auth0 4.0.0-beta.0 → 4.0.0-beta.10

package/dist/esm/auth/base-auth-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-auth-api.js","sourceRoot":"","sources":["../../../src/auth/base-auth-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EACL,OAAO,EAGP,eAAe,GAEhB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAEL,uBAAuB,GACxB,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAiBhF,MAAM,OAAO,YAAa,SAAQ,KAAK;IAErC,YACS,KAAa,EACb,iBAAyB,EACzB,UAAkB,EAClB,IAAY,EACZ,OAAgB;QAEvB,KAAK,CAAC,iBAAiB,IAAI,KAAK,CAAC,CAAC;QAN3B,UAAK,GAAL,KAAK,CAAQ;QACb,sBAAiB,GAAjB,iBAAiB,CAAQ;QACzB,eAAU,GAAV,UAAU,CAAQ;QAClB,SAAI,GAAJ,IAAI,CAAQ;QACZ,YAAO,GAAP,OAAO,CAAS;QANhB,SAAI,GAAG,cAAuB,CAAC;IASxC,CAAC;CACF;AAED,SAAS,cAAc,CAAC,IAAS;IAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,IAA0B,CAAC;IAE/B,IAAI,OAAO,CAAC,KAAK,EAAE;QACjB,IAAI,GAAG,OAA+B,CAAC;KACxC;SAAM;QACL,IAAI,GAAG;YACL,KAAK,EAAE,OAAO,CAAC,IAAI;YACnB,iBAAiB,EAAE,OAAO,CAAC,WAAW;SACvC,CAAC;KACH;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,QAAkB;IAC1C,2CAA2C;IAC3C,IAAI;IACJ,4BAA4B;IAC5B,uCAAuC;IACvC,IAAI;IAEJ,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAEnC,IAAI;QACF,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QAElC,OAAO,IAAI,YAAY,CACrB,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,iBAAiB,EACtB,QAAQ,CAAC,MAAM,EACf,IAAI,EACJ,QAAQ,CAAC,OAAO,CACjB,CAAC;KACH;IAAC,OAAO,CAAC,EAAE;QACV,OAAO,IAAI,aAAa,CACtB,QAAQ,CAAC,MAAM,EACf,IAAI,EACJ,QAAQ,CAAC,OAAO,EAChB,iCAAiC,CAClC,CAAC;KACH;AACH,CAAC;AACD,MAAM,OAAO,WAAY,SAAQ,OAAO;IAOtC,YAAY,OAAoC;QAC9C,KAAK,CAAC;YACJ,GAAG,OAAO;YACV,OAAO,EAAE,WAAW,OAAO,CAAC,MAAM,EAAE;YACpC,UAAU,EAAE,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;YACjF,UAAU;YACV,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE;SAC5C,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QACzC,IAAI,CAAC,yBAAyB,GAAG,OAAO,CAAC,yBAAyB,CAAC;QACnE,IAAI,CAAC,yBAAyB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IACrE,CAAC;IAED;;OAEG;IACO,KAAK,CAAC,uBAAuB,CACrC,OAAuC;QAEvC,OAAO,uBAAuB,CAAC;YAC7B,OAAO;YACP,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;YACzD,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;SAC1D,CAAC,CAAC;IACL,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,SAAiB,EACjB,cAAmC,EACnC,EAAE,sBAAsB,EAAE,aAAa,KAAmB,EAAE,EAC5D,QAAgB,EAChB,gBAAkC,EAClC,OAGsB;IAEtB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B;QACE,IAAI,EAAE,cAAc;QACpB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;SACpD;QACD,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,SAAS,EAAE,QAAQ;YACnB,GAAG,cAAc;YACjB,UAAU,EAAE,SAAS;SACtB,CAAC;KACH,EACD,aAAa,CACd,CAAC;IAEF,MAAM,GAAG,GAA8B,MAAM,eAAe,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IACpF,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE;QACrB,MAAM,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC;KAC5E;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/esm/auth/client-authentication.d.ts

@@ -0,0 +1,26 @@
+export interface AddClientAuthenticationPayload {
+    client_id?: string;
+    client_secret?: string;
+    client_assertion?: string;
+    client_assertion_type?: string;
+    [key: string]: any;
+}
+interface AddClientAuthenticationOptions {
+    payload: AddClientAuthenticationPayload;
+    domain: string;
+    clientId: string;
+    required?: boolean;
+    clientAssertionSigningKey?: string;
+    clientAssertionSigningAlg?: string;
+    clientSecret?: string;
+}
+/**
+ * Adds client authentication, if available, to the provided payload.
+ *
+ * Adds `client_secret` for Client Secret Post token endpoint auth method (the SDK doesn't use Client Secret Basic)
+ * Adds `client_assertion` and `client_assertion_type` for Private Key JWT token endpoint auth method.
+ *
+ * If `clientAssertionSigningKey` is provided it takes precedent over `clientSecret` .
+ */
+export declare const addClientAuthentication: ({ payload, domain, clientId, clientAssertionSigningKey, clientAssertionSigningAlg, clientSecret, }: AddClientAuthenticationOptions) => Promise<Record<string, unknown>>;
+export {};

package/dist/esm/auth/client-authentication.js

@@ -0,0 +1,36 @@
+import * as jose from 'jose';
+import { v4 as uuid } from 'uuid';
+/**
+ * Adds client authentication, if available, to the provided payload.
+ *
+ * Adds `client_secret` for Client Secret Post token endpoint auth method (the SDK doesn't use Client Secret Basic)
+ * Adds `client_assertion` and `client_assertion_type` for Private Key JWT token endpoint auth method.
+ *
+ * If `clientAssertionSigningKey` is provided it takes precedent over `clientSecret` .
+ */
+export const addClientAuthentication = async ({ payload, domain, clientId, clientAssertionSigningKey, clientAssertionSigningAlg, clientSecret, }) => {
+    const cid = payload.client_id || clientId;
+    if (clientAssertionSigningKey && !payload.client_assertion) {
+        const alg = clientAssertionSigningAlg || 'RS256';
+        const privateKey = await jose.importPKCS8(clientAssertionSigningKey, alg);
+        payload.client_assertion = await new jose.SignJWT({})
+            .setProtectedHeader({ alg })
+            .setIssuedAt()
+            .setSubject(cid)
+            .setJti(uuid())
+            .setIssuer(cid)
+            .setAudience(`https://${domain}/`)
+            .setExpirationTime('2mins')
+            .sign(privateKey);
+        payload.client_assertion_type = 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer';
+    }
+    else if (clientSecret && !payload.client_secret) {
+        payload.client_secret = clientSecret;
+    }
+    if ((!payload.client_secret || payload.client_secret.trim().length === 0) &&
+        (!payload.client_assertion || payload.client_assertion.trim().length === 0)) {
+        throw new Error('The client_secret or client_assertion field is required.');
+    }
+    return payload;
+};
+//# sourceMappingURL=client-authentication.js.map

package/dist/esm/auth/client-authentication.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-authentication.js","sourceRoot":"","sources":["../../../src/auth/client-authentication.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,EAAE,IAAI,IAAI,EAAE,MAAM,MAAM,CAAC;AAoBlC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,EAAE,EAC5C,OAAO,EACP,MAAM,EACN,QAAQ,EACR,yBAAyB,EACzB,yBAAyB,EACzB,YAAY,GACmB,EAAoC,EAAE;IACrE,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC;IAC1C,IAAI,yBAAyB,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE;QAC1D,MAAM,GAAG,GAAG,yBAAyB,IAAI,OAAO,CAAC;QACjD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;QAE1E,OAAO,CAAC,gBAAgB,GAAG,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;aAClD,kBAAkB,CAAC,EAAE,GAAG,EAAE,CAAC;aAC3B,WAAW,EAAE;aACb,UAAU,CAAC,GAAG,CAAC;aACf,MAAM,CAAC,IAAI,EAAE,CAAC;aACd,SAAS,CAAC,GAAG,CAAC;aACd,WAAW,CAAC,WAAW,MAAM,GAAG,CAAC;aACjC,iBAAiB,CAAC,OAAO,CAAC;aAC1B,IAAI,CAAC,UAAU,CAAC,CAAC;QACpB,OAAO,CAAC,qBAAqB,GAAG,wDAAwD,CAAC;KAC1F;SAAM,IAAI,YAAY,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE;QACjD,OAAO,CAAC,aAAa,GAAG,YAAY,CAAC;KACtC;IACD,IACE,CAAC,CAAC,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC;QACrE,CAAC,CAAC,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,EAC3E;QACA,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;KAC7E;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC"}

package/dist/esm/auth/database.d.ts

@@ -0,0 +1,157 @@
+import { InitOverride, JSONApiResponse, TextApiResponse } from '../lib/models.js';
+import { BaseAuthAPI } from './base-auth-api.js';
+export interface SignUpRequest {
+    /**
+     * The client_id of your client.
+     * Use if you want to override the class's `clientId`
+     */
+    client_id?: string;
+    /**
+     * The user's email address.
+     */
+    email: string;
+    /**
+     * The user's desired password.
+     */
+    password: string;
+    /**
+     * The name of the database configured to your client.
+     */
+    connection: string;
+    /**
+     * The user's username. Only valid if the connection requires a username.
+     */
+    username?: string;
+    /**
+     * The user's given name(s).
+     */
+    given_name?: string;
+    /**
+     * The user's family name(s).
+     */
+    family_name?: string;
+    /**
+     * The user's full name.
+     */
+    name?: string;
+    /**
+     *The user's nickname.
+     */
+    nickname?: string;
+    /**
+     * A URI pointing to the user's picture.
+     */
+    picture?: string;
+    /**
+     * The user metadata to be associated with the user. If set, the field must be an object containing no more than ten properties. Property names can have a maximum of 100 characters, and property values must be strings of no more than 500 characters.
+     */
+    user_metadata?: {
+        [key: string]: unknown;
+    };
+}
+export interface SignUpResponse {
+    /**
+     * Email address of the new user.
+     */
+    email: string;
+    /**
+     * Indicates whether the email has been verified or not.
+     */
+    email_verified: boolean;
+    /**
+     * The server can return `_id`, `id` or `user_id` depending on various factors.
+     * For convenience we expose it here as just `id`.
+     */
+    id: string;
+    /**
+     * Username of this user.
+     */
+    username?: string;
+    /**
+     * The user's given name(s).
+     */
+    given_name?: string;
+    /**
+     * The user's family name(s).
+     */
+    family_name?: string;
+    /**
+     * The user's full name.
+     */
+    name?: string;
+    /**
+     *The user's nickname.
+     */
+    nickname?: string;
+    /**
+     * A URI pointing to the user's picture.
+     */
+    picture?: string;
+    /**
+     * The user metadata to be associated with the user. If set, the field must be an object containing no more than ten properties. Property names can have a maximum of 100 characters, and property values must be strings of no more than 500 characters.
+     */
+    user_metadata?: {
+        [key: string]: unknown;
+    };
+}
+export interface ChangePasswordRequest {
+    /**
+     * The client_id of your client.
+     * Use if you want to override the class's `clientId`
+     */
+    client_id?: string;
+    /**
+     * The user's email address.
+     */
+    email: string;
+    /**
+     * The name of the database configured to your client.
+     */
+    connection: string;
+    /**
+     * The organization_id of the Organization associated with the user.
+     */
+    organization?: string;
+}
+/**
+ * Sign-up and change-password for Database & Active Directory authentication services.
+ */
+export declare class Database extends BaseAuthAPI {
+    /**
+     * Given a user's credentials, and a connection, this endpoint will create a new user using active authentication.
+     *
+     * This endpoint only works for database connections.
+     *
+     * See: https://auth0.com/docs/api/authentication#signup
+     *
+     * @example
+     * ```js
+     * var data = {
+     *   email: '{EMAIL}',
+     *   password: '{PASSWORD}',
+     *   connection: 'Username-Password-Authentication'
+     * };
+     *
+     * await auth0.database.signUp(data);
+     * ```
+     */
+    signUp(bodyParameters: SignUpRequest, initOverrides?: InitOverride): Promise<JSONApiResponse<SignUpResponse>>;
+    /**
+     * Given a user's email address and a connection, Auth0 will send a change password email.
+     *
+     * This endpoint only works for database connections.
+     *
+     * See: https://auth0.com/docs/api/authentication#change-password
+     *
+     * @example
+     * ```js
+     * var data = {
+     *   email: '{EMAIL}',
+     *   connection: 'Username-Password-Authentication'
+     * };
+     *
+     * await auth0.database.changePassword(data);
+     * ```
+     */
+    changePassword(bodyParameters: ChangePasswordRequest, initOverrides?: InitOverride): Promise<TextApiResponse>;
+}

package/dist/esm/auth/database.js

@@ -0,0 +1,69 @@
+import { JSONApiResponse, TextApiResponse } from '../lib/models.js';
+import { validateRequiredRequestParams } from '../lib/runtime.js';
+import { BaseAuthAPI } from './base-auth-api.js';
+/**
+ * Sign-up and change-password for Database & Active Directory authentication services.
+ */
+export class Database extends BaseAuthAPI {
+    /**
+     * Given a user's credentials, and a connection, this endpoint will create a new user using active authentication.
+     *
+     * This endpoint only works for database connections.
+     *
+     * See: https://auth0.com/docs/api/authentication#signup
+     *
+     * @example
+     * ```js
+     * var data = {
+     *   email: '{EMAIL}',
+     *   password: '{PASSWORD}',
+     *   connection: 'Username-Password-Authentication'
+     * };
+     *
+     * await auth0.database.signUp(data);
+     * ```
+     */
+    async signUp(bodyParameters, initOverrides) {
+        // TODO: call this `validateRequiredParams` so we can use with bodyParameters in the auth api
+        validateRequiredRequestParams(bodyParameters, ['email', 'password', 'connection']);
+        const response = await this.request({
+            path: '/dbconnections/signup',
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+            },
+            body: { client_id: this.clientId, ...bodyParameters },
+        }, initOverrides);
+        return JSONApiResponse.fromResponse(response);
+    }
+    /**
+     * Given a user's email address and a connection, Auth0 will send a change password email.
+     *
+     * This endpoint only works for database connections.
+     *
+     * See: https://auth0.com/docs/api/authentication#change-password
+     *
+     * @example
+     * ```js
+     * var data = {
+     *   email: '{EMAIL}',
+     *   connection: 'Username-Password-Authentication'
+     * };
+     *
+     * await auth0.database.changePassword(data);
+     * ```
+     */
+    async changePassword(bodyParameters, initOverrides) {
+        validateRequiredRequestParams(bodyParameters, ['email', 'connection']);
+        const response = await this.request({
+            path: '/dbconnections/change_password',
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+            },
+            body: { client_id: this.clientId, ...bodyParameters },
+        }, initOverrides);
+        return TextApiResponse.fromResponse(response);
+    }
+}
+//# sourceMappingURL=database.js.map

package/dist/esm/auth/database.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database.js","sourceRoot":"","sources":["../../../src/auth/database.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,eAAe,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAkHjD;;GAEG;AACH,MAAM,OAAO,QAAS,SAAQ,WAAW;IACvC;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,MAAM,CACV,cAA6B,EAC7B,aAA4B;QAE5B,6FAA6F;QAC7F,6BAA6B,CAAC,cAAc,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;QAEnF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CACjC;YACE,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,cAAc,EAAE;SACtD,EACD,aAAa,CACd,CAAC;QAEF,OAAO,eAAe,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,cAAc,CAClB,cAAqC,EACrC,aAA4B;QAE5B,6BAA6B,CAAC,cAAc,EAAE,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CACjC;YACE,IAAI,EAAE,gCAAgC;YACtC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,cAAc,EAAE;SACtD,EACD,aAAa,CACd,CAAC;QAEF,OAAO,eAAe,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;CACF"}

package/dist/esm/auth/id-token-validator.d.ts

@@ -0,0 +1,18 @@
+import { AuthenticationClientOptions } from './base-auth-api.js';
+export declare class IdTokenValidatorError extends Error {
+}
+export interface IDTokenValidateOptions {
+    nonce?: string;
+    maxAge?: number;
+    organization?: string;
+}
+export declare class IDTokenValidator {
+    private jwks;
+    private alg;
+    private audience;
+    private issuer;
+    private clockTolerance;
+    private secret;
+    constructor({ domain, clientId, clientSecret, agent, headers, timeoutDuration, idTokenSigningAlg, clockTolerance, }: AuthenticationClientOptions);
+    validate(idToken: string, { nonce, maxAge, organization }?: IDTokenValidateOptions): Promise<void>;
+}

package/dist/esm/auth/id-token-validator.js

@@ -0,0 +1,117 @@
+import * as jose from 'jose';
+const DEFAULT_CLOCK_TOLERANCE = 60; // secs
+export class IdTokenValidatorError extends Error {
+}
+export class IDTokenValidator {
+    constructor({ domain, clientId, clientSecret, agent, headers, timeoutDuration, idTokenSigningAlg = 'RS256', clockTolerance = DEFAULT_CLOCK_TOLERANCE, }) {
+        this.jwks = jose.createRemoteJWKSet(new URL(`https://${domain}/.well-known/jwks.json`), {
+            timeoutDuration,
+            agent,
+            headers,
+        });
+        this.alg = idTokenSigningAlg;
+        this.audience = clientId;
+        this.secret = new TextEncoder().encode(clientSecret);
+        this.issuer = `https://${domain}/`;
+        this.clockTolerance = clockTolerance;
+    }
+    async validate(idToken, { nonce, maxAge, organization } = {}) {
+        const secret = this.alg === 'HS256' ? this.secret : this.jwks;
+        const header = jose.decodeProtectedHeader(idToken);
+        const payload = jose.decodeJwt(idToken);
+        // Check algorithm
+        if (header.alg !== 'RS256' && header.alg !== 'HS256') {
+            throw new Error(`Signature algorithm of "${header.alg}" is not supported. Expected the ID token to be signed with "RS256" or "HS256".`);
+        }
+        // Issuer
+        if (!payload.iss || typeof payload.iss !== 'string') {
+            throw new IdTokenValidatorError('Issuer (iss) claim must be a string present in the ID token');
+        }
+        if (payload.iss !== this.issuer) {
+            throw new IdTokenValidatorError(`Issuer (iss) claim mismatch in the ID token; expected "${this.issuer}", found "${payload.iss}"`);
+        }
+        // Subject
+        if (!payload.sub || typeof payload.sub !== 'string') {
+            throw new IdTokenValidatorError('Subject (sub) claim must be a string present in the ID token');
+        }
+        // Audience
+        if (!payload.aud || !(typeof payload.aud === 'string' || Array.isArray(payload.aud))) {
+            throw new IdTokenValidatorError('Audience (aud) claim must be a string or array of strings present in the ID token');
+        }
+        if (Array.isArray(payload.aud) && !payload.aud.includes(this.audience)) {
+            throw new IdTokenValidatorError(`Audience (aud) claim mismatch in the ID token; expected "${this.audience}" but was not one of "${payload.aud.join(', ')}"`);
+        }
+        else if (typeof payload.aud === 'string' && payload.aud !== this.audience) {
+            throw new IdTokenValidatorError(`Audience (aud) claim mismatch in the ID token; expected "${this.audience}" but found "${payload.aud}"`);
+        }
+        // Organization
+        if (organization) {
+            if (organization.indexOf('org_') === 0) {
+                if (!payload.org_id || typeof payload.org_id !== 'string') {
+                    throw new Error('Organization Id (org_id) claim must be a string present in the ID token');
+                }
+                if (payload.org_id !== organization) {
+                    throw new Error(`Organization Id (org_id) claim value mismatch in the ID token; expected "${organization}", found "${payload.org_id}"'`);
+                }
+            }
+            else {
+                if (!payload.org_name || typeof payload.org_name !== 'string') {
+                    throw new Error('Organization Name (org_name) claim must be a string present in the ID token');
+                }
+                if (payload.org_name !== organization.toLowerCase()) {
+                    throw new Error(`Organization Name (org_name) claim value mismatch in the ID token; expected "${organization}", found "${payload.org_name}"'`);
+                }
+            }
+        }
+        // Time validation (epoch)
+        const now = Math.floor(Date.now() / 1000);
+        // Expires at
+        if (!payload.exp || typeof payload.exp !== 'number') {
+            throw new IdTokenValidatorError('Expiration Time (exp) claim must be a number present in the ID token');
+        }
+        const expTime = payload.exp + this.clockTolerance;
+        if (now > expTime) {
+            throw new IdTokenValidatorError(`Expiration Time (exp) claim error in the ID token; current time (${now}) is after expiration time (${expTime})`);
+        }
+        // Issued at
+        if (!payload.iat || typeof payload.iat !== 'number') {
+            throw new IdTokenValidatorError('Issued At (iat) claim must be a number present in the ID token');
+        }
+        // Nonce
+        if (nonce || payload.nonce) {
+            if (!payload.nonce || typeof payload.nonce !== 'string') {
+                throw new IdTokenValidatorError('Nonce (nonce) claim must be a string present in the ID token');
+            }
+            if (payload.nonce !== nonce) {
+                throw new IdTokenValidatorError(`Nonce (nonce) claim mismatch in the ID token; expected "${nonce}", found "${payload.nonce}"`);
+            }
+        }
+        // Authorized party
+        if (Array.isArray(payload.aud) && payload.aud.length > 1) {
+            if (!payload.azp || typeof payload.azp !== 'string') {
+                throw new IdTokenValidatorError('Authorized Party (azp) claim must be a string present in the ID token when Audience (aud) claim has multiple values');
+            }
+            if (payload.azp !== this.audience) {
+                throw new IdTokenValidatorError(`Authorized Party (azp) claim mismatch in the ID token; expected "${this.audience}", found "${payload.azp}"`);
+            }
+        }
+        // Authentication time
+        if (maxAge) {
+            if (!payload.auth_time || typeof payload.auth_time !== 'number') {
+                throw new IdTokenValidatorError('Authentication Time (auth_time) claim must be a number present in the ID token when Max Age (max_age) is specified');
+            }
+            const authValidUntil = payload.auth_time + maxAge + this.clockTolerance;
+            if (now > authValidUntil) {
+                throw new IdTokenValidatorError(`Authentication Time (auth_time) claim in the ID token indicates that too much time has passed since the last end-user authentication. Currrent time (${now}) is after last auth at ${authValidUntil}`);
+            }
+        }
+        await jose.jwtVerify(idToken, secret, {
+            issuer: this.issuer,
+            audience: this.audience,
+            clockTolerance: this.clockTolerance,
+            maxTokenAge: maxAge,
+            algorithms: ['HS256', 'RS256'],
+        });
+    }
+}
+//# sourceMappingURL=id-token-validator.js.map

package/dist/esm/auth/id-token-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"id-token-validator.js","sourceRoot":"","sources":["../../../src/auth/id-token-validator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAG7B,MAAM,uBAAuB,GAAG,EAAE,CAAC,CAAC,OAAO;AAE3C,MAAM,OAAO,qBAAsB,SAAQ,KAAK;CAAG;AAQnD,MAAM,OAAO,gBAAgB;IAW3B,YAAY,EACV,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,KAAK,EACL,OAAO,EACP,eAAe,EACf,iBAAiB,GAAG,OAAO,EAC3B,cAAc,GAAG,uBAAuB,GACZ;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,WAAW,MAAM,wBAAwB,CAAC,EAAE;YACtF,eAAe;YACf,KAAK;YACL,OAAO;SACR,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,GAAG,iBAAiB,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,GAAG,WAAW,MAAM,GAAG,CAAC;QACnC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAe,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,KAA6B,EAAE;QAC1F,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAE9D,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAExC,kBAAkB;QAClB,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,EAAE;YACpD,MAAM,IAAI,KAAK,CACb,2BAA2B,MAAM,CAAC,GAAG,iFAAiF,CACvH,CAAC;SACH;QACD,SAAS;QACT,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE;YACnD,MAAM,IAAI,qBAAqB,CAC7B,6DAA6D,CAC9D,CAAC;SACH;QACD,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,MAAM,EAAE;YAC/B,MAAM,IAAI,qBAAqB,CAC7B,0DAA0D,IAAI,CAAC,MAAM,aAAa,OAAO,CAAC,GAAG,GAAG,CACjG,CAAC;SACH;QAED,UAAU;QACV,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE;YACnD,MAAM,IAAI,qBAAqB,CAC7B,8DAA8D,CAC/D,CAAC;SACH;QAED,WAAW;QACX,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE;YACpF,MAAM,IAAI,qBAAqB,CAC7B,mFAAmF,CACpF,CAAC;SACH;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;YACtE,MAAM,IAAI,qBAAqB,CAC7B,4DACE,IAAI,CAAC,QACP,yBAAyB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACnD,CAAC;SACH;aAAM,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ,EAAE;YAC3E,MAAM,IAAI,qBAAqB,CAC7B,4DAA4D,IAAI,CAAC,QAAQ,gBAAgB,OAAO,CAAC,GAAG,GAAG,CACxG,CAAC;SACH;QAED,eAAe;QACf,IAAI,YAAY,EAAE;YAChB,IAAI,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;gBACtC,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE;oBACzD,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;iBACH;gBAED,IAAI,OAAO,CAAC,MAAM,KAAK,YAAY,EAAE;oBACnC,MAAM,IAAI,KAAK,CACb,4EAA4E,YAAY,aAAa,OAAO,CAAC,MAAM,IAAI,CACxH,CAAC;iBACH;aACF;iBAAM;gBACL,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE;oBAC7D,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;iBACH;gBAED,IAAI,OAAO,CAAC,QAAQ,KAAK,YAAY,CAAC,WAAW,EAAE,EAAE;oBACnD,MAAM,IAAI,KAAK,CACb,gFAAgF,YAAY,aAAa,OAAO,CAAC,QAAQ,IAAI,CAC9H,CAAC;iBACH;aACF;SACF;QAED,0BAA0B;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAE1C,aAAa;QACb,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE;YACnD,MAAM,IAAI,qBAAqB,CAC7B,sEAAsE,CACvE,CAAC;SACH;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC;QAElD,IAAI,GAAG,GAAG,OAAO,EAAE;YACjB,MAAM,IAAI,qBAAqB,CAC7B,oEAAoE,GAAG,+BAA+B,OAAO,GAAG,CACjH,CAAC;SACH;QAED,YAAY;QACZ,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE;YACnD,MAAM,IAAI,qBAAqB,CAC7B,gEAAgE,CACjE,CAAC;SACH;QAED,QAAQ;QACR,IAAI,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE;YAC1B,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE;gBACvD,MAAM,IAAI,qBAAqB,CAC7B,8DAA8D,CAC/D,CAAC;aACH;YACD,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE;gBAC3B,MAAM,IAAI,qBAAqB,CAC7B,2DAA2D,KAAK,aAAa,OAAO,CAAC,KAAK,GAAG,CAC9F,CAAC;aACH;SACF;QAED,mBAAmB;QACnB,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE;YACxD,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE;gBACnD,MAAM,IAAI,qBAAqB,CAC7B,qHAAqH,CACtH,CAAC;aACH;YACD,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ,EAAE;gBACjC,MAAM,IAAI,qBAAqB,CAC7B,oEAAoE,IAAI,CAAC,QAAQ,aAAa,OAAO,CAAC,GAAG,GAAG,CAC7G,CAAC;aACH;SACF;QAED,sBAAsB;QACtB,IAAI,MAAM,EAAE;YACV,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,EAAE;gBAC/D,MAAM,IAAI,qBAAqB,CAC7B,oHAAoH,CACrH,CAAC;aACH;YAED,MAAM,cAAc,GAAG,OAAO,CAAC,SAAS,GAAG,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC;YACxE,IAAI,GAAG,GAAG,cAAc,EAAE;gBACxB,MAAM,IAAI,qBAAqB,CAC7B,wJAAwJ,GAAG,2BAA2B,cAAc,EAAE,CACvM,CAAC;aACH;SACF;QAED,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,MAAa,EAAE;YAC3C,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,WAAW,EAAE,MAAM;YACnB,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;SAC/B,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/esm/auth/index.d.ts

@@ -0,0 +1,15 @@
+import { AuthenticationClientOptions } from './base-auth-api.js';
+import { Database } from './database.js';
+import { OAuth } from './oauth.js';
+import { Passwordless } from './passwordless.js';
+export * from './database.js';
+export * from './oauth.js';
+export * from './passwordless.js';
+export { IDTokenValidateOptions, IdTokenValidatorError } from './id-token-validator.js';
+export { AuthApiError, AuthenticationClientOptions } from './base-auth-api.js';
+export declare class AuthenticationClient {
+    database: Database;
+    oauth: OAuth;
+    passwordless: Passwordless;
+    constructor(options: AuthenticationClientOptions);
+}

package/dist/esm/auth/index.js

@@ -0,0 +1,16 @@
+import { Database } from './database.js';
+import { OAuth } from './oauth.js';
+import { Passwordless } from './passwordless.js';
+export * from './database.js';
+export * from './oauth.js';
+export * from './passwordless.js';
+export { IdTokenValidatorError } from './id-token-validator.js';
+export { AuthApiError } from './base-auth-api.js';
+export class AuthenticationClient {
+    constructor(options) {
+        this.database = new Database(options);
+        this.oauth = new OAuth(options);
+        this.passwordless = new Passwordless(options);
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/esm/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAA0B,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AACxF,OAAO,EAAE,YAAY,EAA+B,MAAM,oBAAoB,CAAC;AAE/E,MAAM,OAAO,oBAAoB;IAK/B,YAAY,OAAoC;QAC9C,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,CAAC;IAChD,CAAC;CACF"}