@agentforge-io/core 2.0.14 → 2.0.15

package/dist/services/oauth2.service.d.ts

@@ -36,6 +36,24 @@ export interface OAuth2ProviderConfig {
      * instead of letting an empty string poison the encrypted-token row.
      */
     tokenExtractor?: (json: unknown) => TokenSet;
+    /**
+     * Where to put the client credentials on the token exchange request.
+     *
+     *   - `'body'` (default) — appends `client_id` + `client_secret` to the
+     *     form-encoded body. Works for the majority of providers (Google,
+     *     HubSpot, ClickUp, Slack, GitHub).
+     *
+     *   - `'basic'` — sends them as `Authorization: Basic
+     *     base64(client_id:client_secret)` instead. Required by Notion
+     *     (their `/v1/oauth/token` rejects body credentials with
+     *     `invalid_client`), Spotify, and a handful of other providers
+     *     whose docs say "Basic Auth" explicitly.
+     *
+     * RFC 6749 §2.3.1 allows both forms but recommends Basic when both are
+     * supported. We default to body because it was the legacy behavior and
+     * every existing connector relies on it.
+     */
+    tokenAuth?: 'body' | 'basic';
 }
 export interface AuthorizeUrlResult {
     url: string;

package/dist/services/oauth2.service.js

@@ -40,44 +40,62 @@ class OAuth2Service {
             grant_type: 'authorization_code',
             code,
             redirect_uri: redirectUri,
-            client_id: cfg.clientId,
-            client_secret: cfg.clientSecret,
         });
+        // Body-auth providers carry credentials in the form payload; basic-auth
+        // providers (Notion, Spotify) carry them in the Authorization header
+        // and reject body credentials with `invalid_client`. See
+        // OAuth2ProviderConfig.tokenAuth for the per-provider toggle.
+        if ((cfg.tokenAuth ?? 'body') === 'body') {
+            body.set('client_id', cfg.clientId);
+            body.set('client_secret', cfg.clientSecret);
+        }
         if (pkceVerifier)
             body.set('code_verifier', pkceVerifier);
-        return this.postToken(cfg.tokenUrl, body, cfg.tokenExtractor);
+        return this.postToken(cfg, body);
     }
     async refresh(cfg, refreshToken) {
         const body = new URLSearchParams({
             grant_type: 'refresh_token',
             refresh_token: refreshToken,
-            client_id: cfg.clientId,
-            client_secret: cfg.clientSecret,
         });
-        return this.postToken(cfg.tokenUrl, body, cfg.tokenExtractor);
+        if ((cfg.tokenAuth ?? 'body') === 'body') {
+            body.set('client_id', cfg.clientId);
+            body.set('client_secret', cfg.clientSecret);
+        }
+        return this.postToken(cfg, body);
     }
-    async postToken(tokenUrl, body, extractor) {
-        const res = await this.fetchImpl(tokenUrl, {
+    async postToken(cfg, body) {
+        const headers = {
+            'content-type': 'application/x-www-form-urlencoded',
+            accept: 'application/json',
+        };
+        // Basic-auth providers need credentials in the Authorization header
+        // instead of the body. RFC 6749 §2.3.1 — both forms are spec-legal
+        // but providers vary on which they accept.
+        if (cfg.tokenAuth === 'basic') {
+            const credentials = Buffer.from(`${cfg.clientId}:${cfg.clientSecret}`).toString('base64');
+            headers.authorization = `Basic ${credentials}`;
+        }
+        const res = await this.fetchImpl(cfg.tokenUrl, {
             method: 'POST',
-            headers: {
-                'content-type': 'application/x-www-form-urlencoded',
-                accept: 'application/json',
-            },
+            headers,
             body: body.toString(),
         });
         if (!res.ok) {
             const text = await res.text().catch(() => '');
-            throw new Error(`OAuth2 token endpoint ${tokenUrl} returned ${res.status}: ${text}`);
+            throw new Error(`OAuth2 token endpoint ${cfg.tokenUrl} returned ${res.status}: ${text}`);
         }
         const json = (await res.json());
-        const tokens = extractor ? extractor(json) : defaultExtractor(json);
+        const tokens = cfg.tokenExtractor
+            ? cfg.tokenExtractor(json)
+            : defaultExtractor(json);
         // Guard against accidentally persisting an empty-string token — that
         // would crash the cipher with "Received undefined" downstream and the
         // operator would chase a confusing stack trace. Better to fail fast
         // here with a descriptive error so the connector author knows their
         // extractor (or the default) missed the token.
         if (!tokens.accessToken) {
-            throw new Error(`OAuth2 token endpoint ${tokenUrl} returned a response without an access token. ` +
+            throw new Error(`OAuth2 token endpoint ${cfg.tokenUrl} returned a response without an access token. ` +
                 'If the provider uses a non-standard envelope, supply `tokenExtractor` on the ConnectorDefinition.');
         }
         return tokens;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentforge-io/core",
-  "version": "2.0.14",
+  "version": "2.0.15",
   "description": "Framework-free AI runtime SDK. Owns: agent loop (Anthropic), conversations, tools, streaming, agent-job queue, SdkHooks. Identity, billing, infra (email/uploads/secrets) live in the host's modules — not here.",
   "license": "MIT",
   "main": "dist/index.js",