auth0 3.4.0 → 4.0.0-beta.1

package/README.md

@@ -1,16 +1,17 @@
 ![Node.js client library for Auth0](https://cdn.auth0.com/website/sdks/banner/node-auth0-banner.png)
 
+> ⚠️ Please be aware that v4 is currently in <strong>Beta</strong>. Whilst we encourage you to test the update within your applications, we do no recommend using this version in production yet.
+
 ![Release](https://img.shields.io/npm/v/auth0)
 [![Codecov](https://img.shields.io/codecov/c/github/auth0/node-auth0)](https://codecov.io/gh/auth0/node-auth0)
 ![Downloads](https://img.shields.io/npm/dw/auth0)
 [![License](https://img.shields.io/:license-mit-blue.svg?style=flat)](https://opensource.org/licenses/MIT)
 ![CircleCI](https://img.shields.io/circleci/build/github/auth0/node-auth0)
 
-📚 [Documentation](#documentation) - 🚀 [Getting Started](#getting-started) - 💻 [API Reference](#api-reference) - 💬 [Feedback](#feedback)
+📚 [Documentation](#documentation) - 🚀 [Getting Started](#getting-started) - 💬 [Feedback](#feedback)
 
 ## Documentation
 
-- [FAQs](https://github.com/auth0/node-auth0/blob/master/FAQ.md) - frequently asked questions about node-auth0.
 - [Docs Site](https://auth0.com/docs) - explore our docs site and learn more about Auth0
 
 ## Getting Started
@@ -19,56 +20,59 @@
 
 This library supports the following tooling versions:
 
-- Node.js: `>=8.3.0`
+- Node.js: `>=16`
 
 ### Installation
 
 Using [npm](https://npmjs.org) in your project directory run the following command:
 
 ```bash
-npm install auth0
+npm install auth0@beta
 ```
 
 ### Configure the SDK
 
 #### Authentication API Client
 
-This client must be used to access Auth0's [Authentication API](https://auth0.com/docs/api/authentication).
+This client can be used to access Auth0's [Authentication API](https://auth0.com/docs/api/authentication).
 
 The **AuthenticationClient** constructor takes an _optional_ client ID, if specified it will be used as default value for all endpoints that accept a client ID.
 
 ```js
-var AuthenticationClient = require('auth0').AuthenticationClient;
+import { AuthenticationClient } from 'auth0';
 
-var auth0 = new AuthenticationClient({
+const auth0 = new AuthenticationClient({
   domain: '{YOUR_ACCOUNT}.auth0.com',
   clientId: '{OPTIONAL_CLIENT_ID}',
+  clientSecret: '{OPTIONAL_CLIENT_SECRET}',
 });
 ```
 
 #### Management API Client
 
-> Note: When using the ManagementClient in a browser you should set `telemetry: false`.
-
 The Auth0 Management API is meant to be used by back-end servers or trusted parties performing administrative tasks. Generally speaking, anything that can be done through the Auth0 dashboard (and more) can also be done through this API.
 
 Initialize your client class with an API v2 token and a domain.
 
 ```js
-var ManagementClient = require('auth0').ManagementClient;
+import { ManagementClient } from 'auth0';
 
 var management = new ManagementClient({
-  token: '{YOUR_API_V2_TOKEN}',
   domain: '{YOUR_ACCOUNT}.auth0.com',
+  token: '{YOUR_API_V2_TOKEN}',
 });
 ```
 
-For other examples see the [EXAMPLES.md](https://github.com/auth0/node-auth0/blob/master/EXAMPLES.md) document.
+Or, initialize your client class with a client secret and a domain.
 
-## API Reference
+```js
+import { ManagementClient } from 'auth0';
 
-- [AuthenticationClient](https://auth0.github.io/node-auth0/AuthenticationClient.html)
-- [ManagementClient](https://auth0.github.io/node-auth0/ManagementClient.html)
+var management = new ManagementClient({
+  token: '{YOUR_API_V2_TOKEN}',
+  domain: '{YOUR_ACCOUNT}.auth0.com',
+});
+```
 
 ## Feedback
 

package/dist/cjs/auth/base-auth-api.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BaseAuthAPI = exports.AuthApiError = void 0;
+const errors_js_1 = require("../lib/errors.js");
+const runtime_js_1 = require("../lib/runtime.js");
+const client_authentication_js_1 = require("./client-authentication.js");
+class AuthApiError extends Error {
+    constructor(error, error_description, statusCode, body, headers) {
+        super(error_description || error);
+        this.error = error;
+        this.error_description = error_description;
+        this.statusCode = statusCode;
+        this.body = body;
+        this.headers = headers;
+        this.name = 'AuthApiError';
+    }
+}
+exports.AuthApiError = AuthApiError;
+async function parseError(response) {
+    // Errors typically have a specific format:
+    // {
+    //    error: 'invalid_body',
+    //    error_description: 'Bad Request',
+    // }
+    const body = await response.text();
+    let data;
+    try {
+        data = JSON.parse(body);
+        return new AuthApiError(data.error, data.error_description, response.status, body, response.headers);
+    }
+    catch (_) {
+        return new errors_js_1.ResponseError(response.status, body, response.headers, 'Response returned an error code');
+    }
+}
+class BaseAuthAPI extends runtime_js_1.BaseAPI {
+    constructor(options) {
+        super({ ...options, baseUrl: `https://${options.domain}`, parseError });
+        this.domain = options.domain;
+        this.clientId = options.clientId;
+        this.clientSecret = options.clientSecret;
+        this.clientAssertionSigningKey = options.clientAssertionSigningKey;
+        this.clientAssertionSigningAlg = options.clientAssertionSigningAlg;
+    }
+    /**
+     * @private
+     */
+    async addClientAuthentication(payload, required) {
+        return (0, client_authentication_js_1.addClientAuthentication)({
+            payload,
+            domain: this.domain,
+            required,
+            clientId: this.clientId,
+            clientSecret: this.clientSecret,
+            clientAssertionSigningKey: this.clientAssertionSigningKey,
+            clientAssertionSigningAlg: this.clientAssertionSigningAlg,
+        });
+    }
+}
+exports.BaseAuthAPI = BaseAuthAPI;
+//# sourceMappingURL=base-auth-api.js.map

package/dist/cjs/auth/base-auth-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-auth-api.js","sourceRoot":"","sources":["../../../src/auth/base-auth-api.ts"],"names":[],"mappings":";;;AAAA,gDAAiD;AACjD,kDAA2D;AAC3D,yEAGoC;AAkBpC,MAAa,YAAa,SAAQ,KAAK;IAErC,YACS,KAAa,EACb,iBAAyB,EACzB,UAAkB,EAClB,IAAY,EACZ,OAAgB;QAEvB,KAAK,CAAC,iBAAiB,IAAI,KAAK,CAAC,CAAC;QAN3B,UAAK,GAAL,KAAK,CAAQ;QACb,sBAAiB,GAAjB,iBAAiB,CAAQ;QACzB,eAAU,GAAV,UAAU,CAAQ;QAClB,SAAI,GAAJ,IAAI,CAAQ;QACZ,YAAO,GAAP,OAAO,CAAS;QANhB,SAAI,GAAG,cAAuB,CAAC;IASxC,CAAC;CACF;AAXD,oCAWC;AAED,KAAK,UAAU,UAAU,CAAC,QAAkB;IAC1C,2CAA2C;IAC3C,IAAI;IACJ,4BAA4B;IAC5B,uCAAuC;IACvC,IAAI;IAEJ,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,IAA0B,CAAC;IAE/B,IAAI;QACF,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAyB,CAAC;QAChD,OAAO,IAAI,YAAY,CACrB,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,iBAAiB,EACtB,QAAQ,CAAC,MAAM,EACf,IAAI,EACJ,QAAQ,CAAC,OAAO,CACjB,CAAC;KACH;IAAC,OAAO,CAAC,EAAE;QACV,OAAO,IAAI,yBAAa,CACtB,QAAQ,CAAC,MAAM,EACf,IAAI,EACJ,QAAQ,CAAC,OAAO,EAChB,iCAAiC,CAClC,CAAC;KACH;AACH,CAAC;AACD,MAAa,WAAY,SAAQ,oBAAO;IAOtC,YAAY,OAAoC;QAC9C,KAAK,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,WAAW,OAAO,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;QAExE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QACzC,IAAI,CAAC,yBAAyB,GAAG,OAAO,CAAC,yBAAyB,CAAC;QACnE,IAAI,CAAC,yBAAyB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IACrE,CAAC;IAED;;OAEG;IACO,KAAK,CAAC,uBAAuB,CACrC,OAAuC,EACvC,QAAiB;QAEjB,OAAO,IAAA,kDAAuB,EAAC;YAC7B,OAAO;YACP,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ;YACR,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;YACzD,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;SAC1D,CAAC,CAAC;IACL,CAAC;CACF;AAlCD,kCAkCC"}

package/dist/cjs/auth/client-authentication.js

@@ -0,0 +1,64 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.addClientAuthentication = void 0;
+const jose = __importStar(require("jose"));
+const uuid_1 = require("uuid");
+/**
+ * Adds client authentication, if available, to the provided payload.
+ *
+ * Adds `client_secret` for Client Secret Post token endpoint auth method (the SDK doesn't use Client Secret Basic)
+ * Adds `client_assertion` and `client_assertion_type` for Private Key JWT token endpoint auth method.
+ *
+ * If `clientAssertionSigningKey` is provided it takes precedent over `clientSecret` .
+ */
+const addClientAuthentication = async ({ payload, domain, clientId, required, clientAssertionSigningKey, clientAssertionSigningAlg, clientSecret, }) => {
+    const cid = payload.client_id || clientId;
+    if (clientAssertionSigningKey && !payload.client_assertion) {
+        const alg = clientAssertionSigningAlg || 'RS256';
+        const privateKey = await jose.importPKCS8(clientAssertionSigningKey, alg);
+        payload.client_assertion = await new jose.SignJWT({})
+            .setProtectedHeader({ alg })
+            .setIssuedAt()
+            .setSubject(cid)
+            .setJti((0, uuid_1.v4)())
+            .setIssuer(cid)
+            .setAudience(`https://${domain}/`)
+            .setExpirationTime('2mins')
+            .sign(privateKey);
+        payload.client_assertion_type = 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer';
+    }
+    else if (clientSecret && !payload.client_secret) {
+        payload.client_secret = clientSecret;
+    }
+    if (required &&
+        (!payload.client_secret || payload.client_secret.trim().length === 0) &&
+        (!payload.client_assertion || payload.client_assertion.trim().length === 0)) {
+        throw new Error('The client_secret or client_assertion field is required.');
+    }
+    return payload;
+};
+exports.addClientAuthentication = addClientAuthentication;
+//# sourceMappingURL=client-authentication.js.map

package/dist/cjs/auth/client-authentication.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-authentication.js","sourceRoot":"","sources":["../../../src/auth/client-authentication.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA6B;AAC7B,+BAAkC;AAoBlC;;;;;;;GAOG;AACI,MAAM,uBAAuB,GAAG,KAAK,EAAE,EAC5C,OAAO,EACP,MAAM,EACN,QAAQ,EACR,QAAQ,EACR,yBAAyB,EACzB,yBAAyB,EACzB,YAAY,GACmB,EAAoC,EAAE;IACrE,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC;IAC1C,IAAI,yBAAyB,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE;QAC1D,MAAM,GAAG,GAAG,yBAAyB,IAAI,OAAO,CAAC;QACjD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;QAE1E,OAAO,CAAC,gBAAgB,GAAG,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;aAClD,kBAAkB,CAAC,EAAE,GAAG,EAAE,CAAC;aAC3B,WAAW,EAAE;aACb,UAAU,CAAC,GAAG,CAAC;aACf,MAAM,CAAC,IAAA,SAAI,GAAE,CAAC;aACd,SAAS,CAAC,GAAG,CAAC;aACd,WAAW,CAAC,WAAW,MAAM,GAAG,CAAC;aACjC,iBAAiB,CAAC,OAAO,CAAC;aAC1B,IAAI,CAAC,UAAU,CAAC,CAAC;QACpB,OAAO,CAAC,qBAAqB,GAAG,wDAAwD,CAAC;KAC1F;SAAM,IAAI,YAAY,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE;QACjD,OAAO,CAAC,aAAa,GAAG,YAAY,CAAC;KACtC;IACD,IACE,QAAQ;QACR,CAAC,CAAC,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC;QACrE,CAAC,CAAC,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,EAC3E;QACA,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;KAC7E;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAnCW,QAAA,uBAAuB,2BAmClC"}

package/dist/cjs/auth/database.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Database = void 0;
+const models_js_1 = require("../lib/models.js");
+const runtime_js_1 = require("../lib/runtime.js");
+const base_auth_api_js_1 = require("./base-auth-api.js");
+/**
+ * Sign-up and change-password for Database & Active Directory authentication services.
+ */
+class Database extends base_auth_api_js_1.BaseAuthAPI {
+    /**
+     * Given a user's credentials, and a connection, this endpoint will create a new user using active authentication.
+     *
+     * This endpoint only works for database connections.
+     *
+     * See: https://auth0.com/docs/api/authentication#signup
+     *
+     * @example
+     * ```js
+     * var data = {
+     *   email: '{EMAIL}',
+     *   password: '{PASSWORD}',
+     *   connection: 'Username-Password-Authentication'
+     * };
+     *
+     * await auth0.database.signUp(data);
+     * ```
+     */
+    async signUp(bodyParameters, initOverrides) {
+        // TODO: call this `validateRequiredParams` so we can use with bodyParameters in the auth api
+        (0, runtime_js_1.validateRequiredRequestParams)(bodyParameters, ['email', 'password', 'connection']);
+        const response = await this.request({
+            path: '/dbconnections/signup',
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+            },
+            body: { client_id: this.clientId, ...bodyParameters },
+        }, initOverrides);
+        return models_js_1.JSONApiResponse.fromResponse(response);
+    }
+    /**
+     * Given a user's email address and a connection, Auth0 will send a change password email.
+     *
+     * This endpoint only works for database connections.
+     *
+     * See: https://auth0.com/docs/api/authentication#change-password
+     *
+     * @example
+     * ```js
+     * var data = {
+     *   email: '{EMAIL}',
+     *   connection: 'Username-Password-Authentication'
+     * };
+     *
+     * await auth0.database.changePassword(data);
+     * ```
+     */
+    async changePassword(bodyParameters, initOverrides) {
+        (0, runtime_js_1.validateRequiredRequestParams)(bodyParameters, ['email', 'connection']);
+        const response = await this.request({
+            path: '/dbconnections/change_password',
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+            },
+            body: { client_id: this.clientId, ...bodyParameters },
+        }, initOverrides);
+        return models_js_1.TextApiResponse.fromResponse(response);
+    }
+}
+exports.Database = Database;
+//# sourceMappingURL=database.js.map

package/dist/cjs/auth/database.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database.js","sourceRoot":"","sources":["../../../src/auth/database.ts"],"names":[],"mappings":";;;AAAA,gDAAkF;AAClF,kDAAkE;AAClE,yDAAiD;AA8GjD;;GAEG;AACH,MAAa,QAAS,SAAQ,8BAAW;IACvC;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,MAAM,CACV,cAA6B,EAC7B,aAA4B;QAE5B,6FAA6F;QAC7F,IAAA,0CAA6B,EAAC,cAAc,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;QAEnF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CACjC;YACE,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,cAAc,EAAE;SACtD,EACD,aAAa,CACd,CAAC;QAEF,OAAO,2BAAe,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,cAAc,CAClB,cAAqC,EACrC,aAA4B;QAE5B,IAAA,0CAA6B,EAAC,cAAc,EAAE,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CACjC;YACE,IAAI,EAAE,gCAAgC;YACtC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,cAAc,EAAE;SACtD,EACD,aAAa,CACd,CAAC;QAEF,OAAO,2BAAe,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;CACF;AA7ED,4BA6EC"}

package/dist/cjs/auth/id-token-validator.js

@@ -0,0 +1,135 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IDTokenValidator = exports.IdTokenValidatorError = void 0;
+const jose = __importStar(require("jose"));
+const DEFAULT_CLOCK_TOLERANCE = 60; // secs
+class IdTokenValidatorError extends Error {
+}
+exports.IdTokenValidatorError = IdTokenValidatorError;
+class IDTokenValidator {
+    constructor({ domain, clientId, clientSecret, agent, headers, timeoutDuration, idTokenSigningAlg = 'RS256', clockTolerance = DEFAULT_CLOCK_TOLERANCE, }) {
+        this.jwks = jose.createRemoteJWKSet(new URL(`https://${domain}/.well-known/jwks.json`), {
+            timeoutDuration,
+            agent,
+            headers,
+        });
+        this.alg = idTokenSigningAlg;
+        this.audience = clientId;
+        this.secret = new TextEncoder().encode(clientSecret);
+        this.issuer = `https://${domain}/`;
+        this.clockTolerance = clockTolerance;
+    }
+    async validate(idToken, { nonce, maxAge, organization } = {}) {
+        const secret = this.alg === 'HS256' ? this.secret : this.jwks;
+        const header = jose.decodeProtectedHeader(idToken);
+        const payload = jose.decodeJwt(idToken);
+        // Check algorithm
+        if (header.alg !== 'RS256' && header.alg !== 'HS256') {
+            throw new Error(`Signature algorithm of "${header.alg}" is not supported. Expected the ID token to be signed with "RS256" or "HS256".`);
+        }
+        // Issuer
+        if (!payload.iss || typeof payload.iss !== 'string') {
+            throw new IdTokenValidatorError('Issuer (iss) claim must be a string present in the ID token');
+        }
+        if (payload.iss !== this.issuer) {
+            throw new IdTokenValidatorError(`Issuer (iss) claim mismatch in the ID token; expected "${this.issuer}", found "${payload.iss}"`);
+        }
+        // Subject
+        if (!payload.sub || typeof payload.sub !== 'string') {
+            throw new IdTokenValidatorError('Subject (sub) claim must be a string present in the ID token');
+        }
+        // Audience
+        if (!payload.aud || !(typeof payload.aud === 'string' || Array.isArray(payload.aud))) {
+            throw new IdTokenValidatorError('Audience (aud) claim must be a string or array of strings present in the ID token');
+        }
+        if (Array.isArray(payload.aud) && !payload.aud.includes(this.audience)) {
+            throw new IdTokenValidatorError(`Audience (aud) claim mismatch in the ID token; expected "${this.audience}" but was not one of "${payload.aud.join(', ')}"`);
+        }
+        else if (typeof payload.aud === 'string' && payload.aud !== this.audience) {
+            throw new IdTokenValidatorError(`Audience (aud) claim mismatch in the ID token; expected "${this.audience}" but found "${payload.aud}"`);
+        }
+        // Organization
+        if (organization) {
+            if (!payload.org_id || typeof payload.org_id !== 'string') {
+                throw new IdTokenValidatorError('Organization Id (org_id) claim must be a string present in the ID token');
+            }
+            if (payload.org_id !== organization) {
+                throw new IdTokenValidatorError(`Organization Id (org_id) claim value mismatch in the ID token; expected "${organization}", found "${payload.org_id}"'`);
+            }
+        }
+        // Time validation (epoch)
+        const now = Math.floor(Date.now() / 1000);
+        // Expires at
+        if (!payload.exp || typeof payload.exp !== 'number') {
+            throw new IdTokenValidatorError('Expiration Time (exp) claim must be a number present in the ID token');
+        }
+        const expTime = payload.exp + this.clockTolerance;
+        if (now > expTime) {
+            throw new IdTokenValidatorError(`Expiration Time (exp) claim error in the ID token; current time (${now}) is after expiration time (${expTime})`);
+        }
+        // Issued at
+        if (!payload.iat || typeof payload.iat !== 'number') {
+            throw new IdTokenValidatorError('Issued At (iat) claim must be a number present in the ID token');
+        }
+        // Nonce
+        if (nonce || payload.nonce) {
+            if (!payload.nonce || typeof payload.nonce !== 'string') {
+                throw new IdTokenValidatorError('Nonce (nonce) claim must be a string present in the ID token');
+            }
+            if (payload.nonce !== nonce) {
+                throw new IdTokenValidatorError(`Nonce (nonce) claim mismatch in the ID token; expected "${nonce}", found "${payload.nonce}"`);
+            }
+        }
+        // Authorized party
+        if (Array.isArray(payload.aud) && payload.aud.length > 1) {
+            if (!payload.azp || typeof payload.azp !== 'string') {
+                throw new IdTokenValidatorError('Authorized Party (azp) claim must be a string present in the ID token when Audience (aud) claim has multiple values');
+            }
+            if (payload.azp !== this.audience) {
+                throw new IdTokenValidatorError(`Authorized Party (azp) claim mismatch in the ID token; expected "${this.audience}", found "${payload.azp}"`);
+            }
+        }
+        // Authentication time
+        if (maxAge) {
+            if (!payload.auth_time || typeof payload.auth_time !== 'number') {
+                throw new IdTokenValidatorError('Authentication Time (auth_time) claim must be a number present in the ID token when Max Age (max_age) is specified');
+            }
+            const authValidUntil = payload.auth_time + maxAge + this.clockTolerance;
+            if (now > authValidUntil) {
+                throw new IdTokenValidatorError(`Authentication Time (auth_time) claim in the ID token indicates that too much time has passed since the last end-user authentication. Currrent time (${now}) is after last auth at ${authValidUntil}`);
+            }
+        }
+        await jose.jwtVerify(idToken, secret, {
+            issuer: this.issuer,
+            audience: this.audience,
+            clockTolerance: this.clockTolerance,
+            maxTokenAge: maxAge,
+            algorithms: ['HS256', 'RS256'],
+        });
+    }
+}
+exports.IDTokenValidator = IDTokenValidator;
+//# sourceMappingURL=id-token-validator.js.map

package/dist/cjs/auth/id-token-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"id-token-validator.js","sourceRoot":"","sources":["../../../src/auth/id-token-validator.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA6B;AAG7B,MAAM,uBAAuB,GAAG,EAAE,CAAC,CAAC,OAAO;AAE3C,MAAa,qBAAsB,SAAQ,KAAK;CAAG;AAAnD,sDAAmD;AAQnD,MAAa,gBAAgB;IAW3B,YAAY,EACV,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,KAAK,EACL,OAAO,EACP,eAAe,EACf,iBAAiB,GAAG,OAAO,EAC3B,cAAc,GAAG,uBAAuB,GACZ;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,WAAW,MAAM,wBAAwB,CAAC,EAAE;YACtF,eAAe;YACf,KAAK;YACL,OAAO;SACR,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,GAAG,iBAAiB,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,GAAG,WAAW,MAAM,GAAG,CAAC;QACnC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAe,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,KAA6B,EAAE;QAC1F,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAE9D,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAExC,kBAAkB;QAClB,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,EAAE;YACpD,MAAM,IAAI,KAAK,CACb,2BAA2B,MAAM,CAAC,GAAG,iFAAiF,CACvH,CAAC;SACH;QACD,SAAS;QACT,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE;YACnD,MAAM,IAAI,qBAAqB,CAC7B,6DAA6D,CAC9D,CAAC;SACH;QACD,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,MAAM,EAAE;YAC/B,MAAM,IAAI,qBAAqB,CAC7B,0DAA0D,IAAI,CAAC,MAAM,aAAa,OAAO,CAAC,GAAG,GAAG,CACjG,CAAC;SACH;QAED,UAAU;QACV,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE;YACnD,MAAM,IAAI,qBAAqB,CAC7B,8DAA8D,CAC/D,CAAC;SACH;QAED,WAAW;QACX,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE;YACpF,MAAM,IAAI,qBAAqB,CAC7B,mFAAmF,CACpF,CAAC;SACH;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;YACtE,MAAM,IAAI,qBAAqB,CAC7B,4DACE,IAAI,CAAC,QACP,yBAAyB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACnD,CAAC;SACH;aAAM,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ,EAAE;YAC3E,MAAM,IAAI,qBAAqB,CAC7B,4DAA4D,IAAI,CAAC,QAAQ,gBAAgB,OAAO,CAAC,GAAG,GAAG,CACxG,CAAC;SACH;QAED,eAAe;QACf,IAAI,YAAY,EAAE;YAChB,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE;gBACzD,MAAM,IAAI,qBAAqB,CAC7B,yEAAyE,CAC1E,CAAC;aACH;YAED,IAAI,OAAO,CAAC,MAAM,KAAK,YAAY,EAAE;gBACnC,MAAM,IAAI,qBAAqB,CAC7B,4EAA4E,YAAY,aAAa,OAAO,CAAC,MAAM,IAAI,CACxH,CAAC;aACH;SACF;QAED,0BAA0B;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAE1C,aAAa;QACb,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE;YACnD,MAAM,IAAI,qBAAqB,CAC7B,sEAAsE,CACvE,CAAC;SACH;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC;QAElD,IAAI,GAAG,GAAG,OAAO,EAAE;YACjB,MAAM,IAAI,qBAAqB,CAC7B,oEAAoE,GAAG,+BAA+B,OAAO,GAAG,CACjH,CAAC;SACH;QAED,YAAY;QACZ,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE;YACnD,MAAM,IAAI,qBAAqB,CAC7B,gEAAgE,CACjE,CAAC;SACH;QAED,QAAQ;QACR,IAAI,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE;YAC1B,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE;gBACvD,MAAM,IAAI,qBAAqB,CAC7B,8DAA8D,CAC/D,CAAC;aACH;YACD,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE;gBAC3B,MAAM,IAAI,qBAAqB,CAC7B,2DAA2D,KAAK,aAAa,OAAO,CAAC,KAAK,GAAG,CAC9F,CAAC;aACH;SACF;QAED,mBAAmB;QACnB,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE;YACxD,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE;gBACnD,MAAM,IAAI,qBAAqB,CAC7B,qHAAqH,CACtH,CAAC;aACH;YACD,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ,EAAE;gBACjC,MAAM,IAAI,qBAAqB,CAC7B,oEAAoE,IAAI,CAAC,QAAQ,aAAa,OAAO,CAAC,GAAG,GAAG,CAC7G,CAAC;aACH;SACF;QAED,sBAAsB;QACtB,IAAI,MAAM,EAAE;YACV,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,EAAE;gBAC/D,MAAM,IAAI,qBAAqB,CAC7B,oHAAoH,CACrH,CAAC;aACH;YAED,MAAM,cAAc,GAAG,OAAO,CAAC,SAAS,GAAG,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC;YACxE,IAAI,GAAG,GAAG,cAAc,EAAE;gBACxB,MAAM,IAAI,qBAAqB,CAC7B,wJAAwJ,GAAG,2BAA2B,cAAc,EAAE,CACvM,CAAC;aACH;SACF;QAED,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,MAAa,EAAE;YAC3C,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,WAAW,EAAE,MAAM;YACnB,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;SAC/B,CAAC,CAAC;IACL,CAAC;CACF;AA9KD,4CA8KC"}

package/dist/cjs/auth/index.js

@@ -0,0 +1,40 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthenticationClient = exports.AuthApiError = exports.IdTokenValidatorError = void 0;
+const telemetry_middleware_js_1 = require("../lib/middleware/telemetry-middleware.js");
+const database_js_1 = require("./database.js");
+const oauth_js_1 = require("./oauth.js");
+const passwordless_js_1 = require("./passwordless.js");
+__exportStar(require("./database.js"), exports);
+__exportStar(require("./oauth.js"), exports);
+__exportStar(require("./passwordless.js"), exports);
+var id_token_validator_js_1 = require("./id-token-validator.js");
+Object.defineProperty(exports, "IdTokenValidatorError", { enumerable: true, get: function () { return id_token_validator_js_1.IdTokenValidatorError; } });
+var base_auth_api_js_1 = require("./base-auth-api.js");
+Object.defineProperty(exports, "AuthApiError", { enumerable: true, get: function () { return base_auth_api_js_1.AuthApiError; } });
+class AuthenticationClient {
+    constructor(options) {
+        if (options.telemetry !== false) {
+            options.middleware = [...(options.middleware || []), new telemetry_middleware_js_1.TelemetryMiddleware(options)];
+        }
+        this.database = new database_js_1.Database(options);
+        this.oauth = new oauth_js_1.OAuth(options);
+        this.passwordless = new passwordless_js_1.Passwordless(options);
+    }
+}
+exports.AuthenticationClient = AuthenticationClient;
+//# sourceMappingURL=index.js.map

package/dist/cjs/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,uFAAgF;AAEhF,+CAAyC;AACzC,yCAAmC;AACnC,uDAAiD;AAEjD,gDAA8B;AAC9B,6CAA2B;AAC3B,oDAAkC;AAClC,iEAAwF;AAAvD,8HAAA,qBAAqB,OAAA;AACtD,uDAA+E;AAAtE,gHAAA,YAAY,OAAA;AAErB,MAAa,oBAAoB;IAK/B,YAAY,OAAoC;QAC9C,IAAI,OAAO,CAAC,SAAS,KAAK,KAAK,EAAE;YAC/B,OAAO,CAAC,UAAU,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,IAAI,6CAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;SACxF;QAED,IAAI,CAAC,QAAQ,GAAG,IAAI,sBAAQ,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,GAAG,IAAI,gBAAK,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,IAAI,8BAAY,CAAC,OAAO,CAAC,CAAC;IAChD,CAAC;CACF;AAdD,oDAcC"}