@udibo/oauth2 0.9.1 → 0.9.2

package/esm/server/authorization-server.d.ts

@@ -126,6 +126,11 @@ export interface AuthorizationServerContext<Client extends ClientInterface, User
     services: AuthorizationServerServices<Client, User, S>;
     /** The issuer identifier URL for this request. */
     issuer?: string;
+    /**
+     * Scopes advertised for this request in discovery metadata. Overrides the
+     * server-wide default, including when set to an empty array.
+     */
+    scopesSupported?: string[];
     /** URL of the authorization endpoint. Defaults to `${issuer}/authorize`. */
     authorizationEndpoint?: string;
     /** URL of the token endpoint. Defaults to `${issuer}/token`. */
@@ -164,7 +169,10 @@ export interface AuthorizationServerOptions<Client extends ClientInterface, User
     resolve: (request: Request) => AuthorizationServerContext<Client, User, S> | Promise<AuthorizationServerContext<Client, User, S>>;
     /** Grants the server supports, keyed by `grant_type` (each key must equal `grant.grantType`). */
     grants: AuthorizationServerGrants<Client, User, S>;
-    /** Scopes supported by this server (advertised in RFC 8414 metadata). */
+    /**
+     * Default scopes advertised in RFC 8414 metadata when the request context
+     * does not supply scopesSupported.
+     */
     scopesSupported?: string[];
     /**
      * OIDC issuance keys. Configuring this turns the OIDC provider surface on:

package/esm/server/authorization-server.js

@@ -1099,8 +1099,9 @@ export class AuthorizationServer extends ResourceServer {
             metadata.code_challenge_methods_supported = challengeMethods;
         }
         metadata.response_types_supported = hasAuthCodeGrant ? ["code"] : [];
-        if (this.scopesSupported) {
-            metadata.scopes_supported = this.scopesSupported;
+        const scopesSupported = context.scopesSupported ?? this.scopesSupported;
+        if (scopesSupported) {
+            metadata.scopes_supported = scopesSupported;
         }
         if (this.signingKeys) {
             this.#advertiseEndpoints(metadata, endpoints, true);

package/esm/server/grants/authorization-code.d.ts

@@ -50,10 +50,13 @@ export interface AuthorizationCodeGrantOptions<Client extends ClientInterface, U
      * authentication, never a replacement for it, so a confidential client's
      * secret is still required on this grant.
      *
-     * Defaults to `true`: confidential clients authenticate alongside PKCE.
-     * Public clients, which have no secret, are unaffected. Setting `false`
-     * explicitly enables legacy behavior where PKCE replaces client credentials;
-     * use that opt-out only for an integration that requires it.
+     * Defaults to `true`: confidential clients authenticate alongside PKCE, and
+     * a public client authenticates by `client_id` alone — one that attaches a
+     * `client_secret` it was never issued is refused, as on every other grant.
+     * Setting `false` explicitly enables legacy behavior where PKCE replaces
+     * client credentials: a request carrying a `code_verifier` is looked up by
+     * id, so a presented secret is not checked at all. Use that opt-out only for
+     * an integration that requires it.
      *
      * @default true
      * @see https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1#section-4.1.3

package/esm/server/services/client.d.ts

@@ -17,13 +17,17 @@ export interface ClientServiceInterface<Client extends ClientInterface, User> {
      *   always advertises `none` in `token_endpoint_auth_methods_supported`, so
      *   an implementation that demands a secret from every client makes that
      *   advertisement false.
+     * - A **public** client must resolve `undefined` when a non-empty `secret` is
+     *   presented. It was issued no secret, so a request carrying one is
+     *   misconfigured or confused about the client's type, and the server answers
+     *   `invalid_client` rather than silently treating it as public. An empty
+     *   `secret` carries no credential — a Basic header of `client_id:` decodes
+     *   to one — and counts as presenting none, so the client resolves.
      * - A **confidential** client resolves only with its correct `secret`. With
      *   the secret missing or wrong, resolve `undefined`.
      *
      * `runClientServiceContractTests` from `@udibo/oauth2/testing/contract` pins
-     * both rules; run it against your implementation. It does not pin whether a
-     * public client that presents a `secret` resolves, so do not rely on either
-     * answer.
+     * all three rules; run it against your implementation.
      *
      * @param id The presented `client_id` — unauthenticated input.
      * @param secret The presented `client_secret`, omitted when the request

package/esm/testing/contract/client.js

@@ -82,6 +82,17 @@ export function runClientServiceContractTests(options) {
                 const auth = await clientService.getAuthenticated(client.id);
                 assertEquals(auth?.id, client.id);
             });
+            it("returns undefined for a public client that presents a secret", async () => {
+                const client = makeClient(9);
+                await options.addClient(clientService, client);
+                assertStrictEquals(await clientService.getAuthenticated(client.id, "unissued"), undefined);
+            });
+            it("returns the public client when the presented secret is empty", async () => {
+                const client = makeClient(10);
+                await options.addClient(clientService, client);
+                const auth = await clientService.getAuthenticated(client.id, "");
+                assertEquals(auth?.id, client.id);
+            });
             it("returns undefined for a confidential client when no secret is supplied", async () => {
                 const client = makeClient(3);
                 await options.addClient(clientService, client, "secret");

package/esm/testing/services.d.ts

@@ -99,7 +99,7 @@ export declare class MemoryUserService<U extends MemoryUserShape> implements Use
  * A client is treated as confidential when {@link add} is called with a
  * secret, and public when it is not — there is no separate flag to
  * remember. `getAuthenticated` requires the secret for confidential
- * clients and accepts a missing secret for public clients.
+ * clients, and requires public clients to present none.
  */
 export declare class MemoryClientService<C extends ClientInterface, U> implements ClientServiceInterface<C, U> {
     #private;
@@ -122,7 +122,9 @@ export declare class MemoryClientService<C extends ClientInterface, U> implement
     /**
      * Resolves the client when authentication succeeds, otherwise `undefined`.
      * Confidential clients (registered with a secret) require a matching
-     * `secret`; public clients (registered without one) ignore it.
+     * `secret`; public clients (registered without one) must present none, so a
+     * secret they were never issued fails authentication rather than being
+     * ignored. An empty `secret` counts as none.
      */
     getAuthenticated(id: string, secret?: string): Promise<C | undefined>;
     /**

package/esm/testing/services.js

@@ -109,7 +109,7 @@ export class MemoryUserService {
  * A client is treated as confidential when {@link add} is called with a
  * secret, and public when it is not — there is no separate flag to
  * remember. `getAuthenticated` requires the secret for confidential
- * clients and accepts a missing secret for public clients.
+ * clients, and requires public clients to present none.
  */
 export class MemoryClientService {
     #clientsById = new Map();
@@ -150,19 +150,21 @@ export class MemoryClientService {
     /**
      * Resolves the client when authentication succeeds, otherwise `undefined`.
      * Confidential clients (registered with a secret) require a matching
-     * `secret`; public clients (registered without one) ignore it.
+     * `secret`; public clients (registered without one) must present none, so a
+     * secret they were never issued fails authentication rather than being
+     * ignored. An empty `secret` counts as none.
      */
     async getAuthenticated(id, secret) {
         const client = this.#clientsById.get(id);
         if (!client)
             return undefined;
         const storedHash = this.#secretHashByClientId.get(id);
-        if (storedHash) {
-            if (!secret)
-                return undefined;
-            if (await sha256Hash(secret) !== storedHash)
-                return undefined;
-        }
+        if (!storedHash)
+            return secret ? undefined : client;
+        if (!secret)
+            return undefined;
+        if (await sha256Hash(secret) !== storedHash)
+            return undefined;
         return client;
     }
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@udibo/oauth2",
-  "version": "0.9.1",
+  "version": "0.9.2",
   "description": "A flexible OAuth2 toolkit: framework-agnostic authorization & resource servers, a typed client, Hono adapters (including a backend-for-frontend), and React bindings.",
   "repository": {
     "type": "git",