@udibo/oauth2 0.15.0 → 0.15.1

package/dist/adapters/hono/bff/bff.js

@@ -52,6 +52,7 @@ import { deleteCookie, getCookie, setCookie } from "hono/cookie";
 import { assertMaxBodyBytes, DEFAULT_MAX_BODY_BYTES, readBoundedBody, } from "../../../utils/_body.js";
 import { InvalidRequestError, InvalidTokenError, isOAuth2Error, TemporarilyUnavailableError, } from "../../../errors.js";
 import { defaultFetch } from "../../../utils/_default-fetch.js";
+import { inboundRequestWithHeaders } from "../../../utils/_inbound-request.js";
 import { timingSafeMatchIndex } from "../../../utils/_timing-safe.js";
 import { sha256Hash } from "../../../server/utils/hash.js";
 import { OAUTH2_CONTEXT_KEY } from "../_common.js";
@@ -1023,7 +1024,7 @@ export class HonoBff {
             }
             const headers = new Headers(c.req.raw.headers);
             headers.set("Authorization", `Bearer ${resolution.entry.data.tokens.accessToken}`);
-            c.req.raw = new Request(c.req.raw, { headers });
+            c.req.raw = inboundRequestWithHeaders(c.req.raw, headers);
             await next();
         };
     }

package/dist/utils/_inbound-request.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Not part of the public API. Copies a request the server received, for
+ * middleware that hands downstream handlers a changed `c.req.raw`.
+ *
+ * @module
+ */
+/**
+ * `request` with `headers` in place of its own, keeping its URL, method, body
+ * stream and the client's abort signal. Built from those parts rather than
+ * `new Request(request, …)`, which throws on `@hono/node-server`'s lightweight
+ * request unless the adapter replaced the global `Request` (the Vite dev
+ * server's does not). The body moves to the copy, so reading it from
+ * `request` afterwards finds it used.
+ */
+export declare function inboundRequestWithHeaders(request: Request, headers: Headers): Request;

package/dist/utils/_inbound-request.js

@@ -0,0 +1,25 @@
+/**
+ * Not part of the public API. Copies a request the server received, for
+ * middleware that hands downstream handlers a changed `c.req.raw`.
+ *
+ * @module
+ */
+/**
+ * `request` with `headers` in place of its own, keeping its URL, method, body
+ * stream and the client's abort signal. Built from those parts rather than
+ * `new Request(request, …)`, which throws on `@hono/node-server`'s lightweight
+ * request unless the adapter replaced the global `Request` (the Vite dev
+ * server's does not). The body moves to the copy, so reading it from
+ * `request` afterwards finds it used.
+ */
+export function inboundRequestWithHeaders(request, headers) {
+    const init = {
+        method: request.method,
+        headers,
+        body: request.body,
+        signal: request.signal,
+        redirect: request.redirect,
+        duplex: "half",
+    };
+    return new Request(request.url, init);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@udibo/oauth2",
-  "version": "0.15.0",
+  "version": "0.15.1",
   "description": "A flexible OAuth2 toolkit: framework-agnostic authorization & resource servers, a typed client, Hono adapters (including a backend-for-frontend), and React bindings.",
   "keywords": [
     "authorization-server",