@atproto/oauth-provider 0.1.2 → 0.2.0

package/dist/oauth-hooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-hooks.d.ts","sourceRoot":"","sources":["../src/oauth-hooks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AACnC,OAAO,EACL,oCAAoC,EACpC,yBAAyB,EACzB,mBAAmB,EACnB,kBAAkB,EACnB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAG9C,YAAY,EACV,OAAO,EACP,MAAM,EACN,UAAU,EACV,QAAQ,EACR,UAAU,EACV,IAAI,EACJ,oCAAoC,EACpC,yBAAyB,EACzB,mBAAmB,EACnB,kBAAkB,GACnB,CAAA;AAED,MAAM,MAAM,UAAU,GAAG;IACvB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,CACb,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE;QAAE,QAAQ,EAAE,mBAAmB,CAAC;QAAC,IAAI,CAAC,EAAE,IAAI,CAAA;KAAE,KACjD,SAAS,CAAC,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAA;IAEtD;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC9B,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,oCAAoC,CAAA;QAChD,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,SAAS,GAAG,yBAAyB,CAAC,CAAA;IAEtD;;OAEG;IACH,eAAe,CAAC,EAAE,CAChB,aAAa,EAAE,kBAAkB,EACjC,IAAI,EAAE;QACJ,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,oCAAoC,CAAA;QAChD,OAAO,EAAE,OAAO,CAAA;KACjB,KACE,SAAS,CAAC,IAAI,CAAC,CAAA;CACrB,CAAA"}
+{"version":3,"file":"oauth-hooks.d.ts","sourceRoot":"","sources":["../src/oauth-hooks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AACnC,OAAO,EACL,oCAAoC,EACpC,yBAAyB,EACzB,mBAAmB,EACnB,kBAAkB,EACnB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAC3C,OAAO,EAAE,gCAAgC,EAAE,MAAM,iDAAiD,CAAA;AAClG,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAG9C,YAAY,EACV,OAAO,EACP,MAAM,EACN,UAAU,EACV,QAAQ,EACR,UAAU,EACV,gCAAgC,EAChC,IAAI,EACJ,oCAAoC,EACpC,yBAAyB,EACzB,mBAAmB,EACnB,kBAAkB,GACnB,CAAA;AAED,MAAM,MAAM,UAAU,GAAG;IACvB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,CACb,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE;QAAE,QAAQ,EAAE,mBAAmB,CAAC;QAAC,IAAI,CAAC,EAAE,IAAI,CAAA;KAAE,KACjD,SAAS,CAAC,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAA;IAEtD;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC9B,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,oCAAoC,CAAA;QAChD,OAAO,EAAE,OAAO,CAAA;KACjB,KAAK,SAAS,CAAC,SAAS,GAAG,yBAAyB,CAAC,CAAA;CACvD,CAAA"}

package/dist/oauth-provider.d.ts

@@ -1,10 +1,10 @@
 /// <reference types="node" />
 import { SimpleStore } from '@atproto-labs/simple-store';
-import { Jwks, Keyset, SignedJwt } from '@atproto/jwk';
-import { AccessToken, OAuthAuthenticationRequestParameters, OAuthAuthorizationServerMetadata, OAuthClientIdentification, OAuthClientMetadata, OAuthEndpointName, OAuthTokenResponse, OAuthTokenType } from '@atproto/oauth-types';
+import { Jwks, Keyset } from '@atproto/jwk';
+import { AccessToken, OAuthAuthenticationRequestParameters, OAuthAuthorizationServerMetadata, OAuthClientIdentification, OAuthClientMetadata, OAuthTokenResponse, OAuthTokenType } from '@atproto/oauth-types';
 import { Redis, type RedisOptions } from 'ioredis';
 import { AccountManager } from './account/account-manager.js';
-import { AccountInfo, AccountStore, DeviceAccountInfo, SignInCredentials } from './account/account-store.js';
+import { AccountStore, DeviceAccountInfo, SignInCredentials } from './account/account-store.js';
 import { Account } from './account/account.js';
 import { ClientAuth } from './client/client-auth.js';
 import { ClientId } from './client/client-id.js';
@@ -18,7 +18,6 @@ import { Override } from './lib/util/type.js';
 import { CustomMetadata } from './metadata/build-metadata.js';
 import { OAuthHooks } from './oauth-hooks.js';
 import { OAuthVerifier, OAuthVerifierOptions } from './oauth-verifier.js';
-import { Userinfo } from './oidc/userinfo.js';
 import { AuthorizationResultAuthorize } from './output/build-authorize-data.js';
 import { Customization } from './output/customization.js';
 import { AuthorizationResultRedirect } from './output/send-authorize-redirect.js';
@@ -28,7 +27,7 @@ import { RequestStore } from './request/request-store.js';
 import { RequestUri } from './request/request-uri.js';
 import { AuthorizationRequestJar, AuthorizationRequestQuery, PushedAuthorizationRequest } from './request/types.js';
 import { TokenManager } from './token/token-manager.js';
-import { TokenInfo, TokenStore } from './token/token-store.js';
+import { TokenStore } from './token/token-store.js';
 import { CodeGrantRequest, Introspect, IntrospectionResponse, RefreshGrantRequest, Revoke, TokenRequest } from './token/types.js';
 import { VerifyTokenClaimsOptions } from './token/verify-token-claims.js';
 export type OAuthProviderStore = Partial<ClientStore & AccountStore & DeviceStore & TokenStore & RequestStore & ReplayStore>;
@@ -39,9 +38,7 @@ export type RouterOptions<Req extends IncomingMessage = IncomingMessage, Res ext
 export type OAuthProviderOptions = Override<OAuthVerifierOptions & OAuthHooks, {
     /**
      * Maximum age a device/account session can be before requiring
-     * re-authentication. This can be overridden on a authorization request basis
-     * using the `max_age` parameter and on a client basis using the
-     * `default_max_age` client metadata.
+     * re-authentication.
      */
     authenticationMaxAge?: number;
     /**
@@ -217,7 +214,7 @@ export declare class OAuthProvider extends OAuthVerifier {
         })[];
     };
     protected loginRequired(client: Client, parameters: OAuthAuthenticationRequestParameters, info: DeviceAccountInfo): boolean;
-    protected authenticateClient(client: Client, endpoint: OAuthEndpointName, credentials: OAuthClientIdentification): Promise<ClientAuth>;
+    protected authenticateClient(client: Client, credentials: OAuthClientIdentification): Promise<ClientAuth>;
     protected decodeJAR(client: Client, input: AuthorizationRequestJar): Promise<{
         payload: OAuthAuthenticationRequestParameters;
     } | {
@@ -246,7 +243,10 @@ export declare class OAuthProvider extends OAuthVerifier {
         consentRequired: boolean;
         matchesHint: boolean;
     }[]>;
-    protected signIn(deviceId: DeviceId, credentials: SignInCredentials): Promise<AccountInfo>;
+    protected signIn(deviceId: DeviceId, uri: RequestUri, clientId: ClientId, credentials: SignInCredentials): Promise<{
+        account: Account;
+        consentRequired: boolean;
+    }>;
     protected acceptRequest(deviceId: DeviceId, uri: RequestUri, clientId: ClientId, sub: string): Promise<AuthorizationResultRedirect>;
     protected rejectRequest(deviceId: DeviceId, uri: RequestUri, clientId: ClientId): Promise<AuthorizationResultRedirect>;
     protected token(input: TokenRequest, dpopJkt: null | string): Promise<OAuthTokenResponse>;
@@ -260,11 +260,6 @@ export declare class OAuthProvider extends OAuthVerifier {
      * @see {@link https://datatracker.ietf.org/doc/html/rfc7662#section-2.1 rfc7662}
      */
     protected introspect(input: Introspect): Promise<IntrospectionResponse>;
-    /**
-     * @see {@link https://openid.net/specs/openid-connect-core-1_0.html#rfc.section.5.3.2 Successful UserInfo Response}
-     */
-    protected userinfo({ data, account }: TokenInfo): Promise<Userinfo>;
-    protected signUserinfo(userinfo: Userinfo): Promise<SignedJwt>;
     protected authenticateToken(tokenType: OAuthTokenType, token: AccessToken, dpopJkt: string | null, verifyOptions?: VerifyTokenClaimsOptions): Promise<import("./token/verify-token-claims.js").VerifyTokenClaimsResult>;
     /**
      * @returns An http request handler that can be used with node's http server

package/dist/oauth-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-provider.d.ts","sourceRoot":"","sources":["../src/oauth-provider.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AAExD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAmB,MAAM,cAAc,CAAA;AACvE,OAAO,EACL,WAAW,EAEX,oCAAoC,EACpC,gCAAgC,EAChC,yBAAyB,EACzB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EAGf,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,KAAK,EAAE,KAAK,YAAY,EAAE,MAAM,SAAS,CAAA;AAIlD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EACL,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,iBAAiB,EAGlB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAE9C,OAAO,EAAE,UAAU,EAAqB,MAAM,yBAAyB,CAAA;AACvE,OAAO,EAAE,QAAQ,EAAkB,MAAM,uBAAuB,CAAA;AAChE,OAAO,EACL,aAAa,EACb,sBAAsB,EACvB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,WAAW,EAAiB,MAAM,0BAA0B,CAAA;AACrE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAE3C,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAEhD,OAAO,EAAE,WAAW,EAAiB,MAAM,0BAA0B,CAAA;AAYrE,OAAO,EACL,OAAO,EACP,eAAe,EAEf,MAAM,EACN,cAAc,EAWf,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,cAAc,EAAiB,MAAM,8BAA8B,CAAA;AAC5E,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,4BAA4B,EAAE,MAAM,kCAAkC,CAAA;AAK/E,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAA;AAEzD,OAAO,EACL,2BAA2B,EAE5B,MAAM,qCAAqC,CAAA;AAE5C,OAAO,EAAE,WAAW,EAAiB,MAAM,0BAA0B,CAAA;AAErE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAG7D,OAAO,EAAE,YAAY,EAAkB,MAAM,4BAA4B,CAAA;AACzE,OAAO,EAAE,UAAU,EAAoB,MAAM,0BAA0B,CAAA;AACvE,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,0BAA0B,EAG3B,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAgB,MAAM,wBAAwB,CAAA;AAC5E,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,qBAAqB,EACrB,mBAAmB,EACnB,MAAM,EACN,YAAY,EAIb,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAA;AAEzE,MAAM,MAAM,kBAAkB,GAAG,OAAO,CACtC,WAAW,GACT,YAAY,GACZ,WAAW,GACX,UAAU,GACV,YAAY,GACZ,WAAW,CACd,CAAA;AAED,OAAO,EACL,MAAM,EACN,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,OAAO,EACZ,KAAK,gCAAgC,GACtC,CAAA;AAED,MAAM,MAAM,aAAa,CACvB,GAAG,SAAS,eAAe,GAAG,eAAe,EAC7C,GAAG,SAAS,cAAc,GAAG,cAAc,IACzC;IACF,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CACtE,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CACzC,oBAAoB,GAAG,UAAU,EACjC;IACE;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAE7B;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IAEpB;;OAEG;IACH,QAAQ,CAAC,EAAE,cAAc,CAAA;IAEzB;;OAEG;IACH,aAAa,CAAC,EAAE,aAAa,CAAA;IAE7B;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAA;IAEnC;;;OAGG;IACH,KAAK,CAAC,EAAE,KAAK,GAAG,YAAY,GAAG,MAAM,CAAA;IAErC;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,kBAAkB,CAAA;IAE1B,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,UAAU,CAAC,EAAE,UAAU,CAAA;IAEvB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAE3C;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;IAE9D;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,IAAI,GAAG,KAAK,GAAG,sBAAsB,CAAA;CACzD,CACF,CAAA;AAED,qBAAa,aAAc,SAAQ,aAAa;IAC9C,SAAgB,QAAQ,EAAE,gCAAgC,CAAA;IAC1D,SAAgB,aAAa,CAAC,EAAE,aAAa,CAAA;IAE7C,SAAgB,oBAAoB,EAAE,MAAM,CAAA;IAE5C,SAAgB,cAAc,EAAE,cAAc,CAAA;IAC9C,SAAgB,WAAW,EAAE,WAAW,CAAA;IACxC,SAAgB,aAAa,EAAE,aAAa,CAAA;IAC5C,SAAgB,cAAc,EAAE,cAAc,CAAA;IAC9C,SAAgB,YAAY,EAAE,YAAY,CAAA;gBAEvB,EACjB,QAAQ,EACR,aAAyB,EACzB,oBAA6C,EAC7C,WAA2B,EAE3B,SAA2B,EAC3B,KAAK,EACL,KAAK,EAAE,gCAAgC;IAGvC,YAAoC,EACpC,WAAkC,EAClC,UAAgC,EAGhC,WAAkC,EAClC,WAAkC,EAClC,YAAoC,EAEpC,eAGE,EACF,mBAGE,EAEF,gBAAgD,EAGhD,GAAG,IAAI,EACR,EAAE,oBAAoB;IAsCvB,IAAI,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAEP;IAED,SAAS,CAAC,aAAa,CACrB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,oCAAoC,EAChD,IAAI,EAAE,iBAAiB;cAoBT,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,EAAE,yBAAyB,GACrC,OAAO,CAAC,UAAU,CAAC;cAiBN,SAAS,CACvB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CACN;QACE,OAAO,EAAE,oCAAoC,CAAA;KAC9C,GACD;QACE,OAAO,EAAE,oCAAoC,CAAA;QAC7C,eAAe,EAAE;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAA;QAC7C,GAAG,EAAE,MAAM,CAAA;KACZ,CACJ;IA6CD;;OAEG;cACa,0BAA0B,CACxC,KAAK,EAAE,0BAA0B,EACjC,OAAO,EAAE,IAAI,GAAG,MAAM;;;;YAyCV,wBAAwB;YAmDxB,aAAa;cAWX,SAAS,CACvB,QAAQ,EAAE,QAAQ,EAClB,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,2BAA2B,GAAG,4BAA4B,CAAC;cA0FtD,WAAW,CACzB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,QAAQ,EAAE,QAAQ,EAClB,UAAU,EAAE,oCAAoC,GAC/C,OAAO,CACR;QACE,OAAO,EAAE,OAAO,CAAA;QAChB,IAAI,EAAE,iBAAiB,CAAA;QAEvB,QAAQ,EAAE,OAAO,CAAA;QACjB,aAAa,EAAE,OAAO,CAAA;QACtB,eAAe,EAAE,OAAO,CAAA;QAExB,WAAW,EAAE,OAAO,CAAA;KACrB,EAAE,CACJ;cAkCe,MAAM,CACpB,QAAQ,EAAE,QAAQ,EAClB,WAAW,EAAE,iBAAiB,GAC7B,OAAO,CAAC,WAAW,CAAC;cAIP,aAAa,CAC3B,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,UAAU,EACf,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,2BAA2B,CAAC;cAsDvB,aAAa,CAC3B,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,UAAU,EACf,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,2BAA2B,CAAC;cA0BvB,KAAK,CACnB,KAAK,EAAE,YAAY,EACnB,OAAO,EAAE,IAAI,GAAG,MAAM,GACrB,OAAO,CAAC,kBAAkB,CAAC;cAwBd,SAAS,CACvB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE,IAAI,GAAG,MAAM,GACrB,OAAO,CAAC,kBAAkB,CAAC;IAgCxB,iBAAiB,CACrB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,KAAK,EAAE,mBAAmB,EAC1B,OAAO,EAAE,IAAI,GAAG,MAAM,GACrB,OAAO,CAAC,kBAAkB,CAAC;IAI9B;;OAEG;cACa,MAAM,CAAC,KAAK,EAAE,MAAM;IAMpC;;OAEG;cACa,UAAU,CACxB,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC,qBAAqB,CAAC;IAsDjC;;OAEG;cACa,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;cAWzD,YAAY,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC;cAW3C,iBAAiB,CACxC,SAAS,EAAE,cAAc,EACzB,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,MAAM,GAAG,IAAI,EACtB,aAAa,CAAC,EAAE,wBAAwB;IAgB1C;;;OAGG;IACI,WAAW,CAChB,CAAC,GAAG,IAAI,EACR,GAAG,SAAS,eAAe,GAAG,eAAe,EAC7C,GAAG,SAAS,cAAc,GAAG,cAAc,EAC3C,OAAO,CAAC,EAAE,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC;IAKnD,WAAW,CAChB,CAAC,GAAG,IAAI,EACR,GAAG,SAAS,eAAe,GAAG,eAAe,EAC7C,GAAG,SAAS,cAAc,GAAG,cAAc,EAC3C,EACA,OAGa,GACd,GAAE,aAAa,CAAC,GAAG,EAAE,GAAG,CAAM;CA+bhC"}
+{"version":3,"file":"oauth-provider.d.ts","sourceRoot":"","sources":["../src/oauth-provider.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AAExD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAC3C,OAAO,EACL,WAAW,EAEX,oCAAoC,EACpC,gCAAgC,EAChC,yBAAyB,EACzB,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EAGf,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,KAAK,EAAE,KAAK,YAAY,EAAE,MAAM,SAAS,CAAA;AAIlD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,iBAAiB,EAGlB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAE9C,OAAO,EAAE,UAAU,EAAqB,MAAM,yBAAyB,CAAA;AACvE,OAAO,EAAE,QAAQ,EAAkB,MAAM,uBAAuB,CAAA;AAChE,OAAO,EACL,aAAa,EACb,sBAAsB,EACvB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,WAAW,EAAiB,MAAM,0BAA0B,CAAA;AACrE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAE3C,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAEhD,OAAO,EAAE,WAAW,EAAiB,MAAM,0BAA0B,CAAA;AAYrE,OAAO,EACL,OAAO,EACP,eAAe,EAEf,MAAM,EACN,cAAc,EAYf,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,cAAc,EAAiB,MAAM,8BAA8B,CAAA;AAC5E,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AACzE,OAAO,EAAE,4BAA4B,EAAE,MAAM,kCAAkC,CAAA;AAK/E,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAA;AAEzD,OAAO,EACL,2BAA2B,EAE5B,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EAAE,WAAW,EAAiB,MAAM,0BAA0B,CAAA;AAErE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAG7D,OAAO,EAAE,YAAY,EAAkB,MAAM,4BAA4B,CAAA;AACzE,OAAO,EAAE,UAAU,EAAoB,MAAM,0BAA0B,CAAA;AACvE,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,0BAA0B,EAG3B,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EAAE,UAAU,EAAgB,MAAM,wBAAwB,CAAA;AACjE,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,qBAAqB,EACrB,mBAAmB,EACnB,MAAM,EACN,YAAY,EAIb,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAA;AAEzE,MAAM,MAAM,kBAAkB,GAAG,OAAO,CACtC,WAAW,GACT,YAAY,GACZ,WAAW,GACX,UAAU,GACV,YAAY,GACZ,WAAW,CACd,CAAA;AAED,OAAO,EACL,MAAM,EACN,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,OAAO,EACZ,KAAK,gCAAgC,GACtC,CAAA;AAED,MAAM,MAAM,aAAa,CACvB,GAAG,SAAS,eAAe,GAAG,eAAe,EAC7C,GAAG,SAAS,cAAc,GAAG,cAAc,IACzC;IACF,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CACtE,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CACzC,oBAAoB,GAAG,UAAU,EACjC;IACE;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAE7B;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IAEpB;;OAEG;IACH,QAAQ,CAAC,EAAE,cAAc,CAAA;IAEzB;;OAEG;IACH,aAAa,CAAC,EAAE,aAAa,CAAA;IAE7B;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAA;IAEnC;;;OAGG;IACH,KAAK,CAAC,EAAE,KAAK,GAAG,YAAY,GAAG,MAAM,CAAA;IAErC;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,kBAAkB,CAAA;IAE1B,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,UAAU,CAAC,EAAE,UAAU,CAAA;IAEvB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAE3C;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;IAE9D;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,IAAI,GAAG,KAAK,GAAG,sBAAsB,CAAA;CACzD,CACF,CAAA;AAED,qBAAa,aAAc,SAAQ,aAAa;IAC9C,SAAgB,QAAQ,EAAE,gCAAgC,CAAA;IAC1D,SAAgB,aAAa,CAAC,EAAE,aAAa,CAAA;IAE7C,SAAgB,oBAAoB,EAAE,MAAM,CAAA;IAE5C,SAAgB,cAAc,EAAE,cAAc,CAAA;IAC9C,SAAgB,WAAW,EAAE,WAAW,CAAA;IACxC,SAAgB,aAAa,EAAE,aAAa,CAAA;IAC5C,SAAgB,cAAc,EAAE,cAAc,CAAA;IAC9C,SAAgB,YAAY,EAAE,YAAY,CAAA;gBAEvB,EACjB,QAAQ,EACR,aAAyB,EACzB,oBAA6C,EAC7C,WAA2B,EAE3B,SAA2B,EAC3B,KAAK,EACL,KAAK,EAAE,gCAAgC;IAGvC,YAAoC,EACpC,WAAkC,EAClC,UAAgC,EAGhC,WAAkC,EAClC,WAAkC,EAClC,YAAoC,EAEpC,eAGE,EACF,mBAGE,EAEF,gBAAgD,EAGhD,GAAG,IAAI,EACR,EAAE,oBAAoB;IAuCvB,IAAI,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAEP;IAED,SAAS,CAAC,aAAa,CACrB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,oCAAoC,EAChD,IAAI,EAAE,iBAAiB;cAaT,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,yBAAyB,GACrC,OAAO,CAAC,UAAU,CAAC;cAeN,SAAS,CACvB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CACN;QACE,OAAO,EAAE,oCAAoC,CAAA;KAC9C,GACD;QACE,OAAO,EAAE,oCAAoC,CAAA;QAC7C,eAAe,EAAE;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAA;QAC7C,GAAG,EAAE,MAAM,CAAA;KACZ,CACJ;IA6CD;;OAEG;cACa,0BAA0B,CACxC,KAAK,EAAE,0BAA0B,EACjC,OAAO,EAAE,IAAI,GAAG,MAAM;;;;YAqCV,wBAAwB;YAmDxB,aAAa;cAWX,SAAS,CACvB,QAAQ,EAAE,QAAQ,EAClB,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,2BAA2B,GAAG,4BAA4B,CAAC;cAqGtD,WAAW,CACzB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,QAAQ,EAAE,QAAQ,EAClB,UAAU,EAAE,oCAAoC,GAC/C,OAAO,CACR;QACE,OAAO,EAAE,OAAO,CAAA;QAChB,IAAI,EAAE,iBAAiB,CAAA;QAEvB,QAAQ,EAAE,OAAO,CAAA;QACjB,aAAa,EAAE,OAAO,CAAA;QACtB,eAAe,EAAE,OAAO,CAAA;QAExB,WAAW,EAAE,OAAO,CAAA;KACrB,EAAE,CACJ;cAqCe,MAAM,CACpB,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,UAAU,EACf,QAAQ,EAAE,QAAQ,EAClB,WAAW,EAAE,iBAAiB,GAC7B,OAAO,CAAC;QACT,OAAO,EAAE,OAAO,CAAA;QAChB,eAAe,EAAE,OAAO,CAAA;KACzB,CAAC;cAuBc,aAAa,CAC3B,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,UAAU,EACf,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,2BAA2B,CAAC;cAqDvB,aAAa,CAC3B,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,UAAU,EACf,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,2BAA2B,CAAC;cA0BvB,KAAK,CACnB,KAAK,EAAE,YAAY,EACnB,OAAO,EAAE,IAAI,GAAG,MAAM,GACrB,OAAO,CAAC,kBAAkB,CAAC;cAwBd,SAAS,CACvB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE,IAAI,GAAG,MAAM,GACrB,OAAO,CAAC,kBAAkB,CAAC;IA0DxB,iBAAiB,CACrB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,KAAK,EAAE,mBAAmB,EAC1B,OAAO,EAAE,IAAI,GAAG,MAAM,GACrB,OAAO,CAAC,kBAAkB,CAAC;IAI9B;;OAEG;cACa,MAAM,CAAC,KAAK,EAAE,MAAM;IAMpC;;OAEG;cACa,UAAU,CACxB,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC,qBAAqB,CAAC;cAkDR,iBAAiB,CACxC,SAAS,EAAE,cAAc,EACzB,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,MAAM,GAAG,IAAI,EACtB,aAAa,CAAC,EAAE,wBAAwB;IAgB1C;;;OAGG;IACI,WAAW,CAChB,CAAC,GAAG,IAAI,EACR,GAAG,SAAS,eAAe,GAAG,eAAe,EAC7C,GAAG,SAAS,cAAc,GAAG,cAAc,EAC3C,OAAO,CAAC,EAAE,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC;IAKnD,WAAW,CAChB,CAAC,GAAG,IAAI,EACR,GAAG,SAAS,eAAe,GAAG,eAAe,EAC7C,GAAG,SAAS,cAAc,GAAG,cAAc,EAC3C,EACA,OAGa,GACd,GAAE,aAAa,CAAC,GAAG,EAAE,GAAG,CAAM;CAkahC"}

package/dist/oauth-provider.js

@@ -1,4 +1,27 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OAuthProvider = exports.Keyset = void 0;
 const fetch_node_1 = require("@atproto-labs/fetch-node");
@@ -6,7 +29,7 @@ const simple_store_memory_1 = require("@atproto-labs/simple-store-memory");
 const jwk_1 = require("@atproto/jwk");
 Object.defineProperty(exports, "Keyset", { enumerable: true, get: function () { return jwk_1.Keyset; } });
 const oauth_types_1 = require("@atproto/oauth-types");
-const zod_1 = require("zod");
+const zod_1 = __importStar(require("zod"));
 const access_token_type_js_1 = require("./access-token/access-token-type.js");
 const account_manager_js_1 = require("./account/account-manager.js");
 const account_store_js_1 = require("./account/account-store.js");
@@ -36,7 +59,6 @@ const oauth_verifier_js_1 = require("./oauth-verifier.js");
 const build_error_payload_js_1 = require("./output/build-error-payload.js");
 const output_manager_js_1 = require("./output/output-manager.js");
 const send_authorize_redirect_js_1 = require("./output/send-authorize-redirect.js");
-const oidc_payload_js_1 = require("./parameters/oidc-payload.js");
 const replay_store_js_1 = require("./replay/replay-store.js");
 const request_manager_js_1 = require("./request/request-manager.js");
 const request_store_memory_js_1 = require("./request/request-store-memory.js");
@@ -79,7 +101,7 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
         this.customization = customization;
         this.deviceStore = deviceStore;
         this.accountManager = new account_manager_js_1.AccountManager(accountStore);
-        this.clientManager = new client_manager_js_1.ClientManager(this.keyset, rest, clientStore || null, loopbackMetadata || null, safeFetch, clientJwksCache, clientMetadataCache);
+        this.clientManager = new client_manager_js_1.ClientManager(this.metadata, this.keyset, rest, clientStore || null, loopbackMetadata || null, safeFetch, clientJwksCache, clientMetadataCache);
         this.requestManager = new request_manager_js_1.RequestManager(requestStore, this.signer, this.metadata, rest);
         this.tokenManager = new token_manager_js_1.TokenManager(tokenStore, this.signer, rest, this.accessTokenType, tokenMaxAge);
     }
@@ -93,17 +115,12 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
         if (!Number.isFinite(authAge) || authAge < 0) {
             return true;
         }
-        /** in seconds */
-        const maxAge = parameters.max_age ?? client.metadata.default_max_age;
-        if (maxAge != null && maxAge < this.authenticationMaxAge) {
-            return authAge >= maxAge;
-        }
-        else {
-            return authAge >= this.authenticationMaxAge;
-        }
+        return authAge >= this.authenticationMaxAge;
     }
-    async authenticateClient(client, endpoint, credentials) {
-        const { clientAuth, nonce } = await client.verifyCredentials(credentials, endpoint, { audience: this.issuer });
+    async authenticateClient(client, credentials) {
+        const { clientAuth, nonce } = await client.verifyCredentials(credentials, {
+            audience: this.issuer,
+        });
         if (nonce != null) {
             const unique = await this.replayManager.uniqueAuth(nonce, client.id);
             if (!unique) {
@@ -145,7 +162,7 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
     async pushedAuthorizationRequest(input, dpopJkt) {
         try {
             const client = await this.clientManager.getClient(input.client_id);
-            const clientAuth = await this.authenticateClient(client, 'pushed_authorization_request', input);
+            const clientAuth = await this.authenticateClient(client, input);
             const { payload: parameters } = 'request' in input // Handle JAR
                 ? await this.decodeJAR(client, input)
                 : { payload: input };
@@ -220,8 +237,8 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
                     if (ssoSession.consentRequired) {
                         throw new consent_required_error_js_1.ConsentRequiredError(parameters);
                     }
-                    const redirect = await this.requestManager.setAuthorized(client, uri, deviceId, ssoSession.account, ssoSession.info);
-                    return { issuer, client, parameters, redirect };
+                    const code = await this.requestManager.setAuthorized(client, uri, deviceId, ssoSession.account);
+                    return { issuer, client, parameters, redirect: { code } };
                 }
                 // Automatic SSO when a did was provided
                 if (parameters.prompt == null && parameters.login_hint != null) {
@@ -229,8 +246,8 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
                     if (ssoSessions.length === 1) {
                         const ssoSession = ssoSessions[0];
                         if (!ssoSession.loginRequired && !ssoSession.consentRequired) {
-                            const redirect = await this.requestManager.setAuthorized(client, uri, deviceId, ssoSession.account, ssoSession.info);
-                            return { issuer, client, parameters, redirect };
+                            const code = await this.requestManager.setAuthorized(client, uri, deviceId, ssoSession.account);
+                            return { issuer, client, parameters, redirect: { code } };
                         }
                     }
                 }
@@ -238,7 +255,20 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
                     issuer,
                     client,
                     parameters,
-                    authorize: { uri, sessions },
+                    authorize: {
+                        uri,
+                        sessions,
+                        scopeDetails: parameters.scope
+                            ?.split(/\s+/)
+                            .filter(Boolean)
+                            .sort((a, b) => a.localeCompare(b))
+                            .map((scope) => ({
+                            scope,
+                            // @TODO Allow to customize the scope descriptions (e.g.
+                            // using a hook)
+                            description: undefined,
+                        })),
+                    },
                 };
             }
             catch (err) {
@@ -278,12 +308,28 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
             loginRequired: parameters.prompt === 'login' ||
                 this.loginRequired(client, parameters, info),
             consentRequired: parameters.prompt === 'consent' ||
+                // @TODO the "authorizedClients" should also include the scopes that
+                // were already authorized for the client. Otherwise a client could
+                // use silent authentication to get additional scopes without consent.
                 !info.authorizedClients.includes(client.id),
             matchesHint: hint == null || matchesHint(account),
         }));
     }
-    async signIn(deviceId, credentials) {
-        return this.accountManager.signIn(credentials, deviceId);
+    async signIn(deviceId, uri, clientId, credentials) {
+        const client = await this.clientManager.getClient(clientId);
+        // Ensure the request is still valid (and update the request expiration)
+        // @TODO use the returned scopes to determine if consent is required
+        await this.requestManager.get(uri, clientId, deviceId);
+        const { account, info } = await this.accountManager.signIn(credentials, deviceId);
+        return {
+            account,
+            consentRequired: client.info.isFirstParty
+                ? false
+                : // @TODO: the "authorizedClients" should also include the scopes that
+                    // were already authorized for the client. Otherwise a client could
+                    // use silent authentication to get additional scopes without consent.
+                    !info.authorizedClients.includes(client.id),
+        };
     }
     async acceptRequest(deviceId, uri, clientId, sub) {
         const { issuer } = this;
@@ -296,9 +342,9 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
                 if (this.loginRequired(client, parameters, info)) {
                     throw new login_required_error_js_1.LoginRequiredError(parameters, 'Account authentication required.');
                 }
-                const redirect = await this.requestManager.setAuthorized(client, uri, deviceId, account, info);
+                const code = await this.requestManager.setAuthorized(client, uri, deviceId, account);
                 await this.accountManager.addAuthorizedClient(deviceId, account, client, clientAuth);
-                return { issuer, client, parameters, redirect };
+                return { issuer, client, parameters, redirect: { code } };
             }
             catch (err) {
                 await this.deleteRequest(uri, parameters);
@@ -335,7 +381,7 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
     }
     async token(input, dpopJkt) {
         const client = await this.clientManager.getClient(input.client_id);
-        const clientAuth = await this.authenticateClient(client, 'token', input);
+        const clientAuth = await this.authenticateClient(client, input);
         if (!client.metadata.grant_types.includes(input.grant_type)) {
             throw new invalid_grant_error_js_1.InvalidGrantError(`"${input.grant_type}" grant type is not allowed for this client`);
         }
@@ -352,6 +398,26 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
     async codeGrant(client, clientAuth, input, dpopJkt) {
         try {
             const { sub, deviceId, parameters } = await this.requestManager.findCode(client, clientAuth, input.code);
+            // the following check prevents re-use of PKCE challenges, enforcing the
+            // clients to generate a new challenge for each authorization request. The
+            // replay manager typically prevents replay over a certain time frame,
+            // which might not cover the entire lifetime of the token (depending on
+            // the implementation of the replay store). For this reason, we should
+            // ideally ensure that the code_challenge was not already used by any
+            // existing token or any other pending request.
+            //
+            // The current implementation will cause client devs not issuing a new
+            // code challenge for each authorization request to fail, which should be
+            // a good enough incentive to follow the best practices, until we have a
+            // better implementation.
+            //
+            // @TODO: Use tokenManager to ensure uniqueness of code_challenge
+            if (parameters.code_challenge) {
+                const unique = await this.replayManager.uniqueCodeChallenge(parameters.code_challenge);
+                if (!unique) {
+                    throw new invalid_grant_error_js_1.InvalidGrantError('code_challenge', 'Code challenge already used');
+                }
+            }
             const { account, info } = await this.accountManager.get(deviceId, sub);
             return await this.tokenManager.create(client, clientAuth, account, { id: deviceId, info }, parameters, input, dpopJkt);
         }
@@ -380,7 +446,7 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
      */
     async introspect(input) {
         const client = await this.clientManager.getClient(input.client_id);
-        const clientAuth = await this.authenticateClient(client, 'introspection', input);
+        const clientAuth = await this.authenticateClient(client, input);
         // RFC7662 states the following:
         //
         // > To prevent token scanning attacks, the endpoint MUST also require some
@@ -418,24 +484,6 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
             };
         }
     }
-    /**
-     * @see {@link https://openid.net/specs/openid-connect-core-1_0.html#rfc.section.5.3.2 Successful UserInfo Response}
-     */
-    async userinfo({ data, account }) {
-        return {
-            ...(0, oidc_payload_js_1.oidcPayload)(data.parameters, account),
-            sub: account.sub,
-            client_id: data.clientId,
-            username: account.preferred_username,
-        };
-    }
-    async signUserinfo(userinfo) {
-        const client = await this.clientManager.getClient(userinfo.client_id);
-        return this.signer.sign({
-            alg: client.metadata.userinfo_signed_response_alg,
-            typ: 'JWT',
-        }, userinfo);
-    }
     async authenticateToken(tokenType, token, dpopJkt, verifyOptions) {
         if ((0, token_id_js_1.isTokenId)(token)) {
             this.assertTokenTypeAllowed(tokenType, access_token_type_js_1.AccessTokenType.id);
@@ -469,6 +517,7 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
         const staticJson = (json) => (0, index_js_1.combineMiddlewares)([
             function (req, res, next) {
                 res.setHeader('Access-Control-Allow-Origin', '*');
+                res.setHeader('Access-Control-Allow-Headers', '*');
                 res.setHeader('Cache-Control', 'max-age=300');
                 next();
             },
@@ -480,6 +529,7 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
          */
         const jsonHandler = (buildJson, status) => async function (req, res) {
             res.setHeader('Access-Control-Allow-Origin', '*');
+            res.setHeader('Access-Control-Allow-Headers', '*');
             // https://www.rfc-editor.org/rfc/rfc6749.html#section-5.1
             res.setHeader('Cache-Control', 'no-store');
             res.setHeader('Pragma', 'no-cache');
@@ -517,10 +567,13 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
             }
         };
         const navigationHandler = (handler) => async function (req, res) {
+            res.setHeader('Access-Control-Allow-Origin', '*');
+            res.setHeader('Access-Control-Allow-Headers', '*');
             res.setHeader('Cache-Control', 'no-store');
             res.setHeader('Pragma', 'no-cache');
             try {
                 (0, index_js_1.validateFetchMode)(req, res, ['navigate']);
+                (0, index_js_1.validateFetchDest)(req, res, ['document']);
                 (0, index_js_1.validateSameOrigin)(req, res, issuerOrigin);
                 await handler.call(this, req, res);
                 // Should never happen (fool proofing)
@@ -536,48 +589,56 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
             }
         };
         //- Public OAuth endpoints
-        /*
-         * Although OpenID compatibility is not required to implement the Atproto
-         * OAuth2 specification, we do support OIDC discovery in this
-         * implementation as we believe this may:
-         * 1) Make the implementation of Atproto clients easier (since lots of
-         *    libraries support OIDC discovery)
-         * 2) Allow self hosted PDS' to not implement authentication themselves
-         *    but rely on a trusted Atproto actor to act as their OIDC providers.
-         *    By supporting OIDC in the current implementation, Bluesky's
-         *    Authorization Server server can be used as an OIDC provider for
-         *    these users.
-         */
-        router.get('/.well-known/openid-configuration', staticJson(server.metadata));
         router.get('/.well-known/oauth-authorization-server', staticJson(server.metadata));
         // CORS preflight
-        router.options(/^\/oauth\/(?<endpoint>jwks|par|token|revoke|introspect|userinfo)$/, function (req, res, _next) {
+        const corsPreflight = function (req, res, _next) {
             res
                 .writeHead(204, {
-                'Access-Control-Allow-Origin': req.headers['origin'] || '*',
-                'Access-Control-Allow-Methods': this.params.endpoint === 'jwks' ? 'GET' : 'POST',
+                // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin
+                //
+                // > For requests without credentials, the literal value "*" can be
+                // > specified as a wildcard; the value tells browsers to allow
+                // > requesting code from any origin to access the resource.
+                // > Attempting to use the wildcard with credentials results in an
+                // > error.
+                //
+                // A "*" is safer to use than reflecting the request origin.
+                'Access-Control-Allow-Origin': '*',
+                // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Methods
+                // > The value "*" only counts as a special wildcard value for
+                // > requests without credentials (requests without HTTP cookies or
+                // > HTTP authentication information). In requests with credentials,
+                // > it is treated as the literal method name "*" without special
+                // > semantics.
+                'Access-Control-Allow-Methods': '*',
                 'Access-Control-Allow-Headers': 'Content-Type,Authorization,DPoP',
                 'Access-Control-Max-Age': '86400', // 1 day
             })
                 .end();
-        });
+        };
         router.get('/oauth/jwks', staticJson(server.jwks));
+        router.options('/oauth/par', corsPreflight);
         router.post('/oauth/par', jsonHandler(async function (req, _res) {
-            const input = await (0, index_js_1.validateRequestPayload)(req, types_js_1.pushedAuthorizationRequestSchema);
+            const input = await validateRequest(req, types_js_1.pushedAuthorizationRequestSchema);
             const dpopJkt = await server.checkDpopProof(req.headers['dpop'], req.method, this.url);
             return server.pushedAuthorizationRequest(input, dpopJkt);
         }, 201));
         // https://datatracker.ietf.org/doc/html/rfc9126#section-2.3
-        router.addRoute('*', '/oauth/par', (req, res) => {
+        // > If the request did not use the POST method, the authorization server
+        // > responds with an HTTP 405 (Method Not Allowed) status code.
+        router.options('/oauth/par', corsPreflight);
+        router.all('/oauth/par', (req, res) => {
             res.writeHead(405).end();
         });
+        router.options('/oauth/token', corsPreflight);
         router.post('/oauth/token', jsonHandler(async function (req, _res) {
-            const input = await (0, index_js_1.validateRequestPayload)(req, types_js_2.tokenRequestSchema);
+            const input = await validateRequest(req, types_js_2.tokenRequestSchema);
             const dpopJkt = await server.checkDpopProof(req.headers['dpop'], req.method, this.url);
             return server.token(input, dpopJkt);
         }));
+        router.options('/oauth/revoke', corsPreflight);
         router.post('/oauth/revoke', jsonHandler(async function (req, res) {
-            const input = await (0, index_js_1.validateRequestPayload)(req, types_js_2.revokeSchema);
+            const input = await validateRequest(req, types_js_2.revokeSchema);
             try {
                 await server.revoke(input);
             }
@@ -585,6 +646,7 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
                 onError?.(req, res, err, 'Failed to revoke token');
             }
         }));
+        router.options('/oauth/revoke', corsPreflight);
         router.get('/oauth/revoke', navigationHandler(async function (req, res) {
             const query = Object.fromEntries(this.url.searchParams);
             const input = types_js_2.revokeSchema.parse(query, { path: ['query'] });
@@ -599,45 +661,13 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
             throw new Error('You are successfully logged out. Redirect not implemented');
         }));
         router.post('/oauth/introspect', jsonHandler(async function (req, _res) {
-            const input = await (0, index_js_1.validateRequestPayload)(req, types_js_2.introspectSchema);
+            const input = await validateRequest(req, types_js_2.introspectSchema);
             return server.introspect(input);
         }));
-        const userinfoBodySchema = zod_1.z.object({
-            access_token: jwk_1.signedJwtSchema.optional(),
-        });
-        router.addRoute(['GET', 'POST'], '/oauth/userinfo', (0, index_js_1.acceptMiddleware)(async function (req, _res) {
-            const body = req.method === 'POST'
-                ? await (0, index_js_1.validateRequestPayload)(req, userinfoBodySchema)
-                : null;
-            if (body?.access_token && req.headers['authorization']) {
-                throw new invalid_request_error_js_1.InvalidRequestError('access token must be provided in either the authorization header or the request body');
-            }
-            const auth = await server.authenticateRequest(req.method, this.url, body?.access_token // Allow credentials to be parsed from body.
-                ? {
-                    authorization: `Bearer ${body.access_token}`,
-                    dpop: undefined, // DPoP can only be used with headers
-                }
-                : req.headers, {
-                scope: ['profile'],
-            });
-            const tokenInfo = 'tokenInfo' in auth
-                ? auth.tokenInfo
-                : await server.tokenManager.getTokenInfo(auth.tokenType, auth.tokenId);
-            return server.userinfo(tokenInfo);
-        }, {
-            '': 'application/json',
-            'application/json': jsonHandler(async function (_req, _res) {
-                return this.data;
-            }),
-            'application/jwt': jsonHandler(async function (_req, res) {
-                const jwt = await server.signUserinfo(this.data);
-                res.writeHead(200, { 'Content-Type': 'application/jwt' }).end(jwt);
-                return undefined;
-            }),
-        }));
         //- Private authorization endpoints
         router.use((0, assets_middleware_js_1.authorizeAssetsMiddleware)());
         router.get('/oauth/authorize', navigationHandler(async function (req, res) {
+            (0, index_js_1.validateFetchSite)(req, res, ['cross-site', 'none']);
             const query = Object.fromEntries(this.url.searchParams);
             const input = await types_js_1.authorizationRequestQuerySchema.parseAsync(query, {
                 path: ['query'],
@@ -658,37 +688,43 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
                 }
             }
         }));
-        const signInPayloadSchema = zod_1.z.object({
-            csrf_token: zod_1.z.string(),
+        const signInPayloadSchema = zod_1.default.object({
+            csrf_token: zod_1.default.string(),
             request_uri: request_uri_js_1.requestUriSchema,
             client_id: client_id_js_1.clientIdSchema,
             credentials: account_store_js_1.signInCredentialsSchema,
         });
+        router.options('/oauth/authorize/sign-in', corsPreflight);
         router.post('/oauth/authorize/sign-in', jsonHandler(async function (req, res) {
             (0, index_js_1.validateFetchMode)(req, res, ['same-origin']);
+            (0, index_js_1.validateFetchSite)(req, res, ['same-origin']);
             (0, index_js_1.validateSameOrigin)(req, res, issuerOrigin);
-            const input = await (0, index_js_1.validateRequestPayload)(req, signInPayloadSchema);
+            const input = await validateRequest(req, signInPayloadSchema);
             (0, index_js_1.validateReferer)(req, res, {
                 origin: issuerOrigin,
                 pathname: '/oauth/authorize',
             });
             (0, index_js_1.validateCsrfToken)(req, res, input.csrf_token, csrfCookie(input.request_uri));
-            const { deviceId } = await deviceManager.load(req, res);
-            const { account, info } = await server.signIn(deviceId, input.credentials);
-            // Prevent fixation attacks
-            await deviceManager.rotate(req, res, deviceId);
-            return {
-                account,
-                consentRequired: !info.authorizedClients.includes(input.client_id),
-            };
+            const { deviceId } = await deviceManager.load(req, res, true);
+            return server.signIn(deviceId, input.request_uri, input.client_id, input.credentials);
         }));
-        const acceptQuerySchema = zod_1.z.object({
-            csrf_token: zod_1.z.string(),
+        const acceptQuerySchema = zod_1.default.object({
+            csrf_token: zod_1.default.string(),
             request_uri: request_uri_js_1.requestUriSchema,
             client_id: client_id_js_1.clientIdSchema,
-            account_sub: zod_1.z.string(),
+            account_sub: zod_1.default.string(),
         });
+        // Though this is a "no-cors" request, meaning that the browser will allow
+        // any cross-origin request, with credentials, to be sent, the handler will
+        // 1) validate the request origin,
+        // 2) validate the CSRF token,
+        // 3) validate the referer,
+        // 4) validate the sec-fetch-site header,
+        // 4) validate the sec-fetch-mode header,
+        // 5) validate the sec-fetch-dest header (see navigationHandler).
+        // And will error if any of these checks fail.
         router.get('/oauth/authorize/accept', navigationHandler(async function (req, res) {
+            (0, index_js_1.validateFetchSite)(req, res, ['same-origin']);
             const query = Object.fromEntries(this.url.searchParams);
             const input = await acceptQuerySchema.parseAsync(query, {
                 path: ['query'],
@@ -706,12 +742,22 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
             const data = await server.acceptRequest(deviceId, input.request_uri, input.client_id, input.account_sub);
             return await (0, send_authorize_redirect_js_1.sendAuthorizeRedirect)(res, data);
         }));
-        const rejectQuerySchema = zod_1.z.object({
-            csrf_token: zod_1.z.string(),
+        const rejectQuerySchema = zod_1.default.object({
+            csrf_token: zod_1.default.string(),
             request_uri: request_uri_js_1.requestUriSchema,
             client_id: client_id_js_1.clientIdSchema,
         });
+        // Though this is a "no-cors" request, meaning that the browser will allow
+        // any cross-origin request, with credentials, to be sent, the handler will
+        // 1) validate the request origin,
+        // 2) validate the CSRF token,
+        // 3) validate the referer,
+        // 4) validate the sec-fetch-site header,
+        // 4) validate the sec-fetch-mode header,
+        // 5) validate the sec-fetch-dest header (see navigationHandler).
+        // And will error if any of these checks fail.
         router.get('/oauth/authorize/reject', navigationHandler(async function (req, res) {
+            (0, index_js_1.validateFetchSite)(req, res, ['same-origin']);
             const query = Object.fromEntries(this.url.searchParams);
             const input = await rejectQuerySchema.parseAsync(query, {
                 path: ['query'],
@@ -733,4 +779,20 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
     }
 }
 exports.OAuthProvider = OAuthProvider;
+async function validateRequest(req, schema) {
+    try {
+        return await (0, index_js_1.validateRequestPayload)(req, schema);
+    }
+    catch (err) {
+        if (err instanceof zod_1.ZodError) {
+            const issue = err.issues[0];
+            if (issue?.path.length) {
+                // "part" will typically be
+                const [part, ...path] = issue.path;
+                throw new invalid_request_error_js_1.InvalidRequestError(`Validation of ${part}'s "${path.join('.')}" with error: ${issue.message}`, err);
+            }
+        }
+        throw new invalid_request_error_js_1.InvalidRequestError('Input validation error', err);
+    }
+}
 //# sourceMappingURL=oauth-provider.js.map