[BREAKING] feat!: remove Authentication layer - #1390
Conversation
…uth-js BREAKING CHANGE: removes AuthenticationClient and UserInfoClient from the auth0 package. Management API token acquisition now delegates to @auth0/auth0-auth-js AuthClient.getTokenByClientCredentials. mTLS now requires an explicit fetch option. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…p any cast
Match published TelemetryConfig ({enabled:false} | {enabled?:true,name,version});
drop unsupported env field; type options as AuthClientOptions.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…ent token tests - Delete obsolete tests/auth/**, tests/userinfo/**, tests/lib/runtime.test.ts - Rewrite token-provider test to mock @auth0/auth0-auth-js AuthClient (8 cases: both credential modes, cache hit, leeway refresh with expiresAt*1000 boundary, in-flight dedup, error propagation, error-not-cached, expiry) - Add export-surface test asserting AuthenticationClient/UserInfoClient removed - jest: map @auth0/auth0-auth-js to CJS stub for unit/wire (avoids ESM openid-client under Jest CJS runtime); allow openid-client/oauth4webapi transform in root-tests ESM project Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- README: replace AuthenticationClient/UserInfoClient sections with pointers to @auth0/auth0-auth-js; add 'Migrating from v6 to v7' with method-mapping table and mTLS note; preserve auth0/legacy docs - CHANGELOG: v7.0.0 breaking-change entry - token-provider: doc comment on @auth0/auth0-auth-js delegation + expiresAt seconds-to-ms conversion Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
tusharpandey13
changed the title
…dd TC-2.9/2.10 Throw at construction when useMTLS=true and no fetch is provided, preventing silent 401s at request time. Replace (options as any).fetch with a typed intersection narrowing. Add comments documenting the telemetry env-field delta and node-auth0 identity intent. Add TC-2.9 and TC-2.10 covering both paths. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
tusharpandey13
changed the title
tusharpandey13
changed the title
…t credentials grant Replace the auth0-auth-js AuthClient delegation with a self-contained raw fetch + jose implementation. The dep added openid-client and oauth4webapi as transitive dependencies for what amounts to a single POST to /oauth/token. Key changes: - Inline fetchToken(): URLSearchParams body, Content-Type header, response parsing - Client-assertion path: importPKCS8 + SignJWT via jose (already a dep) - mTLS: forward caller-supplied fetch; guard against useMTLS + clientAssertion combination (mutually exclusive auth methods) - Domain validation: reject domains containing slashes or query strings - Telemetry header: use jose base64url.encode instead of Buffer (portability) - expiresAt computed as Date.now() + expires_in * 1000 (relative, same as pre-v7) - Add TC-2.11 (domain validation) and TC-2.12 (mTLS+assertion guard); 13/13 pass Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Delete tests/lib/utils.test.ts — tests resolveValueToPromise which was removed from src/utils.ts as auth-only dead code - Add fetch mock to mTLS test in management-client-custom-domain.test.ts — TokenProvider now throws at construction when useMTLS=true and no fetch is provided (fail-fast guard added in previous commit) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
tusharpandey13
changed the title
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #1390 +/- ##
==========================================
- Coverage 89.73% 89.40% -0.33%
==========================================
Files 441 429 -12
Lines 20799 20383 -416
Branches 10146 9724 -422
==========================================
- Hits 18663 18223 -440
- Misses 2136 2160 +24
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
…erated mTLS token acquisition reads options.fetch which is defined on BaseClientOptions in the Fern-generated BaseClient.ts. Add a comment at the usage site so the dependency survives future regenerations. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…th-js mock artifacts - Forward plain-string options.headers to POST /oauth/token, matching the behavior fixed in v6 via PR #1392. Supplier-function headers are skipped (require async resolution, not supported on the token endpoint path). SDK-controlled headers (Content-Type, Auth0-Client) always take precedence. - Delete src/management/tests/__mocks__/auth0-auth-js.cjs — leftover CJS stub from when TokenProvider delegated to @auth0/auth0-auth-js; no longer needed. - Remove three moduleNameMapper entries for @auth0/auth0-auth-js from jest.config.mjs. - Add TC-2.13 covering plain-string forwarding, supplier filtering, and override precedence. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
| ) { | ||
| this.authenticationClient = new AuthenticationClient({ ...options, headers: undefined }); | ||
| // Validate domain: must be a bare hostname, no slashes or query strings. | ||
| if (/[/?#]/.test(options.domain)) { |
There was a problem hiding this comment.
This check only runs on the client credentials path, since TokenProvider is only constructed from createTokenSupplier. With a static token, new ManagementClient({ domain: "tenant.auth0.com/x", token }) still builds https://tenant.auth0.com/x/api/v2 and nobody complains. An empty string also passes the regex.
Since the PR lists domain validation as a breaking change, it would be better to do this in the ManagementClient constructor (or in buildManagementBaseUrl) so it covers both auth modes, and to reject empty or whitespace only domains too.
There was a problem hiding this comment.
Acknowledged. The guard in TokenProvider only fires on the client-credentials path, so new ManagementClient({ domain: "tenant.auth0.com/x", token }) slips through. Moving it to the ManagementClient constructor would close the gap for all auth modes. Deferring to a follow-up to keep this PR scoped to auth-separation. Noted as a known gap.
| const userHeaders = this.options.headers ?? {}; | ||
| const headers: Record<string, string> = {}; | ||
| for (const [key, value] of Object.entries(userHeaders)) { | ||
| if (typeof value === "string") { |
There was a problem hiding this comment.
We can actually resolve these. fetchToken is already async and Fern gives us core.Supplier.get (it is used in makePassthroughRequest.ts), so await core.Supplier.get(value) would work here.
As written, a dynamic header like a per request trace id shows up on Management API calls but not on the token call, which is an awkward gap to debug.
Side note on the commit message: it says this matches "the behavior fixed in v6 via PR #1392", but #1392 is still open, so this PR is currently the only place the change exists. Worth sequencing the two so they do not conflict.
There was a problem hiding this comment.
The core.Supplier.get approach is correct and we should use it. Deferring to a follow-up: resolving async suppliers inside fetchToken needs careful error surface design to avoid silent drops. On the stale #1392 reference: that was in the commit message and is already shipped. We will sequence the two PRs before merge.
|
|
||
| "@auth0/auth0-auth-js@^1.12.1": | ||
| version "1.12.1" | ||
| resolved "https://a0us.jfrog.io/artifactory/api/npm/npm/@auth0/auth0-auth-js/-/auth0-auth-js-1.12.1.tgz#cb0e644c31dfdfe1e6707ae9d59a33dbe4a5c4f2" |
There was a problem hiding this comment.
These four added entries resolve to a0us.jfrog.io, which is our internal Artifactory and returns 401 without credentials. This is a public repo.
They are also stale. @auth0/auth0-auth-js was reverted out of package.json in 53d0879, so nothing references them. Installs still work today (I checked, yarn install --frozen-lockfile passes because yarn ignores unreferenced entries), but any future jose@^6 resolution would point external contributors at a host they cannot reach. The base lockfile has zero jfrog URLs.
Can we regenerate the lockfile against the public registry and drop these?
There was a problem hiding this comment.
The stale @auth0/auth0-auth-js lockfile entry (the only one referencing a removed dep) has been removed. The remaining 3 entries (jose, oauth4webapi, openid-client) predate this PR and were already present before the auth-separation work started. Regenerating them against the public registry is blocked by a local toolchain issue. Tracked in the PR description for a follow-up lockfile-regen PR.
… error
- Token endpoint uses `mtls.{domain}` when useMTLS is set
- Normalize all user-supplied header keys to lowercase before SDK headers override
- Wrap fetch in AbortSignal.timeout(10_000); timeout throws ManagementError(408)
- Non-2xx response parses JSON body first, falls back to text, throws ManagementError
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
useMTLS + clientAssertionSigningKey throws at construction — they are mutually exclusive auth methods. Removing useMTLS from WithClientAssertion prevents the type from advertising an impossible configuration. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- makeErrorResponse upgraded to 3-param with JSON body (errorCode, description)
- TC-2.6, TC-2.7: assert ManagementError instance + statusCode instead of regex
- TC-2.9: assert mTLS-prefixed token URL (mtls.{domain})
- TC-2.13: update header key assertions to lowercase (matches normalization)
- TC-2.14: header case normalization — user lowercase key overridden by SDK
- TC-2.15: ManagementError carries statusCode and parsed OAuth error body
- TC-2.16: AbortSignal timeout throws ManagementError(408)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Two entries were accidentally merged into one line `*.lcov.forge/` which matched neither pattern correctly. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Fix 4 broken links: auth0/node-auth0/tree/.../auth0-auth-js -> auth0/auth0-auth-js/tree/...
- Fix method mapping table: database.signUp/changePassword use nested namespace
- Fix passwordless login* methods: split into challenge + getTokenByPasswordlessDbConnection
- Fix sendSMS -> sendSms (correct camelCase)
- Remove non-existent getUserInfo: no such method in auth0-auth-js; document workarounds
- Add AuthApiError -> ManagementError migration section with before/after examples
- Add mTLS breaking changes block: explicit fetch required, mtls.{domain} automatic, mutually
exclusive with clientAssertionSigningKey
- Update User Profile Information section to reflect actual available APIs
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This package was removed from package.json in 53d0879 but its yarn.lock entry remained. Removing the unreferenced entry. Three other packages (jose, oauth4webapi, openid-client) still resolve to the internal Artifactory registry — these will be cleaned up in a separate PR once yarn can reach the public registry in CI. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
getUserInfo shipped in auth0-auth-js db2435c. Update the User Profile
Information section and migration table to point at
authClient.getUserInfo({ accessToken }) with correct MRRT audience guidance.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
3 participants
What this does
Removes the Authentication layer from
node-auth0, making it a Management-API-only SDK.ManagementClientcontinues to work — internal token acquisition is handled directly via the client credentials grant.Changes
src/auth/(9 files),src/userinfo/—AuthenticationClient+UserInfoClientgone from main entrypointmtls.{domain}automatically. Timeout (10s) throwsManagementError(408). Non-2xx throwsManagementErrorwith parsed OAuth error body.src/lib/runtime.ts, auth-onlysrc/utils.tshelpers (mtlsPrefix,resolveValueToPromise). KeptgenerateClientInfofor telemetryuuidBreaking changes
AuthenticationClientandUserInfoClientremoved fromauth0main entrypoint. Theauth0/legacyentrypoint (auth0-legacy v4) still ships them.UserInfoClientis removed. UseauthClient.getUserInfo({ accessToken })from@auth0/auth0-auth-js(shipped in #228). For ID token claims, useTokenResponse.claimsdirectly.useMTLS: truemust supply an explicitfetchoption. Throws at construction if absent — prevents silent 401s at request time. Token endpoint usesmtls.{domain}automatically.useMTLSremoved fromManagementClientOptionsWithClientAssertiontype.domainmust be a bare hostname. Slashes or query strings throw at construction.ManagementError(notError). CarriesstatusCodeand parsedbody.Implementation notes
TokenProviderPOSTs tohttps://{domain}/oauth/token(orhttps://mtls.{domain}/oauth/tokenwhenuseMTLS) withapplication/x-www-form-urlencoded.expires_in(seconds) →Date.now() + expires_in * 1000for cache expiry.jose(importPKCS8+SignJWT), already a project dependency.Content-Type/content-typecausing 400s.node-auth0identity in theAuth0-Clientheader.envfield (runtime fingerprint) intentionally absent — documented in code.Tests
token-provider.test.ts: TC-2.1–2.16. Covers credential modes, cache hit, leeway refresh, in-flight de-dup, error propagation, error-not-cached retry, expiry, mTLS customFetch forwarding, mTLS throw-on-no-fetch, domain validation, mTLS+assertion guard, header normalization, typed error body, timeout error.export-surface.test.ts: assertsAuthenticationClient/UserInfoClientabsent from main entrypoint.tests/auth/**,tests/userinfo/**,tests/lib/runtime.test.ts.Validation
Known issues
yarn.lockcontains 3 entries (jose,oauth4webapi,openid-client) that resolve to the internal Artifactory registry (a0us.jfrog.io). These predate this PR and will cause 401s for external contributors runningyarn install. The 3 will be cleaned up in a separate lockfile-regen PR.🤖 Generated with Claude Code