@auth0/auth0-spa-js 2.2.0 → 2.3.0

package/dist/lib/auth0-spa-js.cjs.js

@@ -550,7 +550,7 @@ var browserTabsLock = createCommonjsModule((function(module, exports) {
 
 var Lock = unwrapExports(browserTabsLock);
 
-var version = "2.2.0";
+var version = "2.3.0";
 
 const DEFAULT_AUTHORIZE_TIMEOUT_IN_SECONDS = 60;
 
@@ -896,7 +896,13 @@ async function getJSON(url, timeout, audience, scope, options, worker, useFormDa
 
 async function oauthToken(_a, worker) {
     var {baseUrl: baseUrl, timeout: timeout, audience: audience, scope: scope, auth0Client: auth0Client, useFormData: useFormData} = _a, options = __rest(_a, [ "baseUrl", "timeout", "audience", "scope", "auth0Client", "useFormData" ]);
-    const body = useFormData ? createQueryParams(options) : JSON.stringify(options);
+    const isTokenExchange = options.grant_type === "urn:ietf:params:oauth:grant-type:token-exchange";
+    const allParams = Object.assign(Object.assign(Object.assign({}, options), isTokenExchange && audience && {
+        audience: audience
+    }), isTokenExchange && scope && {
+        scope: scope
+    });
+    const body = useFormData ? createQueryParams(allParams) : JSON.stringify(allParams);
     return await getJSON(`${baseUrl}/oauth/token`, timeout, audience || "default", scope, {
         method: "POST",
         body: body,
@@ -1920,7 +1926,13 @@ class Auth0Client {
                 throw new GenericError("login_required", "The application is running in a Cross-Origin Isolated context, silently retrieving a token without refresh token is not possible.");
             }
             const authorizeTimeout = options.timeoutInSeconds || this.options.authorizeTimeoutInSeconds;
-            const codeResult = await runIframe(url, this.domainUrl, authorizeTimeout);
+            let eventOrigin;
+            try {
+                eventOrigin = new URL(this.domainUrl).origin;
+            } catch (_a) {
+                eventOrigin = this.domainUrl;
+            }
+            const codeResult = await runIframe(url, eventOrigin, authorizeTimeout);
             if (stateIn !== codeResult.state) {
                 throw new GenericError("state_mismatch", "Invalid state");
             }
@@ -2058,7 +2070,7 @@ class Auth0Client {
             subject_token: options.subject_token,
             subject_token_type: options.subject_token_type,
             scope: getUniqueScopes(options.scope, this.scope),
-            audience: this.options.authorizationParams.audience
+            audience: options.audience || this.options.authorizationParams.audience
         });
     }
 }