auth0 6.4.0 → 7.1.0

package/dist/esm/auth/tokenExchange.d.mts

@@ -1,166 +0,0 @@
-import { BaseAuthAPI } from "./base-auth-api.mjs";
-/**
- * Represents the configuration options required for initiating a Custom Token Exchange request
- * following RFC 8693 specifications.
- *
- * @see {@link https://www.rfc-editor.org/rfc/rfc8693 | RFC 8693: OAuth 2.0 Token Exchange}
- */
-export type CustomTokenExchangeOptions = {
-    /**
-     * The type identifier for the subject token being exchanged
-     *
-     * @pattern
-     * - Must be a namespaced URI under your organization's control
-     * - Forbidden patterns:
-     *   - `^urn:ietf:params:oauth:*` (IETF reserved)
-     *   - `^https:\/\/auth0\.com/*` (Auth0 reserved)
-     *   - `^urn:auth0:*` (Auth0 reserved)
-     *
-     * @example
-     * "urn:acme:legacy-system-token"
-     * "https://api.yourcompany.com/token-type/v1"
-     */
-    subject_token_type: string;
-    /**
-     * The opaque token value being exchanged for Auth0 tokens
-     *
-     * @security
-     * - Must be validated in Auth0 Actions using strong cryptographic verification
-     * - Implement replay attack protection
-     * - Recommended validation libraries: `jose`, `jsonwebtoken`
-     *
-     * @example
-     * "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
-     */
-    subject_token: string;
-    /**
-     * The target audience for the requested Auth0 token
-     *
-     * @remarks
-     * Must match exactly with an API identifier configured in your Auth0 tenant
-     *
-     * @example
-     * "https://api.your-service.com/v1"
-     */
-    audience: string;
-    /**
-     * Space-separated list of OAuth 2.0 scopes being requested
-     *
-     * @remarks
-     * Subject to API authorization policies configured in Auth0
-     *
-     * @example
-     * "openid profile email read:data write:data"
-     */
-    scope?: string;
-    /**
-     * Additional custom parameters for Auth0 Action processing
-     *
-     * @remarks
-     * Accessible in Action code via `event.request.body`
-     *
-     * @example
-     * ```typescript
-     * {
-     *   custom_parameter: "session_context",
-     *   device_fingerprint: "a3d8f7...",
-     * }
-     * ```
-     */
-    [key: string]: unknown;
-};
-/**
- * Interface defining Custom Token Exchange operations
- *
- * @see {@link https://auth0.com/docs/authenticate/protocols/custom-token-exchange | Auth0 Custom Token Exchange Docs}
- */
-export interface ICustomTokenExchange {
-    /**
-     * Executes RFC 8693-compliant token exchange flow
-     *
-     * @throws {Auth0Error} For structured error responses
-     * @throws {Error} For generic errors with these codes:
-     * - `invalid_request`: Invalid parameters
-     * - `consent_required`: Enable "Allow Skipping User Consent" in API settings
-     * - `too_many_attempts`: Suspicious IP throttling triggered
-     *
-     * @example
-     * ```typescript
-     * // External IdP migration scenario
-     * const tokens = await auth0.customTokenExchange.exchangeToken({
-     *   subject_token_type: 'urn:external-idp:legacy',
-     *   subject_token: externalIdPToken,
-     *   audience: 'https://api.your-service.com',
-     *   scope: 'openid profile'
-     * });
-     * ```
-     */
-    exchangeToken(options: CustomTokenExchangeOptions): Promise<TokenResponse>;
-}
-/**
- * Implements Auth0's Custom Token Exchange functionality with security best practices
- *
- * @security
- * - **HTTPS Enforcement**: All requests require TLS encryption
- * - **Credential Protection**: Client secrets never exposed in browser contexts
- * - **Input Validation**: Strict namespace enforcement for token types
- *
- * @example
- * ```typescript
- * // Secure token validation in Auth0 Action
- * exports.onExecuteCustomTokenExchange = async (event, api) => {
- *   const { jws } = require('jose');
- *   const { createRemoteJWKSet } = require('jose/jwks');
- *
- *   const JWKS = createRemoteJWKSet(new URL('https://external-idp.com/.well-known/jwks.json'));
- *
- *   try {
- *     const { payload } = await jws.verify(event.transaction.subject_token, JWKS);
- *     api.authentication.setUserById(payload.sub);
- *   } catch (error) {
- *     api.access.rejectInvalidSubjectToken('Invalid token signature');
- *   }
- * };
- * ```
- */
-export declare class CustomTokenExchange extends BaseAuthAPI implements ICustomTokenExchange {
-    /**
-     * Executes token exchange flow with security validations
-     *
-     * @param options - Exchange configuration parameters
-     * @returns Auth0-issued tokens with requested claims
-     *
-     * @throws {Error} When:
-     * - `subject_token_type` uses prohibited namespace
-     * - Network failures occur
-     * - Auth0 returns error responses (4xx/5xx)
-     */
-    exchangeToken(options: CustomTokenExchangeOptions): Promise<TokenResponse>;
-}
-/**
- * Standardized token response structure for Auth0 authentication flows
- *
- * @remarks
- * **Token Lifetime Management**:
- * - Cache tokens according to `expires_in` value
- * - Rotate refresh tokens using `offline_access` scope
- * - Revoke compromised tokens immediately
- *
- * @security
- * - Store tokens in secure, encrypted storage
- * - Never expose in client-side code or logs
- */
-export type TokenResponse = {
-    /** Bearer token for API authorization */
-    access_token: string;
-    /** Refresh token (requires `offline_access` scope) */
-    refresh_token?: string;
-    /** JWT containing user identity claims */
-    id_token: string;
-    /** Typically "Bearer" */
-    token_type?: string;
-    /** Token validity in seconds (default: 86400) */
-    expires_in: number;
-    /** Granted permissions space */
-    scope: string;
-};

package/dist/esm/auth/tokenExchange.mjs

@@ -1,70 +0,0 @@
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-import { JSONApiResponse } from "../lib/models.mjs";
-import { BaseAuthAPI } from "./base-auth-api.mjs";
-/** RFC 8693-defined grant type for token exchange */
-const TOKEN_EXCHANGE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:token-exchange";
-/** Auth0 token endpoint path */
-const TOKEN_URL = "/oauth/token";
-/**
- * Implements Auth0's Custom Token Exchange functionality with security best practices
- *
- * @security
- * - **HTTPS Enforcement**: All requests require TLS encryption
- * - **Credential Protection**: Client secrets never exposed in browser contexts
- * - **Input Validation**: Strict namespace enforcement for token types
- *
- * @example
- * ```typescript
- * // Secure token validation in Auth0 Action
- * exports.onExecuteCustomTokenExchange = async (event, api) => {
- *   const { jws } = require('jose');
- *   const { createRemoteJWKSet } = require('jose/jwks');
- *
- *   const JWKS = createRemoteJWKSet(new URL('https://external-idp.com/.well-known/jwks.json'));
- *
- *   try {
- *     const { payload } = await jws.verify(event.transaction.subject_token, JWKS);
- *     api.authentication.setUserById(payload.sub);
- *   } catch (error) {
- *     api.access.rejectInvalidSubjectToken('Invalid token signature');
- *   }
- * };
- * ```
- */
-export class CustomTokenExchange extends BaseAuthAPI {
-    /**
-     * Executes token exchange flow with security validations
-     *
-     * @param options - Exchange configuration parameters
-     * @returns Auth0-issued tokens with requested claims
-     *
-     * @throws {Error} When:
-     * - `subject_token_type` uses prohibited namespace
-     * - Network failures occur
-     * - Auth0 returns error responses (4xx/5xx)
-     */
-    exchangeToken(options) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const body = Object.assign(Object.assign({}, options), { grant_type: TOKEN_EXCHANGE_GRANT_TYPE, client_id: this.clientId });
-            yield this.addClientAuthentication(body);
-            const response = yield this.request({
-                path: TOKEN_URL,
-                method: "POST",
-                headers: {
-                    "Content-Type": "application/x-www-form-urlencoded",
-                },
-                body: new URLSearchParams(body),
-            }, {});
-            const r = yield JSONApiResponse.fromResponse(response);
-            return r.data;
-        });
-    }
-}

package/dist/esm/lib/index.d.mts

@@ -1,3 +0,0 @@
-export * from "./errors.mjs";
-export * from "./models.mjs";
-export { RetryConfiguration } from "./retry.mjs";

package/dist/esm/lib/index.mjs

@@ -1,2 +0,0 @@
-export * from "./errors.mjs";
-export * from "./models.mjs";

package/dist/esm/lib/runtime.d.mts

@@ -1,61 +0,0 @@
-import { RequestOpts, InitOverrideFunction, Configuration } from "./models.mjs";
-export * from "./models.mjs";
-/**
- * @private
- * This is the base class for all generated API classes.
- */
-export declare class BaseAPI {
-    protected configuration: Configuration;
-    private middleware;
-    private fetchApi;
-    private parseError;
-    private timeoutDuration;
-    constructor(configuration: Configuration);
-    protected request(context: RequestOpts, initOverrides?: RequestInit | InitOverrideFunction): Promise<Response>;
-    private createFetchParams;
-    private fetchWithTimeout;
-    private fetch;
-}
-/**
- * @private
- */
-export declare const COLLECTION_FORMATS: {
-    csv: string;
-    ssv: string;
-    tsv: string;
-    pipes: string;
-};
-/**
- * @private
- */
-export type ModelPropertyNaming = "camelCase" | "snake_case" | "PascalCase" | "original";
-/**
- * @private
- */
-export interface Consume {
-    contentType: string;
-}
-/**
- * @private
- */
-export declare function validateRequiredRequestParams<TRequestParams extends {
-    [key: string]: any;
-}>(requestParameters: TRequestParams, keys: Array<Extract<keyof TRequestParams, string>>): void;
-type QueryParamConfig = {
-    isArray?: boolean;
-    isCollectionFormatMulti?: boolean;
-    collectionFormat?: keyof typeof COLLECTION_FORMATS;
-};
-/**
- * @private
- */
-export declare function applyQueryParams<TRequestParams extends {
-    [key: string]: any;
-}, Key extends Extract<keyof TRequestParams, string>>(requestParameters: TRequestParams, keys: Array<{
-    key: Key;
-    config: QueryParamConfig;
-}>): Pick<TRequestParams, ReadonlyArray<Key>[number]>;
-/**
- * @private
- */
-export declare function parseFormParam(originalValue: number | boolean | string | Blob): Promise<string | Blob>;

package/dist/esm/lib/runtime.mjs

@@ -1,201 +0,0 @@
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-import { retry } from "./retry.mjs";
-import { FetchError, RequiredError, TimeoutError } from "./errors.mjs";
-export * from "./models.mjs";
-/**
- * @private
- * This is the base class for all generated API classes.
- */
-export class BaseAPI {
-    constructor(configuration) {
-        this.configuration = configuration;
-        this.fetchWithTimeout = (url, init) => __awaiter(this, void 0, void 0, function* () {
-            const controller = new AbortController();
-            const timeout = setTimeout(() => {
-                controller.abort();
-            }, this.timeoutDuration);
-            try {
-                return yield this.fetchApi(url, Object.assign({ signal: controller.signal }, init));
-            }
-            catch (e) {
-                if (e.name === "AbortError") {
-                    throw new TimeoutError();
-                }
-                throw e;
-            }
-            finally {
-                clearTimeout(timeout);
-            }
-        });
-        this.fetch = (url, init) => __awaiter(this, void 0, void 0, function* () {
-            var _a;
-            let fetchParams = { url, init };
-            for (const middleware of this.middleware) {
-                if (middleware.pre) {
-                    fetchParams =
-                        (yield middleware.pre(Object.assign({ fetch: this.fetchWithTimeout }, fetchParams))) || fetchParams;
-                }
-            }
-            let response = undefined;
-            let error = undefined;
-            try {
-                response =
-                    ((_a = this.configuration.retry) === null || _a === void 0 ? void 0 : _a.enabled) !== false
-                        ? yield retry(() => this.fetchWithTimeout(fetchParams.url, fetchParams.init), Object.assign({}, this.configuration.retry))
-                        : yield this.fetchWithTimeout(fetchParams.url, fetchParams.init);
-            }
-            catch (e) {
-                error = e;
-            }
-            if (error || !response.ok) {
-                for (const middleware of this.middleware) {
-                    if (middleware.onError) {
-                        response =
-                            (yield middleware.onError(Object.assign(Object.assign({ fetch: this.fetchWithTimeout }, fetchParams), { error, response: response ? response.clone() : undefined }))) || response;
-                    }
-                }
-                if (response === undefined) {
-                    throw new FetchError(error, "The request failed and the interceptors did not return an alternative response");
-                }
-            }
-            else {
-                for (const middleware of this.middleware) {
-                    if (middleware.post) {
-                        response =
-                            (yield middleware.post(Object.assign(Object.assign({ fetch: this.fetchApi }, fetchParams), { response: response.clone() }))) || response;
-                    }
-                }
-            }
-            return response;
-        });
-        if (configuration.baseUrl === null || configuration.baseUrl === undefined) {
-            throw new Error("Must provide a base URL for the API");
-        }
-        if ("string" !== typeof configuration.baseUrl || configuration.baseUrl.length === 0) {
-            throw new Error("The provided base URL is invalid");
-        }
-        this.middleware = configuration.middleware || [];
-        this.fetchApi = configuration.fetch || globalThis.fetch.bind(globalThis);
-        this.parseError = configuration.parseError;
-        this.timeoutDuration =
-            typeof configuration.timeoutDuration === "number" ? configuration.timeoutDuration : 10000;
-    }
-    request(context, initOverrides) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const { url, init } = yield this.createFetchParams(context, initOverrides);
-            const response = yield this.fetch(url, init);
-            if (response && response.status >= 200 && response.status < 300) {
-                return response;
-            }
-            const error = yield this.parseError(response);
-            throw error;
-        });
-    }
-    createFetchParams(context, initOverrides) {
-        return __awaiter(this, void 0, void 0, function* () {
-            let url = this.configuration.baseUrl + context.path;
-            if (context.query !== undefined && Object.keys(context.query).length !== 0) {
-                // only add the querystring to the URL if there are query parameters.
-                // this is done to avoid urls ending with a "?" character which buggy webservers
-                // do not handle correctly sometimes.
-                url += `?${querystring(context.query)}`;
-            }
-            const headers = Object.assign({}, this.configuration.headers, context.headers);
-            Object.keys(headers).forEach((key) => (headers[key] === undefined ? delete headers[key] : {}));
-            const initOverrideFn = typeof initOverrides === "function" ? initOverrides : () => __awaiter(this, void 0, void 0, function* () { return initOverrides; });
-            const initParams = {
-                method: context.method,
-                headers,
-                body: context.body,
-                dispatcher: this.configuration.agent,
-            };
-            const overriddenInit = Object.assign(Object.assign({}, initParams), (yield initOverrideFn({
-                init: initParams,
-                context,
-            })));
-            const init = Object.assign(Object.assign({}, overriddenInit), { body: overriddenInit.body instanceof FormData ||
-                    overriddenInit.body instanceof URLSearchParams ||
-                    overriddenInit.body instanceof Blob
-                    ? overriddenInit.body
-                    : JSON.stringify(overriddenInit.body) });
-            return { url, init };
-        });
-    }
-}
-/**
- * @private
- */
-export const COLLECTION_FORMATS = {
-    csv: ",",
-    ssv: " ",
-    tsv: "\t",
-    pipes: "|",
-};
-/**
- * @private
- */
-function querystring(params) {
-    return Object.keys(params)
-        .map((key) => querystringSingleKey(key, params[key]))
-        .filter((part) => part.length > 0)
-        .join("&");
-}
-function querystringSingleKey(key, value) {
-    if (value instanceof Array) {
-        const multiValue = value
-            .map((singleValue) => encodeURIComponent(String(singleValue)))
-            .join(`&${encodeURIComponent(key)}=`);
-        return `${encodeURIComponent(key)}=${multiValue}`;
-    }
-    return `${encodeURIComponent(key)}=${encodeURIComponent(String(value))}`;
-}
-/**
- * @private
- */
-export function validateRequiredRequestParams(requestParameters, keys) {
-    keys.forEach((key) => {
-        if (requestParameters[key] === null || requestParameters[key] === undefined) {
-            throw new RequiredError(key, `Required parameter requestParameters.${key} was null or undefined.`);
-        }
-    });
-}
-/**
- * @private
- */
-export function applyQueryParams(requestParameters, keys) {
-    return keys.reduce((acc, { key, config, }) => {
-        let value;
-        if (config.isArray) {
-            if (config.isCollectionFormatMulti) {
-                value = requestParameters[key];
-            }
-            else {
-                value = requestParameters[key].join(COLLECTION_FORMATS[config.collectionFormat]);
-            }
-        }
-        else {
-            if (requestParameters[key] !== undefined) {
-                value = requestParameters[key];
-            }
-        }
-        return value !== undefined ? Object.assign(Object.assign({}, acc), { [key]: value }) : acc;
-    }, {});
-}
-/**
- * @private
- */
-export function parseFormParam(originalValue) {
-    return __awaiter(this, void 0, void 0, function* () {
-        let value = originalValue;
-        value = typeof value == "number" || typeof value == "boolean" ? "" + value : value;
-        return value;
-    });
-}

package/dist/esm/management/api/resources/organizationTemplates/client/Client.d.mts

@@ -1,106 +0,0 @@
-import type { BaseClientOptions, BaseRequestOptions } from "../../../../BaseClient.mjs";
-import { type NormalizedClientOptionsWithAuth } from "../../../../BaseClient.mjs";
-import * as core from "../../../../core/index.mjs";
-import * as Management from "../../../index.mjs";
-export declare namespace OrganizationTemplatesClient {
-    type Options = BaseClientOptions;
-    interface RequestOptions extends BaseRequestOptions {
-    }
-}
-export declare class OrganizationTemplatesClient {
-    protected readonly _options: NormalizedClientOptionsWithAuth<OrganizationTemplatesClient.Options>;
-    constructor(options: OrganizationTemplatesClient.Options);
-    /**
-     * Retrieve a list of Organization Templates. This endpoint supports Checkpoint pagination. Results are returned in a stable order, sorted by their identifier (`id`) in ascending order.
-     *
-     * @param {Management.ListOrganizationTemplatesRequestParameters} request
-     * @param {OrganizationTemplatesClient.RequestOptions} requestOptions - Request-specific configuration.
-     *
-     * @throws {@link Management.BadRequestError}
-     * @throws {@link Management.UnauthorizedError}
-     * @throws {@link Management.ForbiddenError}
-     * @throws {@link Management.TooManyRequestsError}
-     *
-     * @example
-     *     await client.organizationTemplates.list({
-     *         from: "from",
-     *         take: 1
-     *     })
-     */
-    list(request?: Management.ListOrganizationTemplatesRequestParameters, requestOptions?: OrganizationTemplatesClient.RequestOptions): Promise<core.Page<Management.OrganizationTemplate, Management.ListOrganizationTemplatesPaginatedResponseContent>>;
-    /**
-     * Create an Organization Template.
-     *
-     * @param {Management.CreateOrganizationTemplateRequestContent} request
-     * @param {OrganizationTemplatesClient.RequestOptions} requestOptions - Request-specific configuration.
-     *
-     * @throws {@link Management.BadRequestError}
-     * @throws {@link Management.UnauthorizedError}
-     * @throws {@link Management.ForbiddenError}
-     * @throws {@link Management.ConflictError}
-     * @throws {@link Management.TooManyRequestsError}
-     *
-     * @example
-     *     await client.organizationTemplates.create({
-     *         name: "name",
-     *         organization_deletion_behavior: "allow",
-     *         enforce_permission_ceiling: true,
-     *         enforce_self_assignment_restriction: true
-     *     })
-     */
-    create(request: Management.CreateOrganizationTemplateRequestContent, requestOptions?: OrganizationTemplatesClient.RequestOptions): core.HttpResponsePromise<Management.OrganizationTemplate>;
-    private __create;
-    /**
-     * Retrieve details about a single Organization Template specified by ID.
-     *
-     * @param {string} id - Organization Template identifier.
-     * @param {OrganizationTemplatesClient.RequestOptions} requestOptions - Request-specific configuration.
-     *
-     * @throws {@link Management.UnauthorizedError}
-     * @throws {@link Management.ForbiddenError}
-     * @throws {@link Management.NotFoundError}
-     * @throws {@link Management.TooManyRequestsError}
-     *
-     * @example
-     *     await client.organizationTemplates.get("id")
-     */
-    get(id: string, requestOptions?: OrganizationTemplatesClient.RequestOptions): core.HttpResponsePromise<Management.OrganizationTemplate>;
-    private __get;
-    /**
-     * Update the details of a specific Organization Template.
-     *
-     * @param {string} id - Organization Template identifier.
-     * @param {Management.UpdateOrganizationTemplateRequestContent} request
-     * @param {OrganizationTemplatesClient.RequestOptions} requestOptions - Request-specific configuration.
-     *
-     * @throws {@link Management.BadRequestError}
-     * @throws {@link Management.UnauthorizedError}
-     * @throws {@link Management.ForbiddenError}
-     * @throws {@link Management.NotFoundError}
-     * @throws {@link Management.TooManyRequestsError}
-     *
-     * @example
-     *     await client.organizationTemplates.update("id")
-     */
-    update(id: string, request?: Management.UpdateOrganizationTemplateRequestContent, requestOptions?: OrganizationTemplatesClient.RequestOptions): core.HttpResponsePromise<Management.OrganizationTemplate>;
-    private __update;
-    /**
-     * Retrieve a list of organizations assigned to an Organization Template. This endpoint supports Checkpoint pagination. Results are returned in a stable order, sorted by their identifier (`id`) in ascending order.
-     *
-     * @param {string} id - The ID of the organization template.
-     * @param {Management.ListTemplateOrganizationsRequestParameters} request
-     * @param {OrganizationTemplatesClient.RequestOptions} requestOptions - Request-specific configuration.
-     *
-     * @throws {@link Management.BadRequestError}
-     * @throws {@link Management.UnauthorizedError}
-     * @throws {@link Management.ForbiddenError}
-     * @throws {@link Management.TooManyRequestsError}
-     *
-     * @example
-     *     await client.organizationTemplates.listOrganizations("id", {
-     *         from: "from",
-     *         take: 1
-     *     })
-     */
-    listOrganizations(id: string, request?: Management.ListTemplateOrganizationsRequestParameters, requestOptions?: OrganizationTemplatesClient.RequestOptions): Promise<core.Page<Management.OrganizationTemplateAssignedOrganization, Management.ListTemplateOrganizationsPaginatedResponseContent>>;
-}