feat(oauth): add comprehensive TypeScript types and eliminate all 'any' usage

[ArtieReus]

Summary

Adds comprehensive TypeScript types throughout the OAuth package and eliminates all 44 occurrences of any type. This establishes a strong type foundation for the package and prepares it for ESLint config

Changes Made

• Created src/types.ts: Centralized all shared type definitions

  • FlowType, OidcConfig, IdTokenData, ParsedTokenData, AuthData
  • SessionState discriminated union for type-safe state management
  • TokenSessionState for tokenSession's simpler state model
  • OidcStateData, TokenResponse, FlowResponse for OAuth flows
  • All session parameter and instance interfaces

• src/utils.ts: Typed all utility functions (encodeBase64Json, decodeBase64Json, paramsToUrl)

• src/tokenHelpers.ts: Added proper return types and fixed array map callbacks

• src/oidcConfig.ts: Fixed async bug (config: await r.json()) and added types

• src/oidcState.ts: Typed state management and PKCE callbacks

• src/implicitFlow.ts & src/codeFlow.ts: Typed all OAuth flow functions

• src/oidcSession.ts: Most comprehensive changes

  • Created SessionStateUpdate union type for type-safe partial updates
  • Enforces discriminated union constraints at compile time
  • Refactored receiveNewData to explicitly handle auth data presence
  • Added comments explaining discriminated union type narrowing
  • Used ES6 shorthand syntax (flowType instead of flowType: flowType)

• src/tokenSession.ts: Aligned with shared types from types.ts

• src/mockedSession.ts: Uses shared SessionState and interfaces

• src/index.ts: Exported all public types for consumers including TokenSessionState

Related Issues

• Prepares for [Task](oauth): Migrate to vite-react-ts eslint config and modern jsx #1988 (ESLint config migration to vite-react-ts.mjs)

Screenshots (if applicable)

N/A - Type-only changes, no visual impact

Testing Instructions

1. pnpm i
2. cd packages/oauth
3. pnpm typecheck - should pass with no errors
4. pnpm lint - should pass with no errors
5. pnpm test - all 85 tests should pass
6. pnpm build - should build successfully

Checklist

• I have performed a self-review of my code.
• I have commented my code, particularly in hard-to-understand areas.
• I have added tests that prove my fix is effective or that my feature works.
• New and existing unit tests pass locally with my changes.
• I have made corresponding changes to the documentation (if applicable).
• My changes generate no new warnings or errors.
• I have created a changeset for my changes.

PR Manifesto

Review the PR Manifesto for best practises.

[changeset-bot]

⚠️ No Changeset found

Latest commit: f232669

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[Copilot]

Copilot review overview

🟡 Changes recommended

Public contracts remain disconnected or inaccurate, and decoded OAuth data is asserted without adequate runtime validation.

Review effort: Balanced
Findings: 1 · 5

Open (6)

• Validate persisted session state before dereferencing · New
• Exported session factories use detached and inconsistent types · New
• Validate decoded payload before asserting IdTokenData · New
• Declare nullable refreshToken for implicit flow auth data · New
• Expose and forward callbackURL instead of _callbackURL · New
• Align callback contract with tokenSession failure states · New

What changed in this PR

Introduces centralized OAuth types and strengthens TypeScript coverage across session, token, state, and flow utilities.

Changes:

• Adds and exports shared OAuth models and session contracts.
• Replaces several any usages with explicit types.
• Updates flow tests with required OIDC state fields.

File	Description
packages/​oauth/​src/​types.ts	Adds shared OAuth types.
packages/​oauth/​src/​index.ts	Exports public types.
packages/​oauth/​src/​utils.ts	Types encoding and URL helpers.
packages/​oauth/​src/​tokenSession.ts	Types token composition data.
packages/​oauth/​src/​tokenHelpers.ts	Types token decoding and parsing.
packages/​oauth/​src/​oidcState.ts	Types persisted OIDC state and PKCE.
packages/​oauth/​src/​oidcConfig.ts	Types discovery configuration and cache.
packages/​oauth/​src/​implicitFlow.ts	Types implicit-flow inputs and results.
packages/​oauth/​src/​codeFlow.ts	Types code-flow inputs and results.
packages/​oauth/​__tests__/​implicitFlow.test.ts	Updates typed state fixture.
packages/​oauth/​__tests__/​codeFlow.test.ts	Updates typed state fixtures.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

Custom callback URLs can break code-flow login, and mock-token handling has input and encoding regressions.

Review effort: Balanced
Findings: 2 · 2

Open (4)

• Escape non-Latin-1 characters before JWT encoding · New
• Use the same redirect URI for authorization and token exchange · New
• Reject malformed decoded JSON before fallback · New
• Validate decoded claims before asserting IdTokenData · New

Resolved since last review (6)

• Validate persisted session state before dereferencing
• Align callback contract with tokenSession failure states
• Expose and forward callbackURL instead of _callbackURL
• Declare nullable refreshToken for implicit flow auth data
• Validate decoded payload before asserting IdTokenData
• Exported session factories use detached and inconsistent types

Previously missed (1)

In code that hasn't changed since last review

Allow numeric and boolean OIDC request parameters

packages/​oauth/​src/​types.ts:268

requestParams now rejects numeric and boolean values such as { max_age: 0 }, although createOidcRequest stringifies each value when building the URL and earlier callers could pass them. Widen this field and the matching CreateOidcRequestParams.requestParams to accept string | number | boolean values so existing, working requests still type-check.

[Copilot]

Copilot review overview

🟡 Changes recommended

Reusing a URL input can fetch the wrong discovery path, and the stated removal of explicit any is incomplete.

Review effort: Balanced
Findings: 1

Open (1)

• Test custom callbackURL in the token exchange redirect_uri · New

Resolved since last review (4)

• Use the same redirect URI for authorization and token exchange
• Escape non-Latin-1 characters before JWT encoding
• Validate decoded claims before asserting IdTokenData
• Reject malformed decoded JSON before fallback

Previously missed (2)

In code that hasn't changed since last review

Clone URL before appending the OIDC discovery path

packages/​oauth/​src/​oidcConfig.ts:11

getOidcConfig now explicitly accepts a URL, but line 23 uses that same object and line 26 appends the discovery path to its pathname. After one call, the caller's URL is changed; calling again with it misses the original cache entry and fetches a path with /.well-known/openid-configuration appended twice. Clone the URL before changing its pathname and cover reuse of a URL instance in the config tests.

Remove any cast and type-check the PKCE callback

packages/​oauth/​src/​oidcState.ts:15

The new PKCE callback type does not remove the (getPkceImport as any) cast on line 12, so this source file still contains an explicit any despite the PR's stated goal. That cast also bypasses checking the resolved callable. Narrow the CommonJS/ESM export from unknown, verify it is a function, and give that function the PKCE signature.

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-09-29 16:32 UTC