@zudojs/auth-oauth 1.1.0 → 1.1.1

package/dist/oauthClient/oauthAuthorize.core.js

@@ -5,7 +5,7 @@
  */
 import { OAuthConfigurationError } from "../oauthErrors/index.js";
 import { assertValidCodeVerifier, deriveCodeChallenge, generateCodeVerifier, } from "../oauthSecurity/index.js";
-import { assertRedirectUriAllowed, resolveAuthorizeUrl, resolveConfig, } from "./oauthConfig.resolve.js";
+import { assertRedirectUriAllowed, assertScopes, resolveAuthorizeUrl, resolveConfig, } from "./oauthConfig.resolve.js";
 /** Parameters the caller may not override through `additionalParams`. */
 const RESERVED_PARAMS = new Set([
     "response_type",
@@ -56,9 +56,11 @@ export function createAuthorizationUrl(config, options) {
     const codeVerifier = options.codeVerifier ?? generateCodeVerifier();
     assertValidCodeVerifier(codeVerifier);
     const codeChallenge = deriveCodeChallenge(codeVerifier);
-    const scopes = options.scopes !== undefined && options.scopes.length > 0
-        ? options.scopes
-        : resolved.scopes;
+    let scopes = resolved.scopes;
+    if (options.scopes !== undefined && options.scopes.length > 0) {
+        assertScopes(options.scopes);
+        scopes = options.scopes;
+    }
     const params = new URLSearchParams(url.search);
     for (const [key, value] of Object.entries(resolved.preset.authorizeParams ?? {})) {
         params.set(key, value);

package/dist/oauthClient/oauthConfig.resolve.d.ts

@@ -32,6 +32,16 @@ export interface ResolvedOAuthConfig {
     readonly allowedRedirectUris: readonly string[];
     readonly source: OAuthConfig;
 }
+/**
+ * Reject anything that is not a list of RFC 6749 §3.3 scope-tokens.
+ *
+ * Applied to `config.scopes` and to the per-request `scopes` override on
+ * {@link createAuthorizationUrl}, which previously skipped it — so a blank
+ * or space-containing entry reached the `scope` parameter untouched.
+ *
+ * @throws {OAuthConfigurationError} On a non-string or malformed entry.
+ */
+export declare function assertScopes(scopes: readonly unknown[]): void;
 /**
  * Validate an `OAuthConfig` and merge it with its provider preset.
  *

package/dist/oauthClient/oauthConfig.resolve.js

@@ -36,6 +36,25 @@ function boundedInt(value, fallback, min, max, field) {
     }
     return value;
 }
+/**
+ * Reject anything that is not a list of RFC 6749 §3.3 scope-tokens.
+ *
+ * Applied to `config.scopes` and to the per-request `scopes` override on
+ * {@link createAuthorizationUrl}, which previously skipped it — so a blank
+ * or space-containing entry reached the `scope` parameter untouched.
+ *
+ * @throws {OAuthConfigurationError} On a non-string or malformed entry.
+ */
+export function assertScopes(scopes) {
+    if (!Array.isArray(scopes)) {
+        throw new OAuthConfigurationError("scopes must be an array of scope-tokens.");
+    }
+    for (const scope of scopes) {
+        if (typeof scope !== "string" || !/^[\x21\x23-\x5B\x5D-\x7E]+$/.test(scope)) {
+            throw new OAuthConfigurationError("Each scope must be a non-empty RFC 6749 scope-token.");
+        }
+    }
+}
 /**
  * Strip a URL's fragment and normalise scheme/host casing for comparison.
  */
@@ -66,11 +85,7 @@ export function resolveConfig(config) {
     const scopes = config.scopes !== undefined && config.scopes.length > 0
         ? config.scopes
         : preset.defaultScopes;
-    for (const scope of scopes) {
-        if (typeof scope !== "string" || !/^[\x21\x23-\x5B\x5D-\x7E]+$/.test(scope)) {
-            throw new OAuthConfigurationError("Each scope must be a non-empty RFC 6749 scope-token.");
-        }
-    }
+    assertScopes(scopes);
     const fetchImpl = config.fetch ?? globalThis.fetch;
     if (typeof fetchImpl !== "function") {
         throw new OAuthConfigurationError("No fetch implementation available; supply config.fetch.");

package/dist/oauthClient/oauthHttp.core.js

@@ -13,7 +13,7 @@
  * - **Reach** — `redirect: "manual"`, so a 3xx cannot walk the request to a
  *   host that never passed the SSRF guard.
  */
-import { OAuthNetworkError, OAuthProviderError, OAuthResponseError, OAuthResponseTooLargeError, } from "../oauthErrors/index.js";
+import { OAuthError, OAuthNetworkError, OAuthProviderError, OAuthResponseError, OAuthResponseTooLargeError, } from "../oauthErrors/index.js";
 import { parseJsonObject, parseJsonValue } from "../oauthSecurity/index.js";
 /** Provider `error` codes are echoed only if they look like OAuth error codes. */
 const SAFE_ERROR_CODE = /^[A-Za-z0-9_.:-]{1,64}$/;
@@ -94,16 +94,23 @@ export async function requestProviderValue(resolved, request) {
         });
     }
     catch (cause) {
-        const name = cause instanceof Error ? cause.name : "";
-        const timedOut = name === "TimeoutError" || name === "AbortError";
-        throw new OAuthNetworkError(timedOut
-            ? `The ${request.label} request timed out after ${resolved.timeoutMs}ms.`
-            : `The ${request.label} request could not be completed.`, { cause });
+        throw toNetworkError(cause, request.label, resolved.timeoutMs);
     }
     if (response.status >= 300 && response.status < 400) {
         throw new OAuthProviderError(`The ${request.label} endpoint returned an unexpected redirect.`, { providerStatus: response.status });
     }
-    const text = await readCappedText(response, resolved.maxResponseBytes);
+    let text;
+    try {
+        text = await readCappedText(response, resolved.maxResponseBytes);
+    }
+    catch (cause) {
+        // The timeout signal also aborts the body stream, and a transport can
+        // fail mid-body. Both surfaced here as a raw `DOMException` /
+        // transport error rather than the documented `OAuthNetworkError`.
+        if (cause instanceof OAuthError)
+            throw cause;
+        throw toNetworkError(cause, request.label, resolved.timeoutMs);
+    }
     if (!response.ok) {
         let code;
         try {
@@ -128,6 +135,14 @@ export async function requestProviderValue(resolved, request) {
     }
     return payload;
 }
+/** Wrap a transport or timeout failure in the documented error type. */
+function toNetworkError(cause, label, timeoutMs) {
+    const name = cause instanceof Error ? cause.name : "";
+    const timedOut = name === "TimeoutError" || name === "AbortError";
+    return new OAuthNetworkError(timedOut
+        ? `The ${label} request timed out after ${timeoutMs}ms.`
+        : `The ${label} request could not be completed.`, { cause });
+}
 /** Build the `Authorization: Basic` header for client authentication. */
 export function basicAuthHeader(clientId, clientSecret) {
     // RFC 6749 §2.3.1: both halves are form-urlencoded before base64.

package/dist/oauthSecurity/oauthUrl.guard.js

@@ -132,9 +132,15 @@ function isNonPublicIpv6(raw) {
  */
 export function isBlockedFetchHost(hostname) {
     const host = hostname.toLowerCase();
-    const bare = host.startsWith("[") && host.endsWith("]")
+    const unbracketed = host.startsWith("[") && host.endsWith("]")
         ? host.slice(1, -1)
         : host;
+    // A trailing dot marks a fully-qualified name (`localhost.`,
+    // `metadata.google.internal.`). DNS resolves it to the same address as
+    // the undotted form, but the WHATWG parser keeps the dot on domain
+    // hosts, so without stripping it every name-based rule below was one
+    // character away from being bypassed.
+    const bare = unbracketed.replace(/\.+$/, "");
     if (BLOCKED_HOST_NAMES.has(bare))
         return true;
     for (const suffix of BLOCKED_HOST_SUFFIXES) {

package/package.json

@@ -1,8 +1,12 @@
 {
   "name": "@zudojs/auth-oauth",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "OAuth2 authorization-code client for the Zudojs framework — PKCE S256, mandatory state, SSRF-guarded endpoints, and provider presets for Google, GitHub, Microsoft, Apple and Discord.",
   "license": "MIT",
+  "author": {
+    "name": "Oluwayemi Oyinlola",
+    "url": "https://github.com/oyinlola-tech"
+  },
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",