@atproto/lex-server 0.0.1 → 0.0.3

package/dist/service-auth.d.ts

@@ -0,0 +1,67 @@
+import { AtprotoDid, AtprotoDidDocument } from '@atproto/did';
+import { DidString } from '@atproto/lex-schema';
+import { CreateDidResolverOptions } from '@atproto-labs/did-resolver';
+import { LexRouterAuth } from './lex-server.js';
+/**
+ * A function to check and record nonce uniqueness.
+ */
+export type UniqueNonceChecker = (nonce: string) => Promise<boolean>;
+export type ServiceAuthOptions = CreateDidResolverOptions & {
+    /**
+     * Expected audience ("aud") claim in the JWT token. Set to `null` to skip
+     * audience verification (not recommended).
+     */
+    audience: null | DidString;
+    /**
+     * Function to check and record nonce uniqueness. The value checked here must
+     * be unique within {@link ServiceAuthOptions.maxAge} seconds before and after
+     * the current time.
+     *
+     * @param nonce - The nonce to check.
+     */
+    unique: UniqueNonceChecker;
+    /**
+     * Maximum age of the JWT token in seconds.
+     *
+     * @default 300 (5 minutes)
+     */
+    maxAge?: number;
+};
+export type ServiceAuthCredentials = {
+    did: AtprotoDid;
+    didDocument: AtprotoDidDocument;
+    jwt: ParsedJwt;
+};
+/**
+ * Creates an authentication handler for LexRouter that verifies AT protocol
+ * "service auth" JWT bearer tokens signed by decentralized identifiers (DIDs).
+ */
+export declare function serviceAuth({ audience, maxAge, unique, ...options }: ServiceAuthOptions): LexRouterAuth<ServiceAuthCredentials>;
+export type ParseJwtOptions = {
+    maxAge: number;
+    audience: null | DidString;
+    unique: UniqueNonceChecker;
+    lxm: string;
+};
+export type ParsedJwt = {
+    header: HeaderObject;
+    payload: PayloadObject;
+    message: Uint8Array;
+    signature: Uint8Array;
+};
+type HeaderObject = {
+    alg: string;
+    typ?: string;
+};
+type PayloadObject = {
+    iss: DidString;
+    aud: DidString;
+    exp: number;
+    iat?: number;
+    nbf?: number;
+    lxm?: string;
+    nonce?: string;
+};
+export declare function isPayloadObject(obj: unknown): obj is PayloadObject;
+export {};
+//# sourceMappingURL=service-auth.d.ts.map

package/dist/service-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-auth.d.ts","sourceRoot":"","sources":["../src/service-auth.ts"],"names":[],"mappings":"AACA,OAAO,EACL,UAAU,EACV,kBAAkB,EAGnB,MAAM,cAAc,CAAA;AAErB,OAAO,EAAE,SAAS,EAAe,MAAM,qBAAqB,CAAA;AAC5D,OAAO,EACL,wBAAwB,EAEzB,MAAM,4BAA4B,CAAA;AAEnC,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAI/C;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;AAEpE,MAAM,MAAM,kBAAkB,GAAG,wBAAwB,GAAG;IAC1D;;;OAGG;IACH,QAAQ,EAAE,IAAI,GAAG,SAAS,CAAA;IAC1B;;;;;;OAMG;IACH,MAAM,EAAE,kBAAkB,CAAA;IAC1B;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,sBAAsB,GAAG;IACnC,GAAG,EAAE,UAAU,CAAA;IACf,WAAW,EAAE,kBAAkB,CAAA;IAC/B,GAAG,EAAE,SAAS,CAAA;CACf,CAAA;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,EAC1B,QAAQ,EACR,MAAe,EACf,MAAM,EACN,GAAG,OAAO,EACX,EAAE,kBAAkB,GAAG,aAAa,CAAC,sBAAsB,CAAC,CAyD5D;AA2ED,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,IAAI,GAAG,SAAS,CAAA;IAC1B,MAAM,EAAE,kBAAkB,CAAA;IAC1B,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,MAAM,EAAE,YAAY,CAAA;IACpB,OAAO,EAAE,aAAa,CAAA;IACtB,OAAO,EAAE,UAAU,CAAA;IACnB,SAAS,EAAE,UAAU,CAAA;CACtB,CAAA;AA4HD,KAAK,YAAY,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AASjD,KAAK,aAAa,GAAG;IACnB,GAAG,EAAE,SAAS,CAAA;IACd,GAAG,EAAE,SAAS,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AACD,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,aAAa,CAalE"}

package/dist/service-auth.js

@@ -0,0 +1,191 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.serviceAuth = serviceAuth;
+exports.isPayloadObject = isPayloadObject;
+const tslib_1 = require("tslib");
+const crypto = tslib_1.__importStar(require("@atproto/crypto"));
+const did_1 = require("@atproto/did");
+const lex_data_1 = require("@atproto/lex-data");
+const lex_schema_1 = require("@atproto/lex-schema");
+const did_resolver_1 = require("@atproto-labs/did-resolver");
+const errors_js_1 = require("./errors.js");
+const BEARER_PREFIX = 'Bearer ';
+/**
+ * Creates an authentication handler for LexRouter that verifies AT protocol
+ * "service auth" JWT bearer tokens signed by decentralized identifiers (DIDs).
+ */
+function serviceAuth({ audience, maxAge = 5 * 60, unique, ...options }) {
+    const didResolver = (0, did_resolver_1.createDidResolver)(options);
+    return async ({ request, method }) => {
+        const { signal } = request;
+        const jwt = await parseJwtBearer(request, {
+            lxm: method.nsid,
+            maxAge,
+            audience,
+            unique,
+        });
+        let didDocument = await didResolver
+            .resolve(jwt.payload.iss, { signal })
+            .catch((cause) => {
+            throw new errors_js_1.LexServerAuthError('AuthenticationRequired', 'Could not resolve DID document', { Bearer: { error: 'DidResolutionFailed' } }, { cause });
+        });
+        const key = getAtprotoSigningKey(didDocument);
+        if (!key || !(await verifyJwt(jwt, key))) {
+            signal.throwIfAborted();
+            // Try refreshing the DID document in case it was updated
+            didDocument = await didResolver
+                .resolve(jwt.payload.iss, { signal, noCache: true })
+                .catch((cause) => {
+                throw new errors_js_1.LexServerAuthError('AuthenticationRequired', 'Could not resolve DID document', { Bearer: { error: 'DidResolutionFailed' } }, { cause });
+            });
+            // Verify again with the fresh key (if it changed)
+            const keyFresh = getAtprotoSigningKey(didDocument);
+            if (!keyFresh || key === keyFresh || !(await verifyJwt(jwt, keyFresh))) {
+                throw new errors_js_1.LexServerAuthError('AuthenticationRequired', 'Invalid JWT signature', { Bearer: { error: 'BadJwtSignature' } });
+            }
+        }
+        return {
+            did: didDocument.id,
+            didDocument,
+            jwt,
+        };
+    };
+}
+async function verifyJwt(jwt, key) {
+    try {
+        return await crypto.verifySignature(key, jwt.message, jwt.signature, {
+            jwtAlg: jwt.header.alg,
+            allowMalleableSig: true,
+        });
+    }
+    catch (cause) {
+        throw new errors_js_1.LexServerAuthError('AuthenticationRequired', 'Could not verify JWT signature', { Bearer: { error: 'BadJwtSignature' } }, { cause });
+    }
+}
+function getAtprotoSigningKey(didDocument) {
+    try {
+        const key = didDocument.verificationMethod?.find(isAtprotoVerificationMethod, didDocument);
+        if (key?.publicKeyMultibase) {
+            if (key.type === 'EcdsaSecp256r1VerificationKey2019') {
+                const keyBytes = crypto.multibaseToBytes(key.publicKeyMultibase);
+                return crypto.formatDidKey(crypto.P256_JWT_ALG, keyBytes);
+            }
+            else if (key.type === 'EcdsaSecp256k1VerificationKey2019') {
+                const keyBytes = crypto.multibaseToBytes(key.publicKeyMultibase);
+                return crypto.formatDidKey(crypto.SECP256K1_JWT_ALG, keyBytes);
+            }
+            else if (key.type === 'Multikey') {
+                const parsed = crypto.parseMultikey(key.publicKeyMultibase);
+                return crypto.formatDidKey(parsed.jwtAlg, parsed.keyBytes);
+            }
+        }
+    }
+    catch {
+        // Invalid key, ignore
+    }
+    return null;
+}
+function isAtprotoVerificationMethod(vm) {
+    return typeof vm === 'object' && (0, did_1.matchesIdentifier)(this.id, 'atproto', vm.id);
+}
+async function parseJwtBearer(request, options) {
+    const authorization = request.headers.get('authorization');
+    if (!authorization?.startsWith(BEARER_PREFIX)) {
+        throw new errors_js_1.LexServerAuthError('AuthenticationRequired', 'Bearer token required', { Bearer: { error: 'MissingBearer' } });
+    }
+    const token = authorization.slice(BEARER_PREFIX.length).trim();
+    return parseJwt(token, options);
+}
+async function parseJwt(token, options) {
+    const { length, 0: headerB64, 1: payloadB64, 2: signatureB64, } = token.split('.');
+    if (length !== 3) {
+        throw new errors_js_1.LexServerAuthError('AuthenticationRequired', 'Invalid JWT token', { Bearer: { error: 'BadJwt' } });
+    }
+    let header;
+    try {
+        header = jsonFromBase64(headerB64, isHeaderObject);
+    }
+    catch (cause) {
+        throw new errors_js_1.LexServerAuthError('AuthenticationRequired', 'Invalid JWT token', { Bearer: { error: 'BadJwt' } }, { cause });
+    }
+    if (header.alg === 'none' ||
+        // service tokens are not OAuth 2.0 access tokens
+        // https://datatracker.ietf.org/doc/html/rfc9068
+        header.typ === 'at+jwt' ||
+        // "refresh+jwt" is a non-standard type used by the @atproto packages
+        header.typ === 'refresh+jwt' ||
+        // "DPoP" proofs are not meant to be used as service tokens
+        // https://datatracker.ietf.org/doc/html/rfc9449
+        header.typ === 'dpop+jwt') {
+        throw new errors_js_1.LexServerAuthError('AuthenticationRequired', 'Invalid JWT token', { Bearer: { error: 'BadJwt' } });
+    }
+    let payload;
+    try {
+        payload = jsonFromBase64(payloadB64, isPayloadObject);
+    }
+    catch (cause) {
+        throw new errors_js_1.LexServerAuthError('AuthenticationRequired', 'Invalid JWT token', { Bearer: { error: 'BadJwt' } }, { cause });
+    }
+    if (options.audience !== null && options.audience !== payload.aud) {
+        throw new errors_js_1.LexServerAuthError('AuthenticationRequired', 'Invalid audience', {
+            Bearer: { error: 'InvalidAudience' },
+        });
+    }
+    const now = Math.floor(Date.now() / 1000);
+    if (payload.nbf != null && now < payload.nbf) {
+        throw new errors_js_1.LexServerAuthError('AuthenticationRequired', 'JWT token not yet valid', { Bearer: { error: 'JwtNotYetValid' } });
+    }
+    if (now > payload.exp) {
+        throw new errors_js_1.LexServerAuthError('AuthenticationRequired', 'JWT token expired', { Bearer: { error: 'JwtExpired' } });
+    }
+    // Prevent issuer from generating very long-lived tokens
+    if (timeDiff(now, payload.exp) > options.maxAge ||
+        timeDiff(now, payload.iat) > options.maxAge) {
+        throw new errors_js_1.LexServerAuthError('AuthenticationRequired', 'JWT token too old', { Bearer: { error: 'JwtTooOld' } });
+    }
+    if (payload.lxm != null && typeof payload.lxm !== options.lxm) {
+        throw new errors_js_1.LexServerAuthError('AuthenticationRequired', 'Invalid JWT lexicon method ("lxm")', { Bearer: { error: 'BadJwtLexiconMethod' } });
+    }
+    if (payload.nonce != null && !(await (0, options.unique)(payload.nonce))) {
+        throw new errors_js_1.LexServerAuthError('AuthenticationRequired', 'Replay attack detected: nonce is not unique', { Bearer: { error: 'NonceNotUnique' } });
+    }
+    return {
+        header,
+        payload,
+        message: textEncoder.encode(`${headerB64}.${payloadB64}`),
+        signature: (0, lex_data_1.fromBase64)(signatureB64, 'base64url'),
+    };
+}
+const textEncoder = /*#__PURE__*/ new TextEncoder();
+function isHeaderObject(obj) {
+    return ((0, lex_data_1.isPlainObject)(obj) &&
+        typeof obj.alg === 'string' &&
+        (obj.typ === undefined || typeof obj.typ === 'string'));
+}
+function isPayloadObject(obj) {
+    return ((0, lex_data_1.isPlainObject)(obj) &&
+        typeof obj.iss === 'string' &&
+        typeof obj.aud === 'string' &&
+        (obj.lxm === undefined || typeof obj.lxm === 'string') &&
+        (obj.nonce === undefined || typeof obj.nonce === 'string') &&
+        (obj.iat === undefined || isPositiveInt(obj.iat)) &&
+        (obj.nbf === undefined || isPositiveInt(obj.nbf)) &&
+        isPositiveInt(obj.exp) &&
+        (0, lex_schema_1.isDidString)(obj.iss) &&
+        (0, lex_schema_1.isDidString)(obj.aud));
+}
+function timeDiff(t1, t2) {
+    if (t2 === undefined)
+        return 0;
+    return Math.abs(t1 - t2);
+}
+function isPositiveInt(value) {
+    return typeof value === 'number' && Number.isInteger(value) && value > 0;
+}
+function jsonFromBase64(b64, isType) {
+    const obj = JSON.parse((0, lex_data_1.utf8FromBase64)(b64, 'base64url'));
+    if (isType(obj))
+        return obj;
+    throw new Error('Invalid type');
+}
+//# sourceMappingURL=service-auth.js.map

package/dist/service-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-auth.js","sourceRoot":"","sources":["../src/service-auth.ts"],"names":[],"mappings":";;AAuDA,kCA8DC;AAqOD,0CAaC;;AAvWD,gEAAyC;AACzC,sCAKqB;AACrB,gDAA6E;AAC7E,oDAA4D;AAC5D,6DAGmC;AACnC,2CAAgD;AAGhD,MAAM,aAAa,GAAG,SAAS,CAAA;AAmC/B;;;GAGG;AACH,SAAgB,WAAW,CAAC,EAC1B,QAAQ,EACR,MAAM,GAAG,CAAC,GAAG,EAAE,EACf,MAAM,EACN,GAAG,OAAO,EACS;IACnB,MAAM,WAAW,GAAG,IAAA,gCAAiB,EAAC,OAAO,CAAC,CAAA;IAE9C,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;QACnC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;QAC1B,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE;YACxC,GAAG,EAAE,MAAM,CAAC,IAAI;YAChB,MAAM;YACN,QAAQ;YACR,MAAM;SACP,CAAC,CAAA;QAEF,IAAI,WAAW,GAAuB,MAAM,WAAW;aACpD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC;aACpC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,IAAI,8BAAkB,CAC1B,wBAAwB,EACxB,gCAAgC,EAChC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,EAC5C,EAAE,KAAK,EAAE,CACV,CAAA;QACH,CAAC,CAAC,CAAA;QAEJ,MAAM,GAAG,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAA;QAE7C,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YACzC,MAAM,CAAC,cAAc,EAAE,CAAA;YAEvB,yDAAyD;YACzD,WAAW,GAAG,MAAM,WAAW;iBAC5B,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;iBACnD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACf,MAAM,IAAI,8BAAkB,CAC1B,wBAAwB,EACxB,gCAAgC,EAChC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,EAC5C,EAAE,KAAK,EAAE,CACV,CAAA;YACH,CAAC,CAAC,CAAA;YAEJ,kDAAkD;YAClD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAA;YAClD,IAAI,CAAC,QAAQ,IAAI,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;gBACvE,MAAM,IAAI,8BAAkB,CAC1B,wBAAwB,EACxB,uBAAuB,EACvB,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,CACzC,CAAA;YACH,CAAC;QACH,CAAC;QAED,OAAO;YACL,GAAG,EAAE,WAAW,CAAC,EAAE;YACnB,WAAW;YACX,GAAG;SACJ,CAAA;IACH,CAAC,CAAA;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAc,EAAE,GAAe;IACtD,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE;YACnE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG;YACtB,iBAAiB,EAAE,IAAI;SACxB,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,8BAAkB,CAC1B,wBAAwB,EACxB,gCAAgC,EAChC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EACxC,EAAE,KAAK,EAAE,CACV,CAAA;IACH,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,WAA+B;IAE/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,WAAW,CAAC,kBAAkB,EAAE,IAAI,CAC9C,2BAA2B,EAC3B,WAAW,CACZ,CAAA;QAED,IAAI,GAAG,EAAE,kBAAkB,EAAE,CAAC;YAC5B,IAAI,GAAG,CAAC,IAAI,KAAK,mCAAmC,EAAE,CAAC;gBACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;gBAChE,OAAO,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;YAC3D,CAAC;iBAAM,IAAI,GAAG,CAAC,IAAI,KAAK,mCAAmC,EAAE,CAAC;gBAC5D,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;gBAChE,OAAO,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAA;YAChE,CAAC;iBAAM,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBACnC,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;gBAC3D,OAAO,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;YAC5D,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sBAAsB;IACxB,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,2BAA2B,CAIlC,EAAK;IAIL,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,IAAA,uBAAiB,EAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,CAAA;AAC/E,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,OAAgB,EAChB,OAAwB;IAExB,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IAC1D,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,8BAAkB,CAC1B,wBAAwB,EACxB,uBAAuB,EACvB,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,CACvC,CAAA;IACH,CAAC;IAED,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;IAE9D,OAAO,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;AACjC,CAAC;AAgBD,KAAK,UAAU,QAAQ,CACrB,KAAa,EACb,OAAwB;IAExB,MAAM,EACJ,MAAM,EACN,CAAC,EAAE,SAAS,EACZ,CAAC,EAAE,UAAU,EACb,CAAC,EAAE,YAAY,GAChB,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACpB,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,8BAAkB,CAC1B,wBAAwB,EACxB,mBAAmB,EACnB,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAChC,CAAA;IACH,CAAC;IAED,IAAI,MAAoB,CAAA;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,8BAAkB,CAC1B,wBAAwB,EACxB,mBAAmB,EACnB,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAC/B,EAAE,KAAK,EAAE,CACV,CAAA;IACH,CAAC;IAED,IACE,MAAM,CAAC,GAAG,KAAK,MAAM;QACrB,iDAAiD;QACjD,gDAAgD;QAChD,MAAM,CAAC,GAAG,KAAK,QAAQ;QACvB,qEAAqE;QACrE,MAAM,CAAC,GAAG,KAAK,aAAa;QAC5B,2DAA2D;QAC3D,gDAAgD;QAChD,MAAM,CAAC,GAAG,KAAK,UAAU,EACzB,CAAC;QACD,MAAM,IAAI,8BAAkB,CAC1B,wBAAwB,EACxB,mBAAmB,EACnB,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAChC,CAAA;IACH,CAAC;IAED,IAAI,OAAsB,CAAA;IAC1B,IAAI,CAAC;QACH,OAAO,GAAG,cAAc,CAAC,UAAU,EAAE,eAAe,CAAC,CAAA;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,8BAAkB,CAC1B,wBAAwB,EACxB,mBAAmB,EACnB,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAC/B,EAAE,KAAK,EAAE,CACV,CAAA;IACH,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;QAClE,MAAM,IAAI,8BAAkB,CAAC,wBAAwB,EAAE,kBAAkB,EAAE;YACzE,MAAM,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE;SACrC,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IAEzC,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC7C,MAAM,IAAI,8BAAkB,CAC1B,wBAAwB,EACxB,yBAAyB,EACzB,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,CACxC,CAAA;IACH,CAAC;IAED,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QACtB,MAAM,IAAI,8BAAkB,CAC1B,wBAAwB,EACxB,mBAAmB,EACnB,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CACpC,CAAA;IACH,CAAC;IAED,wDAAwD;IACxD,IACE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM;QAC3C,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAC3C,CAAC;QACD,MAAM,IAAI,8BAAkB,CAC1B,wBAAwB,EACxB,mBAAmB,EACnB,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CACnC,CAAA;IACH,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;QAC9D,MAAM,IAAI,8BAAkB,CAC1B,wBAAwB,EACxB,oCAAoC,EACpC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,CAC7C,CAAA;IACH,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,8BAAkB,CAC1B,wBAAwB,EACxB,6CAA6C,EAC7C,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,CACxC,CAAA;IACH,CAAC;IAED,OAAO;QACL,MAAM;QACN,OAAO;QACP,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;QACzD,SAAS,EAAE,IAAA,qBAAU,EAAC,YAAY,EAAE,WAAW,CAAC;KACjD,CAAA;AACH,CAAC;AAED,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,WAAW,EAAE,CAAA;AAGnD,SAAS,cAAc,CAAC,GAAY;IAClC,OAAO,CACL,IAAA,wBAAa,EAAC,GAAG,CAAC;QAClB,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;QAC3B,CAAC,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,CACvD,CAAA;AACH,CAAC;AAWD,SAAgB,eAAe,CAAC,GAAY;IAC1C,OAAO,CACL,IAAA,wBAAa,EAAC,GAAG,CAAC;QAClB,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;QAC3B,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;QAC3B,CAAC,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC;QACtD,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC;QAC1D,CAAC,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjD,CAAC,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjD,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC;QACtB,IAAA,wBAAW,EAAC,GAAG,CAAC,GAAG,CAAC;QACpB,IAAA,wBAAW,EAAC,GAAG,CAAC,GAAG,CAAC,CACrB,CAAA;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,EAAU,EAAE,EAAW;IACvC,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,CAAC,CAAA;IAC9B,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;AAC1B,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAA;AAC1E,CAAC;AAED,SAAS,cAAc,CAAI,GAAW,EAAE,MAAkC;IACxE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,yBAAc,EAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAA;IACxD,IAAI,MAAM,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAA;IAC3B,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAA;AACjC,CAAC","sourcesContent":["import * as crypto from '@atproto/crypto'\nimport {\n  AtprotoDid,\n  AtprotoDidDocument,\n  Did,\n  matchesIdentifier,\n} from '@atproto/did'\nimport { fromBase64, isPlainObject, utf8FromBase64 } from '@atproto/lex-data'\nimport { DidString, isDidString } from '@atproto/lex-schema'\nimport {\n  CreateDidResolverOptions,\n  createDidResolver,\n} from '@atproto-labs/did-resolver'\nimport { LexServerAuthError } from './errors.js'\nimport { LexRouterAuth } from './lex-server.js'\n\nconst BEARER_PREFIX = 'Bearer '\n\n/**\n * A function to check and record nonce uniqueness.\n */\nexport type UniqueNonceChecker = (nonce: string) => Promise<boolean>\n\nexport type ServiceAuthOptions = CreateDidResolverOptions & {\n  /**\n   * Expected audience (\"aud\") claim in the JWT token. Set to `null` to skip\n   * audience verification (not recommended).\n   */\n  audience: null | DidString\n  /**\n   * Function to check and record nonce uniqueness. The value checked here must\n   * be unique within {@link ServiceAuthOptions.maxAge} seconds before and after\n   * the current time.\n   *\n   * @param nonce - The nonce to check.\n   */\n  unique: UniqueNonceChecker\n  /**\n   * Maximum age of the JWT token in seconds.\n   *\n   * @default 300 (5 minutes)\n   */\n  maxAge?: number\n}\n\nexport type ServiceAuthCredentials = {\n  did: AtprotoDid\n  didDocument: AtprotoDidDocument\n  jwt: ParsedJwt\n}\n\n/**\n * Creates an authentication handler for LexRouter that verifies AT protocol\n * \"service auth\" JWT bearer tokens signed by decentralized identifiers (DIDs).\n */\nexport function serviceAuth({\n  audience,\n  maxAge = 5 * 60,\n  unique,\n  ...options\n}: ServiceAuthOptions): LexRouterAuth<ServiceAuthCredentials> {\n  const didResolver = createDidResolver(options)\n\n  return async ({ request, method }) => {\n    const { signal } = request\n    const jwt = await parseJwtBearer(request, {\n      lxm: method.nsid,\n      maxAge,\n      audience,\n      unique,\n    })\n\n    let didDocument: AtprotoDidDocument = await didResolver\n      .resolve(jwt.payload.iss, { signal })\n      .catch((cause) => {\n        throw new LexServerAuthError(\n          'AuthenticationRequired',\n          'Could not resolve DID document',\n          { Bearer: { error: 'DidResolutionFailed' } },\n          { cause },\n        )\n      })\n\n    const key = getAtprotoSigningKey(didDocument)\n\n    if (!key || !(await verifyJwt(jwt, key))) {\n      signal.throwIfAborted()\n\n      // Try refreshing the DID document in case it was updated\n      didDocument = await didResolver\n        .resolve(jwt.payload.iss, { signal, noCache: true })\n        .catch((cause) => {\n          throw new LexServerAuthError(\n            'AuthenticationRequired',\n            'Could not resolve DID document',\n            { Bearer: { error: 'DidResolutionFailed' } },\n            { cause },\n          )\n        })\n\n      // Verify again with the fresh key (if it changed)\n      const keyFresh = getAtprotoSigningKey(didDocument)\n      if (!keyFresh || key === keyFresh || !(await verifyJwt(jwt, keyFresh))) {\n        throw new LexServerAuthError(\n          'AuthenticationRequired',\n          'Invalid JWT signature',\n          { Bearer: { error: 'BadJwtSignature' } },\n        )\n      }\n    }\n\n    return {\n      did: didDocument.id,\n      didDocument,\n      jwt,\n    }\n  }\n}\n\nasync function verifyJwt(jwt: ParsedJwt, key: Did<'key'>) {\n  try {\n    return await crypto.verifySignature(key, jwt.message, jwt.signature, {\n      jwtAlg: jwt.header.alg,\n      allowMalleableSig: true,\n    })\n  } catch (cause) {\n    throw new LexServerAuthError(\n      'AuthenticationRequired',\n      'Could not verify JWT signature',\n      { Bearer: { error: 'BadJwtSignature' } },\n      { cause },\n    )\n  }\n}\n\nfunction getAtprotoSigningKey(\n  didDocument: AtprotoDidDocument,\n): null | Did<'key'> {\n  try {\n    const key = didDocument.verificationMethod?.find(\n      isAtprotoVerificationMethod,\n      didDocument,\n    )\n\n    if (key?.publicKeyMultibase) {\n      if (key.type === 'EcdsaSecp256r1VerificationKey2019') {\n        const keyBytes = crypto.multibaseToBytes(key.publicKeyMultibase)\n        return crypto.formatDidKey(crypto.P256_JWT_ALG, keyBytes)\n      } else if (key.type === 'EcdsaSecp256k1VerificationKey2019') {\n        const keyBytes = crypto.multibaseToBytes(key.publicKeyMultibase)\n        return crypto.formatDidKey(crypto.SECP256K1_JWT_ALG, keyBytes)\n      } else if (key.type === 'Multikey') {\n        const parsed = crypto.parseMultikey(key.publicKeyMultibase)\n        return crypto.formatDidKey(parsed.jwtAlg, parsed.keyBytes)\n      }\n    }\n  } catch {\n    // Invalid key, ignore\n  }\n\n  return null\n}\n\nfunction isAtprotoVerificationMethod<\n  V extends string | { id: string; type: string; publicKeyMultibase?: string },\n>(\n  this: AtprotoDidDocument,\n  vm: V,\n): vm is Exclude<V, string> & {\n  id: `${string}#atproto`\n} {\n  return typeof vm === 'object' && matchesIdentifier(this.id, 'atproto', vm.id)\n}\n\nasync function parseJwtBearer(\n  request: Request,\n  options: ParseJwtOptions,\n): Promise<ParsedJwt> {\n  const authorization = request.headers.get('authorization')\n  if (!authorization?.startsWith(BEARER_PREFIX)) {\n    throw new LexServerAuthError(\n      'AuthenticationRequired',\n      'Bearer token required',\n      { Bearer: { error: 'MissingBearer' } },\n    )\n  }\n\n  const token = authorization.slice(BEARER_PREFIX.length).trim()\n\n  return parseJwt(token, options)\n}\n\nexport type ParseJwtOptions = {\n  maxAge: number\n  audience: null | DidString\n  unique: UniqueNonceChecker\n  lxm: string\n}\n\nexport type ParsedJwt = {\n  header: HeaderObject\n  payload: PayloadObject\n  message: Uint8Array\n  signature: Uint8Array\n}\n\nasync function parseJwt(\n  token: string,\n  options: ParseJwtOptions,\n): Promise<ParsedJwt> {\n  const {\n    length,\n    0: headerB64,\n    1: payloadB64,\n    2: signatureB64,\n  } = token.split('.')\n  if (length !== 3) {\n    throw new LexServerAuthError(\n      'AuthenticationRequired',\n      'Invalid JWT token',\n      { Bearer: { error: 'BadJwt' } },\n    )\n  }\n\n  let header: HeaderObject\n  try {\n    header = jsonFromBase64(headerB64, isHeaderObject)\n  } catch (cause) {\n    throw new LexServerAuthError(\n      'AuthenticationRequired',\n      'Invalid JWT token',\n      { Bearer: { error: 'BadJwt' } },\n      { cause },\n    )\n  }\n\n  if (\n    header.alg === 'none' ||\n    // service tokens are not OAuth 2.0 access tokens\n    // https://datatracker.ietf.org/doc/html/rfc9068\n    header.typ === 'at+jwt' ||\n    // \"refresh+jwt\" is a non-standard type used by the @atproto packages\n    header.typ === 'refresh+jwt' ||\n    // \"DPoP\" proofs are not meant to be used as service tokens\n    // https://datatracker.ietf.org/doc/html/rfc9449\n    header.typ === 'dpop+jwt'\n  ) {\n    throw new LexServerAuthError(\n      'AuthenticationRequired',\n      'Invalid JWT token',\n      { Bearer: { error: 'BadJwt' } },\n    )\n  }\n\n  let payload: PayloadObject\n  try {\n    payload = jsonFromBase64(payloadB64, isPayloadObject)\n  } catch (cause) {\n    throw new LexServerAuthError(\n      'AuthenticationRequired',\n      'Invalid JWT token',\n      { Bearer: { error: 'BadJwt' } },\n      { cause },\n    )\n  }\n\n  if (options.audience !== null && options.audience !== payload.aud) {\n    throw new LexServerAuthError('AuthenticationRequired', 'Invalid audience', {\n      Bearer: { error: 'InvalidAudience' },\n    })\n  }\n\n  const now = Math.floor(Date.now() / 1000)\n\n  if (payload.nbf != null && now < payload.nbf) {\n    throw new LexServerAuthError(\n      'AuthenticationRequired',\n      'JWT token not yet valid',\n      { Bearer: { error: 'JwtNotYetValid' } },\n    )\n  }\n\n  if (now > payload.exp) {\n    throw new LexServerAuthError(\n      'AuthenticationRequired',\n      'JWT token expired',\n      { Bearer: { error: 'JwtExpired' } },\n    )\n  }\n\n  // Prevent issuer from generating very long-lived tokens\n  if (\n    timeDiff(now, payload.exp) > options.maxAge ||\n    timeDiff(now, payload.iat) > options.maxAge\n  ) {\n    throw new LexServerAuthError(\n      'AuthenticationRequired',\n      'JWT token too old',\n      { Bearer: { error: 'JwtTooOld' } },\n    )\n  }\n\n  if (payload.lxm != null && typeof payload.lxm !== options.lxm) {\n    throw new LexServerAuthError(\n      'AuthenticationRequired',\n      'Invalid JWT lexicon method (\"lxm\")',\n      { Bearer: { error: 'BadJwtLexiconMethod' } },\n    )\n  }\n\n  if (payload.nonce != null && !(await (0, options.unique)(payload.nonce))) {\n    throw new LexServerAuthError(\n      'AuthenticationRequired',\n      'Replay attack detected: nonce is not unique',\n      { Bearer: { error: 'NonceNotUnique' } },\n    )\n  }\n\n  return {\n    header,\n    payload,\n    message: textEncoder.encode(`${headerB64}.${payloadB64}`),\n    signature: fromBase64(signatureB64, 'base64url'),\n  }\n}\n\nconst textEncoder = /*#__PURE__*/ new TextEncoder()\n\ntype HeaderObject = { alg: string; typ?: string }\nfunction isHeaderObject(obj: unknown): obj is HeaderObject {\n  return (\n    isPlainObject(obj) &&\n    typeof obj.alg === 'string' &&\n    (obj.typ === undefined || typeof obj.typ === 'string')\n  )\n}\n\ntype PayloadObject = {\n  iss: DidString\n  aud: DidString\n  exp: number\n  iat?: number\n  nbf?: number\n  lxm?: string\n  nonce?: string\n}\nexport function isPayloadObject(obj: unknown): obj is PayloadObject {\n  return (\n    isPlainObject(obj) &&\n    typeof obj.iss === 'string' &&\n    typeof obj.aud === 'string' &&\n    (obj.lxm === undefined || typeof obj.lxm === 'string') &&\n    (obj.nonce === undefined || typeof obj.nonce === 'string') &&\n    (obj.iat === undefined || isPositiveInt(obj.iat)) &&\n    (obj.nbf === undefined || isPositiveInt(obj.nbf)) &&\n    isPositiveInt(obj.exp) &&\n    isDidString(obj.iss) &&\n    isDidString(obj.aud)\n  )\n}\n\nfunction timeDiff(t1: number, t2?: number): number {\n  if (t2 === undefined) return 0\n  return Math.abs(t1 - t2)\n}\n\nfunction isPositiveInt(value: unknown): value is number {\n  return typeof value === 'number' && Number.isInteger(value) && value > 0\n}\n\nfunction jsonFromBase64<T>(b64: string, isType: (obj: unknown) => obj is T): T {\n  const obj = JSON.parse(utf8FromBase64(b64, 'base64url'))\n  if (isType(obj)) return obj\n  throw new Error('Invalid type')\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atproto/lex-server",
-  "version": "0.0.1",
+  "version": "0.0.3",
   "license": "MIT",
   "description": "Request router for Atproto Lexicon protocols and schemas",
   "keywords": [
@@ -45,17 +45,20 @@
     "http-terminator": "^3.2.0",
     "tslib": "^2.8.1",
     "ws": "^8.18.3",
-    "@atproto/lex-cbor": "0.0.5",
-    "@atproto/lex-data": "0.0.5",
-    "@atproto/lex-schema": "0.0.6",
-    "@atproto/lex-json": "0.0.5"
+    "@atproto-labs/did-resolver": "0.2.5",
+    "@atproto/crypto": "0.4.5",
+    "@atproto/did": "0.2.4",
+    "@atproto/lex-cbor": "0.0.6",
+    "@atproto/lex-data": "0.0.6",
+    "@atproto/lex-json": "0.0.6",
+    "@atproto/lex-schema": "0.0.7"
   },
   "devDependencies": {
     "@types/ws": "^8.18.1",
     "@vitest/coverage-v8": "4.0.16",
     "vitest": "^4.0.16",
-    "@atproto/lex": "0.0.8",
-    "@atproto/lex-client": "0.0.6"
+    "@atproto/lex": "0.0.9",
+    "@atproto/lex-client": "0.0.7"
   },
   "scripts": {
     "build": "tsc --build tsconfig.build.json",

package/src/index.ts

@@ -6,3 +6,4 @@ export {
 
 export * from './errors.js'
 export * from './lex-server.js'
+export * from './service-auth.js'

package/src/lex-server.test.ts

@@ -287,7 +287,7 @@ describe('Authentication', () => {
   function createBasicAuth(allowed: {
     username: string
     password: string
-  }): LexRouterAuth<typeof io.example.authTest, BasicAuthCredentials> {
+  }): LexRouterAuth<BasicAuthCredentials> {
     return async ({ request }) => {
       const header = request.headers.get('authorization') ?? ''
       if (!header.startsWith('Basic ')) {
@@ -1514,7 +1514,7 @@ describe('Subscription', () => {
 
     const router = new LexRouter({ upgradeWebSocket }).add(
       io.example.subscribe,
-      async function* ({ params: { message }, request: { signal } }) {
+      async function* ({ params: { message }, signal }) {
         try {
           for (; sentCount < 10; ) {
             await scheduler.wait(5, { signal })

package/src/lex-server.ts

@@ -18,7 +18,8 @@ import {
 } from '@atproto/lex-schema'
 import { drainWebsocket } from './lib/drain-websocket.js'
 
-type LexMethod = Query | Procedure | Subscription
+type Awaitable<T> = T | Promise<T>
+export type LexMethod = Query | Procedure | Subscription
 
 export type NetAddr = {
   hostname: string
@@ -31,11 +32,11 @@ export type UnixAddr = {
   transport: 'unix' | 'unixpacket'
 }
 
-export type Addr = NetAddr | UnixAddr
+export type Addr = NetAddr | UnixAddr | undefined
 
-export type ConnectionInfo = {
-  localAddr?: Addr
-  remoteAddr?: Addr
+export type ConnectionInfo<A extends Addr = Addr> = {
+  remoteAddr: A
+  completed: Promise<void>
 }
 
 type Handler = (
@@ -48,6 +49,7 @@ export type LexRouterHandlerContext<Method extends LexMethod, Credentials> = {
   input: InferMethodInput<Method, Body>
   params: InferMethodParams<Method>
   request: Request
+  signal: AbortSignal
   connection?: ConnectionInfo
 }
 
@@ -72,14 +74,14 @@ export type LexRouterMethodHandler<
   Credentials = unknown,
 > = (
   ctx: LexRouterHandlerContext<Method, Credentials>,
-) => Promise<LexRouterHandlerOutput<Method>>
+) => Awaitable<LexRouterHandlerOutput<Method>>
 
 export type LexRouterMethodConfig<
   Method extends Query | Procedure = Query | Procedure,
   Credentials = unknown,
 > = {
   handler: LexRouterMethodHandler<Method, Credentials>
-  auth: LexRouterAuth<Method, Credentials>
+  auth: LexRouterAuth<Credentials, Method>
 }
 
 export type LexRouterSubscriptionHandler<
@@ -94,18 +96,19 @@ export type LexRouterSubscriptionConfig<
   Credentials = unknown,
 > = {
   handler: LexRouterSubscriptionHandler<Method, Credentials>
-  auth: LexRouterAuth<Method, Credentials>
+  auth: LexRouterAuth<Credentials, Method>
 }
 
 export type LexRouterAuthContext<Method extends LexMethod = LexMethod> = {
+  method: Method
   params: InferMethodParams<Method>
   request: Request
   connection?: ConnectionInfo
 }
 
 export type LexRouterAuth<
-  Method extends LexMethod = LexMethod,
   Credentials = unknown,
+  Method extends LexMethod = LexMethod,
 > = (ctx: LexRouterAuthContext<Method>) => Credentials | Promise<Credentials>
 
 export type LexErrorHandlerContext = {
@@ -185,7 +188,7 @@ export class LexRouter {
   private buildMethodHandler<Method extends Query | Procedure, Credentials>(
     method: Method,
     methodHandler: LexRouterMethodHandler<Method, Credentials>,
-    auth?: LexRouterAuth<Method, Credentials>,
+    auth?: LexRouterAuth<Credentials, Method>,
   ): Handler {
     const getInput = (
       method.type === 'procedure'
@@ -193,10 +196,7 @@ export class LexRouter {
         : getQueryInput.bind(method)
     ) as (request: Request) => Promise<InferMethodInput<Method, Body>>
 
-    return async (
-      request: Request,
-      connection?: ConnectionInfo,
-    ): Promise<Response> => {
+    return async (request, connection) => {
       // @NOTE CORS requests should be handled by a middleware before reaching
       // this point.
       if (
@@ -216,7 +216,7 @@ export class LexRouter {
         const params = method.parameters.fromURLSearchParams(url.searchParams)
 
         const credentials = auth
-          ? await auth({ params, request, connection })
+          ? await auth({ method, params, request, connection })
           : (undefined as Credentials)
 
         const input = await getInput(request)
@@ -227,6 +227,7 @@ export class LexRouter {
           input,
           request,
           connection,
+          signal: request.signal,
         })
 
         if (output instanceof Response) {
@@ -258,7 +259,7 @@ export class LexRouter {
   private buildSubscriptionHandler<Method extends Subscription, Credentials>(
     method: Method,
     methodHandler: LexRouterSubscriptionHandler<Method, Credentials>,
-    auth?: LexRouterAuth<Method, Credentials>,
+    auth?: LexRouterAuth<Credentials, Method>,
   ): Handler {
     const {
       onHandlerError,
@@ -272,10 +273,7 @@ export class LexRouter {
       )
     }
 
-    return async (
-      request: Request,
-      connection?: ConnectionInfo,
-    ): Promise<Response> => {
+    return async (request, connection) => {
       if (request.method !== 'GET') {
         return Response.json(
           { error: 'InvalidRequest', message: 'Method not allowed' },
@@ -302,19 +300,34 @@ export class LexRouter {
         )
       }
 
+      if (request.signal.aborted) {
+        return Response.json(
+          { error: 'RequestAborted', message: 'The request was aborted' },
+          { status: 499 },
+        )
+      }
+
       try {
         const { response, socket } = upgradeWebSocket(request)
 
-        socket.addEventListener('message', () => {
+        // @NOTE We are using a distinct signal than request.signal because that
+        // signal may get aborted before the WebSocket is closed (this is the
+        // case with Deno).
+        const abortController = new AbortController()
+        const { signal } = abortController
+        const abort = () => abortController.abort()
+
+        const onMessage = (event: unknown) => {
           const error = new LexError(
             'InvalidRequest',
             'XRPC subscriptions do not accept messages',
+            { cause: event },
           )
           socket.send(encodeErrorFrame(error))
           socket.close(1008, error.error)
-        })
+        }
 
-        socket.addEventListener('open', async () => {
+        const onOpen = async () => {
           try {
             const url = new URL(request.url)
             const params = method.parameters.fromURLSearchParams(
@@ -322,10 +335,10 @@ export class LexRouter {
             )
 
             const credentials: Credentials = auth
-              ? await auth({ params, request, connection })
+              ? await auth({ method, params, request, connection })
               : (undefined as Credentials)
 
-            request.signal.throwIfAborted()
+            signal.throwIfAborted()
 
             const iterable = methodHandler({
               credentials,
@@ -333,31 +346,20 @@ export class LexRouter {
               input: undefined as InferMethodInput<Method, Body>,
               request,
               connection,
+              signal,
             })
 
             const iterator = iterable[Symbol.asyncIterator]()
 
-            if (iterator.return) {
-              const abort = async () => {
-                socket.removeEventListener('error', abort)
-                socket.removeEventListener('close', abort)
-                try {
-                  await iterator.return!()
-                } catch {
-                  // Ignore
-                }
-              }
-              socket.addEventListener('error', abort)
-              socket.addEventListener('close', abort)
-            }
+            signal.addEventListener('abort', async () => {
+              // @NOTE will cause the process to crash if this throws
+              await iterator.return?.()
+            })
 
-            while (socket.readyState === 1) {
+            while (!signal.aborted && socket.readyState === 1) {
               const result = await iterator.next()
               if (result.done) break
 
-              // Should not be needed (socket would emit "close" event)
-              request.signal.throwIfAborted()
-
               // @TODO add validation of output based on method.output.schema?
 
               const data = encodeMessageFrame(method, result.value)
@@ -366,10 +368,12 @@ export class LexRouter {
 
               // Apply backpressure by waiting for the buffered data to drain
               // before generating the next message
-              await drainWebsocket(socket, request.signal, this.options)
+              await drainWebsocket(socket, signal, this.options)
             }
 
-            socket.close(1000)
+            if (socket.readyState === 1) {
+              socket.close(1000)
+            }
           } catch (error) {
             // If the socket is still open, send an error frame before closing
             if (socket.readyState === 1) {
@@ -391,8 +395,15 @@ export class LexRouter {
             if (onHandlerError && !isAbortReason(request.signal, error)) {
               await onHandlerError({ error, request, method })
             }
+          } finally {
+            abortController.abort()
           }
-        })
+        }
+
+        socket.addEventListener('error', abort)
+        socket.addEventListener('close', abort)
+        socket.addEventListener('open', onOpen)
+        socket.addEventListener('message', onMessage)
 
         return response
       } catch (error) {