@zudojs/auth-oauth 1.2.4 → 1.2.6

package/README.md

@@ -189,8 +189,14 @@ Every one of these is covered by a test in `tests/`.
   **Limit:** the check is on the literal host; DNS is not resolved, so DNS
   rebinding is out of scope. Pair this with network egress controls if endpoint
   URLs come from untrusted operators.
-- **Bounded responses.** Every provider request carries
-  `AbortSignal.timeout(timeoutMs)` (default 10s) and the body is streamed and
+  **Testing against a local fake:** the guard applies in tests too, so a
+  `custom` provider with `tokenUrl: "http://127.0.0.1:4000/token"` is refused.
+  Keep a public-looking `https` URL (`https://oauth.example.test/token`) and
+  route it to your fake with `config.fetch`, which receives the URL string and
+  `RequestInit` and can answer with any `Response`.
+- **Bounded responses.** Every provider request carries a ref'd deadline of
+  `timeoutMs` (default 10s) — not `AbortSignal.timeout()`, whose unref'd timer
+  let a one-shot script exit with code 13 before the timeout fired — and the body is streamed and
   abandoned the moment it passes `maxResponseBytes` (default 256 KiB); an
   oversized `Content-Length` is refused before a byte is read.
 - **Defensive parsing.** A token response must be a JSON _object_ with a

package/dist/index.d.ts

@@ -15,4 +15,3 @@ export * from "./oauthErrors/index.js";
 export * from "./oauthSecurity/index.js";
 export * from "./oauthProviders/index.js";
 export * from "./oauthClient/index.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -15,4 +15,3 @@ export * from "./oauthErrors/index.js";
 export * from "./oauthSecurity/index.js";
 export * from "./oauthProviders/index.js";
 export * from "./oauthClient/index.js";
-//# sourceMappingURL=index.js.map

package/dist/oauthClient/http/index.d.ts

@@ -0,0 +1,6 @@
+/**
+ * HTTP support for the OAuth client: request deadlines.
+ *
+ * @module oauthClient/http
+ */
+export { createRequestDeadline, type RequestDeadline, } from "./oauthHttp.timeout.js";

package/dist/oauthClient/http/index.js

@@ -0,0 +1,6 @@
+/**
+ * HTTP support for the OAuth client: request deadlines.
+ *
+ * @module oauthClient/http
+ */
+export { createRequestDeadline, } from "./oauthHttp.timeout.js";

package/dist/oauthClient/http/oauthHttp.timeout.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Request deadline that keeps the process alive until it fires.
+ *
+ * @module oauthClient/http/oauthHttp.timeout
+ *
+ * `AbortSignal.timeout()` schedules its timer *unref'd*: if nothing else
+ * holds the event loop — a CLI, a one-shot script, a test runner's last
+ * await — Node exits with code 13 ("unsettled top-level await") before the
+ * deadline ever fires, and the caller never sees the documented
+ * `OAuthNetworkError`. A plain `setTimeout` is ref'd, so the deadline is
+ * guaranteed to be observed; `clear()` releases it as soon as the request
+ * settles so a fast response does not hold the process open.
+ */
+/** A deadline bound to one provider request. */
+export interface RequestDeadline {
+    /** Pass as `signal` to `fetch`. Aborts with a `TimeoutError`. */
+    readonly signal: AbortSignal;
+    /**
+     * Settle `promise` or reject with the timeout, whichever comes first.
+     *
+     * The global `fetch` rejects as soon as `signal` aborts, but a
+     * caller-supplied `config.fetch` (or the body stream of a hand-built
+     * `Response`) may ignore the signal; racing makes the deadline hold
+     * either way.
+     */
+    race<T>(promise: Promise<T>): Promise<T>;
+    /** Release the timer. Idempotent; call once the request has settled. */
+    clear(): void;
+}
+/**
+ * Create a request deadline of `timeoutMs` milliseconds.
+ *
+ * The abort reason is a `DOMException` named `TimeoutError`, the same
+ * shape `AbortSignal.timeout()` produces, so `fetch` rejections are
+ * classified identically by the caller.
+ */
+export declare function createRequestDeadline(timeoutMs: number): RequestDeadline;

package/dist/oauthClient/http/oauthHttp.timeout.js

@@ -0,0 +1,44 @@
+/**
+ * Request deadline that keeps the process alive until it fires.
+ *
+ * @module oauthClient/http/oauthHttp.timeout
+ *
+ * `AbortSignal.timeout()` schedules its timer *unref'd*: if nothing else
+ * holds the event loop — a CLI, a one-shot script, a test runner's last
+ * await — Node exits with code 13 ("unsettled top-level await") before the
+ * deadline ever fires, and the caller never sees the documented
+ * `OAuthNetworkError`. A plain `setTimeout` is ref'd, so the deadline is
+ * guaranteed to be observed; `clear()` releases it as soon as the request
+ * settles so a fast response does not hold the process open.
+ */
+/**
+ * Create a request deadline of `timeoutMs` milliseconds.
+ *
+ * The abort reason is a `DOMException` named `TimeoutError`, the same
+ * shape `AbortSignal.timeout()` produces, so `fetch` rejections are
+ * classified identically by the caller.
+ */
+export function createRequestDeadline(timeoutMs) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => {
+        controller.abort(new DOMException(`The operation was aborted due to timeout after ${timeoutMs}ms.`, "TimeoutError"));
+    }, timeoutMs);
+    const signal = controller.signal;
+    return {
+        signal,
+        race(promise) {
+            if (signal.aborted)
+                return Promise.reject(signal.reason);
+            return new Promise((resolve, reject) => {
+                const onAbort = () => reject(signal.reason);
+                signal.addEventListener("abort", onAbort, { once: true });
+                promise.then(resolve, reject).finally(() => {
+                    signal.removeEventListener("abort", onAbort);
+                });
+            });
+        },
+        clear() {
+            clearTimeout(timer);
+        },
+    };
+}

package/dist/oauthClient/index.d.ts

@@ -7,4 +7,3 @@ export { DEFAULT_TIMEOUT_MS, MAX_TIMEOUT_MS, DEFAULT_MAX_RESPONSE_BYTES, MIN_MAX
 export { createAuthorizationUrl } from "./oauthAuthorize.core.js";
 export { parseTokenResponse, exchangeCodeForToken, refreshAccessToken, } from "./oauthToken.core.js";
 export { fetchUserInfo } from "./oauthUserInfo.core.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/oauthClient/index.js

@@ -7,4 +7,3 @@ export { DEFAULT_TIMEOUT_MS, MAX_TIMEOUT_MS, DEFAULT_MAX_RESPONSE_BYTES, MIN_MAX
 export { createAuthorizationUrl } from "./oauthAuthorize.core.js";
 export { parseTokenResponse, exchangeCodeForToken, refreshAccessToken, } from "./oauthToken.core.js";
 export { fetchUserInfo } from "./oauthUserInfo.core.js";
-//# sourceMappingURL=index.js.map

package/dist/oauthClient/oauthAuthorize.core.d.ts

@@ -31,4 +31,3 @@ import type { AuthorizationUrlOptions, AuthorizationUrlResult, OAuthConfig } fro
  * @throws {OAuthEndpointNotAllowedError} If `authorizeUrl` fails the URL guard.
  */
 export declare function createAuthorizationUrl(config: OAuthConfig, options: AuthorizationUrlOptions): AuthorizationUrlResult;
-//# sourceMappingURL=oauthAuthorize.core.d.ts.map

package/dist/oauthClient/oauthAuthorize.core.js

@@ -92,4 +92,3 @@ export function createAuthorizationUrl(config, options) {
         codeChallenge,
     };
 }
-//# sourceMappingURL=oauthAuthorize.core.js.map

package/dist/oauthClient/oauthConfig.resolve.d.ts

@@ -67,4 +67,3 @@ export declare function resolveUserInfoUrl(resolved: ResolvedOAuthConfig): URL;
  * @throws {OAuthRedirectUriError} If it is not allowlisted.
  */
 export declare function assertRedirectUriAllowed(resolved: ResolvedOAuthConfig, redirectUri: string): string;
-//# sourceMappingURL=oauthConfig.resolve.d.ts.map

package/dist/oauthClient/oauthConfig.resolve.js

@@ -155,4 +155,3 @@ export function assertRedirectUriAllowed(resolved, redirectUri) {
     }
     return canonical;
 }
-//# sourceMappingURL=oauthConfig.resolve.js.map

package/dist/oauthClient/oauthHttp.core.d.ts

@@ -6,7 +6,9 @@
  * An OAuth provider is an untrusted remote. Every request made here is
  * bounded three ways:
  *
- * - **Time** — `AbortSignal.timeout(config.timeoutMs)`, default 10s.
+ * - **Time** — a ref'd deadline of `config.timeoutMs` (default 10s) that
+ *   aborts the request and the body read; see `createRequestDeadline` for
+ *   why it is not `AbortSignal.timeout()`.
  * - **Size** — the body is streamed and abandoned the moment it exceeds
  *   `config.maxResponseBytes` (default 256 KiB), and a `Content-Length` over
  *   the cap is refused before reading at all.
@@ -40,4 +42,3 @@ export declare function requestProviderJson(resolved: ResolvedOAuthConfig, reque
 export declare function requestProviderValue(resolved: ResolvedOAuthConfig, request: ProviderRequest): Promise<unknown>;
 /** Build the `Authorization: Basic` header for client authentication. */
 export declare function basicAuthHeader(clientId: string, clientSecret: string): string;
-//# sourceMappingURL=oauthHttp.core.d.ts.map

package/dist/oauthClient/oauthHttp.core.js

@@ -6,7 +6,9 @@
  * An OAuth provider is an untrusted remote. Every request made here is
  * bounded three ways:
  *
- * - **Time** — `AbortSignal.timeout(config.timeoutMs)`, default 10s.
+ * - **Time** — a ref'd deadline of `config.timeoutMs` (default 10s) that
+ *   aborts the request and the body read; see `createRequestDeadline` for
+ *   why it is not `AbortSignal.timeout()`.
  * - **Size** — the body is streamed and abandoned the moment it exceeds
  *   `config.maxResponseBytes` (default 256 KiB), and a `Content-Length` over
  *   the cap is refused before reading at all.
@@ -15,6 +17,7 @@
  */
 import { OAuthError, OAuthNetworkError, OAuthProviderError, OAuthResponseError, OAuthResponseTooLargeError, } from "../oauthErrors/index.js";
 import { parseJsonObject, parseJsonValue } from "../oauthSecurity/index.js";
+import { createRequestDeadline, } from "./http/index.js";
 /** Provider `error` codes are echoed only if they look like OAuth error codes. */
 const SAFE_ERROR_CODE = /^[A-Za-z0-9_.:-]{1,64}$/;
 /** Read a response body, refusing to buffer more than `maxBytes`. */
@@ -85,15 +88,24 @@ export async function requestProviderJson(resolved, request) {
  * `/user/emails`). Same time, size and redirect bounds.
  */
 export async function requestProviderValue(resolved, request) {
+    const deadline = createRequestDeadline(resolved.timeoutMs);
+    try {
+        return await requestWithinDeadline(resolved, request, deadline);
+    }
+    finally {
+        deadline.clear();
+    }
+}
+async function requestWithinDeadline(resolved, request, deadline) {
     let response;
     try {
-        response = await resolved.fetchImpl(request.url.toString(), {
+        response = await deadline.race(resolved.fetchImpl(request.url.toString(), {
             method: request.method,
             headers: request.headers,
             ...(request.body !== undefined ? { body: request.body } : {}),
             redirect: "manual",
-            signal: AbortSignal.timeout(resolved.timeoutMs),
-        });
+            signal: deadline.signal,
+        }));
     }
     catch (cause) {
         throw toNetworkError(cause, request.label, resolved.timeoutMs);
@@ -103,7 +115,7 @@ export async function requestProviderValue(resolved, request) {
     }
     let text;
     try {
-        text = await readCappedText(response, resolved.maxResponseBytes);
+        text = await deadline.race(readCappedText(response, resolved.maxResponseBytes));
     }
     catch (cause) {
         // The timeout signal also aborts the body stream, and a transport can
@@ -151,4 +163,3 @@ export function basicAuthHeader(clientId, clientSecret) {
     const encoded = Buffer.from(`${encodeURIComponent(clientId)}:${encodeURIComponent(clientSecret)}`, "utf8").toString("base64");
     return `Basic ${encoded}`;
 }
-//# sourceMappingURL=oauthHttp.core.js.map

package/dist/oauthClient/oauthToken.core.d.ts

@@ -47,4 +47,3 @@ export declare function exchangeCodeForToken(config: OAuthConfig, options: CodeE
  * @throws {OAuthConfigurationError} If the provider has no refresh support.
  */
 export declare function refreshAccessToken(config: OAuthConfig, refreshToken: string): Promise<OAuthTokenSet>;
-//# sourceMappingURL=oauthToken.core.d.ts.map

package/dist/oauthClient/oauthToken.core.js

@@ -168,4 +168,3 @@ export async function refreshAccessToken(config, refreshToken) {
     });
     return parseTokenResponse(payload);
 }
-//# sourceMappingURL=oauthToken.core.js.map

package/dist/oauthClient/oauthUserInfo.core.d.ts

@@ -24,4 +24,3 @@ import type { OAuthConfig, OAuthUserInfo } from "../oauthTypes/index.js";
  * @throws {OAuthResponseError} If the payload has no usable user id.
  */
 export declare function fetchUserInfo(config: OAuthConfig, accessToken: string): Promise<OAuthUserInfo>;
-//# sourceMappingURL=oauthUserInfo.core.d.ts.map

package/dist/oauthClient/oauthUserInfo.core.js

@@ -101,4 +101,3 @@ export async function fetchUserInfo(config, accessToken) {
     }
     return info;
 }
-//# sourceMappingURL=oauthUserInfo.core.js.map

package/dist/oauthErrors/index.d.ts

@@ -4,4 +4,3 @@
  * @module oauthErrors
  */
 export { OAuthErrorCode, type OAuthErrorOptions, OAuthError, OAuthConfigurationError, OAuthEndpointNotAllowedError, OAuthRedirectUriError, OAuthStateMismatchError, OAuthProviderError, OAuthResponseError, OAuthResponseTooLargeError, OAuthNetworkError, } from "./oauthError.base.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/oauthErrors/index.js

@@ -4,4 +4,3 @@
  * @module oauthErrors
  */
 export { OAuthErrorCode, OAuthError, OAuthConfigurationError, OAuthEndpointNotAllowedError, OAuthRedirectUriError, OAuthStateMismatchError, OAuthProviderError, OAuthResponseError, OAuthResponseTooLargeError, OAuthNetworkError, } from "./oauthError.base.js";
-//# sourceMappingURL=index.js.map

package/dist/oauthErrors/oauthError.base.d.ts

@@ -109,4 +109,3 @@ export declare class OAuthNetworkError extends OAuthError {
     readonly name: string;
     constructor(message: string, options?: OAuthErrorOptions);
 }
-//# sourceMappingURL=oauthError.base.d.ts.map

package/dist/oauthErrors/oauthError.base.js

@@ -159,4 +159,3 @@ export class OAuthNetworkError extends OAuthError {
         });
     }
 }
-//# sourceMappingURL=oauthError.base.js.map

package/dist/oauthProviders/index.d.ts

@@ -4,4 +4,3 @@
  * @module oauthProviders
  */
 export { type OAuthProviderPreset, PROVIDER_PRESETS, normalizeUserInfo, } from "./oauthProvider.presets.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/oauthProviders/index.js

@@ -4,4 +4,3 @@
  * @module oauthProviders
  */
 export { PROVIDER_PRESETS, normalizeUserInfo, } from "./oauthProvider.presets.js";
-//# sourceMappingURL=index.js.map

package/dist/oauthProviders/oauthProvider.presets.d.ts

@@ -50,4 +50,3 @@ export declare const PROVIDER_PRESETS: Readonly<Record<OAuthProvider, OAuthProvi
  * @returns The normalised profile, or `undefined` if no stable id was found.
  */
 export declare function normalizeUserInfo(provider: OAuthProvider, payload: Record<string, unknown>): OAuthUserInfo | undefined;
-//# sourceMappingURL=oauthProvider.presets.d.ts.map

package/dist/oauthProviders/oauthProvider.presets.js

@@ -193,4 +193,3 @@ export function normalizeUserInfo(provider, payload) {
         }
     }
 }
-//# sourceMappingURL=oauthProvider.presets.js.map

package/dist/oauthSecurity/index.d.ts

@@ -7,4 +7,3 @@ export { generateCodeVerifier, assertValidCodeVerifier, deriveCodeChallenge, } f
 export { generateState, verifyState } from "./oauthState.core.js";
 export { isBlockedFetchHost, assertSafeUrl, type UrlUse, } from "./oauthUrl.guard.js";
 export { sanitizeJsonValue, parseJsonObject, parseJsonValue, } from "./oauthJson.sanitize.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/oauthSecurity/index.js

@@ -7,4 +7,3 @@ export { generateCodeVerifier, assertValidCodeVerifier, deriveCodeChallenge, } f
 export { generateState, verifyState } from "./oauthState.core.js";
 export { isBlockedFetchHost, assertSafeUrl, } from "./oauthUrl.guard.js";
 export { sanitizeJsonValue, parseJsonObject, parseJsonValue, } from "./oauthJson.sanitize.js";
-//# sourceMappingURL=index.js.map

package/dist/oauthSecurity/oauthJson.sanitize.d.ts

@@ -35,4 +35,3 @@ export declare function parseJsonObject(text: string, label: string): Record<str
  * @throws {OAuthResponseError} If the body is not valid JSON.
  */
 export declare function parseJsonValue(text: string, label: string): unknown;
-//# sourceMappingURL=oauthJson.sanitize.d.ts.map

package/dist/oauthSecurity/oauthJson.sanitize.js

@@ -84,4 +84,3 @@ export function parseJsonValue(text, label) {
     }
     return sanitizeValue(parsed, 0);
 }
-//# sourceMappingURL=oauthJson.sanitize.js.map

package/dist/oauthSecurity/oauthPkce.core.d.ts

@@ -31,4 +31,3 @@ export declare function assertValidCodeVerifier(verifier: string): void;
  * @throws {OAuthError} If the verifier is malformed.
  */
 export declare function deriveCodeChallenge(verifier: string): string;
-//# sourceMappingURL=oauthPkce.core.d.ts.map

package/dist/oauthSecurity/oauthPkce.core.js

@@ -44,4 +44,3 @@ export function deriveCodeChallenge(verifier) {
     assertValidCodeVerifier(verifier);
     return createHash("sha256").update(verifier, "ascii").digest("base64url");
 }
-//# sourceMappingURL=oauthPkce.core.js.map

package/dist/oauthSecurity/oauthState.core.d.ts

@@ -28,4 +28,3 @@ export declare function generateState(): string;
  * @returns `true` only if both are non-empty strings with identical bytes.
  */
 export declare function verifyState(expected: string, received: string): boolean;
-//# sourceMappingURL=oauthState.core.d.ts.map

package/dist/oauthSecurity/oauthState.core.js

@@ -41,4 +41,3 @@ export function verifyState(expected, received) {
         return false;
     return timingSafeEqual(a, b);
 }
-//# sourceMappingURL=oauthState.core.js.map

package/dist/oauthSecurity/oauthUrl.guard.d.ts

@@ -44,4 +44,3 @@ export type UrlUse = "browser" | "fetch";
  * @throws {OAuthEndpointNotAllowedError} If the URL fails any check.
  */
 export declare function assertSafeUrl(raw: string, label: string, use: UrlUse): URL;
-//# sourceMappingURL=oauthUrl.guard.d.ts.map

package/dist/oauthSecurity/oauthUrl.guard.js

@@ -174,4 +174,3 @@ export function assertSafeUrl(raw, label, use) {
     }
     return url;
 }
-//# sourceMappingURL=oauthUrl.guard.js.map

package/dist/oauthTypes/index.d.ts

@@ -4,4 +4,3 @@
  * @module oauthTypes
  */
 export { type OAuthProvider, type ClientAuthMethod, type FetchLike, type OAuthConfig, type AuthorizationUrlOptions, type AuthorizationUrlResult, type CodeExchangeOptions, type OAuthTokenSet, type OAuthUserInfo, } from "./oauth.type.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/oauthTypes/index.js

@@ -4,4 +4,3 @@
  * @module oauthTypes
  */
 export {} from "./oauth.type.js";
-//# sourceMappingURL=index.js.map

package/dist/oauthTypes/oauth.type.d.ts

@@ -162,4 +162,3 @@ export interface OAuthUserInfo {
     /** Raw provider payload, prototype-polluting keys stripped. */
     readonly raw?: Readonly<Record<string, unknown>>;
 }
-//# sourceMappingURL=oauth.type.d.ts.map

package/dist/oauthTypes/oauth.type.js

@@ -4,4 +4,3 @@
  * @module oauthTypes/oauth
  */
 export {};
-//# sourceMappingURL=oauth.type.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zudojs/auth-oauth",
-  "version": "1.2.4",
+  "version": "1.2.6",
   "description": "OAuth2 authorization-code client for the Zudojs framework — PKCE S256, mandatory state, SSRF-guarded endpoints, and provider presets for Google, GitHub, Microsoft, Apple and Discord.",
   "license": "MIT",
   "author": {
@@ -53,8 +53,8 @@
     "directory": "packages/auth-oauth"
   },
   "dependencies": {
-    "@zudojs/errors": "1.3.1",
-    "@zudojs/security": "1.3.2"
+    "@zudojs/errors": "1.4.0",
+    "@zudojs/security": "1.3.4"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",