auth0 4.0.0-beta.0 → 4.0.0-beta.10

package/dist/cjs/auth/id-token-validator.js

@@ -0,0 +1,145 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IDTokenValidator = exports.IdTokenValidatorError = void 0;
+const jose = __importStar(require("jose"));
+const DEFAULT_CLOCK_TOLERANCE = 60; // secs
+class IdTokenValidatorError extends Error {
+}
+exports.IdTokenValidatorError = IdTokenValidatorError;
+class IDTokenValidator {
+    constructor({ domain, clientId, clientSecret, agent, headers, timeoutDuration, idTokenSigningAlg = 'RS256', clockTolerance = DEFAULT_CLOCK_TOLERANCE, }) {
+        this.jwks = jose.createRemoteJWKSet(new URL(`https://${domain}/.well-known/jwks.json`), {
+            timeoutDuration,
+            agent,
+            headers,
+        });
+        this.alg = idTokenSigningAlg;
+        this.audience = clientId;
+        this.secret = new TextEncoder().encode(clientSecret);
+        this.issuer = `https://${domain}/`;
+        this.clockTolerance = clockTolerance;
+    }
+    async validate(idToken, { nonce, maxAge, organization } = {}) {
+        const secret = this.alg === 'HS256' ? this.secret : this.jwks;
+        const header = jose.decodeProtectedHeader(idToken);
+        const payload = jose.decodeJwt(idToken);
+        // Check algorithm
+        if (header.alg !== 'RS256' && header.alg !== 'HS256') {
+            throw new Error(`Signature algorithm of "${header.alg}" is not supported. Expected the ID token to be signed with "RS256" or "HS256".`);
+        }
+        // Issuer
+        if (!payload.iss || typeof payload.iss !== 'string') {
+            throw new IdTokenValidatorError('Issuer (iss) claim must be a string present in the ID token');
+        }
+        if (payload.iss !== this.issuer) {
+            throw new IdTokenValidatorError(`Issuer (iss) claim mismatch in the ID token; expected "${this.issuer}", found "${payload.iss}"`);
+        }
+        // Subject
+        if (!payload.sub || typeof payload.sub !== 'string') {
+            throw new IdTokenValidatorError('Subject (sub) claim must be a string present in the ID token');
+        }
+        // Audience
+        if (!payload.aud || !(typeof payload.aud === 'string' || Array.isArray(payload.aud))) {
+            throw new IdTokenValidatorError('Audience (aud) claim must be a string or array of strings present in the ID token');
+        }
+        if (Array.isArray(payload.aud) && !payload.aud.includes(this.audience)) {
+            throw new IdTokenValidatorError(`Audience (aud) claim mismatch in the ID token; expected "${this.audience}" but was not one of "${payload.aud.join(', ')}"`);
+        }
+        else if (typeof payload.aud === 'string' && payload.aud !== this.audience) {
+            throw new IdTokenValidatorError(`Audience (aud) claim mismatch in the ID token; expected "${this.audience}" but found "${payload.aud}"`);
+        }
+        // Organization
+        if (organization) {
+            if (organization.indexOf('org_') === 0) {
+                if (!payload.org_id || typeof payload.org_id !== 'string') {
+                    throw new Error('Organization Id (org_id) claim must be a string present in the ID token');
+                }
+                if (payload.org_id !== organization) {
+                    throw new Error(`Organization Id (org_id) claim value mismatch in the ID token; expected "${organization}", found "${payload.org_id}"'`);
+                }
+            }
+            else {
+                if (!payload.org_name || typeof payload.org_name !== 'string') {
+                    throw new Error('Organization Name (org_name) claim must be a string present in the ID token');
+                }
+                if (payload.org_name !== organization.toLowerCase()) {
+                    throw new Error(`Organization Name (org_name) claim value mismatch in the ID token; expected "${organization}", found "${payload.org_name}"'`);
+                }
+            }
+        }
+        // Time validation (epoch)
+        const now = Math.floor(Date.now() / 1000);
+        // Expires at
+        if (!payload.exp || typeof payload.exp !== 'number') {
+            throw new IdTokenValidatorError('Expiration Time (exp) claim must be a number present in the ID token');
+        }
+        const expTime = payload.exp + this.clockTolerance;
+        if (now > expTime) {
+            throw new IdTokenValidatorError(`Expiration Time (exp) claim error in the ID token; current time (${now}) is after expiration time (${expTime})`);
+        }
+        // Issued at
+        if (!payload.iat || typeof payload.iat !== 'number') {
+            throw new IdTokenValidatorError('Issued At (iat) claim must be a number present in the ID token');
+        }
+        // Nonce
+        if (nonce || payload.nonce) {
+            if (!payload.nonce || typeof payload.nonce !== 'string') {
+                throw new IdTokenValidatorError('Nonce (nonce) claim must be a string present in the ID token');
+            }
+            if (payload.nonce !== nonce) {
+                throw new IdTokenValidatorError(`Nonce (nonce) claim mismatch in the ID token; expected "${nonce}", found "${payload.nonce}"`);
+            }
+        }
+        // Authorized party
+        if (Array.isArray(payload.aud) && payload.aud.length > 1) {
+            if (!payload.azp || typeof payload.azp !== 'string') {
+                throw new IdTokenValidatorError('Authorized Party (azp) claim must be a string present in the ID token when Audience (aud) claim has multiple values');
+            }
+            if (payload.azp !== this.audience) {
+                throw new IdTokenValidatorError(`Authorized Party (azp) claim mismatch in the ID token; expected "${this.audience}", found "${payload.azp}"`);
+            }
+        }
+        // Authentication time
+        if (maxAge) {
+            if (!payload.auth_time || typeof payload.auth_time !== 'number') {
+                throw new IdTokenValidatorError('Authentication Time (auth_time) claim must be a number present in the ID token when Max Age (max_age) is specified');
+            }
+            const authValidUntil = payload.auth_time + maxAge + this.clockTolerance;
+            if (now > authValidUntil) {
+                throw new IdTokenValidatorError(`Authentication Time (auth_time) claim in the ID token indicates that too much time has passed since the last end-user authentication. Currrent time (${now}) is after last auth at ${authValidUntil}`);
+            }
+        }
+        await jose.jwtVerify(idToken, secret, {
+            issuer: this.issuer,
+            audience: this.audience,
+            clockTolerance: this.clockTolerance,
+            maxTokenAge: maxAge,
+            algorithms: ['HS256', 'RS256'],
+        });
+    }
+}
+exports.IDTokenValidator = IDTokenValidator;
+//# sourceMappingURL=id-token-validator.js.map

package/dist/cjs/auth/id-token-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"id-token-validator.js","sourceRoot":"","sources":["../../../src/auth/id-token-validator.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA6B;AAG7B,MAAM,uBAAuB,GAAG,EAAE,CAAC,CAAC,OAAO;AAE3C,MAAa,qBAAsB,SAAQ,KAAK;CAAG;AAAnD,sDAAmD;AAQnD,MAAa,gBAAgB;IAW3B,YAAY,EACV,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,KAAK,EACL,OAAO,EACP,eAAe,EACf,iBAAiB,GAAG,OAAO,EAC3B,cAAc,GAAG,uBAAuB,GACZ;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,WAAW,MAAM,wBAAwB,CAAC,EAAE;YACtF,eAAe;YACf,KAAK;YACL,OAAO;SACR,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,GAAG,iBAAiB,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,GAAG,WAAW,MAAM,GAAG,CAAC;QACnC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAe,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,KAA6B,EAAE;QAC1F,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAE9D,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAExC,kBAAkB;QAClB,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,EAAE;YACpD,MAAM,IAAI,KAAK,CACb,2BAA2B,MAAM,CAAC,GAAG,iFAAiF,CACvH,CAAC;SACH;QACD,SAAS;QACT,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE;YACnD,MAAM,IAAI,qBAAqB,CAC7B,6DAA6D,CAC9D,CAAC;SACH;QACD,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,MAAM,EAAE;YAC/B,MAAM,IAAI,qBAAqB,CAC7B,0DAA0D,IAAI,CAAC,MAAM,aAAa,OAAO,CAAC,GAAG,GAAG,CACjG,CAAC;SACH;QAED,UAAU;QACV,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE;YACnD,MAAM,IAAI,qBAAqB,CAC7B,8DAA8D,CAC/D,CAAC;SACH;QAED,WAAW;QACX,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE;YACpF,MAAM,IAAI,qBAAqB,CAC7B,mFAAmF,CACpF,CAAC;SACH;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;YACtE,MAAM,IAAI,qBAAqB,CAC7B,4DACE,IAAI,CAAC,QACP,yBAAyB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACnD,CAAC;SACH;aAAM,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ,EAAE;YAC3E,MAAM,IAAI,qBAAqB,CAC7B,4DAA4D,IAAI,CAAC,QAAQ,gBAAgB,OAAO,CAAC,GAAG,GAAG,CACxG,CAAC;SACH;QAED,eAAe;QACf,IAAI,YAAY,EAAE;YAChB,IAAI,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;gBACtC,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE;oBACzD,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;iBACH;gBAED,IAAI,OAAO,CAAC,MAAM,KAAK,YAAY,EAAE;oBACnC,MAAM,IAAI,KAAK,CACb,4EAA4E,YAAY,aAAa,OAAO,CAAC,MAAM,IAAI,CACxH,CAAC;iBACH;aACF;iBAAM;gBACL,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE;oBAC7D,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;iBACH;gBAED,IAAI,OAAO,CAAC,QAAQ,KAAK,YAAY,CAAC,WAAW,EAAE,EAAE;oBACnD,MAAM,IAAI,KAAK,CACb,gFAAgF,YAAY,aAAa,OAAO,CAAC,QAAQ,IAAI,CAC9H,CAAC;iBACH;aACF;SACF;QAED,0BAA0B;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAE1C,aAAa;QACb,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE;YACnD,MAAM,IAAI,qBAAqB,CAC7B,sEAAsE,CACvE,CAAC;SACH;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC;QAElD,IAAI,GAAG,GAAG,OAAO,EAAE;YACjB,MAAM,IAAI,qBAAqB,CAC7B,oEAAoE,GAAG,+BAA+B,OAAO,GAAG,CACjH,CAAC;SACH;QAED,YAAY;QACZ,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE;YACnD,MAAM,IAAI,qBAAqB,CAC7B,gEAAgE,CACjE,CAAC;SACH;QAED,QAAQ;QACR,IAAI,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE;YAC1B,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE;gBACvD,MAAM,IAAI,qBAAqB,CAC7B,8DAA8D,CAC/D,CAAC;aACH;YACD,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE;gBAC3B,MAAM,IAAI,qBAAqB,CAC7B,2DAA2D,KAAK,aAAa,OAAO,CAAC,KAAK,GAAG,CAC9F,CAAC;aACH;SACF;QAED,mBAAmB;QACnB,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE;YACxD,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE;gBACnD,MAAM,IAAI,qBAAqB,CAC7B,qHAAqH,CACtH,CAAC;aACH;YACD,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ,EAAE;gBACjC,MAAM,IAAI,qBAAqB,CAC7B,oEAAoE,IAAI,CAAC,QAAQ,aAAa,OAAO,CAAC,GAAG,GAAG,CAC7G,CAAC;aACH;SACF;QAED,sBAAsB;QACtB,IAAI,MAAM,EAAE;YACV,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,EAAE;gBAC/D,MAAM,IAAI,qBAAqB,CAC7B,oHAAoH,CACrH,CAAC;aACH;YAED,MAAM,cAAc,GAAG,OAAO,CAAC,SAAS,GAAG,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC;YACxE,IAAI,GAAG,GAAG,cAAc,EAAE;gBACxB,MAAM,IAAI,qBAAqB,CAC7B,wJAAwJ,GAAG,2BAA2B,cAAc,EAAE,CACvM,CAAC;aACH;SACF;QAED,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,MAAa,EAAE;YAC3C,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,WAAW,EAAE,MAAM;YACnB,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;SAC/B,CAAC,CAAC;IACL,CAAC;CACF;AA5LD,4CA4LC"}

package/dist/cjs/auth/index.d.ts

@@ -0,0 +1,15 @@
+import { AuthenticationClientOptions } from './base-auth-api.js';
+import { Database } from './database.js';
+import { OAuth } from './oauth.js';
+import { Passwordless } from './passwordless.js';
+export * from './database.js';
+export * from './oauth.js';
+export * from './passwordless.js';
+export { IDTokenValidateOptions, IdTokenValidatorError } from './id-token-validator.js';
+export { AuthApiError, AuthenticationClientOptions } from './base-auth-api.js';
+export declare class AuthenticationClient {
+    database: Database;
+    oauth: OAuth;
+    passwordless: Passwordless;
+    constructor(options: AuthenticationClientOptions);
+}

package/dist/cjs/auth/index.js

@@ -0,0 +1,36 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthenticationClient = exports.AuthApiError = exports.IdTokenValidatorError = void 0;
+const database_js_1 = require("./database.js");
+const oauth_js_1 = require("./oauth.js");
+const passwordless_js_1 = require("./passwordless.js");
+__exportStar(require("./database.js"), exports);
+__exportStar(require("./oauth.js"), exports);
+__exportStar(require("./passwordless.js"), exports);
+var id_token_validator_js_1 = require("./id-token-validator.js");
+Object.defineProperty(exports, "IdTokenValidatorError", { enumerable: true, get: function () { return id_token_validator_js_1.IdTokenValidatorError; } });
+var base_auth_api_js_1 = require("./base-auth-api.js");
+Object.defineProperty(exports, "AuthApiError", { enumerable: true, get: function () { return base_auth_api_js_1.AuthApiError; } });
+class AuthenticationClient {
+    constructor(options) {
+        this.database = new database_js_1.Database(options);
+        this.oauth = new oauth_js_1.OAuth(options);
+        this.passwordless = new passwordless_js_1.Passwordless(options);
+    }
+}
+exports.AuthenticationClient = AuthenticationClient;
+//# sourceMappingURL=index.js.map

package/dist/cjs/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AACA,+CAAyC;AACzC,yCAAmC;AACnC,uDAAiD;AAEjD,gDAA8B;AAC9B,6CAA2B;AAC3B,oDAAkC;AAClC,iEAAwF;AAAvD,8HAAA,qBAAqB,OAAA;AACtD,uDAA+E;AAAtE,gHAAA,YAAY,OAAA;AAErB,MAAa,oBAAoB;IAK/B,YAAY,OAAoC;QAC9C,IAAI,CAAC,QAAQ,GAAG,IAAI,sBAAQ,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,GAAG,IAAI,gBAAK,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,IAAI,8BAAY,CAAC,OAAO,CAAC,CAAC;IAChD,CAAC;CACF;AAVD,oDAUC"}

package/dist/cjs/auth/oauth.d.ts

@@ -0,0 +1,297 @@
+import { InitOverride, JSONApiResponse, VoidApiResponse } from '../lib/runtime.js';
+import { BaseAuthAPI, AuthenticationClientOptions } from './base-auth-api.js';
+import { IDTokenValidateOptions } from './id-token-validator.js';
+export interface TokenSet {
+    /**
+     * The access token.
+     */
+    access_token: string;
+    /**
+     * The refresh token, vavailable with the `offline_access` scope.
+     */
+    refresh_token?: string;
+    /**
+     * The user's ID Token.
+     */
+    id_token?: string;
+    /**
+     * The token type of the access token.
+     */
+    token_type: 'Bearer';
+    /**
+     * The duration in secs that that the access token is valid.
+     */
+    expires_in: number;
+}
+export interface GrantOptions {
+    idTokenValidateOptions?: Pick<IDTokenValidateOptions, 'organization'>;
+    initOverrides?: InitOverride;
+}
+export interface AuthorizationCodeGrantOptions {
+    idTokenValidateOptions?: IDTokenValidateOptions;
+    initOverrides?: InitOverride;
+}
+export interface ClientCredentials {
+    /**
+     * Specify this to override the parent class's `clientId`
+     */
+    client_id?: string;
+    /**
+     * Specify this to override the parent class's `clientSecret`
+     */
+    client_secret?: string;
+    /**
+     * Specify this to provide your own client assertion JWT rather than
+     * the class creating one for you from the `clientAssertionSigningKey`.
+     */
+    client_assertion?: string;
+    /**
+     * If you provide your own `client_assertion` you should also provide
+     * the `client_assertion_type`.
+     */
+    client_assertion_type?: 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer';
+}
+export interface AuthorizationCodeGrantRequest extends ClientCredentials {
+    /**
+     * The Authorization Code received from the initial `/authorize` call.
+     */
+    code: string;
+    /**
+     *	This is required only if it was set at the `/authorize` endpoint. The values must match.
+     */
+    redirect_uri?: string;
+    /**
+     * Allow for any custom property to be sent to Auth0
+     */
+    [key: string]: any;
+}
+export interface AuthorizationCodeGrantWithPKCERequest extends AuthorizationCodeGrantRequest {
+    /**
+     * Cryptographically random key that was used to generate the code_challenge passed to `/authorize`.
+     */
+    code_verifier: string;
+}
+export interface ClientCredentialsGrantRequest extends ClientCredentials {
+    /**
+     * The unique identifier of the target API you want to access.
+     */
+    audience: string;
+}
+export interface PasswordGrantRequest extends ClientCredentials {
+    /**
+     * The unique identifier of the target API you want to access.
+     */
+    audience?: string;
+    /**
+     * Resource Owner's identifier, such as a username or email address.
+     */
+    username: string;
+    /**
+     * Resource Owner's secret.
+     */
+    password: string;
+    /**
+     * String value of the different scopes the application is asking for. Multiple scopes are separated with whitespace.
+     */
+    scope?: string;
+    /**
+     * String value of the realm the user belongs. Set this if you want to add realm support at this grant.
+     * For more information on what realms are refer to https://auth0.com/docs/get-started/authentication-and-authorization-flow/resource-owner-password-flow#realm-support.
+     */
+    realm?: string;
+}
+export interface DeviceCodeGrantRequest {
+    /**
+     * Specify this to override the parent class's `clientId`
+     */
+    client_id?: string;
+    /**
+     * The device code previously returned from the `/oauth/device/code` endpoint.
+     */
+    device_code: string;
+}
+export interface RefreshTokenGrantRequest extends ClientCredentials {
+    /**
+     * The Refresh Token to use.
+     */
+    refresh_token: string;
+    /**
+     * A space-delimited list of requested scope permissions.
+     * If not sent, the original scopes will be used; otherwise you can request a reduced set of scopes.
+     */
+    scope?: string;
+    /**
+     * Allow for any custom property to be sent to Auth0
+     */
+    [key: string]: any;
+}
+export interface RevokeRefreshTokenRequest extends ClientCredentials {
+    /**
+     * The Refresh Token you want to revoke.
+     */
+    token: string;
+}
+export interface TokenExchangeGrantRequest {
+    /**
+     * Specify this to override the parent class's `clientId`
+     */
+    client_id?: string;
+    /**
+     * Externally-issued identity artifact, representing the user.
+     */
+    subject_token: string;
+    /**
+     * The unique identifier of the target API you want to access.
+     */
+    audience?: string;
+    /**
+     * String value of the different scopes the application is requesting.
+     * Multiple scopes are separated with whitespace.
+     */
+    scope?: string;
+    /**
+     * Optional element used for native iOS interactions for which profile updates can occur.
+     * Expected parameter value will be JSON in the form of: `{ name: { firstName: 'John', lastName: 'Smith }}`
+     */
+    user_profile: string;
+}
+/**
+ *  OAuth 2.0 flows.
+ */
+export declare class OAuth extends BaseAuthAPI {
+    private idTokenValidator;
+    constructor(options: AuthenticationClientOptions);
+    /**
+     * This is the flow that regular web apps use to access an API.
+     *
+     * Use this endpoint to exchange an Authorization Code for a Token.
+     *
+     * See: https://auth0.com/docs/api/authentication#authorization-code-flow44
+     *
+     * @example
+     * ```js
+     * const auth0 = new AuthenticationApi({
+     *    domain: 'my-domain.auth0.com',
+     *    clientId: 'myClientId',
+     *    clientSecret: 'myClientSecret'
+     * });
+     *
+     * await auth0.oauth.authorizationCodeGrant({ code: 'mycode' });
+     * ```
+     */
+    authorizationCodeGrant(bodyParameters: AuthorizationCodeGrantRequest, options?: AuthorizationCodeGrantOptions): Promise<JSONApiResponse<TokenSet>>;
+    /**
+     * PKCE was originally designed to protect the authorization code flow in mobile apps,
+     * but its ability to prevent authorization code injection makes it useful for every type of OAuth client,
+     * even web apps that use client authentication.
+     *
+     * See: https://auth0.com/docs/api/authentication#authorization-code-flow-with-pkce45
+     *
+     * @example
+     * ```js
+     * const auth0 = new AuthenticationApi({
+     *    domain: 'my-domain.auth0.com',
+     *    clientId: 'myClientId',
+     *    clientSecret: 'myClientSecret'
+     * });
+     *
+     * await auth0.oauth.authorizationCodeGrantWithPKCE({
+     *   code: 'mycode',
+     *   code_verifier: 'mycodeverifier'
+     * });
+     * ```
+     */
+    authorizationCodeGrantWithPKCE(bodyParameters: AuthorizationCodeGrantWithPKCERequest, options?: AuthorizationCodeGrantOptions): Promise<JSONApiResponse<TokenSet>>;
+    /**
+     * This is the OAuth 2.0 grant that server processes use to access an API.
+     *
+     * Use this endpoint to directly request an Access Token by using the Client's credentials
+     * (a Client ID and a Client Secret or a Client Assertion).
+     *
+     * See: https://auth0.com/docs/api/authentication#client-credentials-flow
+     *
+     * @example
+     * ```js
+     * const auth0 = new AuthenticationApi({
+     *    domain: 'my-domain.auth0.com',
+     *    clientId: 'myClientId',
+     *    clientSecret: 'myClientSecret'
+     * });
+     *
+     * await auth0.oauth.clientCredentialsGrant({ audience: 'myaudience' });
+     * ```
+     */
+    clientCredentialsGrant(bodyParameters: ClientCredentialsGrantRequest, options?: {
+        initOverrides?: InitOverride;
+    }): Promise<JSONApiResponse<TokenSet>>;
+    /**
+     * This information is typically received from a highly trusted public client like a SPA*.
+     * (<strong>*Note:</string> For single-page applications and native/mobile apps, we recommend using web flows instead.)
+     *
+     * See: https://auth0.com/docs/api/authentication#resource-owner-password
+     *
+     * @example
+     * ```js
+     * const auth0 = new AuthenticationApi({
+     *    domain: 'my-domain.auth0.com',
+     *    clientId: 'myClientId'
+     *    clientSecret: 'myClientSecret'
+     * });
+     *
+     * await auth0.oauth.passwordGrant({
+     *     username: 'myusername@example.com',
+     *     password: 'mypassword'
+     *   },
+     *   { initOverrides: { headers: { 'auth0-forwarded-for': 'END.USER.IP.123' } } }
+     * );
+     * ```
+     *
+     * Set the'auth0-forwarded-for' header to the end-user IP as a string value if you want
+     * brute-force protection to work in server-side scenarios.
+     *
+     * See https://auth0.com/docs/get-started/authentication-and-authorization-flow/avoid-common-issues-with-resource-owner-password-flow-and-attack-protection
+     *
+     */
+    passwordGrant(bodyParameters: PasswordGrantRequest, options?: GrantOptions): Promise<JSONApiResponse<TokenSet>>;
+    /**
+     * Use this endpoint to refresh an Access Token using the Refresh Token you got during authorization.
+     *
+     * See: https://auth0.com/docs/api/authentication#refresh-token
+     *
+     * @example
+     * ```js
+     * const auth0 = new AuthenticationApi({
+     *    domain: 'my-domain.auth0.com',
+     *    clientId: 'myClientId'
+     *    clientSecret: 'myClientSecret'
+     * });
+     *
+     * await auth0.oauth.refreshTokenGrant({ refresh_token: 'myrefreshtoken' })
+     * ```
+     */
+    refreshTokenGrant(bodyParameters: RefreshTokenGrantRequest, options?: GrantOptions): Promise<JSONApiResponse<TokenSet>>;
+    /**
+     * Use this endpoint to invalidate a Refresh Token if it has been compromised.
+     *
+     * The behaviour of this endpoint depends on the state of the <a href="https://auth0.com/docs/secure/tokens/refresh-tokens/revoke-refresh-tokens#refresh-tokens-and-grants">Refresh Token Revocation Deletes Grant</a> toggle.
+     * If this toggle is enabled, then each revocation request invalidates not only the specific token, but all other tokens based on the same authorization grant.
+     * This means that all Refresh Tokens that have been issued for the same user, application, and audience will be revoked.
+     * If this toggle is disabled, then only the refresh token is revoked, while the grant is left intact.
+     *
+     * See: https://auth0.com/docs/api/authentication#revoke-refresh-token
+     *
+     * @example
+     * ```js
+     * const auth0 = new AuthenticationApi({
+     *    domain: 'my-domain.auth0.com',
+     *    clientId: 'myClientId'
+     *    clientSecret: 'myClientSecret'
+     * });
+     *
+     * await auth0.oauth.revokeRefreshToken({ token: 'myrefreshtoken' })
+     * ```
+     */
+    revokeRefreshToken(bodyParameters: RevokeRefreshTokenRequest, options?: {
+        initOverrides?: InitOverride;
+    }): Promise<VoidApiResponse>;
+}