fix(token-revocation): accept non-JSON revocation responses

HttpClient defaults to responseType 'json', so revokeTokenAndLogout()
failed whenever the revocation endpoint returned a non-JSON body. RFC
7009 section 2.2 states the response body must be ignored, so request it
as text instead. Closes #1505

Author: L-X-T

projects/lib/src/oauth-service.spec.ts

@@ -0,0 +1,74 @@
+import { HttpParams, provideHttpClient } from '@angular/common/http';
+import {
+  HttpTestingController,
+  provideHttpClientTesting,
+} from '@angular/common/http/testing';
+import { TestBed } from '@angular/core/testing';
+
+import { OAuthService } from './oauth-service';
+import { provideOAuthClient } from './provider';
+import { MemoryStorage, OAuthLogger, OAuthStorage } from './types';
+
+const silentLogger: OAuthLogger = {
+  debug: () => undefined,
+  info: () => undefined,
+  log: () => undefined,
+  warn: () => undefined,
+  error: () => undefined,
+};
+
+describe('OAuthService', () => {
+  let httpMock: HttpTestingController;
+  let service: OAuthService;
+  let storage: OAuthStorage;
+
+  beforeEach(() => {
+    TestBed.configureTestingModule({
+      providers: [
+        provideHttpClient(),
+        provideHttpClientTesting(),
+        provideOAuthClient(),
+        { provide: OAuthLogger, useValue: silentLogger },
+        { provide: OAuthStorage, useClass: MemoryStorage },
+      ],
+    });
+
+    httpMock = TestBed.inject(HttpTestingController);
+    service = TestBed.inject(OAuthService);
+    storage = TestBed.inject(OAuthStorage);
+
+    service.configure({
+      clientId: 'test-client',
+      revocationEndpoint: 'https://auth.example.com/oauth/revoke',
+    });
+    storage.setItem('access_token', 'access-token');
+    storage.setItem('refresh_token', 'refresh-token');
+  });
+
+  afterEach(() => {
+    httpMock.verify();
+  });
+
+  it('should accept plain text token revocation responses', async () => {
+    const revokePromise = service.revokeTokenAndLogout();
+
+    const requests = httpMock.match('https://auth.example.com/oauth/revoke');
+    expect(requests.length).toBe(2);
+    expect(
+      requests.map((request) =>
+        (request.request.body as HttpParams).get('token_type_hint')
+      )
+    ).toEqual(['access_token', 'refresh_token']);
+
+    for (const request of requests) {
+      expect(request.request.method).toBe('POST');
+      expect(request.request.responseType).toBe('text');
+      expect(request.request.headers.get('Content-Type')).toBe(
+        'application/x-www-form-urlencoded'
+      );
+      request.flush('Token revoked');
+    }
+
+    await expectAsync(revokePromise).toBeResolved();
+  });
+});

projects/lib/src/oauth-service.ts

@@ -2814,18 +2814,20 @@ export class OAuthService extends AuthConfig implements OnDestroy {
     }
 
     return new Promise((resolve, reject) => {
-      let revokeAccessToken: Observable<void>;
-      let revokeRefreshToken: Observable<void>;
+      let revokeAccessToken: Observable<unknown>;
+      let revokeRefreshToken: Observable<unknown>;
 
       if (accessToken) {
         const revokationParams = params
           .set('token', accessToken)
           .set('token_type_hint', 'access_token');
-        revokeAccessToken = this.http.post<void>(
-          revokeEndpoint,
-          revokationParams,
-          { headers }
-        );
+        // Per RFC 7009 section 2.2 the response body is to be ignored, so we
+        // request it as text to avoid HttpClient's default JSON parsing failing
+        // on non-JSON (e.g. empty or plain-text) revocation responses.
+        revokeAccessToken = this.http.post(revokeEndpoint, revokationParams, {
+          headers,
+          responseType: 'text',
+        });
       } else {
         revokeAccessToken = of(null);
       }
@@ -2834,11 +2836,11 @@ export class OAuthService extends AuthConfig implements OnDestroy {
         const revokationParams = params
           .set('token', refreshToken)
           .set('token_type_hint', 'refresh_token');
-        revokeRefreshToken = this.http.post<void>(
-          revokeEndpoint,
-          revokationParams,
-          { headers }
-        );
+        // See note above: ignore the response body (RFC 7009 section 2.2).
+        revokeRefreshToken = this.http.post(revokeEndpoint, revokationParams, {
+          headers,
+          responseType: 'text',
+        });
       } else {
         revokeRefreshToken = of(null);
       }