@atproto/lex-client 0.0.9 → 0.0.11

package/src/www-authenticate.test.ts

@@ -0,0 +1,227 @@
+import { describe, expect, it } from 'vitest'
+import { parseWWWAuthenticateHeader } from './www-authenticate.js'
+
+describe(parseWWWAuthenticateHeader, () => {
+  describe('auth-params', () => {
+    it('parses single unquoted auth param', () => {
+      expect(parseWWWAuthenticateHeader('Bearer realm=example.com')).toEqual({
+        Bearer: { realm: 'example.com' },
+      })
+    })
+
+    it('parses single quoted auth param', () => {
+      expect(parseWWWAuthenticateHeader('Bearer realm="example.com"')).toEqual({
+        Bearer: { realm: 'example.com' },
+      })
+    })
+
+    it('parses quoted values with spaces', () => {
+      expect(parseWWWAuthenticateHeader('Bearer realm="my realm"')).toEqual({
+        Bearer: { realm: 'my realm' },
+      })
+    })
+
+    it('parses quoted values with escaped double quotes', () => {
+      expect(
+        parseWWWAuthenticateHeader('Bearer realm="example\\"quoted\\""'),
+      ).toEqual({
+        Bearer: { realm: 'example"quoted"' },
+      })
+    })
+
+    it('parses quoted values with escaped backslash', () => {
+      expect(
+        parseWWWAuthenticateHeader('Bearer realm="path\\\\to\\\\file"'),
+      ).toEqual({
+        Bearer: { realm: 'path\\to\\file' },
+      })
+    })
+
+    it('parses param names with hyphens', () => {
+      expect(
+        parseWWWAuthenticateHeader('Bearer error-uri="https://example.com"'),
+      ).toEqual({
+        Bearer: { 'error-uri': 'https://example.com' },
+      })
+    })
+
+    it('parses param names with underscores', () => {
+      expect(
+        parseWWWAuthenticateHeader('Bearer error_description="test"'),
+      ).toEqual({
+        Bearer: { error_description: 'test' },
+      })
+    })
+
+    it('parses param with numeric value', () => {
+      expect(parseWWWAuthenticateHeader('Bearer max-age=3600')).toEqual({
+        Bearer: { 'max-age': '3600' },
+      })
+    })
+
+    it('parses empty quoted value', () => {
+      expect(parseWWWAuthenticateHeader('Bearer realm=""')).toEqual({
+        Bearer: { realm: '' },
+      })
+    })
+
+    it('parses Basic auth challenge', () => {
+      expect(
+        parseWWWAuthenticateHeader('Basic realm="Access to staging site"'),
+      ).toEqual({
+        Basic: { realm: 'Access to staging site' },
+      })
+    })
+
+    it('parses Bearer with realm', () => {
+      expect(
+        parseWWWAuthenticateHeader('Bearer realm="https://auth.example.com"'),
+      ).toEqual({
+        Bearer: { realm: 'https://auth.example.com' },
+      })
+    })
+
+    it('parses DPoP with algs param', () => {
+      expect(parseWWWAuthenticateHeader('DPoP algs="ES256 RS256"')).toEqual({
+        DPoP: { algs: 'ES256 RS256' },
+      })
+    })
+
+    it('parses Digest auth challenge', () => {
+      const result = parseWWWAuthenticateHeader(
+        'Digest realm="digest-realm", nonce="abc123"',
+      )
+      expect(result).toEqual({
+        Digest: { realm: 'digest-realm', nonce: 'abc123' },
+      })
+    })
+
+    it('handle empty unquoted params', () => {
+      const result = parseWWWAuthenticateHeader('Bearer realm=')
+      expect(result).toEqual({ Bearer: { realm: '' } })
+    })
+
+    it('handle empty params', () => {
+      const result = parseWWWAuthenticateHeader('Bearer realm=""')
+      expect(result).toEqual({ Bearer: { realm: '' } })
+    })
+
+    it('treats scheme-only header as scheme with itself as token68', () => {
+      const result = parseWWWAuthenticateHeader('Basic')
+      expect(result).toEqual({ Basic: {} })
+    })
+
+    it('parses multiple challenges with commas and escaped quotes', () => {
+      const result = parseWWWAuthenticateHeader(
+        `Newauth realm="apps", type=1,\n\t    title="Login to \\"apps\\"", Basic realm="simple"`,
+      )
+      expect(result).toEqual({
+        Newauth: {
+          realm: 'apps',
+          type: '1',
+          title: 'Login to "apps"',
+        },
+        Basic: { realm: 'simple' },
+      })
+    })
+
+    it('parses first challenge before comma', () => {
+      const result = parseWWWAuthenticateHeader(
+        'Basic realm="foo", Bearer realm="bar"',
+      )
+      expect(result).toEqual({
+        Basic: { realm: 'foo' },
+        Bearer: { realm: 'bar' },
+      })
+    })
+  })
+
+  describe('edge cases', () => {
+    it('handles empty string', () => {
+      expect(parseWWWAuthenticateHeader('')).toEqual({})
+    })
+
+    it('handles whitespace-only string', () => {
+      expect(parseWWWAuthenticateHeader('   ')).toEqual({})
+    })
+
+    it('trims whitespace from header', () => {
+      expect(parseWWWAuthenticateHeader('  Bearer realm="test"  ')).toEqual({
+        Bearer: { realm: 'test' },
+      })
+    })
+
+    it('handles commas as quoted param value', () => {
+      expect(
+        parseWWWAuthenticateHeader('Bearer realm="example, with, commas"'),
+      ).toEqual({ Bearer: { realm: 'example, with, commas' } })
+    })
+
+    it('handles multiple challenges with varying whitespace', () => {
+      expect(
+        parseWWWAuthenticateHeader(
+          '  Bearer realm="test"  ,    Basic    rr=               ',
+        ),
+      ).toEqual({
+        Bearer: { realm: 'test' },
+        Basic: { rr: '' },
+      })
+    })
+  })
+
+  describe('invalid challenges', () => {
+    it('parses single challenge with no comma correctly', () => {
+      expect(
+        parseWWWAuthenticateHeader('Bearer realm="oauth" error="invalid"'),
+      ).toEqual(undefined)
+    })
+
+    it('ignores invalid challenges', () => {
+      expect(parseWWWAuthenticateHeader('Bearer realm="unclosed')).toEqual(
+        undefined,
+      )
+    })
+
+    it('handles random text without equals sign as token68', () => {
+      expect(parseWWWAuthenticateHeader('Bearer sometoken')).toEqual({
+        Bearer: 'sometoken',
+      })
+    })
+
+    it('ignores trailing whitespace after scheme', () => {
+      expect(parseWWWAuthenticateHeader('Bearer   ')).toEqual({ Bearer: {} })
+    })
+
+    it('handles duplicate params (last wins)', () => {
+      expect(
+        parseWWWAuthenticateHeader('Bearer realm="first", realm="second"'),
+      ).toEqual({ Bearer: { realm: 'second' } })
+    })
+
+    it('extracts valid param after invalid characters', () => {
+      expect(parseWWWAuthenticateHeader('Bearer realm@foo="bar"')).toEqual({
+        Bearer: { 'realm@foo': 'bar' },
+      })
+    })
+
+    it('ignores param with empty name', () => {
+      expect(parseWWWAuthenticateHeader('Bearer ="value"')).toEqual(undefined)
+    })
+
+    it('handles completely malformed input gracefully', () => {
+      expect(parseWWWAuthenticateHeader('!@#$%')).toEqual({ '!@#$%': {} })
+    })
+
+    it('handles duplicate schemes as invalid', () => {
+      expect(
+        parseWWWAuthenticateHeader('Basic realm="first", Basic realm="second"'),
+      ).toEqual(undefined)
+    })
+
+    it('handles params without scheme as invalid', () => {
+      expect(parseWWWAuthenticateHeader('Bearer, realm="foo"')).toEqual(
+        undefined,
+      )
+    })
+  })
+})

package/src/www-authenticate.ts

@@ -0,0 +1,77 @@
+type WWWAuthenticateParams = { [authParam in string]: string }
+export type WWWAuthenticate = {
+  [authScheme in string]:
+    | string // token68
+    | WWWAuthenticateParams
+}
+
+/**
+ * Returns `undefined` if the header is malformed.
+ */
+export function parseWWWAuthenticateHeader(
+  header?: unknown,
+): undefined | WWWAuthenticate {
+  if (typeof header !== 'string') return undefined
+
+  const wwwAuthenticate: WWWAuthenticate = {}
+
+  // Split over commas, not within quoted strings
+  const trimmedHeader = header.trim()
+  if (!trimmedHeader) return wwwAuthenticate
+
+  const parts = trimmedHeader.split(/,(?=(?:[^"]*"[^"]*")*[^"]*$)/)
+
+  let currentParams: WWWAuthenticateParams | null = null
+
+  for (let part of parts) {
+    // Check if the part starts with an auth scheme
+    const schemeMatch = part.trim().match(/^([^"=\s]+)(\s+.*)?$/)
+    if (schemeMatch) {
+      const scheme = schemeMatch[1]
+
+      // Duplicate scheme
+      if (Object.hasOwn(wwwAuthenticate, scheme)) return undefined
+
+      const rest = schemeMatch[2]?.trim()
+      if (!rest) {
+        // Scheme only (no params or token68)
+        currentParams = null
+        wwwAuthenticate[scheme] = Object.create(null)
+        continue
+      }
+
+      if (!rest.includes('=')) {
+        // Scheme with token68
+        currentParams = null
+        wwwAuthenticate[scheme] = rest
+        continue
+      }
+
+      // Scheme with params
+
+      currentParams = Object.create(null) as WWWAuthenticateParams
+      wwwAuthenticate[scheme] = currentParams
+
+      // Fall through to parse params
+      part = rest
+    }
+
+    // Invalid header
+    if (!currentParams) return undefined
+
+    const param = part.match(
+      /^\s*([^"\s=]+)=(?:("[^"\\]*(?:\\.[^"\\]*)*")|([^\s,"]*))\s*$/,
+    )
+
+    // invalid param
+    if (!param) return undefined
+
+    const paramName = param[1]
+    const paramValue =
+      param[3] ?? param[2]!.slice(1, -1).replaceAll(/\\(.)/g, '$1')
+
+    currentParams[paramName] = paramValue
+  }
+
+  return wwwAuthenticate
+}

package/src/xrpc.ts

@@ -1,12 +1,11 @@
 import { LexValue, isLexScalar, isPlainObject } from '@atproto/lex-data'
 import { lexStringify } from '@atproto/lex-json'
 import {
-  InferMethodInput,
-  InferMethodParams,
+  InferInput,
+  InferPayload,
   Main,
   Params,
-  ParamsSchema,
-  Payload as LexPayload,
+  Payload,
   Procedure,
   Query,
   Restricted,
@@ -14,15 +13,11 @@ import {
   getMain,
 } from '@atproto/lex-schema'
 import { Agent } from './agent.js'
-import {
-  LexRpcResponseError,
-  LexRpcUnexpectedError,
-  LexRpcUpstreamError,
-} from './errors.js'
-import { LexRpcResponse } from './response.js'
+import { XrpcFailure, asXrpcFailure } from './errors.js'
+import { XrpcResponse } from './response.js'
 import { BinaryBodyInit, CallOptions } from './types.js'
 import {
-  Payload,
+  XrpcPayload,
   buildAtprotoHeaders,
   isAsyncIterable,
   isBlobLike,
@@ -30,106 +25,80 @@ import {
 } from './util.js'
 
 // If all params are optional, allow omitting the params object
-type LexRpcParamsOptions<P extends Params> =
+type XrpcParamsOptions<P extends Params> =
   NonNullable<unknown> extends P ? { params?: P } : { params: P }
 
-type LexRpcRequestPayload<M extends Procedure | Query> = InferMethodInput<
-  M,
-  BinaryBodyInit
->
+export type XrpcRequestParams<M extends Procedure | Query | Subscription> =
+  InferInput<M['parameters']>
 
-type LexRpcInputOptions<In> = In extends { body: infer B; encoding: infer E }
+type XrpcRequestPayload<M extends Procedure | Query> = M extends Procedure
+  ? InferPayload<M['input'], BinaryBodyInit>
+  : undefined
+
+type XrpcInputOptions<In> = In extends { body: infer B; encoding: infer E }
   ? // encoding will be inferred from the schema at runtime if not provided
     { body: B; encoding?: E }
   : { body?: undefined; encoding?: undefined }
 
-export type LexRpcOptions<M extends Procedure | Query = Procedure | Query> =
+export type XrpcOptions<M extends Procedure | Query = Procedure | Query> =
   CallOptions &
-    LexRpcInputOptions<LexRpcRequestPayload<M>> &
-    LexRpcParamsOptions<InferMethodParams<M>>
-
-export type LexRpcFailure<M extends Procedure | Query> =
-  // The server returned a valid XRPC error response
-  | LexRpcResponseError<M>
-  // The response was not a valid XRPC response, or it does not match the schema
-  | LexRpcUpstreamError
-  // Something went wrong (network error, etc.)
-  | LexRpcUnexpectedError
-
-export type LexRpcResult<M extends Procedure | Query> =
-  | LexRpcResponse<M>
-  | LexRpcFailure<M>
+    XrpcInputOptions<XrpcRequestPayload<M>> &
+    XrpcParamsOptions<XrpcRequestParams<M>>
 
 /**
- * Utility method to type cast the error thrown by {@link xrpc} to an
- * {@link LexRpcFailure} matching the provided method. Only use this function
- * inside a catch block right after calling {@link xrpc}, and use the same
- * method type parameter as used in the {@link xrpc} call.
- */
-export function asLexRpcFailure<
-  M extends Procedure | Query = Procedure | Query,
->(err: unknown): LexRpcFailure<M> {
-  if (err instanceof LexRpcResponseError) return err
-  if (err instanceof LexRpcUpstreamError) return err
-  return LexRpcUnexpectedError.from(err)
-}
-
-/**
- * @throws LexRpcFailure<M>
+ * @throws XrpcFailure<M>
  */
 export async function xrpc<const M extends Query | Procedure>(
   agent: Agent,
-  ns: NonNullable<unknown> extends LexRpcOptions<M>
+  ns: NonNullable<unknown> extends XrpcOptions<M>
     ? Main<M>
     : Restricted<'This XRPC method requires an "options" argument'>,
-): Promise<LexRpcResponse<M>>
+): Promise<XrpcResponse<M>>
 export async function xrpc<const M extends Query | Procedure>(
   agent: Agent,
   ns: Main<M>,
-  options: LexRpcOptions<M>,
-): Promise<LexRpcResponse<M>>
+  options: XrpcOptions<M>,
+): Promise<XrpcResponse<M>>
 export async function xrpc<const M extends Query | Procedure>(
   agent: Agent,
   ns: Main<M>,
-  options: LexRpcOptions<M> = {} as LexRpcOptions<M>,
-): Promise<LexRpcResponse<M>> {
-  try {
-    return await lexRpcRequest<M>(agent, ns, options)
-  } catch (err) {
-    throw asLexRpcFailure<M>(err)
-  }
+  options: XrpcOptions<M> = {} as XrpcOptions<M>,
+): Promise<XrpcResponse<M>> {
+  const response = await xrpcSafe<M>(agent, ns, options)
+  if (response.success) return response
+  else throw response
 }
 
+export type XrpcResult<M extends Procedure | Query> =
+  | XrpcResponse<M>
+  | XrpcFailure<M>
+
 export async function xrpcSafe<const M extends Query | Procedure>(
   agent: Agent,
-  ns: NonNullable<unknown> extends LexRpcOptions<M>
+  ns: NonNullable<unknown> extends XrpcOptions<M>
     ? Main<M>
     : Restricted<'This XRPC method requires an "options" argument'>,
-): Promise<LexRpcResult<M>>
+): Promise<XrpcResult<M>>
 export async function xrpcSafe<const M extends Query | Procedure>(
   agent: Agent,
   ns: Main<M>,
-  options: LexRpcOptions<M>,
-): Promise<LexRpcResult<M>>
+  options: XrpcOptions<M>,
+): Promise<XrpcResult<M>>
 export async function xrpcSafe<const M extends Query | Procedure>(
   agent: Agent,
   ns: Main<M>,
-  options: LexRpcOptions<M> = {} as LexRpcOptions<M>,
-): Promise<LexRpcResult<M>> {
-  return lexRpcRequest<M>(agent, ns, options).catch(asLexRpcFailure<M>)
-}
-
-async function lexRpcRequest<const M extends Query | Procedure>(
-  agent: Agent,
-  ns: Main<M>,
-  options: LexRpcOptions<M> = {} as LexRpcOptions<M>,
-): Promise<LexRpcResponse<M>> {
-  const method = getMain(ns)
+  options: XrpcOptions<M> = {} as XrpcOptions<M>,
+): Promise<XrpcResult<M>> {
   options.signal?.throwIfAborted()
-  const url = xrpcRequestUrl(method, options)
-  const request = xrpcRequestInit(method, options)
-  const response = await agent.fetchHandler(url, request)
-  return LexRpcResponse.fromFetchResponse<M>(method, response, options)
+  const method: M = getMain(ns)
+  try {
+    const url = xrpcRequestUrl(method, options)
+    const request = xrpcRequestInit(method, options)
+    const response = await agent.fetchHandler(url, request)
+    return await XrpcResponse.fromFetchResponse<M>(method, response, options)
+  } catch (cause) {
+    return asXrpcFailure(method, cause)
+  }
 }
 
 function xrpcRequestUrl<M extends Procedure | Query | Subscription>(
@@ -138,24 +107,13 @@ function xrpcRequestUrl<M extends Procedure | Query | Subscription>(
 ) {
   const path = `/xrpc/${method.nsid}`
 
-  const queryString = options.params
-    ? xrpcRequestParams(method.parameters, options.params, options)
-    : undefined
+  const queryString = method.parameters
+    ?.toURLSearchParams(options.params ?? {})
+    .toString()
 
   return queryString ? `${path}?${queryString}` : path
 }
 
-function xrpcRequestParams(
-  schema: ParamsSchema | undefined,
-  params: Params | undefined,
-  options: CallOptions,
-): undefined | string {
-  const urlSearchParams = schema?.toURLSearchParams(
-    options.validateRequest ? schema.parse(params) : (params as any),
-  )
-  return urlSearchParams?.size ? urlSearchParams.toString() : undefined
-}
-
 function xrpcRequestInit<T extends Procedure | Query>(
   schema: T,
   options: CallOptions & {
@@ -215,7 +173,7 @@ function xrpcProcedureInput(
   method: Procedure,
   options: CallOptions & { body?: LexValue | BinaryBodyInit },
   encodingHint?: string,
-): null | Payload<BodyInit> {
+): null | XrpcPayload<BodyInit> {
   const { input } = method
   const { body } = options
 
@@ -261,10 +219,10 @@ function xrpcProcedureInput(
 }
 
 function buildPayload(
-  schema: LexPayload,
+  schema: Payload,
   body: undefined | BodyInit,
   encodingHint?: string,
-): null | Payload<BodyInit> {
+): null | XrpcPayload<BodyInit> {
   if (schema.encoding === undefined) {
     if (body !== undefined) {
       throw new TypeError(
@@ -286,7 +244,7 @@ function buildPayload(
   return { encoding, body }
 }
 
-function buildEncoding(schema: LexPayload, encodingHint?: string): string {
+function buildEncoding(schema: Payload, encodingHint?: string): string {
   // Should never happen (required for type safety)
   if (!schema.encoding) {
     throw new TypeError('Unexpected payload')