@atproto/oauth-provider 0.16.5 → 0.17.0

package/dist/router/create-authorization-page-middleware.js

@@ -1,28 +1,25 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createAuthorizationPageMiddleware = createAuthorizationPageMiddleware;
-const oauth_types_1 = require("@atproto/oauth-types");
-const authorization_error_js_1 = require("../errors/authorization-error.js");
-const invalid_request_error_js_1 = require("../errors/invalid-request-error.js");
-const index_js_1 = require("../lib/http/index.js");
-const error_js_1 = require("../lib/util/error.js");
-const write_form_redirect_js_1 = require("../lib/write-form-redirect.js");
-const request_uri_js_1 = require("../request/request-uri.js");
-const send_authorization_page_js_1 = require("./assets/send-authorization-page.js");
-const send_cookie_error_page_js_1 = require("./assets/send-cookie-error-page.js");
-const send_error_page_js_1 = require("./assets/send-error-page.js");
-const send_redirect_js_1 = require("./assets/send-redirect.js");
-const create_api_middleware_js_1 = require("./create-api-middleware.js");
-function createAuthorizationPageMiddleware(server, { onError }) {
+import { oauthAuthorizationRequestQuerySchema, } from '@atproto/oauth-types';
+import { AuthorizationError } from '../errors/authorization-error.js';
+import { InvalidRequestError } from '../errors/invalid-request-error.js';
+import { Router, getCookie, setCookie, validateFetchDest, validateFetchMode, validateFetchSite, validateOrigin, validateReferrer, } from '../lib/http/index.js';
+import { formatError } from '../lib/util/error.js';
+import { writeFormRedirect } from '../lib/write-form-redirect.js';
+import { parseRequestUri, requestUriSchema } from '../request/request-uri.js';
+import { sendAuthorizePageFactory } from './assets/send-authorization-page.js';
+import { sendCookieErrorPageFactory } from './assets/send-cookie-error-page.js';
+import { sendErrorPageFactory } from './assets/send-error-page.js';
+import { sendAuthorizationResultRedirect, sendRedirect, } from './assets/send-redirect.js';
+import { parseRedirectUrl } from './create-api-middleware.js';
+export function createAuthorizationPageMiddleware(server, { onError }) {
     const issuerUrl = new URL(server.issuer);
     const issuerOrigin = issuerUrl.origin;
     const securityOptions = {
         hsts: issuerUrl.protocol === 'http:' ? false : undefined,
     };
-    const sendAuthorizePage = (0, send_authorization_page_js_1.sendAuthorizePageFactory)(server.customization, securityOptions);
-    const sendErrorPage = (0, send_error_page_js_1.sendErrorPageFactory)(server.customization, securityOptions);
-    const sendCookieErrorPage = (0, send_cookie_error_page_js_1.sendCookieErrorPageFactory)(server.customization, securityOptions);
-    const router = new index_js_1.Router(issuerUrl);
+    const sendAuthorizePage = sendAuthorizePageFactory(server.customization, securityOptions);
+    const sendErrorPage = sendErrorPageFactory(server.customization, securityOptions);
+    const sendCookieErrorPage = sendCookieErrorPageFactory(server.customization, securityOptions);
+    const router = new Router(issuerUrl);
     router.get('/oauth/authorize', withErrorHandler(async function (req, res) {
         res.setHeader('Cache-Control', 'no-store');
         res.setHeader('Pragma', 'no-cache');
@@ -30,10 +27,10 @@ function createAuthorizationPageMiddleware(server, { onError }) {
         // well as refreshing the authorization page).
         // @TODO Consider removing this altogether to allow hosting PDS and app on
         // the same site but different origins (different subdomains).
-        (0, index_js_1.validateFetchSite)(req, ['same-origin', 'cross-site', 'none']);
-        (0, index_js_1.validateFetchMode)(req, ['navigate']);
-        (0, index_js_1.validateFetchDest)(req, ['document']);
-        (0, index_js_1.validateOrigin)(req, issuerOrigin);
+        validateFetchSite(req, ['same-origin', 'cross-site', 'none']);
+        validateFetchMode(req, ['navigate']);
+        validateFetchDest(req, ['document']);
+        validateOrigin(req, issuerOrigin);
         // Do not perform any of the following logic if the request is invalid
         const query = parseOAuthAuthorizationRequestQuery(this.url);
         // @NOTE For some reason, even when loaded through a
@@ -48,7 +45,7 @@ function createAuthorizationPageMiddleware(server, { onError }) {
         // Only for iOS users
         req.headers['user-agent']?.includes('iPhone OS') &&
             // Disabled if the user already passed the test, which means their browser preserves cookies on redirect
-            !((0, index_js_1.getCookie)(req, 'cookie-test') === 'succeeded') &&
+            !(getCookie(req, 'cookie-test') === 'succeeded') &&
             // Disabled if the user already has a session
             !(await server.deviceManager.hasSession(req))) {
             // @TODO Another possible solution would be to avoid relying on cookies if we
@@ -61,12 +58,12 @@ function createAuthorizationPageMiddleware(server, { onError }) {
             // preserves cookies by redirecting back to ourselves
             if (!this.url.searchParams.has('redirect-test')) {
                 // 2) Set a testing cookie
-                (0, index_js_1.setCookie)(res, 'cookie-test', 'testing', {
+                setCookie(res, 'cookie-test', 'testing', {
                     sameSite: 'lax',
                     httpOnly: true,
                 });
                 // 3) And send an auto-submit form redirecting back to ourselves
-                return (0, write_form_redirect_js_1.writeFormRedirect)(res, 'get', this.url.href, 
+                return writeFormRedirect(res, 'get', this.url.href, 
                 // 4) We add an extra query parameter to trigger the test logic after
                 // the redirect occurred.
                 [...this.url.searchParams, ['redirect-test', '1']], securityOptions);
@@ -74,11 +71,11 @@ function createAuthorizationPageMiddleware(server, { onError }) {
             else {
                 // 5) We just got redirected back to ourselves. Verify that the
                 // browser preserved cookies during the redirect
-                if ((0, index_js_1.getCookie)(req, 'cookie-test')) {
+                if (getCookie(req, 'cookie-test')) {
                     // 6) Success! The browser preserved cookies. Proceed with the
                     // normal authorization flow.
                     // 7) Set a long lasting cookie to skip the test next time
-                    (0, index_js_1.setCookie)(res, 'cookie-test', 'succeeded', {
+                    setCookie(res, 'cookie-test', 'succeeded', {
                         sameSite: 'lax',
                         maxAge: 31 * 24 * 60 * 60,
                         httpOnly: true,
@@ -91,7 +88,7 @@ function createAuthorizationPageMiddleware(server, { onError }) {
                         // 8) Show an error page to the user explaining the situation
                         // Give the browser another chance to save cookies after the use
                         // pressed "Continue"
-                        (0, index_js_1.setCookie)(res, 'cookie-test', 'testing', {
+                        setCookie(res, 'cookie-test', 'testing', {
                             sameSite: 'lax',
                             httpOnly: true,
                         });
@@ -112,20 +109,20 @@ function createAuthorizationPageMiddleware(server, { onError }) {
                         // back to the client with the error parameters.
                         if ('request_uri' in query) {
                             // Load and delete the authorization request
-                            const requestUri = (0, request_uri_js_1.parseRequestUri)(query.request_uri, {
+                            const requestUri = parseRequestUri(query.request_uri, {
                                 path: ['query', 'request_uri'],
                             });
                             const data = await server.requestManager.get(requestUri, undefined, query.client_id);
                             await server.requestManager.delete(requestUri);
-                            throw new authorization_error_js_1.AuthorizationError(data.parameters, message);
+                            throw new AuthorizationError(data.parameters, message);
                         }
                         else if ('request' in query) {
                             const client = await server.clientManager.getClient(query.client_id);
                             const parameters = await server.decodeJAR(client, query);
-                            throw new authorization_error_js_1.AuthorizationError(parameters, message);
+                            throw new AuthorizationError(parameters, message);
                         }
                         else {
-                            throw new authorization_error_js_1.AuthorizationError(query, message);
+                            throw new AuthorizationError(query, message);
                         }
                     }
                 }
@@ -135,7 +132,7 @@ function createAuthorizationPageMiddleware(server, { onError }) {
         const device = await server.deviceManager.load(req, res);
         const result = await server.authorize(query, device);
         if ('redirect' in result) {
-            return (0, send_redirect_js_1.sendAuthorizationResultRedirect)(res, result, securityOptions);
+            return sendAuthorizationResultRedirect(res, result, securityOptions);
         }
         else {
             return sendAuthorizePage(req, res, result);
@@ -147,17 +144,17 @@ function createAuthorizationPageMiddleware(server, { onError }) {
     // implement it here to avoid duplicating the logic.
     router.get('/oauth/authorize/redirect', withErrorHandler(async function (req, res) {
         // Ensure we come from the authorization page
-        (0, index_js_1.validateFetchSite)(req, ['same-origin']);
-        (0, index_js_1.validateFetchMode)(req, ['navigate']);
-        (0, index_js_1.validateFetchDest)(req, ['document']);
-        (0, index_js_1.validateOrigin)(req, issuerOrigin);
-        const referrer = (0, index_js_1.validateReferrer)(req, {
+        validateFetchSite(req, ['same-origin']);
+        validateFetchMode(req, ['navigate']);
+        validateFetchDest(req, ['document']);
+        validateOrigin(req, issuerOrigin);
+        const referrer = validateReferrer(req, {
             origin: issuerOrigin,
             pathname: '/oauth/authorize',
         });
         // Ensure we are coming from the authorization page
-        request_uri_js_1.requestUriSchema.parse(referrer.searchParams.get('request_uri'));
-        return (0, send_redirect_js_1.sendRedirect)(res, (0, create_api_middleware_js_1.parseRedirectUrl)(this.url), securityOptions);
+        requestUriSchema.parse(referrer.searchParams.get('request_uri'));
+        return sendRedirect(res, parseRedirectUrl(this.url), securityOptions);
     }));
     return router.buildMiddleware();
     function withErrorHandler(handler) {
@@ -168,8 +165,8 @@ function createAuthorizationPageMiddleware(server, { onError }) {
             catch (err) {
                 onError?.(req, res, err, `Authorization Request Error`);
                 if (!res.headersSent) {
-                    if (err instanceof authorization_error_js_1.AuthorizationError) {
-                        return (0, send_redirect_js_1.sendAuthorizationResultRedirect)(res, {
+                    if (err instanceof AuthorizationError) {
+                        return sendAuthorizationResultRedirect(res, {
                             issuer: server.issuer,
                             parameters: err.parameters,
                             redirect: err.toJSON(),
@@ -188,13 +185,13 @@ function createAuthorizationPageMiddleware(server, { onError }) {
 }
 function parseOAuthAuthorizationRequestQuery(url) {
     const query = Object.fromEntries(url.searchParams);
-    const result = oauth_types_1.oauthAuthorizationRequestQuerySchema.safeParse(query, {
+    const result = oauthAuthorizationRequestQuerySchema.safeParse(query, {
         path: ['query'],
     });
     if (!result.success) {
         const message = 'Invalid request parameters';
         const err = result.error;
-        throw new invalid_request_error_js_1.InvalidRequestError((0, error_js_1.formatError)(err, message), err);
+        throw new InvalidRequestError(formatError(err, message), err);
     }
     return result.data;
 }

package/dist/router/create-authorization-page-middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"create-authorization-page-middleware.js","sourceRoot":"","sources":["../../src/router/create-authorization-page-middleware.ts"],"names":[],"mappings":";;AAmCA,8EAqOC;AAvQD,sDAG6B;AAC7B,6EAAqE;AACrE,iFAAwE;AACxE,mDAW6B;AAE7B,mDAAkD;AAElD,0EAAiE;AAEjE,8DAA6E;AAC7E,oFAA8E;AAC9E,kFAA+E;AAC/E,oEAAkE;AAClE,gEAGkC;AAClC,yEAA6D;AAG7D,SAAgB,iCAAiC,CAK/C,MAAqB,EACrB,EAAE,OAAO,EAA+B;IAExC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACxC,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,CAAA;IAErC,MAAM,eAAe,GAA2B;QAC9C,IAAI,EAAE,SAAS,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;KACzD,CAAA;IAED,MAAM,iBAAiB,GAAG,IAAA,qDAAwB,EAChD,MAAM,CAAC,aAAa,EACpB,eAAe,CAChB,CAAA;IACD,MAAM,aAAa,GAAG,IAAA,yCAAoB,EACxC,MAAM,CAAC,aAAa,EACpB,eAAe,CAChB,CAAA;IACD,MAAM,mBAAmB,GAAG,IAAA,sDAA0B,EACpD,MAAM,CAAC,aAAa,EACpB,eAAe,CAChB,CAAA;IAED,MAAM,MAAM,GAAG,IAAI,iBAAM,CAAgB,SAAS,CAAC,CAAA;IAEnD,MAAM,CAAC,GAAG,CACR,kBAAkB,EAClB,gBAAgB,CAAC,KAAK,WAAW,GAAG,EAAE,GAAG;QACvC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAA;QAC1C,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;QAEnC,yEAAyE;QACzE,8CAA8C;QAE9C,0EAA0E;QAC1E,8DAA8D;QAC9D,IAAA,4BAAiB,EAAC,GAAG,EAAE,CAAC,aAAa,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAA;QAC7D,IAAA,4BAAiB,EAAC,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;QACpC,IAAA,4BAAiB,EAAC,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;QACpC,IAAA,yBAAc,EAAC,GAAG,EAAE,YAAY,CAAC,CAAA;QAEjC,sEAAsE;QACtE,MAAM,KAAK,GAAG,mCAAmC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAE3D,oDAAoD;QACpD,uEAAuE;QACvE,uEAAuE;QACvE,6EAA6E;QAC7E,8EAA8E;QAC9E,wEAAwE;QACxE,sEAAsE;QACtE,0EAA0E;QAC1E;QACE,qBAAqB;QACrB,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,WAAW,CAAC;YAChD,wGAAwG;YACxG,CAAC,CAAC,IAAA,oBAAS,EAAC,GAAG,EAAE,aAAa,CAAC,KAAK,WAAW,CAAC;YAChD,6CAA6C;YAC7C,CAAC,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAC7C,CAAC;YACD,6EAA6E;YAC7E,4EAA4E;YAC5E,wEAAwE;YACxE,6EAA6E;YAC7E,sEAAsE;YACtE,+BAA+B;YAE/B,mEAAmE;YACnE,qDAAqD;YACrD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;gBAChD,0BAA0B;gBAC1B,IAAA,oBAAS,EAAC,GAAG,EAAE,aAAa,EAAE,SAAS,EAAE;oBACvC,QAAQ,EAAE,KAAK;oBACf,QAAQ,EAAE,IAAI;iBACf,CAAC,CAAA;gBAEF,gEAAgE;gBAChE,OAAO,IAAA,0CAAiB,EACtB,GAAG,EACH,KAAK,EACL,IAAI,CAAC,GAAG,CAAC,IAAI;gBACb,qEAAqE;gBACrE,yBAAyB;gBACzB,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,EAClD,eAAe,CAChB,CAAA;YACH,CAAC;iBAAM,CAAC;gBACN,+DAA+D;gBAC/D,gDAAgD;gBAChD,IAAI,IAAA,oBAAS,EAAC,GAAG,EAAE,aAAa,CAAC,EAAE,CAAC;oBAClC,8DAA8D;oBAC9D,6BAA6B;oBAE7B,0DAA0D;oBAC1D,IAAA,oBAAS,EAAC,GAAG,EAAE,aAAa,EAAE,WAAW,EAAE;wBACzC,QAAQ,EAAE,KAAK;wBACf,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;wBACzB,QAAQ,EAAE,IAAI;qBACf,CAAC,CAAA;gBACJ,CAAC;qBAAM,CAAC;oBACN,6DAA6D;oBAC7D,yBAAyB;oBAEzB,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,GAAG,EAAE,CAAC;wBACvD,6DAA6D;wBAE7D,gEAAgE;wBAChE,qBAAqB;wBACrB,IAAA,oBAAS,EAAC,GAAG,EAAE,aAAa,EAAE,SAAS,EAAE;4BACvC,QAAQ,EAAE,KAAK;4BACf,QAAQ,EAAE,IAAI;yBACf,CAAC,CAAA;wBAEF,kEAAkE;wBAClE,gBAAgB;wBAChB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;wBAC1C,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,CAAA;wBAClD,OAAO,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,CAAC,CAAA;oBACvD,CAAC;yBAAM,CAAC;wBACN,gEAAgE;wBAChE,oCAAoC;wBAEpC,4DAA4D;wBAC5D,8DAA8D;wBAC9D,MAAM,OAAO,GAAG,yBAAyB,CAAA;wBAEzC,6DAA6D;wBAC7D,+DAA+D;wBAC/D,gDAAgD;wBAChD,IAAI,aAAa,IAAI,KAAK,EAAE,CAAC;4BAC3B,4CAA4C;4BAC5C,MAAM,UAAU,GAAG,IAAA,gCAAe,EAAC,KAAK,CAAC,WAAW,EAAE;gCACpD,IAAI,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC;6BAC/B,CAAC,CAAA;4BACF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,GAAG,CAC1C,UAAU,EACV,SAAS,EACT,KAAK,CAAC,SAAS,CAChB,CAAA;4BACD,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;4BAC9C,MAAM,IAAI,2CAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;wBACxD,CAAC;6BAAM,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;4BAC9B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,SAAS,CACjD,KAAK,CAAC,SAAS,CAChB,CAAA;4BACD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;4BACxD,MAAM,IAAI,2CAAkB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;wBACnD,CAAC;6BAAM,CAAC;4BACN,MAAM,IAAI,2CAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;wBAC9C,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QAExD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QAEpD,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;YACzB,OAAO,IAAA,kDAA+B,EAAC,GAAG,EAAE,MAAM,EAAE,eAAe,CAAC,CAAA;QACtE,CAAC;aAAM,CAAC;YACN,OAAO,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;QAC5C,CAAC;IACH,CAAC,CAAC,CACH,CAAA;IAED,uEAAuE;IACvE,2EAA2E;IAC3E,sEAAsE;IACtE,oDAAoD;IACpD,MAAM,CAAC,GAAG,CACR,2BAA2B,EAC3B,gBAAgB,CAAC,KAAK,WAAW,GAAG,EAAE,GAAG;QACvC,6CAA6C;QAC7C,IAAA,4BAAiB,EAAC,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC,CAAA;QACvC,IAAA,4BAAiB,EAAC,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;QACpC,IAAA,4BAAiB,EAAC,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;QACpC,IAAA,yBAAc,EAAC,GAAG,EAAE,YAAY,CAAC,CAAA;QAEjC,MAAM,QAAQ,GAAG,IAAA,2BAAgB,EAAC,GAAG,EAAE;YACrC,MAAM,EAAE,YAAY;YACpB,QAAQ,EAAE,kBAAkB;SAC7B,CAAC,CAAA;QAEF,mDAAmD;QACnD,iCAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAA;QAEhE,OAAO,IAAA,+BAAY,EAAC,GAAG,EAAE,IAAA,2CAAgB,EAAC,IAAI,CAAC,GAAG,CAAC,EAAE,eAAe,CAAC,CAAA;IACvE,CAAC,CAAC,CACH,CAAA;IAED,OAAO,MAAM,CAAC,eAAe,EAAE,CAAA;IAE/B,SAAS,gBAAgB,CACvB,OAAyD;QAEzD,OAAO,KAAK,WAAW,GAAG,EAAE,GAAG;YAC7B,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YACpC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,6BAA6B,CAAC,CAAA;gBAEvD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBACrB,IAAI,GAAG,YAAY,2CAAkB,EAAE,CAAC;wBACtC,OAAO,IAAA,kDAA+B,EACpC,GAAG,EACH;4BACE,MAAM,EAAE,MAAM,CAAC,MAAM;4BACrB,UAAU,EAAE,GAAG,CAAC,UAAU;4BAC1B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;yBACvB,EACD,eAAe,CAChB,CAAA;oBACH,CAAC;yBAAM,CAAC;wBACN,OAAO,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;oBACrC,CAAC;gBACH,CAAC;qBAAM,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;oBAC1B,GAAG,CAAC,GAAG,EAAE,CAAA;gBACX,CAAC;YACH,CAAC;QACH,CAAC,CAAA;IACH,CAAC;AACH,CAAC;AAED,SAAS,mCAAmC,CAC1C,GAAQ;IAER,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IAClD,MAAM,MAAM,GAAG,kDAAoC,CAAC,SAAS,CAAC,KAAK,EAAE;QACnE,IAAI,EAAE,CAAC,OAAO,CAAC;KAChB,CAAC,CAAA;IAEF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,4BAA4B,CAAA;QAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAA;QACxB,MAAM,IAAI,8CAAmB,CAAC,IAAA,sBAAW,EAAC,GAAG,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,CAAA;IAC/D,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAA;AACpB,CAAC","sourcesContent":["import type { IncomingMessage, ServerResponse } from 'node:http'\nimport {\n  OAuthAuthorizationRequestQuery,\n  oauthAuthorizationRequestQuerySchema,\n} from '@atproto/oauth-types'\nimport { AuthorizationError } from '../errors/authorization-error.js'\nimport { InvalidRequestError } from '../errors/invalid-request-error.js'\nimport {\n  Middleware,\n  Router,\n  RouterCtx,\n  getCookie,\n  setCookie,\n  validateFetchDest,\n  validateFetchMode,\n  validateFetchSite,\n  validateOrigin,\n  validateReferrer,\n} from '../lib/http/index.js'\nimport { SecurityHeadersOptions } from '../lib/http/security-headers.js'\nimport { formatError } from '../lib/util/error.js'\nimport type { Awaitable } from '../lib/util/type.js'\nimport { writeFormRedirect } from '../lib/write-form-redirect.js'\nimport type { OAuthProvider } from '../oauth-provider.js'\nimport { parseRequestUri, requestUriSchema } from '../request/request-uri.js'\nimport { sendAuthorizePageFactory } from './assets/send-authorization-page.js'\nimport { sendCookieErrorPageFactory } from './assets/send-cookie-error-page.js'\nimport { sendErrorPageFactory } from './assets/send-error-page.js'\nimport {\n  sendAuthorizationResultRedirect,\n  sendRedirect,\n} from './assets/send-redirect.js'\nimport { parseRedirectUrl } from './create-api-middleware.js'\nimport type { MiddlewareOptions } from './middleware-options.js'\n\nexport function createAuthorizationPageMiddleware<\n  Ctx extends object | void = void,\n  Req extends IncomingMessage = IncomingMessage,\n  Res extends ServerResponse = ServerResponse,\n>(\n  server: OAuthProvider,\n  { onError }: MiddlewareOptions<Req, Res>,\n): Middleware<Ctx, Req, Res> {\n  const issuerUrl = new URL(server.issuer)\n  const issuerOrigin = issuerUrl.origin\n\n  const securityOptions: SecurityHeadersOptions = {\n    hsts: issuerUrl.protocol === 'http:' ? false : undefined,\n  }\n\n  const sendAuthorizePage = sendAuthorizePageFactory(\n    server.customization,\n    securityOptions,\n  )\n  const sendErrorPage = sendErrorPageFactory(\n    server.customization,\n    securityOptions,\n  )\n  const sendCookieErrorPage = sendCookieErrorPageFactory(\n    server.customization,\n    securityOptions,\n  )\n\n  const router = new Router<Ctx, Req, Res>(issuerUrl)\n\n  router.get(\n    '/oauth/authorize',\n    withErrorHandler(async function (req, res) {\n      res.setHeader('Cache-Control', 'no-store')\n      res.setHeader('Pragma', 'no-cache')\n\n      // \"same-origin\" is required to support the redirect test logic below (as\n      // well as refreshing the authorization page).\n\n      // @TODO Consider removing this altogether to allow hosting PDS and app on\n      // the same site but different origins (different subdomains).\n      validateFetchSite(req, ['same-origin', 'cross-site', 'none'])\n      validateFetchMode(req, ['navigate'])\n      validateFetchDest(req, ['document'])\n      validateOrigin(req, issuerOrigin)\n\n      // Do not perform any of the following logic if the request is invalid\n      const query = parseOAuthAuthorizationRequestQuery(this.url)\n\n      // @NOTE For some reason, even when loaded through a\n      // ASWebAuthenticationSession, iOS will sometimes fail to properly save\n      // cookies set during the rendering of the page. When this happens, the\n      // authorization page logic, which relies on cookies to maintain the session,\n      // will fail. To work around this, we perform an initial redirect to ourselves\n      // using a form GET submit, in an attempt to verify if the browser saves\n      // cookies on redirect or not. If it does, we proceed as normal. If it\n      // doesn't, we redirect the user back to the client with an error message.\n      if (\n        // Only for iOS users\n        req.headers['user-agent']?.includes('iPhone OS') &&\n        // Disabled if the user already passed the test, which means their browser preserves cookies on redirect\n        !(getCookie(req, 'cookie-test') === 'succeeded') &&\n        // Disabled if the user already has a session\n        !(await server.deviceManager.hasSession(req))\n      ) {\n        // @TODO Another possible solution would be to avoid relying on cookies if we\n        // detect that they are not being preserved. This would mean that preserving\n        // sessions (SSO) would not be possible for browsers that don't preserve\n        // cookies on redirect, but at least the authorization request could still be\n        // completed. This was not implemented yet due to the extra complexity\n        // involved in supporting this.\n\n        // 1) When the user first comes here, we will test if their browser\n        // preserves cookies by redirecting back to ourselves\n        if (!this.url.searchParams.has('redirect-test')) {\n          // 2) Set a testing cookie\n          setCookie(res, 'cookie-test', 'testing', {\n            sameSite: 'lax',\n            httpOnly: true,\n          })\n\n          // 3) And send an auto-submit form redirecting back to ourselves\n          return writeFormRedirect(\n            res,\n            'get',\n            this.url.href,\n            // 4) We add an extra query parameter to trigger the test logic after\n            // the redirect occurred.\n            [...this.url.searchParams, ['redirect-test', '1']],\n            securityOptions,\n          )\n        } else {\n          // 5) We just got redirected back to ourselves. Verify that the\n          // browser preserved cookies during the redirect\n          if (getCookie(req, 'cookie-test')) {\n            // 6) Success! The browser preserved cookies. Proceed with the\n            // normal authorization flow.\n\n            // 7) Set a long lasting cookie to skip the test next time\n            setCookie(res, 'cookie-test', 'succeeded', {\n              sameSite: 'lax',\n              maxAge: 31 * 24 * 60 * 60,\n              httpOnly: true,\n            })\n          } else {\n            // The browser did NOT preserve cookies. We have to abort the\n            // authorization request.\n\n            if (this.url.searchParams.get('redirect-test') === '1') {\n              // 8) Show an error page to the user explaining the situation\n\n              // Give the browser another chance to save cookies after the use\n              // pressed \"Continue\"\n              setCookie(res, 'cookie-test', 'testing', {\n                sameSite: 'lax',\n                httpOnly: true,\n              })\n\n              // Make sure next time we reach the other branch and redirect back\n              // to the client\n              const continueUrl = new URL(this.url.href)\n              continueUrl.searchParams.set('redirect-test', '2')\n              return sendCookieErrorPage(req, res, { continueUrl })\n            } else {\n              // 9) Once the use acknowledges the error, redirect them back to\n              // the client with an error message.\n\n              // Allow the client to understand what happened (the `error`\n              // response parameter value is constrained by the OAuth2 spec)\n              const message = 'ERR_COOKIES_UNSUPPORTED'\n\n              // @NOTE AuthorizationError thrown here will be caught by the\n              // error handler middleware defined below, and cause a redirect\n              // back to the client with the error parameters.\n              if ('request_uri' in query) {\n                // Load and delete the authorization request\n                const requestUri = parseRequestUri(query.request_uri, {\n                  path: ['query', 'request_uri'],\n                })\n                const data = await server.requestManager.get(\n                  requestUri,\n                  undefined,\n                  query.client_id,\n                )\n                await server.requestManager.delete(requestUri)\n                throw new AuthorizationError(data.parameters, message)\n              } else if ('request' in query) {\n                const client = await server.clientManager.getClient(\n                  query.client_id,\n                )\n                const parameters = await server.decodeJAR(client, query)\n                throw new AuthorizationError(parameters, message)\n              } else {\n                throw new AuthorizationError(query, message)\n              }\n            }\n          }\n        }\n      }\n\n      // Normal authorization flow\n      const device = await server.deviceManager.load(req, res)\n\n      const result = await server.authorize(query, device)\n\n      if ('redirect' in result) {\n        return sendAuthorizationResultRedirect(res, result, securityOptions)\n      } else {\n        return sendAuthorizePage(req, res, result)\n      }\n    }),\n  )\n\n  // This is a private endpoint that will be called by the user after the\n  // authorization request was either approved or denied. The logic performed\n  // here **could** be performed directly in the frontend. We decided to\n  // implement it here to avoid duplicating the logic.\n  router.get(\n    '/oauth/authorize/redirect',\n    withErrorHandler(async function (req, res) {\n      // Ensure we come from the authorization page\n      validateFetchSite(req, ['same-origin'])\n      validateFetchMode(req, ['navigate'])\n      validateFetchDest(req, ['document'])\n      validateOrigin(req, issuerOrigin)\n\n      const referrer = validateReferrer(req, {\n        origin: issuerOrigin,\n        pathname: '/oauth/authorize',\n      })\n\n      // Ensure we are coming from the authorization page\n      requestUriSchema.parse(referrer.searchParams.get('request_uri'))\n\n      return sendRedirect(res, parseRedirectUrl(this.url), securityOptions)\n    }),\n  )\n\n  return router.buildMiddleware()\n\n  function withErrorHandler<T extends RouterCtx>(\n    handler: (this: T, req: Req, res: Res) => Awaitable<void>,\n  ): Middleware<T, Req, Res> {\n    return async function (req, res) {\n      try {\n        await handler.call(this, req, res)\n      } catch (err) {\n        onError?.(req, res, err, `Authorization Request Error`)\n\n        if (!res.headersSent) {\n          if (err instanceof AuthorizationError) {\n            return sendAuthorizationResultRedirect(\n              res,\n              {\n                issuer: server.issuer,\n                parameters: err.parameters,\n                redirect: err.toJSON(),\n              },\n              securityOptions,\n            )\n          } else {\n            return sendErrorPage(req, res, err)\n          }\n        } else if (!res.destroyed) {\n          res.end()\n        }\n      }\n    }\n  }\n}\n\nfunction parseOAuthAuthorizationRequestQuery(\n  url: URL,\n): OAuthAuthorizationRequestQuery {\n  const query = Object.fromEntries(url.searchParams)\n  const result = oauthAuthorizationRequestQuerySchema.safeParse(query, {\n    path: ['query'],\n  })\n\n  if (!result.success) {\n    const message = 'Invalid request parameters'\n    const err = result.error\n    throw new InvalidRequestError(formatError(err, message), err)\n  }\n\n  return result.data\n}\n"]}
+{"version":3,"file":"create-authorization-page-middleware.js","sourceRoot":"","sources":["../../src/router/create-authorization-page-middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,oCAAoC,GACrC,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AACxE,OAAO,EAEL,MAAM,EAEN,SAAS,EACT,SAAS,EACT,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,GACjB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAElD,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AAEjE,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAC7E,OAAO,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAA;AAC9E,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAClE,OAAO,EACL,+BAA+B,EAC/B,YAAY,GACb,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAG7D,MAAM,UAAU,iCAAiC,CAK/C,MAAqB,EACrB,EAAE,OAAO,EAA+B;IAExC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACxC,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,CAAA;IAErC,MAAM,eAAe,GAA2B;QAC9C,IAAI,EAAE,SAAS,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;KACzD,CAAA;IAED,MAAM,iBAAiB,GAAG,wBAAwB,CAChD,MAAM,CAAC,aAAa,EACpB,eAAe,CAChB,CAAA;IACD,MAAM,aAAa,GAAG,oBAAoB,CACxC,MAAM,CAAC,aAAa,EACpB,eAAe,CAChB,CAAA;IACD,MAAM,mBAAmB,GAAG,0BAA0B,CACpD,MAAM,CAAC,aAAa,EACpB,eAAe,CAChB,CAAA;IAED,MAAM,MAAM,GAAG,IAAI,MAAM,CAAgB,SAAS,CAAC,CAAA;IAEnD,MAAM,CAAC,GAAG,CACR,kBAAkB,EAClB,gBAAgB,CAAC,KAAK,WAAW,GAAG,EAAE,GAAG;QACvC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAA;QAC1C,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;QAEnC,yEAAyE;QACzE,8CAA8C;QAE9C,0EAA0E;QAC1E,8DAA8D;QAC9D,iBAAiB,CAAC,GAAG,EAAE,CAAC,aAAa,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAA;QAC7D,iBAAiB,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;QACpC,iBAAiB,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;QACpC,cAAc,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;QAEjC,sEAAsE;QACtE,MAAM,KAAK,GAAG,mCAAmC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAE3D,oDAAoD;QACpD,uEAAuE;QACvE,uEAAuE;QACvE,6EAA6E;QAC7E,8EAA8E;QAC9E,wEAAwE;QACxE,sEAAsE;QACtE,0EAA0E;QAC1E;QACE,qBAAqB;QACrB,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,WAAW,CAAC;YAChD,wGAAwG;YACxG,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,aAAa,CAAC,KAAK,WAAW,CAAC;YAChD,6CAA6C;YAC7C,CAAC,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAC7C,CAAC;YACD,6EAA6E;YAC7E,4EAA4E;YAC5E,wEAAwE;YACxE,6EAA6E;YAC7E,sEAAsE;YACtE,+BAA+B;YAE/B,mEAAmE;YACnE,qDAAqD;YACrD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;gBAChD,0BAA0B;gBAC1B,SAAS,CAAC,GAAG,EAAE,aAAa,EAAE,SAAS,EAAE;oBACvC,QAAQ,EAAE,KAAK;oBACf,QAAQ,EAAE,IAAI;iBACf,CAAC,CAAA;gBAEF,gEAAgE;gBAChE,OAAO,iBAAiB,CACtB,GAAG,EACH,KAAK,EACL,IAAI,CAAC,GAAG,CAAC,IAAI;gBACb,qEAAqE;gBACrE,yBAAyB;gBACzB,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,EAClD,eAAe,CAChB,CAAA;YACH,CAAC;iBAAM,CAAC;gBACN,+DAA+D;gBAC/D,gDAAgD;gBAChD,IAAI,SAAS,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,CAAC;oBAClC,8DAA8D;oBAC9D,6BAA6B;oBAE7B,0DAA0D;oBAC1D,SAAS,CAAC,GAAG,EAAE,aAAa,EAAE,WAAW,EAAE;wBACzC,QAAQ,EAAE,KAAK;wBACf,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;wBACzB,QAAQ,EAAE,IAAI;qBACf,CAAC,CAAA;gBACJ,CAAC;qBAAM,CAAC;oBACN,6DAA6D;oBAC7D,yBAAyB;oBAEzB,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,GAAG,EAAE,CAAC;wBACvD,6DAA6D;wBAE7D,gEAAgE;wBAChE,qBAAqB;wBACrB,SAAS,CAAC,GAAG,EAAE,aAAa,EAAE,SAAS,EAAE;4BACvC,QAAQ,EAAE,KAAK;4BACf,QAAQ,EAAE,IAAI;yBACf,CAAC,CAAA;wBAEF,kEAAkE;wBAClE,gBAAgB;wBAChB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;wBAC1C,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,CAAA;wBAClD,OAAO,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,CAAC,CAAA;oBACvD,CAAC;yBAAM,CAAC;wBACN,gEAAgE;wBAChE,oCAAoC;wBAEpC,4DAA4D;wBAC5D,8DAA8D;wBAC9D,MAAM,OAAO,GAAG,yBAAyB,CAAA;wBAEzC,6DAA6D;wBAC7D,+DAA+D;wBAC/D,gDAAgD;wBAChD,IAAI,aAAa,IAAI,KAAK,EAAE,CAAC;4BAC3B,4CAA4C;4BAC5C,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,WAAW,EAAE;gCACpD,IAAI,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC;6BAC/B,CAAC,CAAA;4BACF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,GAAG,CAC1C,UAAU,EACV,SAAS,EACT,KAAK,CAAC,SAAS,CAChB,CAAA;4BACD,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;4BAC9C,MAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;wBACxD,CAAC;6BAAM,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;4BAC9B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,SAAS,CACjD,KAAK,CAAC,SAAS,CAChB,CAAA;4BACD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;4BACxD,MAAM,IAAI,kBAAkB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;wBACnD,CAAC;6BAAM,CAAC;4BACN,MAAM,IAAI,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;wBAC9C,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QAExD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QAEpD,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;YACzB,OAAO,+BAA+B,CAAC,GAAG,EAAE,MAAM,EAAE,eAAe,CAAC,CAAA;QACtE,CAAC;aAAM,CAAC;YACN,OAAO,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;QAC5C,CAAC;IACH,CAAC,CAAC,CACH,CAAA;IAED,uEAAuE;IACvE,2EAA2E;IAC3E,sEAAsE;IACtE,oDAAoD;IACpD,MAAM,CAAC,GAAG,CACR,2BAA2B,EAC3B,gBAAgB,CAAC,KAAK,WAAW,GAAG,EAAE,GAAG;QACvC,6CAA6C;QAC7C,iBAAiB,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC,CAAA;QACvC,iBAAiB,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;QACpC,iBAAiB,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;QACpC,cAAc,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;QAEjC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,EAAE;YACrC,MAAM,EAAE,YAAY;YACpB,QAAQ,EAAE,kBAAkB;SAC7B,CAAC,CAAA;QAEF,mDAAmD;QACnD,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAA;QAEhE,OAAO,YAAY,CAAC,GAAG,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,eAAe,CAAC,CAAA;IACvE,CAAC,CAAC,CACH,CAAA;IAED,OAAO,MAAM,CAAC,eAAe,EAAE,CAAA;IAE/B,SAAS,gBAAgB,CACvB,OAAyD;QAEzD,OAAO,KAAK,WAAW,GAAG,EAAE,GAAG;YAC7B,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YACpC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,6BAA6B,CAAC,CAAA;gBAEvD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBACrB,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;wBACtC,OAAO,+BAA+B,CACpC,GAAG,EACH;4BACE,MAAM,EAAE,MAAM,CAAC,MAAM;4BACrB,UAAU,EAAE,GAAG,CAAC,UAAU;4BAC1B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;yBACvB,EACD,eAAe,CAChB,CAAA;oBACH,CAAC;yBAAM,CAAC;wBACN,OAAO,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;oBACrC,CAAC;gBACH,CAAC;qBAAM,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;oBAC1B,GAAG,CAAC,GAAG,EAAE,CAAA;gBACX,CAAC;YACH,CAAC;QACH,CAAC,CAAA;IACH,CAAC;AACH,CAAC;AAED,SAAS,mCAAmC,CAC1C,GAAQ;IAER,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IAClD,MAAM,MAAM,GAAG,oCAAoC,CAAC,SAAS,CAAC,KAAK,EAAE;QACnE,IAAI,EAAE,CAAC,OAAO,CAAC;KAChB,CAAC,CAAA;IAEF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,4BAA4B,CAAA;QAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAA;QACxB,MAAM,IAAI,mBAAmB,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,CAAA;IAC/D,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAA;AACpB,CAAC","sourcesContent":["import type { IncomingMessage, ServerResponse } from 'node:http'\nimport {\n  OAuthAuthorizationRequestQuery,\n  oauthAuthorizationRequestQuerySchema,\n} from '@atproto/oauth-types'\nimport { AuthorizationError } from '../errors/authorization-error.js'\nimport { InvalidRequestError } from '../errors/invalid-request-error.js'\nimport {\n  Middleware,\n  Router,\n  RouterCtx,\n  getCookie,\n  setCookie,\n  validateFetchDest,\n  validateFetchMode,\n  validateFetchSite,\n  validateOrigin,\n  validateReferrer,\n} from '../lib/http/index.js'\nimport { SecurityHeadersOptions } from '../lib/http/security-headers.js'\nimport { formatError } from '../lib/util/error.js'\nimport type { Awaitable } from '../lib/util/type.js'\nimport { writeFormRedirect } from '../lib/write-form-redirect.js'\nimport type { OAuthProvider } from '../oauth-provider.js'\nimport { parseRequestUri, requestUriSchema } from '../request/request-uri.js'\nimport { sendAuthorizePageFactory } from './assets/send-authorization-page.js'\nimport { sendCookieErrorPageFactory } from './assets/send-cookie-error-page.js'\nimport { sendErrorPageFactory } from './assets/send-error-page.js'\nimport {\n  sendAuthorizationResultRedirect,\n  sendRedirect,\n} from './assets/send-redirect.js'\nimport { parseRedirectUrl } from './create-api-middleware.js'\nimport type { MiddlewareOptions } from './middleware-options.js'\n\nexport function createAuthorizationPageMiddleware<\n  Ctx extends object | void = void,\n  Req extends IncomingMessage = IncomingMessage,\n  Res extends ServerResponse = ServerResponse,\n>(\n  server: OAuthProvider,\n  { onError }: MiddlewareOptions<Req, Res>,\n): Middleware<Ctx, Req, Res> {\n  const issuerUrl = new URL(server.issuer)\n  const issuerOrigin = issuerUrl.origin\n\n  const securityOptions: SecurityHeadersOptions = {\n    hsts: issuerUrl.protocol === 'http:' ? false : undefined,\n  }\n\n  const sendAuthorizePage = sendAuthorizePageFactory(\n    server.customization,\n    securityOptions,\n  )\n  const sendErrorPage = sendErrorPageFactory(\n    server.customization,\n    securityOptions,\n  )\n  const sendCookieErrorPage = sendCookieErrorPageFactory(\n    server.customization,\n    securityOptions,\n  )\n\n  const router = new Router<Ctx, Req, Res>(issuerUrl)\n\n  router.get(\n    '/oauth/authorize',\n    withErrorHandler(async function (req, res) {\n      res.setHeader('Cache-Control', 'no-store')\n      res.setHeader('Pragma', 'no-cache')\n\n      // \"same-origin\" is required to support the redirect test logic below (as\n      // well as refreshing the authorization page).\n\n      // @TODO Consider removing this altogether to allow hosting PDS and app on\n      // the same site but different origins (different subdomains).\n      validateFetchSite(req, ['same-origin', 'cross-site', 'none'])\n      validateFetchMode(req, ['navigate'])\n      validateFetchDest(req, ['document'])\n      validateOrigin(req, issuerOrigin)\n\n      // Do not perform any of the following logic if the request is invalid\n      const query = parseOAuthAuthorizationRequestQuery(this.url)\n\n      // @NOTE For some reason, even when loaded through a\n      // ASWebAuthenticationSession, iOS will sometimes fail to properly save\n      // cookies set during the rendering of the page. When this happens, the\n      // authorization page logic, which relies on cookies to maintain the session,\n      // will fail. To work around this, we perform an initial redirect to ourselves\n      // using a form GET submit, in an attempt to verify if the browser saves\n      // cookies on redirect or not. If it does, we proceed as normal. If it\n      // doesn't, we redirect the user back to the client with an error message.\n      if (\n        // Only for iOS users\n        req.headers['user-agent']?.includes('iPhone OS') &&\n        // Disabled if the user already passed the test, which means their browser preserves cookies on redirect\n        !(getCookie(req, 'cookie-test') === 'succeeded') &&\n        // Disabled if the user already has a session\n        !(await server.deviceManager.hasSession(req))\n      ) {\n        // @TODO Another possible solution would be to avoid relying on cookies if we\n        // detect that they are not being preserved. This would mean that preserving\n        // sessions (SSO) would not be possible for browsers that don't preserve\n        // cookies on redirect, but at least the authorization request could still be\n        // completed. This was not implemented yet due to the extra complexity\n        // involved in supporting this.\n\n        // 1) When the user first comes here, we will test if their browser\n        // preserves cookies by redirecting back to ourselves\n        if (!this.url.searchParams.has('redirect-test')) {\n          // 2) Set a testing cookie\n          setCookie(res, 'cookie-test', 'testing', {\n            sameSite: 'lax',\n            httpOnly: true,\n          })\n\n          // 3) And send an auto-submit form redirecting back to ourselves\n          return writeFormRedirect(\n            res,\n            'get',\n            this.url.href,\n            // 4) We add an extra query parameter to trigger the test logic after\n            // the redirect occurred.\n            [...this.url.searchParams, ['redirect-test', '1']],\n            securityOptions,\n          )\n        } else {\n          // 5) We just got redirected back to ourselves. Verify that the\n          // browser preserved cookies during the redirect\n          if (getCookie(req, 'cookie-test')) {\n            // 6) Success! The browser preserved cookies. Proceed with the\n            // normal authorization flow.\n\n            // 7) Set a long lasting cookie to skip the test next time\n            setCookie(res, 'cookie-test', 'succeeded', {\n              sameSite: 'lax',\n              maxAge: 31 * 24 * 60 * 60,\n              httpOnly: true,\n            })\n          } else {\n            // The browser did NOT preserve cookies. We have to abort the\n            // authorization request.\n\n            if (this.url.searchParams.get('redirect-test') === '1') {\n              // 8) Show an error page to the user explaining the situation\n\n              // Give the browser another chance to save cookies after the use\n              // pressed \"Continue\"\n              setCookie(res, 'cookie-test', 'testing', {\n                sameSite: 'lax',\n                httpOnly: true,\n              })\n\n              // Make sure next time we reach the other branch and redirect back\n              // to the client\n              const continueUrl = new URL(this.url.href)\n              continueUrl.searchParams.set('redirect-test', '2')\n              return sendCookieErrorPage(req, res, { continueUrl })\n            } else {\n              // 9) Once the use acknowledges the error, redirect them back to\n              // the client with an error message.\n\n              // Allow the client to understand what happened (the `error`\n              // response parameter value is constrained by the OAuth2 spec)\n              const message = 'ERR_COOKIES_UNSUPPORTED'\n\n              // @NOTE AuthorizationError thrown here will be caught by the\n              // error handler middleware defined below, and cause a redirect\n              // back to the client with the error parameters.\n              if ('request_uri' in query) {\n                // Load and delete the authorization request\n                const requestUri = parseRequestUri(query.request_uri, {\n                  path: ['query', 'request_uri'],\n                })\n                const data = await server.requestManager.get(\n                  requestUri,\n                  undefined,\n                  query.client_id,\n                )\n                await server.requestManager.delete(requestUri)\n                throw new AuthorizationError(data.parameters, message)\n              } else if ('request' in query) {\n                const client = await server.clientManager.getClient(\n                  query.client_id,\n                )\n                const parameters = await server.decodeJAR(client, query)\n                throw new AuthorizationError(parameters, message)\n              } else {\n                throw new AuthorizationError(query, message)\n              }\n            }\n          }\n        }\n      }\n\n      // Normal authorization flow\n      const device = await server.deviceManager.load(req, res)\n\n      const result = await server.authorize(query, device)\n\n      if ('redirect' in result) {\n        return sendAuthorizationResultRedirect(res, result, securityOptions)\n      } else {\n        return sendAuthorizePage(req, res, result)\n      }\n    }),\n  )\n\n  // This is a private endpoint that will be called by the user after the\n  // authorization request was either approved or denied. The logic performed\n  // here **could** be performed directly in the frontend. We decided to\n  // implement it here to avoid duplicating the logic.\n  router.get(\n    '/oauth/authorize/redirect',\n    withErrorHandler(async function (req, res) {\n      // Ensure we come from the authorization page\n      validateFetchSite(req, ['same-origin'])\n      validateFetchMode(req, ['navigate'])\n      validateFetchDest(req, ['document'])\n      validateOrigin(req, issuerOrigin)\n\n      const referrer = validateReferrer(req, {\n        origin: issuerOrigin,\n        pathname: '/oauth/authorize',\n      })\n\n      // Ensure we are coming from the authorization page\n      requestUriSchema.parse(referrer.searchParams.get('request_uri'))\n\n      return sendRedirect(res, parseRedirectUrl(this.url), securityOptions)\n    }),\n  )\n\n  return router.buildMiddleware()\n\n  function withErrorHandler<T extends RouterCtx>(\n    handler: (this: T, req: Req, res: Res) => Awaitable<void>,\n  ): Middleware<T, Req, Res> {\n    return async function (req, res) {\n      try {\n        await handler.call(this, req, res)\n      } catch (err) {\n        onError?.(req, res, err, `Authorization Request Error`)\n\n        if (!res.headersSent) {\n          if (err instanceof AuthorizationError) {\n            return sendAuthorizationResultRedirect(\n              res,\n              {\n                issuer: server.issuer,\n                parameters: err.parameters,\n                redirect: err.toJSON(),\n              },\n              securityOptions,\n            )\n          } else {\n            return sendErrorPage(req, res, err)\n          }\n        } else if (!res.destroyed) {\n          res.end()\n        }\n      }\n    }\n  }\n}\n\nfunction parseOAuthAuthorizationRequestQuery(\n  url: URL,\n): OAuthAuthorizationRequestQuery {\n  const query = Object.fromEntries(url.searchParams)\n  const result = oauthAuthorizationRequestQuerySchema.safeParse(query, {\n    path: ['query'],\n  })\n\n  if (!result.success) {\n    const message = 'Invalid request parameters'\n    const err = result.error\n    throw new InvalidRequestError(formatError(err, message), err)\n  }\n\n  return result.data\n}\n"]}

package/dist/router/create-oauth-middleware.js

@@ -1,15 +1,12 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createOAuthMiddleware = createOAuthMiddleware;
-const oauth_types_1 = require("@atproto/oauth-types");
-const error_parser_js_1 = require("../errors/error-parser.js");
-const invalid_client_error_js_1 = require("../errors/invalid-client-error.js");
-const invalid_grant_error_js_1 = require("../errors/invalid-grant-error.js");
-const invalid_request_error_js_1 = require("../errors/invalid-request-error.js");
-const www_authenticate_error_js_1 = require("../errors/www-authenticate-error.js");
-const index_js_1 = require("../lib/http/index.js");
-const error_js_1 = require("../lib/util/error.js");
-const oauth_errors_js_1 = require("../oauth-errors.js");
+import { oauthAuthorizationRequestParSchema, oauthClientCredentialsSchema, oauthTokenIdentificationSchema, oauthTokenRequestSchema, } from '@atproto/oauth-types';
+import { buildErrorPayload, buildErrorStatus } from '../errors/error-parser.js';
+import { InvalidClientError } from '../errors/invalid-client-error.js';
+import { InvalidGrantError } from '../errors/invalid-grant-error.js';
+import { InvalidRequestError } from '../errors/invalid-request-error.js';
+import { WWWAuthenticateError } from '../errors/www-authenticate-error.js';
+import { Router, cacheControlMiddleware, combineMiddlewares, jsonHandler, parseHttpRequest, staticJsonMiddleware, } from '../lib/http/index.js';
+import { formatError } from '../lib/util/error.js';
+import { OAuthError } from '../oauth-errors.js';
 // CORS preflight
 const corsHeaders = function (req, res, next) {
     res.setHeader('Access-Control-Max-Age', '86400'); // 1 day
@@ -33,28 +30,28 @@ const corsHeaders = function (req, res, next) {
     res.setHeader('Access-Control-Allow-Headers', 'Content-Type,DPoP');
     next();
 };
-const corsPreflight = (0, index_js_1.combineMiddlewares)([
+const corsPreflight = combineMiddlewares([
     corsHeaders,
     (req, res) => {
         res.writeHead(200).end();
     },
 ]);
-function createOAuthMiddleware(server, { onError }) {
-    const router = new index_js_1.Router(new URL(server.issuer));
+export function createOAuthMiddleware(server, { onError }) {
+    const router = new Router(new URL(server.issuer));
     //- Public OAuth endpoints
     router.options('/.well-known/oauth-authorization-server', corsPreflight);
-    router.get('/.well-known/oauth-authorization-server', corsHeaders, (0, index_js_1.cacheControlMiddleware)(300), (0, index_js_1.staticJsonMiddleware)(server.metadata));
+    router.get('/.well-known/oauth-authorization-server', corsHeaders, cacheControlMiddleware(300), staticJsonMiddleware(server.metadata));
     router.options('/oauth/jwks', corsPreflight);
-    router.get('/oauth/jwks', corsHeaders, (0, index_js_1.cacheControlMiddleware)(300), (0, index_js_1.staticJsonMiddleware)(server.jwks));
+    router.get('/oauth/jwks', corsHeaders, cacheControlMiddleware(300), staticJsonMiddleware(server.jwks));
     router.options('/oauth/par', corsPreflight);
     router.post('/oauth/par', corsHeaders, oauthHandler(async function (req) {
-        const payload = await (0, index_js_1.parseHttpRequest)(req, ['json', 'urlencoded']);
+        const payload = await parseHttpRequest(req, ['json', 'urlencoded']);
         // https://datatracker.ietf.org/doc/html/rfc9126#name-error-response
         // https://datatracker.ietf.org/doc/html/rfc6749#autoid-56
-        const credentials = await oauth_types_1.oauthClientCredentialsSchema
+        const credentials = await oauthClientCredentialsSchema
             .parseAsync(payload, { path: ['body'] })
             .catch((err) => throwInvalidClient(err, 'Client credentials missing'));
-        const authorizationRequest = await oauth_types_1.oauthAuthorizationRequestParSchema
+        const authorizationRequest = await oauthAuthorizationRequestParSchema
             .parseAsync(payload, { path: ['body'] })
             .catch((err) => throwInvalidRequest(err, 'Invalid authorization request'));
         const dpopProof = await server.checkDpopProof(req.method, this.url, req.headers);
@@ -68,12 +65,12 @@ function createOAuthMiddleware(server, { onError }) {
     });
     router.options('/oauth/token', corsPreflight);
     router.post('/oauth/token', corsHeaders, oauthHandler(async function (req) {
-        const payload = await (0, index_js_1.parseHttpRequest)(req, ['json', 'urlencoded']);
+        const payload = await parseHttpRequest(req, ['json', 'urlencoded']);
         const clientMetadata = await server.deviceManager.getRequestMetadata(req);
-        const clientCredentials = await oauth_types_1.oauthClientCredentialsSchema
+        const clientCredentials = await oauthClientCredentialsSchema
             .parseAsync(payload, { path: ['body'] })
             .catch((err) => throwInvalidGrant(err, 'Client credentials missing'));
-        const tokenRequest = await oauth_types_1.oauthTokenRequestSchema
+        const tokenRequest = await oauthTokenRequestSchema
             .parseAsync(payload, { path: ['body'] })
             .catch((err) => throwInvalidGrant(err, 'Invalid request payload'));
         const dpopProof = await server.checkDpopProof(req.method, this.url, req.headers);
@@ -81,11 +78,11 @@ function createOAuthMiddleware(server, { onError }) {
     }));
     router.options('/oauth/revoke', corsPreflight);
     router.post('/oauth/revoke', corsHeaders, oauthHandler(async function (req, res) {
-        const payload = await (0, index_js_1.parseHttpRequest)(req, ['json', 'urlencoded']);
-        const credentials = await oauth_types_1.oauthClientCredentialsSchema
+        const payload = await parseHttpRequest(req, ['json', 'urlencoded']);
+        const credentials = await oauthClientCredentialsSchema
             .parseAsync(payload, { path: ['body'] })
             .catch((err) => throwInvalidRequest(err, 'Client credentials missing'));
-        const tokenIdentification = await oauth_types_1.oauthTokenIdentificationSchema
+        const tokenIdentification = await oauthTokenIdentificationSchema
             .parseAsync(payload, { path: ['body'] })
             .catch((err) => throwInvalidRequest(err, 'Invalid request payload'));
         const dpopProof = await server.checkDpopProof(req.method, this.url, req.headers);
@@ -105,7 +102,7 @@ function createOAuthMiddleware(server, { onError }) {
     }));
     return router.buildMiddleware();
     function oauthHandler(buildOAuthResponse, status) {
-        return (0, index_js_1.jsonHandler)(async function (req, res) {
+        return jsonHandler(async function (req, res) {
             try {
                 // https://www.rfc-editor.org/rfc/rfc6749.html#section-5.1
                 res.setHeader('Cache-Control', 'no-store');
@@ -121,28 +118,28 @@ function createOAuthMiddleware(server, { onError }) {
                 return { json, status };
             }
             catch (err) {
-                onError?.(req, res, err, err instanceof oauth_errors_js_1.OAuthError
+                onError?.(req, res, err, err instanceof OAuthError
                     ? `OAuth "${err.error}" error`
                     : 'Unexpected error');
-                if (!res.headersSent && err instanceof www_authenticate_error_js_1.WWWAuthenticateError) {
+                if (!res.headersSent && err instanceof WWWAuthenticateError) {
                     const name = 'WWW-Authenticate';
                     res.setHeader(name, err.wwwAuthenticateHeader);
                     res.appendHeader('Access-Control-Expose-Headers', name);
                 }
-                const status = (0, error_parser_js_1.buildErrorStatus)(err);
-                const json = (0, error_parser_js_1.buildErrorPayload)(err);
+                const status = buildErrorStatus(err);
+                const json = buildErrorPayload(err);
                 return { json, status };
             }
         });
     }
 }
 function throwInvalidGrant(err, prefix) {
-    throw new invalid_grant_error_js_1.InvalidGrantError((0, error_js_1.formatError)(err, prefix), err);
+    throw new InvalidGrantError(formatError(err, prefix), err);
 }
 function throwInvalidClient(err, prefix) {
-    throw new invalid_client_error_js_1.InvalidClientError((0, error_js_1.formatError)(err, prefix), err);
+    throw new InvalidClientError(formatError(err, prefix), err);
 }
 function throwInvalidRequest(err, prefix) {
-    throw new invalid_request_error_js_1.InvalidRequestError((0, error_js_1.formatError)(err, prefix), err);
+    throw new InvalidRequestError(formatError(err, prefix), err);
 }
 //# sourceMappingURL=create-oauth-middleware.js.map

package/dist/router/create-oauth-middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"create-oauth-middleware.js","sourceRoot":"","sources":["../../src/router/create-oauth-middleware.ts"],"names":[],"mappings":";;AA6DA,sDAuLC;AAnPD,sDAK6B;AAC7B,+DAA+E;AAC/E,+EAAsE;AACtE,6EAAoE;AACpE,iFAAwE;AACxE,mFAA0E;AAC1E,mDAQ6B;AAC7B,mDAAkD;AAClD,wDAA+C;AAI/C,iBAAiB;AACjB,MAAM,WAAW,GAAe,UAAU,GAAG,EAAE,GAAG,EAAE,IAAI;IACtD,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAA,CAAC,QAAQ;IAEzD,wFAAwF;IACxF,EAAE;IACF,mEAAmE;IACnE,+DAA+D;IAC/D,4DAA4D;IAC5D,kEAAkE;IAClE,WAAW;IACX,EAAE;IACF,4DAA4D;IAC5D,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAA;IAEjD,yFAAyF;IACzF,8DAA8D;IAC9D,mEAAmE;IACnE,oEAAoE;IACpE,iEAAiE;IACjE,eAAe;IACf,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAA;IAElD,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,mBAAmB,CAAC,CAAA;IAElE,IAAI,EAAE,CAAA;AACR,CAAC,CAAA;AAED,MAAM,aAAa,GAAe,IAAA,6BAAkB,EAAC;IACnD,WAAW;IACX,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACX,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;IAC1B,CAAC;CACF,CAAC,CAAA;AAEF,SAAgB,qBAAqB,CAKnC,MAAqB,EACrB,EAAE,OAAO,EAA+B;IAExC,MAAM,MAAM,GAAG,IAAI,iBAAM,CAAgB,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;IAEhE,0BAA0B;IAE1B,MAAM,CAAC,OAAO,CAAC,yCAAyC,EAAE,aAAa,CAAC,CAAA;IACxE,MAAM,CAAC,GAAG,CACR,yCAAyC,EACzC,WAAW,EACX,IAAA,iCAAsB,EAAC,GAAG,CAAC,EAC3B,IAAA,+BAAoB,EAAC,MAAM,CAAC,QAAQ,CAAC,CACtC,CAAA;IAED,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC,CAAA;IAC5C,MAAM,CAAC,GAAG,CACR,aAAa,EACb,WAAW,EACX,IAAA,iCAAsB,EAAC,GAAG,CAAC,EAC3B,IAAA,+BAAoB,EAAC,MAAM,CAAC,IAAI,CAAC,CAClC,CAAA;IAED,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,aAAa,CAAC,CAAA;IAC3C,MAAM,CAAC,IAAI,CACT,YAAY,EACZ,WAAW,EACX,YAAY,CAAC,KAAK,WAAW,GAAG;QAC9B,MAAM,OAAO,GAAG,MAAM,IAAA,2BAAgB,EAAC,GAAG,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAA;QAEnE,oEAAoE;QACpE,0DAA0D;QAE1D,MAAM,WAAW,GAAG,MAAM,0CAA4B;aACnD,UAAU,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;aACvC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC,CAAA;QAExE,MAAM,oBAAoB,GAAG,MAAM,gDAAkC;aAClE,UAAU,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;aACvC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACb,mBAAmB,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAC1D,CAAA;QAEH,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,cAAc,CAC3C,GAAG,CAAC,MAAO,EACX,IAAI,CAAC,GAAG,EACR,GAAG,CAAC,OAAO,CACZ,CAAA;QAED,OAAO,MAAM,CAAC,0BAA0B,CACtC,WAAW,EACX,oBAAoB,EACpB,SAAS,CACV,CAAA;IACH,CAAC,EAAE,GAAG,CAAC,CACR,CAAA;IACD,4DAA4D;IAC5D,yEAAyE;IACzE,gEAAgE;IAChE,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACpC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,aAAa,CAAC,CAAA;IAC7C,MAAM,CAAC,IAAI,CACT,cAAc,EACd,WAAW,EACX,YAAY,CAAC,KAAK,WAAW,GAAG;QAC9B,MAAM,OAAO,GAAG,MAAM,IAAA,2BAAgB,EAAC,GAAG,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAA;QAEnE,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAA;QAEzE,MAAM,iBAAiB,GAAG,MAAM,0CAA4B;aACzD,UAAU,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;aACvC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC,CAAA;QAEvE,MAAM,YAAY,GAAG,MAAM,qCAAuB;aAC/C,UAAU,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;aACvC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC,CAAA;QAEpE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,cAAc,CAC3C,GAAG,CAAC,MAAO,EACX,IAAI,CAAC,GAAG,EACR,GAAG,CAAC,OAAO,CACZ,CAAA;QAED,OAAO,MAAM,CAAC,KAAK,CACjB,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,SAAS,CACV,CAAA;IACH,CAAC,CAAC,CACH,CAAA;IAED,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,aAAa,CAAC,CAAA;IAC9C,MAAM,CAAC,IAAI,CACT,eAAe,EACf,WAAW,EACX,YAAY,CAAC,KAAK,WAAW,GAAG,EAAE,GAAG;QACnC,MAAM,OAAO,GAAG,MAAM,IAAA,2BAAgB,EAAC,GAAG,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAA;QAEnE,MAAM,WAAW,GAAG,MAAM,0CAA4B;aACnD,UAAU,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;aACvC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC,CAAA;QAEzE,MAAM,mBAAmB,GAAG,MAAM,4CAA8B;aAC7D,UAAU,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;aACvC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC,CAAA;QAEtE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,cAAc,CAC3C,GAAG,CAAC,MAAO,EACX,IAAI,CAAC,GAAG,EACR,GAAG,CAAC,OAAO,CACZ,CAAA;QAED,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,mBAAmB,EAAE,SAAS,CAAC,CAAA;QAClE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,kEAAkE;YAClE,uEAAuE;YACvE,uEAAuE;YACvE,gCAAgC;YAChC,EAAE;YACF,4DAA4D;YAE5D,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAA;QACpD,CAAC;QAED,OAAO,EAAE,CAAA;IACX,CAAC,CAAC,CACH,CAAA;IAED,OAAO,MAAM,CAAC,eAAe,EAAE,CAAA;IAE/B,SAAS,YAAY,CACnB,kBAA4D,EAC5D,MAAe;QAEf,OAAO,IAAA,sBAAW,EAAc,KAAK,WAAW,GAAG,EAAE,GAAG;YACtD,IAAI,CAAC;gBACH,0DAA0D;gBAC1D,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAA;gBAC1C,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;gBAEnC,4DAA4D;gBAC5D,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa,EAAE,CAAA;gBACxC,IAAI,SAAS,EAAE,CAAC;oBACd,MAAM,IAAI,GAAG,YAAY,CAAA;oBACzB,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;oBAC9B,GAAG,CAAC,YAAY,CAAC,+BAA+B,EAAE,IAAI,CAAC,CAAA;gBACzD,CAAC;gBAED,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;gBAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;YACzB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,EAAE,CACP,GAAG,EACH,GAAG,EACH,GAAG,EACH,GAAG,YAAY,4BAAU;oBACvB,CAAC,CAAC,UAAU,GAAG,CAAC,KAAK,SAAS;oBAC9B,CAAC,CAAC,kBAAkB,CACvB,CAAA;gBAED,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,YAAY,gDAAoB,EAAE,CAAC;oBAC5D,MAAM,IAAI,GAAG,kBAAkB,CAAA;oBAC/B,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,qBAAqB,CAAC,CAAA;oBAC9C,GAAG,CAAC,YAAY,CAAC,+BAA+B,EAAE,IAAI,CAAC,CAAA;gBACzD,CAAC;gBAED,MAAM,MAAM,GAAG,IAAA,kCAAgB,EAAC,GAAG,CAAC,CAAA;gBACpC,MAAM,IAAI,GAAG,IAAA,mCAAiB,EAAC,GAAG,CAAC,CAAA;gBAEnC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;YACzB,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAY,EAAE,MAAc;IACrD,MAAM,IAAI,0CAAiB,CAAC,IAAA,sBAAW,EAAC,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAA;AAC5D,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAY,EAAE,MAAc;IACtD,MAAM,IAAI,4CAAkB,CAAC,IAAA,sBAAW,EAAC,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAA;AAC7D,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAY,EAAE,MAAc;IACvD,MAAM,IAAI,8CAAmB,CAAC,IAAA,sBAAW,EAAC,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAA;AAC9D,CAAC","sourcesContent":["import type { IncomingMessage, ServerResponse } from 'node:http'\nimport {\n  oauthAuthorizationRequestParSchema,\n  oauthClientCredentialsSchema,\n  oauthTokenIdentificationSchema,\n  oauthTokenRequestSchema,\n} from '@atproto/oauth-types'\nimport { buildErrorPayload, buildErrorStatus } from '../errors/error-parser.js'\nimport { InvalidClientError } from '../errors/invalid-client-error.js'\nimport { InvalidGrantError } from '../errors/invalid-grant-error.js'\nimport { InvalidRequestError } from '../errors/invalid-request-error.js'\nimport { WWWAuthenticateError } from '../errors/www-authenticate-error.js'\nimport {\n  Middleware,\n  Router,\n  cacheControlMiddleware,\n  combineMiddlewares,\n  jsonHandler,\n  parseHttpRequest,\n  staticJsonMiddleware,\n} from '../lib/http/index.js'\nimport { formatError } from '../lib/util/error.js'\nimport { OAuthError } from '../oauth-errors.js'\nimport type { OAuthProvider } from '../oauth-provider.js'\nimport type { MiddlewareOptions } from './middleware-options.js'\n\n// CORS preflight\nconst corsHeaders: Middleware = function (req, res, next) {\n  res.setHeader('Access-Control-Max-Age', '86400') // 1 day\n\n  // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin\n  //\n  // > For requests without credentials, the literal value \"*\" can be\n  // > specified as a wildcard; the value tells browsers to allow\n  // > requesting code from any origin to access the resource.\n  // > Attempting to use the wildcard with credentials results in an\n  // > error.\n  //\n  // A \"*\" is safer to use than reflecting the request origin.\n  res.setHeader('Access-Control-Allow-Origin', '*')\n\n  // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Methods\n  // > The value \"*\" only counts as a special wildcard value for\n  // > requests without credentials (requests without HTTP cookies or\n  // > HTTP authentication information). In requests with credentials,\n  // > it is treated as the literal method name \"*\" without special\n  // > semantics.\n  res.setHeader('Access-Control-Allow-Methods', '*')\n\n  res.setHeader('Access-Control-Allow-Headers', 'Content-Type,DPoP')\n\n  next()\n}\n\nconst corsPreflight: Middleware = combineMiddlewares([\n  corsHeaders,\n  (req, res) => {\n    res.writeHead(200).end()\n  },\n])\n\nexport function createOAuthMiddleware<\n  Ctx extends object | void = void,\n  Req extends IncomingMessage = IncomingMessage,\n  Res extends ServerResponse = ServerResponse,\n>(\n  server: OAuthProvider,\n  { onError }: MiddlewareOptions<Req, Res>,\n): Middleware<Ctx, Req, Res> {\n  const router = new Router<Ctx, Req, Res>(new URL(server.issuer))\n\n  //- Public OAuth endpoints\n\n  router.options('/.well-known/oauth-authorization-server', corsPreflight)\n  router.get(\n    '/.well-known/oauth-authorization-server',\n    corsHeaders,\n    cacheControlMiddleware(300),\n    staticJsonMiddleware(server.metadata),\n  )\n\n  router.options('/oauth/jwks', corsPreflight)\n  router.get(\n    '/oauth/jwks',\n    corsHeaders,\n    cacheControlMiddleware(300),\n    staticJsonMiddleware(server.jwks),\n  )\n\n  router.options('/oauth/par', corsPreflight)\n  router.post(\n    '/oauth/par',\n    corsHeaders,\n    oauthHandler(async function (req) {\n      const payload = await parseHttpRequest(req, ['json', 'urlencoded'])\n\n      // https://datatracker.ietf.org/doc/html/rfc9126#name-error-response\n      // https://datatracker.ietf.org/doc/html/rfc6749#autoid-56\n\n      const credentials = await oauthClientCredentialsSchema\n        .parseAsync(payload, { path: ['body'] })\n        .catch((err) => throwInvalidClient(err, 'Client credentials missing'))\n\n      const authorizationRequest = await oauthAuthorizationRequestParSchema\n        .parseAsync(payload, { path: ['body'] })\n        .catch((err) =>\n          throwInvalidRequest(err, 'Invalid authorization request'),\n        )\n\n      const dpopProof = await server.checkDpopProof(\n        req.method!,\n        this.url,\n        req.headers,\n      )\n\n      return server.pushedAuthorizationRequest(\n        credentials,\n        authorizationRequest,\n        dpopProof,\n      )\n    }, 201),\n  )\n  // https://datatracker.ietf.org/doc/html/rfc9126#section-2.3\n  // > If the request did not use the POST method, the authorization server\n  // > responds with an HTTP 405 (Method Not Allowed) status code.\n  router.all('/oauth/par', (req, res) => {\n    res.writeHead(405).end()\n  })\n\n  router.options('/oauth/token', corsPreflight)\n  router.post(\n    '/oauth/token',\n    corsHeaders,\n    oauthHandler(async function (req) {\n      const payload = await parseHttpRequest(req, ['json', 'urlencoded'])\n\n      const clientMetadata = await server.deviceManager.getRequestMetadata(req)\n\n      const clientCredentials = await oauthClientCredentialsSchema\n        .parseAsync(payload, { path: ['body'] })\n        .catch((err) => throwInvalidGrant(err, 'Client credentials missing'))\n\n      const tokenRequest = await oauthTokenRequestSchema\n        .parseAsync(payload, { path: ['body'] })\n        .catch((err) => throwInvalidGrant(err, 'Invalid request payload'))\n\n      const dpopProof = await server.checkDpopProof(\n        req.method!,\n        this.url,\n        req.headers,\n      )\n\n      return server.token(\n        clientCredentials,\n        clientMetadata,\n        tokenRequest,\n        dpopProof,\n      )\n    }),\n  )\n\n  router.options('/oauth/revoke', corsPreflight)\n  router.post(\n    '/oauth/revoke',\n    corsHeaders,\n    oauthHandler(async function (req, res) {\n      const payload = await parseHttpRequest(req, ['json', 'urlencoded'])\n\n      const credentials = await oauthClientCredentialsSchema\n        .parseAsync(payload, { path: ['body'] })\n        .catch((err) => throwInvalidRequest(err, 'Client credentials missing'))\n\n      const tokenIdentification = await oauthTokenIdentificationSchema\n        .parseAsync(payload, { path: ['body'] })\n        .catch((err) => throwInvalidRequest(err, 'Invalid request payload'))\n\n      const dpopProof = await server.checkDpopProof(\n        req.method!,\n        this.url,\n        req.headers,\n      )\n\n      try {\n        await server.revoke(credentials, tokenIdentification, dpopProof)\n      } catch (err) {\n        // > Note: invalid tokens do not cause an error response since the\n        // > client cannot handle such an error in a reasonable way.  Moreover,\n        // > the purpose of the revocation request, invalidating the particular\n        // > token, is already achieved.\n        //\n        // https://datatracker.ietf.org/doc/html/rfc7009#section-2.2\n\n        onError?.(req, res, err, 'Failed to revoke token')\n      }\n\n      return {}\n    }),\n  )\n\n  return router.buildMiddleware()\n\n  function oauthHandler<T>(\n    buildOAuthResponse: (this: T, req: Req, res: Res) => unknown,\n    status?: number,\n  ): Middleware<T, Req, Res> {\n    return jsonHandler<T, Req, Res>(async function (req, res) {\n      try {\n        // https://www.rfc-editor.org/rfc/rfc6749.html#section-5.1\n        res.setHeader('Cache-Control', 'no-store')\n        res.setHeader('Pragma', 'no-cache')\n\n        // https://datatracker.ietf.org/doc/html/rfc9449#section-8.2\n        const dpopNonce = server.nextDpopNonce()\n        if (dpopNonce) {\n          const name = 'DPoP-Nonce'\n          res.setHeader(name, dpopNonce)\n          res.appendHeader('Access-Control-Expose-Headers', name)\n        }\n\n        const json = await buildOAuthResponse.call(this, req, res)\n        return { json, status }\n      } catch (err) {\n        onError?.(\n          req,\n          res,\n          err,\n          err instanceof OAuthError\n            ? `OAuth \"${err.error}\" error`\n            : 'Unexpected error',\n        )\n\n        if (!res.headersSent && err instanceof WWWAuthenticateError) {\n          const name = 'WWW-Authenticate'\n          res.setHeader(name, err.wwwAuthenticateHeader)\n          res.appendHeader('Access-Control-Expose-Headers', name)\n        }\n\n        const status = buildErrorStatus(err)\n        const json = buildErrorPayload(err)\n\n        return { json, status }\n      }\n    })\n  }\n}\n\nfunction throwInvalidGrant(err: unknown, prefix: string): never {\n  throw new InvalidGrantError(formatError(err, prefix), err)\n}\n\nfunction throwInvalidClient(err: unknown, prefix: string): never {\n  throw new InvalidClientError(formatError(err, prefix), err)\n}\n\nfunction throwInvalidRequest(err: unknown, prefix: string): never {\n  throw new InvalidRequestError(formatError(err, prefix), err)\n}\n"]}
+{"version":3,"file":"create-oauth-middleware.js","sourceRoot":"","sources":["../../src/router/create-oauth-middleware.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kCAAkC,EAClC,4BAA4B,EAC5B,8BAA8B,EAC9B,uBAAuB,GACxB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAC/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAA;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAA;AAC1E,OAAO,EAEL,MAAM,EACN,sBAAsB,EACtB,kBAAkB,EAClB,WAAW,EACX,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAI/C,iBAAiB;AACjB,MAAM,WAAW,GAAe,UAAU,GAAG,EAAE,GAAG,EAAE,IAAI;IACtD,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAA,CAAC,QAAQ;IAEzD,wFAAwF;IACxF,EAAE;IACF,mEAAmE;IACnE,+DAA+D;IAC/D,4DAA4D;IAC5D,kEAAkE;IAClE,WAAW;IACX,EAAE;IACF,4DAA4D;IAC5D,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAA;IAEjD,yFAAyF;IACzF,8DAA8D;IAC9D,mEAAmE;IACnE,oEAAoE;IACpE,iEAAiE;IACjE,eAAe;IACf,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAA;IAElD,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,mBAAmB,CAAC,CAAA;IAElE,IAAI,EAAE,CAAA;AACR,CAAC,CAAA;AAED,MAAM,aAAa,GAAe,kBAAkB,CAAC;IACnD,WAAW;IACX,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACX,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;IAC1B,CAAC;CACF,CAAC,CAAA;AAEF,MAAM,UAAU,qBAAqB,CAKnC,MAAqB,EACrB,EAAE,OAAO,EAA+B;IAExC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAgB,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;IAEhE,0BAA0B;IAE1B,MAAM,CAAC,OAAO,CAAC,yCAAyC,EAAE,aAAa,CAAC,CAAA;IACxE,MAAM,CAAC,GAAG,CACR,yCAAyC,EACzC,WAAW,EACX,sBAAsB,CAAC,GAAG,CAAC,EAC3B,oBAAoB,CAAC,MAAM,CAAC,QAAQ,CAAC,CACtC,CAAA;IAED,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC,CAAA;IAC5C,MAAM,CAAC,GAAG,CACR,aAAa,EACb,WAAW,EACX,sBAAsB,CAAC,GAAG,CAAC,EAC3B,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAClC,CAAA;IAED,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,aAAa,CAAC,CAAA;IAC3C,MAAM,CAAC,IAAI,CACT,YAAY,EACZ,WAAW,EACX,YAAY,CAAC,KAAK,WAAW,GAAG;QAC9B,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAA;QAEnE,oEAAoE;QACpE,0DAA0D;QAE1D,MAAM,WAAW,GAAG,MAAM,4BAA4B;aACnD,UAAU,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;aACvC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC,CAAA;QAExE,MAAM,oBAAoB,GAAG,MAAM,kCAAkC;aAClE,UAAU,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;aACvC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACb,mBAAmB,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAC1D,CAAA;QAEH,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,cAAc,CAC3C,GAAG,CAAC,MAAO,EACX,IAAI,CAAC,GAAG,EACR,GAAG,CAAC,OAAO,CACZ,CAAA;QAED,OAAO,MAAM,CAAC,0BAA0B,CACtC,WAAW,EACX,oBAAoB,EACpB,SAAS,CACV,CAAA;IACH,CAAC,EAAE,GAAG,CAAC,CACR,CAAA;IACD,4DAA4D;IAC5D,yEAAyE;IACzE,gEAAgE;IAChE,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACpC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,aAAa,CAAC,CAAA;IAC7C,MAAM,CAAC,IAAI,CACT,cAAc,EACd,WAAW,EACX,YAAY,CAAC,KAAK,WAAW,GAAG;QAC9B,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAA;QAEnE,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAA;QAEzE,MAAM,iBAAiB,GAAG,MAAM,4BAA4B;aACzD,UAAU,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;aACvC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC,CAAA;QAEvE,MAAM,YAAY,GAAG,MAAM,uBAAuB;aAC/C,UAAU,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;aACvC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC,CAAA;QAEpE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,cAAc,CAC3C,GAAG,CAAC,MAAO,EACX,IAAI,CAAC,GAAG,EACR,GAAG,CAAC,OAAO,CACZ,CAAA;QAED,OAAO,MAAM,CAAC,KAAK,CACjB,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,SAAS,CACV,CAAA;IACH,CAAC,CAAC,CACH,CAAA;IAED,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,aAAa,CAAC,CAAA;IAC9C,MAAM,CAAC,IAAI,CACT,eAAe,EACf,WAAW,EACX,YAAY,CAAC,KAAK,WAAW,GAAG,EAAE,GAAG;QACnC,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAA;QAEnE,MAAM,WAAW,GAAG,MAAM,4BAA4B;aACnD,UAAU,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;aACvC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC,CAAA;QAEzE,MAAM,mBAAmB,GAAG,MAAM,8BAA8B;aAC7D,UAAU,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;aACvC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC,CAAA;QAEtE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,cAAc,CAC3C,GAAG,CAAC,MAAO,EACX,IAAI,CAAC,GAAG,EACR,GAAG,CAAC,OAAO,CACZ,CAAA;QAED,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,mBAAmB,EAAE,SAAS,CAAC,CAAA;QAClE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,kEAAkE;YAClE,uEAAuE;YACvE,uEAAuE;YACvE,gCAAgC;YAChC,EAAE;YACF,4DAA4D;YAE5D,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAA;QACpD,CAAC;QAED,OAAO,EAAE,CAAA;IACX,CAAC,CAAC,CACH,CAAA;IAED,OAAO,MAAM,CAAC,eAAe,EAAE,CAAA;IAE/B,SAAS,YAAY,CACnB,kBAA4D,EAC5D,MAAe;QAEf,OAAO,WAAW,CAAc,KAAK,WAAW,GAAG,EAAE,GAAG;YACtD,IAAI,CAAC;gBACH,0DAA0D;gBAC1D,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAA;gBAC1C,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;gBAEnC,4DAA4D;gBAC5D,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa,EAAE,CAAA;gBACxC,IAAI,SAAS,EAAE,CAAC;oBACd,MAAM,IAAI,GAAG,YAAY,CAAA;oBACzB,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;oBAC9B,GAAG,CAAC,YAAY,CAAC,+BAA+B,EAAE,IAAI,CAAC,CAAA;gBACzD,CAAC;gBAED,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;gBAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;YACzB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,EAAE,CACP,GAAG,EACH,GAAG,EACH,GAAG,EACH,GAAG,YAAY,UAAU;oBACvB,CAAC,CAAC,UAAU,GAAG,CAAC,KAAK,SAAS;oBAC9B,CAAC,CAAC,kBAAkB,CACvB,CAAA;gBAED,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;oBAC5D,MAAM,IAAI,GAAG,kBAAkB,CAAA;oBAC/B,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,qBAAqB,CAAC,CAAA;oBAC9C,GAAG,CAAC,YAAY,CAAC,+BAA+B,EAAE,IAAI,CAAC,CAAA;gBACzD,CAAC;gBAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;gBACpC,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;gBAEnC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;YACzB,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAY,EAAE,MAAc;IACrD,MAAM,IAAI,iBAAiB,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAA;AAC5D,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAY,EAAE,MAAc;IACtD,MAAM,IAAI,kBAAkB,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAA;AAC7D,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAY,EAAE,MAAc;IACvD,MAAM,IAAI,mBAAmB,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAA;AAC9D,CAAC","sourcesContent":["import type { IncomingMessage, ServerResponse } from 'node:http'\nimport {\n  oauthAuthorizationRequestParSchema,\n  oauthClientCredentialsSchema,\n  oauthTokenIdentificationSchema,\n  oauthTokenRequestSchema,\n} from '@atproto/oauth-types'\nimport { buildErrorPayload, buildErrorStatus } from '../errors/error-parser.js'\nimport { InvalidClientError } from '../errors/invalid-client-error.js'\nimport { InvalidGrantError } from '../errors/invalid-grant-error.js'\nimport { InvalidRequestError } from '../errors/invalid-request-error.js'\nimport { WWWAuthenticateError } from '../errors/www-authenticate-error.js'\nimport {\n  Middleware,\n  Router,\n  cacheControlMiddleware,\n  combineMiddlewares,\n  jsonHandler,\n  parseHttpRequest,\n  staticJsonMiddleware,\n} from '../lib/http/index.js'\nimport { formatError } from '../lib/util/error.js'\nimport { OAuthError } from '../oauth-errors.js'\nimport type { OAuthProvider } from '../oauth-provider.js'\nimport type { MiddlewareOptions } from './middleware-options.js'\n\n// CORS preflight\nconst corsHeaders: Middleware = function (req, res, next) {\n  res.setHeader('Access-Control-Max-Age', '86400') // 1 day\n\n  // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin\n  //\n  // > For requests without credentials, the literal value \"*\" can be\n  // > specified as a wildcard; the value tells browsers to allow\n  // > requesting code from any origin to access the resource.\n  // > Attempting to use the wildcard with credentials results in an\n  // > error.\n  //\n  // A \"*\" is safer to use than reflecting the request origin.\n  res.setHeader('Access-Control-Allow-Origin', '*')\n\n  // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Methods\n  // > The value \"*\" only counts as a special wildcard value for\n  // > requests without credentials (requests without HTTP cookies or\n  // > HTTP authentication information). In requests with credentials,\n  // > it is treated as the literal method name \"*\" without special\n  // > semantics.\n  res.setHeader('Access-Control-Allow-Methods', '*')\n\n  res.setHeader('Access-Control-Allow-Headers', 'Content-Type,DPoP')\n\n  next()\n}\n\nconst corsPreflight: Middleware = combineMiddlewares([\n  corsHeaders,\n  (req, res) => {\n    res.writeHead(200).end()\n  },\n])\n\nexport function createOAuthMiddleware<\n  Ctx extends object | void = void,\n  Req extends IncomingMessage = IncomingMessage,\n  Res extends ServerResponse = ServerResponse,\n>(\n  server: OAuthProvider,\n  { onError }: MiddlewareOptions<Req, Res>,\n): Middleware<Ctx, Req, Res> {\n  const router = new Router<Ctx, Req, Res>(new URL(server.issuer))\n\n  //- Public OAuth endpoints\n\n  router.options('/.well-known/oauth-authorization-server', corsPreflight)\n  router.get(\n    '/.well-known/oauth-authorization-server',\n    corsHeaders,\n    cacheControlMiddleware(300),\n    staticJsonMiddleware(server.metadata),\n  )\n\n  router.options('/oauth/jwks', corsPreflight)\n  router.get(\n    '/oauth/jwks',\n    corsHeaders,\n    cacheControlMiddleware(300),\n    staticJsonMiddleware(server.jwks),\n  )\n\n  router.options('/oauth/par', corsPreflight)\n  router.post(\n    '/oauth/par',\n    corsHeaders,\n    oauthHandler(async function (req) {\n      const payload = await parseHttpRequest(req, ['json', 'urlencoded'])\n\n      // https://datatracker.ietf.org/doc/html/rfc9126#name-error-response\n      // https://datatracker.ietf.org/doc/html/rfc6749#autoid-56\n\n      const credentials = await oauthClientCredentialsSchema\n        .parseAsync(payload, { path: ['body'] })\n        .catch((err) => throwInvalidClient(err, 'Client credentials missing'))\n\n      const authorizationRequest = await oauthAuthorizationRequestParSchema\n        .parseAsync(payload, { path: ['body'] })\n        .catch((err) =>\n          throwInvalidRequest(err, 'Invalid authorization request'),\n        )\n\n      const dpopProof = await server.checkDpopProof(\n        req.method!,\n        this.url,\n        req.headers,\n      )\n\n      return server.pushedAuthorizationRequest(\n        credentials,\n        authorizationRequest,\n        dpopProof,\n      )\n    }, 201),\n  )\n  // https://datatracker.ietf.org/doc/html/rfc9126#section-2.3\n  // > If the request did not use the POST method, the authorization server\n  // > responds with an HTTP 405 (Method Not Allowed) status code.\n  router.all('/oauth/par', (req, res) => {\n    res.writeHead(405).end()\n  })\n\n  router.options('/oauth/token', corsPreflight)\n  router.post(\n    '/oauth/token',\n    corsHeaders,\n    oauthHandler(async function (req) {\n      const payload = await parseHttpRequest(req, ['json', 'urlencoded'])\n\n      const clientMetadata = await server.deviceManager.getRequestMetadata(req)\n\n      const clientCredentials = await oauthClientCredentialsSchema\n        .parseAsync(payload, { path: ['body'] })\n        .catch((err) => throwInvalidGrant(err, 'Client credentials missing'))\n\n      const tokenRequest = await oauthTokenRequestSchema\n        .parseAsync(payload, { path: ['body'] })\n        .catch((err) => throwInvalidGrant(err, 'Invalid request payload'))\n\n      const dpopProof = await server.checkDpopProof(\n        req.method!,\n        this.url,\n        req.headers,\n      )\n\n      return server.token(\n        clientCredentials,\n        clientMetadata,\n        tokenRequest,\n        dpopProof,\n      )\n    }),\n  )\n\n  router.options('/oauth/revoke', corsPreflight)\n  router.post(\n    '/oauth/revoke',\n    corsHeaders,\n    oauthHandler(async function (req, res) {\n      const payload = await parseHttpRequest(req, ['json', 'urlencoded'])\n\n      const credentials = await oauthClientCredentialsSchema\n        .parseAsync(payload, { path: ['body'] })\n        .catch((err) => throwInvalidRequest(err, 'Client credentials missing'))\n\n      const tokenIdentification = await oauthTokenIdentificationSchema\n        .parseAsync(payload, { path: ['body'] })\n        .catch((err) => throwInvalidRequest(err, 'Invalid request payload'))\n\n      const dpopProof = await server.checkDpopProof(\n        req.method!,\n        this.url,\n        req.headers,\n      )\n\n      try {\n        await server.revoke(credentials, tokenIdentification, dpopProof)\n      } catch (err) {\n        // > Note: invalid tokens do not cause an error response since the\n        // > client cannot handle such an error in a reasonable way.  Moreover,\n        // > the purpose of the revocation request, invalidating the particular\n        // > token, is already achieved.\n        //\n        // https://datatracker.ietf.org/doc/html/rfc7009#section-2.2\n\n        onError?.(req, res, err, 'Failed to revoke token')\n      }\n\n      return {}\n    }),\n  )\n\n  return router.buildMiddleware()\n\n  function oauthHandler<T>(\n    buildOAuthResponse: (this: T, req: Req, res: Res) => unknown,\n    status?: number,\n  ): Middleware<T, Req, Res> {\n    return jsonHandler<T, Req, Res>(async function (req, res) {\n      try {\n        // https://www.rfc-editor.org/rfc/rfc6749.html#section-5.1\n        res.setHeader('Cache-Control', 'no-store')\n        res.setHeader('Pragma', 'no-cache')\n\n        // https://datatracker.ietf.org/doc/html/rfc9449#section-8.2\n        const dpopNonce = server.nextDpopNonce()\n        if (dpopNonce) {\n          const name = 'DPoP-Nonce'\n          res.setHeader(name, dpopNonce)\n          res.appendHeader('Access-Control-Expose-Headers', name)\n        }\n\n        const json = await buildOAuthResponse.call(this, req, res)\n        return { json, status }\n      } catch (err) {\n        onError?.(\n          req,\n          res,\n          err,\n          err instanceof OAuthError\n            ? `OAuth \"${err.error}\" error`\n            : 'Unexpected error',\n        )\n\n        if (!res.headersSent && err instanceof WWWAuthenticateError) {\n          const name = 'WWW-Authenticate'\n          res.setHeader(name, err.wwwAuthenticateHeader)\n          res.appendHeader('Access-Control-Expose-Headers', name)\n        }\n\n        const status = buildErrorStatus(err)\n        const json = buildErrorPayload(err)\n\n        return { json, status }\n      }\n    })\n  }\n}\n\nfunction throwInvalidGrant(err: unknown, prefix: string): never {\n  throw new InvalidGrantError(formatError(err, prefix), err)\n}\n\nfunction throwInvalidClient(err: unknown, prefix: string): never {\n  throw new InvalidClientError(formatError(err, prefix), err)\n}\n\nfunction throwInvalidRequest(err: unknown, prefix: string): never {\n  throw new InvalidRequestError(formatError(err, prefix), err)\n}\n"]}

package/dist/router/error-handler.js

@@ -1,3 +1,2 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
+export {};
 //# sourceMappingURL=error-handler.js.map

package/dist/router/middleware-options.js

@@ -1,3 +1,2 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
+export {};
 //# sourceMappingURL=middleware-options.js.map

package/dist/signer/access-token-payload.js

@@ -1,24 +1,21 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.accessTokenPayloadSchema = void 0;
-const zod_1 = require("zod");
-const jwk_1 = require("@atproto/jwk");
-const client_id_js_1 = require("../client/client-id.js");
-const sub_js_1 = require("../oidc/sub.js");
-const token_id_js_1 = require("../token/token-id.js");
-exports.accessTokenPayloadSchema = jwk_1.jwtPayloadSchema
+import { z } from 'zod';
+import { jwtPayloadSchema } from '@atproto/jwk';
+import { clientIdSchema } from '../client/client-id.js';
+import { subSchema } from '../oidc/sub.js';
+import { tokenIdSchema } from '../token/token-id.js';
+export const accessTokenPayloadSchema = jwtPayloadSchema
     .partial()
     .extend({
     // Following are required
-    jti: token_id_js_1.tokenIdSchema,
-    sub: sub_js_1.subSchema,
-    exp: zod_1.z.number().int(),
-    iat: zod_1.z.number().int(),
-    iss: zod_1.z.string().min(1),
+    jti: tokenIdSchema,
+    sub: subSchema,
+    exp: z.number().int(),
+    iat: z.number().int(),
+    iss: z.string().min(1),
     // @NOTE "aud", "scope", "client_id" are not required, as are stored in the
     // DB in 'light' access token mode.
     // Restrict type of following
-    client_id: client_id_js_1.clientIdSchema.optional(),
+    client_id: clientIdSchema.optional(),
 })
     .passthrough();
 //# sourceMappingURL=access-token-payload.js.map

package/dist/signer/access-token-payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"access-token-payload.js","sourceRoot":"","sources":["../../src/signer/access-token-payload.ts"],"names":[],"mappings":";;;AAAA,6BAAuB;AACvB,sCAA+C;AAC/C,yDAAuD;AACvD,2CAA0C;AAC1C,sDAAoD;AAEvC,QAAA,wBAAwB,GAAG,sBAAgB;KACrD,OAAO,EAAE;KACT,MAAM,CAAC;IACN,yBAAyB;IACzB,GAAG,EAAE,2BAAa;IAClB,GAAG,EAAE,kBAAS;IACd,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAEtB,2EAA2E;IAC3E,mCAAmC;IAEnC,6BAA6B;IAC7B,SAAS,EAAE,6BAAc,CAAC,QAAQ,EAAE;CACrC,CAAC;KACD,WAAW,EAAE,CAAA","sourcesContent":["import { z } from 'zod'\nimport { jwtPayloadSchema } from '@atproto/jwk'\nimport { clientIdSchema } from '../client/client-id.js'\nimport { subSchema } from '../oidc/sub.js'\nimport { tokenIdSchema } from '../token/token-id.js'\n\nexport const accessTokenPayloadSchema = jwtPayloadSchema\n  .partial()\n  .extend({\n    // Following are required\n    jti: tokenIdSchema,\n    sub: subSchema,\n    exp: z.number().int(),\n    iat: z.number().int(),\n    iss: z.string().min(1),\n\n    // @NOTE \"aud\", \"scope\", \"client_id\" are not required, as are stored in the\n    // DB in 'light' access token mode.\n\n    // Restrict type of following\n    client_id: clientIdSchema.optional(),\n  })\n  .passthrough()\n\nexport type AccessTokenPayload = z.infer<typeof accessTokenPayloadSchema>\n"]}
+{"version":3,"file":"access-token-payload.js","sourceRoot":"","sources":["../../src/signer/access-token-payload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAEpD,MAAM,CAAC,MAAM,wBAAwB,GAAG,gBAAgB;KACrD,OAAO,EAAE;KACT,MAAM,CAAC;IACN,yBAAyB;IACzB,GAAG,EAAE,aAAa;IAClB,GAAG,EAAE,SAAS;IACd,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAEtB,2EAA2E;IAC3E,mCAAmC;IAEnC,6BAA6B;IAC7B,SAAS,EAAE,cAAc,CAAC,QAAQ,EAAE;CACrC,CAAC;KACD,WAAW,EAAE,CAAA","sourcesContent":["import { z } from 'zod'\nimport { jwtPayloadSchema } from '@atproto/jwk'\nimport { clientIdSchema } from '../client/client-id.js'\nimport { subSchema } from '../oidc/sub.js'\nimport { tokenIdSchema } from '../token/token-id.js'\n\nexport const accessTokenPayloadSchema = jwtPayloadSchema\n  .partial()\n  .extend({\n    // Following are required\n    jti: tokenIdSchema,\n    sub: subSchema,\n    exp: z.number().int(),\n    iat: z.number().int(),\n    iss: z.string().min(1),\n\n    // @NOTE \"aud\", \"scope\", \"client_id\" are not required, as are stored in the\n    // DB in 'light' access token mode.\n\n    // Restrict type of following\n    client_id: clientIdSchema.optional(),\n  })\n  .passthrough()\n\nexport type AccessTokenPayload = z.infer<typeof accessTokenPayloadSchema>\n"]}

package/dist/signer/api-token-payload.js

@@ -1,17 +1,14 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.apiTokenPayloadSchema = void 0;
-const jwk_1 = require("@atproto/jwk");
-const oauth_store_js_1 = require("../oauth-store.js");
-const sub_js_1 = require("../oidc/sub.js");
-const request_uri_js_1 = require("../request/request-uri.js");
-exports.apiTokenPayloadSchema = jwk_1.jwtPayloadSchema
+import { jwtPayloadSchema } from '@atproto/jwk';
+import { deviceIdSchema } from '../oauth-store.js';
+import { subSchema } from '../oidc/sub.js';
+import { requestUriSchema } from '../request/request-uri.js';
+export const apiTokenPayloadSchema = jwtPayloadSchema
     .extend({
-    sub: sub_js_1.subSchema,
-    deviceId: oauth_store_js_1.deviceIdSchema,
+    sub: subSchema,
+    deviceId: deviceIdSchema,
     // If the token is bound to a particular authorization request, it can only
     // be used in the context of that request.
-    requestUri: request_uri_js_1.requestUriSchema.optional(),
+    requestUri: requestUriSchema.optional(),
 })
     .passthrough();
 //# sourceMappingURL=api-token-payload.js.map

package/dist/signer/api-token-payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-token-payload.js","sourceRoot":"","sources":["../../src/signer/api-token-payload.ts"],"names":[],"mappings":";;;AACA,sCAA+C;AAC/C,sDAAkD;AAClD,2CAA0C;AAC1C,8DAA4D;AAE/C,QAAA,qBAAqB,GAAG,sBAAgB;KAClD,MAAM,CAAC;IACN,GAAG,EAAE,kBAAS;IAEd,QAAQ,EAAE,+BAAc;IACxB,2EAA2E;IAC3E,0CAA0C;IAC1C,UAAU,EAAE,iCAAgB,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,WAAW,EAAE,CAAA","sourcesContent":["import { z } from 'zod'\nimport { jwtPayloadSchema } from '@atproto/jwk'\nimport { deviceIdSchema } from '../oauth-store.js'\nimport { subSchema } from '../oidc/sub.js'\nimport { requestUriSchema } from '../request/request-uri.js'\n\nexport const apiTokenPayloadSchema = jwtPayloadSchema\n  .extend({\n    sub: subSchema,\n\n    deviceId: deviceIdSchema,\n    // If the token is bound to a particular authorization request, it can only\n    // be used in the context of that request.\n    requestUri: requestUriSchema.optional(),\n  })\n  .passthrough()\n\nexport type ApiTokenPayload = z.infer<typeof apiTokenPayloadSchema>\n"]}
+{"version":3,"file":"api-token-payload.js","sourceRoot":"","sources":["../../src/signer/api-token-payload.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAE5D,MAAM,CAAC,MAAM,qBAAqB,GAAG,gBAAgB;KAClD,MAAM,CAAC;IACN,GAAG,EAAE,SAAS;IAEd,QAAQ,EAAE,cAAc;IACxB,2EAA2E;IAC3E,0CAA0C;IAC1C,UAAU,EAAE,gBAAgB,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,WAAW,EAAE,CAAA","sourcesContent":["import { z } from 'zod'\nimport { jwtPayloadSchema } from '@atproto/jwk'\nimport { deviceIdSchema } from '../oauth-store.js'\nimport { subSchema } from '../oidc/sub.js'\nimport { requestUriSchema } from '../request/request-uri.js'\n\nexport const apiTokenPayloadSchema = jwtPayloadSchema\n  .extend({\n    sub: subSchema,\n\n    deviceId: deviceIdSchema,\n    // If the token is bound to a particular authorization request, it can only\n    // be used in the context of that request.\n    requestUri: requestUriSchema.optional(),\n  })\n  .passthrough()\n\nexport type ApiTokenPayload = z.infer<typeof apiTokenPayloadSchema>\n"]}