@atproto/oauth-provider 0.18.3 → 0.19.0

package/src/router/create-api-middleware.ts

@@ -1,6 +1,7 @@
 import type { IncomingMessage, ServerResponse } from 'node:http'
 import createHttpError from 'http-errors'
 import { z } from 'zod'
+import { Did, didSchema } from '@atproto/did'
 import { signedJwtSchema } from '@atproto/jwk'
 import {
   API_ENDPOINT_PREFIX,
@@ -16,6 +17,7 @@ import {
   OAuthResponseMode,
   oauthRedirectUriSchema,
   oauthResponseModeSchema,
+  oauthScopeSchema,
 } from '@atproto/oauth-types'
 import { signInDataSchema } from '../account/sign-in-data.js'
 import { signUpInputSchema } from '../account/sign-up-input.js'
@@ -49,14 +51,13 @@ import { asArray } from '../lib/util/cast.js'
 import { localeSchema } from '../lib/util/locale.js'
 import type { Awaitable } from '../lib/util/type.js'
 import type { OAuthProvider } from '../oauth-provider.js'
-import { Sub, subSchema } from '../oidc/sub.js'
 import { RequestUri, requestUriSchema } from '../request/request-uri.js'
 import { AuthorizationRedirectParameters } from '../result/authorization-redirect-parameters.js'
 import { tokenIdSchema } from '../token/token-id.js'
 import { emailOtpSchema } from '../types/email-otp.js'
 import { emailSchema } from '../types/email.js'
 import { handleSchema } from '../types/handle.js'
-import { newPasswordSchema } from '../types/password.js'
+import { newPasswordSchema, oldPasswordSchema } from '../types/password.js'
 import { validateCsrfToken } from './assets/csrf.js'
 import {
   ERROR_REDIRECT_KEYS,
@@ -69,8 +70,6 @@ import {
 } from './assets/send-redirect.js'
 import type { MiddlewareOptions } from './middleware-options.js'
 
-const verifyHandleSchema = z.object({ handle: handleSchema }).strict()
-
 export function createApiMiddleware<
   Ctx extends object | void = void,
   Req extends IncomingMessage = IncomingMessage,
@@ -87,7 +86,7 @@ export function createApiMiddleware<
     apiRoute({
       method: 'POST',
       endpoint: '/verify-handle-availability',
-      schema: verifyHandleSchema,
+      schema: z.object({ handle: handleSchema }).strict(),
       async handler() {
         await server.accountManager.verifyHandleAvailability(this.input.handle)
         return { json: { available: true } }
@@ -116,13 +115,13 @@ export function createApiMiddleware<
         // Only "remember" the newly created account if it was not created during an
         // OAuth flow.
         if (remember) {
-          await server.accountManager.upsertDeviceAccount(deviceId, account.sub)
+          await server.accountManager.upsertDeviceAccount(deviceId, account.did)
         }
 
         const ephemeralToken = remember
           ? undefined
           : await server.signer.createEphemeralToken({
-              sub: account.sub,
+              sub: account.did,
               deviceId,
               requestUri: this.requestUri,
             })
@@ -159,46 +158,21 @@ export function createApiMiddleware<
         )
 
         if (remember) {
-          await server.accountManager.upsertDeviceAccount(deviceId, account.sub)
+          await server.accountManager.upsertDeviceAccount(deviceId, account.did)
         } else {
           // In case the user was already signed in, and signed in again, this
           // time without "remember me", let's sign them off of the device.
-          await server.accountManager.removeDeviceAccount(deviceId, account.sub)
+          await server.accountManager.removeDeviceAccount(deviceId, account.did)
         }
 
         const ephemeralToken = remember
           ? undefined
           : await server.signer.createEphemeralToken({
-              sub: account.sub,
+              sub: account.did,
               deviceId,
               requestUri,
             })
 
-        if (requestUri) {
-          // Check if a consent is required for the client, but only if this
-          // call is made within the context of an oauth request.
-
-          const { clientId, parameters } = await server.requestManager.get(
-            requestUri,
-            deviceId,
-          )
-
-          const { authorizedClients } = await server.accountManager.getAccount(
-            account.sub,
-          )
-
-          const json = {
-            account,
-            ephemeralToken,
-            consentRequired: server.checkConsentRequired(
-              parameters,
-              authorizedClients.get(clientId),
-            ),
-          }
-
-          return { json }
-        }
-
         const json = { account, ephemeralToken }
         return { json }
       },
@@ -211,12 +185,12 @@ export function createApiMiddleware<
       endpoint: '/sign-out',
       schema: z
         .object({
-          sub: z.union([subSchema, z.array(subSchema)]),
+          did: z.union([didSchema, z.array(didSchema)]),
         })
         .strict(),
       rotateDeviceCookies: true,
       async handler() {
-        const uniqueSubs = new Set(asArray(this.input.sub))
+        const uniqueSubs = new Set(asArray(this.input.did))
 
         for (const sub of uniqueSubs) {
           await server.accountManager.removeDeviceAccount(this.deviceId, sub)
@@ -275,7 +249,7 @@ export function createApiMiddleware<
       endpoint: '/update-email-request',
       schema: z
         .object({
-          sub: subSchema,
+          did: didSchema,
           locale: localeSchema.optional(),
         })
         .strict(),
@@ -301,23 +275,23 @@ export function createApiMiddleware<
       endpoint: '/update-email-confirm',
       schema: z
         .object({
-          sub: subSchema,
+          did: didSchema,
           email: emailSchema,
           token: emailOtpSchema.optional(),
           locale: localeSchema.optional(),
         })
         .strict(),
       async handler(req, res) {
-        const { account } = await authenticate.call(this, req, res)
+        let { account } = await authenticate.call(this, req, res)
 
-        await server.accountManager.updateEmailConfirm(
+        account = await server.accountManager.updateEmailConfirm(
           this.deviceId,
           this.deviceMetadata,
           this.input,
           account,
         )
 
-        return { json: { success: true } }
+        return { json: { account } }
       },
     }),
   )
@@ -328,7 +302,7 @@ export function createApiMiddleware<
       endpoint: '/verify-email-request',
       schema: z
         .object({
-          sub: subSchema,
+          did: didSchema,
           locale: localeSchema.optional(),
         })
         .strict(),
@@ -353,22 +327,22 @@ export function createApiMiddleware<
       endpoint: '/verify-email-confirm',
       schema: z
         .object({
-          sub: subSchema,
+          did: didSchema,
           token: emailOtpSchema,
           email: emailSchema,
         })
         .strict(),
       async handler(req, res) {
-        const { account } = await authenticate.call(this, req, res)
+        let { account } = await authenticate.call(this, req, res)
 
-        await server.accountManager.verifyEmailConfirm(
+        account = await server.accountManager.verifyEmailConfirm(
           this.deviceId,
           this.deviceMetadata,
           this.input,
           account,
         )
 
-        return { json: { success: true } }
+        return { json: { account } }
       },
     }),
   )
@@ -379,14 +353,104 @@ export function createApiMiddleware<
       endpoint: '/update-handle',
       schema: z
         .object({
-          sub: subSchema,
+          did: didSchema,
           handle: handleSchema,
         })
         .strict(),
+      async handler(req, res) {
+        let { account } = await authenticate.call(this, req, res)
+
+        account = await server.accountManager.updateHandle(
+          this.deviceId,
+          this.deviceMetadata,
+          this.input,
+          account,
+        )
+
+        return { json: { account } }
+      },
+    }),
+  )
+
+  router.use(
+    apiRoute({
+      method: 'POST',
+      endpoint: '/deactivate-account',
+      schema: z.object({ did: didSchema }).strict(),
+      async handler(req, res) {
+        let { account } = await authenticate.call(this, req, res)
+
+        if (!account.deactivated) {
+          account = await server.accountManager.deactivateAccount(
+            this.deviceId,
+            this.deviceMetadata,
+            account,
+          )
+        }
+
+        return { json: { account } }
+      },
+    }),
+  )
+
+  router.use(
+    apiRoute({
+      method: 'POST',
+      endpoint: '/reactivate-account',
+      schema: z.object({ did: didSchema }).strict(),
+      async handler(req, res) {
+        let { account } = await authenticate.call(this, req, res)
+
+        if (account.deactivated) {
+          account = await server.accountManager.reactivateAccount(
+            this.deviceId,
+            this.deviceMetadata,
+            account,
+          )
+        }
+
+        return { json: { account } }
+      },
+    }),
+  )
+
+  router.use(
+    apiRoute({
+      method: 'POST',
+      endpoint: '/delete-account-request',
+      schema: z
+        .object({ did: didSchema, locale: localeSchema.optional() })
+        .strict(),
+      async handler(req, res) {
+        const { account } = await authenticate.call(this, req, res)
+
+        await server.accountManager.deleteAccountRequest(
+          this.deviceId,
+          this.deviceMetadata,
+          this.input,
+          account,
+        )
+
+        return { json: { success: true } }
+      },
+    }),
+  )
+
+  router.use(
+    apiRoute({
+      method: 'POST',
+      endpoint: '/delete-account-confirm',
+      schema: z
+        .object({
+          did: didSchema,
+          token: emailOtpSchema,
+          password: oldPasswordSchema,
+        })
+        .strict(),
       async handler(req, res) {
         const { account } = await authenticate.call(this, req, res)
 
-        await server.accountManager.updateHandle(
+        await server.accountManager.deleteAccountConfirm(
           this.deviceId,
           this.deviceMetadata,
           this.input,
@@ -424,12 +488,12 @@ export function createApiMiddleware<
     apiRoute({
       method: 'GET',
       endpoint: '/oauth-sessions',
-      schema: z.object({ sub: subSchema }).strict(),
+      schema: z.object({ did: didSchema }).strict(),
       async handler(req, res) {
         const { account } = await authenticate.call(this, req, res)
 
         const tokenInfos = await server.tokenManager.listAccountTokens(
-          account.sub,
+          account.did,
         )
 
         const clientIds = tokenInfos.map((tokenInfo) => tokenInfo.data.clientId)
@@ -468,12 +532,12 @@ export function createApiMiddleware<
     apiRoute({
       method: 'GET',
       endpoint: '/account-sessions',
-      schema: z.object({ sub: subSchema }).strict(),
+      schema: z.object({ did: didSchema }).strict(),
       async handler(req, res) {
         const { account } = await authenticate.call(this, req, res)
 
         const deviceAccounts = await server.accountManager.listAccountDevices(
-          account.sub,
+          account.did,
         )
 
         const json = deviceAccounts.map(
@@ -499,7 +563,7 @@ export function createApiMiddleware<
     apiRoute({
       method: 'POST',
       endpoint: '/revoke-account-session',
-      schema: z.object({ sub: subSchema, deviceId: deviceIdSchema }).strict(),
+      schema: z.object({ did: didSchema, deviceId: deviceIdSchema }).strict(),
       async handler() {
         // @NOTE This route is not authenticated. If a user is able to steal
         // another user's session cookie, we allow them to revoke the device
@@ -507,7 +571,7 @@ export function createApiMiddleware<
 
         await server.accountManager.removeDeviceAccount(
           this.input.deviceId,
-          this.input.sub,
+          this.input.did,
         )
 
         return { json: { success: true } }
@@ -519,7 +583,7 @@ export function createApiMiddleware<
     apiRoute({
       method: 'POST',
       endpoint: '/revoke-oauth-session',
-      schema: z.object({ sub: subSchema, tokenId: tokenIdSchema }).strict(),
+      schema: z.object({ did: didSchema, tokenId: tokenIdSchema }).strict(),
       async handler(req, res) {
         const { account } = await authenticate.call(this, req, res)
 
@@ -527,7 +591,7 @@ export function createApiMiddleware<
           this.input.tokenId,
         )
 
-        if (!tokenInfo || tokenInfo.account.sub !== account.sub) {
+        if (!tokenInfo || tokenInfo.account.did !== account.did) {
           // report this as though the token was not found
           throw new InvalidRequestError(`Invalid token`)
         }
@@ -544,10 +608,7 @@ export function createApiMiddleware<
       method: 'POST',
       endpoint: '/consent',
       schema: z
-        .object({
-          sub: z.union([subSchema, signedJwtSchema]),
-          scope: z.string().optional(),
-        })
+        .object({ did: didSchema, scope: oauthScopeSchema.optional() })
         .strict(),
       async handler(req, res) {
         if (!this.requestUri) {
@@ -710,7 +771,7 @@ export function createApiMiddleware<
   return router.buildMiddleware()
 
   async function authenticate(
-    this: ApiContext<void, { sub: Sub }>,
+    this: ApiContext<void, { did: Did }>,
     req: Req,
     _res: Res,
   ) {
@@ -724,7 +785,7 @@ export function createApiMiddleware<
           await server.signer.verifyEphemeralToken(ephemeralToken)
 
         if (
-          payload.sub === this.input.sub &&
+          payload.sub === this.input.did &&
           payload.deviceId === this.deviceId &&
           payload.requestUri === this.requestUri
         ) {
@@ -744,7 +805,7 @@ export function createApiMiddleware<
       // Ensures the "sub" has an active session on the device
       const deviceAccount = await server.accountManager.getDeviceAccount(
         this.deviceId,
-        this.input.sub,
+        this.input.did,
       )
 
       // The session exists but was created too long ago
@@ -756,7 +817,7 @@ export function createApiMiddleware<
     } catch (err) {
       throw new WWWAuthenticateError(
         'unauthorized',
-        `User ${this.input.sub} not authenticated on this device`,
+        `User ${this.input.did} not authenticated on this device`,
         { Bearer: {} },
         err,
       )
@@ -803,9 +864,9 @@ export function createApiMiddleware<
       }[keyof ApiEndpoints],
     S extends // A schema that validates the POST input or GET params
       ApiEndpoints[E] extends { method: 'POST'; input: infer I }
-        ? z.ZodType<I>
+        ? z.ZodType<I, z.ZodTypeDef, unknown>
         : ApiEndpoints[E] extends { method: 'GET'; params: infer P }
-          ? z.ZodType<P>
+          ? z.ZodType<P, z.ZodTypeDef, unknown>
           : void,
   >(options: {
     method: M

package/src/signer/access-token-payload.ts

@@ -1,7 +1,7 @@
 import { z } from 'zod'
+import { didSchema } from '@atproto/did'
 import { jwtPayloadSchema } from '@atproto/jwk'
 import { clientIdSchema } from '../client/client-id.js'
-import { subSchema } from '../oidc/sub.js'
 import { tokenIdSchema } from '../token/token-id.js'
 
 export const accessTokenPayloadSchema = jwtPayloadSchema
@@ -9,7 +9,7 @@ export const accessTokenPayloadSchema = jwtPayloadSchema
   .extend({
     // Following are required
     jti: tokenIdSchema,
-    sub: subSchema,
+    sub: didSchema,
     exp: z.number().int(),
     iat: z.number().int(),
     iss: z.string().min(1),

package/src/signer/api-token-payload.ts

@@ -1,12 +1,12 @@
 import { z } from 'zod'
+import { didSchema } from '@atproto/did'
 import { jwtPayloadSchema } from '@atproto/jwk'
 import { deviceIdSchema } from '../oauth-store.js'
-import { subSchema } from '../oidc/sub.js'
 import { requestUriSchema } from '../request/request-uri.js'
 
 export const apiTokenPayloadSchema = jwtPayloadSchema
   .extend({
-    sub: subSchema,
+    sub: didSchema,
 
     deviceId: deviceIdSchema,
     // If the token is bound to a particular authorization request, it can only

package/src/signer/signer.ts

@@ -1,10 +1,13 @@
 import {
+  JwtHeader,
   JwtPayload,
   JwtPayloadGetter,
   JwtSignHeader,
+  Key,
   Keyset,
   SignedJwt,
   VerifyOptions,
+  VerifyResult,
 } from '@atproto/jwk'
 import { EPHEMERAL_SESSION_MAX_AGE } from '../constants.js'
 import { dateToEpoch } from '../lib/util/date.js'
@@ -29,7 +32,7 @@ export class Signer {
   async verify<C extends string = never>(
     token: SignedJwt,
     options?: Omit<VerifyOptions<C>, 'issuer'>,
-  ) {
+  ): Promise<VerifyResult<C> & { key: Key }> {
     return this.keyset.verifyJwt<C>(token, {
       ...options,
       issuer: [this.issuer],
@@ -64,7 +67,10 @@ export class Signer {
   async verifyAccessToken<C extends string = never>(
     token: SignedJwt,
     options?: Omit<VerifyOptions<C>, 'issuer' | 'typ'>,
-  ) {
+  ): Promise<{
+    protectedHeader: JwtHeader
+    payload: RequiredKey<AccessTokenPayload, C>
+  }> {
     const result = await this.verify<C>(token, { ...options, typ: 'at+jwt' })
     return {
       protectedHeader: result.protectedHeader,
@@ -77,7 +83,7 @@ export class Signer {
 
   async createEphemeralToken(
     payload: OmitKey<ApiTokenPayload, 'iss' | 'aud' | 'iat'>,
-  ) {
+  ): Promise<SignedJwt> {
     return this.sign(
       {
         alg: undefined,
@@ -94,7 +100,10 @@ export class Signer {
   async verifyEphemeralToken<C extends string = never>(
     token: SignedJwt,
     options?: Omit<VerifyOptions<C>, 'issuer' | 'audience' | 'typ'>,
-  ) {
+  ): Promise<{
+    protectedHeader: JwtHeader
+    payload: RequiredKey<ApiTokenPayload, C>
+  }> {
     const result = await this.verify<C>(token, {
       ...options,
       maxTokenAge: options?.maxTokenAge ?? EPHEMERAL_SESSION_MAX_AGE / 1e3,

package/src/token/token-claims.ts

@@ -1,3 +1,4 @@
+import { Did } from '@atproto/did'
 import { OAuthScope } from '@atproto/oauth-types'
 import { ClientId } from '../client/client-id.js'
 import { TokenId } from './token-id.js'
@@ -11,7 +12,7 @@ import { TokenId } from './token-id.js'
  */
 export type TokenClaims = {
   jti: TokenId
-  sub: string
+  sub: Did
   iat: number
   exp: number
   aud: string | [string, ...string[]]

package/src/token/token-data.ts

@@ -1,3 +1,4 @@
+import { Did } from '@atproto/did'
 import {
   OAuthAuthorizationDetails,
   OAuthAuthorizationRequestParameters,
@@ -5,7 +6,6 @@ import {
 import { ClientAuth, ClientAuthLegacy } from '../client/client-auth.js'
 import { ClientId } from '../client/client-id.js'
 import { DeviceId } from '../device/device-id.js'
-import { Sub } from '../oidc/sub.js'
 import { Code } from '../request/code.js'
 
 export type {
@@ -13,9 +13,9 @@ export type {
   ClientId,
   Code,
   DeviceId,
+  Did,
   OAuthAuthorizationDetails,
   OAuthAuthorizationRequestParameters,
-  Sub,
 }
 
 export type TokenData = {
@@ -25,7 +25,7 @@ export type TokenData = {
   clientId: ClientId
   clientAuth: ClientAuth | ClientAuthLegacy
   deviceId: DeviceId | null
-  sub: Sub
+  did: Did
   parameters: OAuthAuthorizationRequestParameters
   details?: null // Legacy field, not used
   code: Code | null

package/src/token/token-manager.ts

@@ -1,3 +1,4 @@
+import type { Did } from '@atproto/did'
 import { SignedJwt, isSignedJwt } from '@atproto/jwk'
 import { LexResolverError } from '@atproto/lex-resolver'
 import type { Account } from '@atproto/oauth-provider-api'
@@ -20,7 +21,6 @@ import { LexiconManager } from '../lexicon/lexicon-manager.js'
 import { RequestMetadata } from '../lib/http/request.js'
 import { dateToEpoch, dateToRelativeSeconds } from '../lib/util/date.js'
 import { OAuthHooks } from '../oauth-hooks.js'
-import { Sub } from '../oidc/sub.js'
 import { Code, isCode } from '../request/code.js'
 import { AccessTokenPayload } from '../signer/access-token-payload.js'
 import { Signer } from '../signer/signer.js'
@@ -61,10 +61,10 @@ export class TokenManager {
   ): Promise<OAuthAccessToken> {
     const claims: TokenClaims = {
       jti: tokenId,
-      sub: account.sub,
+      sub: account.did,
       iat: dateToEpoch(issuedAt),
       exp: dateToEpoch(expiresAt),
-      aud: account.aud,
+      aud: account.pds,
 
       ...(parameters.dpop_jkt && {
         cnf: { jkt: parameters.dpop_jkt },
@@ -136,7 +136,7 @@ export class TokenManager {
       accessToken,
       refreshToken,
       expiresAt,
-      account.sub,
+      account.did,
       scope,
     )
 
@@ -147,7 +147,7 @@ export class TokenManager {
       clientId: client.id,
       clientAuth,
       deviceId,
-      sub: account.sub,
+      did: account.did,
       parameters,
       details: null,
       scope,
@@ -191,7 +191,7 @@ export class TokenManager {
     accessToken: OAuthAccessToken,
     refreshToken: string | undefined,
     expiresAt: Date,
-    sub: Sub,
+    did: Did,
     scope: string,
   ): OAuthTokenResponse {
     return {
@@ -209,7 +209,7 @@ export class TokenManager {
       // ATPROTO extension: add the sub claim to the token response to allow
       // clients to resolve the PDS url (audience) using the did resolution
       // mechanism.
-      sub,
+      sub: did,
     }
   }
 
@@ -263,7 +263,7 @@ export class TokenManager {
       accessToken,
       nextRefreshToken,
       expiresAt,
-      account.sub,
+      account.did,
       scope,
     )
 
@@ -305,10 +305,10 @@ export class TokenManager {
     if (!tokenInfo) return null
 
     // Fool-proof: Invalid store implementation ?
-    if (payload.sub !== tokenInfo.account.sub) {
+    if (payload.sub !== tokenInfo.account.did) {
       await this.deleteToken(tokenInfo.id)
       throw new Error(
-        `Account sub (${tokenInfo.account.sub}) does not match token sub (${payload.sub})`,
+        `Account sub (${tokenInfo.account.did}) does not match token sub (${payload.sub})`,
       )
     }
 
@@ -395,20 +395,20 @@ export class TokenManager {
 
     return {
       jti: tokenId,
-      sub: account.sub,
+      sub: account.did,
       iat: dateToEpoch(data.updatedAt),
       exp: dateToEpoch(data.expiresAt),
-      aud: account.aud,
+      aud: account.pds,
       scope: data.scope ?? data.parameters.scope,
       // https://datatracker.ietf.org/doc/html/rfc8693#section-4.3
       client_id: data.clientId,
     }
   }
 
-  async listAccountTokens(sub: Sub): Promise<TokenInfo[]> {
-    const results = await this.store.listAccountTokens(sub)
+  async listAccountTokens(did: Did): Promise<TokenInfo[]> {
+    const results = await this.store.listAccountTokens(did)
     return results
-      .filter((tokenInfo) => tokenInfo.account.sub === sub) // Fool proof
+      .filter((tokenInfo) => tokenInfo.account.did === did) // Fool proof
       .filter((tokenInfo) => !isCurrentTokenExpired(tokenInfo))
   }
 }