feat(core): support private_key_jwt token auth method (#11132)

Author: leemcmullen

packages/core/src/lib/actions/callback/oauth/callback.ts

@@ -105,6 +105,7 @@ export async function handleOAuth(
   if (!options.isOnRedirectProxy && provider.redirectProxyUrl) {
     redirect_uri = provider.redirectProxyUrl
   }
+
   let codeGrantResponse = await o.authorizationCodeGrantRequest(
     as,
     client,
@@ -121,6 +122,7 @@ export async function handleOAuth(
         }
         return fetch(...args)
       },
+      clientPrivateKey: provider.token?.clientPrivateKey,
     }
   )
 

packages/core/src/lib/utils/providers.ts

@@ -151,7 +151,12 @@ function normalizeEndpoint(
       url.searchParams.set(key, String(value))
     }
   }
-  return { url, request: e?.request, conform: e?.conform }
+  return {
+    url,
+    request: e?.request,
+    conform: e?.conform,
+    ...(e?.clientPrivateKey ? { clientPrivateKey: e?.clientPrivateKey } : null),
+  }
 }
 
 export function isOIDCProvider(

packages/core/src/providers/oauth.ts

@@ -1,4 +1,4 @@
-import type { Client } from "oauth4webapi"
+import type { Client, PrivateKey } from "oauth4webapi"
 import type { CommonProviderOptions } from "../providers/index.js"
 import type { Awaitable, Profile, TokenSet, User } from "../types.js"
 import type { AuthConfig } from "../index.js"
@@ -45,6 +45,7 @@ interface AdvancedEndpointHandler<P extends UrlParams, C, R> {
   request?: EndpointRequest<C, R, P>
   /** @internal */
   conform?: (response: Response) => Awaitable<Response | undefined>
+  clientPrivateKey?: CryptoKey | PrivateKey
 }
 
 /**
@@ -263,6 +264,7 @@ export type OAuthConfigInternal<Profile> = Omit<
   token?: {
     url: URL
     request?: TokenEndpointHandler["request"]
+    clientPrivateKey?: CryptoKey | PrivateKey
     /** @internal */
     conform?: TokenEndpointHandler["conform"]
   }