@atproto/lex-server 0.0.1 → 0.0.3

package/src/nodejs.ts

@@ -66,6 +66,8 @@ export function upgradeWebSocket(request: Request): {
   return { response, socket }
 }
 
+const kUpgradeEvent = Symbol.for('@atproto/lex-server:upgrade')
+
 function handleWebSocketUpgrade(
   req: IncomingMessage,
   response: Response,
@@ -98,6 +100,8 @@ function handleWebSocketUpgrade(
     // @TODO find a way to properly "close" the _socket when the server is
     // shutting down (might require replacing http-terminator with a local
     // implementation)
+
+    req.emit(kUpgradeEvent, ws)
   })
 }
 
@@ -138,26 +142,10 @@ function toRequest(req: IncomingMessage): Request {
   const url = new URL(req.url ?? '/', `${protocol}://${host}`)
   const headers = toHeaders(req.headers)
   const body = toBody(req)
-
-  const abortController = new AbortController()
-  const abort = (err?: Error) => abortController.abort(err)
-
-  req.on('close', abort)
-  req.on('error', abort)
-  req.on('end', abort)
-
-  abortController.signal.addEventListener(
-    'abort',
-    () => {
-      req.off('close', abort)
-      req.off('error', abort)
-      req.off('end', abort)
-    },
-    { once: true },
-  )
+  const signal = requestSignal(req)
 
   return new Request(url, {
-    signal: abortController.signal,
+    signal,
     method: req.method,
     headers,
     body,
@@ -168,6 +156,58 @@ function toRequest(req: IncomingMessage): Request {
   })
 }
 
+function requestSignal(req: IncomingMessage): AbortSignal {
+  if (req.destroyed) return AbortSignal.abort()
+
+  const abortController = new AbortController()
+
+  const abort = (err?: Error | WebSocket) => {
+    abortController.abort(err instanceof Error ? err : undefined)
+
+    req.off('close', abort)
+    req.off('error', abort)
+    req.off('end', abort)
+    req.off(kUpgradeEvent, abort)
+  }
+
+  req.on('close', abort)
+  req.on('error', abort)
+  req.on('end', abort)
+  req.on(kUpgradeEvent, abort)
+
+  return abortController.signal
+}
+
+function requestCompletion(req: IncomingMessage): Promise<void> {
+  if (req.destroyed) return Promise.resolve()
+
+  // Unlike the abort signal, we complete the promise only when the request
+  // is fully done, accounting for websocket upgrade.
+  return new Promise((resolve) => {
+    const cleanup = () => {
+      req.off('close', done)
+      req.off('error', done)
+      req.off('end', done)
+      req.off(kUpgradeEvent, onUpgrade)
+    }
+
+    const onUpgrade = (ws: WebSocket) => {
+      cleanup()
+      ws.addEventListener('close', () => resolve())
+    }
+
+    const done = () => {
+      resolve()
+      cleanup()
+    }
+
+    req.on('close', done)
+    req.on('error', done)
+    req.on('end', done)
+    req.on(kUpgradeEvent, onUpgrade)
+  })
+}
+
 function toHeaders(headers: IncomingHttpHeaders): Headers {
   const result = new Headers()
   for (const [key, value] of Object.entries(headers)) {
@@ -202,14 +242,14 @@ function toBody(req: IncomingMessage): null | ReadableStream<Uint8Array> {
 }
 
 export type NetAddr = {
+  transport: 'tcp'
   hostname: string
   port: number
-  transport: 'tcp'
 }
 
 export type NodeConnectionInfo = {
-  localAddr?: NetAddr
-  remoteAddr?: NetAddr
+  completed: Promise<void>
+  remoteAddr: NetAddr | undefined
 }
 
 export interface HandlerFunction {
@@ -233,21 +273,15 @@ async function handleRequest(
 
 function toConnectionInfo(req: IncomingMessage): NodeConnectionInfo {
   const { socket } = req
+
   return {
-    localAddr:
-      socket.localAddress != null
-        ? {
-            hostname: socket.localAddress,
-            port: socket.localPort!,
-            transport: 'tcp',
-          }
-        : undefined,
+    completed: requestCompletion(req),
     remoteAddr:
       socket.remoteAddress != null
         ? {
+            transport: 'tcp',
             hostname: socket.remoteAddress,
             port: socket.remotePort!,
-            transport: 'tcp',
           }
         : undefined,
   }

package/src/service-auth.ts

@@ -0,0 +1,375 @@
+import * as crypto from '@atproto/crypto'
+import {
+  AtprotoDid,
+  AtprotoDidDocument,
+  Did,
+  matchesIdentifier,
+} from '@atproto/did'
+import { fromBase64, isPlainObject, utf8FromBase64 } from '@atproto/lex-data'
+import { DidString, isDidString } from '@atproto/lex-schema'
+import {
+  CreateDidResolverOptions,
+  createDidResolver,
+} from '@atproto-labs/did-resolver'
+import { LexServerAuthError } from './errors.js'
+import { LexRouterAuth } from './lex-server.js'
+
+const BEARER_PREFIX = 'Bearer '
+
+/**
+ * A function to check and record nonce uniqueness.
+ */
+export type UniqueNonceChecker = (nonce: string) => Promise<boolean>
+
+export type ServiceAuthOptions = CreateDidResolverOptions & {
+  /**
+   * Expected audience ("aud") claim in the JWT token. Set to `null` to skip
+   * audience verification (not recommended).
+   */
+  audience: null | DidString
+  /**
+   * Function to check and record nonce uniqueness. The value checked here must
+   * be unique within {@link ServiceAuthOptions.maxAge} seconds before and after
+   * the current time.
+   *
+   * @param nonce - The nonce to check.
+   */
+  unique: UniqueNonceChecker
+  /**
+   * Maximum age of the JWT token in seconds.
+   *
+   * @default 300 (5 minutes)
+   */
+  maxAge?: number
+}
+
+export type ServiceAuthCredentials = {
+  did: AtprotoDid
+  didDocument: AtprotoDidDocument
+  jwt: ParsedJwt
+}
+
+/**
+ * Creates an authentication handler for LexRouter that verifies AT protocol
+ * "service auth" JWT bearer tokens signed by decentralized identifiers (DIDs).
+ */
+export function serviceAuth({
+  audience,
+  maxAge = 5 * 60,
+  unique,
+  ...options
+}: ServiceAuthOptions): LexRouterAuth<ServiceAuthCredentials> {
+  const didResolver = createDidResolver(options)
+
+  return async ({ request, method }) => {
+    const { signal } = request
+    const jwt = await parseJwtBearer(request, {
+      lxm: method.nsid,
+      maxAge,
+      audience,
+      unique,
+    })
+
+    let didDocument: AtprotoDidDocument = await didResolver
+      .resolve(jwt.payload.iss, { signal })
+      .catch((cause) => {
+        throw new LexServerAuthError(
+          'AuthenticationRequired',
+          'Could not resolve DID document',
+          { Bearer: { error: 'DidResolutionFailed' } },
+          { cause },
+        )
+      })
+
+    const key = getAtprotoSigningKey(didDocument)
+
+    if (!key || !(await verifyJwt(jwt, key))) {
+      signal.throwIfAborted()
+
+      // Try refreshing the DID document in case it was updated
+      didDocument = await didResolver
+        .resolve(jwt.payload.iss, { signal, noCache: true })
+        .catch((cause) => {
+          throw new LexServerAuthError(
+            'AuthenticationRequired',
+            'Could not resolve DID document',
+            { Bearer: { error: 'DidResolutionFailed' } },
+            { cause },
+          )
+        })
+
+      // Verify again with the fresh key (if it changed)
+      const keyFresh = getAtprotoSigningKey(didDocument)
+      if (!keyFresh || key === keyFresh || !(await verifyJwt(jwt, keyFresh))) {
+        throw new LexServerAuthError(
+          'AuthenticationRequired',
+          'Invalid JWT signature',
+          { Bearer: { error: 'BadJwtSignature' } },
+        )
+      }
+    }
+
+    return {
+      did: didDocument.id,
+      didDocument,
+      jwt,
+    }
+  }
+}
+
+async function verifyJwt(jwt: ParsedJwt, key: Did<'key'>) {
+  try {
+    return await crypto.verifySignature(key, jwt.message, jwt.signature, {
+      jwtAlg: jwt.header.alg,
+      allowMalleableSig: true,
+    })
+  } catch (cause) {
+    throw new LexServerAuthError(
+      'AuthenticationRequired',
+      'Could not verify JWT signature',
+      { Bearer: { error: 'BadJwtSignature' } },
+      { cause },
+    )
+  }
+}
+
+function getAtprotoSigningKey(
+  didDocument: AtprotoDidDocument,
+): null | Did<'key'> {
+  try {
+    const key = didDocument.verificationMethod?.find(
+      isAtprotoVerificationMethod,
+      didDocument,
+    )
+
+    if (key?.publicKeyMultibase) {
+      if (key.type === 'EcdsaSecp256r1VerificationKey2019') {
+        const keyBytes = crypto.multibaseToBytes(key.publicKeyMultibase)
+        return crypto.formatDidKey(crypto.P256_JWT_ALG, keyBytes)
+      } else if (key.type === 'EcdsaSecp256k1VerificationKey2019') {
+        const keyBytes = crypto.multibaseToBytes(key.publicKeyMultibase)
+        return crypto.formatDidKey(crypto.SECP256K1_JWT_ALG, keyBytes)
+      } else if (key.type === 'Multikey') {
+        const parsed = crypto.parseMultikey(key.publicKeyMultibase)
+        return crypto.formatDidKey(parsed.jwtAlg, parsed.keyBytes)
+      }
+    }
+  } catch {
+    // Invalid key, ignore
+  }
+
+  return null
+}
+
+function isAtprotoVerificationMethod<
+  V extends string | { id: string; type: string; publicKeyMultibase?: string },
+>(
+  this: AtprotoDidDocument,
+  vm: V,
+): vm is Exclude<V, string> & {
+  id: `${string}#atproto`
+} {
+  return typeof vm === 'object' && matchesIdentifier(this.id, 'atproto', vm.id)
+}
+
+async function parseJwtBearer(
+  request: Request,
+  options: ParseJwtOptions,
+): Promise<ParsedJwt> {
+  const authorization = request.headers.get('authorization')
+  if (!authorization?.startsWith(BEARER_PREFIX)) {
+    throw new LexServerAuthError(
+      'AuthenticationRequired',
+      'Bearer token required',
+      { Bearer: { error: 'MissingBearer' } },
+    )
+  }
+
+  const token = authorization.slice(BEARER_PREFIX.length).trim()
+
+  return parseJwt(token, options)
+}
+
+export type ParseJwtOptions = {
+  maxAge: number
+  audience: null | DidString
+  unique: UniqueNonceChecker
+  lxm: string
+}
+
+export type ParsedJwt = {
+  header: HeaderObject
+  payload: PayloadObject
+  message: Uint8Array
+  signature: Uint8Array
+}
+
+async function parseJwt(
+  token: string,
+  options: ParseJwtOptions,
+): Promise<ParsedJwt> {
+  const {
+    length,
+    0: headerB64,
+    1: payloadB64,
+    2: signatureB64,
+  } = token.split('.')
+  if (length !== 3) {
+    throw new LexServerAuthError(
+      'AuthenticationRequired',
+      'Invalid JWT token',
+      { Bearer: { error: 'BadJwt' } },
+    )
+  }
+
+  let header: HeaderObject
+  try {
+    header = jsonFromBase64(headerB64, isHeaderObject)
+  } catch (cause) {
+    throw new LexServerAuthError(
+      'AuthenticationRequired',
+      'Invalid JWT token',
+      { Bearer: { error: 'BadJwt' } },
+      { cause },
+    )
+  }
+
+  if (
+    header.alg === 'none' ||
+    // service tokens are not OAuth 2.0 access tokens
+    // https://datatracker.ietf.org/doc/html/rfc9068
+    header.typ === 'at+jwt' ||
+    // "refresh+jwt" is a non-standard type used by the @atproto packages
+    header.typ === 'refresh+jwt' ||
+    // "DPoP" proofs are not meant to be used as service tokens
+    // https://datatracker.ietf.org/doc/html/rfc9449
+    header.typ === 'dpop+jwt'
+  ) {
+    throw new LexServerAuthError(
+      'AuthenticationRequired',
+      'Invalid JWT token',
+      { Bearer: { error: 'BadJwt' } },
+    )
+  }
+
+  let payload: PayloadObject
+  try {
+    payload = jsonFromBase64(payloadB64, isPayloadObject)
+  } catch (cause) {
+    throw new LexServerAuthError(
+      'AuthenticationRequired',
+      'Invalid JWT token',
+      { Bearer: { error: 'BadJwt' } },
+      { cause },
+    )
+  }
+
+  if (options.audience !== null && options.audience !== payload.aud) {
+    throw new LexServerAuthError('AuthenticationRequired', 'Invalid audience', {
+      Bearer: { error: 'InvalidAudience' },
+    })
+  }
+
+  const now = Math.floor(Date.now() / 1000)
+
+  if (payload.nbf != null && now < payload.nbf) {
+    throw new LexServerAuthError(
+      'AuthenticationRequired',
+      'JWT token not yet valid',
+      { Bearer: { error: 'JwtNotYetValid' } },
+    )
+  }
+
+  if (now > payload.exp) {
+    throw new LexServerAuthError(
+      'AuthenticationRequired',
+      'JWT token expired',
+      { Bearer: { error: 'JwtExpired' } },
+    )
+  }
+
+  // Prevent issuer from generating very long-lived tokens
+  if (
+    timeDiff(now, payload.exp) > options.maxAge ||
+    timeDiff(now, payload.iat) > options.maxAge
+  ) {
+    throw new LexServerAuthError(
+      'AuthenticationRequired',
+      'JWT token too old',
+      { Bearer: { error: 'JwtTooOld' } },
+    )
+  }
+
+  if (payload.lxm != null && typeof payload.lxm !== options.lxm) {
+    throw new LexServerAuthError(
+      'AuthenticationRequired',
+      'Invalid JWT lexicon method ("lxm")',
+      { Bearer: { error: 'BadJwtLexiconMethod' } },
+    )
+  }
+
+  if (payload.nonce != null && !(await (0, options.unique)(payload.nonce))) {
+    throw new LexServerAuthError(
+      'AuthenticationRequired',
+      'Replay attack detected: nonce is not unique',
+      { Bearer: { error: 'NonceNotUnique' } },
+    )
+  }
+
+  return {
+    header,
+    payload,
+    message: textEncoder.encode(`${headerB64}.${payloadB64}`),
+    signature: fromBase64(signatureB64, 'base64url'),
+  }
+}
+
+const textEncoder = /*#__PURE__*/ new TextEncoder()
+
+type HeaderObject = { alg: string; typ?: string }
+function isHeaderObject(obj: unknown): obj is HeaderObject {
+  return (
+    isPlainObject(obj) &&
+    typeof obj.alg === 'string' &&
+    (obj.typ === undefined || typeof obj.typ === 'string')
+  )
+}
+
+type PayloadObject = {
+  iss: DidString
+  aud: DidString
+  exp: number
+  iat?: number
+  nbf?: number
+  lxm?: string
+  nonce?: string
+}
+export function isPayloadObject(obj: unknown): obj is PayloadObject {
+  return (
+    isPlainObject(obj) &&
+    typeof obj.iss === 'string' &&
+    typeof obj.aud === 'string' &&
+    (obj.lxm === undefined || typeof obj.lxm === 'string') &&
+    (obj.nonce === undefined || typeof obj.nonce === 'string') &&
+    (obj.iat === undefined || isPositiveInt(obj.iat)) &&
+    (obj.nbf === undefined || isPositiveInt(obj.nbf)) &&
+    isPositiveInt(obj.exp) &&
+    isDidString(obj.iss) &&
+    isDidString(obj.aud)
+  )
+}
+
+function timeDiff(t1: number, t2?: number): number {
+  if (t2 === undefined) return 0
+  return Math.abs(t1 - t2)
+}
+
+function isPositiveInt(value: unknown): value is number {
+  return typeof value === 'number' && Number.isInteger(value) && value > 0
+}
+
+function jsonFromBase64<T>(b64: string, isType: (obj: unknown) => obj is T): T {
+  const obj = JSON.parse(utf8FromBase64(b64, 'base64url'))
+  if (isType(obj)) return obj
+  throw new Error('Invalid type')
+}

package/dist/example.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=example.d.ts.map

package/dist/example.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"example.d.ts","sourceRoot":"","sources":["../src/example.ts"],"names":[],"mappings":""}

package/dist/example.js

@@ -1,36 +0,0 @@
-"use strict";
-/* eslint-disable @typescript-eslint/no-namespace */
-/* eslint-disable n/no-extraneous-import */
-/* eslint-disable import/no-unresolved */
-/* eslint-env node */
-Object.defineProperty(exports, "__esModule", { value: true });
-const lex_1 = require("@atproto/lex");
-const index_js_1 = require("./index.js");
-const nodejs_js_1 = require("./nodejs.js");
-var com;
-(function (com) {
-    let example;
-    (function (example) {
-        let echo;
-        (function (echo) {
-            echo.nsid = 'com.example.echo';
-            echo.message = lex_1.l.typedObject(echo.nsid, 'message', lex_1.l.object({
-                message: lex_1.l.string(),
-            }));
-            echo.main = lex_1.l.subscription(echo.nsid, lex_1.l.params({
-                message: lex_1.l.string({ minLength: 1 }),
-                interval: lex_1.l.optional(lex_1.l.integer({ minimum: 0, default: 500 })),
-            }), lex_1.l.typedUnion([lex_1.l.typedRef(() => echo.message)], false));
-        })(echo = example.echo || (example.echo = {}));
-    })(example = com.example || (com.example = {}));
-})(com || (com = {}));
-const router = new index_js_1.LexRouter({ upgradeWebSocket: nodejs_js_1.upgradeWebSocket })
-    //
-    .add(com.example.echo, async function* ({ params: { interval, message } }) {
-    while (true) {
-        yield com.example.echo.message.$build({ message });
-        await new Promise((resolve) => setTimeout(resolve, interval));
-    }
-});
-(0, nodejs_js_1.serve)(router, { port: 8080, host: '0.0.0.0' });
-//# sourceMappingURL=example.js.map

package/dist/example.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"example.js","sourceRoot":"","sources":["../src/example.ts"],"names":[],"mappings":";AAAA,oDAAoD;AACpD,2CAA2C;AAC3C,yCAAyC;AACzC,qBAAqB;;AAErB,sCAAgC;AAChC,yCAAsC;AACtC,2CAAqD;AAErD,IAAU,GAAG,CAuBZ;AAvBD,WAAU,GAAG;IACX,IAAiB,OAAO,CAqBvB;IArBD,WAAiB,OAAO;QACtB,IAAiB,IAAI,CAmBpB;QAnBD,WAAiB,IAAI;YACN,SAAI,GAAG,kBAAkB,CAAA;YAEzB,YAAO,GAAG,OAAC,CAAC,WAAW,CAClC,KAAA,IAAI,EACJ,SAAS,EACT,OAAC,CAAC,MAAM,CAAC;gBACP,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE;aACpB,CAAC,CACH,CAAA;YAEY,SAAI,GAAG,OAAC,CAAC,YAAY,CAChC,KAAA,IAAI,EACJ,OAAC,CAAC,MAAM,CAAC;gBACP,OAAO,EAAE,OAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;gBACnC,QAAQ,EAAE,OAAC,CAAC,QAAQ,CAAC,OAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;aAC9D,CAAC,EACF,OAAC,CAAC,UAAU,CAAC,CAAC,OAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAA,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CACjD,CAAA;QACH,CAAC,EAnBgB,IAAI,GAAJ,YAAI,KAAJ,YAAI,QAmBpB;IACH,CAAC,EArBgB,OAAO,GAAP,WAAO,KAAP,WAAO,QAqBvB;AACH,CAAC,EAvBS,GAAG,KAAH,GAAG,QAuBZ;AAED,MAAM,MAAM,GAAG,IAAI,oBAAS,CAAC,EAAE,gBAAgB,EAAhB,4BAAgB,EAAE,CAAC;IAChD,EAAE;KACD,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE;IACvE,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;QAClD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAA;IAC/D,CAAC;AACH,CAAC,CAAC,CAAA;AAEJ,IAAA,iBAAK,EAAC,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA","sourcesContent":["/* eslint-disable @typescript-eslint/no-namespace */\n/* eslint-disable n/no-extraneous-import */\n/* eslint-disable import/no-unresolved */\n/* eslint-env node */\n\nimport { l } from '@atproto/lex'\nimport { LexRouter } from './index.js'\nimport { serve, upgradeWebSocket } from './nodejs.js'\n\nnamespace com {\n  export namespace example {\n    export namespace echo {\n      export const nsid = 'com.example.echo'\n\n      export const message = l.typedObject(\n        nsid,\n        'message',\n        l.object({\n          message: l.string(),\n        }),\n      )\n\n      export const main = l.subscription(\n        nsid,\n        l.params({\n          message: l.string({ minLength: 1 }),\n          interval: l.optional(l.integer({ minimum: 0, default: 500 })),\n        }),\n        l.typedUnion([l.typedRef(() => message)], false),\n      )\n    }\n  }\n}\n\nconst router = new LexRouter({ upgradeWebSocket })\n  //\n  .add(com.example.echo, async function* ({ params: { interval, message } }) {\n    while (true) {\n      yield com.example.echo.message.$build({ message })\n      await new Promise((resolve) => setTimeout(resolve, interval))\n    }\n  })\n\nserve(router, { port: 8080, host: '0.0.0.0' })\n"]}

package/dist/lex-auth-error.d.ts

@@ -1,15 +0,0 @@
-import { LexError, LexErrorCode } from '@atproto/lex-data';
-export type WWWAuthenticate = {
-    [k: string]: Record<string, string>;
-};
-export declare function formatWWWAuthenticate(wwwAuthenticate: WWWAuthenticate): string;
-export declare class LexServerAuthError<N extends LexErrorCode = LexErrorCode> extends LexError<N> {
-    readonly wwwAuthenticate?: WWWAuthenticate | undefined;
-    name: string;
-    constructor(error: N, message: string, wwwAuthenticate?: WWWAuthenticate | undefined, options?: ErrorOptions);
-    get wwwAuthenticateHeader(): string;
-    toJSON(): import("@atproto/lex-data").LexErrorData<any>;
-    toResponse(): Response;
-    static from(cause: LexError, wwwAuthenticate?: WWWAuthenticate): LexServerAuthError;
-}
-//# sourceMappingURL=lex-auth-error.d.ts.map

package/dist/lex-auth-error.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"lex-auth-error.d.ts","sourceRoot":"","sources":["../src/lex-auth-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAE1D,MAAM,MAAM,eAAe,GAAG;IAAE,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAA;AACrE,wBAAgB,qBAAqB,CACnC,eAAe,EAAE,eAAe,GAC/B,MAAM,CAWR;AAED,qBAAa,kBAAkB,CAC7B,CAAC,SAAS,YAAY,GAAG,YAAY,CACrC,SAAQ,QAAQ,CAAC,CAAC,CAAC;IAMjB,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe;IAL5C,IAAI,SAAuB;gBAGzB,KAAK,EAAE,CAAC,EACR,OAAO,EAAE,MAAM,EACN,eAAe,CAAC,EAAE,eAAe,YAAA,EAC1C,OAAO,CAAC,EAAE,YAAY;IAKxB,IAAI,qBAAqB,IAAI,MAAM,CAElC;IAED,MAAM;IAKN,UAAU,IAAI,QAAQ;IAatB,MAAM,CAAC,IAAI,CACT,KAAK,EAAE,QAAQ,EACf,eAAe,CAAC,EAAE,eAAe,GAChC,kBAAkB;CAMtB"}

package/dist/lex-auth-error.js

@@ -1,52 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.LexServerAuthError = void 0;
-exports.formatWWWAuthenticate = formatWWWAuthenticate;
-const lex_data_1 = require("@atproto/lex-data");
-function formatWWWAuthenticate(wwwAuthenticate) {
-    return Object.entries(wwwAuthenticate)
-        .map(([type, params]) => {
-        if (!params)
-            return null;
-        const paramsEnc = Object.entries(params)
-            .filter(([_, val]) => val != null)
-            .map(([name, val]) => `${name}=${JSON.stringify(val)}`);
-        return paramsEnc?.length ? `${type} ${paramsEnc.join(', ')}` : type;
-    })
-        .filter(Boolean)
-        .join(', ');
-}
-class LexServerAuthError extends lex_data_1.LexError {
-    wwwAuthenticate;
-    name = 'LexServerAuthError';
-    constructor(error, message, wwwAuthenticate, options) {
-        super(error, message, options);
-        this.wwwAuthenticate = wwwAuthenticate;
-    }
-    get wwwAuthenticateHeader() {
-        return formatWWWAuthenticate(this.wwwAuthenticate ?? {});
-    }
-    toJSON() {
-        const { cause } = this;
-        return cause instanceof lex_data_1.LexError ? cause.toJSON() : super.toJSON();
-    }
-    toResponse() {
-        const { wwwAuthenticateHeader } = this;
-        const headers = wwwAuthenticateHeader
-            ? new Headers({
-                'WWW-Authenticate': wwwAuthenticateHeader,
-                'Access-Control-Expose-Headers': 'WWW-Authenticate', // CORS
-            })
-            : undefined;
-        return Response.json(this.toJSON(), { status: 401, headers });
-    }
-    static from(cause, wwwAuthenticate) {
-        if (cause instanceof LexServerAuthError)
-            return cause;
-        return new LexServerAuthError(cause.error, cause.message, wwwAuthenticate, {
-            cause,
-        });
-    }
-}
-exports.LexServerAuthError = LexServerAuthError;
-//# sourceMappingURL=lex-auth-error.js.map

package/dist/lex-auth-error.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"lex-auth-error.js","sourceRoot":"","sources":["../src/lex-auth-error.ts"],"names":[],"mappings":";;;AAGA,sDAaC;AAhBD,gDAA0D;AAG1D,SAAgB,qBAAqB,CACnC,eAAgC;IAEhC,OAAO,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC;SACnC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE;QACtB,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;aACrC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC;aACjC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACzD,OAAO,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IACrE,CAAC,CAAC;SACD,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,IAAI,CAAC,CAAA;AACf,CAAC;AAED,MAAa,kBAEX,SAAQ,mBAAW;IAMR;IALX,IAAI,GAAG,oBAAoB,CAAA;IAE3B,YACE,KAAQ,EACR,OAAe,EACN,eAAiC,EAC1C,OAAsB;QAEtB,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;QAHrB,oBAAe,GAAf,eAAe,CAAkB;IAI5C,CAAC;IAED,IAAI,qBAAqB;QACvB,OAAO,qBAAqB,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,CAAA;IAC1D,CAAC;IAED,MAAM;QACJ,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAA;QACtB,OAAO,KAAK,YAAY,mBAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;IACpE,CAAC;IAED,UAAU;QACR,MAAM,EAAE,qBAAqB,EAAE,GAAG,IAAI,CAAA;QAEtC,MAAM,OAAO,GAAG,qBAAqB;YACnC,CAAC,CAAC,IAAI,OAAO,CAAC;gBACV,kBAAkB,EAAE,qBAAqB;gBACzC,+BAA+B,EAAE,kBAAkB,EAAE,OAAO;aAC7D,CAAC;YACJ,CAAC,CAAC,SAAS,CAAA;QAEb,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;IAC/D,CAAC;IAED,MAAM,CAAC,IAAI,CACT,KAAe,EACf,eAAiC;QAEjC,IAAI,KAAK,YAAY,kBAAkB;YAAE,OAAO,KAAK,CAAA;QACrD,OAAO,IAAI,kBAAkB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,eAAe,EAAE;YACzE,KAAK;SACN,CAAC,CAAA;IACJ,CAAC;CACF;AA7CD,gDA6CC","sourcesContent":["import { LexError, LexErrorCode } from '@atproto/lex-data'\n\nexport type WWWAuthenticate = { [k: string]: Record<string, string> }\nexport function formatWWWAuthenticate(\n  wwwAuthenticate: WWWAuthenticate,\n): string {\n  return Object.entries(wwwAuthenticate)\n    .map(([type, params]) => {\n      if (!params) return null\n      const paramsEnc = Object.entries(params)\n        .filter(([_, val]) => val != null)\n        .map(([name, val]) => `${name}=${JSON.stringify(val)}`)\n      return paramsEnc?.length ? `${type} ${paramsEnc.join(', ')}` : type\n    })\n    .filter(Boolean)\n    .join(', ')\n}\n\nexport class LexServerAuthError<\n  N extends LexErrorCode = LexErrorCode,\n> extends LexError<N> {\n  name = 'LexServerAuthError'\n\n  constructor(\n    error: N,\n    message: string,\n    readonly wwwAuthenticate?: WWWAuthenticate,\n    options?: ErrorOptions,\n  ) {\n    super(error, message, options)\n  }\n\n  get wwwAuthenticateHeader(): string {\n    return formatWWWAuthenticate(this.wwwAuthenticate ?? {})\n  }\n\n  toJSON() {\n    const { cause } = this\n    return cause instanceof LexError ? cause.toJSON() : super.toJSON()\n  }\n\n  toResponse(): Response {\n    const { wwwAuthenticateHeader } = this\n\n    const headers = wwwAuthenticateHeader\n      ? new Headers({\n          'WWW-Authenticate': wwwAuthenticateHeader,\n          'Access-Control-Expose-Headers': 'WWW-Authenticate', // CORS\n        })\n      : undefined\n\n    return Response.json(this.toJSON(), { status: 401, headers })\n  }\n\n  static from(\n    cause: LexError,\n    wwwAuthenticate?: WWWAuthenticate,\n  ): LexServerAuthError {\n    if (cause instanceof LexServerAuthError) return cause\n    return new LexServerAuthError(cause.error, cause.message, wwwAuthenticate, {\n      cause,\n    })\n  }\n}\n"]}

package/dist/subscripotion.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=subscripotion.d.ts.map

package/dist/subscripotion.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"subscripotion.d.ts","sourceRoot":"","sources":["../src/subscripotion.ts"],"names":[],"mappings":""}