Function parseTokenResponse

packages/cli/src/auth/oauth.ts:332–367

(payload: unknown)

 */
// fallow-ignore-next-line complexity
export function parseTokenResponse(payload: unknown): OAuthTokens {
  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
    throw ErrRefreshFailed("token endpoint returned a non-object payload");
  }
  const obj = payload as Record<string, unknown>;
  const accessToken = stringField(obj, "access_token");
  if (!accessToken) {
    throw ErrRefreshFailed("token endpoint did not return an access_token");
  }
  if (!isHeaderSafe(accessToken)) {
    throw ErrRefreshFailed("access_token contains control characters");
  }

  const out: OAuthTokens = { access_token: accessToken };
  const refreshToken = stringField(obj, "refresh_token");
  if (refreshToken) {
    if (!isHeaderSafe(refreshToken)) {
      throw ErrRefreshFailed("refresh_token contains control characters");
    }
    out.refresh_token = refreshToken;
  }
  const tokenType = stringField(obj, "token_type");
  if (tokenType) out.token_type = tokenType;
  const scope = stringField(obj, "scope");
  if (scope) out.scope = scope;

  const expiresIn = numericField(obj, "expires_in");
  if (expiresIn !== undefined) {
    // Clamp to a sensible minimum so a misbehaving / clock-skewed
    // server returning 0 or a negative value doesn't put expires_at in
    // the past and cause the 401-refresh path to loop.
    const clamped = Math.max(expiresIn, MIN_EXPIRES_IN_SECONDS);
    out.expires_at = new Date(Date.now() + clamped * 1000).toISOString();
  }
  return out;
}

function stringField(obj: Record<string, unknown>, key: string): string | undefined {
  const v = obj[key];