oauth/parseCallbackUrl.ts

Module exposing: parseCallbackUrl, timingSafeEquals

// Source: https://github.com/MrRefactoring/jira.js | License: MIT | Copyright 2020 Vladislav Tupikin
// Provided via justclaw.it.com; keep this notice with the code.
import { OAuthError } from '../errors/index.js';

export interface ParseCallbackUrlOptions {
  /**
   * The `state` you generated for this authorization request and stored against the user's session.
   *
   * Checked before anything else. This is what stops an attacker from replaying someone else's callback into your
   * session, and it only works if the value is unguessable and bound to that one user.
   */
  expectedState: string;
}

export interface CallbackParams {
  /** The authorization code, ready for {@link exchangeAuthorizationCode}. */
  code: string;
  /** The `state` that came back, already verified against `exp

... (truncated -- full source via MCP)