From db2052ad9b012e4ded2ede82191e55864ffa66fa Mon Sep 17 00:00:00 2001 From: "ankitatripathi.mp@gmail.com" Date: Wed, 19 Aug 2026 14:20:53 +0530 Subject: [PATCH 1/2] fix: forward plain-string headers to token fetch request --- src/management/wrapper/token-provider.ts | 8 ++++- tests/management/token-provider.test.ts | 46 ++++++++++++++++++++++++ 2 files changed, 53 insertions(+), 1 deletion(-) diff --git a/src/management/wrapper/token-provider.ts b/src/management/wrapper/token-provider.ts index a00cddd24a..cf6d5d8140 100644 --- a/src/management/wrapper/token-provider.ts +++ b/src/management/wrapper/token-provider.ts @@ -16,7 +16,13 @@ export class TokenProvider { constructor( private readonly options: ManagementClient.ManagementClientOptionsWithClientCredentials & { audience: string }, ) { - this.authenticationClient = new AuthenticationClient({ ...options, headers: undefined }); + const stringHeaders = options.headers + ? (Object.fromEntries(Object.entries(options.headers).filter(([, v]) => typeof v === "string")) as Record< + string, + string + >) + : undefined; + this.authenticationClient = new AuthenticationClient({ ...options, headers: stringHeaders }); } public async getAccessToken() { diff --git a/tests/management/token-provider.test.ts b/tests/management/token-provider.test.ts index 0e2cebd50d..98824e87d6 100644 --- a/tests/management/token-provider.test.ts +++ b/tests/management/token-provider.test.ts @@ -122,6 +122,52 @@ describe("TokenProvider", () => { expect(spy).toHaveBeenCalledTimes(1); }); + it("should forward plain string headers to the token fetch request", async () => { + const domain = "headers-test.auth0.com"; + const customUserAgent = "my-custom-sdk/1.0"; + + const headerSpy = jest.fn().mockReturnValue({ + access_token: "my-access-token", + expires_in: 86400, + token_type: "Bearer", + }); + + nock(`https://${domain}`).post("/oauth/token").matchHeader("user-agent", customUserAgent).reply(200, headerSpy); + + const tp = new TokenProvider({ + ...opts, + domain, + headers: { "User-Agent": customUserAgent }, + }); + + expect(await tp.getAccessToken()).toBe("my-access-token"); + expect(headerSpy).toHaveBeenCalled(); + }); + + it("should not throw when headers contain non-string values (supplier functions filtered out)", async () => { + const domain = "supplier-headers-test.auth0.com"; + + const supplierSpy = jest.fn().mockReturnValue({ + access_token: "my-access-token", + expires_in: 86400, + token_type: "Bearer", + }); + + nock(`https://${domain}`).post("/oauth/token").reply(200, supplierSpy); + + const tp = new TokenProvider({ + ...opts, + domain, + headers: { + "User-Agent": "plain-string", + "X-Dynamic": () => "supplier-value", + } as any, + }); + + await expect(tp.getAccessToken()).resolves.toBe("my-access-token"); + expect(supplierSpy).toHaveBeenCalled(); + }); + it.skip("should use a custom fetch", async () => { const customFetch = jest .fn() From 2f4b361649bed4de0d13f355a5a9ed86daad4258 Mon Sep 17 00:00:00 2001 From: "ankitatripathi.mp@gmail.com" Date: Thu, 20 Aug 2026 15:38:25 +0530 Subject: [PATCH 2/2] fix: use type cast instead of filtering for headers in TokenProvider --- src/management/wrapper/token-provider.ts | 11 ++++------- tests/management/token-provider.test.ts | 24 ------------------------ 2 files changed, 4 insertions(+), 31 deletions(-) diff --git a/src/management/wrapper/token-provider.ts b/src/management/wrapper/token-provider.ts index cf6d5d8140..dc5f76d620 100644 --- a/src/management/wrapper/token-provider.ts +++ b/src/management/wrapper/token-provider.ts @@ -16,13 +16,10 @@ export class TokenProvider { constructor( private readonly options: ManagementClient.ManagementClientOptionsWithClientCredentials & { audience: string }, ) { - const stringHeaders = options.headers - ? (Object.fromEntries(Object.entries(options.headers).filter(([, v]) => typeof v === "string")) as Record< - string, - string - >) - : undefined; - this.authenticationClient = new AuthenticationClient({ ...options, headers: stringHeaders }); + this.authenticationClient = new AuthenticationClient({ + ...options, + headers: options.headers as Record, + }); } public async getAccessToken() { diff --git a/tests/management/token-provider.test.ts b/tests/management/token-provider.test.ts index 98824e87d6..ff5863eb41 100644 --- a/tests/management/token-provider.test.ts +++ b/tests/management/token-provider.test.ts @@ -144,30 +144,6 @@ describe("TokenProvider", () => { expect(headerSpy).toHaveBeenCalled(); }); - it("should not throw when headers contain non-string values (supplier functions filtered out)", async () => { - const domain = "supplier-headers-test.auth0.com"; - - const supplierSpy = jest.fn().mockReturnValue({ - access_token: "my-access-token", - expires_in: 86400, - token_type: "Bearer", - }); - - nock(`https://${domain}`).post("/oauth/token").reply(200, supplierSpy); - - const tp = new TokenProvider({ - ...opts, - domain, - headers: { - "User-Agent": "plain-string", - "X-Dynamic": () => "supplier-value", - } as any, - }); - - await expect(tp.getAccessToken()).resolves.toBe("my-access-token"); - expect(supplierSpy).toHaveBeenCalled(); - }); - it.skip("should use a custom fetch", async () => { const customFetch = jest .fn()