_id || data.client_id.trim().length === 0) {
-      throw new ArgumentError('client_id field is required');
-    }
-
-    const params = {
-      type: 'token',
-    };
-
-    if (cb && cb instanceof Function) {
-      return this.oauth.create(params, data, cb);
-    }
-
-    return this.oauth.create(params, data);
-  }
-
-  /**
-   * Sign in using an authorization code
-   *
-   * @example <caption>
-   *   Given the code returned in the URL params after the redirect
-   *   from successful authentication, exchange the code for auth0
-   *   credentials. It will return JSON with the access_token and id_token.
-   *   More information in the
-   *   <a href="https://auth0.com/docs/api/authentication#authorization-code-grant">
-   *     API Docs
-   *   </a>.
-   * </caption>
-   *
-   * var options = {
-   *   code: '{CODE}',
-   *   redirect_uri: '{REDIRECT_URI}',
-   *   organization: '{ORGANIZATION_ID}' // Optiional field.
-   * };
-   *
-   * auth0.oauth.authorizationCodeGrant(options, function (err, userData) {
-   *   if (err) {
-   *     // Handle error.
-   *   }
-   *
-   *   console.log(userData);
-   * });
-   * @param   {object}    options                  Authorization code payload
-   * @param   {string}    options.organization     Organization ID
-   * @param   {string}    options.code             Code in URL returned after authentication
-   * @param   {string}    options.redirect_uri     The URL to which Auth0 will redirect the browser after authorization has been granted by the user.
-   * @param {Function} cb Callback
-   * @returns  {Promise|undefined}
-   */
-  authorizationCodeGrant(options, cb) {
-    if (!options || typeof options !== 'object') {
-      throw new ArgumentError('Missing options object');
-    }
-
-    const data = this._addClientAuthentication({
-      grant_type: 'authorization_code',
-      client_id: this.clientId,
-      ...options,
-    });
-
-    if (!data.code || data.code.trim().length === 0) {
-      throw new ArgumentError('code field is required');
-    }
-
-    if (!data.redirect_uri || data.redirect_uri.trim().length === 0) {
-      throw new ArgumentError('redirect_uri field is required');
-    }
-
-    const params = {
-      type: 'token',
-    };
-
-    if (cb && cb instanceof Function) {
-      return this.oauthWithIDTokenValidation.create(params, data, cb);
-    }
-
-    return this.oauthWithIDTokenValidation.create(params, data);
-  }
-}
-
-module.exports = OAuthAuthenticator;

package/src/auth/PasswordlessAuthenticator.js

@@ -1,303 +0,0 @@
-const { ArgumentError } = require('rest-facade');
-const RestClient = require('rest-facade').Client;
-const { sanitizeArguments } = require('../utils');
-const { addClientAuthentication } = require('./clientAuthentication');
-
-function getParamsFromOptions(options) {
-  const params = {};
-  if (!options || typeof options !== 'object') {
-    return params;
-  }
-  if (options.forwardedFor) {
-    params._requestCustomizer = function (req) {
-      req.set('auth0-forwarded-for', options.forwardedFor);
-    };
-  }
-  return params;
-}
-
-/**
- * Handles authenticator with passwordless flows, e.g. SMS, Touch ID, etc.
- */
-
-class PasswordlessAuthenticator {
-  /**
-   * @param  {object}              options            Authenticator options.
-   * @param  {string}              options.baseUrl    The auth0 account URL.
-   * @param  {string}              [options.domain] Required if using clientAssertionSigningKey.
-   * @param  {string}              [options.clientId] Default client ID.
-   * @param  {string}              [options.clientSecret] Default client secret.
-   * @param  {string}              [options.clientAssertionSigningKey] Private key used to sign the client assertion JWT.
-   * @param  {string}              [options.clientAssertionSigningAlg] Default 'RS256'.
-   * @param   {string}             [options.proxy]    Add the `superagent-proxy` dependency and specify a proxy url eg 'https://myproxy.com:1234'
-   * @param  {OAuthAuthenticator}  oauth              OAuthAuthenticator instance.
-   */
-  constructor(options, oauth) {
-    if (!options) {
-      throw new ArgumentError('Missing authenticator options');
-    }
-
-    if (typeof options !== 'object') {
-      throw new ArgumentError('The authenticator options must be an object');
-    }
-
-    /**
-     * Options object for the Rest Client instance.
-     *
-     * @type {object}
-     */
-    const clientOptions = {
-      errorFormatter: { message: 'message', name: 'error' },
-      headers: options.headers,
-      proxy: options.proxy,
-    };
-
-    this.oauth = oauth;
-    this.passwordless = new RestClient(`${options.baseUrl}/passwordless/start`, clientOptions);
-    this.domain = options.domain;
-    this.clientId = options.clientId;
-    this.clientSecret = options.clientSecret;
-    this.clientAssertionSigningKey = options.clientAssertionSigningKey;
-    this.clientAssertionSigningAlg = options.clientAssertionSigningAlg;
-  }
-
-  _addClientAuthentication(payload, required) {
-    return addClientAuthentication({
-      payload,
-      required,
-      domain: this.domain,
-      clientSecret: this.clientSecret,
-      clientAssertionSigningKey: this.clientAssertionSigningKey,
-      clientAssertionSigningAlg: this.clientAssertionSigningAlg,
-    });
-  }
-
-  /**
-   * Sign in with the given user credentials.
-   *
-   * @example <caption>
-   * Once you have a verification code, use this endpoint to login
-   * the user with their phone number/email and verification code.
-   *
-   * https://auth0.com/docs/api/authentication#authenticate-user
-   * </caption>
-   *
-   * var data = {
-   *   username: '{PHONE_NUMBER OR EMAIL}',
-   *   otp: '{VERIFICATION_CODE}',
-   *   realm: '{sms or email}' // OPTIONAL DEFAULTS TO SMS
-   * };
-   *
-   * auth0.passwordless.signIn(data, function (err) {
-   *   if (err) {
-   *     // Handle error.
-   *   }
-   * });
-   * @example <caption>
-   *   The user data object has the following structure.
-   * </caption>
-   *
-   * {
-   *   id_token: String,
-   *   access_token: String,
-   *   token_type: String
-   * }
-   * @example <caption>
-   *  LEGACY signIn using the `/oauth/ro` endpoint. When otp is not specified
-   *  password is required. Given the user credentials (`phone_number` and `code`),
-   *  it will do the authentication on the provider and return a JSON with
-   *  the `access_token` and `id_token`.
-   *
-   * https://auth0.com/docs/api/authentication#resource-owner
-   * </caption>
-   *
-   * var data = {
-   *   username: '{PHONE_NUMBER}',
-   *   password: '{VERIFICATION_CODE}'
-   * };
-   *
-   * auth0.passwordless.signIn(data, function (err) {
-   *   if (err) {
-   *     // Handle error.
-   *   }
-   * });
-   * @param   {object}    userData              User credentials object.
-   * @param   {string}    userData.username     The user's phone number if realm=sms, or the user's email if realm=email
-   * @param   {string}    userData.otp        The user's verification code. Required
-   * @param   {string}    [userData.audience]     API Identifier of the API for which you want to get an Access Token.
-   * @param   {string}    [userData.realm=sms]  Realm string: "sms" or "email".
-   * @param   {string}    [userData.password]     [DEPRECATED] Password required if using legacy /oauth/ro endpoint
-   * @param   {string}    [userData.connection=sms] [DEPRECATED] Connection string: "sms" or "email".
-   * @param   {object}    [options]              Additional options.
-   * @param   {string}    [options.forwardedFor] Value to be used for auth0-forwarded-for header
-   * @param   {Function}  [cb]                  Method callback.
-   * @returns  {Promise|undefined}
-   */
-  signIn(userData, options, cb) {
-    const { options: sanitizedOptions, cb: sanitizedCb } = sanitizeArguments(options, cb);
-
-    if (!userData || typeof userData !== 'object') {
-      throw new ArgumentError('Missing user data object');
-    }
-
-    const data = this._addClientAuthentication({
-      client_id: this.clientId,
-      ...userData,
-    });
-
-    if (typeof data.username !== 'string' || data.username.trim().length === 0) {
-      throw new ArgumentError('username field (phone number) is required');
-    }
-
-    // If otp is provided, attempt to sign in using otp grant
-    if (typeof data.otp === 'string' && data.otp.trim().length > 0) {
-      if (!data.realm || (data.realm !== 'email' && data.realm !== 'sms')) {
-        data.realm = 'sms';
-      }
-      data.grant_type = 'http://auth0.com/oauth/grant-type/passwordless/otp';
-      return this.oauth.signIn(data, { type: 'token', ...sanitizedOptions }, sanitizedCb);
-    }
-
-    // Don't let the user override the connection nor the grant type.
-    if (!data.connection || (data.connection !== 'email' && data.connection !== 'sms')) {
-      data.connection = 'sms';
-    }
-    data.grant_type = 'password';
-
-    if (typeof data.password !== 'string' || data.password.trim().length === 0) {
-      throw new ArgumentError('password field (verification code) is required');
-    }
-
-    console.warn(
-      'The oauth/ro endpoint has been deprecated. Please use the realm and otp parameters in this function.'
-    );
-    return this.oauth.signIn(data, sanitizedOptions, sanitizedCb);
-  }
-
-  /**
-   * Start passwordless flow sending an email.
-   *
-   * @example <caption>
-   *   Given the user `email` address, it will send an email with:
-   *
-   *   <ul>
-   *     <li>A link (default, `send:"link"`). You can then authenticate with this
-   *       user opening the link and he will be automatically logged in to the
-   *       application. Optionally, you can append/override parameters to the link
-   *       (like `scope`, `redirect_uri`, `protocol`, `response_type`, etc.) using
-   *       `authParams` object.
-   *     </li>
-   *     <li>
-   *       A verification code (`send:"code"`). You can then authenticate with
-   *       this user using the `/oauth/ro` endpoint specifying `email` as
-   *       `username` and `code` as `password`.
-   *     </li>
-   *   </ul>
-   *
-   *   Find more information in the
-   *   <a href="https://auth0.com/docs/auth-api#!#post--with_email">API Docs</a>
-   * </caption>
-   *
-   * var data = {
-   *   email: '{EMAIL}',
-   *   send: 'link',
-   *   authParams: {} // Optional auth params.
-   * };
-   *
-   * auth0.passwordless.sendEmail(data, function (err) {
-   *   if (err) {
-   *     // Handle error.
-   *   }
-   * });
-   * @param   {object}    userData                User account data.
-   * @param   {string}    userData.email          User email address.
-   * @param   {string}    userData.send           The type of email to be sent.
-   * @param   {object}    [options]              Additional options.
-   * @param   {string}    [options.forwardedFor] Value to be used for auth0-forwarded-for header
-   * @param   {Function}  [cb]                    Method callback.
-   * @returns  {Promise|undefined}
-   */
-  sendEmail(userData, options, cb) {
-    const { options: sanitizedOptions, cb: sanitizedCb } = sanitizeArguments(options, cb);
-    const data = this._addClientAuthentication({
-      client_id: this.clientId,
-      ...userData,
-    });
-    const params = getParamsFromOptions(sanitizedOptions);
-
-    // Don't let the user override the connection nor the grant type.
-    data.connection = 'email';
-
-    if (!userData || typeof userData !== 'object') {
-      throw new ArgumentError('Missing user data object');
-    }
-
-    if (typeof data.email !== 'string' || data.email.trim().length === 0) {
-      throw new ArgumentError('email field is required');
-    }
-
-    if (typeof data.send !== 'string' || data.send.trim().length === 0) {
-      throw new ArgumentError('send field is required');
-    }
-
-    if (sanitizedCb && sanitizedCb instanceof Function) {
-      return this.passwordless.create(params, data, sanitizedCb);
-    }
-
-    return this.passwordless.create(params, data);
-  }
-
-  /**
-   * Start passwordless flow sending an SMS.
-   *
-   * @example <caption>
-   *   Given the user `phone_number`, it will send a SMS message with a
-   *   verification code. You can then authenticate with this user using the
-   *   `/oauth/ro` endpoint specifying `phone_number` as `username` and `code` as
-   *   `password`:
-   * </caption>
-   *
-   * var data = {
-   *   phone_number: '{PHONE}'
-   * };
-   *
-   * auth0.passwordless.sendSMS(data, function (err) {
-   *   if (err) {
-   *     // Handle error.
-   *   }
-   * });
-   * @param   {object}    userData                User account data.
-   * @param   {string}    userData.phone_number   User phone number.
-   * @param   {object}    [options]              Additional options.
-   * @param   {string}    [options.forwardedFor] Value to be used for auth0-forwarded-for header
-   * @param   {Function}  [cb]                    Method callback.
-   * @returns  {Promise|undefined}
-   */
-  sendSMS(userData, options, cb) {
-    const { options: sanitizedOptions, cb: sanitizedCb } = sanitizeArguments(options, cb);
-    const data = this._addClientAuthentication({
-      client_id: this.clientId,
-      ...userData,
-    });
-    const params = getParamsFromOptions(sanitizedOptions);
-
-    // Don't let the user override the connection nor the grant type.
-    data.connection = 'sms';
-
-    if (!userData || typeof userData !== 'object') {
-      throw new ArgumentError('Missing user data object');
-    }
-
-    if (typeof data.phone_number !== 'string' || data.phone_number.trim().length === 0) {
-      throw new ArgumentError('phone_number field is required');
-    }
-
-    if (sanitizedCb && sanitizedCb instanceof Function) {
-      return this.passwordless.create(params, data, sanitizedCb);
-    }
-
-    return this.passwordless.create(params, data);
-  }
-}
-
-module.exports = PasswordlessAuthenticator;