fix: fetch clientId from the auth header if present

supertokens · Oct 22, 2024 · e2b1af3 · e2b1af3
1 parent fa78183
commit e2b1af3
Show file tree

Hide file tree

Showing 2 changed files with 32 additions and 4 deletions.
diff --git a/lib/build/recipe/oauth2provider/recipeImplementation.js b/lib/build/recipe/oauth2provider/recipeImplementation.js
@@ -63,6 +63,7 @@ const combinedRemoteJWKSet_1 = require("../../combinedRemoteJWKSet");
 const recipe_1 = __importDefault(require("../session/recipe"));
 const recipe_2 = __importDefault(require("../openid/recipe"));
 const constants_1 = require("../multitenancy/constants");
+const utils_1 = require("../../utils");
 function getUpdatedRedirectTo(appInfo, redirectTo) {
     return redirectTo.replace(
         "{apiDomain}",
@@ -359,7 +360,11 @@ function getRecipeInterface(
                 };
             }
             if (input.body.grant_type === "client_credentials") {
-                if (input.body.client_id === undefined) {
+                let clientId =
+                    input.authorizationHeader !== undefined
+                        ? utils_1.decodeBase64(input.authorizationHeader.replace(/^Basic /, "").trim()).split(":")[0]
+                        : input.body.client_id;
+                if (clientId === undefined) {
                     return {
                         status: "ERROR",
                         statusCode: 400,
@@ -373,7 +378,7 @@ function getRecipeInterface(
                         ? _b
                         : [];
                 const clientInfo = await this.getOAuth2Client({
-                    clientId: input.body.client_id,
+                    clientId,
                     userContext: input.userContext,
                 });
                 if (clientInfo.status === "ERROR") {
@@ -459,6 +464,14 @@ function getRecipeInterface(
                 body,
                 input.userContext
             );
+            if (res.status === "CLIENT_NOT_FOUND_ERROR") {
+                return {
+                    status: "ERROR",
+                    statusCode: 400,
+                    error: "invalid_request",
+                    errorDescription: "client_id not found",
+                };
+            }
             if (res.status !== "OK") {
                 return {
                     status: "ERROR",

diff --git a/lib/ts/recipe/oauth2provider/recipeImplementation.ts b/lib/ts/recipe/oauth2provider/recipeImplementation.ts
@@ -30,6 +30,7 @@ import { getCombinedJWKS } from "../../combinedRemoteJWKSet";
 import SessionRecipe from "../session/recipe";
 import OpenIdRecipe from "../openid/recipe";
 import { DEFAULT_TENANT_ID } from "../multitenancy/constants";
+import { decodeBase64 } from "../../utils";
 
 function getUpdatedRedirectTo(appInfo: NormalisedAppinfo, redirectTo: string) {
     return redirectTo.replace(
@@ -353,7 +354,11 @@ export default function getRecipeInterface(
             }
 
             if (input.body.grant_type === "client_credentials") {
-                if (input.body.client_id === undefined) {
+                let clientId =
+                    input.authorizationHeader !== undefined
+                        ? decodeBase64(input.authorizationHeader.replace(/^Basic /, "").trim()).split(":")[0]
+                        : input.body.client_id;
+                if (clientId === undefined) {
                     return {
                         status: "ERROR",
                         statusCode: 400,
@@ -363,8 +368,9 @@ export default function getRecipeInterface(
                 }
 
                 const scopes = input.body.scope?.split(" ") ?? [];
+
                 const clientInfo = await this.getOAuth2Client({
-                    clientId: input.body.client_id as string,
+                    clientId,
                     userContext: input.userContext,
                 });
 
@@ -453,6 +459,15 @@ export default function getRecipeInterface(
                 input.userContext
             );
 
+            if (res.status === "CLIENT_NOT_FOUND_ERROR") {
+                return {
+                    status: "ERROR",
+                    statusCode: 400,
+                    error: "invalid_request",
+                    errorDescription: "client_id not found",
+                };
+            }
+
             if (res.status !== "OK") {
                 return {
                     status: "ERROR",