Function authInternal

src/client/auth.ts:428–616

(
    provider: OAuthClientProvider,
    {
        serverUrl,
        authorizationCode,
        scope,
        resourceMetadataUrl,
        fetchFn
    }: {
        serverUrl: string | URL;
        authorizationCode?: string;
        scope?: string;
        resourceMetadataUrl?: URL;
        fetchFn?: FetchLike;
    }
)

}

async function authInternal(
    provider: OAuthClientProvider,
    {
        serverUrl,
        authorizationCode,
        scope,
        resourceMetadataUrl,
        fetchFn
    }: {
        serverUrl: string | URL;
        authorizationCode?: string;
        scope?: string;
        resourceMetadataUrl?: URL;
        fetchFn?: FetchLike;
    }
): Promise<AuthResult> {
    // Check if the provider has cached discovery state to skip discovery
    const cachedState = await provider.discoveryState?.();

    let resourceMetadata: OAuthProtectedResourceMetadata | undefined;
    let authorizationServerUrl: string | URL;
    let metadata: AuthorizationServerMetadata | undefined;

    // If resourceMetadataUrl is not provided, try to load it from cached state
    // This handles browser redirects where the URL was saved before navigation
    let effectiveResourceMetadataUrl = resourceMetadataUrl;
    if (!effectiveResourceMetadataUrl && cachedState?.resourceMetadataUrl) {
        effectiveResourceMetadataUrl = new URL(cachedState.resourceMetadataUrl);
    }

    if (cachedState?.authorizationServerUrl) {
        // Restore discovery state from cache
        authorizationServerUrl = cachedState.authorizationServerUrl;
        resourceMetadata = cachedState.resourceMetadata;
        metadata =
            cachedState.authorizationServerMetadata ?? (await discoverAuthorizationServerMetadata(authorizationServerUrl, { fetchFn }));

        // If resource metadata wasn't cached, try to fetch it for selectResourceURL
        if (!resourceMetadata) {
            try {
                resourceMetadata = await discoverOAuthProtectedResourceMetadata(
                    serverUrl,
                    { resourceMetadataUrl: effectiveResourceMetadataUrl },
                    fetchFn
                );
            } catch {
                // RFC 9728 not available — selectResourceURL will handle undefined
            }
        }

        // Re-save if we enriched the cached state with missing metadata
        if (metadata !== cachedState.authorizationServerMetadata || resourceMetadata !== cachedState.resourceMetadata) {
            await provider.saveDiscoveryState?.({
                authorizationServerUrl: String(authorizationServerUrl),
                resourceMetadataUrl: effectiveResourceMetadataUrl?.toString(),
                resourceMetadata,
                authorizationServerMetadata: metadata
            });