Skip to content

feat(salesforce): PKCE support + userURL configurable #522

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
phof wants to merge 6 commits into
base: main
Choose a base branch
from
Open

feat(salesforce): PKCE support + userURL configurable #522

Changes from 2 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
8e76037
feat(salesforce): add PKCE support
phof May 8, 2026
48f7ddd
feat(salesforce): make userURL configurable
phof May 8, 2026
10088bc
fix(salesforce): prevent authorizationParams from overriding state an…
phof May 8, 2026
3f2a6ea
fix(salesforce): honor runtime-config baseURL when deriving default e…
phof May 8, 2026
4783c1e
docs(salesforce): document URL endpoint defaults as derived from baseURL
phof May 8, 2026
8597dc3
fix(salesforce): prevent authorizationParams from overriding core OAu…
phof May 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 12 additions & 2 deletions src/runtime/server/lib/oauth/salesforce.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ import type { H3Event } from 'h3'
import { eventHandler, getQuery, sendRedirect } from 'h3'
import { withQuery } from 'ufo'
import { defu } from 'defu'
import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken, handleState, handleInvalidState } from '../utils'
import { handleMissingConfiguration, handleAccessTokenErrorResponse, getOAuthRedirectURL, requestAccessToken, handleState, handleInvalidState, handlePkceVerifier } from '../utils'
import { useRuntimeConfig, createError } from '#imports'
import type { OAuthConfig } from '#auth-utils'

Expand Down Expand Up @@ -39,6 +39,11 @@ export interface OAuthSalesforceConfig {
* @default 'https://login.salesforce.com/services/oauth2/token'
*/
tokenURL?: string
/**
* Salesforce OAuth User URL
* @default 'https://login.salesforce.com/services/oauth2/userinfo'
*/
userURL?: string
Comment thread
phof marked this conversation as resolved.
/**
* Extra authorization parameters to provide to the authorization URL
* @default {}
Expand All @@ -62,6 +67,7 @@ export function defineOAuthSalesforceEventHandler({
config = defu(config, runtimeConfig, {
authorizationURL: `${baseURL}/services/oauth2/authorize`,
tokenURL: `${baseURL}/services/oauth2/token`,
userURL: `${baseURL}/services/oauth2/userinfo`,
authorizationParams: {},
}) as OAuthSalesforceConfig

Expand All @@ -82,6 +88,7 @@ export function defineOAuthSalesforceEventHandler({
}

const redirectURL = config.redirectURL || getOAuthRedirectURL(event)
const pkce = await handlePkceVerifier(event)
const state = await handleState(event)

if (!query.code) {
Expand All @@ -94,6 +101,8 @@ export function defineOAuthSalesforceEventHandler({
redirect_uri: redirectURL,
scope: config.scope.join(' '),
state,
code_challenge: pkce.code_challenge,
code_challenge_method: pkce.code_challenge_method,
...config.authorizationParams,
}),
)
Expand All @@ -110,6 +119,7 @@ export function defineOAuthSalesforceEventHandler({
client_secret: config.clientSecret,
redirect_uri: redirectURL,
code: query.code,
code_verifier: pkce.code_verifier,
},
})

Expand All @@ -118,7 +128,7 @@ export function defineOAuthSalesforceEventHandler({
}

const accessToken = tokens.access_token
const user = await $fetch(`${baseURL}/services/oauth2/userinfo`, {
const user = await $fetch(config.userURL as string, {
headers: {
Authorization: `Bearer ${accessToken}`,
},
Expand Down
Loading