(input: BuildAuthorizationUrlInput)
| 137 | /** Build an RFC 6749 §4.1.1 authorization URL. Sync; pre-computed |
| 138 | * challenge lets this stay out of the Promise world. */ |
| 139 | export const buildAuthorizationUrl = (input: BuildAuthorizationUrlInput): string => { |
| 140 | const url = new URL( |
| 141 | assertSupportedOAuthEndpointUrl( |
| 142 | input.authorizationUrl, |
| 143 | "Authorization URL", |
| 144 | input.endpointUrlPolicy, |
| 145 | ), |
| 146 | ); |
| 147 | // Benign default kept by design: a single space is the RFC 6749 scope |
| 148 | // separator. Callers targeting a legacy comma-separated provider pass |
| 149 | // `scopeSeparator` explicitly (see the field's JSDoc). |
| 150 | const separator = input.scopeSeparator ?? " "; |
| 151 | url.searchParams.set("client_id", input.clientId); |
| 152 | url.searchParams.set("redirect_uri", input.redirectUrl); |
| 153 | url.searchParams.set("response_type", "code"); |
| 154 | if (input.scopes.length > 0) { |
| 155 | url.searchParams.set("scope", input.scopes.join(separator)); |
| 156 | } |
| 157 | url.searchParams.set("state", input.state); |
| 158 | url.searchParams.set("code_challenge_method", "S256"); |
| 159 | url.searchParams.set("code_challenge", input.codeChallenge); |
| 160 | if (input.resource) { |
| 161 | url.searchParams.set("resource", input.resource); |
| 162 | } |
| 163 | if (input.extraParams) { |
| 164 | for (const [k, v] of Object.entries(input.extraParams)) { |
| 165 | url.searchParams.set(k, v); |
| 166 | } |
| 167 | } |
| 168 | return url.toString(); |
| 169 | }; |
| 170 | |
| 171 | /** Provider-specific authorize-URL extras that are NOT RFC 6749 params, so the |
| 172 | * generic flow must add them per-provider (keyed off the authorization host). |
no test coverage detected