lrObject Reference
lrObject is the first argument passed to every exports.execute function. It is a read-only data object: not an API with methods. It provides contextual information about the current user, their request, and the running workflow session.
exports.execute = async (lrObject, hook) => {
// lrObject is a plain object: read fields directly
};
Top-Level Fields
| Field | Type | Description |
|---|---|---|
lrObject.Request | object | Metadata about the incoming request. |
lrObject.Identity | object | Full user identity profile (Email RAAS response). |
lrObject.Session | object | Workflow session state: access token, form data, shared state. |
lrObject.IsAuthenticated | boolean | true if the Auth node has successfully authenticated the user upstream. |
lrObject.Request
| Field | Type | Description |
|---|---|---|
IP | string | Client IP address. |
Language | string | Accept-Language value from the request. |
UserAgent | string | Browser or client user-agent string. |
lrObject.Identity
Contains the full Email (RAAS) identity profile. Key fields:
| Field | Type | Description |
|---|---|---|
Email | string | Array<{Type, Value}> | User's email. Pre-auth: plain string. Post-auth: array of {Type, Value} objects. Always check type before accessing. |
PhoneId | string | User's phone identifier (optional). |
UserName | string | Username. |
Uid | string | Unique user identifier. |
EmailVerified | boolean | Whether the email has been verified. |
PhoneIdVerified | boolean | Whether the phone number has been verified. |
NoOfLogins | number | Total login count for this user. |
BirthDate | string | User's date of birth. |
LastPasswordChangeDate | string | ISO timestamp of the last password change. |
Identities | array | Linked social/federated identities (IdentityResponseWithoutLogins objects). |
Pre-auth vs post-auth email format
In pre-auth scripts, Identity.Email is a plain string. In post-auth scripts it is an array of {Type, Value} objects. Always handle both:
let email = "";
if (Array.isArray(lrObject.Identity?.Email)) {
const primary = lrObject.Identity.Email.find(e => e.Type === "Primary") || lrObject.Identity.Email[0];
email = primary?.Value || "";
} else if (typeof lrObject.Identity?.Email === "string") {
email = lrObject.Identity.Email;
}
lrObject.Session
| Field | Type | Description |
|---|---|---|
AccessToken | string | User's session access token. Set by the Auth node. null if Auth has not run. |
WorkflowName | string | Name of the currently executing workflow. |
FormData | map<string, string> | Key-value pairs submitted by the user through Web Page nodes. |
SharedState | map<string, any> | Workflow-scoped key-value store. Auto-populated from authorization_details in PAR/SCA flows. Write back using hook.sharedState.set(). |
SharedState: SCA / PAR flows
When a workflow is initiated via a PAR request with authorization_details, SharedState is automatically populated:
| Field | Description |
|---|---|
authorization_details.type | Transaction type (e.g. lr_payment). |
authorization_details.amount | Transaction amount. |
authorization_details.currency | Currency code. |
authorization_details.payee | Payee name. |
authorization_details.hash | Server-computed integrity token: "{amount}_{currency}_{payee}_{nonce}". |
linking_id | Dynamic linking ID correlating the browser session with the mobile MFA device. |
const sharedState = lrObject?.Session?.SharedState || {};
const authDetails = sharedState.authorization_details || {};
const { amount, currency, payee, hash } = authDetails;
const linkingId = sharedState.linking_id || "";
Checking session and authentication
exports.execute = async (lrObject, hook) => {
if (!lrObject.IsAuthenticated) {
hook.setError(401, "Not authenticated", "Login required.");
return;
}
const token = lrObject.Session?.AccessToken;
const uid = lrObject.Identity?.Uid;
};