auth0 6.4.0 → 7.1.0

package/dist/cjs/auth/backchannel.d.ts

@@ -1,158 +0,0 @@
-import { BaseAuthAPI } from "./base-auth-api.js";
-/**
- * The response from the authorize endpoint.
- */
-export type AuthorizeResponse = {
-    /**
-     * The authorization request ID.
-     */
-    auth_req_id: string;
-    /**
-     * The duration in seconds until the authentication request expires.
-     */
-    expires_in: number;
-    /**
-     * The interval in seconds to wait between poll requests.
-     */
-    interval: number;
-};
-/**
- * Options for the authorize request.
- */
-export type AuthorizeOptions = {
-    /**
-     * A human-readable string intended to be displayed on both the device calling /bc-authorize and the user’s authentication device.
-     */
-    binding_message: string;
-    /**
-     * A space-separated list of OIDC and custom API scopes.
-     */
-    scope: string;
-    /**
-     * Unique identifier of the audience for an issued token.
-     */
-    audience?: string;
-    /**
-     * Custom expiry time in seconds for this request.
-     * @deprecated Use {@link AuthorizeOptions.requested_expiry} instead.
-     */
-    request_expiry?: string;
-    /**
-     * Custom expiry time in seconds for this request.
-     */
-    requested_expiry?: string;
-    /**
-     * The user ID.
-     */
-    userId: string;
-    /**
-     * Optional parameter for subject issuer context.
-     */
-    subjectIssuerContext?: string;
-    /**
-     * Optional authorization details to use Rich Authorization Requests (RAR).
-     * @see https://auth0.com/docs/get-started/apis/configure-rich-authorization-requests
-     */
-    authorization_details?: string;
-} & Record<string, string>;
-export interface AuthorizationDetails {
-    readonly type: string;
-    readonly [parameter: string]: unknown;
-}
-/**
- * The response from the token endpoint.
- */
-export type TokenResponse = {
-    /**
-     * The access token.
-     */
-    access_token: string;
-    /**
-     * The refresh token, available with the `offline_access` scope.
-     */
-    refresh_token?: string;
-    /**
-     * The user's ID Token.
-     */
-    id_token: string;
-    /**
-     * The token type of the access token.
-     */
-    token_type?: string;
-    /**
-     * The duration in seconds that the access token is valid.
-     */
-    expires_in: number;
-    /**
-     * The scopes associated with the token.
-     */
-    scope: string;
-    /**
-     * Optional authorization details when using Rich Authorization Requests (RAR).
-     * @see https://auth0.com/docs/get-started/apis/configure-rich-authorization-requests
-     */
-    authorization_details?: AuthorizationDetails[];
-};
-/**
- * Options for the token request.
- */
-export type TokenOptions = {
-    /**
-     * The authorization request ID.
-     */
-    auth_req_id: string;
-};
-/**
- * Interface for the backchannel authentication.
- */
-export interface IBackchannel {
-    authorize: (options: AuthorizeOptions) => Promise<AuthorizeResponse>;
-    backchannelGrant: (options: TokenOptions) => Promise<TokenResponse>;
-}
-/**
- * Class implementing the backchannel authentication flow.
- */
-export declare class Backchannel extends BaseAuthAPI implements IBackchannel {
-    /**
-     * Initiates a CIBA authorization request.
-     *
-     * @param {AuthorizeOptions} options - The options for the request.
-     * @returns {Promise<AuthorizeResponse>} - The authorization response.
-     *
-     * @throws {Error} - If the request fails.
-     */
-    authorize({ userId, ...options }: AuthorizeOptions): Promise<AuthorizeResponse>;
-    /**
-     * Handles the backchannel grant flow for authentication. Client can poll this method at regular intervals to check if the backchannel auth request has been approved.
-     *
-     * @param {string} auth_req_id - The authorization request ID. This value is returned from the call to /bc-authorize. Once you have exchanged an auth_req_id for an ID and access token, it is no longer usable.
-     * @returns {Promise<TokenResponse>} - A promise that resolves to the token response.
-     *
-     * @throws {Error} - Throws an error if the request fails.
-     *
-     * If the authorizing user has not yet approved or rejected the request, you will receive a response like this:
-     * ```json
-     * {
-     *   "error": "authorization_pending",
-     *   "error_description": "The end-user authorization is pending"
-     * }
-     * ```
-     *
-     * If the authorizing user rejects the request, you will receive a response like this:
-     * ```json
-     * {
-     *   "error": "access_denied",
-     *   "error_description": "The end-user denied the authorization request or it has been expired"
-     * }
-     * ```
-     *
-     * If you are polling too quickly (faster than the interval value returned from /bc-authorize), you will receive a response like this:
-     * ```json
-     * {
-     *   "error": "slow_down",
-     *   "error_description": "You are polling faster than allowed. Try again in 10 seconds."
-     * }
-     * ```
-     */
-    backchannelGrant({ auth_req_id }: TokenOptions): Promise<TokenResponse>;
-}

package/dist/cjs/auth/backchannel.js

@@ -1,135 +0,0 @@
-"use strict";
-// Wednesday, 8 January, 2025
-// Client Initiated Backchannel Authentication (CIBA)
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-var __rest = (this && this.__rest) || function (s, e) {
-    var t = {};
-    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
-        t[p] = s[p];
-    if (s != null && typeof Object.getOwnPropertySymbols === "function")
-        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
-            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
-                t[p[i]] = s[p[i]];
-        }
-    return t;
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.Backchannel = void 0;
-// CIBA is an OpenID Foundation standard for a decoupled authentication flow. It enables
-// solution developers to build authentication flows where the user logging in does not do so
-// directly on the device that receives the ID or access tokens (the “Consumption Device”), but
-// instead on a separate “Authorization Device”.
-const models_js_1 = require("../lib/models.js");
-const base_auth_api_js_1 = require("./base-auth-api.js");
-/**
- * Generates the login hint for the user.
- *
- * @param {string} userId - The user ID.
- * @param {string} domain - The tenant domain.
- * @returns {string} - The login hint as a JSON string.
- */
-const getLoginHint = (userId, domain) => {
-    // remove trailing '/' from domain, added later for uniformity
-    const trimmedDomain = domain.endsWith("/") ? domain.slice(0, -1) : domain;
-    const loginHint = {
-        format: "iss_sub",
-        iss: `https://${trimmedDomain}/`,
-        sub: `${userId}`,
-    };
-    return JSON.stringify(loginHint);
-};
-const CIBA_GRANT_TYPE = "urn:openid:params:grant-type:ciba";
-const CIBA_AUTHORIZE_URL = "/bc-authorize";
-const CIBA_TOKEN_URL = "/oauth/token";
-/**
- * Class implementing the backchannel authentication flow.
- */
-class Backchannel extends base_auth_api_js_1.BaseAuthAPI {
-    /**
-     * Initiates a CIBA authorization request.
-     *
-     * @param {AuthorizeOptions} options - The options for the request.
-     * @returns {Promise<AuthorizeResponse>} - The authorization response.
-     *
-     * @throws {Error} - If the request fails.
-     */
-    authorize(_a) {
-        return __awaiter(this, void 0, void 0, function* () {
-            var { userId } = _a, options = __rest(_a, ["userId"]);
-            const body = Object.assign(Object.assign({}, options), { login_hint: getLoginHint(userId, this.domain), client_id: this.clientId });
-            // The correct parameter is `requested_expiry`, but we also accept the deprecated `request_expiry` for backwards compatibility
-            const requestedExpiry = options.requested_expiry || options.request_expiry;
-            if (requestedExpiry) {
-                body.requested_expiry = requestedExpiry;
-            }
-            yield this.addClientAuthentication(body);
-            const response = yield this.request.bind(this)({
-                path: CIBA_AUTHORIZE_URL,
-                method: "POST",
-                headers: { "Content-Type": "application/x-www-form-urlencoded" },
-                body: new URLSearchParams(body),
-            }, {});
-            const r = yield models_js_1.JSONApiResponse.fromResponse(response);
-            return r.data;
-        });
-    }
-    /**
-     * Handles the backchannel grant flow for authentication. Client can poll this method at regular intervals to check if the backchannel auth request has been approved.
-     *
-     * @param {string} auth_req_id - The authorization request ID. This value is returned from the call to /bc-authorize. Once you have exchanged an auth_req_id for an ID and access token, it is no longer usable.
-     * @returns {Promise<TokenResponse>} - A promise that resolves to the token response.
-     *
-     * @throws {Error} - Throws an error if the request fails.
-     *
-     * If the authorizing user has not yet approved or rejected the request, you will receive a response like this:
-     * ```json
-     * {
-     *   "error": "authorization_pending",
-     *   "error_description": "The end-user authorization is pending"
-     * }
-     * ```
-     *
-     * If the authorizing user rejects the request, you will receive a response like this:
-     * ```json
-     * {
-     *   "error": "access_denied",
-     *   "error_description": "The end-user denied the authorization request or it has been expired"
-     * }
-     * ```
-     *
-     * If you are polling too quickly (faster than the interval value returned from /bc-authorize), you will receive a response like this:
-     * ```json
-     * {
-     *   "error": "slow_down",
-     *   "error_description": "You are polling faster than allowed. Try again in 10 seconds."
-     * }
-     * ```
-     */
-    backchannelGrant(_a) {
-        return __awaiter(this, arguments, void 0, function* ({ auth_req_id }) {
-            const body = {
-                client_id: this.clientId,
-                auth_req_id,
-                grant_type: CIBA_GRANT_TYPE,
-            };
-            yield this.addClientAuthentication(body);
-            const response = yield this.request.bind(this)({
-                path: CIBA_TOKEN_URL,
-                method: "POST",
-                headers: { "Content-Type": "application/x-www-form-urlencoded" },
-                body: new URLSearchParams(body),
-            }, {});
-            const r = yield models_js_1.JSONApiResponse.fromResponse(response);
-            return r.data;
-        });
-    }
-}
-exports.Backchannel = Backchannel;

package/dist/cjs/auth/base-auth-api.d.ts

@@ -1,41 +0,0 @@
-import { BaseAPI, ClientOptions, InitOverrideFunction, JSONApiResponse, RequestOpts } from "../lib/runtime.js";
-import { AddClientAuthenticationPayload } from "./client-authentication.js";
-import { IDTokenValidator } from "./id-token-validator.js";
-import { GrantOptions, TokenSet } from "./oauth.js";
-export interface AuthenticationClientOptions extends ClientOptions {
-    domain: string;
-    clientId: string;
-    clientSecret?: string;
-    clientAssertionSigningKey?: string;
-    clientAssertionSigningAlg?: string;
-    idTokenSigningAlg?: string;
-    clockTolerance?: number;
-    useMTLS?: boolean;
-}
-export declare class AuthApiError extends Error {
-    error: string;
-    error_description: string;
-    statusCode: number;
-    body: string;
-    headers: Headers;
-    name: "AuthApiError";
-    constructor(error: string, error_description: string, statusCode: number, body: string, headers: Headers);
-}
-export declare class BaseAuthAPI extends BaseAPI {
-    domain: string;
-    clientId: string;
-    clientSecret?: string;
-    clientAssertionSigningKey?: string;
-    clientAssertionSigningAlg?: string;
-    useMTLS?: boolean;
-    constructor(options: AuthenticationClientOptions);
-    /**
-     * @private
-     */
-    protected addClientAuthentication(payload: AddClientAuthenticationPayload): Promise<AddClientAuthenticationPayload>;
-}
-/**
- * @private
- * Perform an OAuth 2.0 grant.
- */
-export declare function grant(grantType: string, bodyParameters: Record<string, any>, { idTokenValidateOptions, initOverrides }: GrantOptions | undefined, clientId: string, idTokenValidator: IDTokenValidator, request: (context: RequestOpts, initOverrides?: RequestInit | InitOverrideFunction) => Promise<Response>): Promise<JSONApiResponse<TokenSet>>;

package/dist/cjs/auth/base-auth-api.js

@@ -1,109 +0,0 @@
-"use strict";
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.BaseAuthAPI = exports.AuthApiError = void 0;
-exports.grant = grant;
-const errors_js_1 = require("../lib/errors.js");
-const runtime_js_1 = require("../lib/runtime.js");
-const client_authentication_js_1 = require("./client-authentication.js");
-const auth0_client_telemetry_js_1 = require("../lib/middleware/auth0-client-telemetry.js");
-class AuthApiError extends Error {
-    constructor(error, error_description, statusCode, body, headers) {
-        super(error_description || error);
-        this.error = error;
-        this.error_description = error_description;
-        this.statusCode = statusCode;
-        this.body = body;
-        this.headers = headers;
-        this.name = "AuthApiError";
-    }
-}
-exports.AuthApiError = AuthApiError;
-function parseErrorBody(body) {
-    const rawData = JSON.parse(body);
-    let data;
-    if (rawData.error) {
-        data = rawData;
-    }
-    else {
-        data = {
-            error: rawData.code,
-            error_description: rawData.description,
-        };
-    }
-    return data;
-}
-function parseError(response) {
-    return __awaiter(this, void 0, void 0, function* () {
-        // Errors typically have a specific format:
-        // {
-        //    error: 'invalid_body',
-        //    error_description: 'Bad Request',
-        // }
-        const body = yield response.text();
-        try {
-            const data = parseErrorBody(body);
-            return new AuthApiError(data.error, data.error_description, response.status, body, response.headers);
-        }
-        catch (_a) {
-            return new errors_js_1.ResponseError(response.status, body, response.headers, "Response returned an error code");
-        }
-    });
-}
-class BaseAuthAPI extends runtime_js_1.BaseAPI {
-    constructor(options) {
-        super(Object.assign(Object.assign({}, options), { baseUrl: `https://${options.domain}`, middleware: options.telemetry !== false ? [new auth0_client_telemetry_js_1.Auth0ClientTelemetry(options)] : [], parseError, retry: Object.assign({ enabled: false }, options.retry) }));
-        this.domain = options.domain;
-        this.clientId = options.clientId;
-        this.clientSecret = options.clientSecret;
-        this.clientAssertionSigningKey = options.clientAssertionSigningKey;
-        this.clientAssertionSigningAlg = options.clientAssertionSigningAlg;
-        this.useMTLS = options.useMTLS;
-    }
-    /**
-     * @private
-     */
-    addClientAuthentication(payload) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return (0, client_authentication_js_1.addClientAuthentication)({
-                payload,
-                domain: this.domain,
-                clientId: this.clientId,
-                clientSecret: this.clientSecret,
-                clientAssertionSigningKey: this.clientAssertionSigningKey,
-                clientAssertionSigningAlg: this.clientAssertionSigningAlg,
-                useMTLS: this.useMTLS,
-            });
-        });
-    }
-}
-exports.BaseAuthAPI = BaseAuthAPI;
-/**
- * @private
- * Perform an OAuth 2.0 grant.
- */
-function grant(grantType_1, bodyParameters_1) {
-    return __awaiter(this, arguments, void 0, function* (grantType, bodyParameters, { idTokenValidateOptions, initOverrides } = {}, clientId, idTokenValidator, request) {
-        const response = yield request({
-            path: "/oauth/token",
-            method: "POST",
-            headers: {
-                "Content-Type": "application/x-www-form-urlencoded",
-            },
-            body: new URLSearchParams(Object.assign(Object.assign({ client_id: clientId }, bodyParameters), { grant_type: grantType })),
-        }, initOverrides);
-        const res = yield runtime_js_1.JSONApiResponse.fromResponse(response);
-        if (res.data.id_token) {
-            yield idTokenValidator.validate(res.data.id_token, idTokenValidateOptions);
-        }
-        return res;
-    });
-}

package/dist/cjs/auth/client-authentication.d.ts

@@ -1,27 +0,0 @@
-export interface AddClientAuthenticationPayload {
-    client_id?: string;
-    client_secret?: string;
-    client_assertion?: string;
-    client_assertion_type?: string;
-    [key: string]: any;
-}
-interface AddClientAuthenticationOptions {
-    payload: AddClientAuthenticationPayload;
-    domain: string;
-    clientId: string;
-    required?: boolean;
-    clientAssertionSigningKey?: string;
-    clientAssertionSigningAlg?: string;
-    clientSecret?: string;
-    useMTLS?: boolean;
-}
-/**
- * Adds client authentication, if available, to the provided payload.
- *
- * Adds `client_secret` for Client Secret Post token endpoint auth method (the SDK doesn't use Client Secret Basic)
- * Adds `client_assertion` and `client_assertion_type` for Private Key JWT token endpoint auth method.
- *
- * If `clientAssertionSigningKey` is provided it takes precedent over `clientSecret` .
- */
-export declare const addClientAuthentication: ({ payload, domain, clientId, clientAssertionSigningKey, clientAssertionSigningAlg, clientSecret, useMTLS, }: AddClientAuthenticationOptions) => Promise<Record<string, unknown>>;
-export {};

package/dist/cjs/auth/client-authentication.js

@@ -1,82 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.addClientAuthentication = void 0;
-const jose = __importStar(require("jose"));
-const uuid_1 = require("uuid");
-/**
- * Adds client authentication, if available, to the provided payload.
- *
- * Adds `client_secret` for Client Secret Post token endpoint auth method (the SDK doesn't use Client Secret Basic)
- * Adds `client_assertion` and `client_assertion_type` for Private Key JWT token endpoint auth method.
- *
- * If `clientAssertionSigningKey` is provided it takes precedent over `clientSecret` .
- */
-const addClientAuthentication = (_a) => __awaiter(void 0, [_a], void 0, function* ({ payload, domain, clientId, clientAssertionSigningKey, clientAssertionSigningAlg, clientSecret, useMTLS, }) {
-    const cid = payload.client_id || clientId;
-    if (clientAssertionSigningKey && !payload.client_assertion) {
-        const alg = clientAssertionSigningAlg || "RS256";
-        const privateKey = yield jose.importPKCS8(clientAssertionSigningKey, alg);
-        payload.client_assertion = yield new jose.SignJWT({})
-            .setProtectedHeader({ alg })
-            .setIssuedAt()
-            .setSubject(cid)
-            .setJti((0, uuid_1.v4)())
-            .setIssuer(cid)
-            .setAudience(`https://${domain}/`)
-            .setExpirationTime("2mins")
-            .sign(privateKey);
-        payload.client_assertion_type = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
-    }
-    else if (clientSecret && !payload.client_secret) {
-        payload.client_secret = clientSecret;
-    }
-    if ((!payload.client_secret || payload.client_secret.trim().length === 0) &&
-        (!payload.client_assertion || payload.client_assertion.trim().length === 0) &&
-        !useMTLS) {
-        throw new Error("The client_secret or client_assertion field is required, or it should be mTLS request.");
-    }
-    return payload;
-});
-exports.addClientAuthentication = addClientAuthentication;