@atproto/oauth-provider 0.1.2 → 0.1.3

package/src/lib/http/stream.ts

@@ -7,6 +7,7 @@ import {
   KnownNames,
   KnownParser,
   KnownTypes,
+  parseContentType,
   ParserForType,
   ParserResult,
   parsers,
@@ -64,9 +65,11 @@ export async function parseStream(
     throw createHttpError(400, 'Invalid content-type')
   }
 
+  const type = parseContentType(contentType)
+
   const parser = parsers.find(
     (parser) =>
-      allow?.includes(parser.name) !== false && parser.test(contentType),
+      allow?.includes(parser.name) !== false && parser.test(type.mime),
   )
 
   if (!parser) {
@@ -74,5 +77,5 @@ export async function parseStream(
   }
 
   const buffer = await readStream(req)
-  return parser.parse(buffer)
+  return parser.parse(buffer, type)
 }

package/src/metadata/build-metadata.ts

@@ -127,28 +127,14 @@ export function buildMetadata(
     token_endpoint_auth_signing_alg_values_supported: [...VERIFY_ALGOS],
 
     revocation_endpoint: new URL('/oauth/revoke', issuer).href,
-    revocation_endpoint_auth_methods_supported: [
-      ...Client.AUTH_METHODS_SUPPORTED,
-    ],
-    revocation_endpoint_auth_signing_alg_values_supported: [...VERIFY_ALGOS],
 
     introspection_endpoint: new URL('/oauth/introspect', issuer).href,
-    introspection_endpoint_auth_methods_supported: [
-      ...Client.AUTH_METHODS_SUPPORTED,
-    ],
-    introspection_endpoint_auth_signing_alg_values_supported: [...VERIFY_ALGOS],
 
     userinfo_endpoint: new URL('/oauth/userinfo', issuer).href,
     // end_session_endpoint: new URL('/oauth/logout', issuer).href,
 
     // https://datatracker.ietf.org/doc/html/rfc9126#section-5
     pushed_authorization_request_endpoint: new URL('/oauth/par', issuer).href,
-    pushed_authorization_request_endpoint_auth_methods_supported: [
-      ...Client.AUTH_METHODS_SUPPORTED,
-    ],
-    pushed_authorization_request_endpoint_auth_signing_alg_values_supported: [
-      ...VERIFY_ALGOS,
-    ],
 
     require_pushed_authorization_requests: true,
 

package/src/oauth-provider.ts

@@ -9,7 +9,6 @@ import {
   OAuthAuthorizationServerMetadata,
   OAuthClientIdentification,
   OAuthClientMetadata,
-  OAuthEndpointName,
   OAuthTokenResponse,
   OAuthTokenType,
   atprotoLoopbackClientMetadata,
@@ -339,14 +338,11 @@ export class OAuthProvider extends OAuthVerifier {
 
   protected async authenticateClient(
     client: Client,
-    endpoint: OAuthEndpointName,
     credentials: OAuthClientIdentification,
   ): Promise<ClientAuth> {
-    const { clientAuth, nonce } = await client.verifyCredentials(
-      credentials,
-      endpoint,
-      { audience: this.issuer },
-    )
+    const { clientAuth, nonce } = await client.verifyCredentials(credentials, {
+      audience: this.issuer,
+    })
 
     if (nonce != null) {
       const unique = await this.replayManager.uniqueAuth(nonce, client.id)
@@ -424,11 +420,7 @@ export class OAuthProvider extends OAuthVerifier {
   ) {
     try {
       const client = await this.clientManager.getClient(input.client_id)
-      const clientAuth = await this.authenticateClient(
-        client,
-        'pushed_authorization_request',
-        input,
-      )
+      const clientAuth = await this.authenticateClient(client, input)
 
       const { payload: parameters } =
         'request' in input // Handle JAR
@@ -767,7 +759,7 @@ export class OAuthProvider extends OAuthVerifier {
     dpopJkt: null | string,
   ): Promise<OAuthTokenResponse> {
     const client = await this.clientManager.getClient(input.client_id)
-    const clientAuth = await this.authenticateClient(client, 'token', input)
+    const clientAuth = await this.authenticateClient(client, input)
 
     if (!client.metadata.grant_types.includes(input.grant_type)) {
       throw new InvalidGrantError(
@@ -851,11 +843,7 @@ export class OAuthProvider extends OAuthVerifier {
     input: Introspect,
   ): Promise<IntrospectionResponse> {
     const client = await this.clientManager.getClient(input.client_id)
-    const clientAuth = await this.authenticateClient(
-      client,
-      'introspection',
-      input,
-    )
+    const clientAuth = await this.authenticateClient(client, input)
 
     // RFC7662 states the following:
     //