fix: replace dead WorkOS client_id with seeded oauth_do_cli from id.org.ai

Default client_id was client_01JQYTRXK9ZPD8JPJTKDCRB656 (WorkOS format,
not registered on id.org.ai). Now uses OAUTH_DO_CLI_CLIENT_ID exported
from id.org.ai/auth, pointing to the seeded oauth_do_cli client.

Author: crisner1978

package.json

@@ -1,6 +1,6 @@
 {
   "name": "oauth.do",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "OAuth authentication SDK, React components, and Hono middleware for org.ai identity",
   "type": "module",
   "sideEffects": false,
@@ -100,7 +100,7 @@
     "node": ">=18.0.0"
   },
   "dependencies": {
-    "id.org.ai": "^0.2.0",
+    "id.org.ai": "^0.2.1",
     "open": "^10.1.0"
   },
   "optionalDependencies": {

pnpm-lock.yaml

@@ -14,7 +14,7 @@ import { authorizeDevice, pollForTokens } from './device.js'
 import { getUser, logout as logoutFn } from './auth.js'
 import { createSecureStorage, SecureFileTokenStorage } from './storage.js'
 import { configure } from './config.js'
-import { CANONICAL_API_ORIGIN, CANONICAL_AUTHKIT_DOMAIN, DEFAULT_CALLBACK_URL } from 'id.org.ai/auth'
+import { CANONICAL_API_ORIGIN, CANONICAL_AUTHKIT_DOMAIN, DEFAULT_CALLBACK_URL, OAUTH_DO_CLI_CLIENT_ID } from 'id.org.ai/auth'
 
 // Color codes for terminal output
 const colors = {
@@ -38,7 +38,7 @@ const storage = createSecureStorage()
 function configureFromEnv() {
   configure({
     apiUrl: process.env.OAUTH_API_URL || process.env.API_URL || CANONICAL_API_ORIGIN,
-    clientId: process.env.OAUTH_CLIENT_ID || 'client_01JQYTRXK9ZPD8JPJTKDCRB656',
+    clientId: process.env.OAUTH_CLIENT_ID || OAUTH_DO_CLI_CLIENT_ID,
     authKitDomain: process.env.OAUTH_AUTHKIT_DOMAIN || CANONICAL_AUTHKIT_DOMAIN,
   })
 }

src/cli.ts

@@ -1,5 +1,5 @@
 import type { OAuthConfig } from './types.js'
-import { CANONICAL_API_ORIGIN, CANONICAL_AUTHKIT_DOMAIN } from 'id.org.ai/auth'
+import { CANONICAL_API_ORIGIN, CANONICAL_AUTHKIT_DOMAIN, OAUTH_DO_CLI_CLIENT_ID } from 'id.org.ai/auth'
 import { getEnv } from './utils.js'
 
 /**
@@ -8,7 +8,7 @@ import { getEnv } from './utils.js'
  */
 let globalConfig: Omit<Required<OAuthConfig>, 'storagePath'> & Pick<OAuthConfig, 'storagePath'> = {
   apiUrl: getEnv('OAUTH_API_URL') || getEnv('API_URL') || CANONICAL_API_ORIGIN,
-  clientId: getEnv('OAUTH_CLIENT_ID') || 'client_01JQYTRXK9ZPD8JPJTKDCRB656',
+  clientId: getEnv('OAUTH_CLIENT_ID') || OAUTH_DO_CLI_CLIENT_ID,
   authKitDomain: getEnv('OAUTH_AUTHKIT_DOMAIN') || CANONICAL_AUTHKIT_DOMAIN,
   fetch: globalThis.fetch,
   storagePath: getEnv('OAUTH_STORAGE_PATH'),

src/config.ts

@@ -8,6 +8,7 @@
  */
 
 import * as jose from 'jose'
+import { OAUTH_DO_CLI_CLIENT_ID } from 'id.org.ai/auth'
 import { getCachedUser, cacheUser, payloadToUser, getJwks } from './auth-shared.js'
 
 // ═══════════════════════════════════════════════════════════════════════════
@@ -73,7 +74,7 @@ export interface ApiKeyOptions {
 // Constants
 // ═══════════════════════════════════════════════════════════════════════════
 
-const DEFAULT_CLIENT_ID = 'client_01JQYTRXK9ZPD8JPJTKDCRB656'
+const DEFAULT_CLIENT_ID = OAUTH_DO_CLI_CLIENT_ID
 
 function getDefaultConfig() {
   const clientId = (typeof process !== 'undefined' && process.env?.OAUTH_CLIENT_ID) || DEFAULT_CLIENT_ID

src/itty.ts

@@ -26,14 +26,14 @@ import {
   type Impersonator,
   type IdentityProviderProps,
 } from '@mdxui/auth'
-import { CANONICAL_API_ORIGIN, CANONICAL_AUTHKIT_DOMAIN } from 'id.org.ai/auth'
+import { CANONICAL_API_ORIGIN, CANONICAL_AUTHKIT_DOMAIN, OAUTH_DO_CLI_CLIENT_ID } from 'id.org.ai/auth'
 
 // ===============================================================================
 // oauth.do default configuration
 // ===============================================================================
 
 const OAUTH_DO_CONFIG = {
-  clientId: 'client_01JQYTRXK9ZPD8JPJTKDCRB656',
+  clientId: OAUTH_DO_CLI_CLIENT_ID,
   apiUrl: CANONICAL_API_ORIGIN,
   authKitDomain: CANONICAL_AUTHKIT_DOMAIN,
 }
@@ -85,7 +85,7 @@ export interface OAuthDoProviderProps {
  * OAuth.do Provider - wraps your app with authentication context
  *
  * Pre-configured with oauth.do defaults:
- * - clientId: client_01JQYTRXK9ZPD8JPJTKDCRB656
+ * - clientId: oauth_do_cli
  * - authKitDomain: id.org.ai
  * - apiUrl: https://id.org.ai
  *

src/react.tsx

@@ -497,7 +497,7 @@ describe('itty middleware', () => {
       expect(vi.mocked(jose.jwtVerify)).toHaveBeenCalled()
       const callArgs = vi.mocked(jose.jwtVerify).mock.calls[0]
       expect(callArgs[0]).toBe('valid-token')
-      expect(callArgs[2]).toEqual({ audience: 'client_01JQYTRXK9ZPD8JPJTKDCRB656' })
+      expect(callArgs[2]).toEqual({ audience: 'oauth_do_cli' })
     })
 
     it('should use custom client ID when provided', async () => {

tests/itty.test.ts

@@ -132,7 +132,7 @@ describe('React Components', () => {
         </OAuthDoProvider>,
       )
 
-      expect(screen.getByTestId('client-id')).toHaveTextContent('client_01JQYTRXK9ZPD8JPJTKDCRB656')
+      expect(screen.getByTestId('client-id')).toHaveTextContent('oauth_do_cli')
       expect(screen.getByTestId('api-url')).toHaveTextContent('https://id.org.ai')
       expect(screen.getByTestId('auth-domain')).toHaveTextContent('id.org.ai')
     })
@@ -206,7 +206,7 @@ describe('React Components', () => {
         </OAuthDoProvider>,
       )
 
-      expect(screen.getByTestId('client-id')).toHaveTextContent('client_01JQYTRXK9ZPD8JPJTKDCRB656')
+      expect(screen.getByTestId('client-id')).toHaveTextContent('oauth_do_cli')
       expect(screen.getByTestId('api-url')).toHaveTextContent('https://id.org.ai')
       expect(screen.getByTestId('auth-domain')).toHaveTextContent('id.org.ai')
     })
@@ -338,7 +338,7 @@ describe('React Components', () => {
       fireEvent.click(screen.getByRole('button'))
 
       expect(window.location.href).toContain('https://id.org.ai')
-      expect(window.location.href).toContain('client_id=client_01JQYTRXK9ZPD8JPJTKDCRB656')
+      expect(window.location.href).toContain('client_id=oauth_do_cli')
       expect(window.location.href).toContain('response_type=code')
     })