auth0 5.1.0 → 5.2.0

package/dist/esm/management/core/fetcher/Fetcher.mjs

@@ -8,21 +8,153 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 import { toJson } from "../json.mjs";
+import { createLogger } from "../logging/logger.mjs";
 import { createRequestUrl } from "./createRequestUrl.mjs";
 import { EndpointSupplier } from "./EndpointSupplier.mjs";
 import { getErrorResponseBody } from "./getErrorResponseBody.mjs";
 import { getFetchFn } from "./getFetchFn.mjs";
 import { getRequestBody } from "./getRequestBody.mjs";
 import { getResponseBody } from "./getResponseBody.mjs";
+import { Headers } from "./Headers.mjs";
 import { makeRequest } from "./makeRequest.mjs";
 import { abortRawResponse, toRawResponse, unknownRawResponse } from "./RawResponse.mjs";
 import { requestWithRetries } from "./requestWithRetries.mjs";
+const SENSITIVE_HEADERS = new Set([
+    "authorization",
+    "www-authenticate",
+    "x-api-key",
+    "api-key",
+    "apikey",
+    "x-api-token",
+    "x-auth-token",
+    "auth-token",
+    "cookie",
+    "set-cookie",
+    "proxy-authorization",
+    "proxy-authenticate",
+    "x-csrf-token",
+    "x-xsrf-token",
+    "x-session-token",
+    "x-access-token",
+]);
+function redactHeaders(headers) {
+    const filtered = {};
+    for (const [key, value] of headers instanceof Headers ? headers.entries() : Object.entries(headers)) {
+        if (SENSITIVE_HEADERS.has(key.toLowerCase())) {
+            filtered[key] = "[REDACTED]";
+        }
+        else {
+            filtered[key] = value;
+        }
+    }
+    return filtered;
+}
+const SENSITIVE_QUERY_PARAMS = new Set([
+    "api_key",
+    "api-key",
+    "apikey",
+    "token",
+    "access_token",
+    "access-token",
+    "auth_token",
+    "auth-token",
+    "password",
+    "passwd",
+    "secret",
+    "api_secret",
+    "api-secret",
+    "apisecret",
+    "key",
+    "session",
+    "session_id",
+    "session-id",
+]);
+function redactQueryParameters(queryParameters) {
+    if (queryParameters == null) {
+        return queryParameters;
+    }
+    const redacted = {};
+    for (const [key, value] of Object.entries(queryParameters)) {
+        if (SENSITIVE_QUERY_PARAMS.has(key.toLowerCase())) {
+            redacted[key] = "[REDACTED]";
+        }
+        else {
+            redacted[key] = value;
+        }
+    }
+    return redacted;
+}
+function redactUrl(url) {
+    const protocolIndex = url.indexOf("://");
+    if (protocolIndex === -1)
+        return url;
+    const afterProtocol = protocolIndex + 3;
+    // Find the first delimiter that marks the end of the authority section
+    const pathStart = url.indexOf("/", afterProtocol);
+    let queryStart = url.indexOf("?", afterProtocol);
+    let fragmentStart = url.indexOf("#", afterProtocol);
+    const firstDelimiter = Math.min(pathStart === -1 ? url.length : pathStart, queryStart === -1 ? url.length : queryStart, fragmentStart === -1 ? url.length : fragmentStart);
+    // Find the LAST @ before the delimiter (handles multiple @ in credentials)
+    let atIndex = -1;
+    for (let i = afterProtocol; i < firstDelimiter; i++) {
+        if (url[i] === "@") {
+            atIndex = i;
+        }
+    }
+    if (atIndex !== -1) {
+        url = `${url.slice(0, afterProtocol)}[REDACTED]@${url.slice(atIndex + 1)}`;
+    }
+    // Recalculate queryStart since url might have changed
+    queryStart = url.indexOf("?");
+    if (queryStart === -1)
+        return url;
+    fragmentStart = url.indexOf("#", queryStart);
+    const queryEnd = fragmentStart !== -1 ? fragmentStart : url.length;
+    const queryString = url.slice(queryStart + 1, queryEnd);
+    if (queryString.length === 0)
+        return url;
+    // FAST PATH: Quick check if any sensitive keywords present
+    // Using indexOf is faster than regex for simple substring matching
+    const lower = queryString.toLowerCase();
+    const hasSensitive = lower.includes("token") ||
+        lower.includes("key") ||
+        lower.includes("password") ||
+        lower.includes("passwd") ||
+        lower.includes("secret") ||
+        lower.includes("session") ||
+        lower.includes("auth");
+    if (!hasSensitive) {
+        return url;
+    }
+    // SLOW PATH: Parse and redact
+    const redactedParams = [];
+    const params = queryString.split("&");
+    for (const param of params) {
+        const equalIndex = param.indexOf("=");
+        if (equalIndex === -1) {
+            redactedParams.push(param);
+            continue;
+        }
+        const key = param.slice(0, equalIndex);
+        let shouldRedact = SENSITIVE_QUERY_PARAMS.has(key.toLowerCase());
+        if (!shouldRedact && key.includes("%")) {
+            try {
+                const decodedKey = decodeURIComponent(key);
+                shouldRedact = SENSITIVE_QUERY_PARAMS.has(decodedKey.toLowerCase());
+            }
+            catch (_a) { }
+        }
+        redactedParams.push(shouldRedact ? `${key}=[REDACTED]` : param);
+    }
+    return url.slice(0, queryStart + 1) + redactedParams.join("&") + url.slice(queryEnd);
+}
 function getHeaders(args) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a;
-        const newHeaders = {};
+        const newHeaders = new Headers();
+        newHeaders.set("Accept", args.responseType === "json" ? "application/json" : args.responseType === "text" ? "text/plain" : "*/*");
         if (args.body !== undefined && args.contentType != null) {
-            newHeaders["Content-Type"] = args.contentType;
+            newHeaders.set("Content-Type", args.contentType);
         }
         if (args.headers == null) {
             return newHeaders;
@@ -30,39 +162,70 @@ function getHeaders(args) {
         for (const [key, value] of Object.entries(args.headers)) {
             const result = yield EndpointSupplier.get(value, { endpointMetadata: (_a = args.endpointMetadata) !== null && _a !== void 0 ? _a : {} });
             if (typeof result === "string") {
-                newHeaders[key] = result;
+                newHeaders.set(key, result);
                 continue;
             }
             if (result == null) {
                 continue;
             }
-            newHeaders[key] = `${result}`;
+            newHeaders.set(key, `${result}`);
         }
         return newHeaders;
     });
 }
 export function fetcherImpl(args) {
     return __awaiter(this, void 0, void 0, function* () {
-        var _a, _b;
+        var _a, _b, _c;
         const url = createRequestUrl(args.url, args.queryParameters);
         const requestBody = yield getRequestBody({
             body: args.body,
             type: (_a = args.requestType) !== null && _a !== void 0 ? _a : "other",
         });
         const fetchFn = (_b = args.fetchFn) !== null && _b !== void 0 ? _b : (yield getFetchFn());
+        const headers = yield getHeaders(args);
+        const logger = createLogger(args.logging);
+        if (logger.isDebug()) {
+            const metadata = {
+                method: args.method,
+                url: redactUrl(url),
+                headers: redactHeaders(headers),
+                queryParameters: redactQueryParameters(args.queryParameters),
+                hasBody: requestBody != null,
+            };
+            logger.debug("Making HTTP request", metadata);
+        }
         try {
             const response = yield requestWithRetries(() => __awaiter(this, void 0, void 0, function* () {
-                return makeRequest(fetchFn, url, args.method, yield getHeaders(args), requestBody, args.timeoutMs, args.abortSignal, args.withCredentials, args.duplex);
+                return makeRequest(fetchFn, url, args.method, headers, requestBody, args.timeoutMs, args.abortSignal, args.withCredentials, args.duplex);
             }), args.maxRetries);
             if (response.status >= 200 && response.status < 400) {
+                if (logger.isDebug()) {
+                    const metadata = {
+                        method: args.method,
+                        url: redactUrl(url),
+                        statusCode: response.status,
+                        responseHeaders: redactHeaders(response.headers),
+                    };
+                    logger.debug("HTTP request succeeded", metadata);
+                }
+                const body = yield getResponseBody(response, args.responseType);
                 return {
                     ok: true,
-                    body: (yield getResponseBody(response, args.responseType)),
+                    body: body,
                     headers: response.headers,
                     rawResponse: toRawResponse(response),
                 };
             }
             else {
+                if (logger.isError()) {
+                    const metadata = {
+                        method: args.method,
+                        url: redactUrl(url),
+                        statusCode: response.status,
+                        responseHeaders: redactHeaders(Object.fromEntries(response.headers.entries())),
+                    };
+                    logger.error("HTTP request failed with error status", metadata);
+                }
                 return {
                     ok: false,
                     error: {
@@ -75,7 +238,14 @@ export function fetcherImpl(args) {
             }
         }
         catch (error) {
-            if (args.abortSignal != null && args.abortSignal.aborted) {
+            if ((_c = args.abortSignal) === null || _c === void 0 ? void 0 : _c.aborted) {
+                if (logger.isError()) {
+                    const metadata = {
+                        method: args.method,
+                        url: redactUrl(url),
+                    };
+                    logger.error("HTTP request was aborted", metadata);
+                }
                 return {
                     ok: false,
                     error: {
@@ -86,6 +256,14 @@ export function fetcherImpl(args) {
                 };
             }
             else if (error instanceof Error && error.name === "AbortError") {
+                if (logger.isError()) {
+                    const metadata = {
+                        method: args.method,
+                        url: redactUrl(url),
+                        timeoutMs: args.timeoutMs,
+                    };
+                    logger.error("HTTP request timed out", metadata);
+                }
                 return {
                     ok: false,
                     error: {
@@ -95,6 +273,14 @@ export function fetcherImpl(args) {
                 };
             }
             else if (error instanceof Error) {
+                if (logger.isError()) {
+                    const metadata = {
+                        method: args.method,
+                        url: redactUrl(url),
+                        errorMessage: error.message,
+                    };
+                    logger.error("HTTP request failed with error", metadata);
+                }
                 return {
                     ok: false,
                     error: {
@@ -104,6 +290,14 @@ export function fetcherImpl(args) {
                     rawResponse: unknownRawResponse,
                 };
             }
+            if (logger.isError()) {
+                const metadata = {
+                    method: args.method,
+                    url: redactUrl(url),
+                    error: toJson(error),
+                };
+                logger.error("HTTP request failed with unknown error", metadata);
+            }
             return {
                 ok: false,
                 error: {

package/dist/esm/management/core/fetcher/getErrorResponseBody.mjs

@@ -25,9 +25,10 @@ export function getErrorResponseBody(response) {
             case "application/ld+json":
             case "application/problem+json":
             case "application/vnd.api+json":
-            case "text/json":
+            case "text/json": {
                 const text = yield response.text();
                 return text.length > 0 ? fromJson(text) : undefined;
+            }
             default:
                 if (contentType.startsWith("application/vnd.") && contentType.endsWith("+json")) {
                     const text = yield response.text();

package/dist/esm/management/core/fetcher/getResponseBody.mjs

@@ -7,14 +7,10 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
-import { getBinaryResponse } from "./BinaryResponse.mjs";
-import { isResponseWithBody } from "./ResponseWithBody.mjs";
 import { fromJson } from "../json.mjs";
+import { getBinaryResponse } from "./BinaryResponse.mjs";
 export function getResponseBody(response, responseType) {
     return __awaiter(this, void 0, void 0, function* () {
-        if (!isResponseWithBody(response)) {
-            return undefined;
-        }
         switch (responseType) {
             case "binary-response":
                 return getBinaryResponse(response);
@@ -23,8 +19,26 @@ export function getResponseBody(response, responseType) {
             case "arrayBuffer":
                 return yield response.arrayBuffer();
             case "sse":
+                if (response.body == null) {
+                    return {
+                        ok: false,
+                        error: {
+                            reason: "body-is-null",
+                            statusCode: response.status,
+                        },
+                    };
+                }
                 return response.body;
             case "streaming":
+                if (response.body == null) {
+                    return {
+                        ok: false,
+                        error: {
+                            reason: "body-is-null",
+                            statusCode: response.status,
+                        },
+                    };
+                }
                 return response.body;
             case "text":
                 return yield response.text();
@@ -33,10 +47,10 @@ export function getResponseBody(response, responseType) {
         const text = yield response.text();
         if (text.length > 0) {
             try {
-                let responseBody = fromJson(text);
+                const responseBody = fromJson(text);
                 return responseBody;
             }
-            catch (err) {
+            catch (_err) {
                 return {
                     ok: false,
                     error: {

package/dist/esm/management/core/fetcher/makeRequest.d.mts

@@ -1 +1 @@
-export declare const makeRequest: (fetchFn: (url: string, init: RequestInit) => Promise<Response>, url: string, method: string, headers: Record<string, string>, requestBody: BodyInit | undefined, timeoutMs?: number, abortSignal?: AbortSignal, withCredentials?: boolean, duplex?: "half") => Promise<Response>;
+export declare const makeRequest: (fetchFn: (url: string, init: RequestInit) => Promise<Response>, url: string, method: string, headers: Headers | Record<string, string>, requestBody: BodyInit | undefined, timeoutMs?: number, abortSignal?: AbortSignal, withCredentials?: boolean, duplex?: "half") => Promise<Response>;

package/dist/esm/management/core/fetcher/makeRequest.mjs

@@ -10,18 +10,16 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 import { anySignal, getTimeoutSignal } from "./signals.mjs";
 export const makeRequest = (fetchFn, url, method, headers, requestBody, timeoutMs, abortSignal, withCredentials, duplex) => __awaiter(void 0, void 0, void 0, function* () {
     const signals = [];
-    // Add timeout signal
-    let timeoutAbortId = undefined;
+    let timeoutAbortId;
     if (timeoutMs != null) {
         const { signal, abortId } = getTimeoutSignal(timeoutMs);
         timeoutAbortId = abortId;
         signals.push(signal);
     }
-    // Add arbitrary signal
     if (abortSignal != null) {
         signals.push(abortSignal);
     }
-    let newSignals = anySignal(signals);
+    const newSignals = anySignal(signals);
     const response = yield fetchFn(url, {
         method: method,
         headers,

package/dist/esm/management/core/fetcher/requestWithRetries.mjs

@@ -12,46 +12,38 @@ const MAX_RETRY_DELAY = 60000; // in milliseconds
 const DEFAULT_MAX_RETRIES = 2;
 const JITTER_FACTOR = 0.2; // 20% random jitter
 function addPositiveJitter(delay) {
-    // Generate a random value between 0 and +JITTER_FACTOR
     const jitterMultiplier = 1 + Math.random() * JITTER_FACTOR;
     return delay * jitterMultiplier;
 }
 function addSymmetricJitter(delay) {
-    // Generate a random value in a JITTER_FACTOR-sized percentage range around delay
     const jitterMultiplier = 1 + (Math.random() - 0.5) * JITTER_FACTOR;
     return delay * jitterMultiplier;
 }
 function getRetryDelayFromHeaders(response, retryAttempt) {
-    // Check for Retry-After header first (RFC 7231), with no jitter
     const retryAfter = response.headers.get("Retry-After");
     if (retryAfter) {
-        // Parse as number of seconds...
         const retryAfterSeconds = parseInt(retryAfter, 10);
-        if (!isNaN(retryAfterSeconds) && retryAfterSeconds > 0) {
+        if (!Number.isNaN(retryAfterSeconds) && retryAfterSeconds > 0) {
             return Math.min(retryAfterSeconds * 1000, MAX_RETRY_DELAY);
         }
-        // ...or as an HTTP date; both are valid
         const retryAfterDate = new Date(retryAfter);
-        if (!isNaN(retryAfterDate.getTime())) {
+        if (!Number.isNaN(retryAfterDate.getTime())) {
             const delay = retryAfterDate.getTime() - Date.now();
             if (delay > 0) {
                 return Math.min(Math.max(delay, 0), MAX_RETRY_DELAY);
             }
         }
     }
-    // Then check for industry-standard X-RateLimit-Reset header, with positive jitter
     const rateLimitReset = response.headers.get("X-RateLimit-Reset");
     if (rateLimitReset) {
         const resetTime = parseInt(rateLimitReset, 10);
-        if (!isNaN(resetTime)) {
-            // Assume Unix timestamp in epoch seconds
+        if (!Number.isNaN(resetTime)) {
             const delay = resetTime * 1000 - Date.now();
             if (delay > 0) {
                 return addPositiveJitter(Math.min(delay, MAX_RETRY_DELAY));
             }
         }
     }
-    // Fall back to exponential backoff, with symmetric jitter
     return addSymmetricJitter(Math.min(INITIAL_RETRY_DELAY * Math.pow(2, retryAttempt), MAX_RETRY_DELAY));
 }
 export function requestWithRetries(requestFn_1) {
@@ -59,7 +51,6 @@ export function requestWithRetries(requestFn_1) {
         let response = yield requestFn();
         for (let i = 0; i < maxRetries; ++i) {
             if ([408, 429].includes(response.status) || response.status >= 500) {
-                // Get delay with appropriate jitter applied
                 const delay = getRetryDelayFromHeaders(response, i);
                 yield new Promise((resolve) => setTimeout(resolve, delay));
                 response = yield requestFn();

package/dist/esm/management/core/fetcher/signals.d.mts

@@ -1,11 +1,5 @@
 export declare function getTimeoutSignal(timeoutMs: number): {
     signal: AbortSignal;
-    abortId: NodeJS.Timeout;
+    abortId: ReturnType<typeof setTimeout>;
 };
-/**
- * Returns an abort signal that is getting aborted when
- * at least one of the specified abort signals is aborted.
- *
- * Requires at least node.js 18.
- */
 export declare function anySignal(...args: AbortSignal[] | [AbortSignal[]]): AbortSignal;

package/dist/esm/management/core/fetcher/signals.mjs

@@ -4,26 +4,14 @@ export function getTimeoutSignal(timeoutMs) {
     const abortId = setTimeout(() => controller.abort(TIMEOUT), timeoutMs);
     return { signal: controller.signal, abortId };
 }
-/**
- * Returns an abort signal that is getting aborted when
- * at least one of the specified abort signals is aborted.
- *
- * Requires at least node.js 18.
- */
 export function anySignal(...args) {
-    // Allowing signals to be passed either as array
-    // of signals or as multiple arguments.
     const signals = (args.length === 1 && Array.isArray(args[0]) ? args[0] : args);
     const controller = new AbortController();
     for (const signal of signals) {
         if (signal.aborted) {
-            // Exiting early if one of the signals
-            // is already aborted.
             controller.abort(signal === null || signal === void 0 ? void 0 : signal.reason);
             break;
         }
-        // Listening for signals and removing the listeners
-        // when at least one symbol is aborted.
         signal.addEventListener("abort", () => controller.abort(signal === null || signal === void 0 ? void 0 : signal.reason), {
             signal: controller.signal,
         });

package/dist/esm/management/core/file/file.mjs

@@ -97,7 +97,7 @@ function tryGetFileSizeFromPath(path) {
             const fileStat = yield fs.promises.stat(path);
             return fileStat.size;
         }
-        catch (fallbackError) {
+        catch (_fallbackError) {
             return undefined;
         }
     });

package/dist/esm/management/core/form-data-utils/FormDataWrapper.mjs

@@ -14,9 +14,9 @@ var __asyncValues = (this && this.__asyncValues) || function (o) {
     function verb(n) { i[n] = o[n] && function (v) { return new Promise(function (resolve, reject) { v = o[n](v), settle(resolve, reject, v.done, v.value); }); }; }
     function settle(resolve, reject, d, v) { Promise.resolve(v).then(function(v) { resolve({ value: v, done: d }); }, reject); }
 };
+import { toMultipartDataPart } from "../../core/file/index.mjs";
 import { toJson } from "../../core/json.mjs";
 import { RUNTIME } from "../runtime/index.mjs";
-import { toMultipartDataPart } from "../../core/file/index.mjs";
 export function newFormData() {
     return __awaiter(this, void 0, void 0, function* () {
         return new FormDataWrapper();

package/dist/esm/management/core/index.d.mts

@@ -1,9 +1,10 @@
+export * from "./auth/index.mjs";
+export * from "./base64.mjs";
 export * from "./fetcher/index.mjs";
+export * as file from "./file/index.mjs";
+export * from "./form-data-utils/index.mjs";
+export * as logging from "./logging/index.mjs";
+export * from "./pagination/index.mjs";
 export * from "./runtime/index.mjs";
 export * as url from "./url/index.mjs";
-export * from "./auth/index.mjs";
-export * from "./base64.mjs";
 export * from "./utils/index.mjs";
-export * from "./pagination/index.mjs";
-export * from "./form-data-utils/index.mjs";
-export * as file from "./file/index.mjs";

package/dist/esm/management/core/index.mjs

@@ -1,9 +1,10 @@
+export * from "./auth/index.mjs";
+export * from "./base64.mjs";
 export * from "./fetcher/index.mjs";
+export * as file from "./file/index.mjs";
+export * from "./form-data-utils/index.mjs";
+export * as logging from "./logging/index.mjs";
+export * from "./pagination/index.mjs";
 export * from "./runtime/index.mjs";
 export * as url from "./url/index.mjs";
-export * from "./auth/index.mjs";
-export * from "./base64.mjs";
 export * from "./utils/index.mjs";
-export * from "./pagination/index.mjs";
-export * from "./form-data-utils/index.mjs";
-export * as file from "./file/index.mjs";

package/dist/esm/management/core/logging/exports.d.mts

@@ -0,0 +1,18 @@
+import * as logger from "./logger.mjs";
+export declare namespace logging {
+    /**
+     * Configuration for logger instances.
+     */
+    type LogConfig = logger.LogConfig;
+    type LogLevel = logger.LogLevel;
+    const LogLevel: typeof logger.LogLevel;
+    type ILogger = logger.ILogger;
+    /**
+     * Console logger implementation that outputs to the console.
+     */
+    type ConsoleLogger = logger.ConsoleLogger;
+    /**
+     * Console logger implementation that outputs to the console.
+     */
+    const ConsoleLogger: typeof logger.ConsoleLogger;
+}

package/dist/esm/management/core/logging/exports.mjs

@@ -0,0 +1,9 @@
+import * as logger from "./logger.mjs";
+export var logging;
+(function (logging) {
+    logging.LogLevel = logger.LogLevel;
+    /**
+     * Console logger implementation that outputs to the console.
+     */
+    logging.ConsoleLogger = logger.ConsoleLogger;
+})(logging || (logging = {}));

package/dist/esm/management/core/logging/index.d.mts

@@ -0,0 +1 @@
+export * from "./logger.mjs";

package/dist/esm/management/core/logging/index.mjs

@@ -0,0 +1 @@
+export * from "./logger.mjs";