toolcraft 0.0.27 → 0.0.34

package/node_modules/auth-store/dist/encrypted-file-store.js

@@ -1,7 +1,8 @@
-import { createCipheriv, createDecipheriv, randomBytes, scrypt } from "node:crypto";
+import { createCipheriv, createDecipheriv, randomBytes, randomUUID, scrypt } from "node:crypto";
 import { promises as fs } from "node:fs";
 import { homedir, hostname, userInfo } from "node:os";
 import path from "node:path";
+import { hasOwnErrorCode } from "./error-codes.js";
 const derivedKeyCache = new Map();
 const ENCRYPTION_ALGORITHM = "aes-256-gcm";
 const ENCRYPTION_VERSION = 1;
@@ -9,7 +10,6 @@ const ENCRYPTION_KEY_BYTES = 32;
 const ENCRYPTION_IV_BYTES = 12;
 const ENCRYPTION_AUTH_TAG_BYTES = 16;
 const ENCRYPTION_FILE_MODE = 0o600;
-let temporaryFileSequence = 0;
 export class EncryptedFileStore {
     fs;
     filePath;
@@ -35,7 +35,7 @@ export class EncryptedFileStore {
         this.getRandomBytes = input.getRandomBytes ?? randomBytes;
     }
     async get() {
-        await this.assertRegularCredentialPath();
+        await this.assertCredentialPathHasNoSymbolicLinks(this.filePath);
         let rawDocument;
         try {
             rawDocument = await this.fs.readFile(this.filePath, "utf8");
@@ -69,7 +69,7 @@ export class EncryptedFileStore {
         }
     }
     async set(value) {
-        await this.assertRegularCredentialPath();
+        await this.assertCredentialPathHasNoSymbolicLinks(this.filePath);
         const key = await this.getEncryptionKey();
         const iv = this.getRandomBytes(ENCRYPTION_IV_BYTES);
         const cipher = createCipheriv(ENCRYPTION_ALGORITHM, key, iv);
@@ -85,26 +85,29 @@ export class EncryptedFileStore {
             ciphertext: ciphertext.toString("base64")
         };
         await this.fs.mkdir(path.dirname(this.filePath), { recursive: true });
-        await this.assertRegularCredentialPath();
-        const temporaryPath = `${this.filePath}.${process.pid}.${temporaryFileSequence++}.tmp`;
+        await this.assertCredentialPathHasNoSymbolicLinks(this.filePath);
+        const temporaryPath = `${this.filePath}.${process.pid}.${randomUUID()}.tmp`;
+        let temporaryCreated = false;
         try {
+            await this.assertCredentialPathHasNoSymbolicLinks(temporaryPath);
             await this.fs.writeFile(temporaryPath, JSON.stringify(document), {
                 encoding: "utf8",
                 flag: "wx",
                 mode: ENCRYPTION_FILE_MODE
             });
+            temporaryCreated = true;
             await this.fs.chmod(temporaryPath, ENCRYPTION_FILE_MODE);
             await this.fs.rename(temporaryPath, this.filePath);
         }
         catch (error) {
-            if (!isAlreadyExistsError(error)) {
+            if (temporaryCreated || !isAlreadyExistsError(error)) {
                 await removeIfPresent(this.fs, temporaryPath).catch(() => undefined);
             }
             throw error;
         }
     }
     async delete() {
-        await this.assertRegularCredentialPath();
+        await this.assertCredentialPathHasNoSymbolicLinks(this.filePath);
         try {
             await this.fs.unlink(this.filePath);
         }
@@ -114,8 +117,8 @@ export class EncryptedFileStore {
             }
         }
     }
-    async assertRegularCredentialPath() {
-        const resolvedPath = path.resolve(this.filePath);
+    async assertCredentialPathHasNoSymbolicLinks(targetPath) {
+        const resolvedPath = path.resolve(targetPath);
         const protectedPaths = getProtectedCredentialPaths(resolvedPath, this.symbolicLinkCheckStartPath);
         for (const currentPath of protectedPaths) {
             try {
@@ -179,12 +182,6 @@ async function removeIfPresent(fileSystem, filePath) {
         }
     }
 }
-function isAlreadyExistsError(error) {
-    return (typeof error === "object" &&
-        error !== null &&
-        "code" in error &&
-        error.code === "EEXIST");
-}
 function defaultMachineIdentity() {
     return {
         hostname: hostname(),
@@ -222,19 +219,23 @@ function parseEncryptedDocument(raw) {
         if (!isRecord(parsed)) {
             return null;
         }
-        if (parsed.version !== ENCRYPTION_VERSION) {
+        const version = getOwnEntry(parsed, "version");
+        const iv = getOwnEntry(parsed, "iv");
+        const authTag = getOwnEntry(parsed, "authTag");
+        const ciphertext = getOwnEntry(parsed, "ciphertext");
+        if (version !== ENCRYPTION_VERSION) {
             return null;
         }
-        if (typeof parsed.iv !== "string" ||
-            typeof parsed.authTag !== "string" ||
-            typeof parsed.ciphertext !== "string") {
+        if (typeof iv !== "string" ||
+            typeof authTag !== "string" ||
+            typeof ciphertext !== "string") {
             return null;
         }
         return {
-            version: parsed.version,
-            iv: parsed.iv,
-            authTag: parsed.authTag,
-            ciphertext: parsed.ciphertext
+            version,
+            iv,
+            authTag,
+            ciphertext
         };
     }
     catch {
@@ -244,9 +245,12 @@ function parseEncryptedDocument(raw) {
 function isRecord(value) {
     return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
+function getOwnEntry(record, key) {
+    return Object.prototype.hasOwnProperty.call(record, key) ? record[key] : undefined;
+}
 function isNotFoundError(error) {
-    return Boolean(error &&
-        typeof error === "object" &&
-        "code" in error &&
-        error.code === "ENOENT");
+    return hasOwnErrorCode(error, "ENOENT");
+}
+function isAlreadyExistsError(error) {
+    return hasOwnErrorCode(error, "EEXIST");
 }

package/node_modules/auth-store/dist/error-codes.d.ts

@@ -0,0 +1 @@
+export declare function hasOwnErrorCode(error: unknown, code: string): boolean;

package/node_modules/auth-store/dist/error-codes.js

@@ -0,0 +1,5 @@
+export function hasOwnErrorCode(error, code) {
+    return (error instanceof Error &&
+        Object.prototype.hasOwnProperty.call(error, "code") &&
+        error.code === code);
+}

package/node_modules/auth-store/dist/keychain-store.js

@@ -12,8 +12,8 @@ export class KeychainStore {
     }
     async get() {
         const result = await this.executeSecurityCommand(["find-generic-password", "-s", this.service, "-a", this.account, "-w"], "read secret from macOS Keychain");
-        if (result.exitCode === 0) {
-            return stripTrailingLineBreak(result.stdout);
+        if (getCommandExitCode(result) === 0) {
+            return stripTrailingLineBreak(getCommandOutput(result, "stdout"));
         }
         if (isKeychainEntryNotFound(result)) {
             return null;
@@ -33,13 +33,13 @@ export class KeychainStore {
             "-U",
             "-w"
         ], "store secret in macOS Keychain", { stdin: value });
-        if (result.exitCode !== 0) {
+        if (getCommandExitCode(result) !== 0) {
             throw createSecurityCliFailure("store secret in macOS Keychain", result);
         }
     }
     async delete() {
         const result = await this.executeSecurityCommand(["delete-generic-password", "-s", this.service, "-a", this.account], "delete secret from macOS Keychain");
-        if (result.exitCode === 0 || isKeychainEntryNotFound(result)) {
+        if (getCommandExitCode(result) === 0 || isKeychainEntryNotFound(result)) {
             return;
         }
         throw createSecurityCliFailure("delete secret from macOS Keychain", result);
@@ -121,12 +121,27 @@ function stripTrailingLineBreak(value) {
     return value;
 }
 function isKeychainEntryNotFound(result) {
-    return result.exitCode === KEYCHAIN_ITEM_NOT_FOUND_EXIT_CODE;
+    return getCommandExitCode(result) === KEYCHAIN_ITEM_NOT_FOUND_EXIT_CODE;
 }
 function createSecurityCliFailure(operation, result) {
-    const details = result.stderr.trim() || result.stdout.trim();
+    const exitCode = getCommandExitCode(result);
+    const details = getCommandOutput(result, "stderr").trim()
+        || getCommandOutput(result, "stdout").trim();
     if (details) {
-        return new Error(`Failed to ${operation}: security exited with code ${result.exitCode}: ${details}`);
+        return new Error(`Failed to ${operation}: security exited with code ${exitCode}: ${details}`);
     }
-    return new Error(`Failed to ${operation}: security exited with code ${result.exitCode}`);
+    return new Error(`Failed to ${operation}: security exited with code ${exitCode}`);
+}
+function getCommandExitCode(result) {
+    const value = getOwnEntry(result, "exitCode");
+    return typeof value === "number" && Number.isInteger(value) ? value : 1;
+}
+function getCommandOutput(result, key) {
+    const value = getOwnEntry(result, key);
+    return typeof value === "string" ? value : "";
+}
+function getOwnEntry(record, key) {
+    return Object.prototype.hasOwnProperty.call(record, key)
+        ? record[key]
+        : undefined;
 }

package/node_modules/mcp-oauth/dist/client/auth-store-session-store.js

@@ -41,11 +41,13 @@ export function createAuthStoreClientStore(options) {
                 return null;
             }
             const parsed = JSON.parse(value);
-            if (typeof parsed === "object"
-                && parsed !== null
-                && !Array.isArray(parsed)
-                && typeof parsed.clientId === "string") {
-                return parsed;
+            const clientId = isObjectRecord(parsed) ? getOwnString(parsed, "clientId") : undefined;
+            if (clientId !== undefined) {
+                const client = { clientId };
+                if (isObjectRecord(parsed) && Object.prototype.hasOwnProperty.call(parsed, "clientSecret")) {
+                    client.clientSecret = getOwnEntry(parsed, "clientSecret");
+                }
+                return client;
             }
             throw new Error("Stored OAuth client must be a JSON object with clientId");
         },
@@ -98,3 +100,13 @@ function createIssuerSecretStore(issuer, options) {
         accountPrefix: "issuer",
     });
 }
+function isObjectRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function getOwnEntry(record, key) {
+    return Object.prototype.hasOwnProperty.call(record, key) ? record[key] : undefined;
+}
+function getOwnString(record, key) {
+    const value = getOwnEntry(record, key);
+    return typeof value === "string" ? value : undefined;
+}

package/node_modules/mcp-oauth/dist/client/authorization-state.js

@@ -15,20 +15,33 @@ export function parseAuthorizationState(value) {
     try {
         const decoded = Buffer.from(value, "base64url").toString("utf8");
         const parsed = JSON.parse(decoded);
-        if (parsed.v !== 1
-            || typeof parsed.n !== "string"
-            || parsed.n.length === 0
-            || typeof parsed.i !== "string"
-            || parsed.i.length === 0
-            || typeof parsed.r !== "boolean") {
+        if (!isObjectRecord(parsed)) {
+            return null;
+        }
+        const version = getOwnEntry(parsed, "v");
+        const nonce = getOwnEntry(parsed, "n");
+        const issuer = getOwnEntry(parsed, "i");
+        const requireIssuer = getOwnEntry(parsed, "r");
+        if (version !== 1
+            || typeof nonce !== "string"
+            || nonce.length === 0
+            || typeof issuer !== "string"
+            || issuer.length === 0
+            || typeof requireIssuer !== "boolean") {
             return null;
         }
         return {
-            issuer: parsed.i,
-            requireIssuer: parsed.r,
+            issuer,
+            requireIssuer,
         };
     }
     catch {
         return null;
     }
 }
+function isObjectRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function getOwnEntry(record, key) {
+    return Object.prototype.hasOwnProperty.call(record, key) ? record[key] : undefined;
+}

package/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -98,7 +98,7 @@ export function createDefaultOAuthClientProvider(options) {
                 while (true) {
                     try {
                         refreshedTokens = await refreshAccessToken({
-                            tokenEndpoint: discovery.authorizationServerMetadata.token_endpoint,
+                            tokenEndpoint: requireOwnString(discovery.authorizationServerMetadata, "token_endpoint", "Authorization server metadata"),
                             clientId: session.client.clientId,
                             clientSecret: session.client.clientSecret,
                             refreshToken: session.tokens.refreshToken,
@@ -184,7 +184,7 @@ export function createDefaultOAuthClientProvider(options) {
                     });
                     const code = await loopback.waitForCode(authorizationUrl);
                     const tokens = await exchangeAuthorizationCode({
-                        tokenEndpoint: discovery.authorizationServerMetadata.token_endpoint,
+                        tokenEndpoint: requireOwnString(discovery.authorizationServerMetadata, "token_endpoint", "Authorization server metadata"),
                         clientId: resolvedClient.client.clientId,
                         clientSecret: resolvedClient.client.clientSecret,
                         code,
@@ -239,7 +239,7 @@ export function createDefaultOAuthClientProvider(options) {
                 },
             };
         }
-        const registrationEndpoint = discovery.authorizationServerMetadata.registration_endpoint;
+        const registrationEndpoint = getOwnString(discovery.authorizationServerMetadata, "registration_endpoint");
         if (registrationEndpoint === undefined && options.client.clientId !== undefined) {
             return {
                 kind: "static",
@@ -290,14 +290,16 @@ export function createDefaultOAuthClientProvider(options) {
             body: JSON.stringify(registrationBody),
         });
         const payload = await readOAuthJsonObjectResponse(response);
-        if (typeof payload.client_id !== "string" ||
-            payload.client_id.trim().length === 0) {
+        const clientId = getOwnString(payload, "client_id");
+        if (clientId === undefined ||
+            clientId.trim().length === 0) {
             throw new Error("OAuth client registration response missing client_id");
         }
+        const clientSecret = getOwnString(payload, "client_secret");
         const registeredClient = {
-            clientId: payload.client_id,
-            clientSecret: typeof payload.client_secret === "string" && payload.client_secret.length > 0
-                ? payload.client_secret
+            clientId,
+            clientSecret: clientSecret !== undefined && clientSecret.length > 0
+                ? clientSecret
                 : undefined,
         };
         await saveRegisteredClient(discovery.authorizationServer, registeredClient);
@@ -324,12 +326,13 @@ export function createDefaultOAuthClientProvider(options) {
             return null;
         }
         const client = await clientStore.load(issuer);
-        if (client !== null && !isUsableClient(client)) {
+        const normalizedClient = client === null ? null : normalizeStoredClient(client);
+        if (client !== null && normalizedClient === null) {
             await clientStore.clear(issuer);
             return null;
         }
-        registeredClients.set(issuer, client);
-        return client;
+        registeredClients.set(issuer, normalizedClient);
+        return normalizedClient;
     }
     async function saveRegisteredClient(issuer, client) {
         registeredClients.set(issuer, client);
@@ -345,7 +348,7 @@ export function createDefaultOAuthClientProvider(options) {
     }
 }
 function isProviderOptions(options) {
-    return "provider" in options;
+    return Object.prototype.hasOwnProperty.call(options, "provider");
 }
 function isExpired(tokens, now) {
     return tokens.expiresAt !== null && tokens.expiresAt <= now();
@@ -361,11 +364,15 @@ function resolveDiscovery(discovery, session) {
         return undefined;
     }
     const metadata = session.discovery.authorizationServerMetadata;
-    if (typeof metadata.issuer !== "string" ||
-        typeof metadata.authorization_endpoint !== "string" ||
-        typeof metadata.token_endpoint !== "string" ||
-        !Array.isArray(metadata.code_challenge_methods_supported) ||
-        !metadata.code_challenge_methods_supported.includes("S256")) {
+    const issuer = getOwnString(metadata, "issuer");
+    const authorizationEndpoint = getOwnString(metadata, "authorization_endpoint");
+    const tokenEndpoint = getOwnString(metadata, "token_endpoint");
+    const codeChallengeMethodsSupported = getOwnStringArray(metadata, "code_challenge_methods_supported");
+    if (issuer === undefined ||
+        authorizationEndpoint === undefined ||
+        tokenEndpoint === undefined ||
+        codeChallengeMethodsSupported === undefined ||
+        !codeChallengeMethodsSupported.includes("S256")) {
         return undefined;
     }
     return {
@@ -389,39 +396,96 @@ function normalizeLoadedSession(session) {
     if (session === null) {
         return null;
     }
-    if (!isUsableClient(session.client)) {
+    const client = normalizeStoredClient(getOwnEntry(session, "client"));
+    if (client === null) {
         return { ...session, client: { clientId: "" }, tokens: undefined };
     }
-    return isUsableTokens(session.tokens)
-        ? session
-        : { ...session, tokens: undefined };
+    return {
+        ...session,
+        client,
+        tokens: normalizeStoredTokens(getOwnEntry(session, "tokens")),
+    };
 }
-function isUsableClient(client) {
-    return (typeof client.clientId === "string"
-        && client.clientId.trim().length > 0
-        && (client.clientSecret === undefined
-            || (typeof client.clientSecret === "string" && client.clientSecret.trim().length > 0)));
+function normalizeStoredClient(value) {
+    if (!isObjectRecord(value)) {
+        return null;
+    }
+    const clientId = getOwnString(value, "clientId");
+    if (clientId === undefined || clientId.trim().length === 0) {
+        return null;
+    }
+    const clientSecret = getOwnEntry(value, "clientSecret");
+    if (clientSecret === undefined) {
+        return { clientId };
+    }
+    if (typeof clientSecret !== "string" || clientSecret.trim().length === 0) {
+        return null;
+    }
+    return { clientId, clientSecret };
 }
-function isUsableTokens(tokens) {
-    if (tokens === undefined) {
-        return true;
-    }
-    return (typeof tokens.accessToken === "string"
-        && tokens.accessToken.trim().length > 0
-        && tokens.tokenType === "Bearer"
-        && (tokens.expiresAt === null || (typeof tokens.expiresAt === "number" && Number.isFinite(tokens.expiresAt)))
-        && (tokens.refreshToken === undefined
-            || (typeof tokens.refreshToken === "string" && tokens.refreshToken.trim().length > 0)));
+function normalizeStoredTokens(value) {
+    if (value === undefined || !isObjectRecord(value)) {
+        return undefined;
+    }
+    const accessToken = getOwnString(value, "accessToken");
+    const tokenType = getOwnString(value, "tokenType");
+    const expiresAt = getOwnEntry(value, "expiresAt");
+    const refreshToken = getOwnEntry(value, "refreshToken");
+    const scope = getOwnString(value, "scope");
+    const normalizedRefreshToken = typeof refreshToken === "string" ? refreshToken : undefined;
+    if (accessToken === undefined ||
+        accessToken.trim().length === 0 ||
+        tokenType !== "Bearer" ||
+        !(expiresAt === null ||
+            (typeof expiresAt === "number" && Number.isFinite(expiresAt))) ||
+        (refreshToken !== undefined &&
+            (typeof refreshToken !== "string" || refreshToken.trim().length === 0))) {
+        return undefined;
+    }
+    return {
+        accessToken,
+        tokenType,
+        expiresAt,
+        ...(normalizedRefreshToken === undefined ? {} : { refreshToken: normalizedRefreshToken }),
+        ...(scope === undefined || scope.length === 0 ? {} : { scope }),
+    };
 }
 function getClientMetadata(client) {
     return client.metadata;
 }
+function getOwnEntry(record, key) {
+    return Object.prototype.hasOwnProperty.call(record, key)
+        ? record[key]
+        : undefined;
+}
+function isObjectRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function getOwnString(record, key) {
+    const value = getOwnEntry(record, key);
+    return typeof value === "string" ? value : undefined;
+}
+function requireOwnString(record, key, label) {
+    const value = getOwnString(record, key);
+    if (value === undefined) {
+        throw new Error(`${label} is missing ${key}`);
+    }
+    return value;
+}
+function getOwnStringArray(record, key) {
+    const value = getOwnEntry(record, key);
+    return Array.isArray(value) && value.every((entry) => typeof entry === "string")
+        ? value
+        : undefined;
+}
 function buildAuthorizationUrl(input) {
-    const url = new URL(input.metadata.authorization_endpoint);
+    const authorizationEndpoint = requireOwnString(input.metadata, "authorization_endpoint", "Authorization server metadata");
+    const issuer = requireOwnString(input.metadata, "issuer", "Authorization server metadata");
+    const url = new URL(authorizationEndpoint);
     const resource = canonicalizeResourceIndicator(input.resource);
     const state = createAuthorizationState({
-        issuer: input.metadata.issuer,
-        requireIssuer: input.metadata.authorization_response_iss_parameter_supported === true,
+        issuer,
+        requireIssuer: getOwnEntry(input.metadata, "authorization_response_iss_parameter_supported") === true,
     });
     url.searchParams.set("response_type", "code");
     url.searchParams.set("client_id", input.clientId);
@@ -436,7 +500,7 @@ function buildAuthorizationUrl(input) {
     return url.toString();
 }
 function assertS256PkceSupport(metadata) {
-    if (!metadata.code_challenge_methods_supported.includes("S256")) {
+    if (!getOwnStringArray(metadata, "code_challenge_methods_supported")?.includes("S256")) {
         throw new Error("Authorization server metadata must advertise code_challenge_methods_supported including S256");
     }
 }
@@ -460,13 +524,16 @@ function assertSecureUrl(value, label) {
     throw new Error(`${label} must use https unless it targets a loopback host`);
 }
 function assertSecureOAuthFlowEndpoints(metadata) {
-    assertNoAccessTokenInUrl(metadata.authorization_endpoint, "Authorization endpoint");
-    assertNoAccessTokenInUrl(metadata.token_endpoint, "Token endpoint");
-    assertSecureUrl(metadata.authorization_endpoint, "Authorization endpoint");
-    assertSecureUrl(metadata.token_endpoint, "Token endpoint");
-    if (metadata.registration_endpoint !== undefined) {
-        assertNoAccessTokenInUrl(metadata.registration_endpoint, "Registration endpoint");
-        assertSecureUrl(metadata.registration_endpoint, "Registration endpoint");
+    const authorizationEndpoint = requireOwnString(metadata, "authorization_endpoint", "Authorization server metadata");
+    const tokenEndpoint = requireOwnString(metadata, "token_endpoint", "Authorization server metadata");
+    const registrationEndpoint = getOwnString(metadata, "registration_endpoint");
+    assertNoAccessTokenInUrl(authorizationEndpoint, "Authorization endpoint");
+    assertNoAccessTokenInUrl(tokenEndpoint, "Token endpoint");
+    assertSecureUrl(authorizationEndpoint, "Authorization endpoint");
+    assertSecureUrl(tokenEndpoint, "Token endpoint");
+    if (registrationEndpoint !== undefined) {
+        assertNoAccessTokenInUrl(registrationEndpoint, "Registration endpoint");
+        assertSecureUrl(registrationEndpoint, "Registration endpoint");
     }
 }
 function assertNoAccessTokenInUrl(value, label) {
@@ -487,17 +554,23 @@ function buildClientRegistrationBody(metadata, redirectUri) {
         response_types: ["code"],
         token_endpoint_auth_method: "none",
     };
-    if (metadata?.clientName !== undefined && metadata.clientName.length > 0) {
-        body.client_name = metadata.clientName;
+    const clientName = metadata === undefined ? undefined : getOwnString(metadata, "clientName");
+    const scope = metadata === undefined ? undefined : getOwnString(metadata, "scope");
+    const softwareId = metadata === undefined ? undefined : getOwnString(metadata, "softwareId");
+    const softwareVersion = metadata === undefined
+        ? undefined
+        : getOwnString(metadata, "softwareVersion");
+    if (clientName !== undefined && clientName.length > 0) {
+        body.client_name = clientName;
     }
-    if (metadata?.scope !== undefined && metadata.scope.length > 0) {
-        body.scope = metadata.scope;
+    if (scope !== undefined && scope.length > 0) {
+        body.scope = scope;
     }
-    if (metadata?.softwareId !== undefined && metadata.softwareId.length > 0) {
-        body.software_id = metadata.softwareId;
+    if (softwareId !== undefined && softwareId.length > 0) {
+        body.software_id = softwareId;
     }
-    if (metadata?.softwareVersion !== undefined && metadata.softwareVersion.length > 0) {
-        body.software_version = metadata.softwareVersion;
+    if (softwareVersion !== undefined && softwareVersion.length > 0) {
+        body.software_version = softwareVersion;
     }
     return body;
 }

package/node_modules/mcp-oauth/dist/client/token-endpoint.js

@@ -75,29 +75,33 @@ async function requestTokens(input) {
         body: body.toString(),
     });
     const payload = await readOAuthJsonObjectResponse(response);
-    if (typeof payload.access_token !== "string" || payload.access_token.trim().length === 0) {
+    const accessToken = getOwnEntry(payload, "access_token");
+    if (typeof accessToken !== "string" || accessToken.trim().length === 0) {
         throw new Error("OAuth token response missing access_token");
     }
-    const tokenType = normalizeBearerTokenType(payload.token_type);
+    const tokenType = normalizeBearerTokenType(getOwnEntry(payload, "token_type"));
     if (tokenType === null) {
         throw new Error("OAuth token response missing token_type=Bearer");
     }
-    if (typeof payload.expires_in === "number"
-        && Number.isFinite(payload.expires_in)
-        && payload.expires_in < 0) {
+    const expiresIn = getOwnEntry(payload, "expires_in");
+    if (typeof expiresIn === "number"
+        && Number.isFinite(expiresIn)
+        && expiresIn < 0) {
         throw new Error("OAuth token response has invalid expires_in");
     }
+    const refreshToken = getOwnEntry(payload, "refresh_token");
+    const scope = getOwnEntry(payload, "scope");
     return {
-        accessToken: payload.access_token,
-        refreshToken: typeof payload.refresh_token === "string" && payload.refresh_token.length > 0
-            ? payload.refresh_token
+        accessToken,
+        refreshToken: typeof refreshToken === "string" && refreshToken.length > 0
+            ? refreshToken
             : undefined,
         tokenType,
-        expiresAt: typeof payload.expires_in === "number" && Number.isFinite(payload.expires_in)
-            ? input.now() + (payload.expires_in * 1000)
+        expiresAt: typeof expiresIn === "number" && Number.isFinite(expiresIn)
+            ? input.now() + (expiresIn * 1000)
             : null,
-        scope: typeof payload.scope === "string" && payload.scope.length > 0
-            ? payload.scope
+        scope: typeof scope === "string" && scope.length > 0
+            ? scope
             : undefined,
     };
 }
@@ -126,16 +130,22 @@ export async function readOAuthJsonObjectResponse(response) {
     return record;
 }
 function readOAuthError(payload, fallbackError = "server_error") {
+    const error = getOwnEntry(payload, "error");
+    const errorDescription = getOwnEntry(payload, "error_description");
+    const errorUri = getOwnEntry(payload, "error_uri");
     return {
-        error: typeof payload.error === "string" ? payload.error : fallbackError,
-        error_description: typeof payload.error_description === "string"
-            ? payload.error_description
+        error: typeof error === "string" ? error : fallbackError,
+        error_description: typeof errorDescription === "string"
+            ? errorDescription
             : undefined,
-        error_uri: typeof payload.error_uri === "string"
-            ? payload.error_uri
+        error_uri: typeof errorUri === "string"
+            ? errorUri
             : undefined,
     };
 }
+function getOwnEntry(record, key) {
+    return Object.prototype.hasOwnProperty.call(record, key) ? record[key] : undefined;
+}
 function createFallbackOAuthError(status) {
     const error = status === 503 ? "temporarily_unavailable" : "server_error";
     return new OAuthError({ error }, status);