fix(oauth-provider): relax response_type enum for RFC 6749 redirects

Co-authored-by: Ustay-coder <80252149+Ustay-coder@users.noreply.github.com>

packages/oauth-provider/src/authorize.test.ts

@@ -418,6 +418,29 @@ describe("oauth authorize - authenticated", async () => {
 		);
 	});
 
+	/**
+	 * @see https://github.com/better-auth/better-auth/issues/9250
+	 */
+	it("should redirect with unsupported_response_type for an unknown response_type", async () => {
+		if (!oauthClient?.client_id) {
+			throw Error("beforeAll not run properly");
+		}
+		const authUrl = new URL(`${authServerBaseUrl}/api/auth/oauth2/authorize`);
+		authUrl.searchParams.set("client_id", oauthClient.client_id);
+		authUrl.searchParams.set("redirect_uri", redirectUri);
+		authUrl.searchParams.set("response_type", "token");
+		authUrl.searchParams.set("scope", "openid");
+
+		let errorRedirectUrl = "";
+		await client.$fetch(authUrl.toString(), {
+			onError(context) {
+				errorRedirectUrl = context.response.headers.get("Location") || "";
+			},
+		});
+
+		expect(errorRedirectUrl).toContain("error=unsupported_response_type");
+	});
+
 	/**
 	 * @see https://github.com/better-auth/better-auth/issues/9250
 	 */

packages/oauth-provider/src/oauth.ts

@@ -372,7 +372,7 @@ export const oauthProvider = <O extends OAuthOptions<Scope[]>>(options: O) => {
 				{
 					method: "GET",
 					query: z.object({
-						response_type: z.enum(["code"]).optional(),
+						response_type: z.string().optional(),
 						client_id: z.string(),
 						redirect_uri: SafeUrlSchema.optional(),
 						scope: z.string().optional(),

packages/oauth-provider/src/types/index.ts

@@ -729,7 +729,7 @@ export interface OAuthAuthorizationQuery {
 	 * Optional in the query when using request_uri (PAR) — resolved from stored params.
 	 */
 	// NEVER SUPPORT "token" or "id_token" - depreciated in oAuth2.1
-	response_type?: "code";
+	response_type?: string;
 	/**
 	 * PAR request_uri. When present, other params are resolved from the stored request.
 	 */