feat(auth0-server-js): add challengePasswordlessDbConnection and complete PasswordlessDbConnection

[Piyush-85]

Summary

Adds database-connection passwordless (OTP) support to ServerClient, exposing the two-step flow that @auth0/auth0-auth-js already implements but ServerClient never surfaced.

New methods:

• challengePasswordlessDbConnection(options, storeOptions?, requestOptions?) — sends an OTP to the user for a DB connection configured with email_otp or phone_otp. Discriminates email vs. phone on the presence of phoneNumber. No session is written.
• completePasswordlessDbConnection(options, storeOptions?, requestOptions?) — submits authSession + otp to the token endpoint (passwordless/otp grant), persists a fresh session, and returns authorizationDetails. Scope is caller-controlled (not auto-injected), matching the core contract. Supports fullResponse: true. When the server responds with mfa_required, the error propagates as PasswordlessDbGetTokenError with cause.mfa_token accessible via isMfaRequiredError.

Both methods resolve the domain per call and work in static and resolver (multi-tenant) modes.

Companion fix: completePasswordless and completePasswordlessMagicLink were missing applySessionExpiryAtLogin, unlike completeInteractiveLogin and mfa.verify. Both now stamp the IPSIE session_expiry ceiling at login — additive and no-op unless the tenant configures a session-expiry policy.

New re-exports: ChallengeWithEmailOptions, ChallengeWithPhoneNumberOptions, PasswordlessChallenge, TokenByPasswordlessDbConnectionOptions, PasswordlessChallengeError, PasswordlessDbGetTokenError.

Testing

Tested with npm test in packages/auth0-server-js — all 515 tests pass. TypeScript clean via npx tsc --noEmit --project tsconfig.test.json.

7 new unit tests cover: email and phone challenge dispatching (no session written), OTP exchange with fresh session write, scope non-injection, IPSIE session_expiry ceiling stamping, mfa_required propagation with isMfaRequiredError narrowing, fullResponse, and resolver (multi-tenant) mode.

• This change adds test coverage for new/changed/fixed functionality

Checklist

• I have added documentation for new/changed functionality in this PR or in auth0.com/docs
• All active GitHub checks for tests, formatting, and security are passing

[coderabbitai]

Warning

Review limit reached

Next included review available in 9 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 1a0afab5-3691-4a85-91b1-bfa277eba5c4

📥 Commits

Reviewing files that changed from the base of the PR and between e8de286 and f20f0e6.

📒 Files selected for processing (3)

• packages/auth0-server-js/src/index.ts
• packages/auth0-server-js/src/server-client.spec.ts
• packages/auth0-server-js/src/server-client.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}