Function oauthApiHandler

packages/web/src/ee/features/oauth/apiHandler.ts:18–32

(handler: H)

 * @see https://datatracker.ietf.org/doc/html/rfc9700#section-4.12
 */
export function oauthApiHandler<H extends AnyHandler>(handler: H): H {
    const wrapped = apiHandler(async (...args: Parameters<H>) => {
        const response = await handler(...args);
        if (response.status === 307 || response.status === 308) {
            throw new Error(
                `OAuth authorization server emitted HTTP ${response.status} redirect; ` +
                `per RFC 9700 §4.12 the authorization server MUST NOT use 307/308. ` +
                `Use 303 (See Other) instead.`
            );
        }
        return response;
    });

    return wrapped as H;
}