Function exchangeCodeForTokens

packages/cli/src/auth/oauth.ts:283–320

(args: {
  clientId: string;
  code: string;
  redirectUri: string;
  verifier: string;
  fetchImpl?: typeof fetch;
})

}

async function exchangeCodeForTokens(args: {
  clientId: string;
  code: string;
  redirectUri: string;
  verifier: string;
  fetchImpl?: typeof fetch;
}): Promise<OAuthTokens> {
  const fetchImpl = args.fetchImpl ?? fetch;
  const body = new URLSearchParams({
    grant_type: "authorization_code",
    code: args.code,
    redirect_uri: args.redirectUri,
    client_id: args.clientId,
    code_verifier: args.verifier,
  });
  const res = await fetchImpl(tokenEndpoint(), {
    method: "POST",
    headers: {
      "content-type": "application/x-www-form-urlencoded",
      accept: "application/json",
    },
    body: body.toString(),
  });
  if (res.status === 400 || res.status === 401) {
    // The authorization code is single-use and short-lived. A 400/401
    // here almost always means it expired during the loopback wait or
    // was already redeemed — surface an actionable message instead of
    // a bare "HeyGen API error (400)".
    const detail = (await safeText(res)) || res.statusText;
    throw ErrRefreshFailed(
      `authorization code rejected (${detail}); please run \`auth login\` again`,
    );
  }
  if (!res.ok) {
    throw ErrApi(res.status, (await safeText(res)) || res.statusText);
  }
  return parseTokenResponse(await readJsonOrThrow(res));
}

/**
 * Parse the RFC 6749 token response. Backend may also include