fix: prevent CORS due to withCredentials

Author: SkySails

.changeset/tasty-cooks-train.md

@@ -0,0 +1,5 @@
+---
+"@navigraph/auth": minor
+---
+
+Fix issue where wrong endpoint would be called with `withCredentials` set to true, causing CORS issues.

packages/auth/src/flows/device-flow.ts

@@ -7,7 +7,6 @@ import {
   DeviceFlowTokenExpiredError,
   InvalidClientError,
   InvalidScopeError,
-  Scope,
 } from "@navigraph/app";
 import axios, { AxiosError } from "axios";
 import { getIdentityDeviceAuthEndpoint } from "../constants";
@@ -59,10 +58,7 @@ export async function signInWithDeviceFlow(callback: DeviceFlowCallback): Promis
         code_challenge,
         code_challenge_method: "S256",
       }),
-      {
-        headers: { "Content-Type": "application/x-www-form-urlencoded" },
-        withCredentials: app.scopes.includes(Scope.TILES) ? true : undefined,
-      }
+      { headers: { "Content-Type": "application/x-www-form-urlencoded" } }
     )
     .catch((err: AxiosError<FailedAuthorizationResponse>) => {
       const status = err.response?.status;

packages/auth/src/flows/shared.ts

@@ -1,4 +1,4 @@
-import { Logger } from "@navigraph/app";
+import { Logger, Scope } from "@navigraph/app";
 import axios from "axios";
 import { getIdentityTokenEndpoint } from "../constants";
 import { setUser, tokenStorage } from "../internal";
@@ -7,11 +7,10 @@ import { TokenResponse } from "../types";
 
 export async function tokenCall(params: Record<string, string>) {
   return axios
-    .post<TokenResponse>(
-      getIdentityTokenEndpoint(),
-      new URLSearchParams(params),
-      { headers: { "Content-Type": "application/x-www-form-urlencoded" }} // prettier-ignore
-    )
+    .post<TokenResponse>(getIdentityTokenEndpoint(), new URLSearchParams(params), {
+      withCredentials: params.scopes?.includes(Scope.TILES) ? true : undefined,
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    })
     .then(async ({ data }) => {
       if (data.access_token && data.refresh_token) {
         await tokenStorage.setAccessToken(data.access_token);