@absolutejs/auth 0.54.4 → 0.54.6

package/dist/htmx/index.js

@@ -1811,6 +1811,7 @@ var providers = defineProviders({
     }
   },
   withings: {
+    accessTokenPath: ["body", "access_token"],
     authorizationUrl: "https://account.withings.com/oauth2_user/authorize2",
     isOIDC: false,
     isRefreshable: true,
@@ -2665,10 +2666,21 @@ var buildOAuth2Client = async (meta, config) => {
       if (!response.ok)
         throw await createOAuth2FetchError(response);
       const tokenResponse = await response.json();
+      if (!tokenResponse || typeof tokenResponse !== "object") {
+        throw new Error("OAuth token endpoint returned a non-object response");
+      }
+      const oauthError = Reflect.get(tokenResponse, "error");
+      if (typeof oauthError === "string" && oauthError.length > 0) {
+        throw new Error(`OAuth token exchange failed: ${oauthError}`);
+      }
       const nestedToken = meta.accessTokenPath ? readPath(tokenResponse, meta.accessTokenPath) : undefined;
       if (typeof nestedToken === "string" && nestedToken.length > 0 && tokenResponse && typeof tokenResponse === "object") {
         tokenResponse.access_token = nestedToken;
       }
+      const accessToken = Reflect.get(tokenResponse, "access_token");
+      if (typeof accessToken !== "string" || accessToken.length === 0) {
+        throw new Error("OAuth token endpoint returned no access_token");
+      }
       return tokenResponse;
     }
   };
@@ -2761,5 +2773,5 @@ export {
   escapeHtml
 };
 
-//# debugId=4BFD3282038CF96664756E2164756E21
+//# debugId=D319F7149F34DA4D64756E2164756E21
 //# sourceMappingURL=index.js.map