@scalar/api-client 2.1.40 → 2.1.41

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # @scalar/api-client
 
+## 2.1.41
+
+### Patch Changes
+
+- 823c14d: fix: add tests for oauth2 flows, ensure we reject on state mismatch
+- Updated dependencies [823c14d]
+- Updated dependencies [997cd35]
+  - @scalar/oas-utils@0.2.67
+
 ## 2.1.40
 
 ### Patch Changes

package/dist/views/Request/ResponseSection/ResponseEmpty.vue2.js

@@ -14,7 +14,7 @@ const B = { class: "relative col-1 flex-center gap-6 p-2 capitalize" }, S = { cl
       s.commandPalette.emit({ commandName: "Create Request" });
     }, c = (n) => {
       n != null && n.createNew && y.name === "request" && m();
-    }, k = "2.1.40";
+    }, k = "2.1.41";
     return _(() => s.hotKeys.on(c)), b(() => s.hotKeys.off(c)), (n, e) => (r(), l("div", B, [
       t("div", S, [
         o(f).isReadOnly ? u("", !0) : (r(), l("div", h, [

package/dist/views/Request/libs/oauth2.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth2.d.ts","sourceRoot":"","sources":["../../../../src/views/Request/libs/oauth2.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,0BAA0B,EAC1B,oBAAoB,EACpB,gCAAgC,EAChC,MAAM,EACP,MAAM,iCAAiC,CAAA;AAExC,qDAAqD;AACrD,KAAK,+BAA+B,GAAG,IAAI,CAAC,oBAAoB,EAAE,MAAM,CAAC,GAAG;IAC1E,IAAI,EAAE,OAAO,CAAC,oBAAoB,CAAC,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC,CAAA;CAClE,CAAA;AAED,6CAA6C;AAC7C,eAAO,MAAM,eAAe,YACjB,0BAA0B,KAClC,OAAO,IAAI,gCACoB,CAAA;AAElC;;;;GAIG;AACH,eAAO,MAAM,eAAe,WAClB,oBAAoB,WACnB,gCAAgC,gBAE3B,MAAM,oBAiHlB,CAAA;AAEJ;;;GAGG;AACH,eAAO,MAAM,gBAAgB,WACnB,+BAA+B,WAC9B,gCAAgC,UACjC,MAAM,SACP,MAAM,KACZ,OAAO,CAAC,MAAM,CAqDhB,CAAA"}
+{"version":3,"file":"oauth2.d.ts","sourceRoot":"","sources":["../../../../src/views/Request/libs/oauth2.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,0BAA0B,EAC1B,oBAAoB,EACpB,gCAAgC,EAChC,MAAM,EACP,MAAM,iCAAiC,CAAA;AAExC,qDAAqD;AACrD,KAAK,+BAA+B,GAAG,IAAI,CAAC,oBAAoB,EAAE,MAAM,CAAC,GAAG;IAC1E,IAAI,EAAE,OAAO,CAAC,oBAAoB,CAAC,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC,CAAA;CAClE,CAAA;AAED,6CAA6C;AAC7C,eAAO,MAAM,eAAe,YACjB,0BAA0B,KAClC,OAAO,IAAI,gCACoB,CAAA;AAElC;;;;GAIG;AACH,eAAO,MAAM,eAAe,WAClB,oBAAoB,WACnB,gCAAgC,gBAE3B,MAAM,oBA4HlB,CAAA;AAEJ;;;GAGG;AACH,eAAO,MAAM,gBAAgB,WACnB,+BAA+B,WAC9B,gCAAgC,UACjC,MAAM,SACP,MAAM,KACZ,OAAO,CAAC,MAAM,CAqDhB,CAAA"}

package/dist/views/Request/libs/oauth2.js

@@ -1,73 +1,71 @@
-const _ = (t) => t.type.startsWith("oauth"), g = (t, r, f) => new Promise((s, e) => {
-  const i = t.flow.selectedScopes.join(" ");
+const y = (t) => t.type.startsWith("oauth"), P = (t, r, f) => new Promise((i, e) => {
+  const n = t.flow.selectedScopes.join(" ");
   if (t.flow.type === "clientCredentials" || t.flow.type === "password")
     p(
       t,
       r,
-      i
-    ).then(s).catch(e);
+      n
+    ).then(i).catch(e);
   else {
-    const w = (Math.random() + 1).toString(36).substring(7), o = new URL(t.flow.authorizationUrl);
-    if (t.flow.type === "implicit" ? o.searchParams.set("response_type", "token") : t.flow.type === "authorizationCode" && o.searchParams.set("response_type", "code"), t.flow["x-scalar-redirect-uri"].startsWith("/")) {
-      const d = f.url || window.location.origin + window.location.pathname, a = new URL(
+    const c = (Math.random() + 1).toString(36).substring(7), a = new URL(t.flow.authorizationUrl);
+    if (t.flow.type === "implicit" ? a.searchParams.set("response_type", "token") : t.flow.type === "authorizationCode" && a.searchParams.set("response_type", "code"), t.flow["x-scalar-redirect-uri"].startsWith("/")) {
+      const d = f.url || window.location.origin + window.location.pathname, s = new URL(
         t.flow["x-scalar-redirect-uri"],
         d
       ).toString();
-      o.searchParams.set("redirect_uri", a);
+      a.searchParams.set("redirect_uri", s);
     } else
-      o.searchParams.set(
+      a.searchParams.set(
         "redirect_uri",
         t.flow["x-scalar-redirect-uri"]
       );
-    o.searchParams.set("client_id", t["x-scalar-client-id"]), o.searchParams.set("scope", i), o.searchParams.set("state", w);
-    const n = window.open(o, "openAuth2Window", "left=100,top=100,width=800,height=600");
-    if (n) {
+    a.searchParams.set("client_id", t["x-scalar-client-id"]), a.searchParams.set("scope", n), a.searchParams.set("state", c);
+    const o = window.open(a, "openAuth2Window", "left=100,top=100,width=800,height=600");
+    if (o) {
       const d = setInterval(function() {
-        var u;
-        let a = null, c = null;
+        var h;
+        let s = null, l = null;
         try {
-          const l = new URL(n.location.href).searchParams;
-          a = l.get("access_token"), c = l.get("code");
-          const h = new URLSearchParams(
-            n.location.href.split("#")[1]
+          const w = new URL(o.location.href).searchParams;
+          s = w.get("access_token"), l = w.get("code");
+          const u = new URLSearchParams(
+            o.location.href.split("#")[1]
           );
-          a || (a = h.get("access_token")), c || (c = h.get("code"));
+          s || (s = u.get("access_token")), l || (l = u.get("code"));
         } catch {
         }
-        if (n.closed || a || c)
-          if (clearInterval(d), n.close(), a) {
-            const l = (u = n.location.href.match(/state=([^&]*)/)) == null ? void 0 : u[1];
-            a && l === w && s(a);
-          } else c ? p(
-            t,
-            r,
-            i,
-            c
-          ).then(s).catch(e) : (clearInterval(d), e(
-            new Error("Window was closed without granting authorization")
-          ));
+        (o.closed || s || l) && (clearInterval(d), o.close(), s ? ((h = o.location.href.match(/state=([^&]*)/)) == null ? void 0 : h[1]) === c ? i(s) : e(new Error("State mismatch")) : l ? new URL(o.location.href).searchParams.get(
+          "state"
+        ) === c ? p(
+          t,
+          r,
+          n,
+          l
+        ).then(i).catch(e) : e(new Error("State mismatch")) : (clearInterval(d), e(
+          new Error("Window was closed without granting authorization")
+        )));
       }, 200);
     }
   }
-}), p = async (t, r, f, s) => {
+}), p = async (t, r, f, i) => {
   if (!("clientSecret" in r))
     throw new Error(
-      "Authorize Servers only works for Client Credentials or Authorization Code flow"
+      "Authorize Servers only works for Password, Client Credentials or Authorization Code flow"
     );
   if (!t.flow) throw new Error("OAuth2 flow was not defined");
   const e = new URLSearchParams();
-  e.set("client_id", t["x-scalar-client-id"]), e.set("scope", f), r.clientSecret && e.set("client_secret", r.clientSecret), "x-scalar-redirect-uri" in t.flow && e.set("redirect_uri", t.flow["x-scalar-redirect-uri"]), s ? (e.set("code", s), e.set("grant_type", "authorization_code")) : r.type === "oauth-password" ? (e.set("grant_type", "password"), e.set("username", r.username), e.set("password", r.password)) : e.set("grant_type", "client_credentials");
+  e.set("client_id", t["x-scalar-client-id"]), e.set("scope", f), r.clientSecret && e.set("client_secret", r.clientSecret), "x-scalar-redirect-uri" in t.flow && e.set("redirect_uri", t.flow["x-scalar-redirect-uri"]), i ? (e.set("code", i), e.set("grant_type", "authorization_code")) : r.type === "oauth-password" ? (e.set("grant_type", "password"), e.set("username", r.username), e.set("password", r.password)) : e.set("grant_type", "client_credentials");
   try {
-    const i = {
+    const n = {
       "Content-Type": "application/x-www-form-urlencoded"
     };
-    t["x-scalar-client-id"] && r.clientSecret && (i.Authorization = `Basic ${btoa(`${t["x-scalar-client-id"]}:${r.clientSecret}`)}`);
-    const w = await fetch(t.flow.tokenUrl, {
+    t["x-scalar-client-id"] && r.clientSecret && (n.Authorization = `Basic ${btoa(`${t["x-scalar-client-id"]}:${r.clientSecret}`)}`);
+    const c = await fetch(t.flow.tokenUrl, {
       method: "POST",
-      headers: i,
+      headers: n,
       body: e
-    }), { access_token: o } = await w.json();
-    return o;
+    }), { access_token: a } = await c.json();
+    return a;
   } catch {
     throw new Error(
       "Failed to get an access token. Please check your credentials."
@@ -75,7 +73,7 @@ const _ = (t) => t.type.startsWith("oauth"), g = (t, r, f) => new Promise((s, e)
   }
 };
 export {
-  g as authorizeOauth2,
+  P as authorizeOauth2,
   p as authorizeServers,
-  _ as isOauth2Example
+  y as isOauth2Example
 };

package/package.json

@@ -18,7 +18,7 @@
     "rest",
     "testing"
   ],
-  "version": "2.1.40",
+  "version": "2.1.41",
   "engines": {
     "node": ">=18"
   },
@@ -155,15 +155,15 @@
     "zod": "^3.23.8",
     "@scalar/components": "0.12.63",
     "@scalar/draggable": "0.1.6",
-    "@scalar/import": "0.0.4",
-    "@scalar/oas-utils": "0.2.66",
     "@scalar/icons": "0.1.1",
+    "@scalar/import": "0.0.4",
+    "@scalar/oas-utils": "0.2.67",
     "@scalar/object-utils": "1.1.11",
     "@scalar/openapi-parser": "0.8.8",
     "@scalar/openapi-types": "0.1.4",
     "@scalar/themes": "0.9.45",
-    "@scalar/use-codemirror": "0.11.30",
     "@scalar/types": "0.0.18",
+    "@scalar/use-codemirror": "0.11.30",
     "@scalar/use-toasts": "0.7.7",
     "@scalar/use-tooltip": "1.0.3"
   },