Prepare next release

[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@germ-network/oauth4swift@0.6.0

Minor Changes

• #48 4458abe Thanks @ThisIsMissEm! - Add ClientAuth.Method and ClientAuth.SecretMethod protocols; conform None, SecretBasic, and SecretPost

• #48 fc3addb Thanks @ThisIsMissEm! - Add revocationRequest to ClientAuth.Authenticable; add RevocableToken enum with token_type_hint support (RFC 7009)

• #48 98faa4c Thanks @ThisIsMissEm! - Require GermConvenience 0.3.0, and adopt its response helpers

  The dependency floor moves to 0.3.0, which makes BundledHTTPRequest.request
private(set) and body let. The three sites that assigned header fields in
  place now use settingHeader(_:for:). Anything depending on oauth4swift resolves
  0.3.0 too.

  Drops the local HTTPDataResponse.successOrThrow copy in favour of the version
  lifted into GermConvenience as expectSuccess(orError:), and collapses the
  hand-rolled .result/.error switches in the PAR and token-endpoint paths onto
  get(mapError:).

  0.3.0 also fixes HTTPDataResponse.success, which both of those paths use: a 2xx
  whose body fails to decode now reports the real DecodingError rather than being
  retried as an error body — previously a malformed token response surfaced as
  Errors.invalidRequest. A non-2xx whose body is not an OAuth error response (a
  proxy's HTML, an empty body) now throws HTTPResponseError.unsuccessful with the
  status and bytes intact rather than a bare DecodingError.

Patch Changes

• #48 4f12212 Thanks @ThisIsMissEm! - Make all AuthServerMetadata properties public

• #53 c0deef1 Thanks @nnabeyang! - Preserve refresh tokens when token refresh fails with transient OAuth server errors.

• #56 fc515f0 Thanks @germ-mark! - fix the client_secret_basic Authorization header: add the "Basic " scheme prefix and form-url-encode the client id and secret

• #52 0f47abc Thanks @ThisIsMissEm! - Skip refresh token requests when the server does not advertise refresh_token in grant_types_supported

• #48 b165de4 Thanks @ThisIsMissEm! - Fix missing client_id when not using PAR for authorization

• #57 c0c2c42 Thanks @germ-mark! - Preserve the session on any refresh failure other than a 400 invalid_grant, including error bodies that aren't structured OAuth errors. A TokenRefreshOptions.validate that throws now propagates rather than terminating the session, per its documented contract that throwing means validity couldn't be resolved; a thrown tokenInvalid still terminates, since validators shared with the authorize flow signal invalidity that way.

• #58 8b826f4 Thanks @germ-mark! - Add OAuth.Errors.refreshNotSupported

  Thrown by the refresh gate when the server's grant_types_supported excludes
  refresh_token, so the session is preserved (skip) rather than terminated, and
  callers can distinguish "this server can never refresh - plan around
  access-token expiry" from a transient failure. Note: adding a case to a public
  enum breaks exhaustive switches over OAuth.Errors; no known consumer has one.

• #48 1da4bb8 Thanks @ThisIsMissEm! - Add resolveMaybe to AuthServerMetadata to fetch optional URLs in AS metadata

• #48 88c1a79 Thanks @ThisIsMissEm! - Add notSupported error to OAuth.Errors