@atproto/oauth-client 0.7.2 → 0.7.4

package/dist/util.js.map

@@ -1 +1 @@
-{"version":3,"file":"util.js","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":"AAGA,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAI,CAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;AAE5E,MAAM,UAAU,WAAW,CAAC,OAAgB;IAC1C,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAA;AAC3D,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,OAA6C;IAE7C,MAAM,UAAU,GAAG,IAAI,yBAAyB,EAAE,CAAA;IAElD,MAAM,OAAO,GAAG,UAA6B,MAAa;QACxD,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,4BAA4B,EAAE;YACrD,KAAK,EAAE,IAAI,CAAC,MAAM;SACnB,CAAC,CAAA;QAEF,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAC1B,CAAC,CAAA;IAED,IAAI,CAAC;QACH,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,GAAG,EAAE,CAAC;gBACR,GAAG,CAAC,cAAc,EAAE,CAAA;gBACpB,GAAG,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;YACvE,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAA;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACrB,MAAM,GAAG,CAAA;IACX,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,yBAA0B,SAAQ,eAAe;IACrD,CAAC,MAAM,CAAC,OAAO,CAAC;QACd,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAA;IACvD,CAAC;CACF","sourcesContent":["export type Awaitable<T> = T | PromiseLike<T>\nexport type Simplify<T> = { [K in keyof T]: T[K] } & NonNullable<unknown>\n\nexport const ifString = <V>(v: V) => (typeof v === 'string' ? v : undefined)\n\nexport function contentMime(headers: Headers): string | undefined {\n  return headers.get('content-type')?.split(';')[0]!.trim()\n}\n\nexport function combineSignals(\n  signals: readonly (AbortSignal | undefined)[],\n): AbortController & Disposable {\n  const controller = new DisposableAbortController()\n\n  const onAbort = function (this: AbortSignal, _event: Event) {\n    const reason = new Error('This operation was aborted', {\n      cause: this.reason,\n    })\n\n    controller.abort(reason)\n  }\n\n  try {\n    for (const sig of signals) {\n      if (sig) {\n        sig.throwIfAborted()\n        sig.addEventListener('abort', onAbort, { signal: controller.signal })\n      }\n    }\n\n    return controller\n  } catch (err) {\n    controller.abort(err)\n    throw err\n  }\n}\n\n/**\n * Allows using {@link AbortController} with the `using` keyword, in order to\n * automatically abort them once the execution block ends.\n */\nclass DisposableAbortController extends AbortController implements Disposable {\n  [Symbol.dispose]() {\n    this.abort(new Error('AbortController was disposed'))\n  }\n}\n"]}
+{"version":3,"file":"util.js","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":"AAGA,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAI,CAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;AAE5E,MAAM,UAAU,WAAW,CAAC,OAAgB;IAC1C,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAA;AAC3D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,EAAU;IACtC,IAAI,OAAO,WAAW,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAC9C,OAAO,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAChC,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;IACxC,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACxD,OAAO,UAAU,CAAC,MAAM,CAAA;AAC1B,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,EAAU;IAC9B,MAAM,OAAO,GAAG,iCAAiC,EAAE,KAAK,CAAA;IACxD,IAAI,OAAO,YAAY,KAAK,UAAU,EAAE,CAAC;QACvC,OAAO,IAAI,YAAY,CAAC,OAAO,EAAE,cAAc,CAAC,CAAA;IAClD,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,CAAA;AAC3B,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,OAA6C;IAE7C,MAAM,UAAU,GAAG,IAAI,yBAAyB,EAAE,CAAA;IAElD,MAAM,OAAO,GAAG,UAA6B,MAAa;QACxD,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,4BAA4B,EAAE;YACrD,KAAK,EAAE,IAAI,CAAC,MAAM;SACnB,CAAC,CAAA;QAEF,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAC1B,CAAC,CAAA;IAED,IAAI,CAAC;QACH,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,GAAG,EAAE,CAAC;gBACR,GAAG,CAAC,cAAc,EAAE,CAAA;gBACpB,GAAG,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;YACvE,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAA;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACrB,MAAM,GAAG,CAAA;IACX,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,yBAA0B,SAAQ,eAAe;IACrD,CAAC,MAAM,CAAC,OAAO,CAAC;QACd,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAA;IACvD,CAAC;CACF","sourcesContent":["export type Awaitable<T> = T | PromiseLike<T>\nexport type Simplify<T> = { [K in keyof T]: T[K] } & NonNullable<unknown>\n\nexport const ifString = <V>(v: V) => (typeof v === 'string' ? v : undefined)\n\nexport function contentMime(headers: Headers): string | undefined {\n  return headers.get('content-type')?.split(';')[0]!.trim()\n}\n\n/**\n * Returns an {@link AbortSignal} that aborts after `ms` milliseconds.\n *\n * Uses the native {@link AbortSignal.timeout} when available, and otherwise\n * falls back to an {@link AbortController} + `setTimeout`. The static\n * `AbortSignal.timeout` method is not implemented in every runtime this package\n * targets (notably React Native / Expo), so relying on it directly throws a\n * `TypeError: AbortSignal.timeout is not a function` at runtime.\n *\n * @see {@link https://github.com/facebook/react-native/issues/42042}\n */\nexport function timeoutSignal(ms: number): AbortSignal {\n  if (typeof AbortSignal.timeout === 'function') {\n    return AbortSignal.timeout(ms)\n  }\n\n  const controller = new AbortController()\n  setTimeout(() => controller.abort(timeoutError(ms)), ms)\n  return controller.signal\n}\n\n/**\n * Builds the reason used to abort a {@link timeoutSignal} fallback. Mirrors the\n * native `AbortSignal.timeout` behaviour (a `TimeoutError` `DOMException`) when\n * `DOMException` is available, and degrades to a plain `Error` in runtimes that\n * lack it.\n */\nfunction timeoutError(ms: number): unknown {\n  const message = `The operation timed out after ${ms} ms`\n  if (typeof DOMException === 'function') {\n    return new DOMException(message, 'TimeoutError')\n  }\n  return new Error(message)\n}\n\nexport function combineSignals(\n  signals: readonly (AbortSignal | undefined)[],\n): AbortController & Disposable {\n  const controller = new DisposableAbortController()\n\n  const onAbort = function (this: AbortSignal, _event: Event) {\n    const reason = new Error('This operation was aborted', {\n      cause: this.reason,\n    })\n\n    controller.abort(reason)\n  }\n\n  try {\n    for (const sig of signals) {\n      if (sig) {\n        sig.throwIfAborted()\n        sig.addEventListener('abort', onAbort, { signal: controller.signal })\n      }\n    }\n\n    return controller\n  } catch (err) {\n    controller.abort(err)\n    throw err\n  }\n}\n\n/**\n * Allows using {@link AbortController} with the `using` keyword, in order to\n * automatically abort them once the execution block ends.\n */\nclass DisposableAbortController extends AbortController implements Disposable {\n  [Symbol.dispose]() {\n    this.abort(new Error('AbortController was disposed'))\n  }\n}\n"]}

package/dist/validate-client-metadata.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate-client-metadata.js","sourceRoot":"","sources":["../src/validate-client-metadata.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7C,OAAO,EAAkB,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAEjE,MAAM,UAAU,sBAAsB,CACpC,KAA+B,EAC/B,MAAe;IAEf,+DAA+D;IAC/D,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,MAAM,EAAE,IAAI,EAAE,CAAC;QACnD,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAA;IAC7C,CAAC;IAED,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAElD,qBAAqB;IACrB,IAAI,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,2BAA2B,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IACjD,CAAC;SAAM,CAAC;QACN,+BAA+B,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IACrD,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;IACzC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAA;IACzE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAA;IAC7D,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAA;IACxE,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,0BAA0B,CAAA;IAClD,MAAM,SAAS,GAAG,QAAQ,CAAC,+BAA+B,CAAA;IAC1D,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,MAAM;YACT,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,IAAI,SAAS,CACjB,gGAAgG,MAAM,GAAG,CAC1G,CAAA;YACH,CAAC;YACD,MAAK;QAEP,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,SAAS,CACjB,4FAA4F,MAAM,GAAG,CACtG,CAAA;YACH,CAAC;YAED,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,SAAS,CACjB,iCAAiC,MAAM,qBAAqB,CAC7D,CAAA;YACH,CAAC;YAED,sEAAsE;YACtE,uEAAuE;YACvE,qDAAqD;YACrD,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CACnE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CACjB,CAAA;YAED,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;gBACxB,MAAM,IAAI,SAAS,CACjB,iCAAiC,MAAM,kEAAkE,CAC1G,CAAA;YACH,CAAC;YAED,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;gBACtE,MAAM,IAAI,SAAS,CACjB,iCAAiC,MAAM,mCAAmC,YAAY,eAAe,CACtG,CAAA;YACH,CAAC;YAED,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAClB,oEAAoE;gBACpE,0BAA0B;gBAC1B,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;oBAC9B,IACE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAChE,CAAC;wBACD,MAAM,IAAI,SAAS,CACjB,4BAA4B,GAAG,CAAC,GAAG,gHAAgH,CACpJ,CAAA;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBAC7B,wEAAwE;gBACxE,wEAAwE;gBACxE,2CAA2C;YAC7C,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,SAAS,CACjB,iCAAiC,MAAM,mBAAmB,CAC3D,CAAA;YACH,CAAC;YAED,MAAK;QACP,CAAC;QAED;YACE,MAAM,IAAI,SAAS,CACjB,mDAAmD,MAAM,EAAE,CAC5D,CAAA;IACL,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC","sourcesContent":["import { Keyset } from '@atproto/jwk'\nimport {\n  OAuthClientMetadataInput,\n  assertOAuthDiscoverableClientId,\n  assertOAuthLoopbackClientId,\n} from '@atproto/oauth-types'\nimport { FALLBACK_ALG } from './constants.js'\nimport { ClientMetadata, clientMetadataSchema } from './types.js'\n\nexport function validateClientMetadata(\n  input: OAuthClientMetadataInput,\n  keyset?: Keyset,\n): ClientMetadata {\n  // Allow to pass a keyset and omit the jwks/jwks_uri properties\n  if (!input.jwks && !input.jwks_uri && keyset?.size) {\n    input = { ...input, jwks: keyset.toJSON() }\n  }\n\n  const metadata = clientMetadataSchema.parse(input)\n\n  // Validate client ID\n  if (metadata.client_id.startsWith('http:')) {\n    assertOAuthLoopbackClientId(metadata.client_id)\n  } else {\n    assertOAuthDiscoverableClientId(metadata.client_id)\n  }\n\n  const scopes = metadata.scope?.split(' ')\n  if (!scopes?.includes('atproto')) {\n    throw new TypeError(`Client metadata must include the \"atproto\" scope`)\n  }\n\n  if (!metadata.response_types.includes('code')) {\n    throw new TypeError(`\"response_types\" must include \"code\"`)\n  }\n\n  if (!metadata.grant_types.includes('authorization_code')) {\n    throw new TypeError(`\"grant_types\" must include \"authorization_code\"`)\n  }\n\n  const method = metadata.token_endpoint_auth_method\n  const methodAlg = metadata.token_endpoint_auth_signing_alg\n  switch (method) {\n    case 'none':\n      if (methodAlg) {\n        throw new TypeError(\n          `\"token_endpoint_auth_signing_alg\" must not be provided when \"token_endpoint_auth_method\" is \"${method}\"`,\n        )\n      }\n      break\n\n    case 'private_key_jwt': {\n      if (!methodAlg) {\n        throw new TypeError(\n          `\"token_endpoint_auth_signing_alg\" must be provided when \"token_endpoint_auth_method\" is \"${method}\"`,\n        )\n      }\n\n      if (!keyset) {\n        throw new TypeError(\n          `Client authentication method \"${method}\" requires a keyset`,\n        )\n      }\n\n      // @NOTE This reproduces the logic from `negotiateClientAuthMethod` at\n      // initialization time to ensure that every key that might end-up being\n      // used is indeed valid & advertised in the metadata.\n      const signingKeys = Array.from(keyset.list({ usage: 'sign' })).filter(\n        (key) => key.kid,\n      )\n\n      if (!signingKeys.length) {\n        throw new TypeError(\n          `Client authentication method \"${method}\" requires at least one active signing key with a \"kid\" property`,\n        )\n      }\n\n      if (!signingKeys.some((key) => key.algorithms.includes(FALLBACK_ALG))) {\n        throw new TypeError(\n          `Client authentication method \"${method}\" requires at least one active \"${FALLBACK_ALG}\" signing key`,\n        )\n      }\n\n      if (metadata.jwks) {\n        // Ensure that all the signing keys that could end-up being used are\n        // advertised in the JWKS.\n        for (const key of signingKeys) {\n          if (\n            !metadata.jwks.keys.some((k) => k.kid === key.kid && !k.revoked)\n          ) {\n            throw new TypeError(\n              `Missing or inactive key \"${key.kid}\" in jwks. Make sure that every signing key of the Keyset is declared as an active key in the Metadata's JWKS.`,\n            )\n          }\n        }\n      } else if (metadata.jwks_uri) {\n        // @NOTE we only ensure that all the signing keys are referenced in JWKS\n        // when it is available (see previous \"if\") as we don't want to download\n        // that file here (for efficiency reasons).\n      } else {\n        throw new TypeError(\n          `Client authentication method \"${method}\" requires a JWKS`,\n        )\n      }\n\n      break\n    }\n\n    default:\n      throw new TypeError(\n        `Unsupported \"token_endpoint_auth_method\" value: ${method}`,\n      )\n  }\n\n  return metadata\n}\n"]}
+{"version":3,"file":"validate-client-metadata.js","sourceRoot":"","sources":["../src/validate-client-metadata.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7C,OAAO,EAAkB,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAEjE,MAAM,UAAU,sBAAsB,CACpC,KAA+B,EAC/B,MAAe;IAEf,+DAA+D;IAC/D,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,MAAM,EAAE,IAAI,EAAE,CAAC;QACnD,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAA;IAC7C,CAAC;IAED,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAElD,qBAAqB;IACrB,IAAI,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,2BAA2B,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IACjD,CAAC;SAAM,CAAC;QACN,+BAA+B,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IACrD,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;IACzC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAA;IACzE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAA;IAC7D,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAA;IACxE,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,0BAA0B,CAAA;IAClD,MAAM,SAAS,GAAG,QAAQ,CAAC,+BAA+B,CAAA;IAC1D,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,MAAM;YACT,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,IAAI,SAAS,CACjB,gGAAgG,MAAM,GAAG,CAC1G,CAAA;YACH,CAAC;YACD,MAAK;QAEP,KAAK,iBAAiB,EAAE,CAAC;YACvB,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,SAAS,CACjB,4FAA4F,MAAM,GAAG,CACtG,CAAA;YACH,CAAC;YAED,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,SAAS,CACjB,iCAAiC,MAAM,qBAAqB,CAC7D,CAAA;YACH,CAAC;YAED,sEAAsE;YACtE,uEAAuE;YACvE,qDAAqD;YACrD,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CACnE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CACjB,CAAA;YAED,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;gBACxB,MAAM,IAAI,SAAS,CACjB,iCAAiC,MAAM,kEAAkE,CAC1G,CAAA;YACH,CAAC;YAED,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;gBACtE,MAAM,IAAI,SAAS,CACjB,iCAAiC,MAAM,mCAAmC,YAAY,eAAe,CACtG,CAAA;YACH,CAAC;YAED,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAClB,oEAAoE;gBACpE,0BAA0B;gBAC1B,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;oBAC9B,IACE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAChE,CAAC;wBACD,MAAM,IAAI,SAAS,CACjB,4BAA4B,GAAG,CAAC,GAAG,gHAAgH,CACpJ,CAAA;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBAC7B,wEAAwE;gBACxE,wEAAwE;gBACxE,2CAA2C;YAC7C,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,SAAS,CACjB,iCAAiC,MAAM,mBAAmB,CAC3D,CAAA;YACH,CAAC;YAED,MAAK;QACP,CAAC;QAED;YACE,MAAM,IAAI,SAAS,CACjB,mDAAmD,MAAM,EAAE,CAC5D,CAAA;IACL,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC","sourcesContent":["import { Keyset } from '@atproto/jwk'\nimport {\n  OAuthClientMetadataInput,\n  assertOAuthDiscoverableClientId,\n  assertOAuthLoopbackClientId,\n} from '@atproto/oauth-types'\nimport { FALLBACK_ALG } from './constants.js'\nimport { ClientMetadata, clientMetadataSchema } from './types.js'\n\nexport function validateClientMetadata(\n  input: OAuthClientMetadataInput,\n  keyset?: Keyset,\n): ClientMetadata {\n  // Allow to pass a keyset and omit the jwks/jwks_uri properties\n  if (!input.jwks && !input.jwks_uri && keyset?.size) {\n    input = { ...input, jwks: keyset.toJSON() }\n  }\n\n  const metadata = clientMetadataSchema.parse(input)\n\n  // Validate client ID\n  if (metadata.client_id.startsWith('http:')) {\n    assertOAuthLoopbackClientId(metadata.client_id)\n  } else {\n    assertOAuthDiscoverableClientId(metadata.client_id)\n  }\n\n  const scopes = metadata.scope?.split(' ')\n  if (!scopes?.includes('atproto')) {\n    throw new TypeError(`Client metadata must include the \"atproto\" scope`)\n  }\n\n  if (!metadata.response_types.includes('code')) {\n    throw new TypeError(`\"response_types\" must include \"code\"`)\n  }\n\n  if (!metadata.grant_types.includes('authorization_code')) {\n    throw new TypeError(`\"grant_types\" must include \"authorization_code\"`)\n  }\n\n  const method = metadata.token_endpoint_auth_method\n  const methodAlg = metadata.token_endpoint_auth_signing_alg\n  switch (method) {\n    case 'none':\n      if (methodAlg) {\n        throw new TypeError(\n          `\"token_endpoint_auth_signing_alg\" must not be provided when \"token_endpoint_auth_method\" is \"${method}\"`,\n        )\n      }\n      break\n\n    case 'private_key_jwt': {\n      if (!methodAlg) {\n        throw new TypeError(\n          `\"token_endpoint_auth_signing_alg\" must be provided when \"token_endpoint_auth_method\" is \"${method}\"`,\n        )\n      }\n\n      if (!keyset) {\n        throw new TypeError(\n          `Client authentication method \"${method}\" requires a keyset`,\n        )\n      }\n\n      // @NOTE This reproduces the logic from `negotiateClientAuthMethod` at\n      // initialization time to ensure that every key that might end-up being\n      // used is indeed valid & advertised in the metadata.\n      const signingKeys = Array.from(keyset.list({ usage: 'sign' })).filter(\n        (key) => key.kid,\n      )\n\n      if (!signingKeys.length) {\n        throw new TypeError(\n          `Client authentication method \"${method}\" requires at least one active signing key with a \"kid\" property`,\n        )\n      }\n\n      if (!signingKeys.some((key) => key.algorithms.includes(FALLBACK_ALG))) {\n        throw new TypeError(\n          `Client authentication method \"${method}\" requires at least one active \"${FALLBACK_ALG}\" signing key`,\n        )\n      }\n\n      if (metadata.jwks) {\n        // Ensure that all the signing keys that could end-up being used are\n        // advertised in the JWKS.\n        for (const key of signingKeys) {\n          if (\n            !metadata.jwks.keys.some((k) => k.kid === key.kid && !k.revoked)\n          ) {\n            throw new TypeError(\n              `Missing or inactive key \"${key.kid}\" in jwks. Make sure that every signing key of the Keyset is declared as an active key in the Metadata's JWKS.`,\n            )\n          }\n        }\n      } else if (metadata.jwks_uri) {\n        // @NOTE we only ensure that all the signing keys are referenced in JWKS\n        // when it is available (see previous \"if\") as we don't want to download\n        // that file here (for efficiency reasons).\n      } else {\n        throw new TypeError(\n          `Client authentication method \"${method}\" requires a JWKS`,\n        )\n      }\n\n      break\n    }\n\n    default:\n      throw new TypeError(\n        `Unsupported \"token_endpoint_auth_method\" value: ${method}`,\n      )\n  }\n\n  return metadata\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atproto/oauth-client",
-  "version": "0.7.2",
+  "version": "0.7.4",
   "engines": {
     "node": ">=22"
   },
@@ -29,21 +29,22 @@
     "core-js": "^3",
     "multiformats": "^13.0.0",
     "zod": "^3.23.8",
-    "@atproto-labs/handle-resolver": "^0.4.1",
-    "@atproto-labs/identity-resolver": "^0.4.0",
-    "@atproto-labs/simple-store": "^0.4.0",
-    "@atproto-labs/did-resolver": "^0.3.1",
-    "@atproto-labs/fetch": "^0.3.0",
-    "@atproto-labs/simple-store-memory": "^0.2.0",
-    "@atproto/jwk": "^0.7.0",
-    "@atproto/oauth-types": "^0.7.1",
-    "@atproto/did": "^0.5.0",
-    "@atproto/xrpc": "^0.8.0"
+    "@atproto-labs/fetch": "^0.3.1",
+    "@atproto-labs/did-resolver": "^0.3.2",
+    "@atproto-labs/simple-store": "^0.4.1",
+    "@atproto-labs/simple-store-memory": "^0.2.1",
+    "@atproto-labs/handle-resolver": "^0.4.2",
+    "@atproto/did": "^0.5.1",
+    "@atproto-labs/identity-resolver": "^0.4.1",
+    "@atproto/jwk": "^0.7.1",
+    "@atproto/oauth-types": "^0.7.2",
+    "@atproto/xrpc": "^0.8.1"
   },
   "devDependencies": {
-    "typescript": "^6.0.3"
+    "vitest": "^4.0.16"
   },
   "scripts": {
-    "build": "tsc --build tsconfig.build.json"
+    "build": "tsgo --build tsconfig.build.json",
+    "test": "vitest run"
   }
 }

package/src/oauth-server-agent.ts

@@ -25,6 +25,7 @@ import { OAuthResolver } from './oauth-resolver.js'
 import { OAuthResponseError } from './oauth-response-error.js'
 import { Runtime } from './runtime.js'
 import { ClientMetadata } from './types.js'
+import { timeoutSignal } from './util.js'
 
 export type { AtprotoOAuthScope, AtprotoOAuthTokenResponse }
 
@@ -189,7 +190,7 @@ export class OAuthServerAgent {
     const resolved = await this.oauthResolver.resolveFromIdentity(sub, {
       noCache: true,
       allowStale: false,
-      signal: AbortSignal.timeout(10e3),
+      signal: timeoutSignal(10e3),
     })
 
     if (this.issuer !== resolved.metadata.issuer) {

package/src/session-getter.ts

@@ -15,7 +15,7 @@ import { OAuthResponseError } from './oauth-response-error.js'
 import { TokenSet } from './oauth-server-agent.js'
 import { OAuthServerFactory } from './oauth-server-factory.js'
 import { Runtime } from './runtime.js'
-import { combineSignals } from './util.js'
+import { combineSignals, timeoutSignal } from './util.js'
 
 export type Session = {
   dpopKey: Key
@@ -247,7 +247,7 @@ export class SessionGetter extends CachedGetter<AtprotoDid, Session> {
       async () => {
         // Make sure, even if there is no signal in the options, that the
         // request will be cancelled after at most 30 seconds.
-        const signal = AbortSignal.timeout(30e3)
+        const signal = timeoutSignal(30e3)
 
         using abortController = combineSignals([options?.signal, signal])
 

package/src/util.test.ts

@@ -0,0 +1,86 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { timeoutSignal } from './util.js'
+
+describe(timeoutSignal, () => {
+  describe('with native AbortSignal.timeout', () => {
+    it('delegates to the native implementation when available', () => {
+      using spy = vi.spyOn(AbortSignal, 'timeout')
+
+      const signal = timeoutSignal(1000)
+
+      expect(spy).toHaveBeenCalledOnce()
+      expect(spy).toHaveBeenCalledWith(1000)
+      expect(signal).toBeInstanceOf(AbortSignal)
+      expect(signal.aborted).toBe(false)
+    })
+
+    it('returns a signal that actually aborts after the timeout', async () => {
+      const signal = timeoutSignal(5)
+      expect(signal.aborted).toBe(false)
+
+      await new Promise((resolve) => setTimeout(resolve, 20))
+      expect(signal.aborted).toBe(true)
+    })
+  })
+
+  describe('without native AbortSignal.timeout (e.g. React Native)', () => {
+    let original: typeof AbortSignal.timeout
+
+    beforeEach(() => {
+      vi.useFakeTimers()
+      original = AbortSignal.timeout
+      // Simulate a runtime that does not implement the static method.
+      // @ts-expect-error intentionally removing a built-in to emulate RN
+      AbortSignal.timeout = undefined
+    })
+
+    afterEach(() => {
+      AbortSignal.timeout = original
+      vi.useRealTimers()
+    })
+
+    it('does not throw and returns a usable AbortSignal', () => {
+      const signal = timeoutSignal(1000)
+      expect(signal).toBeInstanceOf(AbortSignal)
+      expect(signal.aborted).toBe(false)
+    })
+
+    it('aborts the signal once the timeout elapses', () => {
+      const signal = timeoutSignal(1000)
+      const onAbort = vi.fn()
+      signal.addEventListener('abort', onAbort)
+
+      vi.advanceTimersByTime(999)
+      expect(signal.aborted).toBe(false)
+      expect(onAbort).not.toHaveBeenCalled()
+
+      vi.advanceTimersByTime(1)
+      expect(signal.aborted).toBe(true)
+      expect(onAbort).toHaveBeenCalledOnce()
+    })
+
+    it('aborts with a TimeoutError reason', () => {
+      const signal = timeoutSignal(1000)
+      vi.advanceTimersByTime(1000)
+
+      expect(signal.reason).toBeInstanceOf(DOMException)
+      expect(signal.reason.name).toBe('TimeoutError')
+    })
+
+    it('falls back to a plain Error when DOMException is unavailable', () => {
+      const originalDomException = globalThis.DOMException
+      try {
+        // @ts-expect-error intentionally removing a built-in to emulate RN
+        globalThis.DOMException = undefined
+
+        const signal = timeoutSignal(1000)
+        vi.advanceTimersByTime(1000)
+
+        expect(signal.aborted).toBe(true)
+        expect(signal.reason).toBeInstanceOf(Error)
+      } finally {
+        globalThis.DOMException = originalDomException
+      }
+    })
+  })
+})

package/src/util.ts

@@ -7,6 +7,41 @@ export function contentMime(headers: Headers): string | undefined {
   return headers.get('content-type')?.split(';')[0]!.trim()
 }
 
+/**
+ * Returns an {@link AbortSignal} that aborts after `ms` milliseconds.
+ *
+ * Uses the native {@link AbortSignal.timeout} when available, and otherwise
+ * falls back to an {@link AbortController} + `setTimeout`. The static
+ * `AbortSignal.timeout` method is not implemented in every runtime this package
+ * targets (notably React Native / Expo), so relying on it directly throws a
+ * `TypeError: AbortSignal.timeout is not a function` at runtime.
+ *
+ * @see {@link https://github.com/facebook/react-native/issues/42042}
+ */
+export function timeoutSignal(ms: number): AbortSignal {
+  if (typeof AbortSignal.timeout === 'function') {
+    return AbortSignal.timeout(ms)
+  }
+
+  const controller = new AbortController()
+  setTimeout(() => controller.abort(timeoutError(ms)), ms)
+  return controller.signal
+}
+
+/**
+ * Builds the reason used to abort a {@link timeoutSignal} fallback. Mirrors the
+ * native `AbortSignal.timeout` behaviour (a `TimeoutError` `DOMException`) when
+ * `DOMException` is available, and degrades to a plain `Error` in runtimes that
+ * lack it.
+ */
+function timeoutError(ms: number): unknown {
+  const message = `The operation timed out after ${ms} ms`
+  if (typeof DOMException === 'function') {
+    return new DOMException(message, 'TimeoutError')
+  }
+  return new Error(message)
+}
+
 export function combineSignals(
   signals: readonly (AbortSignal | undefined)[],
 ): AbortController & Disposable {

package/tsconfig.build.json

@@ -2,7 +2,8 @@
   "extends": ["../../../tsconfig/isomorphic.json"],
   "compilerOptions": {
     "rootDir": "./src",
-    "outDir": "./dist"
+    "outDir": "./dist",
   },
-  "include": ["./src"]
+  "include": ["./src"],
+  "exclude": ["**/*.test.ts"],
 }

package/tsconfig.build.tsbuildinfo

@@ -1 +1 @@
-{"root":["./src/constants.ts","./src/core-js.d.ts","./src/fetch-dpop.ts","./src/identity-resolver.ts","./src/index.ts","./src/lock.ts","./src/oauth-authorization-server-metadata-resolver.ts","./src/oauth-callback-error.ts","./src/oauth-client-auth.ts","./src/oauth-client.ts","./src/oauth-protected-resource-metadata-resolver.ts","./src/oauth-resolver-error.ts","./src/oauth-resolver.ts","./src/oauth-response-error.ts","./src/oauth-server-agent.ts","./src/oauth-server-factory.ts","./src/oauth-session.ts","./src/runtime-implementation.ts","./src/runtime.ts","./src/session-getter.ts","./src/state-store.ts","./src/types.ts","./src/util.ts","./src/validate-client-metadata.ts","./src/errors/auth-method-unsatisfiable-error.ts","./src/errors/token-invalid-error.ts","./src/errors/token-refresh-error.ts","./src/errors/token-revoked-error.ts"],"version":"6.0.3"}
+{"version":"7.0.0-dev.20260614.1","root":["./src/constants.ts","./src/core-js.d.ts","./src/fetch-dpop.ts","./src/identity-resolver.ts","./src/index.ts","./src/lock.ts","./src/oauth-authorization-server-metadata-resolver.ts","./src/oauth-callback-error.ts","./src/oauth-client-auth.ts","./src/oauth-client.ts","./src/oauth-protected-resource-metadata-resolver.ts","./src/oauth-resolver-error.ts","./src/oauth-resolver.ts","./src/oauth-response-error.ts","./src/oauth-server-agent.ts","./src/oauth-server-factory.ts","./src/oauth-session.ts","./src/runtime-implementation.ts","./src/runtime.ts","./src/session-getter.ts","./src/state-store.ts","./src/types.ts","./src/util.ts","./src/validate-client-metadata.ts","./src/errors/auth-method-unsatisfiable-error.ts","./src/errors/token-invalid-error.ts","./src/errors/token-refresh-error.ts","./src/errors/token-revoked-error.ts"]}

package/tsconfig.json

@@ -1,4 +1,7 @@
 {
   "include": [],
-  "references": [{ "path": "./tsconfig.build.json" }]
+  "references": [
+    { "path": "./tsconfig.build.json" },
+    { "path": "./tsconfig.tests.json" },
+  ],
 }

package/tsconfig.tests.json

@@ -0,0 +1,8 @@
+{
+  "extends": "../../../tsconfig/vitest.json",
+  "include": ["./tests", "./src/**/*.test.ts", "./src/core-js.d.ts"],
+  "compilerOptions": {
+    "rootDir": ".",
+    "noUnusedLocals": false,
+  },
+}

package/vitest.config.ts

@@ -0,0 +1,5 @@
+import { defineProject } from 'vitest/config'
+
+export default defineProject({
+  test: {},
+})