Function handleToken

packages/core/test-servers/src/worker.ts:194–232

(request: Request)

};

const handleToken = async (request: Request) => {
  const params = new URLSearchParams(await request.text());
  const basic = decodeBasic(request.headers.get("authorization"));
  const clientId = basic?.username ?? params.get("client_id");
  const clientSecret = basic?.password ?? params.get("client_secret");
  const client = clientId ? clients.get(clientId) : undefined;
  if (!clientId || !client) return json({ error: "invalid_client" }, { status: 401 });
  if (client.clientSecret !== null && client.clientSecret !== clientSecret) {
    return json({ error: "invalid_client" }, { status: 401 });
  }
  const code = params.get("code");
  const redirectUri = params.get("redirect_uri");
  const verifier = params.get("code_verifier");
  const record = code ? authorizationCodes.get(code) : undefined;
  if (!code || !redirectUri || !verifier || !record) {
    return json({ error: "invalid_grant" }, { status: 400 });
  }
  if (
    record.clientId !== clientId ||
    record.redirectUri !== redirectUri ||
    record.codeChallenge !== (await codeChallengeForVerifier(verifier))
  ) {
    return json({ error: "invalid_grant" }, { status: 400 });
  }
  authorizationCodes.delete(code);
  const accessToken = `at_${crypto.randomUUID()}`;
  const refreshToken = `rt_${crypto.randomUUID()}`;
  issuedAccessTokens.add(accessToken);
  return json(
    {
      access_token: accessToken,
      refresh_token: refreshToken,
      token_type: "Bearer",
      expires_in: 3600,
      ...(record.scope ? { scope: record.scope } : {}),
    },
    { headers: { "cache-control": "no-store" } },
  );
};

const OpenApiEchoItem = Schema.Struct({ id: Schema.Number, name: Schema.String });
const OpenApiEchoItemsGroup = HttpApiGroup.make("items").add(