@atproto/oauth-provider 0.1.0

package/src/token/types.ts

@@ -0,0 +1,86 @@
+import {
+  OAuthAuthorizationDetails,
+  OAuthTokenType,
+  accessTokenSchema,
+  oauthClientIdentificationSchema,
+} from '@atproto/oauth-types'
+import { z } from 'zod'
+
+import { clientIdSchema } from '../client/client-id.js'
+import { codeSchema } from '../request/code.js'
+import { refreshTokenSchema } from './refresh-token.js'
+
+export const codeGrantRequestSchema = z.intersection(
+  oauthClientIdentificationSchema,
+  z.object({
+    grant_type: z.literal('authorization_code'),
+    code: codeSchema,
+    /** @see {@link https://datatracker.ietf.org/doc/html/rfc7636#section-4.1} */
+    code_verifier: z
+      .string()
+      .min(43)
+      .max(128)
+      .regex(/^[a-zA-Z0-9-._~]+$/),
+    redirect_uri: z.string().url(),
+    // request_uri ???
+  }),
+)
+
+export type CodeGrantRequest = z.infer<typeof codeGrantRequestSchema>
+
+export const refreshGrantRequestSchema = z.intersection(
+  oauthClientIdentificationSchema,
+  z.object({
+    grant_type: z.literal('refresh_token'),
+    refresh_token: refreshTokenSchema,
+    client_id: clientIdSchema,
+  }),
+)
+
+export type RefreshGrantRequest = z.infer<typeof refreshGrantRequestSchema>
+
+export const tokenRequestSchema = z.union([
+  codeGrantRequestSchema,
+  refreshGrantRequestSchema,
+])
+
+export type TokenRequest = z.infer<typeof tokenRequestSchema>
+
+export const tokenIdentification = z.object({
+  token: z.union([accessTokenSchema, refreshTokenSchema]),
+  token_type_hint: z.enum(['access_token', 'refresh_token']).optional(),
+})
+
+export type TokenIdentification = z.infer<typeof tokenIdentification>
+
+export const revokeSchema = tokenIdentification
+
+export type Revoke = z.infer<typeof revokeSchema>
+
+export const introspectSchema = z.intersection(
+  oauthClientIdentificationSchema,
+  tokenIdentification,
+)
+
+export type Introspect = z.infer<typeof introspectSchema>
+
+// https://datatracker.ietf.org/doc/html/rfc7662#section-2.2
+export type IntrospectionResponse =
+  | { active: false }
+  | {
+      active: true
+
+      scope?: string
+      client_id?: string
+      username?: string
+      token_type?: OAuthTokenType
+      authorization_details?: OAuthAuthorizationDetails
+
+      aud?: string | [string, ...string[]]
+      exp?: number
+      iat?: number
+      iss?: string
+      jti?: string
+      nbf?: number
+      sub?: string
+    }

package/src/token/verify-token-claims.ts

@@ -0,0 +1,65 @@
+import { AccessToken, OAuthTokenType } from '@atproto/oauth-types'
+
+import { InvalidDpopKeyBindingError } from '../errors/invalid-dpop-key-binding-error.js'
+import { InvalidDpopProofError } from '../errors/invalid-dpop-proof-error.js'
+import { asArray } from '../lib/util/cast.js'
+import { InvalidTokenError } from '../oauth-errors.js'
+import { TokenClaims } from './token-claims.js'
+import { TokenId } from './token-id.js'
+
+export type VerifyTokenClaimsOptions = {
+  /** One of these audience must be included in the token audience(s) */
+  audience?: [string, ...string[]]
+  /** One of these scope must be included in the token scope(s) */
+  scope?: [string, ...string[]]
+}
+
+export type VerifyTokenClaimsResult = {
+  token: AccessToken
+  tokenId: TokenId
+  tokenType: OAuthTokenType
+  claims: TokenClaims
+}
+
+export function verifyTokenClaims(
+  token: AccessToken,
+  tokenId: TokenId,
+  tokenType: OAuthTokenType,
+  dpopJkt: string | null,
+  claims: TokenClaims,
+  options?: VerifyTokenClaimsOptions,
+): VerifyTokenClaimsResult {
+  const dateReference = Date.now()
+  const claimsJkt = claims.cnf?.jkt ?? null
+
+  const expectedTokenType: OAuthTokenType = claimsJkt ? 'DPoP' : 'Bearer'
+  if (expectedTokenType !== tokenType) {
+    throw new InvalidTokenError(expectedTokenType, `Invalid token type`)
+  }
+  if (tokenType === 'DPoP' && !dpopJkt) {
+    throw new InvalidDpopProofError(`jkt is required for DPoP tokens`)
+  }
+  if (claimsJkt !== dpopJkt) {
+    throw new InvalidDpopKeyBindingError()
+  }
+
+  if (options?.audience) {
+    const aud = asArray(claims.aud)
+    if (!options.audience.some((v) => aud.includes(v))) {
+      throw new InvalidTokenError(tokenType, `Invalid audience`)
+    }
+  }
+
+  if (options?.scope) {
+    const scopes = claims.scope?.split(' ')
+    if (!scopes || !options.scope.some((v) => scopes.includes(v))) {
+      throw new InvalidTokenError(tokenType, `Invalid scope`)
+    }
+  }
+
+  if (claims.exp && claims.exp * 1000 <= dateReference) {
+    throw new InvalidTokenError(tokenType, `Token expired`)
+  }
+
+  return { token, tokenId, tokenType, claims }
+}

package/tailwind.config.js

@@ -0,0 +1,13 @@
+/** @type {import('tailwindcss').Config} */
+export default {
+  content: ['src/assets/app/**/*.{js,ts,jsx,tsx}'],
+  theme: {
+    extend: {
+      colors: {
+        primary: 'rgb(var(--color-primary) / <alpha-value>)',
+        error: 'rgb(var(--color-error) / <alpha-value>)',
+      },
+    },
+  },
+  plugins: [],
+}

package/tsconfig.backend.json

@@ -0,0 +1,9 @@
+{
+  "extends": ["../../../tsconfig/nodenext.json"],
+  "compilerOptions": {
+    "outDir": "dist",
+    "rootDir": "src"
+  },
+  "include": ["src"],
+  "exclude": ["src/assets/app"]
+}

package/tsconfig.frontend.json

@@ -0,0 +1,11 @@
+{
+  "extends": [
+    "../../../tsconfig/browser.json",
+    "../../../tsconfig/bundler.json"
+  ],
+  "compilerOptions": {
+    "rootDir": "src/assets/app",
+    "outDir": "dist/assets/app"
+  },
+  "include": ["src/assets/app/**/*.ts", "src/assets/app/**/*.tsx"]
+}

package/tsconfig.json

@@ -0,0 +1,8 @@
+{
+  "include": [],
+  "references": [
+    { "path": "./tsconfig.frontend.json" },
+    { "path": "./tsconfig.backend.json" },
+    { "path": "./tsconfig.tools.json" }
+  ]
+}

package/tsconfig.tools.json

@@ -0,0 +1,8 @@
+{
+  "extends": ["../../../tsconfig/nodenext.json"],
+  "compilerOptions": {
+    "rootDir": ".",
+    "noEmit": true
+  },
+  "include": ["./*.js", "./*.cjs", "./*.mjs", "./*.ts"]
+}