feat(auth0-express-api): add support for on-behalf-of token exchange

[nandan-bhat]

What changed

chore: bump auth0-api-js and re-export its public API

@auth0/auth0-api-js goes from ^1.4.0 to ^1.6.1, since OBOTE (On-behalf-Of Token Exchange) landed in 1.6.0. Re-exports only what this package's surface already exposes: the actor claim helpers, the errors it can throw, the OBO types, and ApiClient as a type only, so createAuth0Api() stays the only way to build a client.

feat: on-behalf-of token exchange

• requiresAuth() now sets req.auth0.token alongside req.auth0.user, so a token on the request is always one this API has verified. It is non-enumerable, so JSON.stringify, spreads and console.log leave it out.
• The exchange is api-js, not a wrapper. Call req.auth0.client.getTokenOnBehalfOf(token, { audience, scope }) and pass the subject token yourself.
• On a protected route that token is req.auth0.token. Anywhere else it can be a token your API holds for elsewhere, such as one stored for a background job.
• Needs clientId plus either clientSecret or clientAssertionSigningKey.
• EXAMPLES.md gains an API as a client section, which is where token verification and token exchange get separated. It covers the tenant prerequisites, the two errors, and why a subject token must never come from the request.

Usage Example

import { requiresAuth } from '@auth0/auth0-express-api';

app.get('/orders', requiresAuth(), async (req, res) => {
  const { accessToken } = await req.auth0.client.getTokenOnBehalfOf(req.auth0.token!, {
    audience: 'https://orders.example.com',
    scope: 'read:orders',
  });

  const orders = await fetch('https://orders.example.com/orders', {
    headers: { authorization: `Bearer ${accessToken}` },
  });

  res.json(await orders.json());
});

Testing

• All tests pass across 8 files, including the exchange end to end through msw, a missing subject token, missing
  credentials and a tenant rejection
• npm run build and npm run lint are clean

[Piyush-85]

PTAL @nandan-bhat

[kishore7snehil]

LGTM!

[Piyush-85]

LGTM