auth0 6.4.0 → 7.1.0

package/dist/esm/auth/backchannel.d.mts

@@ -1,158 +0,0 @@
-import { BaseAuthAPI } from "./base-auth-api.mjs";
-/**
- * The response from the authorize endpoint.
- */
-export type AuthorizeResponse = {
-    /**
-     * The authorization request ID.
-     */
-    auth_req_id: string;
-    /**
-     * The duration in seconds until the authentication request expires.
-     */
-    expires_in: number;
-    /**
-     * The interval in seconds to wait between poll requests.
-     */
-    interval: number;
-};
-/**
- * Options for the authorize request.
- */
-export type AuthorizeOptions = {
-    /**
-     * A human-readable string intended to be displayed on both the device calling /bc-authorize and the user’s authentication device.
-     */
-    binding_message: string;
-    /**
-     * A space-separated list of OIDC and custom API scopes.
-     */
-    scope: string;
-    /**
-     * Unique identifier of the audience for an issued token.
-     */
-    audience?: string;
-    /**
-     * Custom expiry time in seconds for this request.
-     * @deprecated Use {@link AuthorizeOptions.requested_expiry} instead.
-     */
-    request_expiry?: string;
-    /**
-     * Custom expiry time in seconds for this request.
-     */
-    requested_expiry?: string;
-    /**
-     * The user ID.
-     */
-    userId: string;
-    /**
-     * Optional parameter for subject issuer context.
-     */
-    subjectIssuerContext?: string;
-    /**
-     * Optional authorization details to use Rich Authorization Requests (RAR).
-     * @see https://auth0.com/docs/get-started/apis/configure-rich-authorization-requests
-     */
-    authorization_details?: string;
-} & Record<string, string>;
-export interface AuthorizationDetails {
-    readonly type: string;
-    readonly [parameter: string]: unknown;
-}
-/**
- * The response from the token endpoint.
- */
-export type TokenResponse = {
-    /**
-     * The access token.
-     */
-    access_token: string;
-    /**
-     * The refresh token, available with the `offline_access` scope.
-     */
-    refresh_token?: string;
-    /**
-     * The user's ID Token.
-     */
-    id_token: string;
-    /**
-     * The token type of the access token.
-     */
-    token_type?: string;
-    /**
-     * The duration in seconds that the access token is valid.
-     */
-    expires_in: number;
-    /**
-     * The scopes associated with the token.
-     */
-    scope: string;
-    /**
-     * Optional authorization details when using Rich Authorization Requests (RAR).
-     * @see https://auth0.com/docs/get-started/apis/configure-rich-authorization-requests
-     */
-    authorization_details?: AuthorizationDetails[];
-};
-/**
- * Options for the token request.
- */
-export type TokenOptions = {
-    /**
-     * The authorization request ID.
-     */
-    auth_req_id: string;
-};
-/**
- * Interface for the backchannel authentication.
- */
-export interface IBackchannel {
-    authorize: (options: AuthorizeOptions) => Promise<AuthorizeResponse>;
-    backchannelGrant: (options: TokenOptions) => Promise<TokenResponse>;
-}
-/**
- * Class implementing the backchannel authentication flow.
- */
-export declare class Backchannel extends BaseAuthAPI implements IBackchannel {
-    /**
-     * Initiates a CIBA authorization request.
-     *
-     * @param {AuthorizeOptions} options - The options for the request.
-     * @returns {Promise<AuthorizeResponse>} - The authorization response.
-     *
-     * @throws {Error} - If the request fails.
-     */
-    authorize({ userId, ...options }: AuthorizeOptions): Promise<AuthorizeResponse>;
-    /**
-     * Handles the backchannel grant flow for authentication. Client can poll this method at regular intervals to check if the backchannel auth request has been approved.
-     *
-     * @param {string} auth_req_id - The authorization request ID. This value is returned from the call to /bc-authorize. Once you have exchanged an auth_req_id for an ID and access token, it is no longer usable.
-     * @returns {Promise<TokenResponse>} - A promise that resolves to the token response.
-     *
-     * @throws {Error} - Throws an error if the request fails.
-     *
-     * If the authorizing user has not yet approved or rejected the request, you will receive a response like this:
-     * ```json
-     * {
-     *   "error": "authorization_pending",
-     *   "error_description": "The end-user authorization is pending"
-     * }
-     * ```
-     *
-     * If the authorizing user rejects the request, you will receive a response like this:
-     * ```json
-     * {
-     *   "error": "access_denied",
-     *   "error_description": "The end-user denied the authorization request or it has been expired"
-     * }
-     * ```
-     *
-     * If you are polling too quickly (faster than the interval value returned from /bc-authorize), you will receive a response like this:
-     * ```json
-     * {
-     *   "error": "slow_down",
-     *   "error_description": "You are polling faster than allowed. Try again in 10 seconds."
-     * }
-     * ```
-     */
-    backchannelGrant({ auth_req_id }: TokenOptions): Promise<TokenResponse>;
-}

package/dist/esm/auth/backchannel.mjs

@@ -1,131 +0,0 @@
-// Wednesday, 8 January, 2025
-// Client Initiated Backchannel Authentication (CIBA)
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-var __rest = (this && this.__rest) || function (s, e) {
-    var t = {};
-    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
-        t[p] = s[p];
-    if (s != null && typeof Object.getOwnPropertySymbols === "function")
-        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
-            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
-                t[p[i]] = s[p[i]];
-        }
-    return t;
-};
-// CIBA is an OpenID Foundation standard for a decoupled authentication flow. It enables
-// solution developers to build authentication flows where the user logging in does not do so
-// directly on the device that receives the ID or access tokens (the “Consumption Device”), but
-// instead on a separate “Authorization Device”.
-import { JSONApiResponse } from "../lib/models.mjs";
-import { BaseAuthAPI } from "./base-auth-api.mjs";
-/**
- * Generates the login hint for the user.
- *
- * @param {string} userId - The user ID.
- * @param {string} domain - The tenant domain.
- * @returns {string} - The login hint as a JSON string.
- */
-const getLoginHint = (userId, domain) => {
-    // remove trailing '/' from domain, added later for uniformity
-    const trimmedDomain = domain.endsWith("/") ? domain.slice(0, -1) : domain;
-    const loginHint = {
-        format: "iss_sub",
-        iss: `https://${trimmedDomain}/`,
-        sub: `${userId}`,
-    };
-    return JSON.stringify(loginHint);
-};
-const CIBA_GRANT_TYPE = "urn:openid:params:grant-type:ciba";
-const CIBA_AUTHORIZE_URL = "/bc-authorize";
-const CIBA_TOKEN_URL = "/oauth/token";
-/**
- * Class implementing the backchannel authentication flow.
- */
-export class Backchannel extends BaseAuthAPI {
-    /**
-     * Initiates a CIBA authorization request.
-     *
-     * @param {AuthorizeOptions} options - The options for the request.
-     * @returns {Promise<AuthorizeResponse>} - The authorization response.
-     *
-     * @throws {Error} - If the request fails.
-     */
-    authorize(_a) {
-        return __awaiter(this, void 0, void 0, function* () {
-            var { userId } = _a, options = __rest(_a, ["userId"]);
-            const body = Object.assign(Object.assign({}, options), { login_hint: getLoginHint(userId, this.domain), client_id: this.clientId });
-            // The correct parameter is `requested_expiry`, but we also accept the deprecated `request_expiry` for backwards compatibility
-            const requestedExpiry = options.requested_expiry || options.request_expiry;
-            if (requestedExpiry) {
-                body.requested_expiry = requestedExpiry;
-            }
-            yield this.addClientAuthentication(body);
-            const response = yield this.request.bind(this)({
-                path: CIBA_AUTHORIZE_URL,
-                method: "POST",
-                headers: { "Content-Type": "application/x-www-form-urlencoded" },
-                body: new URLSearchParams(body),
-            }, {});
-            const r = yield JSONApiResponse.fromResponse(response);
-            return r.data;
-        });
-    }
-    /**
-     * Handles the backchannel grant flow for authentication. Client can poll this method at regular intervals to check if the backchannel auth request has been approved.
-     *
-     * @param {string} auth_req_id - The authorization request ID. This value is returned from the call to /bc-authorize. Once you have exchanged an auth_req_id for an ID and access token, it is no longer usable.
-     * @returns {Promise<TokenResponse>} - A promise that resolves to the token response.
-     *
-     * @throws {Error} - Throws an error if the request fails.
-     *
-     * If the authorizing user has not yet approved or rejected the request, you will receive a response like this:
-     * ```json
-     * {
-     *   "error": "authorization_pending",
-     *   "error_description": "The end-user authorization is pending"
-     * }
-     * ```
-     *
-     * If the authorizing user rejects the request, you will receive a response like this:
-     * ```json
-     * {
-     *   "error": "access_denied",
-     *   "error_description": "The end-user denied the authorization request or it has been expired"
-     * }
-     * ```
-     *
-     * If you are polling too quickly (faster than the interval value returned from /bc-authorize), you will receive a response like this:
-     * ```json
-     * {
-     *   "error": "slow_down",
-     *   "error_description": "You are polling faster than allowed. Try again in 10 seconds."
-     * }
-     * ```
-     */
-    backchannelGrant(_a) {
-        return __awaiter(this, arguments, void 0, function* ({ auth_req_id }) {
-            const body = {
-                client_id: this.clientId,
-                auth_req_id,
-                grant_type: CIBA_GRANT_TYPE,
-            };
-            yield this.addClientAuthentication(body);
-            const response = yield this.request.bind(this)({
-                path: CIBA_TOKEN_URL,
-                method: "POST",
-                headers: { "Content-Type": "application/x-www-form-urlencoded" },
-                body: new URLSearchParams(body),
-            }, {});
-            const r = yield JSONApiResponse.fromResponse(response);
-            return r.data;
-        });
-    }
-}

package/dist/esm/auth/base-auth-api.d.mts

@@ -1,41 +0,0 @@
-import { BaseAPI, ClientOptions, InitOverrideFunction, JSONApiResponse, RequestOpts } from "../lib/runtime.mjs";
-import { AddClientAuthenticationPayload } from "./client-authentication.mjs";
-import { IDTokenValidator } from "./id-token-validator.mjs";
-import { GrantOptions, TokenSet } from "./oauth.mjs";
-export interface AuthenticationClientOptions extends ClientOptions {
-    domain: string;
-    clientId: string;
-    clientSecret?: string;
-    clientAssertionSigningKey?: string;
-    clientAssertionSigningAlg?: string;
-    idTokenSigningAlg?: string;
-    clockTolerance?: number;
-    useMTLS?: boolean;
-}
-export declare class AuthApiError extends Error {
-    error: string;
-    error_description: string;
-    statusCode: number;
-    body: string;
-    headers: Headers;
-    name: "AuthApiError";
-    constructor(error: string, error_description: string, statusCode: number, body: string, headers: Headers);
-}
-export declare class BaseAuthAPI extends BaseAPI {
-    domain: string;
-    clientId: string;
-    clientSecret?: string;
-    clientAssertionSigningKey?: string;
-    clientAssertionSigningAlg?: string;
-    useMTLS?: boolean;
-    constructor(options: AuthenticationClientOptions);
-    /**
-     * @private
-     */
-    protected addClientAuthentication(payload: AddClientAuthenticationPayload): Promise<AddClientAuthenticationPayload>;
-}
-/**
- * @private
- * Perform an OAuth 2.0 grant.
- */
-export declare function grant(grantType: string, bodyParameters: Record<string, any>, { idTokenValidateOptions, initOverrides }: GrantOptions | undefined, clientId: string, idTokenValidator: IDTokenValidator, request: (context: RequestOpts, initOverrides?: RequestInit | InitOverrideFunction) => Promise<Response>): Promise<JSONApiResponse<TokenSet>>;

package/dist/esm/auth/base-auth-api.mjs

@@ -1,103 +0,0 @@
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-import { ResponseError } from "../lib/errors.mjs";
-import { BaseAPI, JSONApiResponse } from "../lib/runtime.mjs";
-import { addClientAuthentication } from "./client-authentication.mjs";
-import { Auth0ClientTelemetry } from "../lib/middleware/auth0-client-telemetry.mjs";
-export class AuthApiError extends Error {
-    constructor(error, error_description, statusCode, body, headers) {
-        super(error_description || error);
-        this.error = error;
-        this.error_description = error_description;
-        this.statusCode = statusCode;
-        this.body = body;
-        this.headers = headers;
-        this.name = "AuthApiError";
-    }
-}
-function parseErrorBody(body) {
-    const rawData = JSON.parse(body);
-    let data;
-    if (rawData.error) {
-        data = rawData;
-    }
-    else {
-        data = {
-            error: rawData.code,
-            error_description: rawData.description,
-        };
-    }
-    return data;
-}
-function parseError(response) {
-    return __awaiter(this, void 0, void 0, function* () {
-        // Errors typically have a specific format:
-        // {
-        //    error: 'invalid_body',
-        //    error_description: 'Bad Request',
-        // }
-        const body = yield response.text();
-        try {
-            const data = parseErrorBody(body);
-            return new AuthApiError(data.error, data.error_description, response.status, body, response.headers);
-        }
-        catch (_a) {
-            return new ResponseError(response.status, body, response.headers, "Response returned an error code");
-        }
-    });
-}
-export class BaseAuthAPI extends BaseAPI {
-    constructor(options) {
-        super(Object.assign(Object.assign({}, options), { baseUrl: `https://${options.domain}`, middleware: options.telemetry !== false ? [new Auth0ClientTelemetry(options)] : [], parseError, retry: Object.assign({ enabled: false }, options.retry) }));
-        this.domain = options.domain;
-        this.clientId = options.clientId;
-        this.clientSecret = options.clientSecret;
-        this.clientAssertionSigningKey = options.clientAssertionSigningKey;
-        this.clientAssertionSigningAlg = options.clientAssertionSigningAlg;
-        this.useMTLS = options.useMTLS;
-    }
-    /**
-     * @private
-     */
-    addClientAuthentication(payload) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return addClientAuthentication({
-                payload,
-                domain: this.domain,
-                clientId: this.clientId,
-                clientSecret: this.clientSecret,
-                clientAssertionSigningKey: this.clientAssertionSigningKey,
-                clientAssertionSigningAlg: this.clientAssertionSigningAlg,
-                useMTLS: this.useMTLS,
-            });
-        });
-    }
-}
-/**
- * @private
- * Perform an OAuth 2.0 grant.
- */
-export function grant(grantType_1, bodyParameters_1) {
-    return __awaiter(this, arguments, void 0, function* (grantType, bodyParameters, { idTokenValidateOptions, initOverrides } = {}, clientId, idTokenValidator, request) {
-        const response = yield request({
-            path: "/oauth/token",
-            method: "POST",
-            headers: {
-                "Content-Type": "application/x-www-form-urlencoded",
-            },
-            body: new URLSearchParams(Object.assign(Object.assign({ client_id: clientId }, bodyParameters), { grant_type: grantType })),
-        }, initOverrides);
-        const res = yield JSONApiResponse.fromResponse(response);
-        if (res.data.id_token) {
-            yield idTokenValidator.validate(res.data.id_token, idTokenValidateOptions);
-        }
-        return res;
-    });
-}

package/dist/esm/auth/client-authentication.d.mts

@@ -1,27 +0,0 @@
-export interface AddClientAuthenticationPayload {
-    client_id?: string;
-    client_secret?: string;
-    client_assertion?: string;
-    client_assertion_type?: string;
-    [key: string]: any;
-}
-interface AddClientAuthenticationOptions {
-    payload: AddClientAuthenticationPayload;
-    domain: string;
-    clientId: string;
-    required?: boolean;
-    clientAssertionSigningKey?: string;
-    clientAssertionSigningAlg?: string;
-    clientSecret?: string;
-    useMTLS?: boolean;
-}
-/**
- * Adds client authentication, if available, to the provided payload.
- *
- * Adds `client_secret` for Client Secret Post token endpoint auth method (the SDK doesn't use Client Secret Basic)
- * Adds `client_assertion` and `client_assertion_type` for Private Key JWT token endpoint auth method.
- *
- * If `clientAssertionSigningKey` is provided it takes precedent over `clientSecret` .
- */
-export declare const addClientAuthentication: ({ payload, domain, clientId, clientAssertionSigningKey, clientAssertionSigningAlg, clientSecret, useMTLS, }: AddClientAuthenticationOptions) => Promise<Record<string, unknown>>;
-export {};

package/dist/esm/auth/client-authentication.mjs

@@ -1,45 +0,0 @@
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-import * as jose from "jose";
-import { v4 as uuid } from "uuid";
-/**
- * Adds client authentication, if available, to the provided payload.
- *
- * Adds `client_secret` for Client Secret Post token endpoint auth method (the SDK doesn't use Client Secret Basic)
- * Adds `client_assertion` and `client_assertion_type` for Private Key JWT token endpoint auth method.
- *
- * If `clientAssertionSigningKey` is provided it takes precedent over `clientSecret` .
- */
-export const addClientAuthentication = (_a) => __awaiter(void 0, [_a], void 0, function* ({ payload, domain, clientId, clientAssertionSigningKey, clientAssertionSigningAlg, clientSecret, useMTLS, }) {
-    const cid = payload.client_id || clientId;
-    if (clientAssertionSigningKey && !payload.client_assertion) {
-        const alg = clientAssertionSigningAlg || "RS256";
-        const privateKey = yield jose.importPKCS8(clientAssertionSigningKey, alg);
-        payload.client_assertion = yield new jose.SignJWT({})
-            .setProtectedHeader({ alg })
-            .setIssuedAt()
-            .setSubject(cid)
-            .setJti(uuid())
-            .setIssuer(cid)
-            .setAudience(`https://${domain}/`)
-            .setExpirationTime("2mins")
-            .sign(privateKey);
-        payload.client_assertion_type = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
-    }
-    else if (clientSecret && !payload.client_secret) {
-        payload.client_secret = clientSecret;
-    }
-    if ((!payload.client_secret || payload.client_secret.trim().length === 0) &&
-        (!payload.client_assertion || payload.client_assertion.trim().length === 0) &&
-        !useMTLS) {
-        throw new Error("The client_secret or client_assertion field is required, or it should be mTLS request.");
-    }
-    return payload;
-});

package/dist/esm/auth/database.d.mts

@@ -1,157 +0,0 @@
-import { InitOverride, JSONApiResponse, TextApiResponse } from "../lib/models.mjs";
-import { BaseAuthAPI } from "./base-auth-api.mjs";
-export interface SignUpRequest {
-    /**
-     * The client_id of your client.
-     * Use if you want to override the class's `clientId`
-     */
-    client_id?: string;
-    /**
-     * The user's email address.
-     */
-    email: string;
-    /**
-     * The user's desired password.
-     */
-    password: string;
-    /**
-     * The name of the database configured to your client.
-     */
-    connection: string;
-    /**
-     * The user's username. Only valid if the connection requires a username.
-     */
-    username?: string;
-    /**
-     * The user's given name(s).
-     */
-    given_name?: string;
-    /**
-     * The user's family name(s).
-     */
-    family_name?: string;
-    /**
-     * The user's full name.
-     */
-    name?: string;
-    /**
-     *The user's nickname.
-     */
-    nickname?: string;
-    /**
-     * A URI pointing to the user's picture.
-     */
-    picture?: string;
-    /**
-     * The user metadata to be associated with the user. If set, the field must be an object containing no more than ten properties. Property names can have a maximum of 100 characters, and property values must be strings of no more than 500 characters.
-     */
-    user_metadata?: {
-        [key: string]: unknown;
-    };
-}
-export interface SignUpResponse {
-    /**
-     * Email address of the new user.
-     */
-    email: string;
-    /**
-     * Indicates whether the email has been verified or not.
-     */
-    email_verified: boolean;
-    /**
-     * The server can return `_id`, `id` or `user_id` depending on various factors.
-     * For convenience we expose it here as just `id`.
-     */
-    id: string;
-    /**
-     * Username of this user.
-     */
-    username?: string;
-    /**
-     * The user's given name(s).
-     */
-    given_name?: string;
-    /**
-     * The user's family name(s).
-     */
-    family_name?: string;
-    /**
-     * The user's full name.
-     */
-    name?: string;
-    /**
-     *The user's nickname.
-     */
-    nickname?: string;
-    /**
-     * A URI pointing to the user's picture.
-     */
-    picture?: string;
-    /**
-     * The user metadata to be associated with the user. If set, the field must be an object containing no more than ten properties. Property names can have a maximum of 100 characters, and property values must be strings of no more than 500 characters.
-     */
-    user_metadata?: {
-        [key: string]: unknown;
-    };
-}
-export interface ChangePasswordRequest {
-    /**
-     * The client_id of your client.
-     * Use if you want to override the class's `clientId`
-     */
-    client_id?: string;
-    /**
-     * The user's email address.
-     */
-    email: string;
-    /**
-     * The name of the database configured to your client.
-     */
-    connection: string;
-    /**
-     * The organization_id of the Organization associated with the user.
-     */
-    organization?: string;
-}
-/**
- * Sign-up and change-password for Database & Active Directory authentication services.
- */
-export declare class Database extends BaseAuthAPI {
-    /**
-     * Given a user's credentials, and a connection, this endpoint will create a new user using active authentication.
-     *
-     * This endpoint only works for database connections.
-     *
-     * See: https://auth0.com/docs/api/authentication#signup
-     *
-     * @example
-     * ```js
-     * var data = {
-     *   email: '{EMAIL}',
-     *   password: '{PASSWORD}',
-     *   connection: 'Username-Password-Authentication'
-     * };
-     *
-     * await auth0.database.signUp(data);
-     * ```
-     */
-    signUp(bodyParameters: SignUpRequest, initOverrides?: InitOverride): Promise<JSONApiResponse<SignUpResponse>>;
-    /**
-     * Given a user's email address and a connection, Auth0 will send a change password email.
-     *
-     * This endpoint only works for database connections.
-     *
-     * See: https://auth0.com/docs/api/authentication#change-password
-     *
-     * @example
-     * ```js
-     * var data = {
-     *   email: '{EMAIL}',
-     *   connection: 'Username-Password-Authentication'
-     * };
-     *
-     * await auth0.database.changePassword(data);
-     * ```
-     */
-    changePassword(bodyParameters: ChangePasswordRequest, initOverrides?: InitOverride): Promise<TextApiResponse>;
-}