From 1fc7496f94b5cfdc45e3459927c64cd5a7758269 Mon Sep 17 00:00:00 2001
From: vriveraPeersyst <vrivera@peersyst.com>
Date: Tue, 21 Jul 2026 18:25:09 +0200
Subject: [PATCH] fix(javascript-provider): request the API audience on login
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The JavascriptProvider constructor computed `defaults.audience` (the network's
API audience, e.g. https://api.auth.near.org) but dropped it — it built the
Auth0Client with `authorizationParams: {}`. So a plain login sent no audience
and Auth0 fell back to the tenant's Default Audience (the on-chain signing
audience). The post-login authorize-app Action then denied it with
"Signing audience requested without transaction payload", since a login carries
no transaction.

Set `authorizationParams: { audience: defaults.audience }` so login requests the
API audience explicitly. Signature requests still override it with
`signingAudience`. Adds a regression test.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 packages/providers/javascript/src/provider.ts       |  7 ++++++-
 packages/providers/javascript/test/provider.spec.ts | 11 +++++++++++
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/packages/providers/javascript/src/provider.ts b/packages/providers/javascript/src/provider.ts
index 4b0f25d..9af6146 100644
--- a/packages/providers/javascript/src/provider.ts
+++ b/packages/providers/javascript/src/provider.ts
@@ -42,7 +42,12 @@ export class JavascriptProvider implements IFastAuthProvider {
         this.client = new Auth0Client({
             domain: this.options.domain,
             clientId: this.options.clientId,
-            authorizationParams: {},
+            // Default to the network's API audience so a plain login requests it
+            // explicitly. Without it, Auth0 falls back to the tenant's Default Audience
+            // (the on-chain signing audience), which the post-login Action rejects for a
+            // login that carries no transaction payload. Signature requests override this
+            // with `signingAudience`.
+            authorizationParams: { audience: defaults.audience },
         });
     }
 
diff --git a/packages/providers/javascript/test/provider.spec.ts b/packages/providers/javascript/test/provider.spec.ts
index 32845ec..d4d8ed9 100644
--- a/packages/providers/javascript/test/provider.spec.ts
+++ b/packages/providers/javascript/test/provider.spec.ts
@@ -65,6 +65,17 @@ describe("JavascriptProvider", () => {
         provider = new JavascriptProvider(mockOptions);
     });
 
+    describe("constructor", () => {
+        it("configures the network's API audience so a plain login does not inherit the tenant signing audience", () => {
+            const { Auth0Client } = jest.requireMock("@auth0/auth0-spa-js");
+            expect(Auth0Client).toHaveBeenCalledWith(
+                expect.objectContaining({
+                    authorizationParams: { audience: "https://api.testnet.fast-auth.com" },
+                }),
+            );
+        });
+    });
+
     describe("isLoggedIn", () => {
         beforeEach(() => {
             mockLocation.search = "";