refactor: skip checking www-authenticate if expected status is received

fixes #191

Author: panva

src/index.ts

@@ -2725,8 +2725,6 @@ export async function processPushedAuthorizationResponse(
     throw CodedTypeError('"response" must be an instance of Response', ERR_INVALID_ARG_TYPE)
   }
 
-  checkAuthenticationChallenges(response)
-
   await checkOAuthBodyError(response, 201, 'Pushed Authorization Request Endpoint')
 
   assertReadableResponse(response)
@@ -2775,6 +2773,8 @@ async function parseOAuthResponseErrorBody(response: Response): Promise<OAuth2Er
 
 async function checkOAuthBodyError(response: Response, expected: number, label: string) {
   if (response.status !== expected) {
+    checkAuthenticationChallenges(response)
+
     let err: OAuth2Error | undefined
     if ((err = await parseOAuthResponseErrorBody(response))) {
       await response.body?.cancel()
@@ -3452,8 +3452,6 @@ async function processGenericAccessTokenResponse(
     throw CodedTypeError('"response" must be an instance of Response', ERR_INVALID_ARG_TYPE)
   }
 
-  checkAuthenticationChallenges(response)
-
   await checkOAuthBodyError(response, 200, 'Token Endpoint')
 
   assertReadableResponse(response)
@@ -4373,8 +4371,6 @@ export async function processRevocationResponse(response: Response): Promise<und
     throw CodedTypeError('"response" must be an instance of Response', ERR_INVALID_ARG_TYPE)
   }
 
-  checkAuthenticationChallenges(response)
-
   await checkOAuthBodyError(response, 200, 'Revocation Endpoint')
 
   return undefined
@@ -4508,8 +4504,6 @@ export async function processIntrospectionResponse(
     throw CodedTypeError('"response" must be an instance of Response', ERR_INVALID_ARG_TYPE)
   }
 
-  checkAuthenticationChallenges(response)
-
   await checkOAuthBodyError(response, 200, 'Introspection Endpoint')
 
   let json: JsonObject
@@ -5592,8 +5586,6 @@ export async function processDeviceAuthorizationResponse(
     throw CodedTypeError('"response" must be an instance of Response', ERR_INVALID_ARG_TYPE)
   }
 
-  checkAuthenticationChallenges(response)
-
   await checkOAuthBodyError(response, 200, 'Device Authorization Endpoint')
 
   assertReadableResponse(response)
@@ -6172,8 +6164,6 @@ export async function processBackchannelAuthenticationResponse(
     throw CodedTypeError('"response" must be an instance of Response', ERR_INVALID_ARG_TYPE)
   }
 
-  checkAuthenticationChallenges(response)
-
   await checkOAuthBodyError(response, 200, 'Backchannel Authentication Endpoint')
 
   assertReadableResponse(response)
@@ -6367,8 +6357,6 @@ export async function processDynamicClientRegistrationResponse(
     throw CodedTypeError('"response" must be an instance of Response', ERR_INVALID_ARG_TYPE)
   }
 
-  checkAuthenticationChallenges(response)
-
   await checkOAuthBodyError(response, 201, 'Dynamic Client Registration Endpoint')
 
   assertReadableResponse(response)

test/issue-191.test.ts

@@ -0,0 +1,42 @@
+// see https://github.com/panva/oauth4webapi/issues/191
+
+import test from 'ava'
+import { issuer, client, getResponse } from './_setup.js'
+import * as lib from '../src/index.js'
+
+const questionableResponse = () =>
+  getResponse(JSON.stringify({ access_token: 'foo', token_type: 'bearer', scope: '' }), {
+    headers: new Headers({
+      'content-type': 'application/json',
+      'WWW-Authenticate': 'Key realm="kong"',
+    }),
+  })
+
+const errorResponse = () =>
+  getResponse(JSON.stringify({ access_token: 'foo', token_type: 'bearer', scope: '' }), {
+    headers: new Headers({
+      'content-type': 'application/json',
+      'WWW-Authenticate': 'Key realm="kong"',
+    }),
+    status: 400,
+  })
+
+test('only checks www-authenticate when the status code is invalid', async (t) => {
+  for (const req of [
+    lib.processAuthorizationCodeResponse(issuer, client, questionableResponse()),
+    lib.processDeviceCodeResponse(issuer, client, questionableResponse()),
+    lib.processClientCredentialsResponse(issuer, client, questionableResponse()),
+    lib.processRefreshTokenResponse(issuer, client, questionableResponse()),
+  ]) {
+    await t.notThrowsAsync(() => req)
+  }
+
+  for (const req of [
+    lib.processAuthorizationCodeResponse(issuer, client, errorResponse()),
+    lib.processDeviceCodeResponse(issuer, client, errorResponse()),
+    lib.processClientCredentialsResponse(issuer, client, errorResponse()),
+    lib.processRefreshTokenResponse(issuer, client, errorResponse()),
+  ]) {
+    await t.throwsAsync(() => req, { code: 'OAUTH_WWW_AUTHENTICATE_CHALLENGE' })
+  }
+})