@cloudflare/workers-oauth-provider 0.0.0-6ab489d → 0.0.0-75d3fe2

package/dist/oauth-provider.js

@@ -142,7 +142,16 @@ var OAuthProviderImpl = class {
       return this.addCorsHeaders(response, request);
     }
     if (this.isTokenEndpoint(url)) {
-      const response = await this.handleTokenRequest(request, env);
+      const parsed = await this.parseTokenEndpointRequest(request, env);
+      if (parsed instanceof Response) {
+        return this.addCorsHeaders(parsed, request);
+      }
+      let response;
+      if (parsed.isRevocationRequest) {
+        response = await this.handleRevocationRequest(parsed.body, env);
+      } else {
+        response = await this.handleTokenRequest(parsed.body, parsed.clientInfo, env);
+      }
       return this.addCorsHeaders(response, request);
     }
     if (this.options.clientRegistrationEndpoint && this.isClientRegistrationEndpoint(url)) {
@@ -206,6 +215,67 @@ var OAuthProviderImpl = class {
     if (!this.options.clientRegistrationEndpoint) return false;
     return this.matchEndpoint(url, this.options.clientRegistrationEndpoint);
   }
+  /**
+   * Parses and validates a token endpoint request (used for both token exchange and revocation)
+   * @param request - The HTTP request to parse
+   * @returns Promise with parsed body and client info, or error response
+   */
+  async parseTokenEndpointRequest(request, env) {
+    if (request.method !== "POST") {
+      return this.createErrorResponse("invalid_request", "Method not allowed", 405);
+    }
+    let contentType = request.headers.get("Content-Type") || "";
+    let body = {};
+    if (!contentType.includes("application/x-www-form-urlencoded")) {
+      return this.createErrorResponse("invalid_request", "Content-Type must be application/x-www-form-urlencoded", 400);
+    }
+    const formData = await request.formData();
+    for (const [key, value] of formData.entries()) {
+      body[key] = value;
+    }
+    const authHeader = request.headers.get("Authorization");
+    let clientId = "";
+    let clientSecret = "";
+    if (authHeader && authHeader.startsWith("Basic ")) {
+      const credentials = atob(authHeader.substring(6));
+      const [id, secret] = credentials.split(":", 2);
+      clientId = decodeURIComponent(id);
+      clientSecret = decodeURIComponent(secret || "");
+    } else {
+      clientId = body.client_id;
+      clientSecret = body.client_secret || "";
+    }
+    if (!clientId) {
+      return this.createErrorResponse("invalid_client", "Client ID is required", 401);
+    }
+    const clientInfo = await this.getClient(env, clientId);
+    if (!clientInfo) {
+      return this.createErrorResponse("invalid_client", "Client not found", 401);
+    }
+    const isPublicClient = clientInfo.tokenEndpointAuthMethod === "none";
+    if (!isPublicClient) {
+      if (!clientSecret) {
+        return this.createErrorResponse("invalid_client", "Client authentication failed: missing client_secret", 401);
+      }
+      if (!clientInfo.clientSecret) {
+        return this.createErrorResponse(
+          "invalid_client",
+          "Client authentication failed: client has no registered secret",
+          401
+        );
+      }
+      const providedSecretHash = await hashSecret(clientSecret);
+      if (providedSecretHash !== clientInfo.clientSecret) {
+        return this.createErrorResponse("invalid_client", "Client authentication failed: invalid client_secret", 401);
+      }
+    }
+    const isRevocationRequest = !body.grant_type && !!body.token;
+    return {
+      body,
+      clientInfo,
+      isRevocationRequest
+    };
+  }
   /**
    * Checks if a URL matches a specific API route
    * @param url - The URL to check
@@ -329,59 +399,12 @@ var OAuthProviderImpl = class {
   /**
    * Handles client authentication and token issuance via the token endpoint
    * Supports authorization_code and refresh_token grant types
-   * @param request - The HTTP request
+   * @param body - The parsed request body
+   * @param clientInfo - The authenticated client information
    * @param env - Cloudflare Worker environment variables
    * @returns Response with token data or error
    */
-  async handleTokenRequest(request, env) {
-    if (request.method !== "POST") {
-      return this.createErrorResponse("invalid_request", "Method not allowed", 405);
-    }
-    let contentType = request.headers.get("Content-Type") || "";
-    let body = {};
-    if (!contentType.includes("application/x-www-form-urlencoded")) {
-      return this.createErrorResponse("invalid_request", "Content-Type must be application/x-www-form-urlencoded", 400);
-    }
-    const formData = await request.formData();
-    for (const [key, value] of formData.entries()) {
-      body[key] = value;
-    }
-    const authHeader = request.headers.get("Authorization");
-    let clientId = "";
-    let clientSecret = "";
-    if (authHeader && authHeader.startsWith("Basic ")) {
-      const credentials = atob(authHeader.substring(6));
-      const [id, secret] = credentials.split(":", 2);
-      clientId = decodeURIComponent(id);
-      clientSecret = decodeURIComponent(secret || "");
-    } else {
-      clientId = body.client_id;
-      clientSecret = body.client_secret || "";
-    }
-    if (!clientId) {
-      return this.createErrorResponse("invalid_client", "Client ID is required", 401);
-    }
-    const clientInfo = await this.getClient(env, clientId);
-    if (!clientInfo) {
-      return this.createErrorResponse("invalid_client", "Client not found", 401);
-    }
-    const isPublicClient = clientInfo.tokenEndpointAuthMethod === "none";
-    if (!isPublicClient) {
-      if (!clientSecret) {
-        return this.createErrorResponse("invalid_client", "Client authentication failed: missing client_secret", 401);
-      }
-      if (!clientInfo.clientSecret) {
-        return this.createErrorResponse(
-          "invalid_client",
-          "Client authentication failed: client has no registered secret",
-          401
-        );
-      }
-      const providedSecretHash = await hashSecret(clientSecret);
-      if (providedSecretHash !== clientInfo.clientSecret) {
-        return this.createErrorResponse("invalid_client", "Client authentication failed: invalid client_secret", 401);
-      }
-    }
+  async handleTokenRequest(body, clientInfo, env) {
     const grantType = body.grant_type;
     if (grantType === "authorization_code") {
       return this.handleAuthorizationCodeGrant(body, clientInfo, env);
@@ -679,6 +702,86 @@ var OAuthProviderImpl = class {
       }
     );
   }
+  /**
+   * Handles OAuth 2.0 token revocation requests (RFC 7009)
+   * @param body - The parsed request body containing revocation parameters
+   * @param env - Cloudflare Worker environment variables
+   * @returns Response confirming revocation or error
+   */
+  async handleRevocationRequest(body, env) {
+    return this.revokeToken(body, env);
+  }
+  /**
+   * - Access tokens: Revokes only the specific token
+   * - Refresh tokens: Revokes the entire grant (access + refresh tokens)
+   * @param body - The parsed request body containing token parameter
+   * @param env - Cloudflare Worker environment variables
+   * @returns Response confirming revocation or error
+   */
+  async revokeToken(body, env) {
+    const token = body.token;
+    if (!token) {
+      return this.createErrorResponse("invalid_request", "Token parameter is required");
+    }
+    const tokenParts = token.split(":");
+    if (tokenParts.length !== 3) {
+      return new Response("", { status: 200 });
+    }
+    const [userId, grantId, _] = tokenParts;
+    const tokenId = await generateTokenId(token);
+    const isAccessToken = await this.validateAccessToken(tokenId, userId, grantId, env);
+    const isRefreshToken = await this.validateRefreshToken(tokenId, userId, grantId, env);
+    if (isAccessToken) {
+      await this.revokeSpecificAccessToken(tokenId, userId, grantId, env);
+    } else if (isRefreshToken) {
+      await this.createOAuthHelpers(env).revokeGrant(grantId, userId);
+    }
+    return new Response("", { status: 200 });
+  }
+  /**
+   * Revokes a specific access token without affecting the refresh token
+   * @param tokenId - The hashed token ID
+   * @param userId - The user ID extracted from the token
+   * @param grantId - The grant ID extracted from the token
+   * @param env - Cloudflare Worker environment variables
+   */
+  async revokeSpecificAccessToken(tokenId, userId, grantId, env) {
+    const tokenKey = `token:${userId}:${grantId}:${tokenId}`;
+    await env.OAUTH_KV.delete(tokenKey);
+  }
+  /**
+   * Validates if a token is a valid access token
+   * @param tokenId - The hashed token ID
+   * @param userId - The user ID extracted from the token
+   * @param grantId - The grant ID extracted from the token
+   * @param env - Cloudflare Worker environment variables
+   * @returns Promise<boolean> indicating if the token is valid
+   */
+  async validateAccessToken(tokenId, userId, grantId, env) {
+    const tokenKey = `token:${userId}:${grantId}:${tokenId}`;
+    const tokenData = await env.OAUTH_KV.get(tokenKey, { type: "json" });
+    if (!tokenData) {
+      return false;
+    }
+    const now = Math.floor(Date.now() / 1e3);
+    return tokenData.expiresAt >= now;
+  }
+  /**
+   * Validates if a token is a valid refresh token
+   * @param tokenId - The hashed token ID
+   * @param userId - The user ID extracted from the token
+   * @param grantId - The grant ID extracted from the token
+   * @param env - Cloudflare Worker environment variables
+   * @returns Promise<boolean> indicating if the token is valid
+   */
+  async validateRefreshToken(tokenId, userId, grantId, env) {
+    const grantKey = `grant:${userId}:${grantId}`;
+    const grantData = await env.OAUTH_KV.get(grantKey, { type: "json" });
+    if (!grantData) {
+      return false;
+    }
+    return grantData.refreshTokenId === tokenId || grantData.previousRefreshTokenId === tokenId;
+  }
   /**
    * Handles the dynamic client registration endpoint (RFC 7591)
    * @param request - The HTTP request
@@ -1071,15 +1174,16 @@ var OAuthHelpersImpl = class {
     const state = url.searchParams.get("state") || "";
     const codeChallenge = url.searchParams.get("code_challenge") || void 0;
     const codeChallengeMethod = url.searchParams.get("code_challenge_method") || "plain";
+    if (!redirectUri.startsWith("http://") && !redirectUri.startsWith("https://")) {
+      throw new Error("Invalid redirect URI");
+    }
     if (responseType === "token" && !this.provider.options.allowImplicitFlow) {
       throw new Error("The implicit grant flow is not enabled for this provider");
     }
     if (clientId) {
       const clientInfo = await this.lookupClient(clientId);
       if (!clientInfo) {
-        throw new Error(
-          `Invalid client. The clientId provided does not match to this client.`
-        );
+        throw new Error(`Invalid client. The clientId provided does not match to this client.`);
       }
       if (clientInfo && redirectUri) {
         if (!clientInfo.redirectUris.includes(redirectUri)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloudflare/workers-oauth-provider",
-  "version": "0.0.0-6ab489d",
+  "version": "0.0.0-75d3fe2",
   "description": "OAuth provider for Cloudflare Workers",
   "main": "dist/oauth-provider.js",
   "types": "dist/oauth-provider.d.ts",
@@ -26,11 +26,12 @@
   },
   "devDependencies": {
     "@changesets/changelog-github": "^0.5.1",
-    "@changesets/cli": "^2.29.5",
+    "@changesets/cli": "^2.29.7",
     "@cloudflare/workers-types": "^4.20250807.0",
+    "pkg-pr-new": "^0.0.59",
     "prettier": "^3.6.2",
     "tsup": "^8.5.0",
-    "tsx": "^4.20.3",
+    "tsx": "^4.20.5",
     "typescript": "^5.9.2",
     "vitest": "^3.2.4"
   },