auth0 3.4.0 → 4.0.0-beta.0

package/src/auth/TokensManager.js

@@ -1,254 +0,0 @@
-const axios = require('axios');
-const { ArgumentError } = require('rest-facade');
-const { addClientAuthentication } = require('./clientAuthentication');
-
-/**
- * Provides methods for getting token data and exchanging tokens.
- */
-class TokensManager {
-  /**
-   * @param  {object}   options                 Manager options.
-   * @param  {string}   options.baseUrl         The auth0 account URL.
-   * @param  {string}   [options.headers]       Default request headers.
-   * @param  {string}   [options.domain]  Required if using clientAssertionSigningKey.
-   * @param  {string}   [options.clientId]      Default client ID.
-   * @param  {string}   [options.clientSecret]  Default client Secret.
-   * @param  {string}   [options.clientAssertionSigningKey]  Private key used to sign the client assertion JWT.
-   * @param  {string}   [options.clientAssertionSigningAlg]  Default 'RS256'.
-   */
-  constructor(options) {
-    if (typeof options !== 'object') {
-      throw new ArgumentError('Missing tokens manager options');
-    }
-
-    if (typeof options.baseUrl !== 'string') {
-      throw new ArgumentError('baseUrl field is required');
-    }
-
-    this.baseUrl = options.baseUrl;
-    this.headers = options.headers || {};
-    this.domain = options.domain;
-    this.clientId = options.clientId || '';
-    this.clientSecret = options.clientSecret || '';
-    this.clientAssertionSigningKey = options.clientAssertionSigningKey;
-    this.clientAssertionSigningAlg = options.clientAssertionSigningAlg;
-  }
-
-  /**
-   * Given an ID token get the user profile linked to it.
-   *
-   * @example <caption>
-   *   Validates a JSON Web Token (signature and expiration) and returns the user
-   *   information associated with the user id (sub property) of the token. Find
-   *   more information in the
-   *   <a href="https://auth0.com/docs/auth-api#!#post--tokeninfo">API Docs</a>.
-   * </caption>
-   *
-   * auth0.tokens.getInfo(token, function (err, tokenInfo) {
-   *   if (err) {
-   *     // Handle error.
-   *   }
-   *
-   *   console.log(tokenInfo);
-   * });
-   * @param   {string}    idToken     User ID token.
-   * @param   {Function}  [cb]        Method callback.
-   * @returns  {Promise|undefined}
-   */
-  getInfo(idToken, cb) {
-    const headers = { ...this.headers };
-
-    if (idToken === null || idToken === undefined) {
-      throw new ArgumentError('An ID token is required');
-    }
-
-    if (typeof idToken !== 'string' || idToken.trim().length === 0) {
-      throw new ArgumentError('The ID token is not valid');
-    }
-
-    // Perform the request.
-    const promise = axios({
-      method: 'POST',
-      url: `${this.baseUrl}/tokeninfo`,
-      data: { id_token: idToken },
-      headers,
-    }).then(({ data }) => data);
-
-    // Use callback if given.
-    if (cb instanceof Function) {
-      promise.then(cb.bind(null, null)).catch(cb);
-      return;
-    }
-
-    return promise;
-  }
-
-  /**
-   * Exchange the token of the logged in user with a token that is valid to call
-   * the API (signed with the API secret).
-   *
-   * @example <caption>
-   *   Given an existing token, this endpoint will generate a new token signed
-   *   with the target client secret. This is used to flow the identity of the
-   *   user from the application to an API or across different APIs that are
-   *   protected with different secrets. Find more information in the
-   *   <a href="https://auth0.com/docs/auth-api#!#post--delegation">API Docs</a>.
-   * </caption>
-   *
-   * var data = {
-   *   id_token: '{ID_TOKEN}',
-   *   api_type: 'app',
-   *   target: '{TARGET}',
-   *   grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer'
-   * };
-   *
-   * auth0.tokens.getDelegationToken(data, function (err, token) {
-   *   if (err) {
-   *     // Handle error.
-   *   }
-   *
-   *   console.log(token);
-   * });
-   * @param   {object}    data                Token data object.
-   * @param   {string}    data.id_token       User ID token.
-   * @param   {string}    data.refresh_token  User refresh token.
-   * @param   {string}    data.target         Target client ID.
-   * @param   {string}    data.api_type       The API to be used (aws, auth0, etc).
-   * @param   {string}    data.grant_type     Grant type (password, jwt, etc).
-   * @param   {Function}  [cb]                Callback function.
-   * @returns  {Promise|undefined}
-   */
-  getDelegationToken(data, cb) {
-    const body = { client_id: this.clientId, ...data };
-    const { headers } = this;
-
-    if (!data) {
-      throw new ArgumentError('Missing token data object');
-    }
-
-    const hasIdToken = typeof data.id_token === 'string' && data.id_token.trim().length !== 0;
-
-    const hasRefreshToken =
-      typeof data.refresh_token === 'string' && data.refresh_token.trim().length !== 0;
-
-    if (!hasIdToken && !hasRefreshToken) {
-      throw new ArgumentError('one of id_token or refresh_token is required');
-    }
-
-    if (hasIdToken && hasRefreshToken) {
-      throw new ArgumentError(
-        'id_token and refresh_token fields cannot be specified simulatenously'
-      );
-    }
-
-    if (typeof data.target !== 'string' || data.target.trim().length === 0) {
-      throw new ArgumentError('target field is required');
-    }
-
-    if (typeof data.api_type !== 'string' || data.api_type.trim().length === 0) {
-      throw new ArgumentError('api_type field is required');
-    }
-
-    if (typeof data.grant_type !== 'string' || data.grant_type.trim().length === 0) {
-      throw new ArgumentError('grant_type field is required');
-    }
-
-    // Perform the request.
-    const promise = axios({
-      method: 'POST',
-      url: `${this.baseUrl}/delegation`,
-      data: body,
-      headers,
-    }).then(({ data }) => data);
-
-    // Use callback if given.
-    if (cb instanceof Function) {
-      promise.then(cb.bind(null, null)).catch(cb);
-      return;
-    }
-
-    return promise;
-  }
-
-  /**
-   * Proactively revoke an issued refresh token.
-   *
-   * @example <caption>
-   *   Given an existing refresh token, this endpoint will revoke it in order
-   *   to prevent unauthorized silently user authentication tokens refresh.
-   *   Find more information in the <a href="https://auth0.com/docs/api/authentication#revoke-refresh-token">API Docs</a>.
-   * </caption>
-   *
-   *  var data = {
-   *   token: '{REFRESH_TOKEN}'
-   * };
-   *
-   * auth0.tokens.revokeRefreshToken(data, function (err, _) {
-   *   if (err) {
-   *     // Handle error.
-   *   }
-   *
-   *   // Do stuff.
-   * });
-   * @param   {object}    data                  Token data object.
-   * @param   {string}    data.token            User refresh token.
-   * @param   {string}    [data.client_id]      Target client ID.
-   * @param   {string}    [data.client_secret]  Target client secret.
-   * @param   {Function}  [cb]                  Callback function.
-   * @returns  {Promise|undefined}
-   */
-  revokeRefreshToken(data, cb) {
-    if (!data) {
-      throw new ArgumentError('Missing token data object');
-    }
-
-    const hasToken = typeof data.token === 'string' && data.token.trim().length !== 0;
-
-    if (!hasToken) {
-      throw new ArgumentError('token property is required');
-    }
-
-    const hasClientId =
-      (data.client_id &&
-        typeof data.client_id === 'string' &&
-        data.client_id.trim().length !== 0) ||
-      this.clientId !== '';
-
-    if (!hasClientId) {
-      throw new ArgumentError(
-        'Neither token data client_id property or constructor clientId property has been set'
-      );
-    }
-
-    const body = addClientAuthentication({
-      payload: {
-        client_id: this.clientId,
-        ...data,
-      },
-      domain: this.domain,
-      clientSecret: this.clientSecret,
-      clientAssertionSigningKey: this.clientAssertionSigningKey,
-      clientAssertionSigningAlg: this.clientAssertionSigningAlg,
-    });
-
-    const { headers } = this;
-
-    // Perform the request.
-    const promise = axios({
-      method: 'POST',
-      url: `${this.baseUrl}/oauth/revoke`,
-      data: body,
-      headers,
-    }).then(({ data }) => data);
-
-    // Use callback if given.
-    if (cb instanceof Function) {
-      promise.then(cb.bind(null, null)).catch(cb);
-      return;
-    }
-
-    return promise;
-  }
-}
-
-module.exports = TokensManager;

package/src/auth/UsersManager.js

@@ -1,161 +0,0 @@
-const axios = require('axios');
-
-const { ArgumentError } = require('rest-facade');
-
-/**
- * Provides methods for getting user information and impersonating users.
- */
-class UsersManager {
-  /**
-   * @param  {object}   options               Manager options.
-   * @param  {string}   options.baseUrl       The auth0 account URL.
-   * @param  {string}   [options.headers]     Default request headers.
-   * @param  {string}   [options.clientId]    Default client ID.
-   */
-  constructor(options) {
-    if (typeof options !== 'object') {
-      throw new ArgumentError('Missing users manager options');
-    }
-
-    if (typeof options.baseUrl !== 'string') {
-      throw new ArgumentError('baseUrl field is required');
-    }
-
-    this.baseUrl = options.baseUrl;
-    this.headers = options.headers;
-    this.clientId = options.clientId;
-  }
-
-  /**
-   * Given an access token get the user profile linked to it.
-   *
-   * @example <caption>
-   *   Get the user information based on the Auth0 access token (obtained during
-   *   login). Find more information in the
-   *   <a href="https://auth0.com/docs/auth-api#!#get--userinfo">API Docs</a>.
-   * </caption>
-   *
-   * auth0.users.getInfo(accessToken, function (err, userInfo) {
-   *   if (err) {
-   *     // Handle error.
-   *   }
-   *
-   *   console.log(userInfo);
-   * });
-   * @param   {string}    accessToken   User access token.
-   * @param   {Function}  [cb]          Callback function.
-   * @returns  {Promise|undefined}
-   */
-  getInfo(accessToken, cb) {
-    const url = `${this.baseUrl}/userinfo`;
-    const headers = { ...this.headers };
-
-    if (accessToken === null || accessToken === undefined) {
-      throw new ArgumentError('An access token is required');
-    }
-
-    if (typeof accessToken !== 'string' || accessToken.trim().length === 0) {
-      throw new ArgumentError('Invalid access token');
-    }
-
-    // Send the user access token in the Authorization header.
-    headers['Authorization'] = `Bearer ${accessToken}`;
-
-    // Perform the request.
-    const promise = axios({
-      method: 'GET',
-      url,
-      headers,
-    }).then(({ data }) => data);
-
-    // Use callback if given.
-    if (cb instanceof Function) {
-      promise.then(cb.bind(null, null)).catch(cb);
-      return;
-    }
-
-    return promise;
-  }
-
-  /**
-   * Impersonate the user with the given user ID.
-   *
-   * @example <caption>
-   *   Gets a link that can be used once to log in as a specific user. Useful for
-   *   troubleshooting. Find more information in the
-   *   [API Docs](https://auth0.com/docs/auth-api#!#post--users--user_id--impersonate).
-   * </caption>
-   *
-   * var settings = {
-   *   impersonator_id: '{IMPERSONATOR_ID}',
-   *   protocol: 'oauth2',
-   *   additionalParameters: {}  // Optional additional params.
-   * };
-   *
-   * auth0.users.impersonate(userId, settings, function (err, link) {
-   *   if (err) {
-   *     // Handle error.
-   *   }
-   *
-   *   console.log(link);
-   * });
-   * @param   {string}    userId                    User ID token.
-   * @param   {object}    settings                  Impersonation settings.
-   * @param   {string}    settings.impersonator_id  Impersonator user ID.
-   * @param   {string}    settings.protocol         The authentication protocol.
-   * @param   {string}    settings.token            API v1 token obtained for impersonation
-   * @param   {string}    [settings.clientId]       Client id used for impersonation. Uses the one supplied in the constructor by default.
-   * @param   {Function}  [cb]                      Callback function.
-   * @returns  {Promise|undefined}
-   */
-  impersonate(userId, settings, cb) {
-    const url = `${this.baseUrl}/users/${userId}/impersonate`;
-
-    if (userId === null || userId === undefined) {
-      throw new ArgumentError('You must specify a user ID');
-    }
-
-    if (typeof userId !== 'string' || userId.trim().length === 0) {
-      throw new ArgumentError('The user ID is not valid');
-    }
-
-    if (typeof settings !== 'object') {
-      throw new ArgumentError('Missing impersonation settings object');
-    }
-
-    if (
-      typeof settings.impersonator_id !== 'string' ||
-      settings.impersonator_id.trim().length === 0
-    ) {
-      throw new ArgumentError('impersonator_id field is required');
-    }
-
-    if (typeof settings.protocol !== 'string' || settings.protocol.trim().length === 0) {
-      throw new ArgumentError('protocol field is required');
-    }
-
-    if (typeof settings.token !== 'string' || settings.token.trim().length === 0) {
-      throw new ArgumentError('token field is required');
-    }
-
-    const data = { client_id: settings.clientId || this.clientId, ...settings };
-    const headers = { Authorization: `Bearer ${settings.token}`, ...this.headers };
-    // Perform the request.
-    const promise = axios({
-      method: 'POST',
-      headers,
-      data,
-      url,
-    }).then(({ data }) => data);
-
-    // Use callback if given.
-    if (cb instanceof Function) {
-      promise.then(cb.bind(null, null)).catch(cb);
-      return;
-    }
-
-    return promise;
-  }
-}
-
-module.exports = UsersManager;

package/src/auth/clientAuthentication.js

@@ -1,86 +0,0 @@
-const { ArgumentError } = require('rest-facade');
-const jwt = require('jsonwebtoken');
-const uuid = require('uuid');
-
-/**
- * Create a JWT signed with the clientAssertionSigningKey
- * for use on clients with token endpoint auth method of private_key_jwt.
- *
- * @param {string} domain The domain of the Authorization Server (can be a custom domain).
- * @param {string} clientId The Client ID.
- * @param {string} clientAssertionSigningKey A private key in PEM format to sign the client assertion JWT.
- * @param {string} clientAssertionSigningAlg The alg to use to sign the JWT (default RS256)
- * @returns {string} A JWT.
- */
-const createClientAssertionJWT = ({
-  clientId,
-  clientAssertionSigningKey,
-  clientAssertionSigningAlg,
-  domain,
-}) => {
-  const now = Math.floor(Date.now() / 1000);
-  const payload = {
-    iss: clientId,
-    sub: clientId,
-    aud: `https://${domain}/`,
-    iat: now,
-    exp: now + 180,
-    jti: uuid.v4(),
-  };
-  return jwt.sign(payload, clientAssertionSigningKey, {
-    algorithm: clientAssertionSigningAlg || 'RS256',
-  });
-};
-
-/**
- * Adds client authentication, if available, to the payload of the following requests:
- * - /oauth/token
- * - /oauth/revoke
- * - /mfa/associate
- * - /mfa/challenge
- * - /passwordless/start
- *
- * Adds `client_secret` for Client Secret Post token endpoint auth method (the SDK doesn't use Client Secret Basic)
- * Adds `client_assertion` and `client_assertion_type` for Private Key JWT token endpoint auth method.
- *
- * If `clientAssertionSigningKey` is provided it takes precedent over `clientSecret` .
- *
- * @param {object} payload The body of the request to be authenticated.
- * @param {string} domain The domain of the Authorization Server (can be a custom domain).
- * @param {boolean} [required] True if client authentication is required.
- * @param {string} [clientAssertionSigningKey] A private key in PEM format to sign the client assertion JWT.
- * @param {string} clientAssertionSigningAlg The alg to use to sign the JWT (default RS256)
- * @param {string} [clientSecret] The client secret.
- * @returns {object} The payload with additional fields for client authentication.
- */
-const addClientAuthentication = ({
-  payload,
-  domain,
-  required,
-  clientAssertionSigningKey,
-  clientAssertionSigningAlg,
-  clientSecret,
-}) => {
-  const clientId = payload.client_id;
-  if (clientAssertionSigningKey && !payload.client_assertion) {
-    payload.client_assertion = createClientAssertionJWT({
-      clientId,
-      clientAssertionSigningKey,
-      clientAssertionSigningAlg,
-      domain,
-    });
-    payload.client_assertion_type = 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer';
-  } else if (clientSecret && !payload.client_secret) {
-    payload.client_secret = clientSecret;
-  }
-  if (
-    required &&
-    (!payload.client_secret || payload.client_secret.trim().length === 0) &&
-    (!payload.client_assertion || payload.client_assertion.trim().length === 0)
-  ) {
-    throw new ArgumentError('The client_secret or client_assertion field is required.');
-  }
-  return payload;
-};
-
-module.exports.addClientAuthentication = addClientAuthentication;

package/src/auth/idToken.js

@@ -1,167 +0,0 @@
-const urlDecodeB64 = function (data) {
-  return Buffer.from(data, 'base64').toString('utf8');
-};
-
-/**
- * Decodes a string token into the 3 parts, throws if the format is invalid
- *
- * @param {string} token token
- * @returns {object}
- */
-const decode = function (token) {
-  const parts = token.split('.');
-
-  if (parts.length !== 3) {
-    throw new Error('ID token could not be decoded');
-  }
-
-  return {
-    _raw: token,
-    header: JSON.parse(urlDecodeB64(parts[0])),
-    payload: JSON.parse(urlDecodeB64(parts[1])),
-    signature: parts[2],
-  };
-};
-
-const DEFAULT_LEEWAY = 60; //default clock-skew, in seconds
-
-/**
- * Validator for ID Tokens following OIDC spec.
- *
- * @param {string} token the string token to verify
- * @param {object} options the options required to run this verification
- * @returns {object} The decoded token payload, or throws an exception if validation failed
- */
-const validate = function (token, options) {
-  if (!token) {
-    throw new Error('ID token is required but missing');
-  }
-
-  const decodedToken = decode(token);
-
-  // Check algorithm
-  const { header } = decodedToken;
-  if (header.alg !== 'RS256' && header.alg !== 'HS256') {
-    throw new Error(
-      `Signature algorithm of "${header.alg}" is not supported. Expected the ID token to be signed with "RS256" or "HS256".`
-    );
-  }
-
-  const { payload } = decodedToken;
-
-  // Issuer
-  if (!payload.iss || typeof payload.iss !== 'string') {
-    throw new Error('Issuer (iss) claim must be a string present in the ID token');
-  }
-  if (payload.iss !== options.issuer) {
-    throw new Error(
-      `Issuer (iss) claim mismatch in the ID token; expected "${options.issuer}", found "${payload.iss}"`
-    );
-  }
-
-  // Subject
-  if (!payload.sub || typeof payload.sub !== 'string') {
-    throw new Error('Subject (sub) claim must be a string present in the ID token');
-  }
-
-  // Audience
-  if (!payload.aud || !(typeof payload.aud === 'string' || Array.isArray(payload.aud))) {
-    throw new Error(
-      'Audience (aud) claim must be a string or array of strings present in the ID token'
-    );
-  }
-  if (Array.isArray(payload.aud) && !payload.aud.includes(options.audience)) {
-    throw new Error(
-      `Audience (aud) claim mismatch in the ID token; expected "${
-        options.audience
-      }" but was not one of "${payload.aud.join(', ')}"`
-    );
-  } else if (typeof payload.aud === 'string' && payload.aud !== options.audience) {
-    throw new Error(
-      `Audience (aud) claim mismatch in the ID token; expected "${options.audience}" but found "${payload.aud}"`
-    );
-  }
-
-  // Organization
-  if (options.organization) {
-    if (!payload.org_id || typeof payload.org_id !== 'string') {
-      throw new Error('Organization Id (org_id) claim must be a string present in the ID token');
-    }
-
-    if (payload.org_id !== options.organization) {
-      throw new Error(
-        `Organization Id (org_id) claim value mismatch in the ID token; expected "${options.organization}", found "${payload.org_id}"'`
-      );
-    }
-  }
-
-  // --Time validation (epoch)--
-  const now = Math.floor(Date.now() / 1000);
-  const leeway = options.leeway || DEFAULT_LEEWAY;
-
-  // Expires at
-  if (!payload.exp || typeof payload.exp !== 'number') {
-    throw new Error('Expiration Time (exp) claim must be a number present in the ID token');
-  }
-  const expTime = payload.exp + leeway;
-
-  if (now > expTime) {
-    throw new Error(
-      `Expiration Time (exp) claim error in the ID token; current time (${now}) is after expiration time (${expTime})`
-    );
-  }
-
-  // Issued at
-  if (!payload.iat || typeof payload.iat !== 'number') {
-    throw new Error('Issued At (iat) claim must be a number present in the ID token');
-  }
-
-  // Nonce
-  if (options.nonce) {
-    if (!payload.nonce || typeof payload.nonce !== 'string') {
-      throw new Error('Nonce (nonce) claim must be a string present in the ID token');
-    }
-    if (payload.nonce !== options.nonce) {
-      throw new Error(
-        `Nonce (nonce) claim mismatch in the ID token; expected "${options.nonce}", found "${payload.nonce}"`
-      );
-    }
-  }
-
-  // Authorized party
-  if (Array.isArray(payload.aud) && payload.aud.length > 1) {
-    if (!payload.azp || typeof payload.azp !== 'string') {
-      throw new Error(
-        'Authorized Party (azp) claim must be a string present in the ID token when Audience (aud) claim has multiple values'
-      );
-    }
-    if (payload.azp !== options.audience) {
-      throw new Error(
-        `Authorized Party (azp) claim mismatch in the ID token; expected "${options.audience}", found "${payload.azp}"`
-      );
-    }
-  }
-
-  // Authentication time
-  if (options.maxAge) {
-    if (!payload.auth_time || typeof payload.auth_time !== 'number') {
-      throw new Error(
-        'Authentication Time (auth_time) claim must be a number present in the ID token when Max Age (max_age) is specified'
-      );
-    }
-
-    const authValidUntil = payload.auth_time + options.maxAge + leeway;
-    if (now > authValidUntil) {
-      throw new Error(
-        `Authentication Time (auth_time) claim in the ID token indicates that too much time has passed since the last end-user authentication. Currrent time (${now}) is after last auth at ${authValidUntil}`
-      );
-    }
-  }
-
-  return decodedToken;
-};
-
-module.exports = {
-  decode,
-  validate,
-};