auth0 6.4.0 → 7.0.0

package/dist/cjs/auth/tokenExchange.d.ts

@@ -1,166 +0,0 @@
-import { BaseAuthAPI } from "./base-auth-api.js";
-/**
- * Represents the configuration options required for initiating a Custom Token Exchange request
- * following RFC 8693 specifications.
- *
- * @see {@link https://www.rfc-editor.org/rfc/rfc8693 | RFC 8693: OAuth 2.0 Token Exchange}
- */
-export type CustomTokenExchangeOptions = {
-    /**
-     * The type identifier for the subject token being exchanged
-     *
-     * @pattern
-     * - Must be a namespaced URI under your organization's control
-     * - Forbidden patterns:
-     *   - `^urn:ietf:params:oauth:*` (IETF reserved)
-     *   - `^https:\/\/auth0\.com/*` (Auth0 reserved)
-     *   - `^urn:auth0:*` (Auth0 reserved)
-     *
-     * @example
-     * "urn:acme:legacy-system-token"
-     * "https://api.yourcompany.com/token-type/v1"
-     */
-    subject_token_type: string;
-    /**
-     * The opaque token value being exchanged for Auth0 tokens
-     *
-     * @security
-     * - Must be validated in Auth0 Actions using strong cryptographic verification
-     * - Implement replay attack protection
-     * - Recommended validation libraries: `jose`, `jsonwebtoken`
-     *
-     * @example
-     * "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
-     */
-    subject_token: string;
-    /**
-     * The target audience for the requested Auth0 token
-     *
-     * @remarks
-     * Must match exactly with an API identifier configured in your Auth0 tenant
-     *
-     * @example
-     * "https://api.your-service.com/v1"
-     */
-    audience: string;
-    /**
-     * Space-separated list of OAuth 2.0 scopes being requested
-     *
-     * @remarks
-     * Subject to API authorization policies configured in Auth0
-     *
-     * @example
-     * "openid profile email read:data write:data"
-     */
-    scope?: string;
-    /**
-     * Additional custom parameters for Auth0 Action processing
-     *
-     * @remarks
-     * Accessible in Action code via `event.request.body`
-     *
-     * @example
-     * ```typescript
-     * {
-     *   custom_parameter: "session_context",
-     *   device_fingerprint: "a3d8f7...",
-     * }
-     * ```
-     */
-    [key: string]: unknown;
-};
-/**
- * Interface defining Custom Token Exchange operations
- *
- * @see {@link https://auth0.com/docs/authenticate/protocols/custom-token-exchange | Auth0 Custom Token Exchange Docs}
- */
-export interface ICustomTokenExchange {
-    /**
-     * Executes RFC 8693-compliant token exchange flow
-     *
-     * @throws {Auth0Error} For structured error responses
-     * @throws {Error} For generic errors with these codes:
-     * - `invalid_request`: Invalid parameters
-     * - `consent_required`: Enable "Allow Skipping User Consent" in API settings
-     * - `too_many_attempts`: Suspicious IP throttling triggered
-     *
-     * @example
-     * ```typescript
-     * // External IdP migration scenario
-     * const tokens = await auth0.customTokenExchange.exchangeToken({
-     *   subject_token_type: 'urn:external-idp:legacy',
-     *   subject_token: externalIdPToken,
-     *   audience: 'https://api.your-service.com',
-     *   scope: 'openid profile'
-     * });
-     * ```
-     */
-    exchangeToken(options: CustomTokenExchangeOptions): Promise<TokenResponse>;
-}
-/**
- * Implements Auth0's Custom Token Exchange functionality with security best practices
- *
- * @security
- * - **HTTPS Enforcement**: All requests require TLS encryption
- * - **Credential Protection**: Client secrets never exposed in browser contexts
- * - **Input Validation**: Strict namespace enforcement for token types
- *
- * @example
- * ```typescript
- * // Secure token validation in Auth0 Action
- * exports.onExecuteCustomTokenExchange = async (event, api) => {
- *   const { jws } = require('jose');
- *   const { createRemoteJWKSet } = require('jose/jwks');
- *
- *   const JWKS = createRemoteJWKSet(new URL('https://external-idp.com/.well-known/jwks.json'));
- *
- *   try {
- *     const { payload } = await jws.verify(event.transaction.subject_token, JWKS);
- *     api.authentication.setUserById(payload.sub);
- *   } catch (error) {
- *     api.access.rejectInvalidSubjectToken('Invalid token signature');
- *   }
- * };
- * ```
- */
-export declare class CustomTokenExchange extends BaseAuthAPI implements ICustomTokenExchange {
-    /**
-     * Executes token exchange flow with security validations
-     *
-     * @param options - Exchange configuration parameters
-     * @returns Auth0-issued tokens with requested claims
-     *
-     * @throws {Error} When:
-     * - `subject_token_type` uses prohibited namespace
-     * - Network failures occur
-     * - Auth0 returns error responses (4xx/5xx)
-     */
-    exchangeToken(options: CustomTokenExchangeOptions): Promise<TokenResponse>;
-}
-/**
- * Standardized token response structure for Auth0 authentication flows
- *
- * @remarks
- * **Token Lifetime Management**:
- * - Cache tokens according to `expires_in` value
- * - Rotate refresh tokens using `offline_access` scope
- * - Revoke compromised tokens immediately
- *
- * @security
- * - Store tokens in secure, encrypted storage
- * - Never expose in client-side code or logs
- */
-export type TokenResponse = {
-    /** Bearer token for API authorization */
-    access_token: string;
-    /** Refresh token (requires `offline_access` scope) */
-    refresh_token?: string;
-    /** JWT containing user identity claims */
-    id_token: string;
-    /** Typically "Bearer" */
-    token_type?: string;
-    /** Token validity in seconds (default: 86400) */
-    expires_in: number;
-    /** Granted permissions space */
-    scope: string;
-};

package/dist/cjs/auth/tokenExchange.js

@@ -1,74 +0,0 @@
-"use strict";
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CustomTokenExchange = void 0;
-const models_js_1 = require("../lib/models.js");
-const base_auth_api_js_1 = require("./base-auth-api.js");
-/** RFC 8693-defined grant type for token exchange */
-const TOKEN_EXCHANGE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:token-exchange";
-/** Auth0 token endpoint path */
-const TOKEN_URL = "/oauth/token";
-/**
- * Implements Auth0's Custom Token Exchange functionality with security best practices
- *
- * @security
- * - **HTTPS Enforcement**: All requests require TLS encryption
- * - **Credential Protection**: Client secrets never exposed in browser contexts
- * - **Input Validation**: Strict namespace enforcement for token types
- *
- * @example
- * ```typescript
- * // Secure token validation in Auth0 Action
- * exports.onExecuteCustomTokenExchange = async (event, api) => {
- *   const { jws } = require('jose');
- *   const { createRemoteJWKSet } = require('jose/jwks');
- *
- *   const JWKS = createRemoteJWKSet(new URL('https://external-idp.com/.well-known/jwks.json'));
- *
- *   try {
- *     const { payload } = await jws.verify(event.transaction.subject_token, JWKS);
- *     api.authentication.setUserById(payload.sub);
- *   } catch (error) {
- *     api.access.rejectInvalidSubjectToken('Invalid token signature');
- *   }
- * };
- * ```
- */
-class CustomTokenExchange extends base_auth_api_js_1.BaseAuthAPI {
-    /**
-     * Executes token exchange flow with security validations
-     *
-     * @param options - Exchange configuration parameters
-     * @returns Auth0-issued tokens with requested claims
-     *
-     * @throws {Error} When:
-     * - `subject_token_type` uses prohibited namespace
-     * - Network failures occur
-     * - Auth0 returns error responses (4xx/5xx)
-     */
-    exchangeToken(options) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const body = Object.assign(Object.assign({}, options), { grant_type: TOKEN_EXCHANGE_GRANT_TYPE, client_id: this.clientId });
-            yield this.addClientAuthentication(body);
-            const response = yield this.request({
-                path: TOKEN_URL,
-                method: "POST",
-                headers: {
-                    "Content-Type": "application/x-www-form-urlencoded",
-                },
-                body: new URLSearchParams(body),
-            }, {});
-            const r = yield models_js_1.JSONApiResponse.fromResponse(response);
-            return r.data;
-        });
-    }
-}
-exports.CustomTokenExchange = CustomTokenExchange;

package/dist/cjs/lib/index.d.ts

@@ -1,3 +0,0 @@
-export * from "./errors.js";
-export * from "./models.js";
-export { RetryConfiguration } from "./retry.js";

package/dist/cjs/lib/index.js

@@ -1,18 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./errors.js"), exports);
-__exportStar(require("./models.js"), exports);

package/dist/cjs/lib/runtime.d.ts

@@ -1,61 +0,0 @@
-import { RequestOpts, InitOverrideFunction, Configuration } from "./models.js";
-export * from "./models.js";
-/**
- * @private
- * This is the base class for all generated API classes.
- */
-export declare class BaseAPI {
-    protected configuration: Configuration;
-    private middleware;
-    private fetchApi;
-    private parseError;
-    private timeoutDuration;
-    constructor(configuration: Configuration);
-    protected request(context: RequestOpts, initOverrides?: RequestInit | InitOverrideFunction): Promise<Response>;
-    private createFetchParams;
-    private fetchWithTimeout;
-    private fetch;
-}
-/**
- * @private
- */
-export declare const COLLECTION_FORMATS: {
-    csv: string;
-    ssv: string;
-    tsv: string;
-    pipes: string;
-};
-/**
- * @private
- */
-export type ModelPropertyNaming = "camelCase" | "snake_case" | "PascalCase" | "original";
-/**
- * @private
- */
-export interface Consume {
-    contentType: string;
-}
-/**
- * @private
- */
-export declare function validateRequiredRequestParams<TRequestParams extends {
-    [key: string]: any;
-}>(requestParameters: TRequestParams, keys: Array<Extract<keyof TRequestParams, string>>): void;
-type QueryParamConfig = {
-    isArray?: boolean;
-    isCollectionFormatMulti?: boolean;
-    collectionFormat?: keyof typeof COLLECTION_FORMATS;
-};
-/**
- * @private
- */
-export declare function applyQueryParams<TRequestParams extends {
-    [key: string]: any;
-}, Key extends Extract<keyof TRequestParams, string>>(requestParameters: TRequestParams, keys: Array<{
-    key: Key;
-    config: QueryParamConfig;
-}>): Pick<TRequestParams, ReadonlyArray<Key>[number]>;
-/**
- * @private
- */
-export declare function parseFormParam(originalValue: number | boolean | string | Blob): Promise<string | Blob>;

package/dist/cjs/lib/runtime.js

@@ -1,222 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.COLLECTION_FORMATS = exports.BaseAPI = void 0;
-exports.validateRequiredRequestParams = validateRequiredRequestParams;
-exports.applyQueryParams = applyQueryParams;
-exports.parseFormParam = parseFormParam;
-const retry_js_1 = require("./retry.js");
-const errors_js_1 = require("./errors.js");
-__exportStar(require("./models.js"), exports);
-/**
- * @private
- * This is the base class for all generated API classes.
- */
-class BaseAPI {
-    constructor(configuration) {
-        this.configuration = configuration;
-        this.fetchWithTimeout = (url, init) => __awaiter(this, void 0, void 0, function* () {
-            const controller = new AbortController();
-            const timeout = setTimeout(() => {
-                controller.abort();
-            }, this.timeoutDuration);
-            try {
-                return yield this.fetchApi(url, Object.assign({ signal: controller.signal }, init));
-            }
-            catch (e) {
-                if (e.name === "AbortError") {
-                    throw new errors_js_1.TimeoutError();
-                }
-                throw e;
-            }
-            finally {
-                clearTimeout(timeout);
-            }
-        });
-        this.fetch = (url, init) => __awaiter(this, void 0, void 0, function* () {
-            var _a;
-            let fetchParams = { url, init };
-            for (const middleware of this.middleware) {
-                if (middleware.pre) {
-                    fetchParams =
-                        (yield middleware.pre(Object.assign({ fetch: this.fetchWithTimeout }, fetchParams))) || fetchParams;
-                }
-            }
-            let response = undefined;
-            let error = undefined;
-            try {
-                response =
-                    ((_a = this.configuration.retry) === null || _a === void 0 ? void 0 : _a.enabled) !== false
-                        ? yield (0, retry_js_1.retry)(() => this.fetchWithTimeout(fetchParams.url, fetchParams.init), Object.assign({}, this.configuration.retry))
-                        : yield this.fetchWithTimeout(fetchParams.url, fetchParams.init);
-            }
-            catch (e) {
-                error = e;
-            }
-            if (error || !response.ok) {
-                for (const middleware of this.middleware) {
-                    if (middleware.onError) {
-                        response =
-                            (yield middleware.onError(Object.assign(Object.assign({ fetch: this.fetchWithTimeout }, fetchParams), { error, response: response ? response.clone() : undefined }))) || response;
-                    }
-                }
-                if (response === undefined) {
-                    throw new errors_js_1.FetchError(error, "The request failed and the interceptors did not return an alternative response");
-                }
-            }
-            else {
-                for (const middleware of this.middleware) {
-                    if (middleware.post) {
-                        response =
-                            (yield middleware.post(Object.assign(Object.assign({ fetch: this.fetchApi }, fetchParams), { response: response.clone() }))) || response;
-                    }
-                }
-            }
-            return response;
-        });
-        if (configuration.baseUrl === null || configuration.baseUrl === undefined) {
-            throw new Error("Must provide a base URL for the API");
-        }
-        if ("string" !== typeof configuration.baseUrl || configuration.baseUrl.length === 0) {
-            throw new Error("The provided base URL is invalid");
-        }
-        this.middleware = configuration.middleware || [];
-        this.fetchApi = configuration.fetch || globalThis.fetch.bind(globalThis);
-        this.parseError = configuration.parseError;
-        this.timeoutDuration =
-            typeof configuration.timeoutDuration === "number" ? configuration.timeoutDuration : 10000;
-    }
-    request(context, initOverrides) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const { url, init } = yield this.createFetchParams(context, initOverrides);
-            const response = yield this.fetch(url, init);
-            if (response && response.status >= 200 && response.status < 300) {
-                return response;
-            }
-            const error = yield this.parseError(response);
-            throw error;
-        });
-    }
-    createFetchParams(context, initOverrides) {
-        return __awaiter(this, void 0, void 0, function* () {
-            let url = this.configuration.baseUrl + context.path;
-            if (context.query !== undefined && Object.keys(context.query).length !== 0) {
-                // only add the querystring to the URL if there are query parameters.
-                // this is done to avoid urls ending with a "?" character which buggy webservers
-                // do not handle correctly sometimes.
-                url += `?${querystring(context.query)}`;
-            }
-            const headers = Object.assign({}, this.configuration.headers, context.headers);
-            Object.keys(headers).forEach((key) => (headers[key] === undefined ? delete headers[key] : {}));
-            const initOverrideFn = typeof initOverrides === "function" ? initOverrides : () => __awaiter(this, void 0, void 0, function* () { return initOverrides; });
-            const initParams = {
-                method: context.method,
-                headers,
-                body: context.body,
-                dispatcher: this.configuration.agent,
-            };
-            const overriddenInit = Object.assign(Object.assign({}, initParams), (yield initOverrideFn({
-                init: initParams,
-                context,
-            })));
-            const init = Object.assign(Object.assign({}, overriddenInit), { body: overriddenInit.body instanceof FormData ||
-                    overriddenInit.body instanceof URLSearchParams ||
-                    overriddenInit.body instanceof Blob
-                    ? overriddenInit.body
-                    : JSON.stringify(overriddenInit.body) });
-            return { url, init };
-        });
-    }
-}
-exports.BaseAPI = BaseAPI;
-/**
- * @private
- */
-exports.COLLECTION_FORMATS = {
-    csv: ",",
-    ssv: " ",
-    tsv: "\t",
-    pipes: "|",
-};
-/**
- * @private
- */
-function querystring(params) {
-    return Object.keys(params)
-        .map((key) => querystringSingleKey(key, params[key]))
-        .filter((part) => part.length > 0)
-        .join("&");
-}
-function querystringSingleKey(key, value) {
-    if (value instanceof Array) {
-        const multiValue = value
-            .map((singleValue) => encodeURIComponent(String(singleValue)))
-            .join(`&${encodeURIComponent(key)}=`);
-        return `${encodeURIComponent(key)}=${multiValue}`;
-    }
-    return `${encodeURIComponent(key)}=${encodeURIComponent(String(value))}`;
-}
-/**
- * @private
- */
-function validateRequiredRequestParams(requestParameters, keys) {
-    keys.forEach((key) => {
-        if (requestParameters[key] === null || requestParameters[key] === undefined) {
-            throw new errors_js_1.RequiredError(key, `Required parameter requestParameters.${key} was null or undefined.`);
-        }
-    });
-}
-/**
- * @private
- */
-function applyQueryParams(requestParameters, keys) {
-    return keys.reduce((acc, { key, config, }) => {
-        let value;
-        if (config.isArray) {
-            if (config.isCollectionFormatMulti) {
-                value = requestParameters[key];
-            }
-            else {
-                value = requestParameters[key].join(exports.COLLECTION_FORMATS[config.collectionFormat]);
-            }
-        }
-        else {
-            if (requestParameters[key] !== undefined) {
-                value = requestParameters[key];
-            }
-        }
-        return value !== undefined ? Object.assign(Object.assign({}, acc), { [key]: value }) : acc;
-    }, {});
-}
-/**
- * @private
- */
-function parseFormParam(originalValue) {
-    return __awaiter(this, void 0, void 0, function* () {
-        let value = originalValue;
-        value = typeof value == "number" || typeof value == "boolean" ? "" + value : value;
-        return value;
-    });
-}

package/dist/cjs/userinfo/index.d.ts

@@ -1,87 +0,0 @@
-import { ResponseError } from "../lib/errors.js";
-import { ClientOptions, InitOverride, JSONApiResponse } from "../lib/models.js";
-import { BaseAPI } from "../lib/runtime.js";
-/**
- * Response interface for the UserInfo endpoint
- * @group UserInfo API
- */
-export interface UserInfoResponse {
-    sub: string;
-    name: string;
-    given_name?: string;
-    family_name?: string;
-    middle_name?: string;
-    nickname: string;
-    preferred_username?: string;
-    profile?: string;
-    picture?: string;
-    website?: string;
-    email: string;
-    email_verified: boolean;
-    gender?: string;
-    birthdate?: string;
-    zoneinfo?: string;
-    locale?: string;
-    phone_number?: string;
-    phone_number_verified?: string;
-    address?: {
-        country?: string;
-    };
-    updated_at: string;
-    [key: string]: unknown;
-}
-export declare class UserInfoError extends Error {
-    error: string;
-    error_description: string;
-    statusCode: number;
-    body: string;
-    headers: Headers;
-    name: "UserInfoError";
-    constructor(error: string, error_description: string, statusCode: number, body: string, headers: Headers);
-}
-export declare function parseError(response: Response): Promise<ResponseError | UserInfoError>;
-/**
- * Auth0 UserInfo API Client
- *
- * Provides access to the UserInfo endpoint to retrieve user profile information
- * using an access token obtained during authentication.
- *
- * @group UserInfo API
- *
- * @example Basic usage
- * ```typescript
- * import { UserInfoClient } from 'auth0';
- *
- * const userInfoClient = new UserInfoClient({
- *   domain: 'your-tenant.auth0.com'
- * });
- *
- * const userInfo = await userInfoClient.getUserInfo(accessToken);
- * console.log(userInfo.data.sub, userInfo.data.email);
- * ```
- */
-export declare class UserInfoClient extends BaseAPI {
-    /**
-     * Create a new UserInfo API client
-     * @param options - Configuration options including domain and client settings
-     */
-    constructor(options: {
-        domain: string;
-    } & ClientOptions);
-    /**
-   * Given an access token get the user profile linked to it.
-   *
-   * @example <caption>
-   *   Get the user information based on the Auth0 access token (obtained during
-   *   login). Find more information in the
-   *   <a href="https://auth0.com/docs/auth-api#!#get--userinfo">API Docs</a>.
-   * </caption>
-   *
-   * const userInfoClient = new UserInfoClient({
-   *   domain: '...'
-   * });
-
-   * const userInfo = await userInfoClient.getUserInfo(accessToken);
-   */
-    getUserInfo(accessToken: string, initOverrides?: InitOverride): Promise<JSONApiResponse<UserInfoResponse>>;
-}