@_mustachio/openauth 0.13.3 → 0.14.0

package/dist/esm/client.js

@@ -37,59 +37,59 @@ function createClient(input) {
     jwksCache.set(issuer, result);
     return result;
   }
+  function applyClientAuth(headers, body) {
+    const secret = input.clientSecret;
+    if (secret === undefined)
+      return;
+    if ((input.tokenEndpointAuthMethod ?? "client_secret_basic") === "client_secret_post") {
+      body.set("client_secret", secret);
+      return;
+    }
+    const cred = `${encodeURIComponent(input.clientID)}:${encodeURIComponent(secret)}`;
+    headers["authorization"] = `Basic ${btoa(cred)}`;
+  }
   const result = {
-    async authorize(redirectURI, response, opts) {
-      const result = new URL(issuer + "/authorize");
+    async authorize(redirectURI, opts) {
+      const wk = await getIssuer();
+      const url = new URL(wk.authorization_endpoint);
+      const pkce = await generatePKCE();
       const challenge = {
-        state: crypto.randomUUID()
+        state: crypto.randomUUID(),
+        verifier: pkce.verifier
       };
-      result.searchParams.set("client_id", input.clientID);
-      result.searchParams.set("redirect_uri", redirectURI);
-      result.searchParams.set("response_type", response);
-      result.searchParams.set("state", challenge.state);
+      url.searchParams.set("client_id", input.clientID);
+      url.searchParams.set("redirect_uri", redirectURI);
+      url.searchParams.set("response_type", "code");
+      url.searchParams.set("state", challenge.state);
+      url.searchParams.set("code_challenge_method", "S256");
+      url.searchParams.set("code_challenge", pkce.challenge);
       if (opts?.provider)
-        result.searchParams.set("provider", opts.provider);
+        url.searchParams.set("provider", opts.provider);
       if (opts?.scope !== undefined) {
         const scope = Array.isArray(opts.scope) ? opts.scope.join(" ") : opts.scope;
         if (scope)
-          result.searchParams.set("scope", scope);
-      }
-      if (opts?.pkce && response === "code") {
-        const pkce = await generatePKCE();
-        result.searchParams.set("code_challenge_method", "S256");
-        result.searchParams.set("code_challenge", pkce.challenge);
-        challenge.verifier = pkce.verifier;
+          url.searchParams.set("scope", scope);
       }
-      return {
-        challenge,
-        url: result.toString()
-      };
-    },
-    async pkce(redirectURI, opts) {
-      const result = new URL(issuer + "/authorize");
-      if (opts?.provider)
-        result.searchParams.set("provider", opts.provider);
-      result.searchParams.set("client_id", input.clientID);
-      result.searchParams.set("redirect_uri", redirectURI);
-      result.searchParams.set("response_type", "code");
-      const pkce = await generatePKCE();
-      result.searchParams.set("code_challenge_method", "S256");
-      result.searchParams.set("code_challenge", pkce.challenge);
-      return [pkce.verifier, result.toString()];
+      return { challenge, url: url.toString() };
     },
     async exchange(code, redirectURI, verifier) {
-      const tokens = await f(issuer + "/token", {
+      const wk = await getIssuer();
+      const body = new URLSearchParams({
+        code,
+        redirect_uri: redirectURI,
+        grant_type: "authorization_code",
+        client_id: input.clientID
+      });
+      if (verifier)
+        body.set("code_verifier", verifier);
+      const headers = {
+        "Content-Type": "application/x-www-form-urlencoded"
+      };
+      applyClientAuth(headers, body);
+      const tokens = await f(wk.token_endpoint, {
         method: "POST",
-        headers: {
-          "Content-Type": "application/x-www-form-urlencoded"
-        },
-        body: new URLSearchParams({
-          code,
-          redirect_uri: redirectURI,
-          grant_type: "authorization_code",
-          client_id: input.clientID,
-          code_verifier: verifier || ""
-        }).toString()
+        headers,
+        body: body.toString()
       });
       const json = await tokens.json();
       if (!tokens.ok) {
@@ -121,15 +121,20 @@ function createClient(input) {
           };
         }
       }
-      const tokens = await f(issuer + "/token", {
+      const wk = await getIssuer();
+      const body = new URLSearchParams({
+        grant_type: "refresh_token",
+        refresh_token: refresh,
+        client_id: input.clientID
+      });
+      const headers = {
+        "Content-Type": "application/x-www-form-urlencoded"
+      };
+      applyClientAuth(headers, body);
+      const tokens = await f(wk.token_endpoint, {
         method: "POST",
-        headers: {
-          "Content-Type": "application/x-www-form-urlencoded"
-        },
-        body: new URLSearchParams({
-          grant_type: "refresh_token",
-          refresh_token: refresh
-        }).toString()
+        headers,
+        body: body.toString()
       });
       const json = await tokens.json();
       if (!tokens.ok) {
@@ -151,30 +156,24 @@ function createClient(input) {
       const jwks = await getJWKS();
       try {
         const result = await jwtVerify(token, jwks, {
-          issuer
+          issuer,
+          audience: options?.audience ?? input.clientID
         });
         const claim = result.payload.claim;
-        let subjectType;
-        let subjectProperties;
-        if (claim && typeof claim.type === "string") {
-          subjectType = claim.type;
-          subjectProperties = claim.properties;
-        } else if (result.payload.mode === "access" && typeof result.payload.type === "string") {
-          subjectType = result.payload.type;
-          subjectProperties = result.payload.properties;
-        }
-        if (subjectType === undefined) {
+        if (!claim || typeof claim.type !== "string") {
           return { err: new InvalidSubjectError };
         }
+        const subjectType = claim.type;
         const schema = subjects[subjectType];
         if (!schema) {
           return { err: new InvalidSubjectError };
         }
-        const validated = await schema["~standard"].validate(subjectProperties);
+        const validated = await schema["~standard"].validate(claim.properties);
         if (validated.issues) {
           return { err: new InvalidSubjectError };
         }
         return {
+          err: false,
           aud: result.payload.aud,
           subject: {
             type: subjectType,

package/dist/esm/domain/authorize.js

@@ -211,6 +211,16 @@ async function issueCodeFromInlineSuccess(result, record, deps) {
   }, AUTH_CODE_TTL_MS, { keyStore: deps.keyStore, tokenStore: deps.tokenStore });
   if (isErr(saved))
     return err(saved.error);
+  await safeAudit(deps, {
+    kind: "authorize_succeeded",
+    tenantId: flow.tenantId,
+    clientId: flow.clientId,
+    methodId: flow.methodId,
+    methodKind: flow.methodKind,
+    flowId: flow.flowId,
+    providerSubject: result.providerSubject,
+    timestamp: now
+  });
   return ok({
     kind: "issue-code",
     code,

package/dist/esm/domain/callback.js

@@ -6,26 +6,8 @@ import { randomToken } from "./crypto";
 import { dispatchMethod } from "./method-dispatch";
 import { callbackTarget } from "./mount";
 import { saveEncryptedCode } from "./token";
-import { verifyStateEnvelope } from "./state-envelope";
+import { extractCallbackState, verifyStateEnvelope } from "./state-envelope";
 import { AUTH_CODE_TTL_MS } from "./authorize";
-async function extractCallbackState(req) {
-  const fromQuery = new URL(req.url).searchParams.get("state");
-  if (fromQuery)
-    return fromQuery;
-  if (req.method !== "POST")
-    return null;
-  const ct = req.headers.get("content-type") ?? "";
-  if (!ct.includes("application/x-www-form-urlencoded"))
-    return null;
-  try {
-    const body = await req.clone().text();
-    const form = new URLSearchParams(body);
-    const v = form.get("state") ?? form.get("RelayState");
-    return v && v.length > 0 ? v : null;
-  } catch {
-    return null;
-  }
-}
 async function handleCallback(input, deps) {
   const url = new URL(input.rawRequest.url);
   const state = await extractCallbackState(input.rawRequest);
@@ -147,6 +129,16 @@ async function translate(result, flow, deps) {
       }, AUTH_CODE_TTL_MS, { keyStore: deps.keyStore, tokenStore: deps.tokenStore });
       if (isErr(saved))
         return err(saved.error);
+      await safeAudit(deps, {
+        kind: "authorize_succeeded",
+        tenantId: flow.tenantId,
+        clientId: flow.clientId,
+        methodId: flow.methodId,
+        methodKind: flow.methodKind,
+        flowId: flow.flowId,
+        providerSubject: result.providerSubject,
+        timestamp: now
+      });
       return ok({
         kind: "issue-code",
         code,
@@ -282,6 +274,16 @@ async function tryIdpInitiated(input, deps, url) {
   }, AUTH_CODE_TTL_MS, { keyStore: deps.keyStore, tokenStore: deps.tokenStore });
   if (isErr(saved))
     return err(saved.error);
+  await safeAudit(deps, {
+    kind: "authorize_succeeded",
+    tenantId: input.tenant.id,
+    clientId: binding.clientId,
+    methodId,
+    methodKind: method.kind,
+    flowId: "",
+    providerSubject: result.providerSubject,
+    timestamp: now
+  });
   return ok({
     kind: "issue-code",
     code,

package/dist/esm/domain/client-credentials.js

@@ -4,6 +4,8 @@ import { err, isErr, ok } from "../types/result";
 import { verifyClientCredentials } from "./client-auth";
 import { randomId } from "./crypto";
 import { mintTokens } from "./token";
+import { safeAudit } from "./audit";
+import { validateSubjectClaim } from "./subject";
 async function clientCredentialsGrant(req, deps, tenantId) {
   const tenantCfg = await deps.configStore.getTenantConfig(tenantId);
   if (isErr(tenantCfg))
@@ -67,6 +69,20 @@ async function clientCredentialsGrant(req, deps, tenantId) {
   } catch (e) {
     return err(authError.serverError("success callback threw", e));
   }
+  const checked = await validateSubjectClaim(deps.subjects, claim);
+  if (isErr(checked)) {
+    await safeAudit(deps, {
+      kind: "invalid_subject_claim",
+      tenantId: tenant.id,
+      clientId: client.id,
+      subjectType: checked.error.rejection.subjectType,
+      reason: checked.error.rejection.reason,
+      detail: checked.error.rejection.detail,
+      timestamp: deps.clock()
+    });
+    return err(checked.error);
+  }
+  claim = checked.value;
   const minted = await mintTokens({
     tenant,
     claim,

package/dist/esm/domain/method-route.js

@@ -74,6 +74,16 @@ async function translate(result, flow, deps) {
       }, AUTH_CODE_TTL_MS, { keyStore: deps.keyStore, tokenStore: deps.tokenStore });
       if (isErr(saved))
         return err(saved.error);
+      await safeAudit(deps, {
+        kind: "authorize_succeeded",
+        tenantId: final.tenantId,
+        clientId: final.clientId,
+        methodId: final.methodId,
+        methodKind: final.methodKind,
+        flowId: final.flowId,
+        providerSubject: result.providerSubject,
+        timestamp: now
+      });
       return ok({
         kind: "issue-code",
         code,

package/dist/esm/domain/refresh.js

@@ -4,6 +4,16 @@ import { err, isErr } from "../types/result";
 import { safeAudit } from "./audit";
 import { verifyClientCredentials } from "./client-auth";
 import { mintTokens } from "./token";
+function validateRequestedScopes(requested, granted) {
+  if (!requested)
+    return null;
+  for (const s of requested.split(" ").filter(Boolean)) {
+    if (!granted.includes(s)) {
+      return authError.invalidScope(`requested scope "${s}" not granted by original refresh token`);
+    }
+  }
+  return null;
+}
 async function refreshTokens(req, deps) {
   const peek = await deps.tokenStore.peekRefresh(req.refreshToken);
   if (isErr(peek))
@@ -39,6 +49,9 @@ async function refreshTokens(req, deps) {
       return err(authError.invalidDpopProof("refresh token DPoP jkt does not match the original binding"));
     }
   }
+  const scopeErr = validateRequestedScopes(req.scope, peekedPayload.scopes);
+  if (scopeErr)
+    return err(scopeErr);
   const consumed = await deps.tokenStore.consumeRefresh(req.refreshToken, {
     reuseWindowMs: deps.reuseWindowMs
   });
@@ -56,12 +69,10 @@ async function refreshTokens(req, deps) {
     return err(consumed.error);
   }
   const payload = consumed.value;
+  const authoritativeScopeErr = validateRequestedScopes(req.scope, payload.scopes);
+  if (authoritativeScopeErr)
+    return err(authoritativeScopeErr);
   const requestedScopes = req.scope ? req.scope.split(" ").filter(Boolean) : payload.scopes;
-  for (const s of requestedScopes) {
-    if (!payload.scopes.includes(s)) {
-      return err(authError.invalidScope(`requested scope "${s}" not granted by original refresh token`));
-    }
-  }
   const tenant = {
     id: payload.tenantId,
     config: tenantCfg.value,

package/dist/esm/domain/register.js

@@ -50,12 +50,18 @@ async function registerNewClient(request, tenant, deps) {
   };
   const hookResult = await deps.registerClient({
     tenant,
-    request
+    request,
+    client: clientConfig,
+    ...secret !== undefined ? { secret } : {}
   });
   if (isErr(hookResult))
     return err(hookResult.error);
   const persisted = hookResult.value.client;
-  const persistedSecret = hookResult.value.secret;
+  const keptOurSecret = persisted.type === "confidential" && clientConfig.type === "confidential" && persisted.secretHash === clientConfig.secretHash;
+  const persistedSecret = hookResult.value.secret ?? (keptOurSecret ? secret : undefined);
+  if (persisted.type === "confidential" && persistedSecret === undefined) {
+    return err(authError.serverError("registerClient persisted a confidential client with a substituted " + "secretHash but returned no matching plaintext secret"));
+  }
   const issuedAt = Math.floor(deps.clock() / 1000);
   return ok({
     client_id: persisted.id,

package/dist/esm/domain/state-envelope.js

@@ -74,7 +74,26 @@ function isEnvelopeShape(value) {
   const v = value;
   return typeof v.tenantId === "string" && typeof v.flowId === "string" && typeof v.nonce === "string" && typeof v.kid === "string";
 }
+async function extractCallbackState(req) {
+  const fromQuery = new URL(req.url).searchParams.get("state");
+  if (fromQuery)
+    return fromQuery;
+  if (req.method !== "POST")
+    return null;
+  const ct = req.headers.get("content-type") ?? "";
+  if (!ct.toLowerCase().includes("application/x-www-form-urlencoded")) {
+    return null;
+  }
+  try {
+    const form = new URLSearchParams(await req.clone().text());
+    const v = form.get("state") ?? form.get("RelayState");
+    return v && v.length > 0 ? v : null;
+  } catch {
+    return null;
+  }
+}
 export {
+  extractCallbackState,
   mintStateEnvelope,
   verifyStateEnvelope
 };

package/dist/esm/domain/subject.js

@@ -0,0 +1,35 @@
+// src/domain/subject.ts
+import { authError } from "../types/error";
+import { err, ok } from "../types/result";
+async function validateSubjectClaim(subjects, claim) {
+  const declared = Object.keys(subjects);
+  const subjectType = typeof claim?.type === "string" ? claim.type : "";
+  const schema = subjectType ? subjects[subjectType] : undefined;
+  if (!schema) {
+    return err(Object.assign(authError.serverError(`success() returned subject type "${subjectType}", which is not declared in \`subjects\``), {
+      rejection: {
+        reason: "unknown-type",
+        subjectType,
+        detail: `declared: ${declared.join(", ") || "(none)"}`
+      }
+    }));
+  }
+  const validated = await schema["~standard"].validate(claim.properties);
+  if (validated.issues) {
+    const detail = validated.issues.map((i) => (i.path ?? []).map(String).join(".") || "(root)").join(", ") || "(root)";
+    return err(Object.assign(authError.serverError(`success() returned properties that violate the "${subjectType}" schema`), {
+      rejection: {
+        reason: "invalid-properties",
+        subjectType,
+        detail
+      }
+    }));
+  }
+  return ok({
+    type: subjectType,
+    properties: validated.value
+  });
+}
+export {
+  validateSubjectClaim
+};

package/dist/esm/domain/token.js

@@ -15,6 +15,7 @@ import {
 import { buildIdTokenClaims, shouldIssueIdToken } from "./id-token";
 import { signAccessToken, signIdToken } from "./jwt";
 import { validatePkce } from "./pkce";
+import { validateSubjectClaim } from "./subject";
 async function saveEncryptedCode(code, payload, ttl, deps) {
   const keyResult = await deps.keyStore.currentEncryptionKey();
   if (isErr(keyResult))
@@ -91,6 +92,20 @@ async function exchangeCode(req, deps) {
   } catch (e) {
     return err(authError.serverError("success callback threw", e));
   }
+  const checked = await validateSubjectClaim(deps.subjects, claim);
+  if (isErr(checked)) {
+    await safeAudit(deps, {
+      kind: "invalid_subject_claim",
+      tenantId: payload.tenantId,
+      clientId: payload.clientId,
+      subjectType: checked.error.rejection.subjectType,
+      reason: checked.error.rejection.reason,
+      detail: checked.error.rejection.detail,
+      timestamp: deps.clock()
+    });
+    return err(checked.error);
+  }
+  claim = checked.value;
   if (deps.persistUpstreamTokens) {
     try {
       await deps.persistUpstreamTokens({

package/dist/esm/http/handlers/token.js

@@ -67,6 +67,7 @@ function makeTokenHandler(deps) {
         keyStore: deps.keyStore,
         ...deps.auditLog ? { auditLog: deps.auditLog } : {},
         success: deps.success,
+        subjects: deps.subjects,
         ...deps.persistUpstreamTokens ? { persistUpstreamTokens: deps.persistUpstreamTokens } : {},
         issuerUrl: c.get("issuerUrl"),
         clock: deps.clock,
@@ -99,6 +100,7 @@ function makeTokenHandler(deps) {
         ...deps.auditLog ? { auditLog: deps.auditLog } : {},
         methodCache: deps.methodCache,
         success: deps.success,
+        subjects: deps.subjects,
         ...deps.persistUpstreamTokens ? { persistUpstreamTokens: deps.persistUpstreamTokens } : {},
         issuerUrl: c.get("issuerUrl"),
         clock: deps.clock,

package/dist/esm/http/middleware/tenant.js

@@ -1,5 +1,8 @@
 // src/http/middleware/tenant.ts
-import { verifyStateEnvelope } from "../../domain/state-envelope";
+import {
+  extractCallbackState,
+  verifyStateEnvelope
+} from "../../domain/state-envelope";
 import { isErr } from "../../types/result";
 import { parseCookieHeader } from "../cookies";
 import {
@@ -90,7 +93,7 @@ function buildTenantContext(req, id, config, custom) {
   };
 }
 async function runCallbackRecovery(req, deps) {
-  const state = await extractStateParam(req);
+  const state = await extractCallbackState(req);
   if (state) {
     const env = await verifyStateEnvelope(state, deps.stateKeys);
     if (env.ok) {
@@ -103,24 +106,6 @@ async function runCallbackRecovery(req, deps) {
   }
   return { kind: "fresh-request" };
 }
-async function extractStateParam(req) {
-  const url = new URL(req.url);
-  const fromQuery = url.searchParams.get("state");
-  if (fromQuery)
-    return fromQuery;
-  if (req.method !== "POST")
-    return null;
-  const ct = req.headers.get("content-type") ?? "";
-  if (!ct.toLowerCase().startsWith("application/x-www-form-urlencoded")) {
-    return null;
-  }
-  try {
-    const text = await req.clone().text();
-    return new URLSearchParams(text).get("state");
-  } catch {
-    return null;
-  }
-}
 export {
   bootstrapMiddleware,
   tenantMiddleware

package/dist/esm/index.js

@@ -67,6 +67,7 @@ function createIdP(opts) {
     ...opts.callbackHostFor ? { callbackHostFor: opts.callbackHostFor } : {},
     resolveTenant: opts.resolveTenant,
     success: opts.success,
+    subjects: opts.subjects,
     ...opts.onLogout ? { onLogout: opts.onLogout } : {},
     ...opts.persistUpstreamTokens ? { persistUpstreamTokens: opts.persistUpstreamTokens } : {},
     ...opts.exchangeAudience ? { exchangeAudience: opts.exchangeAudience } : {},

package/dist/types/client.d.ts

@@ -90,26 +90,45 @@ export interface ClientInput {
      */
     issuer?: string;
     /**
-     * Optionally, override the internally used fetch function.
+     * The client secret, for **confidential** clients only.
      *
-     * This is useful if you are using a polyfilled fetch function in your application and you
-     * want the client to use it too.
-     */
-    fetch?: FetchLike;
-}
-export interface AuthorizeOptions {
-    /**
-     * Enable the PKCE flow. This is for SPA apps.
+     * Supply this for a server-side app registered as a confidential client;
+     * `exchange()` and `refresh()` then authenticate at `/token`. Omit it for
+     * public clients (SPA, mobile, CLI) — a secret cannot be kept in code
+     * that ships to users, and the IdP requires PKCE there instead.
+     *
+     * Without this, a confidential client's `exchange()` is rejected with
+     * `invalid_client`: the token endpoint has no way to authenticate it.
      *
+     * @example
      * ```ts
      * {
-     *   pkce: true
+     *   clientID: "my-server-app",
+     *   clientSecret: process.env.CLIENT_SECRET
      * }
      * ```
+     */
+    clientSecret?: string;
+    /**
+     * How to present `clientSecret` at the token endpoint.
      *
-     * @default false
+     * `client_secret_basic` (the default) sends HTTP Basic credentials, which
+     * is what RFC 6749 §2.3.1 prefers and what the IdP parses first.
+     * `client_secret_post` puts them in the form body. Both are advertised in
+     * discovery as `token_endpoint_auth_methods_supported`.
+     *
+     * @default "client_secret_basic"
+     */
+    tokenEndpointAuthMethod?: "client_secret_basic" | "client_secret_post";
+    /**
+     * Optionally, override the internally used fetch function.
+     *
+     * This is useful if you are using a polyfilled fetch function in your application and you
+     * want the client to use it too.
      */
-    pkce?: boolean;
+    fetch?: FetchLike;
+}
+export interface AuthorizeOptions {
     /**
      * The provider you want to use for the OAuth flow.
      *
@@ -238,7 +257,13 @@ export interface VerifyOptions {
      */
     issuer?: string;
     /**
-     * @internal
+     * The audience to require on the token.
+     *
+     * Defaults to this client's `clientID`, which is what the IdP puts in
+     * `aud` for an ordinary login. Set this when verifying a token minted
+     * for a **resource** — an `/authorize` call that passed `audience` puts
+     * that value in `aud` instead, so a resource server verifying it must
+     * name itself here.
      */
     audience?: string;
     /**
@@ -251,9 +276,14 @@ export interface VerifyOptions {
 }
 export interface VerifyResult<T extends SubjectSchema> {
     /**
-     * This is always `undefined` when the verify is successful.
+     * This is always `false` when the verify is successful.
+     *
+     * A literal, not an optional — `err?: undefined` would leave the
+     * property present on this arm, so `"err" in result` narrowed nothing
+     * and callers had to test truthiness instead. Matches `ExchangeSuccess`
+     * and `RefreshSuccess`.
      */
-    err?: undefined;
+    err: false;
     /**
      * Returns the refreshed tokens only if they’ve been refreshed.
      *
@@ -297,38 +327,29 @@ export interface VerifyError {
  */
 export interface Client {
     /**
-     * Start the autorization flow. For example, in SSR sites.
+     * Start the authorization code flow.
      *
      * ```ts
-     * const { url } = await client.authorize(<redirect_uri>, "code")
+     * const { challenge, url } = await client.authorize(<redirect_uri>)
+     * // store `challenge`, then redirect the user to `url`
      * ```
      *
-     * This takes a redirect URI and the type of flow you want to use. The redirect URI is the
-     * location where the user will be redirected to after the flow is complete.
-     *
-     * Supports both the _code_ and _token_ flows. We recommend using the _code_ flow as it's more
-     * secure.
+     * Returns the URL to send the user to, and a `challenge` carrying the
+     * CSRF `state` and the PKCE `verifier`. Persist the challenge (a cookie
+     * server-side, `sessionStorage` in a SPA) and hand the verifier back to
+     * {@link Client.exchange} when the user returns.
      *
-     * :::tip
-     * This returns a URL to redirect the user to. This starts the OAuth flow.
-     * :::
-     *
-     * This returns a URL to the auth server. You can redirect the user to the URL to start the
-     * OAuth flow.
-     *
-     * For SPA apps, we recommend using the PKCE flow.
-     *
-     * ```ts {4}
-     * const { challenge, url } = await client.authorize(
-     *   <redirect_uri>,
-     *   "code",
-     *   { pkce: true }
-     * )
-     * ```
+     * **PKCE is always used.** The IdP requires it for public clients, and
+     * OAuth 2.1 §7.5.1 recommends it for confidential ones too, so there is
+     * no reason to offer it as a toggle. Before 0.14.0 it was opt-in and
+     * off by default, which meant the documented server-side flow could not
+     * complete against a public client at all.
      *
-     * This returns a redirect URL and a challenge that you need to use later to verify the code.
+     * Only the authorization code flow is supported. The implicit flow
+     * (`response_type=token`) is removed in OAuth 2.1 and the IdP rejects
+     * it with `unsupported_response_type`.
      */
-    authorize(redirectURI: string, response: "code" | "token", opts?: AuthorizeOptions): Promise<AuthorizeResult>;
+    authorize(redirectURI: string, opts?: AuthorizeOptions): Promise<AuthorizeResult>;
     /**
      * Exchange the code for access and refresh tokens.
      *