tidy

packages/oauth/oauth-client/src/oauth-client.ts

@@ -249,18 +249,20 @@ export class OAuthClient extends CustomEventTarget<OAuthClientEventMap> {
     return this.keyset?.publicJwks ?? ({ keys: [] as const } as const)
   }
 
-  async authorize(input: string, options?: AuthorizeOptions): Promise<URL> {
+  async authorize(
+    input: string,
+    { signal, ...options }: AuthorizeOptions = {},
+  ): Promise<URL> {
     const redirectUri =
       options?.redirect_uri ?? this.clientMetadata.redirect_uris[0]
     if (!this.clientMetadata.redirect_uris.includes(redirectUri)) {
       // The server will enforce this, but let's catch it early
       throw new TypeError('Invalid redirect_uri')
     }
 
-    const { identity, metadata } = await this.oauthResolver.resolve(
-      input,
-      options,
-    )
+    const { identity, metadata } = await this.oauthResolver.resolve(input, {
+      signal,
+    })
 
     const pkce = await this.runtime.generatePKCE()
     const dpopKey = await this.runtime.generateKey(

packages/oauth/oauth-client/src/oauth-session.ts

@@ -27,7 +27,7 @@ export class OAuthSession {
   constructor(
     public readonly server: OAuthServerAgent,
     public readonly sub: string,
-    private readonly tokenGetter: SessionGetter,
+    private readonly sessionGetter: SessionGetter,
     fetch: Fetch = globalThis.fetch,
   ) {
     this.dpopFetch = dpopFetchWrapper<void>({
@@ -56,7 +56,7 @@ export class OAuthSession {
    * if, and only if, they are (about to be) expired. Defaults to `undefined`.
    */
   protected async getTokenSet(refresh: boolean | 'auto'): Promise<TokenSet> {
-    const { tokenSet } = await this.tokenGetter.get(this.sub, {
+    const { tokenSet } = await this.sessionGetter.get(this.sub, {
       noCache: refresh === true,
       allowStale: refresh === false,
     })
@@ -88,7 +88,7 @@ export class OAuthSession {
       const tokenSet = await this.getTokenSet(false)
       await this.server.revoke(tokenSet.access_token)
     } finally {
-      await this.tokenGetter.delStored(
+      await this.sessionGetter.delStored(
         this.sub,
         new TokenRevokedError(this.sub),
       )
@@ -146,7 +146,7 @@ export class OAuthSession {
       // TODO: Is there a "softer" way to handle this, e.g. by marking the
       // session as "expired" in the session store, allowing the user to trigger
       // a new login (using login_hint)?
-      await this.tokenGetter.delStored(
+      await this.sessionGetter.delStored(
         this.sub,
         new TokenInvalidError(this.sub),
       )