Function parseChallenges

packages/core/sdk/src/www-authenticate.ts:34–166

(header: string)

/** Parse authentication challenges without joining parameters across schemes. */
export const parseChallenges = (header: string): readonly Challenge[] | null => {
  const len = header.length;
  const challenges: Challenge[] = [];
  let current: Challenge | null = null;
  let state: "boundary" | "scheme" | "token68" | "params" = "boundary";
  let sawComma = true; // header start counts as a list boundary
  let i = 0;

  const readWord = (): string => {
    const start = i;
    while (i < len && WORD_RE.test(header[i]!)) i += 1;
    return header.slice(start, i);
  };
  // Returns null on an unterminated quote or a quote run into the next token.
  const readQuoted = (): string | null => {
    let value = "";
    i += 1; // opening quote
    while (i < len) {
      const ch = header[i]!;
      if (ch === '"') {
        i += 1;
        return i >= len || /[\s,]/.test(header[i]!) ? value : null;
      }
      if (ch === "\\" && i + 1 < len) {
        value += header[i + 1];
        i += 2;
        continue;
      }
      value += ch;
      i += 1;
    }
    return null; // unterminated
  };

  while (i < len) {
    while (i < len && /\s/.test(header[i]!)) i += 1;
    if (i >= len) break;
    if (header[i] === ",") {
      sawComma = true;
      i += 1;
      continue;
    }
    if (!WORD_RE.test(header[i]!)) return null; // stray quote/byte: malformed
    const word = readWord();
    // Look ahead through BWS for `=` to classify the word.
    let j = i;
    while (j < len && /[ \t]/.test(header[j]!)) j += 1;
    const isPaddingRun = (() => {
      // An `=`-run directly on the word (no BWS) that is followed (after
      // optional whitespace) by a comma or the end of input is token68
      // padding. An `=` followed by a value — even across BWS — is an
      // auth-param (RFC 7230 allows BWS around `=`).
      if (header[i] !== "=") return false;
      let k = i;
      while (k < len && header[k] === "=") k += 1;
      while (k < len && /[ \t]/.test(header[k]!)) k += 1;
      return k >= len || header[k] === ",";
    })();