implemented OAuth client credentials flow #2690
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Reviewer's Guide by SourceryThis PR implements the OAuth2 Client Credentials flow, adding support for this authentication method alongside the existing Authorization Code flow. The implementation includes new configuration options for authentication and request formats, with comprehensive test coverage. Sequence diagram for OAuth2 Client Credentials flowsequenceDiagram
participant Client as OAuth2Client
participant AuthServer as Authorization Server
Client->>AuthServer: POST /oauth/token (grant_type: client_credentials)
AuthServer-->>Client: 200 OK (access_token, refresh_token, expires_in, token_type)
Updated class diagram for OAuth2ClientclassDiagram
class OAuth2Client {
-OAuth2ClientOptions options
+getAuthorizationUrl() Promise~string~
+getAuthorizationRedirectResponse() Promise~AuthorizationRedirectResponse|AuthorizationRedirectErrorResponse|undefined~
+getAccessTokenFromCode(code: string) Promise~AccessTokenResponse|AccessTokenErrorResponse~
+getAccessTokenFromClientCredentials() Promise~AccessTokenResponse|AccessTokenErrorResponse~
-getAccessTokenRequestHeaders() HeadersInit
-getAccessTokenRequestBody(params: AccessTokenRequest) BodyInit
-makeAccessTokenRequest(params: AccessTokenRequest) Promise~AccessTokenResponse|AccessTokenErrorResponse~
}
class OAuth2ClientOptions {
<<interface>>
+string[] scopes
+AuthFormat authFormat
+RequestFormat requestFormat
}
class AuthorizationCode_OAuth2ClientOptions {
<<interface>>
+OAuth2Type type
+string clientId
+string clientSecret
+string redirectUri
+string state
+string authorizationEndpoint
+string tokenEndpoint
}
class AuthorizationCodePKCE_OAuth2ClientOptions {
<<interface>>
+OAuth2Type type
+string codeVerifier
}
class ClientCredentials_OAuth2ClientOptions {
<<interface>>
+OAuth2Type type
+string clientId
+string clientSecret
+string tokenEndpoint
}
OAuth2ClientOptions <|-- AuthorizationCode_OAuth2ClientOptions
OAuth2ClientOptions <|-- AuthorizationCodePKCE_OAuth2ClientOptions
OAuth2ClientOptions <|-- ClientCredentials_OAuth2ClientOptions
OAuth2Client o-- OAuth2ClientOptions
File-Level Changes
Assessment against linked issues
Possibly linked issues
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey @imolorhe - I've reviewed your changes and found some issues that need to be addressed.
Blocking issues:
- Use a more secure base64 encoding method for handling non-ASCII characters in credentials (link)
Here's what I looked at during the review
- 🟡 General issues: 2 issues found
- 🔴 Security: 1 blocking issue
- 🟢 Testing: all looks good
- 🟢 Complexity: all looks good
- 🟢 Documentation: all looks good
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
| const headers: HeadersInit = {}; | ||
| switch (this.options.authFormat) { | ||
| case AuthFormat.BASIC_AUTH: { | ||
| headers.Authorization = `Basic ${btoa( |
There was a problem hiding this comment.
🚨 issue (security): Use a more secure base64 encoding method for handling non-ASCII characters in credentials
btoa() fails with non-ASCII characters. Consider using TextEncoder and Buffer.from().toString('base64') or a similar UTF-8 safe approach.
There was a problem hiding this comment.
@sourcery-ai review
|
|
||
| private async makeAccessTokenRequest( | ||
| params: AccessTokenRequest | ||
| ): Promise<AccessTokenResponse | AccessTokenErrorResponse> { | ||
| const response = await fetch(this.options.tokenEndpoint, { |
There was a problem hiding this comment.
issue: Add explicit error handling for network failures in token requests
Wrap the fetch call in a try-catch block and provide specific error handling for network failures, timeouts, and non-JSON responses.
| } | ||
|
|
||
| private getAccessTokenRequestBody(params: AccessTokenRequest): BodyInit { | ||
| let bodyParams: Partial<AccessTokenRequest> = structuredClone(params); |
There was a problem hiding this comment.
suggestion (performance): Replace structuredClone with Object.assign for better performance
Since we're only dealing with a shallow object structure, using Object.assign({}, params) would be more efficient than a deep clone.
Suggested change
| let bodyParams: Partial<AccessTokenRequest> = structuredClone(params); | |
| let bodyParams: Partial<AccessTokenRequest> = Object.assign({}, params); |
|
Visit the preview URL for this PR (updated for commit 60bcbeb): https://altair-gql--pr2690-imolorhe-oauth2-clie-ayj24hxn.web.app (expires Sun, 10 Nov 2024 07:29:05 GMT) 🔥 via Firebase Hosting GitHub Action 🌎 Sign: 02d6323d75a99e532a38922862e269d63351a6cf |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes
Closes #2680
Checks
yarn test-buildChanges proposed in this pull request:
Summary by Sourcery
Implement the OAuth2 client credentials flow in the OAuth2Client class, enabling access token retrieval using client credentials. Enhance the client to support various authentication and request formats, and add tests to ensure functionality across different scenarios.
New Features:
Enhancements:
Tests: