SEP-1046: Client credentials flow for M2M without user interaction (#1157)

Co-authored-by: Paul Carleton <paulc@anthropic.com>

src/server/auth/handlers/revoke.test.ts

@@ -114,6 +114,7 @@ describe('Revocation Handler', () => {
             }
             throw new InvalidTokenError('Token is invalid or expired');
         }
+
         // No revokeToken method
     };
 

src/server/auth/handlers/token.ts

@@ -135,10 +135,8 @@ export function tokenHandler({ provider, rateLimit: rateLimitConfig }: TokenHand
                     res.status(200).json(tokens);
                     break;
                 }
-
-                // Not supported right now
-                //case "client_credentials":
-
+                // Additional auth methods will not be added on the server side of the SDK.
+                case 'client_credentials':
                 default:
                     throw new UnsupportedGrantTypeError('The grant type is not supported by this authorization server.');
             }

src/server/auth/middleware/clientAuth.ts

@@ -32,26 +32,18 @@ export function authenticateClient({ clientsStore }: ClientAuthenticationMiddlew
             if (!result.success) {
                 throw new InvalidRequestError(String(result.error));
             }
-
             const { client_id, client_secret } = result.data;
             const client = await clientsStore.getClient(client_id);
             if (!client) {
                 throw new InvalidClientError('Invalid client_id');
             }
-
-            // If client has a secret, validate it
             if (client.client_secret) {
-                // Check if client_secret is required but not provided
                 if (!client_secret) {
                     throw new InvalidClientError('Client secret is required');
                 }
-
-                // Check if client_secret matches
                 if (client.client_secret !== client_secret) {
                     throw new InvalidClientError('Invalid client_secret');
                 }
-
-                // Check if client_secret has expired
                 if (client.client_secret_expires_at && client.client_secret_expires_at < Math.floor(Date.now() / 1000)) {
                     throw new InvalidClientError('Client secret has expired');
                 }