Function withOAuth

src/client/middleware.ts:37–95

(provider: OAuthClientProvider, baseUrl?: string | URL)

 */
export const withOAuth =
    (provider: OAuthClientProvider, baseUrl?: string | URL): Middleware =>
    next => {
        return async (input, init) => {
            const makeRequest = async (): Promise<Response> => {
                const headers = new Headers(init?.headers);

                // Add authorization header if tokens are available
                const tokens = await provider.tokens();
                if (tokens) {
                    headers.set('Authorization', `Bearer ${tokens.access_token}`);
                }

                return await next(input, { ...init, headers });
            };

            let response = await makeRequest();

            // Handle 401 responses by attempting re-authentication
            if (response.status === 401) {
                try {
                    const { resourceMetadataUrl, scope } = extractWWWAuthenticateParams(response);

                    // Use provided baseUrl or extract from request URL
                    const serverUrl = baseUrl || (typeof input === 'string' ? new URL(input).origin : input.origin);

                    const result = await auth(provider, {
                        serverUrl,
                        resourceMetadataUrl,
                        scope,
                        fetchFn: next
                    });

                    if (result === 'REDIRECT') {
                        throw new UnauthorizedError('Authentication requires user authorization - redirect initiated');
                    }

                    if (result !== 'AUTHORIZED') {
                        throw new UnauthorizedError(`Authentication failed with result: ${result}`);
                    }

                    // Retry the request with fresh tokens
                    response = await makeRequest();
                } catch (error) {
                    if (error instanceof UnauthorizedError) {
                        throw error;
                    }
                    throw new UnauthorizedError(`Failed to re-authenticate: ${error instanceof Error ? error.message : String(error)}`);
                }
            }

            // If we still have a 401 after re-auth attempt, throw an error
            if (response.status === 401) {
                const url = typeof input === 'string' ? input : input.toString();
                throw new UnauthorizedError(`Authentication failed for ${url}`);
            }

            return response;
        };