@tensorgrad/oauth 0.1.1 → 0.2.0

package/README.md

@@ -7,6 +7,7 @@ Small OAuth client SDK for integrating tensorGrad SSO into first-party apps.
 - creates `state` values
 - creates PKCE verifier/challenge pairs
 - builds tensorGrad `/oauth/authorize` URLs
+- supports `prompt=login` for account switching
 - exchanges authorization codes at `/oauth/token`
 - fetches canonical identity from `/oauth/userinfo`
 - normalizes tensorGrad user payloads
@@ -100,9 +101,21 @@ export default {
     }
 
     if (url.pathname === "/auth/callback") {
+      const oauthError = url.searchParams.get("error");
+      const oauthErrorDescription = url.searchParams.get("error_description");
       const code = url.searchParams.get("code");
       const state = url.searchParams.get("state");
 
+      if (oauthError) {
+        return Response.json(
+          {
+            error: oauthError,
+            errorDescription: oauthErrorDescription ?? null
+          },
+          { status: 400 }
+        );
+      }
+
       if (!code || !state) {
         return new Response("Missing code or state", { status: 400 });
       }
@@ -113,6 +126,7 @@ export default {
       const expectedState = "<persisted-state>";
       const codeVerifier = "<persisted-code-verifier>";
 
+      // Use a constant-time comparison in your app when comparing secrets.
       if (state !== expectedState) {
         return new Response("Invalid state", { status: 400 });
       }
@@ -152,5 +166,8 @@ export default {
 - tensorGrad currently uses `https://www.tensorgrad.com` as the OAuth provider.
 - `DEFAULT_TG_SCOPES` is the recommended scope set for first-party apps.
 - `assertGrantedScopes(token.scope, ["admin"])` is the simplest way to require admin access.
+- pass `prompt: "login"` to `createAuthorizationUrl(...)` when you need tensorGrad to force a fresh account selection.
+- handle `error` / `error_description` on the callback before validating `code`
+- compare persisted `state` values using a constant-time comparison in your app
 - `isAdminScopeGranted(token.scope)` is available when you only need a boolean check.
 - app session and logout handling stay in the consuming app.

package/dist/index.d.ts

@@ -14,6 +14,7 @@ export interface AuthorizationUrlOptions {
     redirectUri: string;
     scope: string[] | string;
     state: string;
+    prompt?: "login";
     codeChallenge?: string;
     codeChallengeMethod?: "S256" | "plain";
     extraParams?: Record<string, string>;

package/dist/index.js

@@ -90,6 +90,9 @@ export function createAuthorizationUrl(config, options) {
     url.searchParams.set("response_type", "code");
     url.searchParams.set("scope", scope);
     url.searchParams.set("state", state);
+    if (options.prompt) {
+        url.searchParams.set("prompt", options.prompt);
+    }
     if (options.codeChallenge) {
         url.searchParams.set("code_challenge", requireNonEmptyString("codeChallenge", options.codeChallenge));
         url.searchParams.set("code_challenge_method", options.codeChallengeMethod ?? "S256");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tensorgrad/oauth",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "Small OAuth client SDK for tensorGrad SSO integrations.",
   "type": "module",
   "main": "./dist/index.js",