@cloudflare/workers-oauth-provider 0.8.2 → 0.8.3

package/dist/oauth-provider.d.ts

@@ -358,8 +358,9 @@ interface TokenExchangeCallbackResult {
    */
   refreshTokenTTL?: number;
   /**
-   * List of scopes authorized for the new access token
-   * (If undefined, the granted scopes will be used)
+   * Optional scopes for the new access token. Values outside the scope ceiling
+   * for the current grant flow are ignored. If omitted, the effective requested
+   * scopes are used.
    */
   accessTokenScope?: string[];
 }
@@ -388,12 +389,11 @@ interface TokenExchangeCallbackOptions {
    */
   grantId: string;
   /**
-   * List of scopes that were granted
+   * List of scopes on the underlying authorization grant.
    */
   scope: string[];
   /**
-   * List of scopes that were requested for this token by the client
-   * (Will be the same as granted scopes unless client specifically requested a downscoping)
+   * Effective scopes selected for this token before applying the callback result.
    */
   requestedScope: string[];
   /**
@@ -790,7 +790,7 @@ interface ExchangeTokenOptions {
    */
   subjectToken: string;
   /**
-   * Optional narrowed set of scopes for the new token (must be subset of original grant scopes)
+   * Optional requested scopes for the new token. Issued scopes are limited to the subject token's scopes.
    */
   scope?: string[];
   /**

package/dist/oauth-provider.js

@@ -990,13 +990,21 @@ var OAuthProviderImpl = class OAuthProviderImpl {
 			description: "Method not allowed",
 			statusCode: 405
 		});
-		let contentType = request.headers.get("Content-Type") || "";
+		const contentType = request.headers.get("Content-Type") || "";
 		let body = {};
-		if (!contentType.includes("application/x-www-form-urlencoded")) return this.createErrorResponse("invalid_request", {
+		if (contentType.split(";")[0].trim().toLowerCase() !== "application/x-www-form-urlencoded") return this.createErrorResponse("invalid_request", {
 			description: "Content-Type must be application/x-www-form-urlencoded",
 			statusCode: 400
 		});
-		const formData = await request.formData();
+		let formData;
+		try {
+			formData = await request.formData();
+		} catch {
+			return this.createErrorResponse("invalid_request", {
+				description: "Request body must be valid application/x-www-form-urlencoded data",
+				statusCode: 400
+			});
+		}
 		const processedKeys = /* @__PURE__ */ new Set();
 		for (const [key, value] of formData.entries()) {
 			if (processedKeys.has(key)) continue;
@@ -1264,6 +1272,14 @@ var OAuthProviderImpl = class OAuthProviderImpl {
 			} else calculatedChallenge = codeVerifier;
 			if (calculatedChallenge !== grantData.codeChallenge) return this.createErrorResponse("invalid_grant", { description: "Invalid PKCE code_verifier" });
 		}
+		const originOnly = !!this.options.resourceMatchOriginOnly;
+		if (body.resource && grantData.resource) {
+			const requestedResources = Array.isArray(body.resource) ? body.resource : [body.resource];
+			const grantedResources = Array.isArray(grantData.resource) ? grantData.resource : [grantData.resource];
+			for (const requested of requestedResources) if (!grantedResources.some((granted) => resourceMatches(requested, granted, originOnly))) return this.createErrorResponse("invalid_target", { description: "Requested resource was not included in the authorization request" });
+		}
+		const audience = parseResourceParameter(body.resource || grantData.resource);
+		if ((body.resource || grantData.resource) && !audience) return this.createErrorResponse("invalid_target", { description: "The resource parameter must be a valid absolute URI without a fragment" });
 		let accessTokenTTL = this.options.accessTokenTTL;
 		let refreshTokenTTL = this.options.refreshTokenTTL;
 		const encryptionKey = await unwrapKeyWithToken(code, grantData.authCodeWrappedKey);
@@ -1325,14 +1341,6 @@ var OAuthProviderImpl = class OAuthProviderImpl {
 			grantData.expiresAt = expiresAt;
 		}
 		await this.saveGrantWithTTL(env, grantKey, grantData, now);
-		const originOnly = !!this.options.resourceMatchOriginOnly;
-		if (body.resource && grantData.resource) {
-			const requestedResources = Array.isArray(body.resource) ? body.resource : [body.resource];
-			const grantedResources = Array.isArray(grantData.resource) ? grantData.resource : [grantData.resource];
-			for (const requested of requestedResources) if (!grantedResources.some((granted) => resourceMatches(requested, granted, originOnly))) return this.createErrorResponse("invalid_target", { description: "Requested resource was not included in the authorization request" });
-		}
-		const audience = parseResourceParameter(body.resource || grantData.resource);
-		if ((body.resource || grantData.resource) && !audience) return this.createErrorResponse("invalid_target", { description: "The resource parameter must be a valid absolute URI without a fragment" });
 		const tokenResponse = {
 			access_token: await this.createAccessToken({
 				userId,
@@ -1502,7 +1510,7 @@ var OAuthProviderImpl = class OAuthProviderImpl {
 	* `OAuthProviderImpl` is not exposed outside this module, this is still effectively
 	* module-private.
 	* @param subjectToken - The subject token to exchange
-	* @param requestedScopes - Optional narrowed scopes (must be subset of original)
+	* @param requestedScopes - Optional requested scopes, limited to the subject token's scopes
 	* @param requestedResource - Optional resource/audience (must be subset of original if original had resource)
 	* @param expiresIn - Optional TTL override in seconds
 	* @param clientInfo - The client making the exchange request
@@ -1516,7 +1524,7 @@ var OAuthProviderImpl = class OAuthProviderImpl {
 		const grantKey = `grant:${tokenSummary.userId}:${tokenSummary.grantId}`;
 		const grantData = await env.OAUTH_KV.get(grantKey, { type: "json" });
 		if (!grantData) throw new OAuthError("invalid_grant", { description: "Grant not found" });
-		let tokenScopes = this.downscope(requestedScopes, grantData.scope);
+		let tokenScopes = this.downscope(requestedScopes, tokenSummary.scope);
 		const originOnly = !!this.options.resourceMatchOriginOnly;
 		let newAudience = tokenSummary.audience;
 		if (requestedResource) {
@@ -1566,7 +1574,7 @@ var OAuthProviderImpl = class OAuthProviderImpl {
 					encryptedAccessTokenProps = tokenResult.encryptedData;
 					accessTokenEncryptionKey = tokenResult.key;
 				}
-				if (callbackResult.accessTokenScope) tokenScopes = this.downscope(callbackResult.accessTokenScope, grantData.scope);
+				if (callbackResult.accessTokenScope) tokenScopes = this.downscope(callbackResult.accessTokenScope, tokenSummary.scope);
 			}
 		}
 		if (accessTokenTTL < KV_MIN_EXPIRATION_TTL_SECONDS) throw new OAuthError("invalid_request", { description: "Requested token lifetime must be at least 60 seconds" });
@@ -2210,15 +2218,15 @@ var OAuthProviderImpl = class OAuthProviderImpl {
 		return accessToken;
 	}
 	/**
-	* Downscopes requested scopes to only include those that are in the grant
-	* Filters out any requested scopes that are not in the granted scopes
+	* Restricts requested scopes to the scopes available for the current flow.
+	* If no scope is requested, all available scopes are returned.
 	* @param requestedScope - The scope parameter from the request (string or array)
-	* @param grantedScopes - The scopes that were granted in the authorization
-	* @returns The filtered scopes that are a subset of the granted scopes
+	* @param allowedScopes - The maximum scopes available for the current flow
+	* @returns The requested scopes that are included in the allowed scopes
 	*/
-	downscope(requestedScope, grantedScopes) {
-		if (!requestedScope) return grantedScopes;
-		return (typeof requestedScope === "string" ? requestedScope.split(" ").filter(Boolean) : requestedScope).filter((scope) => grantedScopes.includes(scope));
+	downscope(requestedScope, allowedScopes) {
+		if (!requestedScope) return allowedScopes;
+		return (typeof requestedScope === "string" ? requestedScope.split(" ").filter(Boolean) : requestedScope).filter((scope) => allowedScopes.includes(scope));
 	}
 	/**
 	* Checks if the global_fetch_strictly_public compatibility flag is enabled.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloudflare/workers-oauth-provider",
-  "version": "0.8.2",
+  "version": "0.8.3",
   "description": "OAuth provider for Cloudflare Workers",
   "main": "dist/oauth-provider.js",
   "types": "dist/oauth-provider.d.ts",