fix: avoid reusing disturbed request bodies

Author: nandan-bhat

src/server/auth-client.ts

@@ -203,6 +203,7 @@ export interface AuthClientOptions {
   enableAccessTokenEndpoint?: boolean;
   noContentProfileResponseWhenUnauthenticated?: boolean;
   enableConnectAccountEndpoint?: boolean;
+  tokenRefreshLeeway?: number;
 
   useDPoP?: boolean;
   dpopKeyPair?: DpopKeyPair;
@@ -258,6 +259,7 @@ export class AuthClient {
   private readonly enableAccessTokenEndpoint: boolean;
   private readonly noContentProfileResponseWhenUnauthenticated: boolean;
   private readonly enableConnectAccountEndpoint: boolean;
+  private readonly tokenRefreshLeeway: number;
 
   private dpopOptions?: DpopOptions;
 
@@ -379,6 +381,7 @@ export class AuthClient {
       options.noContentProfileResponseWhenUnauthenticated ?? false;
     this.enableConnectAccountEndpoint =
       options.enableConnectAccountEndpoint ?? false;
+    this.tokenRefreshLeeway = options.tokenRefreshLeeway ?? 0;
 
     this.useDPoP = options.useDPoP ?? false;
 
@@ -1200,6 +1203,13 @@ export class AuthClient {
         audience: options.audience ?? this.authorizationParameters.audience
       }
     );
+    const now = Date.now() / 1000;
+    const expiresAt =
+      typeof tokenSet.expiresAt === "number" ? tokenSet.expiresAt : undefined;
+    const isExpired = typeof expiresAt === "number" && expiresAt <= now;
+    const isWithinRefreshWindow =
+      typeof expiresAt === "number" &&
+      expiresAt <= now + this.tokenRefreshLeeway;
 
     // no access token was found that matches the, optional, provided audience and scope
     if (!tokenSet.refreshToken && !tokenSet.accessToken) {
@@ -1213,12 +1223,7 @@ export class AuthClient {
     }
 
     // the access token was found, but it has expired and we do not have a refresh token
-    if (
-      !tokenSet.refreshToken &&
-      tokenSet.accessToken &&
-      tokenSet.expiresAt &&
-      tokenSet.expiresAt <= Date.now() / 1000
-    ) {
+    if (!tokenSet.refreshToken && tokenSet.accessToken && isExpired) {
       return [
         new AccessTokenError(
           AccessTokenErrorCode.MISSING_REFRESH_TOKEN,
@@ -1230,11 +1235,7 @@ export class AuthClient {
 
     if (tokenSet.refreshToken) {
       // either the access token has expired or we are forcing a refresh
-      if (
-        options.refresh ||
-        !tokenSet.expiresAt ||
-        tokenSet.expiresAt <= Date.now() / 1000
-      ) {
+      if (options.refresh || !expiresAt || isWithinRefreshWindow) {
         const [error, response] = await this.#refreshTokenSet(tokenSet, {
           audience: options.audience,
           scope: options.scope ? scope : undefined,

src/server/next-compat.test.ts

@@ -46,6 +46,19 @@ describe("next-compat", () => {
       expect(parsed).toEqual({ foo: "bar" });
     });
 
+    it("should not throw when the input body is already used", async () => {
+      const plainReq = new Request("https://example.com/api/data", {
+        method: "POST",
+        body: JSON.stringify({ foo: "bar" })
+      });
+
+      await plainReq.text(); // consume body
+
+      const nextReq = toNextRequest(plainReq);
+      expect(nextReq).toBeInstanceOf(NextRequest);
+      expect(nextReq.method).toBe("POST");
+    });
+
     it("should set duplex to 'half' if not provided", () => {
       const req = new Request("https://example.com", { method: "GET" });
       const nextReq = toNextRequest(req);

src/server/next-compat.ts

@@ -42,6 +42,41 @@ function collectFromNextUrl(input: Request): NextConfig | undefined {
   return config && Object.keys(config).length ? config : undefined;
 }
 
+function tryCloneRequest(input: Request): Request | null {
+  if (typeof (input as any).clone !== "function") {
+    return null;
+  }
+
+  try {
+    return input.clone();
+  } catch {
+    return null;
+  }
+}
+
+function getSafeBody(input: any): BodyInit | null | undefined {
+  if (!("body" in input)) {
+    return undefined;
+  }
+
+  const body = input.body;
+
+  if (body == null) {
+    return body;
+  }
+
+  if (input.bodyUsed) {
+    return undefined;
+  }
+
+  const locked = (body as any).locked;
+  if (typeof locked === "boolean" && locked) {
+    return undefined;
+  }
+
+  return body as BodyInit;
+}
+
 /**
  * Normalize a Request or NextRequest to a NextRequest instance.
  * Ensures consistent behavior across Next.js 15 (Edge) and 16 (Node Proxy).
@@ -54,18 +89,22 @@ export function toNextRequest(input: Request | NextRequest): NextRequest {
 
   const nextConfig = collectFromNextUrl(input);
 
+  const source =
+    input instanceof Request ? (tryCloneRequest(input) ?? input) : input;
+  const body = getSafeBody(source);
+
   const init: any = {
-    method: input.method,
-    headers: input.headers,
-    body: input.body as any,
-    duplex: (input as any).duplex ?? "half"
+    method: source.method,
+    headers: source.headers,
+    duplex: (source as any).duplex ?? "half",
+    ...(body !== undefined ? { body } : {})
   };
 
   if (nextConfig) {
     init.nextConfig = nextConfig;
   }
 
-  return new NextRequest(input.url, init);
+  return new NextRequest(source.url, init);
 }
 
 /**