@openid4vc/oauth2 0.6.0-alpha-20260929114029 → 0.6.0

package/dist/index.mjs

@@ -2047,7 +2047,7 @@ async function calculateCodeChallenge(options) {
 //#endregion
 //#region src/access-token/verify-access-token-request.ts
 async function verifyPreAuthorizedCodeAccessTokenRequest(options) {
-	if (options.pkce) await verifyAccessTokenRequestPkce(options.pkce, options.callbacks);
+	await verifyAccessTokenRequestPkce(options.pkce, options.accessTokenRequest, options.callbacks);
 	const dpopResult = options.dpop ? await verifyAccessTokenRequestDpop(options.dpop, options.request, options.callbacks) : void 0;
 	const clientAttestationResult = options.clientAttestation ? await verifyAccessTokenRequestClientAttestation(options.clientAttestation, options.authorizationServerMetadata, options.callbacks, dpopResult?.jwkThumbprint, options.now) : void 0;
 	if (options.grant.preAuthorizedCode !== options.expectedPreAuthorizedCode) throw new Oauth2ServerErrorResponseError({
@@ -2081,7 +2081,7 @@ async function verifyPreAuthorizedCodeAccessTokenRequest(options) {
 	};
 }
 async function verifyAuthorizationCodeAccessTokenRequest(options) {
-	if (options.pkce) await verifyAccessTokenRequestPkce(options.pkce, options.callbacks);
+	await verifyAccessTokenRequestPkce(options.pkce, options.accessTokenRequest, options.callbacks);
 	const dpopResult = options.dpop ? await verifyAccessTokenRequestDpop(options.dpop, options.request, options.callbacks) : void 0;
 	const clientAttestationResult = options.clientAttestation ? await verifyAccessTokenRequestClientAttestation(options.clientAttestation, options.authorizationServerMetadata, options.callbacks, dpopResult?.jwkThumbprint, options.now) : void 0;
 	if (options.grant.code !== options.expectedCode) throw new Oauth2ServerErrorResponseError({
@@ -2101,7 +2101,7 @@ async function verifyAuthorizationCodeAccessTokenRequest(options) {
 	};
 }
 async function verifyRefreshTokenAccessTokenRequest(options) {
-	if (options.pkce) await verifyAccessTokenRequestPkce(options.pkce, options.callbacks);
+	await verifyAccessTokenRequestPkce(options.pkce, options.accessTokenRequest, options.callbacks);
 	const dpopResult = options.dpop ? await verifyAccessTokenRequestDpop(options.dpop, options.request, options.callbacks) : void 0;
 	const clientAttestationResult = options.clientAttestation ? await verifyAccessTokenRequestClientAttestation(options.clientAttestation, options.authorizationServerMetadata, options.callbacks, dpopResult?.jwkThumbprint, options.now) : void 0;
 	if (options.grant.refreshToken !== options.expectedRefreshToken) throw new Oauth2ServerErrorResponseError({
@@ -2212,9 +2212,16 @@ async function verifyAccessTokenRequestDpop(options, request, callbacks) {
 		jwkThumbprint
 	};
 }
-async function verifyAccessTokenRequestPkce(options, callbacks) {
+async function verifyAccessTokenRequestPkce(options, accessTokenRequest, callbacks) {
+	if (!options) {
+		if (accessTokenRequest.code_verifier) throw new Oauth2ServerErrorResponseError({
+			error: "invalid_grant",
+			error_description: `Unexpected 'code_verifier' in access token request, no code challenge is bound to the grant`
+		});
+		return null;
+	}
 	if (options.codeChallenge && !options.codeVerifier) throw new Oauth2ServerErrorResponseError({
-		error: "invalid_request",
+		error: "invalid_grant",
 		error_description: `Missing required 'code_verifier' in access token request`
 	});
 	if (!options.codeVerifier) return null;