feat(auth0-fastify): add Custom Token Exchange support#78
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (2)
📝 WalkthroughWalkthroughAdds custom token exchange support to ChangesCustom Token Exchange Feature
Sequence DiagramsequenceDiagram
participant Test as Vitest Test
participant Fastify as Fastify Route
participant Auth0Client as auth0Client
participant MSW as MSW Token Endpoint
rect rgba(100, 200, 100, 0.5)
Note over Fastify,Auth0Client: Session-creating flow
Test->>Fastify: POST /login-custom-token-exchange
Fastify->>Auth0Client: loginWithCustomTokenExchange({subjectToken}, {request, reply})
Auth0Client->>MSW: POST /oauth/token (subjectToken)
MSW-->>Auth0Client: accessToken, idToken [, act claim]
Auth0Client-->>Fastify: __a0_session cookie set (user.sub, tokenSets)
Fastify-->>Test: HTTP response + Set-Cookie
end
rect rgba(100, 150, 200, 0.5)
Note over Fastify,Auth0Client: Delegation flow (no session)
Test->>Fastify: POST /custom-token-exchange
Fastify->>Auth0Client: customTokenExchange({subjectToken}, [actorToken])
Auth0Client->>MSW: POST /oauth/token (subjectToken, [actor tokens])
MSW-->>Auth0Client: accessToken [or TokenExchangeError on 400]
Auth0Client-->>Fastify: accessToken result (no session cookie)
Fastify-->>Test: HTTP response (no Set-Cookie)
end
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/auth0-fastify/EXAMPLES.md`:
- Around line 212-216: Remove the blank line that appears between the two
blockquote callouts in the EXAMPLES.md file. The blank line exists between the
[!NOTE] blockquote about the openid scope and the [!IMPORTANT] blockquote about
store options, which violates the MD028 rule. Delete this empty line so the two
blockquotes are directly consecutive without any separation between them.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: f7bf7519-d0eb-491e-a775-3b5d4e1161a6
📒 Files selected for processing (4)
packages/auth0-fastify/EXAMPLES.mdpackages/auth0-fastify/package.jsonpackages/auth0-fastify/src/index.spec.tspackages/auth0-fastify/src/index.ts
| expect(session.tokenSets[0]?.accessToken).toBe(accessToken); | ||
| }); | ||
|
|
||
| test('customTokenExchange returns a token without creating a session', async () => { |
There was a problem hiding this comment.
nit: worth adding a test where customTokenExchange does not overwrite an existing session
There is a session and after calling customTokenExchange it remains intact.
| export type { | ||
| LoginWithCustomTokenExchangeOptions, | ||
| CustomTokenExchangeOptions, | ||
| LoginWithCustomTokenExchangeResult, | ||
| } from '@auth0/auth0-server-js'; |
There was a problem hiding this comment.
Suggest also re-exporting TokenResponse and ActClaim from @auth0/auth0-server-js here.
customTokenExchange() returns a TokenResponse which carries act?: ActClaim for delegation flows. Without these exports, a developer who writes a typed helper function or service layer cannot name these types from @auth0/auth0-fastify
3 participants
Changes
Adds Custom Token Exchange (CTE) support to the
Fastifyplugin, building on theCTEmethods released in@auth0/auth0-server-js v1.6.0.The plugin follows the same client-only pattern it already uses for
CIBA(loginBackchannel): no new mounted route. Developers call the methods onfastify.auth0Clientfrom their own routes.LoginWithCustomTokenExchangeOptions,CustomTokenExchangeOptions, andLoginWithCustomTokenExchangeResultfrom auth0-server-js so consumers can import them from @auth0/auth0-fastify.@auth0/auth0-server-jsfrom^1.4.0to^1.6.0(the version that ships theCTEmethods).EXAMPLESsection covering both methods, actor-token delegation and theactclaim, the openid-scope note, and the refresh-token suppression caveat when an actor token is used.No change to the plugin body. The methods are already reachable on the decorated client; this PR makes the types and docs first-class.
Testing
Added unit tests in index.spec.ts:
loginWithCustomTokenExchangewrites the exchanged user to the sessionloginWithCustomTokenExchangestores the token under the configured audiencecustomTokenExchangereturns a token without creating a sessioncustomTokenExchangesurfaces the act claim when an actor token is usedcustomTokenExchangethrows when the exchange failsSummary by CodeRabbit
Documentation
Tests
Chores
@auth0/auth0-server-jsdependency to^1.6.1.Refactor