oidc-spa 10.2.5 → 10.2.7

package/esm/vendor/build-runtime/magic-string.mjs

@@ -1,4 +1,4 @@
-// node_modules/magic-string/node_modules/@jridgewell/sourcemap-codec/dist/sourcemap-codec.mjs
+// node_modules/@jridgewell/sourcemap-codec/dist/sourcemap-codec.mjs
 var comma = ",".charCodeAt(0);
 var semicolon = ";".charCodeAt(0);
 var chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "oidc-spa",
-    "version": "10.2.5",
+    "version": "10.2.7",
     "description": "OpenID Connect / OAuth2 solution for client-first Web Applications",
     "repository": {
         "type": "git",
@@ -27,7 +27,7 @@
         "@angular/router": "*",
         "@nuxt/kit": "*",
         "@tanstack/react-router": "*",
-        "@tanstack/react-start": "*",
+        "@tanstack/react-start": ">=1.168.25",
         "@types/react": "*",
         "react": "*",
         "rxjs": "*"

package/src/core/createOidc.ts

@@ -999,6 +999,15 @@ export async function createOidc_nonMemoized<
                                 });
                             }
 
+                            if (error.message === "Invalid client or Invalid client credentials") {
+                                return (
+                                    await import("./diagnostic")
+                                ).createInvalidClientCredentialsInitializationError({
+                                    clientId,
+                                    issuerUri
+                                });
+                            }
+
                             {
                                 const authResponse_error = authResponse.error;
 
@@ -1196,6 +1205,15 @@ export async function createOidc_nonMemoized<
                         });
                     }
 
+                    if (error.message === "Invalid client or Invalid client credentials") {
+                        return (
+                            await import("./diagnostic")
+                        ).createInvalidClientCredentialsInitializationError({
+                            clientId,
+                            issuerUri
+                        });
+                    }
+
                     if (authResponse_error === undefined) {
                         return error;
                     }

package/src/core/diagnostic.ts

@@ -338,6 +338,44 @@ export async function createIframeTimeoutInitializationError(params: {
     });
 }
 
+export function createInvalidClientCredentialsInitializationError(params: {
+    issuerUri: string;
+    clientId: string;
+}): OidcInitializationError {
+    const { issuerUri, clientId } = params;
+
+    return new OidcInitializationError({
+        isAuthServerLikelyDown: false,
+        messageOrCause: [
+            `The token endpoint rejected the OIDC client "${clientId}" with "Invalid client or Invalid client credentials".\n`,
+            `This usually means the client is configured as a confidential/private client and requires a client secret.\n`,
+            `oidc-spa performs the token exchange in the browser, so the OIDC client must be a public client that does not require a client secret.\n`,
+            `Issuer URI: "${issuerUri}"\n`,
+            ...(() => {
+                if (!isKeycloak({ issuerUri })) {
+                    return [
+                        "Check the documentation of your OIDC server and configure this client as a public client using Authorization Code Flow + PKCE."
+                    ];
+                }
+
+                const kc = createKeycloakUtils({ issuerUri });
+
+                return [
+                    `Since it seems that you are using Keycloak, here are the steps to follow:\n`,
+                    `1. Go to the Keycloak admin console: ${kc.adminConsoleUrl_master}\n`,
+                    `2. Log in as an admin user.\n`,
+                    `3. In the top left corner select the realm "${kc.issuerUriParsed.realm}".\n`,
+                    `4. In the left menu, click on "Clients".\n`,
+                    `5. Find "${clientId}" in the list of clients and click on it.\n`,
+                    `6. In "Capability config", turn "Client authentication" off. On older Keycloak versions, set the client access type to "public".\n`,
+                    `7. Save the changes.\n\n`,
+                    `More info: https://docs.oidc-spa.dev/v/v10/providers-configuration/keycloak`
+                ];
+            })()
+        ].join(" ")
+    });
+}
+
 export async function createFailedToFetchTokenEndpointInitializationError(params: {
     issuerUri: string;
     clientId: string;

package/src/tanstack-start/react/createOidcSpaUtils.ts

@@ -1022,7 +1022,7 @@ export function createOidcSpaUtils<
 }
 
 const fetchServerEnvVariableValues = createServerFn({ method: "GET" })
-    .inputValidator((data: { envVarNames: string[] }) => {
+    .validator((data: { envVarNames: string[] }) => {
         if (typeof data !== "object" || data === null) {
             throw new Error("Expected an object");
         }