@crossauth/sveltekit 1.1.2 → 1.1.4

package/dist/sveltekitadminendpoints.d.ts

@@ -201,7 +201,7 @@ export interface SearchUsersActionData {
  * | baseEndpoint               | This PageData is returned by all endpoints' load function. | - `user` logged in {@link @crossauth/common!User}                                | *Not provided*                                                   |                                                             |           |
  * |                            |                                                            | - `csrfToken` CSRF token if enabled                                              |                                                                  |                                                             |           |                                                                                  | loginPage                |
  * | -------------------------- | ---------------------------------------------------------- | -------------------------------------------------------------------------------- | ---------------------------------------------------------------- | ----------------------------------------------------------- | --------- |
- * | searchUsersEndpoint        | Returns a paginated set of users or those matchign search  | See return of {@link SvelteKitAdminEndpoints.searchUsers}                        | *Not provided*                                                   |                                                             |           |
+ * | searchUsersEndpoint        | Returns a paginated set of users or those matchign search  | See return of searchUsers                                                        | *Not provided*                                                   |                                                             |           |
  * | -------------------------- | ---------------------------------------------------------- | -------------------------------------------------------------------------------- | ---------------------------------------------------------------- | ----------------------------------------------------------- | --------- |
  * | updateUserEndpoint         | Update a user's details                                    | - `allowedFactor2` see {@link SvelteKitAdminEndpoints}.`signupEndpoint`          | `default`:                                                       | `default`:                                                  | `id`      |
  * |                            |                                                            | - `editUser` the {@link @crossauth/common!User} being edited                     |  - see {@link SvelteKitAdminEndpoints.updateUser} return          |  - see {@link SvelteKitAdminEndpoints.updateUser} event      |           |

package/dist/sveltekitadminendpoints.js

@@ -86,7 +86,7 @@ async function defaultUserSearchFn(searchTerm, userStorage, skip = 0, _take = 10
  * | baseEndpoint               | This PageData is returned by all endpoints' load function. | - `user` logged in {@link @crossauth/common!User}                                | *Not provided*                                                   |                                                             |           |
  * |                            |                                                            | - `csrfToken` CSRF token if enabled                                              |                                                                  |                                                             |           |                                                                                  | loginPage                |
  * | -------------------------- | ---------------------------------------------------------- | -------------------------------------------------------------------------------- | ---------------------------------------------------------------- | ----------------------------------------------------------- | --------- |
- * | searchUsersEndpoint        | Returns a paginated set of users or those matchign search  | See return of {@link SvelteKitAdminEndpoints.searchUsers}                        | *Not provided*                                                   |                                                             |           |
+ * | searchUsersEndpoint        | Returns a paginated set of users or those matchign search  | See return of searchUsers                                                        | *Not provided*                                                   |                                                             |           |
  * | -------------------------- | ---------------------------------------------------------- | -------------------------------------------------------------------------------- | ---------------------------------------------------------------- | ----------------------------------------------------------- | --------- |
  * | updateUserEndpoint         | Update a user's details                                    | - `allowedFactor2` see {@link SvelteKitAdminEndpoints}.`signupEndpoint`          | `default`:                                                       | `default`:                                                  | `id`      |
  * |                            |                                                            | - `editUser` the {@link @crossauth/common!User} being edited                     |  - see {@link SvelteKitAdminEndpoints.updateUser} return          |  - see {@link SvelteKitAdminEndpoints.updateUser} event      |           |

package/dist/sveltekitoauthclient.d.ts

@@ -62,7 +62,7 @@ export interface SvelteKitOAuthClientOptions extends OAuthClientOptions {
      */
     receiveTokenFn?: (oauthResponse: OAuthTokenResponse, client: SvelteKitOAuthClient, event: RequestEvent, silent: boolean, setUserFn: (event: RequestEvent, token: {
         [key: string]: any;
-    }) => Promise<void>) => Promise<Response | TokenReturn | undefined>;
+    }) => Promise<void>) => Promise<Response | TokenReturn>;
     /**
      * The function to call when there is an OAuth error and
      * {@link SvelteKitOAuthClientOptions.errorResponseType}
@@ -440,19 +440,19 @@ export declare class SvelteKitOAuthClient extends OAuthClientBackend {
         load: (event: RequestEvent) => Promise<AuthorizationCodeFlowReturn>;
     };
     readonly redirectUriEndpoint: {
-        get: (event: RequestEvent) => Promise<Response | TokenReturn | undefined>;
+        get: (event: RequestEvent) => Promise<Response>;
         load: (event: RequestEvent) => Promise<RedirectUriReturn>;
     };
     readonly clientCredentialsFlowEndpoint: {
         post: (event: RequestEvent) => Promise<Response>;
         actions: {
-            default: (event: RequestEvent) => Promise<{}>;
+            default: (event: RequestEvent) => Promise<Response | TokenReturn>;
         };
     };
     readonly refreshTokenFlowEndpoint: {
         post: (event: RequestEvent) => Promise<Response>;
         actions: {
-            default: (event: RequestEvent) => Promise<{}>;
+            default: (event: RequestEvent) => Promise<Response | TokenReturn>;
         };
     };
     readonly refreshTokensIfExpiredEndpoint: {
@@ -505,9 +505,9 @@ export declare class SvelteKitOAuthClient extends OAuthClientBackend {
             ok: boolean;
         }>;
         actions: {
-            password: (event: RequestEvent) => Promise<{}>;
-            passwordOtp: (event: RequestEvent) => Promise<{}>;
-            passwordOob: (event: RequestEvent) => Promise<{}>;
+            password: (event: RequestEvent) => Promise<Response | OAuthTokenResponse>;
+            passwordOtp: (event: RequestEvent) => Promise<Response | OAuthTokenResponse>;
+            passwordOob: (event: RequestEvent) => Promise<Response | OAuthTokenResponse>;
         };
     };
     readonly passwordOtpEndpoint: {
@@ -532,7 +532,7 @@ export declare class SvelteKitOAuthClient extends OAuthClientBackend {
             ok: boolean;
         }>;
         actions: {
-            default: (event: RequestEvent) => Promise<{}>;
+            default: (event: RequestEvent) => Promise<Response | OAuthTokenResponse>;
         };
     };
     readonly passwordOobEndpoint: {
@@ -557,7 +557,7 @@ export declare class SvelteKitOAuthClient extends OAuthClientBackend {
             ok: boolean;
         }>;
         actions: {
-            default: (event: RequestEvent) => Promise<{}>;
+            default: (event: RequestEvent) => Promise<Response | OAuthTokenResponse>;
         };
     };
     readonly deleteTokensEndpoint: {

package/dist/sveltekitoauthclient.js

@@ -7,6 +7,7 @@ import { SvelteKitServer } from './sveltekitserver';
 import { json } from '@sveltejs/kit';
 import { JsonOrFormData } from './utils';
 import {} from './tests/sveltemocks';
+import {} from './sveltekitoauthserver';
 ////////////////////////////////////////////////////////////////////////////
 // DEFAULT FUNCTIONS
 async function jsonError(_server, _event, ce) {
@@ -125,8 +126,31 @@ async function saveInSessionAndRedirect(oauthResponse, client, event, silent, se
             if (payload)
                 await setUserFn(event, payload);
         }
+        let url = client.authorizedUrl;
+        var data = new JsonOrFormData();
+        await data.loadData(event);
+        let formData = data.toObject();
+        let msg = formData.msg ?? event.url.searchParams.get("msg");
+        let error = formData.error ?? event.url.searchParams.get("error");
+        if (msg) {
+            if (url.includes("?")) {
+                url += "&msg=" + encodeURIComponent(msg);
+            }
+            else {
+                url += "?msg=" + encodeURIComponent(msg);
+            }
+        }
+        if (error) {
+            if (url.includes("?")) {
+                url += "&error=" + encodeURIComponent(error);
+            }
+            else {
+                url += "?error=" + encodeURIComponent(error);
+            }
+        }
         if (!silent)
-            return client.redirect(302, client.authorizedUrl);
+            return client.redirect(302, url);
+        return json({});
     }
     catch (e) {
         if (SvelteKitServer.isSvelteKitError(e) || SvelteKitServer.isSvelteKitRedirect(e))
@@ -151,8 +175,6 @@ async function saveInSessionAndReturn(oauthResponse, client, event, silent, setU
                 await setUserFn(event, payload);
         }
         return json({ ok: true, ...oauthResponse });
-        if (!silent)
-            return client.redirect(302, client.authorizedUrl);
     }
     catch (e) {
         if (SvelteKitServer.isSvelteKitError(e) || SvelteKitServer.isSvelteKitRedirect(e))
@@ -540,40 +562,49 @@ export class SvelteKitOAuthClient extends OAuthClientBackend {
         if (this, this.loginProtectedFlows.length > 0 && this.loginUrl == "") {
             throw new CrossauthError(ErrorCode.Configuration, "loginUrl must be set if protecting oauth endpoints");
         }
+        // this doesn't work as it relies on data stored in the session, which cannot be done
+        // as tokens are fetched from a backend POST, thus no cookies
         this.hook = async ({ event }) => {
-            CrossauthLogger.logger.debug(j({ msg: "OAuth hook, user " + event.locals.user }));
-            if (event.locals.user)
-                return undefined;
-            if (!server.sessionAdapter)
-                return undefined;
-            let sessionData = await server.sessionAdapter.getSessionData(event, this.sessionDataName);
-            let validIdToken = false;
-            //CrossauthLogger.logger.debug(j({msg:"Session data " + (sessionData && sessionData["id_payload"]) ? JSON.stringify(sessionData?.id_payload) : "none)"}));
-            if (sessionData && sessionData["id_payload"]) {
-                let expiry = sessionData["expires_at"];
-                if (expiry && expiry > Date.now() && sessionData["id_payload"].sub) {
-                    CrossauthLogger.logger.debug(j({ msg: "ID token is valid" }));
-                    await this.setEventLocalsUser(event, sessionData["id_payload"]);
-                    if (event.locals.user)
-                        validIdToken = true;
-                }
-            }
-            if (!validIdToken && sessionData && sessionData["refresh_token"]) {
-                CrossauthLogger.logger.debug(j({ msg: "No ID token found but refresh token found - attemping refresh flow" }));
-                const resp = await this.refreshTokens(event, "silent", false);
-                if (!resp?.ok) {
-                    const error = resp instanceof Response || resp == undefined ? "server_error" : (resp.error ?? "server_error");
-                    const error_description = resp instanceof Response || resp == undefined ? "Unknown error" : (resp.error_description ?? "Unknown error");
-                    const ce = CrossauthError.fromOAuthError(error, error_description);
-                    CrossauthLogger.logger.debug(j({ err: ce }));
-                    CrossauthLogger.logger.warn(j({ msg: "Error refreshing token", cerr: ce }));
+            CrossauthLogger.logger.debug(j({ msg: "OAuth hook, user " + event.locals.user?.username }));
+            try {
+                if (event.locals.user)
+                    return undefined;
+                if (!server.sessionAdapter)
+                    return undefined;
+                let sessionData = await server.sessionAdapter.getSessionData(event, this.sessionDataName);
+                let validIdToken = false;
+                //CrossauthLogger.logger.debug(j({msg:"Session data " + (sessionData && sessionData["id_payload"]) ? JSON.stringify(sessionData?.id_payload) : "none)"}));
+                if (sessionData && sessionData["id_payload"]) {
+                    let expiry = sessionData["expires_at"];
+                    if (expiry && expiry > Date.now() && sessionData["id_payload"].sub) {
+                        CrossauthLogger.logger.debug(j({ msg: "ID token is valid" }));
+                        await this.setEventLocalsUser(event, sessionData["id_payload"]);
+                        if (event.locals.user)
+                            validIdToken = true;
+                    }
                 }
-                else {
-                    await this.setEventLocalsUser(event, sessionData["id_payload"]);
+                if (!validIdToken && sessionData && sessionData["refresh_token"]) {
+                    CrossauthLogger.logger.debug(j({ msg: "No ID token found but refresh token found - attemping refresh flow" }));
+                    const resp = await this.refreshTokens(event, "silent", false);
+                    if (!resp?.ok) {
+                        const error = resp instanceof Response || resp == undefined ? "server_error" : (resp.error ?? "server_error");
+                        const error_description = resp instanceof Response || resp == undefined ? "Unknown error" : (resp.error_description ?? "Unknown error");
+                        const ce = CrossauthError.fromOAuthError(error, error_description);
+                        CrossauthLogger.logger.debug(j({ err: ce }));
+                        CrossauthLogger.logger.warn(j({ msg: "Error refreshing token", cerr: ce }));
+                    }
+                    else {
+                        await this.setEventLocalsUser(event, sessionData["id_payload"]);
+                    }
                 }
+                if (this.testMiddleware)
+                    this.testEvent = event;
+            }
+            catch (e) {
+                let ce = CrossauthError.asCrossauthError(e);
+                CrossauthLogger.logger.debug(j({ err: ce }));
+                CrossauthLogger.logger.error(j({ msg: "Error in oauth client hook", cerr: ce }));
             }
-            if (this.testMiddleware)
-                this.testEvent = event;
             return undefined;
         };
     }
@@ -1030,7 +1061,7 @@ export class SvelteKitOAuthClient extends OAuthClientBackend {
         try {
             if (!this.server.sessionAdapter)
                 throw new CrossauthError(ErrorCode.Configuration, "Session server must be instantiated to use bff()");
-            if (!this.server.oAuthClient)
+            if (!this.server.oAuthClient && !this.server.oAuthClients)
                 throw new CrossauthError(ErrorCode.Configuration, "OAuth Client not found"); // pathological but prevents TS errors
             if (!this.bffBaseUrl)
                 throw new CrossauthError(ErrorCode.Configuration, "Must set bffBaseUrl to use bff()");
@@ -1168,7 +1199,7 @@ export class SvelteKitOAuthClient extends OAuthClientBackend {
             CrossauthLogger.logger.debug(j({ msg: "Called allBff", url: event.url.toString() }));
             if (!this.server.sessionAdapter)
                 throw new CrossauthError(ErrorCode.Configuration, "Session server must be instantiated to use bff()");
-            if (!this.server.oAuthClient)
+            if (!this.server.oAuthClient && !this.server.oAuthClients)
                 throw new CrossauthError(ErrorCode.Configuration, "OAuth Client not found"); // pathological but prevents TS errors
             if (!this.bffBaseUrl)
                 throw new CrossauthError(ErrorCode.Configuration, "Must set bffBaseUrl to use bff()");
@@ -1238,7 +1269,7 @@ export class SvelteKitOAuthClient extends OAuthClientBackend {
             const decode = data.getAsBoolean("decode") ?? true;
             if (!this.server.sessionAdapter)
                 throw new CrossauthError(ErrorCode.Configuration, "Session server must be instantiated to use bff()");
-            if (!this.server.oAuthClient)
+            if (!this.server.oAuthClient && !this.server.oAuthClients)
                 throw new CrossauthError(ErrorCode.Configuration, "OAuth Client not found"); // pathological but prevents TS errors
             if (!this.tokenEndpoints || this.tokenEndpoints.length == 0)
                 throw new CrossauthError(ErrorCode.Unauthorized, "No tokens have been made available");
@@ -1304,7 +1335,7 @@ export class SvelteKitOAuthClient extends OAuthClientBackend {
         const resp = await this.tokens(event, token);
         if (resp.body)
             return json(resp.body, { status: resp.status });
-        return json(null, { status: resp.status });
+        return json({ error: "null body" }, { status: resp.status });
     }
     async startDeviceCodeFlow_internal(event) {
         let formData = undefined;
@@ -1469,8 +1500,10 @@ export class SvelteKitOAuthClient extends OAuthClientBackend {
         get: async (event) => {
             if (this.tokenResponseType == "saveInSessionAndLoad" || this.tokenResponseType == "sendInPage") {
                 const ce = new CrossauthError(ErrorCode.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use load not get");
-                return this.errorFn(this.server, event, ce);
+                CrossauthLogger.logger.debug(j({ err: ce }));
+                return await this.errorFn(this.server, event, ce);
             }
+            let redirectUrl = undefined;
             try {
                 if (!(this.validFlows.includes(OAuthFlows.AuthorizationCode))) {
                     const ce = new CrossauthError(ErrorCode.Unauthorized, "Authorization flow is not supported");
@@ -1480,13 +1513,22 @@ export class SvelteKitOAuthClient extends OAuthClientBackend {
                     throw new CrossauthError(ErrorCode.Configuration, "Need session server or adapter for authorization code flow");
                 }
                 let scope = event.url.searchParams.get("scope") ?? undefined;
+                let upstream = event.url.searchParams.get("upstream") ?? undefined;
+                let next = event.url.searchParams.get("next") ?? undefined;
                 if (scope == "")
                     scope = undefined;
                 const state = this.randomValue(this.stateLength);
                 const sessionData = { scope, state };
                 // we need a session to save the state
                 await this.storeSessionData(event, sessionData);
-                const { url, error, error_description } = await this.startAuthorizationCodeFlow(state, scope);
+                // if we have an upstream client, this call will save the original /authorize call and redirect to
+                // the upstream auth server's /authorize endpoint
+                if ((upstream || this.server.oAuthAuthServer?.authServer.upstreamClient) && next && this.server.oAuthAuthServer) {
+                    await this.server.oAuthAuthServer.saveDownstreamAuthzCodeFlow(event, new URL(next, event.url), upstream);
+                }
+                // the following call returns a constructed url for the
+                // auth server's /authorize endpoint
+                const { url, error, error_description } = await this.startAuthorizationCodeFlow(state, { scope, upstream });
                 if (error || !url) {
                     const ce = CrossauthError.fromOAuthError(error ?? "server_error", error_description);
                     return await this.errorFn(this.server, event, ce);
@@ -1499,7 +1541,7 @@ export class SvelteKitOAuthClient extends OAuthClientBackend {
                         msg: `OAuth redirect`,
                     }));
                 }
-                throw this.redirect(302, url);
+                redirectUrl = url;
             }
             catch (e) {
                 if (SvelteKitServer.isSvelteKitRedirect(e))
@@ -1510,8 +1552,12 @@ export class SvelteKitOAuthClient extends OAuthClientBackend {
                 CrossauthLogger.logger.debug({ err: e });
                 CrossauthLogger.logger.error({ cerr: e });
                 //throw this.error(ce.httpStatus, ce.message);
-                return this.errorFn(this.server, event, ce);
+                return jsonError(this.server, event, ce);
+                //return await this.errorFn(this.server, event, ce);
             }
+            if (!redirectUrl)
+                jsonError(this.server, event, new CrossauthError(ErrorCode.UnknownError, "Unexpectedly got redirect URL"));
+            throw this.redirect(302, redirectUrl); // to auth server's authorize endpoint
         },
         load: async (event) => {
             if ( /*this.tokenResponseType == "saveInSessionAndRedirect" ||*/this.tokenResponseType == "sendJson" || this.tokenResponseType == "saveInSessionAndLoad") {
@@ -1537,11 +1583,20 @@ export class SvelteKitOAuthClient extends OAuthClientBackend {
                 let scope = event.url.searchParams.get("scope") ?? undefined;
                 if (scope == "")
                     scope = undefined;
+                let upstream = event.url.searchParams.get("upstream") ?? undefined;
+                let next = event.url.searchParams.get("next") ?? undefined;
                 const state = this.randomValue(this.stateLength);
                 const sessionData = { scope, state };
                 // we need a session to save the state
                 await this.storeSessionData(event, sessionData);
-                const { url, error, error_description } = await this.startAuthorizationCodeFlow(state, scope);
+                // if we have an upstream client, this call will save the original /authorize call and redirect to
+                // the upstream auth server's /authorize endpoint
+                if ((upstream || this.server.oAuthAuthServer?.authServer.upstreamClient) && next && this.server.oAuthAuthServer) {
+                    await this.server.oAuthAuthServer.saveDownstreamAuthzCodeFlow(event, new URL(next), upstream);
+                }
+                // the following call returns a constructed url for the
+                // auth server's /authorize endpoint
+                const { url, error, error_description } = await this.startAuthorizationCodeFlow(state, { scope, upstream });
                 if (error || !url) {
                     const ce = CrossauthError.fromOAuthError(error ?? "server_error", error_description);
                     return {
@@ -1558,7 +1613,7 @@ export class SvelteKitOAuthClient extends OAuthClientBackend {
                         msg: `OAuth redirect`,
                     }));
                 }
-                throw this.redirect(302, url);
+                throw this.redirect(302, url); // to auth server's authorize endpoint
             }
             catch (e) {
                 if (SvelteKitServer.isSvelteKitRedirect(e))
@@ -1594,12 +1649,21 @@ export class SvelteKitOAuthClient extends OAuthClientBackend {
                 let scope = event.url.searchParams.get("scope") ?? undefined;
                 if (scope == "")
                     scope = undefined;
+                let upstream = event.url.searchParams.get("upstream") ?? undefined;
+                let next = event.url.searchParams.get("next") ?? undefined;
                 const state = this.randomValue(this.stateLength);
                 const { codeChallenge, codeVerifier } = await this.codeChallengeAndVerifier();
                 const sessionData = { scope, state, codeChallenge, codeVerifier };
                 // we need a session to save the state
                 await this.storeSessionData(event, sessionData);
-                const { url, error, error_description } = await this.startAuthorizationCodeFlow(state, scope, codeChallenge, true);
+                // if we have an upstream client, this call will save the original /authorize call and redirect to
+                // the upstream auth server's /authorize endpoint
+                if ((upstream || this.server.oAuthAuthServer?.authServer.upstreamClient) && next && this.server.oAuthAuthServer) {
+                    await this.server.oAuthAuthServer.saveDownstreamAuthzCodeFlow(event, new URL(next), upstream);
+                }
+                // the following call returns a constructed url for the
+                // auth server's /authorize endpoint
+                const { url, error, error_description } = await this.startAuthorizationCodeFlow(state, { scope, codeChallenge, pkce: true, upstream });
                 if (error || !url) {
                     const ce = CrossauthError.fromOAuthError(error ?? "server_error", error_description);
                     return await this.errorFn(this.server, event, ce);
@@ -1612,7 +1676,7 @@ export class SvelteKitOAuthClient extends OAuthClientBackend {
                         msg: `OAuth redirect`,
                     }));
                 }
-                throw this.redirect(302, url);
+                throw this.redirect(302, url); // to auth server's authorize endpoint
             }
             catch (e) {
                 if (SvelteKitServer.isSvelteKitRedirect(e))
@@ -1653,12 +1717,21 @@ export class SvelteKitOAuthClient extends OAuthClientBackend {
                 let scope = event.url.searchParams.get("scope") ?? undefined;
                 if (scope == "")
                     scope = undefined;
+                let upstream = event.url.searchParams.get("upstream") ?? undefined;
+                let next = event.url.searchParams.get("next") ?? undefined;
                 const state = this.randomValue(this.stateLength);
                 const { codeChallenge, codeVerifier } = await this.codeChallengeAndVerifier();
                 const sessionData = { scope, state, codeChallenge, codeVerifier };
                 // we need a session to save the state
                 await this.storeSessionData(event, sessionData);
-                const { url, error, error_description } = await this.startAuthorizationCodeFlow(state, scope, codeChallenge, true);
+                // if we have an upstream client, this call will save the original /authorize call and redirect to
+                // the upstream auth server's /authorize endpoint
+                if ((upstream || this.server.oAuthAuthServer?.authServer.upstreamClient) && next && this.server.oAuthAuthServer) {
+                    await this.server.oAuthAuthServer.saveDownstreamAuthzCodeFlow(event, new URL(next), upstream);
+                }
+                // the following call returns a constructed url for the
+                // auth server's /authorize endpoint
+                const { url, error, error_description } = await this.startAuthorizationCodeFlow(state, { scope, codeChallenge, pkce: true, upstream });
                 if (error || !url) {
                     const ce = CrossauthError.fromOAuthError(error ?? "server_error", error_description);
                     return {
@@ -1675,7 +1748,7 @@ export class SvelteKitOAuthClient extends OAuthClientBackend {
                         msg: `OAuth redirect`,
                     }));
                 }
-                throw this.redirect(302, url);
+                throw this.redirect(302, url); // to auth server's authorize endpoint
             }
             catch (e) {
                 if (SvelteKitServer.isSvelteKitRedirect(e))
@@ -1700,42 +1773,39 @@ export class SvelteKitOAuthClient extends OAuthClientBackend {
                 const ce = new CrossauthError(ErrorCode.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use load not get");
                 return this.errorFn(this.server, event, ce);
             }
-            try {
-                if (!(this.validFlows.includes(OAuthFlows.AuthorizationCode) ||
-                    this.validFlows.includes(OAuthFlows.AuthorizationCodeWithPKCE) ||
-                    this.validFlows.includes(OAuthFlows.OidcAuthorizationCode))) {
-                    const ce = new CrossauthError(ErrorCode.Unauthorized, "Authorization flows are not supported");
-                    return this.errorFn(this.server, event, ce);
-                }
-                CrossauthLogger.logger.debug(j({ msg: "redirectUriEndpoint, token response type " + this.tokenResponseType }));
-                const code = event.url.searchParams.get("code") ?? "";
-                const state = event.url.searchParams.get("state") ?? undefined;
-                const error = event.url.searchParams.get("error") ?? undefined;
-                const error_description = event.url.searchParams.get("error") ?? undefined;
-                const oauthData = await this.server.sessionAdapter?.getSessionData(event, this.sessionDataName);
-                if (oauthData?.state != state) {
-                    throw new CrossauthError(ErrorCode.Unauthorized, "State does not match");
-                }
-                const resp = this.errorIfIdTokenInvalid(await this.redirectEndpoint(code, oauthData?.scope, oauthData?.codeVerifier, error, error_description));
-                if (resp.error)
-                    return this.errorFn(this.server, event, CrossauthError.fromOAuthError(resp.error, resp.error_description));
-                if (resp.error) {
-                    const ce = CrossauthError.fromOAuthError(resp.error, resp.error_description);
-                    return await this.errorFn(this.server, event, ce);
-                }
-                return await this.receiveTokenFn(resp, this, event, false, this.setEventLocalsUser);
-            }
-            catch (e) {
-                if (SvelteKitServer.isSvelteKitRedirect(e))
-                    throw e;
-                if (SvelteKitServer.isSvelteKitError(e))
-                    throw e;
-                const ce = CrossauthError.asCrossauthError(e);
-                CrossauthLogger.logger.debug({ err: e });
-                CrossauthLogger.logger.error({ cerr: e });
-                //throw this.error(ce.httpStatus, ce.message);
+            if (!(this.validFlows.includes(OAuthFlows.AuthorizationCode) ||
+                this.validFlows.includes(OAuthFlows.AuthorizationCodeWithPKCE) ||
+                this.validFlows.includes(OAuthFlows.OidcAuthorizationCode))) {
+                const ce = new CrossauthError(ErrorCode.Unauthorized, "Authorization flows are not supported");
                 return this.errorFn(this.server, event, ce);
             }
+            CrossauthLogger.logger.debug(j({ msg: "redirectUriEndpoint, token response type " + this.tokenResponseType }));
+            const code = event.url.searchParams.get("code") ?? "";
+            const state = event.url.searchParams.get("state") ?? undefined;
+            const error = event.url.searchParams.get("error") ?? undefined;
+            const error_description = event.url.searchParams.get("error") ?? undefined;
+            const oauthData = await this.server.sessionAdapter?.getSessionData(event, this.sessionDataName);
+            if (oauthData?.state != state) {
+                return json({
+                    error: "access_denied",
+                    error_description: "state does not match"
+                }, { status: 403 });
+            }
+            // call the auth server's token endpoint to exchange the code for new tokens
+            const resp = this.errorIfIdTokenInvalid(await this.redirectEndpoint({
+                code,
+                scope: oauthData?.scope,
+                codeVerifier: oauthData?.codeVerifier,
+                error,
+                errorDescription: error_description
+            }));
+            if (resp.error)
+                return this.errorFn(this.server, event, CrossauthError.fromOAuthError(resp.error, resp.error_description));
+            if (resp.error) {
+                const ce = CrossauthError.fromOAuthError(resp.error, resp.error_description);
+                return await this.errorFn(this.server, event, ce);
+            }
+            return await this.receiveTokenFn(resp, this, event, false, this.setEventLocalsUser);
         },
         load: async (event) => {
             if ( /*this.tokenResponseType == "saveInSessionAndRedirect" ||*/this.tokenResponseType == "sendJson" || this.tokenResponseType == "saveInSessionAndLoad") {
@@ -1765,7 +1835,13 @@ export class SvelteKitOAuthClient extends OAuthClientBackend {
                 if (oauthData?.state != state) {
                     throw new CrossauthError(ErrorCode.Unauthorized, "State does not match");
                 }
-                const resp = this.errorIfIdTokenInvalid(await this.redirectEndpoint(code, oauthData?.scope, oauthData?.codeVerifier, error, error_description));
+                const resp = this.errorIfIdTokenInvalid(await this.redirectEndpoint({
+                    code,
+                    scope: oauthData?.scope,
+                    codeVerifier: oauthData?.codeVerifier,
+                    error,
+                    errorDescription: error_description
+                }));
                 if (resp.error)
                     return {
                         ok: false,
@@ -1919,6 +1995,7 @@ export class SvelteKitOAuthClient extends OAuthClientBackend {
                 const ce = new CrossauthError(ErrorCode.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use actions not post");
                 return this.errorFn(this.server, event, ce);
             }
+            CrossauthLogger.logger.debug(j({ msg: "Refresh token flow started" }));
             let formData = undefined;
             try {
                 if (!(this.validFlows.includes(OAuthFlows.RefreshToken))) {
@@ -1988,6 +2065,7 @@ export class SvelteKitOAuthClient extends OAuthClientBackend {
                     const ce = new CrossauthError(ErrorCode.Configuration, "If tokenResponseType is " + this.tokenResponseType + ", use post not load");
                     throw ce;
                 }
+                CrossauthLogger.logger.debug(j({ msg: "Refresh token flow started" }));
                 let formData = undefined;
                 try {
                     if (!(this.validFlows.includes(OAuthFlows.RefreshToken))) {
@@ -2033,7 +2111,12 @@ export class SvelteKitOAuthClient extends OAuthClientBackend {
                         throw ce;
                     }
                     const resp = this.errorIfIdTokenInvalid(await this.refreshTokenFlow(refreshToken));
-                    const resp2 = await this.receiveTokenFn(resp, this, event, false, this.setEventLocalsUser) ?? {};
+                    const resp2 = await this.receiveTokenFn(resp, this, event, false, this.setEventLocalsUser);
+                    if (!resp2) {
+                        return {
+                            ok: true,
+                        };
+                    }
                     if (resp2 instanceof Response)
                         throw new CrossauthError(ErrorCode.Configuration, "Refresh token flow should return an object not Response");
                     return resp2;

package/dist/sveltekitoauthserver.d.ts

@@ -14,6 +14,7 @@ export interface AuthorizeQueryType {
     state: string;
     code_challenge?: string;
     code_challenge_method?: string;
+    next?: string;
 }
 export interface ReturnBase {
     ok: boolean;
@@ -177,6 +178,11 @@ export interface SvelteKitAuthorizationServerOptions extends OAuthAuthorizationS
     redirect?: any;
     /** Pass the Sveltekit error function */
     error?: any;
+    /**
+     * This is used when there is an upstream client to save the tokens.
+     * Default `oauth`.
+     */
+    sessionDataName?: string;
 }
 /**
  * This class implements an OAuth authorization server, serving endpoints
@@ -263,6 +269,7 @@ export declare class SvelteKitAuthorizationServer {
     private jwksEndpointUrl;
     readonly redirect: any;
     readonly error: any;
+    private sessionDataName;
     /**
      * Constructor
      * @param svelteKitServer the SvelteKit server this belongs to
@@ -297,7 +304,10 @@ export declare class SvelteKitAuthorizationServer {
     private setRefreshTokenCookie;
     private requireGetParam;
     private requireBodyParam;
-    private getAuthorizeQuery;
+    getAuthorizeQuery(url: URL): {
+        query?: AuthorizeQueryType;
+        error: ReturnBase;
+    };
     private getMfaChallengeQuery;
     private mfaAuthenticators;
     private mfaChallenge;
@@ -345,6 +355,14 @@ export declare class SvelteKitAuthorizationServer {
         [key: string]: any;
     }, sessionDataName: string): Promise<void>;
     private redirectError;
+    /**
+     * Called from the client side of an auth server with an upstream auth server
+     * @param event Sveltekit event
+     * @param url URL the originating client originally made to our auth server's /authorize endpoint
+     * @param upstream the label of the upstream client if we have seeral
+     * @returns
+     */
+    saveDownstreamAuthzCodeFlow(event: RequestEvent, url: URL, upstream?: string): Promise<ReturnBase | undefined>;
     /**
      * `load` and `actions` functions for the authorize endpoint.
      *
@@ -366,7 +384,7 @@ export declare class SvelteKitAuthorizationServer {
         post: (event: RequestEvent) => Promise<Response>;
     };
     readonly upstreamRedirectUriEndpoint: {
-        get: (event: RequestEvent) => Promise<void | Response>;
+        get: (event: RequestEvent, upstream?: string) => Promise<void | Response>;
     };
     /**
      * `get` and `post` functions for the mfa/authenticators endpoint.