auth0 7.6.0 → 7.7.0

package/dist/esm/management/api/types/types.mjs

@@ -756,6 +756,18 @@ export const OauthScope = {
     /**
      * Delete Organization Client Associations */
     DeleteOrganizationClients: "delete:organization_clients",
+    /**
+     * Create Universal Portals */
+    CreatePortals: "create:portals",
+    /**
+     * Read Universal Portals */
+    ReadPortals: "read:portals",
+    /**
+     * Update Universal Portals */
+    UpdatePortals: "update:portals",
+    /**
+     * Delete Universal Portals */
+    DeletePortals: "delete:portals",
     /**
      * Create Network ACL Keys */
     CreateNetworkAclKeys: "create:network_acl_keys",
@@ -778,6 +790,12 @@ export var TooManyRequestsErrorBody;
         TooManyRequests: "Too Many Requests",
     };
 })(TooManyRequestsErrorBody || (TooManyRequestsErrorBody = {}));
+export var InternalServerErrorBody;
+(function (InternalServerErrorBody) {
+    InternalServerErrorBody.Error_ = {
+        InternalServerError: "Internal Server Error",
+    };
+})(InternalServerErrorBody || (InternalServerErrorBody = {}));
 /** How the action is being referred to: `action_id` or `action_name`. */
 export const ActionBindingRefTypeEnum = {
     BindingId: "binding_id",
@@ -1251,6 +1269,13 @@ export const ClientProfileApplyPolicyExternalMetadataCreatedByEnum = {
 export const ClientProfileApplyPolicyExternalMetadataTypeEnum = {
     Cimd: "cimd",
 };
+/** Optional OIDC scope that matched clients may be granted. */
+export const ClientProfileClientConfigurationOidcSupportAllowedScopesEnum = {
+    Profile: "profile",
+    Email: "email",
+    Address: "address",
+    Phone: "phone",
+};
 /** A method used to discover a user's organization. */
 export const ClientProfileClientConfigurationOrganizationDiscoveryMethodEnum = {
     Email: "email",
@@ -1974,7 +1999,7 @@ export const ConnectionTokenEndpointAuthSigningAlgEnum = {
     Rs384: "RS384",
     Rs512: "RS512",
 };
-/** Specifies the format of the aud (audience) claim included in the JWT used for client authentication at the token endpoint. Accepted values are: 'issuer' (the aud claim is set to the OIDC issuer URL) or 'token_endpoint' (the aud claim is set to the token endpoint URL). */
+/** Specifies the format of the aud (audience) claim included in the JWT used for client authentication at the token endpoint. Accepted values are: 'issuer' (the aud claim is set to the identity provider's issuer URL) or 'token_endpoint' (the aud claim is set to the token endpoint URL). */
 export const ConnectionTokenEndpointJwtcaAudFormatEnumOidc = {
     Issuer: "issuer",
     TokenEndpoint: "token_endpoint",
@@ -6737,6 +6762,23 @@ export const OrganizationUsageEnum = {
     Allow: "allow",
     Require: "require",
 };
+/** Horizontal alignment of the image within its container. */
+export const Position = {
+    Left: "left",
+    Center: "center",
+    Right: "right",
+};
+/** Controls the section container style. */
+export const PageComponentAuth0StructureSectionVariantEnum = {
+    Card: "card",
+    None: "none",
+};
+/** Controls the line style. Defaults to "solid". */
+export const PageComponentAuth0StructureSeparatorVariantEnum = {
+    Dashed: "dashed",
+    None: "none",
+    Solid: "solid",
+};
 /** Name of the prompt. */
 export const PartialGroupsEnum = {
     Login: "login",
@@ -6807,6 +6849,18 @@ export const PhoneTemplateNotificationTypeEnum = {
     BlockedAccount: "blocked_account",
     PasswordBreach: "password_breach",
 };
+export var PortalClientSecretPost;
+(function (PortalClientSecretPost) {
+    PortalClientSecretPost.TokenEndpointAuthMethod = {
+        ClientSecretPost: "client_secret_post",
+    };
+})(PortalClientSecretPost || (PortalClientSecretPost = {}));
+export var PortalClientSecretPostRequest;
+(function (PortalClientSecretPostRequest) {
+    PortalClientSecretPostRequest.TokenEndpointAuthMethod = {
+        ClientSecretPost: "client_secret_post",
+    };
+})(PortalClientSecretPostRequest || (PortalClientSecretPostRequest = {}));
 /** Selected Signing Algorithm */
 export const PostConnectionKeysAlgEnum = {
     Rs256: "RS256",
@@ -6975,6 +7029,16 @@ export const RefreshTokenRotationTypeEnum = {
     Rotating: "rotating",
     NonRotating: "non-rotating",
 };
+/** Controls whether access tokens issued for this API include agent subject claims. With <code>auth0-v1</code>, access tokens include additional claims that identify whether the subject is a <code>user</code>, <code>service</code>, or <code>ai_agent</code>. The <code>sub</code> claim can reference an agent ID, and the <code>@clients</code> suffix is no longer appended to client IDs. With <code>off</code>, these claims are not included and the <code>@clients</code> suffix is still appended. When not set, the API behaves as <code>off</code>. */
+export const ResourceServerAgentSubjectClaimsResponseEnum = {
+    Off: "off",
+    Auth0V1: "auth0-v1",
+};
+/** Controls whether access tokens issued for this API include agent subject claims. With <code>auth0-v1</code>, access tokens include additional claims that identify whether the subject is a <code>user</code>, <code>service</code>, or <code>ai_agent</code>. The <code>sub</code> claim can reference an agent ID, and the <code>@clients</code> suffix is no longer appended to client IDs. With <code>off</code>, these claims are not included and the <code>@clients</code> suffix is still appended. When not set, the API behaves as <code>off</code>. */
+export const ResourceServerAgentSubjectClaimsSchemaEnum = {
+    Off: "off",
+    Auth0V1: "auth0-v1",
+};
 export const ResourceServerConsentPolicyEnum = {
     TransactionalAuthorizationWithMfa: "transactional-authorization-with-mfa",
 };
@@ -7034,6 +7098,10 @@ export const ResourceServerTokenEncryptionAlgorithmEnum = {
 export const ResourceServerTokenEncryptionFormatEnum = {
     CompactNestedJwe: "compact-nested-jwe",
 };
+/** The type of the resource server. */
+export const ResourceServerTypeEnum = {
+    UniversalCommerceProtocolServer: "universal_commerce_protocol_server",
+};
 /** The type of the role */
 export const RoleTypeEnum = {
     Tenant: "tenant",
@@ -7154,6 +7222,7 @@ export const SearchParserEnum = {
     Scim: "scim",
     Lucene: "lucene",
 };
+/** Filter by status. Exact match. */
 export const SegmentStatusEnum = {
     Active: "active",
     Archived: "archived",

package/dist/esm/management/version.d.mts

@@ -1 +1 @@
-export declare const SDK_VERSION = "7.6.0";
+export declare const SDK_VERSION = "7.7.0";

package/dist/esm/management/version.mjs

@@ -1 +1 @@
-export const SDK_VERSION = "7.6.0";
+export const SDK_VERSION = "7.7.0";

package/dist/esm/management/wrapper/ManagementClient.d.mts

@@ -16,7 +16,10 @@ export declare namespace ManagementClient {
      * @public
      */
     interface ManagementClientOptions extends Omit<FernClient.Options, "token" | "environment" | "fetcher" | "baseUrl"> {
-        /** Auth0 domain (e.g., 'your-tenant.auth0.com') */
+        /**
+         * Auth0 domain as a bare hostname (e.g., 'your-tenant.auth0.com'), without a scheme or path.
+         * The client throws at construction if the domain is empty or is not a bare hostname.
+         */
         domain: string;
         /**
          * API audience. Defaults to https://{domain}/api/v2/

package/dist/esm/management/wrapper/ManagementClient.mjs

@@ -1,6 +1,6 @@
 import { ManagementClient as FernClient } from "../Client.mjs";
 import { withCustomDomainHeader } from "../request-options.mjs";
-import { createTelemetryHeaders, createTokenSupplier } from "./auth-helpers.mjs";
+import { buildManagementBaseUrl, createTelemetryHeaders, createTokenSupplier } from "./auth-helpers.mjs";
 /**
  * Auth0 Management API client wrapper.
  *
@@ -66,7 +66,8 @@ export class ManagementClient extends FernClient {
      * @group Management API
      */
     constructor(_options) {
-        const baseUrl = `https://${_options.domain}/api/v2`;
+        // Validates the domain before anything else, so a static token is covered as well as client credentials.
+        const baseUrl = buildManagementBaseUrl(_options.domain);
         const headers = createTelemetryHeaders(_options);
         const token = createTokenSupplier(_options);
         // Temporarily remove fetcher from options to avoid people passing it for now

package/dist/esm/management/wrapper/auth-helpers.d.mts

@@ -18,6 +18,9 @@ export type ManagementAuthConfig = ManagementClient.ManagementClientOptionsWithT
 /**
  * Builds the Management API v2 base URL for a tenant domain.
  *
+ * The domain is validated first, so every caller rejects a domain that is not a bare hostname,
+ * whichever authentication mode is in use.
+ *
  * @group Management API
  * @internal
  */

package/dist/esm/management/wrapper/auth-helpers.mjs

@@ -1,12 +1,17 @@
 import { TokenProvider } from "./token-provider.mjs";
+import { validateDomain } from "./domain.mjs";
 import { Auth0ClientTelemetry } from "../../lib/middleware/auth0-client-telemetry.mjs";
 /**
  * Builds the Management API v2 base URL for a tenant domain.
  *
+ * The domain is validated first, so every caller rejects a domain that is not a bare hostname,
+ * whichever authentication mode is in use.
+ *
  * @group Management API
  * @internal
  */
 export function buildManagementBaseUrl(domain) {
+    validateDomain(domain);
     return `https://${domain}/api/v2`;
 }
 /**

package/dist/esm/management/wrapper/domain.d.mts

@@ -0,0 +1,12 @@
+/**
+ * Validates that a domain is a bare hostname such as `tenant.auth0.com`, optionally with a port.
+ *
+ * Throws when the domain is missing, empty or whitespace-only, or contains a scheme, path, query
+ * string, fragment, credentials, or whitespace. Both the Management API base URL and the token
+ * endpoint are built from the domain, so it is validated at construction for every authentication
+ * mode.
+ *
+ * @group Management API
+ * @internal
+ */
+export declare function validateDomain(domain: unknown): asserts domain is string;

package/dist/esm/management/wrapper/domain.mjs

@@ -0,0 +1,25 @@
+/**
+ * Characters that cannot appear in a bare hostname. Each one changes the host or path of the URLs
+ * built from the domain: `/` and `\` start a path (URL parsers treat `\` like `/`), `?` and `#`
+ * start a query string or fragment, `@` turns the text before it into credentials and sends the
+ * request to the host after it, and whitespace is never part of a hostname.
+ */
+const INVALID_DOMAIN_CHARACTERS = /[\s/\\?#@]/;
+/**
+ * Validates that a domain is a bare hostname such as `tenant.auth0.com`, optionally with a port.
+ *
+ * Throws when the domain is missing, empty or whitespace-only, or contains a scheme, path, query
+ * string, fragment, credentials, or whitespace. Both the Management API base URL and the token
+ * endpoint are built from the domain, so it is validated at construction for every authentication
+ * mode.
+ *
+ * @group Management API
+ * @internal
+ */
+export function validateDomain(domain) {
+    if (typeof domain !== "string" || domain.length === 0 || INVALID_DOMAIN_CHARACTERS.test(domain)) {
+        // JSON.stringify makes an empty value or stray whitespace visible in the message.
+        const received = typeof domain === "string" ? JSON.stringify(domain) : String(domain);
+        throw new Error(`ManagementClient: invalid domain ${received}. Provide a bare hostname, e.g. "tenant.auth0.com".`);
+    }
+}

package/dist/esm/management/wrapper/management-auth.d.mts

@@ -63,7 +63,8 @@ export interface ManagementAuth {
  *
  * When client credentials are provided, tokens are obtained via the client credentials grant
  * and cached until shortly before they expire. When a static `token` is provided, it is used
- * as-is.
+ * as-is. In both cases, `domain` must be a bare hostname such as `tenant.auth0.com`; anything
+ * else throws.
  *
  * The returned {@link ManagementAuth.clientOptions} carry the same telemetry headers, request
  * timeouts, retry counts, logging, and custom domain behaviour that the full `ManagementClient`

package/dist/esm/management/wrapper/management-auth.mjs

@@ -9,7 +9,8 @@ import { buildManagementBaseUrl, createTelemetryHeaders, createTokenSupplier, }
  *
  * When client credentials are provided, tokens are obtained via the client credentials grant
  * and cached until shortly before they expire. When a static `token` is provided, it is used
- * as-is.
+ * as-is. In both cases, `domain` must be a bare hostname such as `tenant.auth0.com`; anything
+ * else throws.
  *
  * The returned {@link ManagementAuth.clientOptions} carry the same telemetry headers, request
  * timeouts, retry counts, logging, and custom domain behaviour that the full `ManagementClient`

package/dist/esm/management/wrapper/token-provider.mjs

@@ -10,16 +10,16 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 import { base64url, importPKCS8, SignJWT } from "jose";
 import { generateClientInfo } from "../../utils.mjs";
 import { ManagementError } from "../errors/ManagementError.mjs";
+import { validateDomain } from "./domain.mjs";
 const LEEWAY = 10 * 1000; // 10s refresh-ahead in ms
 export class TokenProvider {
     constructor(options) {
         this.options = options;
         this.expiresAt = 0;
         this.accessToken = "";
-        // Validate domain: must be a bare hostname, no slashes or query strings.
-        if (/[/?#]/.test(options.domain)) {
-            throw new Error(`ManagementClient: invalid domain "${options.domain}". Provide a bare hostname, e.g. "tenant.auth0.com".`);
-        }
+        // TokenProvider is exported and can be constructed directly, so it validates the domain itself
+        // rather than relying on ManagementClient or createManagementAuth having done so.
+        validateDomain(options.domain);
         if (options.useMTLS) {
             const { fetch: customFetch } = options;
             if (!customFetch) {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "auth0",
-    "version": "7.6.0",
+    "version": "7.7.0",
     "private": false,
     "repository": {
         "type": "git",
@@ -287,6 +287,17 @@
             },
             "default": "./dist/cjs/management/api/resources/organizations/exports.js"
         },
+        "./portals": {
+            "import": {
+                "types": "./dist/esm/management/api/resources/portals/exports.d.mts",
+                "default": "./dist/esm/management/api/resources/portals/exports.mjs"
+            },
+            "require": {
+                "types": "./dist/cjs/management/api/resources/portals/exports.d.ts",
+                "default": "./dist/cjs/management/api/resources/portals/exports.js"
+            },
+            "default": "./dist/cjs/management/api/resources/portals/exports.js"
+        },
         "./prompts": {
             "import": {
                 "types": "./dist/esm/management/api/resources/prompts/exports.d.mts",