matrix-js-sdk 41.9.0 → 42.0.0

package/src/client.ts

@@ -242,11 +242,7 @@ import { type RoomMessageEventContent, type StickerEventContent } from "./@types
 import { type ImageInfo } from "./@types/media.ts";
 import { type Capabilities, ServerCapabilities } from "./serverCapabilities.ts";
 import { sha256 } from "./digest.ts";
-import {
-    discoverAndValidateOIDCIssuerWellKnown,
-    type OidcClientConfig,
-    validateAuthMetadataAndKeys,
-} from "./oidc/index.ts";
+import { type ValidatedAuthMetadata, OAuth2Error, isValidAuthMetadata } from "./oauth/index.ts";
 import { type EmptyObject } from "./@types/common.ts";
 import { UnsupportedDelayedEventsEndpointError, UnsupportedStickyEventsEndpointError } from "./errors.ts";
 import { type Transport } from "./matrixrtc/index.ts";
@@ -349,8 +345,7 @@ export interface ICreateClientOpts {
      * Set to false to send the access token to the server via a query parameter rather
      * than the Authorization HTTP header.
      *
-     * Note that as of v1.11 of the Matrix spec, sending the access token via a query
-     * is deprecated.
+     * @deprecated as of v1.11 in https://spec.matrix.org/v1.17/client-server-api/#using-access-tokens
      *
      * Default true.
      */
@@ -8893,34 +8888,23 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     /**
      * Discover and validate the auth metadata for the OAuth 2.0 API.
      *
-     * Fetches /auth_metadata falling back to legacy implementation using /auth_issuer followed by
-     * https://oidc-issuer.example.com/.well-known/openid-configuration and other files linked therein.
      * When successful, validated metadata is returned.
      *
-     * @returns validated authentication metadata and optionally signing keys
+     * @returns validated authentication metadata
      * @throws when delegated auth config is invalid or unreachable
      */
-    public async getAuthMetadata(): Promise<OidcClientConfig> {
-        let authMetadata: unknown | undefined;
-        try {
-            const useStable = await this.isVersionSupported("v1.15");
-            authMetadata = await this.http.request<unknown>(Method.Get, "/auth_metadata", undefined, undefined, {
-                prefix: useStable ? ClientPrefix.V1 : ClientPrefix.Unstable + "/org.matrix.msc2965",
-            });
-        } catch (e) {
-            if (e instanceof MatrixError && e.errcode === "M_UNRECOGNIZED") {
-                // Fall back to older variant of MSC2965
-                const { issuer } = await this.http.request<{
-                    issuer: string;
-                }>(Method.Get, "/auth_issuer", undefined, undefined, {
-                    prefix: ClientPrefix.Unstable + "/org.matrix.msc2965",
-                });
-                return discoverAndValidateOIDCIssuerWellKnown(issuer);
-            }
-            throw e;
+    public async getAuthMetadata(): Promise<ValidatedAuthMetadata> {
+        const useStable = await this.isVersionSupported("v1.15");
+        const authMetadata = await this.http.request(Method.Get, "/auth_metadata", undefined, undefined, {
+            prefix: useStable ? ClientPrefix.V1 : ClientPrefix.Unstable + "/org.matrix.msc2965",
+        });
+
+        if (isValidAuthMetadata(authMetadata)) {
+            return authMetadata;
         }
 
-        return validateAuthMetadataAndKeys(authMetadata);
+        logger.error("Issuer configuration not valid");
+        throw new Error(OAuth2Error.OpSupport);
     }
 }
 

package/src/crypto-api/index.ts

@@ -721,7 +721,7 @@ export interface CryptoApi {
     ///////////////////////////////////////////////////////////////////////////////////////////////////////////////////
 
     /**
-     * Export secrets bundle for transmitting to another device as part of OIDC QR login
+     * Export secrets bundle for transmitting to another device as part of OAuth2 QR login
      */
     exportSecretsBundle?(): Promise<Awaited<ReturnType<SecretsBundle["to_json"]>>>;
 

package/src/crypto-api/verification.ts

@@ -119,7 +119,15 @@ export interface VerificationRequest extends TypedEventEmitter<
     /**
      * Send an `m.key.verification.start` event to start verification via a particular method.
      *
-     * This is normally used when starting a verification via emojis (ie, `method` is set to `m.sas.v1`).
+     * This is used for SAS (emoji) verification: `method` should be set to `m.sas.v1`. It does not start
+     * QR-code verification, and passing a QR-code method (such as `m.reciprocate.v1`, `m.qr_code.scan.v1`,
+     * or `m.qr_code.show.v1`) will be rejected with an "Unsupported verification method" error.
+     *
+     * For QR-code verification, use {@link VerificationRequest#generateQRCode} to display a QR code to the
+     * other device, or {@link VerificationRequest#scanQRCode} to consume a QR code scanned from it. This is
+     * only possible once the `phase` is {@link VerificationPhase.Ready}; when it is, a client can typically
+     * offer the user any of three options: show a QR code, scan the other party's QR code, or fall back to
+     * emoji (SAS) verification via this method.
      *
      * @param method - the name of the verification method to use.
      *
@@ -130,8 +138,10 @@ export interface VerificationRequest extends TypedEventEmitter<
     /**
      * Start a QR code verification by providing a scanned QR code for this verification flow.
      *
-     * Validates the QR code, and if it is ok, sends an `m.key.verification.start` event with `method` set to
-     * `m.reciprocate.v1`, to tell the other side the scan was successful.
+     * Call this once the user has scanned the QR code displayed by the other device (for example, the bytes
+     * produced by that device's {@link VerificationRequest#generateQRCode}). Validates the QR code, and if it
+     * is ok, sends an `m.key.verification.start` event with `method` set to `m.reciprocate.v1`, to tell the
+     * other side the scan was successful.
      *
      * See also {@link VerificationRequest#startVerification} which can be used to start other verification methods.
      *
@@ -149,8 +159,16 @@ export interface VerificationRequest extends TypedEventEmitter<
     /**
      * Generate the data for a QR code allowing the other device to verify this one, if it supports it.
      *
-     * Only returns data once `phase` is {@link VerificationPhase.Ready} and the other party can scan a QR code;
-     * otherwise returns `undefined`.
+     * Returns the QR code data only when all of the following hold; otherwise it returns `undefined`:
+     *  - `phase` is {@link VerificationPhase.Ready};
+     *  - the other party advertises support for scanning a QR code (ie, `otherPartySupportsMethod("m.qr_code.scan.v1")`
+     *    is true); and
+     *  - this device has its cross-signing keys available locally. A frequent cause of an unexpected `undefined`
+     *    is that cross-signing has not been set up or the keys have not yet been fetched, so the QR code cannot be
+     *    constructed even though the phase and method checks pass.
+     *
+     * On success, display the returned bytes as a QR code for the other device to scan; if the other side scans it
+     * and confirms, there is nothing further to do on this side.
      */
     generateQRCode(): Promise<Uint8ClampedArray | undefined>;
 

package/src/http-api/fetch.ts

@@ -208,7 +208,7 @@ export class FetchHttpApi<O extends IHttpOpts> {
      * @returns The parsed response.
      * @throws Error if a problem occurred. This includes network problems and Matrix-specific error JSON.
      */
-    public request<T>(
+    public request<T = unknown>(
         method: Method,
         path: string,
         queryParams?: QueryDict,

package/src/http-api/index.ts

@@ -15,14 +15,7 @@ limitations under the License.
 */
 
 import { FetchHttpApi } from "./fetch.ts";
-import {
-    type FileType,
-    type IContentUri,
-    type IHttpOpts,
-    type Upload,
-    type UploadOpts,
-    type UploadResponse,
-} from "./interface.ts";
+import { type FileType, type IHttpOpts, type Upload, type UploadOpts, type UploadResponse } from "./interface.ts";
 import { MediaPrefix } from "./prefix.ts";
 import { type QueryDict, removeElement } from "../utils.ts";
 import * as callbacks from "../realtime-callbacks.ts";
@@ -176,19 +169,4 @@ export class MatrixHttpApi<O extends IHttpOpts> extends FetchHttpApi<O> {
     public getCurrentUploads(): Upload[] {
         return this.uploads;
     }
-
-    /**
-     * Get the content repository url with query parameters.
-     * @returns An object with a 'base', 'path' and 'params' for base URL,
-     *          path and query parameters respectively.
-     */
-    public getContentUri(): IContentUri {
-        return {
-            base: this.opts.baseUrl,
-            path: MediaPrefix.V3 + "/upload",
-            params: {
-                access_token: this.opts.accessToken!,
-            },
-        };
-    }
 }

package/src/http-api/interface.ts

@@ -21,7 +21,6 @@ import { type QueryDict } from "../utils.ts";
 export type Body = Record<string, any> | BodyInit;
 
 /**
- * @experimental
  * Unencrypted access and (optional) refresh token
  */
 export type AccessTokens = {
@@ -40,7 +39,6 @@ export type AccessTokens = {
 };
 
 /**
- * @experimental
  * Function that performs token refresh using the given refreshToken.
  * Returns a promise that resolves to the refreshed access and (optional) refresh tokens.
  *
@@ -143,15 +141,6 @@ export interface IRequestOpts extends BaseRequestOpts {
     inhibitLogoutEmit?: boolean;
 }
 
-export interface IContentUri {
-    base: string;
-    path: string;
-    params: {
-        // eslint-disable-next-line camelcase
-        access_token: string;
-    };
-}
-
 export enum HttpApiEvent {
     SessionLoggedOut = "Session.logged_out",
     NoConsent = "no_consent",

package/src/matrix.ts

@@ -44,7 +44,7 @@ export * from "./models/typed-event-emitter.ts";
 export * from "./models/user.ts";
 export * from "./models/device.ts";
 export * from "./models/search-result.ts";
-export * from "./oidc/index.ts";
+export * from "./oauth/index.ts";
 export * from "./scheduler.ts";
 export * from "./filter.ts";
 export * from "./timeline-window.ts";

package/src/oauth/authorize.ts

@@ -0,0 +1,274 @@
+/*
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { secureRandomString } from "../randomstring.ts";
+import { OAuth2Error } from "./error.ts";
+import { type ValidatedAuthMetadata } from "./discover.ts";
+import {
+    hasOptionalNumberProperty,
+    hasOptionalStringProperty,
+    hasRequiredNumberProperty,
+    hasRequiredStringProperty,
+    isRecord,
+} from "../@types/type-guards.ts";
+import { Method } from "../http-api";
+import { OAuthGrantType } from "./register.ts";
+import { sleep } from "../utils.ts";
+
+/**
+ * The expected response type from the token endpoint during authorization code flow
+ * Normalized to always use capitalized 'Bearer' for token_type
+ *
+ * See https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.4
+ */
+export type BearerTokenResponse = Omit<ValidTokenResponse, "token_type"> & {
+    token_type: "Bearer";
+};
+
+/**
+ * Metadata from OAuth 2.0 token_endpoint as per
+ * https://datatracker.ietf.org/doc/html/rfc6749#section-5.1
+ * With validated properties required in type
+ *
+ * This response is expected for the authorization code grant and refresh token grant,
+ * as defined in the Matrix spec.
+ */
+interface ValidTokenResponse {
+    token_type: "Bearer" | "bearer";
+    access_token: string;
+    expires_in?: number;
+    refresh_token?: string;
+    scope?: string;
+}
+
+/**
+ * Validate the given response matches the format expected for a {@link ValidTokenResponse}
+ * @param response - the response to validate
+ * @throws if the response does not match the expected format
+ */
+export function validateBearerTokenResponse(response: unknown): asserts response is ValidTokenResponse {
+    if (
+        !isRecord(response) ||
+        !hasRequiredStringProperty(response, "token_type") ||
+        // token_type is case-insensitive, some OPs return `token_type: "bearer"`
+        response["token_type"].toLowerCase() !== "bearer" ||
+        !hasRequiredStringProperty(response, "access_token") ||
+        !hasOptionalNumberProperty(response, "expires_in") ||
+        !hasOptionalStringProperty(response, "refresh_token") ||
+        !hasOptionalStringProperty(response, "scope")
+    ) {
+        throw new Error(OAuth2Error.InvalidBearerTokenResponse);
+    }
+}
+
+/**
+ * Generate the scope used in authorization request with OAuth2 IdP
+ * @returns scope
+ */
+export const generateScope = (deviceId?: string): string => {
+    const safeDeviceId = deviceId ?? secureRandomString(10);
+    return `urn:matrix:client:api:* urn:matrix:client:device:${safeDeviceId}`;
+};
+
+/**
+ * Normalize token_type to use capital case to make consuming the token response easier
+ * token_type is case insensitive, and it is spec-compliant for OPs to return token_type: "bearer"
+ * Later, when used in auth headers it is case sensitive and must be Bearer
+ * See: https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.4
+ *
+ * @param response - validated token response
+ * @returns response with token_type set to 'Bearer'
+ */
+export const normalizeBearerTokenResponseTokenType = (response: ValidTokenResponse): BearerTokenResponse => ({
+    ...response,
+    token_type: "Bearer",
+});
+
+/**
+ * Response from the OAuth2 token endpoint when exchanging a token for grant_type device_code.
+ */
+export interface DeviceAccessTokenResponse {
+    access_token: string;
+    token_type: string;
+    refresh_token?: string;
+    scope?: string;
+    expires_in?: number;
+}
+
+/**
+ * Validate the given response matches the format expected for a {@link DeviceAccessTokenResponse}
+ * @param response - the response to validate
+ * @throws if the response does not match the expected format
+ */
+export function isValidDeviceAccessTokenResponse(response: unknown): response is DeviceAccessTokenResponse {
+    return (
+        isRecord(response) &&
+        hasRequiredStringProperty(response, "access_token") &&
+        hasRequiredStringProperty(response, "token_type") &&
+        hasOptionalStringProperty(response, "refresh_token") &&
+        hasOptionalStringProperty(response, "scope") &&
+        hasOptionalNumberProperty(response, "expires_in")
+    );
+}
+
+/**
+ * Error from the OAuth2 token endpoint when exchanging a token for grant_type device_code.
+ */
+export interface DeviceAccessTokenError {
+    error: string;
+    error_description?: string;
+    error_uri?: string;
+    session_state?: string;
+}
+
+/**
+ * Response from the OAuth2 device authorization endpoint.
+ * As specified in https://datatracker.ietf.org/doc/html/rfc8628#section-3.2
+ */
+export interface DeviceAuthorizationResponse {
+    /** The device verification code. */
+    device_code: string;
+    /** The end-user verification code. */
+    user_code: string;
+    /**
+     * The end-user verification URI on the authorization server.
+     * The URI should be short and easy to remember as end users will be asked to manually type it into their user agent.
+     */
+    verification_uri: string;
+    /**
+     * The URI which doesn’t require the user to manually type the user_code, designed for non-textual transmission.
+     */
+    verification_uri_complete?: string;
+    /** The lifetime in seconds of the "device_code" and "user_code". */
+    expires_in: number;
+    /**
+     * The minimum amount of time in seconds that the client SHOULD wait between polling requests to the token endpoint.
+     * If no value is provided, clients MUST use 5 as the default.
+     */
+    interval?: number;
+}
+
+/**
+ * Validate the given response matches the format expected for a {@link DeviceAuthorizationResponse}
+ * @param response - the response to validate
+ * @throws if the response does not match the expected format
+ */
+export function validateDeviceAuthorizationResponse(
+    response: unknown,
+): asserts response is DeviceAuthorizationResponse {
+    if (
+        !isRecord(response) ||
+        !hasRequiredStringProperty(response, "device_code") ||
+        !hasRequiredStringProperty(response, "user_code") ||
+        !hasRequiredStringProperty(response, "verification_uri") ||
+        !hasRequiredNumberProperty(response, "expires_in") ||
+        !hasOptionalStringProperty(response, "verification_uri_complete") ||
+        !hasOptionalNumberProperty(response, "interval")
+    ) {
+        throw new Error(OAuth2Error.InvalidDeviceAuthorizationResponse);
+    }
+}
+
+/**
+ * Begin OAuth2 device authorization flow.
+ * @param options - The device authorization parameters.
+ * @param options.clientId - the client ID returned from client registration.
+ * @param options.scope - the scope to request for authorization.
+ * @param options.metadata - the validated OAuth2 metadata for the Identity Provider.
+ * @returns a promise that resolves to a device access token response,
+ *   or an error response if the user denies authorization or the device code expires.
+ */
+export const startDeviceAuthorization = async ({
+    clientId,
+    scope,
+    metadata,
+}: {
+    clientId: string;
+    scope: string;
+    metadata: ValidatedAuthMetadata;
+}): Promise<DeviceAuthorizationResponse> => {
+    const body = new URLSearchParams({ client_id: clientId, scope: scope }).toString();
+
+    const url = metadata.device_authorization_endpoint;
+    if (!url) {
+        throw new Error("No device_authorization_endpoint given");
+    }
+
+    const response = await fetch(url, {
+        method: Method.Post,
+        headers: {
+            "Content-Type": "application/x-www-form-urlencoded",
+        },
+        body,
+    });
+
+    const data = await response.json();
+    validateDeviceAuthorizationResponse(data);
+    return data;
+};
+
+/**
+ * Polls the OAuth2 token endpoint until we get a device access token response, or encounter an unrecoverable error.
+ * @param options - The device authorization parameters.
+ * @param options.session - The session returned from a previous call to {@link startDeviceAuthorization}.
+ * @param options.metadata - The validated OAuth2 metadata for the Identity Provider.
+ * @param options.clientId - The client ID returned from client registration.
+ * @returns a promise that resolves to a device access token response,
+ *   or an error response if the user denies authorization or the device code expires.
+ */
+export const waitForDeviceAuthorization = async ({
+    session,
+    metadata,
+    clientId,
+}: {
+    session: DeviceAuthorizationResponse;
+    metadata: ValidatedAuthMetadata;
+    clientId: string;
+}): Promise<DeviceAccessTokenResponse | DeviceAccessTokenError> => {
+    let interval = (session.interval ?? 5) * 1000; // poll interval
+    const expiration = Date.now() + session.expires_in * 1000;
+    do {
+        const body = new URLSearchParams({
+            device_code: session.device_code,
+            grant_type: OAuthGrantType.DeviceAuthorization,
+            client_id: clientId,
+        }).toString();
+        const response = await fetch(metadata.token_endpoint, {
+            method: Method.Post,
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body,
+        });
+
+        const data = await response.json();
+
+        if (response.ok && isValidDeviceAccessTokenResponse(data)) {
+            return data;
+        }
+        const errorResponse = data as DeviceAccessTokenError;
+        switch (errorResponse.error) {
+            case "authorization_pending":
+                break;
+            case "slow_down":
+                interval += 5000;
+                break;
+            case "access_denied":
+            case "expired_token":
+                return errorResponse;
+        }
+        await sleep(interval);
+    } while (Date.now() < expiration);
+    return { error: "expired" };
+};

package/src/oauth/discover.ts

@@ -0,0 +1,102 @@
+/*
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import {
+    hasOptionalStringProperty,
+    hasRequiredStringProperty,
+    isRecord,
+    optionalStringArrayProperty,
+    requiredArrayValue,
+} from "../@types/type-guards.ts";
+import { OAuthGrantType } from "./index.ts";
+
+/**
+ * Metadata from OAuth 2.0 client authentication API as per
+ * https://spec.matrix.org/v1.18/client-server-api/#get_matrixclientv1auth_metadata
+ * With validated properties required in type
+ */
+export interface ValidatedAuthMetadata {
+    /** List of actions that the account management URL supports. */
+    account_management_actions_supported?: string[];
+    /** The URL where the user is able to access the account management capabilities of the homeserver. */
+    account_management_uri?: string;
+    /** URL of the authorization endpoint, necessary to use the authorization code grant. */
+    authorization_endpoint: string;
+    /**
+     * List of OAuth 2.0 Proof Key for Code Exchange (PKCE) code challenge methods that the server supports at the authorization endpoint.
+     *
+     * This array MUST contain at least the S256 value, for improved security in the authorization code grant.
+     */
+    code_challenge_methods_supported: string[];
+    /** URL of the device authorization endpoint, as defined in RFC 8628, necessary to use the device authorization grant. */
+    device_authorization_endpoint?: string;
+    /**
+     * List of OAuth 2.0 grant type strings that the server supports at the token endpoint.
+     *
+     * This array MUST contain at least the authorization_code and refresh_token values,
+     * for clients to be able to use the authorization code grant and refresh token grant, respectively.
+     */
+    grant_types_supported: string[];
+    /** The authorization server’s issuer identifier, which is a URL that uses the https scheme and has no query or fragment components. */
+    issuer: string;
+    /** List of OpenID Connect prompt values that the server supports at the authorization endpoint. */
+    prompt_values_supported?: string[];
+    /** URL of the client registration endpoint, necessary to perform dynamic registration of a client. */
+    registration_endpoint: string;
+    /**
+     * List of OAuth 2.0 response mode strings that the server supports at the authorization endpoint.
+     *
+     * This array MUST contain at least the query and fragment values, for improved security in the authorization code grant.
+     */
+    response_modes_supported: string[];
+    /**
+     * List of OAuth 2.0 response type strings that the server supports at the authorization endpoint.
+     *
+     * This array MUST contain at least the code value, for clients to be able to use the authorization code grant.
+     */
+    response_types_supported: string[];
+    /** URL of the revocation endpoint, necessary to log out a client by invalidating its access and refresh tokens. */
+    revocation_endpoint: string;
+    /** URL of the token endpoint, used by the grants. */
+    token_endpoint: string;
+}
+
+/**
+ * Validates OAuth 2.0 auth metadata as defined by
+ * https://spec.matrix.org/v1.18/client-server-api/#get_matrixclientv1auth_metadata
+ * @param authMetadata - json object
+ * @returns boolean of whether the input is valid
+ */
+export const isValidAuthMetadata = (authMetadata: unknown): authMetadata is ValidatedAuthMetadata => {
+    return (
+        isRecord(authMetadata) &&
+        hasRequiredStringProperty(authMetadata, "issuer") &&
+        hasRequiredStringProperty(authMetadata, "authorization_endpoint") &&
+        hasRequiredStringProperty(authMetadata, "token_endpoint") &&
+        hasRequiredStringProperty(authMetadata, "revocation_endpoint") &&
+        hasRequiredStringProperty(authMetadata, "registration_endpoint") &&
+        hasOptionalStringProperty(authMetadata, "account_management_uri") &&
+        hasOptionalStringProperty(authMetadata, "device_authorization_endpoint") &&
+        optionalStringArrayProperty(authMetadata, "account_management_actions_supported") &&
+        optionalStringArrayProperty(authMetadata, "prompt_values_supported") &&
+        requiredArrayValue(authMetadata, "response_modes_supported", "query") &&
+        requiredArrayValue(authMetadata, "response_modes_supported", "fragment") &&
+        requiredArrayValue(authMetadata, "response_types_supported", "code") &&
+        requiredArrayValue(authMetadata, "grant_types_supported", OAuthGrantType.AuthorizationCode) &&
+        requiredArrayValue(authMetadata, "grant_types_supported", OAuthGrantType.RefreshToken) &&
+        requiredArrayValue(authMetadata, "code_challenge_methods_supported", "S256")
+    );
+};

package/src/{oidc → oauth}/error.ts

@@ -15,19 +15,20 @@ limitations under the License.
 */
 
 /**
- * Errors expected to be encountered during OIDC discovery, client registration, and authentication.
+ * Errors expected to be encountered during OAuth2 discovery, client registration, and authentication.
  * Not intended to be displayed directly to the user.
  */
-export enum OidcError {
-    NotSupported = "OIDC authentication not supported",
-    Misconfigured = "OIDC is misconfigured",
-    General = "Something went wrong with OIDC discovery",
-    OpSupport = "Configured OIDC OP does not support required functions",
+export enum OAuth2Error {
+    General = "Something went wrong with OAuth2 discovery",
+    OpSupport = "Configured OAuth2 OP does not support required functions",
     DynamicRegistrationNotSupported = "Dynamic registration not supported",
     DynamicRegistrationFailed = "Dynamic registration failed",
     DynamicRegistrationInvalid = "Dynamic registration invalid response",
     CodeExchangeFailed = "Failed to exchange code for token",
     InvalidBearerTokenResponse = "Invalid bearer token response",
-    InvalidIdToken = "Invalid ID token",
+    InvalidDeviceAuthorizationResponse = "Invalid device authorization response",
     MissingOrInvalidStoredState = "State required to finish logging in is not found in storage.",
+    RefreshTokenFailed = "Failed to refresh token",
+    RevokeTokenFailed = "Failed to revoke token",
+    DeviceAuthorizationGrantFailed = "Failed to perform device authorization grant",
 }