fix(auth0-auth-js): derive challenge type from authenticator_type and oob_channel#165
Open
GuaiamumSuspeito wants to merge 2 commits into
Open
Conversation
… oob_channel `transformAuthenticatorResponse` was copying `api.type`, a field the Auth0 GET /mfa/authenticators endpoint never returns. This caused every authenticator's `type` to be `undefined`, which made auth0-spa-js's `getAuthenticators()` filter out all results and return an empty array. The fix derives `type` from `authenticator_type` and `oob_channel` using a new `deriveChallengeType` helper, matching the challenge types that downstream consumers expect (otp, recovery-code, phone, push-notification, email). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…mments Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
| /** Additional type information */ | ||
| type?: string; | ||
| /** Challenge type derived from authenticator_type and oob_channel */ | ||
| type?: ChallengeType; |
Author
There was a problem hiding this comment.
This is a library API break, not sure what's the approach on API breaks for the repo, but if you'd rather avoid it than doing a major bump or breaking consumers, we can keep it as a plain string and leave the conversion to @auth0/auth0-spa-js
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
mfa.getAuthenticators()in@auth0/auth0-spa-jsalways returns an empty array, even when the user has active MFA authenticators enrolled.The bug spans two packages:
Layer 1 —
@auth0/auth0-auth-js(this fix):transformAuthenticatorResponseinutils.tsmapsapi.typeto the response, but the Auth0GET /mfa/authenticatorsendpoint does not return atypefield. Per the official API docs, the response usesauthenticator_typeandoob_channel:[ {"authenticator_type": "recovery-code", "id": "recovery-code|dev_...", "active": true}, {"authenticator_type": "otp", "id": "totp|dev_...", "active": true}, {"authenticator_type": "oob", "oob_channel": "sms", "id": "sms|dev_...", "name": "+1123XXXXX", "active": true} ]Since
api.typeis alwaysundefined, every transformed authenticator hastype: undefined.Layer 2 —
@auth0/auth0-spa-js(downstream):MfaApiClient.getAuthenticatorsfilters authenticators withif (!auth.type) return false, which rejects everything becausetypeis alwaysundefined.The fix adds a
deriveChallengeType(authenticatorType, oobChannel)function that maps the API fields to the challenge typesauth0-spa-jsexpects:authenticator_typeoob_channeltypeotpotprecovery-coderecovery-codeoobsmsphoneoobvoicephoneoobauth0push-notificationoobemailemailAlso adds
oob_channel(singular) toAuthenticatorApiResponseand exports a newChallengeTypeunion type.References
@auth0/auth0-spa-jsChallengeTypedefinition:src/mfa/types.ts@auth0/auth0-spa-jsfilter inMfaApiClient.getAuthenticators:src/mfa/MfaApiClient.tsTesting
Added 8 unit tests for
deriveChallengeTypecovering all authenticator type / OOB channel combinations and edge cases (unknown types, missing channel). Updated existinglistAuthenticatorstests to assert the derivedtypevalues ('otp','phone') instead ofundefined. Updated mock data to includeoob_channelto match real API response shapes.All 146 existing tests pass.
Checklist