@atproto/oauth-provider 0.1.0

package/src/assets/asset.ts

@@ -0,0 +1,8 @@
+import type { Readable } from 'node:stream'
+
+export type Asset = {
+  url: string
+  type?: string
+  sha256: string
+  createStream: () => Readable
+}

package/src/assets/assets-middleware.ts

@@ -0,0 +1,32 @@
+import { writeStream } from '../lib/http/index.js'
+
+import { ASSETS_URL_PREFIX, getAsset } from './index.js'
+
+export function authorizeAssetsMiddleware() {
+  return async function assetsMiddleware(req, res, next): Promise<void> {
+    if (req.method !== 'GET' && req.method !== 'HEAD') return next()
+    if (!req.url?.startsWith(ASSETS_URL_PREFIX)) return next()
+
+    const [pathname, query] = req.url.split('?', 2) as [
+      string,
+      string | undefined,
+    ]
+    const filename = pathname.slice(ASSETS_URL_PREFIX.length)
+    if (!filename) return next()
+
+    const asset = await getAsset(filename).catch(() => null)
+    if (!asset) return next()
+
+    if (req.headers['if-none-match'] === asset.sha256) {
+      return void res.writeHead(304).end()
+    }
+
+    res.setHeader('ETag', asset.sha256)
+
+    if (query === asset.sha256) {
+      res.setHeader('Cache-Control', 'public, max-age=31536000, immutable')
+    }
+
+    await writeStream(res, asset.createStream(), asset.type)
+  }
+}

package/src/assets/index.ts

@@ -0,0 +1,74 @@
+import type { ManifestItem } from '@atproto-labs/rollup-plugin-bundle-manifest'
+
+// If this library is used as a regular dependency (e.g. from node_modules), the
+// assets will simply be referenced from the node_modules directory. However, if
+// this library is bundled (e.g. via rollup), the assets need to be copied to
+// the output directory. Most bundlers support this (webpack, rollup, etc.) by
+// re-writing new URL('./path', import.meta.url) calls to point to the correct
+// output directory.
+//
+// https://github.com/evanw/esbuild/issues/795
+// https://www.npmjs.com/package/@web/rollup-plugin-import-meta-assets
+
+// Note that the bundle-manifest, being a JSON file, can be imported directly
+// without any special handling. This is because all bundlers support JSON
+// imports out of the box.
+
+import { createReadStream } from 'node:fs'
+import { join, posix } from 'node:path'
+import { Readable } from 'node:stream'
+
+// @ts-expect-error: This file is generated at build time
+import appBundleManifestJson from './app/bundle-manifest.json'
+import { Asset } from './asset'
+
+const appBundleManifest: Map<string, ManifestItem> = new Map(
+  Object.entries(appBundleManifestJson),
+)
+
+export const ASSETS_URL_PREFIX = '/@atproto/oauth-provider/~assets/'
+
+export async function getAsset(inputFilename: string): Promise<Asset> {
+  const filename = posix.normalize(inputFilename)
+
+  if (
+    filename.startsWith('/') || // Prevent absolute paths
+    filename.startsWith('../') || // Prevent directory traversal attacks
+    /[<>:"|?*\\]/.test(filename) // Windows disallowed characters
+  ) {
+    throw new AssetNotFoundError(filename)
+  }
+
+  const manifest = appBundleManifest.get(filename)
+  if (!manifest) throw new AssetNotFoundError(filename)
+
+  // When this package is used as a regular "node_modules" dependency, and gets
+  // bundled by the consumer, the assets should be copied to the bundle's output
+  // directory. In case the bundler does not support copying assets from the
+  // "dist/assets/app" folder, this package's build system can be modified to
+  // embed the asset data directly into the bundle-manifest.json (see the `data`
+  // option of "@atproto-labs/rollup-plugin-bundle-manifest" in rollup.config.js).
+
+  const { data } = manifest
+
+  return {
+    url: posix.join(ASSETS_URL_PREFIX, filename),
+    type: manifest.mime,
+    sha256: manifest.sha256,
+    createStream: data
+      ? () => Readable.from(Buffer.from(data, 'base64'))
+      : () =>
+          // ESM version:
+          // createReadStream(new URL(`./app/${filename}`, import.meta.url))
+          // CJS version:
+          createReadStream(join(__dirname, './app', filename)),
+  }
+}
+
+class AssetNotFoundError extends Error {
+  public readonly code = 'ENOENT'
+  public readonly statusCode = 404
+  constructor(filename: string) {
+    super(`Asset not found: ${filename}`)
+  }
+}

package/src/client/client-auth.ts

@@ -0,0 +1,45 @@
+import { CLIENT_ASSERTION_TYPE_JWT_BEARER } from '@atproto/oauth-types'
+import { KeyLike, calculateJwkThumbprint, exportJWK } from 'jose'
+import { JOSEError } from 'jose/errors'
+
+import { InvalidClientError } from '../errors/invalid-client-error.js'
+
+export type ClientAuth =
+  | { method: 'none' }
+  | {
+      method: typeof CLIENT_ASSERTION_TYPE_JWT_BEARER
+      alg: string
+      kid: string
+      jkt: string
+    }
+
+export function compareClientAuth(a: ClientAuth, b: ClientAuth): boolean {
+  if (a.method === 'none') {
+    if (b.method !== a.method) return false
+
+    return true
+  }
+
+  if (a.method === CLIENT_ASSERTION_TYPE_JWT_BEARER) {
+    if (b.method !== a.method) return false
+
+    return true
+  }
+
+  // Fool-proof
+  throw new TypeError('Invalid ClientAuth method')
+}
+
+export async function authJwkThumbprint(
+  key: Uint8Array | KeyLike,
+): Promise<string> {
+  try {
+    return await calculateJwkThumbprint(await exportJWK(key), 'sha512')
+  } catch (err) {
+    const message =
+      err instanceof JOSEError
+        ? err.message
+        : 'Failed to compute JWK thumbprint'
+    throw new InvalidClientError(message, err)
+  }
+}

package/src/client/client-data.ts

@@ -0,0 +1,9 @@
+import { Jwks } from '@atproto/jwk'
+import { OAuthClientMetadata } from '@atproto/oauth-types'
+
+export type { OAuthClientMetadata }
+
+export type ClientData = {
+  metadata: OAuthClientMetadata
+  jwks?: Jwks
+}

package/src/client/client-id.ts

@@ -0,0 +1,4 @@
+import { OAuthClientId, oauthClientIdSchema } from '@atproto/oauth-types'
+
+export type ClientId = OAuthClientId
+export const clientIdSchema = oauthClientIdSchema

package/src/client/client-info.ts

@@ -0,0 +1,13 @@
+export type ClientInfo = {
+  /**
+   * Defaults to `false`
+   */
+  isFirstParty: boolean
+
+  /**
+   * Defaults to `true` if the client is isFirstParty, or if the client was
+   * loaded from the store. (i.e. false in case of "loopback" & "discoverable"
+   * clients)
+   */
+  isTrusted: boolean
+}