init
This commit is contained in:
nucther committed
commit
d282e2bcae
3481 files changed
+568488
No files matched your search
+323
@@ -0,0 +1,323 @@
|
||||
import { Auth0ClientOptions, RedirectLoginOptions, PopupLoginOptions, PopupConfigOptions, RedirectLoginResult, GetTokenSilentlyOptions, GetTokenWithPopupOptions, LogoutOptions, User, IdToken, GetTokenSilentlyVerboseResponse, TokenEndpointResponse, ConnectAccountRedirectResult, RedirectConnectAccountOptions } from './global';
|
||||
import { CustomTokenExchangeOptions } from './TokenExchange';
|
||||
import { Dpop } from './dpop/dpop';
|
||||
import { Fetcher, type FetcherConfig, type CustomFetchMinimalOutput } from './fetcher';
|
||||
/**
|
||||
* Auth0 SDK for Single Page Applications using [Authorization Code Grant Flow with PKCE](https://auth0.com/docs/api-auth/tutorials/authorization-code-grant-pkce).
|
||||
*/
|
||||
export declare class Auth0Client {
|
||||
private readonly transactionManager;
|
||||
private readonly cacheManager;
|
||||
private readonly domainUrl;
|
||||
private readonly tokenIssuer;
|
||||
private readonly scope;
|
||||
private readonly cookieStorage;
|
||||
private readonly dpop;
|
||||
private readonly sessionCheckExpiryDays;
|
||||
private readonly orgHintCookieName;
|
||||
private readonly isAuthenticatedCookieName;
|
||||
private readonly nowProvider;
|
||||
private readonly httpTimeoutMs;
|
||||
private readonly options;
|
||||
private readonly userCache;
|
||||
private readonly myAccountApi;
|
||||
private worker?;
|
||||
private readonly activeLockKeys;
|
||||
private readonly defaultOptions;
|
||||
constructor(options: Auth0ClientOptions);
|
||||
private _url;
|
||||
private _authorizeUrl;
|
||||
private _verifyIdToken;
|
||||
private _processOrgHint;
|
||||
private _prepareAuthorizeUrl;
|
||||
/**
|
||||
* ```js
|
||||
* try {
|
||||
* await auth0.loginWithPopup(options);
|
||||
* } catch(e) {
|
||||
* if (e instanceof PopupCancelledError) {
|
||||
* // Popup was closed before login completed
|
||||
* }
|
||||
* }
|
||||
* ```
|
||||
*
|
||||
* Opens a popup with the `/authorize` URL using the parameters
|
||||
* provided as arguments. Random and secure `state` and `nonce`
|
||||
* parameters will be auto-generated. If the response is successful,
|
||||
* results will be valid according to their expiration times.
|
||||
*
|
||||
* IMPORTANT: This method has to be called from an event handler
|
||||
* that was started by the user like a button click, for example,
|
||||
* otherwise the popup will be blocked in most browsers.
|
||||
*
|
||||
* @param options
|
||||
* @param config
|
||||
*/
|
||||
loginWithPopup(options?: PopupLoginOptions, config?: PopupConfigOptions): Promise<void>;
|
||||
/**
|
||||
* ```js
|
||||
* const user = await auth0.getUser();
|
||||
* ```
|
||||
*
|
||||
* Returns the user information if available (decoded
|
||||
* from the `id_token`).
|
||||
*
|
||||
* @typeparam TUser The type to return, has to extend {@link User}.
|
||||
*/
|
||||
getUser<TUser extends User>(): Promise<TUser | undefined>;
|
||||
/**
|
||||
* ```js
|
||||
* const claims = await auth0.getIdTokenClaims();
|
||||
* ```
|
||||
*
|
||||
* Returns all claims from the id_token if available.
|
||||
*/
|
||||
getIdTokenClaims(): Promise<IdToken | undefined>;
|
||||
/**
|
||||
* ```js
|
||||
* await auth0.loginWithRedirect(options);
|
||||
* ```
|
||||
*
|
||||
* Performs a redirect to `/authorize` using the parameters
|
||||
* provided as arguments. Random and secure `state` and `nonce`
|
||||
* parameters will be auto-generated.
|
||||
*
|
||||
* @param options
|
||||
*/
|
||||
loginWithRedirect<TAppState = any>(options?: RedirectLoginOptions<TAppState>): Promise<void>;
|
||||
/**
|
||||
* After the browser redirects back to the callback page,
|
||||
* call `handleRedirectCallback` to handle success and error
|
||||
* responses from Auth0. If the response is successful, results
|
||||
* will be valid according to their expiration times.
|
||||
*/
|
||||
handleRedirectCallback<TAppState = any>(url?: string): Promise<RedirectLoginResult<TAppState> | ConnectAccountRedirectResult<TAppState>>;
|
||||
/**
|
||||
* Handles the redirect callback from the login flow.
|
||||
*
|
||||
* @template AppState - The application state persisted from the /authorize redirect.
|
||||
* @param {string} authenticationResult - The parsed authentication result from the URL.
|
||||
* @param {string} transaction - The login transaction.
|
||||
*
|
||||
* @returns {RedirectLoginResult} Resolves with the persisted app state.
|
||||
* @throws {GenericError | Error} If the transaction is missing, invalid, or the code exchange fails.
|
||||
*/
|
||||
private _handleLoginRedirectCallback;
|
||||
/**
|
||||
* Handles the redirect callback from the connect account flow.
|
||||
* This works the same as the redirect from the login flow expect it verifies the `connect_code`
|
||||
* with the My Account API rather than the `code` with the Authorization Server.
|
||||
*
|
||||
* @template AppState - The application state persisted from the connect redirect.
|
||||
* @param {string} connectResult - The parsed connect accounts result from the URL.
|
||||
* @param {string} transaction - The login transaction.
|
||||
* @returns {Promise<ConnectAccountRedirectResult>} The result of the My Account API, including any persisted app state.
|
||||
* @throws {GenericError | MyAccountApiError} If the transaction is missing, invalid, or an error is returned from the My Account API.
|
||||
*/
|
||||
private _handleConnectAccountRedirectCallback;
|
||||
/**
|
||||
* ```js
|
||||
* await auth0.checkSession();
|
||||
* ```
|
||||
*
|
||||
* Check if the user is logged in using `getTokenSilently`. The difference
|
||||
* with `getTokenSilently` is that this doesn't return a token, but it will
|
||||
* pre-fill the token cache.
|
||||
*
|
||||
* This method also heeds the `auth0.{clientId}.is.authenticated` cookie, as an optimization
|
||||
* to prevent calling Auth0 unnecessarily. If the cookie is not present because
|
||||
* there was no previous login (or it has expired) then tokens will not be refreshed.
|
||||
*
|
||||
* It should be used for silently logging in the user when you instantiate the
|
||||
* `Auth0Client` constructor. You should not need this if you are using the
|
||||
* `createAuth0Client` factory.
|
||||
*
|
||||
* **Note:** the cookie **may not** be present if running an app using a private tab, as some
|
||||
* browsers clear JS cookie data and local storage when the tab or page is closed, or on page reload. This effectively
|
||||
* means that `checkSession` could silently return without authenticating the user on page refresh when
|
||||
* using a private tab, despite having previously logged in. As a workaround, use `getTokenSilently` instead
|
||||
* and handle the possible `login_required` error [as shown in the readme](https://github.com/auth0/auth0-spa-js#creating-the-client).
|
||||
*
|
||||
* @param options
|
||||
*/
|
||||
checkSession(options?: GetTokenSilentlyOptions): Promise<void>;
|
||||
/**
|
||||
* Fetches a new access token and returns the response from the /oauth/token endpoint, omitting the refresh token.
|
||||
*
|
||||
* @param options
|
||||
*/
|
||||
getTokenSilently(options: GetTokenSilentlyOptions & {
|
||||
detailedResponse: true;
|
||||
}): Promise<GetTokenSilentlyVerboseResponse>;
|
||||
/**
|
||||
* Fetches a new access token and returns it.
|
||||
*
|
||||
* @param options
|
||||
*/
|
||||
getTokenSilently(options?: GetTokenSilentlyOptions): Promise<string>;
|
||||
private _getTokenSilently;
|
||||
/**
|
||||
* ```js
|
||||
* const token = await auth0.getTokenWithPopup(options);
|
||||
* ```
|
||||
* Opens a popup with the `/authorize` URL using the parameters
|
||||
* provided as arguments. Random and secure `state` and `nonce`
|
||||
* parameters will be auto-generated. If the response is successful,
|
||||
* results will be valid according to their expiration times.
|
||||
*
|
||||
* @param options
|
||||
* @param config
|
||||
*/
|
||||
getTokenWithPopup(options?: GetTokenWithPopupOptions, config?: PopupConfigOptions): Promise<string | undefined>;
|
||||
/**
|
||||
* ```js
|
||||
* const isAuthenticated = await auth0.isAuthenticated();
|
||||
* ```
|
||||
*
|
||||
* Returns `true` if there's valid information stored,
|
||||
* otherwise returns `false`.
|
||||
*
|
||||
*/
|
||||
isAuthenticated(): Promise<boolean>;
|
||||
/**
|
||||
* ```js
|
||||
* await auth0.buildLogoutUrl(options);
|
||||
* ```
|
||||
*
|
||||
* Builds a URL to the logout endpoint using the parameters provided as arguments.
|
||||
* @param options
|
||||
*/
|
||||
private _buildLogoutUrl;
|
||||
/**
|
||||
* ```js
|
||||
* await auth0.logout(options);
|
||||
* ```
|
||||
*
|
||||
* Clears the application session and performs a redirect to `/v2/logout`, using
|
||||
* the parameters provided as arguments, to clear the Auth0 session.
|
||||
*
|
||||
* If the `federated` option is specified it also clears the Identity Provider session.
|
||||
* [Read more about how Logout works at Auth0](https://auth0.com/docs/logout).
|
||||
*
|
||||
* @param options
|
||||
*/
|
||||
logout(options?: LogoutOptions): Promise<void>;
|
||||
private _getTokenFromIFrame;
|
||||
private _getTokenUsingRefreshToken;
|
||||
private _saveEntryInCache;
|
||||
private _getIdTokenFromCache;
|
||||
private _getEntryFromCache;
|
||||
/**
|
||||
* Releases any locks acquired by the current page that are not released yet
|
||||
*
|
||||
* Get's called on the `pagehide` event.
|
||||
* https://developer.mozilla.org/en-US/docs/Web/API/Window/pagehide_event
|
||||
*/
|
||||
private _releaseLockOnPageHide;
|
||||
private _requestToken;
|
||||
/**
|
||||
* Exchanges an external subject token for an Auth0 token via a token exchange request.
|
||||
*
|
||||
* @param {CustomTokenExchangeOptions} options - The options required to perform the token exchange.
|
||||
*
|
||||
* @returns {Promise<TokenEndpointResponse>} A promise that resolves to the token endpoint response,
|
||||
* which contains the issued Auth0 tokens.
|
||||
*
|
||||
* This method implements the token exchange grant as specified in RFC 8693 by first validating
|
||||
* the provided subject token type and then constructing a token request to the /oauth/token endpoint.
|
||||
* The request includes the following parameters:
|
||||
*
|
||||
* - `grant_type`: Hard-coded to "urn:ietf:params:oauth:grant-type:token-exchange".
|
||||
* - `subject_token`: The external token provided via the options.
|
||||
* - `subject_token_type`: The type of the external token (validated by this function).
|
||||
* - `scope`: A unique set of scopes, generated by merging the scopes supplied in the options
|
||||
* with the SDK’s default scopes.
|
||||
* - `audience`: The target audience from the options, with fallback to the SDK's authorization configuration.
|
||||
*
|
||||
* **Example Usage:**
|
||||
*
|
||||
* ```
|
||||
* // Define the token exchange options
|
||||
* const options: CustomTokenExchangeOptions = {
|
||||
* subject_token: 'eyJhbGciOiJIUzI1NiIsInR5cCI6Ikp...',
|
||||
* subject_token_type: 'urn:acme:legacy-system-token',
|
||||
* scope: "openid profile"
|
||||
* };
|
||||
*
|
||||
* // Exchange the external token for Auth0 tokens
|
||||
* try {
|
||||
* const tokenResponse = await instance.exchangeToken(options);
|
||||
* // Use tokenResponse.access_token, tokenResponse.id_token, etc.
|
||||
* } catch (error) {
|
||||
* // Handle token exchange error
|
||||
* }
|
||||
* ```
|
||||
*/
|
||||
exchangeToken(options: CustomTokenExchangeOptions): Promise<TokenEndpointResponse>;
|
||||
protected _assertDpop(dpop: Dpop | undefined): asserts dpop is Dpop;
|
||||
/**
|
||||
* Returns the current DPoP nonce used for making requests to Auth0.
|
||||
*
|
||||
* It can return `undefined` because when starting fresh it will not
|
||||
* be populated until after the first response from the server.
|
||||
*
|
||||
* It requires enabling the {@link Auth0ClientOptions.useDpop} option.
|
||||
*
|
||||
* @param nonce The nonce value.
|
||||
* @param id The identifier of a nonce: if absent, it will get the nonce
|
||||
* used for requests to Auth0. Otherwise, it will be used to
|
||||
* select a specific non-Auth0 nonce.
|
||||
*/
|
||||
getDpopNonce(id?: string): Promise<string | undefined>;
|
||||
/**
|
||||
* Sets the current DPoP nonce used for making requests to Auth0.
|
||||
*
|
||||
* It requires enabling the {@link Auth0ClientOptions.useDpop} option.
|
||||
*
|
||||
* @param nonce The nonce value.
|
||||
* @param id The identifier of a nonce: if absent, it will set the nonce
|
||||
* used for requests to Auth0. Otherwise, it will be used to
|
||||
* select a specific non-Auth0 nonce.
|
||||
*/
|
||||
setDpopNonce(nonce: string, id?: string): Promise<void>;
|
||||
/**
|
||||
* Returns a string to be used to demonstrate possession of the private
|
||||
* key used to cryptographically bind access tokens with DPoP.
|
||||
*
|
||||
* It requires enabling the {@link Auth0ClientOptions.useDpop} option.
|
||||
*/
|
||||
generateDpopProof(params: {
|
||||
url: string;
|
||||
method: string;
|
||||
nonce?: string;
|
||||
accessToken: string;
|
||||
}): Promise<string>;
|
||||
/**
|
||||
* Returns a new `Fetcher` class that will contain a `fetchWithAuth()` method.
|
||||
* This is a drop-in replacement for the Fetch API's `fetch()` method, but will
|
||||
* handle certain authentication logic for you, like building the proper auth
|
||||
* headers or managing DPoP nonces and retries automatically.
|
||||
*
|
||||
* Check the `EXAMPLES.md` file for a deeper look into this method.
|
||||
*/
|
||||
createFetcher<TOutput extends CustomFetchMinimalOutput = Response>(config?: FetcherConfig<TOutput>): Fetcher<TOutput>;
|
||||
/**
|
||||
* Initiates a redirect to connect the user's account with a specified connection.
|
||||
* This method generates PKCE parameters, creates a transaction, and redirects to the /connect endpoint.
|
||||
*
|
||||
* You must enable `Offline Access` from the Connection Permissions settings to be able to use the connection with Connected Accounts.
|
||||
*
|
||||
* @template TAppState - The application state to persist through the transaction.
|
||||
* @param {RedirectConnectAccountOptions<TAppState>} options - Options for the connect account redirect flow.
|
||||
* @param {string} options.connection - The name of the connection to link (e.g. 'google-oauth2').
|
||||
* @param {string[]} [options.scopes] - Array of scopes to request from the Identity Provider during the connect account flow.
|
||||
* @param {AuthorizationParams} [options.authorization_params] - Additional authorization parameters for the request to the upstream IdP.
|
||||
* @param {string} [options.redirectUri] - The URI to redirect back to after connecting the account.
|
||||
* @param {TAppState} [options.appState] - Application state to persist through the transaction.
|
||||
* @param {(url: string) => Promise<void>} [options.openUrl] - Custom function to open the URL.
|
||||
*
|
||||
* @returns {Promise<void>} Resolves when the redirect is initiated.
|
||||
* @throws {MyAccountApiError} If the connect request to the My Account API fails.
|
||||
*/
|
||||
connectAccountWithRedirect<TAppState = any>(options: RedirectConnectAccountOptions<TAppState>): Promise<void>;
|
||||
}
|
||||
+78
@@ -0,0 +1,78 @@
|
||||
import { ICache } from './cache';
|
||||
import { Auth0ClientOptions, AuthorizationParams, AuthorizeOptions, ClientAuthorizationParams, LogoutOptions } from './global';
|
||||
/**
|
||||
* @ignore
|
||||
*/
|
||||
export declare const GET_TOKEN_SILENTLY_LOCK_KEY = "auth0.lock.getTokenSilently";
|
||||
/**
|
||||
* @ignore
|
||||
*/
|
||||
export declare const buildGetTokenSilentlyLockKey: (clientId: string, audience: string) => string;
|
||||
/**
|
||||
* @ignore
|
||||
*/
|
||||
export declare const buildOrganizationHintCookieName: (clientId: string) => string;
|
||||
/**
|
||||
* @ignore
|
||||
*/
|
||||
export declare const OLD_IS_AUTHENTICATED_COOKIE_NAME = "auth0.is.authenticated";
|
||||
/**
|
||||
* @ignore
|
||||
*/
|
||||
export declare const buildIsAuthenticatedCookieName: (clientId: string) => string;
|
||||
/**
|
||||
* @ignore
|
||||
*/
|
||||
export declare const cacheFactory: (location: string) => () => ICache;
|
||||
/**
|
||||
* @ignore
|
||||
*/
|
||||
export declare const getAuthorizeParams: (clientOptions: Auth0ClientOptions & {
|
||||
authorizationParams: ClientAuthorizationParams;
|
||||
}, scope: Record<string, string>, authorizationParams: AuthorizationParams & {
|
||||
scope?: string | undefined;
|
||||
}, state: string, nonce: string, code_challenge: string, redirect_uri: string | undefined, response_mode: string | undefined, thumbprint: string | undefined) => AuthorizeOptions;
|
||||
/**
|
||||
* @ignore
|
||||
*
|
||||
* Function used to provide support for the deprecated onRedirect through openUrl.
|
||||
*/
|
||||
export declare const patchOpenUrlWithOnRedirect: <T extends Pick<LogoutOptions, "openUrl" | "onRedirect">>(options: T) => T;
|
||||
/**
|
||||
* @ignore
|
||||
*
|
||||
* Checks if all scopes are included inside other array of scopes
|
||||
*/
|
||||
export declare const allScopesAreIncluded: (scopeToInclude?: string, scopes?: string) => boolean;
|
||||
/**
|
||||
* @ignore
|
||||
*
|
||||
* Returns the scopes that are missing after a refresh
|
||||
*/
|
||||
export declare const getMissingScopes: (requestedScope?: string, respondedScope?: string) => string;
|
||||
/**
|
||||
* @ignore
|
||||
*
|
||||
* For backward compatibility we are going to check if we are going to downscope while doing a refresh request
|
||||
* while MRRT is allowed. If the audience is the same for the refresh_token we are going to use and it has
|
||||
* lower scopes than the ones originally in the token, we are going to return the scopes that were stored
|
||||
* with the refresh_token in the tokenset.
|
||||
* @param useMrrt Setting that the user can activate to use MRRT in their requests
|
||||
* @param authorizationParams Contains the audience and scope that the user requested to obtain a token
|
||||
* @param cachedAudience Audience stored with the refresh_token wich we are going to use in the request
|
||||
* @param cachedScope Scope stored with the refresh_token wich we are going to use in the request
|
||||
*/
|
||||
export declare const getScopeToRequest: (useMrrt: boolean | undefined, authorizationParams: {
|
||||
audience?: string;
|
||||
scope: string;
|
||||
}, cachedAudience?: string, cachedScope?: string) => string;
|
||||
/**
|
||||
* @ignore
|
||||
*
|
||||
* Checks if the refresh request has been done using MRRT
|
||||
* @param cachedAudience Audience from the refresh token used to refresh
|
||||
* @param cachedScope Scopes from the refresh token used to refresh
|
||||
* @param requestAudience Audience sent to the server
|
||||
* @param requestScope Scopes sent to the server
|
||||
*/
|
||||
export declare const isRefreshWithMrrt: (cachedAudience: string | undefined, cachedScope: string | undefined, requestAudience: string | undefined, requestScope: string) => boolean;
|
||||
+92
@@ -0,0 +1,92 @@
|
||||
import { AuthorizationParams } from './global';
|
||||
import { Fetcher } from './fetcher';
|
||||
interface ConnectRequest {
|
||||
/** The name of the connection to link the account with (e.g., 'google-oauth2', 'facebook'). */
|
||||
connection: string;
|
||||
/** Array of scopes to request from the Identity Provider during the connect account flow. */
|
||||
scopes?: string[];
|
||||
/** The URI to redirect to after the connection process completes. */
|
||||
redirect_uri: string;
|
||||
/** An opaque value used to maintain state between the request and callback. */
|
||||
state?: string;
|
||||
/** The PKCE code challenge derived from the code verifier. */
|
||||
code_challenge?: string;
|
||||
/** The method used to derive the code challenge. Required when code_challenge is provided. */
|
||||
code_challenge_method?: 'S256';
|
||||
authorization_params?: AuthorizationParams;
|
||||
}
|
||||
interface ConnectResponse {
|
||||
/** The base URI to initiate the account connection flow. */
|
||||
connect_uri: string;
|
||||
/** The authentication session identifier. */
|
||||
auth_session: string;
|
||||
/** Parameters to be used with the connect URI. */
|
||||
connect_params: {
|
||||
/** The ticket identifier to be used with the connection URI. */
|
||||
ticket: string;
|
||||
};
|
||||
/** The number of seconds until the ticket expires. */
|
||||
expires_in: number;
|
||||
}
|
||||
interface CompleteRequest {
|
||||
/** The authentication session identifier */
|
||||
auth_session: string;
|
||||
/** The authorization code returned from the connect flow */
|
||||
connect_code: string;
|
||||
/** The redirect URI used in the original request */
|
||||
redirect_uri: string;
|
||||
/** The PKCE code verifier */
|
||||
code_verifier?: string;
|
||||
}
|
||||
export interface CompleteResponse {
|
||||
/** The unique identifier of the connected account */
|
||||
id: string;
|
||||
/** The connection name */
|
||||
connection: string;
|
||||
/** The access type, always 'offline' */
|
||||
access_type: 'offline';
|
||||
/** Array of scopes granted */
|
||||
scopes?: string[];
|
||||
/** ISO date string of when the connected account was created */
|
||||
created_at: string;
|
||||
/** ISO date string of when the refresh token expires (optional) */
|
||||
expires_at?: string;
|
||||
}
|
||||
export interface ErrorResponse {
|
||||
type: string;
|
||||
status: number;
|
||||
title: string;
|
||||
detail: string;
|
||||
validation_errors?: {
|
||||
detail: string;
|
||||
field?: string;
|
||||
pointer?: string;
|
||||
source?: string;
|
||||
}[];
|
||||
}
|
||||
/**
|
||||
* Subset of the MyAccount API that handles the connect accounts flow.
|
||||
*/
|
||||
export declare class MyAccountApiClient {
|
||||
private myAccountFetcher;
|
||||
private apiBase;
|
||||
constructor(myAccountFetcher: Fetcher<Response>, apiBase: string);
|
||||
/**
|
||||
* Get a ticket for the connect account flow.
|
||||
*/
|
||||
connectAccount(params: ConnectRequest): Promise<ConnectResponse>;
|
||||
/**
|
||||
* Verify the redirect from the connect account flow and complete the connecting of the account.
|
||||
*/
|
||||
completeAccount(params: CompleteRequest): Promise<CompleteResponse>;
|
||||
private _handleResponse;
|
||||
}
|
||||
export declare class MyAccountApiError extends Error {
|
||||
readonly type: string;
|
||||
readonly status: number;
|
||||
readonly title: string;
|
||||
readonly detail: string;
|
||||
readonly validation_errors?: ErrorResponse['validation_errors'];
|
||||
constructor({ type, status, title, detail, validation_errors }: ErrorResponse);
|
||||
}
|
||||
export {};
|
||||
+71
@@ -0,0 +1,71 @@
|
||||
/**
|
||||
* Represents the configuration options required for initiating a Custom Token Exchange request
|
||||
* following RFC 8693 specifications.
|
||||
*
|
||||
* @see {@link https://www.rfc-editor.org/rfc/rfc8693 | RFC 8693: OAuth 2.0 Token Exchange}
|
||||
*/
|
||||
export type CustomTokenExchangeOptions = {
|
||||
/**
|
||||
* The type identifier for the subject token being exchanged
|
||||
*
|
||||
* @pattern
|
||||
* - Must be a namespaced URI under your organization's control
|
||||
* - Forbidden patterns:
|
||||
* - `^urn:ietf:params:oauth:*` (IETF reserved)
|
||||
* - `^https:\/\/auth0\.com/*` (Auth0 reserved)
|
||||
* - `^urn:auth0:*` (Auth0 reserved)
|
||||
*
|
||||
* @example
|
||||
* "urn:acme:legacy-system-token"
|
||||
* "https://api.yourcompany.com/token-type/v1"
|
||||
*/
|
||||
subject_token_type: string;
|
||||
/**
|
||||
* The opaque token value being exchanged for Auth0 tokens
|
||||
*
|
||||
* @security
|
||||
* - Must be validated in Auth0 Actions using strong cryptographic verification
|
||||
* - Implement replay attack protection
|
||||
* - Recommended validation libraries: `jose`, `jsonwebtoken`
|
||||
*
|
||||
* @example
|
||||
* "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
|
||||
*/
|
||||
subject_token: string;
|
||||
/**
|
||||
* The target audience for the requested Auth0 token
|
||||
*
|
||||
* @remarks
|
||||
* Must match exactly with an API identifier configured in your Auth0 tenant.
|
||||
* If not provided, falls back to the client's default audience.
|
||||
*
|
||||
* @example
|
||||
* "https://api.your-service.com/v1"
|
||||
*/
|
||||
audience?: string;
|
||||
/**
|
||||
* Space-separated list of OAuth 2.0 scopes being requested
|
||||
*
|
||||
* @remarks
|
||||
* Subject to API authorization policies configured in Auth0
|
||||
*
|
||||
* @example
|
||||
* "openid profile email read:data write:data"
|
||||
*/
|
||||
scope?: string;
|
||||
/**
|
||||
* Additional custom parameters for Auth0 Action processing
|
||||
*
|
||||
* @remarks
|
||||
* Accessible in Action code via `event.request.body`
|
||||
*
|
||||
* @example
|
||||
* ```typescript
|
||||
* {
|
||||
* custom_parameter: "session_context",
|
||||
* device_fingerprint: "a3d8f7...",
|
||||
* }
|
||||
* ```
|
||||
*/
|
||||
[key: string]: unknown;
|
||||
};
|
||||
+2
@@ -0,0 +1,2 @@
|
||||
import { TokenEndpointOptions, TokenEndpointResponse } from './global';
|
||||
export declare function oauthToken({ baseUrl, timeout, audience, scope, auth0Client, useFormData, useMrrt, dpop, ...options }: TokenEndpointOptions, worker?: Worker): Promise<TokenEndpointResponse>;
|
||||
+7
@@ -0,0 +1,7 @@
|
||||
import { ICache, Cacheable, MaybePromise } from './shared';
|
||||
export declare class LocalStorageCache implements ICache {
|
||||
set<T = Cacheable>(key: string, entry: T): void;
|
||||
get<T = Cacheable>(key: string): MaybePromise<T | undefined>;
|
||||
remove(key: string): void;
|
||||
allKeys(): string[];
|
||||
}
|
||||
+52
@@ -0,0 +1,52 @@
|
||||
import { CacheKeyManifest } from './key-manifest';
|
||||
import { CacheEntry, ICache, CacheKey, DecodedToken, IdTokenEntry } from './shared';
|
||||
export declare class CacheManager {
|
||||
private cache;
|
||||
private keyManifest?;
|
||||
private nowProvider;
|
||||
constructor(cache: ICache, keyManifest?: CacheKeyManifest | undefined, nowProvider?: () => number | Promise<number>);
|
||||
setIdToken(clientId: string, idToken: string, decodedToken: DecodedToken): Promise<void>;
|
||||
getIdToken(cacheKey: CacheKey): Promise<IdTokenEntry | undefined>;
|
||||
get(cacheKey: CacheKey, expiryAdjustmentSeconds?: number, useMrrt?: boolean, cacheMode?: string): Promise<Partial<CacheEntry> | undefined>;
|
||||
private modifiedCachedEntry;
|
||||
set(entry: CacheEntry): Promise<void>;
|
||||
remove(client_id: string, audience?: string, scope?: string): Promise<void>;
|
||||
clear(clientId?: string): Promise<void>;
|
||||
private wrapCacheEntry;
|
||||
private getCacheKeys;
|
||||
/**
|
||||
* Returns the cache key to be used to store the id token
|
||||
* @param clientId The client id used to link to the id token
|
||||
* @returns The constructed cache key, as a string, to store the id token
|
||||
*/
|
||||
private getIdTokenCacheKey;
|
||||
/**
|
||||
* Finds the corresponding key in the cache based on the provided cache key.
|
||||
* The keys inside the cache are in the format {prefix}::{clientId}::{audience}::{scope}.
|
||||
* The first key in the cache that satisfies the following conditions is returned
|
||||
* - `prefix` is strict equal to Auth0's internally configured `keyPrefix`
|
||||
* - `clientId` is strict equal to the `cacheKey.clientId`
|
||||
* - `audience` is strict equal to the `cacheKey.audience`
|
||||
* - `scope` contains at least all the `cacheKey.scope` values
|
||||
* *
|
||||
* @param keyToMatch The provided cache key
|
||||
* @param allKeys A list of existing cache keys
|
||||
*/
|
||||
private matchExistingCacheKey;
|
||||
/**
|
||||
* Returns the first entry that contains a refresh_token that satisfies the following conditions
|
||||
* The keys inside the cache are in the format {prefix}::{clientId}::{audience}::{scope}.
|
||||
* - `prefix` is strict equal to Auth0's internally configured `keyPrefix`
|
||||
* - `clientId` is strict equal to the `cacheKey.clientId`
|
||||
* @param keyToMatch The provided cache key
|
||||
* @param allKeys A list of existing cache keys
|
||||
*/
|
||||
private getEntryWithRefreshToken;
|
||||
/**
|
||||
* Updates in the cache all entries that has a match with previous refresh_token with the
|
||||
* new refresh_token obtained from the server
|
||||
* @param oldRefreshToken Old refresh_token used on refresh
|
||||
* @param newRefreshToken New refresh_token obtained from the server after refresh
|
||||
*/
|
||||
updateEntry(oldRefreshToken: string, newRefreshToken: string): Promise<void>;
|
||||
}
|
||||
+4
@@ -0,0 +1,4 @@
|
||||
import { ICache } from './shared';
|
||||
export declare class InMemoryCache {
|
||||
enclosedCache: ICache;
|
||||
}
|
||||
+4
@@ -0,0 +1,4 @@
|
||||
export * from './cache-localstorage';
|
||||
export * from './cache-memory';
|
||||
export * from './cache-manager';
|
||||
export * from './shared';
|
||||
+12
@@ -0,0 +1,12 @@
|
||||
import { ICache, KeyManifestEntry, MaybePromise } from './shared';
|
||||
export declare class CacheKeyManifest {
|
||||
private cache;
|
||||
private clientId;
|
||||
private readonly manifestKey;
|
||||
constructor(cache: ICache, clientId: string);
|
||||
add(key: string): Promise<void>;
|
||||
remove(key: string): Promise<void>;
|
||||
get(): MaybePromise<KeyManifestEntry | undefined>;
|
||||
clear(): MaybePromise<void>;
|
||||
private createManifestKeyFrom;
|
||||
}
|
||||
+68
@@ -0,0 +1,68 @@
|
||||
import { IdToken, User } from '../global';
|
||||
export declare const CACHE_KEY_PREFIX = "@@auth0spajs@@";
|
||||
export declare const CACHE_KEY_ID_TOKEN_SUFFIX = "@@user@@";
|
||||
export type CacheKeyData = {
|
||||
audience?: string;
|
||||
scope?: string;
|
||||
clientId: string;
|
||||
};
|
||||
export declare class CacheKey {
|
||||
prefix: string;
|
||||
suffix?: string | undefined;
|
||||
clientId: string;
|
||||
scope?: string;
|
||||
audience?: string;
|
||||
constructor(data: CacheKeyData, prefix?: string, suffix?: string | undefined);
|
||||
/**
|
||||
* Converts this `CacheKey` instance into a string for use in a cache
|
||||
* @returns A string representation of the key
|
||||
*/
|
||||
toKey(): string;
|
||||
/**
|
||||
* Converts a cache key string into a `CacheKey` instance.
|
||||
* @param key The key to convert
|
||||
* @returns An instance of `CacheKey`
|
||||
*/
|
||||
static fromKey(key: string): CacheKey;
|
||||
/**
|
||||
* Utility function to build a `CacheKey` instance from a cache entry
|
||||
* @param entry The entry
|
||||
* @returns An instance of `CacheKey`
|
||||
*/
|
||||
static fromCacheEntry(entry: CacheEntry): CacheKey;
|
||||
}
|
||||
export interface DecodedToken {
|
||||
claims: IdToken;
|
||||
user: User;
|
||||
}
|
||||
export interface IdTokenEntry {
|
||||
id_token: string;
|
||||
decodedToken: DecodedToken;
|
||||
}
|
||||
export type CacheEntry = {
|
||||
id_token?: string;
|
||||
token_type?: string;
|
||||
access_token: string;
|
||||
expires_in: number;
|
||||
decodedToken?: DecodedToken;
|
||||
audience: string;
|
||||
scope: string;
|
||||
client_id: string;
|
||||
refresh_token?: string;
|
||||
oauthTokenScope?: string;
|
||||
};
|
||||
export type WrappedCacheEntry = {
|
||||
body: Partial<CacheEntry>;
|
||||
expiresAt: number;
|
||||
};
|
||||
export type KeyManifestEntry = {
|
||||
keys: string[];
|
||||
};
|
||||
export type Cacheable = WrappedCacheEntry | KeyManifestEntry;
|
||||
export type MaybePromise<T> = Promise<T> | T;
|
||||
export interface ICache {
|
||||
set<T = Cacheable>(key: string, entry: T): MaybePromise<void>;
|
||||
get<T = Cacheable>(key: string): MaybePromise<T | undefined>;
|
||||
remove(key: string): MaybePromise<void>;
|
||||
allKeys?(): MaybePromise<string[]>;
|
||||
}
|
||||
+48
@@ -0,0 +1,48 @@
|
||||
import { PopupConfigOptions } from './global';
|
||||
/**
|
||||
* @ignore
|
||||
*/
|
||||
export declare const DEFAULT_AUTHORIZE_TIMEOUT_IN_SECONDS = 60;
|
||||
/**
|
||||
* @ignore
|
||||
*/
|
||||
export declare const DEFAULT_POPUP_CONFIG_OPTIONS: PopupConfigOptions;
|
||||
/**
|
||||
* @ignore
|
||||
*/
|
||||
export declare const DEFAULT_SILENT_TOKEN_RETRY_COUNT = 3;
|
||||
/**
|
||||
* @ignore
|
||||
*/
|
||||
export declare const CLEANUP_IFRAME_TIMEOUT_IN_SECONDS = 2;
|
||||
/**
|
||||
* @ignore
|
||||
*/
|
||||
export declare const DEFAULT_FETCH_TIMEOUT_MS = 10000;
|
||||
export declare const CACHE_LOCATION_MEMORY = "memory";
|
||||
export declare const CACHE_LOCATION_LOCAL_STORAGE = "localstorage";
|
||||
/**
|
||||
* @ignore
|
||||
*/
|
||||
export declare const MISSING_REFRESH_TOKEN_ERROR_MESSAGE = "Missing Refresh Token";
|
||||
/**
|
||||
* @ignore
|
||||
*/
|
||||
export declare const INVALID_REFRESH_TOKEN_ERROR_MESSAGE = "invalid refresh token";
|
||||
/**
|
||||
* @ignore
|
||||
*/
|
||||
export declare const DEFAULT_SCOPE = "openid profile email";
|
||||
/**
|
||||
* @ignore
|
||||
*/
|
||||
export declare const DEFAULT_SESSION_CHECK_EXPIRY_DAYS = 1;
|
||||
/**
|
||||
* @ignore
|
||||
*/
|
||||
export declare const DEFAULT_AUTH0_CLIENT: {
|
||||
name: string;
|
||||
version: string;
|
||||
};
|
||||
export declare const DEFAULT_NOW_PROVIDER: () => number;
|
||||
export declare const DEFAULT_AUDIENCE = "default";
|
||||
+17
@@ -0,0 +1,17 @@
|
||||
import { DpopStorage } from './storage';
|
||||
import * as dpopUtils from './utils';
|
||||
export declare class Dpop {
|
||||
protected readonly storage: DpopStorage;
|
||||
constructor(clientId: string);
|
||||
getNonce(id?: string): Promise<string | undefined>;
|
||||
setNonce(nonce: string, id?: string): Promise<void>;
|
||||
protected getOrGenerateKeyPair(): Promise<dpopUtils.KeyPair>;
|
||||
generateProof(params: {
|
||||
url: string;
|
||||
method: string;
|
||||
nonce?: string;
|
||||
accessToken?: string;
|
||||
}): Promise<string>;
|
||||
calculateThumbprint(): Promise<string>;
|
||||
clear(): Promise<void>;
|
||||
}
|
||||
+27
@@ -0,0 +1,27 @@
|
||||
import { type KeyPair } from './utils';
|
||||
declare const TABLES: {
|
||||
readonly NONCE: "nonce";
|
||||
readonly KEYPAIR: "keypair";
|
||||
};
|
||||
type Table = (typeof TABLES)[keyof typeof TABLES];
|
||||
export declare class DpopStorage {
|
||||
protected readonly clientId: string;
|
||||
protected dbHandle: IDBDatabase | undefined;
|
||||
constructor(clientId: string);
|
||||
protected getVersion(): number;
|
||||
protected createDbHandle(): Promise<IDBDatabase>;
|
||||
protected getDbHandle(): Promise<IDBDatabase>;
|
||||
protected executeDbRequest<T = unknown>(table: string, mode: IDBTransactionMode, requestFactory: (table: IDBObjectStore) => IDBRequest<T>): Promise<T>;
|
||||
protected buildKey(id?: string): string;
|
||||
setNonce(nonce: string, id?: string): Promise<void>;
|
||||
setKeyPair(keyPair: KeyPair): Promise<void>;
|
||||
protected save(table: Table, key: IDBValidKey, obj: unknown): Promise<void>;
|
||||
findNonce(id?: string): Promise<string | undefined>;
|
||||
findKeyPair(): Promise<KeyPair | undefined>;
|
||||
protected find<T = unknown>(table: Table, key: IDBValidKey): Promise<T | undefined>;
|
||||
protected deleteBy(table: Table, predicate: (key: IDBValidKey) => boolean): Promise<void>;
|
||||
protected deleteByClientId(table: Table, clientId: string): Promise<void>;
|
||||
clearNonces(): Promise<void>;
|
||||
clearKeyPairs(): Promise<void>;
|
||||
}
|
||||
export {};
|
||||
+15
@@ -0,0 +1,15 @@
|
||||
import * as dpopLib from 'dpop';
|
||||
export declare const DPOP_NONCE_HEADER = "dpop-nonce";
|
||||
export type KeyPair = Readonly<dpopLib.KeyPair>;
|
||||
type GenerateProofParams = {
|
||||
keyPair: KeyPair;
|
||||
url: string;
|
||||
method: string;
|
||||
nonce?: string;
|
||||
accessToken?: string;
|
||||
};
|
||||
export declare function generateKeyPair(): Promise<KeyPair>;
|
||||
export declare function calculateThumbprint(keyPair: Pick<KeyPair, 'publicKey'>): Promise<string>;
|
||||
export declare function generateProof({ keyPair, url, method, nonce, accessToken }: GenerateProofParams): Promise<string>;
|
||||
export declare function isGrantTypeSupported(grantType: string): boolean;
|
||||
export {};
|
||||
+79
@@ -0,0 +1,79 @@
|
||||
/**
|
||||
* Thrown when network requests to the Auth server fail.
|
||||
*/
|
||||
export declare class GenericError extends Error {
|
||||
error: string;
|
||||
error_description: string;
|
||||
constructor(error: string, error_description: string);
|
||||
static fromPayload({ error, error_description }: {
|
||||
error: string;
|
||||
error_description: string;
|
||||
}): GenericError;
|
||||
}
|
||||
/**
|
||||
* Thrown when handling the redirect callback fails, will be one of Auth0's
|
||||
* Authentication API's Standard Error Responses: https://auth0.com/docs/api/authentication?javascript#standard-error-responses
|
||||
*/
|
||||
export declare class AuthenticationError extends GenericError {
|
||||
state: string;
|
||||
appState: any;
|
||||
constructor(error: string, error_description: string, state: string, appState?: any);
|
||||
}
|
||||
/**
|
||||
* Thrown when handling the redirect callback for the connect flow fails, will be one of Auth0's
|
||||
* Authentication API's Standard Error Responses: https://auth0.com/docs/api/authentication?javascript#standard-error-responses
|
||||
*/
|
||||
export declare class ConnectError extends GenericError {
|
||||
connection: string;
|
||||
state: string;
|
||||
appState: any;
|
||||
constructor(error: string, error_description: string, connection: string, state: string, appState?: any);
|
||||
}
|
||||
/**
|
||||
* Thrown when silent auth times out (usually due to a configuration issue) or
|
||||
* when network requests to the Auth server timeout.
|
||||
*/
|
||||
export declare class TimeoutError extends GenericError {
|
||||
constructor();
|
||||
}
|
||||
/**
|
||||
* Error thrown when the login popup times out (if the user does not complete auth)
|
||||
*/
|
||||
export declare class PopupTimeoutError extends TimeoutError {
|
||||
popup: Window;
|
||||
constructor(popup: Window);
|
||||
}
|
||||
export declare class PopupCancelledError extends GenericError {
|
||||
popup: Window;
|
||||
constructor(popup: Window);
|
||||
}
|
||||
/**
|
||||
* Error thrown when the token exchange results in a `mfa_required` error
|
||||
*/
|
||||
export declare class MfaRequiredError extends GenericError {
|
||||
mfa_token: string;
|
||||
constructor(error: string, error_description: string, mfa_token: string);
|
||||
}
|
||||
/**
|
||||
* Error thrown when there is no refresh token to use
|
||||
*/
|
||||
export declare class MissingRefreshTokenError extends GenericError {
|
||||
audience: string;
|
||||
scope: string;
|
||||
constructor(audience: string, scope: string);
|
||||
}
|
||||
/**
|
||||
* Error thrown when there are missing scopes after refreshing a token
|
||||
*/
|
||||
export declare class MissingScopesError extends GenericError {
|
||||
audience: string;
|
||||
scope: string;
|
||||
constructor(audience: string, scope: string);
|
||||
}
|
||||
/**
|
||||
* Error thrown when the wrong DPoP nonce is used and a potential subsequent retry wasn't able to fix it.
|
||||
*/
|
||||
export declare class UseDpopNonceError extends GenericError {
|
||||
newDpopNonce: string | undefined;
|
||||
constructor(newDpopNonce: string | undefined);
|
||||
}
|
||||
+54
@@ -0,0 +1,54 @@
|
||||
import { GetTokenSilentlyVerboseResponse } from './global';
|
||||
export type ResponseHeaders = Record<string, string | null | undefined> | [string, string][] | {
|
||||
get(name: string): string | null | undefined;
|
||||
};
|
||||
export type CustomFetchMinimalOutput = {
|
||||
status: number;
|
||||
headers: ResponseHeaders;
|
||||
};
|
||||
export type CustomFetchImpl<TOutput extends CustomFetchMinimalOutput> = (req: Request) => Promise<TOutput>;
|
||||
export type AuthParams = {
|
||||
scope?: string[];
|
||||
audience?: string;
|
||||
};
|
||||
type AccessTokenFactory = (authParams?: AuthParams) => Promise<string | GetTokenSilentlyVerboseResponse>;
|
||||
export type FetcherConfig<TOutput extends CustomFetchMinimalOutput> = {
|
||||
getAccessToken?: AccessTokenFactory;
|
||||
baseUrl?: string;
|
||||
fetch?: CustomFetchImpl<TOutput>;
|
||||
dpopNonceId?: string;
|
||||
};
|
||||
export type FetcherHooks = {
|
||||
isDpopEnabled: () => boolean;
|
||||
getAccessToken: AccessTokenFactory;
|
||||
getDpopNonce: () => Promise<string | undefined>;
|
||||
setDpopNonce: (nonce: string) => Promise<void>;
|
||||
generateDpopProof: (params: {
|
||||
url: string;
|
||||
method: string;
|
||||
nonce?: string;
|
||||
accessToken: string;
|
||||
}) => Promise<string>;
|
||||
};
|
||||
export type FetchWithAuthCallbacks<TOutput> = {
|
||||
onUseDpopNonceError?(): Promise<TOutput>;
|
||||
};
|
||||
export declare class Fetcher<TOutput extends CustomFetchMinimalOutput> {
|
||||
protected readonly config: Omit<FetcherConfig<TOutput>, 'fetch'> & Required<Pick<FetcherConfig<TOutput>, 'fetch'>>;
|
||||
protected readonly hooks: FetcherHooks;
|
||||
constructor(config: FetcherConfig<TOutput>, hooks: FetcherHooks);
|
||||
protected isAbsoluteUrl(url: string): boolean;
|
||||
protected buildUrl(baseUrl: string | undefined, url: string | undefined): string;
|
||||
protected getAccessToken(authParams?: AuthParams): Promise<string | GetTokenSilentlyVerboseResponse>;
|
||||
protected extractUrl(info: RequestInfo | URL): string;
|
||||
protected buildBaseRequest(info: RequestInfo | URL, init: RequestInit | undefined): Request;
|
||||
protected setAuthorizationHeader(request: Request, accessToken: string, tokenType?: string): void;
|
||||
protected setDpopProofHeader(request: Request, accessToken: string): Promise<void>;
|
||||
protected prepareRequest(request: Request, authParams?: AuthParams): Promise<void>;
|
||||
protected getHeader(headers: ResponseHeaders, name: string): string;
|
||||
protected hasUseDpopNonceError(response: TOutput): boolean;
|
||||
protected handleResponse(response: TOutput, callbacks: FetchWithAuthCallbacks<TOutput>): Promise<TOutput>;
|
||||
protected internalFetchWithAuth(info: RequestInfo | URL, init: RequestInit | undefined, callbacks: FetchWithAuthCallbacks<TOutput>, authParams?: AuthParams): Promise<TOutput>;
|
||||
fetchWithAuth(info: RequestInfo | URL, init?: RequestInit, authParams?: AuthParams): Promise<TOutput>;
|
||||
}
|
||||
export {};
|
||||
+715
@@ -0,0 +1,715 @@
|
||||
import { ICache } from './cache';
|
||||
import type { Dpop } from './dpop/dpop';
|
||||
import { CompleteResponse } from './MyAccountApiClient';
|
||||
export interface AuthorizationParams {
|
||||
/**
|
||||
* - `'page'`: displays the UI with a full page view
|
||||
* - `'popup'`: displays the UI with a popup window
|
||||
* - `'touch'`: displays the UI in a way that leverages a touch interface
|
||||
* - `'wap'`: displays the UI with a "feature phone" type interface
|
||||
*/
|
||||
display?: 'page' | 'popup' | 'touch' | 'wap';
|
||||
/**
|
||||
* - `'none'`: do not prompt user for login or consent on reauthentication
|
||||
* - `'login'`: prompt user for reauthentication
|
||||
* - `'consent'`: prompt user for consent before processing request
|
||||
* - `'select_account'`: prompt user to select an account
|
||||
*/
|
||||
prompt?: 'none' | 'login' | 'consent' | 'select_account';
|
||||
/**
|
||||
* Maximum allowable elapsed time (in seconds) since authentication.
|
||||
* If the last time the user authenticated is greater than this value,
|
||||
* the user must be reauthenticated.
|
||||
*/
|
||||
max_age?: string | number;
|
||||
/**
|
||||
* The space-separated list of language tags, ordered by preference.
|
||||
* For example: `'fr-CA fr en'`.
|
||||
*/
|
||||
ui_locales?: string;
|
||||
/**
|
||||
* Previously issued ID Token.
|
||||
*/
|
||||
id_token_hint?: string;
|
||||
/**
|
||||
* Provides a hint to Auth0 as to what flow should be displayed.
|
||||
* The default behavior is to show a login page but you can override
|
||||
* this by passing 'signup' to show the signup page instead.
|
||||
*
|
||||
* This only affects the New Universal Login Experience.
|
||||
*/
|
||||
screen_hint?: 'signup' | 'login' | string;
|
||||
/**
|
||||
* The user's email address or other identifier. When your app knows
|
||||
* which user is trying to authenticate, you can provide this parameter
|
||||
* to pre-fill the email box or select the right session for sign-in.
|
||||
*
|
||||
* This currently only affects the classic Lock experience.
|
||||
*/
|
||||
login_hint?: string;
|
||||
acr_values?: string;
|
||||
/**
|
||||
* The default scope to be used on authentication requests.
|
||||
*
|
||||
* This defaults to `profile email` if not set. If you are setting extra scopes and require
|
||||
* `profile` and `email` to be included then you must include them in the provided scope.
|
||||
*
|
||||
* Note: The `openid` scope is **always applied** regardless of this setting.
|
||||
*/
|
||||
scope?: string;
|
||||
/**
|
||||
* The default audience to be used for requesting API access.
|
||||
*/
|
||||
audience?: string;
|
||||
/**
|
||||
* The name of the connection configured for your application.
|
||||
* If null, it will redirect to the Auth0 Login Page and show
|
||||
* the Login Widget.
|
||||
*/
|
||||
connection?: string;
|
||||
/**
|
||||
* The organization to log in to.
|
||||
*
|
||||
* This will specify an `organization` parameter in your user's login request.
|
||||
*
|
||||
* - If you provide an Organization ID (a string with the prefix `org_`), it will be validated against the `org_id` claim of your user's ID Token. The validation is case-sensitive.
|
||||
* - If you provide an Organization Name (a string *without* the prefix `org_`), it will be validated against the `org_name` claim of your user's ID Token. The validation is case-insensitive.
|
||||
* To use an Organization Name you must have "Allow Organization Names in Authentication API" switched on in your Auth0 settings dashboard.
|
||||
* More information is available on the [Auth0 documentation portal](https://auth0.com/docs/manage-users/organizations/configure-organizations/use-org-name-authentication-api)
|
||||
*
|
||||
*/
|
||||
organization?: string;
|
||||
/**
|
||||
* The Id of an invitation to accept. This is available from the user invitation URL that is given when participating in a user invitation flow.
|
||||
*/
|
||||
invitation?: string;
|
||||
/**
|
||||
* The default URL where Auth0 will redirect your browser to with
|
||||
* the authentication result. It must be whitelisted in
|
||||
* the "Allowed Callback URLs" field in your Auth0 Application's
|
||||
* settings. If not provided here, it should be provided in the other
|
||||
* methods that provide authentication.
|
||||
*/
|
||||
redirect_uri?: string;
|
||||
/**
|
||||
* If you need to send custom parameters to the Authorization Server,
|
||||
* make sure to use the original parameter name.
|
||||
*/
|
||||
[key: string]: any;
|
||||
}
|
||||
export interface ClientAuthorizationParams extends Omit<AuthorizationParams, 'scope'> {
|
||||
scope?: string | Record<string, string>;
|
||||
}
|
||||
interface BaseLoginOptions {
|
||||
/**
|
||||
* URL parameters that will be sent back to the Authorization Server. This can be known parameters
|
||||
* defined by Auth0 or custom parameters that you define.
|
||||
*/
|
||||
authorizationParams?: AuthorizationParams;
|
||||
}
|
||||
export interface Auth0ClientOptions {
|
||||
/**
|
||||
* Your Auth0 account domain such as `'example.auth0.com'`,
|
||||
* `'example.eu.auth0.com'` or , `'example.mycompany.com'`
|
||||
* (when using [custom domains](https://auth0.com/docs/custom-domains))
|
||||
*/
|
||||
domain: string;
|
||||
/**
|
||||
* The issuer to be used for validation of JWTs, optionally defaults to the domain above
|
||||
*/
|
||||
issuer?: string;
|
||||
/**
|
||||
* The Client ID found on your Application settings page
|
||||
*/
|
||||
clientId: string;
|
||||
/**
|
||||
* The value in seconds used to account for clock skew in JWT expirations.
|
||||
* Typically, this value is no more than a minute or two at maximum.
|
||||
* Defaults to 60s.
|
||||
*/
|
||||
leeway?: number;
|
||||
/**
|
||||
* The location to use when storing cache data. Valid values are `memory` or `localstorage`.
|
||||
* The default setting is `memory`.
|
||||
*
|
||||
* Read more about [changing storage options in the Auth0 docs](https://auth0.com/docs/libraries/auth0-single-page-app-sdk#change-storage-options)
|
||||
*/
|
||||
cacheLocation?: CacheLocation;
|
||||
/**
|
||||
* Specify a custom cache implementation to use for token storage and retrieval. This setting takes precedence over `cacheLocation` if they are both specified.
|
||||
*/
|
||||
cache?: ICache;
|
||||
/**
|
||||
* If true, refresh tokens are used to fetch new access tokens from the Auth0 server. If false, the legacy technique of using a hidden iframe and the `authorization_code` grant with `prompt=none` is used.
|
||||
* The default setting is `false`.
|
||||
*
|
||||
* **Note**: Use of refresh tokens must be enabled by an administrator on your Auth0 client application.
|
||||
*/
|
||||
useRefreshTokens?: boolean;
|
||||
/**
|
||||
* If true, fallback to the technique of using a hidden iframe and the `authorization_code` grant with `prompt=none` when unable to use refresh tokens. If false, the iframe fallback is not used and
|
||||
* errors relating to a failed `refresh_token` grant should be handled appropriately. The default setting is `false`.
|
||||
*
|
||||
* **Note**: There might be situations where doing silent auth with a Web Message response from an iframe is not possible,
|
||||
* like when you're serving your application from the file system or a custom protocol (like in a Desktop or Native app).
|
||||
* In situations like this you can disable the iframe fallback and handle the failed `refresh_token` grant and prompt the user to login interactively with `loginWithRedirect` or `loginWithPopup`."
|
||||
*
|
||||
* E.g. Using the `file:` protocol in an Electron application does not support that legacy technique.
|
||||
*
|
||||
* @example
|
||||
* let token: string;
|
||||
* try {
|
||||
* token = await auth0.getTokenSilently();
|
||||
* } catch (e) {
|
||||
* if (e.error === 'missing_refresh_token' || e.error === 'invalid_grant') {
|
||||
* auth0.loginWithRedirect();
|
||||
* }
|
||||
* }
|
||||
*/
|
||||
useRefreshTokensFallback?: boolean;
|
||||
/**
|
||||
* A maximum number of seconds to wait before declaring background calls to /authorize as failed for timeout
|
||||
* Defaults to 60s.
|
||||
*/
|
||||
authorizeTimeoutInSeconds?: number;
|
||||
/**
|
||||
* Specify the timeout for HTTP calls using `fetch`. The default is 10 seconds.
|
||||
*/
|
||||
httpTimeoutInSeconds?: number;
|
||||
/**
|
||||
* Internal property to send information about the client to the authorization server.
|
||||
* @internal
|
||||
*/
|
||||
auth0Client?: {
|
||||
name: string;
|
||||
version: string;
|
||||
env?: {
|
||||
[key: string]: string;
|
||||
};
|
||||
};
|
||||
/**
|
||||
* Sets an additional cookie with no SameSite attribute to support legacy browsers
|
||||
* that are not compatible with the latest SameSite changes.
|
||||
* This will log a warning on modern browsers, you can disable the warning by setting
|
||||
* this to false but be aware that some older useragents will not work,
|
||||
* See https://www.chromium.org/updates/same-site/incompatible-clients
|
||||
* Defaults to true
|
||||
*/
|
||||
legacySameSiteCookie?: boolean;
|
||||
/**
|
||||
* If `true`, the SDK will use a cookie when storing information about the auth transaction while
|
||||
* the user is going through the authentication flow on the authorization server.
|
||||
*
|
||||
* The default is `false`, in which case the SDK will use session storage.
|
||||
*
|
||||
* @notes
|
||||
*
|
||||
* You might want to enable this if you rely on your users being able to authenticate using flows that
|
||||
* may end up spanning across multiple tabs (e.g. magic links) or you cannot otherwise rely on session storage being available.
|
||||
*/
|
||||
useCookiesForTransactions?: boolean;
|
||||
/**
|
||||
* Number of days until the cookie `auth0.is.authenticated` will expire
|
||||
* Defaults to 1.
|
||||
*/
|
||||
sessionCheckExpiryDays?: number;
|
||||
/**
|
||||
* The domain the cookie is accessible from. If not set, the cookie is scoped to
|
||||
* the current domain, including the subdomain.
|
||||
*
|
||||
* Note: setting this incorrectly may cause silent authentication to stop working
|
||||
* on page load.
|
||||
*
|
||||
*
|
||||
* To keep a user logged in across multiple subdomains set this to your
|
||||
* top-level domain and prefixed with a `.` (eg: `.example.com`).
|
||||
*/
|
||||
cookieDomain?: string;
|
||||
/**
|
||||
* If true, data to the token endpoint is transmitted as x-www-form-urlencoded data, if false it will be transmitted as JSON. The default setting is `true`.
|
||||
*
|
||||
* **Note:** Setting this to `false` may affect you if you use Auth0 Rules and are sending custom, non-primitive data. If you disable this,
|
||||
* please verify that your Auth0 Rules continue to work as intended.
|
||||
*/
|
||||
useFormData?: boolean;
|
||||
/**
|
||||
* Modify the value used as the current time during the token validation.
|
||||
*
|
||||
* **Note**: Using this improperly can potentially compromise the token validation.
|
||||
*/
|
||||
nowProvider?: () => Promise<number> | number;
|
||||
/**
|
||||
* If provided, the SDK will load the token worker from this URL instead of the integrated `blob`. An example of when this is useful is if you have strict
|
||||
* Content-Security-Policy (CSP) and wish to avoid needing to set `worker-src: blob:`. We recommend either serving the worker, which you can find in the module
|
||||
* at `<module_path>/dist/auth0-spa-js.worker.production.js`, from the same host as your application or using the Auth0 CDN
|
||||
* `https://cdn.auth0.com/js/auth0-spa-js/<version>/auth0-spa-js.worker.production.js`.
|
||||
*
|
||||
* **Note**: The worker is only used when `useRefreshTokens: true`, `cacheLocation: 'memory'`, and the `cache` is not custom.
|
||||
*/
|
||||
workerUrl?: string;
|
||||
/**
|
||||
* If `true`, the SDK will allow the refreshing of tokens using MRRT
|
||||
*/
|
||||
useMrrt?: boolean;
|
||||
/**
|
||||
* If `true`, DPoP (OAuth 2.0 Demonstrating Proof of Possession, RFC9449)
|
||||
* will be used to cryptographically bind tokens to this specific browser
|
||||
* so they can't be used from a different device in case of a leak.
|
||||
*
|
||||
* The default setting is `false`.
|
||||
*/
|
||||
useDpop?: boolean;
|
||||
/**
|
||||
* URL parameters that will be sent back to the Authorization Server. This can be known parameters
|
||||
* defined by Auth0 or custom parameters that you define.
|
||||
*/
|
||||
authorizationParams?: ClientAuthorizationParams;
|
||||
}
|
||||
/**
|
||||
* The possible locations where tokens can be stored
|
||||
*/
|
||||
export type CacheLocation = 'memory' | 'localstorage';
|
||||
/**
|
||||
* @ignore
|
||||
*/
|
||||
export interface AuthorizeOptions extends AuthorizationParams {
|
||||
response_type: string;
|
||||
response_mode: string;
|
||||
redirect_uri?: string;
|
||||
nonce: string;
|
||||
state: string;
|
||||
scope: string;
|
||||
code_challenge: string;
|
||||
code_challenge_method: string;
|
||||
}
|
||||
export interface RedirectLoginOptions<TAppState = any> extends BaseLoginOptions {
|
||||
/**
|
||||
* Used to store state before doing the redirect
|
||||
*/
|
||||
appState?: TAppState;
|
||||
/**
|
||||
* Used to add to the URL fragment before redirecting
|
||||
*/
|
||||
fragment?: string;
|
||||
/**
|
||||
* Used to control the redirect and not rely on the SDK to do the actual redirect.
|
||||
*
|
||||
* @example
|
||||
* const client = new Auth0Client({
|
||||
* async onRedirect(url) {
|
||||
* window.location.replace(url);
|
||||
* }
|
||||
* });
|
||||
* @deprecated since v2.0.1, use `openUrl` instead.
|
||||
*/
|
||||
onRedirect?: (url: string) => Promise<void>;
|
||||
/**
|
||||
* Used to control the redirect and not rely on the SDK to do the actual redirect.
|
||||
*
|
||||
* @example
|
||||
* const client = new Auth0Client({
|
||||
* openUrl(url) {
|
||||
* window.location.replace(url);
|
||||
* }
|
||||
* });
|
||||
*
|
||||
* @example
|
||||
* import { Browser } from '@capacitor/browser';
|
||||
*
|
||||
* const client = new Auth0Client({
|
||||
* async openUrl(url) {
|
||||
* await Browser.open({ url });
|
||||
* }
|
||||
* });
|
||||
*/
|
||||
openUrl?: (url: string) => Promise<void> | void;
|
||||
}
|
||||
/**
|
||||
* The types of responses expected from the authorization server.
|
||||
* - `code`: used for the standard login flow.
|
||||
* - `connect_code`: used for the connect account flow.
|
||||
*/
|
||||
export declare enum ResponseType {
|
||||
Code = "code",
|
||||
ConnectCode = "connect_code"
|
||||
}
|
||||
export interface RedirectLoginResult<TAppState = any> {
|
||||
/**
|
||||
* State stored when the redirect request was made
|
||||
*/
|
||||
appState?: TAppState;
|
||||
/**
|
||||
* The type of response, for login it will be `code`
|
||||
*/
|
||||
response_type: ResponseType.Code;
|
||||
}
|
||||
export interface PopupLoginOptions extends BaseLoginOptions {
|
||||
}
|
||||
export interface PopupConfigOptions {
|
||||
/**
|
||||
* The number of seconds to wait for a popup response before
|
||||
* throwing a timeout error. Defaults to 60s
|
||||
*/
|
||||
timeoutInSeconds?: number;
|
||||
/**
|
||||
* Accepts an already-created popup window to use. If not specified, the SDK
|
||||
* will create its own. This may be useful for platforms like iOS that have
|
||||
* security restrictions around when popups can be invoked (e.g. from a user click event)
|
||||
*/
|
||||
popup?: any;
|
||||
}
|
||||
export interface GetTokenSilentlyOptions {
|
||||
/**
|
||||
* When `off`, ignores the cache and always sends a
|
||||
* request to Auth0.
|
||||
* When `cache-only`, only reads from the cache and never sends a request to Auth0.
|
||||
* Defaults to `on`, where it both reads from the cache and sends a request to Auth0 as needed.
|
||||
*/
|
||||
cacheMode?: 'on' | 'off' | 'cache-only';
|
||||
/**
|
||||
* Parameters that will be sent back to Auth0 as part of a request.
|
||||
*/
|
||||
authorizationParams?: {
|
||||
/**
|
||||
* There's no actual redirect when getting a token silently,
|
||||
* but, according to the spec, a `redirect_uri` param is required.
|
||||
* Auth0 uses this parameter to validate that the current `origin`
|
||||
* matches the `redirect_uri` `origin` when sending the response.
|
||||
* It must be whitelisted in the "Allowed Web Origins" in your
|
||||
* Auth0 Application's settings.
|
||||
*/
|
||||
redirect_uri?: string;
|
||||
/**
|
||||
* The scope that was used in the authentication request
|
||||
*/
|
||||
scope?: string;
|
||||
/**
|
||||
* The audience that was used in the authentication request
|
||||
*/
|
||||
audience?: string;
|
||||
/**
|
||||
* If you need to send custom parameters to the Authorization Server,
|
||||
* make sure to use the original parameter name.
|
||||
*/
|
||||
[key: string]: any;
|
||||
};
|
||||
/** A maximum number of seconds to wait before declaring the background /authorize call as failed for timeout
|
||||
* Defaults to 60s.
|
||||
*/
|
||||
timeoutInSeconds?: number;
|
||||
/**
|
||||
* If true, the full response from the /oauth/token endpoint (or the cache, if the cache was used) is returned
|
||||
* (minus `refresh_token` if one was issued). Otherwise, just the access token is returned.
|
||||
*
|
||||
* The default is `false`.
|
||||
*/
|
||||
detailedResponse?: boolean;
|
||||
}
|
||||
export interface GetTokenWithPopupOptions extends PopupLoginOptions {
|
||||
/**
|
||||
* When `off`, ignores the cache and always sends a request to Auth0.
|
||||
* When `cache-only`, only reads from the cache and never sends a request to Auth0.
|
||||
* Defaults to `on`, where it both reads from the cache and sends a request to Auth0 as needed.
|
||||
*/
|
||||
cacheMode?: 'on' | 'off' | 'cache-only';
|
||||
}
|
||||
export interface LogoutUrlOptions {
|
||||
/**
|
||||
* The `clientId` of your application.
|
||||
*
|
||||
* If this property is not set, then the `clientId` that was used during initialization of the SDK is sent to the logout endpoint.
|
||||
*
|
||||
* If this property is set to `null`, then no client ID value is sent to the logout endpoint.
|
||||
*
|
||||
* [Read more about how redirecting after logout works](https://auth0.com/docs/logout/guides/redirect-users-after-logout)
|
||||
*/
|
||||
clientId?: string | null;
|
||||
/**
|
||||
* Parameters to pass to the logout endpoint. This can be known parameters defined by Auth0 or custom parameters
|
||||
* you wish to provide.
|
||||
*/
|
||||
logoutParams?: {
|
||||
/**
|
||||
* When supported by the upstream identity provider,
|
||||
* forces the user to logout of their identity provider
|
||||
* and from Auth0.
|
||||
* [Read more about how federated logout works at Auth0](https://auth0.com/docs/logout/guides/logout-idps)
|
||||
*/
|
||||
federated?: boolean;
|
||||
/**
|
||||
* The URL where Auth0 will redirect your browser to after the logout.
|
||||
*
|
||||
* **Note**: If the `client_id` parameter is included, the
|
||||
* `returnTo` URL that is provided must be listed in the
|
||||
* Application's "Allowed Logout URLs" in the Auth0 dashboard.
|
||||
* However, if the `client_id` parameter is not included, the
|
||||
* `returnTo` URL must be listed in the "Allowed Logout URLs" at
|
||||
* the account level in the Auth0 dashboard.
|
||||
*
|
||||
* [Read more about how redirecting after logout works](https://auth0.com/docs/logout/guides/redirect-users-after-logout)
|
||||
*/
|
||||
returnTo?: string;
|
||||
/**
|
||||
* If you need to send custom parameters to the logout endpoint, make sure to use the original parameter name.
|
||||
*/
|
||||
[key: string]: any;
|
||||
};
|
||||
}
|
||||
export interface LogoutOptions extends LogoutUrlOptions {
|
||||
/**
|
||||
* Used to control the redirect and not rely on the SDK to do the actual redirect.
|
||||
*
|
||||
* @example
|
||||
* await auth0.logout({
|
||||
* async onRedirect(url) {
|
||||
* window.location.replace(url);
|
||||
* }
|
||||
* });
|
||||
* @deprecated since v2.0.1, use `openUrl` instead.
|
||||
*/
|
||||
onRedirect?: (url: string) => Promise<void>;
|
||||
/**
|
||||
* Used to control the redirect and not rely on the SDK to do the actual redirect.
|
||||
*
|
||||
* Set to `false` to disable the redirect, or provide a function to handle the actual redirect yourself.
|
||||
*
|
||||
* @example
|
||||
* await auth0.logout({
|
||||
* openUrl(url) {
|
||||
* window.location.replace(url);
|
||||
* }
|
||||
* });
|
||||
*
|
||||
* @example
|
||||
* import { Browser } from '@capacitor/browser';
|
||||
*
|
||||
* await auth0.logout({
|
||||
* async openUrl(url) {
|
||||
* await Browser.open({ url });
|
||||
* }
|
||||
* });
|
||||
*/
|
||||
openUrl?: false | ((url: string) => Promise<void> | void);
|
||||
}
|
||||
export interface RedirectConnectAccountOptions<TAppState = any> {
|
||||
/**
|
||||
* The name of the connection to link (e.g. 'google-oauth2').
|
||||
*/
|
||||
connection: string;
|
||||
/**
|
||||
* Array of scopes to request from the Identity Provider during the connect account flow.
|
||||
*
|
||||
* @example
|
||||
* await auth0.connectAccountWithRedirect({
|
||||
* connection: 'google-oauth2',
|
||||
* scopes: ['https://www.googleapis.com/auth/calendar']
|
||||
* });
|
||||
*/
|
||||
scopes?: string[];
|
||||
/**
|
||||
* Additional authorization parameters for the request.
|
||||
*
|
||||
* @example
|
||||
* await auth0.connectAccountWithRedirect({
|
||||
* connection: 'github',
|
||||
* authorization_params: {
|
||||
* audience: 'https://api.github.com'
|
||||
* }
|
||||
* });
|
||||
*/
|
||||
authorization_params?: AuthorizationParams;
|
||||
/**
|
||||
* The URI to redirect back to after connecting the account.
|
||||
*/
|
||||
redirectUri?: string;
|
||||
/**
|
||||
* Optional application state to persist through the transaction.
|
||||
*
|
||||
* @example
|
||||
* await auth0.connectAccountWithRedirect({
|
||||
* connection: 'google-oauth2',
|
||||
* appState: { returnTo: '/settings' }
|
||||
* });
|
||||
*/
|
||||
appState?: TAppState;
|
||||
/**
|
||||
* Optional function to handle the redirect URL.
|
||||
*
|
||||
* @example
|
||||
* await auth0.connectAccountWithRedirect({
|
||||
* connection: 'google-oauth2',
|
||||
* openUrl: async (url) => { myBrowserApi.open(url); }
|
||||
* });
|
||||
*/
|
||||
openUrl?: (url: string) => Promise<void>;
|
||||
}
|
||||
/**
|
||||
* The result returned after a successful account connection redirect.
|
||||
*
|
||||
* Combines the redirect login result (including any persisted app state)
|
||||
* with the complete response from the My Account API.
|
||||
*
|
||||
* @template TAppState - The type of application state persisted through the transaction.
|
||||
* @example
|
||||
* const result = await auth0.connectAccountWithRedirect(options);
|
||||
* console.log(result.appState); // Access persisted app state
|
||||
* console.log(result.connection); // The connection of the account you connected to.
|
||||
* console.log(result.response_type === 'connect_code'); // The response type will be 'connect_code'
|
||||
*/
|
||||
export type ConnectAccountRedirectResult<TAppState = any> = CompleteResponse & {
|
||||
/**
|
||||
* State stored when the redirect request was made
|
||||
*/
|
||||
appState?: TAppState;
|
||||
/**
|
||||
* The type of response, for connect account it will be `connect_code`
|
||||
*/
|
||||
response_type: ResponseType.ConnectCode;
|
||||
};
|
||||
/**
|
||||
* @ignore
|
||||
*/
|
||||
export interface AuthenticationResult {
|
||||
state: string;
|
||||
code?: string;
|
||||
/**
|
||||
* This is for the redirect from the connect account flow.
|
||||
*/
|
||||
connect_code?: string;
|
||||
error?: string;
|
||||
error_description?: string;
|
||||
}
|
||||
/**
|
||||
* @ignore
|
||||
*/
|
||||
export interface TokenEndpointOptions {
|
||||
baseUrl: string;
|
||||
client_id: string;
|
||||
grant_type: string;
|
||||
timeout?: number;
|
||||
auth0Client: any;
|
||||
useFormData?: boolean;
|
||||
dpop?: Pick<Dpop, 'generateProof' | 'getNonce' | 'setNonce'>;
|
||||
[key: string]: any;
|
||||
}
|
||||
export type TokenEndpointResponse = {
|
||||
id_token: string;
|
||||
token_type: string;
|
||||
access_token: string;
|
||||
refresh_token?: string;
|
||||
expires_in: number;
|
||||
scope?: string;
|
||||
};
|
||||
/**
|
||||
* @ignore
|
||||
*/
|
||||
export interface OAuthTokenOptions extends TokenEndpointOptions {
|
||||
code_verifier: string;
|
||||
code: string;
|
||||
redirect_uri: string;
|
||||
audience: string;
|
||||
scope: string;
|
||||
}
|
||||
/**
|
||||
* @ignore
|
||||
*/
|
||||
export interface RefreshTokenOptions extends TokenEndpointOptions {
|
||||
refresh_token: string;
|
||||
}
|
||||
/**
|
||||
* @ignore
|
||||
*/
|
||||
export interface JWTVerifyOptions {
|
||||
iss: string;
|
||||
aud: string;
|
||||
id_token: string;
|
||||
nonce?: string;
|
||||
leeway?: number;
|
||||
max_age?: number;
|
||||
organization?: string;
|
||||
now?: number;
|
||||
}
|
||||
export interface IdToken {
|
||||
__raw: string;
|
||||
name?: string;
|
||||
given_name?: string;
|
||||
family_name?: string;
|
||||
middle_name?: string;
|
||||
nickname?: string;
|
||||
preferred_username?: string;
|
||||
profile?: string;
|
||||
picture?: string;
|
||||
website?: string;
|
||||
email?: string;
|
||||
email_verified?: boolean;
|
||||
gender?: string;
|
||||
birthdate?: string;
|
||||
zoneinfo?: string;
|
||||
locale?: string;
|
||||
phone_number?: string;
|
||||
phone_number_verified?: boolean;
|
||||
address?: string;
|
||||
updated_at?: string;
|
||||
iss?: string;
|
||||
aud?: string;
|
||||
exp?: number;
|
||||
nbf?: number;
|
||||
iat?: number;
|
||||
jti?: string;
|
||||
azp?: string;
|
||||
nonce?: string;
|
||||
auth_time?: string;
|
||||
at_hash?: string;
|
||||
c_hash?: string;
|
||||
acr?: string;
|
||||
amr?: string[];
|
||||
sub_jwk?: string;
|
||||
cnf?: string;
|
||||
sid?: string;
|
||||
org_id?: string;
|
||||
org_name?: string;
|
||||
[key: string]: any;
|
||||
}
|
||||
export declare class User {
|
||||
name?: string;
|
||||
given_name?: string;
|
||||
family_name?: string;
|
||||
middle_name?: string;
|
||||
nickname?: string;
|
||||
preferred_username?: string;
|
||||
profile?: string;
|
||||
picture?: string;
|
||||
website?: string;
|
||||
email?: string;
|
||||
email_verified?: boolean;
|
||||
gender?: string;
|
||||
birthdate?: string;
|
||||
zoneinfo?: string;
|
||||
locale?: string;
|
||||
phone_number?: string;
|
||||
phone_number_verified?: boolean;
|
||||
address?: string;
|
||||
updated_at?: string;
|
||||
sub?: string;
|
||||
[key: string]: any;
|
||||
}
|
||||
/**
|
||||
* @ignore
|
||||
*/
|
||||
export type FetchOptions = {
|
||||
method?: string;
|
||||
headers?: Record<string, string>;
|
||||
credentials?: 'include' | 'omit';
|
||||
body?: string;
|
||||
signal?: AbortSignal;
|
||||
};
|
||||
/**
|
||||
* @ignore
|
||||
*/
|
||||
export type FetchResponse = {
|
||||
ok: boolean;
|
||||
headers: Record<string, string | undefined>;
|
||||
json: any;
|
||||
};
|
||||
export type GetTokenSilentlyVerboseResponse = Omit<TokenEndpointResponse, 'refresh_token'>;
|
||||
export {};
|
||||
+5
@@ -0,0 +1,5 @@
|
||||
import { FetchOptions } from './global';
|
||||
import { Dpop } from './dpop/dpop';
|
||||
export declare const createAbortController: () => AbortController;
|
||||
export declare const switchFetch: (fetchUrl: string, audience: string, scope: string, fetchOptions: FetchOptions, worker?: Worker, useFormData?: boolean, timeout?: number, useMrrt?: boolean) => Promise<any>;
|
||||
export declare function getJSON<T>(url: string, timeout: number | undefined, audience: string, scope: string, options: FetchOptions, worker?: Worker, useFormData?: boolean, useMrrt?: boolean, dpop?: Pick<Dpop, 'generateProof' | 'getNonce' | 'setNonce'>, isDpopRetry?: boolean): Promise<T>;
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
import { Auth0Client } from './Auth0Client';
|
||||
import { Auth0ClientOptions } from './global';
|
||||
import './global';
|
||||
export * from './global';
|
||||
/**
|
||||
* Asynchronously creates the Auth0Client instance and calls `checkSession`.
|
||||
*
|
||||
* **Note:** There are caveats to using this in a private browser tab, which may not silently authenticae
|
||||
* a user on page refresh. Please see [the checkSession docs](https://auth0.github.io/auth0-spa-js/classes/Auth0Client.html#checksession) for more info.
|
||||
*
|
||||
* @param options The client options
|
||||
* @returns An instance of Auth0Client
|
||||
*/
|
||||
export declare function createAuth0Client(options: Auth0ClientOptions): Promise<Auth0Client>;
|
||||
export { Auth0Client };
|
||||
export { ConnectError, GenericError, AuthenticationError, TimeoutError, PopupTimeoutError, PopupCancelledError, MfaRequiredError, MissingRefreshTokenError, UseDpopNonceError } from './errors';
|
||||
export { ICache, LocalStorageCache, InMemoryCache, Cacheable, DecodedToken, CacheEntry, WrappedCacheEntry, KeyManifestEntry, MaybePromise, CacheKey, CacheKeyData } from './cache';
|
||||
export { type FetcherConfig } from './fetcher';
|
||||
export { MyAccountApiError } from './MyAccountApiClient';
|
||||
export { CustomTokenExchangeOptions } from './TokenExchange';
|
||||
+21
@@ -0,0 +1,21 @@
|
||||
import { IdToken, JWTVerifyOptions } from './global';
|
||||
export declare const decode: (token: string) => {
|
||||
encoded: {
|
||||
header: string;
|
||||
payload: string;
|
||||
signature: string;
|
||||
};
|
||||
header: any;
|
||||
claims: IdToken;
|
||||
user: any;
|
||||
};
|
||||
export declare const verify: (options: JWTVerifyOptions) => {
|
||||
encoded: {
|
||||
header: string;
|
||||
payload: string;
|
||||
signature: string;
|
||||
};
|
||||
header: any;
|
||||
claims: IdToken;
|
||||
user: any;
|
||||
};
|
||||
+2
@@ -0,0 +1,2 @@
|
||||
export declare const singlePromise: <T>(cb: () => Promise<T>, key: string) => Promise<T>;
|
||||
export declare const retryPromise: (cb: () => Promise<boolean>, maxNumberOfRetries?: number) => Promise<boolean>;
|
||||
+35
@@ -0,0 +1,35 @@
|
||||
/**
|
||||
* @ignore
|
||||
*/
|
||||
/**
|
||||
* Returns a string of unique scopes by removing duplicates and unnecessary whitespace.
|
||||
*
|
||||
* @param {...(string | undefined)[]} scopes - A list of scope strings or undefined values.
|
||||
* @returns {string} A string containing unique scopes separated by a single space.
|
||||
*/
|
||||
export declare const getUniqueScopes: (...scopes: (string | undefined)[]) => string;
|
||||
/**
|
||||
* @ignore
|
||||
*/
|
||||
/**
|
||||
* We will check if the developer has created the client with a string or object of audience:scopes. We will inject
|
||||
* the base scopes to each audience, and store the base ones inside default key. As well, if the developer created the Auth0Client
|
||||
* with a string of scopes, we will store the requested ones with the base scopes inside the default key as well.
|
||||
* @param authScopes The scopes requested by the user when creating the Auth0Client
|
||||
* @param openIdScope openId scope
|
||||
* @param extraScopes Other scopes to accumulate such as offline_access
|
||||
* @returns {Record<string, string>} An object with all scopes that are going to be accumulated.
|
||||
*/
|
||||
export declare const injectDefaultScopes: (authScopes: string | Record<string, string> | undefined, openIdScope: string, ...extraScopes: string[]) => Record<string, string>;
|
||||
/**
|
||||
* @ignore
|
||||
*/
|
||||
/**
|
||||
* Will return a string of scopes. If a specific audience was requested and it exist inside the scopes object, we will return those
|
||||
* related to that audience that we want to accumulate. If not, we will return the ones stored inside the default key.
|
||||
* @param authScopes Object of audience:scopes that are going to be accumulated
|
||||
* @param methodScopes The scopes requested for the developer in a specific request
|
||||
* @param audience The audience the developer requested for an specific request or the one they configured in the Auth0Client
|
||||
* @returns {string} A combination of Auth0Client scopes and the ones requested by the developer for a specific request
|
||||
*/
|
||||
export declare const scopesToRequest: (authScopes: Record<string, string>, methodScopes: string | undefined, audience: string | undefined) => string;
|
||||
+26
@@ -0,0 +1,26 @@
|
||||
interface ClientStorageOptions {
|
||||
daysUntilExpire?: number;
|
||||
cookieDomain?: string;
|
||||
}
|
||||
/**
|
||||
* Defines a type that handles storage to/from a storage location
|
||||
*/
|
||||
export type ClientStorage = {
|
||||
get<T extends Object>(key: string): T | undefined;
|
||||
save(key: string, value: any, options?: ClientStorageOptions): void;
|
||||
remove(key: string, options?: ClientStorageOptions): void;
|
||||
};
|
||||
/**
|
||||
* A storage protocol for marshalling data to/from cookies
|
||||
*/
|
||||
export declare const CookieStorage: ClientStorage;
|
||||
/**
|
||||
* Cookie storage that creates a cookie for modern and legacy browsers.
|
||||
* See: https://web.dev/samesite-cookie-recipes/#handling-incompatible-clients
|
||||
*/
|
||||
export declare const CookieStorageWithLegacySameSite: ClientStorage;
|
||||
/**
|
||||
* A storage protocol for marshalling data to/from session storage
|
||||
*/
|
||||
export declare const SessionStorage: ClientStorage;
|
||||
export {};
|
||||
+33
@@ -0,0 +1,33 @@
|
||||
import { ClientStorage } from './storage';
|
||||
export interface LoginTransaction {
|
||||
nonce: string;
|
||||
scope: string;
|
||||
audience: string;
|
||||
appState?: any;
|
||||
code_verifier: string;
|
||||
redirect_uri?: string;
|
||||
organization?: string;
|
||||
state?: string;
|
||||
response_type: 'code';
|
||||
}
|
||||
export interface ConnectAccountTransaction {
|
||||
appState?: any;
|
||||
audience?: string;
|
||||
auth_session: string;
|
||||
code_verifier: string;
|
||||
redirect_uri: string;
|
||||
scope?: string;
|
||||
state: string;
|
||||
connection: string;
|
||||
response_type: 'connect_code';
|
||||
}
|
||||
export declare class TransactionManager {
|
||||
private storage;
|
||||
private clientId;
|
||||
private cookieDomain?;
|
||||
private storageKey;
|
||||
constructor(storage: ClientStorage, clientId: string, cookieDomain?: string | undefined);
|
||||
create<T extends Object = LoginTransaction>(transaction: T): void;
|
||||
get<T extends Object = LoginTransaction>(): T | undefined;
|
||||
remove(): void;
|
||||
}
|
||||
+35
@@ -0,0 +1,35 @@
|
||||
import { AuthenticationResult, PopupConfigOptions } from './global';
|
||||
export declare const parseAuthenticationResult: (queryString: string) => AuthenticationResult;
|
||||
export declare const runIframe: (authorizeUrl: string, eventOrigin: string, timeoutInSeconds?: number) => Promise<AuthenticationResult>;
|
||||
export declare const openPopup: (url: string) => Window | null;
|
||||
export declare const runPopup: (config: PopupConfigOptions) => Promise<AuthenticationResult>;
|
||||
export declare const getCrypto: () => Crypto;
|
||||
export declare const createRandomString: () => string;
|
||||
export declare const encode: (value: string) => string;
|
||||
export declare const decode: (value: string) => string;
|
||||
/**
|
||||
* Strips any property that is not present in ALLOWED_AUTH0CLIENT_PROPERTIES
|
||||
* @param auth0Client - The full auth0Client object
|
||||
* @returns The stripped auth0Client object
|
||||
*/
|
||||
export declare const stripAuth0Client: (auth0Client: any) => any;
|
||||
export declare const createQueryParams: ({ clientId: client_id, ...params }: any) => string;
|
||||
export declare const sha256: (s: string) => Promise<any>;
|
||||
export declare const urlDecodeB64: (input: string) => string;
|
||||
export declare const bufferToBase64UrlEncoded: (input: number[] | Uint8Array) => string;
|
||||
export declare const validateCrypto: () => void;
|
||||
/**
|
||||
* @ignore
|
||||
*/
|
||||
export declare const getDomain: (domainUrl: string) => string;
|
||||
/**
|
||||
* @ignore
|
||||
*/
|
||||
export declare const getTokenIssuer: (issuer: string | undefined, domainUrl: string) => string;
|
||||
export declare const parseNumber: (value: any) => number | undefined;
|
||||
/**
|
||||
* Ponyfill for `Object.fromEntries()`, which is not available until ES2020.
|
||||
*
|
||||
* When the target of this project reaches ES2020, this can be removed.
|
||||
*/
|
||||
export declare const fromEntries: <T = any>(iterable: Iterable<[PropertyKey, T]>) => Record<PropertyKey, T>;
|
||||
+2
@@ -0,0 +1,2 @@
|
||||
declare const _default: "2.9.1";
|
||||
export default _default;
|
||||
+1
@@ -0,0 +1 @@
|
||||
export {};
|
||||
+15
@@ -0,0 +1,15 @@
|
||||
import { FetchOptions } from '../global';
|
||||
/**
|
||||
* @ts-ignore
|
||||
*/
|
||||
export type WorkerRefreshTokenMessage = {
|
||||
timeout: number;
|
||||
fetchUrl: string;
|
||||
fetchOptions: FetchOptions;
|
||||
useFormData?: boolean;
|
||||
useMrrt?: boolean;
|
||||
auth: {
|
||||
audience: string;
|
||||
scope: string;
|
||||
};
|
||||
};
|
||||
+7
@@ -0,0 +1,7 @@
|
||||
import { WorkerRefreshTokenMessage } from './worker.types';
|
||||
/**
|
||||
* Sends the specified message to the web worker
|
||||
* @param message The message to send
|
||||
* @param to The worker to send the message to
|
||||
*/
|
||||
export declare const sendMessage: (message: WorkerRefreshTokenMessage, to: Worker) => Promise<unknown>;
|
||||
Reference in new issue
Block a user