Function stripIdToken

packages/core/sdk/src/oauth-helpers.ts:469–486

(response: Response)

// its claims against the AS metadata and rejects mismatches we don't care
// about. Strip the field before delegation.
const stripIdToken = async (response: Response): Promise<Response> => {
  const body = await response
    .clone()
    .json()
    .then(
      (value: unknown) => value,
      () => null,
    );
  if (!body || typeof body !== "object" || !("id_token" in (body as Record<string, unknown>))) {
    return response;
  }
  const { id_token: _ignored, ...rest } = body as Record<string, unknown>;
  return new Response(JSON.stringify(rest), {
    status: response.status,
    statusText: response.statusText,
    headers: response.headers,
  });
};

const processTokenEndpointResponse = async (
  as: oauth.AuthorizationServer,