@atproto/oauth-client 0.7.5 → 0.7.7

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # @atproto/oauth-client
 
+## 0.7.7
+
+### Patch Changes
+
+- [#5099](https://github.com/bluesky-social/atproto/pull/5099) [`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Update TypeScript build to rely on references to composite internal projects
+
+- [#5099](https://github.com/bluesky-social/atproto/pull/5099) [`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Bundle only necessary files in the NPM tarball, including the `CHANGELOG.md` and `README.md` files (if present).
+
+- Updated dependencies [[`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07), [`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07), [`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07)]:
+  - @atproto-labs/simple-store-memory@0.2.3
+  - @atproto-labs/identity-resolver@0.4.3
+  - @atproto-labs/handle-resolver@0.4.4
+  - @atproto-labs/did-resolver@0.3.4
+  - @atproto-labs/simple-store@0.4.3
+  - @atproto/oauth-types@0.7.4
+  - @atproto-labs/fetch@0.3.3
+  - @atproto/jwk@0.7.3
+  - @atproto/xrpc@0.8.3
+  - @atproto/did@0.5.3
+
+## 0.7.6
+
+### Patch Changes
+
+- [#5157](https://github.com/bluesky-social/atproto/pull/5157) [`8bcba69`](https://github.com/bluesky-social/atproto/commit/8bcba69cf1f02d09e07b51ce091918312029df63) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Minor syntax fix in tests
+
 ## 0.7.5
 
 ### Patch Changes

package/package.json

@@ -1,9 +1,6 @@
 {
   "name": "@atproto/oauth-client",
-  "version": "0.7.5",
-  "engines": {
-    "node": ">=22"
-  },
+  "version": "0.7.7",
   "license": "MIT",
   "description": "OAuth client for ATPROTO PDS. This package serves as common base for environment-specific implementations (NodeJS, Browser, React-Native).",
   "keywords": [
@@ -18,6 +15,11 @@
     "url": "https://github.com/bluesky-social/atproto",
     "directory": "packages/oauth/oauth-client"
   },
+  "files": [
+    "./dist",
+    "./README.md",
+    "./CHANGELOG.md"
+  ],
   "type": "module",
   "exports": {
     ".": {
@@ -25,20 +27,23 @@
       "default": "./dist/index.js"
     }
   },
+  "engines": {
+    "node": ">=22"
+  },
   "dependencies": {
     "core-js": "^3",
     "multiformats": "^13.0.0",
     "zod": "^3.23.8",
-    "@atproto-labs/did-resolver": "^0.3.3",
-    "@atproto-labs/fetch": "^0.3.2",
-    "@atproto-labs/identity-resolver": "^0.4.2",
-    "@atproto-labs/simple-store-memory": "^0.2.2",
-    "@atproto/did": "^0.5.2",
-    "@atproto/jwk": "^0.7.2",
-    "@atproto-labs/handle-resolver": "^0.4.3",
-    "@atproto-labs/simple-store": "^0.4.2",
-    "@atproto/oauth-types": "^0.7.3",
-    "@atproto/xrpc": "^0.8.2"
+    "@atproto-labs/fetch": "^0.3.3",
+    "@atproto-labs/identity-resolver": "^0.4.3",
+    "@atproto/jwk": "^0.7.3",
+    "@atproto-labs/simple-store": "^0.4.3",
+    "@atproto-labs/handle-resolver": "^0.4.4",
+    "@atproto/did": "^0.5.3",
+    "@atproto-labs/simple-store-memory": "^0.2.3",
+    "@atproto-labs/did-resolver": "^0.3.4",
+    "@atproto/xrpc": "^0.8.3",
+    "@atproto/oauth-types": "^0.7.4"
   },
   "devDependencies": {
     "vitest": "^4.0.16"

package/src/constants.ts

@@ -1,4 +0,0 @@
-/**
- * Per ATProto spec (OpenID uses RS256)
- */
-export const FALLBACK_ALG = 'ES256'

package/src/core-js.d.ts

@@ -1 +0,0 @@
-declare module 'core-js/es/symbol/dispose.js'

package/src/errors/auth-method-unsatisfiable-error.ts

@@ -1 +0,0 @@
-export class AuthMethodUnsatisfiableError extends Error {}

package/src/errors/token-invalid-error.ts

@@ -1,9 +0,0 @@
-export class TokenInvalidError extends Error {
-  constructor(
-    public readonly sub: string,
-    message = `The session for "${sub}" is invalid`,
-    options?: { cause?: unknown },
-  ) {
-    super(message, options)
-  }
-}

package/src/errors/token-refresh-error.ts

@@ -1,9 +0,0 @@
-export class TokenRefreshError extends Error {
-  constructor(
-    public readonly sub: string,
-    message: string,
-    options?: { cause?: unknown },
-  ) {
-    super(message, options)
-  }
-}

package/src/errors/token-revoked-error.ts

@@ -1,9 +0,0 @@
-export class TokenRevokedError extends Error {
-  constructor(
-    public readonly sub: string,
-    message = `The session for "${sub}" was successfully revoked`,
-    options?: { cause?: unknown },
-  ) {
-    super(message, options)
-  }
-}

package/src/fetch-dpop.ts

@@ -1,250 +0,0 @@
-import { base64url } from 'multiformats/bases/base64'
-import { Key } from '@atproto/jwk'
-import { Fetch, FetchContext, cancelBody, peekJson } from '@atproto-labs/fetch'
-import { SimpleStore } from '@atproto-labs/simple-store'
-
-// "undefined" in non https environments or environments without crypto
-const subtle = globalThis.crypto?.subtle as SubtleCrypto | undefined
-
-const ReadableStream = globalThis.ReadableStream as
-  | typeof globalThis.ReadableStream
-  | undefined
-
-export type DpopFetchWrapperOptions<C = FetchContext> = {
-  key: Key
-  nonces: SimpleStore<string, string>
-  supportedAlgs?: string[]
-  sha256?: (input: string) => Promise<string>
-
-  /**
-   * Is the intended server an authorization server (true) or a resource server
-   * (false)? Setting this may allow to avoid parsing the response body to
-   * determine the dpop-nonce.
-   *
-   * @default undefined
-   */
-  isAuthServer?: boolean
-  fetch?: Fetch<C>
-}
-
-export function dpopFetchWrapper<C = FetchContext>({
-  key,
-  // @TODO we should provide a default based on specs
-  supportedAlgs,
-  nonces,
-  sha256 = typeof subtle !== 'undefined' ? subtleSha256 : undefined,
-  isAuthServer,
-  fetch = globalThis.fetch,
-}: DpopFetchWrapperOptions<C>): Fetch<C> {
-  if (!sha256) {
-    throw new TypeError(
-      `crypto.subtle is not available in this environment. Please provide a sha256 function.`,
-    )
-  }
-
-  // Throws if negotiation fails
-  const alg = negotiateAlg(key, supportedAlgs)
-
-  return async function (this: C, input, init) {
-    const request: Request =
-      init == null && input instanceof Request
-        ? input
-        : new Request(input, init)
-
-    const authorizationHeader = request.headers.get('Authorization')
-    const ath = authorizationHeader?.startsWith('DPoP ')
-      ? await sha256(authorizationHeader.slice(5))
-      : undefined
-
-    const { origin } = new URL(request.url)
-
-    const htm = request.method
-    const htu = buildHtu(request.url)
-
-    let initNonce: string | undefined
-    try {
-      initNonce = await nonces.get(origin)
-    } catch {
-      // Ignore get errors, we will just not send a nonce
-    }
-
-    const initProof = await buildProof(key, alg, htm, htu, initNonce, ath)
-    request.headers.set('DPoP', initProof)
-
-    const initResponse = await fetch.call(this, request)
-
-    // Make sure the response body is consumed. Either by the caller (when the
-    // response is returned), of if an error is thrown (catch block).
-
-    const nextNonce = initResponse.headers.get('DPoP-Nonce')
-    if (!nextNonce || nextNonce === initNonce) {
-      // No nonce was returned or it is the same as the one we sent. No need to
-      // update the nonce store, or retry the request.
-      return initResponse
-    }
-
-    // Store the fresh nonce for future requests
-    try {
-      await nonces.set(origin, nextNonce)
-    } catch {
-      // Ignore set errors
-    }
-
-    const shouldRetry = await isUseDpopNonceError(initResponse, isAuthServer)
-    if (!shouldRetry) {
-      // Not a "use_dpop_nonce" error, so there is no need to retry
-      return initResponse
-    }
-
-    // If the input stream was already consumed, we cannot retry the request. A
-    // solution would be to clone() the request but that would bufferize the
-    // entire stream in memory which can lead to memory starvation. Instead, we
-    // will return the original response and let the calling code handle retries.
-
-    if (input === request) {
-      // The input request body was consumed. We cannot retry the request.
-      return initResponse
-    }
-
-    if (ReadableStream && init?.body instanceof ReadableStream) {
-      // The init body was consumed. We cannot retry the request.
-      return initResponse
-    }
-
-    // We will now retry the request with the fresh nonce.
-
-    // The initial response body must be consumed (see cancelBody's doc).
-    await cancelBody(initResponse, 'log')
-
-    const nextProof = await buildProof(key, alg, htm, htu, nextNonce, ath)
-    const nextRequest = new Request(input, init)
-    nextRequest.headers.set('DPoP', nextProof)
-
-    const retryRequest = await fetch.call(this, nextRequest)
-    const retryNonce = retryRequest.headers.get('DPoP-Nonce')
-    if (!retryNonce || retryNonce === initNonce) {
-      // No nonce was returned or it is the same as the one we sent. No need to
-      // update the nonce store, or retry the request.
-      return retryRequest
-    }
-
-    // Store the fresh nonce for future requests
-    try {
-      await nonces.set(origin, retryNonce)
-    } catch {
-      // Ignore set errors
-    }
-
-    return retryRequest
-  }
-}
-
-/**
- * Strip query and fragment
- *
- * @see {@link https://www.rfc-editor.org/rfc/rfc9449.html#section-4.2-4.6}
- */
-function buildHtu(url: string): string {
-  const fragmentIndex = url.indexOf('#')
-  const queryIndex = url.indexOf('?')
-
-  const end =
-    fragmentIndex === -1
-      ? queryIndex
-      : queryIndex === -1
-        ? fragmentIndex
-        : Math.min(fragmentIndex, queryIndex)
-
-  return end === -1 ? url : url.slice(0, end)
-}
-
-async function buildProof(
-  key: Key,
-  alg: string,
-  htm: string,
-  htu: string,
-  nonce?: string,
-  ath?: string,
-) {
-  const jwk = key.bareJwk
-  if (!jwk) {
-    throw new Error('Only asymmetric keys can be used as DPoP proofs')
-  }
-
-  const now = Math.floor(Date.now() / 1e3)
-
-  return key.createJwt(
-    // https://datatracker.ietf.org/doc/html/rfc9449#section-4.2
-    {
-      alg,
-      typ: 'dpop+jwt',
-      jwk,
-    },
-    {
-      iat: now,
-      // Any collision will cause the request to be rejected by the server. no biggie.
-      jti: Math.random().toString(36).slice(2),
-      htm,
-      htu,
-      nonce,
-      ath,
-    },
-  )
-}
-
-async function isUseDpopNonceError(
-  response: Response,
-  isAuthServer?: boolean,
-): Promise<boolean> {
-  // https://datatracker.ietf.org/doc/html/rfc6750#section-3
-  // https://datatracker.ietf.org/doc/html/rfc9449#name-resource-server-provided-no
-  if (isAuthServer === undefined || isAuthServer === false) {
-    if (response.status === 401) {
-      const wwwAuth = response.headers.get('WWW-Authenticate')
-      if (wwwAuth?.startsWith('DPoP')) {
-        return wwwAuth.includes('error="use_dpop_nonce"')
-      }
-    }
-  }
-
-  // https://datatracker.ietf.org/doc/html/rfc9449#name-authorization-server-provid
-  if (isAuthServer === undefined || isAuthServer === true) {
-    if (response.status === 400) {
-      try {
-        const json = await peekJson(response, 10 * 1024)
-        return typeof json === 'object' && json?.['error'] === 'use_dpop_nonce'
-      } catch {
-        // Response too big (to be "use_dpop_nonce" error) or invalid JSON
-        return false
-      }
-    }
-  }
-
-  return false
-}
-
-function negotiateAlg(key: Key, supportedAlgs: string[] | undefined): string {
-  if (supportedAlgs) {
-    // Use order of supportedAlgs as preference
-    const alg = supportedAlgs.find((a) => key.algorithms.includes(a))
-    if (alg) return alg
-  } else {
-    const [alg] = key.algorithms
-    if (alg) return alg
-  }
-
-  throw new Error('Key does not match any alg supported by the server')
-}
-
-async function subtleSha256(input: string): Promise<string> {
-  if (subtle == null) {
-    throw new Error(
-      `crypto.subtle is not available in this environment. Please provide a sha256 function.`,
-    )
-  }
-
-  const bytes = new TextEncoder().encode(input)
-  const digest = await subtle.digest('SHA-256', bytes)
-  const digestBytes = new Uint8Array(digest)
-  return base64url.baseEncode(digestBytes)
-}

package/src/identity-resolver.ts

@@ -1,25 +0,0 @@
-export {
-  type CreateIdentityResolverOptions,
-  createIdentityResolver,
-} from '@atproto-labs/identity-resolver'
-
-// @TODO Currently, the `OAuthClient`'s `IdentityResolver` is an instance of
-// `AtprotoIdentityResolver`, which implements the ATProto Identity resolution
-// protocol (did resolution + dns resolution). In the future, we may want to
-// allow using a different `IdentityResolver` implementation, such as one based
-// on XRPC's "com.atproto.identity.resolveIdentity" method. This would be
-// particularly useful for browser based clients, since DNS lookups are not
-// available in browser environments (and require an alternative implementation,
-// such as one based on the "com.atproto.identity.resolveHandle" XRPC method, or
-// using DNS-over-HTTPS). Once we decide to support such a behavior, the
-// `identityResolver` option below should be made mandatory, and the code bellow
-// should be removed from the @atproto/oauth-client package (and moved to the
-// environment specific package, such as @atproto/oauth-client-browser and
-// @atproto/oauth-client-node), allowing the dependency graph to be optimized
-// for the specific environment. When that is done, the
-// `AtprotoIdentityResolver` class should also be moved to its own package.
-
-// @TODO Once we move to a distinct implementation, we should also introduce a
-// caching layer for the `IdentityResolver` to avoid redundant resolution
-// requests. Once this is done, the caching layers for the did and handle
-// resolvers should be removed as they will be redundant.

package/src/index.ts

@@ -1,32 +0,0 @@
-import 'core-js/es/symbol/dispose.js'
-
-export * from '@atproto-labs/did-resolver'
-export {
-  FetchError,
-  FetchRequestError,
-  FetchResponseError,
-} from '@atproto-labs/fetch'
-export * from '@atproto-labs/handle-resolver'
-
-export * from '@atproto/did'
-export * from '@atproto/jwk'
-export * from '@atproto/oauth-types'
-
-export * from './lock.js'
-export * from './oauth-authorization-server-metadata-resolver.js'
-export * from './oauth-callback-error.js'
-export * from './oauth-client.js'
-export * from './oauth-protected-resource-metadata-resolver.js'
-export * from './oauth-resolver-error.js'
-export * from './oauth-response-error.js'
-export * from './oauth-server-agent.js'
-export * from './oauth-server-factory.js'
-export * from './oauth-session.js'
-export * from './runtime-implementation.js'
-export * from './session-getter.js'
-export * from './state-store.js'
-export * from './types.js'
-
-export * from './errors/token-invalid-error.js'
-export * from './errors/token-refresh-error.js'
-export * from './errors/token-revoked-error.js'

package/src/lock.ts

@@ -1,33 +0,0 @@
-import { RuntimeLock } from './runtime-implementation.js'
-
-const locks = new Map<unknown, Promise<void>>()
-
-function acquireLocalLock(name: unknown): Promise<() => void> {
-  return new Promise((resolveAcquire) => {
-    const prev = locks.get(name) ?? Promise.resolve()
-    const next = prev.then(() => {
-      return new Promise<void>((resolveRelease) => {
-        const release = () => {
-          // Only delete the lock if it is still the current one
-          if (locks.get(name) === next) locks.delete(name)
-
-          resolveRelease()
-        }
-
-        resolveAcquire(release)
-      })
-    })
-
-    locks.set(name, next)
-  })
-}
-
-export const requestLocalLock: RuntimeLock = (name, fn) => {
-  return acquireLocalLock(name).then(async (release) => {
-    try {
-      return await fn()
-    } finally {
-      release()
-    }
-  })
-}

package/src/oauth-authorization-server-metadata-resolver.ts

@@ -1,120 +0,0 @@
-import {
-  OAuthAuthorizationServerMetadata,
-  oauthAuthorizationServerMetadataValidator,
-  oauthIssuerIdentifierSchema,
-} from '@atproto/oauth-types'
-import {
-  Fetch,
-  FetchResponseError,
-  bindFetch,
-  cancelBody,
-} from '@atproto-labs/fetch'
-import {
-  CachedGetter,
-  GetCachedOptions,
-  SimpleStore,
-} from '@atproto-labs/simple-store'
-import { contentMime } from './util.js'
-
-export type { GetCachedOptions, OAuthAuthorizationServerMetadata }
-
-export type AuthorizationServerMetadataCache = SimpleStore<
-  string,
-  OAuthAuthorizationServerMetadata
->
-
-export type OAuthAuthorizationServerMetadataResolverConfig = {
-  allowHttpIssuer?: boolean
-}
-
-/**
- * @see {@link https://datatracker.ietf.org/doc/html/rfc8414}
- */
-export class OAuthAuthorizationServerMetadataResolver extends CachedGetter<
-  string,
-  OAuthAuthorizationServerMetadata
-> {
-  private readonly fetch: Fetch<unknown>
-  private readonly allowHttpIssuer: boolean
-
-  constructor(
-    cache: AuthorizationServerMetadataCache,
-    fetch?: Fetch,
-    config?: OAuthAuthorizationServerMetadataResolverConfig,
-  ) {
-    super(async (issuer, options) => this.fetchMetadata(issuer, options), cache)
-
-    this.fetch = bindFetch(fetch)
-    this.allowHttpIssuer = config?.allowHttpIssuer === true
-  }
-
-  async get(
-    input: URL | string,
-    options?: GetCachedOptions,
-  ): Promise<OAuthAuthorizationServerMetadata> {
-    const issuer = oauthIssuerIdentifierSchema.parse(String(input))
-    if (!this.allowHttpIssuer && issuer.startsWith('http:')) {
-      throw new TypeError(
-        'Unsecure issuer URL protocol only allowed in development and test environments',
-      )
-    }
-    return super.get(issuer, options)
-  }
-
-  private async fetchMetadata(
-    issuer: string,
-    options?: GetCachedOptions,
-  ): Promise<OAuthAuthorizationServerMetadata> {
-    const url = new URL(`/.well-known/oauth-authorization-server`, issuer)
-    const request = new Request(url, {
-      headers: { accept: 'application/json' },
-      cache: options?.noCache ? 'no-cache' : undefined,
-      signal: options?.signal,
-      redirect: 'manual', // response must be 200 OK
-    })
-
-    const response = await this.fetch(request)
-
-    // https://datatracker.ietf.org/doc/html/rfc8414#section-3.2
-    if (response.status !== 200) {
-      await cancelBody(response, 'log')
-      throw await FetchResponseError.from(
-        response,
-        `Unexpected status code ${response.status} for "${url}"`,
-        undefined,
-        { cause: request },
-      )
-    }
-
-    if (contentMime(response.headers) !== 'application/json') {
-      await cancelBody(response, 'log')
-      throw await FetchResponseError.from(
-        response,
-        `Unexpected content type for "${url}"`,
-        undefined,
-        { cause: request },
-      )
-    }
-
-    const metadata = oauthAuthorizationServerMetadataValidator.parse(
-      await response.json(),
-    )
-
-    // Validate the issuer (MIX-UP attacks)
-    // https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics#name-mix-up-attacks
-    // https://datatracker.ietf.org/doc/html/rfc8414#section-2
-    if (metadata.issuer !== issuer) {
-      throw new TypeError(`Invalid issuer ${metadata.issuer}`)
-    }
-
-    // ATPROTO requires client_id_metadata_document
-    // https://datatracker.ietf.org/doc/draft-ietf-oauth-client-id-metadata-document/
-    if (metadata.client_id_metadata_document_supported !== true) {
-      throw new TypeError(
-        `Authorization server "${issuer}" does not support client_id_metadata_document`,
-      )
-    }
-
-    return metadata
-  }
-}

package/src/oauth-callback-error.ts

@@ -1,16 +0,0 @@
-export class OAuthCallbackError extends Error {
-  static from(err: unknown, params: URLSearchParams, state?: string) {
-    if (err instanceof OAuthCallbackError) return err
-    const message = err instanceof Error ? err.message : undefined
-    return new OAuthCallbackError(params, message, state, err)
-  }
-
-  constructor(
-    public readonly params: URLSearchParams,
-    message = params.get('error_description') || 'OAuth callback error',
-    public readonly state?: string,
-    cause?: unknown,
-  ) {
-    super(message, { cause })
-  }
-}