From e9f232de193d1581236cc5231a129a50026a72de Mon Sep 17 00:00:00 2001
From: Chris Krycho <chris.krycho@vanta.com>
Date: Tue, 23 Sep 2025 17:31:06 -0600
Subject: [PATCH] =?UTF-8?q?=F0=9F=A4=96=20Merge=20PR=20#73561=20[passport-?=
 =?UTF-8?q?http-bearer]=20make=20done=20callback=20`info.scope`=20property?=
 =?UTF-8?q?=20optional=20by=20@chriskrycho?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 types/passport-http-bearer/index.d.ts         |  2 +-
 .../passport-http-bearer-tests.ts             | 25 +++++++++++++++++++
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/types/passport-http-bearer/index.d.ts b/types/passport-http-bearer/index.d.ts
index 7db5ba26d90e36..00b021dac98863 100644
--- a/types/passport-http-bearer/index.d.ts
+++ b/types/passport-http-bearer/index.d.ts
@@ -13,7 +13,7 @@ interface IStrategyOptions {
 }
 interface IVerifyOptions {
     message?: string | undefined;
-    scope: string | string[];
+    scope?: string | string[];
 }
 
 interface VerifyFunction {
diff --git a/types/passport-http-bearer/passport-http-bearer-tests.ts b/types/passport-http-bearer/passport-http-bearer-tests.ts
index b8dfd745046ed8..81c9a60dd455da 100644
--- a/types/passport-http-bearer/passport-http-bearer-tests.ts
+++ b/types/passport-http-bearer/passport-http-bearer-tests.ts
@@ -66,6 +66,31 @@ passport.use(
     }),
 );
 
+// Allow *not* passing `scope`, because is merely conventional.
+passport.use(
+    new httpBearer.Strategy(
+        (token: string, done: (error: unknown, user: unknown, options?: httpBearer.IVerifyOptions) => void) => {
+            done(null, {}, {/* no values is technically fine! */});
+            done(null, {}, { message: "so is just having a message" });
+        },
+    ),
+);
+
+// Allow arbitrary additional data on the `info` object
+interface ExtraOptions extends httpBearer.IVerifyOptions {
+    arbitraryData: string;
+}
+
+type ExtendedDoneFn = (error: unknown, user: unknown, options?: ExtraOptions) => void;
+
+passport.use(
+    new httpBearer.Strategy((token: string, done: ExtendedDoneFn) => {
+        done(null, {}, {
+            arbitraryData: "can go here",
+        });
+    }),
+);
+
 let app = express();
 app.post("/login", passport.authenticate("bearer", { failureRedirect: "/login" }), function(req, res) {
     res.redirect("/");