@absolutejs/auth 0.57.7 → 0.57.9

package/dist/providers/index.js

@@ -232,17 +232,23 @@ var providers = defineProviders({
   },
   apple: {
     authorizationUrl: "https://appleid.apple.com/auth/authorize",
+    createAuthorizationURLSearchParams: {
+      response_mode: "form_post"
+    },
+    createClientSecret: (config) => createAppleClientSecret(config),
     isOIDC: true,
     isRefreshable: true,
-    PKCEMethod: "S256",
-    profileRequest: {
-      authIn: "header",
-      encoding: "application/json",
-      method: "GET",
-      url: "https://appleid.apple.com/auth/userinfo"
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      tokenParamName: "token",
+      url: "https://appleid.apple.com/auth/revoke"
     },
     scopeRequired: false,
-    subject: ["id"],
+    subject: ["sub"],
+    subjectBySource: {
+      idToken: ["sub"]
+    },
     subjectType: "string",
     tokenRequest: {
       authIn: "body",
@@ -311,6 +317,7 @@ var providers = defineProviders({
         token_type_hint: "refresh_token"
       }),
       encoding: "application/json",
+      inputSource: "refreshToken",
       tokenParamName: "token",
       url: (config) => `https://${config.domain}/oauth/revoke`
     },
@@ -1442,6 +1449,7 @@ var providers = defineProviders({
         token_type_hint: "refresh_token"
       }),
       encoding: "application/json",
+      inputSource: "refreshToken",
       url: "https://www.reddit.com/api/v1/revoke_token"
     },
     scopeRequired: true,
@@ -1815,49 +1823,27 @@ var providers = defineProviders({
     authorizationUrl: "https://account.withings.com/oauth2_user/authorize2",
     isOIDC: false,
     isRefreshable: true,
-    profileRequest: {
-      authIn: "header",
-      body: async (config) => {
-        const props = await getWithingsProps(config);
-        if (props === undefined)
-          throw new Error("Failed to get Withings search properties");
-        const { nonce, hashedSignature } = props;
-        return [
-          ["action", "getuser"],
-          ["nonce", nonce],
-          ["client_id", config.clientId],
-          ["signature", hashedSignature]
-        ];
-      },
-      encoding: "application/x-www-form-urlencoded",
-      method: "POST",
-      url: "https://wbsapi.withings.net/v2/oauth2"
-    },
     refreshAccessTokenBody: {
       action: "requesttoken"
     },
     revocationRequest: {
-      authIn: "header",
-      body: async (config) => {
-        const props = await getWithingsProps(config);
-        if (!props)
-          throw new Error("Failed to get Withings props");
-        const { nonce, hashedSignature } = props;
-        return [
-          ["action", "revoke"],
-          ["client_id", config.clientId],
-          ["nonce", nonce],
-          ["signature", hashedSignature]
-        ];
-      },
+      authIn: "body",
+      body: (config) => getWithingsSignatureParams(config, "revoke"),
       encoding: "application/x-www-form-urlencoded",
-      method: "POST",
-      url: "https://wbsapi.withings.net/v2/oauth2"
+      includeClientCredentials: false,
+      inputSource: "subject",
+      inputType: "number",
+      tokenParamName: "userid",
+      url: "https://wbsapi.withings.net/v2/oauth2",
+      validateResponse: (value) => assertWithingsSuccess(value)
     },
     scopeDelimiter: ",",
     scopeRequired: true,
     subject: ["userid"],
-    subjectType: "string",
+    subjectBySource: {
+      tokenResponse: ["body", "userid"]
+    },
+    subjectType: "number",
     tokenRequest: {
       authIn: "body",
       encoding: "application/x-www-form-urlencoded",
@@ -2049,14 +2035,39 @@ var isPKCEProviderOption = (option) => {
   const provider = providers[option];
   return provider.PKCEMethod !== undefined;
 };
-var isRefreshableOAuth2Client = (providerName, _client) => isRefreshableProviderOption(providerName);
+function isProfileOAuth2Client(providerOrClient, maybeClient) {
+  const client = maybeClient ?? providerOrClient;
+  if (maybeClient !== undefined && (typeof providerOrClient !== "string" || !isProfileProviderOption(providerOrClient))) {
+    return false;
+  }
+  return typeof client === "object" && client !== null && "fetchUserProfile" in client && typeof client.fetchUserProfile === "function";
+}
+var isProfileProviderOption = (option) => {
+  if (!isValidProviderOption(option))
+    return false;
+  const provider = providers[option];
+  return provider.profileRequest !== undefined;
+};
+function isRefreshableOAuth2Client(providerOrClient, maybeClient) {
+  const client = maybeClient ?? providerOrClient;
+  if (maybeClient !== undefined && (typeof providerOrClient !== "string" || !isRefreshableProviderOption(providerOrClient))) {
+    return false;
+  }
+  return typeof client === "object" && client !== null && "refreshAccessToken" in client && typeof client.refreshAccessToken === "function";
+}
 var isRefreshableProviderOption = (option) => {
   if (!isValidProviderOption(option))
     return false;
   const provider = providers[option];
   return provider.isRefreshable;
 };
-var isRevocableOAuth2Client = (providerName, _client) => isRevocableProviderOption(providerName);
+function isRevocableOAuth2Client(providerOrClient, maybeClient) {
+  const client = maybeClient ?? providerOrClient;
+  if (maybeClient !== undefined && (typeof providerOrClient !== "string" || !isRevocableProviderOption(providerOrClient))) {
+    return false;
+  }
+  return typeof client === "object" && client !== null && "resolveRevocationInput" in client && typeof client.resolveRevocationInput === "function" && "revokeToken" in client && typeof client.revokeToken === "function";
+}
 var isRevocableProviderOption = (option) => {
   if (!isValidProviderOption(option))
     return false;
@@ -2070,6 +2081,14 @@ var isScopeRequiredProviderOption = (option) => {
   return provider.scopeRequired;
 };
 var isValidProviderOption = (option) => Object.hasOwn(providers, option);
+var readPath = (value, path) => path.reduce((cursor, key) => cursor && typeof cursor === "object" ? Reflect.get(cursor, key) : undefined, value);
+var assertWithingsSuccess = (value) => {
+  if (!isObject(value) || value.status !== 0) {
+    const status = isObject(value) ? value.status : "invalid response";
+    const detail = isObject(value) && typeof value.error === "string" ? `: ${value.error}` : "";
+    throw new Error(`Withings request failed (${String(status)})${detail}`);
+  }
+};
 var createOAuth2FetchError = async (response) => {
   const clone = response.clone();
   const prefix = `HTTP ${response.status} ${response.statusText} for ${response.url}`;
@@ -2103,16 +2122,27 @@ var createOAuth2Request = ({
     }
     oauthHeaders.set("Authorization", `Basic ${encodeBase64(`${clientId}:${clientSecret}`)}`);
   }
+  if (body === undefined && authIn !== "body") {
+    return new Request(url, {
+      headers: oauthHeaders,
+      method: "POST"
+    });
+  }
   if (encoding === "application/json") {
     oauthHeaders.set("Content-Type", "application/json");
+    const jsonBody = body instanceof URLSearchParams ? Object.fromEntries(body.entries()) : { ...body };
+    if (authIn === "body")
+      jsonBody.client_id = clientId;
+    if (authIn === "body" && clientSecret)
+      jsonBody.client_secret = clientSecret;
     return new Request(url, {
-      body: JSON.stringify(body),
+      body: JSON.stringify(jsonBody),
       headers: oauthHeaders,
       method: "POST"
     });
   }
   oauthHeaders.set("Content-Type", "application/x-www-form-urlencoded");
-  const entries = body instanceof URLSearchParams ? Array.from(body.entries()) : Object.entries(body).filter((entry) => typeof entry[1] === "string");
+  const entries = body instanceof URLSearchParams ? Array.from(body.entries()) : Object.entries(body ?? {}).filter((entry) => typeof entry[1] === "string");
   const params = new URLSearchParams(entries);
   if (authIn === "body") {
     params.set("client_id", clientId);
@@ -2158,25 +2188,31 @@ var encodeBase64 = (input) => {
   }
   return btoa(raw);
 };
-var getWithingsProps = async (config) => {
+var getWithingsSignatureParams = async (config, action) => {
   const timestamp = Math.floor(Date.now() / 1000);
-  const signature = `getnonce,${config.clientId},${timestamp}`;
-  const hashedSignature = await hmacSha256(signature, config.clientSecret);
+  const nonceSignature = await hmacSha256(`getnonce,${config.clientId},${timestamp}`, config.clientSecret);
   const nonceUrl = new URL("https://wbsapi.withings.net/v2/signature");
   nonceUrl.searchParams.set("action", "getnonce");
   nonceUrl.searchParams.set("client_id", config.clientId);
   nonceUrl.searchParams.set("timestamp", timestamp.toString());
-  nonceUrl.searchParams.set("signature", hashedSignature);
+  nonceUrl.searchParams.set("signature", nonceSignature);
   const nonceTarget = nonceUrl.toString();
   const nonceResponse = await fetch(nonceTarget, { method: "POST" });
+  if (!nonceResponse.ok) {
+    throw await createOAuth2FetchError(nonceResponse);
+  }
   const nonceData = await nonceResponse.json();
-  if (nonceData.status === 0) {
-    return {
-      hashedSignature,
-      nonce: nonceData.body.nonce
-    };
+  if (!isObject(nonceData) || nonceData.status !== 0 || !isObject(nonceData.body) || typeof nonceData.body.nonce !== "string" || nonceData.body.nonce.length === 0) {
+    throw new Error("Withings returned an invalid nonce response");
   }
-  return;
+  const { nonce } = nonceData.body;
+  const signature = await hmacSha256(`${action},${config.clientId},${nonce}`, config.clientSecret);
+  return {
+    action,
+    client_id: config.clientId,
+    nonce,
+    signature
+  };
 };
 var hmacSha256 = async (message, secret) => {
   const encoder = new TextEncoder;
@@ -2184,15 +2220,53 @@ var hmacSha256 = async (message, secret) => {
   const sigBuffer = await crypto.subtle.sign("HMAC", key, encoder.encode(message));
   return Array.from(new Uint8Array(sigBuffer)).map((byte) => byte.toString(16).padStart(2, "0")).join("");
 };
+var parseOAuth2TokenResponse = (value, accessTokenPath) => {
+  if (!isObject(value)) {
+    throw new Error("OAuth token endpoint returned a non-object response");
+  }
+  const oauthError = Reflect.get(value, "error");
+  if (typeof oauthError === "string" && oauthError.length > 0) {
+    throw new Error(`OAuth token exchange failed: ${oauthError}`);
+  }
+  const response = { ...value };
+  const nestedToken = accessTokenPath ? readPath(value, accessTokenPath) : undefined;
+  if (typeof nestedToken === "string" && nestedToken.length > 0) {
+    response.access_token = nestedToken;
+  }
+  if (typeof response.access_token !== "string" || response.access_token.length === 0) {
+    throw new Error("OAuth token endpoint returned no access_token");
+  }
+  for (const key of ["refresh_token", "token_type", "scope", "id_token"]) {
+    const field = response[key];
+    if (field !== undefined && typeof field !== "string") {
+      throw new Error(`OAuth token endpoint returned invalid ${key}: expected string`);
+    }
+  }
+  const expiresIn = response.expires_in;
+  if (typeof expiresIn === "string" && expiresIn.trim() !== "") {
+    response.expires_in = Number(expiresIn);
+  }
+  if (response.expires_in !== undefined && (typeof response.expires_in !== "number" || !Number.isFinite(response.expires_in) || response.expires_in < 0)) {
+    throw new Error("OAuth token endpoint returned invalid expires_in: expected a non-negative number");
+  }
+  return response;
+};
+var readIdentityKey = (value, key) => {
+  if (Array.isArray(value)) {
+    if (!/^\d+$/.test(key)) {
+      throw new Error(`Invalid identity data shape: expected an array index, got ${key}`);
+    }
+    return value[Number(key)];
+  }
+  if (!isObject(value)) {
+    throw new Error(`Invalid identity data shape: expected object, got ${typeof value}`);
+  }
+  return value[key];
+};
 var extractPropFromIdentity = (identity, keys, propType) => {
   let value = identity;
   for (const key of keys) {
-    if (Array.isArray(value))
-      value = value[Number(key)];
-    if (!isObject(value)) {
-      throw new Error(`Invalid identity data shape: expected object, got ${typeof value}`);
-    }
-    value = value[key];
+    value = readIdentityKey(value, key);
   }
   if (propType !== undefined && !isExpectedType(value, propType)) {
     throw new Error(`Invalid identity data shape: expected ${propType}, got ${typeof value}`);
@@ -2227,6 +2301,13 @@ var normalizeProviderIdentity = ({
   const normalizedIdentity = structuredClone(identity);
   return setPropInIdentity(normalizedIdentity, canonicalKeys, subject);
 };
+var DAYS_IN_APPLE_CLIENT_SECRET_LIFETIME = 180;
+var HOURS_PER_DAY = 24;
+var MINUTES_PER_HOUR = 60;
+var SECONDS_PER_MINUTE = 60;
+var APPLE_CLIENT_SECRET_LIFETIME_SECONDS = SECONDS_PER_MINUTE * MINUTES_PER_HOUR * HOURS_PER_DAY * DAYS_IN_APPLE_CLIENT_SECRET_LIFETIME;
+var APPLE_ISSUER = "https://appleid.apple.com";
+var MILLISECONDS_PER_SECOND = 1000;
 var createS256CodeChallenge = async (codeVerifier) => {
   const data = new TextEncoder().encode(codeVerifier);
   const hashBuffer = await crypto.subtle.digest("SHA-256", data);
@@ -2239,20 +2320,40 @@ var createRandomBase64UrlGenerator = (length) => () => {
 var generateCodeVerifier = createRandomBase64UrlGenerator(NUM_GENERATOR_BYTES);
 var generateState = createRandomBase64UrlGenerator(NUM_GENERATOR_BYTES);
 var base64Url = (input) => encodeBase64(input).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+var encodeJwtPart = (value) => base64Url(new TextEncoder().encode(JSON.stringify(value)));
+var createAppleClientSecret = async (credentials) => {
+  const issuedAt = Math.floor(Date.now() / MILLISECONDS_PER_SECOND);
+  const header = encodeJwtPart({
+    alg: "ES256",
+    kid: credentials.keyId,
+    typ: "JWT"
+  });
+  const payload = encodeJwtPart({
+    aud: APPLE_ISSUER,
+    exp: issuedAt + APPLE_CLIENT_SECRET_LIFETIME_SECONDS,
+    iat: issuedAt,
+    iss: credentials.teamId,
+    sub: credentials.clientId
+  });
+  const signingInput = `${header}.${payload}`;
+  const privateKey = await crypto.subtle.importKey("pkcs8", Uint8Array.from(credentials.pkcs8PrivateKey), { name: "ECDSA", namedCurve: "P-256" }, false, ["sign"]);
+  const signature = await crypto.subtle.sign({ hash: "SHA-256", name: "ECDSA" }, privateKey, new TextEncoder().encode(signingInput));
+  return `${signingInput}.${base64Url(signature)}`;
+};
 var ALG_ES256 = "ES256";
 var ALG_RS256 = "RS256";
 var CLOCK_SKEW_SECONDS = 60;
 var DEFAULT_SCOPES = ["openid", "email", "profile"];
 var JWKS_REFETCH_COOLDOWN_MS = 60000;
 var JWT_SEGMENT_COUNT = 3;
-var MILLISECONDS_PER_SECOND = 1000;
+var MILLISECONDS_PER_SECOND2 = 1000;
 var trimTrailingSlash = (value) => value.endsWith("/") ? value.slice(0, -1) : value;
 var fetchJson = async (url) => {
   const response = await fetch(url, {
     headers: { accept: "application/json" }
   });
   if (!response.ok) {
-    throw new Error(`Request to ${url} failed with status ${response.status}`);
+    throw await createOAuth2FetchError(response);
   }
   return response.json();
 };
@@ -2283,11 +2384,14 @@ var verifySignature = (key, alg, signingInput, signature) => {
 var selectKey = (jwks, kid) => jwks.find((jwk) => kid === undefined || jwk.kid === kid);
 var assertClaims = (payload, expected) => {
   const aud = Reflect.get(payload, "aud");
+  const azp = Reflect.get(payload, "azp");
   const exp = Reflect.get(payload, "exp");
+  const iat = Reflect.get(payload, "iat");
   const iss = Reflect.get(payload, "iss");
+  const nbf = Reflect.get(payload, "nbf");
   const sub = Reflect.get(payload, "sub");
   const audiences = Array.isArray(aud) ? aud : [aud];
-  const nowSeconds = Math.floor(Date.now() / MILLISECONDS_PER_SECOND);
+  const nowSeconds = Math.floor(Date.now() / MILLISECONDS_PER_SECOND2);
   if (iss !== expected.issuer) {
     throw new Error('id_token "iss" does not match the provider issuer');
   }
@@ -2297,9 +2401,24 @@ var assertClaims = (payload, expected) => {
   if (!audiences.includes(expected.audience)) {
     throw new Error('id_token "aud" does not include the client id');
   }
+  if (audiences.some((audience) => typeof audience !== "string") || typeof aud !== "string" && !Array.isArray(aud)) {
+    throw new Error('id_token "aud" must be a string or string array');
+  }
+  if (audiences.length > 1 && (typeof azp !== "string" || azp !== expected.audience)) {
+    throw new Error('id_token with multiple audiences requires matching "azp"');
+  }
   if (typeof exp !== "number" || exp + CLOCK_SKEW_SECONDS < nowSeconds) {
     throw new Error("id_token has expired");
   }
+  if (typeof iat !== "number") {
+    throw new Error('id_token is missing numeric "iat"');
+  }
+  if (iat > nowSeconds + CLOCK_SKEW_SECONDS) {
+    throw new Error('id_token "iat" is in the future');
+  }
+  if (nbf !== undefined && (typeof nbf !== "number" || nbf > nowSeconds + CLOCK_SKEW_SECONDS)) {
+    throw new Error("id_token is not active yet");
+  }
   if (expected.nonce !== undefined && Reflect.get(payload, "nonce") !== expected.nonce) {
     throw new Error('id_token "nonce" does not match');
   }
@@ -2426,9 +2545,9 @@ var createOIDCClient = async (config) => {
       method: "POST"
     });
     if (!response.ok) {
-      throw new Error(`OIDC token request failed with status ${response.status}`);
+      throw await createOAuth2FetchError(response);
     }
-    const tokens = await response.json();
+    const tokens = parseOAuth2TokenResponse(await response.json());
     return tokens;
   };
   const verifyToken = async (idToken, options) => {
@@ -2474,20 +2593,26 @@ var createOIDCClient = async (config) => {
 };
 var oidcProviderOptions = Object.keys(providers).filter(isOIDCProviderOption);
 var pkceProviderOptions = Object.keys(providers).filter(isPKCEProviderOption);
+var profileProviderOptions = Object.keys(providers).filter(isProfileProviderOption);
 var providerOptions = Object.keys(providers).filter(isValidProviderOption);
 var refreshableProviderOptions = Object.keys(providers).filter(isRefreshableProviderOption);
 var revocableProviderOptions = Object.keys(providers).filter(isRevocableProviderOption);
 var scopeRequiredProviderOptions = Object.keys(providers).filter(isScopeRequiredProviderOption);
-var readPath = (value, path) => path.reduce((cursor, key) => cursor && typeof cursor === "object" ? Reflect.get(cursor, key) : undefined, value);
 var buildOAuth2Client = async (meta, config) => {
   const isConfigPropertyFunction = (cfgProp) => typeof cfgProp === "function";
   const resolveConfigProp = async (cfgProp) => {
     const result = isConfigPropertyFunction(cfgProp) ? cfgProp(config) : cfgProp;
     return result;
   };
+  const resolveClientSecret = async () => {
+    if (meta.createClientSecret) {
+      return resolveConfigProp(meta.createClientSecret);
+    }
+    return hasClientSecret(config) ? config.clientSecret : undefined;
+  };
   const authorizationUrl = await resolveConfigProp(meta.authorizationUrl);
   const tokenUrl = await resolveConfigProp(meta.tokenRequest.url);
-  return {
+  const client = {
     async createAuthorizationUrl(opts) {
       const { state, scope = [], searchParams = [], codeVerifier } = opts;
       const url = new URL(authorizationUrl);
@@ -2508,7 +2633,7 @@ var buildOAuth2Client = async (meta, config) => {
         url.searchParams.set("code_challenge_method", meta.PKCEMethod);
         url.searchParams.set("code_challenge", codeChallenge);
       }
-      Object.entries(resolveConfigProp(meta.createAuthorizationURLSearchParams) ?? {}).forEach(([key, value]) => url.searchParams.set(key, value));
+      Object.entries(await resolveConfigProp(meta.createAuthorizationURLSearchParams) ?? {}).forEach(([key, value]) => url.searchParams.set(key, value));
       searchParams.forEach(([key, value]) => url.searchParams.set(key, value));
       return url;
     },
@@ -2541,7 +2666,7 @@ var buildOAuth2Client = async (meta, config) => {
       if (authIn === "header") {
         profileHeaders.Authorization = `Bearer ${accessToken}`;
       } else if (authIn === "path") {
-        endpoint.pathname = `${endpoint.pathname.replace(/\/+$/, "")}/${accessToken}`;
+        endpoint.pathname = `${endpoint.pathname.replace(/\/+$/, "")}/${encodeURIComponent(accessToken)}`;
       } else {
         endpoint.searchParams.append("access_token", accessToken);
       }
@@ -2562,9 +2687,8 @@ var buildOAuth2Client = async (meta, config) => {
       params.set("grant_type", "refresh_token");
       params.set("refresh_token", refreshToken);
       const { clientId } = config;
-      let clientSecretValue;
-      if (hasClientSecret(config)) {
-        clientSecretValue = config.clientSecret;
+      const clientSecretValue = await resolveClientSecret();
+      if (clientSecretValue) {
         params.set("client_id", clientId);
         params.set("client_secret", clientSecretValue);
       }
@@ -2579,60 +2703,99 @@ var buildOAuth2Client = async (meta, config) => {
       const response = await fetch(request);
       if (!response.ok)
         throw await createOAuth2FetchError(response);
-      return response.json();
+      return parseOAuth2TokenResponse(await response.json());
+    },
+    resolveRevocationInput(context) {
+      const { revocationRequest } = meta;
+      if (!revocationRequest) {
+        throw new Error("Token revocation not defined for this provider");
+      }
+      const inputSource = revocationRequest.inputSource ?? "accessToken";
+      const input = context[inputSource];
+      if (input === undefined) {
+        throw new Error(`Revocation requires ${inputSource}, but it was not provided`);
+      }
+      const expectsNumber = revocationRequest.authIn !== "header" && revocationRequest.inputType === "number";
+      if (expectsNumber && (typeof input !== "number" || !Number.isFinite(input))) {
+        throw new TypeError("This provider requires a numeric revocation input");
+      }
+      if (!expectsNumber && typeof input !== "string") {
+        throw new TypeError("This provider requires a string revocation input");
+      }
+      return input;
     },
-    async revokeToken(token) {
+    async revokeToken(input) {
       const { revocationRequest } = meta;
       if (!revocationRequest) {
         throw new Error("Token revocation not defined for this provider");
       }
-      const { url, authIn, body, headers, tokenParamName } = revocationRequest;
+      if (revocationRequest.authIn !== "header" && revocationRequest.inputType === "number" && (typeof input !== "number" || !Number.isFinite(input))) {
+        throw new TypeError("This provider requires a numeric revocation input");
+      }
+      const {
+        url,
+        authIn,
+        body,
+        encoding,
+        headers,
+        includeClientCredentials = true,
+        tokenParamName,
+        validateResponse
+      } = revocationRequest;
       const endpoint = await resolveConfigProp(url);
       const resolvedBody = await resolveConfigProp(body);
-      const revocationBody = new URLSearchParams(resolvedBody);
+      const revocationBody = resolvedBody === undefined ? undefined : new URLSearchParams(resolvedBody);
       const revocationHeaders = new Headers(headers && await resolveConfigProp(headers));
       const { clientId } = config;
-      const clientSecret = hasClientSecret(config) ? config.clientSecret : undefined;
+      const clientSecret = await resolveClientSecret();
       let request;
       if (authIn === "body") {
-        revocationBody.set(tokenParamName, token);
-        revocationBody.set("client_id", clientId);
-        if (clientSecret)
-          revocationBody.set("client_secret", clientSecret);
+        const bodyWithToken = revocationBody ?? new URLSearchParams;
+        bodyWithToken.set(tokenParamName, String(input));
+        const hasAuthorizationHeader = revocationHeaders.has("Authorization");
+        if (includeClientCredentials && !hasAuthorizationHeader)
+          bodyWithToken.set("client_id", clientId);
+        if (includeClientCredentials && !hasAuthorizationHeader && clientSecret)
+          bodyWithToken.set("client_secret", clientSecret);
         request = createOAuth2Request({
-          authIn: "body",
-          body: revocationBody,
+          authIn: hasAuthorizationHeader || !includeClientCredentials ? "query" : "body",
+          body: bodyWithToken,
           clientId,
           clientSecret,
-          encoding: "application/x-www-form-urlencoded",
+          encoding,
           headers: revocationHeaders,
           url: endpoint.toString()
         });
       } else if (authIn === "header") {
-        revocationHeaders.set("Authorization", `Bearer ${token}`);
+        revocationHeaders.set("Authorization", `Bearer ${String(input)}`);
         request = createOAuth2Request({
-          authIn: "header",
+          authIn: "query",
           body: revocationBody,
           clientId,
-          clientSecret,
-          encoding: "application/x-www-form-urlencoded",
+          encoding,
           headers: revocationHeaders,
           url: endpoint.toString()
         });
       } else {
+        const queryEndpoint = new URL(endpoint);
+        queryEndpoint.searchParams.set(tokenParamName, String(input));
         request = createOAuth2Request({
           authIn: "query",
           body: revocationBody,
           clientId,
-          clientSecret,
-          encoding: "application/x-www-form-urlencoded",
+          encoding,
           headers: revocationHeaders,
-          url: `${endpoint.toString()}?${tokenParamName}=${token}`
+          url: queryEndpoint.toString()
         });
       }
       const response = await fetch(request);
       if (!response.ok)
         throw await createOAuth2FetchError(response);
+      if (validateResponse) {
+        await validateResponse(await response.json().catch(() => {
+          return;
+        }));
+      }
     },
     async validateAuthorizationCode(opts) {
       const { code, codeVerifier } = opts;
@@ -2658,32 +2821,27 @@ var buildOAuth2Client = async (meta, config) => {
         authIn,
         body: payload,
         clientId: config.clientId,
-        clientSecret: hasClientSecret(config) ? config.clientSecret : undefined,
+        clientSecret: await resolveClientSecret(),
         encoding,
         url: tokenUrl
       });
       const response = await fetch(request);
       if (!response.ok)
         throw await createOAuth2FetchError(response);
-      const tokenResponse = await response.json();
-      if (!tokenResponse || typeof tokenResponse !== "object") {
-        throw new Error("OAuth token endpoint returned a non-object response");
-      }
-      const oauthError = Reflect.get(tokenResponse, "error");
-      if (typeof oauthError === "string" && oauthError.length > 0) {
-        throw new Error(`OAuth token exchange failed: ${oauthError}`);
-      }
-      const nestedToken = meta.accessTokenPath ? readPath(tokenResponse, meta.accessTokenPath) : undefined;
-      if (typeof nestedToken === "string" && nestedToken.length > 0 && tokenResponse && typeof tokenResponse === "object") {
-        tokenResponse.access_token = nestedToken;
-      }
-      const accessToken = Reflect.get(tokenResponse, "access_token");
-      if (typeof accessToken !== "string" || accessToken.length === 0) {
-        throw new Error("OAuth token endpoint returned no access_token");
-      }
-      return tokenResponse;
+      return parseOAuth2TokenResponse(await response.json(), meta.accessTokenPath);
     }
   };
+  if (!meta.profileRequest) {
+    Reflect.deleteProperty(client, "fetchUserProfile");
+  }
+  if (!meta.isRefreshable) {
+    Reflect.deleteProperty(client, "refreshAccessToken");
+  }
+  if (!meta.revocationRequest) {
+    Reflect.deleteProperty(client, "resolveRevocationInput");
+    Reflect.deleteProperty(client, "revokeToken");
+  }
+  return client;
 };
 var createCustomOAuth2Client = (providerConfig, credentials) => buildOAuth2Client(providerConfig, credentials);
 var createOAuth2Client = (providerName, config) => buildOAuth2Client(providers[providerName], config);
@@ -2706,5 +2864,5 @@ export {
   decodeJWT
 };
 
-//# debugId=902C18A45F6C2D7A64756E2164756E21
+//# debugId=8F4DD1C7459EFF1964756E2164756E21
 //# sourceMappingURL=index.js.map