fix(oauth): use interoperable basic credentials

Author: MisterJimson

.changeset/oauth-client-basic-auth.md

@@ -2,4 +2,4 @@
 "@executor-js/sdk": patch
 ---
 
-Allow registered OAuth clients to use `client_secret_basic` at the token endpoint. The selected client-auth method is persisted and reused for authorization-code exchanges, client-credentials mints, token refreshes, and client-credentials re-mints; existing clients continue to default to `client_secret_post`.
+Allow registered OAuth clients to use interoperable `client_secret_basic` at the token endpoint. Basic credentials preserve the literal client ID and secret expected by common providers. The selected client-auth method is persisted and reused for authorization-code exchanges, client-credentials mints, token refreshes, and client-credentials re-mints; existing clients continue to default to `client_secret_post`.

packages/core/sdk/src/oauth-client.ts

@@ -70,8 +70,8 @@ export interface OAuthClient {
   readonly resource?: string | null;
   /** How the client authenticates to the token endpoint: `"body"`
    *  (`client_secret_post`, the default) or `"basic"` (`client_secret_basic`,
-   *  base64 `client_id:client_secret` in the Authorization header). Some
-   *  providers only accept Basic for confidential clients.
+   *  base64 of the literal UTF-8 `client_id:client_secret` pair in the
+   *  Authorization header). Some providers only accept Basic for confidential clients.
    *  Omitted/undefined is treated as `"body"` throughout. */
   readonly tokenEndpointAuthMethod?: ClientAuthMethod;
 }

packages/core/sdk/src/oauth-helpers.test.ts

@@ -546,27 +546,6 @@ describe("exchangeAuthorizationCode", () => {
     ),
   );
 
-  it.effect("uses HTTP Basic auth when clientAuth=basic (Stripe-style)", () =>
-    withTokenEndpoint(tokenResponse(validCodeBody), ({ tokenUrl, calls }) =>
-      Effect.gen(function* () {
-        yield* exchangeAuthorizationCode({
-          tokenUrl,
-          clientId: "cid",
-          clientSecret: "csecret",
-          redirectUrl: "https://app.example.com/cb",
-          codeVerifier: "verifier",
-          code: "abc",
-          clientAuth: "basic",
-        });
-        const call = (yield* calls)[0]!;
-        const expected = `Basic ${Buffer.from("cid:csecret").toString("base64")}`;
-        expect(call.headers["authorization"]).toBe(expected);
-        expect(call.body.has("client_id")).toBe(false);
-        expect(call.body.has("client_secret")).toBe(false);
-      }),
-    ),
-  );
-
   it.effect("uses the documented 20-second timeout default", () =>
     withTokenEndpoint(tokenResponse(validCodeBody), ({ tokenUrl }) =>
       Effect.gen(function* () {
@@ -685,6 +664,26 @@ describe("exchangeAuthorizationCode", () => {
 });
 
 describe("exchangeClientCredentials", () => {
+  it.effect("uses literal HTTP Basic credentials when clientAuth=basic", () =>
+    withTokenEndpoint(tokenResponse(validRefreshBody), ({ tokenUrl, calls }) =>
+      Effect.gen(function* () {
+        yield* exchangeClientCredentials({
+          tokenUrl,
+          clientId: "client_id-with-punctuation",
+          clientSecret: "client_secret-with-punctuation",
+          clientAuth: "basic",
+        });
+        const call = (yield* calls)[0]!;
+        const expected = `Basic ${Buffer.from(
+          "client_id-with-punctuation:client_secret-with-punctuation",
+        ).toString("base64")}`;
+        expect(call.headers["authorization"]).toBe(expected);
+        expect(call.body.has("client_id")).toBe(false);
+        expect(call.body.has("client_secret")).toBe(false);
+      }),
+    ),
+  );
+
   it.effect("routes token grant requests through the injected fetch", () =>
     withTokenEndpoint(tokenResponse(validRefreshBody), ({ tokenUrl }) =>
       Effect.gen(function* () {

packages/core/sdk/src/oauth-helpers.ts

@@ -556,10 +556,26 @@ const pickClientAuth = (
 ): oauth.ClientAuth => {
   if (!clientSecret) return oauth.None();
   return method === "basic"
-    ? oauth.ClientSecretBasic(clientSecret)
+    ? clientSecretBasicInterop(clientSecret)
     : oauth.ClientSecretPost(clientSecret);
 };
 
+// oauth4webapi's ClientSecretBasic follows RFC 6749 strictly by form-encoding
+// both credentials before base64 encoding them. A number of token endpoints
+// instead implement HTTP Basic per RFC 7617 and compare the decoded username
+// and password literally. Characters such as `_` therefore become `%5F` and
+// otherwise-valid credentials are rejected. Use the broadly interoperable
+// wire representation expected by those endpoints: base64 of the literal
+// UTF-8 `client_id:client_secret` pair.
+const clientSecretBasicInterop =
+  (clientSecret: string): oauth.ClientAuth =>
+  (_as, client, _body, headers) => {
+    const bytes = new TextEncoder().encode(`${client.client_id}:${clientSecret}`);
+    let binary = "";
+    for (const byte of bytes) binary += String.fromCharCode(byte);
+    headers.set("authorization", `Basic ${globalThis.btoa(binary)}`);
+  };
+
 const tokenResponseFrom = (r: oauth.TokenEndpointResponse): OAuth2TokenResponse => ({
   access_token: r.access_token,
   token_type: r.token_type,