@udibo/oauth2 0.21.0 → 0.21.2

package/dist/adapters/hono/bff/bff.d.ts

@@ -319,10 +319,14 @@ export interface HonoBffOptions {
      *   server-side store is needed. It cannot list sessions, so it does not
      *   support {@link HonoBffOptions.backchannelLogout}, and sign-out cannot
      *   invalidate a copied cookie: it stays valid until its `maxAgeMs`. Use a
-     *   shared {@link SessionStore} when you need revocation.
+     *   shared {@link SessionStore} when you need revocation. Against an
+     *   authorization server that rotates refresh tokens, a request still
+     *   carrying the cookie from before a refresh replays the old token and
+     *   trips reuse detection.
      * - A {@link SessionStore} over a database or cache every instance shares,
-     *   for server-side revocation and back-channel logout. Check it with
-     *   `runSessionStoreContractTests`.
+     *   for server-side revocation and back-channel logout. Implement
+     *   `RefreshLockStore` (`withRefreshLock`) on it so instances refresh a
+     *   session one at a time, and check it with `runSessionStoreContractTests`.
      * - {@link MemorySessionStore} for a single process, tests and local
      *   development. A session it holds is unknown to every other instance, so
      *   behind a load balancer the user appears signed out.

package/dist/adapters/hono/bff/bff.js

@@ -58,8 +58,12 @@ import { sha256Hash } from "../../../server/utils/hash.js";
 import { OAUTH2_CONTEXT_KEY } from "../_common.js";
 import { DEFAULT_MAX_RETURN_TO_LENGTH, loginContinuation as computeLoginContinuation, safeReturnTo, } from "../../../utils/url.js";
 import { resolveCookieName, resolvePrefixConstrainedAttributes, } from "./cookie-prefix.js";
-import { DEFAULT_SESSION_MAX_AGE_MS, sessionStoreMaxAgeMs, supportsBackchannelLogout, } from "./session-store.js";
+import { DEFAULT_SESSION_MAX_AGE_MS, sessionStoreMaxAgeMs, supportsBackchannelLogout, supportsRefreshLock, } from "./session-store.js";
 import { buildDownstreamHeaders, buildUpstreamHeaders, isInvalidTokenChallenge, resolveForwardHeaders, resolveProxyUrl, } from "./proxy.js";
+function refreshedSince(seen, current) {
+    return (current.refreshToken !== seen.refreshToken ||
+        current.tokens.accessToken !== seen.tokens.accessToken);
+}
 function isRevokedGrant(error) {
     if (!isOAuth2Error(error))
         return false;
@@ -1005,12 +1009,35 @@ export class HonoBff {
         const inFlight = this.#refreshes.get(entry.cookieValue);
         if (inFlight)
             return inFlight;
-        const pending = this.#exchangeRefresh(entry).finally(() => {
+        const pending = this.#lockedRefresh(entry).finally(() => {
             this.#refreshes.delete(entry.cookieValue);
         });
         this.#refreshes.set(entry.cookieValue, pending);
         return pending;
     }
+    async #lockedRefresh(entry) {
+        const store = this.#store;
+        if (!supportsRefreshLock(store))
+            return await this.#exchangeRefresh(entry);
+        const { cookieValue } = entry;
+        try {
+            return await store.withRefreshLock(cookieValue, async () => {
+                const current = await store.read(cookieValue);
+                if (!current)
+                    return { status: "revoked" };
+                if (refreshedSince(entry.data, current)) {
+                    return {
+                        status: "refreshed",
+                        entry: { cookieValue, data: current },
+                    };
+                }
+                return await this.#exchangeRefresh({ cookieValue, data: current });
+            });
+        }
+        catch {
+            return { status: "unavailable" };
+        }
+    }
     async #exchangeRefresh(entry) {
         const { cookieValue, data } = entry;
         if (!data.refreshToken)

package/dist/adapters/hono/bff/mod.d.ts

@@ -12,12 +12,13 @@
  * the memory pair serves a single process, tests and local development.
  *
  * Need a server-side store (Postgres, Redis, …)? Implement the
- * {@link SessionStore} interface and verify it with
- * `runSessionStoreContractTests` from `@udibo/oauth2/hono/bff/testing`.
+ * {@link SessionStore} interface, plus {@link RefreshLockStore} when several
+ * instances share it, and verify it with `runSessionStoreContractTests` from
+ * `@udibo/oauth2/hono/bff/testing`.
  *
  * @module
  */
 export { type BackchannelLogoutSubject, type BffCallbackError, HonoBff, type HonoBffBackchannelOptions, type HonoBffCookieOptions, type HonoBffCsrfOptions, type HonoBffOptions, type HonoBffPaths, type HonoBffResourceServer, } from "./bff.ts";
 export { type AuthRequestCookieOptions, type AuthRequestStorageFactory, EncryptedCookieAuthRequestStorage, encryptedCookieAuthRequestStorage, type EncryptedCookieAuthRequestStorageOptions, MemoryAuthRequestStorageFactory, } from "./auth-request-store.ts";
 export { DEFAULT_PROXY_FORWARD_HEADERS, type HonoBffProxyOptions, } from "./proxy.ts";
-export { type BackchannelLogoutStore, type BoundedSessionStore, DEFAULT_SESSION_MAX_AGE_MS, EncryptedCookieSessionStore, type EncryptedCookieSessionStoreOptions, MemorySessionStore, type SessionData, type SessionStore, sessionStoreMaxAgeMs, supportsBackchannelLogout, } from "./session-store.ts";
+export { type BackchannelLogoutStore, type BoundedSessionStore, DEFAULT_SESSION_MAX_AGE_MS, EncryptedCookieSessionStore, type EncryptedCookieSessionStoreOptions, MemorySessionStore, type RefreshLockStore, type SessionData, type SessionStore, sessionStoreMaxAgeMs, supportsBackchannelLogout, } from "./session-store.ts";

package/dist/adapters/hono/bff/mod.js

@@ -12,8 +12,9 @@
  * the memory pair serves a single process, tests and local development.
  *
  * Need a server-side store (Postgres, Redis, …)? Implement the
- * {@link SessionStore} interface and verify it with
- * `runSessionStoreContractTests` from `@udibo/oauth2/hono/bff/testing`.
+ * {@link SessionStore} interface, plus {@link RefreshLockStore} when several
+ * instances share it, and verify it with `runSessionStoreContractTests` from
+ * `@udibo/oauth2/hono/bff/testing`.
  *
  * @module
  */

package/dist/adapters/hono/bff/session-store.d.ts

@@ -69,6 +69,54 @@ export interface BackchannelLogoutStore {
 }
 /** Whether a store implements the {@link BackchannelLogoutStore} capability. */
 export declare function supportsBackchannelLogout(store: SessionStore): store is SessionStore & BackchannelLogoutStore;
+/**
+ * Optional {@link SessionStore} capability: one token refresh at a time per
+ * session, across every instance that shares the store. A store opts in by
+ * implementing this method (it is duck-typed at runtime).
+ *
+ * Without it, `HonoBff` shares a refresh only between requests on the same
+ * instance. Two instances that refresh one session at once both present its
+ * refresh token: against an authorization server that rotates refresh tokens,
+ * the loser's exchange fails, or trips reuse detection and revokes the whole
+ * rotation family, and the user is signed out. With it, the BFF re-reads the
+ * session while it holds the lock and uses a peer's fresh tokens instead of
+ * spending the refresh token again. Implement it on any store more than one
+ * instance shares. {@link EncryptedCookieSessionStore} cannot: its sessions
+ * live in each browser's cookie, with nothing on the server to lock.
+ */
+export interface RefreshLockStore {
+    /**
+     * Runs `refresh` while no other `withRefreshLock` call for the same
+     * `cookieValue`, on any instance, is running, and settles with its result.
+     * Calls for other sessions must not wait on each other.
+     *
+     * - The lock is keyed by the cookie value, so it holds only for a store
+     *   whose `update` returns the cookie value it was given. A store that
+     *   issues a new value on update cannot implement it.
+     * - The lock must not block this store's own `read`, `update` or `destroy`:
+     *   `refresh` reads, writes and can destroy the session it locks.
+     * - Release it when `refresh` settles, including when it throws.
+     * - The lock covers the whole refresh: the token request and the store's
+     *   own reads and writes. With `DirectClient` a refresh can take about 30
+     *   seconds when its discovery cache is cold, since discovery tries two
+     *   well-known paths and every request has a 10-second deadline. If the
+     *   lock expires when its holder dies, expire it only after that plus the
+     *   store's own I/O, or renew the lease while it is held. A lock that
+     *   expires mid-refresh lets a second instance spend the same token.
+     * - Reject when the lock cannot be acquired within a bound you choose.
+     *   `HonoBff` then answers `502` `temporarily_unavailable` and keeps the
+     *   session.
+     *
+     * A Postgres store can hold `pg_advisory_xact_lock` on a hash of the session
+     * key in a transaction around `refresh`, with a `lock_timeout`. A Redis
+     * store can take a key with `SET NX PX` and wait for it with a deadline. Key
+     * the lock by the same digest the store keys its records by, never the raw
+     * cookie value, and include the tenant in a tenant-scoped store.
+     */
+    withRefreshLock<T>(cookieValue: string, refresh: () => Promise<T>): Promise<T>;
+}
+/** Whether a store implements the {@link RefreshLockStore} capability. */
+export declare function supportsRefreshLock(store: SessionStore): store is SessionStore & RefreshLockStore;
 /**
  * Default session lifetime — 14 days — shared by
  * {@link EncryptedCookieSessionStore} and `HonoBff`'s
@@ -129,7 +177,7 @@ export interface SessionStore {
  * restarts. Suitable for single-process development or tests; use a
  * persistent store in production.
  */
-export declare class MemorySessionStore implements SessionStore, BackchannelLogoutStore {
+export declare class MemorySessionStore implements SessionStore, BackchannelLogoutStore, RefreshLockStore {
     #private;
     /** Stores the session under a fresh random id and returns it as the cookie value. */
     create(data: SessionData): Promise<string>;
@@ -139,6 +187,12 @@ export declare class MemorySessionStore implements SessionStore, BackchannelLogo
     update(cookieValue: string, data: SessionData): Promise<string>;
     /** Removes the session record for the given id. */
     destroy(cookieValue: string): Promise<void>;
+    /**
+     * Runs `refresh` once every earlier call for the same session has settled,
+     * so every `HonoBff` sharing this store object refreshes a session once.
+     * Calls for other sessions run alongside.
+     */
+    withRefreshLock<T>(cookieValue: string, refresh: () => Promise<T>): Promise<T>;
     /**
      * Destroys the sessions a validated logout_token targets: the specific `sid`
      * when given, otherwise every session for `sub`. Returns the number

package/dist/adapters/hono/bff/session-store.js

@@ -30,6 +30,10 @@ export function supportsBackchannelLogout(store) {
     return (typeof store.destroyByLogout ===
         "function");
 }
+/** Whether a store implements the {@link RefreshLockStore} capability. */
+export function supportsRefreshLock(store) {
+    return (typeof store.withRefreshLock === "function");
+}
 /**
  * Default session lifetime — 14 days — shared by
  * {@link EncryptedCookieSessionStore} and `HonoBff`'s
@@ -58,6 +62,7 @@ export function sessionStoreMaxAgeMs(store) {
  */
 export class MemorySessionStore {
     #sessions = new Map();
+    #refreshLocks = new Map();
     /** Stores the session under a fresh random id and returns it as the cookie value. */
     create(data) {
         const id = crypto.randomUUID();
@@ -81,6 +86,25 @@ export class MemorySessionStore {
         this.#sessions.delete(cookieValue);
         return Promise.resolve();
     }
+    /**
+     * Runs `refresh` once every earlier call for the same session has settled,
+     * so every `HonoBff` sharing this store object refreshes a session once.
+     * Calls for other sessions run alongside.
+     */
+    async withRefreshLock(cookieValue, refresh) {
+        const previous = this.#refreshLocks.get(cookieValue) ?? Promise.resolve();
+        const run = previous.then(refresh);
+        const released = run.then(() => undefined, () => undefined);
+        this.#refreshLocks.set(cookieValue, released);
+        try {
+            return await run;
+        }
+        finally {
+            if (this.#refreshLocks.get(cookieValue) === released) {
+                this.#refreshLocks.delete(cookieValue);
+            }
+        }
+    }
     /**
      * Destroys the sessions a validated logout_token targets: the specific `sid`
      * when given, otherwise every session for `sub`. Returns the number

package/dist/adapters/hono/bff/testing.d.ts

@@ -10,7 +10,8 @@
  * The runner-style helper {@link runSessionStoreContractTests} is
  * available for verifying custom {@link SessionStore} implementations
  * (Postgres, Redis, DynamoDB, …) satisfy the create / read / update /
- * destroy contract.
+ * destroy contract, and the refresh lock when the store implements
+ * `RefreshLockStore`.
  *
  * @module
  */
@@ -171,5 +172,11 @@ export interface SessionStoreContractOptions {
  * module's top level. It does not check that a stateful store's `update`
  * rejects a missing or destroyed session, which {@link SessionStore.update}
  * requires — test that yourself.
+ *
+ * A store that implements `withRefreshLock` ({@link RefreshLockStore}) also
+ * runs the lock checks; they are skipped for a store without it. They use one
+ * store object, so they prove the lock's behavior, not that separate
+ * instances share it: point two store objects at one backend in a test of
+ * your own for that.
  */
 export declare function runSessionStoreContractTests(options: SessionStoreContractOptions): void;

package/dist/adapters/hono/bff/testing.js

@@ -10,13 +10,14 @@
  * The runner-style helper {@link runSessionStoreContractTests} is
  * available for verifying custom {@link SessionStore} implementations
  * (Postgres, Redis, DynamoDB, …) satisfy the create / read / update /
- * destroy contract.
+ * destroy contract, and the refresh lock when the store implements
+ * `RefreshLockStore`.
  *
  * @module
  */
 import { assert, beforeEach, describe, expect, it } from "vitest";
 import { delay } from "../../../utils/_delay.js";
-import { sessionStoreMaxAgeMs, } from "./session-store.js";
+import { sessionStoreMaxAgeMs, supportsRefreshLock, } from "./session-store.js";
 /**
  * Seeds a session in `bff.sessionStore` and returns a `Cookie` header
  * value (`<name>=<value>`) ready to attach to subsequent
@@ -165,12 +166,36 @@ function parseCookieHeader(header, name) {
     throw new Error(`parseCookieHeader: cookie "${name}" not found in header "${header}"`);
 }
 const BOUND_MS = 1000;
+const LOCK_WAIT_MS = 2000;
+const LOCK_CONTENTION_MS = 100;
+async function settlesWithin(promise, message) {
+    const timer = new AbortController();
+    const { signal } = timer;
+    const timedOut = Symbol("timed out");
+    try {
+        const result = await Promise.race([
+            promise,
+            delay(LOCK_WAIT_MS, { signal }).then(() => timedOut),
+        ]);
+        assert(result !== timedOut, message);
+        return result;
+    }
+    finally {
+        timer.abort();
+    }
+}
 /**
  * Contract test suite for {@link SessionStore} implementations. Registers
  * `describe`/`it` blocks from Vitest, so call it at a test
  * module's top level. It does not check that a stateful store's `update`
  * rejects a missing or destroyed session, which {@link SessionStore.update}
  * requires — test that yourself.
+ *
+ * A store that implements `withRefreshLock` ({@link RefreshLockStore}) also
+ * runs the lock checks; they are skipped for a store without it. They use one
+ * store object, so they prove the lock's behavior, not that separate
+ * instances share it: point two store objects at one backend in a test of
+ * your own for that.
  */
 export function runSessionStoreContractTests(options) {
     const destroyClearsRead = options.destroyClearsRead ?? true;
@@ -244,6 +269,95 @@ export function runSessionStoreContractTests(options) {
                 "session does. Supply makeBoundedStore so the contract can prove " +
                 "the bound is real.").toStrictEqual(false);
         });
+        function lockStore(skip) {
+            skip(!supportsRefreshLock(store), "the store does not implement withRefreshLock");
+            return store;
+        }
+        it("withRefreshLock runs one refresh of a session at a time", async ({ skip, }) => {
+            const locking = lockStore(skip);
+            const value = await locking.create(sampleSession());
+            const firstStarted = Promise.withResolvers();
+            const releaseFirst = Promise.withResolvers();
+            const order = [];
+            const first = locking.withRefreshLock(value, async () => {
+                order.push("first started");
+                firstStarted.resolve();
+                await releaseFirst.promise;
+                order.push("first settled");
+                return "first";
+            });
+            await settlesWithin(firstStarted.promise, "withRefreshLock never ran a refresh on a session nobody else holds");
+            const second = locking.withRefreshLock(value, () => {
+                order.push("second started");
+                return Promise.resolve("second");
+            });
+            await delay(LOCK_CONTENTION_MS);
+            expect(order, "a second refresh of one session started while the first still held " +
+                "the lock, so both would spend the same refresh token").toStrictEqual(["first started"]);
+            releaseFirst.resolve();
+            expect(await settlesWithin(Promise.all([first, second]), "the second refresh never ran after the first released the lock")).toStrictEqual(["first", "second"]);
+            expect(order).toStrictEqual([
+                "first started",
+                "first settled",
+                "second started",
+            ]);
+        });
+        it("withRefreshLock does not hold up another session's refresh", async ({ skip, }) => {
+            const locking = lockStore(skip);
+            const held = await locking.create(sampleSession());
+            const other = await locking.create(sampleSession());
+            const releaseHeld = Promise.withResolvers();
+            const holding = locking.withRefreshLock(held, () => releaseHeld.promise);
+            expect(await settlesWithin(locking.withRefreshLock(other, () => Promise.resolve("other")), "a refresh of one session waited on another session's lock")).toBe("other");
+            releaseHeld.resolve();
+            await holding;
+        });
+        it("withRefreshLock lets the refresh read and update the session it locks", async ({ skip, }) => {
+            const locking = lockStore(skip);
+            const value = await locking.create(sampleSession());
+            const updated = {
+                ...sampleSession(),
+                tokens: { ...sampleSession().tokens, accessToken: "access-2" },
+                refreshToken: "refresh-2",
+            };
+            const fetched = await settlesWithin(locking.withRefreshLock(value, async () => {
+                const next = await locking.update(value, updated);
+                return await locking.read(next);
+            }), "read or update blocked inside withRefreshLock: HonoBff reads and " +
+                "writes the session while it holds the lock, so it would deadlock");
+            expect(fetched?.tokens.accessToken).toBe("access-2");
+            expect(fetched?.refreshToken).toBe("refresh-2");
+        });
+        it("withRefreshLock lets the refresh destroy the session it locks", async ({ skip, }) => {
+            const locking = lockStore(skip);
+            const value = await locking.create(sampleSession());
+            await settlesWithin(locking.withRefreshLock(value, () => locking.destroy(value)), "destroy blocked inside withRefreshLock: HonoBff destroys the " +
+                "session it locks when the authorization server refuses the " +
+                "refresh, so it would deadlock");
+        });
+        it("withRefreshLock runs a refresh that was waiting when the holder threw", async ({ skip, }) => {
+            const locking = lockStore(skip);
+            const value = await locking.create(sampleSession());
+            const failure = new Error("token endpoint unreachable");
+            const releaseFirst = Promise.withResolvers();
+            const first = locking.withRefreshLock(value, async () => {
+                await releaseFirst.promise;
+                throw failure;
+            });
+            const waiting = locking.withRefreshLock(value, () => Promise.resolve("waiting"));
+            releaseFirst.resolve();
+            await expect(first).rejects.toBe(failure);
+            expect(await settlesWithin(waiting.catch((error) => error), "a refresh queued behind one that threw never ran, so every " +
+                "request waiting on that session hangs"), "a refresh queued behind one that threw must run, not inherit its error").toBe("waiting");
+        });
+        it("withRefreshLock releases the lock when the refresh throws", async ({ skip, }) => {
+            const locking = lockStore(skip);
+            const value = await locking.create(sampleSession());
+            const failure = new Error("token endpoint unreachable");
+            await expect(locking.withRefreshLock(value, () => Promise.reject(failure))).rejects.toBe(failure);
+            expect(await settlesWithin(locking.withRefreshLock(value, () => Promise.resolve("next")), "a refresh that threw kept the lock, so the session can never " +
+                "refresh again")).toBe("next");
+        });
         if (makeBoundedStore) {
             it("reports the max age it was built with, so a BFF can outlive it", async () => {
                 const bounded = await makeBoundedStore(BOUND_MS);

package/dist/identity/external/_shared.d.ts

@@ -24,6 +24,14 @@ export declare const ID_TOKEN_EXPIRY_LEEWAY_SECONDS = 120;
  * OAuth2 error carries a description the provider wrote.
  */
 export declare function describeError(error: unknown): string;
+/**
+ * Deadline, in milliseconds, on each request a connector sends to a provider —
+ * the token exchange and the profile, UserInfo and key-set reads. Send it as
+ * `signal: packageDeadlineSignal(AbortSignal.timeout(...))` on the `fetch`
+ * init: that one signal covers the connect, the headers and the whole body, so
+ * the body read after it needs no deadline of its own.
+ */
+export declare const PROVIDER_REQUEST_TIMEOUT_MS = 10000;
 /**
  * Response bytes a connector reads from a provider endpoint — token, profile,
  * UserInfo, or key set — before refusing the response.

package/dist/identity/external/_shared.js

@@ -37,6 +37,14 @@ export function describeError(error) {
     }
     return sanitizeProviderText(error instanceof Error ? error.message : String(error));
 }
+/**
+ * Deadline, in milliseconds, on each request a connector sends to a provider —
+ * the token exchange and the profile, UserInfo and key-set reads. Send it as
+ * `signal: packageDeadlineSignal(AbortSignal.timeout(...))` on the `fetch`
+ * init: that one signal covers the connect, the headers and the whole body, so
+ * the body read after it needs no deadline of its own.
+ */
+export const PROVIDER_REQUEST_TIMEOUT_MS = 10_000;
 /**
  * Response bytes a connector reads from a provider endpoint — token, profile,
  * UserInfo, or key set — before refusing the response.

package/dist/identity/external/_token-exchange.d.ts

@@ -10,8 +10,6 @@
  */
 /** Response bytes accepted from a token endpoint before the exchange is refused. */
 export declare const MAX_TOKEN_RESPONSE_BYTES: number;
-/** Wall-clock budget for the exchange, covering the connect and the body read. */
-export declare const TOKEN_EXCHANGE_TIMEOUT_MS = 10000;
 /** Input for {@link runTokenExchange}. */
 export interface TokenExchangeInput {
     /** Provider id carried on every thrown {@link ExternalAuthError}. */
@@ -39,7 +37,7 @@ export interface TokenExchangeInput {
     httpErrorHint: string;
     /** Guidance appended for the OAuth2 error code the provider reported. */
     tokenErrorHint: (code: string | undefined) => string;
-    /** Exchange deadline. Defaults to {@link TOKEN_EXCHANGE_TIMEOUT_MS}. */
+    /** Exchange deadline. Defaults to {@link PROVIDER_REQUEST_TIMEOUT_MS}. */
     timeoutMs?: number;
 }
 /** A token response that cleared every step of {@link runTokenExchange}. */

package/dist/identity/external/_token-exchange.js

@@ -9,12 +9,10 @@
  * @module
  */
 import { packageDeadlineSignal } from "../../utils/_default-fetch.js";
-import { describeError, MAX_PROVIDER_RESPONSE_BYTES, sanitizeProviderText, } from "./_shared.js";
+import { describeError, MAX_PROVIDER_RESPONSE_BYTES, PROVIDER_REQUEST_TIMEOUT_MS, sanitizeProviderText, } from "./_shared.js";
 import { ExternalAuthError } from "./errors.js";
 /** Response bytes accepted from a token endpoint before the exchange is refused. */
 export const MAX_TOKEN_RESPONSE_BYTES = MAX_PROVIDER_RESPONSE_BYTES;
-/** Wall-clock budget for the exchange, covering the connect and the body read. */
-export const TOKEN_EXCHANGE_TIMEOUT_MS = 10_000;
 /**
  * Posts the authorization code and returns a token response known to be a JSON
  * object carrying `requiredField`. Every failure throws
@@ -34,7 +32,7 @@ export async function runTokenExchange(input) {
             },
             body: input.body,
             redirect: "manual",
-            signal: packageDeadlineSignal(AbortSignal.timeout(input.timeoutMs ?? TOKEN_EXCHANGE_TIMEOUT_MS)),
+            signal: packageDeadlineSignal(AbortSignal.timeout(input.timeoutMs ?? PROVIDER_REQUEST_TIMEOUT_MS)),
         });
     }
     catch (error) {

package/dist/identity/external/apple.js

@@ -17,8 +17,8 @@
  */
 import { toArrayBuffer } from "../../utils/_buffer.js";
 import { base64urlDecode } from "../../utils/crypto.js";
-import { defaultFetch } from "../../utils/_default-fetch.js";
-import { assertIdTokenClaims, describeError, readProviderText, } from "./_shared.js";
+import { defaultFetch, packageDeadlineSignal, } from "../../utils/_default-fetch.js";
+import { assertIdTokenClaims, describeError, PROVIDER_REQUEST_TIMEOUT_MS, readProviderText, } from "./_shared.js";
 import { runTokenExchange } from "./_token-exchange.js";
 import { createAppleClientSecretFactory, } from "./apple-client-secret.js";
 import { ExternalAuthError } from "./errors.js";
@@ -101,6 +101,7 @@ export function appleProvider(options) {
         try {
             res = await fetchImpl(APPLE_JWKS_URL, {
                 headers: { Accept: "application/json" },
+                signal: packageDeadlineSignal(AbortSignal.timeout(PROVIDER_REQUEST_TIMEOUT_MS)),
             });
         }
         catch (error) {

package/dist/identity/external/github.js

@@ -4,8 +4,8 @@
  *
  * @module
  */
-import { defaultFetch } from "../../utils/_default-fetch.js";
-import { describeError, readProviderText } from "./_shared.js";
+import { defaultFetch, packageDeadlineSignal, } from "../../utils/_default-fetch.js";
+import { describeError, PROVIDER_REQUEST_TIMEOUT_MS, readProviderText, } from "./_shared.js";
 import { runTokenExchange } from "./_token-exchange.js";
 import { ExternalAuthError } from "./errors.js";
 const GITHUB_AUTHORIZE_URL = "https://github.com/login/oauth/authorize";
@@ -65,6 +65,7 @@ export function githubProvider(options) {
                     Authorization: `Bearer ${accessToken}`,
                     Accept: "application/vnd.github+json",
                 },
+                signal: packageDeadlineSignal(AbortSignal.timeout(PROVIDER_REQUEST_TIMEOUT_MS)),
             });
         }
         catch (error) {

package/dist/identity/external/oauth2.js

@@ -7,9 +7,9 @@
  *
  * @module
  */
-import { defaultFetch } from "../../utils/_default-fetch.js";
+import { defaultFetch, packageDeadlineSignal, } from "../../utils/_default-fetch.js";
 import { generateCodeChallenge } from "../../utils/pkce.js";
-import { describeError, readErrorBody, readProviderText } from "./_shared.js";
+import { describeError, PROVIDER_REQUEST_TIMEOUT_MS, readErrorBody, readProviderText, } from "./_shared.js";
 import { runTokenExchange } from "./_token-exchange.js";
 import { ExternalAuthError } from "./errors.js";
 /**
@@ -73,6 +73,7 @@ export function oauth2Provider(options) {
                     Authorization: `Bearer ${accessToken}`,
                     Accept: "application/json",
                 },
+                signal: packageDeadlineSignal(AbortSignal.timeout(PROVIDER_REQUEST_TIMEOUT_MS)),
             });
         }
         catch (error) {

package/dist/identity/external/oidc.js

@@ -7,9 +7,9 @@
 import { DirectClient } from "../../client/direct-client.js";
 import { MemoryAuthRequestStorage } from "../../client/storage.js";
 import { isOAuth2Error } from "../../errors.js";
-import { defaultFetch } from "../../utils/_default-fetch.js";
+import { defaultFetch, packageDeadlineSignal, } from "../../utils/_default-fetch.js";
 import { generateCodeChallenge } from "../../utils/pkce.js";
-import { assertIdTokenClaims, describeError, readProviderText, stripTrailingSlash, } from "./_shared.js";
+import { assertIdTokenClaims, describeError, PROVIDER_REQUEST_TIMEOUT_MS, readProviderText, stripTrailingSlash, } from "./_shared.js";
 import { ExternalAuthError } from "./errors.js";
 /**
  * Creates a connector for any spec-compliant OpenID Connect provider.
@@ -148,6 +148,7 @@ export function oidcProvider(options) {
                     Authorization: `Bearer ${accessToken}`,
                     Accept: "application/json",
                 },
+                signal: packageDeadlineSignal(AbortSignal.timeout(PROVIDER_REQUEST_TIMEOUT_MS)),
             });
             if (!res.ok) {
                 await res.body?.cancel();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@udibo/oauth2",
-  "version": "0.21.0",
+  "version": "0.21.2",
   "description": "A flexible OAuth2 toolkit: framework-agnostic authorization & resource servers, a typed client, Hono adapters (including a backend-for-frontend), and React bindings.",
   "keywords": [
     "authorization-server",