@tensorgrad/oauth 0.1.0 → 0.2.0

package/README.md

@@ -7,6 +7,7 @@ Small OAuth client SDK for integrating tensorGrad SSO into first-party apps.
 - creates `state` values
 - creates PKCE verifier/challenge pairs
 - builds tensorGrad `/oauth/authorize` URLs
+- supports `prompt=login` for account switching
 - exchanges authorization codes at `/oauth/token`
 - fetches canonical identity from `/oauth/userinfo`
 - normalizes tensorGrad user payloads
@@ -45,6 +46,7 @@ console.log(TENSORGRAD_ISSUER);
 
 ```ts
 import {
+  DEFAULT_TG_SCOPES,
   TENSORGRAD_ISSUER,
   assertGrantedScopes,
   createAuthorizationUrl,
@@ -84,7 +86,7 @@ export default {
         },
         {
           redirectUri,
-          scope: ["openid", "profile", "email"],
+          scope: DEFAULT_TG_SCOPES,
           state,
           codeChallenge: pkce.codeChallenge,
           codeChallengeMethod: pkce.codeChallengeMethod
@@ -99,9 +101,21 @@ export default {
     }
 
     if (url.pathname === "/auth/callback") {
+      const oauthError = url.searchParams.get("error");
+      const oauthErrorDescription = url.searchParams.get("error_description");
       const code = url.searchParams.get("code");
       const state = url.searchParams.get("state");
 
+      if (oauthError) {
+        return Response.json(
+          {
+            error: oauthError,
+            errorDescription: oauthErrorDescription ?? null
+          },
+          { status: 400 }
+        );
+      }
+
       if (!code || !state) {
         return new Response("Missing code or state", { status: 400 });
       }
@@ -112,6 +126,7 @@ export default {
       const expectedState = "<persisted-state>";
       const codeVerifier = "<persisted-code-verifier>";
 
+      // Use a constant-time comparison in your app when comparing secrets.
       if (state !== expectedState) {
         return new Response("Invalid state", { status: 400 });
       }
@@ -125,7 +140,7 @@ export default {
         codeVerifier
       });
 
-      assertGrantedScopes(token.scope, ["openid", "profile", "email"]);
+      assertGrantedScopes(token.scope, DEFAULT_TG_SCOPES);
 
       const userFromToken = normalizeTgUser(token.user);
       const userFromUserInfo = normalizeTgUser(
@@ -149,6 +164,10 @@ export default {
 
 - `openid` is mandatory and the library enforces that when building authorize URLs.
 - tensorGrad currently uses `https://www.tensorgrad.com` as the OAuth provider.
+- `DEFAULT_TG_SCOPES` is the recommended scope set for first-party apps.
 - `assertGrantedScopes(token.scope, ["admin"])` is the simplest way to require admin access.
+- pass `prompt: "login"` to `createAuthorizationUrl(...)` when you need tensorGrad to force a fresh account selection.
+- handle `error` / `error_description` on the callback before validating `code`
+- compare persisted `state` values using a constant-time comparison in your app
 - `isAdminScopeGranted(token.scope)` is available when you only need a boolean check.
 - app session and logout handling stay in the consuming app.

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 export declare const TENSORGRAD_ISSUER = "https://www.tensorgrad.com";
+export declare const DEFAULT_TG_SCOPES: readonly ["openid", "profile", "email"];
 export interface tgOAuthConfig {
     issuer: string;
     clientId: string;
@@ -13,6 +14,7 @@ export interface AuthorizationUrlOptions {
     redirectUri: string;
     scope: string[] | string;
     state: string;
+    prompt?: "login";
     codeChallenge?: string;
     codeChallengeMethod?: "S256" | "plain";
     extraParams?: Record<string, string>;

package/dist/index.js

@@ -1,4 +1,5 @@
 export const TENSORGRAD_ISSUER = "https://www.tensorgrad.com";
+export const DEFAULT_TG_SCOPES = ["openid", "profile", "email"];
 const MIN_STATE_BYTES = 16;
 const MAX_RANDOM_BYTES = 96;
 const MIN_PKCE_RANDOM_BYTES = 32;
@@ -89,6 +90,9 @@ export function createAuthorizationUrl(config, options) {
     url.searchParams.set("response_type", "code");
     url.searchParams.set("scope", scope);
     url.searchParams.set("state", state);
+    if (options.prompt) {
+        url.searchParams.set("prompt", options.prompt);
+    }
     if (options.codeChallenge) {
         url.searchParams.set("code_challenge", requireNonEmptyString("codeChallenge", options.codeChallenge));
         url.searchParams.set("code_challenge_method", options.codeChallengeMethod ?? "S256");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tensorgrad/oauth",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Small OAuth client SDK for tensorGrad SSO integrations.",
   "type": "module",
   "main": "./dist/index.js",
@@ -27,6 +27,10 @@
     "tensorgrad",
     "sso"
   ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/tensorGrad/tgAuth"
+  },
   "license": "MIT",
   "devDependencies": {
     "typescript": "^5.9.2"