@atproto/bsky 0.0.170 → 0.0.171

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # @atproto/bsky
 
+## 0.0.171
+
+### Patch Changes
+
+- [#4028](https://github.com/bluesky-social/atproto/pull/4028) [`88c136427`](https://github.com/bluesky-social/atproto/commit/88c136427451a20d21812a1aa88a70cf21904138) Thanks [@rafaelbsky](https://github.com/rafaelbsky)! - Age assurance compliance
+
+- Updated dependencies [[`88c136427`](https://github.com/bluesky-social/atproto/commit/88c136427451a20d21812a1aa88a70cf21904138)]:
+  - @atproto/api@0.15.25
+
 ## 0.0.170
 
 ### Patch Changes

package/dist/api/app/bsky/unspecced/getAgeAssuranceState.d.ts

@@ -0,0 +1,4 @@
+import { AppContext } from '../../../../context';
+import { Server } from '../../../../lexicon';
+export default function (server: Server, ctx: AppContext): void;
+//# sourceMappingURL=getAgeAssuranceState.d.ts.map

package/dist/api/app/bsky/unspecced/getAgeAssuranceState.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getAgeAssuranceState.d.ts","sourceRoot":"","sources":["../../../../../src/api/app/bsky/unspecced/getAgeAssuranceState.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAG5C,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAmBvD"}

package/dist/api/app/bsky/unspecced/getAgeAssuranceState.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = default_1;
+const xrpc_server_1 = require("@atproto/xrpc-server");
+function default_1(server, ctx) {
+    server.app.bsky.unspecced.getAgeAssuranceState({
+        auth: ctx.authVerifier.standard,
+        handler: async ({ auth }) => {
+            const viewer = auth.credentials.iss;
+            const actorInfo = await getAgeVerificationState(ctx, viewer);
+            return {
+                encoding: 'application/json',
+                body: {
+                    lastInitiatedAt: actorInfo.ageAssuranceStatus?.lastInitiatedAt
+                        ?.toDate()
+                        .toISOString() ?? undefined,
+                    status: actorInfo.ageAssuranceStatus?.status ?? 'unknown',
+                },
+            };
+        },
+    });
+}
+const getAgeVerificationState = async (ctx, actorDid) => {
+    try {
+        const res = await ctx.dataplane.getActors({
+            dids: [actorDid],
+            returnAgeAssuranceForDids: [actorDid],
+            skipCacheForDids: [actorDid],
+        });
+        return res.actors[0];
+    }
+    catch (err) {
+        throw new xrpc_server_1.UpstreamFailureError('Cannot get current age assurance state', 'GetAgeAssuranceStateFailed', { cause: err });
+    }
+};
+//# sourceMappingURL=getAgeAssuranceState.js.map

package/dist/api/app/bsky/unspecced/getAgeAssuranceState.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getAgeAssuranceState.js","sourceRoot":"","sources":["../../../../../src/api/app/bsky/unspecced/getAgeAssuranceState.ts"],"names":[],"mappings":";;AAKA,4BAmBC;AAxBD,sDAA2D;AAK3D,mBAAyB,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC;QAC7C,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,QAAQ;QAC/B,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;YAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAA;YACnC,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;YAE5D,OAAO;gBACL,QAAQ,EAAE,kBAAkB;gBAC5B,IAAI,EAAE;oBACJ,eAAe,EACb,SAAS,CAAC,kBAAkB,EAAE,eAAe;wBAC3C,EAAE,MAAM,EAAE;yBACT,WAAW,EAAE,IAAI,SAAS;oBAC/B,MAAM,EAAE,SAAS,CAAC,kBAAkB,EAAE,MAAM,IAAI,SAAS;iBAC1D;aACF,CAAA;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,uBAAuB,GAAG,KAAK,EACnC,GAAe,EACf,QAAgB,EACI,EAAE;IACtB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC;YACxC,IAAI,EAAE,CAAC,QAAQ,CAAC;YAChB,yBAAyB,EAAE,CAAC,QAAQ,CAAC;YACrC,gBAAgB,EAAE,CAAC,QAAQ,CAAC;SAC7B,CAAC,CAAA;QAEF,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,kCAAoB,CAC5B,wCAAwC,EACxC,4BAA4B,EAC5B,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;IACH,CAAC;AACH,CAAC,CAAA"}

package/dist/api/app/bsky/unspecced/initAgeAssurance.d.ts

@@ -0,0 +1,4 @@
+import { AppContext } from '../../../../context';
+import { Server } from '../../../../lexicon';
+export default function (server: Server, ctx: AppContext): void;
+//# sourceMappingURL=initAgeAssurance.d.ts.map

package/dist/api/app/bsky/unspecced/initAgeAssurance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"initAgeAssurance.d.ts","sourceRoot":"","sources":["../../../../../src/api/app/bsky/unspecced/initAgeAssurance.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAEhD,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAI5C,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAwDvD"}

package/dist/api/app/bsky/unspecced/initAgeAssurance.js

@@ -0,0 +1,59 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = default_1;
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const address_1 = require("@hapi/address");
+const disposable_email_domains_js_1 = require("disposable-email-domains-js");
+const xrpc_server_1 = require("@atproto/xrpc-server");
+const feature_gates_1 = require("../../../../feature-gates");
+const util_1 = require("../../../kws/util");
+function default_1(server, ctx) {
+    server.app.bsky.unspecced.initAgeAssurance({
+        auth: ctx.authVerifier.standard,
+        handler: async ({ auth, input, req }) => {
+            if (!ctx.kwsClient) {
+                throw new xrpc_server_1.MethodNotImplementedError('This service is not configured to support age assurance.');
+            }
+            const actorDid = auth.credentials.iss;
+            const enabled = ctx.cfg.debugMode ||
+                ctx.featureGates.check({ userID: actorDid }, feature_gates_1.GateID.AgeAssurance);
+            if (!enabled) {
+                throw new xrpc_server_1.ForbiddenError();
+            }
+            const { email, language, countryCode } = input.body;
+            if (!(0, address_1.isEmailValid)(email) || (0, disposable_email_domains_js_1.isDisposableEmail)(email)) {
+                throw new xrpc_server_1.InvalidRequestError('This email address is not supported, please use a different email.');
+            }
+            const attemptId = node_crypto_1.default.randomUUID();
+            // Assumes `app.set('trust proxy', ...)` configured with `true` or specific values.
+            const initIp = req.ip;
+            const initUa = (0, util_1.getClientUa)(req);
+            const externalPayload = { actorDid, attemptId };
+            await ctx.kwsClient.sendEmail({
+                countryCode,
+                email,
+                externalPayload,
+                language,
+            });
+            const event = await (0, util_1.createStashEvent)(ctx, {
+                actorDid,
+                attemptId,
+                email,
+                initIp,
+                initUa,
+                status: 'pending',
+            });
+            return {
+                encoding: 'application/json',
+                body: {
+                    status: event.status,
+                    lastInitiatedAt: event.createdAt,
+                },
+            };
+        },
+    });
+}
+//# sourceMappingURL=initAgeAssurance.js.map

package/dist/api/app/bsky/unspecced/initAgeAssurance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"initAgeAssurance.js","sourceRoot":"","sources":["../../../../../src/api/app/bsky/unspecced/initAgeAssurance.ts"],"names":[],"mappings":";;;;;AAcA,4BAwDC;AAtED,8DAAgC;AAChC,2CAA4C;AAC5C,6EAA+D;AAC/D,sDAI6B;AAE7B,6DAAkD;AAGlD,4CAAiE;AAEjE,mBAAyB,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC;QACzC,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,QAAQ;QAC/B,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE;YACtC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;gBACnB,MAAM,IAAI,uCAAyB,CACjC,0DAA0D,CAC3D,CAAA;YACH,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAA;YACrC,MAAM,OAAO,GACX,GAAG,CAAC,GAAG,CAAC,SAAS;gBACjB,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,sBAAM,CAAC,YAAY,CAAC,CAAA;YACnE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,4BAAc,EAAE,CAAA;YAC5B,CAAC;YAED,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC,IAAI,CAAA;YACnD,IAAI,CAAC,IAAA,sBAAY,EAAC,KAAK,CAAC,IAAI,IAAA,+CAAiB,EAAC,KAAK,CAAC,EAAE,CAAC;gBACrD,MAAM,IAAI,iCAAmB,CAC3B,oEAAoE,CACrE,CAAA;YACH,CAAC;YAED,MAAM,SAAS,GAAG,qBAAM,CAAC,UAAU,EAAE,CAAA;YACrC,mFAAmF;YACnF,MAAM,MAAM,GAAG,GAAG,CAAC,EAAE,CAAA;YACrB,MAAM,MAAM,GAAG,IAAA,kBAAW,EAAC,GAAG,CAAC,CAAA;YAC/B,MAAM,eAAe,GAAuB,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAA;YAEnE,MAAM,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC;gBAC5B,WAAW;gBACX,KAAK;gBACL,eAAe;gBACf,QAAQ;aACT,CAAC,CAAA;YAEF,MAAM,KAAK,GAAG,MAAM,IAAA,uBAAgB,EAAC,GAAG,EAAE;gBACxC,QAAQ;gBACR,SAAS;gBACT,KAAK;gBACL,MAAM;gBACN,MAAM;gBACN,MAAM,EAAE,SAAS;aAClB,CAAC,CAAA;YAEF,OAAO;gBACL,QAAQ,EAAE,kBAAkB;gBAC5B,IAAI,EAAE;oBACJ,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,eAAe,EAAE,KAAK,CAAC,SAAS;iBACjC;aACF,CAAA;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC"}

package/dist/api/external.d.ts

@@ -0,0 +1,4 @@
+import { Router } from 'express';
+import { AppContext } from '../context';
+export declare const createRouter: (ctx: AppContext) => Router;
+//# sourceMappingURL=external.d.ts.map

package/dist/api/external.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"external.d.ts","sourceRoot":"","sources":["../../src/api/external.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAGvC,eAAO,MAAM,YAAY,GAAI,KAAK,UAAU,KAAG,MAQ9C,CAAA"}

package/dist/api/external.js

@@ -0,0 +1,47 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createRouter = void 0;
+const express_1 = require("express");
+const kwsApi = __importStar(require("./kws"));
+const createRouter = (ctx) => {
+    const router = (0, express_1.Router)();
+    if (ctx.kwsClient) {
+        router.use('/kws', kwsApi.createRouter(ctx));
+    }
+    return router;
+};
+exports.createRouter = createRouter;
+//# sourceMappingURL=external.js.map

package/dist/api/external.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"external.js","sourceRoot":"","sources":["../../src/api/external.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,qCAAgC;AAEhC,8CAA+B;AAExB,MAAM,YAAY,GAAG,CAAC,GAAe,EAAU,EAAE;IACtD,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAA;IAEvB,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;QAClB,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;IAC9C,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AARY,QAAA,YAAY,gBAQxB"}

package/dist/api/index.d.ts

@@ -3,5 +3,6 @@ import { Server } from '../lexicon';
 export * as health from './health';
 export * as wellKnown from './well-known';
 export * as blobResolver from './blob-resolver';
+export * as external from './external';
 export default function (server: Server, ctx: AppContext): Server;
 //# sourceMappingURL=index.d.ts.map

package/dist/api/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AAsEnC,OAAO,KAAK,MAAM,MAAM,UAAU,CAAA;AAElC,OAAO,KAAK,SAAS,MAAM,cAAc,CAAA;AAEzC,OAAO,KAAK,YAAY,MAAM,iBAAiB,CAAA;AAE/C,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,UAwEvD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AAwEnC,OAAO,KAAK,MAAM,MAAM,UAAU,CAAA;AAElC,OAAO,KAAK,SAAS,MAAM,cAAc,CAAA;AAEzC,OAAO,KAAK,YAAY,MAAM,iBAAiB,CAAA;AAE/C,OAAO,KAAK,QAAQ,MAAM,YAAY,CAAA;AAEtC,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,UA0EvD"}

package/dist/api/index.js

@@ -36,7 +36,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.blobResolver = exports.wellKnown = exports.health = void 0;
+exports.external = exports.blobResolver = exports.wellKnown = exports.health = void 0;
 exports.default = default_1;
 const getProfile_1 = __importDefault(require("./app/bsky/actor/getProfile"));
 const getProfiles_1 = __importDefault(require("./app/bsky/actor/getProfiles"));
@@ -89,6 +89,7 @@ const putPreferences_1 = __importDefault(require("./app/bsky/notification/putPre
 const putPreferencesV2_1 = __importDefault(require("./app/bsky/notification/putPreferencesV2"));
 const registerPush_1 = __importDefault(require("./app/bsky/notification/registerPush"));
 const updateSeen_1 = __importDefault(require("./app/bsky/notification/updateSeen"));
+const getAgeAssuranceState_1 = __importDefault(require("./app/bsky/unspecced/getAgeAssuranceState"));
 const getConfig_1 = __importDefault(require("./app/bsky/unspecced/getConfig"));
 const getPopularFeedGenerators_1 = __importDefault(require("./app/bsky/unspecced/getPopularFeedGenerators"));
 const getPostThreadOtherV2_1 = __importDefault(require("./app/bsky/unspecced/getPostThreadOtherV2"));
@@ -99,6 +100,7 @@ const getSuggestedUsers_1 = __importDefault(require("./app/bsky/unspecced/getSug
 const getTaggedSuggestions_1 = __importDefault(require("./app/bsky/unspecced/getTaggedSuggestions"));
 const getTrendingTopics_1 = __importDefault(require("./app/bsky/unspecced/getTrendingTopics"));
 const getTrends_1 = __importDefault(require("./app/bsky/unspecced/getTrends"));
+const initAgeAssurance_1 = __importDefault(require("./app/bsky/unspecced/initAgeAssurance"));
 const getAccountInfos_1 = __importDefault(require("./com/atproto/admin/getAccountInfos"));
 const getSubjectStatus_1 = __importDefault(require("./com/atproto/admin/getSubjectStatus"));
 const updateSubjectStatus_1 = __importDefault(require("./com/atproto/admin/updateSubjectStatus"));
@@ -109,6 +111,7 @@ const fetchLabels_1 = __importDefault(require("./com/atproto/temp/fetchLabels"))
 exports.health = __importStar(require("./health"));
 exports.wellKnown = __importStar(require("./well-known"));
 exports.blobResolver = __importStar(require("./blob-resolver"));
+exports.external = __importStar(require("./external"));
 function default_1(server, ctx) {
     // app.bsky
     (0, getTimeline_1.default)(server, ctx);
@@ -172,6 +175,8 @@ function default_1(server, ctx) {
     (0, getConfig_1.default)(server, ctx);
     (0, getPopularFeedGenerators_1.default)(server, ctx);
     (0, getTaggedSuggestions_1.default)(server, ctx);
+    (0, getAgeAssuranceState_1.default)(server, ctx);
+    (0, initAgeAssurance_1.default)(server, ctx);
     // com.atproto
     (0, getSubjectStatus_1.default)(server, ctx);
     (0, updateSubjectStatus_1.default)(server, ctx);

package/dist/api/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6EA,4BAwEC;AAnJD,6EAAoD;AACpD,+EAAsD;AACtD,qFAA4D;AAC5D,iFAAwD;AACxD,mGAA0E;AAC1E,kFAAyD;AACzD,kFAAyD;AACzD,kFAAyD;AACzD,sEAA6C;AAC7C,wFAA+D;AAC/D,0FAAiE;AACjE,wEAA+C;AAC/C,8EAAqD;AACrD,kFAAyD;AACzD,wEAA+C;AAC/C,0EAAiD;AACjD,kFAAyD;AACzD,0FAAiE;AACjE,8EAAqD;AACrD,8EAAqD;AACrD,iGAAwE;AACxE,2EAAkD;AAClD,iFAAwD;AACxD,6EAAoD;AACpD,2FAAkE;AAClE,uEAA8C;AAC9C,mFAA0D;AAC1D,iFAAwD;AACxD,yEAAgD;AAChD,yEAAgD;AAChD,yFAAgE;AAChE,qFAA4D;AAC5D,uFAA8D;AAC9D,6GAAoF;AACpF,2EAAkD;AAClD,mFAA0D;AAC1D,6EAAoD;AACpD,6FAAoE;AACpE,+EAAsD;AACtD,uFAA8D;AAC9D,iFAAwD;AACxD,iFAA+D;AAC/D,4FAAmE;AACnE,4FAAmE;AACnE,kHAAyF;AACzF,kGAAyE;AACzE,8GAAqF;AACrF,4FAAmE;AACnE,gGAAuE;AACvE,wFAA+D;AAC/D,oFAA2D;AAC3D,+EAAsD;AACtD,6GAAoF;AACpF,qGAA4E;AAC5E,2FAAkE;AAClE,+FAA+E;AAC/E,6GAAoF;AACpF,+FAAsE;AACtE,qGAA4E;AAC5E,+FAAsE;AACtE,+EAAsD;AACtD,0FAAiE;AACjE,4FAAmE;AACnE,kGAAyE;AACzE,yFAAgE;AAChE,kFAAyD;AACzD,6EAAoD;AACpD,iFAAwD;AAExD,mDAAkC;AAElC,0DAAyC;AAEzC,gEAA+C;AAE/C,mBAAyB,MAAc,EAAE,GAAe;IACtD,WAAW;IACX,IAAA,qBAAW,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACxB,IAAA,uBAAa,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC1B,IAAA,2BAAiB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC9B,IAAA,uBAAa,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC1B,IAAA,iBAAO,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACpB,IAAA,0BAAgB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC7B,IAAA,2BAAiB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC9B,IAAA,kBAAQ,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACrB,IAAA,qBAAW,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACxB,IAAA,mBAAS,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACtB,IAAA,uBAAa,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC1B,IAAA,8BAAoB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACjC,IAAA,yBAAe,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC5B,IAAA,kBAAQ,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACrB,IAAA,qBAAW,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACxB,IAAA,uBAAa,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC1B,IAAA,oBAAU,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACvB,IAAA,qBAAW,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACxB,IAAA,uBAAa,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC1B,IAAA,8BAAoB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACjC,IAAA,mBAAS,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACtB,IAAA,uBAAa,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC1B,IAAA,sBAAY,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACzB,IAAA,2BAAiB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC9B,IAAA,oBAAU,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACvB,IAAA,iBAAO,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACpB,IAAA,kBAAQ,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACrB,IAAA,sBAAY,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACzB,IAAA,kBAAQ,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACrB,IAAA,0BAAgB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC7B,IAAA,wBAAc,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC3B,IAAA,yBAAe,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC5B,IAAA,4BAAkB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC/B,IAAA,mBAAS,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACtB,IAAA,qBAAW,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACxB,IAAA,uBAAa,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC1B,IAAA,yBAAe,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC5B,IAAA,oBAAU,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACvB,IAAA,sBAAY,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACzB,IAAA,oCAA0B,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACvC,IAAA,2BAAiB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC9B,IAAA,mBAAS,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACtB,IAAA,kCAAwB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACrC,IAAA,2BAAiB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC9B,IAAA,2BAA0B,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACvC,IAAA,qBAAkB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC/B,IAAA,sBAAY,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACzB,IAAA,+BAAqB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAClC,IAAA,wBAAc,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC3B,IAAA,wBAAc,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC3B,IAAA,wBAAc,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC3B,IAAA,mCAAyB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACtC,IAAA,2BAAiB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC9B,IAAA,iCAAuB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACpC,IAAA,oBAAU,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACvB,IAAA,wBAAc,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC3B,IAAA,0BAAgB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC7B,IAAA,sBAAY,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACzB,IAAA,mBAAS,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACtB,IAAA,kCAAwB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACrC,IAAA,8BAAoB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACjC,cAAc;IACd,IAAA,0BAAgB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC7B,IAAA,6BAAmB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAChC,IAAA,yBAAe,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC5B,IAAA,uBAAa,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC1B,IAAA,mBAAS,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACtB,IAAA,qBAAW,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACxB,IAAA,qBAAW,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACxB,OAAO,MAAM,CAAA;AACf,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiFA,4BA0EC;AAzJD,6EAAoD;AACpD,+EAAsD;AACtD,qFAA4D;AAC5D,iFAAwD;AACxD,mGAA0E;AAC1E,kFAAyD;AACzD,kFAAyD;AACzD,kFAAyD;AACzD,sEAA6C;AAC7C,wFAA+D;AAC/D,0FAAiE;AACjE,wEAA+C;AAC/C,8EAAqD;AACrD,kFAAyD;AACzD,wEAA+C;AAC/C,0EAAiD;AACjD,kFAAyD;AACzD,0FAAiE;AACjE,8EAAqD;AACrD,8EAAqD;AACrD,iGAAwE;AACxE,2EAAkD;AAClD,iFAAwD;AACxD,6EAAoD;AACpD,2FAAkE;AAClE,uEAA8C;AAC9C,mFAA0D;AAC1D,iFAAwD;AACxD,yEAAgD;AAChD,yEAAgD;AAChD,yFAAgE;AAChE,qFAA4D;AAC5D,uFAA8D;AAC9D,6GAAoF;AACpF,2EAAkD;AAClD,mFAA0D;AAC1D,6EAAoD;AACpD,6FAAoE;AACpE,+EAAsD;AACtD,uFAA8D;AAC9D,iFAAwD;AACxD,iFAA+D;AAC/D,4FAAmE;AACnE,4FAAmE;AACnE,kHAAyF;AACzF,kGAAyE;AACzE,8GAAqF;AACrF,4FAAmE;AACnE,gGAAuE;AACvE,wFAA+D;AAC/D,oFAA2D;AAC3D,qGAA4E;AAC5E,+EAAsD;AACtD,6GAAoF;AACpF,qGAA4E;AAC5E,2FAAkE;AAClE,+FAA+E;AAC/E,6GAAoF;AACpF,+FAAsE;AACtE,qGAA4E;AAC5E,+FAAsE;AACtE,+EAAsD;AACtD,6FAAoE;AACpE,0FAAiE;AACjE,4FAAmE;AACnE,kGAAyE;AACzE,yFAAgE;AAChE,kFAAyD;AACzD,6EAAoD;AACpD,iFAAwD;AAExD,mDAAkC;AAElC,0DAAyC;AAEzC,gEAA+C;AAE/C,uDAAsC;AAEtC,mBAAyB,MAAc,EAAE,GAAe;IACtD,WAAW;IACX,IAAA,qBAAW,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACxB,IAAA,uBAAa,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC1B,IAAA,2BAAiB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC9B,IAAA,uBAAa,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC1B,IAAA,iBAAO,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACpB,IAAA,0BAAgB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC7B,IAAA,2BAAiB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC9B,IAAA,kBAAQ,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACrB,IAAA,qBAAW,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACxB,IAAA,mBAAS,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACtB,IAAA,uBAAa,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC1B,IAAA,8BAAoB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACjC,IAAA,yBAAe,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC5B,IAAA,kBAAQ,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACrB,IAAA,qBAAW,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACxB,IAAA,uBAAa,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC1B,IAAA,oBAAU,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACvB,IAAA,qBAAW,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACxB,IAAA,uBAAa,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC1B,IAAA,8BAAoB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACjC,IAAA,mBAAS,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACtB,IAAA,uBAAa,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC1B,IAAA,sBAAY,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACzB,IAAA,2BAAiB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC9B,IAAA,oBAAU,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACvB,IAAA,iBAAO,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACpB,IAAA,kBAAQ,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACrB,IAAA,sBAAY,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACzB,IAAA,kBAAQ,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACrB,IAAA,0BAAgB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC7B,IAAA,wBAAc,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC3B,IAAA,yBAAe,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC5B,IAAA,4BAAkB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC/B,IAAA,mBAAS,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACtB,IAAA,qBAAW,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACxB,IAAA,uBAAa,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC1B,IAAA,yBAAe,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC5B,IAAA,oBAAU,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACvB,IAAA,sBAAY,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACzB,IAAA,oCAA0B,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACvC,IAAA,2BAAiB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC9B,IAAA,mBAAS,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACtB,IAAA,kCAAwB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACrC,IAAA,2BAAiB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC9B,IAAA,2BAA0B,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACvC,IAAA,qBAAkB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC/B,IAAA,sBAAY,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACzB,IAAA,+BAAqB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAClC,IAAA,wBAAc,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC3B,IAAA,wBAAc,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC3B,IAAA,wBAAc,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC3B,IAAA,mCAAyB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACtC,IAAA,2BAAiB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC9B,IAAA,iCAAuB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACpC,IAAA,oBAAU,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACvB,IAAA,wBAAc,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC3B,IAAA,0BAAgB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC7B,IAAA,sBAAY,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACzB,IAAA,mBAAS,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACtB,IAAA,kCAAwB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACrC,IAAA,8BAAoB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACjC,IAAA,8BAAoB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACjC,IAAA,0BAAgB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC7B,cAAc;IACd,IAAA,0BAAgB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC7B,IAAA,6BAAmB,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAChC,IAAA,yBAAe,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC5B,IAAA,uBAAa,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC1B,IAAA,mBAAS,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACtB,IAAA,qBAAW,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACxB,IAAA,qBAAW,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACxB,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/api/kws/api.d.ts

@@ -0,0 +1,4 @@
+import { RequestHandler } from 'express';
+import { AppContextWithKwsClient } from './types';
+export declare const verificationHandler: (ctx: AppContextWithKwsClient) => RequestHandler;
+//# sourceMappingURL=api.d.ts.map

package/dist/api/kws/api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../../src/api/kws/api.ts"],"names":[],"mappings":"AAAA,OAAgB,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAEjD,OAAO,EACL,uBAAuB,EAIxB,MAAM,SAAS,CAAA;AAsChB,eAAO,MAAM,mBAAmB,GAC7B,KAAK,uBAAuB,KAAG,cA6C/B,CAAA"}

package/dist/api/kws/api.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verificationHandler = void 0;
+const logger_1 = require("../../logger");
+const types_1 = require("./types");
+const util_1 = require("./util");
+const validateRequest = (ctx, req) => {
+    try {
+        const intermediate = types_1.verificationIntermediateQuerySchema.parse({
+            externalPayload: req.query.externalPayload,
+            signature: req.query.signature,
+            status: req.query.status,
+        });
+        const data = `${intermediate.status}:${intermediate.externalPayload}`;
+        (0, util_1.validateSignature)(ctx.cfg.kws.verificationSecret, data, intermediate.signature);
+        return {
+            ...intermediate,
+            externalPayload: (0, util_1.parseExternalPayload)(intermediate.externalPayload),
+            status: (0, util_1.parseStatus)(intermediate.status),
+        };
+    }
+    catch (err) {
+        throw new Error('Invalid KWS API request', { cause: err });
+    }
+};
+const verificationHandler = (ctx) => async (req, res) => {
+    let actorDid;
+    try {
+        const query = validateRequest(ctx, req);
+        const { externalPayload, status: { verified }, } = query;
+        if (!verified) {
+            throw new Error('Unexpected KWS verification response call with unverified status');
+        }
+        const { actorDid: externalPayloadActorDid, attemptId } = externalPayload;
+        actorDid = externalPayloadActorDid;
+        // Assumes `app.set('trust proxy', ...)` configured with `true` or specific values.
+        const completeIp = req.ip;
+        const completeUa = (0, util_1.getClientUa)(req);
+        await (0, util_1.createStashEvent)(ctx, {
+            actorDid,
+            attemptId,
+            completeIp,
+            completeUa,
+            status: 'assured',
+        });
+        return res
+            .status(302)
+            .setHeader('Location', `${ctx.cfg.kws.redirectUrl}?${new URLSearchParams({ actorDid, result: 'success' })}`)
+            .end();
+    }
+    catch (err) {
+        logger_1.httpLogger.error({ err }, 'Failed to handle KWS verification response');
+        return res
+            .status(302)
+            .setHeader('Location', `${ctx.cfg.kws.redirectUrl}?${new URLSearchParams({ ...(actorDid ? { actorDid } : {}), result: 'unknown' })}`)
+            .end();
+    }
+};
+exports.verificationHandler = verificationHandler;
+//# sourceMappingURL=api.js.map

package/dist/api/kws/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../../src/api/kws/api.ts"],"names":[],"mappings":";;;AACA,yCAAgD;AAChD,mCAKgB;AAChB,iCAMe;AAEf,MAAM,eAAe,GAAG,CACtB,GAA4B,EAC5B,GAAoB,EACE,EAAE;IACxB,IAAI,CAAC;QACH,MAAM,YAAY,GAChB,2CAAmC,CAAC,KAAK,CAAC;YACxC,eAAe,EAAE,GAAG,CAAC,KAAK,CAAC,eAAe;YAC1C,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,SAAS;YAC9B,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM;SACzB,CAAC,CAAA;QAEJ,MAAM,IAAI,GAAG,GAAG,YAAY,CAAC,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,CAAA;QACrE,IAAA,wBAAiB,EACf,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAC9B,IAAI,EACJ,YAAY,CAAC,SAAS,CACvB,CAAA;QAED,OAAO;YACL,GAAG,YAAY;YACf,eAAe,EAAE,IAAA,2BAAoB,EAAC,YAAY,CAAC,eAAe,CAAC;YACnE,MAAM,EAAE,IAAA,kBAAW,EAAC,YAAY,CAAC,MAAM,CAAC;SACzC,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC5D,CAAC;AACH,CAAC,CAAA;AAEM,MAAM,mBAAmB,GAC9B,CAAC,GAA4B,EAAkB,EAAE,CACjD,KAAK,EAAE,GAAoB,EAAE,GAAqB,EAAE,EAAE;IACpD,IAAI,QAA4B,CAAA;IAChC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACvC,MAAM,EACJ,eAAe,EACf,MAAM,EAAE,EAAE,QAAQ,EAAE,GACrB,GAAG,KAAK,CAAA;QACT,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAA;QACH,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,uBAAuB,EAAE,SAAS,EAAE,GAAG,eAAe,CAAA;QACxE,QAAQ,GAAG,uBAAuB,CAAA;QAClC,mFAAmF;QACnF,MAAM,UAAU,GAAG,GAAG,CAAC,EAAE,CAAA;QACzB,MAAM,UAAU,GAAG,IAAA,kBAAW,EAAC,GAAG,CAAC,CAAA;QACnC,MAAM,IAAA,uBAAgB,EAAC,GAAG,EAAE;YAC1B,QAAQ;YACR,SAAS;YACT,UAAU;YACV,UAAU;YACV,MAAM,EAAE,SAAS;SAClB,CAAC,CAAA;QACF,OAAO,GAAG;aACP,MAAM,CAAC,GAAG,CAAC;aACX,SAAS,CACR,UAAU,EACV,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,CACrF;aACA,GAAG,EAAE,CAAA;IACV,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,mBAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,4CAA4C,CAAC,CAAA;QAEhE,OAAO,GAAG;aACP,MAAM,CAAC,GAAG,CAAC;aACX,SAAS,CACR,UAAU,EACV,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,eAAe,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,CAC9G;aACA,GAAG,EAAE,CAAA;IACV,CAAC;AACH,CAAC,CAAA;AA9CU,QAAA,mBAAmB,uBA8C7B"}

package/dist/api/kws/index.d.ts

@@ -0,0 +1,4 @@
+import { Router } from 'express';
+import { AppContext } from '../../context';
+export declare const createRouter: (ctx: AppContext) => Router;
+//# sourceMappingURL=index.d.ts.map

package/dist/api/kws/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/kws/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAO,MAAM,SAAS,CAAA;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAK1C,eAAO,MAAM,YAAY,GAAI,KAAK,UAAU,KAAG,MAQ9C,CAAA"}

package/dist/api/kws/index.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createRouter = void 0;
+const express_1 = require("express");
+const api_1 = require("./api");
+const webhook_1 = require("./webhook");
+const createRouter = (ctx) => {
+    assertAppContextWithAgeAssuranceClient(ctx);
+    const router = (0, express_1.Router)();
+    router.use((0, express_1.raw)({ type: 'application/json' }));
+    router.post('/age-assurance-webhook', (0, webhook_1.webhookAuth)(ctx), (0, webhook_1.webhookHandler)(ctx));
+    router.get('/age-assurance-verification', (0, api_1.verificationHandler)(ctx));
+    return router;
+};
+exports.createRouter = createRouter;
+const assertAppContextWithAgeAssuranceClient = (ctx) => {
+    if (!ctx.kwsClient) {
+        throw new Error('Tried to set up KWS router without kwsClient configured.');
+    }
+};
+//# sourceMappingURL=index.js.map

package/dist/api/kws/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/api/kws/index.ts"],"names":[],"mappings":";;;AAAA,qCAAqC;AAErC,+BAA2C;AAE3C,uCAAuD;AAEhD,MAAM,YAAY,GAAG,CAAC,GAAe,EAAU,EAAE;IACtD,sCAAsC,CAAC,GAAG,CAAC,CAAA;IAE3C,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAA;IACvB,MAAM,CAAC,GAAG,CAAC,IAAA,aAAG,EAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAA;IAC7C,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,IAAA,qBAAW,EAAC,GAAG,CAAC,EAAE,IAAA,wBAAc,EAAC,GAAG,CAAC,CAAC,CAAA;IAC5E,MAAM,CAAC,GAAG,CAAC,6BAA6B,EAAE,IAAA,yBAAmB,EAAC,GAAG,CAAC,CAAC,CAAA;IACnE,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AARY,QAAA,YAAY,gBAQxB;AAED,MAAM,sCAAsC,GAEE,CAAC,GAAe,EAAE,EAAE;IAChE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;IAC7E,CAAC;AACH,CAAC,CAAA"}

package/dist/api/kws/types.d.ts

@@ -0,0 +1,100 @@
+import { z } from 'zod';
+import { KwsConfig, ServerConfig } from '../../config';
+import { AppContext } from '../../context';
+import { KwsClient } from '../../kws';
+export type AppContextWithKwsClient = AppContext & {
+    kwsClient: KwsClient;
+    cfg: ServerConfig & {
+        kws: KwsConfig;
+    };
+};
+export type KwsExternalPayload = {
+    actorDid: string;
+    attemptId: string;
+};
+export declare const externalPayloadSchema: z.ZodObject<{
+    actorDid: z.ZodString;
+    attemptId: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    actorDid: string;
+    attemptId: string;
+}, {
+    actorDid: string;
+    attemptId: string;
+}>;
+export type KwsStatus = {
+    verified: boolean;
+};
+export type KwsVerificationIntermediateQuery = {
+    externalPayload: string;
+    status: string;
+    signature: string;
+};
+export declare const verificationIntermediateQuerySchema: z.ZodObject<{
+    externalPayload: z.ZodString;
+    signature: z.ZodString;
+    status: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    status: string;
+    externalPayload: string;
+    signature: string;
+}, {
+    status: string;
+    externalPayload: string;
+    signature: string;
+}>;
+export type KwsVerificationQuery = {
+    externalPayload: KwsExternalPayload;
+    signature: string;
+    status: KwsStatus;
+};
+export type KwsWebhookBody = {
+    payload: {
+        externalPayload: KwsExternalPayload;
+        status: KwsStatus;
+    };
+};
+export declare const statusSchema: z.ZodObject<{
+    verified: z.ZodBoolean;
+}, "strip", z.ZodTypeAny, {
+    verified: boolean;
+}, {
+    verified: boolean;
+}>;
+export declare const webhookBodyIntermediateSchema: z.ZodObject<{
+    payload: z.ZodObject<{
+        externalPayload: z.ZodString;
+        status: z.ZodObject<{
+            verified: z.ZodBoolean;
+        }, "strip", z.ZodTypeAny, {
+            verified: boolean;
+        }, {
+            verified: boolean;
+        }>;
+    }, "strip", z.ZodTypeAny, {
+        status: {
+            verified: boolean;
+        };
+        externalPayload: string;
+    }, {
+        status: {
+            verified: boolean;
+        };
+        externalPayload: string;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    payload: {
+        status: {
+            verified: boolean;
+        };
+        externalPayload: string;
+    };
+}, {
+    payload: {
+        status: {
+            verified: boolean;
+        };
+        externalPayload: string;
+    };
+}>;
+//# sourceMappingURL=types.d.ts.map

package/dist/api/kws/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/api/kws/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAErC,MAAM,MAAM,uBAAuB,GAAG,UAAU,GAAG;IACjD,SAAS,EAAE,SAAS,CAAA;IACpB,GAAG,EAAE,YAAY,GAAG;QAClB,GAAG,EAAE,SAAS,CAAA;KACf,CAAA;CACF,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAGD,eAAO,MAAM,qBAAqB;;;;;;;;;EAKvB,CAAA;AAEX,MAAM,MAAM,SAAS,GAAG;IACtB,QAAQ,EAAE,OAAO,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,gCAAgC,GAAG;IAC7C,eAAe,EAAE,MAAM,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAGD,eAAO,MAAM,mCAAmC;;;;;;;;;;;;EAI9C,CAAA;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,eAAe,EAAE,kBAAkB,CAAA;IACnC,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,SAAS,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,OAAO,EAAE;QACP,eAAe,EAAE,kBAAkB,CAAA;QACnC,MAAM,EAAE,SAAS,CAAA;KAClB,CAAA;CACF,CAAA;AAGD,eAAO,MAAM,YAAY;;;;;;EAEvB,CAAA;AAGF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAKxC,CAAA"}

package/dist/api/kws/types.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.webhookBodyIntermediateSchema = exports.statusSchema = exports.verificationIntermediateQuerySchema = exports.externalPayloadSchema = void 0;
+const zod_1 = require("zod");
+// `.strict()` because we control the payload structure.
+exports.externalPayloadSchema = zod_1.z
+    .object({
+    actorDid: zod_1.z.string(),
+    attemptId: zod_1.z.string(),
+})
+    .strict();
+// Not `.strict()` to avoid breaking if KWS adds fields.
+exports.verificationIntermediateQuerySchema = zod_1.z.object({
+    externalPayload: zod_1.z.string(),
+    signature: zod_1.z.string(),
+    status: zod_1.z.string(),
+});
+// Not `.strict()` to avoid breaking if KWS adds fields.
+exports.statusSchema = zod_1.z.object({
+    verified: zod_1.z.boolean(),
+});
+// Not `.strict()` to avoid breaking if KWS adds fields.
+exports.webhookBodyIntermediateSchema = zod_1.z.object({
+    payload: zod_1.z.object({
+        externalPayload: zod_1.z.string(),
+        status: exports.statusSchema,
+    }),
+});
+//# sourceMappingURL=types.js.map

package/dist/api/kws/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/api/kws/types.ts"],"names":[],"mappings":";;;AAAA,6BAAuB;AAiBvB,wDAAwD;AAC3C,QAAA,qBAAqB,GAAG,OAAC;KACnC,MAAM,CAAC;IACN,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE;IACpB,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE;CACtB,CAAC;KACD,MAAM,EAAE,CAAA;AAYX,wDAAwD;AAC3C,QAAA,mCAAmC,GAAG,OAAC,CAAC,MAAM,CAAC;IAC1D,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE;IAC3B,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE;IACrB,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE;CACnB,CAAC,CAAA;AAeF,wDAAwD;AAC3C,QAAA,YAAY,GAAG,OAAC,CAAC,MAAM,CAAC;IACnC,QAAQ,EAAE,OAAC,CAAC,OAAO,EAAE;CACtB,CAAC,CAAA;AAEF,wDAAwD;AAC3C,QAAA,6BAA6B,GAAG,OAAC,CAAC,MAAM,CAAC;IACpD,OAAO,EAAE,OAAC,CAAC,MAAM,CAAC;QAChB,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE;QAC3B,MAAM,EAAE,oBAAY;KACrB,CAAC;CACH,CAAC,CAAA"}

package/dist/api/kws/util.d.ts

@@ -0,0 +1,21 @@
+import express from 'express';
+import { AppContext } from '../../context';
+import { AgeAssuranceEvent, AgeAssuranceState } from '../../lexicon/types/app/bsky/unspecced/defs';
+import { KwsExternalPayload, KwsStatus } from './types';
+export declare const createStashEvent: (ctx: AppContext, { actorDid, attemptId, email, initIp, initUa, completeIp, completeUa, status, }: {
+    actorDid: string;
+    attemptId: string;
+    email?: string;
+    initIp?: string;
+    initUa?: string;
+    completeIp?: string;
+    completeUa?: string;
+    status: AgeAssuranceState["status"];
+}) => Promise<AgeAssuranceEvent>;
+export declare const validateSignature: (key: string, data: string, signature: string) => void;
+export declare const serializeExternalPayload: (value: KwsExternalPayload) => string;
+export declare const parseExternalPayload: (serialized: string) => KwsExternalPayload;
+export declare const parseStatus: (serialized: string) => KwsStatus;
+export declare const kwsWwwAuthenticate: () => Record<string, string>;
+export declare const getClientUa: (req: express.Request) => string | undefined;
+//# sourceMappingURL=util.d.ts.map

package/dist/api/kws/util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"util.d.ts","sourceRoot":"","sources":["../../../src/api/kws/util.ts"],"names":[],"mappings":"AACA,OAAO,OAAO,MAAM,SAAS,CAAA;AAE7B,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,6CAA6C,CAAA;AAEpD,OAAO,EACL,kBAAkB,EAClB,SAAS,EAGV,MAAM,SAAS,CAAA;AAEhB,eAAO,MAAM,gBAAgB,GAC3B,KAAK,UAAU,EACf,iFASG;IACD,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAA;CACpC,+BAoBF,CAAA;AAED,eAAO,MAAM,iBAAiB,GAC5B,KAAK,MAAM,EACX,MAAM,MAAM,EACZ,WAAW,MAAM,SAiBlB,CAAA;AAED,eAAO,MAAM,wBAAwB,GAAI,OAAO,kBAAkB,KAAG,MAEpE,CAAA;AAED,eAAO,MAAM,oBAAoB,GAC/B,YAAY,MAAM,KACjB,kBAOF,CAAA;AAED,eAAO,MAAM,WAAW,GAAI,YAAY,MAAM,KAAG,SAOhD,CAAA;AAED,eAAO,MAAM,kBAAkB,QAAO,MAAM,CAAC,MAAM,EAAE,MAAM,CAEzD,CAAA;AAEF,eAAO,MAAM,WAAW,GAAI,KAAK,OAAO,CAAC,OAAO,KAAG,MAAM,GAAG,SAE3D,CAAA"}

package/dist/api/kws/util.js

@@ -0,0 +1,78 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getClientUa = exports.kwsWwwAuthenticate = exports.parseStatus = exports.parseExternalPayload = exports.serializeExternalPayload = exports.validateSignature = exports.createStashEvent = void 0;
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const common_1 = require("@atproto/common");
+const stash_1 = require("../../stash");
+const types_1 = require("./types");
+const createStashEvent = async (ctx, { actorDid, attemptId, email, initIp, initUa, completeIp, completeUa, status, }) => {
+    const stashPayload = {
+        createdAt: new Date().toISOString(),
+        email,
+        status,
+        attemptId,
+        initIp,
+        initUa,
+        completeIp,
+        completeUa,
+    };
+    await ctx.stashClient.create({
+        actorDid,
+        namespace: stash_1.Namespaces.AppBskyUnspeccedDefsAgeAssuranceEvent,
+        key: common_1.TID.nextStr(),
+        payload: stashPayload,
+    });
+    return stashPayload;
+};
+exports.createStashEvent = createStashEvent;
+const validateSignature = (key, data, signature) => {
+    const expectedSignature = node_crypto_1.default
+        .createHmac('sha256', key)
+        .update(data)
+        .digest('hex');
+    const expectedSignatureBuf = Buffer.from(expectedSignature, 'hex');
+    const actualSignatureBuf = Buffer.from(signature, 'hex');
+    if (expectedSignatureBuf.length !== actualSignatureBuf.length) {
+        throw new Error(`Signature mismatch`);
+    }
+    if (!node_crypto_1.default.timingSafeEqual(expectedSignatureBuf, actualSignatureBuf)) {
+        throw new Error(`Signature mismatch`);
+    }
+};
+exports.validateSignature = validateSignature;
+const serializeExternalPayload = (value) => {
+    return JSON.stringify(value);
+};
+exports.serializeExternalPayload = serializeExternalPayload;
+const parseExternalPayload = (serialized) => {
+    try {
+        const value = JSON.parse(serialized);
+        return types_1.externalPayloadSchema.parse(value);
+    }
+    catch (err) {
+        throw new Error(`Invalid external payload: ${serialized}`, { cause: err });
+    }
+};
+exports.parseExternalPayload = parseExternalPayload;
+const parseStatus = (serialized) => {
+    try {
+        const value = JSON.parse(serialized);
+        return types_1.statusSchema.parse(value);
+    }
+    catch (err) {
+        throw new Error(`Invalid status: ${serialized}`, { cause: err });
+    }
+};
+exports.parseStatus = parseStatus;
+const kwsWwwAuthenticate = () => ({
+    'www-authenticate': `Signature realm="kws"`,
+});
+exports.kwsWwwAuthenticate = kwsWwwAuthenticate;
+const getClientUa = (req) => {
+    return req.headers['user-agent'];
+};
+exports.getClientUa = getClientUa;
+//# sourceMappingURL=util.js.map