oidc-caep-client 0.2.5 → 0.2.6-next.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oidc-caep-client",
-  "version": "0.2.5",
+  "version": "0.2.6-next.0",
   "description": "In-browser OpenID Connect public client (PKCE, PAR, DPoP, RFC 9207) with token caching/auto-refresh and a Shared Signals (SSF) / CAEP event receiver",
   "homepage": "https://rcbj.github.io/oidc-caep-client/",
   "repository": {

package/src/discovery.js

@@ -3,12 +3,23 @@ import { ValidationError } from './errors.js';
 
 const cache = new Map();
 
+/**
+ * `s` without its trailing slashes. A loop, not `replace(/\/+$/, '')`: that regex is retried at every
+ * slash of a run that is not at the end, so a long run followed by any other character is quadratic.
+ * @param {string} s
+ */
+function trimTrailingSlashes(s) {
+  let end = s.length;
+  while (end > 0 && s.charCodeAt(end - 1) === 0x2f) end--;
+  return s.slice(0, end);
+}
+
 /**
  * Builds the OpenID Connect Discovery 1.0 §4 URL: the well-known suffix is appended to the issuer.
  * @param {string} issuer
  */
 export function oidcDiscoveryUrl(issuer) {
-  return `${issuer.replace(/\/+$/, '')}/.well-known/openid-configuration`;
+  return `${trimTrailingSlashes(issuer)}/.well-known/openid-configuration`;
 }
 
 /**
@@ -19,7 +30,7 @@ export function oidcDiscoveryUrl(issuer) {
  */
 export function wellKnownUrls(issuer, suffix) {
   const u = new URL(issuer);
-  const path = u.pathname.replace(/\/+$/, '');
+  const path = trimTrailingSlashes(u.pathname);
   const inserted = `${u.origin}/.well-known/${suffix}${path}`;
   const appended = `${u.origin}${path}/.well-known/${suffix}`;
   return inserted === appended ? [inserted] : [inserted, appended];