From 666489266e714f1fa6d2ac3a49741cadfb4b2f54 Mon Sep 17 00:00:00 2001
From: Yogesh Chaudhary <yogesh.chaudhary@okta.com>
Date: Tue, 18 Aug 2026 19:05:00 +0530
Subject: [PATCH] fix: remove Auth0Server dependency from getClaims and
 requireClaims

---
 __tests__/server/api.test.ts | 51 +++++++++++++++++++++++++-----------
 src/server/api.ts            | 20 ++++++++------
 2 files changed, 48 insertions(+), 23 deletions(-)

diff --git a/__tests__/server/api.test.ts b/__tests__/server/api.test.ts
index 53ff33b..4d92b11 100644
--- a/__tests__/server/api.test.ts
+++ b/__tests__/server/api.test.ts
@@ -10,16 +10,9 @@ import {
   ConfigurationError,
   InsufficientScopeError
 } from '../../src/errors/index.js';
-import { getInstance } from '../../src/server/utils.js';
 import { ApiClient } from '@auth0/auth0-api-js';
 import type { JWTClaims } from '../../src/types/index.js';
 
-vi.mock('../../src/server/utils.js', () => ({
-  getInstance: vi.fn(() => ({
-    config: { domain: 'test.auth0.com', audience: 'https://api.example.com' }
-  }))
-}));
-
 const mockVerifyAccessToken = vi.hoisted(() => vi.fn());
 
 vi.mock('@auth0/auth0-api-js', () => {
@@ -189,19 +182,43 @@ describe('requireClaims — scope check', () => {
   });
 });
 
-// ─── audience guard (no _setVerifyJwt stub) ───────────────────────────────────
+// ─── config guards (no _setVerifyJwt stub) ────────────────────────────────────
+
+describe('config guard — missing AUTH0_DOMAIN', () => {
+  beforeEach(() => {
+    delete process.env['AUTH0_DOMAIN'];
+    process.env['AUTH0_AUDIENCE'] = 'https://api.example.com';
+  });
+
+  afterEach(() => {
+    delete process.env['AUTH0_DOMAIN'];
+    delete process.env['AUTH0_AUDIENCE'];
+    _resetApiClient();
+  });
+
+  it('getClaims throws ConfigurationError when AUTH0_DOMAIN is not set', async () => {
+    await expect(getClaims(makeRequest('Bearer some-token'))).rejects.toThrow(
+      ConfigurationError
+    );
+  });
+
+  it('requireClaims throws ConfigurationError when AUTH0_DOMAIN is not set', async () => {
+    await expect(
+      requireClaims(makeRequest('Bearer some-token'))
+    ).rejects.toThrow(ConfigurationError);
+  });
+});
 
-describe('audience guard — missing AUTH0_AUDIENCE', () => {
+describe('config guard — missing AUTH0_AUDIENCE', () => {
   beforeEach(() => {
-    vi.mocked(getInstance).mockReturnValue({
-      config: { domain: 'test.auth0.com', audience: undefined }
-    } as ReturnType<typeof getInstance>);
+    process.env['AUTH0_DOMAIN'] = 'test.auth0.com';
+    delete process.env['AUTH0_AUDIENCE'];
   });
 
   afterEach(() => {
-    vi.mocked(getInstance).mockReturnValue({
-      config: { domain: 'test.auth0.com', audience: 'https://api.example.com' }
-    } as ReturnType<typeof getInstance>);
+    delete process.env['AUTH0_DOMAIN'];
+    delete process.env['AUTH0_AUDIENCE'];
+    _resetApiClient();
   });
 
   it('getClaims throws ConfigurationError when AUTH0_AUDIENCE is not set', async () => {
@@ -223,10 +240,14 @@ describe('audience guard — missing AUTH0_AUDIENCE', () => {
 
 describe('ApiClient integration — real verifyJwt path', () => {
   beforeEach(() => {
+    process.env['AUTH0_DOMAIN'] = 'test.auth0.com';
+    process.env['AUTH0_AUDIENCE'] = 'https://api.example.com';
     mockVerifyAccessToken.mockResolvedValue(CLAIMS);
   });
 
   afterEach(() => {
+    delete process.env['AUTH0_DOMAIN'];
+    delete process.env['AUTH0_AUDIENCE'];
     _resetApiClient();
     vi.mocked(ApiClient).mockClear();
     mockVerifyAccessToken.mockReset();
diff --git a/src/server/api.ts b/src/server/api.ts
index 5a7ed63..f3f0c0d 100644
--- a/src/server/api.ts
+++ b/src/server/api.ts
@@ -4,7 +4,6 @@ import {
   ConfigurationError,
   InsufficientScopeError
 } from '../errors/index.js';
-import { getInstance } from './utils.js';
 import type { JWTClaims } from '../types/index.js';
 
 // ─── Test injection ───────────────────────────────────────────────────────────
@@ -34,18 +33,23 @@ function extractBearerToken(request: Request): string | null {
 async function verifyJwt(token: string): Promise<JWTClaims> {
   if (_verifyJwtFn) return _verifyJwtFn(token);
 
-  const auth0 = getInstance();
-  if (!auth0.config.audience) {
+  const domain = process.env['AUTH0_DOMAIN'];
+  const audience = process.env['AUTH0_AUDIENCE'];
+
+  if (!domain) {
+    throw new ConfigurationError(
+      'AUTH0_DOMAIN is required for Bearer token verification. ' +
+        'Set it as an environment variable.'
+    );
+  }
+  if (!audience) {
     throw new ConfigurationError(
       'AUTH0_AUDIENCE is required for Bearer token verification. ' +
-        'Set it as an environment variable or pass it to new Auth0Server({ audience: "..." }).'
+        'Set it as an environment variable.'
     );
   }
   if (!_apiClient) {
-    _apiClient = new ApiClient({
-      domain: auth0.config.domain,
-      audience: auth0.config.audience
-    });
+    _apiClient = new ApiClient({ domain, audience });
   }
   const claims = await _apiClient.verifyAccessToken({ accessToken: token });
   return claims as unknown as JWTClaims;