@authup/client-auth-console 1.0.0-beta.70 → 1.0.0-beta.71

package/dist/client/index.html

@@ -13,7 +13,7 @@
     <link rel="icon" type="image/svg+xml" href="/console/auth/assets/favicon-CEtVE1SK.svg" />
     <title>Authup</title>
     <!--preload-links-->
-  <script type="module" crossorigin src="/console/auth/assets/index-oZXM2RN4.js"></script>
+  <script type="module" crossorigin src="/console/auth/assets/index-Pd7hWwbo.js"></script>
   <link rel="stylesheet" crossorigin href="/console/auth/assets/index-CyF87xq2.css">
 </head>
 <body>

package/dist/server/server.js

@@ -39743,6 +39743,15 @@ var OAuth2Error = class extends AuthupError {
 	}
 };
 //#endregion
+//#region ../../packages/specs/src/oauth2/check.ts
+/**
+* Whether the code is one of the errors RFC 6749 §5.2 defines for a
+* token endpoint response, read from the response body's `error` field.
+*/
+function isOAuth2TokenErrorCode(code) {
+	return code === OAuth2ErrorCode.INVALID_REQUEST || code === OAuth2ErrorCode.INVALID_CLIENT || code === OAuth2ErrorCode.INVALID_GRANT || code === OAuth2ErrorCode.UNAUTHORIZED_CLIENT || code === OAuth2ErrorCode.UNSUPPORTED_GRANT_TYPE || code === OAuth2ErrorCode.INVALID_SCOPE;
+}
+//#endregion
 //#region ../../packages/specs/src/oauth2/scope/helpers.ts
 /**
 * Deserialize a string representation of multiple oauth2 scopes.
@@ -82875,6 +82884,14 @@ function getClientErrorCode(err) {
 	if (!isObject$7(err.response.data) || typeof err.response.data.code !== "string") return null;
 	return err.response.data.code;
 }
+/**
+* The OAuth2 `error` field of a response body (RFC 6749 §5.2).
+*/
+function getClientOAuth2ErrorCode(err) {
+	if (!isObject$7(err) || !isObject$7(err.response)) return null;
+	if (!isObject$7(err.response.data) || typeof err.response.data.error !== "string") return null;
+	return err.response.data.error;
+}
 //#endregion
 //#region ../../node_modules/@rapiq/parser-expression/dist/index.mjs
 var ExpressionFieldsParser = class extends SimpleFieldsParser {};
@@ -87938,6 +87955,7 @@ var ClientAuthenticationHook = class extends EventEmitter$2 {
 			const { request } = err;
 			const currentState = getClientRequestRetryState(request);
 			if (currentState.retryCount > 0) return Promise.reject(err);
+			if (isOAuth2TokenErrorCode(getClientOAuth2ErrorCode(err))) return Promise.reject(err);
 			currentState.retryCount += 1;
 			const code = getClientErrorCode(err);
 			if (isJWKErrorCode(code)) {
@@ -88832,6 +88850,18 @@ var StoreAuthOrigin = /* @__PURE__ */ function(StoreAuthOrigin) {
 	return StoreAuthOrigin;
 }({});
 //#endregion
+//#region ../../packages/client-web-kit/src/core/http-client/build.ts
+/**
+* A client for one kit consumer (the store, the provided client, the hook's
+* refresh and revoke): the result of `httpClient` when it is a function, the
+* instance itself otherwise, else one built from `baseURL`.
+*/
+function buildHTTPClient(options) {
+	if (typeof options.httpClient === "function") return options.httpClient();
+	if (options.httpClient) return options.httpClient;
+	return new Client({ baseURL: options.baseURL });
+}
+//#endregion
 //#region ../../packages/client-web-kit/src/core/hydration/singleton.ts
 var HydrationStoreSymbol = Symbol.for("AuthupHydrationStore");
 function provideHydrationStore(store, app) {
@@ -89128,7 +89158,7 @@ function createPromiseShareWrapperFn(fn) {
 	};
 }
 function createStore(context) {
-	const client = context.httpClient ?? new Client({ baseURL: context.baseURL });
+	const client = buildHTTPClient(context);
 	const cookiesRead = (0, vue_exports.ref)(false);
 	const accessToken = (0, vue_exports.ref)(null);
 	const setAccessToken = (input) => {
@@ -90435,11 +90465,12 @@ function installHTTPClientAuthenticationHook(app, options = {}) {
 	const store = injectStoreFactory(app)(options.pinia);
 	const { refreshToken } = storeToRefs$1(store);
 	let refreshTokenInUse = null;
+	const buildClient = () => buildHTTPClient(options);
 	const hook = new ClientAuthenticationHook({
 		tokenCreator: () => {
 			if (!refreshToken.value) throw new Error("No refresh token available.");
 			refreshTokenInUse = refreshToken.value;
-			return (options.httpClient ?? new Client({ baseURL: options.baseURL })).token.createWithRefreshToken({ refresh_token: refreshTokenInUse });
+			return buildClient().token.createWithRefreshToken({ refresh_token: refreshTokenInUse });
 		},
 		timer: !options.isServer
 	});
@@ -90448,7 +90479,7 @@ function installHTTPClientAuthenticationHook(app, options = {}) {
 		if (refreshTokenInUse === null || store.refreshToken !== refreshTokenInUse) {
 			handleAccessTokenEvent();
 			handleAccessTokenExpireDateEvent();
-			const client = options.httpClient ?? new Client({ baseURL: options.baseURL });
+			const client = buildClient();
 			Promise.resolve().then(() => client.token.revoke({ token: response.access_token })).catch(() => {});
 			if (response.refresh_token) {
 				const refresh = response.refresh_token;
@@ -90512,7 +90543,7 @@ function injectHTTPClient(app) {
 //#region ../../packages/client-web-kit/src/core/http-client/install.ts
 function installHTTPClient(app, options = {}) {
 	if (hasHTTPClient(app)) return;
-	const client = options.httpClient ?? new Client({ baseURL: options.baseURL });
+	const client = buildHTTPClient(options);
 	injectHTTPClientAuthenticationHook(app).attach(client);
 	provideHTTPClient(client, app);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@authup/client-auth-console",
-    "version": "1.0.0-beta.70",
+    "version": "1.0.0-beta.71",
     "type": "module",
     "license": "AGPL-3.0-only",
     "description": "Authup's hosted login, consent, registration, password recovery and device pages, as a server-rendered Vue bundle.",
@@ -25,15 +25,15 @@
         "node": "^22.13.0 || ^23.5.0 || >=24.0.0"
     },
     "dependencies": {
-        "@authup/core-http-kit": "^1.0.0-beta.70"
+        "@authup/core-http-kit": "^1.0.0-beta.71"
     },
     "devDependencies": {
-        "@authup/client-web-kit": "^1.0.0-beta.70",
-        "@authup/client-web-kit-theme": "^1.0.0-beta.70",
-        "@authup/client-web-theme": "^1.0.0-beta.70",
-        "@authup/core-kit": "^1.0.0-beta.70",
-        "@authup/i18n": "^1.0.0-beta.70",
-        "@authup/kit": "^1.0.0-beta.70",
+        "@authup/client-web-kit": "^1.0.0-beta.71",
+        "@authup/client-web-kit-theme": "^1.0.0-beta.71",
+        "@authup/client-web-theme": "^1.0.0-beta.71",
+        "@authup/core-kit": "^1.0.0-beta.71",
+        "@authup/i18n": "^1.0.0-beta.71",
+        "@authup/kit": "^1.0.0-beta.71",
         "@fontsource/asap": "^5.3.0",
         "@fontsource/nunito": "^5.3.0",
         "@iconify-json/fa6-brands": "^1.2.0",

package/src/contract.ts

@@ -103,6 +103,11 @@ export type RenderContext = {
      * constructed from payload.config.baseURL (host self-call rewrite,
      * test injection). It carries the visitor's bearer once their session
      * resolved, so a host must build one per render and never share it.
+     *
+     * Its base url must be payload.config.baseURL: the app renders urls
+     * derived from it (the identity provider buttons), and hydration does
+     * not correct an attribute. A host that dials another address does so
+     * in the client's transport.
      */
     httpClient?: IClient,
     /**