@atproto/identity 0.2.1 → 0.3.1

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # @atproto/identity
 
+## 0.3.1
+
+### Patch Changes
+
+- [#1788](https://github.com/bluesky-social/atproto/pull/1788) [`84e2d4d2`](https://github.com/bluesky-social/atproto/commit/84e2d4d2b6694f344d80c18672c78b650189d423) Thanks [@bnewbold](https://github.com/bnewbold)! - update license to "MIT or Apache2"
+
+- Updated dependencies [[`84e2d4d2`](https://github.com/bluesky-social/atproto/commit/84e2d4d2b6694f344d80c18672c78b650189d423)]:
+  - @atproto/common-web@0.2.3
+  - @atproto/crypto@0.2.3
+
+## 0.3.0
+
+### Minor Changes
+
+- [#1773](https://github.com/bluesky-social/atproto/pull/1773) [`bb039d8e`](https://github.com/bluesky-social/atproto/commit/bb039d8e4ce5b7f70c4f3e86d1327e210ef24dc3) Thanks [@dholms](https://github.com/dholms)! - Pass stale did doc into refresh cache functions
+
+### Patch Changes
+
+- [`35d108ce`](https://github.com/bluesky-social/atproto/commit/35d108ce94866ce1b3d147cd0620a0ba1c4ebcd7) Thanks [@devinivy](https://github.com/devinivy)! - Allow pds to serve did doc with credentials, API client to respect PDS listed in the did doc.
+
+- Updated dependencies [[`35d108ce`](https://github.com/bluesky-social/atproto/commit/35d108ce94866ce1b3d147cd0620a0ba1c4ebcd7)]:
+  - @atproto/common-web@0.2.2
+
 ## 0.2.1
 
 ### Patch Changes

package/LICENSE.txt

@@ -0,0 +1,7 @@
+Dual MIT/Apache-2.0 License
+
+Copyright (c) 2022-2023 Bluesky PBC, and Contributors
+
+Except as otherwise noted in individual files, this software is licensed under the MIT license (<http://opensource.org/licenses/MIT>), or the Apache License, Version 2.0 (<http://www.apache.org/licenses/LICENSE-2.0>).
+
+Downstream projects and end users may chose either license individually, or both together, at their discretion. The motivation for this dual-licensing is the additional software patent assurance provided by Apache 2.0.

package/README.md

@@ -37,4 +37,9 @@ if (data.handle != handle) {
 
 ## License
 
-MIT License
+This project is dual-licensed under MIT and Apache 2.0 terms:
+
+- MIT license ([LICENSE-MIT.txt](https://github.com/bluesky-social/atproto/blob/main/LICENSE-MIT.txt) or http://opensource.org/licenses/MIT)
+- Apache License, Version 2.0, ([LICENSE-APACHE.txt](https://github.com/bluesky-social/atproto/blob/main/LICENSE-APACHE.txt) or http://www.apache.org/licenses/LICENSE-2.0)
+
+Downstream projects and end users may chose either license individually, or both together, at their discretion. The motivation for this dual-licensing is the additional software patent assurance provided by Apache 2.0.

package/dist/did/atproto-data.d.ts

@@ -1,9 +1,7 @@
 import { DidDocument, AtprotoData } from '../types';
-export declare const getDid: (doc: DidDocument) => string;
+import { getDid, getHandle, getPdsEndpoint, getFeedGenEndpoint, getNotifEndpoint } from '@atproto/common-web';
+export { getDid, getHandle, getPdsEndpoint as getPds, getFeedGenEndpoint as getFeedGen, getNotifEndpoint as getNotif, };
 export declare const getKey: (doc: DidDocument) => string | undefined;
-export declare const getHandle: (doc: DidDocument) => string | undefined;
-export declare const getPds: (doc: DidDocument) => string | undefined;
-export declare const getFeedGen: (doc: DidDocument) => string | undefined;
-export declare const getNotif: (doc: DidDocument) => string | undefined;
 export declare const parseToAtprotoDocument: (doc: DidDocument) => Partial<AtprotoData>;
 export declare const ensureAtpDocument: (doc: DidDocument) => AtprotoData;
+export declare const ensureAtprotoKey: (doc: DidDocument) => string;

package/dist/did/base-resolver.d.ts

@@ -1,11 +1,11 @@
-import { DidCache, AtprotoData, DidDocument } from '../types';
+import { DidCache, AtprotoData, DidDocument, CacheResult } from '../types';
 export declare abstract class BaseResolver {
     cache?: DidCache | undefined;
     constructor(cache?: DidCache | undefined);
     abstract resolveNoCheck(did: string): Promise<unknown | null>;
     validateDidDoc(did: string, val: unknown): DidDocument;
     resolveNoCache(did: string): Promise<DidDocument | null>;
-    refreshCache(did: string): Promise<void>;
+    refreshCache(did: string, prevResult?: CacheResult): Promise<void>;
     resolve(did: string, forceRefresh?: boolean): Promise<DidDocument | null>;
     ensureResolve(did: string, forceRefresh?: boolean): Promise<DidDocument>;
     resolveAtprotoData(did: string, forceRefresh?: boolean): Promise<AtprotoData>;

package/dist/index.js

@@ -21170,15 +21170,14 @@ __export(src_exports3, {
   UnsupportedDidWebPathError: () => UnsupportedDidWebPathError,
   didDocument: () => didDocument,
   ensureAtpDocument: () => ensureAtpDocument,
+  ensureAtprotoKey: () => ensureAtprotoKey,
   getDid: () => getDid,
-  getFeedGen: () => getFeedGen,
+  getFeedGen: () => getFeedGenEndpoint,
   getHandle: () => getHandle,
   getKey: () => getKey,
-  getNotif: () => getNotif,
-  getPds: () => getPds,
-  parseToAtprotoDocument: () => parseToAtprotoDocument,
-  service: () => service,
-  verificationMethod: () => verificationMethod
+  getNotif: () => getNotifEndpoint,
+  getPds: () => getPdsEndpoint,
+  parseToAtprotoDocument: () => parseToAtprotoDocument
 });
 module.exports = __toCommonJS(src_exports3);
 
@@ -24177,16 +24176,18 @@ var decompressPubkey2 = (compressed) => {
 };
 
 // ../crypto/src/p256/operations.ts
-var verifyDidSig = async (did, data, sig) => {
+var verifyDidSig = async (did, data, sig, opts) => {
   const { jwtAlg, keyBytes } = parseDidKey(did);
   if (jwtAlg !== P256_JWT_ALG) {
     throw new Error(`Not a P-256 did:key: ${did}`);
   }
-  return verifySig(keyBytes, data, sig);
+  return verifySig(keyBytes, data, sig, opts);
 };
-var verifySig = async (publicKey, data, sig) => {
+var verifySig = async (publicKey, data, sig, opts) => {
   const msgHash = await sha2562(data);
-  return p256.verify(sig, msgHash, publicKey, { lowS: true });
+  return p256.verify(sig, msgHash, publicKey, {
+    lowS: opts?.lowS ?? true
+  });
 };
 
 // ../crypto/src/p256/plugin.ts
@@ -24198,16 +24199,18 @@ var p256Plugin = {
 var plugin_default = p256Plugin;
 
 // ../crypto/src/secp256k1/operations.ts
-var verifyDidSig2 = async (did, data, sig) => {
+var verifyDidSig2 = async (did, data, sig, opts) => {
   const { jwtAlg, keyBytes } = parseDidKey(did);
   if (jwtAlg !== SECP256K1_JWT_ALG) {
     throw new Error(`Not a secp256k1 did:key: ${did}`);
   }
-  return verifySig2(keyBytes, data, sig);
+  return verifySig2(keyBytes, data, sig, opts);
 };
-var verifySig2 = async (publicKey, data, sig) => {
+var verifySig2 = async (publicKey, data, sig, opts) => {
   const msgHash = await sha2562(data);
-  return secp256k1.verify(sig, msgHash, publicKey, { lowS: true });
+  return secp256k1.verify(sig, msgHash, publicKey, {
+    lowS: opts?.lowS ?? true
+  });
 };
 
 // ../crypto/src/secp256k1/plugin.ts
@@ -24296,13 +24299,13 @@ var multibaseToBytes = (mb) => {
 };
 
 // ../crypto/src/verify.ts
-var verifySignature = (didKey, data, sig) => {
+var verifySignature = (didKey, data, sig, opts) => {
   const parsed = parseDidKey(didKey);
   const plugin = plugins_default.find((p) => p.jwtAlg === parsed.jwtAlg);
   if (!plugin) {
-    throw new Error(`Unsupported signature alg: :${parsed.jwtAlg}`);
+    throw new Error(`Unsupported signature alg: ${parsed.jwtAlg}`);
   }
-  return plugin.verifySignature(didKey, data, sig);
+  return plugin.verifySignature(didKey, data, sig, opts);
 };
 
 // ../common-web/src/check.ts
@@ -27950,26 +27953,7 @@ var DAY = HOUR * 24;
 // ../common-web/src/strings.ts
 var import_graphemer = __toESM(require_lib());
 
-// src/types.ts
-var verificationMethod = objectType({
-  id: stringType(),
-  type: stringType(),
-  controller: stringType(),
-  publicKeyMultibase: stringType().optional()
-});
-var service = objectType({
-  id: stringType(),
-  type: stringType(),
-  serviceEndpoint: unionType([stringType(), recordType(unknownType())])
-});
-var didDocument = objectType({
-  id: stringType(),
-  alsoKnownAs: arrayType(stringType()).optional(),
-  verificationMethod: arrayType(verificationMethod).optional(),
-  service: arrayType(service).optional()
-});
-
-// src/did/atproto-data.ts
+// ../common-web/src/did-doc.ts
 var getDid = (doc) => {
   const id = doc.id;
   if (typeof id !== "string") {
@@ -27977,7 +27961,16 @@ var getDid = (doc) => {
   }
   return id;
 };
-var getKey = (doc) => {
+var getHandle = (doc) => {
+  const aka = doc.alsoKnownAs;
+  if (!aka)
+    return void 0;
+  const found = aka.find((name2) => name2.startsWith("at://"));
+  if (!found)
+    return void 0;
+  return found.slice(5);
+};
+var getSigningKey = (doc) => {
   const did = getDid(doc);
   let keys = doc.verificationMethod;
   if (!keys)
@@ -27988,56 +27981,109 @@ var getKey = (doc) => {
     keys = [keys];
   }
   const found = keys.find((key) => key.id === "#atproto" || key.id === `${did}#atproto`);
-  if (!found)
-    return void 0;
-  if (!found.publicKeyMultibase)
-    return void 0;
-  const keyBytes = multibaseToBytes(found.publicKeyMultibase);
-  let didKey = void 0;
-  if (found.type === "EcdsaSecp256r1VerificationKey2019") {
-    didKey = formatDidKey(P256_JWT_ALG, keyBytes);
-  } else if (found.type === "EcdsaSecp256k1VerificationKey2019") {
-    didKey = formatDidKey(SECP256K1_JWT_ALG, keyBytes);
-  } else if (found.type === "Multikey") {
-    const parsed = parseMultikey(found.publicKeyMultibase);
-    didKey = formatDidKey(parsed.jwtAlg, parsed.keyBytes);
-  }
-  return didKey;
-};
-var getHandle = (doc) => {
-  const aka = doc.alsoKnownAs;
-  if (!aka)
-    return void 0;
-  const found = aka.find((name2) => name2.startsWith("at://"));
-  if (!found)
+  if (!found?.publicKeyMultibase)
     return void 0;
-  return found.slice(5);
+  return {
+    type: found.type,
+    publicKeyMultibase: found.publicKeyMultibase
+  };
 };
-var getPds = (doc) => {
+var getPdsEndpoint = (doc) => {
   return getServiceEndpoint(doc, {
     id: "#atproto_pds",
     type: "AtprotoPersonalDataServer"
   });
 };
-var getFeedGen = (doc) => {
+var getFeedGenEndpoint = (doc) => {
   return getServiceEndpoint(doc, {
     id: "#bsky_fg",
     type: "BskyFeedGenerator"
   });
 };
-var getNotif = (doc) => {
+var getNotifEndpoint = (doc) => {
   return getServiceEndpoint(doc, {
     id: "#bsky_notif",
     type: "BskyNotificationService"
   });
 };
+var getServiceEndpoint = (doc, opts) => {
+  const did = getDid(doc);
+  let services = doc.service;
+  if (!services)
+    return void 0;
+  if (typeof services !== "object")
+    return void 0;
+  if (!Array.isArray(services)) {
+    services = [services];
+  }
+  const found = services.find((service2) => service2.id === opts.id || service2.id === `${did}${opts.id}`);
+  if (!found)
+    return void 0;
+  if (found.type !== opts.type) {
+    return void 0;
+  }
+  if (typeof found.serviceEndpoint !== "string") {
+    return void 0;
+  }
+  return validateUrl(found.serviceEndpoint);
+};
+var validateUrl = (urlStr) => {
+  let url;
+  try {
+    url = new URL(urlStr);
+  } catch {
+    return void 0;
+  }
+  if (!["http:", "https:"].includes(url.protocol)) {
+    return void 0;
+  } else if (!url.hostname) {
+    return void 0;
+  } else {
+    return urlStr;
+  }
+};
+var verificationMethod = z.object({
+  id: z.string(),
+  type: z.string(),
+  controller: z.string(),
+  publicKeyMultibase: z.string().optional()
+});
+var service = z.object({
+  id: z.string(),
+  type: z.string(),
+  serviceEndpoint: z.union([z.string(), z.record(z.unknown())])
+});
+var didDocument = z.object({
+  id: z.string(),
+  alsoKnownAs: z.array(z.string()).optional(),
+  verificationMethod: z.array(verificationMethod).optional(),
+  service: z.array(service).optional()
+});
+
+// src/did/atproto-data.ts
+var getKey = (doc) => {
+  const key = getSigningKey(doc);
+  if (!key)
+    return void 0;
+  const keyBytes = multibaseToBytes(key.publicKeyMultibase);
+  let didKey = void 0;
+  if (key.type === "EcdsaSecp256r1VerificationKey2019") {
+    didKey = formatDidKey(P256_JWT_ALG, keyBytes);
+  } else if (key.type === "EcdsaSecp256k1VerificationKey2019") {
+    didKey = formatDidKey(SECP256K1_JWT_ALG, keyBytes);
+  } else if (key.type === "Multikey") {
+    const parsed = parseMultikey(key.publicKeyMultibase);
+    didKey = formatDidKey(parsed.jwtAlg, parsed.keyBytes);
+  }
+  return didKey;
+};
 var parseToAtprotoDocument = (doc) => {
   const did = getDid(doc);
   return {
     did,
     signingKey: getKey(doc),
     handle: getHandle(doc),
-    pds: getPds(doc)
+    pds: getPdsEndpoint(doc)
   };
 };
 var ensureAtpDocument = (doc) => {
@@ -28056,36 +28102,12 @@ var ensureAtpDocument = (doc) => {
   }
   return { did, signingKey, handle, pds };
 };
-var validateUrl = (url) => {
-  const { hostname, protocol } = new URL(url);
-  if (!["http:", "https:"].includes(protocol)) {
-    throw new Error("Invalid pds protocol");
-  }
-  if (!hostname) {
-    throw new Error("Invalid pds hostname");
-  }
-};
-var getServiceEndpoint = (doc, opts) => {
-  const did = getDid(doc);
-  let services = doc.service;
-  if (!services)
-    return void 0;
-  if (typeof services !== "object")
-    return void 0;
-  if (!Array.isArray(services)) {
-    services = [services];
-  }
-  const found = services.find((service2) => service2.id === opts.id || service2.id === `${did}${opts.id}`);
-  if (!found)
-    return void 0;
-  if (found.type !== opts.type) {
-    return void 0;
-  }
-  if (typeof found.serviceEndpoint !== "string") {
-    return void 0;
+var ensureAtprotoKey = (doc) => {
+  const { signingKey } = parseToAtprotoDocument(doc);
+  if (!signingKey) {
+    throw new Error(`Could not parse signingKey from doc: ${doc}`);
   }
-  validateUrl(found.serviceEndpoint);
-  return found.serviceEndpoint;
+  return signingKey;
 };
 
 // src/errors.ts
@@ -28141,16 +28163,17 @@ var BaseResolver = class {
       return null;
     return this.validateDidDoc(did, got);
   }
-  async refreshCache(did) {
-    await this.cache?.refreshCache(did, () => this.resolveNoCache(did));
+  async refreshCache(did, prevResult) {
+    await this.cache?.refreshCache(did, () => this.resolveNoCache(did), prevResult);
   }
   async resolve(did, forceRefresh = false) {
+    let fromCache = null;
     if (this.cache && !forceRefresh) {
-      const fromCache = await this.cache.checkCache(did);
-      if (fromCache?.stale) {
-        await this.refreshCache(did);
-      }
-      if (fromCache) {
+      fromCache = await this.cache.checkCache(did);
+      if (fromCache && !fromCache.expired) {
+        if (fromCache?.stale) {
+          await this.refreshCache(did, fromCache);
+        }
         return fromCache.doc;
       }
     }
@@ -28159,7 +28182,7 @@ var BaseResolver = class {
       await this.cache?.clearEntry(did);
       return null;
     }
-    await this.cache?.cacheDid(did, got);
+    await this.cache?.cacheDid(did, got, fromCache ?? void 0);
     return got;
   }
   async ensureResolve(did, forceRefresh = false) {
@@ -28177,8 +28200,8 @@ var BaseResolver = class {
     if (did.startsWith("did:key:")) {
       return did;
     } else {
-      const data = await this.resolveAtprotoData(did, forceRefresh);
-      return data.signingKey;
+      const didDocument2 = await this.ensureResolve(did, forceRefresh);
+      return ensureAtprotoKey(didDocument2);
     }
   }
   async verifySignature(did, data, sig, forceRefresh = false) {
@@ -28296,13 +28319,12 @@ var MemoryCache = class {
       return null;
     const now = Date.now();
     const expired = now > val.updatedAt + this.maxTTL;
-    if (expired)
-      return null;
     const stale = now > val.updatedAt + this.staleTTL;
     return {
       ...val,
       did,
-      stale
+      stale,
+      expired
     };
   }
   async clearEntry(did) {
@@ -28350,7 +28372,7 @@ var HandleResolver = class {
     const url = new URL("/.well-known/atproto-did", `https://${handle}`);
     try {
       const res = await fetch(url, { signal });
-      const did = await res.text();
+      const did = (await res.text()).split("\n")[0].trim();
       if (typeof did === "string" && did.startsWith("did:")) {
         return did;
       }
@@ -28424,15 +28446,14 @@ var IdResolver = class {
   UnsupportedDidWebPathError,
   didDocument,
   ensureAtpDocument,
+  ensureAtprotoKey,
   getDid,
   getFeedGen,
   getHandle,
   getKey,
   getNotif,
   getPds,
-  parseToAtprotoDocument,
-  service,
-  verificationMethod
+  parseToAtprotoDocument
 });
 /*!
  * mime-db