Add additional parameter support

README.md

@@ -74,10 +74,13 @@ const { data, error } = await insforge.auth.signInWithPassword({
 });
 
 // OAuth authentication (built-in or custom provider key)
-await insforge.auth.signInWithOAuth({
-  provider: "google", // e.g. built-in: "google", custom: "auth0-acme"
+await insforge.auth.signInWithOAuth("google", {
   redirectTo: "http://localhost:3000/dashboard",
+  additionalParams: { prompt: "select_account" },
 });
+// additionalParams is for provider-specific hints only.
+// Do not pass client_id, scope, redirect_uri, code_challenge, state, or response_type;
+// InsForge sets server-owned OAuth fields and ignores colliding client-provided keys.
 
 // Get current user (call this during browser app startup)
 const { data: currentUser } = await insforge.auth.getCurrentUser();

SDK-REFERENCE.md

@@ -212,13 +212,16 @@ await insforge.auth.signInWithPassword({
 ### `signInWithOAuth()`
 
 ```javascript
-await insforge.auth.signInWithOAuth({
-  provider: "google", // built-in (e.g. "google") or custom provider key (e.g. "auth0-acme")
+await insforge.auth.signInWithOAuth("google", {
   redirectTo: "http://localhost:3000/dashboard",
+  additionalParams: { prompt: "select_account" }, // optional provider-specific OAuth params
   skipBrowserRedirect: true, // optional, returns URL instead of redirecting
 });
 // Response: { data: { url, provider }, error }
 // Auto-redirects in browser unless skipBrowserRedirect: true
+// additionalParams is for provider-specific hints only. Do not pass client_id, scope,
+// redirect_uri, code_challenge, state, or response_type; InsForge sets those server-side
+// and ignores colliding client-provided keys.
 
 // AUTOMATIC OAuth Callback Detection (v0.0.14+):
 // When users are redirected back from OAuth provider, the SDK automatically:

integration-tests/auth.test.ts

@@ -421,10 +421,13 @@ describe('Auth Module', () => {
   describe('signInWithOAuth()', () => {
     it('should return an OAuth URL for a built-in provider', async () => {
       const c = createClient();
-      const { data, error } = await c.auth.signInWithOAuth({
-        provider: 'google',
-        skipBrowserRedirect: true,
-      });
+      const { data, error } = await c.auth.signInWithOAuth(
+        'google',
+        {
+          redirectTo: 'http://localhost:3000/dashboard',
+          skipBrowserRedirect: true,
+        },
+      );
 
       // Provider may not be configured – both outcomes are valid
       if (error) {
@@ -437,10 +440,13 @@ describe('Auth Module', () => {
 
     it('should return an OAuth URL for a custom provider', async () => {
       const c = createClient();
-      const { data, error } = await c.auth.signInWithOAuth({
-        provider: 'custom-test-provider',
-        skipBrowserRedirect: true,
-      });
+      const { data, error } = await c.auth.signInWithOAuth(
+        'custom-test-provider',
+        {
+          redirectTo: 'http://localhost:3000/dashboard',
+          skipBrowserRedirect: true,
+        },
+      );
 
       // Custom provider likely not configured – verify structured error
       if (error) {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@insforge/sdk",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "Official JavaScript/TypeScript client for InsForge Backend-as-a-Service platform",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
@@ -57,7 +57,7 @@
     "url": "https://github.com/InsForge/insforge-sdk-js/issues"
   },
   "dependencies": {
-    "@insforge/shared-schemas": "^1.1.53",
+    "@insforge/shared-schemas": "^1.1.55",
     "@supabase/postgrest-js": "^1.21.3",
     "socket.io-client": "^4.8.1"
   },

src/modules/auth/__tests__/auth.test.ts

@@ -0,0 +1,204 @@
+import { describe, expect, it, vi } from 'vitest';
+import { HttpClient } from '../../../lib/http-client';
+import { TokenManager } from '../../../lib/token-manager';
+import { Auth } from '../auth';
+
+vi.mock('../helpers', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../helpers')>();
+  return {
+    ...actual,
+    generateCodeVerifier: vi.fn(() => 'a'.repeat(43)),
+    generateCodeChallenge: vi.fn(() => Promise.resolve('b'.repeat(43))),
+    storePkceVerifier: vi.fn(),
+  };
+});
+
+function createJsonResponse(status: number, body: any): Response {
+  const response = {
+    ok: status >= 200 && status < 300,
+    status,
+    statusText: 'OK',
+    headers: new Headers({ 'content-type': 'application/json' }),
+    json: () => Promise.resolve(body),
+    text: () => Promise.resolve(JSON.stringify(body)),
+  } as Response;
+
+  (response as any).clone = () => createJsonResponse(status, body);
+
+  return response;
+}
+
+describe('Auth', () => {
+  describe('signInWithOAuth()', () => {
+    it('sends provider-specific additionalParams during OAuth init', async () => {
+      const fetchMock = vi.fn().mockResolvedValue(
+        createJsonResponse(200, {
+          authUrl: 'https://accounts.google.com/o/oauth2/v2/auth',
+        }),
+      );
+      const http = new HttpClient(
+        {
+          baseUrl: 'http://localhost:7130',
+          fetch: fetchMock as any,
+          retryCount: 0,
+          timeout: 0,
+        },
+        new TokenManager(),
+      );
+      const auth = new Auth(http, new TokenManager(), { isServerMode: true });
+
+      const { data, error } = await auth.signInWithOAuth(
+        'google',
+        {
+          redirectTo: 'http://localhost:3000/dashboard',
+          additionalParams: {
+            prompt: 'select_account',
+            login_hint: 'person@example.com',
+          },
+          skipBrowserRedirect: true,
+        },
+      );
+
+      expect(error).toBeNull();
+      expect(data.url).toBe('https://accounts.google.com/o/oauth2/v2/auth');
+
+      const requestUrl = new URL(fetchMock.mock.calls[0][0] as string);
+      expect(requestUrl.pathname).toBe('/api/auth/oauth/google');
+      expect(requestUrl.searchParams.get('redirect_uri')).toBe(
+        'http://localhost:3000/dashboard',
+      );
+      expect(requestUrl.searchParams.get('code_challenge')).toHaveLength(43);
+      expect(requestUrl.searchParams.get('prompt')).toBe('select_account');
+      expect(requestUrl.searchParams.get('login_hint')).toBe(
+        'person@example.com',
+      );
+    });
+
+    it('supports the deprecated object wrapper signature', async () => {
+      const fetchMock = vi.fn().mockResolvedValue(
+        createJsonResponse(200, {
+          authUrl: 'https://accounts.google.com/o/oauth2/v2/auth',
+        }),
+      );
+      const http = new HttpClient(
+        {
+          baseUrl: 'http://localhost:7130',
+          fetch: fetchMock as any,
+          retryCount: 0,
+          timeout: 0,
+        },
+        new TokenManager(),
+      );
+      const auth = new Auth(http, new TokenManager(), { isServerMode: true });
+
+      const { error } = await auth.signInWithOAuth({
+        provider: 'google',
+        redirectTo: 'http://localhost:3000/dashboard',
+        additionalParams: { prompt: 'select_account' },
+        skipBrowserRedirect: true,
+      });
+
+      expect(error).toBeNull();
+
+      const requestUrl = new URL(fetchMock.mock.calls[0][0] as string);
+      expect(requestUrl.searchParams.get('redirect_uri')).toBe(
+        'http://localhost:3000/dashboard',
+      );
+      expect(requestUrl.searchParams.get('prompt')).toBe('select_account');
+    });
+
+    it('does not let additionalParams override OAuth init fields', async () => {
+      const fetchMock = vi.fn().mockResolvedValue(
+        createJsonResponse(200, {
+          authUrl: 'https://accounts.google.com/o/oauth2/v2/auth',
+        }),
+      );
+      const http = new HttpClient(
+        {
+          baseUrl: 'http://localhost:7130',
+          fetch: fetchMock as any,
+          retryCount: 0,
+          timeout: 0,
+        },
+        new TokenManager(),
+      );
+      const auth = new Auth(http, new TokenManager(), { isServerMode: true });
+
+      const { error } = await auth.signInWithOAuth(
+        'google',
+        {
+          redirectTo: 'http://localhost:3000/dashboard',
+          additionalParams: {
+            redirect_uri: 'https://evil.example/callback',
+            code_challenge: 'evil',
+            prompt: 'select_account',
+          },
+          skipBrowserRedirect: true,
+        },
+      );
+
+      expect(error).toBeNull();
+
+      const requestUrl = new URL(fetchMock.mock.calls[0][0] as string);
+      expect(requestUrl.searchParams.get('redirect_uri')).toBe(
+        'http://localhost:3000/dashboard',
+      );
+      expect(requestUrl.searchParams.get('code_challenge')).toHaveLength(43);
+      expect(requestUrl.searchParams.get('code_challenge')).not.toBe('evil');
+      expect(requestUrl.searchParams.get('prompt')).toBe('select_account');
+      expect(requestUrl.searchParams.has('additionalParams[redirect_uri]')).toBe(
+        false,
+      );
+      expect(requestUrl.searchParams.has('additionalParams[code_challenge]')).toBe(
+        false,
+      );
+    });
+
+    it('returns INVALID_INPUT when called without an options object', async () => {
+      const fetchMock = vi.fn();
+      const http = new HttpClient(
+        {
+          baseUrl: 'http://localhost:7130',
+          fetch: fetchMock as any,
+          retryCount: 0,
+          timeout: 0,
+        },
+        new TokenManager(),
+      );
+      const auth = new Auth(http, new TokenManager(), { isServerMode: true });
+
+      const { error } = await (auth.signInWithOAuth as any)('google');
+
+      expect(error).not.toBeNull();
+      expect(error?.statusCode).toBe(400);
+      expect(error?.error).toBe('INVALID_INPUT');
+      expect(fetchMock).not.toHaveBeenCalled();
+    });
+
+    it('returns INVALID_INPUT when redirectTo is missing at runtime', async () => {
+      const fetchMock = vi.fn();
+      const http = new HttpClient(
+        {
+          baseUrl: 'http://localhost:7130',
+          fetch: fetchMock as any,
+          retryCount: 0,
+          timeout: 0,
+        },
+        new TokenManager(),
+      );
+      const auth = new Auth(http, new TokenManager(), { isServerMode: true });
+
+      const { error } = await (auth.signInWithOAuth as any)({
+        provider: 'google',
+        additionalParams: { prompt: 'select_account' },
+        skipBrowserRedirect: true,
+      });
+
+      expect(error).not.toBeNull();
+      expect(error?.message).toBe('Redirect URI is required');
+      expect(error?.statusCode).toBe(400);
+      expect(error?.error).toBe('INVALID_INPUT');
+      expect(fetchMock).not.toHaveBeenCalled();
+    });
+  });
+});