authproto 0.3.0.beta1

data/examples/confidential_client/views/index.erb

@@ -0,0 +1,44 @@
+<div class="flex flex-col items-center md:flex md:flex-row md:justify-stretch md:items-center min-h-screen min-w-screen bg-white text-gray-900 dark:bg-gray-900 dark:text-gray-100">
+  <div class="px-6 pt-4 md:max-w-lg md:grid md:content-center md:justify-items-end md:self-stretch md:w-1/2 md:max-w-fix md:p-4 md:text-right md:dark:border-r md:dark:border-gray-700 md:bg-gray-100 md:dark:bg-gray-800">
+    <h1 class="text-xl md:text-2xl lg:text-5xl md:mt-4 mb-4 font-semibold text-brand">Sign in</h1>
+    <p class="hidden md:block max-w-xs text-gray-500 dark:text-gray-500">Enter your AT Protocol handle</p>
+  </div>
+  <div class="w-full px-6 md:max-w-3xl md:px-12">
+    <form method="post" action="/auth" class="flex flex-col py-4 space-y-4">
+      <div class="space-y-4">
+        <% if session[:error] %>
+          <div class="mb-8 bg-red-50 border-red-700 text-red-700 p-4 rounded-md">
+            <%= session[:error] %>
+            <% session[:error] = nil %>
+          </div>
+        <% end %>
+        <% if session[:notice] %>
+          <div class="mb-8 bg-yellow-50 border-yellow-700 text-yellow-700 p-4 rounded-md">
+            <%= session[:notice] %>
+            <% session[:notice] = nil %>
+          </div>
+        <% end %>
+        <fieldset>
+          <p class="mb-1 text-gray-600 dark:text-gray-400 text-sm font-medium">Handle</p>
+          <div class="flex flex-col space-y-4">
+            <div class="pl-1 pr-2 min-h-12 flex items-center justify-stretch rounded-lg text-gray-700 dark:text-gray-100 bg-gray-100 has-[:focus]:bg-gray-200 dark:bg-gray-800 dark:has-[:focus]:bg-gray-700 outline-none border-solid border-2 border-transparent hover:border-gray-400 has-[:focus]:border-brand hover:has-[:focus]:border-brand dark:hover:border-gray-500">
+              <div class="self-start shrink-0 grow-0 w-8 h-12 flex items-center justify-center text-gray-500">
+                <div>
+                  <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" class="w-5">
+                    <path fill="currentColor" fill-rule="evenodd" clip-rule="evenodd" d="M12 4a8 8 0 1 0 4.21 14.804 1 1 0 0 1 1.054 1.7A9.958 9.958 0 0 1 12 22C6.477 22 2 17.523 2 12S6.477 2 12 2s10 4.477 10 10c0 1.104-.27 2.31-.949 3.243-.716.984-1.849 1.6-3.331 1.465a4.207 4.207 0 0 1-2.93-1.585c-.94 1.21-2.388 1.94-3.985 1.715-2.53-.356-4.04-2.91-3.682-5.458.358-2.547 2.514-4.586 5.044-4.23.905.127 1.68.536 2.286 1.126a1 1 0 0 1 1.964.368l-.515 3.545v.002a2.222 2.222 0 0 0 1.999 2.526c.75.068 1.212-.21 1.533-.65.358-.493.566-1.245.566-2.067a8 8 0 0 0-8-8Zm-.112 5.13c-1.195-.168-2.544.819-2.784 2.529-.24 1.71.784 3.03 1.98 3.198 1.195.168 2.543-.819 2.784-2.529.24-1.71-.784-3.03-1.98-3.198Z"></path>
+                  </svg>
+                </div>
+              </div>
+              <div class="relative">
+                <input class="w-full bg-transparent bg-clip-padding text-base text-inherit outline-none dark:placeholder-gray-500" name="handle" type="text" placeholder="handle.bsky.social" aria-label="Handle" autocapitalize="none" autocorrect="off" autocomplete="username" spellcheck="false" dir="auto" enterkeyhint="next" required title="valid handle">
+              </div>
+            </div>
+          </div>
+        </fieldset>
+      </div>
+      <div class="pt-4">
+        <button role="Button" type="submit" aria-label="Next" class="py-2 px-6 rounded-lg truncate cursor-pointer touch-manipulation tracking-wide overflow-hidden bg-blue-400 text-white">Next</button>
+      </div>
+    </form>
+  </div>
+</div>

data/examples/confidential_client/views/layout.erb

@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title>AT Protocol OAuth Example</title>
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <script src="https://cdn.tailwindcss.com"></script>
+</head>
+<body>
+<%= yield %>
+</body>
+</html>

data/examples/minisky_console/.gitignore

@@ -0,0 +1,2 @@
+.env
+db

data/examples/minisky_console/Gemfile

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+source 'https://rubygems.org'
+
+gem 'authproto', path: '../..'
+gem 'dotenv'
+gem 'irb'
+gem 'minisky'
+gem 'puma'
+gem 'rackup'
+gem 'sinatra'
+gem 'sqlite3'

data/examples/minisky_console/Gemfile.lock

@@ -0,0 +1,131 @@
+PATH
+  remote: ../..
+  specs:
+    authproto (0.2.5)
+      didkit (~> 0.5.0)
+      jose (~> 1.2)
+      jwt (~> 3.3)
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    base58 (0.2.3)
+    base64 (0.3.0)
+    concurrent-ruby (1.3.8)
+    didkit (0.5.0)
+      base58 (~> 0.2)
+    dotenv (3.2.0)
+    erb (6.0.7)
+    immutable-ruby (0.2.0)
+      concurrent-ruby (~> 1.1)
+      sorted_set (~> 1.0)
+    io-console (0.9.4)
+    irb (1.18.0)
+      pp (>= 0.6.0)
+      prism (>= 1.3.0)
+      rdoc (>= 4.0.0)
+      reline (>= 0.4.2)
+    jose (1.2.0)
+      base64
+      immutable-ruby
+    jwt (3.3.0)
+      base64
+    logger (1.7.0)
+    minisky (0.5.1)
+      base64 (~> 0.1)
+    mustermann (3.1.1)
+    nio4r (2.7.5)
+    pp (0.6.4)
+      prettyprint
+    prettyprint (0.2.1)
+    prism (2.0.0)
+    prism (2.0.0-arm64-darwin)
+    puma (8.0.2)
+      nio4r (~> 2.0)
+    rack (3.2.7)
+    rack-protection (4.2.1)
+      base64 (>= 0.1.0)
+      logger (>= 1.6.0)
+      rack (>= 3.0.0, < 4)
+    rack-session (2.1.2)
+      base64 (>= 0.1.0)
+      rack (>= 3.0.0)
+    rackup (2.3.1)
+      rack (>= 3)
+    rbs (4.2.0)
+      logger
+      prism (>= 1.6.0)
+      tsort
+    rbtree (0.4.7)
+    rdoc (8.1.0)
+      erb
+      prism (>= 1.6.0)
+      rbs (>= 4.0.0)
+      tsort
+    reline (0.7.0)
+      io-console (~> 0.5)
+    sinatra (4.2.1)
+      logger (>= 1.6.0)
+      mustermann (~> 3.0)
+      rack (>= 3.0.0, < 4)
+      rack-protection (= 4.2.1)
+      rack-session (>= 2.0.0, < 3)
+      tilt (~> 2.0)
+    sorted_set (1.1.0)
+      rbtree
+    sqlite3 (2.10.2-arm64-darwin)
+    tilt (2.9.0)
+    tsort (0.2.0)
+
+PLATFORMS
+  arm64-darwin-24
+
+DEPENDENCIES
+  authproto!
+  dotenv
+  irb
+  minisky
+  puma
+  rackup
+  sinatra
+  sqlite3
+
+CHECKSUMS
+  authproto (0.2.5)
+  base58 (0.2.3) sha256=fda5c5d3bda8b429ad0d1a5309c2d1e488ba46f0a2ab99a639890f26c61bf3be
+  base64 (0.3.0) sha256=27337aeabad6ffae05c265c450490628ef3ebd4b67be58257393227588f5a97b
+  bundler (4.0.23) sha256=407ba8a1d928f412847f819aa5f8b6aef7c59fb51feb517112af8a165487287b
+  concurrent-ruby (1.3.8) sha256=b2f1be836e968ccc78ccfce277ea79c72a88633f22306782c16ff23fb415d1e1
+  didkit (0.5.0) sha256=8b24320fbf137cd4095b7fc7cc8a1dbee9b1aafa49fa80b9aac2902f4c282463
+  dotenv (3.2.0) sha256=e375b83121ea7ca4ce20f214740076129ab8514cd81378161f11c03853fe619d
+  erb (6.0.7) sha256=c5ca6dc25b0ef974a44dc8f59fe847577122483b1968a38dec305c60bf91ee92
+  immutable-ruby (0.2.0) sha256=1ab896e0d9c8c3fe21ddc3dd29be87511da2f6b0970c5a1c36838a9a4a4605e7
+  io-console (0.9.4) sha256=a403304f32928ee85e56d457b4612ca43f2703b561a3258844992bd24085fbb1
+  irb (1.18.0) sha256=de9454a0703a54704b9811a5ef31a60c86949fbf4013fcf244fabc7c775248e3
+  jose (1.2.0) sha256=c6e7061b71d2efc5aa70875c203f10595c67a0a48a58012527844c045ac2cbee
+  jwt (3.3.0) sha256=44cc34fbc341c148233cf66641522b4bce0dfb1ce55e8073f05c56f44f4ee546
+  logger (1.7.0) sha256=196edec7cc44b66cfb40f9755ce11b392f21f7967696af15d274dde7edff0203
+  minisky (0.5.1) sha256=47a7d63a1ca16c786e3bd3d4ddb15c5d585165efd1dfbe2be9bf47335fe19d4f
+  mustermann (3.1.1) sha256=4c6170c7234d5499c345562ba7c7dfe73e1754286dcc1abb053064d66a127198
+  nio4r (2.7.5) sha256=6c90168e48fb5f8e768419c93abb94ba2b892a1d0602cb06eef16d8b7df1dca1
+  pp (0.6.4) sha256=dfcb0fce700c41456265922884f9fe195d7fbb0674a3578e6c0f69588e82b570
+  prettyprint (0.2.1) sha256=d555d57ea6d7cf001d4774b693546a6bd88bec1e778ddffb5c60b68ceec4b7d4
+  prism (2.0.0) sha256=fd551446f0c6ca71455ef8d1d40bd2ca1538044834fa22df8837e5095f3a5a39
+  prism (2.0.0-arm64-darwin) sha256=edebbfcc16f6a879f47dac9501b20a7cd95abe96397bb485106d6670541abeb1
+  puma (8.0.2) sha256=c8ed871dfbbe66448ea9ffd46692342d9804d4071522b52b5331b7b6e7b686fb
+  rack (3.2.7) sha256=93e13e1c24f93556671d85d2d79fa228c3485815c50d7e2f265b5330c6528fb7
+  rack-protection (4.2.1) sha256=cf6e2842df8c55f5e4d1a4be015e603e19e9bc3a7178bae58949ccbb58558bac
+  rack-session (2.1.2) sha256=595434f8c0c3473ae7d7ac56ecda6cc6dfd9d37c0b2b5255330aa1576967ffe8
+  rackup (2.3.1) sha256=6c79c26753778e90983761d677a48937ee3192b3ffef6bc963c0950f94688868
+  rbs (4.2.0) sha256=51f7b886dcc05bc09e10b901daa6a81829f6adc03101d6ca9ea4aac6103e0674
+  rbtree (0.4.7) sha256=1efabbcb3fd5f12249c9c8a610a765074868164eed0c50c9db2531c00ed161cb
+  rdoc (8.1.0) sha256=befc37880a5cfd36dcb176c748b5fd5ee39dd3536a75e81824e4972ce230f60a
+  reline (0.7.0) sha256=5b012d8e55dbf9d450f12bde2cf7d15ff546ae80b3f8f3b30e570d431815583d
+  sinatra (4.2.1) sha256=b7aeb9b11d046b552972ade834f1f9be98b185fa8444480688e3627625377080
+  sorted_set (1.1.0) sha256=bac01eb16b6bcfcdb7d732a28e87422be8b5c9fdcfeadbe9072682407524ee83
+  sqlite3 (2.10.2-arm64-darwin) sha256=5b0d235ea037e6dcd1b8387a19d73be571917db9f93044d35741cf933a21a37d
+  tilt (2.9.0) sha256=da5735d0280bba96e9a91041bb14aee435ccad5c17b0fa519249ae543d9aa3a5
+  tsort (0.2.0) sha256=9650a793f6859a43b6641671278f79cfead60ac714148aabe4e3f0060480089f
+
+BUNDLED WITH
+  4.0.23

data/examples/minisky_console/README.md

@@ -0,0 +1,112 @@
+# Minisky OAuth Console Example
+
+This is an example showing how to do an (experimental) OAuth client based on Minisky from the `irb` level, both locally and against the client metadata hosted on a production server. Both configurations are *public* clients.
+
+Note: both variants receive and save the access tokens locally on your machine, and in both you perform requests using the received token locally in `irb`. The production server code only serves the JSON file and prints the callback params, it does not use the `AuthProto` library itself.
+
+
+## Requirements
+
+- Ruby 3.3+
+- Bundler
+- A domain name for your application that matches your client metadata (required for production)
+- SSL certificate for your domain (required for production)
+
+## Setup
+
+1. Clone the repository and navigate to the example directory:
+
+```bash
+cd examples/minisky_console
+```
+
+2. Install dependencies:
+
+```bash
+bundle install
+```
+
+3. Generate an encryption key:
+
+```bash
+openssl rand -base64 32
+
+cat > .env
+ATPROTO_MASTER_KEY=<value from above>
+```
+
+
+## Localhost use
+
+Run `bin/console`, then:
+
+```rb
+require_relative 'localhost'
+
+client = create_client('your.pds.hostname.here')
+authorize(client)
+```
+
+This will print:
+
+```
+Open this URL in the browser and complete authorization:
+https://....
+
+Waiting for OAuth callback at http://127.0.0.1:9292/callback (Ctrl-C to cancel)
+```
+
+Open this URL and authorize the app. The example starts a temporary inline HTTP server on the specified port on localhost, which only receives the callback and calls the provided block, which completes the authorization.
+
+Once the browser redirects to the callback URL after your approval, the console should print:
+
+```
+Authentication complete ✓
+```
+
+Then, you can run `client.get_request(...)` and `client.post_request(...)` to perform authorized actions on the given account. By default, the example asks for permissions `repo:app.bsky.feed.post` and `rpc:app.bsky.feed.getTimeline?aud=*`, which allow calling `getTimeline` and creating/modifying posts.
+
+(Note, the session is currently lost when you close the console.)
+
+
+## Production use
+
+Deploy the code in `examples/minisky_console` to a production server using a method of your choice. The relevant part is in the `app.rb` file.
+
+Create an `.env` file in the app folder with:
+
+```
+SERVER_HOST=your.server.hostname
+```
+
+Locally, run `bin/console`, then:
+
+```rb
+require_relative 'production'
+
+client = create_client('your.server.hostname', 'your.pds.hostname')
+authorize(client)
+```
+
+This will print:
+
+```
+Open this URL in the browser and complete authorization:
+https://....
+```
+
+Open this URL and authorize the app. Once the browser redirects to the callback URL after your approval, the page you get redirected to will print the received params.
+
+Copy the printed command back to the console:
+
+```rb
+handle_callback(client, { ... })
+```
+
+This will print:
+
+```
+Authentication complete ✓
+```
+
+Then, you can run `client.get_request(...)` and `client.post_request(...)` to perform authorized actions on the given account.

data/examples/minisky_console/app.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+require 'dotenv/load'
+require 'json'
+require 'sinatra'
+
+$server_host = ENV.fetch('SERVER_HOST')
+
+$metadata = {
+  'application_type' => 'native',
+  'client_id' => "https://#{$server_host}/oauth-client-metadata.json",
+  'client_name' => 'Minisky OAuth Example App',
+  'redirect_uris' => ["https://#{$server_host}/callback"],
+  'grant_types' => ['authorization_code', 'refresh_token'],
+  'response_types' => ['code'],
+  'scope' => 'atproto repo:app.bsky.feed.post rpc:app.bsky.feed.getTimeline?aud=*',
+  'token_endpoint_auth_method' => 'none',
+  'dpop_bound_access_tokens' => true,
+}
+
+get "/" do
+  content_type 'text/plain'
+
+  "To start authentication, run this in bin/console:\n\n" +
+  "require_relative 'production'\n" +
+  "client = create_client('#{$server_host}', 'target.pds.hostname')\n" +
+  "authorize(client)\n\n" +
+  "Then open the printed URL and authorize the app. You will receive a hash with data, which you need to paste to:\n\n" +
+  "handle_callback(client, { ... })\n"
+end
+
+get "/oauth-client-metadata.json" do
+  content_type :json
+
+  JSON.generate($metadata) + "\n"
+end
+
+get "/callback" do
+  content_type 'text/plain'
+
+  if params[:error]
+    params.slice(:error, :error_description).to_json
+  elsif params[:code] && params[:state] && params[:iss]
+    "To complete authentication, run this in the console where you started the authentication flow " +
+    "(replace \"client\" with the local variable name you've used):\n\n" +
+    "handle_callback(client, #{params.slice(:code, :state, :iss).map { |k, v| [k.to_sym, v] }.to_h.inspect})\n"
+  else
+    "Missing params"
+  end
+end

data/examples/minisky_console/bin/console

@@ -0,0 +1,6 @@
+#!/usr/bin/env ruby
+
+require 'bundler/setup'
+require 'irb'
+
+IRB.start(__FILE__)

data/examples/minisky_console/config.ru

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+require_relative 'app'
+
+run Sinatra::Application

data/examples/minisky_console/localhost.rb

@@ -0,0 +1,53 @@
+require 'authproto/minisky'
+require 'dotenv/load'
+require 'uri'
+
+AuthProto.configure do |config|
+  config.http_client = AuthProto::InsecureHTTPClient.new(timeout: 10)
+
+  config.storage = AuthProto::Storage::SQLite.new(
+    path: File.join(__dir__, "db", "localhost_auth.sqlite3")
+  )
+end
+
+$metadata = {
+  'application_type' => 'native',
+  'client_id' => 'http://localhost/',
+  'client_name' => 'AT Protocol OAuth Ruby Example',
+  'redirect_uris' => ['http://127.0.0.1:9292/callback'],
+  'grant_types' => ['authorization_code', 'refresh_token'],
+  'response_types' => ['code'],
+  'scope' => 'atproto repo:app.bsky.feed.post rpc:app.bsky.feed.getTimeline?aud=*',
+  'token_endpoint_auth_method' => 'none',
+  'dpop_bound_access_tokens' => true,
+}
+
+$client_id = $metadata['client_id'] + '?' + URI.encode_www_form({
+  redirect_uri: $metadata['redirect_uris'][0],
+  scope: $metadata['scope']
+})
+
+$metadata['client_id'] = $client_id
+
+def create_client(pds)
+  Minisky::OAuthClient.new(pds,
+    client_id: $client_id,
+    redirect_uri: $metadata['redirect_uris'][0],
+    metadata: $metadata
+  )
+end
+
+def authorize(client)
+  auth = client.authorize(pds_url: "https://#{client.host}", scope: $metadata['scope'])
+
+  puts "Open this URL in the browser and complete authorization:"
+  puts auth[:url]
+  puts
+
+  AuthProto::LocalhostServer.start($metadata) do |json|
+    client.handle_callback(**json)
+  end
+
+  puts "Authentication complete ✓"
+  puts "Your session id: #{auth[:session_id]}"
+end

data/examples/minisky_console/production.rb

@@ -0,0 +1,32 @@
+require 'authproto/minisky'
+require 'dotenv/load'
+require 'uri'
+
+AuthProto.configure do |config|
+  config.http_client = AuthProto::HTTPClient.new(timeout: 10)
+
+  config.storage = AuthProto::Storage::SQLite.new(
+    path: File.join(__dir__, "db", "production_auth.sqlite3")
+  )
+end
+
+def create_client(server_hostname, pds)
+  Minisky::OAuthClient.new(pds,
+    client_id: "https://#{server_hostname}/oauth-client-metadata.json",
+    redirect_uri: "https://#{server_hostname}/callback"
+  )
+end
+
+def authorize(client)
+  auth = client.authorize(pds_url: "https://#{client.host}", scope: client.oauth_client.client_metadata.scope)
+
+  puts "Open this URL in the browser and complete authorization:"
+  puts auth[:url]
+end
+
+def handle_callback(client, json)
+  result = client.handle_callback(**json)
+
+  puts "Authentication complete ✓"
+  puts "Your session id: #{result[:session_id]}"
+end