@tdacorp/identity-client 0.2.3 → 0.2.5

package/dist/{chunk-MB66JUMG.js → chunk-36WOXP7V.js}

@@ -1,6 +1,7 @@
 // src/discovery.ts
 import { createRemoteJWKSet } from "jose";
 var DISCOVERY_CACHE_TTL_MS = 6e5;
+var FETCH_TIMEOUT_MS = 2500;
 var CACHE_MAX_ENTRIES = 100;
 var discoveryCache = /* @__PURE__ */ new Map();
 var discoveryPending = /* @__PURE__ */ new Map();
@@ -31,23 +32,36 @@ function assertHttps(url, label) {
     throw new Error(`Discovery: ${label} "${url}" must be https (loopback hosts are the only http exception)`);
   }
 }
+var ENDPOINT_FIELDS = [
+  { field: "jwks_uri", required: true },
+  { field: "token_endpoint", required: true },
+  { field: "authorization_endpoint", required: true },
+  { field: "userinfo_endpoint", required: false },
+  { field: "end_session_endpoint", required: false },
+  { field: "revocation_endpoint", required: false },
+  { field: "introspection_endpoint", required: false },
+  { field: "registration_endpoint", required: false }
+];
+function validateEndpointField(field, url, issuerOrigin) {
+  assertHttps(url, field);
+  if (new URL(url).origin !== issuerOrigin) {
+    throw new Error(`Discovery: ${field} "${url}" is not same-origin as issuer`);
+  }
+}
 function validateDiscoveryDocument(document, issuerUrl) {
   assertHttps(issuerUrl, "issuer");
-  assertHttps(document.jwks_uri, "jwks_uri");
-  assertHttps(document.token_endpoint, "token_endpoint");
-  assertHttps(document.authorization_endpoint, "authorization_endpoint");
   if (document.issuer !== issuerUrl) {
     throw new Error(`Discovery: document issuer "${document.issuer}" does not match the configured issuer "${issuerUrl}"`);
   }
   const issuerOrigin = new URL(issuerUrl).origin;
-  if (new URL(document.jwks_uri).origin !== issuerOrigin) {
-    throw new Error(`Discovery: jwks_uri "${document.jwks_uri}" is not same-origin as issuer "${issuerUrl}"`);
-  }
-  if (new URL(document.token_endpoint).origin !== issuerOrigin) {
-    throw new Error(`Discovery: token_endpoint "${document.token_endpoint}" is not same-origin as issuer "${issuerUrl}"`);
-  }
-  if (new URL(document.authorization_endpoint).origin !== issuerOrigin) {
-    throw new Error(`Discovery: authorization_endpoint "${document.authorization_endpoint}" is not same-origin as issuer "${issuerUrl}"`);
+  for (const { field, required } of ENDPOINT_FIELDS) {
+    const value = document[field];
+    if (value === void 0 && !required) continue;
+    if (typeof value !== "string") {
+      const requirement = required ? "is required and must be a string" : ", if present, must be a string";
+      throw new Error(`Discovery: ${field} ${requirement}`);
+    }
+    validateEndpointField(field, value, issuerOrigin);
   }
 }
 async function fetchDiscovery(issuerUrl) {
@@ -58,7 +72,10 @@ async function fetchDiscovery(issuerUrl) {
   }
   const pending = discoveryPending.get(issuerUrl);
   if (pending) return pending;
-  const promise = fetch(discoveryUrl(issuerUrl), { headers: { Accept: "application/json" } }).then(
+  const promise = fetch(discoveryUrl(issuerUrl), {
+    headers: { Accept: "application/json" },
+    signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+  }).then(
     async (response) => {
       if (!response.ok) {
         throw new Error(`Discovery fetch for ${issuerUrl} failed: HTTP ${response.status}`);
@@ -115,6 +132,7 @@ function generateState() {
 }
 
 // src/token.ts
+var FETCH_TIMEOUT_MS2 = 2500;
 var TokenRequestError = class extends Error {
   status;
   error;
@@ -163,14 +181,29 @@ async function postTokenRequest(tokenEndpoint, clientId, clientSecret, clientAut
   } else {
     body.set("client_id", clientId);
   }
-  return fetch(tokenEndpoint, { method: "POST", headers, body: body.toString() });
+  return fetch(tokenEndpoint, {
+    method: "POST",
+    headers,
+    body: body.toString(),
+    signal: AbortSignal.timeout(FETCH_TIMEOUT_MS2)
+  });
+}
+async function postTokenRequestOrThrow(tokenEndpoint, clientId, clientSecret, clientAuthMethod, params) {
+  try {
+    return await postTokenRequest(tokenEndpoint, clientId, clientSecret, clientAuthMethod, params);
+  } catch (error) {
+    throw new TokenRequestError({
+      error: "network_failure",
+      errorDescription: error instanceof Error ? error.message : "Failed to reach the token endpoint"
+    });
+  }
 }
 async function readTokenResponseBody(response) {
   return await response.json().catch(() => null);
 }
 async function exchangeAuthorizationCode(options) {
   const discovery = await fetchDiscoveryForTokenRequest(options.issuer);
-  const response = await postTokenRequest(
+  const response = await postTokenRequestOrThrow(
     discovery.token_endpoint,
     options.clientId,
     options.clientSecret,
@@ -190,7 +223,7 @@ async function exchangeAuthorizationCode(options) {
 }
 async function clientCredentialsGrant(options) {
   const discovery = await fetchDiscoveryForTokenRequest(options.issuer);
-  const response = await postTokenRequest(
+  const response = await postTokenRequestOrThrow(
     discovery.token_endpoint,
     options.clientId,
     options.clientSecret,

package/dist/index.cjs

@@ -38,6 +38,7 @@ module.exports = __toCommonJS(index_exports);
 // src/discovery.ts
 var import_jose = require("jose");
 var DISCOVERY_CACHE_TTL_MS = 6e5;
+var FETCH_TIMEOUT_MS = 2500;
 var CACHE_MAX_ENTRIES = 100;
 var discoveryCache = /* @__PURE__ */ new Map();
 var discoveryPending = /* @__PURE__ */ new Map();
@@ -68,23 +69,36 @@ function assertHttps(url, label) {
     throw new Error(`Discovery: ${label} "${url}" must be https (loopback hosts are the only http exception)`);
   }
 }
+var ENDPOINT_FIELDS = [
+  { field: "jwks_uri", required: true },
+  { field: "token_endpoint", required: true },
+  { field: "authorization_endpoint", required: true },
+  { field: "userinfo_endpoint", required: false },
+  { field: "end_session_endpoint", required: false },
+  { field: "revocation_endpoint", required: false },
+  { field: "introspection_endpoint", required: false },
+  { field: "registration_endpoint", required: false }
+];
+function validateEndpointField(field, url, issuerOrigin) {
+  assertHttps(url, field);
+  if (new URL(url).origin !== issuerOrigin) {
+    throw new Error(`Discovery: ${field} "${url}" is not same-origin as issuer`);
+  }
+}
 function validateDiscoveryDocument(document, issuerUrl) {
   assertHttps(issuerUrl, "issuer");
-  assertHttps(document.jwks_uri, "jwks_uri");
-  assertHttps(document.token_endpoint, "token_endpoint");
-  assertHttps(document.authorization_endpoint, "authorization_endpoint");
   if (document.issuer !== issuerUrl) {
     throw new Error(`Discovery: document issuer "${document.issuer}" does not match the configured issuer "${issuerUrl}"`);
   }
   const issuerOrigin = new URL(issuerUrl).origin;
-  if (new URL(document.jwks_uri).origin !== issuerOrigin) {
-    throw new Error(`Discovery: jwks_uri "${document.jwks_uri}" is not same-origin as issuer "${issuerUrl}"`);
-  }
-  if (new URL(document.token_endpoint).origin !== issuerOrigin) {
-    throw new Error(`Discovery: token_endpoint "${document.token_endpoint}" is not same-origin as issuer "${issuerUrl}"`);
-  }
-  if (new URL(document.authorization_endpoint).origin !== issuerOrigin) {
-    throw new Error(`Discovery: authorization_endpoint "${document.authorization_endpoint}" is not same-origin as issuer "${issuerUrl}"`);
+  for (const { field, required } of ENDPOINT_FIELDS) {
+    const value = document[field];
+    if (value === void 0 && !required) continue;
+    if (typeof value !== "string") {
+      const requirement = required ? "is required and must be a string" : ", if present, must be a string";
+      throw new Error(`Discovery: ${field} ${requirement}`);
+    }
+    validateEndpointField(field, value, issuerOrigin);
   }
 }
 async function fetchDiscovery(issuerUrl) {
@@ -95,7 +109,10 @@ async function fetchDiscovery(issuerUrl) {
   }
   const pending = discoveryPending.get(issuerUrl);
   if (pending) return pending;
-  const promise = fetch(discoveryUrl(issuerUrl), { headers: { Accept: "application/json" } }).then(
+  const promise = fetch(discoveryUrl(issuerUrl), {
+    headers: { Accept: "application/json" },
+    signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+  }).then(
     async (response) => {
       if (!response.ok) {
         throw new Error(`Discovery fetch for ${issuerUrl} failed: HTTP ${response.status}`);
@@ -152,6 +169,7 @@ function generateState() {
 }
 
 // src/token.ts
+var FETCH_TIMEOUT_MS2 = 2500;
 var TokenRequestError = class extends Error {
   status;
   error;
@@ -200,14 +218,29 @@ async function postTokenRequest(tokenEndpoint, clientId, clientSecret, clientAut
   } else {
     body.set("client_id", clientId);
   }
-  return fetch(tokenEndpoint, { method: "POST", headers, body: body.toString() });
+  return fetch(tokenEndpoint, {
+    method: "POST",
+    headers,
+    body: body.toString(),
+    signal: AbortSignal.timeout(FETCH_TIMEOUT_MS2)
+  });
+}
+async function postTokenRequestOrThrow(tokenEndpoint, clientId, clientSecret, clientAuthMethod, params) {
+  try {
+    return await postTokenRequest(tokenEndpoint, clientId, clientSecret, clientAuthMethod, params);
+  } catch (error) {
+    throw new TokenRequestError({
+      error: "network_failure",
+      errorDescription: error instanceof Error ? error.message : "Failed to reach the token endpoint"
+    });
+  }
 }
 async function readTokenResponseBody(response) {
   return await response.json().catch(() => null);
 }
 async function exchangeAuthorizationCode(options) {
   const discovery = await fetchDiscoveryForTokenRequest(options.issuer);
-  const response = await postTokenRequest(
+  const response = await postTokenRequestOrThrow(
     discovery.token_endpoint,
     options.clientId,
     options.clientSecret,
@@ -227,7 +260,7 @@ async function exchangeAuthorizationCode(options) {
 }
 async function clientCredentialsGrant(options) {
   const discovery = await fetchDiscoveryForTokenRequest(options.issuer);
-  const response = await postTokenRequest(
+  const response = await postTokenRequestOrThrow(
     discovery.token_endpoint,
     options.clientId,
     options.clientSecret,

package/dist/index.js

@@ -11,7 +11,7 @@ import {
   refreshTokens,
   verifyAccessToken,
   verifyIdToken
-} from "./chunk-MB66JUMG.js";
+} from "./chunk-36WOXP7V.js";
 export {
   CLOCK_SKEW_TOLERANCE_SECONDS,
   TokenRequestError,

package/dist/next.cjs

@@ -29,6 +29,7 @@ var import_server = require("next/server");
 // src/discovery.ts
 var import_jose = require("jose");
 var DISCOVERY_CACHE_TTL_MS = 6e5;
+var FETCH_TIMEOUT_MS = 2500;
 var CACHE_MAX_ENTRIES = 100;
 var discoveryCache = /* @__PURE__ */ new Map();
 var discoveryPending = /* @__PURE__ */ new Map();
@@ -59,23 +60,36 @@ function assertHttps(url, label) {
     throw new Error(`Discovery: ${label} "${url}" must be https (loopback hosts are the only http exception)`);
   }
 }
+var ENDPOINT_FIELDS = [
+  { field: "jwks_uri", required: true },
+  { field: "token_endpoint", required: true },
+  { field: "authorization_endpoint", required: true },
+  { field: "userinfo_endpoint", required: false },
+  { field: "end_session_endpoint", required: false },
+  { field: "revocation_endpoint", required: false },
+  { field: "introspection_endpoint", required: false },
+  { field: "registration_endpoint", required: false }
+];
+function validateEndpointField(field, url, issuerOrigin) {
+  assertHttps(url, field);
+  if (new URL(url).origin !== issuerOrigin) {
+    throw new Error(`Discovery: ${field} "${url}" is not same-origin as issuer`);
+  }
+}
 function validateDiscoveryDocument(document, issuerUrl) {
   assertHttps(issuerUrl, "issuer");
-  assertHttps(document.jwks_uri, "jwks_uri");
-  assertHttps(document.token_endpoint, "token_endpoint");
-  assertHttps(document.authorization_endpoint, "authorization_endpoint");
   if (document.issuer !== issuerUrl) {
     throw new Error(`Discovery: document issuer "${document.issuer}" does not match the configured issuer "${issuerUrl}"`);
   }
   const issuerOrigin = new URL(issuerUrl).origin;
-  if (new URL(document.jwks_uri).origin !== issuerOrigin) {
-    throw new Error(`Discovery: jwks_uri "${document.jwks_uri}" is not same-origin as issuer "${issuerUrl}"`);
-  }
-  if (new URL(document.token_endpoint).origin !== issuerOrigin) {
-    throw new Error(`Discovery: token_endpoint "${document.token_endpoint}" is not same-origin as issuer "${issuerUrl}"`);
-  }
-  if (new URL(document.authorization_endpoint).origin !== issuerOrigin) {
-    throw new Error(`Discovery: authorization_endpoint "${document.authorization_endpoint}" is not same-origin as issuer "${issuerUrl}"`);
+  for (const { field, required } of ENDPOINT_FIELDS) {
+    const value = document[field];
+    if (value === void 0 && !required) continue;
+    if (typeof value !== "string") {
+      const requirement = required ? "is required and must be a string" : ", if present, must be a string";
+      throw new Error(`Discovery: ${field} ${requirement}`);
+    }
+    validateEndpointField(field, value, issuerOrigin);
   }
 }
 async function fetchDiscovery(issuerUrl) {
@@ -86,7 +100,10 @@ async function fetchDiscovery(issuerUrl) {
   }
   const pending = discoveryPending.get(issuerUrl);
   if (pending) return pending;
-  const promise = fetch(discoveryUrl(issuerUrl), { headers: { Accept: "application/json" } }).then(
+  const promise = fetch(discoveryUrl(issuerUrl), {
+    headers: { Accept: "application/json" },
+    signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+  }).then(
     async (response) => {
       if (!response.ok) {
         throw new Error(`Discovery fetch for ${issuerUrl} failed: HTTP ${response.status}`);
@@ -143,6 +160,7 @@ function generateState() {
 }
 
 // src/token.ts
+var FETCH_TIMEOUT_MS2 = 2500;
 var TokenRequestError = class extends Error {
   status;
   error;
@@ -191,14 +209,29 @@ async function postTokenRequest(tokenEndpoint, clientId, clientSecret, clientAut
   } else {
     body.set("client_id", clientId);
   }
-  return fetch(tokenEndpoint, { method: "POST", headers, body: body.toString() });
+  return fetch(tokenEndpoint, {
+    method: "POST",
+    headers,
+    body: body.toString(),
+    signal: AbortSignal.timeout(FETCH_TIMEOUT_MS2)
+  });
+}
+async function postTokenRequestOrThrow(tokenEndpoint, clientId, clientSecret, clientAuthMethod, params) {
+  try {
+    return await postTokenRequest(tokenEndpoint, clientId, clientSecret, clientAuthMethod, params);
+  } catch (error) {
+    throw new TokenRequestError({
+      error: "network_failure",
+      errorDescription: error instanceof Error ? error.message : "Failed to reach the token endpoint"
+    });
+  }
 }
 async function readTokenResponseBody(response) {
   return await response.json().catch(() => null);
 }
 async function exchangeAuthorizationCode(options) {
   const discovery = await fetchDiscoveryForTokenRequest(options.issuer);
-  const response = await postTokenRequest(
+  const response = await postTokenRequestOrThrow(
     discovery.token_endpoint,
     options.clientId,
     options.clientSecret,

package/dist/next.js

@@ -5,7 +5,7 @@ import {
   generateCodeVerifier,
   generateState,
   verifyIdToken
-} from "./chunk-MB66JUMG.js";
+} from "./chunk-36WOXP7V.js";
 import {
   seal,
   unseal

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tdacorp/identity-client",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "description": "OIDC relying-party client for TDACorp Identity: discovery, PKCE, token exchange, token verification and Next.js route helpers.",
   "license": "MIT",
   "bugs": {