@tdacorp/identity-client 0.2.5 → 0.2.6

package/README.md

@@ -302,6 +302,26 @@ breaking rename (`middleware.ts` → `proxy.ts`) to keep working on Next.js
 package ships Route Handlers a consuming app mounts wherever it wants
 instead.
 
+Both factories' `redirectUri` accepts a function as well as a plain string —
+`(request) => string`, useful when the app is reachable at more than one
+origin (a preview deployment per branch, say):
+
+```ts
+redirectUri: (request) => `${request.nextUrl.origin}/api/auth/callback`,
+```
+
+The resolved value must be identical on both the login and callback route's
+own `redirectUri`, since the token endpoint checks it against what the
+authorization request used (RFC 6749 §4.1.3) — true automatically for
+`request.nextUrl.origin`, since one browser session's login and callback
+requests share a domain.
+
+`createCallbackRoute` also accepts `clientAuthMethod`, the same option
+`exchangeAuthorizationCode` takes directly (see "Token exchange, refresh,
+and client credentials" above) — set it to `'client_secret_post'` if your
+relying party is registered on the identity platform for that method
+instead of the default `client_secret_basic`.
+
 ## Limitations in v0.1
 
 - **No built-in fallback for an `indeterminate` `permits()` result.** That is

package/dist/next.cjs

@@ -420,6 +420,9 @@ function sanitizeReturnTo(returnTo) {
   }
   return returnTo.startsWith("/") ? returnTo : void 0;
 }
+function resolveRedirectUri(redirectUri, request) {
+  return typeof redirectUri === "function" ? redirectUri(request) : redirectUri;
+}
 function transactionCookieOptions(maxAge) {
   return {
     httpOnly: true,
@@ -445,7 +448,7 @@ function createLoginRoute(config) {
     const discovery = await fetchDiscovery(config.issuer);
     const authorizeUrl = new URL(discovery.authorization_endpoint);
     authorizeUrl.searchParams.set("client_id", config.clientId);
-    authorizeUrl.searchParams.set("redirect_uri", config.redirectUri);
+    authorizeUrl.searchParams.set("redirect_uri", resolveRedirectUri(config.redirectUri, request));
     authorizeUrl.searchParams.set("response_type", "code");
     authorizeUrl.searchParams.set("scope", config.scope ?? "openid profile email roles");
     authorizeUrl.searchParams.set("state", state);
@@ -499,8 +502,9 @@ function createCallbackRoute(config) {
         issuer: config.issuer,
         clientId: config.clientId,
         clientSecret: config.clientSecret,
+        clientAuthMethod: config.clientAuthMethod,
         code,
-        redirectUri: config.redirectUri,
+        redirectUri: resolveRedirectUri(config.redirectUri, request),
         codeVerifier: transaction.codeVerifier
       });
     } catch (error) {

package/dist/next.d.cts

@@ -1,13 +1,32 @@
-import { NextResponse, NextRequest } from 'next/server';
-import { d as TokenSet, I as IdTokenClaims } from './verify-ggSzUrdC.cjs';
+import { NextRequest, NextResponse } from 'next/server';
+import { T as TokenEndpointAuthMethod, d as TokenSet, I as IdTokenClaims } from './verify-ggSzUrdC.cjs';
 import { SealSecret } from './sealed.cjs';
 import '@tdacorp/identity-authz';
 import 'jose';
 
+/**
+ * A `redirect_uri` (RFC 6749 §3.1.2), either fixed or derived from the
+ * incoming request (e.g. `(request) => new URL('/api/auth/callback',
+ * request.nextUrl.origin).toString()`, for a deployment reachable at more
+ * than one origin -- a preview URL per branch, say).
+ *
+ * The resolved value MUST be identical on both the `createLoginRoute` call
+ * that starts a login and the `createCallbackRoute` call that finishes it
+ * (RFC 6749 §4.1.3 requires the token endpoint to see the same
+ * `redirect_uri` the authorization request used, and the identity server
+ * enforces this). A function form is only safe when it derives the same
+ * result from equivalent requests -- ordinarily true for `request.nextUrl
+ * .origin`, since the login and callback requests share one browser
+ * session and one domain, but not for anything that varies within that,
+ * e.g. a path segment.
+ */
+type RedirectUriConfig = string | ((request: NextRequest) => string);
 interface CreateLoginRouteConfig {
     issuer: string;
     clientId: string;
-    redirectUri: string;
+    /** See `RedirectUriConfig` -- must resolve to the same value
+     *  `createCallbackRoute`'s own `redirectUri` does. */
+    redirectUri: RedirectUriConfig;
     /** Space-separated OAuth scopes. Defaults to `"openid profile email
      *  roles"` -- `roles` is included in the default because without it the
      *  minted token carries no `roles` claim, and every `permits()` call
@@ -63,7 +82,19 @@ interface CreateCallbackRouteConfig {
     clientId: string;
     /** Omit for a public client authenticating via PKCE alone. */
     clientSecret?: string;
-    redirectUri: string;
+    /** How to send `clientSecret` to the token endpoint. Defaults to
+     *  `'client_secret_basic'`, matching `exchangeAuthorizationCode`'s own
+     *  default -- omitting this field changes nothing for an existing
+     *  caller. Set it to `'client_secret_post'` if the relying party is
+     *  registered on the identity platform for that method instead: sending
+     *  Basic auth to a `client_secret_post`-only client gets `invalid_client`
+     *  back, since the token endpoint never receives credentials in the form
+     *  it expects. See `exchangeAuthorizationCode`'s own `clientAuthMethod`
+     *  docs for the full reasoning. */
+    clientAuthMethod?: TokenEndpointAuthMethod;
+    /** See `RedirectUriConfig` -- must resolve to the same value
+     *  `createLoginRoute`'s own `redirectUri` did. */
+    redirectUri: RedirectUriConfig;
     cookieSecret: SealSecret;
     transactionCookieName?: string;
     /** Defaults to `clientId`, correct for a standard login where this app is
@@ -92,4 +123,4 @@ interface CreateCallbackRouteConfig {
  *  package stops there. */
 declare function createCallbackRoute(config: CreateCallbackRouteConfig): (request: NextRequest) => Promise<NextResponse>;
 
-export { type CallbackError, type CreateCallbackRouteConfig, type CreateLoginRouteConfig, createCallbackRoute, createLoginRoute };
+export { type CallbackError, type CreateCallbackRouteConfig, type CreateLoginRouteConfig, type RedirectUriConfig, createCallbackRoute, createLoginRoute };

package/dist/next.d.ts

@@ -1,13 +1,32 @@
-import { NextResponse, NextRequest } from 'next/server';
-import { d as TokenSet, I as IdTokenClaims } from './verify-ggSzUrdC.js';
+import { NextRequest, NextResponse } from 'next/server';
+import { T as TokenEndpointAuthMethod, d as TokenSet, I as IdTokenClaims } from './verify-ggSzUrdC.js';
 import { SealSecret } from './sealed.js';
 import '@tdacorp/identity-authz';
 import 'jose';
 
+/**
+ * A `redirect_uri` (RFC 6749 §3.1.2), either fixed or derived from the
+ * incoming request (e.g. `(request) => new URL('/api/auth/callback',
+ * request.nextUrl.origin).toString()`, for a deployment reachable at more
+ * than one origin -- a preview URL per branch, say).
+ *
+ * The resolved value MUST be identical on both the `createLoginRoute` call
+ * that starts a login and the `createCallbackRoute` call that finishes it
+ * (RFC 6749 §4.1.3 requires the token endpoint to see the same
+ * `redirect_uri` the authorization request used, and the identity server
+ * enforces this). A function form is only safe when it derives the same
+ * result from equivalent requests -- ordinarily true for `request.nextUrl
+ * .origin`, since the login and callback requests share one browser
+ * session and one domain, but not for anything that varies within that,
+ * e.g. a path segment.
+ */
+type RedirectUriConfig = string | ((request: NextRequest) => string);
 interface CreateLoginRouteConfig {
     issuer: string;
     clientId: string;
-    redirectUri: string;
+    /** See `RedirectUriConfig` -- must resolve to the same value
+     *  `createCallbackRoute`'s own `redirectUri` does. */
+    redirectUri: RedirectUriConfig;
     /** Space-separated OAuth scopes. Defaults to `"openid profile email
      *  roles"` -- `roles` is included in the default because without it the
      *  minted token carries no `roles` claim, and every `permits()` call
@@ -63,7 +82,19 @@ interface CreateCallbackRouteConfig {
     clientId: string;
     /** Omit for a public client authenticating via PKCE alone. */
     clientSecret?: string;
-    redirectUri: string;
+    /** How to send `clientSecret` to the token endpoint. Defaults to
+     *  `'client_secret_basic'`, matching `exchangeAuthorizationCode`'s own
+     *  default -- omitting this field changes nothing for an existing
+     *  caller. Set it to `'client_secret_post'` if the relying party is
+     *  registered on the identity platform for that method instead: sending
+     *  Basic auth to a `client_secret_post`-only client gets `invalid_client`
+     *  back, since the token endpoint never receives credentials in the form
+     *  it expects. See `exchangeAuthorizationCode`'s own `clientAuthMethod`
+     *  docs for the full reasoning. */
+    clientAuthMethod?: TokenEndpointAuthMethod;
+    /** See `RedirectUriConfig` -- must resolve to the same value
+     *  `createLoginRoute`'s own `redirectUri` did. */
+    redirectUri: RedirectUriConfig;
     cookieSecret: SealSecret;
     transactionCookieName?: string;
     /** Defaults to `clientId`, correct for a standard login where this app is
@@ -92,4 +123,4 @@ interface CreateCallbackRouteConfig {
  *  package stops there. */
 declare function createCallbackRoute(config: CreateCallbackRouteConfig): (request: NextRequest) => Promise<NextResponse>;
 
-export { type CallbackError, type CreateCallbackRouteConfig, type CreateLoginRouteConfig, createCallbackRoute, createLoginRoute };
+export { type CallbackError, type CreateCallbackRouteConfig, type CreateLoginRouteConfig, type RedirectUriConfig, createCallbackRoute, createLoginRoute };

package/dist/next.js

@@ -27,6 +27,9 @@ function sanitizeReturnTo(returnTo) {
   }
   return returnTo.startsWith("/") ? returnTo : void 0;
 }
+function resolveRedirectUri(redirectUri, request) {
+  return typeof redirectUri === "function" ? redirectUri(request) : redirectUri;
+}
 function transactionCookieOptions(maxAge) {
   return {
     httpOnly: true,
@@ -52,7 +55,7 @@ function createLoginRoute(config) {
     const discovery = await fetchDiscovery(config.issuer);
     const authorizeUrl = new URL(discovery.authorization_endpoint);
     authorizeUrl.searchParams.set("client_id", config.clientId);
-    authorizeUrl.searchParams.set("redirect_uri", config.redirectUri);
+    authorizeUrl.searchParams.set("redirect_uri", resolveRedirectUri(config.redirectUri, request));
     authorizeUrl.searchParams.set("response_type", "code");
     authorizeUrl.searchParams.set("scope", config.scope ?? "openid profile email roles");
     authorizeUrl.searchParams.set("state", state);
@@ -106,8 +109,9 @@ function createCallbackRoute(config) {
         issuer: config.issuer,
         clientId: config.clientId,
         clientSecret: config.clientSecret,
+        clientAuthMethod: config.clientAuthMethod,
         code,
-        redirectUri: config.redirectUri,
+        redirectUri: resolveRedirectUri(config.redirectUri, request),
         codeVerifier: transaction.codeVerifier
       });
     } catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tdacorp/identity-client",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "description": "OIDC relying-party client for TDACorp Identity: discovery, PKCE, token exchange, token verification and Next.js route helpers.",
   "license": "MIT",
   "bugs": {