@atproto/oauth-client 0.7.8 → 0.7.9
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +18 -0
- package/dist/fetch-dpop.d.ts +3 -3
- package/dist/fetch-dpop.d.ts.map +1 -1
- package/dist/fetch-dpop.js +1 -1
- package/dist/fetch-dpop.js.map +1 -1
- package/dist/lock.d.ts +1 -1
- package/dist/lock.d.ts.map +1 -1
- package/dist/lock.js.map +1 -1
- package/dist/oauth-authorization-server-metadata-resolver.d.ts +3 -3
- package/dist/oauth-authorization-server-metadata-resolver.d.ts.map +1 -1
- package/dist/oauth-authorization-server-metadata-resolver.js.map +1 -1
- package/dist/oauth-client-auth.d.ts +5 -5
- package/dist/oauth-client-auth.d.ts.map +1 -1
- package/dist/oauth-client-auth.js.map +1 -1
- package/dist/oauth-client.d.ts +12 -12
- package/dist/oauth-client.d.ts.map +1 -1
- package/dist/oauth-client.js.map +1 -1
- package/dist/oauth-protected-resource-metadata-resolver.d.ts +3 -3
- package/dist/oauth-protected-resource-metadata-resolver.d.ts.map +1 -1
- package/dist/oauth-protected-resource-metadata-resolver.js.map +1 -1
- package/dist/oauth-resolver.d.ts +4 -4
- package/dist/oauth-resolver.d.ts.map +1 -1
- package/dist/oauth-resolver.js.map +1 -1
- package/dist/oauth-response-error.d.ts +1 -1
- package/dist/oauth-response-error.d.ts.map +1 -1
- package/dist/oauth-response-error.js.map +1 -1
- package/dist/oauth-server-agent.d.ts +9 -9
- package/dist/oauth-server-agent.d.ts.map +1 -1
- package/dist/oauth-server-agent.js +1 -1
- package/dist/oauth-server-agent.js.map +1 -1
- package/dist/oauth-server-factory.d.ts +9 -9
- package/dist/oauth-server-factory.d.ts.map +1 -1
- package/dist/oauth-server-factory.js.map +1 -1
- package/dist/oauth-session.d.ts +5 -5
- package/dist/oauth-session.d.ts.map +1 -1
- package/dist/oauth-session.js.map +1 -1
- package/dist/runtime-implementation.d.ts +2 -2
- package/dist/runtime-implementation.d.ts.map +1 -1
- package/dist/runtime-implementation.js.map +1 -1
- package/dist/runtime.d.ts +2 -2
- package/dist/runtime.d.ts.map +1 -1
- package/dist/runtime.js.map +1 -1
- package/dist/session-getter.d.ts +7 -7
- package/dist/session-getter.d.ts.map +1 -1
- package/dist/session-getter.js.map +1 -1
- package/dist/state-store.d.ts +3 -3
- package/dist/state-store.d.ts.map +1 -1
- package/dist/state-store.js.map +1 -1
- package/dist/types.d.ts +3 -3
- package/dist/types.d.ts.map +1 -1
- package/dist/types.js.map +1 -1
- package/dist/validate-client-metadata.d.ts +3 -3
- package/dist/validate-client-metadata.d.ts.map +1 -1
- package/dist/validate-client-metadata.js.map +1 -1
- package/package.json +11 -11
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"validate-client-metadata.js","sourceRoot":"","sources":["../src/validate-client-metadata.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7C,OAAO,
|
|
1
|
+
{"version":3,"file":"validate-client-metadata.js","sourceRoot":"","sources":["../src/validate-client-metadata.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7C,OAAO,EAAuB,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAEtE,MAAM,UAAU,sBAAsB,CACpC,KAA+B,EAC/B,MAAe;IAEf,+DAA+D;IAC/D,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,MAAM,EAAE,IAAI,EAAE,CAAC;QACnD,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAA;IAC7C,CAAC;IAED,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAElD,qBAAqB;IACrB,IAAI,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,2BAA2B,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IACjD,CAAC;SAAM,CAAC;QACN,+BAA+B,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IACrD,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;IACzC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAA;IACzE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAA;IAC7D,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAA;IACxE,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,0BAA0B,CAAA;IAClD,MAAM,SAAS,GAAG,QAAQ,CAAC,+BAA+B,CAAA;IAC1D,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,MAAM;YACT,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,IAAI,SAAS,CACjB,gGAAgG,MAAM,GAAG,CAC1G,CAAA;YACH,CAAC;YACD,MAAK;QAEP,KAAK,iBAAiB,EAAE,CAAC;YACvB,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,SAAS,CACjB,4FAA4F,MAAM,GAAG,CACtG,CAAA;YACH,CAAC;YAED,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,SAAS,CACjB,iCAAiC,MAAM,qBAAqB,CAC7D,CAAA;YACH,CAAC;YAED,sEAAsE;YACtE,uEAAuE;YACvE,qDAAqD;YACrD,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CACnE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CACjB,CAAA;YAED,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;gBACxB,MAAM,IAAI,SAAS,CACjB,iCAAiC,MAAM,kEAAkE,CAC1G,CAAA;YACH,CAAC;YAED,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;gBACtE,MAAM,IAAI,SAAS,CACjB,iCAAiC,MAAM,mCAAmC,YAAY,eAAe,CACtG,CAAA;YACH,CAAC;YAED,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAClB,oEAAoE;gBACpE,0BAA0B;gBAC1B,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;oBAC9B,IACE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAChE,CAAC;wBACD,MAAM,IAAI,SAAS,CACjB,4BAA4B,GAAG,CAAC,GAAG,gHAAgH,CACpJ,CAAA;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBAC7B,wEAAwE;gBACxE,wEAAwE;gBACxE,2CAA2C;YAC7C,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,SAAS,CACjB,iCAAiC,MAAM,mBAAmB,CAC3D,CAAA;YACH,CAAC;YAED,MAAK;QACP,CAAC;QAED;YACE,MAAM,IAAI,SAAS,CACjB,mDAAmD,MAAM,EAAE,CAC5D,CAAA;IACL,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC","sourcesContent":["import type { Keyset } from '@atproto/jwk'\nimport {\n type OAuthClientMetadataInput,\n assertOAuthDiscoverableClientId,\n assertOAuthLoopbackClientId,\n} from '@atproto/oauth-types'\nimport { FALLBACK_ALG } from './constants.js'\nimport { type ClientMetadata, clientMetadataSchema } from './types.js'\n\nexport function validateClientMetadata(\n input: OAuthClientMetadataInput,\n keyset?: Keyset,\n): ClientMetadata {\n // Allow to pass a keyset and omit the jwks/jwks_uri properties\n if (!input.jwks && !input.jwks_uri && keyset?.size) {\n input = { ...input, jwks: keyset.toJSON() }\n }\n\n const metadata = clientMetadataSchema.parse(input)\n\n // Validate client ID\n if (metadata.client_id.startsWith('http:')) {\n assertOAuthLoopbackClientId(metadata.client_id)\n } else {\n assertOAuthDiscoverableClientId(metadata.client_id)\n }\n\n const scopes = metadata.scope?.split(' ')\n if (!scopes?.includes('atproto')) {\n throw new TypeError(`Client metadata must include the \"atproto\" scope`)\n }\n\n if (!metadata.response_types.includes('code')) {\n throw new TypeError(`\"response_types\" must include \"code\"`)\n }\n\n if (!metadata.grant_types.includes('authorization_code')) {\n throw new TypeError(`\"grant_types\" must include \"authorization_code\"`)\n }\n\n const method = metadata.token_endpoint_auth_method\n const methodAlg = metadata.token_endpoint_auth_signing_alg\n switch (method) {\n case 'none':\n if (methodAlg) {\n throw new TypeError(\n `\"token_endpoint_auth_signing_alg\" must not be provided when \"token_endpoint_auth_method\" is \"${method}\"`,\n )\n }\n break\n\n case 'private_key_jwt': {\n if (!methodAlg) {\n throw new TypeError(\n `\"token_endpoint_auth_signing_alg\" must be provided when \"token_endpoint_auth_method\" is \"${method}\"`,\n )\n }\n\n if (!keyset) {\n throw new TypeError(\n `Client authentication method \"${method}\" requires a keyset`,\n )\n }\n\n // @NOTE This reproduces the logic from `negotiateClientAuthMethod` at\n // initialization time to ensure that every key that might end-up being\n // used is indeed valid & advertised in the metadata.\n const signingKeys = Array.from(keyset.list({ usage: 'sign' })).filter(\n (key) => key.kid,\n )\n\n if (!signingKeys.length) {\n throw new TypeError(\n `Client authentication method \"${method}\" requires at least one active signing key with a \"kid\" property`,\n )\n }\n\n if (!signingKeys.some((key) => key.algorithms.includes(FALLBACK_ALG))) {\n throw new TypeError(\n `Client authentication method \"${method}\" requires at least one active \"${FALLBACK_ALG}\" signing key`,\n )\n }\n\n if (metadata.jwks) {\n // Ensure that all the signing keys that could end-up being used are\n // advertised in the JWKS.\n for (const key of signingKeys) {\n if (\n !metadata.jwks.keys.some((k) => k.kid === key.kid && !k.revoked)\n ) {\n throw new TypeError(\n `Missing or inactive key \"${key.kid}\" in jwks. Make sure that every signing key of the Keyset is declared as an active key in the Metadata's JWKS.`,\n )\n }\n }\n } else if (metadata.jwks_uri) {\n // @NOTE we only ensure that all the signing keys are referenced in JWKS\n // when it is available (see previous \"if\") as we don't want to download\n // that file here (for efficiency reasons).\n } else {\n throw new TypeError(\n `Client authentication method \"${method}\" requires a JWKS`,\n )\n }\n\n break\n }\n\n default:\n throw new TypeError(\n `Unsupported \"token_endpoint_auth_method\" value: ${method}`,\n )\n }\n\n return metadata\n}\n"]}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@atproto/oauth-client",
|
|
3
|
-
"version": "0.7.
|
|
3
|
+
"version": "0.7.9",
|
|
4
4
|
"license": "MIT",
|
|
5
5
|
"description": "OAuth client for ATPROTO PDS. This package serves as common base for environment-specific implementations (NodeJS, Browser, React-Native).",
|
|
6
6
|
"keywords": [
|
|
@@ -34,16 +34,16 @@
|
|
|
34
34
|
"core-js": "^3",
|
|
35
35
|
"multiformats": "^13.0.0",
|
|
36
36
|
"zod": "^3.23.8",
|
|
37
|
-
"@atproto-labs/
|
|
38
|
-
"@atproto-labs/
|
|
39
|
-
"@atproto-labs/
|
|
40
|
-
"@atproto-labs/
|
|
41
|
-
"@atproto-labs/
|
|
42
|
-
"@atproto
|
|
43
|
-
"@atproto/
|
|
44
|
-
"@atproto/
|
|
45
|
-
"@atproto/
|
|
46
|
-
"@atproto/xrpc": "^0.8.
|
|
37
|
+
"@atproto-labs/fetch": "^0.3.4",
|
|
38
|
+
"@atproto-labs/simple-store": "^0.4.4",
|
|
39
|
+
"@atproto-labs/identity-resolver": "^0.4.4",
|
|
40
|
+
"@atproto-labs/handle-resolver": "^0.4.5",
|
|
41
|
+
"@atproto-labs/simple-store-memory": "^0.2.4",
|
|
42
|
+
"@atproto/did": "^0.5.4",
|
|
43
|
+
"@atproto/jwk": "^0.7.4",
|
|
44
|
+
"@atproto/oauth-types": "^0.7.5",
|
|
45
|
+
"@atproto-labs/did-resolver": "^0.3.5",
|
|
46
|
+
"@atproto/xrpc": "^0.8.5"
|
|
47
47
|
},
|
|
48
48
|
"devDependencies": {
|
|
49
49
|
"vitest": "^4.0.16"
|