@hyper.authio/client 0.8.0 → 0.8.1

package/README.md

@@ -126,8 +126,9 @@ client's front-channel logout URI in an iframe; `validateFrontChannelLogout(requ
 
 ### Step-up
 
-When an API answers `403` with `WWW-Authenticate: Bearer error="insufficient_user_authentication", acr_values="2",
-max_age=300` (RFC 9470):
+When an API answers `401` with `WWW-Authenticate: Bearer error="insufficient_user_authentication", acr_values="2",
+max_age=300` (RFC 9470 §3; servers before `@hyper.authio/server` 0.8.1 and `@hyper.authio/mcp` 0.4.1 answer `403`, and
+the challenge reads the same):
 
 ```ts
 const challenge = parseAuthioBearerChallenge(response.headers.get("www-authenticate"));

package/dist/index.cjs

@@ -1339,13 +1339,16 @@ function createAuthioClient(options) {
         };
         const token = await clientCredentials.getToken({ ...key, signal: request.signal });
         const response = await attempt(token);
-        if (response.status !== 401) return response;
+        if (response.status !== 401 || isStepUpChallenge(response)) return response;
         clientCredentials.invalidate({ ...key, accessToken: token.accessToken });
         return attempt(await clientCredentials.getToken({ ...key, signal: request.signal }));
       };
     }
   };
 }
+function isStepUpChallenge(response) {
+  return parseAuthioBearerChallenge(response.headers.get("www-authenticate"))?.error === AuthioOAuthErrors.InsufficientUserAuthentication;
+}
 function createTokenClient(connection, discovery, authenticator) {
   const requestToken = async (parameters, signal, authenticate = true) => {
     const response = await postForm(connection, discovery, authenticate ? authenticator : void 0, "token_endpoint", parameters, signal);