@atproto/oauth-provider 0.18.3 → 0.19.0

package/src/account/account-store.ts

@@ -1,12 +1,17 @@
+import { Did } from '@atproto/did'
 import type {
   Account,
+  ConfirmAccountDeletionInput,
   ConfirmEmailUpdateInput,
   ConfirmEmailVerificationInput,
   ConfirmResetPasswordInput,
+  DeactivateAccountInput,
+  InitiateAccountDeletionInput,
   InitiateEmailUpdateInput,
   InitiateEmailUpdateOutput,
   InitiateEmailVerificationInput,
   InitiatePasswordResetInput,
+  ReactivateAccountInput,
   UpdateHandleInput,
 } from '@atproto/oauth-provider-api'
 import { OAuthScope } from '@atproto/oauth-types'
@@ -21,7 +26,6 @@ import {
   InvalidRequestError,
   SecondAuthenticationFactorRequiredError,
 } from '../oauth-errors.js'
-import { Sub } from '../oidc/sub.js'
 import { InviteCode } from '../types/invite-code.js'
 import { SignUpInput } from './sign-up-input.js'
 
@@ -30,11 +34,11 @@ import { SignUpInput } from './sign-up-input.js'
 export * from '../client/client-id.js'
 export * from '../device/device-data.js'
 export * from '../device/device-id.js'
-export * from '../oidc/sub.js'
 export * from '../request/request-id.js'
 
 export type {
   Account,
+  Did,
   HcaptchaVerifyResult,
   InviteCode,
   OAuthScope,
@@ -58,6 +62,11 @@ export type VerifyEmailRequestInput = InitiateEmailVerificationInput
 export type VerifyEmailConfirmInput = ConfirmEmailVerificationInput
 export type UpdateHandleData = UpdateHandleInput
 
+export type DeactivateAccountData = DeactivateAccountInput
+export type ReactivateAccountData = ReactivateAccountInput
+export type DeleteAccountRequestInput = InitiateAccountDeletionInput
+export type DeleteAccountConfirmInput = ConfirmAccountDeletionInput
+
 export type CreateAccountData = {
   locale: string
   email: string
@@ -124,7 +133,7 @@ export interface AccountStore {
 
   /**
    * @throws {InvalidCredentialsError} - When the credentials are not valid.
-   * Populate {@link InvalidCredentialsError.sub} with the subject identifier
+   * Populate {@link InvalidCredentialsError.did} with the subject identifier
    * when the identifier matched an existing account (e.g. wrong password for
    * a known user); omit it when the identifier was not found. Throwing the
    * generic {@link InvalidRequestError} is also accepted for backward
@@ -138,7 +147,7 @@ export interface AccountStore {
    * Add a client & scopes to the list of authorized clients for the given account.
    */
   setAuthorizedClient(
-    sub: Sub,
+    did: Did,
     clientId: ClientId,
     data: AuthorizedClientData,
   ): Awaitable<void>
@@ -146,7 +155,7 @@ export interface AccountStore {
   /**
    * @throws {InvalidRequestError} - When the credentials are not valid
    */
-  getAccount(sub: Sub): Awaitable<{
+  getAccount(did: Did): Awaitable<{
     account: Account
     authorizedClients: AuthorizedClients
   }>
@@ -162,7 +171,7 @@ export interface AccountStore {
    * {@link RequestStore.deleteRequest}), all accounts bound to that request
    * should be deleted as well.
    */
-  upsertDeviceAccount(deviceId: DeviceId, sub: Sub): Awaitable<void>
+  upsertDeviceAccount(deviceId: DeviceId, did: Did): Awaitable<void>
 
   /**
    * @param requestId - If provided, the result must either have the same
@@ -173,7 +182,7 @@ export interface AccountStore {
    */
   getDeviceAccount(
     deviceId: DeviceId,
-    sub: Sub,
+    did: Did,
   ): Awaitable<DeviceAccount | null>
 
   /**
@@ -182,14 +191,14 @@ export interface AccountStore {
    *
    * @note Noop if the device-account is not found.
    */
-  removeDeviceAccount(deviceId: DeviceId, sub: Sub): Awaitable<void>
+  removeDeviceAccount(deviceId: DeviceId, did: Did): Awaitable<void>
 
   /**
    * @returns **all** the device accounts that match the {@link requestId}
    * criteria and given {@link filter}.
    */
   listDeviceAccounts(
-    filter: { sub: Sub } | { deviceId: DeviceId },
+    filter: { did: Did } | { deviceId: DeviceId },
   ): Awaitable<DeviceAccount[]>
 
   resetPasswordRequest(
@@ -206,8 +215,8 @@ export interface AccountStore {
   /**
    * Must trigger a verification email to be sent to the new email address, that
    * will then be confirmed through {@link updateEmailConfirm}. The account's
-   * `email_verified` field is expected to become `false` until the new email is
-   * confirmed.
+   * {@link Account['emailVerified'] emailVerified} field is expected to become
+   * `false` until the new email is confirmed.
    */
   updateEmailConfirm(data: UpdateEmailConfirmInput): Awaitable<Account | null>
 
@@ -225,25 +234,64 @@ export interface AccountStore {
    * cannot be used
    */
   updateHandle(data: UpdateHandleData): Awaitable<Account>
+
+  /**
+   * Mark the account as deactivated. The account remains recoverable. Should
+   * be a no-op when the account is already deactivated.
+   *
+   * @throws {InvalidRequestError} - When the account cannot be deactivated
+   * (e.g. unknown account)
+   */
+  deactivateAccount(data: DeactivateAccountData): Awaitable<Account>
+
+  /**
+   * Reactivate a previously-deactivated account. Should be a no-op when the
+   * account is already active.
+   *
+   * @throws {InvalidRequestError} - When the account cannot be reactivated
+   * (e.g. unknown account)
+   */
+  reactivateAccount(data: ReactivateAccountData): Awaitable<Account>
+
+  /**
+   * Initiate account deletion: typically sends a confirmation token to the
+   * account's email address. The account is NOT deleted until
+   * {@link deleteAccountConfirm} is called with the matching token and the
+   * user's current password.
+   */
+  deleteAccountRequest(data: DeleteAccountRequestInput): Awaitable<void>
+
+  /**
+   * Finalize account deletion. Implementations MUST verify both the email
+   * confirmation `token` issued by {@link deleteAccountRequest} and the user's
+   * current `password` before deleting any data. Deletion is irreversible.
+   *
+   * @throws {InvalidRequestError} - When the token or password is invalid.
+   */
+  deleteAccountConfirm(data: DeleteAccountConfirmInput): Awaitable<void>
 }
 
 export const isAccountStore = buildInterfaceChecker<AccountStore>([
-  'createAccount',
   'authenticateAccount',
-  'setAuthorizedClient',
+  'createAccount',
+  'deactivateAccount',
+  'deleteAccountConfirm',
+  'deleteAccountRequest',
   'getAccount',
-  'upsertDeviceAccount',
   'getDeviceAccount',
-  'removeDeviceAccount',
   'listDeviceAccounts',
-  'resetPasswordRequest',
+  'reactivateAccount',
+  'removeDeviceAccount',
   'resetPasswordConfirm',
-  'updateEmailRequest',
+  'resetPasswordRequest',
+  'setAuthorizedClient',
   'updateEmailConfirm',
-  'verifyEmailRequest',
+  'updateEmailRequest',
+  'updateHandle',
+  'upsertDeviceAccount',
   'verifyEmailConfirm',
+  'verifyEmailRequest',
   'verifyHandleAvailability',
-  'updateHandle',
 ])
 
 export function asAccountStore<V>(implementation: V): V & AccountStore {

package/src/device/device-store.ts

@@ -18,9 +18,9 @@ export interface DeviceStore {
 
 export const isDeviceStore = buildInterfaceChecker<DeviceStore>([
   'createDevice',
+  'deleteDevice',
   'readDevice',
   'updateDevice',
-  'deleteDevice',
 ])
 
 export function asDeviceStore<V>(implementation: V): V & DeviceStore {

package/src/errors/invalid-credentials-error.ts

@@ -1,4 +1,4 @@
-import { Sub } from '../oidc/sub.js'
+import { Did } from '@atproto/did'
 import { InvalidRequestError } from './invalid-request-error.js'
 
 /**
@@ -6,22 +6,22 @@ import { InvalidRequestError } from './invalid-request-error.js'
  * that a sign-in attempt was rejected because the provided credentials did not
  * match a known account.
  *
- * Stores should populate {@link InvalidCredentialsError.sub} when the
- * identifier resolved to an existing account but e.g. the password or OTP was
- * incorrect. The identifier-unknown case should leave `sub` unset. This
- * information is surfaced to the `onSignInFailed` hook and never sent back to
- * the client, so populating it does not affect the client-visible response.
+ * Stores should populate {@link did}. when the identifier resolved to an
+ * existing account but e.g. the password or OTP was incorrect. The
+ * identifier-unknown case should leave {@link did} unset. This information is
+ * surfaced to the `onSignInFailed` hook and never sent back to the client, so
+ * populating it does not affect the client-visible response.
  *
  * Only the subject identifier (DID) is carried — not a full `Account` — to
  * avoid embedding PII (email, name, etc.) in an error that may be serialized
  * by loggers or monitoring tools walking the `.cause` chain. Hook consumers
  * that need richer profile info can resolve it from their own account store
- * using `sub`.
+ * using {@link did}.
  */
 export class InvalidCredentialsError extends InvalidRequestError {
   constructor(
     message = 'Invalid identifier or password',
-    public readonly sub?: Sub,
+    public readonly did?: Did,
     cause?: unknown,
   ) {
     super(message, cause)

package/src/lexicon/lexicon-store.ts

@@ -10,9 +10,9 @@ export interface LexiconStore {
 }
 
 export const isLexiconStore = buildInterfaceChecker<LexiconStore>([
+  'deleteLexicon',
   'findLexicon',
   'storeLexicon',
-  'deleteLexicon',
 ])
 
 export function ifLexiconStore<V extends Partial<LexiconStore>>(

package/src/lib/util/function.ts

@@ -16,8 +16,8 @@ export async function callAsync<F extends (...args: any[]) => unknown>(
 export async function callAsync<F extends (...args: any[]) => unknown>(
   fn?: F,
   ...args: Parameters<F>
-): Promise<Awaited<ReturnType<F>> | undefined> {
-  return (await fn?.(...args)) as Awaited<ReturnType<F>> | undefined
+): Promise<unknown> {
+  return fn?.(...args)
 }
 
 export function invokeOnce<T extends (this: any, ...a: any[]) => any>(

package/src/oauth-hooks.ts

@@ -1,3 +1,4 @@
+import { Did } from '@atproto/did'
 import { Jwks } from '@atproto/jwk'
 import type { Account } from '@atproto/oauth-provider-api'
 import {
@@ -9,6 +10,7 @@ import {
   OAuthTokenType,
 } from '@atproto/oauth-types'
 import {
+  DeleteAccountConfirmInput,
   ResetPasswordConfirmInput,
   ResetPasswordRequestInput,
   SignUpData,
@@ -38,7 +40,6 @@ import {
 } from './lib/hcaptcha.js'
 import { RequestMetadata } from './lib/http/request.js'
 import { Awaitable, OmitKey } from './lib/util/type.js'
-import { Sub } from './oidc/sub.js'
 import { RequestId } from './request/request-id.js'
 import { AccessTokenPayload } from './signer/access-token-payload.js'
 import { TokenClaims } from './token/token-claims.js'
@@ -55,6 +56,7 @@ export {
   type ClientId,
   type ClientInfo,
   type DeviceId,
+  type Did,
   type DpopProof,
   type HcaptchaClientTokens,
   type HcaptchaConfig,
@@ -75,7 +77,6 @@ export {
   type SignInData,
   type SignUpData,
   type SignUpInput,
-  type Sub,
   type TokenClaims,
   type UpdateHandleData,
 }
@@ -208,6 +209,87 @@ export type OAuthHooks = {
     account: Account
   }) => Awaitable<void>
 
+  /**
+   * This hook is called when a user requests account deactivation, before the
+   * account is deactivated on the account store.
+   */
+  onDeactivateAccount?: (data: {
+    deviceId: DeviceId
+    deviceMetadata: RequestMetadata
+    account: Account
+  }) => Awaitable<void>
+
+  /**
+   * This hook is called after a user successfully deactivated their account on
+   * the account store.
+   */
+  onDeactivatedAccount?: (data: {
+    deviceId: DeviceId
+    deviceMetadata: RequestMetadata
+    account: Account
+  }) => Awaitable<void>
+
+  /**
+   * This hook is called when a user requests account reactivation, before the
+   * account is reactivated on the account store.
+   */
+  onReactivateAccount?: (data: {
+    deviceId: DeviceId
+    deviceMetadata: RequestMetadata
+    account: Account
+  }) => Awaitable<void>
+
+  /**
+   * This hook is called after a user successfully reactivated their account on
+   * the account store.
+   */
+  onReactivatedAccount?: (data: {
+    deviceId: DeviceId
+    deviceMetadata: RequestMetadata
+    account: Account
+  }) => Awaitable<void>
+
+  /**
+   * This hook is called when a user requests account deletion, before the
+   * confirmation email is dispatched on the account store.
+   */
+  onDeleteAccountRequest?: (data: {
+    deviceId: DeviceId
+    deviceMetadata: RequestMetadata
+    account: Account
+  }) => Awaitable<void>
+
+  /**
+   * This hook is called after a user has requested account deletion and the
+   * confirmation email has been dispatched.
+   */
+  onDeleteAccountRequested?: (data: {
+    deviceId: DeviceId
+    deviceMetadata: RequestMetadata
+    account: Account
+  }) => Awaitable<void>
+
+  /**
+   * This hook is called when a user confirms account deletion, before the
+   * account is actually deleted on the account store.
+   */
+  onDeleteAccountConfirm?: (data: {
+    deviceId: DeviceId
+    deviceMetadata: RequestMetadata
+    account: Account
+  }) => Awaitable<void>
+
+  /**
+   * This hook is called after a user has successfully deleted their account
+   * on the account store.
+   */
+  onDeleteAccountConfirmed?: (data: {
+    deviceId: DeviceId
+    deviceMetadata: RequestMetadata
+    account: Account
+    input: DeleteAccountConfirmInput
+  }) => Awaitable<void>
+
   /**
    * This hook is called when a user attempts to sign up, after every validation
    * has passed (including hcaptcha).
@@ -336,7 +418,7 @@ export type OAuthHooks = {
   onSignInFailed?: (data: {
     data: SignInData
     error: InvalidRequestError
-    sub: Sub | null
+    did: Did | null
     deviceId: DeviceId
     deviceMetadata: RequestMetadata
     clientId?: ClientId

package/src/oauth-provider.ts

@@ -642,6 +642,10 @@ export class OAuthProvider extends OAuthVerifier {
         throw new AccountSelectionRequiredError(parameters)
       }
 
+      const ssoSessions = sessions
+        .filter(hasActiveAccount)
+        .filter(matchesHint, parameters)
+
       // prompt=none
       //
       // > The Authorization Server MUST NOT display any authentication or
@@ -653,7 +657,6 @@ export class OAuthProvider extends OAuthVerifier {
       // > Section 3.1.2.6. This can be used as a method to check for existing
       // > authentication and/or consent.
       if (parameters.prompt === 'none') {
-        const ssoSessions = sessions.filter(matchesHint, parameters)
         if (ssoSessions.length > 1) {
           throw new AccountSelectionRequiredError(parameters)
         }
@@ -682,7 +685,6 @@ export class OAuthProvider extends OAuthVerifier {
 
       // Automatic SSO when a hint was provided that matches a single session
       if (parameters.prompt == null && parameters.login_hint != null) {
-        const ssoSessions = sessions.filter(matchesHint, parameters)
         if (ssoSessions.length === 1) {
           const ssoSession = ssoSessions[0]!
           if (!ssoSession.loginRequired && !ssoSession.consentRequired) {
@@ -704,12 +706,14 @@ export class OAuthProvider extends OAuthVerifier {
         client,
         parameters,
         requestUri,
-        sessions,
-        selectedSub:
+        sessions: sessions
+          // Strip un-necessary information (like consentRequired)
+          .map(({ account, loginRequired }) => ({ account, loginRequired })),
+        selectedDid:
           parameters.prompt == null ||
           parameters.prompt === 'login' ||
           parameters.prompt === 'consent'
-            ? sessions.find(matchesHint, parameters)?.account.sub
+            ? sessions.find(matchesHint, parameters)?.account.did
             : undefined,
         permissionSets: await this.lexiconManager
           .getPermissionSetsFromScope(parameters.scope)
@@ -884,9 +888,9 @@ export class OAuthProvider extends OAuthVerifier {
             // As an additional security measure, we also sign the device out,
             // so that the device cannot be used to access the account anymore
             // without a new authentication.
-            const { deviceId, sub } = tokenInfo.data
+            const { deviceId, did } = tokenInfo.data
             if (deviceId) {
-              await this.accountManager.removeDeviceAccount(deviceId, sub)
+              await this.accountManager.removeDeviceAccount(deviceId, did)
             }
           }
         }
@@ -912,7 +916,7 @@ export class OAuthProvider extends OAuthVerifier {
 
     await this.validateCodeGrant(parameters, input)
 
-    const { account } = await this.accountManager.getAccount(data.sub)
+    const { account } = await this.accountManager.getAccount(data.did)
 
     return this.tokenManager.createToken(
       client,
@@ -1098,5 +1102,9 @@ function matchesHint(
   const hint = this.login_hint
   if (!hint) return false
 
-  return account.sub === hint || account.preferred_username === hint
+  return account.did === hint || account.handle === hint
+}
+
+function hasActiveAccount({ account }: { account: Account }): boolean {
+  return !account.deactivated
 }

package/src/request/request-data.ts

@@ -1,9 +1,9 @@
+import { Did } from '@atproto/did'
 import { OAuthAuthorizationRequestParameters } from '@atproto/oauth-types'
 import { ClientAuth, ClientAuthLegacy } from '../client/client-auth.js'
 import { ClientId } from '../client/client-id.js'
 import { DeviceId } from '../device/device-id.js'
 import { NonNullableKeys } from '../lib/util/type.js'
-import { Sub } from '../oidc/sub.js'
 import { Code } from './code.js'
 
 export type {
@@ -12,8 +12,8 @@ export type {
   ClientId,
   Code,
   DeviceId,
+  Did,
   OAuthAuthorizationRequestParameters,
-  Sub,
 }
 
 export type RequestData = {
@@ -22,15 +22,15 @@ export type RequestData = {
   parameters: Readonly<OAuthAuthorizationRequestParameters>
   expiresAt: Date
   deviceId: DeviceId | null
-  sub: Sub | null
+  did: Did | null
   code: Code | null
 }
 
 export type RequestDataAuthorized = NonNullableKeys<
   RequestData,
-  'sub' | 'deviceId'
+  'did' | 'deviceId'
 >
 
 export const isRequestDataAuthorized = (
   data: RequestData,
-): data is RequestDataAuthorized => data.sub !== null && data.deviceId !== null
+): data is RequestDataAuthorized => data.did !== null && data.deviceId !== null

package/src/request/request-manager.ts

@@ -78,7 +78,7 @@ export class RequestManager {
       parameters,
       expiresAt,
       deviceId,
-      sub: null,
+      did: null,
       code: null,
     })
 
@@ -337,7 +337,7 @@ export class RequestManager {
     const updates: UpdateRequestData = {}
 
     try {
-      if (data.sub || data.code) {
+      if (data.did || data.code) {
         // If an account was linked to the request, the next step is to exchange
         // the code for a token.
         throw new AccessDeniedError(
@@ -404,6 +404,13 @@ export class RequestManager {
     let { parameters } = data
 
     try {
+      if (account.deactivated) {
+        throw new AccessDeniedError(
+          parameters,
+          'This account has been deactivated',
+        )
+      }
+
       if (data.expiresAt < new Date()) {
         throw new AccessDeniedError(parameters, 'This request has expired')
       }
@@ -419,7 +426,7 @@ export class RequestManager {
           'This request was initiated from another device',
         )
       }
-      if (data.sub || data.code) {
+      if (data.did || data.code) {
         throw new AccessDeniedError(
           parameters,
           'This request was already authorized',
@@ -453,7 +460,7 @@ export class RequestManager {
 
       // Bind the request to the account, preventing it from being used again.
       await this.store.updateRequest(requestId, {
-        sub: account.sub,
+        did: account.did,
         code,
         // Allow the client to exchange the code for a token within the next 60 seconds.
         expiresAt: new Date(Date.now() + AUTHORIZATION_INACTIVITY_TIMEOUT),

package/src/request/request-store.ts

@@ -12,7 +12,7 @@ export type { Awaitable }
 
 export type UpdateRequestData = Pick<
   Partial<RequestData>,
-  'sub' | 'code' | 'deviceId' | 'expiresAt' | 'parameters'
+  'did' | 'code' | 'deviceId' | 'expiresAt' | 'parameters'
 >
 
 export type FoundRequestResult = {
@@ -43,11 +43,11 @@ export interface RequestStore {
 }
 
 export const isRequestStore = buildInterfaceChecker<RequestStore>([
+  'consumeRequestCode',
   'createRequest',
+  'deleteRequest',
   'readRequest',
   'updateRequest',
-  'deleteRequest',
-  'consumeRequestCode',
 ])
 
 export function asRequestStore<V extends Partial<RequestStore>>(

package/src/result/authorization-result-authorize-page.ts

@@ -12,5 +12,5 @@ export type AuthorizationResultAuthorizePage = {
 
   requestUri: RequestUri
   sessions: readonly Session[]
-  selectedSub?: Account['sub']
+  selectedDid?: Account['did']
 }

package/src/router/assets/send-authorization-page.ts

@@ -33,7 +33,7 @@ export function sendAuthorizePageFactory(
           loginHint: data.parameters.login_hint,
           promptMode: data.parameters.prompt,
           permissionSets: Object.fromEntries(data.permissionSets),
-          selectedSub: data.selectedSub,
+          selectedDid: data.selectedDid,
         },
         __sessions: data.sessions,
       },