Fix: TypeError when CordovaAuth0Plugin is not a constructor (auth0-js 9.30.1+)

[ankita10119]

Changes

Problem

Users installing auth0-lock get the following error on Lock initialization, preventing the widget from rendering entirely:

Uncaught TypeError: CordovaAuth0Plugin is not a constructor at Auth0APIClient (p2_api.js)

This affects any fresh install of auth0-lock since auth0-js ^9.29.0 resolves to 9.30.1+ on npm.

Root Cause

auth0-js 9.30.0 introduced a Rollup build tooling change (via #1563) that changed how cordova-auth0-plugin.min.js bundles its exports. As a result, when webpack's ESM interop resolves the module, the default export is an empty object {} instead of the constructor function - breaking new CordovaAuth0Plugin() in p2_api.js

auth0-js version	cordova-auth0-plugin.min.js export
<= 9.29.0	function (valid constructor) ✅
>= 9.30.1	{} (empty object) ❌

Fix

Guard the instantiation with a typeof check - if CordovaAuth0Plugin is not a valid constructor, fall back to an empty plugins array:

// Before
plugins: opts.plugins || [new CordovaAuth0Plugin()],

// After
plugins: opts.plugins || (typeof CordovaAuth0Plugin === 'function' ? [new CordovaAuth0Plugin()] : []),

This is safe because plugins is optional in auth0-js's WebAuth - the Cordova plugin only applies in Cordova environments. Web-based auth flows are unaffected.

References

SDK-8308

Testing

• Reproduced the error by installing auth0-lock@14.2.4 with auth0-js@9.31.0 in a React app, Lock failed to initialize with the TypeError
• Applied the fix via local build, Lock initializes correctly, widget renders, login flow works end to end
• Confirmed auth0-js <= 9.29.0 (where the plugin exports a function) continues to work correctly since typeof function === 'function' is true

• This change adds unit test coverage
• This change adds integration test coverage
• This change has been tested on the latest version of the platform/language

Checklist

• I have read the Auth0 general contribution guidelines
• I have read the Auth0 Code of Conduct
• All code quality tools/guidelines have been run/followed
• All relevant assets have been compiled