@hxa-rn/rnaa 8.1.0

package/harmony/rnaa/src/main/ets/RNAppAuthTurboModule.ets

@@ -0,0 +1,713 @@
+/**
+ * RNAppAuth TurboModule (HarmonyOS / RN for OpenHarmony).
+ *
+ * Self-contained OAuth 2.0 / OpenID Connect bridge replacing the Android
+ * AppAuth-based RNAppAuthModule. Implements the 5 public methods
+ * (prefetchConfiguration / register / authorize / refresh / logout) plus the
+ * internal handleRedirect that completes a pending authorize/logout flow after
+ * the system browser redirects back through the RNOH 'url' device event.
+ *
+ * Protocol stack is split into OAuthProtocol.ets (URLs/parsing),
+ * OAuthHttpClient.ets (@ohos.net.http), PKCE.ets (cryptoFramework + Base64URL)
+ * and DateUtil.ets.
+ */
+import { UITurboModule, UITurboModuleContext } from '@rnoh/react-native-openharmony/ts';
+import { TM } from './generated/ts';
+import hilog from '@ohos.hilog';
+import { common, Want } from '@kit.AbilityKit';
+import { util } from '@kit.ArkTS';
+import { OAuthHttpClient } from './OAuthHttpClient';
+import { OAuthProtocol, AuthorizationUrlParams, EndSessionUrlParams } from './OAuthProtocol';
+import { PKCE } from './PKCE';
+import { DateUtil } from './DateUtil';
+import { Deferred, OAuthError, AuthorizationResponse } from './Types';
+
+const DOMAIN: number = 0x0000;
+const TAG: string = 'RNAppAuth';
+const DEFAULT_TIMEOUT_MILLIS: number = 15000;
+
+export class RNAppAuthTurboModule extends UITurboModule implements TM.RNAppAuth.Spec {
+  private httpClient: OAuthHttpClient = new OAuthHttpClient();
+
+  private serviceConfigCache: Map<string, TM.RNAppAuth.ServiceConfiguration> = new Map();
+
+  // Pending authorize state (bridged to handleRedirect).
+  private pendingAuthorize: Deferred<Object> | null = null;
+  // Pending logout state (bridged to handleRedirect).
+  private pendingLogout: Deferred<Object> | null = null;
+  private pendingFlowState: string = '';
+  private pendingCodeVerifier: string = '';
+  private pendingSkipCodeExchange: boolean = false;
+  private pendingUsePKCE: boolean = false;
+  private pendingClientSecret: string = '';
+  private pendingClientAuthMethod: string = 'basic';
+  private pendingAdditionalParameters: Record<string, string> = {};
+  private pendingRedirectUrl: string = '';
+  private pendingClientId: string = '';
+  private pendingScopes: string[] = [];
+  private pendingTimeoutMillis: number = DEFAULT_TIMEOUT_MILLIS;
+  private pendingTokenHeaders: Record<string, string> = {};
+  private pendingAuthorizationHeaders: Record<string, string> = {};
+  private pendingRegistrationHeaders: Record<string, string> = {};
+  private pendingServiceConfiguration: TM.RNAppAuth.ServiceConfiguration | null = null;
+  private pendingIssuer: string = '';
+  private pendingPostLogoutRedirectUri: string = '';
+  private pendingIdTokenHint: string = '';
+
+  constructor(ctx: UITurboModuleContext) {
+    super(ctx);
+  }
+
+  prefetchConfiguration(warmAndPrefetchChrome: boolean, issuer: string, redirectUrl: string,
+    clientId: string, scopes: string[], serviceConfiguration: TM.RNAppAuth.ServiceConfiguration,
+    dangerouslyAllowInsecureHttpRequests: boolean, customHeaders: TM.RNAppAuth.CustomHeaders,
+    connectionTimeoutMillis: number): Promise<void> {
+    // Async wrapper so a caught error becomes a rejected Promise (no throw).
+    return this.doPrefetchConfiguration(issuer, serviceConfiguration, connectionTimeoutMillis,
+      customHeaders);
+  }
+
+  private async doPrefetchConfiguration(issuer: string,
+    serviceConfiguration: TM.RNAppAuth.ServiceConfiguration, connectionTimeoutMillis: number,
+    customHeaders: TM.RNAppAuth.CustomHeaders): Promise<void> {
+    try {
+      let timeout: number = RNAppAuthTurboModule.safeTimeout(connectionTimeoutMillis);
+      this.parseHeaderMap(customHeaders);
+      // warmAndPrefetchChrome is a no-op on Harmony (no Chrome Custom Tabs).
+      if (issuer !== null && issuer.length > 0 && this.serviceConfigCache.has(issuer)) {
+        return;
+      }
+      await this.resolveServiceConfiguration(issuer, serviceConfiguration, timeout);
+    } catch (err) {
+      throw RNAppAuthTurboModule.toOAuthError(err, 'service_configuration_fetch_error');
+    }
+  }
+
+  register(issuer: string, redirectUrls: string[], responseTypes: string[], grantTypes: string[],
+    subjectType: string, tokenEndpointAuthMethod: string, additionalParameters: Object,
+    serviceConfiguration: TM.RNAppAuth.ServiceConfiguration, connectionTimeoutMillis: number,
+    dangerouslyAllowInsecureHttpRequests: boolean,
+    customHeaders: TM.RNAppAuth.CustomHeaders): Promise<TM.RNAppAuth.RegistrationResponse> {
+    return this.doRegister(issuer, redirectUrls, responseTypes, grantTypes, subjectType,
+      tokenEndpointAuthMethod, additionalParameters, serviceConfiguration, connectionTimeoutMillis,
+      customHeaders);
+  }
+
+  private async doRegister(issuer: string, redirectUrls: string[], responseTypes: string[],
+    grantTypes: string[], subjectType: string, tokenEndpointAuthMethod: string,
+    additionalParameters: Object, serviceConfiguration: TM.RNAppAuth.ServiceConfiguration,
+    connectionTimeoutMillis: number,
+    customHeaders: TM.RNAppAuth.CustomHeaders): Promise<TM.RNAppAuth.RegistrationResponse> {
+    try {
+      let timeout: number = RNAppAuthTurboModule.safeTimeout(connectionTimeoutMillis);
+      this.parseHeaderMap(customHeaders);
+      let config: TM.RNAppAuth.ServiceConfiguration =
+        await this.resolveServiceConfiguration(issuer, serviceConfiguration, timeout);
+      let registrationEndpoint: string | undefined = config.registrationEndpoint;
+      if (!RNAppAuthTurboModule.isNonEmptyString(registrationEndpoint)) {
+        throw new OAuthError('registration_failed', 'No registration endpoint available');
+      }
+      let endpoint: string = registrationEndpoint as string;
+      let additionalParams: Record<string, string> = RNAppAuthTurboModule.toStringMap(additionalParameters);
+      let body: Record<string, Object> = OAuthProtocol.buildRegistrationBody(redirectUrls,
+        responseTypes, grantTypes, subjectType, tokenEndpointAuthMethod, additionalParams);
+      let responseBody: Record<string, Object> = await this.httpClient.postJson(endpoint,
+        body, this.pendingRegistrationHeaders, timeout);
+      if (responseBody === null || responseBody === undefined) {
+        throw new OAuthError('registration_failed', 'Empty registration response');
+      }
+      return this.buildRegistrationResultMap(responseBody);
+    } catch (err) {
+      return Promise.reject(RNAppAuthTurboModule.toOAuthError(err, 'registration_failed'));
+    }
+  }
+
+  authorize(issuer: string, redirectUrl: string, clientId: string, clientSecret: string,
+    scopes: string[], additionalParameters: Object,
+    serviceConfiguration: TM.RNAppAuth.ServiceConfiguration, skipCodeExchange: boolean,
+    connectionTimeoutMillis: number, useNonce: boolean, usePKCE: boolean,
+    clientAuthMethod: string, dangerouslyAllowInsecureHttpRequests: boolean,
+    customHeaders: TM.RNAppAuth.CustomHeaders): Promise<TM.RNAppAuth.AuthorizeResult> {
+    return this.doAuthorize(issuer, redirectUrl, clientId, clientSecret, scopes,
+      additionalParameters, serviceConfiguration, skipCodeExchange, connectionTimeoutMillis,
+      useNonce, usePKCE, clientAuthMethod, customHeaders);
+  }
+
+  private async doAuthorize(issuer: string, redirectUrl: string, clientId: string,
+    clientSecret: string, scopes: string[], additionalParameters: Object,
+    serviceConfiguration: TM.RNAppAuth.ServiceConfiguration, skipCodeExchange: boolean,
+    connectionTimeoutMillis: number, useNonce: boolean, usePKCE: boolean,
+    clientAuthMethod: string, customHeaders: TM.RNAppAuth.CustomHeaders): Promise<TM.RNAppAuth.AuthorizeResult> {
+    try {
+      let timeout: number = RNAppAuthTurboModule.safeTimeout(connectionTimeoutMillis);
+      this.parseHeaderMap(customHeaders);
+      let config: TM.RNAppAuth.ServiceConfiguration =
+        await this.resolveServiceConfiguration(issuer, serviceConfiguration, timeout);
+      let authorizationEndpoint: string | undefined = config.authorizationEndpoint;
+      if (authorizationEndpoint === undefined || authorizationEndpoint.length === 0) {
+        throw new OAuthError('authentication_failed', 'No authorization endpoint available');
+      }
+
+      let rawParams: Record<string, string> = RNAppAuthTurboModule.toStringMap(additionalParameters);
+      let state: string = '';
+      let nonce: string = '';
+      let additionalParams: Record<string, string> = {};
+      let rawKeys: string[] = Object.keys(rawParams);
+      for (let key of rawKeys) {
+        if (key === 'state') {
+          state = rawParams[key];
+        } else if (key === 'nonce') {
+          nonce = rawParams[key];
+        } else {
+          additionalParams[key] = rawParams[key];
+        }
+      }
+      if (state.length === 0) {
+        state = PKCE.generateState();
+      }
+      if (nonce.length === 0 && useNonce) {
+        nonce = PKCE.generateNonce();
+      }
+
+      let codeVerifier: string = '';
+      let codeChallenge: string = '';
+      if (usePKCE) {
+        codeVerifier = PKCE.generateCodeVerifier();
+        codeChallenge = await PKCE.deriveCodeChallenge(codeVerifier);
+      }
+
+      let urlParams: AuthorizationUrlParams = {
+        authorizationEndpoint: authorizationEndpoint,
+        clientId: clientId,
+        redirectUrl: redirectUrl,
+        scopes: scopes,
+        state: state,
+        nonce: nonce,
+        codeChallenge: codeChallenge,
+        additionalParameters: additionalParams,
+      };
+      let authUrl: string = OAuthProtocol.buildAuthorizationUrl(urlParams);
+
+      // Store pending state before opening the browser.
+      this.pendingFlowState = state;
+      this.pendingCodeVerifier = codeVerifier;
+      this.pendingSkipCodeExchange = skipCodeExchange;
+      this.pendingUsePKCE = usePKCE;
+      this.pendingClientSecret = clientSecret === null ? '' : clientSecret;
+      this.pendingClientAuthMethod = clientAuthMethod === null ? 'basic' : clientAuthMethod;
+      this.pendingAdditionalParameters = additionalParams;
+      this.pendingRedirectUrl = redirectUrl;
+      this.pendingClientId = clientId;
+      this.pendingScopes = scopes;
+      this.pendingTimeoutMillis = timeout;
+      this.pendingServiceConfiguration = config;
+      this.pendingIssuer = issuer === null ? '' : issuer;
+
+      let deferred: Deferred<Object> = new Deferred<Object>();
+      this.pendingAuthorize = deferred;
+
+      await this.openBrowser(authUrl);
+      return deferred.promise as Promise<TM.RNAppAuth.AuthorizeResult>;
+    } catch (err) {
+      return Promise.reject(RNAppAuthTurboModule.toOAuthError(err, 'authentication_failed'));
+    }
+  }
+
+  refresh(issuer: string, redirectUrl: string, clientId: string, clientSecret: string,
+    refreshToken: string, scopes: string[], additionalParameters: Object,
+    serviceConfiguration: TM.RNAppAuth.ServiceConfiguration, connectionTimeoutMillis: number,
+    clientAuthMethod: string, dangerouslyAllowInsecureHttpRequests: boolean,
+    customHeaders: TM.RNAppAuth.CustomHeaders): Promise<TM.RNAppAuth.RefreshResult> {
+    return this.doRefresh(issuer, redirectUrl, clientId, clientSecret, refreshToken, scopes,
+      additionalParameters, serviceConfiguration, connectionTimeoutMillis, clientAuthMethod,
+      customHeaders);
+  }
+
+  private async doRefresh(issuer: string, redirectUrl: string, clientId: string,
+    clientSecret: string, refreshToken: string, scopes: string[],
+    additionalParameters: Object, serviceConfiguration: TM.RNAppAuth.ServiceConfiguration,
+    connectionTimeoutMillis: number, clientAuthMethod: string,
+    customHeaders: TM.RNAppAuth.CustomHeaders): Promise<TM.RNAppAuth.RefreshResult> {
+    try {
+      let timeout: number = RNAppAuthTurboModule.safeTimeout(connectionTimeoutMillis);
+      this.parseHeaderMap(customHeaders);
+      let config: TM.RNAppAuth.ServiceConfiguration =
+        await this.resolveServiceConfiguration(issuer, serviceConfiguration, timeout);
+      let tokenEndpoint: string | undefined = config.tokenEndpoint;
+      if (tokenEndpoint === undefined || tokenEndpoint.length === 0) {
+        throw new OAuthError('token_refresh_failed', 'No token endpoint available');
+      }
+      let additionalParams: Record<string, string> = RNAppAuthTurboModule.toStringMap(additionalParameters);
+      if (clientSecret !== null && clientSecret.length > 0) {
+        additionalParams.client_secret = clientSecret;
+      }
+      let params: Record<string, string> = OAuthProtocol.buildRefreshTokenParams(refreshToken,
+        clientId, scopes, redirectUrl, additionalParams);
+      let headers: Record<string, string> = RNAppAuthTurboModule.copyMap(this.pendingTokenHeaders);
+      if (clientSecret !== null && clientSecret.length > 0 && clientAuthMethod !== 'post') {
+        headers.Authorization = RNAppAuthTurboModule.buildBasicAuthHeader(clientId, clientSecret);
+      }
+      let responseBody: Record<string, Object> = await this.httpClient.postForm(tokenEndpoint, params,
+        headers, timeout);
+      return this.buildRefreshResultMap(responseBody);
+    } catch (err) {
+      return Promise.reject(RNAppAuthTurboModule.toOAuthError(err, 'token_refresh_failed'));
+    }
+  }
+
+  logout(issuer: string, idTokenHint: string, postLogoutRedirectUri: string,
+    serviceConfiguration: TM.RNAppAuth.ServiceConfiguration, additionalParameters: Object,
+    dangerouslyAllowInsecureHttpRequests: boolean): Promise<TM.RNAppAuth.EndSessionResult> {
+    return this.doLogout(issuer, idTokenHint, postLogoutRedirectUri, serviceConfiguration,
+      additionalParameters);
+  }
+
+  private async doLogout(issuer: string, idTokenHint: string, postLogoutRedirectUri: string,
+    serviceConfiguration: TM.RNAppAuth.ServiceConfiguration,
+    additionalParameters: Object): Promise<TM.RNAppAuth.EndSessionResult> {
+    try {
+      let timeout: number = DEFAULT_TIMEOUT_MILLIS;
+      let config: TM.RNAppAuth.ServiceConfiguration =
+        await this.resolveServiceConfiguration(issuer, serviceConfiguration, timeout);
+      let endSessionEndpoint: string | undefined = config.endSessionEndpoint;
+      if (endSessionEndpoint === undefined || endSessionEndpoint.length === 0) {
+        throw new OAuthError('end_session_failed', 'No end session endpoint available');
+      }
+      let rawLogoutParams: Record<string, string> = RNAppAuthTurboModule.toStringMap(additionalParameters);
+      let state: string = '';
+      let additionalParams: Record<string, string> = {};
+      let logoutKeys: string[] = Object.keys(rawLogoutParams);
+      for (let key of logoutKeys) {
+        if (key === 'state') {
+          state = rawLogoutParams[key];
+        } else {
+          additionalParams[key] = rawLogoutParams[key];
+        }
+      }
+      if (state.length === 0) {
+        state = PKCE.generateState();
+      }
+      let urlParams: EndSessionUrlParams = {
+        endSessionEndpoint: endSessionEndpoint,
+        idTokenHint: idTokenHint,
+        postLogoutRedirectUri: postLogoutRedirectUri,
+        state: state,
+        additionalParameters: additionalParams,
+      };
+      let endSessionUrl: string = OAuthProtocol.buildEndSessionUrl(urlParams);
+
+      this.pendingFlowState = state;
+      this.pendingPostLogoutRedirectUri = postLogoutRedirectUri;
+      this.pendingIdTokenHint = idTokenHint;
+
+      let deferred: Deferred<Object> = new Deferred<Object>();
+      this.pendingLogout = deferred;
+
+      await this.openBrowser(endSessionUrl);
+      return deferred.promise as Promise<TM.RNAppAuth.EndSessionResult>;
+    } catch (err) {
+      return Promise.reject(RNAppAuthTurboModule.toOAuthError(err, 'end_session_failed'));
+    }
+  }
+
+  handleRedirect(url: string): Promise<boolean> {
+    return this.doHandleRedirect(url);
+  }
+
+  cancelPendingFlow(): Promise<boolean> {
+    let cancelled: boolean = false;
+    if (this.pendingAuthorize !== null) {
+      let deferred: Deferred<Object> = this.pendingAuthorize;
+      this.pendingAuthorize = null;
+      deferred.reject(new OAuthError('access_denied', 'Authorization flow cancelled by user'));
+      cancelled = true;
+    }
+    if (this.pendingLogout !== null) {
+      let deferred: Deferred<Object> = this.pendingLogout;
+      this.pendingLogout = null;
+      deferred.reject(new OAuthError('access_denied', 'End session flow cancelled by user'));
+      cancelled = true;
+    }
+    return Promise.resolve(cancelled);
+  }
+
+  private async doHandleRedirect(url: string): Promise<boolean> {
+    let response: AuthorizationResponse = OAuthProtocol.parseCallbackUrl(url);
+    // A redirect is only ours when it carries OAuth callback parameters
+    // (state/code/error). This avoids consuming the app's own unrelated deep
+    // links that also flow through the RNOH 'url' device event.
+    let isOAuthCallback: boolean = response.state.length > 0 ||
+      response.authorizationCode.length > 0 || response.error.length > 0;
+    if (!isOAuthCallback) {
+      return false;
+    }
+    // Only handle redirects whose state matches an in-flight flow.
+    if (response.state.length > 0 && response.state !== this.pendingFlowState) {
+      return false;
+    }
+
+    if (this.pendingAuthorize !== null) {
+      let deferred: Deferred<Object> = this.pendingAuthorize;
+      this.pendingAuthorize = null;
+      return await this.completeAuthorize(deferred, response);
+    }
+
+    if (this.pendingLogout !== null) {
+      let deferred: Deferred<Object> = this.pendingLogout;
+      this.pendingLogout = null;
+      let result: TM.RNAppAuth.EndSessionResult = {
+        idTokenHint: this.pendingIdTokenHint,
+        postLogoutRedirectUri: this.pendingPostLogoutRedirectUri,
+        state: response.state.length > 0 ? response.state : this.pendingFlowState,
+      };
+      deferred.resolve(result);
+      return true;
+    }
+
+    return false;
+  }
+
+  private async completeAuthorize(deferred: Deferred<Object>,
+    response: AuthorizationResponse): Promise<boolean> {
+    if (response.error.length > 0) {
+      deferred.reject(new OAuthError(response.error,
+        response.errorDescription.length > 0 ? response.errorDescription : response.error));
+      return true;
+    }
+    if (response.authorizationCode.length === 0) {
+      deferred.reject(new OAuthError('authentication_failed', 'No authorization code in redirect'));
+      return true;
+    }
+    if (this.pendingSkipCodeExchange) {
+      let result: TM.RNAppAuth.AuthorizeResult = this.buildAuthorizationResponseMap(response);
+      deferred.resolve(result);
+      return true;
+    }
+    try {
+      let tokenBody: Record<string, Object> = await this.exchangeCodeForToken(
+        response.authorizationCode);
+      let result: TM.RNAppAuth.AuthorizeResult = this.buildAuthorizeResultMap(tokenBody, response);
+      deferred.resolve(result);
+      return true;
+    } catch (err) {
+      deferred.reject(RNAppAuthTurboModule.toOAuthError(err, 'token_exchange_failed'));
+      return true;
+    }
+  }
+
+  private async exchangeCodeForToken(code: string): Promise<Record<string, Object>> {
+    let config: TM.RNAppAuth.ServiceConfiguration | null = this.pendingServiceConfiguration;
+    if (config === null || config.tokenEndpoint === undefined || config.tokenEndpoint.length === 0) {
+      throw new OAuthError('token_exchange_failed', 'No token endpoint available');
+    }
+    let params: Record<string, string> = OAuthProtocol.buildTokenExchangeParams(code,
+      this.pendingRedirectUrl, this.pendingClientId, this.pendingCodeVerifier,
+      this.pendingAdditionalParameters);
+    let headers: Record<string, string> = RNAppAuthTurboModule.copyMap(this.pendingTokenHeaders);
+    if (this.pendingClientSecret.length > 0) {
+      if (this.pendingClientAuthMethod === 'post') {
+        params.client_secret = this.pendingClientSecret;
+      } else {
+        headers.Authorization = RNAppAuthTurboModule.buildBasicAuthHeader(this.pendingClientId,
+          this.pendingClientSecret);
+      }
+    }
+    return await this.httpClient.postForm(config.tokenEndpoint, params, headers,
+      this.pendingTimeoutMillis);
+  }
+
+  private buildAuthorizationResponseMap(response: AuthorizationResponse): TM.RNAppAuth.AuthorizeResult {
+    let additionalParams: Object = RNAppAuthTurboModule.toJsObject(response.additionalParameters);
+    let result: TM.RNAppAuth.AuthorizeResult = {
+      accessToken: response.accessToken,
+      accessTokenExpirationDate: DateUtil.formatTimestamp(response.accessTokenExpirationTime),
+      authorizeAdditionalParameters: additionalParams,
+      idToken: response.idToken,
+      refreshToken: '',
+      tokenType: response.tokenType,
+      scopes: this.pendingScopes,
+      authorizationCode: response.authorizationCode,
+    };
+    if (response.accessTokenExpirationTime > 0) {
+      result.accessTokenExpirationDate = DateUtil.formatTimestamp(response.accessTokenExpirationTime);
+    }
+    if (this.pendingCodeVerifier.length > 0) {
+      result.codeVerifier = this.pendingCodeVerifier;
+    }
+    return result;
+  }
+
+  private buildAuthorizeResultMap(tokenBody: Record<string, Object>,
+    response: AuthorizationResponse): TM.RNAppAuth.AuthorizeResult {
+    let scopes: string[] = this.pendingScopes;
+    let scopeStr: string = OAuthHttpClient.asString(tokenBody, 'scope');
+    if (scopeStr.length > 0) {
+      scopes = scopeStr.split(' ');
+    } else if (response.scope.length > 0) {
+      scopes = response.scope.split(' ');
+    }
+    let result: TM.RNAppAuth.AuthorizeResult = {
+      accessToken: OAuthHttpClient.asString(tokenBody, 'access_token'),
+      accessTokenExpirationDate: '',
+      authorizeAdditionalParameters: RNAppAuthTurboModule.toJsObject(response.additionalParameters),
+      tokenAdditionalParameters: RNAppAuthTurboModule.toJsObject(
+        RNAppAuthTurboModule.remainingParams(tokenBody, RNAppAuthTurboModule.TOKEN_STANDARD_KEYS)),
+      idToken: OAuthHttpClient.asString(tokenBody, 'id_token'),
+      refreshToken: OAuthHttpClient.asString(tokenBody, 'refresh_token'),
+      tokenType: OAuthHttpClient.asString(tokenBody, 'token_type'),
+      scopes: scopes,
+      authorizationCode: response.authorizationCode,
+    };
+    let expiresIn: number = OAuthHttpClient.asNumber(tokenBody, 'expires_in');
+    if (expiresIn > 0) {
+      result.accessTokenExpirationDate = DateUtil.formatTimestamp(Date.now() + expiresIn * 1000);
+    }
+    if (this.pendingCodeVerifier.length > 0) {
+      result.codeVerifier = this.pendingCodeVerifier;
+    }
+    return result;
+  }
+
+  private buildRefreshResultMap(body: Record<string, Object>): TM.RNAppAuth.RefreshResult {
+    let result: TM.RNAppAuth.RefreshResult = {
+      accessToken: OAuthHttpClient.asString(body, 'access_token'),
+      accessTokenExpirationDate: '',
+      additionalParameters: RNAppAuthTurboModule.toJsObject(
+        RNAppAuthTurboModule.remainingParams(body, RNAppAuthTurboModule.TOKEN_STANDARD_KEYS)),
+      idToken: OAuthHttpClient.asString(body, 'id_token'),
+      refreshToken: OAuthHttpClient.asString(body, 'refresh_token'),
+      tokenType: OAuthHttpClient.asString(body, 'token_type'),
+    };
+    let expiresIn: number = OAuthHttpClient.asNumber(body, 'expires_in');
+    if (expiresIn > 0) {
+      result.accessTokenExpirationDate = DateUtil.formatTimestamp(Date.now() + expiresIn * 1000);
+    }
+    return result;
+  }
+
+  private buildRegistrationResultMap(body: Record<string, Object>): TM.RNAppAuth.RegistrationResponse {
+    let result: TM.RNAppAuth.RegistrationResponse = {
+      clientId: OAuthHttpClient.asString(body, 'client_id'),
+      additionalParameters: RNAppAuthTurboModule.toJsObject(
+        RNAppAuthTurboModule.remainingParams(body, RNAppAuthTurboModule.REGISTRATION_STANDARD_KEYS)),
+    };
+    let clientIdIssuedAt: number = OAuthHttpClient.asNumber(body, 'client_id_issued_at');
+    if (clientIdIssuedAt > 0) {
+      result.clientIdIssuedAt = DateUtil.formatTimestamp(clientIdIssuedAt * 1000);
+    }
+    let clientSecretExpiresAt: number = OAuthHttpClient.asNumber(body, 'client_secret_expires_at');
+    if (clientSecretExpiresAt > 0) {
+      result.clientSecretExpiresAt = DateUtil.formatTimestamp(clientSecretExpiresAt * 1000);
+    }
+    let clientSecret: string = OAuthHttpClient.asString(body, 'client_secret');
+    if (clientSecret.length > 0) {
+      result.clientSecret = clientSecret;
+    }
+    let registrationAccessToken: string = OAuthHttpClient.asString(body, 'registration_access_token');
+    if (registrationAccessToken.length > 0) {
+      result.registrationAccessToken = registrationAccessToken;
+    }
+    let registrationClientUri: string = OAuthHttpClient.asString(body, 'registration_client_uri');
+    if (registrationClientUri.length > 0) {
+      result.registrationClientUri = registrationClientUri;
+    }
+    let tokenEndpointAuthMethod: string = OAuthHttpClient.asString(body, 'token_endpoint_auth_method');
+    if (tokenEndpointAuthMethod.length > 0) {
+      result.tokenEndpointAuthMethod = tokenEndpointAuthMethod;
+    }
+    return result;
+  }
+
+  private async resolveServiceConfiguration(issuer: string,
+    serviceConfiguration: TM.RNAppAuth.ServiceConfiguration,
+    timeoutMillis: number): Promise<TM.RNAppAuth.ServiceConfiguration> {
+    if (serviceConfiguration !== null && serviceConfiguration !== undefined &&
+      RNAppAuthTurboModule.isNonEmptyString(serviceConfiguration.authorizationEndpoint)) {
+      return serviceConfiguration;
+    }
+    if (serviceConfiguration !== null && serviceConfiguration !== undefined &&
+      RNAppAuthTurboModule.isNonEmptyString(serviceConfiguration.registrationEndpoint)) {
+      return serviceConfiguration;
+    }
+    if (issuer !== null && issuer.length > 0 && this.serviceConfigCache.has(issuer)) {
+      return RNAppAuthTurboModule.mergeServiceConfigurationOverrides(
+        this.serviceConfigCache.get(issuer)!, serviceConfiguration);
+    }
+    if (issuer === null || issuer.length === 0) {
+      throw new OAuthError('service_configuration_fetch_error',
+        'No issuer or serviceConfiguration provided');
+    }
+    let discovery = await this.httpClient.fetchDiscovery(issuer, timeoutMillis);
+    let config: TM.RNAppAuth.ServiceConfiguration = {
+      authorizationEndpoint: discovery.authorizationEndpoint,
+      tokenEndpoint: discovery.tokenEndpoint,
+      revocationEndpoint: discovery.revocationEndpoint.length > 0 ? discovery.revocationEndpoint : undefined,
+      registrationEndpoint: discovery.registrationEndpoint.length > 0 ? discovery.registrationEndpoint : undefined,
+      endSessionEndpoint: discovery.endSessionEndpoint.length > 0 ? discovery.endSessionEndpoint : undefined,
+    };
+    config = RNAppAuthTurboModule.mergeServiceConfigurationOverrides(config, serviceConfiguration);
+    this.serviceConfigCache.set(issuer, config);
+    return config;
+  }
+
+  private static mergeServiceConfigurationOverrides(
+    base: TM.RNAppAuth.ServiceConfiguration,
+    overrides: TM.RNAppAuth.ServiceConfiguration): TM.RNAppAuth.ServiceConfiguration {
+    if (overrides === null || overrides === undefined) {
+      return base;
+    }
+    let merged: TM.RNAppAuth.ServiceConfiguration = {
+      authorizationEndpoint: base.authorizationEndpoint,
+      tokenEndpoint: base.tokenEndpoint,
+      revocationEndpoint: base.revocationEndpoint,
+      registrationEndpoint: base.registrationEndpoint,
+      endSessionEndpoint: base.endSessionEndpoint,
+    };
+    if (RNAppAuthTurboModule.isNonEmptyString(overrides.authorizationEndpoint)) {
+      merged.authorizationEndpoint = overrides.authorizationEndpoint;
+    }
+    if (RNAppAuthTurboModule.isNonEmptyString(overrides.tokenEndpoint)) {
+      merged.tokenEndpoint = overrides.tokenEndpoint;
+    }
+    if (RNAppAuthTurboModule.isNonEmptyString(overrides.revocationEndpoint)) {
+      merged.revocationEndpoint = overrides.revocationEndpoint;
+    }
+    if (RNAppAuthTurboModule.isNonEmptyString(overrides.registrationEndpoint)) {
+      merged.registrationEndpoint = overrides.registrationEndpoint;
+    }
+    if (RNAppAuthTurboModule.isNonEmptyString(overrides.endSessionEndpoint)) {
+      merged.endSessionEndpoint = overrides.endSessionEndpoint;
+    }
+    return merged;
+  }
+
+  private async openBrowser(url: string): Promise<void> {
+    let want: Want = {
+      action: 'ohos.want.action.viewData',
+      entities: ['entity.system.browsable'],
+      uri: url,
+    };
+    try {
+      let ctx: common.UIAbilityContext = this.ctx.uiAbilityContext;
+      await ctx.startAbility(want);
+    } catch (err) {
+      hilog.error(DOMAIN, TAG, `openBrowser failed: ${err}`);
+      throw new OAuthError('authentication_failed', 'Failed to launch browser for authorization');
+    }
+  }
+
+  private parseHeaderMap(headerMap: Object): void {
+    if (headerMap === null || headerMap === undefined) {
+      return;
+    }
+    let map = headerMap as Record<string, Object>;
+    let register = map.register;
+    let authorize = map.authorize;
+    let token = map.token;
+    if (register !== undefined && register !== null) {
+      this.pendingRegistrationHeaders = RNAppAuthTurboModule.toStringMap(register);
+    }
+    if (authorize !== undefined && authorize !== null) {
+      this.pendingAuthorizationHeaders = RNAppAuthTurboModule.toStringMap(authorize);
+    }
+    if (token !== undefined && token !== null) {
+      this.pendingTokenHeaders = RNAppAuthTurboModule.toStringMap(token);
+    }
+  }
+
+  private static readonly TOKEN_STANDARD_KEYS: string[] =
+    ['access_token', 'token_type', 'expires_in', 'refresh_token', 'id_token', 'scope'];
+  private static readonly REGISTRATION_STANDARD_KEYS: string[] =
+    ['client_id', 'client_secret', 'client_id_issued_at', 'client_secret_expires_at',
+      'registration_access_token', 'registration_client_uri', 'token_endpoint_auth_method'];
+
+  private static safeTimeout(connectionTimeoutMillis: number): number {
+    if (connectionTimeoutMillis !== null && connectionTimeoutMillis > 0) {
+      return connectionTimeoutMillis;
+    }
+    return DEFAULT_TIMEOUT_MILLIS;
+  }
+
+  /**
+   * JS/TurboModule may pass null for omitted optional strings.
+   * Treat null the same as undefined/empty so `.length` never runs on null.
+   * Non-empty strings keep previous behavior (used by authorize/refresh too).
+   */
+  private static isNonEmptyString(value: string | null | undefined): boolean {
+    if (value === null || value === undefined) {
+      return false;
+    }
+    return value.length > 0;
+  }
+
+  private static toStringMap(obj: Object): Record<string, string> {
+    let result: Record<string, string> = {};
+    if (obj === null || obj === undefined) {
+      return result;
+    }
+    let rec = obj as Record<string, Object>;
+    let keys: string[] = Object.keys(rec);
+    for (let key of keys) {
+      let value: Object | undefined = rec[key];
+      result[key] = value === undefined || value === null ? '' : `${value}`;
+    }
+    return result;
+  }
+
+  private static copyMap(source: Record<string, string>): Record<string, string> {
+    let result: Record<string, string> = {};
+    let keys: string[] = Object.keys(source);
+    for (let key of keys) {
+      result[key] = source[key];
+    }
+    return result;
+  }
+
+  private static buildBasicAuthHeader(clientId: string, clientSecret: string): string {
+    try {
+      let credentials: string = `${clientId}:${clientSecret}`;
+      let bytes: Uint8Array = new util.TextEncoder().encodeInto(credentials);
+      let encoded: string = new util.Base64Helper().encodeToStringSync(bytes, util.Type.BASIC);
+      return `Basic ${encoded}`;
+    } catch (err) {
+      hilog.error(DOMAIN, TAG, `buildBasicAuthHeader failed: ${err}`);
+      return 'Basic ';
+    }
+  }
+
+  private static remainingParams(body: Record<string, Object>,
+    standardKeys: string[]): Record<string, string> {
+    let result: Record<string, string> = {};
+    let keys: string[] = Object.keys(body);
+    for (let key of keys) {
+      let isStandard: boolean = false;
+      for (let sk of standardKeys) {
+        if (sk === key) {
+          isStandard = true;
+          break;
+        }
+      }
+      if (!isStandard) {
+        let value: Object | undefined = body[key];
+        result[key] = value === undefined || value === null ? '' : `${value}`;
+      }
+    }
+    return result;
+  }
+
+  private static toJsObject(params: Record<string, string>): Object {
+    let result: Record<string, string> = {};
+    let keys: string[] = Object.keys(params);
+    for (let key of keys) {
+      result[key] = params[key];
+    }
+    return result;
+  }
+
+  private static toOAuthError(err: Object, fallbackCode: string): OAuthError {
+    if (err instanceof OAuthError) {
+      return err;
+    }
+    return new OAuthError(fallbackCode, OAuthHttpClient.errorMessage(err));
+  }
+}