omniauth-atproto 0.1.0 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5e2f34cc5f324628d5f73659d4cd3ea11cbfbcdc5420cefaa78908c928008d7a
-  data.tar.gz: 1e349da8447a8d95b29a8f0c8965d13c1cdf5525e84ecdb02a2bf69b253de82e
+  metadata.gz: e79046605d1235915ec27cb5f200e0744f1a645c630efcf5792b7ee3563d86f8
+  data.tar.gz: b36566fae3041251882c97e10c9d110fc5893edcf2da9e1f779d1c9aee525d42
 SHA512:
-  metadata.gz: d71697e0c667218a143ad87f2bf30098e6766365cb6bef90709ffdb004bffdff3edd000c332c8124279c3dd63c4cc9a47748e3658c23124ee629a41e9eddbd4d
-  data.tar.gz: fafbab85910a7b064e9f4ef118bc9c5f0df5d900a4ca7b8c9c01286a76ccc4c88c0bbb1ceb96d174d3db5d71de3acbdb396d3ee62dbe57a9c90d4b193d941dc4
+  metadata.gz: a2bffaa5781a042deb22166582c8d3d0301abee04eccd1c01ccfee320a5cd3af590a0e1a41e97e94a4e1e70b16bb3421ec5b7102334caf83f9421df76111a1e0
+  data.tar.gz: babee933a42f7d584dd7899aab66434d9b5c4438dc524ded0f4030b401bc1205a00d01547000787ede9835410fdaa52118b10ff6379f396e644080dd371da1e1

data/README.md

@@ -15,7 +15,7 @@ gem 'omniauth-atproto'
 
 ## Usage
 
-You can cnfigure it :
+You can configure it :
 ```ruby
 Rails.application.config.middleware.use OmniAuth::Builder do
   provider(:atproto,
@@ -31,7 +31,9 @@ Rails.application.config.middleware.use OmniAuth::Builder do
     client_jwk: OmniAuth::Atproto::KeyManager.current_jwk)
 end
 ```
-You will have to generate keys and the oauth/client-metadata.json document (a generator should come soon)
+client_options are optional if you use handle resolution (see below).
+
+You will have to generate keys and the oauth/client-metadata.json document (a generator should come soon).
 
 ```ruby
 #lib/tasks/atproto.rake
@@ -74,4 +76,19 @@ Then you can
 ```bash
 rails atproto:generate_metadata
 ```
-The values from the metadata endpoint should correspond to those you gave as option for the strategy (that's why a generator would be very handy) 
+The values from the metadata endpoint should correspond to those you gave as option for the strategy (that's why a generator would be very handy).
+
+All subsequent request made with the token should use the same private_key (with dpop, see the atproto_client gem).
+
+The pds is going to request your app at oauth/client-metadata.json. For developement you will have to use some kind of proxy, like ngrok (there is a "development mode" in the spec but I didnt try it)
+
+You can either set default client_options in the initializer, or keep it empty if you want to resolve the authorization server from the user handle. In this case you can add a handle param to the original omniauth request :
+
+```erb
+<%= form_tag('/auth/atproto', method: 'post', data: {turbo: false}) do %>
+  <input name="handle" value="frabr.lasercats.fr"></input>
+  <button type='submit'>Login with Atproto</button>
+<% end %>
+```
+
+Here is the [documentation I tried to follow](https://atproto.com/specs/oauth)

data/lib/omniauth/strategies/atproto.rb

@@ -2,20 +2,15 @@ require 'omniauth-oauth2'
 require 'json'
 require 'net/http'
 require 'atproto_client'
+require 'didkit'
+require 'faraday'
 
 module OmniAuth
   module Strategies
     class Atproto < OmniAuth::Strategies::OAuth2
-      def initialize(app, *args)
-        super
-        @dpop_handler = AtProto::DpopHandler.new(options.private_key)
-      end
-
+      option :fields, %i[handle]
       option :scope, 'atproto'
       option :pkce, true
-      option :token_params, {
-        test: true
-      }
 
       info do
         {
@@ -24,9 +19,47 @@ module OmniAuth
         }
       end
 
+      def request_phase
+        unless has_default_client_options?
+          @handle = request.params['handle']
+
+          unless @handle
+            fail!(:missing_handle,
+                  OmniAuth::Error.new(
+                    'Handle parameter is required if no client options are set'
+                  ))
+          end
+
+          set_client_options
+        end
+        super
+      end
+
       private
 
+      def has_default_client_options?
+        %i[site authorize_url token_url].all? { |k| options.client_options.key? k }
+      end
+
+      def set_client_options
+        options.client_options[:site] = authorization_info['issuer']
+        options.client_options[:authorize_url] = authorization_info['authorization_endpoint']
+        options.client_options[:token_url] = authorization_info['token_endpoint']
+      end
+
+      def authorization_info
+        session['omniauth.auth_info'] ||= begin
+          resolver = DIDKit::Resolver.new
+          did = resolver.resolve_handle(@handle)
+          endpoint = resolver.resolve_did(did).pds_endpoint
+          auth_server = get_authorization_server(endpoint)
+          auth_info = get_authorization_data(auth_server)
+        end
+      end
+
       def build_access_token
+        set_client_options unless has_default_client_options?
+
         new_token_params = token_params.merge(
           {
             grant_type: 'authorization_code',
@@ -37,7 +70,8 @@ module OmniAuth
             client_assertion: generate_client_assertion
           }
         )
-        response = @dpop_handler.make_request(
+        dpop_handler = AtProto::DpopHandler.new(options.private_key)
+        response = dpop_handler.make_request(
           client.token_url,
           :post,
           headers: { 'Content-Type' => 'application/json', 'Accept' => 'application/json' },
@@ -60,7 +94,6 @@ module OmniAuth
                       else
                         raise 'Invalid private_key format'
                       end
-
         jwt_payload = {
           iss: options.client_id,
           sub: options.client_id,
@@ -81,6 +114,46 @@ module OmniAuth
           }
         )
       end
+
+      def get_authorization_server(pds_endpoint)
+        response = Faraday.get("#{pds_endpoint}/.well-known/oauth-protected-resource")
+
+        unless response.success?
+          fail!(:invalid_auth_server,
+                OmniAuth::Error.new(
+                  "Failed to get PDS authorization server: #{response.status}"
+                ))
+        end
+
+        result = JSON.parse(response.body)
+
+        auth_server = result.dig('authorization_servers', 0)
+        unless auth_server
+          fail!(:invalid_auth_server,
+                OmniAuth::Error.new('No authorization server found in response'))
+        end
+        auth_server
+      end
+
+      def get_authorization_data(issuer)
+        response = Faraday.get("#{issuer}/.well-known/oauth-authorization-server")
+
+        unless response.success?
+          fail!(:invalid_metadata,
+                OmniAuth::Error.new(
+                  "Failed to get authorization server metadata: #{response.status}"
+                ))
+        end
+        result = JSON.parse(response.body)
+
+        unless result['issuer'] == issuer
+          fail!(:invalid_metadata,
+                OmniAuth::Error.new('Invalid metadata - issuer mismatch'))
+        end
+        # we cannot keep everything in session (cookie overflow error)
+        fields = %w[issuer authorization_endpoint token_endpoint]
+        result.select { |k, _v| fields.include?(k) }
+      end
     end
   end
 end

data/lib/omniauth-atproto/key_manager.rb

@@ -48,11 +48,11 @@ module OmniAuth
         def rotate_keys
           # Backup current keys if they exist
           if File.exist?(KEY_PATH)
-            File.write(KEY_PATH, 'config/old_atproto_private_key.pem')
+            # File.write(KEY_PATH, 'config/old_atproto_private_key.pem')
             FileUtils.rm(KEY_PATH)
           end
           if File.exist?(JWK_PATH)
-            File.write(JWK_PATH, 'config/old_atproto_jwk.json')
+            # File.write(JWK_PATH, 'config/old_atproto_jwk.json')
             FileUtils.rm(JWK_PATH)
           end
           load_or_generate_keys

data/lib/omniauth-atproto/version.rb

@@ -1,5 +1,5 @@
 module OmniAuth
   module Atproto
-    VERSION = "0.1.0"
+    VERSION = '0.1.1'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-atproto
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - frabr
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2024-11-26 00:00:00.000000000 Z
+date: 2024-11-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: atproto_client
@@ -25,47 +25,61 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: jwt
+  name: didkit
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '2.7'
+        version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '2.7'
+        version: '0'
 - !ruby/object:Gem::Dependency
-  name: omniauth-oauth2
+  name: faraday
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: jwt
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.8'
+        version: '2.7'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.8'
+        version: '2.7'
 - !ruby/object:Gem::Dependency
-  name: omniauth-rails_csrf_protection
+  name: omniauth-oauth2
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '1.8'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '1.8'
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement