JavaScript SDK (@auris/js)

npm install @auris/js

pnpm add @auris/js

yarn add @auris/js

import { AurisClient } from '@auris/js'
 
const auris = new AurisClient({
  domain: 'auth.yourdomain.com',  // Dein Auris-Tenant-Domain (erforderlich)
  clientId: 'app_xxxxx',          // Anwendungs-Client-ID aus der Console (erforderlich)
  redirectUri: 'http://localhost:3000/callback', // Muss einer registrierten Callback-URL entsprechen (für PKCE erforderlich)
  tenant: 'my-tenant',            // Tenant-Bezeichner als x-tenant-Header (optional, Standard: 'default')
  storage: 'localStorage',        // Token-Speicher: 'localStorage' | 'sessionStorage' | 'memory' | TokenStore-Instanz
  autoRefresh: true,              // Access-Tokens vor Ablauf automatisch erneuern (Standard: true)
  scope: 'openid profile email',  // Anzufordernde OAuth2-Scopes (Standard: 'openid profile email')
})

loginWithRedirect(options?: LoginWithRedirectOptions): Promise<void>

// Einfache Login-Weiterleitung
await auris.loginWithRedirect()
 
// Registrierungsbildschirm öffnen
await auris.loginWithRedirect({ screen_hint: 'signup' })
 
// E-Mail vorausfüllen und Re-Authentifizierung erzwingen
await auris.loginWithRedirect({ login_hint: '[email protected]', prompt: 'login' })

handleRedirectCallback(): Promise<AuthResult>

const result = await auris.handleRedirectCallback()
 
if (result.user) {
  console.log('Angemeldet als', result.user.email)
  window.location.href = '/dashboard'
}

login(email: string, password: string): Promise<AuthResult>

const result = await auris.login('[email protected]', 'hunter2')
console.log(result.user.id)

signup(email: string, password: string, options?: SignupOptions): Promise<AuthResult>

const result = await auris.signup('[email protected]', 'securepassword', {
  firstName: 'Bob',
  lastName: 'Smith',
})

logout(options?: LogoutOptions): Promise<void>

// Tokens löschen und zur Startseite weiterleiten
await auris.logout({ returnTo: 'http://localhost:3000' })
 
// Tokens löschen ohne Weiterleitung (z.B. in einem Node.js-Kontext)
await auris.logout()

getUser(): Promise<UserInfo | null>

const user = await auris.getUser()
if (user) {
  console.log(user.id)       // Auris-Benutzer-ID
  console.log(user.email)
  console.log(user.roles)    // string[] — zugewiesene Rollen
  console.log(user.metadata) // Record<string, unknown>
}

isAuthenticated(): Promise<boolean>

if (await auris.isAuthenticated()) {
  // Authentifizierte Operationen durchführen
}

getAccessToken(): Promise<string | null>

const token = await auris.getAccessToken()
 
// Token in API-Anfragen verwenden
const response = await fetch('/api/data', {
  headers: { Authorization: `Bearer ${token}` },
})

refreshToken(): Promise<AuthResult>

const result = await auris.refreshToken()
console.log(result.accessToken)

loginWithMagicLink(email: string): Promise<void>

await auris.loginWithMagicLink('[email protected]')
// Weiterleiten oder "Überprüfe deine E-Mails"-Nachricht anzeigen

verifyMagicLink(token: string): Promise<AuthResult>

const urlParams = new URLSearchParams(window.location.search)
const token = urlParams.get('token')
 
if (token) {
  const result = await auris.verifyMagicLink(token)
  console.log('Authentifiziert:', result.user)
}

forgotPassword(email: string): Promise<void>

await auris.forgotPassword('[email protected]')

loginWithSocial(provider: SocialProvider): Promise<void>

type SocialProvider =
  | 'google'
  | 'github'
  | 'microsoft'
  | 'apple'
  | 'facebook'
  | 'discord'
  | 'linkedin'
  | 'twitter'
  | 'slack'

await auris.loginWithSocial('google')
await auris.loginWithSocial('github')

getM2MToken(clientSecret: string, scopes?: string[]): Promise<M2MTokenResult>

const result = await auris.getM2MToken('cs_live_xxxxx', ['read:users', 'manage:roles'])
console.log(result.accessToken)
console.log(result.expiresIn) // Sekunden bis zum Ablauf

onAuthStateChange(callback: (user: UserInfo | null) => void): Unsubscribe

const unsubscribe = auris.onAuthStateChange((user) => {
  if (user) {
    console.log('Angemeldet:', user.email)
  } else {
    console.log('Abgemeldet')
  }
})
 
// Wenn der Listener nicht mehr benötigt wird:
unsubscribe()

check(permissions: string[]): Promise<PermissionCheckResult>

const result = await auris.permissions.check(['manage:users', 'view:reports'])
 
if (result.has('manage:users')) {
  // Admin-UI anzeigen
}
 
if (result.hasAll) {
  // Benutzer hat beide Berechtigungen
}

checkOne(permission: string): Promise<boolean>

const canDelete = await auris.permissions.checkOne('delete:documents')
if (canDelete) {
  showDeleteButton()
}

listUserPermissions(): Promise<string[]>

const permissions = await auris.permissions.listUserPermissions()
console.log(permissions) // ['view:documents', 'create:documents', 'manage:users', ...]

check(input: FgaCheckInput): Promise<FgaCheckResult>

const result = await auris.fga.check({
  objectType: 'document',
  objectId: 'doc_abc123',
  relation: 'editor',
  subjectType: 'user',
  subjectId: user.id,
})
 
if (result.allowed) {
  enableEditMode()
}

const tree = await auris.fga.expand({
  objectType: 'project',
  objectId: 'proj_xyz',
  relation: 'member',
})

// Alle Dokumente auflisten, die der aktuelle Benutzer anzeigen kann
const documentIds = await auris.fga.listObjects({
  objectType: 'document',
  relation: 'viewer',
  subjectType: 'user',
  subjectId: user.id,
})

await auris.fga.writeTuples([
  {
    objectType: 'document',
    objectId: 'doc_abc123',
    relation: 'editor',
    subjectType: 'user',
    subjectId: 'usr_456',
  },
])

await auris.fga.deleteTuples([
  {
    objectType: 'document',
    objectId: 'doc_abc123',
    relation: 'editor',
    subjectType: 'user',
    subjectId: 'usr_456',
  },
])

import { createManagementClient } from '@auris/js'
 
const mgmt = await createManagementClient({
  domain: 'auth.yourdomain.com',
  clientId: 'app_xxxxx',
  clientSecret: 'cs_live_xxxxx',
  tenant: 'my-tenant',
})

// Benutzer mit Paginierung auflisten
const { users, total } = await mgmt.users.list({ page: 1, limit: 50 })
 
// Einzelnen Benutzer nach ID abrufen
const user = await mgmt.users.get('usr_abc123')
 
// Benutzer erstellen
const newUser = await mgmt.users.create({
  email: '[email protected]',
  password: 'temporary-password',
  firstName: 'Alice',
  roles: ['editor'],
})
 
// Benutzer aktualisieren
await mgmt.users.update('usr_abc123', { firstName: 'Alicia' })
 
// Benutzer deaktivieren
await mgmt.users.update('usr_abc123', { enabled: false })
 
// Benutzer löschen
await mgmt.users.delete('usr_abc123')

const orgs = await mgmt.organizations.list()
const org = await mgmt.organizations.get('org_xyz')
const newOrg = await mgmt.organizations.create({ name: 'Acme GmbH', slug: 'acme' })
await mgmt.organizations.update('org_xyz', { name: 'Acme Corporation' })
await mgmt.organizations.delete('org_xyz')

const roles = await mgmt.roles.list()
const role = await mgmt.roles.get('role_abc')
const newRole = await mgmt.roles.create({ name: 'Editor', description: 'Kann Inhalte bearbeiten' })
await mgmt.roles.update('role_abc', { description: 'Kann Inhalte anzeigen und bearbeiten' })
await mgmt.roles.delete('role_abc')

import express from 'express'
import { verifyWebhookSignature } from '@auris/js'
 
const app = express()
 
app.post('/webhooks/auris', express.raw({ type: 'application/json' }), async (req, res) => {
  const isValid = await verifyWebhookSignature({
    payload: req.body.toString('utf-8'),
    signature: req.headers['x-webhook-signature'],
    secret: process.env.AURIS_WEBHOOK_SECRET,
    timestamp: req.headers['x-webhook-timestamp'],
  })
 
  if (!isValid) {
    return res.status(401).json({ error: 'Ungültige Signatur' })
  }
 
  const event = JSON.parse(req.body)
  console.log('Event empfangen:', event.type)
  res.json({ received: true })
})

import { verifyJwt } from '@auris/js'
 
try {
  const payload = await verifyJwt(
    accessToken,
    `https://${process.env.AURIS_DOMAIN}/.well-known/jwks.json`
  )
  console.log('Benutzer-ID:', payload.sub)
  console.log('Rollen:', payload.roles)
} catch (err) {
  console.error('Token ungültig:', err.message)
}

interface AuthResult {
  user: UserInfo
  accessToken: string
  refreshToken?: string
  expiresIn: number
  tokenType: 'Bearer'
}
 
interface UserInfo {
  id: string
  sub: string
  email: string
  emailVerified: boolean
  name: string
  firstName: string
  lastName: string
  username: string
  picture?: string
  roles: string[]
  metadata: Record<string, unknown>
  tenant: string
  createdAt: string
}
 
interface TokenStore {
  get(key: string): string | null | Promise<string | null>
  set(key: string, value: string): void | Promise<void>
  remove(key: string): void | Promise<void>
}
 
type Unsubscribe = () => void

import { AurisClient, TokenStore } from '@auris/js'
 
class RedisTokenStore implements TokenStore {
  constructor(private redis: RedisClient, private prefix = 'auris:') {}
 
  async get(key: string) {
    return this.redis.get(this.prefix + key)
  }
 
  async set(key: string, value: string) {
    await this.redis.set(this.prefix + key, value, { EX: 60 * 60 * 24 })
  }
 
  async remove(key: string) {
    await this.redis.del(this.prefix + key)
  }
}
 
const auris = new AurisClient({
  domain: 'auth.yourdomain.com',
  clientId: 'app_xxxxx',
  storage: new RedisTokenStore(redisClient),
})

import { AurisClient, AurisError } from '@auris/js'
 
try {
  await auris.login('[email protected]', 'wrongpassword')
} catch (err) {
  if (err instanceof AurisError) {
    console.error(err.code)    // z.B. 'invalid_credentials', 'account_locked', 'mfa_required'
    console.error(err.message) // Lesbare Fehlermeldung
    console.error(err.status)  // HTTP-Statuscode (z.B. 401, 403, 429)
  }
}