@tdacorp/identity-client 0.2.4 → 0.2.6

package/README.md

@@ -302,6 +302,26 @@ breaking rename (`middleware.ts` → `proxy.ts`) to keep working on Next.js
 package ships Route Handlers a consuming app mounts wherever it wants
 instead.
 
+Both factories' `redirectUri` accepts a function as well as a plain string —
+`(request) => string`, useful when the app is reachable at more than one
+origin (a preview deployment per branch, say):
+
+```ts
+redirectUri: (request) => `${request.nextUrl.origin}/api/auth/callback`,
+```
+
+The resolved value must be identical on both the login and callback route's
+own `redirectUri`, since the token endpoint checks it against what the
+authorization request used (RFC 6749 §4.1.3) — true automatically for
+`request.nextUrl.origin`, since one browser session's login and callback
+requests share a domain.
+
+`createCallbackRoute` also accepts `clientAuthMethod`, the same option
+`exchangeAuthorizationCode` takes directly (see "Token exchange, refresh,
+and client credentials" above) — set it to `'client_secret_post'` if your
+relying party is registered on the identity platform for that method
+instead of the default `client_secret_basic`.
+
 ## Limitations in v0.1
 
 - **No built-in fallback for an `indeterminate` `permits()` result.** That is

package/dist/{chunk-HO6U23GY.js → chunk-36WOXP7V.js}

@@ -1,6 +1,7 @@
 // src/discovery.ts
 import { createRemoteJWKSet } from "jose";
 var DISCOVERY_CACHE_TTL_MS = 6e5;
+var FETCH_TIMEOUT_MS = 2500;
 var CACHE_MAX_ENTRIES = 100;
 var discoveryCache = /* @__PURE__ */ new Map();
 var discoveryPending = /* @__PURE__ */ new Map();
@@ -71,7 +72,10 @@ async function fetchDiscovery(issuerUrl) {
   }
   const pending = discoveryPending.get(issuerUrl);
   if (pending) return pending;
-  const promise = fetch(discoveryUrl(issuerUrl), { headers: { Accept: "application/json" } }).then(
+  const promise = fetch(discoveryUrl(issuerUrl), {
+    headers: { Accept: "application/json" },
+    signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+  }).then(
     async (response) => {
       if (!response.ok) {
         throw new Error(`Discovery fetch for ${issuerUrl} failed: HTTP ${response.status}`);
@@ -128,6 +132,7 @@ function generateState() {
 }
 
 // src/token.ts
+var FETCH_TIMEOUT_MS2 = 2500;
 var TokenRequestError = class extends Error {
   status;
   error;
@@ -176,14 +181,29 @@ async function postTokenRequest(tokenEndpoint, clientId, clientSecret, clientAut
   } else {
     body.set("client_id", clientId);
   }
-  return fetch(tokenEndpoint, { method: "POST", headers, body: body.toString() });
+  return fetch(tokenEndpoint, {
+    method: "POST",
+    headers,
+    body: body.toString(),
+    signal: AbortSignal.timeout(FETCH_TIMEOUT_MS2)
+  });
+}
+async function postTokenRequestOrThrow(tokenEndpoint, clientId, clientSecret, clientAuthMethod, params) {
+  try {
+    return await postTokenRequest(tokenEndpoint, clientId, clientSecret, clientAuthMethod, params);
+  } catch (error) {
+    throw new TokenRequestError({
+      error: "network_failure",
+      errorDescription: error instanceof Error ? error.message : "Failed to reach the token endpoint"
+    });
+  }
 }
 async function readTokenResponseBody(response) {
   return await response.json().catch(() => null);
 }
 async function exchangeAuthorizationCode(options) {
   const discovery = await fetchDiscoveryForTokenRequest(options.issuer);
-  const response = await postTokenRequest(
+  const response = await postTokenRequestOrThrow(
     discovery.token_endpoint,
     options.clientId,
     options.clientSecret,
@@ -203,7 +223,7 @@ async function exchangeAuthorizationCode(options) {
 }
 async function clientCredentialsGrant(options) {
   const discovery = await fetchDiscoveryForTokenRequest(options.issuer);
-  const response = await postTokenRequest(
+  const response = await postTokenRequestOrThrow(
     discovery.token_endpoint,
     options.clientId,
     options.clientSecret,

package/dist/index.cjs

@@ -38,6 +38,7 @@ module.exports = __toCommonJS(index_exports);
 // src/discovery.ts
 var import_jose = require("jose");
 var DISCOVERY_CACHE_TTL_MS = 6e5;
+var FETCH_TIMEOUT_MS = 2500;
 var CACHE_MAX_ENTRIES = 100;
 var discoveryCache = /* @__PURE__ */ new Map();
 var discoveryPending = /* @__PURE__ */ new Map();
@@ -108,7 +109,10 @@ async function fetchDiscovery(issuerUrl) {
   }
   const pending = discoveryPending.get(issuerUrl);
   if (pending) return pending;
-  const promise = fetch(discoveryUrl(issuerUrl), { headers: { Accept: "application/json" } }).then(
+  const promise = fetch(discoveryUrl(issuerUrl), {
+    headers: { Accept: "application/json" },
+    signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+  }).then(
     async (response) => {
       if (!response.ok) {
         throw new Error(`Discovery fetch for ${issuerUrl} failed: HTTP ${response.status}`);
@@ -165,6 +169,7 @@ function generateState() {
 }
 
 // src/token.ts
+var FETCH_TIMEOUT_MS2 = 2500;
 var TokenRequestError = class extends Error {
   status;
   error;
@@ -213,14 +218,29 @@ async function postTokenRequest(tokenEndpoint, clientId, clientSecret, clientAut
   } else {
     body.set("client_id", clientId);
   }
-  return fetch(tokenEndpoint, { method: "POST", headers, body: body.toString() });
+  return fetch(tokenEndpoint, {
+    method: "POST",
+    headers,
+    body: body.toString(),
+    signal: AbortSignal.timeout(FETCH_TIMEOUT_MS2)
+  });
+}
+async function postTokenRequestOrThrow(tokenEndpoint, clientId, clientSecret, clientAuthMethod, params) {
+  try {
+    return await postTokenRequest(tokenEndpoint, clientId, clientSecret, clientAuthMethod, params);
+  } catch (error) {
+    throw new TokenRequestError({
+      error: "network_failure",
+      errorDescription: error instanceof Error ? error.message : "Failed to reach the token endpoint"
+    });
+  }
 }
 async function readTokenResponseBody(response) {
   return await response.json().catch(() => null);
 }
 async function exchangeAuthorizationCode(options) {
   const discovery = await fetchDiscoveryForTokenRequest(options.issuer);
-  const response = await postTokenRequest(
+  const response = await postTokenRequestOrThrow(
     discovery.token_endpoint,
     options.clientId,
     options.clientSecret,
@@ -240,7 +260,7 @@ async function exchangeAuthorizationCode(options) {
 }
 async function clientCredentialsGrant(options) {
   const discovery = await fetchDiscoveryForTokenRequest(options.issuer);
-  const response = await postTokenRequest(
+  const response = await postTokenRequestOrThrow(
     discovery.token_endpoint,
     options.clientId,
     options.clientSecret,

package/dist/index.js

@@ -11,7 +11,7 @@ import {
   refreshTokens,
   verifyAccessToken,
   verifyIdToken
-} from "./chunk-HO6U23GY.js";
+} from "./chunk-36WOXP7V.js";
 export {
   CLOCK_SKEW_TOLERANCE_SECONDS,
   TokenRequestError,

package/dist/next.cjs

@@ -29,6 +29,7 @@ var import_server = require("next/server");
 // src/discovery.ts
 var import_jose = require("jose");
 var DISCOVERY_CACHE_TTL_MS = 6e5;
+var FETCH_TIMEOUT_MS = 2500;
 var CACHE_MAX_ENTRIES = 100;
 var discoveryCache = /* @__PURE__ */ new Map();
 var discoveryPending = /* @__PURE__ */ new Map();
@@ -99,7 +100,10 @@ async function fetchDiscovery(issuerUrl) {
   }
   const pending = discoveryPending.get(issuerUrl);
   if (pending) return pending;
-  const promise = fetch(discoveryUrl(issuerUrl), { headers: { Accept: "application/json" } }).then(
+  const promise = fetch(discoveryUrl(issuerUrl), {
+    headers: { Accept: "application/json" },
+    signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+  }).then(
     async (response) => {
       if (!response.ok) {
         throw new Error(`Discovery fetch for ${issuerUrl} failed: HTTP ${response.status}`);
@@ -156,6 +160,7 @@ function generateState() {
 }
 
 // src/token.ts
+var FETCH_TIMEOUT_MS2 = 2500;
 var TokenRequestError = class extends Error {
   status;
   error;
@@ -204,14 +209,29 @@ async function postTokenRequest(tokenEndpoint, clientId, clientSecret, clientAut
   } else {
     body.set("client_id", clientId);
   }
-  return fetch(tokenEndpoint, { method: "POST", headers, body: body.toString() });
+  return fetch(tokenEndpoint, {
+    method: "POST",
+    headers,
+    body: body.toString(),
+    signal: AbortSignal.timeout(FETCH_TIMEOUT_MS2)
+  });
+}
+async function postTokenRequestOrThrow(tokenEndpoint, clientId, clientSecret, clientAuthMethod, params) {
+  try {
+    return await postTokenRequest(tokenEndpoint, clientId, clientSecret, clientAuthMethod, params);
+  } catch (error) {
+    throw new TokenRequestError({
+      error: "network_failure",
+      errorDescription: error instanceof Error ? error.message : "Failed to reach the token endpoint"
+    });
+  }
 }
 async function readTokenResponseBody(response) {
   return await response.json().catch(() => null);
 }
 async function exchangeAuthorizationCode(options) {
   const discovery = await fetchDiscoveryForTokenRequest(options.issuer);
-  const response = await postTokenRequest(
+  const response = await postTokenRequestOrThrow(
     discovery.token_endpoint,
     options.clientId,
     options.clientSecret,
@@ -400,6 +420,9 @@ function sanitizeReturnTo(returnTo) {
   }
   return returnTo.startsWith("/") ? returnTo : void 0;
 }
+function resolveRedirectUri(redirectUri, request) {
+  return typeof redirectUri === "function" ? redirectUri(request) : redirectUri;
+}
 function transactionCookieOptions(maxAge) {
   return {
     httpOnly: true,
@@ -425,7 +448,7 @@ function createLoginRoute(config) {
     const discovery = await fetchDiscovery(config.issuer);
     const authorizeUrl = new URL(discovery.authorization_endpoint);
     authorizeUrl.searchParams.set("client_id", config.clientId);
-    authorizeUrl.searchParams.set("redirect_uri", config.redirectUri);
+    authorizeUrl.searchParams.set("redirect_uri", resolveRedirectUri(config.redirectUri, request));
     authorizeUrl.searchParams.set("response_type", "code");
     authorizeUrl.searchParams.set("scope", config.scope ?? "openid profile email roles");
     authorizeUrl.searchParams.set("state", state);
@@ -479,8 +502,9 @@ function createCallbackRoute(config) {
         issuer: config.issuer,
         clientId: config.clientId,
         clientSecret: config.clientSecret,
+        clientAuthMethod: config.clientAuthMethod,
         code,
-        redirectUri: config.redirectUri,
+        redirectUri: resolveRedirectUri(config.redirectUri, request),
         codeVerifier: transaction.codeVerifier
       });
     } catch (error) {

package/dist/next.d.cts

@@ -1,13 +1,32 @@
-import { NextResponse, NextRequest } from 'next/server';
-import { d as TokenSet, I as IdTokenClaims } from './verify-ggSzUrdC.cjs';
+import { NextRequest, NextResponse } from 'next/server';
+import { T as TokenEndpointAuthMethod, d as TokenSet, I as IdTokenClaims } from './verify-ggSzUrdC.cjs';
 import { SealSecret } from './sealed.cjs';
 import '@tdacorp/identity-authz';
 import 'jose';
 
+/**
+ * A `redirect_uri` (RFC 6749 §3.1.2), either fixed or derived from the
+ * incoming request (e.g. `(request) => new URL('/api/auth/callback',
+ * request.nextUrl.origin).toString()`, for a deployment reachable at more
+ * than one origin -- a preview URL per branch, say).
+ *
+ * The resolved value MUST be identical on both the `createLoginRoute` call
+ * that starts a login and the `createCallbackRoute` call that finishes it
+ * (RFC 6749 §4.1.3 requires the token endpoint to see the same
+ * `redirect_uri` the authorization request used, and the identity server
+ * enforces this). A function form is only safe when it derives the same
+ * result from equivalent requests -- ordinarily true for `request.nextUrl
+ * .origin`, since the login and callback requests share one browser
+ * session and one domain, but not for anything that varies within that,
+ * e.g. a path segment.
+ */
+type RedirectUriConfig = string | ((request: NextRequest) => string);
 interface CreateLoginRouteConfig {
     issuer: string;
     clientId: string;
-    redirectUri: string;
+    /** See `RedirectUriConfig` -- must resolve to the same value
+     *  `createCallbackRoute`'s own `redirectUri` does. */
+    redirectUri: RedirectUriConfig;
     /** Space-separated OAuth scopes. Defaults to `"openid profile email
      *  roles"` -- `roles` is included in the default because without it the
      *  minted token carries no `roles` claim, and every `permits()` call
@@ -63,7 +82,19 @@ interface CreateCallbackRouteConfig {
     clientId: string;
     /** Omit for a public client authenticating via PKCE alone. */
     clientSecret?: string;
-    redirectUri: string;
+    /** How to send `clientSecret` to the token endpoint. Defaults to
+     *  `'client_secret_basic'`, matching `exchangeAuthorizationCode`'s own
+     *  default -- omitting this field changes nothing for an existing
+     *  caller. Set it to `'client_secret_post'` if the relying party is
+     *  registered on the identity platform for that method instead: sending
+     *  Basic auth to a `client_secret_post`-only client gets `invalid_client`
+     *  back, since the token endpoint never receives credentials in the form
+     *  it expects. See `exchangeAuthorizationCode`'s own `clientAuthMethod`
+     *  docs for the full reasoning. */
+    clientAuthMethod?: TokenEndpointAuthMethod;
+    /** See `RedirectUriConfig` -- must resolve to the same value
+     *  `createLoginRoute`'s own `redirectUri` did. */
+    redirectUri: RedirectUriConfig;
     cookieSecret: SealSecret;
     transactionCookieName?: string;
     /** Defaults to `clientId`, correct for a standard login where this app is
@@ -92,4 +123,4 @@ interface CreateCallbackRouteConfig {
  *  package stops there. */
 declare function createCallbackRoute(config: CreateCallbackRouteConfig): (request: NextRequest) => Promise<NextResponse>;
 
-export { type CallbackError, type CreateCallbackRouteConfig, type CreateLoginRouteConfig, createCallbackRoute, createLoginRoute };
+export { type CallbackError, type CreateCallbackRouteConfig, type CreateLoginRouteConfig, type RedirectUriConfig, createCallbackRoute, createLoginRoute };

package/dist/next.d.ts

@@ -1,13 +1,32 @@
-import { NextResponse, NextRequest } from 'next/server';
-import { d as TokenSet, I as IdTokenClaims } from './verify-ggSzUrdC.js';
+import { NextRequest, NextResponse } from 'next/server';
+import { T as TokenEndpointAuthMethod, d as TokenSet, I as IdTokenClaims } from './verify-ggSzUrdC.js';
 import { SealSecret } from './sealed.js';
 import '@tdacorp/identity-authz';
 import 'jose';
 
+/**
+ * A `redirect_uri` (RFC 6749 §3.1.2), either fixed or derived from the
+ * incoming request (e.g. `(request) => new URL('/api/auth/callback',
+ * request.nextUrl.origin).toString()`, for a deployment reachable at more
+ * than one origin -- a preview URL per branch, say).
+ *
+ * The resolved value MUST be identical on both the `createLoginRoute` call
+ * that starts a login and the `createCallbackRoute` call that finishes it
+ * (RFC 6749 §4.1.3 requires the token endpoint to see the same
+ * `redirect_uri` the authorization request used, and the identity server
+ * enforces this). A function form is only safe when it derives the same
+ * result from equivalent requests -- ordinarily true for `request.nextUrl
+ * .origin`, since the login and callback requests share one browser
+ * session and one domain, but not for anything that varies within that,
+ * e.g. a path segment.
+ */
+type RedirectUriConfig = string | ((request: NextRequest) => string);
 interface CreateLoginRouteConfig {
     issuer: string;
     clientId: string;
-    redirectUri: string;
+    /** See `RedirectUriConfig` -- must resolve to the same value
+     *  `createCallbackRoute`'s own `redirectUri` does. */
+    redirectUri: RedirectUriConfig;
     /** Space-separated OAuth scopes. Defaults to `"openid profile email
      *  roles"` -- `roles` is included in the default because without it the
      *  minted token carries no `roles` claim, and every `permits()` call
@@ -63,7 +82,19 @@ interface CreateCallbackRouteConfig {
     clientId: string;
     /** Omit for a public client authenticating via PKCE alone. */
     clientSecret?: string;
-    redirectUri: string;
+    /** How to send `clientSecret` to the token endpoint. Defaults to
+     *  `'client_secret_basic'`, matching `exchangeAuthorizationCode`'s own
+     *  default -- omitting this field changes nothing for an existing
+     *  caller. Set it to `'client_secret_post'` if the relying party is
+     *  registered on the identity platform for that method instead: sending
+     *  Basic auth to a `client_secret_post`-only client gets `invalid_client`
+     *  back, since the token endpoint never receives credentials in the form
+     *  it expects. See `exchangeAuthorizationCode`'s own `clientAuthMethod`
+     *  docs for the full reasoning. */
+    clientAuthMethod?: TokenEndpointAuthMethod;
+    /** See `RedirectUriConfig` -- must resolve to the same value
+     *  `createLoginRoute`'s own `redirectUri` did. */
+    redirectUri: RedirectUriConfig;
     cookieSecret: SealSecret;
     transactionCookieName?: string;
     /** Defaults to `clientId`, correct for a standard login where this app is
@@ -92,4 +123,4 @@ interface CreateCallbackRouteConfig {
  *  package stops there. */
 declare function createCallbackRoute(config: CreateCallbackRouteConfig): (request: NextRequest) => Promise<NextResponse>;
 
-export { type CallbackError, type CreateCallbackRouteConfig, type CreateLoginRouteConfig, createCallbackRoute, createLoginRoute };
+export { type CallbackError, type CreateCallbackRouteConfig, type CreateLoginRouteConfig, type RedirectUriConfig, createCallbackRoute, createLoginRoute };

package/dist/next.js

@@ -5,7 +5,7 @@ import {
   generateCodeVerifier,
   generateState,
   verifyIdToken
-} from "./chunk-HO6U23GY.js";
+} from "./chunk-36WOXP7V.js";
 import {
   seal,
   unseal
@@ -27,6 +27,9 @@ function sanitizeReturnTo(returnTo) {
   }
   return returnTo.startsWith("/") ? returnTo : void 0;
 }
+function resolveRedirectUri(redirectUri, request) {
+  return typeof redirectUri === "function" ? redirectUri(request) : redirectUri;
+}
 function transactionCookieOptions(maxAge) {
   return {
     httpOnly: true,
@@ -52,7 +55,7 @@ function createLoginRoute(config) {
     const discovery = await fetchDiscovery(config.issuer);
     const authorizeUrl = new URL(discovery.authorization_endpoint);
     authorizeUrl.searchParams.set("client_id", config.clientId);
-    authorizeUrl.searchParams.set("redirect_uri", config.redirectUri);
+    authorizeUrl.searchParams.set("redirect_uri", resolveRedirectUri(config.redirectUri, request));
     authorizeUrl.searchParams.set("response_type", "code");
     authorizeUrl.searchParams.set("scope", config.scope ?? "openid profile email roles");
     authorizeUrl.searchParams.set("state", state);
@@ -106,8 +109,9 @@ function createCallbackRoute(config) {
         issuer: config.issuer,
         clientId: config.clientId,
         clientSecret: config.clientSecret,
+        clientAuthMethod: config.clientAuthMethod,
         code,
-        redirectUri: config.redirectUri,
+        redirectUri: resolveRedirectUri(config.redirectUri, request),
         codeVerifier: transaction.codeVerifier
       });
     } catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tdacorp/identity-client",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "description": "OIDC relying-party client for TDACorp Identity: discovery, PKCE, token exchange, token verification and Next.js route helpers.",
   "license": "MIT",
   "bugs": {