fix: encode revocation requests and preserve discovery failures

.changeset/appauth-revocation-encoding.md

@@ -0,0 +1,5 @@
+---
+"react-native-app-auth": patch
+---
+
+Form-encode raw token/client values and OAuth Basic credential components, preserving reserved characters and Unicode. Treat an omitted Basic secret as empty, normalize one trailing issuer slash, reject failed discovery HTTP responses, and retain the original revocation network error as cause.

docs/docs/usage/revoke.md

@@ -12,13 +12,27 @@ import { revoke } from 'react-native-app-auth';
 const config = {
   issuer: '<YOUR_ISSUER_URL>',
   clientId: '<YOUR_CLIENT_ID>',
+  // Only if your provider requires Basic client authentication:
+  // clientSecret: '<YOUR_CLIENT_SECRET>',
   redirectUrl: '<YOUR_REDIRECT_URL>',
   scopes: ['<YOUR_SCOPES_ARRAY>'],
 };
 
 const result = await revoke(config, {
   tokenToRevoke: `<TOKEN_TO_REVOKE>`,
-  includeBasicAuth: true,
+  includeBasicAuth: false,
   sendClientId: true,
 });
 ```
+
+Set `includeBasicAuth` only when required by your provider; it uses `clientId` and `clientSecret`
+(an omitted secret is empty). Embedded client secrets cannot be kept confidential in a native app;
+see [Client Secrets](/docs/client-secrets).
+
+Pass raw token and credential values, not pre-encoded strings. The library applies form encoding to
+the request body and Basic authentication components, including reserved characters and Unicode.
+An issuer's trailing slash is handled when requesting discovery. Failed discovery HTTP responses reject
+before revocation is attempted, and revocation network failures retain the original error as `cause`.
+
+The runtime result is the fetch response. Inspect its `ok` or `status` to confirm revocation succeeded;
+a resolved HTTP error response does not mean the provider revoked the token.

packages/react-native-app-auth/index.js

@@ -329,6 +329,11 @@ export const refresh = (
   return wrapNativeAuthPromise(RNAppAuth.refresh(...nativeMethodArguments));
 };
 
+const encodeFormComponent = value =>
+  encodeURIComponent(value)
+    .replace(/[!'()~]/g, character => `%${character.charCodeAt(0).toString(16).toUpperCase()}`)
+    .replace(/%20/g, '+');
+
 export const revoke = async (
   { clientId, issuer, serviceConfiguration, clientSecret },
   { tokenToRevoke, sendClientId = false, includeBasicAuth = false }
@@ -341,7 +346,10 @@ export const revoke = async (
   if (serviceConfiguration && serviceConfiguration.revocationEndpoint) {
     revocationEndpoint = serviceConfiguration.revocationEndpoint;
   } else {
-    const response = await fetch(`${issuer}/.well-known/openid-configuration`);
+    const response = await fetch(`${issuer.replace(/\/$/, '')}/.well-known/openid-configuration`);
+    if (response.ok === false) {
+      throw new Error(`Failed to fetch the openid config: HTTP ${response.status}`);
+    }
     const openidConfig = await response.json();
 
     invariant(
@@ -356,7 +364,9 @@ export const revoke = async (
     'Content-Type': 'application/x-www-form-urlencoded',
   };
   if (includeBasicAuth) {
-    headers.Authorization = `Basic ${base64.encode(`${clientId}:${clientSecret}`)}`;
+    headers.Authorization = `Basic ${base64.encode(
+      `${encodeFormComponent(clientId)}:${encodeFormComponent(clientSecret == null ? '' : clientSecret)}`
+    )}`;
   }
   /**
     Identity Server insists on client_id being passed in the body,
@@ -367,9 +377,13 @@ export const revoke = async (
   return await fetch(revocationEndpoint, {
     method: 'POST',
     headers,
-    body: `token=${tokenToRevoke}${sendClientId ? `&client_id=${clientId}` : ''}`,
+    body: `token=${encodeFormComponent(tokenToRevoke)}${
+      sendClientId ? `&client_id=${encodeFormComponent(clientId)}` : ''
+    }`,
   }).catch(error => {
-    throw new Error('Failed to revoke token', error);
+    const revocationError = new Error('Failed to revoke token');
+    revocationError.cause = error;
+    throw revocationError;
   });
 };