@atproto/oauth-provider 0.1.0

package/src/request/types.ts

@@ -0,0 +1,48 @@
+import { signedJwtSchema, unsignedJwtSchema } from '@atproto/jwk'
+import {
+  oauthAuthenticationRequestParametersSchema,
+  oauthClientIdentificationSchema,
+} from '@atproto/oauth-types'
+import { z } from 'zod'
+
+import { requestUriSchema } from './request-uri.js'
+
+export const authorizationRequestJarSchema = z.object({
+  /**
+   * AuthorizationRequest inside a JWT:
+   * - "iat" is required and **MUST** be less than one minute
+   *
+   * @see {@link https://datatracker.ietf.org/doc/html/rfc9101}
+   */
+  request: z.union([signedJwtSchema, unsignedJwtSchema]),
+})
+
+export type AuthorizationRequestJar = z.infer<
+  typeof authorizationRequestJarSchema
+>
+
+export const pushedAuthorizationRequestSchema = z.intersection(
+  oauthClientIdentificationSchema,
+  z.union([
+    oauthAuthenticationRequestParametersSchema,
+    authorizationRequestJarSchema,
+    //
+  ]),
+)
+
+export type PushedAuthorizationRequest = z.infer<
+  typeof pushedAuthorizationRequestSchema
+>
+
+export const authorizationRequestQuerySchema = z.intersection(
+  oauthClientIdentificationSchema,
+  z.union([
+    oauthAuthenticationRequestParametersSchema,
+    authorizationRequestJarSchema,
+    z.object({ request_uri: requestUriSchema }),
+  ]),
+)
+
+export type AuthorizationRequestQuery = z.infer<
+  typeof authorizationRequestQuerySchema
+>

package/src/signer/signed-token-payload.ts

@@ -0,0 +1,35 @@
+import { jwtPayloadSchema } from '@atproto/jwk'
+import z from 'zod'
+
+import { clientIdSchema } from '../client/client-id.js'
+import { Simplify } from '../lib/util/type.js'
+import { subSchema } from '../oidc/sub.js'
+import { tokenIdSchema } from '../token/token-id.js'
+
+export const signedTokenPayloadSchema = z.intersection(
+  jwtPayloadSchema
+    .pick({
+      exp: true,
+      iat: true,
+      iss: true,
+      aud: true,
+    })
+    .required(),
+  jwtPayloadSchema
+    .omit({
+      exp: true,
+      iat: true,
+      iss: true,
+      aud: true,
+    })
+    .partial()
+    .extend({
+      jti: tokenIdSchema,
+      sub: subSchema,
+      client_id: clientIdSchema,
+    }),
+)
+
+export type SignedTokenPayload = Simplify<
+  z.infer<typeof signedTokenPayloadSchema>
+>

package/src/signer/signer.ts

@@ -0,0 +1,165 @@
+import { randomBytes } from 'node:crypto'
+
+import {
+  JwtPayload,
+  JwtPayloadGetter,
+  JwtSignHeader,
+  Keyset,
+  SignedJwt,
+  VerifyOptions,
+} from '@atproto/jwk'
+import {
+  OAuthAuthenticationRequestParameters,
+  OAuthAuthorizationDetails,
+} from '@atproto/oauth-types'
+import { generate as hash } from 'oidc-token-hash'
+
+import { Account } from '../account/account.js'
+import { Client } from '../client/client.js'
+import { InvalidClientMetadataError } from '../errors/invalid-client-metadata-error.js'
+import { dateToEpoch } from '../lib/util/date.js'
+import { claimRequested } from '../parameters/claims-requested.js'
+import { oidcPayload } from '../parameters/oidc-payload.js'
+import { TokenId } from '../token/token-id.js'
+import {
+  SignedTokenPayload,
+  signedTokenPayloadSchema,
+} from './signed-token-payload.js'
+
+export type SignPayload = Omit<JwtPayload, 'iss'>
+
+export class Signer {
+  constructor(
+    public readonly issuer: string,
+    public readonly keyset: Keyset,
+  ) {}
+
+  async verify<P extends Record<string, unknown> = JwtPayload>(
+    token: SignedJwt,
+    options?: Omit<VerifyOptions, 'issuer'>,
+  ) {
+    return this.keyset.verifyJwt<P>(token, {
+      ...options,
+      issuer: [this.issuer],
+    })
+  }
+
+  public async sign(
+    signHeader: JwtSignHeader,
+    payload: SignPayload | JwtPayloadGetter<SignPayload>,
+  ): Promise<SignedJwt> {
+    return this.keyset.createJwt(signHeader, async (protectedHeader, key) => ({
+      ...(typeof payload === 'function'
+        ? await payload(protectedHeader, key)
+        : payload),
+      iss: this.issuer,
+    }))
+  }
+
+  async accessToken(
+    client: Client,
+    parameters: OAuthAuthenticationRequestParameters,
+    account: Account,
+    extra: {
+      jti: TokenId
+      exp: Date
+      iat?: Date
+      alg?: string
+      cnf?: Record<string, string>
+      authorization_details?: OAuthAuthorizationDetails
+    },
+  ): Promise<SignedJwt> {
+    const header: JwtSignHeader = {
+      // https://datatracker.ietf.org/doc/html/rfc9068#section-2.1
+      alg: extra.alg,
+      typ: 'at+jwt',
+    }
+
+    const payload: Omit<SignedTokenPayload, 'iss'> = {
+      aud: account.aud,
+      iat: dateToEpoch(extra?.iat),
+      exp: dateToEpoch(extra.exp),
+      sub: account.sub,
+      jti: extra.jti,
+      cnf: extra.cnf,
+      // https://datatracker.ietf.org/doc/html/rfc8693#section-4.3
+      client_id: client.id,
+      scope: parameters.scope || client.metadata.scope,
+      authorization_details: extra.authorization_details,
+    }
+
+    return this.sign(header, payload)
+  }
+
+  async verifyAccessToken(token: SignedJwt) {
+    const result = await this.verify<SignedTokenPayload>(token, {
+      typ: 'at+jwt',
+    })
+
+    // The result is already type casted as an AccessTokenPayload, but we need
+    // to actually verify this. That should already be covered by the fact that
+    // we don't sign 'at+jwt' tokens without a valid token ID. Let's double
+    // check in case another version/implementation was used to generate the
+    // token.
+    signedTokenPayloadSchema.parse(result.payload)
+
+    return result
+  }
+
+  async idToken(
+    client: Client,
+    params: OAuthAuthenticationRequestParameters,
+    account: Account,
+    extra: {
+      exp: Date
+      iat?: Date
+      auth_time?: Date
+      code?: string
+      access_token?: string
+    },
+  ): Promise<SignedJwt> {
+    // This can happen when a client is using password_grant. If a client is
+    // using password_grant, it should not set "require_auth_time" to true.
+    if (client.metadata.require_auth_time && extra.auth_time == null) {
+      throw new InvalidClientMetadataError(
+        '"require_auth_time" metadata is not compatible with "password_grant" flow',
+      )
+    }
+
+    return this.sign(
+      {
+        alg: client.metadata.id_token_signed_response_alg,
+        typ: 'JWT',
+      },
+      async ({ alg }, key) => ({
+        ...oidcPayload(params, account),
+
+        aud: client.id,
+        iat: dateToEpoch(extra.iat),
+        exp: dateToEpoch(extra.exp),
+        sub: account.sub,
+        jti: randomBytes(16).toString('hex'),
+        scope: params.scope,
+        nonce: params.nonce,
+
+        s_hash: params.state //
+          ? await hash(params.state, alg, key.crv)
+          : undefined,
+        c_hash: extra.code //
+          ? await hash(extra.code, alg, key.crv)
+          : undefined,
+        at_hash: extra.access_token //
+          ? await hash(extra.access_token, alg, key.crv)
+          : undefined,
+
+        // https://openid.net/specs/openid-provider-authentication-policy-extension-1_0.html#rfc.section.5.2
+        auth_time:
+          client.metadata.require_auth_time ||
+          (extra.auth_time != null && params.max_age != null) ||
+          claimRequested(params, 'id_token', 'auth_time', extra.auth_time)
+            ? dateToEpoch(extra.auth_time!)
+            : undefined,
+      }),
+    )
+  }
+}

package/src/token/refresh-token.ts

@@ -0,0 +1,31 @@
+import { z } from 'zod'
+
+import {
+  REFRESH_TOKEN_BYTES_LENGTH,
+  REFRESH_TOKEN_PREFIX,
+} from '../constants.js'
+import { randomHexId } from '../lib/util/crypto.js'
+
+export const REFRESH_TOKEN_LENGTH =
+  REFRESH_TOKEN_PREFIX.length + REFRESH_TOKEN_BYTES_LENGTH * 2 // hex encoding
+
+export const refreshTokenSchema = z
+  .string()
+  .length(REFRESH_TOKEN_LENGTH)
+  .refine(
+    (v): v is `${typeof REFRESH_TOKEN_PREFIX}${string}` =>
+      v.startsWith(REFRESH_TOKEN_PREFIX),
+    {
+      message: `Invalid refresh token format`,
+    },
+  )
+
+export const isRefreshToken = (data: unknown): data is RefreshToken =>
+  refreshTokenSchema.safeParse(data).success
+
+export type RefreshToken = z.infer<typeof refreshTokenSchema>
+export const generateRefreshToken = async (): Promise<RefreshToken> => {
+  return `${REFRESH_TOKEN_PREFIX}${await randomHexId(
+    REFRESH_TOKEN_BYTES_LENGTH,
+  )}`
+}

package/src/token/token-claims.ts

@@ -0,0 +1,31 @@
+import { jwtPayloadSchema } from '@atproto/jwk'
+import z from 'zod'
+
+import { clientIdSchema } from '../client/client-id.js'
+import { Simplify } from '../lib/util/type.js'
+import { subSchema } from '../oidc/sub.js'
+
+export const tokenClaimsSchema = z.intersection(
+  jwtPayloadSchema
+    .pick({
+      iat: true,
+      exp: true,
+      aud: true,
+    })
+    .required(),
+  jwtPayloadSchema
+    .omit({
+      exp: true,
+      iat: true,
+      iss: true,
+      aud: true,
+      jti: true,
+    })
+    .partial()
+    .extend({
+      sub: subSchema,
+      client_id: clientIdSchema,
+    }),
+)
+
+export type TokenClaims = Simplify<z.infer<typeof tokenClaimsSchema>>

package/src/token/token-data.ts

@@ -0,0 +1,33 @@
+import {
+  OAuthAuthenticationRequestParameters,
+  OAuthAuthorizationDetails,
+} from '@atproto/oauth-types'
+
+import { ClientAuth } from '../client/client-auth.js'
+import { ClientId } from '../client/client-id.js'
+import { DeviceId } from '../device/device-id.js'
+import { Sub } from '../oidc/sub.js'
+import { Code } from '../request/code.js'
+
+export type {
+  ClientAuth,
+  ClientId,
+  Code,
+  DeviceId,
+  OAuthAuthenticationRequestParameters,
+  OAuthAuthorizationDetails,
+  Sub,
+}
+
+export type TokenData = {
+  createdAt: Date
+  updatedAt: Date
+  expiresAt: Date
+  clientId: ClientId
+  clientAuth: ClientAuth
+  deviceId: DeviceId | null
+  sub: Sub
+  parameters: OAuthAuthenticationRequestParameters
+  details: OAuthAuthorizationDetails | null
+  code: Code | null
+}

package/src/token/token-id.ts

@@ -0,0 +1,26 @@
+import { z } from 'zod'
+
+import { TOKEN_ID_BYTES_LENGTH, TOKEN_ID_PREFIX } from '../constants.js'
+import { randomHexId } from '../lib/util/crypto.js'
+
+export const TOKEN_ID_LENGTH =
+  TOKEN_ID_PREFIX.length + TOKEN_ID_BYTES_LENGTH * 2 // hex encoding
+
+export const tokenIdSchema = z
+  .string()
+  .length(TOKEN_ID_LENGTH)
+  .refine(
+    (v): v is `${typeof TOKEN_ID_PREFIX}${string}` =>
+      v.startsWith(TOKEN_ID_PREFIX),
+    {
+      message: `Invalid token ID format`,
+    },
+  )
+
+export type TokenId = z.infer<typeof tokenIdSchema>
+export const generateTokenId = async (): Promise<TokenId> => {
+  return `${TOKEN_ID_PREFIX}${await randomHexId(TOKEN_ID_BYTES_LENGTH)}`
+}
+
+export const isTokenId = (data: unknown): data is TokenId =>
+  tokenIdSchema.safeParse(data).success