deps: bump @cloudflare/workers-oauth-provider from 0.3.0 to 0.8.0

[dependabot]

Bumps @cloudflare/workers-oauth-provider from 0.3.0 to 0.8.0.

Release notes

Sourced from @​cloudflare/workers-oauth-provider's releases.

v0.8.0

Minor Changes

• #228 d3d1c10 Thanks @​mattzcarey! - Simplify clientRegistrationCallback to be an allow-or-reject policy hook. Returning undefined allows registration; returning an object rejects registration with optional code, description, and status. Metadata override behavior has been removed.

• #184 917fe92 Thanks @​Talador12! - Add clientRegistrationCallback for validating or rejecting dynamic client registrations before storage. Return undefined/nothing to allow registration, or return an object to reject it. Closes #162.

  • Default rejection error follows RFC 7591 §3.2.2 (invalid_client_metadata / 400). Callbacks rejecting for non-metadata reasons (missing IAT, untrusted origin) should override code and status explicitly.
  • The request passed to the callback is cloned before the library reads the body, so callbacks may consume the body (e.g. to verify a signature over the raw bytes).
  • Callback exceptions are caught and surfaced as 500 server_error.
  • software_statement (RFC 7591 §3.1.1) JWTs are not processed by the library; callbacks wishing to honor them must verify the JWT and apply its claims themselves.

Patch Changes

• #231 624fc56 Thanks @​william-canva! - Bound the KV page size used when revoking existing grants during authorization.

• #224 46cf9b6 Thanks @​mattzcarey! - Add Cache-Control: no-store and Pragma: no-cache to OAuth responses that carry tokens, credentials, or OAuth state, matching the response examples in RFC 6749 §5.1/§5.2: token endpoint responses (success and error), dynamic client registration responses carrying client_secret, and EMA JWT-bearer token responses.

• #207 fd6e40b Thanks @​EfeDurmaz16! - Tighten token endpoint client authentication parsing for RFC 6749 compliance.

• #187 a1534c4 Thanks @​Talador12! - Advertise fragment in response_modes_supported when allowImplicitFlow enables the implicit token response type. RFC 8414 §2 requires authorization server metadata to list supported response modes; RFC 6749 §4.2.2 delivers implicit-flow access tokens through the redirect URI fragment.

• #188 64aa241 Thanks @​Talador12! - Verify client ownership on token revocation (RFC 7009 §2.1) and honor token_type_hint for lookup ordering. Previously any client could revoke any other client's tokens.

• #225 601f042 Thanks @​mattzcarey! - Validate the authorization code and requesting client before acting on a grant during the authorization code exchange.

  The /token authorization code grant now verifies the submitted code against the stored code hash and confirms the requesting client matches the grant's client before any single-use replay handling runs. The auth code hash is retained after exchange so that a replayed code can be verified rather than acted upon based on its userId:grantId prefix alone. This ensures a code that does not match the one issued for a grant has no effect on that grant.

v0.7.2

Patch Changes

• #222 45397d8 Thanks @​mattzcarey! - Add an opt-in allowPublicClients flag to enterpriseManagedAuthorization.

  By default the enterprise-managed authorization (ID-JAG) grant requires client authentication, so public clients (token_endpoint_auth_method: 'none') are rejected. Setting allowPublicClients: true also accepts public clients on this grant — for example clients registered via a Client ID Metadata Document (CIMD), which are always public and cannot present a client secret. The default remains false, preserving existing behavior.

v0.7.1

Patch Changes

• #221 8e3f08c Thanks @​mattzcarey! - Preserve RFC 7591 §2.2 internationalized client metadata variants.

  Localized variants of the human-readable client metadata fields — expressed with a #<BCP 47 language tag> suffix on the member name (e.g. client_name#ja, tos_uri#fr) — were previously dropped during client registration. They are now captured for client_name, client_uri, logo_uri, tos_uri, and policy_uri, stored on the client record under a new optional i18n map (keyed by the raw field#tag name), and echoed back in the registration response alongside their canonical fields. The same handling applies to Client ID Metadata Document ingestion.

  Localized values are validated with the same rules as their canonical field: URI variants must be absolute http: or https: URLs, and all variants must

... (truncated)

Changelog

Sourced from @​cloudflare/workers-oauth-provider's changelog.

0.8.0

Minor Changes

• #228 d3d1c10 Thanks @​mattzcarey! - Simplify clientRegistrationCallback to be an allow-or-reject policy hook. Returning undefined allows registration; returning an object rejects registration with optional code, description, and status. Metadata override behavior has been removed.

• #184 917fe92 Thanks @​Talador12! - Add clientRegistrationCallback for validating or rejecting dynamic client registrations before storage. Return undefined/nothing to allow registration, or return an object to reject it. Closes #162.

  • Default rejection error follows RFC 7591 §3.2.2 (invalid_client_metadata / 400). Callbacks rejecting for non-metadata reasons (missing IAT, untrusted origin) should override code and status explicitly.
  • The request passed to the callback is cloned before the library reads the body, so callbacks may consume the body (e.g. to verify a signature over the raw bytes).
  • Callback exceptions are caught and surfaced as 500 server_error.
  • software_statement (RFC 7591 §3.1.1) JWTs are not processed by the library; callbacks wishing to honor them must verify the JWT and apply its claims themselves.

Patch Changes

• #231 624fc56 Thanks @​william-canva! - Bound the KV page size used when revoking existing grants during authorization.

• #224 46cf9b6 Thanks @​mattzcarey! - Add Cache-Control: no-store and Pragma: no-cache to OAuth responses that carry tokens, credentials, or OAuth state, matching the response examples in RFC 6749 §5.1/§5.2: token endpoint responses (success and error), dynamic client registration responses carrying client_secret, and EMA JWT-bearer token responses.

• #207 fd6e40b Thanks @​EfeDurmaz16! - Tighten token endpoint client authentication parsing for RFC 6749 compliance.

• #187 a1534c4 Thanks @​Talador12! - Advertise fragment in response_modes_supported when allowImplicitFlow enables the implicit token response type. RFC 8414 §2 requires authorization server metadata to list supported response modes; RFC 6749 §4.2.2 delivers implicit-flow access tokens through the redirect URI fragment.

• #188 64aa241 Thanks @​Talador12! - Verify client ownership on token revocation (RFC 7009 §2.1) and honor token_type_hint for lookup ordering. Previously any client could revoke any other client's tokens.

• #225 601f042 Thanks @​mattzcarey! - Validate the authorization code and requesting client before acting on a grant during the authorization code exchange.

  The /token authorization code grant now verifies the submitted code against the stored code hash and confirms the requesting client matches the grant's client before any single-use replay handling runs. The auth code hash is retained after exchange so that a replayed code can be verified rather than acted upon based on its userId:grantId prefix alone. This ensures a code that does not match the one issued for a grant has no effect on that grant.

0.7.2

Patch Changes

• #222 45397d8 Thanks @​mattzcarey! - Add an opt-in allowPublicClients flag to enterpriseManagedAuthorization.

  By default the enterprise-managed authorization (ID-JAG) grant requires client authentication, so public clients (token_endpoint_auth_method: 'none') are rejected. Setting allowPublicClients: true also accepts public clients on this grant — for example clients registered via a Client ID Metadata Document (CIMD), which are always public and cannot present a client secret. The default remains false, preserving existing behavior.

0.7.1

Patch Changes

• #221 8e3f08c Thanks @​mattzcarey! - Preserve RFC 7591 §2.2 internationalized client metadata variants.

  Localized variants of the human-readable client metadata fields — expressed with a #<BCP 47 language tag> suffix on the member name (e.g. client_name#ja, tos_uri#fr) — were previously dropped during client registration. They are now captured for client_name, client_uri, logo_uri, tos_uri, and policy_uri, stored on the client record under a new optional i18n map (keyed by the raw field#tag name), and echoed back in the registration response alongside their canonical fields. The same handling applies to Client ID Metadata Document ingestion.

... (truncated)

Commits

• e77979e Version Packages (#226)
• 624fc56 perf: bound grant pagination when revoking existing grants (#231)
• 591ba5a chore: upgrade Vitest to v4 (#229)
• 64aa241 fix: verify client ownership and honor token_type_hint in revocation (RFC 700...
• d3d1c10 fix: simplify DCR callback rejection shape (#228)
• 917fe92 feat: add clientRegistrationCallback for customizing DCR
• fd6e40b fix: validate token endpoint client authentication
• a1534c4 fix: advertise fragment response mode when implicit flow is enabled
• 601f042 fix: validate authorization code and client before acting on grant (#225)
• 46cf9b6 fix: prevent caching of token, credential, and error responses (RFC 6749 §5.1...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #52.