Method exchangeCode

src/TokenClient.ts:87–155

* Exchange code. * * @see https://www.rfc-editor.org/rfc/rfc6749#section-4.1.3

({
        grant_type = "authorization_code",
        redirect_uri = this._settings.redirect_uri,
        client_id = this._settings.client_id,
        client_secret = this._settings.client_secret,
        extraHeaders,
        ...args
    }: ExchangeCodeArgs)

     * @see https://www.rfc-editor.org/rfc/rfc6749#section-4.1.3
     */
    public async exchangeCode({
        grant_type = "authorization_code",
        redirect_uri = this._settings.redirect_uri,
        client_id = this._settings.client_id,
        client_secret = this._settings.client_secret,
        extraHeaders,
        ...args
    }: ExchangeCodeArgs): Promise<Record<string, unknown>> {
        const logger = this._logger.create("exchangeCode");
        if (!client_id) {
            logger.throw(new Error("A client_id is required"));
        }
        if (!redirect_uri) {
            logger.throw(new Error("A redirect_uri is required"));
        }
        if (!args.code) {
            logger.throw(new Error("A code is required"));
        }

        const params = new URLSearchParams({ grant_type, redirect_uri });
        for (const [key, value] of Object.entries(args)) {
            if (value != null) {
                params.set(key, value);
            }
        }

        // Validate client_secret if required before making any external calls
        if ((this._settings.client_authentication === "client_secret_basic" ||
             this._settings.client_authentication === "client_secret_jwt") &&
            (client_secret === undefined || client_secret === null)) {
            logger.throw(new Error("A client_secret is required"));
            // eslint-disable-next-line @typescript-eslint/only-throw-error
            throw null; // https://github.com/microsoft/TypeScript/issues/46972
        }

        let basicAuth: string | undefined;
        const url = await this._metadataService.getTokenEndpoint(false);
        switch (this._settings.client_authentication) {
            case "client_secret_basic":
                basicAuth = CryptoUtils.generateBasicAuth(client_id, client_secret!);
                break;
            case "client_secret_post":
                params.append("client_id", client_id);
                if (client_secret) {
                    params.append("client_secret", client_secret);
                }
                break;
            case "client_secret_jwt": {
                const clientAssertion = await CryptoUtils.generateClientAssertionJwt(client_id, client_secret!, url, this._settings.token_endpoint_auth_signing_alg);
                params.append("client_id", client_id);
                params.append("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer");
                params.append("client_assertion", clientAssertion);
                break;
            }
        }
        logger.debug("got token endpoint");

        const response = await this._jsonService.postForm(url, {