fix: Support WWW-Authenticate scope param for SEP-835 (#983)

Co-authored-by: OtotheA <oscar@otothea.com>
This commit is contained in:
Chip 2025-11-03 09:24:42 -06:00 • committed by GitHub
commit ee9fed28cc
No known key found for this signature in database
GPG key ID: B5690EEEBB952194

View file

@ -1,4 +1,4 @@
import { auth, extractResourceMetadataUrl, OAuthClientProvider, UnauthorizedError } from './auth.js';
import { auth, extractWWWAuthenticateParams, OAuthClientProvider, UnauthorizedError } from './auth.js';
import { FetchLike } from '../shared/transport.js';
/**
@ -54,7 +54,7 @@ export const withOAuth =
// Handle 401 responses by attempting re-authentication
if (response.status === 401) {
try {
const resourceMetadataUrl = extractResourceMetadataUrl(response);
const { resourceMetadataUrl, scope } = extractWWWAuthenticateParams(response);
// Use provided baseUrl or extract from request URL
const serverUrl = baseUrl || (typeof input === 'string' ? new URL(input).origin : input.origin);
@ -62,6 +62,7 @@ export const withOAuth =
const result = await auth(provider, {
serverUrl,
resourceMetadataUrl,
scope,
fetchFn: next
});