fastmcp 4.24.4 → 4.25.0

package/dist/{chunk-CAQLTSJ5.js → chunk-JFHOYU3S.js}

@@ -2451,6 +2451,10 @@ var OAuthProxy = class {
     if (contentType.includes("application/x-www-form-urlencoded")) {
       const text = await response.text();
       const params = new URLSearchParams(text);
+      this.rejectUpstreamError({
+        error: params.get("error"),
+        error_description: params.get("error_description")
+      });
       const rawData = {
         access_token: params.get("access_token") || "",
         expires_in: params.get("expires_in") ? parseInt(params.get("expires_in")) : void 0,
@@ -2463,6 +2467,7 @@ var OAuthProxy = class {
       return tokenResponseSchema.parse(rawData);
     }
     const rawJson = await response.json();
+    this.rejectUpstreamError(rawJson);
     return tokenResponseSchema.parse(rawJson);
   }
   /**
@@ -2556,6 +2561,32 @@ var OAuthProxy = class {
       tokenType: tokens.token_type || "Bearer"
     };
   }
+  /**
+   * RFC 6749 §5.2: a provider refuses a token request by naming the error in
+   * the response body. The status that carries it is not fixed — GitHub, whose
+   * own branch exists above, answers every refusal with 200 — so a refusal is
+   * recognised here, from the body, rather than left to fail the token schema
+   * parse. Without this the upstream's own diagnosis (`bad_verification_code`,
+   * `invalid_grant`, …) is replaced by a `ZodError`, which the routes answer as
+   * `server_error` (callback) or `invalid_request` (token).
+   *
+   * The upstream's code is kept as the `OAuthProxyError` code, and its
+   * description when it sent one, so the client is told what the provider
+   * actually refused.
+   */
+  rejectUpstreamError(payload) {
+    if (!payload || typeof payload !== "object") {
+      return;
+    }
+    const { error, error_description } = payload;
+    if (typeof error !== "string" || error === "") {
+      return;
+    }
+    throw new OAuthProxyError(
+      error,
+      typeof error_description === "string" ? error_description : void 0
+    );
+  }
   /**
    * Resolve the client behind a `client_id`: a stored registration if there is
    * one, otherwise — when CIMD is enabled — the client's metadata document.
@@ -3324,4 +3355,4 @@ export {
   DiskStore,
   JWKSVerifier
 };
-//# sourceMappingURL=chunk-CAQLTSJ5.js.map
+//# sourceMappingURL=chunk-JFHOYU3S.js.map