@atproto/oauth-client 0.7.6 → 0.7.7

package/src/oauth-resolver.ts

@@ -1,177 +0,0 @@
-import { extractPdsUrl } from '@atproto/did'
-import {
-  OAuthAuthorizationServerMetadata,
-  oauthIssuerIdentifierSchema,
-} from '@atproto/oauth-types'
-import {
-  IdentityInfo,
-  IdentityResolver,
-  ResolveIdentityOptions,
-} from '@atproto-labs/identity-resolver'
-import {
-  GetCachedOptions,
-  OAuthAuthorizationServerMetadataResolver,
-} from './oauth-authorization-server-metadata-resolver.js'
-import { OAuthProtectedResourceMetadataResolver } from './oauth-protected-resource-metadata-resolver.js'
-import { OAuthResolverError } from './oauth-resolver-error.js'
-
-export type { GetCachedOptions }
-export type ResolveOAuthOptions = GetCachedOptions & ResolveIdentityOptions
-
-export class OAuthResolver {
-  constructor(
-    readonly identityResolver: IdentityResolver,
-    readonly protectedResourceMetadataResolver: OAuthProtectedResourceMetadataResolver,
-    readonly authorizationServerMetadataResolver: OAuthAuthorizationServerMetadataResolver,
-  ) {}
-
-  /**
-   * @param input - A handle, DID, PDS URL or Entryway URL
-   */
-  public async resolve(
-    input: string,
-    options?: ResolveOAuthOptions,
-  ): Promise<{
-    identityInfo?: IdentityInfo
-    metadata: OAuthAuthorizationServerMetadata
-  }> {
-    // Allow using an entryway, or PDS url, directly as login input (e.g.
-    // when the user forgot their handle, or when the handle does not
-    // resolve to a DID)
-    return /^https?:\/\//.test(input)
-      ? this.resolveFromService(input, options)
-      : this.resolveFromIdentity(input, options)
-  }
-
-  /**
-   * @note this method can be used to verify if a particular uri supports OAuth
-   * based sign-in (for compatibility with legacy implementation).
-   */
-  public async resolveFromService(
-    input: string,
-    options?: ResolveOAuthOptions,
-  ): Promise<{
-    metadata: OAuthAuthorizationServerMetadata
-  }> {
-    try {
-      // Assume first that input is a PDS URL (as required by ATPROTO)
-      const metadata = await this.getResourceServerMetadata(input, options)
-      return { metadata }
-    } catch (err) {
-      if (!options?.signal?.aborted && err instanceof OAuthResolverError) {
-        try {
-          // Fallback to trying to fetch as an issuer (Entryway)
-          const result = oauthIssuerIdentifierSchema.safeParse(input)
-          if (result.success) {
-            const metadata = await this.getAuthorizationServerMetadata(
-              result.data,
-              options,
-            )
-            return { metadata }
-          }
-        } catch {
-          // Fallback failed, throw original error
-        }
-      }
-
-      throw err
-    }
-  }
-
-  public async resolveFromIdentity(
-    input: string,
-    options?: ResolveOAuthOptions,
-  ): Promise<{
-    identityInfo: IdentityInfo
-    metadata: OAuthAuthorizationServerMetadata
-    pds: URL
-  }> {
-    const identityInfo = await this.resolveIdentity(input, options)
-
-    options?.signal?.throwIfAborted()
-
-    const pds = extractPdsUrl(identityInfo.didDoc)
-
-    const metadata = await this.getResourceServerMetadata(pds, options)
-
-    return { identityInfo, metadata, pds }
-  }
-
-  public async resolveIdentity(
-    input: string,
-    options?: ResolveIdentityOptions,
-  ): Promise<IdentityInfo> {
-    try {
-      return await this.identityResolver.resolve(input, options)
-    } catch (cause) {
-      throw OAuthResolverError.from(
-        cause,
-        `Failed to resolve identity: ${input}`,
-      )
-    }
-  }
-
-  public async getAuthorizationServerMetadata(
-    issuer: string | URL,
-    options?: GetCachedOptions,
-  ): Promise<OAuthAuthorizationServerMetadata> {
-    try {
-      return await this.authorizationServerMetadataResolver.get(issuer, options)
-    } catch (cause) {
-      throw OAuthResolverError.from(
-        cause,
-        `Failed to resolve OAuth server metadata for issuer: ${issuer}`,
-      )
-    }
-  }
-
-  public async getResourceServerMetadata(
-    pdsUrl: string | URL,
-    options?: GetCachedOptions,
-  ) {
-    try {
-      const rsMetadata = await this.protectedResourceMetadataResolver.get(
-        pdsUrl,
-        options,
-      )
-
-      if (!rsMetadata) {
-        return this.getAuthorizationServerMetadata(pdsUrl, options)
-      }
-
-      // ATPROTO requires one, and only one, authorization server entry
-      if (rsMetadata.authorization_servers?.length !== 1) {
-        throw new OAuthResolverError(
-          rsMetadata.authorization_servers?.length
-            ? `Unable to determine authorization server for PDS: ${pdsUrl}`
-            : `No authorization servers found for PDS: ${pdsUrl}`,
-        )
-      }
-
-      const issuer = rsMetadata.authorization_servers![0]!
-
-      options?.signal?.throwIfAborted()
-
-      const asMetadata = await this.getAuthorizationServerMetadata(
-        issuer,
-        options,
-      )
-
-      // https://www.rfc-editor.org/rfc/rfc9728.html#section-4
-      if (asMetadata.protected_resources) {
-        if (!asMetadata.protected_resources.includes(rsMetadata.resource)) {
-          throw new OAuthResolverError(
-            `PDS "${pdsUrl}" not protected by issuer "${issuer}"`,
-          )
-        }
-      }
-
-      return asMetadata
-    } catch (cause) {
-      throw OAuthResolverError.from(
-        cause,
-        `Failed to resolve OAuth server metadata for resource: ${pdsUrl}`,
-      )
-    }
-  }
-}

package/src/oauth-response-error.ts

@@ -1,33 +0,0 @@
-import { Json } from '@atproto-labs/fetch'
-import { ifString } from './util.js'
-
-export class OAuthResponseError extends Error {
-  readonly error?: string
-  readonly errorDescription?: string
-
-  constructor(
-    public readonly response: Response,
-    public readonly payload: Json,
-  ) {
-    const objPayload = typeof payload === 'object' ? payload : undefined
-    const error = ifString(objPayload?.['error'])
-    const errorDescription = ifString(objPayload?.['error_description'])
-
-    const messageError = error ? `"${error}"` : 'unknown'
-    const messageDesc = errorDescription ? `: ${errorDescription}` : ''
-    const message = `OAuth ${messageError} error${messageDesc}`
-
-    super(message)
-
-    this.error = error
-    this.errorDescription = errorDescription
-  }
-
-  get status() {
-    return this.response.status
-  }
-
-  get headers() {
-    return this.response.headers
-  }
-}

package/src/oauth-server-agent.ts

@@ -1,289 +0,0 @@
-import { AtprotoDid } from '@atproto/did'
-import { Key, Keyset } from '@atproto/jwk'
-import {
-  AtprotoOAuthScope,
-  AtprotoOAuthTokenResponse,
-  OAuthAuthorizationRequestPar,
-  OAuthAuthorizationServerMetadata,
-  OAuthEndpointName,
-  OAuthParResponse,
-  OAuthRedirectUri,
-  OAuthTokenRequest,
-  atprotoOAuthTokenResponseSchema,
-  oauthParResponseSchema,
-} from '@atproto/oauth-types'
-import { Fetch, Json, bindFetch, fetchJsonProcessor } from '@atproto-labs/fetch'
-import { SimpleStore } from '@atproto-labs/simple-store'
-import { TokenRefreshError } from './errors/token-refresh-error.js'
-import { dpopFetchWrapper } from './fetch-dpop.js'
-import {
-  ClientAuthMethod,
-  ClientCredentialsFactory,
-  createClientCredentialsFactory,
-} from './oauth-client-auth.js'
-import { OAuthResolver } from './oauth-resolver.js'
-import { OAuthResponseError } from './oauth-response-error.js'
-import { Runtime } from './runtime.js'
-import { ClientMetadata } from './types.js'
-import { timeoutSignal } from './util.js'
-
-export type { AtprotoOAuthScope, AtprotoOAuthTokenResponse }
-
-export type TokenSet = {
-  iss: string
-  sub: AtprotoDid
-  aud: string
-  scope: AtprotoOAuthScope
-
-  refresh_token?: string
-  access_token: string
-  token_type: 'DPoP'
-  /** ISO Date */
-  expires_at?: string
-}
-
-export type DpopNonceCache = SimpleStore<string, string>
-
-export class OAuthServerAgent {
-  protected dpopFetch: Fetch<unknown>
-  protected clientCredentialsFactory: ClientCredentialsFactory
-
-  /**
-   * @throws see {@link createClientCredentialsFactory}
-   */
-  constructor(
-    readonly authMethod: ClientAuthMethod,
-    readonly dpopKey: Key,
-    readonly serverMetadata: OAuthAuthorizationServerMetadata,
-    readonly clientMetadata: ClientMetadata,
-    readonly dpopNonces: DpopNonceCache,
-    readonly oauthResolver: OAuthResolver,
-    readonly runtime: Runtime,
-    readonly keyset?: Keyset,
-    fetch?: Fetch,
-  ) {
-    this.clientCredentialsFactory = createClientCredentialsFactory(
-      authMethod,
-      serverMetadata,
-      clientMetadata,
-      runtime,
-      keyset,
-    )
-
-    this.dpopFetch = dpopFetchWrapper<void>({
-      fetch: bindFetch(fetch),
-      key: dpopKey,
-      supportedAlgs: serverMetadata.dpop_signing_alg_values_supported,
-      sha256: async (v) => runtime.sha256(v),
-      nonces: dpopNonces,
-      isAuthServer: true,
-    })
-  }
-
-  get issuer() {
-    return this.serverMetadata.issuer
-  }
-
-  async revoke(token: string) {
-    try {
-      await this.request('revocation', { token })
-    } catch {
-      // Don't care
-    }
-  }
-
-  async exchangeCode(
-    code: string,
-    codeVerifier?: string,
-    redirectUri?: OAuthRedirectUri,
-  ): Promise<TokenSet> {
-    const now = Date.now()
-
-    const tokenResponse = await this.request('token', {
-      grant_type: 'authorization_code',
-      // redirectUri should always be passed by the calling code, but if it is
-      // not, default to the first redirect_uri registered for the client:
-      redirect_uri: redirectUri ?? this.clientMetadata.redirect_uris[0],
-      code,
-      code_verifier: codeVerifier,
-    })
-
-    try {
-      // /!\ IMPORTANT /!\
-      //
-      // The tokenResponse MUST always be valid before the "sub" it contains
-      // can be trusted (see Atproto's OAuth spec for details).
-      const aud = await this.verifyIssuer(tokenResponse.sub)
-
-      return {
-        aud,
-        sub: tokenResponse.sub,
-        iss: this.issuer,
-
-        scope: tokenResponse.scope,
-        refresh_token: tokenResponse.refresh_token,
-        access_token: tokenResponse.access_token,
-        token_type: tokenResponse.token_type,
-
-        expires_at:
-          typeof tokenResponse.expires_in === 'number'
-            ? new Date(now + tokenResponse.expires_in * 1000).toISOString()
-            : undefined,
-      }
-    } catch (err) {
-      await this.revoke(tokenResponse.access_token)
-
-      throw err
-    }
-  }
-
-  async refresh(tokenSet: TokenSet): Promise<TokenSet> {
-    if (!tokenSet.refresh_token) {
-      throw new TokenRefreshError(tokenSet.sub, 'No refresh token available')
-    }
-
-    // /!\ IMPORTANT /!\
-    //
-    // The "sub" MUST be a DID, whose issuer authority is indeed the server we
-    // are trying to obtain credentials from. Note that we are doing this
-    // *before* we actually try to refresh the token:
-    // 1) To avoid unnecessary refresh
-    // 2) So that the refresh is the last async operation, ensuring as few
-    //    async operations happen before the result gets a chance to be stored.
-    const aud = await this.verifyIssuer(tokenSet.sub)
-
-    const now = Date.now()
-
-    const tokenResponse = await this.request('token', {
-      grant_type: 'refresh_token',
-      refresh_token: tokenSet.refresh_token,
-    })
-
-    return {
-      aud,
-      sub: tokenSet.sub,
-      iss: this.issuer,
-
-      scope: tokenResponse.scope,
-      refresh_token: tokenResponse.refresh_token,
-      access_token: tokenResponse.access_token,
-      token_type: tokenResponse.token_type,
-
-      expires_at:
-        typeof tokenResponse.expires_in === 'number'
-          ? new Date(now + tokenResponse.expires_in * 1000).toISOString()
-          : undefined,
-    }
-  }
-
-  /**
-   * VERY IMPORTANT ! Always call this to process token responses.
-   *
-   * Whenever an OAuth token response is received, we **MUST** verify that the
-   * "sub" is a DID, whose issuer authority is indeed the server we just
-   * obtained credentials from. This check is a critical step to actually be
-   * able to use the "sub" (DID) as being the actual user's identifier.
-   *
-   * @returns The user's PDS URL (the resource server for the user)
-   */
-  protected async verifyIssuer(sub: AtprotoDid): Promise<string> {
-    const resolved = await this.oauthResolver.resolveFromIdentity(sub, {
-      noCache: true,
-      allowStale: false,
-      signal: timeoutSignal(10e3),
-    })
-
-    if (this.issuer !== resolved.metadata.issuer) {
-      // Best case scenario; the user switched PDS. Worst case scenario; a bad
-      // actor is trying to impersonate a user. In any case, we must not allow
-      // this token to be used.
-      throw new TypeError('Issuer mismatch')
-    }
-
-    return resolved.pds.href
-  }
-
-  async request<Endpoint extends OAuthEndpointName>(
-    endpoint: Endpoint,
-    payload: Endpoint extends 'token'
-      ? OAuthTokenRequest
-      : Endpoint extends 'pushed_authorization_request'
-        ? OAuthAuthorizationRequestPar
-        : Record<string, unknown>,
-  ): Promise<
-    Endpoint extends 'token'
-      ? AtprotoOAuthTokenResponse
-      : Endpoint extends 'pushed_authorization_request'
-        ? OAuthParResponse
-        : Json
-  >
-  async request(
-    endpoint: OAuthEndpointName,
-    payload: Record<string, unknown>,
-  ): Promise<unknown> {
-    const url = this.serverMetadata[`${endpoint}_endpoint`]
-    if (!url) throw new Error(`No ${endpoint} endpoint available`)
-
-    const auth = await this.clientCredentialsFactory()
-
-    // https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-13#section-3.2.2
-    // https://datatracker.ietf.org/doc/html/rfc7009#section-2.1
-    // https://datatracker.ietf.org/doc/html/rfc7662#section-2.1
-    // https://datatracker.ietf.org/doc/html/rfc9126#section-2
-    const { response, json } = await this.dpopFetch(url, {
-      method: 'POST',
-      headers: {
-        ...auth.headers,
-        'Content-Type': 'application/x-www-form-urlencoded',
-      },
-      body: wwwFormUrlEncode({ ...payload, ...auth.payload }),
-    }).then(fetchJsonProcessor())
-
-    if (response.ok) {
-      switch (endpoint) {
-        case 'token':
-          return atprotoOAuthTokenResponseSchema.parse(json)
-        case 'pushed_authorization_request':
-          return oauthParResponseSchema.parse(json)
-        default:
-          return json
-      }
-    } else {
-      throw new OAuthResponseError(response, json)
-    }
-  }
-}
-
-function wwwFormUrlEncode(payload: Record<string, undefined | unknown>) {
-  return new URLSearchParams(
-    Object.entries(payload)
-      .filter(entryHasDefinedValue)
-      .map(stringifyEntryValue),
-  ).toString()
-}
-
-function entryHasDefinedValue(
-  entry: [string, unknown],
-): entry is [string, null | NonNullable<unknown>] {
-  return entry[1] !== undefined
-}
-
-function stringifyEntryValue(entry: [string, unknown]): [string, string] {
-  const name = entry[0]
-  const value = entry[1]
-
-  switch (typeof value) {
-    case 'string':
-      return [name, value]
-    case 'number':
-    case 'boolean':
-      return [name, String(value)]
-    default: {
-      const enc = JSON.stringify(value)
-      if (enc === undefined) {
-        throw new Error(`Unsupported value type for ${name}: ${String(value)}`)
-      }
-      return [name, enc]
-    }
-  }
-}

package/src/oauth-server-factory.ts

@@ -1,64 +0,0 @@
-import { Key, Keyset } from '@atproto/jwk'
-import { OAuthAuthorizationServerMetadata } from '@atproto/oauth-types'
-import { Fetch } from '@atproto-labs/fetch'
-import { GetCachedOptions } from './oauth-authorization-server-metadata-resolver.js'
-import { ClientAuthMethod } from './oauth-client-auth.js'
-import { OAuthResolver } from './oauth-resolver.js'
-import { DpopNonceCache, OAuthServerAgent } from './oauth-server-agent.js'
-import { Runtime } from './runtime.js'
-import { ClientMetadata } from './types.js'
-
-export class OAuthServerFactory {
-  constructor(
-    readonly clientMetadata: ClientMetadata,
-    readonly runtime: Runtime,
-    readonly resolver: OAuthResolver,
-    readonly fetch: Fetch,
-    readonly keyset: Keyset | undefined,
-    readonly dpopNonceCache: DpopNonceCache,
-  ) {}
-
-  /**
-   * @param authMethod `undefined` means that we are restoring a session that
-   * was created before we started storing the `authMethod` in the session. In
-   * that case, we will use the first key from the keyset.
-   *
-   * Support for this might be removed in the future.
-   *
-   * @throws see {@link OAuthServerFactory.fromMetadata}
-   */
-  async fromIssuer(
-    issuer: string,
-    authMethod: ClientAuthMethod,
-    dpopKey: Key,
-    options?: GetCachedOptions,
-  ) {
-    const serverMetadata = await this.resolver.getAuthorizationServerMetadata(
-      issuer,
-      options,
-    )
-
-    return this.fromMetadata(serverMetadata, authMethod, dpopKey)
-  }
-
-  /**
-   * @throws see {@link OAuthServerAgent}
-   */
-  async fromMetadata(
-    serverMetadata: OAuthAuthorizationServerMetadata,
-    authMethod: ClientAuthMethod,
-    dpopKey: Key,
-  ) {
-    return new OAuthServerAgent(
-      authMethod,
-      dpopKey,
-      serverMetadata,
-      this.clientMetadata,
-      this.dpopNonceCache,
-      this.resolver,
-      this.runtime,
-      this.keyset,
-      this.fetch,
-    )
-  }
-}