auth0 6.4.0 → 7.1.0

package/dist/esm/auth/database.mjs

@@ -1,90 +0,0 @@
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-import { JSONApiResponse, TextApiResponse } from "../lib/models.mjs";
-import { validateRequiredRequestParams } from "../lib/runtime.mjs";
-import { BaseAuthAPI } from "./base-auth-api.mjs";
-/**
- * Sign-up and change-password for Database & Active Directory authentication services.
- */
-export class Database extends BaseAuthAPI {
-    /**
-     * Given a user's credentials, and a connection, this endpoint will create a new user using active authentication.
-     *
-     * This endpoint only works for database connections.
-     *
-     * See: https://auth0.com/docs/api/authentication#signup
-     *
-     * @example
-     * ```js
-     * var data = {
-     *   email: '{EMAIL}',
-     *   password: '{PASSWORD}',
-     *   connection: 'Username-Password-Authentication'
-     * };
-     *
-     * await auth0.database.signUp(data);
-     * ```
-     */
-    signUp(bodyParameters, initOverrides) {
-        return __awaiter(this, void 0, void 0, function* () {
-            // TODO: call this `validateRequiredParams` so we can use with bodyParameters in the auth api
-            validateRequiredRequestParams(bodyParameters, ["email", "password", "connection"]);
-            const response = yield this.request({
-                path: "/dbconnections/signup",
-                method: "POST",
-                headers: {
-                    "Content-Type": "application/json",
-                },
-                body: Object.assign({ client_id: this.clientId }, bodyParameters),
-            }, initOverrides);
-            // Transform the response to ensure id field is always available
-            const jsonResponse = yield JSONApiResponse.fromResponse(response);
-            if (jsonResponse.data) {
-                const data = jsonResponse.data;
-                // Map _id or user_id to id
-                if (!data.id && (data._id || data.user_id)) {
-                    data.id = data._id || data.user_id;
-                }
-            }
-            return jsonResponse;
-        });
-    }
-    /**
-     * Given a user's email address and a connection, Auth0 will send a change password email.
-     *
-     * This endpoint only works for database connections.
-     *
-     * See: https://auth0.com/docs/api/authentication#change-password
-     *
-     * @example
-     * ```js
-     * var data = {
-     *   email: '{EMAIL}',
-     *   connection: 'Username-Password-Authentication'
-     * };
-     *
-     * await auth0.database.changePassword(data);
-     * ```
-     */
-    changePassword(bodyParameters, initOverrides) {
-        return __awaiter(this, void 0, void 0, function* () {
-            validateRequiredRequestParams(bodyParameters, ["email", "connection"]);
-            const response = yield this.request({
-                path: "/dbconnections/change_password",
-                method: "POST",
-                headers: {
-                    "Content-Type": "application/json",
-                },
-                body: Object.assign({ client_id: this.clientId }, bodyParameters),
-            }, initOverrides);
-            return TextApiResponse.fromResponse(response);
-        });
-    }
-}

package/dist/esm/auth/id-token-validator.d.mts

@@ -1,18 +0,0 @@
-import { AuthenticationClientOptions } from "./base-auth-api.mjs";
-export declare class IdTokenValidatorError extends Error {
-}
-export interface IDTokenValidateOptions {
-    nonce?: string;
-    maxAge?: number;
-    organization?: string;
-}
-export declare class IDTokenValidator {
-    private jwks;
-    private alg;
-    private audience;
-    private issuer;
-    private clockTolerance;
-    private secret;
-    constructor({ domain, clientId, clientSecret, headers, timeoutDuration, idTokenSigningAlg, clockTolerance, }: AuthenticationClientOptions);
-    validate(idToken: string, { nonce, maxAge, organization }?: IDTokenValidateOptions): Promise<void>;
-}

package/dist/esm/auth/id-token-validator.mjs

@@ -1,120 +0,0 @@
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-import * as jose from "jose";
-const DEFAULT_CLOCK_TOLERANCE = 60; // secs
-export class IdTokenValidatorError extends Error {
-}
-export class IDTokenValidator {
-    constructor({ domain, clientId, clientSecret, headers, timeoutDuration, idTokenSigningAlg = "RS256", clockTolerance = DEFAULT_CLOCK_TOLERANCE, }) {
-        this.jwks = jose.createRemoteJWKSet(new URL(`https://${domain}/.well-known/jwks.json`), {
-            timeoutDuration,
-            headers,
-        });
-        this.alg = idTokenSigningAlg;
-        this.audience = clientId;
-        this.secret = new TextEncoder().encode(clientSecret);
-        this.issuer = `https://${domain}/`;
-        this.clockTolerance = clockTolerance;
-    }
-    validate(idToken_1) {
-        return __awaiter(this, arguments, void 0, function* (idToken, { nonce, maxAge, organization } = {}) {
-            const secret = this.alg === "HS256" ? this.secret : this.jwks;
-            const header = jose.decodeProtectedHeader(idToken);
-            const payload = jose.decodeJwt(idToken);
-            // Check algorithm
-            if (header.alg !== "RS256" && header.alg !== "HS256") {
-                throw new Error(`Signature algorithm of "${header.alg}" is not supported. Expected the ID token to be signed with "RS256" or "HS256".`);
-            }
-            // Issuer
-            if (!payload.iss || typeof payload.iss !== "string") {
-                throw new IdTokenValidatorError("Issuer (iss) claim must be a string present in the ID token");
-            }
-            if (payload.iss !== this.issuer) {
-                throw new IdTokenValidatorError(`Issuer (iss) claim mismatch in the ID token; expected "${this.issuer}", found "${payload.iss}"`);
-            }
-            // Subject
-            if (!payload.sub || typeof payload.sub !== "string") {
-                throw new IdTokenValidatorError("Subject (sub) claim must be a string present in the ID token");
-            }
-            // Audience
-            if (!payload.aud || !(typeof payload.aud === "string" || Array.isArray(payload.aud))) {
-                throw new IdTokenValidatorError("Audience (aud) claim must be a string or array of strings present in the ID token");
-            }
-            if (Array.isArray(payload.aud) && !payload.aud.includes(this.audience)) {
-                throw new IdTokenValidatorError(`Audience (aud) claim mismatch in the ID token; expected "${this.audience}" but was not one of "${payload.aud.join(", ")}"`);
-            }
-            else if (typeof payload.aud === "string" && payload.aud !== this.audience) {
-                throw new IdTokenValidatorError(`Audience (aud) claim mismatch in the ID token; expected "${this.audience}" but found "${payload.aud}"`);
-            }
-            // Organization
-            if (organization) {
-                if (organization.indexOf("org_") === 0) {
-                    if (!payload.org_id || typeof payload.org_id !== "string") {
-                        throw new Error("Organization Id (org_id) claim must be a string present in the ID token");
-                    }
-                }
-                else {
-                    if (!payload.org_name || typeof payload.org_name !== "string") {
-                        throw new Error("Organization Name (org_name) claim must be a string present in the ID token");
-                    }
-                }
-            }
-            // Time validation (epoch)
-            const now = Math.floor(Date.now() / 1000);
-            // Expires at
-            if (!payload.exp || typeof payload.exp !== "number") {
-                throw new IdTokenValidatorError("Expiration Time (exp) claim must be a number present in the ID token");
-            }
-            const expTime = payload.exp + this.clockTolerance;
-            if (now > expTime) {
-                throw new IdTokenValidatorError(`Expiration Time (exp) claim error in the ID token; current time (${now}) is after expiration time (${expTime})`);
-            }
-            // Issued at
-            if (!payload.iat || typeof payload.iat !== "number") {
-                throw new IdTokenValidatorError("Issued At (iat) claim must be a number present in the ID token");
-            }
-            // Nonce
-            if (nonce || payload.nonce) {
-                if (!payload.nonce || typeof payload.nonce !== "string") {
-                    throw new IdTokenValidatorError("Nonce (nonce) claim must be a string present in the ID token");
-                }
-                if (payload.nonce !== nonce) {
-                    throw new IdTokenValidatorError(`Nonce (nonce) claim mismatch in the ID token; expected "${nonce}", found "${payload.nonce}"`);
-                }
-            }
-            // Authorized party
-            if (Array.isArray(payload.aud) && payload.aud.length > 1) {
-                if (!payload.azp || typeof payload.azp !== "string") {
-                    throw new IdTokenValidatorError("Authorized Party (azp) claim must be a string present in the ID token when Audience (aud) claim has multiple values");
-                }
-                if (payload.azp !== this.audience) {
-                    throw new IdTokenValidatorError(`Authorized Party (azp) claim mismatch in the ID token; expected "${this.audience}", found "${payload.azp}"`);
-                }
-            }
-            // Authentication time
-            if (maxAge) {
-                if (!payload.auth_time || typeof payload.auth_time !== "number") {
-                    throw new IdTokenValidatorError("Authentication Time (auth_time) claim must be a number present in the ID token when Max Age (max_age) is specified");
-                }
-                const authValidUntil = payload.auth_time + maxAge + this.clockTolerance;
-                if (now > authValidUntil) {
-                    throw new IdTokenValidatorError(`Authentication Time (auth_time) claim in the ID token indicates that too much time has passed since the last end-user authentication. Currrent time (${now}) is after last auth at ${authValidUntil}`);
-                }
-            }
-            yield jose.jwtVerify(idToken, secret, {
-                issuer: this.issuer,
-                audience: this.audience,
-                clockTolerance: this.clockTolerance,
-                maxTokenAge: maxAge,
-                algorithms: ["HS256", "RS256"],
-            });
-        });
-    }
-}

package/dist/esm/auth/index.d.mts

@@ -1,65 +0,0 @@
-import { IBackchannel } from "./backchannel.mjs";
-import { AuthenticationClientOptions } from "./base-auth-api.mjs";
-import { Database } from "./database.mjs";
-import { OAuth } from "./oauth.mjs";
-import { Passwordless } from "./passwordless.mjs";
-import { ICustomTokenExchange } from "./tokenExchange.mjs";
-export * from "./database.mjs";
-export * from "./oauth.mjs";
-export * from "./passwordless.mjs";
-export { IDTokenValidateOptions, IdTokenValidatorError } from "./id-token-validator.mjs";
-export { AuthApiError, AuthenticationClientOptions } from "./base-auth-api.mjs";
-/**
- * Auth0 Authentication API Client
- *
- * Provides access to Auth0's authentication endpoints for login, signup,
- * passwordless authentication, and token exchange operations.
- *
- * @group Authentication API
- *
- * @example Basic setup
- * ```typescript
- * import { AuthenticationClient } from 'auth0';
- *
- * const auth0 = new AuthenticationClient({
- *   domain: 'your-tenant.auth0.com',
- *   clientId: 'your-client-id'
- * });
- * ```
- *
- * @example OAuth login
- * ```typescript
- * // Exchange authorization code for tokens
- * const tokenSet = await auth0.oauth.authorizationCodeGrant({
- *   code: 'auth-code',
- *   redirect_uri: 'https://app.example.com/callback'
- * });
- * ```
- *
- * @example Database operations
- * ```typescript
- * // Create user
- * const user = await auth0.database.signUp({
- *   connection: 'Username-Password-Authentication',
- *   username: 'john@example.com',
- *   password: 'secure-password123'
- * });
- * ```
- */
-export declare class AuthenticationClient {
-    /** Database connection operations (signup, change password) */
-    database: Database;
-    /** OAuth 2.0 and OIDC operations (authorization, token exchange) */
-    oauth: OAuth;
-    /** Passwordless authentication (email/SMS) */
-    passwordless: Passwordless;
-    /** Back-channel authentication (CIBA) */
-    backchannel: IBackchannel;
-    /** Custom token exchange operations */
-    tokenExchange: ICustomTokenExchange;
-    /**
-     * Create a new Authentication API client
-     * @param options - Configuration options for the client
-     */
-    constructor(options: AuthenticationClientOptions);
-}

package/dist/esm/auth/index.mjs

@@ -1,60 +0,0 @@
-import { Backchannel } from "./backchannel.mjs";
-import { Database } from "./database.mjs";
-import { OAuth } from "./oauth.mjs";
-import { Passwordless } from "./passwordless.mjs";
-import { CustomTokenExchange } from "./tokenExchange.mjs";
-export * from "./database.mjs";
-export * from "./oauth.mjs";
-export * from "./passwordless.mjs";
-export { IdTokenValidatorError } from "./id-token-validator.mjs";
-export { AuthApiError } from "./base-auth-api.mjs";
-/**
- * Auth0 Authentication API Client
- *
- * Provides access to Auth0's authentication endpoints for login, signup,
- * passwordless authentication, and token exchange operations.
- *
- * @group Authentication API
- *
- * @example Basic setup
- * ```typescript
- * import { AuthenticationClient } from 'auth0';
- *
- * const auth0 = new AuthenticationClient({
- *   domain: 'your-tenant.auth0.com',
- *   clientId: 'your-client-id'
- * });
- * ```
- *
- * @example OAuth login
- * ```typescript
- * // Exchange authorization code for tokens
- * const tokenSet = await auth0.oauth.authorizationCodeGrant({
- *   code: 'auth-code',
- *   redirect_uri: 'https://app.example.com/callback'
- * });
- * ```
- *
- * @example Database operations
- * ```typescript
- * // Create user
- * const user = await auth0.database.signUp({
- *   connection: 'Username-Password-Authentication',
- *   username: 'john@example.com',
- *   password: 'secure-password123'
- * });
- * ```
- */
-export class AuthenticationClient {
-    /**
-     * Create a new Authentication API client
-     * @param options - Configuration options for the client
-     */
-    constructor(options) {
-        this.database = new Database(options);
-        this.oauth = new OAuth(options);
-        this.passwordless = new Passwordless(options);
-        this.backchannel = new Backchannel(options);
-        this.tokenExchange = new CustomTokenExchange(options);
-    }
-}