@atproto/oauth-client-expo 0.0.1

package/ios/Crypto.swift

@@ -0,0 +1,83 @@
+import Foundation
+import CryptoKit
+import JOSESwift
+
+class CryptoUtil: NSObject {
+  static func digest(data: Data) -> Data {
+    let hash = SHA256.hash(data: data)
+    return Data(hash)
+  }
+
+  public static func getRandomValues(byteLength: Int) -> Data {
+    let bytes = (0..<byteLength).map { _ in UInt8.random(in: UInt8.min...UInt8.max) }
+    return Data(bytes)
+  }
+
+  static func generateJwk() -> EncodedJWK {
+    let kid = UUID().uuidString
+
+    let privKey = P256.Signing.PrivateKey()
+    let pubKey = privKey.publicKey
+
+    let x = pubKey.x963Representation[1..<33].base64URLEncodedString()
+    let y = pubKey.x963Representation[33...].base64URLEncodedString()
+    let d = privKey.rawRepresentation.base64URLEncodedString()
+
+    let jwk = EncodedJWK()
+    jwk.kty = "EC"
+    jwk.crv = "P-256"
+    jwk.kid = kid
+    jwk.x = x
+    jwk.y = y
+    jwk.d = d
+    jwk.alg = "ES256"
+
+    return jwk
+  }
+
+  static func decodeJwk(x: String, y: String, d: String) throws -> SecKey {
+    func base64UrlDecode(_ string: String) -> Data? {
+      var base64 = string
+        .replacingOccurrences(of: "-", with: "+")
+        .replacingOccurrences(of: "_", with: "/")
+
+      let remainder = base64.count % 4
+      if remainder > 0 {
+        base64 += String(repeating: "=", count: 4 - remainder)
+      }
+
+      return Data(base64Encoded: base64)
+    }
+
+    guard let xData = base64UrlDecode(x),
+          let yData = base64UrlDecode(y),
+          let dData = base64UrlDecode(d) else {
+      throw ExpoAtprotoOAuthClientError.invalidJwk
+    }
+
+    var keyData = Data()
+    keyData.append(0x04)
+    keyData.append(xData)
+    keyData.append(yData)
+    keyData.append(dData)
+
+    let attributes: [String: Any] = [
+      kSecAttrKeyType as String: kSecAttrKeyTypeEC,
+      kSecAttrKeyClass as String: kSecAttrKeyClassPrivate,
+      kSecAttrKeySizeInBits as String: 256
+    ]
+
+    var error: Unmanaged<CFError>?
+
+    let key = SecKeyCreateWithData(keyData as CFData, attributes as CFDictionary, &error)
+    if error != nil {
+      throw error!.takeUnretainedValue()
+    }
+
+    guard let key = key else {
+      throw ExpoAtprotoOAuthClientError.invalidJwk
+    }
+
+    return key
+  }
+}

package/ios/ExpoAtprotoOAuthClient.podspec

@@ -0,0 +1,31 @@
+require 'json'
+
+package = JSON.parse(File.read(File.join(__dir__, '..', 'package.json')))
+
+Pod::Spec.new do |s|
+  s.name           = 'ExpoAtprotoOAuthClient'
+  s.version        = package['version']
+  s.summary        = package['description']
+  s.description    = package['description']
+  s.license        = package['license']
+  s.author         = package['author']
+  s.authors        = package['authors']
+  s.homepage       = package['homepage']
+  s.platforms      = {
+    :ios => '15.1',
+    :tvos => '15.1'
+  }
+  s.swift_version  = '5.4'
+  s.source         = { git: 'https://github.com/bluesky-social/atproto' }
+  s.static_framework = true
+
+  s.dependency 'ExpoModulesCore'
+  s.dependency 'JOSESwift', '~> 2.3'
+
+  # Swift/Objective-C compatibility
+  s.pod_target_xcconfig = {
+    'DEFINES_MODULE' => 'YES',
+  }
+
+  s.source_files = "**/*.{h,m,mm,swift,hpp,cpp}"
+end

package/ios/ExpoAtprotoOAuthClientModule.swift

@@ -0,0 +1,45 @@
+import ExpoModulesCore
+
+enum ExpoAtprotoOAuthClientError: Error {
+  case unsupportedAlgorithm(String)
+  case invalidJwk
+  case invalidHeader(String)
+  case invalidPayload(String)
+  case nullSigner
+}
+
+public class ExpoAtprotoOAuthClientModule: Module {
+  public func definition() -> ModuleDefinition {
+    Name("ExpoAtprotoOAuthClient")
+
+    AsyncFunction("digest") { (data: Data, algo: String) throws -> Data in
+      if algo != "sha256" {
+        throw ExpoAtprotoOAuthClientError.unsupportedAlgorithm(algo)
+      }
+      return CryptoUtil.digest(data: data)
+    }
+
+    AsyncFunction("getRandomValues") { (byteLength: Int) -> Data in
+      return CryptoUtil.getRandomValues(byteLength: byteLength)
+    }
+
+    AsyncFunction("generatePrivateJwk") { (algo: String) throws -> EncodedJWK in
+      if algo != "ES256" {
+        throw ExpoAtprotoOAuthClientError.unsupportedAlgorithm(algo)
+      }
+      return CryptoUtil.generateJwk()
+    }
+
+    AsyncFunction("createJwt") { (header: String, payload: String, jwk: EncodedJWK) throws -> String in
+      let jwk = try CryptoUtil.decodeJwk(x: jwk.x, y: jwk.y, d: jwk.d)
+      let jwt = try JoseUtil.createJwt(header: header, payload: payload, jwk: jwk)
+      return jwt
+    }
+
+    AsyncFunction("verifyJwt") { (token: String, jwk: EncodedJWK, options: VerifyOptions) throws -> VerifyResult in
+      let jwk = try CryptoUtil.decodeJwk(x: jwk.x, y: jwk.y, d: jwk.d)
+      let res = try JoseUtil.verifyJwt(token: token, jwk: jwk, options: options)
+      return res
+    }
+  }
+}

package/ios/Jose.swift

@@ -0,0 +1,137 @@
+import JOSESwift
+
+class JoseUtil: NSObject {
+  private static func headerStringToHeader(_ headerString: String) -> JWSHeader? {
+    guard let headerData = headerString.data(using: .utf8) else {
+      return nil
+    }
+    return JWSHeader(headerData)
+  }
+
+  private static func payloadStringToPayload(_ payloadString: String) -> Payload? {
+    guard let payloadData = payloadString.data(using: .utf8) else {
+      return nil
+    }
+    return Payload(payloadData)
+  }
+
+  static func createJwt(header: String, payload: String, jwk: SecKey) throws -> String {
+    guard let header = headerStringToHeader(header) else {
+      throw ExpoAtprotoOAuthClientError.invalidHeader("could not parse header string")
+    }
+
+    guard let payload = payloadStringToPayload(payload) else {
+      throw ExpoAtprotoOAuthClientError.invalidPayload("could not parse payload string")
+    }
+
+    let signer = Signer(signingAlgorithm: .ES256, key: jwk)
+
+    guard let signer = signer else {
+      throw ExpoAtprotoOAuthClientError.nullSigner
+    }
+
+    let jws = try JWS(header: header, payload: payload, signer: signer)
+
+    return jws.compactSerializedString
+  }
+
+  static func verifyJwt(token: String, jwk: SecKey, options: VerifyOptions) throws -> VerifyResult {
+    guard let jws = try? JWS(compactSerialization: token),
+          let verifier = Verifier(verifyingAlgorithm: .ES256, key: jwk),
+          let validation = try? jws.validate(using: verifier)
+    else {
+      throw ExpoAtprotoOAuthClientError.invalidJwk
+    }
+
+    let header = validation.header
+    let payload = String(data: validation.payload.data(), encoding: .utf8)
+    guard let payload = payload else {
+      throw ExpoAtprotoOAuthClientError.invalidPayload("unable to parse payload")
+    }
+
+    var protectedHeader: [String: Any] = [:]
+    protectedHeader["alg"] = "ES256"
+    if header.jku != nil {
+      protectedHeader["jku"] = header.jku?.absoluteString
+    }
+    if header.kid != nil {
+      protectedHeader["kid"] = header.kid
+    }
+    if header.typ != nil {
+      protectedHeader["typ"] = header.typ
+    }
+    if header.cty != nil {
+      protectedHeader["cty"] = header.cty
+    }
+    if header.crit != nil {
+      protectedHeader["crit"] = header.crit
+    }
+
+    if let typ = options.typ {
+      if header.typ != typ {
+        throw ExpoAtprotoOAuthClientError.invalidPayload("typ mismatch")
+      }
+    }
+
+    let claims = try JSONSerialization.jsonObject(with: validation.payload.data(), options: []) as? [String: Any]
+
+    if let requiredClaims = options.requiredClaims {
+      try requiredClaims.forEach { c in
+        if claims?[c] == nil {
+          throw ExpoAtprotoOAuthClientError.invalidPayload("required claim \(c) missing")
+        }
+      }
+    }
+
+    if let audience = options.audience {
+      if claims?["aud"] as? String != audience {
+        throw ExpoAtprotoOAuthClientError.invalidPayload("audience mismatch")
+      }
+    }
+
+    if let subject = options.subject {
+      if claims?["sub"] as? String != subject {
+        throw ExpoAtprotoOAuthClientError.invalidPayload("subject mismatch")
+      }
+    }
+
+    if let checkTolerance = options.clockTolerance {
+      let now = Date()
+      let expiryDate: Date
+      if let expiryString = claims?["exp"] as? String {
+        let formatter = ISO8601DateFormatter()
+        expiryDate = formatter.date(from: expiryString)!
+      } else {
+        throw ExpoAtprotoOAuthClientError.invalidPayload("expiry missing")
+      }
+      if expiryDate < now - checkTolerance {
+        throw ExpoAtprotoOAuthClientError.invalidPayload("token expired")
+      }
+    }
+
+    if let maxTokenAge = options.maxTokenAge {
+      let now = Date()
+      if let expiryString = claims?["exp"] as? String {
+        let formatter = ISO8601DateFormatter()
+        let expiryDate = formatter.date(from: expiryString)!
+        if expiryDate < now - maxTokenAge {
+          throw ExpoAtprotoOAuthClientError.invalidPayload("token expired")
+        }
+      } else {
+        throw ExpoAtprotoOAuthClientError.invalidPayload("expiry missing")
+      }
+    }
+
+    if let issuer = options.issuer {
+      if claims?["iss"] as? String != issuer {
+        throw ExpoAtprotoOAuthClientError.invalidPayload("issuer mismatch")
+      }
+    }
+
+    let res = VerifyResult()
+    res.payload = payload
+    res.protectedHeader = protectedHeader
+
+    return res
+  }
+}

package/ios/Records.swift

@@ -0,0 +1,58 @@
+import ExpoModulesCore
+
+struct EncodedJWK: Record {
+  @Field
+  var kty: String
+
+  @Field
+  var crv: String
+
+  @Field
+  var kid: String
+
+  @Field
+  var x: String
+
+  @Field
+  var y: String
+
+  @Field
+  var d: String
+
+  @Field
+  var alg: String
+}
+
+struct VerifyOptions: Record {
+  @Field
+  var audience: String?
+
+  @Field
+  var clockTolerance: Double?
+
+  @Field
+  var issuer: String?
+
+  @Field
+  var maxTokenAge: Double?
+
+  @Field
+  var subject: String?
+
+  @Field
+  var typ: String?
+
+  @Field
+  var currentDate: Date?
+
+  @Field
+  var requiredClaims: [String]?
+}
+
+struct VerifyResult: Record {
+  @Field
+  var payload: String
+
+  @Field
+  var protectedHeader: [String: Any]
+}

package/package.json

@@ -0,0 +1,52 @@
+{
+  "name": "@atproto/oauth-client-expo",
+  "version": "0.0.1",
+  "license": "MIT",
+  "description": "ATPROTO OAuth client for Expo applications",
+  "authors": [
+    "Hailey <me@haileyok.com> (https://github.com/haileyok)",
+    "Matthieu Sieben <me@matthieusieben.com> (https://github.com/matthieusieben)"
+  ],
+  "keywords": [
+    "atproto",
+    "oauth",
+    "client",
+    "react-native",
+    "expo"
+  ],
+  "bugs": {
+    "url": "https://github.com/bluesky-social/atproto/issues"
+  },
+  "homepage": "https://github.com/bluesky-social/atproto/tree/main/packages/oauth/oauth-client-expo#readme",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/bluesky-social/atproto",
+    "directory": "packages/oauth/oauth-client-expo"
+  },
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "dependencies": {
+    "abortcontroller-polyfill": "^1.7.8",
+    "core-js": "^3",
+    "event-target-polyfill": "^0.0.4",
+    "expo-web-browser": "^15.0.8",
+    "react-native-mmkv": "^3.3.3",
+    "react-native-url-polyfill": "^3.0.0",
+    "@atproto-labs/simple-store": "0.3.0",
+    "@atproto/oauth-client": "0.5.7",
+    "@atproto/oauth-client-browser": "0.3.33"
+  },
+  "peerDependencies": {
+    "expo": "*",
+    "react-native": "*"
+  },
+  "scripts": {
+    "build": "tsc --build tsconfig.build.json"
+  }
+}

package/src/ExpoAtprotoOAuthClientModule.ts

@@ -0,0 +1,33 @@
+import { NativeModule, requireNativeModule } from 'expo'
+import { SignedJwt, VerifyOptions, VerifyResult } from '@atproto/oauth-client'
+import { ExpoAtprotoOAuthClientModuleEvents } from './ExpoAtprotoOAuthClientModule.types'
+
+export type NativeJwk = {
+  kty: 'EC'
+  crv: 'P-256'
+  kid: string
+  x: string
+  y: string
+  d: string
+  alg: 'ES256'
+}
+
+declare class ExpoAtprotoOAuthClientModule extends NativeModule<ExpoAtprotoOAuthClientModuleEvents> {
+  digest(data: Uint8Array, algo: string): Promise<Uint8Array>
+
+  getRandomValues(byteLength: number): Promise<Uint8Array>
+
+  generatePrivateJwk(algorithm: string): Promise<NativeJwk>
+
+  createJwt(header: string, payload: string, jwk: NativeJwk): Promise<SignedJwt>
+
+  verifyJwt<C extends string = never>(
+    token: SignedJwt,
+    jwk: NativeJwk,
+    options: VerifyOptions<C>,
+  ): Promise<VerifyResult<C>>
+}
+
+export default requireNativeModule<ExpoAtprotoOAuthClientModule>(
+  'ExpoAtprotoOAuthClient',
+)

package/src/ExpoAtprotoOAuthClientModule.types.ts

@@ -0,0 +1,2 @@
+// eslint-disable-next-line @typescript-eslint/ban-types
+export type ExpoAtprotoOAuthClientModuleEvents = {}

package/src/expo-oauth-client-interface.ts

@@ -0,0 +1,10 @@
+import type {
+  AuthorizeOptions,
+  OAuthClient,
+  OAuthSession,
+} from '@atproto/oauth-client'
+
+export interface ExpoOAuthClientInterface extends OAuthClient, Disposable {
+  signIn(input: string, options?: AuthorizeOptions): Promise<OAuthSession>
+  handleCallback(): Promise<null | OAuthSession>
+}

package/src/expo-oauth-client-options.ts

@@ -0,0 +1,27 @@
+import type {
+  OAuthClientMetadataInput,
+  OAuthClientOptions,
+  OAuthResponseMode,
+} from '@atproto/oauth-client'
+
+export type Simplify<T> = { [K in keyof T]: T[K] } & NonNullable<unknown>
+
+export type ExpoOAuthClientOptions = Simplify<
+  {
+    clientMetadata: Readonly<OAuthClientMetadataInput>
+    responseMode?: Exclude<OAuthResponseMode, 'form_post'>
+  } & Omit<
+    OAuthClientOptions,
+    | 'clientMetadata'
+    | 'responseMode'
+    | 'keyset'
+    | 'runtimeImplementation'
+    | 'sessionStore'
+    | 'stateStore'
+    | 'didCache'
+    | 'handleCache'
+    | 'dpopNonceCache'
+    | 'authorizationServerMetadataCache'
+    | 'protectedResourceMetadataCache'
+  >
+>

package/src/expo-oauth-client.d.ts

@@ -0,0 +1,6 @@
+import { ExpoOAuthClientInterface } from './expo-oauth-client-interface'
+import { ExpoOAuthClientOptions } from './expo-oauth-client-options'
+
+export declare class ExpoOAuthClient implements ExpoOAuthClientInterface {
+  constructor(options: ExpoOAuthClientOptions)
+}

package/src/expo-oauth-client.native.ts

@@ -0,0 +1,111 @@
+import './polyfill'
+
+import { openAuthSessionAsync } from 'expo-web-browser'
+import {
+  AuthorizeOptions,
+  OAuthClient,
+  OAuthSession,
+} from '@atproto/oauth-client'
+import { default as NativeModule } from './ExpoAtprotoOAuthClientModule'
+import { ExpoOAuthClientInterface } from './expo-oauth-client-interface'
+import { ExpoOAuthClientOptions } from './expo-oauth-client-options'
+import { ExpoKey } from './utils/expo-key'
+import {
+  AuthorizationServerMetadataCache,
+  DidCache,
+  DpopNonceCache,
+  HandleCache,
+  ProtectedResourceMetadataCache,
+  SessionStore,
+  StateStore,
+} from './utils/stores'
+
+export const CUSTOM_URI_SCHEME_REGEX = /^(?:[^.]+(?:\.[^.]+)+):\/(?:[^/].*)?$/
+const isCustomUriScheme = (uri: string) => CUSTOM_URI_SCHEME_REGEX.test(uri)
+
+export class ExpoOAuthClient
+  extends OAuthClient
+  implements ExpoOAuthClientInterface
+{
+  readonly #disposables: DisposableStack
+
+  constructor(options: ExpoOAuthClientOptions) {
+    using stack = new DisposableStack()
+
+    super({
+      ...options,
+      responseMode: options.responseMode ?? 'query',
+      keyset: undefined,
+      runtimeImplementation: {
+        createKey: async (algs) => ExpoKey.generate(algs),
+        digest: async (bytes, { name }) => NativeModule.digest(bytes, name),
+        getRandomValues: async (length) => NativeModule.getRandomValues(length),
+      },
+      sessionStore: stack.use(new SessionStore()),
+      stateStore: stack.use(new StateStore()),
+      didCache: stack.use(new DidCache()),
+      handleCache: stack.use(new HandleCache()),
+      dpopNonceCache: stack.use(new DpopNonceCache()),
+      authorizationServerMetadataCache: stack.use(
+        new AuthorizationServerMetadataCache(),
+      ),
+      protectedResourceMetadataCache: stack.use(
+        new ProtectedResourceMetadataCache(),
+      ),
+    })
+
+    stack.defer(() => super[Symbol.dispose]?.())
+
+    this.#disposables = stack.move()
+  }
+
+  async handleCallback(): Promise<null | OAuthSession> {
+    return null
+  }
+
+  async signIn(
+    input: string,
+    options?: AuthorizeOptions,
+  ): Promise<OAuthSession> {
+    const redirectUri =
+      options?.redirect_uri ??
+      this.clientMetadata.redirect_uris.find(isCustomUriScheme)
+
+    if (!redirectUri) {
+      throw new TypeError(
+        'A redirect URI with a custom scheme is required for Expo OAuth.',
+      )
+    }
+
+    const url = await this.authorize(input, {
+      ...options,
+      redirect_uri: redirectUri,
+      display: options?.display ?? 'touch',
+    })
+
+    console.debug('openAuthSessionAsync', { url, redirectUri })
+
+    const result = await openAuthSessionAsync(url.toString(), redirectUri)
+
+    console.debug('AUTH SESSION RESULT', result)
+
+    if (result.type === 'success') {
+      const callbackUrl = new URL(result.url)
+      const params =
+        this.responseMode === 'fragment'
+          ? new URLSearchParams(callbackUrl.hash.slice(1))
+          : callbackUrl.searchParams
+
+      const { session } = await this.callback(params, {
+        redirect_uri: redirectUri,
+      })
+      return session
+    } else {
+      throw new Error(`Authentication cancelled: ${result.type}`)
+    }
+  }
+
+  [Symbol.dispose]() {
+    this.#disposables.dispose()
+  }
+}

package/src/expo-oauth-client.web.ts

@@ -0,0 +1,42 @@
+import {
+  AuthorizeOptions,
+  BrowserOAuthClient,
+  OAuthSession,
+} from '@atproto/oauth-client-browser'
+import { ExpoOAuthClientInterface } from './expo-oauth-client-interface'
+import { ExpoOAuthClientOptions } from './expo-oauth-client-options'
+
+export class ExpoOAuthClient
+  extends BrowserOAuthClient
+  implements ExpoOAuthClientInterface
+{
+  constructor({
+    clientMetadata,
+    responseMode = 'fragment',
+    ...options
+  }: ExpoOAuthClientOptions) {
+    super({ ...options, clientMetadata, responseMode })
+  }
+
+  override async signIn(
+    input: string,
+    options?: AuthorizeOptions,
+  ): Promise<OAuthSession> {
+    // Force popup mode
+    return this.signInPopup(input, {
+      ...options,
+      display: options?.display ?? 'touch',
+    })
+  }
+
+  async handleCallback(): Promise<null | OAuthSession> {
+    const params = this.readCallbackParams()
+    if (!params) return null
+
+    const url = this.findRedirectUrl()
+    if (!url) return null
+
+    const { session } = await this.initCallback(params, url)
+    return session
+  }
+}

package/src/index.ts

@@ -0,0 +1,4 @@
+export type { ExpoOAuthClientInterface } from './expo-oauth-client-interface'
+export type { ExpoOAuthClientOptions } from './expo-oauth-client-options'
+
+export { ExpoOAuthClient } from './expo-oauth-client'

package/src/polyfill.ts

@@ -0,0 +1,4 @@
+import 'core-js/proposals/explicit-resource-management'
+import 'abortcontroller-polyfill/dist/polyfill-patch-fetch'
+import 'event-target-polyfill'
+import 'react-native-url-polyfill/auto'