OAuth: Fix for multiple redirect_uris

packages/oauth/oauth-client-browser/src/browser-oauth-database.ts

@@ -43,6 +43,7 @@ export type Schema = {
     iss: string
     verifier?: string
     appState?: string
+    redirectUri?: string
   }>
   session: Item<{
     dpopKey: EncodedKey

packages/oauth/oauth-client/src/oauth-client.ts

@@ -298,6 +298,9 @@ export class OAuthClient extends CustomEventTarget<OAuthClientEventMap> {
       dpopKey,
       verifier: pkce.verifier,
       appState: options?.state,
+      ...(redirectUri !== this.clientMetadata.redirect_uris[0]
+        ? { redirectUri }
+        : {}),
     })
 
     const parameters: OAuthAuthorizationRequestParameters = {
@@ -443,7 +446,11 @@ export class OAuthClient extends CustomEventTarget<OAuthClientEventMap> {
         )
       }
 
-      const tokenSet = await server.exchangeCode(codeParam, stateData.verifier)
+      const tokenSet = await server.exchangeCode(
+        codeParam,
+        stateData.redirectUri ?? this.clientMetadata.redirect_uris[0],
+        stateData.verifier,
+      )
       try {
         await this.sessionGetter.setStored(tokenSet.sub, {
           dpopKey: stateData.dpopKey,

packages/oauth/oauth-client/src/oauth-server-agent.ts

@@ -78,12 +78,16 @@ export class OAuthServerAgent {
     }
   }
 
-  async exchangeCode(code: string, codeVerifier?: string): Promise<TokenSet> {
+  async exchangeCode(
+    code: string,
+    redirectUri: string,
+    codeVerifier?: string,
+  ): Promise<TokenSet> {
     const now = Date.now()
 
     const tokenResponse = await this.request('token', {
       grant_type: 'authorization_code',
-      redirect_uri: this.clientMetadata.redirect_uris[0]!,
+      redirect_uri: redirectUri,
       code,
       code_verifier: codeVerifier,
     })

packages/oauth/oauth-client/src/state-store.ts

@@ -6,6 +6,7 @@ export type InternalStateData = {
   dpopKey: Key
   verifier?: string
   appState?: string
+  redirectUri?: string
 }
 
 export type StateStore = SimpleStore<string, InternalStateData>