auth0 6.0.0 → 6.2.0

package/dist/cjs/management/wrapper/auth-helpers.js

@@ -0,0 +1,84 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildManagementBaseUrl = buildManagementBaseUrl;
+exports.isClientOptionsWithToken = isClientOptionsWithToken;
+exports.createTokenSupplier = createTokenSupplier;
+exports.createTelemetryHeaders = createTelemetryHeaders;
+const token_provider_js_1 = require("./token-provider.js");
+const auth0_client_telemetry_js_1 = require("../../lib/middleware/auth0-client-telemetry.js");
+/**
+ * Builds the Management API v2 base URL for a tenant domain.
+ *
+ * @group Management API
+ * @internal
+ */
+function buildManagementBaseUrl(domain) {
+    return `https://${domain}/api/v2`;
+}
+/**
+ * Type guard that determines if options use static token authentication.
+ *
+ * @group Management API
+ * @internal
+ */
+function isClientOptionsWithToken(options) {
+    return "token" in options;
+}
+/**
+ * Type guard that narrows client credentials to the client-secret variant.
+ *
+ * @group Management API
+ * @internal
+ */
+function hasClientSecret(options) {
+    return "clientSecret" in options;
+}
+/**
+ * Creates a token supplier from the provided options.
+ *
+ * Returns the supplied token as-is for token-based auth, or a self-refreshing
+ * {@link TokenProvider}-backed supplier for client credentials (secret or assertion).
+ *
+ * @group Management API
+ * @internal
+ */
+function createTokenSupplier(options) {
+    var _a;
+    if (isClientOptionsWithToken(options)) {
+        return options.token;
+    }
+    const audience = (_a = options.audience) !== null && _a !== void 0 ? _a : `${buildManagementBaseUrl(options.domain)}/`;
+    // The named type guard narrows the union so each branch matches one of TokenProvider's
+    // overloaded constructors (client secret vs client assertion). Both branches forward the
+    // full options object, which is what selects the signing method downstream.
+    if (hasClientSecret(options)) {
+        const tokenProviderOptions = Object.assign(Object.assign({}, options), { audience });
+        const tokenProvider = new token_provider_js_1.TokenProvider(tokenProviderOptions);
+        return () => tokenProvider.getAccessToken();
+    }
+    else {
+        const tokenProviderOptions = Object.assign(Object.assign({}, options), { audience });
+        const tokenProvider = new token_provider_js_1.TokenProvider(tokenProviderOptions);
+        return () => tokenProvider.getAccessToken();
+    }
+}
+/**
+ * Builds the request headers for the Management client, including the `Auth0-Client` telemetry
+ * header when telemetry is enabled. Respects `telemetry: false` and custom `clientInfo`, and
+ * preserves any user-supplied headers.
+ *
+ * @group Management API
+ * @internal
+ */
+function createTelemetryHeaders(options) {
+    var _a;
+    const headers = Object.assign({}, ((_a = options.headers) !== null && _a !== void 0 ? _a : {}));
+    if (options.telemetry !== false) {
+        const telemetry = new auth0_client_telemetry_js_1.Auth0ClientTelemetry({ clientInfo: options.clientInfo });
+        const auth0ClientHeader = telemetry.getAuth0ClientHeader();
+        if (auth0ClientHeader) {
+            headers["Auth0-Client"] = auth0ClientHeader;
+        }
+    }
+    return headers;
+}

package/dist/cjs/management/wrapper/management-auth.d.ts

@@ -0,0 +1,109 @@
+import * as core from "../core/index.js";
+import type { ManagementClient } from "./ManagementClient.js";
+import { type ManagementHeaders } from "./auth-helpers.js";
+/**
+ * Options for {@link createManagementAuth}.
+ *
+ * Provide either a static `token`, or client credentials (`clientId` plus either
+ * `clientSecret` or `clientAssertionSigningKey`) to have a token fetched and refreshed
+ * automatically.
+ *
+ * @group Management API
+ * @public
+ */
+export type ManagementAuthOptions = ManagementClient.ManagementClientOptionsWithToken | ManagementClient.ManagementClientOptionsWithClientCredentials;
+/**
+ * Ready-to-spread options for any Management sub-client constructor.
+ *
+ * These mirror the options that the full {@link ManagementClient} passes to its sub-clients,
+ * so individually imported clients share the same base URL, self-refreshing token, telemetry
+ * headers, and request behaviour.
+ *
+ * @group Management API
+ * @public
+ */
+export interface ManagementAuthClientOptions {
+    /** The Management API v2 base URL for the tenant. */
+    baseUrl: string;
+    /** A supplier that returns a valid access token, fetching or refreshing it when needed. */
+    token: core.Supplier<string>;
+    /** Headers to send with every request, including the `Auth0-Client` telemetry header when enabled. */
+    headers?: ManagementHeaders;
+    /** The default maximum time to wait for a response in seconds. */
+    timeoutInSeconds?: number;
+    /** The default number of times to retry a request. */
+    maxRetries?: number;
+    /** Logging configuration for the client. */
+    logging?: core.logging.LogConfig | core.logging.Logger;
+    /** Custom fetcher, set automatically when a custom domain header is configured. */
+    fetcher?: (args: any) => Promise<any>;
+}
+/**
+ * A reusable authentication context for the Management API.
+ *
+ * Spread {@link ManagementAuth.clientOptions} into any Management sub-client constructor so
+ * every client shares the same base URL and self-refreshing token.
+ *
+ * @group Management API
+ * @public
+ */
+export interface ManagementAuth {
+    /** The Management API v2 base URL for the tenant, e.g. `https://tenant.auth0.com/api/v2`. */
+    baseUrl: string;
+    /** Returns a valid access token, fetching or refreshing it when needed. */
+    getToken: () => Promise<string>;
+    /** Ready-to-spread options for any Management sub-client constructor. */
+    clientOptions: ManagementAuthClientOptions;
+}
+/**
+ * Creates a shared authentication context for the Auth0 Management API without pulling in the
+ * full {@link ManagementClient}. This is useful for size-constrained runtimes (for example
+ * Cloudflare Workers) where you import individual sub-clients such as `auth0/clients` and
+ * `auth0/users` and want to handle auth once.
+ *
+ * When client credentials are provided, tokens are obtained via the client credentials grant
+ * and cached until shortly before they expire. When a static `token` is provided, it is used
+ * as-is.
+ *
+ * The returned {@link ManagementAuth.clientOptions} carry the same telemetry headers, request
+ * timeouts, retry counts, logging, and custom domain behaviour that the full `ManagementClient`
+ * applies, so individually imported sub-clients behave consistently.
+ *
+ * @group Management API
+ * @public
+ *
+ * @example Client credentials with individual sub-clients
+ * ```ts
+ * import { createManagementAuth } from "auth0/management";
+ * import { ClientsClient } from "auth0/clients";
+ * import { UsersClient } from "auth0/users";
+ *
+ * const auth = createManagementAuth({
+ *     domain: "your-tenant.auth0.com",
+ *     clientId: "your-client-id",
+ *     clientSecret: "your-client-secret",
+ * });
+ *
+ * const clients = new ClientsClient(auth.clientOptions);
+ * const users = new UsersClient(auth.clientOptions);
+ * ```
+ *
+ * @example Static token
+ * ```ts
+ * const auth = createManagementAuth({
+ *     domain: "your-tenant.auth0.com",
+ *     token: "your-api-v2-token",
+ * });
+ * ```
+ *
+ * @example Custom domain header (applied to whitelisted endpoints)
+ * ```ts
+ * const auth = createManagementAuth({
+ *     domain: "your-tenant.auth0.com",
+ *     clientId: "your-client-id",
+ *     clientSecret: "your-client-secret",
+ *     withCustomDomainHeader: "auth.example.com",
+ * });
+ * ```
+ */
+export declare function createManagementAuth(options: ManagementAuthOptions): ManagementAuth;

package/dist/cjs/management/wrapper/management-auth.js

@@ -0,0 +1,106 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createManagementAuth = createManagementAuth;
+const core = __importStar(require("../core/index.js"));
+const request_options_js_1 = require("../request-options.js");
+const auth_helpers_js_1 = require("./auth-helpers.js");
+/**
+ * Creates a shared authentication context for the Auth0 Management API without pulling in the
+ * full {@link ManagementClient}. This is useful for size-constrained runtimes (for example
+ * Cloudflare Workers) where you import individual sub-clients such as `auth0/clients` and
+ * `auth0/users` and want to handle auth once.
+ *
+ * When client credentials are provided, tokens are obtained via the client credentials grant
+ * and cached until shortly before they expire. When a static `token` is provided, it is used
+ * as-is.
+ *
+ * The returned {@link ManagementAuth.clientOptions} carry the same telemetry headers, request
+ * timeouts, retry counts, logging, and custom domain behaviour that the full `ManagementClient`
+ * applies, so individually imported sub-clients behave consistently.
+ *
+ * @group Management API
+ * @public
+ *
+ * @example Client credentials with individual sub-clients
+ * ```ts
+ * import { createManagementAuth } from "auth0/management";
+ * import { ClientsClient } from "auth0/clients";
+ * import { UsersClient } from "auth0/users";
+ *
+ * const auth = createManagementAuth({
+ *     domain: "your-tenant.auth0.com",
+ *     clientId: "your-client-id",
+ *     clientSecret: "your-client-secret",
+ * });
+ *
+ * const clients = new ClientsClient(auth.clientOptions);
+ * const users = new UsersClient(auth.clientOptions);
+ * ```
+ *
+ * @example Static token
+ * ```ts
+ * const auth = createManagementAuth({
+ *     domain: "your-tenant.auth0.com",
+ *     token: "your-api-v2-token",
+ * });
+ * ```
+ *
+ * @example Custom domain header (applied to whitelisted endpoints)
+ * ```ts
+ * const auth = createManagementAuth({
+ *     domain: "your-tenant.auth0.com",
+ *     clientId: "your-client-id",
+ *     clientSecret: "your-client-secret",
+ *     withCustomDomainHeader: "auth.example.com",
+ * });
+ * ```
+ */
+function createManagementAuth(options) {
+    const baseUrl = (0, auth_helpers_js_1.buildManagementBaseUrl)(options.domain);
+    const tokenSupplier = (0, auth_helpers_js_1.createTokenSupplier)(options);
+    const getToken = () => core.Supplier.get(tokenSupplier);
+    const headers = (0, auth_helpers_js_1.createTelemetryHeaders)(options);
+    let clientOptions = Object.assign(Object.assign(Object.assign(Object.assign({ baseUrl, token: getToken }, (Object.keys(headers).length > 0 ? { headers } : {})), (options.timeoutInSeconds !== undefined ? { timeoutInSeconds: options.timeoutInSeconds } : {})), (options.maxRetries !== undefined ? { maxRetries: options.maxRetries } : {})), (options.logging !== undefined ? { logging: options.logging } : {}));
+    // Apply custom domain header configuration if provided, matching the full ManagementClient.
+    if ("withCustomDomainHeader" in options && options.withCustomDomainHeader !== undefined) {
+        clientOptions = (0, request_options_js_1.withCustomDomainHeader)(options.withCustomDomainHeader, clientOptions);
+    }
+    return {
+        baseUrl,
+        getToken,
+        clientOptions,
+    };
+}

package/dist/esm/management/Client.d.mts

@@ -1,4 +1,5 @@
 import { ActionsClient } from "./api/resources/actions/client/Client.mjs";
+import { AgentsClient } from "./api/resources/agents/client/Client.mjs";
 import { AnomalyClient } from "./api/resources/anomaly/client/Client.mjs";
 import { AttackProtectionClient } from "./api/resources/attackProtection/client/Client.mjs";
 import { BrandingClient } from "./api/resources/branding/client/Client.mjs";
@@ -54,6 +55,7 @@ export declare namespace ManagementClient {
 export declare class ManagementClient {
     protected readonly _options: NormalizedClientOptionsWithAuth<ManagementClient.Options>;
     protected _actions: ActionsClient | undefined;
+    protected _agents: AgentsClient | undefined;
     protected _branding: BrandingClient | undefined;
     protected _clientGrants: ClientGrantsClient | undefined;
     protected _clients: ClientsClient | undefined;
@@ -100,6 +102,7 @@ export declare class ManagementClient {
     protected _verifiableCredentials: VerifiableCredentialsClient | undefined;
     constructor(options: ManagementClient.Options);
     get actions(): ActionsClient;
+    get agents(): AgentsClient;
     get branding(): BrandingClient;
     get clientGrants(): ClientGrantsClient;
     get clients(): ClientsClient;

package/dist/esm/management/Client.mjs

@@ -9,6 +9,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 import { ActionsClient } from "./api/resources/actions/client/Client.mjs";
+import { AgentsClient } from "./api/resources/agents/client/Client.mjs";
 import { AnomalyClient } from "./api/resources/anomaly/client/Client.mjs";
 import { AttackProtectionClient } from "./api/resources/attackProtection/client/Client.mjs";
 import { BrandingClient } from "./api/resources/branding/client/Client.mjs";
@@ -63,6 +64,10 @@ export class ManagementClient {
         var _a;
         return ((_a = this._actions) !== null && _a !== void 0 ? _a : (this._actions = new ActionsClient(this._options)));
     }
+    get agents() {
+        var _a;
+        return ((_a = this._agents) !== null && _a !== void 0 ? _a : (this._agents = new AgentsClient(this._options)));
+    }
     get branding() {
         var _a;
         return ((_a = this._branding) !== null && _a !== void 0 ? _a : (this._branding = new BrandingClient(this._options)));