@dropsh/plugin-oauth2 0.5.8 → 0.6.1

package/dist/plugins/oauth2/src/provider.js

@@ -8,7 +8,30 @@ const DISPLAY = {
 function bearer(req, token) {
     return { ...(req.headers ?? {}), Authorization: `Bearer ${token}` };
 }
-async function postToken(http, url, params, now) {
+/**
+ * Read the RFC 6749 `error` code from a token endpoint's error response. The
+ * body may already be an object (as our tests and some clients provide) or the
+ * raw JSON string the real http client carries; parse defensively and return
+ * the `error` field only when it is a string.
+ */
+function readOAuthError(body) {
+    let parsed = body;
+    if (typeof body === "string") {
+        try {
+            parsed = JSON.parse(body);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    if (parsed && typeof parsed === "object" && "error" in parsed) {
+        const code = parsed.error;
+        if (typeof code === "string")
+            return code;
+    }
+    return undefined;
+}
+async function postToken(http, url, params, now, identity) {
     try {
         const res = await http.send({
             method: "POST",
@@ -29,8 +52,22 @@ async function postToken(http, url, params, now) {
     catch (err) {
         if (err instanceof AuthError)
             throw err;
-        if (err instanceof HttpError)
-            throw new AuthError(`Token request failed: HTTP ${err.status}`, { body: err.body });
+        if (err instanceof HttpError) {
+            // Interpret RFC 6749: only claim `invalid_client` when the server said so;
+            // everything else (a bare 401/403, another code, or no code) is the
+            // generic `credentials_rejected`. Name the inputs used, never the secret.
+            const oauthError = readOAuthError(err.body);
+            const reason = oauthError === "invalid_client" ? "invalid_client" : "credentials_rejected";
+            const scopePart = identity.scope !== undefined ? `, scope "${identity.scope}"` : "";
+            throw new AuthError(`OAuth2 token request rejected for profile "${identity.profile}" ` +
+                `(client_id "${identity.client_id}"${scopePart}) at ${identity.token_endpoint}: ${reason}.`, {
+                reason,
+                profile: identity.profile,
+                client_id: identity.client_id,
+                ...(identity.scope !== undefined ? { scope: identity.scope } : {}),
+                token_endpoint: identity.token_endpoint,
+            });
+        }
         throw new AuthError(`Token request failed: ${err.message}`);
     }
 }
@@ -38,6 +75,33 @@ export function oauth2Provider(cfg) {
     // Profile identity is `cfg.id` (falling back to `cfg.type`); `cfg.type` stays
     // purely the grant-flow selector used by login/renew/status below.
     const id = cfg.id ?? cfg.type;
+    // The non-secret identity every token request carries, so a rejection can name
+    // the inputs it used without ever echoing the client secret.
+    const identity = {
+        profile: id,
+        client_id: cfg.client_id,
+        ...(cfg.scope !== undefined ? { scope: cfg.scope } : {}),
+        token_endpoint: cfg.token_url,
+    };
+    // A non-authcode grant needs a configured client_secret. An unset OR empty
+    // secret is a config error — not an expired session and not a prompt — so it
+    // fails BEFORE any token request (no empty secret is ever posted).
+    function requireClientSecret() {
+        const secret = cfg.type === "oauth2_client_credentials" || cfg.type === "oauth2_password"
+            ? cfg.client_secret
+            : undefined;
+        if (typeof secret !== "string" || secret.length === 0) {
+            throw new AuthError(`OAuth2 profile "${id}" has no client_secret configured; ` +
+                `set plugins[].with.client_secret for this profile.`, {
+                reason: "secret_not_configured",
+                profile: id,
+                client_id: cfg.client_id,
+                ...(cfg.scope !== undefined ? { scope: cfg.scope } : {}),
+                token_endpoint: cfg.token_url,
+            });
+        }
+        return secret;
+    }
     return {
         id,
         displayName: cfg.id ? `${DISPLAY[cfg.type]} [${cfg.id}]` : DISPLAY[cfg.type],
@@ -57,10 +121,13 @@ export function oauth2Provider(cfg) {
                     now: ctx.now,
                 });
             }
-            const params = new URLSearchParams({ client_id: cfg.client_id });
-            const secret = cfg.client_secret ?? (await ctx.prompt({ label: "Client secret", secret: true }));
-            params.set("client_secret", secret);
+            // The client_secret is config, not a runtime credential: require it up
+            // front (throws before any token request if unset/empty) rather than
+            // prompting for it or posting an empty secret.
+            const secret = requireClientSecret();
+            const params = new URLSearchParams({ client_id: cfg.client_id, client_secret: secret });
             if (cfg.type === "oauth2_password") {
+                // The user's password *is* a runtime credential, so it is still prompted.
                 const password = await ctx.prompt({ label: "Password", secret: true });
                 params.set("grant_type", "password");
                 params.set("username", cfg.username);
@@ -71,7 +138,7 @@ export function oauth2Provider(cfg) {
             }
             if (cfg.scope)
                 params.set("scope", cfg.scope);
-            return postToken(ctx.http, cfg.token_url, params, ctx.now);
+            return postToken(ctx.http, cfg.token_url, params, ctx.now, identity);
         },
         async logout() {
             // simple_oauth has no standard revoke endpoint wired; core clears the session.
@@ -101,7 +168,7 @@ export function oauth2Provider(cfg) {
                     refresh_token: refreshToken,
                     client_id: cfg.client_id,
                 });
-                const refreshed = await postToken(rt.http, cfg.token_url, params, rt.now);
+                const refreshed = await postToken(rt.http, cfg.token_url, params, rt.now, identity);
                 if (typeof refreshed.refresh_token !== "string")
                     refreshed.refresh_token = refreshToken;
                 current = refreshed;
@@ -118,7 +185,7 @@ export function oauth2Provider(cfg) {
                 });
                 if (cfg.scope)
                     params.set("scope", cfg.scope);
-                const minted = await postToken(rt.http, cfg.token_url, params, rt.now);
+                const minted = await postToken(rt.http, cfg.token_url, params, rt.now, identity);
                 current = minted;
                 await rt.save(minted);
             }
@@ -130,10 +197,14 @@ export function oauth2Provider(cfg) {
                     await refreshAuthcode(refresh);
                     return;
                 }
-                if (cfg.type === "oauth2_client_credentials" && cfg.client_secret) {
-                    await mintClientCredentials(cfg.client_secret);
+                if (cfg.type === "oauth2_client_credentials") {
+                    // A missing/empty secret here is a config error (surfaced by the
+                    // guard), not a genuinely expired session.
+                    await mintClientCredentials(requireClientSecret());
                     return;
                 }
+                // password grant: no silent re-mint is possible (it needs the user's
+                // password), so a genuinely expired session must be re-established by login.
                 throw new AuthError("Session expired. Run 'dropsh auth login'.");
             }
             // Coalesce concurrent renewals so we hit the token endpoint once.
@@ -154,14 +225,15 @@ export function oauth2Provider(cfg) {
                     return { ...req, headers: bearer(req, current.access_token) };
                 },
                 // Reactive path: the server rejected the token (401). Try once to re-mint /
-                // refresh from the credentials we have; report whether the caller may retry.
+                // refresh from the credentials we have; report whether the caller may retry
+                // and, on failure, carry the cause so the caller can surface *why*.
                 async renew() {
                     try {
                         await coalescedRenew();
-                        return true;
+                        return { ok: true };
                     }
-                    catch {
-                        return false;
+                    catch (cause) {
+                        return { ok: false, cause };
                     }
                 },
             };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dropsh/plugin-oauth2",
-  "version": "0.5.8",
+  "version": "0.6.1",
   "type": "module",
   "main": "./dist/plugins/oauth2/src/index.js",
   "types": "./dist/plugins/oauth2/src/index.d.ts",
@@ -23,7 +23,7 @@
   "devDependencies": {
     "typescript": "^5.6.0",
     "vitest": "^4.1.8",
-    "dropsh": "0.5.8"
+    "dropsh": "0.6.1"
   },
   "scripts": {
     "build": "tsc",