From b96fa631070305d0a223c3ce7d4d9aaf67d2c846 Mon Sep 17 00:00:00 2001
From: masaru87 <55574641+masaru87@users.noreply.github.com>
Date: Mon, 27 Jul 2026 12:57:08 +0900
Subject: [PATCH] fix: encode parameter values in the authorization url

---
 src/oauth2.ts |  2 +-
 test/test.ts  | 10 ++++++++++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/src/oauth2.ts b/src/oauth2.ts
index f607cab..d99a15a 100644
--- a/src/oauth2.ts
+++ b/src/oauth2.ts
@@ -24,7 +24,7 @@ export default class OAuth2 {
     return (
       `https://${options.host}/OAuth2AccessRequest.action?` +
       Object.keys(params)
-        .map((key) => (params[key] ? `${key}=${params[key]}` : ""))
+        .map((key) => (params[key] ? `${key}=${encodeURIComponent(params[key])}` : ""))
         .filter((x) => x.length > 0)
         .join("&")
     );
diff --git a/test/test.ts b/test/test.ts
index 1427ff4..09e5c13 100644
--- a/test/test.ts
+++ b/test/test.ts
@@ -32,6 +32,16 @@ describe("OAuth2 API", () => {
     expect(oauth2.getAuthorizationURL({ host, redirectUri, state })).toBe(expected);
   });
 
+  it("should encode parameter values in the authorization url.", () => {
+    const redirectUri = "https://app.example.com/callback?tenant=acme&lang=ja";
+    const state = "ab+cd/ef==";
+    const params = new URL(oauth2.getAuthorizationURL({ host, redirectUri, state })).searchParams;
+
+    expect(params.get("redirect_uri")).toBe(redirectUri);
+    expect(params.get("state")).toBe(state);
+    expect([...params.keys()]).toEqual(["client_id", "response_type", "redirect_uri", "state"]);
+  });
+
   it("should get access token.", async () => {
     mockRequest({
       method: "POST",