@osdk/oauth 1.2.0-beta.1 → 1.2.0-beta.2

package/build/cjs/index.cjs

@@ -980,7 +980,7 @@ function readSession(client) {
     globalThis.sessionStorage?.getItem(localStorageKey(client)) ?? "{}"
   );
 }
-function common(client, as, _signIn, oauthHttpOptions, refresh, refreshTokenMarker) {
+function common(client, as, _signIn, oauthHttpOptions, refresh, refreshTokenMarker, scopes) {
   let token;
   const eventTarget = new typescriptEventTarget.TypedEventTarget();
   function makeTokenAndSaveRefresh(resp, type) {
@@ -992,7 +992,8 @@ function common(client, as, _signIn, oauthHttpOptions, refresh, refreshTokenMark
     !(expires_in != null) ? process.env.NODE_ENV !== "production" ? invariant2__default.default(false) : invariant2__default.default(false) : undefined;
     saveLocal(client, {
       refresh_token,
-      refreshTokenMarker
+      refreshTokenMarker,
+      requestedScopes: scopes
     });
     token = {
       refresh_token,
@@ -1083,13 +1084,14 @@ function createConfidentialOauthClient(client_id, client_secret, url, scopes = [
   const oauthHttpOptions = {
     [customFetch]: fetchFn
   };
+  const joinedScopes = scopes.join(" ");
   const {
     getToken,
     makeTokenAndSaveRefresh
-  } = common(client, authServer, _signIn, oauthHttpOptions, undefined, undefined);
+  } = common(client, authServer, _signIn, oauthHttpOptions, undefined, undefined, joinedScopes);
   async function _signIn() {
     return makeTokenAndSaveRefresh(throwIfError(await processClientCredentialsResponse(authServer, client, await clientCredentialsGrantRequest(authServer, client, new URLSearchParams({
-      scope: scopes.join(" ")
+      scope: joinedScopes
     }), oauthHttpOptions))), "signIn");
   }
   return getToken;
@@ -1170,7 +1172,7 @@ function processOptionsAndAssignDefaults(url, redirect_uri, useHistory, loginPag
     useHistory: options.useHistory ?? true,
     loginPage: options.loginPage,
     postLoginPage: options.postLoginPage || window.location.toString(),
-    scopes: options.scopes ?? ["api:read-data", "api:write-data"],
+    joinedScopes: [...options.scopes ?? ["api:read-data", "api:write-data"]].sort().join(" "),
     fetchFn: options.fetchFn ?? globalThis.fetch,
     ctxPath: options.ctxPath ?? "multipass",
     refreshTokenMarker: options.refreshTokenMarker
@@ -1180,11 +1182,12 @@ function processOptionsAndAssignDefaults(url, redirect_uri, useHistory, loginPag
 // src/createPublicOauthClient.ts
 function createPublicOauthClient(client_id, url, redirect_uri, useHistory, loginPage, postLoginPage, scopes, fetchFn, ctxPath) {
   let refreshTokenMarker;
+  let joinedScopes;
   ({
     useHistory,
     loginPage,
     postLoginPage,
-    scopes,
+    joinedScopes,
     fetchFn,
     ctxPath,
     refreshTokenMarker
@@ -1200,7 +1203,7 @@ function createPublicOauthClient(client_id, url, redirect_uri, useHistory, login
   const {
     makeTokenAndSaveRefresh,
     getToken
-  } = common(client, authServer, _signIn, oauthHttpOptions, maybeRefresh.bind(globalThis, true), refreshTokenMarker);
+  } = common(client, authServer, _signIn, oauthHttpOptions, maybeRefresh.bind(globalThis, true), refreshTokenMarker, joinedScopes);
   const go = async (x) => {
     if (useHistory) {
       window.history.replaceState({}, "", x);
@@ -1212,9 +1215,11 @@ function createPublicOauthClient(client_id, url, redirect_uri, useHistory, login
   async function maybeRefresh(expectRefreshToken) {
     const {
       refresh_token,
-      refreshTokenMarker: lastRefreshTokenMarker
+      refreshTokenMarker: lastRefreshTokenMarker,
+      requestedScopes: initialRequestedScopes
     } = readLocal(client);
-    if (!refresh_token || lastRefreshTokenMarker !== refreshTokenMarker) {
+    const areScopesEqual = initialRequestedScopes != null && joinedScopes === initialRequestedScopes;
+    if (!refresh_token || lastRefreshTokenMarker !== refreshTokenMarker || !areScopesEqual) {
       if (expectRefreshToken) throw new Error("No refresh token found");
       return;
     }
@@ -1282,7 +1287,7 @@ function createPublicOauthClient(client_id, url, redirect_uri, useHistory, login
       redirect_uri,
       code_challenge: await calculatePKCECodeChallenge(codeVerifier),
       code_challenge_method: "S256",
-      scope: ["offline_access", ...scopes].join(" ")
+      scope: `offline_access ${joinedScopes}`
     })}`);
     await delay_default(1e3);
     throw new Error("Unable to redirect");