Member Junction
    Preparing search index...

    Class AuthServerDiscovery

    Discovers and caches OAuth 2.0 authorization server metadata.

    Implements RFC 8414 metadata discovery with fallback to OpenID Connect discovery endpoint for maximum compatibility.

    Features:

    • Automatic endpoint discovery
    • Database-backed caching with configurable TTL
    • Fallback from OAuth to OIDC discovery
    • Validation of required metadata fields
    const discovery = new AuthServerDiscovery();

    // Get metadata (from cache or fetch)
    const metadata = await discovery.getMetadata(
        'https://auth.example.com',
        contextUser,
        { cacheTTLMinutes: 1440 } // 24 hours
    );

    console.log('Authorization endpoint:', metadata.authorization_endpoint);
    console.log('Token endpoint:', metadata.token_endpoint);
    console.log('Supports DCR:', !!metadata.registration_endpoint);
    Index

    Constructors

    constructor

    Methods

    getMetadata invalidateCache supportsDCR supportsPKCE

    Constructors

    Methods

    • Gets authorization server metadata for an issuer URL.

      First checks in-memory cache, then database cache, finally fetches from the authorization server if not cached or expired.

      Parameters

      • issuerUrl: string

        The authorization server's issuer URL

      • contextUser: UserInfo

        User context for database operations

      • Optionaloptions: { cacheTTLMinutes?: number }

        Optional configuration

      Returns Promise<AuthServerMetadata>

      Authorization server metadata

      Error if metadata cannot be discovered

    • Invalidates cached metadata for an issuer.

      Call this when you need to force a refresh of the metadata, such as after a configuration change or error.

      Parameters

      • issuerUrl: string

        The authorization server's issuer URL

      • contextUser: UserInfo

        User context for database operations

      Returns Promise<void>

    • Checks if an authorization server supports PKCE with S256.

      Parameters

      • issuerUrl: string

        The authorization server's issuer URL

      • contextUser: UserInfo

        User context for database operations

      Returns Promise<boolean>

      true if S256 PKCE is supported (or if not explicitly listed, assume supported)

    Settings

    Member Visibility

    On This Page

    Constructors
    Methods