workers-gate 0.2.1 → 0.3.0

package/README.md

@@ -98,6 +98,8 @@ The contract: `authorizeUrl` must request whatever scope/claims `identify` needs
 
 `silent` is `true` when a returning visitor's session just expired; OAuth-style providers can translate it to `prompt=none`. If the IdP answers the callback with an `error` param, the gate automatically retries an interactive login. `oauthProvider`'s `identify` also receives the full `tokenResponse` for extras like `id_token`.
 
+`oauthProvider` takes two param bags: `authorizeParams` goes on every authorize URL; `silentParams` only on silent re-authorization and wins on conflicts. Which one `prompt=none` belongs in depends on how the IdP reads it. If it means "skip the consent screen when already authorized" and first-timers still get the screen (Discord, for one), put it in `authorizeParams`. If it means "never interact" and not-yet-authorized users get an `error` back (OIDC proper), put it in `silentParams` so first logins stay interactive.
+
 ## Recipes
 
 The library ships no IdP presets — endpoints, scope, and policy are yours. Both example projects are deployable as-is (wrangler config, `.dev.vars` template, generated types).
@@ -111,7 +113,8 @@ provider: oauthProvider({
   clientId: env.DISCORD_CLIENT_ID,
   clientSecret: env.DISCORD_CLIENT_SECRET,
   scope: "guilds.members.read",
-  silentParams: { prompt: "none" },
+  // Discord's prompt=none only skips consent for already-authorized users
+  authorizeParams: { prompt: "none" },
   async identify({ accessToken }) {
     // membership in this one guild, straight from Discord; 404 = not a member
     const res = await fetch(

package/dist/oauth.d.ts

@@ -14,7 +14,9 @@ export interface OAuthProviderConfig<Data extends {}> {
     clientSecret: string;
     /** Must cover whatever identify() fetches — scope and identify are a pair */
     scope?: string;
-    /** Extra query params appended on silent re-authorization, e.g. { prompt: "none" } */
+    /** Extra query params appended to every authorize URL, e.g. { access_type: "offline" } */
+    authorizeParams?: Record<string, string>;
+    /** Extra query params appended only on silent re-authorization; they win over authorizeParams */
     silentParams?: Record<string, string>;
     /** Fetch the data about the visitor that the gate's filter will judge */
     identify(input: OAuthIdentifyInput): Promise<Data | null>;

package/dist/oauth.js

@@ -16,11 +16,14 @@ export function oauthProvider(config) {
             if (config.scope)
                 url.searchParams.set("scope", config.scope);
             url.searchParams.set("state", state);
-            if (silent) {
-                for (const [key, value] of Object.entries(config.silentParams ?? {})) {
+            const apply = (params = {}) => {
+                for (const [key, value] of Object.entries(params)) {
                     url.searchParams.set(key, value);
                 }
-            }
+            };
+            apply(config.authorizeParams);
+            if (silent)
+                apply(config.silentParams);
             return url.toString();
         },
         async identify({ code, redirectUri }) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "workers-gate",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Stateless authorization gate for apps on Cloudflare Workers — bring your own provider, no database, cookie signing delegated to jose",
   "keywords": [
     "authorization",
@@ -50,7 +50,7 @@
   },
   "devDependencies": {
     "@types/node": "^26.1.0",
-    "oxfmt": "^0.67.0",
+    "oxfmt": "^0.71.0",
     "oxlint": "^1.72.0",
     "typescript": "^7.0.2",
     "vitest": "^5.0.0"