auth0 6.4.0 → 7.1.0

package/dist/esm/management/version.d.mts

@@ -1 +1 @@
-export declare const SDK_VERSION = "6.4.0";
+export declare const SDK_VERSION = "7.1.0";

package/dist/esm/management/version.mjs

@@ -1 +1 @@
-export const SDK_VERSION = "6.4.0";
+export const SDK_VERSION = "7.1.0";

package/dist/esm/management/wrapper/ManagementClient.d.mts

@@ -15,7 +15,7 @@ export declare namespace ManagementClient {
      * @group Management API
      * @public
      */
-    interface ManagementClientOptions extends Omit<FernClient.Options, "token" | "environment" | "fetcher" | "baseUrl" | "fetch"> {
+    interface ManagementClientOptions extends Omit<FernClient.Options, "token" | "environment" | "fetcher" | "baseUrl"> {
         /** Auth0 domain (e.g., 'your-tenant.auth0.com') */
         domain: string;
         /**
@@ -114,7 +114,14 @@ export declare namespace ManagementClient {
         clientAssertionSigningKey: string;
         /** Algorithm for signing the client assertion. Defaults to RS256 */
         clientAssertionSigningAlg?: string;
-        /** Enable mTLS for token endpoint calls */
+        /**
+         * Enable mTLS for token endpoint calls.
+         *
+         * mTLS (RFC 8705) is a transport-layer concern that is independent of the client
+         * authentication method: a client authenticating with `private_key_jwt` can still present a
+         * TLS client certificate to obtain a certificate-bound access token. This mirrors v6, which
+         * added the `mtls.` endpoint alias from `useMTLS` alone regardless of the auth method.
+         */
         useMTLS?: boolean;
     }
     /**

package/dist/esm/management/wrapper/ManagementClient.mjs

@@ -71,7 +71,6 @@ export class ManagementClient extends FernClient {
         const token = createTokenSupplier(_options);
         // Temporarily remove fetcher from options to avoid people passing it for now
         delete _options.fetcher;
-        delete _options.fetch;
         // Prepare the base client options
         let clientOptions = Object.assign(Object.assign({}, _options), { baseUrl,
             headers,

package/dist/esm/management/wrapper/token-provider.d.mts

@@ -1,7 +1,6 @@
-import { ManagementClient } from "./ManagementClient.mjs";
+import type { ManagementClient } from "./ManagementClient.mjs";
 export declare class TokenProvider {
     private readonly options;
-    private authenticationClient;
     private expiresAt;
     private accessToken;
     private pending;
@@ -12,4 +11,7 @@ export declare class TokenProvider {
         audience: string;
     });
     getAccessToken(): Promise<string>;
+    private fetchToken;
+    private buildClientAssertion;
+    private buildTelemetryHeader;
 }

package/dist/esm/management/wrapper/token-provider.mjs

@@ -7,30 +7,161 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
-import { AuthenticationClient } from "../../auth/index.mjs";
-const LEEWAY = 10 * 1000;
+import { base64url, importPKCS8, SignJWT } from "jose";
+import { generateClientInfo } from "../../utils.mjs";
+import { ManagementError } from "../errors/ManagementError.mjs";
+const LEEWAY = 10 * 1000; // 10s refresh-ahead in ms
 export class TokenProvider {
     constructor(options) {
         this.options = options;
         this.expiresAt = 0;
         this.accessToken = "";
-        this.authenticationClient = new AuthenticationClient(Object.assign(Object.assign({}, options), { headers: options.headers }));
+        // Validate domain: must be a bare hostname, no slashes or query strings.
+        if (/[/?#]/.test(options.domain)) {
+            throw new Error(`ManagementClient: invalid domain "${options.domain}". Provide a bare hostname, e.g. "tenant.auth0.com".`);
+        }
+        if (options.useMTLS) {
+            const { fetch: customFetch } = options;
+            if (!customFetch) {
+                throw new Error("ManagementClient: useMTLS requires a custom fetch implementation. " +
+                    "Provide a `fetch` option configured with your mTLS client certificate.");
+            }
+            // mTLS (RFC 8705) is a transport-layer concern independent of the client authentication
+            // method. It combines with both `clientSecret` and `clientAssertionSigningKey`: the TLS
+            // client certificate yields a certificate-bound token regardless of how the client
+            // authenticates. v6 supported this, so no auth-method restriction is imposed here.
+        }
     }
     getAccessToken() {
         return __awaiter(this, void 0, void 0, function* () {
             if (!this.accessToken || Date.now() > this.expiresAt - LEEWAY) {
-                this.pending =
-                    this.pending ||
-                        this.authenticationClient.oauth.clientCredentialsGrant({
-                            audience: this.options.audience,
-                        });
-                const { data: { access_token: accessToken, expires_in: expiresIn }, } = yield this.pending.finally(() => {
+                this.pending = this.pending || this.fetchToken();
+                const result = yield this.pending.finally(() => {
                     delete this.pending;
                 });
-                this.expiresAt = Date.now() + expiresIn * 1000;
-                this.accessToken = accessToken;
+                this.expiresAt = result.expiresAt;
+                this.accessToken = result.accessToken;
             }
             return this.accessToken;
         });
     }
+    fetchToken() {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const { domain, clientId, audience } = this.options;
+            const tokenUrl = this.options.useMTLS ? `https://mtls.${domain}/oauth/token` : `https://${domain}/oauth/token`;
+            const body = new URLSearchParams({
+                grant_type: "client_credentials",
+                client_id: clientId,
+                audience,
+            });
+            if ("clientSecret" in this.options) {
+                body.set("client_secret", this.options.clientSecret);
+            }
+            else if ("clientAssertionSigningKey" in this.options) {
+                const assertion = yield this.buildClientAssertion(domain, clientId);
+                body.set("client_assertion", assertion);
+                body.set("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer");
+            }
+            // Build request headers. Start with user-supplied plain-string headers so they can be
+            // overridden by SDK-controlled values (Content-Type, Auth0-Client) set below.
+            // Supplier-function headers (Fern's Supplier<string | null | undefined> type) are skipped —
+            // they require async resolution and are not supported on the token endpoint path.
+            const userHeaders = (_a = this.options.headers) !== null && _a !== void 0 ? _a : {};
+            const headers = {};
+            for (const [key, value] of Object.entries(userHeaders)) {
+                if (typeof value === "string") {
+                    headers[key.toLowerCase()] = value;
+                }
+            }
+            headers["content-type"] = "application/x-www-form-urlencoded";
+            const telemetryHeader = this.buildTelemetryHeader();
+            if (telemetryHeader) {
+                headers["auth0-client"] = telemetryHeader;
+            }
+            // Use custom fetch for mTLS, else global fetch.
+            // `fetch` is defined on BaseClientOptions (src/management/BaseClient.ts) which is Fern-generated.
+            // If that file is regenerated, verify `fetch?: typeof fetch` is still present — token acquisition
+            // for mTLS depends on it being forwarded here.
+            const { fetch: customFetch } = this.options;
+            const fetcher = customFetch !== null && customFetch !== void 0 ? customFetch : fetch;
+            let response;
+            try {
+                response = yield fetcher(tokenUrl, {
+                    method: "POST",
+                    headers,
+                    body: body.toString(),
+                    signal: AbortSignal.timeout(10000),
+                });
+            }
+            catch (err) {
+                // Built-in fetch aborts with a "TimeoutError"; node-fetch (used on the mTLS path with a
+                // custom fetch) aborts with an "AbortError". Match both so a token-request timeout maps
+                // to a 408 regardless of the underlying fetch implementation.
+                if (err instanceof Error && (err.name === "TimeoutError" || err.name === "AbortError")) {
+                    throw new ManagementError({
+                        message: "ManagementClient: token request timed out",
+                        statusCode: 408,
+                    });
+                }
+                throw err;
+            }
+            if (!response.ok) {
+                // Read the body exactly once. `response.json()` followed by `response.text()` throws
+                // "Body has already been read", which would swallow non-JSON error payloads (e.g. proxy
+                // or WAF 502s). Read text, then attempt to parse it as JSON.
+                const raw = yield response.text().catch(() => "");
+                let errorBody;
+                try {
+                    errorBody = raw ? JSON.parse(raw) : response.statusText;
+                }
+                catch (_b) {
+                    errorBody = raw || response.statusText;
+                }
+                throw new ManagementError({
+                    message: "ManagementClient: token request failed",
+                    statusCode: response.status,
+                    body: errorBody,
+                });
+            }
+            const json = (yield response.json());
+            return {
+                accessToken: json.access_token,
+                expiresAt: Date.now() + json.expires_in * 1000,
+            };
+        });
+    }
+    buildClientAssertion(domain, clientId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { clientAssertionSigningKey, clientAssertionSigningAlg = "RS256" } = this
+                .options;
+            const key = yield importPKCS8(clientAssertionSigningKey, clientAssertionSigningAlg);
+            const now = Math.floor(Date.now() / 1000);
+            return new SignJWT({})
+                .setProtectedHeader({ alg: clientAssertionSigningAlg })
+                .setIssuedAt(now)
+                .setIssuer(clientId)
+                .setSubject(clientId)
+                .setAudience(`https://${domain}/`)
+                .setExpirationTime(now + 180) // 3 min lifetime
+                .setJti(crypto.randomUUID())
+                .sign(key);
+        });
+    }
+    buildTelemetryHeader() {
+        var _a;
+        const opts = this.options;
+        if (opts.telemetry === false)
+            return null;
+        const nodeAuth0Info = generateClientInfo();
+        const info = opts.clientInfo
+            ? { name: opts.clientInfo.name, version: String((_a = opts.clientInfo.version) !== null && _a !== void 0 ? _a : nodeAuth0Info.version) }
+            : { name: nodeAuth0Info.name, version: nodeAuth0Info.version };
+        // NOTE: auth0-auth-js TelemetryConfig does not support env fields.
+        // The runtime fingerprint (env.node / env.cloudflare-workers) present in the
+        // original node-auth0 Auth0-Client header is intentionally omitted here.
+        // This is a known, accepted delta vs the pre-v7 token request telemetry shape.
+        // Use jose's base64url encoder for runtime portability (Buffer is Node-only).
+        return base64url.encode(new TextEncoder().encode(JSON.stringify(info)));
+    }
 }

package/dist/esm/utils.d.mts

@@ -5,21 +5,3 @@ export declare const generateClientInfo: () => {
         [x: string]: string;
     };
 };
-/**
- * @private
- */
-export declare const mtlsPrefix = "mtls";
-type SyncGetter<T> = () => T;
-type AsyncGetter<T> = () => Promise<T>;
-/**
- * Resolves a value that can be a static value, a synchronous function, or an asynchronous function.
- *
- * @template T - The type of the value to be resolved.
- * @param {T | SyncGetter<T> | AsyncGetter<T>} value - The value to be resolved. It can be:
- *   - A static value of type T.
- *   - A synchronous function that returns a value of type T.
- *   - An asynchronous function that returns a Promise of type T.
- * @returns {Promise<T>} A promise that resolves to the value of type T.
- */
-export declare const resolveValueToPromise: <T>(value: T | SyncGetter<T> | AsyncGetter<T>) => Promise<T>;
-export {};

package/dist/esm/utils.mjs

@@ -1,12 +1,3 @@
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
 import { SDK_VERSION as version } from "./management/version.mjs";
 import { RUNTIME } from "./management/core/index.mjs";
 export const generateClientInfo = () => {
@@ -22,24 +13,3 @@ export const generateClientInfo = () => {
         },
     };
 };
-/**
- * @private
- */
-export const mtlsPrefix = "mtls";
-/**
- * Resolves a value that can be a static value, a synchronous function, or an asynchronous function.
- *
- * @template T - The type of the value to be resolved.
- * @param {T | SyncGetter<T> | AsyncGetter<T>} value - The value to be resolved. It can be:
- *   - A static value of type T.
- *   - A synchronous function that returns a value of type T.
- *   - An asynchronous function that returns a Promise of type T.
- * @returns {Promise<T>} A promise that resolves to the value of type T.
- */
-export const resolveValueToPromise = (value) => __awaiter(void 0, void 0, void 0, function* () {
-    if (typeof value === "function") {
-        const result = value(); // Call the function
-        return result instanceof Promise ? result : Promise.resolve(result); // Handle sync/async
-    }
-    return Promise.resolve(value); // Static value
-});

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "auth0",
-    "version": "6.4.0",
+    "version": "7.1.0",
     "private": false,
     "repository": {
         "type": "git",
@@ -199,6 +199,17 @@
             },
             "default": "./dist/cjs/management/api/resources/groups/exports.js"
         },
+        "./guardian": {
+            "import": {
+                "types": "./dist/esm/management/api/resources/guardian/exports.d.mts",
+                "default": "./dist/esm/management/api/resources/guardian/exports.mjs"
+            },
+            "require": {
+                "types": "./dist/cjs/management/api/resources/guardian/exports.d.ts",
+                "default": "./dist/cjs/management/api/resources/guardian/exports.js"
+            },
+            "default": "./dist/cjs/management/api/resources/guardian/exports.js"
+        },
         "./hooks": {
             "import": {
                 "types": "./dist/esm/management/api/resources/hooks/exports.d.mts",
@@ -254,17 +265,6 @@
             },
             "default": "./dist/cjs/management/api/resources/networkAcls/exports.js"
         },
-        "./organizationTemplates": {
-            "import": {
-                "types": "./dist/esm/management/api/resources/organizationTemplates/exports.d.mts",
-                "default": "./dist/esm/management/api/resources/organizationTemplates/exports.mjs"
-            },
-            "require": {
-                "types": "./dist/cjs/management/api/resources/organizationTemplates/exports.d.ts",
-                "default": "./dist/cjs/management/api/resources/organizationTemplates/exports.js"
-            },
-            "default": "./dist/cjs/management/api/resources/organizationTemplates/exports.js"
-        },
         "./organizations": {
             "import": {
                 "types": "./dist/esm/management/api/resources/organizations/exports.d.mts",
@@ -826,6 +826,28 @@
             },
             "default": "./dist/cjs/management/api/resources/eventStreams/resources/redeliveries/exports.js"
         },
+        "./experimentation": {
+            "import": {
+                "types": "./dist/esm/management/api/resources/experimentation/exports.d.mts",
+                "default": "./dist/esm/management/api/resources/experimentation/exports.mjs"
+            },
+            "require": {
+                "types": "./dist/cjs/management/api/resources/experimentation/exports.d.ts",
+                "default": "./dist/cjs/management/api/resources/experimentation/exports.js"
+            },
+            "default": "./dist/cjs/management/api/resources/experimentation/exports.js"
+        },
+        "./experimentation/experiments": {
+            "import": {
+                "types": "./dist/esm/management/api/resources/experimentation/resources/experiments/exports.d.mts",
+                "default": "./dist/esm/management/api/resources/experimentation/resources/experiments/exports.mjs"
+            },
+            "require": {
+                "types": "./dist/cjs/management/api/resources/experimentation/resources/experiments/exports.d.ts",
+                "default": "./dist/cjs/management/api/resources/experimentation/resources/experiments/exports.js"
+            },
+            "default": "./dist/cjs/management/api/resources/experimentation/resources/experiments/exports.js"
+        },
         "./flows/executions": {
             "import": {
                 "types": "./dist/esm/management/api/resources/flows/resources/executions/exports.d.mts",
@@ -881,17 +903,6 @@
             },
             "default": "./dist/cjs/management/api/resources/groups/resources/roles/exports.js"
         },
-        "./guardian": {
-            "import": {
-                "types": "./dist/esm/management/api/resources/guardian/exports.d.mts",
-                "default": "./dist/esm/management/api/resources/guardian/exports.mjs"
-            },
-            "require": {
-                "types": "./dist/cjs/management/api/resources/guardian/exports.d.ts",
-                "default": "./dist/cjs/management/api/resources/guardian/exports.js"
-            },
-            "default": "./dist/cjs/management/api/resources/guardian/exports.js"
-        },
         "./guardian/enrollments": {
             "import": {
                 "types": "./dist/esm/management/api/resources/guardian/resources/enrollments/exports.d.mts",
@@ -925,6 +936,17 @@
             },
             "default": "./dist/cjs/management/api/resources/guardian/resources/policies/exports.js"
         },
+        "./guardian/factors/email": {
+            "import": {
+                "types": "./dist/esm/management/api/resources/guardian/resources/factors/resources/email/exports.d.mts",
+                "default": "./dist/esm/management/api/resources/guardian/resources/factors/resources/email/exports.mjs"
+            },
+            "require": {
+                "types": "./dist/cjs/management/api/resources/guardian/resources/factors/resources/email/exports.d.ts",
+                "default": "./dist/cjs/management/api/resources/guardian/resources/factors/resources/email/exports.js"
+            },
+            "default": "./dist/cjs/management/api/resources/guardian/resources/factors/resources/email/exports.js"
+        },
         "./guardian/factors/phone": {
             "import": {
                 "types": "./dist/esm/management/api/resources/guardian/resources/factors/resources/phone/exports.d.mts",