@hfunlabs/hypurr-connect 0.1.23 → 0.1.24

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hfunlabs/hypurr-connect",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "type": "module",
   "packageManager": "pnpm@10.10.0",
   "main": "./dist/index.js",

package/src/HypurrConnectProvider.tsx

@@ -375,19 +375,63 @@ function takeTelegramAuthSession(state: string):
   return { codeVerifier, returnTo };
 }
 
-function resolveAuthTokenUrl(authHubUrl?: string, tokenUrl?: string): string {
-  const configuredTokenUrl = tokenUrl?.trim();
-  if (configuredTokenUrl) return configuredTokenUrl;
-
+function fallbackAuthTokenUrl(authHubUrl?: string): string {
   const url = new URL(authHubUrl || DEFAULT_AUTH_HUB_URL);
-  const pathWithoutTrailingSlash = url.pathname.replace(/\/+$/, "");
-  const basePath = pathWithoutTrailingSlash.replace(/\/[^/]*$/, "");
-  url.pathname = `${basePath}/token`;
+  url.pathname = "/oauth/token";
   url.search = "";
   url.hash = "";
   return url.toString();
 }
 
+function authMetadataUrls(authHubUrl?: string): string[] {
+  const authUrl = new URL(authHubUrl || DEFAULT_AUTH_HUB_URL);
+  const urls = [
+    new URL("/.well-known/oauth-authorization-server", authUrl).toString(),
+    new URL("/.well-known/openid-configuration", authUrl).toString(),
+  ];
+
+  const authPath = authUrl.pathname.replace(/\/+$/, "");
+  const basePath = authPath.replace(/\/[^/]*$/, "");
+  if (basePath) {
+    urls.push(
+      new URL(
+        `/.well-known/oauth-authorization-server${basePath}`,
+        authUrl,
+      ).toString(),
+    );
+  }
+
+  return Array.from(new Set(urls));
+}
+
+async function tokenUrlFromMetadata(
+  authHubUrl?: string,
+): Promise<string | undefined> {
+  for (const metadataUrl of authMetadataUrls(authHubUrl)) {
+    try {
+      const response = await fetch(metadataUrl, {
+        headers: { accept: "application/json" },
+      });
+      if (!response.ok) continue;
+      const metadata = (await response.json()) as { token_endpoint?: unknown };
+      const tokenEndpoint = metadata.token_endpoint;
+      if (typeof tokenEndpoint === "string" && tokenEndpoint.trim()) {
+        return tokenEndpoint.trim();
+      }
+    } catch {
+      // Metadata discovery is best effort; fall back to the conventional route.
+    }
+  }
+
+  return undefined;
+}
+
+async function resolveAuthTokenUrl(authHubUrl?: string): Promise<string> {
+  return (
+    (await tokenUrlFromMetadata(authHubUrl)) || fallbackAuthTokenUrl(authHubUrl)
+  );
+}
+
 function getTokenFromExchangeResponse(data: unknown): string | null {
   if (typeof data === "string") {
     const token = data.trim();
@@ -412,14 +456,12 @@ async function exchangeTelegramAuthCode({
   code,
   codeVerifier,
   returnTo,
-  tokenUrl,
 }: {
   authHubUrl?: string;
   clientId: string;
   code: string;
   codeVerifier: string;
   returnTo: string;
-  tokenUrl?: string;
 }): Promise<string> {
   const body = new URLSearchParams({
     client_id: clientId,
@@ -429,7 +471,7 @@ async function exchangeTelegramAuthCode({
     return_to: returnTo,
   });
 
-  const response = await fetch(resolveAuthTokenUrl(authHubUrl, tokenUrl), {
+  const response = await fetch(await resolveAuthTokenUrl(authHubUrl), {
     method: "POST",
     headers: {
       accept: "application/json",
@@ -599,7 +641,6 @@ export function HypurrConnectProvider({
           code: callback.code,
           codeVerifier: authSession.codeVerifier,
           returnTo: authSession.returnTo || currentReturnTo(),
-          tokenUrl: config.telegram?.tokenUrl,
         })
           .then(acceptTelegramToken)
           .catch((err) =>
@@ -620,7 +661,6 @@ export function HypurrConnectProvider({
       acceptTelegramToken,
       config.clientId,
       config.telegram?.authHubUrl,
-      config.telegram?.tokenUrl,
     ],
   );
 

package/src/types.ts

@@ -33,8 +33,6 @@ export interface HypurrConnectConfig {
   telegram?: {
     /** Auth hub login URL. Defaults to https://auth.hypurr.fun/login. */
     authHubUrl?: string;
-    /** Auth hub token exchange URL. Defaults to the auth hub login URL with `/login` replaced by `/token`. */
-    tokenUrl?: string;
     /** Optional callback URL. Defaults to the current page without auth query params. */
     returnTo?: string | (() => string);
     /** Requested hub scopes. Defaults to the scopes required by this SDK. */