@alteran/astro 0.7.2 → 0.7.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/package.json +1 -1
  2. package/src/pages/oauth/par.ts +2 -2
  3. package/src/pages/oauth/revoke.ts +1 -1
  4. package/src/pages/oauth/token.ts +1 -1
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@alteran/astro",
3
- "version": "0.7.2",
3
+ "version": "0.7.3",
4
4
  "description": "Astro integration for running a Cloudflare-hosted Bluesky PDS with Alteran.",
5
5
  "module": "index.js",
6
6
  "types": "index.d.ts",
package/src/pages/oauth/par.ts CHANGED
@@ -16,9 +16,9 @@ export const prerender = false;
16
16
  export async function POST({ locals, request }: APIContext) {
17
17
  const { env } = locals.runtime;
18
18
 
19
- // Enforce DPoP with nonce; if missing or stale, return use_dpop_nonce
19
+ // Enforce DPoP binding, but do not require a nonce on the initial PAR request.
20
20
  try {
21
- const ver = await verifyDpop(env, request, { consumeJti: false });
21
+ const ver = await verifyDpop(env, request, { consumeJti: false, requireNonce: false });
22
22
 
23
23
  // Parse form-encoded body
24
24
  const bodyText = await request.text();
package/src/pages/oauth/revoke.ts CHANGED
@@ -12,7 +12,7 @@ export const prerender = false;
12
12
  export async function POST({ locals, request }: APIContext) {
13
13
  const { env } = locals.runtime;
14
14
  try {
15
- const dpop = await verifyDpop(env, request, { consumeJti: false });
15
+ const dpop = await verifyDpop(env, request, { consumeJti: false, requireNonce: false });
16
16
  const form = new URLSearchParams(await request.text());
17
17
  const token = form.get('token') || '';
18
18
  const client_id = form.get('client_id') || '';
package/src/pages/oauth/token.ts CHANGED
@@ -25,7 +25,7 @@ export async function POST({ locals, request }: APIContext) {
25
25
  const { env } = locals.runtime;
26
26
 
27
27
  try {
28
- const ver = await verifyDpop(env, request, { consumeJti: false });
28
+ const ver = await verifyDpop(env, request, { consumeJti: false, requireNonce: false });
29
29
  const form = new URLSearchParams(await request.text());
30
30
  const grant_type = form.get('grant_type') || '';
31
31
  const issuer = publicPdsOrigin(env, request);