export async function getAuthorizationUrl(query, options) {
const { logger, provider } = options;
let url = provider.authorization?.url;
let as;
// Falls back to authjs.dev if the user only passed params
if (!url || url.host === 'authjs.dev' || true) {
// If url is undefined, we assume that issuer is always defined
// We check this in assert.ts
// eslint-disable-next-line @typescript-eslint/no-non-null-assertion
const issuer = new URL(provider.issuer);
const discoveryResponse = await o.discoveryRequest(**issuer**);
const as = await o.processDiscoveryResponse(issuer, discoveryResponse);
if (!as.authorization_endpoint) {
throw new TypeError(
'Authorization server did not provide an authorization endpoint.'
);
}
url = new URL(as.authorization_endpoint);
}
export async function discoveryRequest(issuerIdentifier, options) {
if (!(issuerIdentifier instanceof URL)) {
throw new TypeError('"issuerIdentifier" must be an instance of URL');
}
if (issuerIdentifier.protocol !== 'https:' && issuerIdentifier.protocol !== 'http:') {
throw new TypeError('"issuer.protocol" must be "https:" or "http:"');
}
const url = new URL(issuerIdentifier.href);
switch (options?.algorithm) {
case undefined:
case 'oidc':
url.pathname = `${url.pathname}/.well-known/openid-configuration`.replace('//', '/');
break;
case 'oauth2':
if (url.pathname === '/') {
url.pathname = '.well-known/oauth-authorization-server';
}
else {
url.pathname = `.well-known/oauth-authorization-server/${url.pathname}`.replace('//', '/');
}
break;
default:
throw new TypeError('"options.algorithm" must be "oidc" (default), or "oauth2"');
}
const headers = prepareHeaders(options?.headers);
headers.set('accept', 'application/json');
return (options?.[customFetch] || fetch)(url.href, {
headers: Object.fromEntries(headers.entries()),
method: 'GET',
redirect: 'manual',
signal: options?.signal ? signal(options.signal) : null,
}).then(processDpopNonce);
}
As you can see above, we are passing issuer in discoveryRequest function which always results in response from the default tenant of our provider instead of the tenant whose id we have passed while configuring our provider. This can fetch incorrect authorization url from default tenant.
Environment
Reproduction URL
https://github.com/FusionAuth/fusionauth-quickstart-javascript-nextjs-web
Describe the issue
As you can see above, we are passing issuer in discoveryRequest function which always results in response from the default tenant of our provider instead of the tenant whose id we have passed while configuring our provider. This can fetch incorrect authorization url from default tenant.
How to reproduce
Expected behavior
We should be passing provider.wellKnown in
discoveryRequest
function everywhere as it already takes its correct tenant well known url into account.