@atproto/oauth-client 0.7.5 → 0.7.7

package/src/util.test.ts

@@ -1,86 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { timeoutSignal } from './util.js'
-
-describe(timeoutSignal, () => {
-  describe('with native AbortSignal.timeout', () => {
-    it('delegates to the native implementation when available', () => {
-      using spy = vi.spyOn(AbortSignal, 'timeout')
-
-      const signal = timeoutSignal(1000)
-
-      expect(spy).toHaveBeenCalledOnce()
-      expect(spy).toHaveBeenCalledWith(1000)
-      expect(signal).toBeInstanceOf(AbortSignal)
-      expect(signal.aborted).toBe(false)
-    })
-
-    it('returns a signal that actually aborts after the timeout', async () => {
-      const signal = timeoutSignal(5)
-      expect(signal.aborted).toBe(false)
-
-      await new Promise((resolve) => setTimeout(resolve, 20))
-      expect(signal.aborted).toBe(true)
-    })
-  })
-
-  describe('without native AbortSignal.timeout (e.g. React Native)', () => {
-    let original: typeof AbortSignal.timeout
-
-    beforeEach(() => {
-      vi.useFakeTimers()
-      original = AbortSignal.timeout
-      // Simulate a runtime that does not implement the static method.
-      // @ts-expect-error intentionally removing a built-in to emulate RN
-      AbortSignal.timeout = undefined
-    })
-
-    afterEach(() => {
-      AbortSignal.timeout = original
-      vi.useRealTimers()
-    })
-
-    it('does not throw and returns a usable AbortSignal', () => {
-      const signal = timeoutSignal(1000)
-      expect(signal).toBeInstanceOf(AbortSignal)
-      expect(signal.aborted).toBe(false)
-    })
-
-    it('aborts the signal once the timeout elapses', () => {
-      const signal = timeoutSignal(1000)
-      const onAbort = vi.fn()
-      signal.addEventListener('abort', onAbort)
-
-      vi.advanceTimersByTime(999)
-      expect(signal.aborted).toBe(false)
-      expect(onAbort).not.toHaveBeenCalled()
-
-      vi.advanceTimersByTime(1)
-      expect(signal.aborted).toBe(true)
-      expect(onAbort).toHaveBeenCalledOnce()
-    })
-
-    it('aborts with a TimeoutError reason', () => {
-      const signal = timeoutSignal(1000)
-      vi.advanceTimersByTime(1000)
-
-      expect(signal.reason).toBeInstanceOf(DOMException)
-      expect(signal.reason.name).toBe('TimeoutError')
-    })
-
-    it('falls back to a plain Error when DOMException is unavailable', () => {
-      const originalDomException = globalThis.DOMException
-      try {
-        // @ts-expect-error intentionally removing a built-in to emulate RN
-        globalThis.DOMException = undefined
-
-        const signal = timeoutSignal(1000)
-        vi.advanceTimersByTime(1000)
-
-        expect(signal.aborted).toBe(true)
-        expect(signal.reason).toBeInstanceOf(Error)
-      } finally {
-        globalThis.DOMException = originalDomException
-      }
-    })
-  })
-})

package/src/util.ts

@@ -1,81 +0,0 @@
-export type Awaitable<T> = T | PromiseLike<T>
-export type Simplify<T> = { [K in keyof T]: T[K] } & NonNullable<unknown>
-
-export const ifString = <V>(v: V) => (typeof v === 'string' ? v : undefined)
-
-export function contentMime(headers: Headers): string | undefined {
-  return headers.get('content-type')?.split(';')[0]!.trim()
-}
-
-/**
- * Returns an {@link AbortSignal} that aborts after `ms` milliseconds.
- *
- * Uses the native {@link AbortSignal.timeout} when available, and otherwise
- * falls back to an {@link AbortController} + `setTimeout`. The static
- * `AbortSignal.timeout` method is not implemented in every runtime this package
- * targets (notably React Native / Expo), so relying on it directly throws a
- * `TypeError: AbortSignal.timeout is not a function` at runtime.
- *
- * @see {@link https://github.com/facebook/react-native/issues/42042}
- */
-export function timeoutSignal(ms: number): AbortSignal {
-  if (typeof AbortSignal.timeout === 'function') {
-    return AbortSignal.timeout(ms)
-  }
-
-  const controller = new AbortController()
-  setTimeout(() => controller.abort(timeoutError(ms)), ms)
-  return controller.signal
-}
-
-/**
- * Builds the reason used to abort a {@link timeoutSignal} fallback. Mirrors the
- * native `AbortSignal.timeout` behaviour (a `TimeoutError` `DOMException`) when
- * `DOMException` is available, and degrades to a plain `Error` in runtimes that
- * lack it.
- */
-function timeoutError(ms: number): unknown {
-  const message = `The operation timed out after ${ms} ms`
-  if (typeof DOMException === 'function') {
-    return new DOMException(message, 'TimeoutError')
-  }
-  return new Error(message)
-}
-
-export function combineSignals(
-  signals: readonly (AbortSignal | undefined)[],
-): AbortController & Disposable {
-  const controller = new DisposableAbortController()
-
-  const onAbort = function (this: AbortSignal, _event: Event) {
-    const reason = new Error('This operation was aborted', {
-      cause: this.reason,
-    })
-
-    controller.abort(reason)
-  }
-
-  try {
-    for (const sig of signals) {
-      if (sig) {
-        sig.throwIfAborted()
-        sig.addEventListener('abort', onAbort, { signal: controller.signal })
-      }
-    }
-
-    return controller
-  } catch (err) {
-    controller.abort(err)
-    throw err
-  }
-}
-
-/**
- * Allows using {@link AbortController} with the `using` keyword, in order to
- * automatically abort them once the execution block ends.
- */
-class DisposableAbortController extends AbortController implements Disposable {
-  [Symbol.dispose]() {
-    this.abort(new Error('AbortController was disposed'))
-  }
-}

package/src/validate-client-metadata.ts

@@ -1,116 +0,0 @@
-import { Keyset } from '@atproto/jwk'
-import {
-  OAuthClientMetadataInput,
-  assertOAuthDiscoverableClientId,
-  assertOAuthLoopbackClientId,
-} from '@atproto/oauth-types'
-import { FALLBACK_ALG } from './constants.js'
-import { ClientMetadata, clientMetadataSchema } from './types.js'
-
-export function validateClientMetadata(
-  input: OAuthClientMetadataInput,
-  keyset?: Keyset,
-): ClientMetadata {
-  // Allow to pass a keyset and omit the jwks/jwks_uri properties
-  if (!input.jwks && !input.jwks_uri && keyset?.size) {
-    input = { ...input, jwks: keyset.toJSON() }
-  }
-
-  const metadata = clientMetadataSchema.parse(input)
-
-  // Validate client ID
-  if (metadata.client_id.startsWith('http:')) {
-    assertOAuthLoopbackClientId(metadata.client_id)
-  } else {
-    assertOAuthDiscoverableClientId(metadata.client_id)
-  }
-
-  const scopes = metadata.scope?.split(' ')
-  if (!scopes?.includes('atproto')) {
-    throw new TypeError(`Client metadata must include the "atproto" scope`)
-  }
-
-  if (!metadata.response_types.includes('code')) {
-    throw new TypeError(`"response_types" must include "code"`)
-  }
-
-  if (!metadata.grant_types.includes('authorization_code')) {
-    throw new TypeError(`"grant_types" must include "authorization_code"`)
-  }
-
-  const method = metadata.token_endpoint_auth_method
-  const methodAlg = metadata.token_endpoint_auth_signing_alg
-  switch (method) {
-    case 'none':
-      if (methodAlg) {
-        throw new TypeError(
-          `"token_endpoint_auth_signing_alg" must not be provided when "token_endpoint_auth_method" is "${method}"`,
-        )
-      }
-      break
-
-    case 'private_key_jwt': {
-      if (!methodAlg) {
-        throw new TypeError(
-          `"token_endpoint_auth_signing_alg" must be provided when "token_endpoint_auth_method" is "${method}"`,
-        )
-      }
-
-      if (!keyset) {
-        throw new TypeError(
-          `Client authentication method "${method}" requires a keyset`,
-        )
-      }
-
-      // @NOTE This reproduces the logic from `negotiateClientAuthMethod` at
-      // initialization time to ensure that every key that might end-up being
-      // used is indeed valid & advertised in the metadata.
-      const signingKeys = Array.from(keyset.list({ usage: 'sign' })).filter(
-        (key) => key.kid,
-      )
-
-      if (!signingKeys.length) {
-        throw new TypeError(
-          `Client authentication method "${method}" requires at least one active signing key with a "kid" property`,
-        )
-      }
-
-      if (!signingKeys.some((key) => key.algorithms.includes(FALLBACK_ALG))) {
-        throw new TypeError(
-          `Client authentication method "${method}" requires at least one active "${FALLBACK_ALG}" signing key`,
-        )
-      }
-
-      if (metadata.jwks) {
-        // Ensure that all the signing keys that could end-up being used are
-        // advertised in the JWKS.
-        for (const key of signingKeys) {
-          if (
-            !metadata.jwks.keys.some((k) => k.kid === key.kid && !k.revoked)
-          ) {
-            throw new TypeError(
-              `Missing or inactive key "${key.kid}" in jwks. Make sure that every signing key of the Keyset is declared as an active key in the Metadata's JWKS.`,
-            )
-          }
-        }
-      } else if (metadata.jwks_uri) {
-        // @NOTE we only ensure that all the signing keys are referenced in JWKS
-        // when it is available (see previous "if") as we don't want to download
-        // that file here (for efficiency reasons).
-      } else {
-        throw new TypeError(
-          `Client authentication method "${method}" requires a JWKS`,
-        )
-      }
-
-      break
-    }
-
-    default:
-      throw new TypeError(
-        `Unsupported "token_endpoint_auth_method" value: ${method}`,
-      )
-  }
-
-  return metadata
-}

package/tsconfig.build.json

@@ -1,9 +0,0 @@
-{
-  "extends": ["../../../tsconfig/isomorphic.json"],
-  "compilerOptions": {
-    "rootDir": "./src",
-    "outDir": "./dist",
-  },
-  "include": ["./src"],
-  "exclude": ["**/*.test.ts"],
-}

package/tsconfig.build.tsbuildinfo

@@ -1 +0,0 @@
-{"version":"7.0.0-dev.20260614.1","root":["./src/constants.ts","./src/core-js.d.ts","./src/fetch-dpop.ts","./src/identity-resolver.ts","./src/index.ts","./src/lock.ts","./src/oauth-authorization-server-metadata-resolver.ts","./src/oauth-callback-error.ts","./src/oauth-client-auth.ts","./src/oauth-client.ts","./src/oauth-protected-resource-metadata-resolver.ts","./src/oauth-resolver-error.ts","./src/oauth-resolver.ts","./src/oauth-response-error.ts","./src/oauth-server-agent.ts","./src/oauth-server-factory.ts","./src/oauth-session.ts","./src/runtime-implementation.ts","./src/runtime.ts","./src/session-getter.ts","./src/state-store.ts","./src/types.ts","./src/util.ts","./src/validate-client-metadata.ts","./src/errors/auth-method-unsatisfiable-error.ts","./src/errors/token-invalid-error.ts","./src/errors/token-refresh-error.ts","./src/errors/token-revoked-error.ts"]}

package/tsconfig.json

@@ -1,7 +0,0 @@
-{
-  "include": [],
-  "references": [
-    { "path": "./tsconfig.build.json" },
-    { "path": "./tsconfig.tests.json" },
-  ],
-}

package/tsconfig.tests.json

@@ -1,8 +0,0 @@
-{
-  "extends": "../../../tsconfig/vitest.json",
-  "include": ["./tests", "./src/**/*.test.ts", "./src/core-js.d.ts"],
-  "compilerOptions": {
-    "rootDir": ".",
-    "noUnusedLocals": false,
-  },
-}

package/vitest.config.ts

@@ -1,5 +0,0 @@
-import { defineProject } from 'vitest/config'
-
-export default defineProject({
-  test: {},
-})