build: upgrade workers OAuth provider to 0.8.0 - #160

Summary

Upgrade @cloudflare/workers-oauth-provider from ^0.6.0 to ^0.8.0 and adopt its new exact grantId callback context.

When Cloudflare rejects a stored upstream refresh token with invalid_grant, the server now revokes only the downstream grant currently being refreshed:

await helpers.revokeGrant(options.grantId, options.userId)

This replaces the previous paginated sweep over every grant for the same (userId, clientId) pair. It is simpler, avoids unnecessary KV reads, and cannot revoke a different concurrent grant for the same client.

Relevant upstream changes

Security and correctness hardening

• Validate an authorization code and requesting client before acting on a grant during code exchange.
• Verify client ownership during token revocation and honor token_type_hint.
• Tighten token-endpoint client authentication parsing for RFC 6749 compliance.
• Add Cache-Control: no-store and Pragma: no-cache to token, credential, registration, and OAuth error responses.
• Bound KV pagination while revoking existing grants during authorization.

API additions used here

• TokenExchangeCallbackOptions.grantId identifies the authoritative grant record being refreshed and is stable for that grant's lifetime.
• The refresh failure guard threads this ID into OAuthHelpers.revokeGrant(grantId, userId).

Other new optional features—Enterprise-Managed Authorization and the dynamic-client-registration policy callback—remain disabled.

Upstream releases:

• https://github.com/cloudflare/workers-oauth-provider/releases/tag/v0.7.0
• https://github.com/cloudflare/workers-oauth-provider/releases/tag/v0.8.0

Compatibility review

• OAuthProvider, getOAuthApi, AuthRequest, OAuthError, and OAuthHelpers exports used by this repository remain available.
• parseAuthRequest() and completeAuthorization() retain their contracts.
• Existing KV grants and tokens retain compatible storage handling; no binding or deployment changes are required.
• The package has no npm security advisory. The value of this upgrade is upstream protocol and authorization-logic hardening.

Test changes

• Assert upstream invalid_grant revokes the exact callback grantId.
• Assert listUserGrants() is never called.
• Exercise the behavior both at the refresh guard boundary and through the real handleTokenExchangeCallback path.
• Preserve coverage that transient errors and server credential errors do not revoke grants.
• Preserve coverage that revoke failures do not mask the original invalid_grant.
• Remove obsolete pagination and cross-user sweep tests along with the deleted sweep implementation.

Validation

• npm run check: 261 tests across 16 files
• npm audit --omit=dev reports no vulnerability against @cloudflare/workers-oauth-provider.