@udibo/oauth2 0.21.1 → 0.21.2

package/dist/identity/external/_shared.d.ts

@@ -24,6 +24,14 @@ export declare const ID_TOKEN_EXPIRY_LEEWAY_SECONDS = 120;
  * OAuth2 error carries a description the provider wrote.
  */
 export declare function describeError(error: unknown): string;
+/**
+ * Deadline, in milliseconds, on each request a connector sends to a provider —
+ * the token exchange and the profile, UserInfo and key-set reads. Send it as
+ * `signal: packageDeadlineSignal(AbortSignal.timeout(...))` on the `fetch`
+ * init: that one signal covers the connect, the headers and the whole body, so
+ * the body read after it needs no deadline of its own.
+ */
+export declare const PROVIDER_REQUEST_TIMEOUT_MS = 10000;
 /**
  * Response bytes a connector reads from a provider endpoint — token, profile,
  * UserInfo, or key set — before refusing the response.

package/dist/identity/external/_shared.js

@@ -37,6 +37,14 @@ export function describeError(error) {
     }
     return sanitizeProviderText(error instanceof Error ? error.message : String(error));
 }
+/**
+ * Deadline, in milliseconds, on each request a connector sends to a provider —
+ * the token exchange and the profile, UserInfo and key-set reads. Send it as
+ * `signal: packageDeadlineSignal(AbortSignal.timeout(...))` on the `fetch`
+ * init: that one signal covers the connect, the headers and the whole body, so
+ * the body read after it needs no deadline of its own.
+ */
+export const PROVIDER_REQUEST_TIMEOUT_MS = 10_000;
 /**
  * Response bytes a connector reads from a provider endpoint — token, profile,
  * UserInfo, or key set — before refusing the response.

package/dist/identity/external/_token-exchange.d.ts

@@ -10,8 +10,6 @@
  */
 /** Response bytes accepted from a token endpoint before the exchange is refused. */
 export declare const MAX_TOKEN_RESPONSE_BYTES: number;
-/** Wall-clock budget for the exchange, covering the connect and the body read. */
-export declare const TOKEN_EXCHANGE_TIMEOUT_MS = 10000;
 /** Input for {@link runTokenExchange}. */
 export interface TokenExchangeInput {
     /** Provider id carried on every thrown {@link ExternalAuthError}. */
@@ -39,7 +37,7 @@ export interface TokenExchangeInput {
     httpErrorHint: string;
     /** Guidance appended for the OAuth2 error code the provider reported. */
     tokenErrorHint: (code: string | undefined) => string;
-    /** Exchange deadline. Defaults to {@link TOKEN_EXCHANGE_TIMEOUT_MS}. */
+    /** Exchange deadline. Defaults to {@link PROVIDER_REQUEST_TIMEOUT_MS}. */
     timeoutMs?: number;
 }
 /** A token response that cleared every step of {@link runTokenExchange}. */

package/dist/identity/external/_token-exchange.js

@@ -9,12 +9,10 @@
  * @module
  */
 import { packageDeadlineSignal } from "../../utils/_default-fetch.js";
-import { describeError, MAX_PROVIDER_RESPONSE_BYTES, sanitizeProviderText, } from "./_shared.js";
+import { describeError, MAX_PROVIDER_RESPONSE_BYTES, PROVIDER_REQUEST_TIMEOUT_MS, sanitizeProviderText, } from "./_shared.js";
 import { ExternalAuthError } from "./errors.js";
 /** Response bytes accepted from a token endpoint before the exchange is refused. */
 export const MAX_TOKEN_RESPONSE_BYTES = MAX_PROVIDER_RESPONSE_BYTES;
-/** Wall-clock budget for the exchange, covering the connect and the body read. */
-export const TOKEN_EXCHANGE_TIMEOUT_MS = 10_000;
 /**
  * Posts the authorization code and returns a token response known to be a JSON
  * object carrying `requiredField`. Every failure throws
@@ -34,7 +32,7 @@ export async function runTokenExchange(input) {
             },
             body: input.body,
             redirect: "manual",
-            signal: packageDeadlineSignal(AbortSignal.timeout(input.timeoutMs ?? TOKEN_EXCHANGE_TIMEOUT_MS)),
+            signal: packageDeadlineSignal(AbortSignal.timeout(input.timeoutMs ?? PROVIDER_REQUEST_TIMEOUT_MS)),
         });
     }
     catch (error) {

package/dist/identity/external/apple.js

@@ -17,8 +17,8 @@
  */
 import { toArrayBuffer } from "../../utils/_buffer.js";
 import { base64urlDecode } from "../../utils/crypto.js";
-import { defaultFetch } from "../../utils/_default-fetch.js";
-import { assertIdTokenClaims, describeError, readProviderText, } from "./_shared.js";
+import { defaultFetch, packageDeadlineSignal, } from "../../utils/_default-fetch.js";
+import { assertIdTokenClaims, describeError, PROVIDER_REQUEST_TIMEOUT_MS, readProviderText, } from "./_shared.js";
 import { runTokenExchange } from "./_token-exchange.js";
 import { createAppleClientSecretFactory, } from "./apple-client-secret.js";
 import { ExternalAuthError } from "./errors.js";
@@ -101,6 +101,7 @@ export function appleProvider(options) {
         try {
             res = await fetchImpl(APPLE_JWKS_URL, {
                 headers: { Accept: "application/json" },
+                signal: packageDeadlineSignal(AbortSignal.timeout(PROVIDER_REQUEST_TIMEOUT_MS)),
             });
         }
         catch (error) {

package/dist/identity/external/github.js

@@ -4,8 +4,8 @@
  *
  * @module
  */
-import { defaultFetch } from "../../utils/_default-fetch.js";
-import { describeError, readProviderText } from "./_shared.js";
+import { defaultFetch, packageDeadlineSignal, } from "../../utils/_default-fetch.js";
+import { describeError, PROVIDER_REQUEST_TIMEOUT_MS, readProviderText, } from "./_shared.js";
 import { runTokenExchange } from "./_token-exchange.js";
 import { ExternalAuthError } from "./errors.js";
 const GITHUB_AUTHORIZE_URL = "https://github.com/login/oauth/authorize";
@@ -65,6 +65,7 @@ export function githubProvider(options) {
                     Authorization: `Bearer ${accessToken}`,
                     Accept: "application/vnd.github+json",
                 },
+                signal: packageDeadlineSignal(AbortSignal.timeout(PROVIDER_REQUEST_TIMEOUT_MS)),
             });
         }
         catch (error) {

package/dist/identity/external/oauth2.js

@@ -7,9 +7,9 @@
  *
  * @module
  */
-import { defaultFetch } from "../../utils/_default-fetch.js";
+import { defaultFetch, packageDeadlineSignal, } from "../../utils/_default-fetch.js";
 import { generateCodeChallenge } from "../../utils/pkce.js";
-import { describeError, readErrorBody, readProviderText } from "./_shared.js";
+import { describeError, PROVIDER_REQUEST_TIMEOUT_MS, readErrorBody, readProviderText, } from "./_shared.js";
 import { runTokenExchange } from "./_token-exchange.js";
 import { ExternalAuthError } from "./errors.js";
 /**
@@ -73,6 +73,7 @@ export function oauth2Provider(options) {
                     Authorization: `Bearer ${accessToken}`,
                     Accept: "application/json",
                 },
+                signal: packageDeadlineSignal(AbortSignal.timeout(PROVIDER_REQUEST_TIMEOUT_MS)),
             });
         }
         catch (error) {

package/dist/identity/external/oidc.js

@@ -7,9 +7,9 @@
 import { DirectClient } from "../../client/direct-client.js";
 import { MemoryAuthRequestStorage } from "../../client/storage.js";
 import { isOAuth2Error } from "../../errors.js";
-import { defaultFetch } from "../../utils/_default-fetch.js";
+import { defaultFetch, packageDeadlineSignal, } from "../../utils/_default-fetch.js";
 import { generateCodeChallenge } from "../../utils/pkce.js";
-import { assertIdTokenClaims, describeError, readProviderText, stripTrailingSlash, } from "./_shared.js";
+import { assertIdTokenClaims, describeError, PROVIDER_REQUEST_TIMEOUT_MS, readProviderText, stripTrailingSlash, } from "./_shared.js";
 import { ExternalAuthError } from "./errors.js";
 /**
  * Creates a connector for any spec-compliant OpenID Connect provider.
@@ -148,6 +148,7 @@ export function oidcProvider(options) {
                     Authorization: `Bearer ${accessToken}`,
                     Accept: "application/json",
                 },
+                signal: packageDeadlineSignal(AbortSignal.timeout(PROVIDER_REQUEST_TIMEOUT_MS)),
             });
             if (!res.ok) {
                 await res.body?.cancel();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@udibo/oauth2",
-  "version": "0.21.1",
+  "version": "0.21.2",
   "description": "A flexible OAuth2 toolkit: framework-agnostic authorization & resource servers, a typed client, Hono adapters (including a backend-for-frontend), and React bindings.",
   "keywords": [
     "authorization-server",