/userinfo endpoint

Purpose

handleUserInfo implements the OAuth/OIDC userinfo endpoint. Given a Bearer authorization header, it looks up the associated access token, verifies it has not expired, and returns the matching user payload shaped by the configured userShape (or by a custom userMapper when the caller supplies one).

The endpoint backs the primary identity-fetch path that production OAuth adapters use after a successful code-exchange, so it is the surface most test scenarios assert against.

Features

Bearer <token> extraction with regex validation.
Looks up the token in the in-memory access-token map and 401s on unknown or expired tokens.
Dispatches across github / google / generic shapes, or hands the primed payload to a caller-supplied userMapper.
All error responses use RFC-6750 invalid_token envelopes.

Usage: Basic

const r = handleUserInfo(state, "Bearer at_abc");
// → { status: 200, body: { id: 42, login: "alice", … } }

Usage: Advanced

Provide a custom mapper to return arbitrary claim shapes:

const state = {
    ...,
    options: {
        ...,
        userMapper: (primed) => ({ sub: String(primed?.id), groups: ["admins"] }),
    },
};

API Reference

handleUserInfo(state, authorizationHeader: string | undefined): UserInfoResult
interface UserInfoResult — { status: 200 | 401, body: Record<string, unknown> }.

Implementation Notes

The matcher uses ^Bearer\s+(.+)$ (case-sensitive, unicode flag) so RFC-6750's exact-spelling requirement is enforced — "bearer" or "Token" headers are rejected as malformed. Token expiry is checked with <= Date.now() so a token whose expiresAt equals the current millisecond is treated as expired (defensive boundary). The default branch of the userShape switch is unreachable under the typed input and is /* c8 ignore */d to keep coverage clean.

1.9 KiB Raw Blame History