@udibo/oauth2 0.20.0 → 0.21.1

package/dist/adapters/hono/bff/bff.d.ts

@@ -319,10 +319,14 @@ export interface HonoBffOptions {
      *   server-side store is needed. It cannot list sessions, so it does not
      *   support {@link HonoBffOptions.backchannelLogout}, and sign-out cannot
      *   invalidate a copied cookie: it stays valid until its `maxAgeMs`. Use a
-     *   shared {@link SessionStore} when you need revocation.
+     *   shared {@link SessionStore} when you need revocation. Against an
+     *   authorization server that rotates refresh tokens, a request still
+     *   carrying the cookie from before a refresh replays the old token and
+     *   trips reuse detection.
      * - A {@link SessionStore} over a database or cache every instance shares,
-     *   for server-side revocation and back-channel logout. Check it with
-     *   `runSessionStoreContractTests`.
+     *   for server-side revocation and back-channel logout. Implement
+     *   `RefreshLockStore` (`withRefreshLock`) on it so instances refresh a
+     *   session one at a time, and check it with `runSessionStoreContractTests`.
      * - {@link MemorySessionStore} for a single process, tests and local
      *   development. A session it holds is unknown to every other instance, so
      *   behind a load balancer the user appears signed out.

package/dist/adapters/hono/bff/bff.js

@@ -58,8 +58,12 @@ import { sha256Hash } from "../../../server/utils/hash.js";
 import { OAUTH2_CONTEXT_KEY } from "../_common.js";
 import { DEFAULT_MAX_RETURN_TO_LENGTH, loginContinuation as computeLoginContinuation, safeReturnTo, } from "../../../utils/url.js";
 import { resolveCookieName, resolvePrefixConstrainedAttributes, } from "./cookie-prefix.js";
-import { DEFAULT_SESSION_MAX_AGE_MS, sessionStoreMaxAgeMs, supportsBackchannelLogout, } from "./session-store.js";
+import { DEFAULT_SESSION_MAX_AGE_MS, sessionStoreMaxAgeMs, supportsBackchannelLogout, supportsRefreshLock, } from "./session-store.js";
 import { buildDownstreamHeaders, buildUpstreamHeaders, isInvalidTokenChallenge, resolveForwardHeaders, resolveProxyUrl, } from "./proxy.js";
+function refreshedSince(seen, current) {
+    return (current.refreshToken !== seen.refreshToken ||
+        current.tokens.accessToken !== seen.tokens.accessToken);
+}
 function isRevokedGrant(error) {
     if (!isOAuth2Error(error))
         return false;
@@ -1005,12 +1009,35 @@ export class HonoBff {
         const inFlight = this.#refreshes.get(entry.cookieValue);
         if (inFlight)
             return inFlight;
-        const pending = this.#exchangeRefresh(entry).finally(() => {
+        const pending = this.#lockedRefresh(entry).finally(() => {
             this.#refreshes.delete(entry.cookieValue);
         });
         this.#refreshes.set(entry.cookieValue, pending);
         return pending;
     }
+    async #lockedRefresh(entry) {
+        const store = this.#store;
+        if (!supportsRefreshLock(store))
+            return await this.#exchangeRefresh(entry);
+        const { cookieValue } = entry;
+        try {
+            return await store.withRefreshLock(cookieValue, async () => {
+                const current = await store.read(cookieValue);
+                if (!current)
+                    return { status: "revoked" };
+                if (refreshedSince(entry.data, current)) {
+                    return {
+                        status: "refreshed",
+                        entry: { cookieValue, data: current },
+                    };
+                }
+                return await this.#exchangeRefresh({ cookieValue, data: current });
+            });
+        }
+        catch {
+            return { status: "unavailable" };
+        }
+    }
     async #exchangeRefresh(entry) {
         const { cookieValue, data } = entry;
         if (!data.refreshToken)

package/dist/adapters/hono/bff/mod.d.ts

@@ -12,12 +12,13 @@
  * the memory pair serves a single process, tests and local development.
  *
  * Need a server-side store (Postgres, Redis, …)? Implement the
- * {@link SessionStore} interface and verify it with
- * `runSessionStoreContractTests` from `@udibo/oauth2/hono/bff/testing`.
+ * {@link SessionStore} interface, plus {@link RefreshLockStore} when several
+ * instances share it, and verify it with `runSessionStoreContractTests` from
+ * `@udibo/oauth2/hono/bff/testing`.
  *
  * @module
  */
 export { type BackchannelLogoutSubject, type BffCallbackError, HonoBff, type HonoBffBackchannelOptions, type HonoBffCookieOptions, type HonoBffCsrfOptions, type HonoBffOptions, type HonoBffPaths, type HonoBffResourceServer, } from "./bff.ts";
 export { type AuthRequestCookieOptions, type AuthRequestStorageFactory, EncryptedCookieAuthRequestStorage, encryptedCookieAuthRequestStorage, type EncryptedCookieAuthRequestStorageOptions, MemoryAuthRequestStorageFactory, } from "./auth-request-store.ts";
 export { DEFAULT_PROXY_FORWARD_HEADERS, type HonoBffProxyOptions, } from "./proxy.ts";
-export { type BackchannelLogoutStore, type BoundedSessionStore, DEFAULT_SESSION_MAX_AGE_MS, EncryptedCookieSessionStore, type EncryptedCookieSessionStoreOptions, MemorySessionStore, type SessionData, type SessionStore, sessionStoreMaxAgeMs, supportsBackchannelLogout, } from "./session-store.ts";
+export { type BackchannelLogoutStore, type BoundedSessionStore, DEFAULT_SESSION_MAX_AGE_MS, EncryptedCookieSessionStore, type EncryptedCookieSessionStoreOptions, MemorySessionStore, type RefreshLockStore, type SessionData, type SessionStore, sessionStoreMaxAgeMs, supportsBackchannelLogout, } from "./session-store.ts";

package/dist/adapters/hono/bff/mod.js

@@ -12,8 +12,9 @@
  * the memory pair serves a single process, tests and local development.
  *
  * Need a server-side store (Postgres, Redis, …)? Implement the
- * {@link SessionStore} interface and verify it with
- * `runSessionStoreContractTests` from `@udibo/oauth2/hono/bff/testing`.
+ * {@link SessionStore} interface, plus {@link RefreshLockStore} when several
+ * instances share it, and verify it with `runSessionStoreContractTests` from
+ * `@udibo/oauth2/hono/bff/testing`.
  *
  * @module
  */

package/dist/adapters/hono/bff/session-store.d.ts

@@ -69,6 +69,54 @@ export interface BackchannelLogoutStore {
 }
 /** Whether a store implements the {@link BackchannelLogoutStore} capability. */
 export declare function supportsBackchannelLogout(store: SessionStore): store is SessionStore & BackchannelLogoutStore;
+/**
+ * Optional {@link SessionStore} capability: one token refresh at a time per
+ * session, across every instance that shares the store. A store opts in by
+ * implementing this method (it is duck-typed at runtime).
+ *
+ * Without it, `HonoBff` shares a refresh only between requests on the same
+ * instance. Two instances that refresh one session at once both present its
+ * refresh token: against an authorization server that rotates refresh tokens,
+ * the loser's exchange fails, or trips reuse detection and revokes the whole
+ * rotation family, and the user is signed out. With it, the BFF re-reads the
+ * session while it holds the lock and uses a peer's fresh tokens instead of
+ * spending the refresh token again. Implement it on any store more than one
+ * instance shares. {@link EncryptedCookieSessionStore} cannot: its sessions
+ * live in each browser's cookie, with nothing on the server to lock.
+ */
+export interface RefreshLockStore {
+    /**
+     * Runs `refresh` while no other `withRefreshLock` call for the same
+     * `cookieValue`, on any instance, is running, and settles with its result.
+     * Calls for other sessions must not wait on each other.
+     *
+     * - The lock is keyed by the cookie value, so it holds only for a store
+     *   whose `update` returns the cookie value it was given. A store that
+     *   issues a new value on update cannot implement it.
+     * - The lock must not block this store's own `read`, `update` or `destroy`:
+     *   `refresh` reads, writes and can destroy the session it locks.
+     * - Release it when `refresh` settles, including when it throws.
+     * - The lock covers the whole refresh: the token request and the store's
+     *   own reads and writes. With `DirectClient` a refresh can take about 30
+     *   seconds when its discovery cache is cold, since discovery tries two
+     *   well-known paths and every request has a 10-second deadline. If the
+     *   lock expires when its holder dies, expire it only after that plus the
+     *   store's own I/O, or renew the lease while it is held. A lock that
+     *   expires mid-refresh lets a second instance spend the same token.
+     * - Reject when the lock cannot be acquired within a bound you choose.
+     *   `HonoBff` then answers `502` `temporarily_unavailable` and keeps the
+     *   session.
+     *
+     * A Postgres store can hold `pg_advisory_xact_lock` on a hash of the session
+     * key in a transaction around `refresh`, with a `lock_timeout`. A Redis
+     * store can take a key with `SET NX PX` and wait for it with a deadline. Key
+     * the lock by the same digest the store keys its records by, never the raw
+     * cookie value, and include the tenant in a tenant-scoped store.
+     */
+    withRefreshLock<T>(cookieValue: string, refresh: () => Promise<T>): Promise<T>;
+}
+/** Whether a store implements the {@link RefreshLockStore} capability. */
+export declare function supportsRefreshLock(store: SessionStore): store is SessionStore & RefreshLockStore;
 /**
  * Default session lifetime — 14 days — shared by
  * {@link EncryptedCookieSessionStore} and `HonoBff`'s
@@ -129,7 +177,7 @@ export interface SessionStore {
  * restarts. Suitable for single-process development or tests; use a
  * persistent store in production.
  */
-export declare class MemorySessionStore implements SessionStore, BackchannelLogoutStore {
+export declare class MemorySessionStore implements SessionStore, BackchannelLogoutStore, RefreshLockStore {
     #private;
     /** Stores the session under a fresh random id and returns it as the cookie value. */
     create(data: SessionData): Promise<string>;
@@ -139,6 +187,12 @@ export declare class MemorySessionStore implements SessionStore, BackchannelLogo
     update(cookieValue: string, data: SessionData): Promise<string>;
     /** Removes the session record for the given id. */
     destroy(cookieValue: string): Promise<void>;
+    /**
+     * Runs `refresh` once every earlier call for the same session has settled,
+     * so every `HonoBff` sharing this store object refreshes a session once.
+     * Calls for other sessions run alongside.
+     */
+    withRefreshLock<T>(cookieValue: string, refresh: () => Promise<T>): Promise<T>;
     /**
      * Destroys the sessions a validated logout_token targets: the specific `sid`
      * when given, otherwise every session for `sub`. Returns the number

package/dist/adapters/hono/bff/session-store.js

@@ -30,6 +30,10 @@ export function supportsBackchannelLogout(store) {
     return (typeof store.destroyByLogout ===
         "function");
 }
+/** Whether a store implements the {@link RefreshLockStore} capability. */
+export function supportsRefreshLock(store) {
+    return (typeof store.withRefreshLock === "function");
+}
 /**
  * Default session lifetime — 14 days — shared by
  * {@link EncryptedCookieSessionStore} and `HonoBff`'s
@@ -58,6 +62,7 @@ export function sessionStoreMaxAgeMs(store) {
  */
 export class MemorySessionStore {
     #sessions = new Map();
+    #refreshLocks = new Map();
     /** Stores the session under a fresh random id and returns it as the cookie value. */
     create(data) {
         const id = crypto.randomUUID();
@@ -81,6 +86,25 @@ export class MemorySessionStore {
         this.#sessions.delete(cookieValue);
         return Promise.resolve();
     }
+    /**
+     * Runs `refresh` once every earlier call for the same session has settled,
+     * so every `HonoBff` sharing this store object refreshes a session once.
+     * Calls for other sessions run alongside.
+     */
+    async withRefreshLock(cookieValue, refresh) {
+        const previous = this.#refreshLocks.get(cookieValue) ?? Promise.resolve();
+        const run = previous.then(refresh);
+        const released = run.then(() => undefined, () => undefined);
+        this.#refreshLocks.set(cookieValue, released);
+        try {
+            return await run;
+        }
+        finally {
+            if (this.#refreshLocks.get(cookieValue) === released) {
+                this.#refreshLocks.delete(cookieValue);
+            }
+        }
+    }
     /**
      * Destroys the sessions a validated logout_token targets: the specific `sid`
      * when given, otherwise every session for `sub`. Returns the number

package/dist/adapters/hono/bff/testing.d.ts

@@ -10,7 +10,8 @@
  * The runner-style helper {@link runSessionStoreContractTests} is
  * available for verifying custom {@link SessionStore} implementations
  * (Postgres, Redis, DynamoDB, …) satisfy the create / read / update /
- * destroy contract.
+ * destroy contract, and the refresh lock when the store implements
+ * `RefreshLockStore`.
  *
  * @module
  */
@@ -171,5 +172,11 @@ export interface SessionStoreContractOptions {
  * module's top level. It does not check that a stateful store's `update`
  * rejects a missing or destroyed session, which {@link SessionStore.update}
  * requires — test that yourself.
+ *
+ * A store that implements `withRefreshLock` ({@link RefreshLockStore}) also
+ * runs the lock checks; they are skipped for a store without it. They use one
+ * store object, so they prove the lock's behavior, not that separate
+ * instances share it: point two store objects at one backend in a test of
+ * your own for that.
  */
 export declare function runSessionStoreContractTests(options: SessionStoreContractOptions): void;

package/dist/adapters/hono/bff/testing.js

@@ -10,13 +10,14 @@
  * The runner-style helper {@link runSessionStoreContractTests} is
  * available for verifying custom {@link SessionStore} implementations
  * (Postgres, Redis, DynamoDB, …) satisfy the create / read / update /
- * destroy contract.
+ * destroy contract, and the refresh lock when the store implements
+ * `RefreshLockStore`.
  *
  * @module
  */
 import { assert, beforeEach, describe, expect, it } from "vitest";
 import { delay } from "../../../utils/_delay.js";
-import { sessionStoreMaxAgeMs, } from "./session-store.js";
+import { sessionStoreMaxAgeMs, supportsRefreshLock, } from "./session-store.js";
 /**
  * Seeds a session in `bff.sessionStore` and returns a `Cookie` header
  * value (`<name>=<value>`) ready to attach to subsequent
@@ -165,12 +166,36 @@ function parseCookieHeader(header, name) {
     throw new Error(`parseCookieHeader: cookie "${name}" not found in header "${header}"`);
 }
 const BOUND_MS = 1000;
+const LOCK_WAIT_MS = 2000;
+const LOCK_CONTENTION_MS = 100;
+async function settlesWithin(promise, message) {
+    const timer = new AbortController();
+    const { signal } = timer;
+    const timedOut = Symbol("timed out");
+    try {
+        const result = await Promise.race([
+            promise,
+            delay(LOCK_WAIT_MS, { signal }).then(() => timedOut),
+        ]);
+        assert(result !== timedOut, message);
+        return result;
+    }
+    finally {
+        timer.abort();
+    }
+}
 /**
  * Contract test suite for {@link SessionStore} implementations. Registers
  * `describe`/`it` blocks from Vitest, so call it at a test
  * module's top level. It does not check that a stateful store's `update`
  * rejects a missing or destroyed session, which {@link SessionStore.update}
  * requires — test that yourself.
+ *
+ * A store that implements `withRefreshLock` ({@link RefreshLockStore}) also
+ * runs the lock checks; they are skipped for a store without it. They use one
+ * store object, so they prove the lock's behavior, not that separate
+ * instances share it: point two store objects at one backend in a test of
+ * your own for that.
  */
 export function runSessionStoreContractTests(options) {
     const destroyClearsRead = options.destroyClearsRead ?? true;
@@ -244,6 +269,95 @@ export function runSessionStoreContractTests(options) {
                 "session does. Supply makeBoundedStore so the contract can prove " +
                 "the bound is real.").toStrictEqual(false);
         });
+        function lockStore(skip) {
+            skip(!supportsRefreshLock(store), "the store does not implement withRefreshLock");
+            return store;
+        }
+        it("withRefreshLock runs one refresh of a session at a time", async ({ skip, }) => {
+            const locking = lockStore(skip);
+            const value = await locking.create(sampleSession());
+            const firstStarted = Promise.withResolvers();
+            const releaseFirst = Promise.withResolvers();
+            const order = [];
+            const first = locking.withRefreshLock(value, async () => {
+                order.push("first started");
+                firstStarted.resolve();
+                await releaseFirst.promise;
+                order.push("first settled");
+                return "first";
+            });
+            await settlesWithin(firstStarted.promise, "withRefreshLock never ran a refresh on a session nobody else holds");
+            const second = locking.withRefreshLock(value, () => {
+                order.push("second started");
+                return Promise.resolve("second");
+            });
+            await delay(LOCK_CONTENTION_MS);
+            expect(order, "a second refresh of one session started while the first still held " +
+                "the lock, so both would spend the same refresh token").toStrictEqual(["first started"]);
+            releaseFirst.resolve();
+            expect(await settlesWithin(Promise.all([first, second]), "the second refresh never ran after the first released the lock")).toStrictEqual(["first", "second"]);
+            expect(order).toStrictEqual([
+                "first started",
+                "first settled",
+                "second started",
+            ]);
+        });
+        it("withRefreshLock does not hold up another session's refresh", async ({ skip, }) => {
+            const locking = lockStore(skip);
+            const held = await locking.create(sampleSession());
+            const other = await locking.create(sampleSession());
+            const releaseHeld = Promise.withResolvers();
+            const holding = locking.withRefreshLock(held, () => releaseHeld.promise);
+            expect(await settlesWithin(locking.withRefreshLock(other, () => Promise.resolve("other")), "a refresh of one session waited on another session's lock")).toBe("other");
+            releaseHeld.resolve();
+            await holding;
+        });
+        it("withRefreshLock lets the refresh read and update the session it locks", async ({ skip, }) => {
+            const locking = lockStore(skip);
+            const value = await locking.create(sampleSession());
+            const updated = {
+                ...sampleSession(),
+                tokens: { ...sampleSession().tokens, accessToken: "access-2" },
+                refreshToken: "refresh-2",
+            };
+            const fetched = await settlesWithin(locking.withRefreshLock(value, async () => {
+                const next = await locking.update(value, updated);
+                return await locking.read(next);
+            }), "read or update blocked inside withRefreshLock: HonoBff reads and " +
+                "writes the session while it holds the lock, so it would deadlock");
+            expect(fetched?.tokens.accessToken).toBe("access-2");
+            expect(fetched?.refreshToken).toBe("refresh-2");
+        });
+        it("withRefreshLock lets the refresh destroy the session it locks", async ({ skip, }) => {
+            const locking = lockStore(skip);
+            const value = await locking.create(sampleSession());
+            await settlesWithin(locking.withRefreshLock(value, () => locking.destroy(value)), "destroy blocked inside withRefreshLock: HonoBff destroys the " +
+                "session it locks when the authorization server refuses the " +
+                "refresh, so it would deadlock");
+        });
+        it("withRefreshLock runs a refresh that was waiting when the holder threw", async ({ skip, }) => {
+            const locking = lockStore(skip);
+            const value = await locking.create(sampleSession());
+            const failure = new Error("token endpoint unreachable");
+            const releaseFirst = Promise.withResolvers();
+            const first = locking.withRefreshLock(value, async () => {
+                await releaseFirst.promise;
+                throw failure;
+            });
+            const waiting = locking.withRefreshLock(value, () => Promise.resolve("waiting"));
+            releaseFirst.resolve();
+            await expect(first).rejects.toBe(failure);
+            expect(await settlesWithin(waiting.catch((error) => error), "a refresh queued behind one that threw never ran, so every " +
+                "request waiting on that session hangs"), "a refresh queued behind one that threw must run, not inherit its error").toBe("waiting");
+        });
+        it("withRefreshLock releases the lock when the refresh throws", async ({ skip, }) => {
+            const locking = lockStore(skip);
+            const value = await locking.create(sampleSession());
+            const failure = new Error("token endpoint unreachable");
+            await expect(locking.withRefreshLock(value, () => Promise.reject(failure))).rejects.toBe(failure);
+            expect(await settlesWithin(locking.withRefreshLock(value, () => Promise.resolve("next")), "a refresh that threw kept the lock, so the session can never " +
+                "refresh again")).toBe("next");
+        });
         if (makeBoundedStore) {
             it("reports the max age it was built with, so a BFF can outlive it", async () => {
                 const bounded = await makeBoundedStore(BOUND_MS);

package/dist/cli/idp/server.js

@@ -23,6 +23,7 @@ import { PasswordGrant } from "../../server/grants/password.js";
 import { RefreshTokenGrant } from "../../server/grants/refresh-token.js";
 import { StaticSigningKeyProvider, } from "../../server/signing-keys.js";
 import { generateCodeChallenge, generateCodeVerifier, generateState, } from "../../utils/pkce.js";
+import { DEFAULT_MAX_BODY_BYTES, readBoundedBody } from "../../utils/_body.js";
 import { timingSafeEqualString } from "../../utils/crypto.js";
 import { safeReturnTo } from "../../utils/url.js";
 import { MemoryAuthorizationCodeService, MemoryClientService, MemoryTokenService, MemoryUserService, } from "../../testing/services.js";
@@ -218,8 +219,22 @@ function handleConsentFor(state, request) {
         }));
     };
 }
+class BodyTooLargeError extends Error {
+}
+async function readBody(request) {
+    const bytes = await readBoundedBody(request, DEFAULT_MAX_BODY_BYTES);
+    if (!bytes) {
+        throw new BodyTooLargeError(`request body exceeds ${DEFAULT_MAX_BODY_BYTES} bytes`);
+    }
+    return bytes;
+}
+async function readFormBody(request) {
+    return await new Response(await readBody(request), {
+        headers: { "content-type": request.headers.get("content-type") ?? "" },
+    }).formData();
+}
 async function handleLoginSubmission(state, config, request) {
-    const form = await request.formData();
+    const form = await readFormBody(request);
     const returnTo = safeReturnTo(formValue(form, "return_to"));
     const quickSignIn = formValue(form, "as");
     let user;
@@ -252,7 +267,7 @@ async function handleConsentSubmission(state, request) {
     const user = await currentUser(state, request);
     if (!user)
         return redirect("/login");
-    const form = await request.formData();
+    const form = await readFormBody(request);
     const returnTo = safeReturnTo(formValue(form, "return_to"));
     const target = new URL(returnTo, request.url);
     const clientId = target.searchParams.get("client_id");
@@ -294,7 +309,7 @@ function handleLogout(state, config, request) {
     });
 }
 async function readJsonBody(request) {
-    const text = await request.text();
+    const text = new TextDecoder().decode(await readBody(request));
     if (text.trim().length === 0)
         return {};
     const parsed = JSON.parse(text);
@@ -522,7 +537,7 @@ export async function startDevIdentityProvider(options) {
             }
         }
         catch (error) {
-            return jsonError(400, error instanceof Error ? error.message : String(error));
+            return jsonError(error instanceof BodyTooLargeError ? 413 : 400, error instanceof Error ? error.message : String(error));
         }
     };
     const server = serveNode({

package/dist/identity/external/_shared.d.ts

@@ -24,10 +24,25 @@ export declare const ID_TOKEN_EXPIRY_LEEWAY_SECONDS = 120;
  * OAuth2 error carries a description the provider wrote.
  */
 export declare function describeError(error: unknown): string;
+/**
+ * Response bytes a connector reads from a provider endpoint — token, profile,
+ * UserInfo, or key set — before refusing the response.
+ */
+export declare const MAX_PROVIDER_RESPONSE_BYTES: number;
+/**
+ * Reads `res`'s body as text, stopping and cancelling it past
+ * {@link MAX_PROVIDER_RESPONSE_BYTES}. `source` names the endpoint in the
+ * error message, e.g. `"the Acme profile endpoint"`.
+ *
+ * @throws {ExternalAuthError} `provider_error` when the body is larger than
+ *   the cap or stops arriving.
+ */
+export declare function readProviderText(res: Response, provider: string, source: string): Promise<string>;
 /**
  * Reads a failed response's body into a bounded, single-line `": <text>"`
- * suffix to append to an error message, or `""` when the body is empty or
- * unreadable. Consumes the body, so the caller must not read it again.
+ * suffix to append to an error message, or `""` when the body is empty,
+ * unreadable, or larger than {@link MAX_PROVIDER_RESPONSE_BYTES}. Consumes
+ * the body, so the caller must not read it again.
  */
 export declare function readErrorBody(res: Response): Promise<string>;
 /**

package/dist/identity/external/_shared.js

@@ -9,6 +9,7 @@
  * @module
  */
 import { isOAuth2Error } from "../../errors.js";
+import { readBoundedBody } from "../../utils/_body.js";
 import { timingSafeEqualString } from "../../utils/crypto.js";
 import { PROVIDER_TEXT_MAX_LENGTH, sanitizeProviderText, } from "../../utils/text.js";
 import { ExternalAuthError } from "./errors.js";
@@ -36,14 +37,45 @@ export function describeError(error) {
     }
     return sanitizeProviderText(error instanceof Error ? error.message : String(error));
 }
+/**
+ * Response bytes a connector reads from a provider endpoint — token, profile,
+ * UserInfo, or key set — before refusing the response.
+ */
+export const MAX_PROVIDER_RESPONSE_BYTES = 64 * 1024;
+/**
+ * Reads `res`'s body as text, stopping and cancelling it past
+ * {@link MAX_PROVIDER_RESPONSE_BYTES}. `source` names the endpoint in the
+ * error message, e.g. `"the Acme profile endpoint"`.
+ *
+ * @throws {ExternalAuthError} `provider_error` when the body is larger than
+ *   the cap or stops arriving.
+ */
+export async function readProviderText(res, provider, source) {
+    let bytes;
+    try {
+        bytes = await readBoundedBody(res, MAX_PROVIDER_RESPONSE_BYTES);
+    }
+    catch (error) {
+        throw new ExternalAuthError(provider, "provider_error", `${source} response could not be read (${describeError(error)}).`, { cause: error });
+    }
+    if (!bytes) {
+        throw new ExternalAuthError(provider, "provider_error", `${source} response exceeded ${MAX_PROVIDER_RESPONSE_BYTES} bytes — ` +
+            `refusing to parse a response this large.`);
+    }
+    return new TextDecoder().decode(bytes);
+}
 /**
  * Reads a failed response's body into a bounded, single-line `": <text>"`
- * suffix to append to an error message, or `""` when the body is empty or
- * unreadable. Consumes the body, so the caller must not read it again.
+ * suffix to append to an error message, or `""` when the body is empty,
+ * unreadable, or larger than {@link MAX_PROVIDER_RESPONSE_BYTES}. Consumes
+ * the body, so the caller must not read it again.
  */
 export async function readErrorBody(res) {
     try {
-        const snippet = sanitizeProviderText(await res.text());
+        const bytes = await readBoundedBody(res, MAX_PROVIDER_RESPONSE_BYTES);
+        if (!bytes)
+            return "";
+        const snippet = sanitizeProviderText(new TextDecoder().decode(bytes));
         return snippet ? `: ${snippet}` : "";
     }
     catch {

package/dist/identity/external/_token-exchange.js

@@ -9,10 +9,10 @@
  * @module
  */
 import { packageDeadlineSignal } from "../../utils/_default-fetch.js";
-import { describeError, sanitizeProviderText } from "./_shared.js";
+import { describeError, MAX_PROVIDER_RESPONSE_BYTES, sanitizeProviderText, } from "./_shared.js";
 import { ExternalAuthError } from "./errors.js";
 /** Response bytes accepted from a token endpoint before the exchange is refused. */
-export const MAX_TOKEN_RESPONSE_BYTES = 64 * 1024;
+export const MAX_TOKEN_RESPONSE_BYTES = MAX_PROVIDER_RESPONSE_BYTES;
 /** Wall-clock budget for the exchange, covering the connect and the body read. */
 export const TOKEN_EXCHANGE_TIMEOUT_MS = 10_000;
 /**

package/dist/identity/external/apple.js

@@ -18,7 +18,7 @@
 import { toArrayBuffer } from "../../utils/_buffer.js";
 import { base64urlDecode } from "../../utils/crypto.js";
 import { defaultFetch } from "../../utils/_default-fetch.js";
-import { assertIdTokenClaims, describeError } from "./_shared.js";
+import { assertIdTokenClaims, describeError, readProviderText, } from "./_shared.js";
 import { runTokenExchange } from "./_token-exchange.js";
 import { createAppleClientSecretFactory, } from "./apple-client-secret.js";
 import { ExternalAuthError } from "./errors.js";
@@ -110,9 +110,10 @@ export function appleProvider(options) {
             await res.body?.cancel();
             throw new ExternalAuthError(id, "provider_error", `Apple's JWKS endpoint responded with HTTP ${res.status}.`);
         }
+        const text = await readProviderText(res, id, "Apple's JWKS endpoint");
         let doc;
         try {
-            doc = (await res.json());
+            doc = JSON.parse(text);
         }
         catch (error) {
             throw new ExternalAuthError(id, "provider_error", `Apple's JWKS endpoint returned invalid JSON (${describeError(error)}).`, { cause: error });

package/dist/identity/external/github.js

@@ -5,7 +5,7 @@
  * @module
  */
 import { defaultFetch } from "../../utils/_default-fetch.js";
-import { describeError } from "./_shared.js";
+import { describeError, readProviderText } from "./_shared.js";
 import { runTokenExchange } from "./_token-exchange.js";
 import { ExternalAuthError } from "./errors.js";
 const GITHUB_AUTHORIZE_URL = "https://github.com/login/oauth/authorize";
@@ -74,8 +74,9 @@ export function githubProvider(options) {
             await res.body?.cancel();
             return null;
         }
+        const text = await readProviderText(res, id, url);
         try {
-            return await res.json();
+            return JSON.parse(text);
         }
         catch (error) {
             throw new ExternalAuthError(id, "provider_error", `${url} returned a response that was not valid JSON ` +

package/dist/identity/external/oauth2.js

@@ -9,7 +9,7 @@
  */
 import { defaultFetch } from "../../utils/_default-fetch.js";
 import { generateCodeChallenge } from "../../utils/pkce.js";
-import { describeError, readErrorBody } from "./_shared.js";
+import { describeError, readErrorBody, readProviderText } from "./_shared.js";
 import { runTokenExchange } from "./_token-exchange.js";
 import { ExternalAuthError } from "./errors.js";
 /**
@@ -85,8 +85,9 @@ export function oauth2Provider(options) {
                 `access token was issued but lacks profile access — ensure the ` +
                 `identity scope is requested.`);
         }
+        const text = await readProviderText(res, id, `the ${options.displayName} profile endpoint`);
         try {
-            return (await res.json());
+            return JSON.parse(text);
         }
         catch (error) {
             throw new ExternalAuthError(id, "provider_error", `the ${options.displayName} profile endpoint returned a response ` +

package/dist/identity/external/oidc.js

@@ -9,7 +9,7 @@ import { MemoryAuthRequestStorage } from "../../client/storage.js";
 import { isOAuth2Error } from "../../errors.js";
 import { defaultFetch } from "../../utils/_default-fetch.js";
 import { generateCodeChallenge } from "../../utils/pkce.js";
-import { assertIdTokenClaims, describeError, stripTrailingSlash, } from "./_shared.js";
+import { assertIdTokenClaims, describeError, readProviderText, stripTrailingSlash, } from "./_shared.js";
 import { ExternalAuthError } from "./errors.js";
 /**
  * Creates a connector for any spec-compliant OpenID Connect provider.
@@ -153,7 +153,7 @@ export function oidcProvider(options) {
                 await res.body?.cancel();
                 return null;
             }
-            const info = (await res.json());
+            const info = JSON.parse(await readProviderText(res, id, "the UserInfo endpoint"));
             return info.sub === idTokenSub ? info : null;
         }
         catch {

package/dist/identity/hibp.d.ts

@@ -32,6 +32,14 @@ export interface BreachedPasswordOptions {
     failOpen?: boolean;
     /** Abort the range request after this many ms. Defaults to 3000. */
     timeoutMs?: number;
+    /**
+     * Largest range response, in bytes, the check reads. Defaults to 1048576
+     * (1 MiB), about ten times a padded range. The read counts bytes as they
+     * arrive and cancels the response at the cap, whether or not it has a
+     * `Content-Length`; a larger response counts as the range API being
+     * unavailable, so `failOpen` decides the outcome.
+     */
+    maxResponseBytes?: number;
     /** Fetch implementation — inject for tests. Defaults to `globalThis.fetch`. */
     fetch?: typeof fetch;
     /** Range API base URL. Defaults to `https://api.pwnedpasswords.com/range/`. */
@@ -56,6 +64,8 @@ export declare function sha1Hex(input: string): Promise<string>;
  * Build a {@link PasswordPolicy} validator that rejects passwords found in the
  * HIBP breach corpus.
  *
+ * @throws {RangeError} If `maxResponseBytes` is not a positive integer.
+ *
  * @example
  * ```ts
  * const policy: PasswordPolicy = {

package/dist/identity/hibp.js

@@ -17,10 +17,12 @@
  *
  * @module
  */
+import { assertMaxBodyBytes, readBoundedBody } from "../utils/_body.js";
 import { encodeHex } from "../utils/_encoding.js";
 import { defaultFetch, packageDeadlineSignal, } from "../utils/_default-fetch.js";
 import { dispatchIdentityEvent } from "./events.js";
 const DEFAULT_BASE_URL = "https://api.pwnedpasswords.com/range/";
+const DEFAULT_MAX_RESPONSE_BYTES = 1024 * 1024;
 const VALIDATOR_NAME = "breached_password";
 const BREACHED_MESSAGE = "This password has appeared in a data breach; choose a different one.";
 const UNAVAILABLE_MESSAGE = "The password couldn't be checked against known breaches; try again.";
@@ -33,6 +35,8 @@ export async function sha1Hex(input) {
  * Build a {@link PasswordPolicy} validator that rejects passwords found in the
  * HIBP breach corpus.
  *
+ * @throws {RangeError} If `maxResponseBytes` is not a positive integer.
+ *
  * @example
  * ```ts
  * const policy: PasswordPolicy = {
@@ -45,6 +49,8 @@ export function breachedPasswordValidator(options = {}) {
     const threshold = options.threshold ?? 1;
     const failOpen = options.failOpen ?? true;
     const timeoutMs = options.timeoutMs ?? 3000;
+    const maxResponseBytes = options.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES;
+    assertMaxBodyBytes(maxResponseBytes, "maxResponseBytes");
     const fetchImpl = options.fetch ?? defaultFetch;
     const baseUrl = options.baseUrl ?? DEFAULT_BASE_URL;
     const onEvent = options.onEvent;
@@ -61,7 +67,11 @@ export function breachedPasswordValidator(options = {}) {
                 await response.body?.cancel();
                 throw new Error(`range API responded ${response.status}`);
             }
-            const body = await response.text();
+            const bytes = await readBoundedBody(response, maxResponseBytes);
+            if (!bytes) {
+                throw new Error(`range API response exceeded ${maxResponseBytes} bytes`);
+            }
+            const body = new TextDecoder().decode(bytes);
             for (const line of body.split("\n")) {
                 const [lineSuffix, countText] = line.trim().split(":");
                 if (lineSuffix === suffix && Number(countText) >= threshold) {

package/dist/server/_response-json.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Not part of the public API. The bounded JSON read the token readers apply
+ * to the responses of the authorization server they call.
+ *
+ * @module
+ */
+/**
+ * Parses `response`'s body as JSON, reading at most `maxBytes`. `label`
+ * names the response in error messages.
+ *
+ * @throws {ServerError} When the body exceeds `maxBytes` (the read stops and
+ *   the body is cancelled) or is not JSON.
+ * @throws {TemporarilyUnavailableError} When the body stops arriving before it
+ *   is complete: the deadline fired or the connection dropped mid-body.
+ */
+export declare function readResponseJson(response: Response, maxBytes: number, label: string): Promise<unknown>;

package/dist/server/_response-json.js

@@ -0,0 +1,35 @@
+/**
+ * Not part of the public API. The bounded JSON read the token readers apply
+ * to the responses of the authorization server they call.
+ *
+ * @module
+ */
+import { ServerError, TemporarilyUnavailableError } from "../errors.js";
+import { readBoundedBody } from "../utils/_body.js";
+/**
+ * Parses `response`'s body as JSON, reading at most `maxBytes`. `label`
+ * names the response in error messages.
+ *
+ * @throws {ServerError} When the body exceeds `maxBytes` (the read stops and
+ *   the body is cancelled) or is not JSON.
+ * @throws {TemporarilyUnavailableError} When the body stops arriving before it
+ *   is complete: the deadline fired or the connection dropped mid-body.
+ */
+export async function readResponseJson(response, maxBytes, label) {
+    let bytes;
+    try {
+        bytes = await readBoundedBody(response, maxBytes);
+    }
+    catch (cause) {
+        throw new TemporarilyUnavailableError(`${label} request failed`, { cause });
+    }
+    if (!bytes) {
+        throw new ServerError(`${label} response exceeded ${maxBytes} bytes`);
+    }
+    try {
+        return JSON.parse(new TextDecoder().decode(bytes));
+    }
+    catch (cause) {
+        throw new ServerError(`${label} response was not JSON`, { cause });
+    }
+}

package/dist/server/introspection-token-reader.d.ts

@@ -67,6 +67,13 @@ export interface IntrospectionTokenReaderOptions<Client extends ClientInterface,
      * {@linkcode fetch} that doesn't honour `AbortSignal`.
      */
     fetchTimeoutMs?: number;
+    /**
+     * Largest introspection response, in bytes, the reader accepts. Defaults to
+     * 65536 (64 KiB). The read counts bytes as they arrive and cancels the
+     * response at the cap, whether or not it has a `Content-Length`; a larger
+     * response throws {@linkcode ServerError}.
+     */
+    maxResponseBytes?: number;
     /**
      * `fetch` implementation used to call the introspection endpoint. Defaults
      * to the global `fetch`. Inject it to route through a custom client (mTLS,
@@ -127,10 +134,14 @@ export declare class IntrospectionTokenReader<Client extends ClientInterface, Us
     private getClient;
     private getUser?;
     private fetchTimeoutMs;
+    private maxResponseBytes;
     private customFetch?;
     /**
-     * `Scope` defaults to {@linkcode BasicScope}, `fetchTimeoutMs` to 5000, and
-     * `fetch` to the global `fetch` when omitted from `options`.
+     * `Scope` defaults to {@linkcode BasicScope}, `fetchTimeoutMs` to 5000,
+     * `maxResponseBytes` to 65536, and `fetch` to the global `fetch` when
+     * omitted from `options`.
+     *
+     * @throws {RangeError} If `maxResponseBytes` is not a positive integer.
      */
     constructor(options: IntrospectionTokenReaderOptions<Client, User, S>);
     /**
@@ -149,9 +160,10 @@ export declare class IntrospectionTokenReader<Client extends ClientInterface, Us
      *   a genuinely invalid token (which is `undefined` → `invalid_token`), not
      *   collapsed into it.
      * @throws {ServerError} If the endpoint returns any other non-2xx status
-     *   (e.g. the reader's own introspection credentials are rejected) or a body
-     *   that is not JSON — a misconfiguration, not a verdict on the caller's
-     *   token.
+     *   (e.g. the reader's own introspection credentials are rejected), a body
+     *   that is not JSON, or one larger than
+     *   {@linkcode IntrospectionTokenReaderOptions.maxResponseBytes} — a
+     *   misconfiguration, not a verdict on the caller's token.
      *
      * An active response is only accepted when its `token_type` names a bearer
      * token. RFC 7662 answers for refresh tokens too, and a refresh token's

package/dist/server/introspection-token-reader.js

@@ -12,6 +12,8 @@
 import { ServerError, TemporarilyUnavailableError } from "../errors.js";
 import { BasicScope } from "../models/scope.js";
 import { encodeBasicAuth } from "../utils/basic-auth.js";
+import { assertMaxBodyBytes, DEFAULT_MAX_RESPONSE_BYTES, } from "../utils/_body.js";
+import { readResponseJson } from "./_response-json.js";
 import { defaultFetch, packageDeadlineSignal, } from "../utils/_default-fetch.js";
 /**
  * Validates tokens by calling an OAuth2 introspection endpoint (RFC 7662).
@@ -62,10 +64,14 @@ export class IntrospectionTokenReader {
     getClient;
     getUser;
     fetchTimeoutMs;
+    maxResponseBytes;
     customFetch;
     /**
-     * `Scope` defaults to {@linkcode BasicScope}, `fetchTimeoutMs` to 5000, and
-     * `fetch` to the global `fetch` when omitted from `options`.
+     * `Scope` defaults to {@linkcode BasicScope}, `fetchTimeoutMs` to 5000,
+     * `maxResponseBytes` to 65536, and `fetch` to the global `fetch` when
+     * omitted from `options`.
+     *
+     * @throws {RangeError} If `maxResponseBytes` is not a positive integer.
      */
     constructor(options) {
         this.introspectionEndpoint = options.introspectionEndpoint;
@@ -76,6 +82,9 @@ export class IntrospectionTokenReader {
         this.getClient = options.getClient;
         this.getUser = options.getUser;
         this.fetchTimeoutMs = options.fetchTimeoutMs ?? 5_000;
+        this.maxResponseBytes =
+            options.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES;
+        assertMaxBodyBytes(this.maxResponseBytes, "maxResponseBytes");
         this.customFetch = options.fetch;
     }
     /**
@@ -94,9 +103,10 @@ export class IntrospectionTokenReader {
      *   a genuinely invalid token (which is `undefined` → `invalid_token`), not
      *   collapsed into it.
      * @throws {ServerError} If the endpoint returns any other non-2xx status
-     *   (e.g. the reader's own introspection credentials are rejected) or a body
-     *   that is not JSON — a misconfiguration, not a verdict on the caller's
-     *   token.
+     *   (e.g. the reader's own introspection credentials are rejected), a body
+     *   that is not JSON, or one larger than
+     *   {@linkcode IntrospectionTokenReaderOptions.maxResponseBytes} — a
+     *   misconfiguration, not a verdict on the caller's token.
      *
      * An active response is only accepted when its `token_type` names a bearer
      * token. RFC 7662 answers for refresh tokens too, and a refresh token's
@@ -153,16 +163,7 @@ export class IntrospectionTokenReader {
                     ? new TemporarilyUnavailableError(`token introspection failed (HTTP ${response.status})`)
                     : new ServerError(`token introspection failed (HTTP ${response.status})`);
             }
-            try {
-                return (await response.json());
-            }
-            catch (cause) {
-                throw controller.signal.aborted
-                    ? new TemporarilyUnavailableError("token introspection request failed", { cause })
-                    : new ServerError("token introspection response was not JSON", {
-                        cause,
-                    });
-            }
+            return (await readResponseJson(response, this.maxResponseBytes, "token introspection"));
         }
         finally {
             clearTimeout(deadline);

package/dist/server/jwks-token-reader.d.ts

@@ -146,6 +146,14 @@ export interface JwksTokenReaderOptions<Client extends ClientInterface, User, S
      * {@linkcode fetch} that doesn't honour `AbortSignal`.
      */
     fetchTimeoutMs?: number;
+    /**
+     * Largest discovery document or JWKS, in bytes, the reader accepts.
+     * Defaults to 262144 (256 KiB). The read counts bytes as they arrive and
+     * cancels the response at the cap, whether or not it has a
+     * `Content-Length`; a larger response fails the refresh with a
+     * {@linkcode ServerError}, as a malformed one does.
+     */
+    maxResponseBytes?: number;
     /** Optional scope constructor for parsing scope strings. Defaults to BasicScope. */
     Scope?: ScopeConstructor<S>;
     /**
@@ -233,14 +241,15 @@ export declare class JwksTokenReader<Client extends ClientInterface, User, S ext
      * Defaults: every Web Crypto asymmetric algorithm accepted, `at+jwt`
      * required as `typ`, `client_id` as the required client-id claim, 30
      * seconds of clock skew, a 10-minute cache with a 30-second minimum
-     * between fetches, a 5-second request deadline, {@linkcode BasicScope},
-     * and the global `fetch`.
+     * between fetches, a 5-second request deadline, a 256 KiB response cap,
+     * {@linkcode BasicScope}, and the global `fetch`.
      *
      * @throws {TypeError} If `issuer` is not an absolute URL, `audience` is
      *   empty, or `algorithms` names an algorithm this package cannot verify
      *   (a silently ignored entry would read as a policy that isn't enforced).
      * @throws {RangeError} If `clockSkewSeconds` is negative, non-finite, or
-     *   overflows when converted to milliseconds.
+     *   overflows when converted to milliseconds, or `maxResponseBytes` is not
+     *   a positive integer.
      */
     constructor(options: JwksTokenReaderOptions<Client, User, S>);
     /**
@@ -263,8 +272,10 @@ export declare class JwksTokenReader<Client extends ClientInterface, User, S ext
      *   invalid token, not collapsed into it. Once keys are cached, a failed
      *   refresh is absorbed and the cached keys keep serving.
      * @throws {ServerError} If, with no keys cached, the JWKS endpoint returns
-     *   a 4xx or a body that is not a JWKS, or discovery reports no `jwks_uri`
-     *   — a misconfiguration, not a verdict on the caller's token.
+     *   a 4xx or a body that is not a JWKS, either document exceeds
+     *   {@linkcode JwksTokenReaderOptions.maxResponseBytes}, or discovery
+     *   reports no `jwks_uri` — a misconfiguration, not a verdict on the
+     *   caller's token.
      */
     getToken(accessToken: string): Promise<Token<Client, User, S> | undefined>;
 }

package/dist/server/jwks-token-reader.js

@@ -14,10 +14,12 @@
  */
 import { ServerError, TemporarilyUnavailableError } from "../errors.js";
 import { BasicScope } from "../models/scope.js";
+import { assertMaxBodyBytes, DEFAULT_MAX_KEY_SET_BYTES, } from "../utils/_body.js";
 import { toArrayBuffer } from "../utils/_buffer.js";
 import { base64urlDecode } from "../utils/crypto.js";
 import { defaultFetch, packageDeadlineSignal, } from "../utils/_default-fetch.js";
 import { assertClockSkewSeconds } from "./_clock-skew.js";
+import { readResponseJson } from "./_response-json.js";
 const ALGORITHMS = {
     ES256: {
         kty: "EC",
@@ -210,6 +212,7 @@ export class JwksTokenReader {
     #cacheMaxAgeMs;
     #minFetchIntervalMs;
     #fetchTimeoutMs;
+    #maxResponseBytes;
     #metadataUrls;
     #Scope;
     #getClient;
@@ -224,14 +227,15 @@ export class JwksTokenReader {
      * Defaults: every Web Crypto asymmetric algorithm accepted, `at+jwt`
      * required as `typ`, `client_id` as the required client-id claim, 30
      * seconds of clock skew, a 10-minute cache with a 30-second minimum
-     * between fetches, a 5-second request deadline, {@linkcode BasicScope},
-     * and the global `fetch`.
+     * between fetches, a 5-second request deadline, a 256 KiB response cap,
+     * {@linkcode BasicScope}, and the global `fetch`.
      *
      * @throws {TypeError} If `issuer` is not an absolute URL, `audience` is
      *   empty, or `algorithms` names an algorithm this package cannot verify
      *   (a silently ignored entry would read as a policy that isn't enforced).
      * @throws {RangeError} If `clockSkewSeconds` is negative, non-finite, or
-     *   overflows when converted to milliseconds.
+     *   overflows when converted to milliseconds, or `maxResponseBytes` is not
+     *   a positive integer.
      */
     constructor(options) {
         this.#issuer = options.issuer;
@@ -255,6 +259,9 @@ export class JwksTokenReader {
         this.#cacheMaxAgeMs = options.cacheMaxAgeMs ?? 600_000;
         this.#minFetchIntervalMs = options.minFetchIntervalMs ?? 30_000;
         this.#fetchTimeoutMs = options.fetchTimeoutMs ?? 5_000;
+        this.#maxResponseBytes =
+            options.maxResponseBytes ?? DEFAULT_MAX_KEY_SET_BYTES;
+        assertMaxBodyBytes(this.#maxResponseBytes, "maxResponseBytes");
         this.#Scope =
             options.Scope ?? BasicScope;
         this.#getClient = options.getClient;
@@ -282,8 +289,10 @@ export class JwksTokenReader {
      *   invalid token, not collapsed into it. Once keys are cached, a failed
      *   refresh is absorbed and the cached keys keep serving.
      * @throws {ServerError} If, with no keys cached, the JWKS endpoint returns
-     *   a 4xx or a body that is not a JWKS, or discovery reports no `jwks_uri`
-     *   — a misconfiguration, not a verdict on the caller's token.
+     *   a 4xx or a body that is not a JWKS, either document exceeds
+     *   {@linkcode JwksTokenReaderOptions.maxResponseBytes}, or discovery
+     *   reports no `jwks_uri` — a misconfiguration, not a verdict on the
+     *   caller's token.
      */
     async getToken(accessToken) {
         const parsed = parseJws(accessToken);
@@ -499,12 +508,7 @@ export class JwksTokenReader {
                     ? new TemporarilyUnavailableError(`${label} request failed (HTTP ${response.status})`)
                     : new ServerError(`${label} request failed (HTTP ${response.status})`);
             }
-            try {
-                return await response.json();
-            }
-            catch (cause) {
-                throw new ServerError(`${label} response was not JSON`, { cause });
-            }
+            return await readResponseJson(response, this.#maxResponseBytes, label);
         }
         finally {
             clearTimeout(deadline);

package/dist/utils/_body.d.ts

@@ -1,6 +1,7 @@
 /**
- * Internal bounded request-body reader for the endpoints that parse a body
- * before they have authenticated the caller.
+ * Internal bounded body reader for the request bodies the endpoints parse
+ * before they have authenticated the caller, and for the responses the
+ * package reads from the servers it calls.
  *
  * @module
  */
@@ -17,20 +18,30 @@ export declare const DEFAULT_MAX_BODY_BYTES: number;
  * block, so any token a client could send as `Authorization: Bearer` fits.
  */
 export declare const DEFAULT_MAX_TOKEN_BODY_BYTES: number;
+/**
+ * The default cap on an introspection response: 64 KiB, the same cap the
+ * clients apply to every authorization-server response.
+ */
+export declare const DEFAULT_MAX_RESPONSE_BYTES: number;
+/**
+ * The default cap on a discovery document or JWKS: 256 KiB, room for dozens
+ * of RSA keys that each carry an X.509 certificate chain.
+ */
+export declare const DEFAULT_MAX_KEY_SET_BYTES: number;
 /**
  * Throws a `RangeError` naming `option` unless `maxBodyBytes` is a positive
  * safe integer.
  */
 export declare function assertMaxBodyBytes(maxBodyBytes: number, option: string): void;
 /**
- * Reads `request`'s body, counting bytes as they arrive, and returns `null`
- * once it exceeds `maxBytes` — cancelling the stream rather than draining it.
- * A `Content-Length` over the cap is refused without reading; one under it is
- * not trusted. Consumes the body unless `keepReadable` is set, which reads a
- * clone and leaves the original readable (a refusal cancels both). Rejects if
- * the stream errors or was already read.
+ * Reads `request`'s body — or a response's — counting bytes as they arrive,
+ * and returns `null` once it exceeds `maxBytes`, cancelling the stream rather
+ * than draining it. A `Content-Length` over the cap is refused without
+ * reading; one under it is not trusted. Consumes the body unless
+ * `keepReadable` is set, which reads a clone and leaves the original readable
+ * (a refusal cancels both). Rejects if the stream errors or was already read.
  */
-export declare function readBoundedBody(request: Request, maxBytes: number, options?: {
+export declare function readBoundedBody(request: Request | Response, maxBytes: number, options?: {
     keepReadable?: boolean;
 }): Promise<Uint8Array<ArrayBuffer> | null>;
 /**

package/dist/utils/_body.js

@@ -1,6 +1,7 @@
 /**
- * Internal bounded request-body reader for the endpoints that parse a body
- * before they have authenticated the caller.
+ * Internal bounded body reader for the request bodies the endpoints parse
+ * before they have authenticated the caller, and for the responses the
+ * package reads from the servers it calls.
  *
  * @module
  */
@@ -17,6 +18,16 @@ export const DEFAULT_MAX_BODY_BYTES = 64 * 1024;
  * block, so any token a client could send as `Authorization: Bearer` fits.
  */
 export const DEFAULT_MAX_TOKEN_BODY_BYTES = 16 * 1024;
+/**
+ * The default cap on an introspection response: 64 KiB, the same cap the
+ * clients apply to every authorization-server response.
+ */
+export const DEFAULT_MAX_RESPONSE_BYTES = 64 * 1024;
+/**
+ * The default cap on a discovery document or JWKS: 256 KiB, room for dozens
+ * of RSA keys that each carry an X.509 certificate chain.
+ */
+export const DEFAULT_MAX_KEY_SET_BYTES = 256 * 1024;
 /**
  * Throws a `RangeError` naming `option` unless `maxBodyBytes` is a positive
  * safe integer.
@@ -27,12 +38,12 @@ export function assertMaxBodyBytes(maxBodyBytes, option) {
     }
 }
 /**
- * Reads `request`'s body, counting bytes as they arrive, and returns `null`
- * once it exceeds `maxBytes` — cancelling the stream rather than draining it.
- * A `Content-Length` over the cap is refused without reading; one under it is
- * not trusted. Consumes the body unless `keepReadable` is set, which reads a
- * clone and leaves the original readable (a refusal cancels both). Rejects if
- * the stream errors or was already read.
+ * Reads `request`'s body — or a response's — counting bytes as they arrive,
+ * and returns `null` once it exceeds `maxBytes`, cancelling the stream rather
+ * than draining it. A `Content-Length` over the cap is refused without
+ * reading; one under it is not trusted. Consumes the body unless
+ * `keepReadable` is set, which reads a clone and leaves the original readable
+ * (a refusal cancels both). Rejects if the stream errors or was already read.
  */
 export async function readBoundedBody(request, maxBytes, options = {}) {
     if (!request.body)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@udibo/oauth2",
-  "version": "0.20.0",
+  "version": "0.21.1",
   "description": "A flexible OAuth2 toolkit: framework-agnostic authorization & resource servers, a typed client, Hono adapters (including a backend-for-frontend), and React bindings.",
   "keywords": [
     "authorization-server",