Repository navigation
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true
|
🦋 Changeset detectedLatest commit: d340537 The changes in this PR will be included in the next version bump. This PR includes changesets to release 11 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
@clerk/astro
@clerk/backend
@clerk/chrome-extension
@clerk/clerk-js
@clerk/electron
@clerk/electron-passkeys
@clerk/eslint-plugin
@clerk/expo
@clerk/expo-biometrics
@clerk/expo-google-signin
@clerk/expo-native-components
@clerk/expo-passkeys
@clerk/express
@clerk/fastify
@clerk/hono
@clerk/localizations
@clerk/mosaic
@clerk/nextjs
@clerk/nuxt
@clerk/react
@clerk/react-router
@clerk/shared
@clerk/tanstack-react-start
@clerk/testing
@clerk/ui
@clerk/upgrade
@clerk/vue
commit: |
… what Clerk supports Drop subjectTokenType, requestedTokenType, actorToken, actorTokenType, and audience, and require a single resource. The SDK always sends the access-token subject_token_type that RFC 8693 section 2.1 requires.
…exchange Clerk only permits confidential OAuth applications to perform token exchange, so drop the public-client branch that sent client_id in the body.
…publishable key Take clientId and publishableKey (plus optional proxyUrl) per call and derive the Frontend API token endpoint from them, instead of loading the OAuth application through the Backend API. The exchange no longer requires the instance secret key.
Treat only HTTP 200 as a successful token-exchange response and require scope, expires_in and refresh_token to be absent or correctly typed, so malformed responses surface as OAuthTokenExchangeError invalid_response instead of a raw TypeError or wrongly typed result.
Reject a resource with a fragment, a non-absolute URI, or a scheme other than https or loopback http with an invalid_request OAuthTokenExchangeError before any network request (RFC 8693 section 2.1). The caller's original string is still sent unchanged.
Check the raw resource string against the RFC 3986 character set and pct-encoding before the WHATWG parse, so strings WHATWG repairs (spaces, tabs, backslashes, non-ASCII, bad escapes) are rejected instead of sent. Also add an invalid_response error factory, rename the invalid_request factory, drop a code comment and a cast, and share test helpers.
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds
clerkClient.oauthApplications.__experimental_exchangeToken(), which performs an OAuth 2.0 Token Exchange (RFC 8693) for an OAuth application and returns the issued token. Failures throw a newOAuthTokenExchangeError, exported from@clerk/backend/errors.Why
@clerk/backendcan verify OAuth access tokens and read theactclaim of an exchanged token, but has no way to perform the exchange. Backend services that need to call a downstream API on a user's behalf have to hand-roll the form-encoded token request, client authentication, and error parsing.How
tokenFetchUrl, so callers pass only the application ID, client secret, and exchange parameters; no publishable key or discovery is needed. The trade-off is one extra Backend API request per exchange.urn:ietf:params:oauth:grant-type:token-exchangegrant (RFC 8693 §2.1);audienceandresourcerepeat when given arrays andscopeis space-delimited.encodeURIComponent). Public clients omitclientSecretand sendclient_idin the body instead (RFC 6749 §3.2.1).OAuthTokenExchangeError, aClerkErrorlikeMachineTokenVerificationError, with the OAuth error incode(aliased aserror),errorDescription, andstatus; non-JSON or malformed responses useinvalid_response.actorTokenTypewithoutactorTokenis rejected before any request.__experimental_prefix perdocs/CONTRIBUTING.md, plus an@experimentalJSDoc.Before merge
Checklist
pnpm testruns as expected.pnpm buildruns as expected.Type of change