diff --git a/examples/oauth.ts b/examples/par.ts index cc6d632..110d820 100644 --- a/examples/oauth.ts +++ b/examples/par.ts @@ -37,15 +37,16 @@ const code_verifier = oauth.generateRandomCodeVerifier() const code_challenge = await oauth.calculatePKCECodeChallenge(code_verifier) let state: string | undefined +// Pushed Authorization Request & Response (PAR) +let request_uri: string { - // redirect user to as.authorization_endpoint - const authorizationUrl = new URL(as.authorization_endpoint!) - authorizationUrl.searchParams.set('client_id', client.client_id) - authorizationUrl.searchParams.set('redirect_uri', redirect_uri) - authorizationUrl.searchParams.set('response_type', 'code') - authorizationUrl.searchParams.set('scope', 'api:read') - authorizationUrl.searchParams.set('code_challenge', code_challenge) - authorizationUrl.searchParams.set('code_challenge_method', code_challenge_method) + const params = new URLSearchParams() + params.set('client_id', client.client_id) + params.set('redirect_uri', redirect_uri) + params.set('response_type', 'code') + params.set('scope', 'api:read') + params.set('code_challenge', code_challenge) + params.set('code_challenge_method', code_challenge_method) /** * We cannot be sure the AS supports PKCE so we're going to use state too. Use of PKCE is @@ -53,9 +54,33 @@ let state: string | undefined */ if (as.code_challenge_methods_supported?.includes('S256') !== true) { state = oauth.generateRandomState() - authorizationUrl.searchParams.set('state', state) + params.set('state', state) + } + + const response = await oauth.pushedAuthorizationRequest(as, client, params) + let challenges: oauth.WWWAuthenticateChallenge[] | undefined + if ((challenges = oauth.parseWwwAuthenticateChallenges(response))) { + for (const challenge of challenges) { + console.error('WWW-Authenticate Challenge', challenge) + } + throw new Error() // Handle WWW-Authenticate Challenges as needed } + const result = await oauth.processPushedAuthorizationResponse(as, client, response) + if (oauth.isOAuth2Error(result)) { + console.error('Error Response', result) + throw new Error() // Handle OAuth 2.0 response body error + } + + ;({ request_uri } = result) +} + +{ + // redirect user to as.authorization_endpoint + const authorizationUrl = new URL(as.authorization_endpoint!) + authorizationUrl.searchParams.set('client_id', client.client_id) + authorizationUrl.searchParams.set('request_uri', request_uri) + // now redirect the user to authorizationUrl.href }