@alteran/astro 0.7.3 → 0.7.5

package/README.md

@@ -392,12 +392,11 @@ USER_PASSWORD=your-password
 REFRESH_TOKEN=your-access-secret
 REFRESH_TOKEN_SECRET=your-refresh-secret
 PDS_SEQ_WINDOW=512
-PDS_OAUTH_CLIENT_HOSTS=client.example,another-client.example
 ```
 
-`PDS_OAUTH_CLIENT_HOSTS` is required for OAuth clients that use dynamic
-client metadata. It is a comma-separated allowlist of hostnames that this
-single-user PDS may fetch for client metadata and JWKS documents.
+OAuth client metadata and JWKS documents are fetched dynamically from public
+HTTPS URLs using hardened fetch checks: no redirects, public DNS only, size
+limits, and timeouts.
 
 ### 3. Run Database Migration
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alteran/astro",
-  "version": "0.7.3",
+  "version": "0.7.5",
   "description": "Astro integration for running a Cloudflare-hosted Bluesky PDS with Alteran.",
   "module": "index.js",
   "types": "index.d.ts",

package/src/lib/oauth/clients.ts

@@ -8,6 +8,7 @@ const MAX_CLIENT_JSON_BYTES = 128 * 1024;
 const CLIENT_ASSERTION_TYPE = 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer';
 
 export type ClientAuthMethod = 'none' | 'private_key_jwt';
+export type OAuthApplicationType = 'web' | 'native';
 
 export type OAuthClientMetadata = {
   client_id: string;
@@ -19,7 +20,7 @@ export type OAuthClientMetadata = {
   dpop_bound_access_tokens: true;
   jwks?: { keys: JsonWebKey[] };
   jwks_uri?: string;
-  application_type?: string;
+  application_type: OAuthApplicationType;
 };
 
 export type VerifiedClientAuth = {
@@ -27,26 +28,6 @@ export type VerifiedClientAuth = {
   keyId: string | null;
 };
 
-function configuredClientHosts(env: Env): Set<string> {
-  return new Set(
-    String(env.PDS_OAUTH_CLIENT_HOSTS || '')
-      .split(',')
-      .map((host) => host.trim().toLowerCase())
-      .filter(Boolean),
-  );
-}
-
-function assertClientHostAllowed(env: Env, url: URL, label: string): void {
-  const allowed = configuredClientHosts(env);
-  if (allowed.size === 0) {
-    throw new Error(`${label} host is not allowlisted`);
-  }
-  const host = url.hostname.toLowerCase().replace(/^\[|\]$/g, '');
-  if (!allowed.has(host)) {
-    throw new Error(`${label} host is not allowlisted`);
-  }
-}
-
 function isIpLiteral(hostname: string): boolean {
   const host = hostname.toLowerCase().replace(/^\[|\]$/g, '');
   if (/^\d+\.\d+\.\d+\.\d+$/.test(host)) return true;
@@ -153,16 +134,52 @@ function isLoopbackHostname(hostname: string): boolean {
   return host === 'localhost' || host === '127.0.0.1' || host === '::1';
 }
 
-export function isAllowedRedirectUri(uri: string): boolean {
+function reverseDomain(hostname: string): string {
+  return hostname
+    .toLowerCase()
+    .split('.')
+    .filter(Boolean)
+    .reverse()
+    .join('.');
+}
+
+function isNativePrivateUseRedirect(url: URL, uri: string, clientId: string | undefined): boolean {
+  if (!clientId) return false;
+  let clientUrl: URL;
+  try {
+    clientUrl = new URL(clientId);
+  } catch {
+    return false;
+  }
+  if (clientUrl.protocol !== 'https:') return false;
+
+  const scheme = url.protocol.slice(0, -1);
+  if (!scheme || scheme !== reverseDomain(clientUrl.hostname)) return false;
+  if (!uri.startsWith(`${scheme}:/`) || uri.startsWith(`${scheme}://`)) return false;
+  if (url.username || url.password || url.hash || url.host) return false;
+  return url.pathname.startsWith('/');
+}
+
+export function isAllowedRedirectUri(
+  uri: string,
+  opts: { applicationType?: OAuthApplicationType; clientId?: string } = {},
+): boolean {
   try {
     const url = new URL(uri);
     if (url.username || url.password || url.hash) return false;
     if (url.protocol === 'https:') {
+      if (opts.applicationType === 'native' && opts.clientId) {
+        const clientUrl = new URL(opts.clientId);
+        if (url.origin !== clientUrl.origin) return false;
+      }
       return !isBlockedHost(url.hostname);
     }
     if (url.protocol === 'http:') {
       return isLoopbackHostname(url.hostname);
     }
+    if (opts.applicationType === 'native') {
+      return isNativePrivateUseRedirect(url, uri, opts.clientId);
+    }
     return false;
   } catch {
     return false;
@@ -190,7 +207,6 @@ export async function safeFetchJson(env: Env, url: string, label: string): Promi
   }
 
   const parsed = new URL(url);
-  assertClientHostAllowed(env, parsed, label);
   await assertHostnameResolvesPublic(parsed, label);
 
   const ctl = new AbortController();
@@ -290,14 +306,21 @@ export function validateClientMetadataShape(metadata: any, clientId: string): OA
     throw new Error('redirect_uris required');
   }
   const redirect_uris = metadata.redirect_uris;
-  if (!redirect_uris.every((uri: unknown) => typeof uri === 'string' && isAllowedRedirectUri(uri))) {
+  const application_type = metadata.application_type ?? 'web';
+  if (application_type !== 'web' && application_type !== 'native') {
+    throw new Error('unsupported application_type');
+  }
+  if (!redirect_uris.every((uri: unknown) => (
+    typeof uri === 'string' &&
+    isAllowedRedirectUri(uri, { applicationType: application_type, clientId })
+  ))) {
     throw new Error('redirect_uris contains unsupported URI');
   }
   if (metadata.dpop_bound_access_tokens !== true) {
     throw new Error('client must require DPoP');
   }
 
-  const method = metadata.token_endpoint_auth_method;
+  const method = metadata.token_endpoint_auth_method ?? 'none';
   if (method !== 'none' && method !== 'private_key_jwt') {
     throw new Error('unsupported token_endpoint_auth_method');
   }
@@ -337,7 +360,7 @@ export function validateClientMetadataShape(metadata: any, clientId: string): OA
     dpop_bound_access_tokens: true,
     jwks: metadata.jwks,
     jwks_uri: metadata.jwks_uri,
-    application_type: typeof metadata.application_type === 'string' ? metadata.application_type : undefined,
+    application_type,
   };
 }
 
@@ -355,7 +378,10 @@ export function validateParRequest(metadata: OAuthClientMetadata, request: {
   if (request.response_type !== 'code') {
     throw new Error('unsupported response_type');
   }
-  if (!request.redirect_uri || !isAllowedRedirectUri(request.redirect_uri)) {
+  if (!request.redirect_uri || !isAllowedRedirectUri(request.redirect_uri, {
+    applicationType: metadata.application_type,
+    clientId: metadata.client_id,
+  })) {
     throw new Error('unsupported redirect_uri');
   }
   if (!metadata.redirect_uris.some((uri) => redirectUriMatches(uri, request.redirect_uri))) {
@@ -402,10 +428,7 @@ export async function verifyClientAuthentication(
   form: URLSearchParams,
 ): Promise<VerifiedClientAuth> {
   if (metadata.token_endpoint_auth_method === 'none') {
-    if (form.get('client_assertion') || form.get('client_assertion_type')) {
-      throw new Error('public client must not send client_assertion');
-    }
-    return { method: 'none', keyId: null };
+    return verifyPublicClientAuthentication(form);
   }
 
   const client_assertion_type = form.get('client_assertion_type') || '';
@@ -421,6 +444,27 @@ export async function verifyClientAuthentication(
   return { method: 'private_key_jwt', keyId: result.keyId };
 }
 
+export function verifyPublicClientAuthentication(form: URLSearchParams): VerifiedClientAuth {
+  if (form.get('client_assertion') || form.get('client_assertion_type')) {
+    throw new Error('public client must not send client_assertion');
+  }
+  return { method: 'none', keyId: null };
+}
+
+export async function requireStoredClientAuthentication(
+  env: Env,
+  clientId: string,
+  issuerOrigin: string,
+  form: URLSearchParams,
+  expected: { method: string | null; keyId?: string | null },
+): Promise<VerifiedClientAuth> {
+  if (expected.method === 'none') {
+    return verifyPublicClientAuthentication(form);
+  }
+  const metadata = await fetchClientMetadata(env, clientId);
+  return requireSameClientAuth(env, clientId, issuerOrigin, metadata, form, expected);
+}
+
 async function consumeClientAssertionJti(env: Env, clientId: string, jti: string, exp: number): Promise<boolean> {
   const key = `oauth:client-assertion:jti:${clientId}:${jti}`;
   await cleanupExpiredOAuthReplaySecrets(env, Math.floor(Date.now() / 1000));

package/src/pages/oauth/revoke.ts

@@ -4,7 +4,7 @@ import { consumeDpopVerificationJti, verifyDpop, dpopErrorResponse } from '../..
 import { DpopNonceError } from '../../lib/oauth/dpop-errors';
 import { publicPdsOrigin } from '../../lib/oauth/consent';
 import { verifyAccessToken, verifyRefreshToken } from '../../lib/session-tokens';
-import { fetchClientMetadata, requireSameClientAuth } from '../../lib/oauth/clients';
+import { requireStoredClientAuthentication } from '../../lib/oauth/clients';
 import { getOAuthSession, getRefreshToken, revokeOAuthSession, revokeRefreshToken } from '../../db/account';
 
 export const prerender = false;
@@ -21,7 +21,6 @@ export async function POST({ locals, request }: APIContext) {
     }
 
     const issuer = publicPdsOrigin(env, request);
-    const clientMeta = await fetchClientMetadata(env, client_id);
 
     const refresh = await verifyRefreshToken(env, token, { ignoreExpiration: true }).catch(() => null);
     if (refresh?.decoded?.jti) {
@@ -29,7 +28,7 @@ export async function POST({ locals, request }: APIContext) {
       if (stored?.tokenKind === 'oauth' && stored.oauthSessionId) {
         const session = await getOAuthSession(env, stored.oauthSessionId);
         if (session && session.clientId === client_id && session.dpopJkt === dpop.jkt) {
-          await requireSameClientAuth(env, client_id, issuer, clientMeta, form, {
+          await requireStoredClientAuthentication(env, client_id, issuer, form, {
             method: session.clientAuthMethod,
             keyId: session.clientAuthKeyId,
           });
@@ -46,7 +45,7 @@ export async function POST({ locals, request }: APIContext) {
     if (typeof sessionId === 'string') {
       const session = await getOAuthSession(env, sessionId);
       if (session && session.clientId === client_id && session.dpopJkt === dpop.jkt) {
-        await requireSameClientAuth(env, client_id, issuer, clientMeta, form, {
+        await requireStoredClientAuthentication(env, client_id, issuer, form, {
           method: session.clientAuthMethod,
           keyId: session.clientAuthKeyId,
         });

package/src/pages/oauth/token.ts

@@ -5,10 +5,7 @@ import { DpopNonceError } from '../../lib/oauth/dpop-errors';
 import { publicPdsOrigin } from '../../lib/oauth/consent';
 import { consumeCode } from '../../lib/oauth/store';
 import { issueSessionTokens, verifyRefreshToken, verifyAccessToken } from '../../lib/session-tokens';
-import {
-  fetchClientMetadata,
-  requireSameClientAuth,
-} from '../../lib/oauth/clients';
+import { requireStoredClientAuthentication } from '../../lib/oauth/clients';
 import {
   createOAuthSession,
   getOAuthSession,
@@ -48,12 +45,11 @@ export async function POST({ locals, request }: APIContext) {
       if (expected !== rec.code_challenge) return jsonError('invalid_grant', 'PKCE verification failed');
       if (ver.jkt !== rec.dpopJkt) return jsonError('invalid_dpop', 'DPoP key mismatch');
 
-      const clientMeta = await fetchClientMetadata(env, client_id).catch((error) => {
-        throw new Error(`Client metadata fetch failed: ${errorMessage(error) ?? error}`);
-      });
-      await requireSameClientAuth(env, client_id, issuer, clientMeta, form, {
+      await requireStoredClientAuthentication(env, client_id, issuer, form, {
         method: rec.clientAuthMethod,
         keyId: rec.clientAuthKeyId ?? null,
+      }).catch((error) => {
+        throw new Error(`Client authentication failed: ${errorMessage(error) ?? error}`);
       });
       await consumeDpopVerificationJti(env, ver);
 
@@ -138,12 +134,11 @@ export async function POST({ locals, request }: APIContext) {
       if (client_id !== session.clientId) return jsonError('invalid_grant', 'client_id mismatch');
       if (ver.jkt !== session.dpopJkt) return jsonError('invalid_dpop', 'DPoP key mismatch');
 
-      const clientMeta = await fetchClientMetadata(env, client_id).catch((error) => {
-        throw new Error(`Client metadata fetch failed: ${errorMessage(error) ?? error}`);
-      });
-      await requireSameClientAuth(env, client_id, issuer, clientMeta, form, {
+      await requireStoredClientAuthentication(env, client_id, issuer, form, {
         method: session.clientAuthMethod,
         keyId: session.clientAuthKeyId,
+      }).catch((error) => {
+        throw new Error(`Client authentication failed: ${errorMessage(error) ?? error}`);
       });
       await consumeDpopVerificationJti(env, ver);