@atproto/oauth-provider-api 0.7.2 → 0.7.3

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # @atproto/oauth-provider-api
 
+## 0.7.3
+
+### Patch Changes
+
+- [#5099](https://github.com/bluesky-social/atproto/pull/5099) [`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Update TypeScript build to rely on references to composite internal projects
+
+- [#5099](https://github.com/bluesky-social/atproto/pull/5099) [`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Bundle only necessary files in the NPM tarball, including the `CHANGELOG.md` and `README.md` files (if present).
+
+- [#5099](https://github.com/bluesky-social/atproto/pull/5099) [`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Build with `noImplicitAny` enabled
+
+- Updated dependencies [[`28a0b58`](https://github.com/bluesky-social/atproto/commit/28a0b588147863eaef948cd2bb8fc0f19d08cda9), [`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07), [`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07), [`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07), [`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07)]:
+  - @atproto/syntax@0.6.4
+  - @atproto/oauth-types@0.7.4
+  - @atproto/jwk@0.7.3
+
 ## 0.7.2
 
 ### Patch Changes

package/package.json

@@ -1,9 +1,6 @@
 {
   "name": "@atproto/oauth-provider-api",
-  "version": "0.7.2",
-  "engines": {
-    "node": ">=22"
-  },
+  "version": "0.7.3",
   "license": "MIT",
   "description": "Shared data types for the @atproto/oauth-provider and @atproto/oauth-provider-ui packages",
   "keywords": [
@@ -18,6 +15,10 @@
     "url": "https://github.com/bluesky-social/atproto",
     "directory": "packages/oauth/oauth-provider-api"
   },
+  "files": [
+    "./dist",
+    "./CHANGELOG.md"
+  ],
   "type": "module",
   "exports": {
     ".": {
@@ -25,12 +26,14 @@
       "default": "./dist/index.js"
     }
   },
+  "engines": {
+    "node": ">=22"
+  },
   "dependencies": {
-    "@atproto/oauth-types": "^0.7.3",
-    "@atproto/syntax": "^0.6.3",
-    "@atproto/jwk": "^0.7.2"
+    "@atproto/oauth-types": "^0.7.4",
+    "@atproto/syntax": "^0.6.4",
+    "@atproto/jwk": "^0.7.3"
   },
-  "devDependencies": {},
   "scripts": {
     "build": "tsgo --build tsconfig.build.json"
   }

package/src/api-endpoints.ts

@@ -1,364 +0,0 @@
-import type { SignedJwt } from '@atproto/jwk'
-import type { OAuthClientMetadata } from '@atproto/oauth-types'
-import type { DatetimeString, DidString, HandleString } from '@atproto/syntax'
-import type {
-  Account,
-  DeviceMetadata,
-  ISODateString,
-  Session,
-} from './types.js'
-
-export type { DidString }
-
-// These are the endpoints implemented by the OAuth provider, for its UI to
-// call.
-
-export type ApiEndpoints = {
-  '/verify-handle-availability': {
-    method: 'POST'
-    input: VerifyHandleAvailabilityInput
-    output: { available: true }
-  }
-  '/sign-up': {
-    method: 'POST'
-    input: SignUpInput
-    output: SignUpOutput
-  }
-  '/sign-in': {
-    method: 'POST'
-    input: SignInInput
-    output: SignInOutput
-  }
-  '/reset-password-request': {
-    method: 'POST'
-    input: InitiatePasswordResetInput
-    output: { success: true }
-  }
-  '/reset-password-confirm': {
-    method: 'POST'
-    input: ConfirmResetPasswordInput
-    output: { success: true }
-  }
-  '/sign-out': {
-    method: 'POST'
-    input: SignOutInput
-    output: { success: true }
-  }
-  /**
-   * Lists all the accounts that are currently active, on the current device.
-   */
-  '/device-sessions': {
-    method: 'GET'
-    output: Session[]
-  }
-  /**
-   * Lists all the active OAuth sessions (access/refresh tokens) that where
-   * issued to OAuth clients (apps).
-   *
-   * @NOTE can be revoked using the oauth revocation endpoint (json or form
-   * encoded)
-   *
-   * ```http
-   * POST /oauth/revoke
-   * Content-Type: application/x-www-form-urlencoded
-   *
-   * token=<tokenId>
-   * ```
-   */
-  '/oauth-sessions': {
-    method: 'GET'
-    params: OAuthSessionsInput
-    output: OAuthSessionsOutput
-  }
-  '/revoke-oauth-session': {
-    method: 'POST'
-    input: RevokeOAuthSessionInput
-    output: { success: true }
-  }
-  /**
-   * Lists all the sessions that are currently active for a particular user, on
-   * other devices.
-   */
-  '/account-sessions': {
-    method: 'GET'
-    params: AccountSessionsInput
-    output: AccountSessionsOutput
-  }
-  '/revoke-account-session': {
-    method: 'POST'
-    input: RevokeAccountSessionInput
-    output: { success: true }
-  }
-  '/update-email-request': {
-    method: 'POST'
-    input: InitiateEmailUpdateInput
-    output: InitiateEmailUpdateOutput
-  }
-  '/update-email-confirm': {
-    method: 'POST'
-    input: ConfirmEmailUpdateInput
-    output: ConfirmEmailUpdateOutput
-  }
-  '/verify-email-request': {
-    method: 'POST'
-    input: InitiateEmailVerificationInput
-    output: { success: true }
-  }
-  '/verify-email-confirm': {
-    method: 'POST'
-    input: ConfirmEmailVerificationInput
-    output: ConfirmEmailVerificationOutput
-  }
-  '/update-handle': {
-    method: 'POST'
-    input: UpdateHandleInput
-    output: UpdateHandleOutput
-  }
-  /**
-   * Marks the account as deactivated. The account remains recoverable — the
-   * user can sign back in to reactivate via {@link ApiEndpoints['/reactivate-account']}.
-   * Profile, posts, feeds and lists are hidden across the network until then.
-   */
-  '/deactivate-account': {
-    method: 'POST'
-    input: DeactivateAccountInput
-    output: DeactivateAccountOutput
-  }
-  /**
-   * Reactivates a previously-deactivated account. No-op when the account is
-   * already active.
-   */
-  '/reactivate-account': {
-    method: 'POST'
-    input: ReactivateAccountInput
-    output: ReactivateAccountOutput
-  }
-  /**
-   * Initiates account deletion by sending a confirmation code to the account's
-   * email address. The account is NOT deleted until
-   * {@link ApiEndpoints['/delete-account-confirm']} is called with the matching
-   * token and the user's current password.
-   */
-  '/delete-account-request': {
-    method: 'POST'
-    input: InitiateAccountDeletionInput
-    output: { success: true }
-  }
-  /**
-   * Confirms and finalizes account deletion. Requires both the email
-   * confirmation token issued by {@link ApiEndpoints['/delete-account-request']}
-   * and the user's current password. Deletion is irreversible.
-   */
-  '/delete-account-confirm': {
-    method: 'POST'
-    input: ConfirmAccountDeletionInput
-    output: { success: true }
-  }
-  '/consent': {
-    method: 'POST'
-    input: ConsentInput
-    output: { url: string }
-  }
-  '/reject': {
-    method: 'POST'
-    input: RejectInput
-    output: { url: string }
-  }
-}
-
-/**
- * When a user signs in without the "remember me" option, the server returns an
- * ephemeral token. When used as `Bearer` authorization header, the token will
- * be used in order to authenticate the users in place of using the user's
- * cookie based session (which are only created when "remember me" is checked).
- *
- * Only include this token in the `Authorization` header when making requests to
- * the OAuth provider API, **FOR THE ACCOUNT IT WAS GENERATED FOR**.
- */
-export type EphemeralToken = SignedJwt
-
-export type SignInInput = {
-  locale: string
-  username: string
-  password: string
-  emailOtp?: string
-  remember?: boolean
-}
-
-export type SignInOutput = {
-  account: Account
-  ephemeralToken?: EphemeralToken
-}
-
-export type SignUpInput = {
-  locale: string
-  handle: string
-  email: string
-  password: string
-  inviteCode?: string
-  hcaptchaToken?: string
-}
-
-export type SignUpOutput = {
-  account: Account
-  ephemeralToken?: EphemeralToken
-}
-
-export type SignOutInput = {
-  did: DidString | DidString[]
-}
-
-export type InitiatePasswordResetInput = {
-  locale: string
-  email: string
-}
-
-export type ConfirmResetPasswordInput = {
-  token: string
-  password: string
-}
-
-export type InitiateEmailUpdateInput = {
-  did: DidString
-  locale?: string
-}
-
-export type InitiateEmailUpdateOutput = {
-  tokenRequired: boolean
-}
-
-export type ConfirmEmailUpdateInput = {
-  did: DidString
-  token?: string
-  email: string
-  locale?: string
-}
-
-export type ConfirmEmailUpdateOutput = {
-  account: Account
-}
-
-export type InitiateEmailVerificationInput = {
-  did: DidString
-  locale?: string
-}
-
-export type ConfirmEmailVerificationInput = {
-  did: DidString
-  token: string
-  email: string
-}
-
-export type ConfirmEmailVerificationOutput = {
-  account: Account
-}
-
-export type VerifyHandleAvailabilityInput = {
-  handle: HandleString
-}
-
-export type UpdateHandleInput = {
-  did: DidString
-  handle: HandleString
-}
-
-export type UpdateHandleOutput = {
-  account: Account
-}
-
-export type DeactivateAccountInput = {
-  did: DidString
-  deleteAfter?: DatetimeString
-}
-
-export type DeactivateAccountOutput = {
-  account: Account
-}
-
-export type ReactivateAccountInput = {
-  did: DidString
-}
-
-export type ReactivateAccountOutput = {
-  account: Account
-}
-
-export type InitiateAccountDeletionInput = {
-  did: DidString
-  locale?: string
-}
-
-export type ConfirmAccountDeletionInput = {
-  did: DidString
-  token: string
-  password: string
-}
-
-export type RevokeAccountSessionInput = {
-  did: DidString
-  deviceId: string
-}
-
-export type OAuthSessionsInput = {
-  did: DidString
-}
-
-export type OAuthSessionsOutput = ActiveOAuthSession[]
-
-export type AccountSessionsInput = {
-  did: DidString
-}
-
-export type AccountSessionsOutput = ActiveAccountSession[]
-
-export type RevokeOAuthSessionInput = {
-  did: DidString
-  tokenId: string
-}
-
-export type ConsentInput = {
-  did: DidString
-  scope?: string
-}
-
-export type RejectInput = Record<string, never>
-
-/**
- * Represents an account that is currently signed-in to the Authorization
- * Server. If the session was created too long ago, the user may be required to
- * re-authenticate ({@link ActiveDeviceSession.loginRequired}).
- */
-export type ActiveDeviceSession = {
-  account: Account
-
-  /**
-   * The session is too old and the user must re-authenticate.
-   */
-  loginRequired: boolean
-}
-
-/**
- * Represents another device on which an account is currently signed-in.
- */
-export type ActiveAccountSession = {
-  deviceId: string
-  deviceMetadata: DeviceMetadata
-
-  isCurrentDevice: boolean
-}
-
-/**
- * Represents an active OAuth session (access token).
- */
-export type ActiveOAuthSession = {
-  tokenId: string
-
-  createdAt: ISODateString
-  updatedAt: ISODateString
-
-  clientId: string
-  /** An "undefined" value means that the client metadata could not be fetched */
-  clientMetadata?: OAuthClientMetadata
-
-  scope?: string
-}

package/src/contants.ts

@@ -1,4 +0,0 @@
-export const CSRF_COOKIE_NAME = 'csrf-token'
-export const CSRF_HEADER_NAME = 'x-csrf-token'
-
-export const API_ENDPOINT_PREFIX = '/@atproto/oauth-provider/~api'

package/src/customization-data.ts

@@ -1,17 +0,0 @@
-import type { LinkDefinition } from './types.js'
-
-// These are the types of the variables that are injected into the HTML by the
-// backend. They are used to configure the frontend.
-
-export type CustomizationData = {
-  // Functional customization
-  hcaptchaSiteKey?: string
-  inviteCodeRequired?: boolean
-  availableUserDomains?: string[]
-  show2FaWarningOnEmailUpdate?: boolean
-
-  // Aesthetic customization
-  name?: string
-  logo?: string
-  links?: LinkDefinition[]
-}

package/src/errors.ts

@@ -1,21 +0,0 @@
-export const HANDLE_UNAVAILABLE_REASON = Object.freeze([
-  'syntax',
-  'domain',
-  'slur',
-  'taken',
-  'reserved',
-  'resolution',
-  'unsupported',
-] as const)
-
-export type HandleUnavailableReason = (typeof HANDLE_UNAVAILABLE_REASON)[number]
-
-export const isHandleUnavailableReason = (
-  value: unknown,
-): value is HandleUnavailableReason => {
-  return (HANDLE_UNAVAILABLE_REASON as readonly unknown[]).includes(value)
-}
-
-// @TODO consider moving JsonErrorResponse & sub-classes here (or only the
-// schemas?), allowing the same code to be used on both the server and client
-// for error handling/parsing/formatting.

package/src/index.ts

@@ -1,6 +0,0 @@
-export type * from './api-endpoints.js'
-export type * from './customization-data.js'
-export type * from './types.js'
-
-export * from './contants.js'
-export * from './errors.js'

package/src/types.ts

@@ -1,43 +0,0 @@
-import type { DidString, HandleString } from '@atproto/syntax'
-
-export type { DidString }
-
-export type Account = {
-  did: DidString
-  pds: DidString
-  deactivated: boolean
-  locale?: string
-  email?: string
-  emailVerified?: boolean
-  name?: string
-  handle?: HandleString
-  picture?: string
-}
-
-/**
- * Represents an account that is currently signed-in to the Authorization
- * Server. If the session was created too long ago, the user may be required to
- * re-authenticate ({@link Session.loginRequired}).
- */
-export type Session = {
-  account: Account
-  info?: never // Prevent relying on this in the frontend
-
-  loginRequired: boolean
-}
-
-export type MultiLangString = Record<string, string | undefined>
-
-export type LinkDefinition = {
-  title: string | MultiLangString
-  href: string
-  rel?: string
-}
-
-export type DeviceMetadata = {
-  userAgent: string | null
-  ipAddress: string
-  lastSeenAt: ISODateString
-}
-
-export type ISODateString = `${string}T${string}Z`

package/tsconfig.build.json

@@ -1,8 +0,0 @@
-{
-  "extends": "../../../tsconfig/isomorphic.json",
-  "compilerOptions": {
-    "rootDir": "./src",
-    "outDir": "./dist",
-  },
-  "include": ["./src"],
-}

package/tsconfig.build.tsbuildinfo

@@ -1 +0,0 @@
-{"version":"7.0.0-dev.20260614.1","root":["./src/api-endpoints.ts","./src/contants.ts","./src/customization-data.ts","./src/errors.ts","./src/index.ts","./src/types.ts"]}

package/tsconfig.json

@@ -1,4 +0,0 @@
-{
-  "include": [],
-  "references": [{ "path": "./tsconfig.build.json" }],
-}