@alteran/astro 0.6.1 → 0.7.0

package/src/pages/xrpc/com.atproto.server.deleteSession.ts

@@ -1,20 +1,39 @@
 import type { APIContext } from 'astro';
+import { bearerToken } from '../../lib/util';
+import { verifyRefreshToken } from '../../lib/session-tokens';
+import { getRefreshToken, revokeOAuthSession, deleteRefreshToken } from '../../db/account';
 
 export const prerender = false;
 
 /**
  * com.atproto.server.deleteSession
- * Delete the current session (logout)
+ * Delete the current refresh credential. OAuth refresh rows also revoke the
+ * owning OAuth session, which invalidates the current DPoP-bound access token.
  */
-export async function POST({ locals }: APIContext) {
+export async function POST({ locals, request }: APIContext) {
   const { env } = locals.runtime;
+  const token = bearerToken(request);
+  if (!token) {
+    return new Response(JSON.stringify({ error: 'AuthRequired', message: 'No authorization token provided' }), {
+      status: 401,
+      headers: { 'Content-Type': 'application/json' },
+    });
+  }
 
-  // TODO: Implement proper session revocation
-  // For single-user PDS, we just return success
-  // In a full implementation, this would:
-  // 1. Extract refresh token from Authorization header
-  // 2. Add it to a blacklist/revocation list
-  // 3. Invalidate associated access tokens
+  const verification = await verifyRefreshToken(env, token, { ignoreExpiration: true }).catch(() => null);
+  const jti = verification?.decoded?.jti;
+  if (!jti) {
+    return new Response(JSON.stringify({ error: 'InvalidToken', message: 'Invalid refresh token' }), {
+      status: 401,
+      headers: { 'Content-Type': 'application/json' },
+    });
+  }
+
+  const stored = await getRefreshToken(env, jti);
+  if (stored?.tokenKind === 'oauth' && stored.oauthSessionId) {
+    await revokeOAuthSession(env, stored.oauthSessionId);
+  }
+  await deleteRefreshToken(env, jti);
 
   return new Response(JSON.stringify({}), {
     status: 200,
@@ -22,4 +41,4 @@ export async function POST({ locals }: APIContext) {
       'Content-Type': 'application/json',
     },
   });
-}
+}

package/src/pages/xrpc/com.atproto.server.getSession.ts

@@ -1,5 +1,5 @@
 import type { APIContext } from 'astro';
-import { AuthTokenExpiredError, authenticateRequest, expiredToken, unauthorized } from '../../lib/auth';
+import { authErrorResponse, authenticateRequest, unauthorized } from '../../lib/auth';
 import { getAccountByIdentifier } from '../../db/account';
 
 export const prerender = false;
@@ -16,9 +16,8 @@ export async function GET({ locals, request }: APIContext) {
   try {
     authContext = await authenticateRequest(request, env);
   } catch (error) {
-    if (error instanceof AuthTokenExpiredError) {
-      return expiredToken();
-    }
+    const handled = await authErrorResponse(env, error);
+    if (handled) return handled;
     throw error;
   }
   if (!authContext) {

package/src/worker/runtime.ts

@@ -140,11 +140,33 @@ export function createPdsFetchHandler(options?: CreatePdsFetchHandlerOptions): P
     }
 
     const astroFetch = await getAstroFetch(options);
-    const response = await astroFetch(request, resolvedEnv as any, ctx);
+    const response = await astroFetch(normalizeXrpcRequestForAstro(request), resolvedEnv as any, ctx);
     return response as unknown as WorkersResponse;
   };
 }
 
+export function normalizeXrpcRequestForAstro(request: WorkersRequest): WorkersRequest {
+  const url = new URL(request.url);
+  if (!url.pathname.startsWith('/xrpc/')) {
+    return request;
+  }
+
+  // Astro's SSR origin-check middleware rejects unsafe requests when Origin is
+  // absent or cross-origin. XRPC is a bearer-token API, not cookie/form auth,
+  // and atproto clients legitimately send bodyless POSTs from native runtimes.
+  if (request.headers.get('origin') === url.origin) {
+    return request;
+  }
+
+  const headerRecord: Record<string, string> = {};
+  request.headers.forEach((value, key) => {
+    headerRecord[key] = value;
+  });
+  headerRecord.origin = url.origin;
+
+  return new Request(request as any, { headers: headerRecord }) as unknown as WorkersRequest;
+}
+
 type AstroFetchHandler = (
   request: WorkersRequest,
   env: Env,

package/types/env.d.ts

@@ -60,6 +60,7 @@ declare global {
     // Relay crawl configuration
     PDS_RELAY_HOSTS?: string; // CSV of relay hostnames (no scheme). Default: bsky.network
     PDS_RELAY_NOTIFY?: string; // 'false' to disable auto notify
+    PDS_OAUTH_CLIENT_HOSTS?: string; // CSV of trusted OAuth client metadata/JWKS hostnames
   }
 
   namespace App {