auth0 7.5.0 → 7.7.0

package/dist/esm/management/errors/ManagementTimeoutError.mjs

@@ -1,14 +1,15 @@
 // This file was auto-generated by Fern from our API Definition.
-export class ManagementTimeoutError extends Error {
+import * as errors from "./index.mjs";
+export class ManagementTimeoutError extends errors.ManagementError {
     constructor(message, opts) {
-        super(message);
+        super({
+            message: message,
+            cause: opts === null || opts === void 0 ? void 0 : opts.cause,
+        });
         Object.setPrototypeOf(this, new.target.prototype);
         if (Error.captureStackTrace) {
             Error.captureStackTrace(this, this.constructor);
         }
         this.name = "ManagementTimeoutError";
-        if ((opts === null || opts === void 0 ? void 0 : opts.cause) != null) {
-            this.cause = opts.cause;
-        }
     }
 }

package/dist/esm/management/version.d.mts

@@ -1 +1 @@
-export declare const SDK_VERSION = "7.5.0";
+export declare const SDK_VERSION = "7.7.0";

package/dist/esm/management/version.mjs

@@ -1 +1 @@
-export const SDK_VERSION = "7.5.0";
+export const SDK_VERSION = "7.7.0";

package/dist/esm/management/wrapper/ManagementClient.d.mts

@@ -16,7 +16,10 @@ export declare namespace ManagementClient {
      * @public
      */
     interface ManagementClientOptions extends Omit<FernClient.Options, "token" | "environment" | "fetcher" | "baseUrl"> {
-        /** Auth0 domain (e.g., 'your-tenant.auth0.com') */
+        /**
+         * Auth0 domain as a bare hostname (e.g., 'your-tenant.auth0.com'), without a scheme or path.
+         * The client throws at construction if the domain is empty or is not a bare hostname.
+         */
         domain: string;
         /**
          * API audience. Defaults to https://{domain}/api/v2/

package/dist/esm/management/wrapper/ManagementClient.mjs

@@ -1,6 +1,6 @@
 import { ManagementClient as FernClient } from "../Client.mjs";
 import { withCustomDomainHeader } from "../request-options.mjs";
-import { createTelemetryHeaders, createTokenSupplier } from "./auth-helpers.mjs";
+import { buildManagementBaseUrl, createTelemetryHeaders, createTokenSupplier } from "./auth-helpers.mjs";
 /**
  * Auth0 Management API client wrapper.
  *
@@ -66,7 +66,8 @@ export class ManagementClient extends FernClient {
      * @group Management API
      */
     constructor(_options) {
-        const baseUrl = `https://${_options.domain}/api/v2`;
+        // Validates the domain before anything else, so a static token is covered as well as client credentials.
+        const baseUrl = buildManagementBaseUrl(_options.domain);
         const headers = createTelemetryHeaders(_options);
         const token = createTokenSupplier(_options);
         // Temporarily remove fetcher from options to avoid people passing it for now

package/dist/esm/management/wrapper/auth-helpers.d.mts

@@ -18,6 +18,9 @@ export type ManagementAuthConfig = ManagementClient.ManagementClientOptionsWithT
 /**
  * Builds the Management API v2 base URL for a tenant domain.
  *
+ * The domain is validated first, so every caller rejects a domain that is not a bare hostname,
+ * whichever authentication mode is in use.
+ *
  * @group Management API
  * @internal
  */

package/dist/esm/management/wrapper/auth-helpers.mjs

@@ -1,12 +1,17 @@
 import { TokenProvider } from "./token-provider.mjs";
+import { validateDomain } from "./domain.mjs";
 import { Auth0ClientTelemetry } from "../../lib/middleware/auth0-client-telemetry.mjs";
 /**
  * Builds the Management API v2 base URL for a tenant domain.
  *
+ * The domain is validated first, so every caller rejects a domain that is not a bare hostname,
+ * whichever authentication mode is in use.
+ *
  * @group Management API
  * @internal
  */
 export function buildManagementBaseUrl(domain) {
+    validateDomain(domain);
     return `https://${domain}/api/v2`;
 }
 /**

package/dist/esm/management/wrapper/domain.d.mts

@@ -0,0 +1,12 @@
+/**
+ * Validates that a domain is a bare hostname such as `tenant.auth0.com`, optionally with a port.
+ *
+ * Throws when the domain is missing, empty or whitespace-only, or contains a scheme, path, query
+ * string, fragment, credentials, or whitespace. Both the Management API base URL and the token
+ * endpoint are built from the domain, so it is validated at construction for every authentication
+ * mode.
+ *
+ * @group Management API
+ * @internal
+ */
+export declare function validateDomain(domain: unknown): asserts domain is string;

package/dist/esm/management/wrapper/domain.mjs

@@ -0,0 +1,25 @@
+/**
+ * Characters that cannot appear in a bare hostname. Each one changes the host or path of the URLs
+ * built from the domain: `/` and `\` start a path (URL parsers treat `\` like `/`), `?` and `#`
+ * start a query string or fragment, `@` turns the text before it into credentials and sends the
+ * request to the host after it, and whitespace is never part of a hostname.
+ */
+const INVALID_DOMAIN_CHARACTERS = /[\s/\\?#@]/;
+/**
+ * Validates that a domain is a bare hostname such as `tenant.auth0.com`, optionally with a port.
+ *
+ * Throws when the domain is missing, empty or whitespace-only, or contains a scheme, path, query
+ * string, fragment, credentials, or whitespace. Both the Management API base URL and the token
+ * endpoint are built from the domain, so it is validated at construction for every authentication
+ * mode.
+ *
+ * @group Management API
+ * @internal
+ */
+export function validateDomain(domain) {
+    if (typeof domain !== "string" || domain.length === 0 || INVALID_DOMAIN_CHARACTERS.test(domain)) {
+        // JSON.stringify makes an empty value or stray whitespace visible in the message.
+        const received = typeof domain === "string" ? JSON.stringify(domain) : String(domain);
+        throw new Error(`ManagementClient: invalid domain ${received}. Provide a bare hostname, e.g. "tenant.auth0.com".`);
+    }
+}

package/dist/esm/management/wrapper/management-auth.d.mts

@@ -63,7 +63,8 @@ export interface ManagementAuth {
  *
  * When client credentials are provided, tokens are obtained via the client credentials grant
  * and cached until shortly before they expire. When a static `token` is provided, it is used
- * as-is.
+ * as-is. In both cases, `domain` must be a bare hostname such as `tenant.auth0.com`; anything
+ * else throws.
  *
  * The returned {@link ManagementAuth.clientOptions} carry the same telemetry headers, request
  * timeouts, retry counts, logging, and custom domain behaviour that the full `ManagementClient`

package/dist/esm/management/wrapper/management-auth.mjs

@@ -9,7 +9,8 @@ import { buildManagementBaseUrl, createTelemetryHeaders, createTokenSupplier, }
  *
  * When client credentials are provided, tokens are obtained via the client credentials grant
  * and cached until shortly before they expire. When a static `token` is provided, it is used
- * as-is.
+ * as-is. In both cases, `domain` must be a bare hostname such as `tenant.auth0.com`; anything
+ * else throws.
  *
  * The returned {@link ManagementAuth.clientOptions} carry the same telemetry headers, request
  * timeouts, retry counts, logging, and custom domain behaviour that the full `ManagementClient`

package/dist/esm/management/wrapper/token-provider.mjs

@@ -10,16 +10,16 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 import { base64url, importPKCS8, SignJWT } from "jose";
 import { generateClientInfo } from "../../utils.mjs";
 import { ManagementError } from "../errors/ManagementError.mjs";
+import { validateDomain } from "./domain.mjs";
 const LEEWAY = 10 * 1000; // 10s refresh-ahead in ms
 export class TokenProvider {
     constructor(options) {
         this.options = options;
         this.expiresAt = 0;
         this.accessToken = "";
-        // Validate domain: must be a bare hostname, no slashes or query strings.
-        if (/[/?#]/.test(options.domain)) {
-            throw new Error(`ManagementClient: invalid domain "${options.domain}". Provide a bare hostname, e.g. "tenant.auth0.com".`);
-        }
+        // TokenProvider is exported and can be constructed directly, so it validates the domain itself
+        // rather than relying on ManagementClient or createManagementAuth having done so.
+        validateDomain(options.domain);
         if (options.useMTLS) {
             const { fetch: customFetch } = options;
             if (!customFetch) {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "auth0",
-    "version": "7.5.0",
+    "version": "7.7.0",
     "private": false,
     "repository": {
         "type": "git",
@@ -287,6 +287,17 @@
             },
             "default": "./dist/cjs/management/api/resources/organizations/exports.js"
         },
+        "./portals": {
+            "import": {
+                "types": "./dist/esm/management/api/resources/portals/exports.d.mts",
+                "default": "./dist/esm/management/api/resources/portals/exports.mjs"
+            },
+            "require": {
+                "types": "./dist/cjs/management/api/resources/portals/exports.d.ts",
+                "default": "./dist/cjs/management/api/resources/portals/exports.js"
+            },
+            "default": "./dist/cjs/management/api/resources/portals/exports.js"
+        },
         "./prompts": {
             "import": {
                 "types": "./dist/esm/management/api/resources/prompts/exports.d.mts",
@@ -606,17 +617,6 @@
             },
             "default": "./dist/cjs/management/api/resources/attackProtection/resources/captcha/exports.js"
         },
-        "./attackProtection/captchaPolicies": {
-            "import": {
-                "types": "./dist/esm/management/api/resources/attackProtection/resources/captchaPolicies/exports.d.mts",
-                "default": "./dist/esm/management/api/resources/attackProtection/resources/captchaPolicies/exports.mjs"
-            },
-            "require": {
-                "types": "./dist/cjs/management/api/resources/attackProtection/resources/captchaPolicies/exports.d.ts",
-                "default": "./dist/cjs/management/api/resources/attackProtection/resources/captchaPolicies/exports.js"
-            },
-            "default": "./dist/cjs/management/api/resources/attackProtection/resources/captchaPolicies/exports.js"
-        },
         "./attackProtection/phoneProviderProtection": {
             "import": {
                 "types": "./dist/esm/management/api/resources/attackProtection/resources/phoneProviderProtection/exports.d.mts",