@hyper.authio/client 0.8.0 → 0.8.1

package/dist/index.d.cts

@@ -853,7 +853,9 @@ interface AuthioFrontChannelLogout {
  */
 declare function readAuthioFrontChannelLogout(request: string | URL | URLSearchParams | Readonly<Record<string, unknown>>, issuer: string): AuthioFrontChannelLogout;
 /**
- * Parses a `WWW-Authenticate` bearer challenge, or `undefined` when the header holds none.
+ * Parses a `WWW-Authenticate` bearer challenge, or `undefined` when the header holds none. It reads the header only,
+ * whatever the status: a step-up challenge (`insufficient_user_authentication`) comes with `401` (RFC 9470 §3), or
+ * with `403` from servers before `@hyper.authio/server` 0.8.1 and `@hyper.authio/mcp` 0.4.1.
  */
 declare function parseAuthioBearerChallenge(header: string | null | undefined): AuthioBearerChallenge | undefined;
 

package/dist/index.d.ts

@@ -853,7 +853,9 @@ interface AuthioFrontChannelLogout {
  */
 declare function readAuthioFrontChannelLogout(request: string | URL | URLSearchParams | Readonly<Record<string, unknown>>, issuer: string): AuthioFrontChannelLogout;
 /**
- * Parses a `WWW-Authenticate` bearer challenge, or `undefined` when the header holds none.
+ * Parses a `WWW-Authenticate` bearer challenge, or `undefined` when the header holds none. It reads the header only,
+ * whatever the status: a step-up challenge (`insufficient_user_authentication`) comes with `401` (RFC 9470 §3), or
+ * with `403` from servers before `@hyper.authio/server` 0.8.1 and `@hyper.authio/mcp` 0.4.1.
  */
 declare function parseAuthioBearerChallenge(header: string | null | undefined): AuthioBearerChallenge | undefined;
 

package/dist/index.js

@@ -1337,13 +1337,16 @@ function createAuthioClient(options) {
         };
         const token = await clientCredentials.getToken({ ...key, signal: request.signal });
         const response = await attempt(token);
-        if (response.status !== 401) return response;
+        if (response.status !== 401 || isStepUpChallenge(response)) return response;
         clientCredentials.invalidate({ ...key, accessToken: token.accessToken });
         return attempt(await clientCredentials.getToken({ ...key, signal: request.signal }));
       };
     }
   };
 }
+function isStepUpChallenge(response) {
+  return parseAuthioBearerChallenge(response.headers.get("www-authenticate"))?.error === AuthioOAuthErrors.InsufficientUserAuthentication;
+}
 function createTokenClient(connection, discovery, authenticator) {
   const requestToken = async (parameters, signal, authenticate = true) => {
     const response = await postForm(connection, discovery, authenticate ? authenticator : void 0, "token_endpoint", parameters, signal);