General question about usage and documentation

[FlorianB-DE]

In my view, this library is impossible to use. I had to reverse several files and dependencies to gather the knowledge I now want to present.

Also, I'm in no way into Oauth2 and stuff, I just wanna use the thing ;(

I mean I'm currently writing a test case and run into tons of undocumented stuff. Examples:

import {
	Request as AuthRequest,
        Response as AuthResponse,
} from '@node-oauth/oauth2-server';
const server = new OAuth2Server({
	model: model,
	requireClientAuthentication: { password: false }, // this does actually nothing, you have to specify this for every server.token request
});

const request = new AuthRequest({
	headers: {
		'content-type': 'application/x-www-form-urlencoded', // this is the only acceptable form. Why? I mean I haven't read the spec, 
                // maybe it's and RFC kind of thing but what is wrong with sending my credentials via 'application/json'?
		'transfer-encoding': 'chunked', // this is necessary due to type-is requirements (had to figure that one out by digging)
                Authorization: 'Basic ' + Buffer.from(client!.id + ':' + client!.secret).toString('base64'), // this is provided in your example.
                // Doesn't work if you have no client secret tho. Then "null" is passed to the model. Fun! 
                // Also, if you use empty string instead, you get the Error: Missing parameter: `client_secret` instead. LOL
	},
	body: {
		username: 'admin',
		password: 'password',
		grant_type: 'password', // I know, grant_type: 'password' is deprecated. 
	}
});

const authResponse = new AuthResponse();
const token = await authServer.token(authRequest, authResponse, {
	requireClientAuthentication: false, // as said. This has to be set again. 
                // I think it's because the "getClient" method runs before the "handleGrantType" method
});

[jankapunkt]

Which OAuth workflow do you intend to implement?

[FlorianB-DE]

The "Resource Owner Password Flow" for now. I'm starting to understand how this all works but tbh, I didn't want to do that in the first place. Ideally it should be stated somewhere which requests requires what headers and information. e.g. the documentation should say something like this:

If you have a client with a secret, you can use the Authorization header which has to be set to clientID:clientSecret base64 encoded otherwise if the client is a public client, this method does not work. The client ID has to be in the request body then.

Also the Typescript types are incomplete. It allowed me so set requireClientAuthentication: false in the token request method. I now know that this is wrong...

Also the documentation doesn't state anywhere that only 'x-www-form-urlencoded' are accepted. I now read some of RFC 6749 and know that this is required but not at all communicated. I could find this out myself by test driven development and throwing parameters at it and debugging until I formed a request that was accepted.

Sorry if I'm sounding rude. I was very frustrated yesterday :D
I'm trying to fix some of the TypeScript issue.

[jankapunkt]

Please take notice of https://www.rfc-editor.org/rfc/rfc6819#section-4.4.3 if you intend to implement password flow for other than legacy reasons.

[FlorianB-DE]

I know it's deprecated. It's just the thing I'm currently trying cause it was the easiest