auth0 4.0.0-beta.6 → 4.0.0-beta.8

package/dist/esm/auth/database.d.ts

@@ -0,0 +1,157 @@
+import { InitOverride, JSONApiResponse, TextApiResponse } from '../lib/models.js';
+import { BaseAuthAPI } from './base-auth-api.js';
+export interface SignUpRequest {
+    /**
+     * The client_id of your client.
+     * Use if you want to override the class's `clientId`
+     */
+    client_id?: string;
+    /**
+     * The user's email address.
+     */
+    email: string;
+    /**
+     * The user's desired password.
+     */
+    password: string;
+    /**
+     * The name of the database configured to your client.
+     */
+    connection: string;
+    /**
+     * The user's username. Only valid if the connection requires a username.
+     */
+    username?: string;
+    /**
+     * The user's given name(s).
+     */
+    given_name?: string;
+    /**
+     * The user's family name(s).
+     */
+    family_name?: string;
+    /**
+     * The user's full name.
+     */
+    name?: string;
+    /**
+     *The user's nickname.
+     */
+    nickname?: string;
+    /**
+     * A URI pointing to the user's picture.
+     */
+    picture?: string;
+    /**
+     * The user metadata to be associated with the user. If set, the field must be an object containing no more than ten properties. Property names can have a maximum of 100 characters, and property values must be strings of no more than 500 characters.
+     */
+    user_metadata?: {
+        [key: string]: unknown;
+    };
+}
+export interface SignUpResponse {
+    /**
+     * Email address of the new user.
+     */
+    email: string;
+    /**
+     * Indicates whether the email has been verified or not.
+     */
+    email_verified: boolean;
+    /**
+     * The server can return `_id`, `id` or `user_id` depending on various factors.
+     * For convenience we expose it here as just `id`.
+     */
+    id: string;
+    /**
+     * Username of this user.
+     */
+    username?: string;
+    /**
+     * The user's given name(s).
+     */
+    given_name?: string;
+    /**
+     * The user's family name(s).
+     */
+    family_name?: string;
+    /**
+     * The user's full name.
+     */
+    name?: string;
+    /**
+     *The user's nickname.
+     */
+    nickname?: string;
+    /**
+     * A URI pointing to the user's picture.
+     */
+    picture?: string;
+    /**
+     * The user metadata to be associated with the user. If set, the field must be an object containing no more than ten properties. Property names can have a maximum of 100 characters, and property values must be strings of no more than 500 characters.
+     */
+    user_metadata?: {
+        [key: string]: unknown;
+    };
+}
+export interface ChangePasswordRequest {
+    /**
+     * The client_id of your client.
+     * Use if you want to override the class's `clientId`
+     */
+    client_id?: string;
+    /**
+     * The user's email address.
+     */
+    email: string;
+    /**
+     * The name of the database configured to your client.
+     */
+    connection: string;
+    /**
+     * The organization_id of the Organization associated with the user.
+     */
+    organization?: string;
+}
+/**
+ * Sign-up and change-password for Database & Active Directory authentication services.
+ */
+export declare class Database extends BaseAuthAPI {
+    /**
+     * Given a user's credentials, and a connection, this endpoint will create a new user using active authentication.
+     *
+     * This endpoint only works for database connections.
+     *
+     * See: https://auth0.com/docs/api/authentication#signup
+     *
+     * @example
+     * ```js
+     * var data = {
+     *   email: '{EMAIL}',
+     *   password: '{PASSWORD}',
+     *   connection: 'Username-Password-Authentication'
+     * };
+     *
+     * await auth0.database.signUp(data);
+     * ```
+     */
+    signUp(bodyParameters: SignUpRequest, initOverrides?: InitOverride): Promise<JSONApiResponse<SignUpResponse>>;
+    /**
+     * Given a user's email address and a connection, Auth0 will send a change password email.
+     *
+     * This endpoint only works for database connections.
+     *
+     * See: https://auth0.com/docs/api/authentication#change-password
+     *
+     * @example
+     * ```js
+     * var data = {
+     *   email: '{EMAIL}',
+     *   connection: 'Username-Password-Authentication'
+     * };
+     *
+     * await auth0.database.changePassword(data);
+     * ```
+     */
+    changePassword(bodyParameters: ChangePasswordRequest, initOverrides?: InitOverride): Promise<TextApiResponse>;
+}

package/dist/esm/auth/database.js.map

@@ -1 +1 @@
-{"version":3,"file":"database.js","sourceRoot":"","sources":["../../../src/auth/database.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,eAAe,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AA8GjD;;GAEG;AACH,MAAM,OAAO,QAAS,SAAQ,WAAW;IACvC;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,MAAM,CACV,cAA6B,EAC7B,aAA4B;QAE5B,6FAA6F;QAC7F,6BAA6B,CAAC,cAAc,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;QAEnF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CACjC;YACE,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,cAAc,EAAE;SACtD,EACD,aAAa,CACd,CAAC;QAEF,OAAO,eAAe,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,cAAc,CAClB,cAAqC,EACrC,aAA4B;QAE5B,6BAA6B,CAAC,cAAc,EAAE,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CACjC;YACE,IAAI,EAAE,gCAAgC;YACtC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,cAAc,EAAE;SACtD,EACD,aAAa,CACd,CAAC;QAEF,OAAO,eAAe,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;CACF"}
+{"version":3,"file":"database.js","sourceRoot":"","sources":["../../../src/auth/database.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,eAAe,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAkHjD;;GAEG;AACH,MAAM,OAAO,QAAS,SAAQ,WAAW;IACvC;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,MAAM,CACV,cAA6B,EAC7B,aAA4B;QAE5B,6FAA6F;QAC7F,6BAA6B,CAAC,cAAc,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;QAEnF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CACjC;YACE,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,cAAc,EAAE;SACtD,EACD,aAAa,CACd,CAAC;QAEF,OAAO,eAAe,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,cAAc,CAClB,cAAqC,EACrC,aAA4B;QAE5B,6BAA6B,CAAC,cAAc,EAAE,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CACjC;YACE,IAAI,EAAE,gCAAgC;YACtC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,cAAc,EAAE;SACtD,EACD,aAAa,CACd,CAAC;QAEF,OAAO,eAAe,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;CACF"}

package/dist/esm/auth/id-token-validator.d.ts

@@ -0,0 +1,18 @@
+import { AuthenticationClientOptions } from './base-auth-api.js';
+export declare class IdTokenValidatorError extends Error {
+}
+export interface IDTokenValidateOptions {
+    nonce?: string;
+    maxAge?: number;
+    organization?: string;
+}
+export declare class IDTokenValidator {
+    private jwks;
+    private alg;
+    private audience;
+    private issuer;
+    private clockTolerance;
+    private secret;
+    constructor({ domain, clientId, clientSecret, agent, headers, timeoutDuration, idTokenSigningAlg, clockTolerance, }: AuthenticationClientOptions);
+    validate(idToken: string, { nonce, maxAge, organization }?: IDTokenValidateOptions): Promise<void>;
+}

package/dist/esm/auth/index.d.ts

@@ -0,0 +1,15 @@
+import { AuthenticationClientOptions } from './base-auth-api.js';
+import { Database } from './database.js';
+import { OAuth } from './oauth.js';
+import { Passwordless } from './passwordless.js';
+export * from './database.js';
+export * from './oauth.js';
+export * from './passwordless.js';
+export { IDTokenValidateOptions, IdTokenValidatorError } from './id-token-validator.js';
+export { AuthApiError, AuthenticationClientOptions } from './base-auth-api.js';
+export declare class AuthenticationClient {
+    database: Database;
+    oauth: OAuth;
+    passwordless: Passwordless;
+    constructor(options: AuthenticationClientOptions);
+}

package/dist/esm/auth/oauth.d.ts

@@ -0,0 +1,297 @@
+import { InitOverride, JSONApiResponse, VoidApiResponse } from '../lib/runtime.js';
+import { BaseAuthAPI, AuthenticationClientOptions } from './base-auth-api.js';
+import { IDTokenValidateOptions } from './id-token-validator.js';
+export interface TokenSet {
+    /**
+     * The access token.
+     */
+    access_token: string;
+    /**
+     * The refresh token, vavailable with the `offline_access` scope.
+     */
+    refresh_token?: string;
+    /**
+     * The user's ID Token.
+     */
+    id_token?: string;
+    /**
+     * The token type of the access token.
+     */
+    token_type: 'Bearer';
+    /**
+     * The duration in secs that that the access token is valid.
+     */
+    expires_in: number;
+}
+export interface GrantOptions {
+    idTokenValidateOptions?: Pick<IDTokenValidateOptions, 'organization'>;
+    initOverrides?: InitOverride;
+}
+export interface AuthorizationCodeGrantOptions {
+    idTokenValidateOptions?: IDTokenValidateOptions;
+    initOverrides?: InitOverride;
+}
+export interface ClientCredentials {
+    /**
+     * Specify this to override the parent class's `clientId`
+     */
+    client_id?: string;
+    /**
+     * Specify this to override the parent class's `clientSecret`
+     */
+    client_secret?: string;
+    /**
+     * Specify this to provide your own client assertion JWT rather than
+     * the class creating one for you from the `clientAssertionSigningKey`.
+     */
+    client_assertion?: string;
+    /**
+     * If you provide your own `client_assertion` you should also provide
+     * the `client_assertion_type`.
+     */
+    client_assertion_type?: 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer';
+}
+export interface AuthorizationCodeGrantRequest extends ClientCredentials {
+    /**
+     * The Authorization Code received from the initial `/authorize` call.
+     */
+    code: string;
+    /**
+     *	This is required only if it was set at the `/authorize` endpoint. The values must match.
+     */
+    redirect_uri?: string;
+    /**
+     * Allow for any custom property to be sent to Auth0
+     */
+    [key: string]: any;
+}
+export interface AuthorizationCodeGrantWithPKCERequest extends AuthorizationCodeGrantRequest {
+    /**
+     * Cryptographically random key that was used to generate the code_challenge passed to `/authorize`.
+     */
+    code_verifier: string;
+}
+export interface ClientCredentialsGrantRequest extends ClientCredentials {
+    /**
+     * The unique identifier of the target API you want to access.
+     */
+    audience: string;
+}
+export interface PasswordGrantRequest extends ClientCredentials {
+    /**
+     * The unique identifier of the target API you want to access.
+     */
+    audience?: string;
+    /**
+     * Resource Owner's identifier, such as a username or email address.
+     */
+    username: string;
+    /**
+     * Resource Owner's secret.
+     */
+    password: string;
+    /**
+     * String value of the different scopes the application is asking for. Multiple scopes are separated with whitespace.
+     */
+    scope?: string;
+    /**
+     * String value of the realm the user belongs. Set this if you want to add realm support at this grant.
+     * For more information on what realms are refer to https://auth0.com/docs/get-started/authentication-and-authorization-flow/resource-owner-password-flow#realm-support.
+     */
+    realm?: string;
+}
+export interface DeviceCodeGrantRequest {
+    /**
+     * Specify this to override the parent class's `clientId`
+     */
+    client_id?: string;
+    /**
+     * The device code previously returned from the `/oauth/device/code` endpoint.
+     */
+    device_code: string;
+}
+export interface RefreshTokenGrantRequest extends ClientCredentials {
+    /**
+     * The Refresh Token to use.
+     */
+    refresh_token: string;
+    /**
+     * A space-delimited list of requested scope permissions.
+     * If not sent, the original scopes will be used; otherwise you can request a reduced set of scopes.
+     */
+    scope?: string;
+    /**
+     * Allow for any custom property to be sent to Auth0
+     */
+    [key: string]: any;
+}
+export interface RevokeRefreshTokenRequest extends ClientCredentials {
+    /**
+     * The Refresh Token you want to revoke.
+     */
+    token: string;
+}
+export interface TokenExchangeGrantRequest {
+    /**
+     * Specify this to override the parent class's `clientId`
+     */
+    client_id?: string;
+    /**
+     * Externally-issued identity artifact, representing the user.
+     */
+    subject_token: string;
+    /**
+     * The unique identifier of the target API you want to access.
+     */
+    audience?: string;
+    /**
+     * String value of the different scopes the application is requesting.
+     * Multiple scopes are separated with whitespace.
+     */
+    scope?: string;
+    /**
+     * Optional element used for native iOS interactions for which profile updates can occur.
+     * Expected parameter value will be JSON in the form of: `{ name: { firstName: 'John', lastName: 'Smith }}`
+     */
+    user_profile: string;
+}
+/**
+ *  OAuth 2.0 flows.
+ */
+export declare class OAuth extends BaseAuthAPI {
+    private idTokenValidator;
+    constructor(options: AuthenticationClientOptions);
+    /**
+     * This is the flow that regular web apps use to access an API.
+     *
+     * Use this endpoint to exchange an Authorization Code for a Token.
+     *
+     * See: https://auth0.com/docs/api/authentication#authorization-code-flow44
+     *
+     * @example
+     * ```js
+     * const auth0 = new AuthenticationApi({
+     *    domain: 'my-domain.auth0.com',
+     *    clientId: 'myClientId',
+     *    clientSecret: 'myClientSecret'
+     * });
+     *
+     * await auth0.oauth.authorizationCodeGrant({ code: 'mycode' });
+     * ```
+     */
+    authorizationCodeGrant(bodyParameters: AuthorizationCodeGrantRequest, options?: AuthorizationCodeGrantOptions): Promise<JSONApiResponse<TokenSet>>;
+    /**
+     * PKCE was originally designed to protect the authorization code flow in mobile apps,
+     * but its ability to prevent authorization code injection makes it useful for every type of OAuth client,
+     * even web apps that use client authentication.
+     *
+     * See: https://auth0.com/docs/api/authentication#authorization-code-flow-with-pkce45
+     *
+     * @example
+     * ```js
+     * const auth0 = new AuthenticationApi({
+     *    domain: 'my-domain.auth0.com',
+     *    clientId: 'myClientId',
+     *    clientSecret: 'myClientSecret'
+     * });
+     *
+     * await auth0.oauth.authorizationCodeGrantWithPKCE({
+     *   code: 'mycode',
+     *   code_verifier: 'mycodeverifier'
+     * });
+     * ```
+     */
+    authorizationCodeGrantWithPKCE(bodyParameters: AuthorizationCodeGrantWithPKCERequest, options?: AuthorizationCodeGrantOptions): Promise<JSONApiResponse<TokenSet>>;
+    /**
+     * This is the OAuth 2.0 grant that server processes use to access an API.
+     *
+     * Use this endpoint to directly request an Access Token by using the Client's credentials
+     * (a Client ID and a Client Secret or a Client Assertion).
+     *
+     * See: https://auth0.com/docs/api/authentication#client-credentials-flow
+     *
+     * @example
+     * ```js
+     * const auth0 = new AuthenticationApi({
+     *    domain: 'my-domain.auth0.com',
+     *    clientId: 'myClientId',
+     *    clientSecret: 'myClientSecret'
+     * });
+     *
+     * await auth0.oauth.clientCredentialsGrant({ audience: 'myaudience' });
+     * ```
+     */
+    clientCredentialsGrant(bodyParameters: ClientCredentialsGrantRequest, options?: {
+        initOverrides?: InitOverride;
+    }): Promise<JSONApiResponse<TokenSet>>;
+    /**
+     * This information is typically received from a highly trusted public client like a SPA*.
+     * (<strong>*Note:</string> For single-page applications and native/mobile apps, we recommend using web flows instead.)
+     *
+     * See: https://auth0.com/docs/api/authentication#resource-owner-password
+     *
+     * @example
+     * ```js
+     * const auth0 = new AuthenticationApi({
+     *    domain: 'my-domain.auth0.com',
+     *    clientId: 'myClientId'
+     *    clientSecret: 'myClientSecret'
+     * });
+     *
+     * await auth0.oauth.passwordGrant({
+     *     username: 'myusername@example.com',
+     *     password: 'mypassword'
+     *   },
+     *   { initOverrides: { headers: { 'auth0-forwarded-for': 'END.USER.IP.123' } } }
+     * );
+     * ```
+     *
+     * Set the'auth0-forwarded-for' header to the end-user IP as a string value if you want
+     * brute-force protection to work in server-side scenarios.
+     *
+     * See https://auth0.com/docs/get-started/authentication-and-authorization-flow/avoid-common-issues-with-resource-owner-password-flow-and-attack-protection
+     *
+     */
+    passwordGrant(bodyParameters: PasswordGrantRequest, options?: GrantOptions): Promise<JSONApiResponse<TokenSet>>;
+    /**
+     * Use this endpoint to refresh an Access Token using the Refresh Token you got during authorization.
+     *
+     * See: https://auth0.com/docs/api/authentication#refresh-token
+     *
+     * @example
+     * ```js
+     * const auth0 = new AuthenticationApi({
+     *    domain: 'my-domain.auth0.com',
+     *    clientId: 'myClientId'
+     *    clientSecret: 'myClientSecret'
+     * });
+     *
+     * await auth0.oauth.refreshTokenGrant({ refresh_token: 'myrefreshtoken' })
+     * ```
+     */
+    refreshTokenGrant(bodyParameters: RefreshTokenGrantRequest, options?: GrantOptions): Promise<JSONApiResponse<TokenSet>>;
+    /**
+     * Use this endpoint to invalidate a Refresh Token if it has been compromised.
+     *
+     * The behaviour of this endpoint depends on the state of the <a href="https://auth0.com/docs/secure/tokens/refresh-tokens/revoke-refresh-tokens#refresh-tokens-and-grants">Refresh Token Revocation Deletes Grant</a> toggle.
+     * If this toggle is enabled, then each revocation request invalidates not only the specific token, but all other tokens based on the same authorization grant.
+     * This means that all Refresh Tokens that have been issued for the same user, application, and audience will be revoked.
+     * If this toggle is disabled, then only the refresh token is revoked, while the grant is left intact.
+     *
+     * See: https://auth0.com/docs/api/authentication#revoke-refresh-token
+     *
+     * @example
+     * ```js
+     * const auth0 = new AuthenticationApi({
+     *    domain: 'my-domain.auth0.com',
+     *    clientId: 'myClientId'
+     *    clientSecret: 'myClientSecret'
+     * });
+     *
+     * await auth0.oauth.revokeRefreshToken({ token: 'myrefreshtoken' })
+     * ```
+     */
+    revokeRefreshToken(bodyParameters: RevokeRefreshTokenRequest, options?: {
+        initOverrides?: InitOverride;
+    }): Promise<VoidApiResponse>;
+}

package/dist/esm/auth/oauth.js

@@ -1,5 +1,5 @@
-import { JSONApiResponse, VoidApiResponse, validateRequiredRequestParams, } from '../lib/runtime.js';
-import { BaseAuthAPI } from './base-auth-api.js';
+import { VoidApiResponse, validateRequiredRequestParams, } from '../lib/runtime.js';
+import { BaseAuthAPI, grant } from './base-auth-api.js';
 import { IDTokenValidator } from './id-token-validator.js';
 /**
  *  OAuth 2.0 flows.
@@ -9,33 +9,6 @@ export class OAuth extends BaseAuthAPI {
         super(options);
         this.idTokenValidator = new IDTokenValidator(options);
     }
-    async validateIdToken(tokenSet, idTokenValidateOptions) {
-        const { id_token: idToken } = tokenSet;
-        if (idToken) {
-            await this.idTokenValidator.validate(idToken, idTokenValidateOptions);
-        }
-    }
-    /**
-     * Perform an OAuth 2.0 grant.
-     * (You should only need this if you can't find the grant you need in this library.)
-     */
-    async grant(grantType, bodyParameters, { idTokenValidateOptions, initOverrides } = {}) {
-        const response = await this.request({
-            path: '/oauth/token',
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/x-www-form-urlencoded',
-            },
-            body: new URLSearchParams({
-                client_id: this.clientId,
-                ...bodyParameters,
-                grant_type: grantType,
-            }),
-        }, initOverrides);
-        const res = await JSONApiResponse.fromResponse(response);
-        await this.validateIdToken(res.data, idTokenValidateOptions);
-        return res;
-    }
     /**
      * This is the flow that regular web apps use to access an API.
      *
@@ -56,7 +29,7 @@ export class OAuth extends BaseAuthAPI {
      */
     async authorizationCodeGrant(bodyParameters, options = {}) {
         validateRequiredRequestParams(bodyParameters, ['code']);
-        return this.grant('authorization_code', await this.addClientAuthentication(bodyParameters, true), options);
+        return grant('authorization_code', await this.addClientAuthentication(bodyParameters), options, this.clientId, this.idTokenValidator, this.request.bind(this));
     }
     /**
      * PKCE was originally designed to protect the authorization code flow in mobile apps,
@@ -81,7 +54,7 @@ export class OAuth extends BaseAuthAPI {
      */
     async authorizationCodeGrantWithPKCE(bodyParameters, options = {}) {
         validateRequiredRequestParams(bodyParameters, ['code', 'code_verifier']);
-        return this.grant('authorization_code', await this.addClientAuthentication(bodyParameters, false), options);
+        return grant('authorization_code', await this.addClientAuthentication(bodyParameters), options, this.clientId, this.idTokenValidator, this.request.bind(this));
     }
     /**
      * This is the OAuth 2.0 grant that server processes use to access an API.
@@ -104,7 +77,7 @@ export class OAuth extends BaseAuthAPI {
      */
     async clientCredentialsGrant(bodyParameters, options = {}) {
         validateRequiredRequestParams(bodyParameters, ['audience']);
-        return this.grant('client_credentials', await this.addClientAuthentication(bodyParameters, true), options);
+        return grant('client_credentials', await this.addClientAuthentication(bodyParameters), options, this.clientId, this.idTokenValidator, this.request.bind(this));
     }
     /**
      * This information is typically received from a highly trusted public client like a SPA*.
@@ -120,11 +93,11 @@ export class OAuth extends BaseAuthAPI {
      *    clientSecret: 'myClientSecret'
      * });
      *
-     * await auth0.oauth.clientCredentialsGrant({
+     * await auth0.oauth.passwordGrant({
      *     username: 'myusername@example.com',
      *     password: 'mypassword'
      *   },
-     *   { headers: { 'auth0-forwarded-for': 'END.USER.IP.123' } }
+     *   { initOverrides: { headers: { 'auth0-forwarded-for': 'END.USER.IP.123' } } }
      * );
      * ```
      *
@@ -136,7 +109,7 @@ export class OAuth extends BaseAuthAPI {
      */
     async passwordGrant(bodyParameters, options = {}) {
         validateRequiredRequestParams(bodyParameters, ['username', 'password']);
-        return this.grant(bodyParameters.realm ? 'http://auth0.com/oauth/grant-type/password-realm' : 'password', await this.addClientAuthentication(bodyParameters, false), options);
+        return grant(bodyParameters.realm ? 'http://auth0.com/oauth/grant-type/password-realm' : 'password', await this.addClientAuthentication(bodyParameters), options, this.clientId, this.idTokenValidator, this.request.bind(this));
     }
     /**
      * Use this endpoint to refresh an Access Token using the Refresh Token you got during authorization.
@@ -156,7 +129,7 @@ export class OAuth extends BaseAuthAPI {
      */
     async refreshTokenGrant(bodyParameters, options = {}) {
         validateRequiredRequestParams(bodyParameters, ['refresh_token']);
-        return this.grant('refresh_token', await this.addClientAuthentication(bodyParameters, false), options);
+        return grant('refresh_token', await this.addClientAuthentication(bodyParameters), options, this.clientId, this.idTokenValidator, this.request.bind(this));
     }
     /**
      * Use this endpoint to invalidate a Refresh Token if it has been compromised.
@@ -187,7 +160,7 @@ export class OAuth extends BaseAuthAPI {
             headers: {
                 'Content-Type': 'application/json',
             },
-            body: await this.addClientAuthentication({ client_id: this.clientId, ...bodyParameters }, false),
+            body: await this.addClientAuthentication({ client_id: this.clientId, ...bodyParameters }),
         }, options.initOverrides);
         return VoidApiResponse.fromResponse(response);
     }

package/dist/esm/auth/oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/auth/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,eAAe,EACf,eAAe,EACf,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,WAAW,EAA+B,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAA0B,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAgLnF;;GAEG;AACH,MAAM,OAAO,KAAM,SAAQ,WAAW;IAEpC,YAAY,OAAoC;QAC9C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,gBAAgB,GAAG,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACxD,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,QAAkB,EAClB,sBAA+C;QAE/C,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC;QACvC,IAAI,OAAO,EAAE;YACX,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;SACvE;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK,CACT,SAAiB,EACjB,cAAmC,EACnC,EAAE,sBAAsB,EAAE,aAAa,KAAmB,EAAE;QAE5D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CACjC;YACE,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;aACpD;YACD,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,SAAS,EAAE,IAAI,CAAC,QAAQ;gBACxB,GAAG,cAAc;gBACjB,UAAU,EAAE,SAAS;aACtB,CAAC;SACH,EACD,aAAa,CACd,CAAC;QAEF,MAAM,GAAG,GAA8B,MAAM,eAAe,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QACpF,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;QAC7D,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,sBAAsB,CAC1B,cAA6C,EAC7C,UAAyC,EAAE;QAE3C,6BAA6B,CAAC,cAAc,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAExD,OAAO,IAAI,CAAC,KAAK,CACf,oBAAoB,EACpB,MAAM,IAAI,CAAC,uBAAuB,CAAC,cAAc,EAAE,IAAI,CAAC,EACxD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,KAAK,CAAC,8BAA8B,CAClC,cAAqD,EACrD,UAAyC,EAAE;QAE3C,6BAA6B,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;QAEzE,OAAO,IAAI,CAAC,KAAK,CACf,oBAAoB,EACpB,MAAM,IAAI,CAAC,uBAAuB,CAAC,cAAc,EAAE,KAAK,CAAC,EACzD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,CAAC,sBAAsB,CAC1B,cAA6C,EAC7C,UAA4C,EAAE;QAE9C,6BAA6B,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAE5D,OAAO,IAAI,CAAC,KAAK,CACf,oBAAoB,EACpB,MAAM,IAAI,CAAC,uBAAuB,CAAC,cAAc,EAAE,IAAI,CAAC,EACxD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,KAAK,CAAC,aAAa,CACjB,cAAoC,EACpC,UAAwB,EAAE;QAE1B,6BAA6B,CAAC,cAAc,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;QAExE,OAAO,IAAI,CAAC,KAAK,CACf,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,kDAAkD,CAAC,CAAC,CAAC,UAAU,EACtF,MAAM,IAAI,CAAC,uBAAuB,CAAC,cAAc,EAAE,KAAK,CAAC,EACzD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,iBAAiB,CACrB,cAAwC,EACxC,UAAwB,EAAE;QAE1B,6BAA6B,CAAC,cAAc,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC;QAEjE,OAAO,IAAI,CAAC,KAAK,CACf,eAAe,EACf,MAAM,IAAI,CAAC,uBAAuB,CAAC,cAAc,EAAE,KAAK,CAAC,EACzD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,KAAK,CAAC,kBAAkB,CACtB,cAAyC,EACzC,UAA4C,EAAE;QAE9C,6BAA6B,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QAEzD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CACjC;YACE,IAAI,EAAE,eAAe;YACrB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,MAAM,IAAI,CAAC,uBAAuB,CACtC,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,cAAc,EAAE,EAC/C,KAAK,CACN;SACF,EACD,OAAO,CAAC,aAAa,CACtB,CAAC;QAEF,OAAO,eAAe,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;CACF"}
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/auth/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,eAAe,EACf,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,WAAW,EAA+B,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACrF,OAAO,EAA0B,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAgLnF;;GAEG;AACH,MAAM,OAAO,KAAM,SAAQ,WAAW;IAEpC,YAAY,OAAoC;QAC9C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,gBAAgB,GAAG,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACxD,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,sBAAsB,CAC1B,cAA6C,EAC7C,UAAyC,EAAE;QAE3C,6BAA6B,CAAC,cAAc,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAExD,OAAO,KAAK,CACV,oBAAoB,EACpB,MAAM,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAAC,EAClD,OAAO,EACP,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,gBAAgB,EACrB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CACxB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,KAAK,CAAC,8BAA8B,CAClC,cAAqD,EACrD,UAAyC,EAAE;QAE3C,6BAA6B,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;QAEzE,OAAO,KAAK,CACV,oBAAoB,EACpB,MAAM,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAAC,EAClD,OAAO,EACP,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,gBAAgB,EACrB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CACxB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,CAAC,sBAAsB,CAC1B,cAA6C,EAC7C,UAA4C,EAAE;QAE9C,6BAA6B,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAE5D,OAAO,KAAK,CACV,oBAAoB,EACpB,MAAM,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAAC,EAClD,OAAO,EACP,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,gBAAgB,EACrB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CACxB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,KAAK,CAAC,aAAa,CACjB,cAAoC,EACpC,UAAwB,EAAE;QAE1B,6BAA6B,CAAC,cAAc,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;QAExE,OAAO,KAAK,CACV,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,kDAAkD,CAAC,CAAC,CAAC,UAAU,EACtF,MAAM,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAAC,EAClD,OAAO,EACP,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,gBAAgB,EACrB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CACxB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,iBAAiB,CACrB,cAAwC,EACxC,UAAwB,EAAE;QAE1B,6BAA6B,CAAC,cAAc,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC;QAEjE,OAAO,KAAK,CACV,eAAe,EACf,MAAM,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAAC,EAClD,OAAO,EACP,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,gBAAgB,EACrB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CACxB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,KAAK,CAAC,kBAAkB,CACtB,cAAyC,EACzC,UAA4C,EAAE;QAE9C,6BAA6B,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QAEzD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CACjC;YACE,IAAI,EAAE,eAAe;YACrB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,MAAM,IAAI,CAAC,uBAAuB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,cAAc,EAAE,CAAC;SAC1F,EACD,OAAO,CAAC,aAAa,CACtB,CAAC;QAEF,OAAO,eAAe,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;CACF"}