feature/customTokenExchange

[tusharpandey13]

Changes

Authentication api

• Added custom token exchange grant method for authenticationClient
• Added tests for same

Management api

Path	HTTP Method	Method Name
/token-exchange-profiles/{id}	DELETE	delete
/token-exchange-profiles/{id}	PATCH	update
/token-exchange-profiles	POST	create
/token-exchange-profiles	GET	getAll
/token-exchange-profiles/{id}	GET	get

• Added tests for same

Misc

• Removed lodash-es from package-lock.json

References

Custom Token Exchange Beta

Test results

Test Suites: 47 passed, 47 total
Tests:       1482 passed, 1482 total
Snapshots:   0 total
Time:        8.113 s
Ran all test suites.

Manual Testing Guide

Pre-Requisites

1. Enable the CTE feature in your Auth0 tenant.
2. Create an application with token_exchange set to custom_authentication.
3. Deploy a Custom Token Exchange Action and note its Action ID.
4. Securely store your Client ID, Client Secret, and Management API token.
5. Install the SDK: npm install auth0

Test Scenarios

1. Create CTE Profile
   Use the following code to create a profile:

   managementClient.tokenExchangeProfiles.create({
     action_id: '<ACTION_ID>',
     name: 'Test Profile',
     subject_token_type: 'urn:acme:test-token',
     type: 'custom_authentication',
   });

2. Token Exchange Request
   Exchange a valid token using:

   const response = await authenticationClient.tokenExchange.exchangeToken({
     subject_token_type: 'urn:acme:test-token',
     subject_token: '<VALID_TOKEN>',
     audience: 'https://api.example.com',
     scope: 'openid profile email',
   });
   console.log(response);

Appendix

1. Invalid Token Handling: Use an expired or invalid subject_token and ensure the Action uses api.access.rejectInvalidSubjectToken to handle errors.

2. Set Metadata: Update user metadata in the Action by adding api.user.setUserMetadata('locale', 'en-US');

3. Action Validation
   Add logging in the Action to validate request data: console.log(event.transaction.subject_token);

Checklist

• I have read the Auth0 general contribution guidelines
• I have read the Auth0 Code of Conduct
• All existing and new tests complete without errors