@atproto/oauth-provider 0.1.0

package/dist/lib/util/authorization-header.d.ts

@@ -0,0 +1,4 @@
+import { z } from 'zod';
+export declare const authorizationHeaderSchema: z.ZodTuple<[z.ZodUnion<[z.ZodEffects<z.ZodString, "DPoP", string>, z.ZodEffects<z.ZodString, "Bearer", string>]>, z.ZodString], null>;
+export declare const parseAuthorizationHeader: (header?: string) => ["DPoP" | "Bearer", string];
+//# sourceMappingURL=authorization-header.d.ts.map

package/dist/lib/util/authorization-header.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-header.d.ts","sourceRoot":"","sources":["../../../src/lib/util/authorization-header.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAKvB,eAAO,MAAM,yBAAyB,uIAGpC,CAAA;AAEF,eAAO,MAAM,wBAAwB,YAAa,MAAM,gCAcvD,CAAA"}

package/dist/lib/util/authorization-header.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseAuthorizationHeader = exports.authorizationHeaderSchema = void 0;
+const oauth_types_1 = require("@atproto/oauth-types");
+const zod_1 = require("zod");
+const invalid_request_error_js_1 = require("../../errors/invalid-request-error.js");
+const www_authenticate_error_js_1 = require("../../errors/www-authenticate-error.js");
+exports.authorizationHeaderSchema = zod_1.z.tuple([
+    oauth_types_1.oauthTokenTypeSchema,
+    oauth_types_1.accessTokenSchema,
+]);
+const parseAuthorizationHeader = (header) => {
+    if (header == null) {
+        throw new www_authenticate_error_js_1.WWWAuthenticateError('invalid_request', 'Authorization header required', { Bearer: {}, DPoP: {} });
+    }
+    const parsed = exports.authorizationHeaderSchema.safeParse(header.split(' ', 2));
+    if (!parsed.success) {
+        throw new invalid_request_error_js_1.InvalidRequestError('Invalid authorization header');
+    }
+    return parsed.data;
+};
+exports.parseAuthorizationHeader = parseAuthorizationHeader;
+//# sourceMappingURL=authorization-header.js.map

package/dist/lib/util/authorization-header.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-header.js","sourceRoot":"","sources":["../../../src/lib/util/authorization-header.ts"],"names":[],"mappings":";;;AAAA,sDAA8E;AAC9E,6BAAuB;AAEvB,oFAA2E;AAC3E,sFAA6E;AAEhE,QAAA,yBAAyB,GAAG,OAAC,CAAC,KAAK,CAAC;IAC/C,kCAAoB;IACpB,+BAAiB;CAClB,CAAC,CAAA;AAEK,MAAM,wBAAwB,GAAG,CAAC,MAAe,EAAE,EAAE;IAC1D,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,gDAAoB,CAC5B,iBAAiB,EACjB,+BAA+B,EAC/B,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CACzB,CAAA;IACH,CAAC;IAED,MAAM,MAAM,GAAG,iCAAyB,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAA;IACxE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,8CAAmB,CAAC,8BAA8B,CAAC,CAAA;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAA;AACpB,CAAC,CAAA;AAdY,QAAA,wBAAwB,4BAcpC"}

package/dist/lib/util/cast.d.ts

@@ -0,0 +1,2 @@
+export declare function asArray<T>(value: T | T[]): T[];
+//# sourceMappingURL=cast.d.ts.map

package/dist/lib/util/cast.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cast.d.ts","sourceRoot":"","sources":["../../../src/lib/util/cast.ts"],"names":[],"mappings":"AAAA,wBAAgB,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,EAAE,CAG9C"}

package/dist/lib/util/cast.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.asArray = void 0;
+function asArray(value) {
+    if (value == null)
+        return [];
+    return Array.isArray(value) ? value : [value];
+}
+exports.asArray = asArray;
+//# sourceMappingURL=cast.js.map

package/dist/lib/util/cast.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cast.js","sourceRoot":"","sources":["../../../src/lib/util/cast.ts"],"names":[],"mappings":";;;AAAA,SAAgB,OAAO,CAAI,KAAc;IACvC,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,EAAE,CAAA;IAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;AAC/C,CAAC;AAHD,0BAGC"}

package/dist/lib/util/crypto.d.ts

@@ -0,0 +1,3 @@
+export declare function randomHexId(bytesLength?: number): Promise<string>;
+export declare const VERIFY_ALGOS: readonly ["RS256", "RS384", "RS512", "PS256", "PS384", "PS512", "ES256", "ES256K", "ES384", "ES512"];
+//# sourceMappingURL=crypto.d.ts.map

package/dist/lib/util/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../../src/lib/util/crypto.ts"],"names":[],"mappings":"AAEA,wBAAsB,WAAW,CAAC,WAAW,SAAK,mBAOjD;AAID,eAAO,MAAM,YAAY,sGAaf,CAAA"}

package/dist/lib/util/crypto.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VERIFY_ALGOS = exports.randomHexId = void 0;
+const node_crypto_1 = require("node:crypto");
+async function randomHexId(bytesLength = 16) {
+    return new Promise((resolve, reject) => {
+        (0, node_crypto_1.randomBytes)(bytesLength, (err, buf) => {
+            if (err)
+                return reject(err);
+            resolve(buf.toString('hex'));
+        });
+    });
+}
+exports.randomHexId = randomHexId;
+// Basically all algorithms supported by "jose"'s jwtVerify().
+// @TODO: Is there a way to get this list from the runtime instead of hardcoding it?
+exports.VERIFY_ALGOS = [
+    'RS256',
+    'RS384',
+    'RS512',
+    'PS256',
+    'PS384',
+    'PS512',
+    'ES256',
+    'ES256K',
+    'ES384',
+    'ES512',
+];
+//# sourceMappingURL=crypto.js.map

package/dist/lib/util/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../../src/lib/util/crypto.ts"],"names":[],"mappings":";;;AAAA,6CAAyC;AAElC,KAAK,UAAU,WAAW,CAAC,WAAW,GAAG,EAAE;IAChD,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7C,IAAA,yBAAW,EAAC,WAAW,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACpC,IAAI,GAAG;gBAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAA;YAC3B,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;QAC9B,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAPD,kCAOC;AAED,8DAA8D;AAC9D,oFAAoF;AACvE,QAAA,YAAY,GAAG;IAC1B,OAAO;IACP,OAAO;IACP,OAAO;IAEP,OAAO;IACP,OAAO;IACP,OAAO;IAEP,OAAO;IACP,QAAQ;IACR,OAAO;IACP,OAAO;CACC,CAAA"}

package/dist/lib/util/date.d.ts

@@ -0,0 +1,3 @@
+export declare function dateToEpoch(date?: Date): number;
+export declare function dateToRelativeSeconds(date: Date): number;
+//# sourceMappingURL=date.d.ts.map

package/dist/lib/util/date.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"date.d.ts","sourceRoot":"","sources":["../../../src/lib/util/date.ts"],"names":[],"mappings":"AAAA,wBAAgB,WAAW,CAAC,IAAI,GAAE,IAAiB,UAElD;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,IAAI,UAE/C"}

package/dist/lib/util/date.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.dateToRelativeSeconds = exports.dateToEpoch = void 0;
+function dateToEpoch(date = new Date()) {
+    return Math.floor(date.getTime() / 1000);
+}
+exports.dateToEpoch = dateToEpoch;
+function dateToRelativeSeconds(date) {
+    return Math.floor((date.getTime() - Date.now()) / 1000);
+}
+exports.dateToRelativeSeconds = dateToRelativeSeconds;
+//# sourceMappingURL=date.js.map

package/dist/lib/util/date.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"date.js","sourceRoot":"","sources":["../../../src/lib/util/date.ts"],"names":[],"mappings":";;;AAAA,SAAgB,WAAW,CAAC,OAAa,IAAI,IAAI,EAAE;IACjD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAA;AAC1C,CAAC;AAFD,kCAEC;AAED,SAAgB,qBAAqB,CAAC,IAAU;IAC9C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAA;AACzD,CAAC;AAFD,sDAEC"}

package/dist/lib/util/hostname.d.ts

@@ -0,0 +1,6 @@
+/// <reference types="node" />
+import { ParsedDomain } from 'psl';
+export declare function isInternetHost(host: string): boolean;
+export declare function parseUrlDomain(input: string | URL): ParsedDomain | null;
+export declare function parseDomain(domain: string): ParsedDomain | null;
+//# sourceMappingURL=hostname.d.ts.map

package/dist/lib/util/hostname.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hostname.d.ts","sourceRoot":"","sources":["../../../src/lib/util/hostname.ts"],"names":[],"mappings":";AAAA,OAAO,EAAS,YAAY,EAAE,MAAM,KAAK,CAAA;AAEzC,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,YAAY,GAAG,IAAI,CAGvE;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,uBAOzC"}

package/dist/lib/util/hostname.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseDomain = exports.parseUrlDomain = exports.isInternetHost = void 0;
+const psl_1 = require("psl");
+function isInternetHost(host) {
+    return parseDomain(host) !== null;
+}
+exports.isInternetHost = isInternetHost;
+function parseUrlDomain(input) {
+    const url = new URL(input);
+    return parseDomain(url.hostname);
+}
+exports.parseUrlDomain = parseUrlDomain;
+function parseDomain(domain) {
+    const parsed = (0, psl_1.parse)(domain);
+    if ('listed' in parsed && parsed.listed && parsed.domain) {
+        return parsed;
+    }
+    else {
+        return null;
+    }
+}
+exports.parseDomain = parseDomain;
+//# sourceMappingURL=hostname.js.map

package/dist/lib/util/hostname.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hostname.js","sourceRoot":"","sources":["../../../src/lib/util/hostname.ts"],"names":[],"mappings":";;;AAAA,6BAAyC;AAEzC,SAAgB,cAAc,CAAC,IAAY;IACzC,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,IAAI,CAAA;AACnC,CAAC;AAFD,wCAEC;AAED,SAAgB,cAAc,CAAC,KAAmB;IAChD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IAC1B,OAAO,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;AAClC,CAAC;AAHD,wCAGC;AAED,SAAgB,WAAW,CAAC,MAAc;IACxC,MAAM,MAAM,GAAG,IAAA,WAAK,EAAC,MAAM,CAAC,CAAA;IAC5B,IAAI,QAAQ,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACzD,OAAO,MAAM,CAAA;IACf,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAPD,kCAOC"}

package/dist/lib/util/redirect-uri.d.ts

@@ -0,0 +1,7 @@
+/**
+ *
+ * @see {@link https://datatracker.ietf.org/doc/html/rfc8252#section-8.4}
+ * @see {@link https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-11#section-8.4.2}
+ */
+export declare function compareRedirectUri(allowed_uri: string, request_uri: string): boolean;
+//# sourceMappingURL=redirect-uri.d.ts.map

package/dist/lib/util/redirect-uri.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect-uri.d.ts","sourceRoot":"","sources":["../../../src/lib/util/redirect-uri.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,GAClB,OAAO,CAmCT"}

package/dist/lib/util/redirect-uri.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.compareRedirectUri = void 0;
+const oauth_types_1 = require("@atproto/oauth-types");
+/**
+ *
+ * @see {@link https://datatracker.ietf.org/doc/html/rfc8252#section-8.4}
+ * @see {@link https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-11#section-8.4.2}
+ */
+function compareRedirectUri(allowed_uri, request_uri) {
+    // https://datatracker.ietf.org/doc/html/rfc8252#section-8.4
+    //
+    // > Authorization servers MUST require clients to register their complete
+    // > redirect URI (including the path component) and reject authorization
+    // > requests that specify a redirect URI that doesn't exactly match the
+    // > one that was registered; the exception is loopback redirects, where
+    // > an exact match is required except for the port URI component.
+    if (allowed_uri === request_uri)
+        return true;
+    // https://datatracker.ietf.org/doc/html/rfc8252#section-7.3
+    const allowedUri = new URL(allowed_uri);
+    if ((0, oauth_types_1.isLoopbackHost)(allowedUri.hostname)) {
+        const requestUri = new URL(request_uri);
+        return (
+        // > The authorization server MUST allow any port to be specified at the
+        // > time of the request for loopback IP redirect URIs, to accommodate
+        // > clients that obtain an available ephemeral port from the operating
+        // > system at the time of the request
+        //
+        // Note: We only apply this rule if the allowed URI does not have a port
+        // specified.
+        (!allowedUri.port || allowedUri.port === requestUri.port) &&
+            allowedUri.hostname === requestUri.hostname &&
+            allowedUri.pathname === requestUri.pathname &&
+            allowedUri.protocol === requestUri.protocol &&
+            allowedUri.search === requestUri.search &&
+            allowedUri.hash === requestUri.hash &&
+            allowedUri.username === requestUri.username &&
+            allowedUri.password === requestUri.password);
+    }
+    return false;
+}
+exports.compareRedirectUri = compareRedirectUri;
+//# sourceMappingURL=redirect-uri.js.map

package/dist/lib/util/redirect-uri.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect-uri.js","sourceRoot":"","sources":["../../../src/lib/util/redirect-uri.ts"],"names":[],"mappings":";;;AAAA,sDAAqD;AAErD;;;;GAIG;AACH,SAAgB,kBAAkB,CAChC,WAAmB,EACnB,WAAmB;IAEnB,4DAA4D;IAC5D,EAAE;IACF,0EAA0E;IAC1E,yEAAyE;IACzE,wEAAwE;IACxE,wEAAwE;IACxE,kEAAkE;IAClE,IAAI,WAAW,KAAK,WAAW;QAAE,OAAO,IAAI,CAAA;IAE5C,4DAA4D;IAC5D,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAA;IACvC,IAAI,IAAA,4BAAc,EAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAA;QAEvC,OAAO;QACL,wEAAwE;QACxE,sEAAsE;QACtE,uEAAuE;QACvE,sCAAsC;QACtC,EAAE;QACF,wEAAwE;QACxE,aAAa;QACb,CAAC,CAAC,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,CAAC;YACzD,UAAU,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ;YAC3C,UAAU,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ;YAC3C,UAAU,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ;YAC3C,UAAU,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM;YACvC,UAAU,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI;YACnC,UAAU,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ;YAC3C,UAAU,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ,CAC5C,CAAA;IACH,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAtCD,gDAsCC"}

package/dist/lib/util/time.d.ts

@@ -0,0 +1,6 @@
+import { Awaitable } from './type.js';
+/**
+ * Utility function to protect against timing attacks.
+ */
+export declare function constantTime<T>(delay: number, fn: () => Awaitable<T>): Promise<T>;
+//# sourceMappingURL=time.d.ts.map

package/dist/lib/util/time.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"time.d.ts","sourceRoot":"","sources":["../../../src/lib/util/time.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAErC;;GAEG;AACH,wBAAsB,YAAY,CAAC,CAAC,EAClC,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,SAAS,CAAC,CAAC,CAAC,GACrB,OAAO,CAAC,CAAC,CAAC,CAwBZ"}

package/dist/lib/util/time.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.constantTime = void 0;
+/**
+ * Utility function to protect against timing attacks.
+ */
+async function constantTime(delay, fn) {
+    if (!Number.isFinite(delay) || delay <= 0) {
+        throw new TypeError('Delay must be greater than 0');
+    }
+    const start = Date.now();
+    try {
+        return await fn();
+    }
+    finally {
+        const delta = Date.now() - start;
+        // Let's make sure we always wait for a multiple of `delay` milliseconds.
+        const n = Math.max(1, Math.ceil(delta / delay));
+        // Ideally, the multiple should always be 1 in order to to properly defend
+        // against timing attacks. Show a warning if it's not.
+        if (n > 1) {
+            console.warn(`constantTime: execution time was ${delta}ms, waiting for the next multiple of ${delay}ms. You should increase the delay to properly defend against timing attacks.`);
+        }
+        await new Promise((resolve) => setTimeout(resolve, n * delay));
+    }
+}
+exports.constantTime = constantTime;
+//# sourceMappingURL=time.js.map

package/dist/lib/util/time.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"time.js","sourceRoot":"","sources":["../../../src/lib/util/time.ts"],"names":[],"mappings":";;;AAEA;;GAEG;AACI,KAAK,UAAU,YAAY,CAChC,KAAa,EACb,EAAsB;IAEtB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,SAAS,CAAC,8BAA8B,CAAC,CAAA;IACrD,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACxB,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,EAAE,CAAA;IACnB,CAAC;YAAS,CAAC;QACT,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAA;QAEhC,yEAAyE;QACzE,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAA;QAE/C,0EAA0E;QAC1E,sDAAsD;QACtD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACV,OAAO,CAAC,IAAI,CACV,oCAAoC,KAAK,wCAAwC,KAAK,8EAA8E,CACrK,CAAA;QACH,CAAC;QAED,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAA;IAChE,CAAC;AACH,CAAC;AA3BD,oCA2BC"}

package/dist/lib/util/type.d.ts

@@ -0,0 +1,6 @@
+export type Simplify<T> = {
+    [K in keyof T]: T[K];
+} & {};
+export type Override<T, V> = Simplify<V & Omit<T, keyof V>>;
+export type Awaitable<T> = T | Promise<T>;
+//# sourceMappingURL=type.d.ts.map

package/dist/lib/util/type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"type.d.ts","sourceRoot":"","sources":["../../../src/lib/util/type.ts"],"names":[],"mappings":"AACA,MAAM,MAAM,QAAQ,CAAC,CAAC,IAAI;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CAAE,GAAG,EAAE,CAAA;AACvD,MAAM,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,IAAI,QAAQ,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAA;AAC3D,MAAM,MAAM,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA"}

package/dist/lib/util/type.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=type.js.map

package/dist/lib/util/type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"type.js","sourceRoot":"","sources":["../../../src/lib/util/type.ts"],"names":[],"mappings":""}

package/dist/lib/util/well-known.d.ts

@@ -0,0 +1,3 @@
+/// <reference types="node" />
+export declare function buildWellknownUrl(url: URL, name: string): URL;
+//# sourceMappingURL=well-known.d.ts.map

package/dist/lib/util/well-known.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"well-known.d.ts","sourceRoot":"","sources":["../../../src/lib/util/well-known.ts"],"names":[],"mappings":";AAAA,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,GAAG,GAAG,CAO7D"}

package/dist/lib/util/well-known.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildWellknownUrl = void 0;
+function buildWellknownUrl(url, name) {
+    const path = url.pathname === '/'
+        ? `/.well-known/${name}`
+        : `${url.pathname.replace(/\/+$/, '')}/${name}`;
+    return new URL(path, url);
+}
+exports.buildWellknownUrl = buildWellknownUrl;
+//# sourceMappingURL=well-known.js.map

package/dist/lib/util/well-known.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"well-known.js","sourceRoot":"","sources":["../../../src/lib/util/well-known.ts"],"names":[],"mappings":";;;AAAA,SAAgB,iBAAiB,CAAC,GAAQ,EAAE,IAAY;IACtD,MAAM,IAAI,GACR,GAAG,CAAC,QAAQ,KAAK,GAAG;QAClB,CAAC,CAAC,gBAAgB,IAAI,EAAE;QACxB,CAAC,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,IAAI,EAAE,CAAA;IAEnD,OAAO,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;AAC3B,CAAC;AAPD,8CAOC"}

package/dist/metadata/build-metadata.d.ts

@@ -0,0 +1,14 @@
+import { Keyset } from '@atproto/jwk';
+import { OAuthAuthorizationServerMetadata } from '@atproto/oauth-types';
+export type CustomMetadata = {
+    claims_supported?: string[];
+    scopes_supported?: string[];
+    authorization_details_types_supported?: string[];
+    protected_resources?: string[];
+};
+/**
+ * @see {@link https://datatracker.ietf.org/doc/html/rfc8414#section-2}
+ * @see {@link https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata}
+ */
+export declare function buildMetadata(issuer: string, keyset: Keyset, customMetadata?: CustomMetadata): OAuthAuthorizationServerMetadata;
+//# sourceMappingURL=build-metadata.d.ts.map

package/dist/metadata/build-metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-metadata.d.ts","sourceRoot":"","sources":["../../src/metadata/build-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACrC,OAAO,EAAE,gCAAgC,EAAE,MAAM,sBAAsB,CAAA;AAMvE,MAAM,MAAM,cAAc,GAAG;IAC3B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC3B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC3B,qCAAqC,CAAC,EAAE,MAAM,EAAE,CAAA;IAChD,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAA;CAC/B,CAAA;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,cAAc,CAAC,EAAE,cAAc,GAC9B,gCAAgC,CA8IlC"}

package/dist/metadata/build-metadata.js

@@ -0,0 +1,132 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildMetadata = void 0;
+const client_js_1 = require("../client/client.js");
+const claims_js_1 = require("../oidc/claims.js");
+const crypto_js_1 = require("../lib/util/crypto.js");
+/**
+ * @see {@link https://datatracker.ietf.org/doc/html/rfc8414#section-2}
+ * @see {@link https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata}
+ */
+function buildMetadata(issuer, keyset, customMetadata) {
+    return {
+        issuer,
+        scopes_supported: [
+            'offline_access',
+            'openid',
+            'email',
+            'phone',
+            'profile',
+            ...(customMetadata?.scopes_supported ?? []),
+        ],
+        claims_supported: [
+            /* IESG (Always provided) */
+            'sub', // did
+            'iss', // Authorization Server Origin
+            'aud',
+            'exp',
+            'iat',
+            'jti',
+            'client_id',
+            /* OpenID */
+            // 'acr', // "0"
+            // 'amr',
+            // 'azp',
+            'auth_time', // number - seconds since epoch
+            'nonce', // always required in "id_token", why would it not be supported?
+            ...(customMetadata?.claims_supported ?? claims_js_1.OIDC_STANDARD_CLAIMS),
+        ],
+        subject_types_supported: [
+            //
+            'public', // The same "sub" is returned for all clients
+            // 'pairwise', // A different "sub" is returned for each client
+        ],
+        response_types_supported: [
+            // OAuth
+            'code',
+            'token',
+            // OpenID
+            'none',
+            'code id_token token',
+            'code id_token',
+            'code token',
+            'id_token token',
+            'id_token',
+        ],
+        response_modes_supported: [
+            // https://openid.net/specs/oauth-v2-multiple-response-types-1_0.html#ResponseModes
+            'query',
+            'fragment',
+            // https://openid.net/specs/oauth-v2-form-post-response-mode-1_0.html#FormPostResponseMode
+            'form_post',
+        ],
+        grant_types_supported: [
+            //
+            'authorization_code',
+            'refresh_token',
+        ],
+        code_challenge_methods_supported: [
+            // https://www.iana.org/assignments/oauth-parameters/oauth-parameters.xhtml#pkce-code-challenge-method
+            'S256',
+            'plain',
+        ],
+        ui_locales_supported: [
+            //
+            'en-US',
+        ],
+        id_token_signing_alg_values_supported: [...keyset.signAlgorithms],
+        display_values_supported: [
+            //
+            'page',
+            'popup',
+            'touch',
+            // 'wap', LoL
+        ],
+        // https://datatracker.ietf.org/doc/html/rfc9207
+        authorization_response_iss_parameter_supported: true,
+        // https://datatracker.ietf.org/doc/html/rfc9101#section-4
+        request_object_signing_alg_values_supported: [...crypto_js_1.VERIFY_ALGOS, 'none'],
+        request_object_encryption_alg_values_supported: [], // None
+        request_object_encryption_enc_values_supported: [], // None
+        // No claim makes sense to be translated
+        claims_locales_supported: [],
+        claims_parameter_supported: true,
+        request_parameter_supported: true,
+        request_uri_parameter_supported: true,
+        require_request_uri_registration: true,
+        jwks_uri: new URL('/oauth/jwks', issuer).href,
+        authorization_endpoint: new URL('/oauth/authorize', issuer).href,
+        token_endpoint: new URL('/oauth/token', issuer).href,
+        token_endpoint_auth_methods_supported: [...client_js_1.Client.AUTH_METHODS_SUPPORTED],
+        token_endpoint_auth_signing_alg_values_supported: [...crypto_js_1.VERIFY_ALGOS],
+        revocation_endpoint: new URL('/oauth/revoke', issuer).href,
+        revocation_endpoint_auth_methods_supported: [
+            ...client_js_1.Client.AUTH_METHODS_SUPPORTED,
+        ],
+        revocation_endpoint_auth_signing_alg_values_supported: [...crypto_js_1.VERIFY_ALGOS],
+        introspection_endpoint: new URL('/oauth/introspect', issuer).href,
+        introspection_endpoint_auth_methods_supported: [
+            ...client_js_1.Client.AUTH_METHODS_SUPPORTED,
+        ],
+        introspection_endpoint_auth_signing_alg_values_supported: [...crypto_js_1.VERIFY_ALGOS],
+        userinfo_endpoint: new URL('/oauth/userinfo', issuer).href,
+        // end_session_endpoint: new URL('/oauth/logout', issuer).href,
+        // https://datatracker.ietf.org/doc/html/rfc9126#section-5
+        pushed_authorization_request_endpoint: new URL('/oauth/par', issuer).href,
+        pushed_authorization_request_endpoint_auth_methods_supported: [
+            ...client_js_1.Client.AUTH_METHODS_SUPPORTED,
+        ],
+        pushed_authorization_request_endpoint_auth_signing_alg_values_supported: [
+            ...crypto_js_1.VERIFY_ALGOS,
+        ],
+        require_pushed_authorization_requests: true,
+        // https://datatracker.ietf.org/doc/html/rfc9449#section-5.1
+        dpop_signing_alg_values_supported: [...crypto_js_1.VERIFY_ALGOS],
+        // https://datatracker.ietf.org/doc/html/rfc9396#section-14.4
+        authorization_details_types_supported: customMetadata?.authorization_details_types_supported,
+        // https://datatracker.ietf.org/doc/html/draft-ietf-oauth-resource-metadata-05#section-4
+        protected_resources: customMetadata?.protected_resources,
+    };
+}
+exports.buildMetadata = buildMetadata;
+//# sourceMappingURL=build-metadata.js.map

package/dist/metadata/build-metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-metadata.js","sourceRoot":"","sources":["../../src/metadata/build-metadata.ts"],"names":[],"mappings":";;;AAGA,mDAA4C;AAC5C,iDAAwD;AACxD,qDAAoD;AASpD;;;GAGG;AACH,SAAgB,aAAa,CAC3B,MAAc,EACd,MAAc,EACd,cAA+B;IAE/B,OAAO;QACL,MAAM;QAEN,gBAAgB,EAAE;YAChB,gBAAgB;YAChB,QAAQ;YACR,OAAO;YACP,OAAO;YACP,SAAS;YAET,GAAG,CAAC,cAAc,EAAE,gBAAgB,IAAI,EAAE,CAAC;SAC5C;QACD,gBAAgB,EAAE;YAChB,4BAA4B;YAE5B,KAAK,EAAE,MAAM;YACb,KAAK,EAAE,8BAA8B;YACrC,KAAK;YACL,KAAK;YACL,KAAK;YACL,KAAK;YACL,WAAW;YAEX,YAAY;YAEZ,gBAAgB;YAChB,SAAS;YACT,SAAS;YACT,WAAW,EAAE,+BAA+B;YAC5C,OAAO,EAAE,gEAAgE;YAEzE,GAAG,CAAC,cAAc,EAAE,gBAAgB,IAAI,gCAAoB,CAAC;SAC9D;QACD,uBAAuB,EAAE;YACvB,EAAE;YACF,QAAQ,EAAE,6CAA6C;YACvD,+DAA+D;SAChE;QACD,wBAAwB,EAAE;YACxB,QAAQ;YACR,MAAM;YACN,OAAO;YAEP,SAAS;YACT,MAAM;YACN,qBAAqB;YACrB,eAAe;YACf,YAAY;YACZ,gBAAgB;YAChB,UAAU;SACX;QACD,wBAAwB,EAAE;YACxB,mFAAmF;YACnF,OAAO;YACP,UAAU;YACV,0FAA0F;YAC1F,WAAW;SACZ;QACD,qBAAqB,EAAE;YACrB,EAAE;YACF,oBAAoB;YACpB,eAAe;SAChB;QACD,gCAAgC,EAAE;YAChC,sGAAsG;YACtG,MAAM;YACN,OAAO;SACR;QACD,oBAAoB,EAAE;YACpB,EAAE;YACF,OAAO;SACR;QACD,qCAAqC,EAAE,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC;QACjE,wBAAwB,EAAE;YACxB,EAAE;YACF,MAAM;YACN,OAAO;YACP,OAAO;YACP,aAAa;SACd;QAED,gDAAgD;QAChD,8CAA8C,EAAE,IAAI;QAEpD,0DAA0D;QAC1D,2CAA2C,EAAE,CAAC,GAAG,wBAAY,EAAE,MAAM,CAAC;QACtE,8CAA8C,EAAE,EAAE,EAAE,OAAO;QAC3D,8CAA8C,EAAE,EAAE,EAAE,OAAO;QAE3D,wCAAwC;QACxC,wBAAwB,EAAE,EAAE;QAE5B,0BAA0B,EAAE,IAAI;QAChC,2BAA2B,EAAE,IAAI;QACjC,+BAA+B,EAAE,IAAI;QACrC,gCAAgC,EAAE,IAAI;QAEtC,QAAQ,EAAE,IAAI,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,IAAI;QAE7C,sBAAsB,EAAE,IAAI,GAAG,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,IAAI;QAEhE,cAAc,EAAE,IAAI,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,IAAI;QACpD,qCAAqC,EAAE,CAAC,GAAG,kBAAM,CAAC,sBAAsB,CAAC;QACzE,gDAAgD,EAAE,CAAC,GAAG,wBAAY,CAAC;QAEnE,mBAAmB,EAAE,IAAI,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,IAAI;QAC1D,0CAA0C,EAAE;YAC1C,GAAG,kBAAM,CAAC,sBAAsB;SACjC;QACD,qDAAqD,EAAE,CAAC,GAAG,wBAAY,CAAC;QAExE,sBAAsB,EAAE,IAAI,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,IAAI;QACjE,6CAA6C,EAAE;YAC7C,GAAG,kBAAM,CAAC,sBAAsB;SACjC;QACD,wDAAwD,EAAE,CAAC,GAAG,wBAAY,CAAC;QAE3E,iBAAiB,EAAE,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,IAAI;QAC1D,+DAA+D;QAE/D,0DAA0D;QAC1D,qCAAqC,EAAE,IAAI,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,IAAI;QACzE,4DAA4D,EAAE;YAC5D,GAAG,kBAAM,CAAC,sBAAsB;SACjC;QACD,uEAAuE,EAAE;YACvE,GAAG,wBAAY;SAChB;QAED,qCAAqC,EAAE,IAAI;QAE3C,4DAA4D;QAC5D,iCAAiC,EAAE,CAAC,GAAG,wBAAY,CAAC;QAEpD,6DAA6D;QAC7D,qCAAqC,EACnC,cAAc,EAAE,qCAAqC;QAEvD,wFAAwF;QACxF,mBAAmB,EAAE,cAAc,EAAE,mBAAmB;KACzD,CAAA;AACH,CAAC;AAlJD,sCAkJC"}

package/dist/oauth-client.d.ts

@@ -0,0 +1,4 @@
+export * from '@atproto/oauth-types';
+export type * from './client/client.js';
+export * from './client/client-utils.js';
+//# sourceMappingURL=oauth-client.d.ts.map

package/dist/oauth-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-client.d.ts","sourceRoot":"","sources":["../src/oauth-client.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAA;AACpC,mBAAmB,oBAAoB,CAAA;AACvC,cAAc,0BAA0B,CAAA"}

package/dist/oauth-client.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("@atproto/oauth-types"), exports);
+__exportStar(require("./client/client-utils.js"), exports);
+//# sourceMappingURL=oauth-client.js.map

package/dist/oauth-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-client.js","sourceRoot":"","sources":["../src/oauth-client.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uDAAoC;AAEpC,2DAAwC"}

package/dist/oauth-dpop.d.ts

@@ -0,0 +1,3 @@
+export * from './dpop/dpop-nonce.js';
+export * from './dpop/dpop-manager.js';
+//# sourceMappingURL=oauth-dpop.d.ts.map

package/dist/oauth-dpop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-dpop.d.ts","sourceRoot":"","sources":["../src/oauth-dpop.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAA;AACpC,cAAc,wBAAwB,CAAA"}

package/dist/oauth-dpop.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./dpop/dpop-nonce.js"), exports);
+__exportStar(require("./dpop/dpop-manager.js"), exports);
+//# sourceMappingURL=oauth-dpop.js.map

package/dist/oauth-dpop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-dpop.js","sourceRoot":"","sources":["../src/oauth-dpop.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uDAAoC;AACpC,yDAAsC"}

package/dist/oauth-errors.d.ts

@@ -0,0 +1,20 @@
+export { OAuthError } from './errors/oauth-error.js';
+export { AccessDeniedError } from './errors/access-denied-error.js';
+export { AccountSelectionRequiredError } from './errors/account-selection-required-error.js';
+export { ConsentRequiredError } from './errors/consent-required-error.js';
+export { InvalidAuthorizationDetailsError } from './errors/invalid-authorization-details-error.js';
+export { InvalidClientError } from './errors/invalid-client-error.js';
+export { InvalidClientIdError } from './errors/invalid-client-id-error.js';
+export { InvalidClientMetadataError } from './errors/invalid-client-metadata-error.js';
+export { InvalidDpopKeyBindingError } from './errors/invalid-dpop-key-binding-error.js';
+export { InvalidDpopProofError } from './errors/invalid-dpop-proof-error.js';
+export { InvalidGrantError } from './errors/invalid-grant-error.js';
+export { InvalidParametersError } from './errors/invalid-parameters-error.js';
+export { InvalidRedirectUriError } from './errors/invalid-redirect-uri-error.js';
+export { InvalidRequestError } from './errors/invalid-request-error.js';
+export { InvalidTokenError } from './errors/invalid-token-error.js';
+export { LoginRequiredError } from './errors/login-required-error.js';
+export { UnauthorizedClientError } from './errors/unauthorized-client-error.js';
+export { UseDpopNonceError } from './errors/use-dpop-nonce-error.js';
+export { WWWAuthenticateError } from './errors/www-authenticate-error.js';
+//# sourceMappingURL=oauth-errors.d.ts.map

package/dist/oauth-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-errors.d.ts","sourceRoot":"","sources":["../src/oauth-errors.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AAEpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAA;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,8CAA8C,CAAA;AAC5F,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAA;AACzE,OAAO,EAAE,gCAAgC,EAAE,MAAM,iDAAiD,CAAA;AAClG,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAA;AAC1E,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAA;AACtF,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAA;AACvF,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAA;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAA;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAA;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAA;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAA;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAA;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAA;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAA"}