@cloudflare/workers-oauth-provider 0.0.5 → 0.0.6

package/README.md

@@ -2,10 +2,6 @@
 
 This is a TypeScript library that implements the provider side of the OAuth 2.1 protocol with PKCE support. The library is intended to be used on Cloudflare Workers.
 
-## Beta
-
-As of March, 2025, this library is very new, prerelease software. The API is still subject to change.
-
 ## Benefits of this library
 
 * The library acts as a wrapper around your Worker code, which adds authorization for your API endpoints.
@@ -20,8 +16,7 @@ As of March, 2025, this library is very new, prerelease software. The API is sti
 A Worker that uses the library might look like this:
 
 ```ts
-import { OAuthProvider } from "my-oauth";
-import type { ExportedHandler } from "@cloudflare/workers-types";
+import { OAuthProvider } from "@cloudflare/workers-oauth-provider";
 import { WorkerEntrypoint } from "cloudflare:workers";
 
 // We export the OAuthProvider instance as the entrypoint to our Worker. This means it
@@ -328,7 +323,7 @@ This library (including the schema documentation) was largely written with the h
 
 "haha gpus go brrr"
 
-In all seriousness, two months ago (January 2025), I ([@kentonv](https://github.com/kentonv)) would have agreed. I was an AI skeptic. I thoughts LLMs were glorified Markov chain generators that didn't actually understand code and couldn't produce anything novel. I started this project on a lark, fully expecting the AI to produce terrible code for me to laugh at. And then, uh... the code actually looked pretty good. Not perfect, but I just told the AI to fix things, and it did. I was shocked.
+In all seriousness, two months ago (January 2025), I ([@kentonv](https://github.com/kentonv)) would have agreed. I was an AI skeptic. I thought LLMs were glorified Markov chain generators that didn't actually understand code and couldn't produce anything novel. I started this project on a lark, fully expecting the AI to produce terrible code for me to laugh at. And then, uh... the code actually looked pretty good. Not perfect, but I just told the AI to fix things, and it did. I was shocked.
 
 To emphasize, **this is not "vibe coded"**. Every line was thoroughly reviewed and cross-referenced with relevant RFCs, by security experts with previous experience with those RFCs. I was *trying* to validate my skepticism. I ended up proving myself wrong.
 

package/dist/oauth-provider.d.ts

@@ -1,4 +1,3 @@
-import { ExportedHandler, ExecutionContext } from '@cloudflare/workers-types';
 import { WorkerEntrypoint } from 'cloudflare:workers';
 
 /**

package/dist/oauth-provider.js

@@ -351,9 +351,9 @@ var OAuthProviderImpl = class {
     let clientSecret = "";
     if (authHeader && authHeader.startsWith("Basic ")) {
       const credentials = atob(authHeader.substring(6));
-      const [id, secret] = credentials.split(":");
-      clientId = id;
-      clientSecret = secret || "";
+      const [id, secret] = credentials.split(":", 2);
+      clientId = decodeURIComponent(id);
+      clientSecret = decodeURIComponent(secret || "");
     } else {
       clientId = body.client_id;
       clientSecret = body.client_secret || "";
@@ -1076,6 +1076,11 @@ var OAuthHelpersImpl = class {
     }
     if (clientId) {
       const clientInfo = await this.lookupClient(clientId);
+      if (!clientInfo) {
+        throw new Error(
+          `Invalid client. The clientId provided does not match to this client.`
+        );
+      }
       if (clientInfo && redirectUri) {
         if (!clientInfo.redirectUris.includes(redirectUri)) {
           throw new Error(

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "@cloudflare/workers-oauth-provider",
-  "version": "0.0.5",
+  "version": "0.0.6",
   "description": "OAuth provider for Cloudflare Workers",
   "main": "dist/oauth-provider.js",
   "types": "dist/oauth-provider.d.ts",
   "author": "Kenton Varda <kenton@cloudflare.com>",
   "license": "MIT",
+  "sideEffects": false,
   "files": [
     "dist"
   ],
@@ -13,20 +14,32 @@
   "publishConfig": {
     "access": "public"
   },
-  "dependencies": {
-    "@cloudflare/workers-types": "^4.20250311.0"
-  },
-  "devDependencies": {
-    "prettier": "^3.5.3",
-    "tsup": "^8.4.0",
-    "typescript": "^5.8.2",
-    "vitest": "^3.0.8"
-  },
   "scripts": {
     "build": "tsup",
     "build:watch": "tsup --watch",
+    "check": "npm run typecheck && npm run test",
+    "typecheck": "tsc",
     "test": "vitest run",
     "test:watch": "vitest",
+    "prepublishOnly": "npm run build",
     "prettier": "prettier -w ."
-  }
-}
+  },
+  "devDependencies": {
+    "@changesets/changelog-github": "^0.5.1",
+    "@changesets/cli": "^2.29.5",
+    "@cloudflare/workers-types": "^4.20250807.0",
+    "prettier": "^3.6.2",
+    "tsup": "^8.5.0",
+    "tsx": "^4.20.3",
+    "typescript": "^5.9.2",
+    "vitest": "^3.2.4"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/cloudflare/workers-oauth-provider"
+  },
+  "bugs": {
+    "url": "https://github.com/cloudflare/workers-oauth-provider/issues"
+  },
+  "homepage": "https://github.com/cloudflare/workers-oauth-provider#readme"
+}