oauthAnswer

tcmts.atproto.oauthAnswer · #l5wb34y2 · term · runs anywhere

The code an authorization server's answer gives, if it's this sign-in's: its state, no error, and its issuer named (RFC 9207) as the one asked. Throws saying which isn't so.

import { Refused } from "#codebase/tcmts/atproto";

export function oauthAnswer(q: URLSearchParams, state: string, issuer: string): string {
  if (q.get("state") !== state) throw new Error("signing in came back from a different sign-in");
  if (q.get("error"))
    throw new Refused(`signing in didn't work: ${q.get("error_description") ?? q.get("error")}`);
  if (q.get("iss")?.replace(/\/+$/, "") !== issuer.replace(/\/+$/, ""))
    throw new Error(
      `signing in came back from ${q.get("iss") ?? "a server that didn't say"}, not ${issuer}`,
    );
  const code = q.get("code");
  if (!code) throw new Error("signing in came back with no code");
  return code;
}

uses

used by