@atproto/oauth-provider 0.18.4 → 0.19.0

package/src/request/request-data.ts

@@ -1,9 +1,9 @@
+import { Did } from '@atproto/did'
 import { OAuthAuthorizationRequestParameters } from '@atproto/oauth-types'
 import { ClientAuth, ClientAuthLegacy } from '../client/client-auth.js'
 import { ClientId } from '../client/client-id.js'
 import { DeviceId } from '../device/device-id.js'
 import { NonNullableKeys } from '../lib/util/type.js'
-import { Sub } from '../oidc/sub.js'
 import { Code } from './code.js'
 
 export type {
@@ -12,8 +12,8 @@ export type {
   ClientId,
   Code,
   DeviceId,
+  Did,
   OAuthAuthorizationRequestParameters,
-  Sub,
 }
 
 export type RequestData = {
@@ -22,15 +22,15 @@ export type RequestData = {
   parameters: Readonly<OAuthAuthorizationRequestParameters>
   expiresAt: Date
   deviceId: DeviceId | null
-  sub: Sub | null
+  did: Did | null
   code: Code | null
 }
 
 export type RequestDataAuthorized = NonNullableKeys<
   RequestData,
-  'sub' | 'deviceId'
+  'did' | 'deviceId'
 >
 
 export const isRequestDataAuthorized = (
   data: RequestData,
-): data is RequestDataAuthorized => data.sub !== null && data.deviceId !== null
+): data is RequestDataAuthorized => data.did !== null && data.deviceId !== null

package/src/request/request-manager.ts

@@ -78,7 +78,7 @@ export class RequestManager {
       parameters,
       expiresAt,
       deviceId,
-      sub: null,
+      did: null,
       code: null,
     })
 
@@ -337,7 +337,7 @@ export class RequestManager {
     const updates: UpdateRequestData = {}
 
     try {
-      if (data.sub || data.code) {
+      if (data.did || data.code) {
         // If an account was linked to the request, the next step is to exchange
         // the code for a token.
         throw new AccessDeniedError(
@@ -404,6 +404,13 @@ export class RequestManager {
     let { parameters } = data
 
     try {
+      if (account.deactivated) {
+        throw new AccessDeniedError(
+          parameters,
+          'This account has been deactivated',
+        )
+      }
+
       if (data.expiresAt < new Date()) {
         throw new AccessDeniedError(parameters, 'This request has expired')
       }
@@ -419,7 +426,7 @@ export class RequestManager {
           'This request was initiated from another device',
         )
       }
-      if (data.sub || data.code) {
+      if (data.did || data.code) {
         throw new AccessDeniedError(
           parameters,
           'This request was already authorized',
@@ -453,7 +460,7 @@ export class RequestManager {
 
       // Bind the request to the account, preventing it from being used again.
       await this.store.updateRequest(requestId, {
-        sub: account.sub,
+        did: account.did,
         code,
         // Allow the client to exchange the code for a token within the next 60 seconds.
         expiresAt: new Date(Date.now() + AUTHORIZATION_INACTIVITY_TIMEOUT),

package/src/request/request-store.ts

@@ -12,7 +12,7 @@ export type { Awaitable }
 
 export type UpdateRequestData = Pick<
   Partial<RequestData>,
-  'sub' | 'code' | 'deviceId' | 'expiresAt' | 'parameters'
+  'did' | 'code' | 'deviceId' | 'expiresAt' | 'parameters'
 >
 
 export type FoundRequestResult = {

package/src/result/authorization-result-authorize-page.ts

@@ -12,5 +12,5 @@ export type AuthorizationResultAuthorizePage = {
 
   requestUri: RequestUri
   sessions: readonly Session[]
-  selectedSub?: Account['sub']
+  selectedDid?: Account['did']
 }

package/src/router/assets/send-authorization-page.ts

@@ -33,7 +33,7 @@ export function sendAuthorizePageFactory(
           loginHint: data.parameters.login_hint,
           promptMode: data.parameters.prompt,
           permissionSets: Object.fromEntries(data.permissionSets),
-          selectedSub: data.selectedSub,
+          selectedDid: data.selectedDid,
         },
         __sessions: data.sessions,
       },

package/src/router/create-api-middleware.ts

@@ -1,6 +1,7 @@
 import type { IncomingMessage, ServerResponse } from 'node:http'
 import createHttpError from 'http-errors'
 import { z } from 'zod'
+import { Did, didSchema } from '@atproto/did'
 import { signedJwtSchema } from '@atproto/jwk'
 import {
   API_ENDPOINT_PREFIX,
@@ -16,6 +17,7 @@ import {
   OAuthResponseMode,
   oauthRedirectUriSchema,
   oauthResponseModeSchema,
+  oauthScopeSchema,
 } from '@atproto/oauth-types'
 import { signInDataSchema } from '../account/sign-in-data.js'
 import { signUpInputSchema } from '../account/sign-up-input.js'
@@ -49,14 +51,13 @@ import { asArray } from '../lib/util/cast.js'
 import { localeSchema } from '../lib/util/locale.js'
 import type { Awaitable } from '../lib/util/type.js'
 import type { OAuthProvider } from '../oauth-provider.js'
-import { Sub, subSchema } from '../oidc/sub.js'
 import { RequestUri, requestUriSchema } from '../request/request-uri.js'
 import { AuthorizationRedirectParameters } from '../result/authorization-redirect-parameters.js'
 import { tokenIdSchema } from '../token/token-id.js'
 import { emailOtpSchema } from '../types/email-otp.js'
 import { emailSchema } from '../types/email.js'
 import { handleSchema } from '../types/handle.js'
-import { newPasswordSchema } from '../types/password.js'
+import { newPasswordSchema, oldPasswordSchema } from '../types/password.js'
 import { validateCsrfToken } from './assets/csrf.js'
 import {
   ERROR_REDIRECT_KEYS,
@@ -69,8 +70,6 @@ import {
 } from './assets/send-redirect.js'
 import type { MiddlewareOptions } from './middleware-options.js'
 
-const verifyHandleSchema = z.object({ handle: handleSchema }).strict()
-
 export function createApiMiddleware<
   Ctx extends object | void = void,
   Req extends IncomingMessage = IncomingMessage,
@@ -87,7 +86,7 @@ export function createApiMiddleware<
     apiRoute({
       method: 'POST',
       endpoint: '/verify-handle-availability',
-      schema: verifyHandleSchema,
+      schema: z.object({ handle: handleSchema }).strict(),
       async handler() {
         await server.accountManager.verifyHandleAvailability(this.input.handle)
         return { json: { available: true } }
@@ -116,13 +115,13 @@ export function createApiMiddleware<
         // Only "remember" the newly created account if it was not created during an
         // OAuth flow.
         if (remember) {
-          await server.accountManager.upsertDeviceAccount(deviceId, account.sub)
+          await server.accountManager.upsertDeviceAccount(deviceId, account.did)
         }
 
         const ephemeralToken = remember
           ? undefined
           : await server.signer.createEphemeralToken({
-              sub: account.sub,
+              sub: account.did,
               deviceId,
               requestUri: this.requestUri,
             })
@@ -159,46 +158,21 @@ export function createApiMiddleware<
         )
 
         if (remember) {
-          await server.accountManager.upsertDeviceAccount(deviceId, account.sub)
+          await server.accountManager.upsertDeviceAccount(deviceId, account.did)
         } else {
           // In case the user was already signed in, and signed in again, this
           // time without "remember me", let's sign them off of the device.
-          await server.accountManager.removeDeviceAccount(deviceId, account.sub)
+          await server.accountManager.removeDeviceAccount(deviceId, account.did)
         }
 
         const ephemeralToken = remember
           ? undefined
           : await server.signer.createEphemeralToken({
-              sub: account.sub,
+              sub: account.did,
               deviceId,
               requestUri,
             })
 
-        if (requestUri) {
-          // Check if a consent is required for the client, but only if this
-          // call is made within the context of an oauth request.
-
-          const { clientId, parameters } = await server.requestManager.get(
-            requestUri,
-            deviceId,
-          )
-
-          const { authorizedClients } = await server.accountManager.getAccount(
-            account.sub,
-          )
-
-          const json = {
-            account,
-            ephemeralToken,
-            consentRequired: server.checkConsentRequired(
-              parameters,
-              authorizedClients.get(clientId),
-            ),
-          }
-
-          return { json }
-        }
-
         const json = { account, ephemeralToken }
         return { json }
       },
@@ -211,12 +185,12 @@ export function createApiMiddleware<
       endpoint: '/sign-out',
       schema: z
         .object({
-          sub: z.union([subSchema, z.array(subSchema)]),
+          did: z.union([didSchema, z.array(didSchema)]),
         })
         .strict(),
       rotateDeviceCookies: true,
       async handler() {
-        const uniqueSubs = new Set(asArray(this.input.sub))
+        const uniqueSubs = new Set(asArray(this.input.did))
 
         for (const sub of uniqueSubs) {
           await server.accountManager.removeDeviceAccount(this.deviceId, sub)
@@ -275,7 +249,7 @@ export function createApiMiddleware<
       endpoint: '/update-email-request',
       schema: z
         .object({
-          sub: subSchema,
+          did: didSchema,
           locale: localeSchema.optional(),
         })
         .strict(),
@@ -301,23 +275,23 @@ export function createApiMiddleware<
       endpoint: '/update-email-confirm',
       schema: z
         .object({
-          sub: subSchema,
+          did: didSchema,
           email: emailSchema,
           token: emailOtpSchema.optional(),
           locale: localeSchema.optional(),
         })
         .strict(),
       async handler(req, res) {
-        const { account } = await authenticate.call(this, req, res)
+        let { account } = await authenticate.call(this, req, res)
 
-        await server.accountManager.updateEmailConfirm(
+        account = await server.accountManager.updateEmailConfirm(
           this.deviceId,
           this.deviceMetadata,
           this.input,
           account,
         )
 
-        return { json: { success: true } }
+        return { json: { account } }
       },
     }),
   )
@@ -328,7 +302,7 @@ export function createApiMiddleware<
       endpoint: '/verify-email-request',
       schema: z
         .object({
-          sub: subSchema,
+          did: didSchema,
           locale: localeSchema.optional(),
         })
         .strict(),
@@ -353,22 +327,22 @@ export function createApiMiddleware<
       endpoint: '/verify-email-confirm',
       schema: z
         .object({
-          sub: subSchema,
+          did: didSchema,
           token: emailOtpSchema,
           email: emailSchema,
         })
         .strict(),
       async handler(req, res) {
-        const { account } = await authenticate.call(this, req, res)
+        let { account } = await authenticate.call(this, req, res)
 
-        await server.accountManager.verifyEmailConfirm(
+        account = await server.accountManager.verifyEmailConfirm(
           this.deviceId,
           this.deviceMetadata,
           this.input,
           account,
         )
 
-        return { json: { success: true } }
+        return { json: { account } }
       },
     }),
   )
@@ -379,14 +353,104 @@ export function createApiMiddleware<
       endpoint: '/update-handle',
       schema: z
         .object({
-          sub: subSchema,
+          did: didSchema,
           handle: handleSchema,
         })
         .strict(),
+      async handler(req, res) {
+        let { account } = await authenticate.call(this, req, res)
+
+        account = await server.accountManager.updateHandle(
+          this.deviceId,
+          this.deviceMetadata,
+          this.input,
+          account,
+        )
+
+        return { json: { account } }
+      },
+    }),
+  )
+
+  router.use(
+    apiRoute({
+      method: 'POST',
+      endpoint: '/deactivate-account',
+      schema: z.object({ did: didSchema }).strict(),
+      async handler(req, res) {
+        let { account } = await authenticate.call(this, req, res)
+
+        if (!account.deactivated) {
+          account = await server.accountManager.deactivateAccount(
+            this.deviceId,
+            this.deviceMetadata,
+            account,
+          )
+        }
+
+        return { json: { account } }
+      },
+    }),
+  )
+
+  router.use(
+    apiRoute({
+      method: 'POST',
+      endpoint: '/reactivate-account',
+      schema: z.object({ did: didSchema }).strict(),
+      async handler(req, res) {
+        let { account } = await authenticate.call(this, req, res)
+
+        if (account.deactivated) {
+          account = await server.accountManager.reactivateAccount(
+            this.deviceId,
+            this.deviceMetadata,
+            account,
+          )
+        }
+
+        return { json: { account } }
+      },
+    }),
+  )
+
+  router.use(
+    apiRoute({
+      method: 'POST',
+      endpoint: '/delete-account-request',
+      schema: z
+        .object({ did: didSchema, locale: localeSchema.optional() })
+        .strict(),
+      async handler(req, res) {
+        const { account } = await authenticate.call(this, req, res)
+
+        await server.accountManager.deleteAccountRequest(
+          this.deviceId,
+          this.deviceMetadata,
+          this.input,
+          account,
+        )
+
+        return { json: { success: true } }
+      },
+    }),
+  )
+
+  router.use(
+    apiRoute({
+      method: 'POST',
+      endpoint: '/delete-account-confirm',
+      schema: z
+        .object({
+          did: didSchema,
+          token: emailOtpSchema,
+          password: oldPasswordSchema,
+        })
+        .strict(),
       async handler(req, res) {
         const { account } = await authenticate.call(this, req, res)
 
-        await server.accountManager.updateHandle(
+        await server.accountManager.deleteAccountConfirm(
           this.deviceId,
           this.deviceMetadata,
           this.input,
@@ -424,12 +488,12 @@ export function createApiMiddleware<
     apiRoute({
       method: 'GET',
       endpoint: '/oauth-sessions',
-      schema: z.object({ sub: subSchema }).strict(),
+      schema: z.object({ did: didSchema }).strict(),
       async handler(req, res) {
         const { account } = await authenticate.call(this, req, res)
 
         const tokenInfos = await server.tokenManager.listAccountTokens(
-          account.sub,
+          account.did,
         )
 
         const clientIds = tokenInfos.map((tokenInfo) => tokenInfo.data.clientId)
@@ -468,12 +532,12 @@ export function createApiMiddleware<
     apiRoute({
       method: 'GET',
       endpoint: '/account-sessions',
-      schema: z.object({ sub: subSchema }).strict(),
+      schema: z.object({ did: didSchema }).strict(),
       async handler(req, res) {
         const { account } = await authenticate.call(this, req, res)
 
         const deviceAccounts = await server.accountManager.listAccountDevices(
-          account.sub,
+          account.did,
         )
 
         const json = deviceAccounts.map(
@@ -499,7 +563,7 @@ export function createApiMiddleware<
     apiRoute({
       method: 'POST',
       endpoint: '/revoke-account-session',
-      schema: z.object({ sub: subSchema, deviceId: deviceIdSchema }).strict(),
+      schema: z.object({ did: didSchema, deviceId: deviceIdSchema }).strict(),
       async handler() {
         // @NOTE This route is not authenticated. If a user is able to steal
         // another user's session cookie, we allow them to revoke the device
@@ -507,7 +571,7 @@ export function createApiMiddleware<
 
         await server.accountManager.removeDeviceAccount(
           this.input.deviceId,
-          this.input.sub,
+          this.input.did,
         )
 
         return { json: { success: true } }
@@ -519,7 +583,7 @@ export function createApiMiddleware<
     apiRoute({
       method: 'POST',
       endpoint: '/revoke-oauth-session',
-      schema: z.object({ sub: subSchema, tokenId: tokenIdSchema }).strict(),
+      schema: z.object({ did: didSchema, tokenId: tokenIdSchema }).strict(),
       async handler(req, res) {
         const { account } = await authenticate.call(this, req, res)
 
@@ -527,7 +591,7 @@ export function createApiMiddleware<
           this.input.tokenId,
         )
 
-        if (!tokenInfo || tokenInfo.account.sub !== account.sub) {
+        if (!tokenInfo || tokenInfo.account.did !== account.did) {
           // report this as though the token was not found
           throw new InvalidRequestError(`Invalid token`)
         }
@@ -544,10 +608,7 @@ export function createApiMiddleware<
       method: 'POST',
       endpoint: '/consent',
       schema: z
-        .object({
-          sub: z.union([subSchema, signedJwtSchema]),
-          scope: z.string().optional(),
-        })
+        .object({ did: didSchema, scope: oauthScopeSchema.optional() })
         .strict(),
       async handler(req, res) {
         if (!this.requestUri) {
@@ -710,7 +771,7 @@ export function createApiMiddleware<
   return router.buildMiddleware()
 
   async function authenticate(
-    this: ApiContext<void, { sub: Sub }>,
+    this: ApiContext<void, { did: Did }>,
     req: Req,
     _res: Res,
   ) {
@@ -724,7 +785,7 @@ export function createApiMiddleware<
           await server.signer.verifyEphemeralToken(ephemeralToken)
 
         if (
-          payload.sub === this.input.sub &&
+          payload.sub === this.input.did &&
           payload.deviceId === this.deviceId &&
           payload.requestUri === this.requestUri
         ) {
@@ -744,7 +805,7 @@ export function createApiMiddleware<
       // Ensures the "sub" has an active session on the device
       const deviceAccount = await server.accountManager.getDeviceAccount(
         this.deviceId,
-        this.input.sub,
+        this.input.did,
       )
 
       // The session exists but was created too long ago
@@ -756,7 +817,7 @@ export function createApiMiddleware<
     } catch (err) {
       throw new WWWAuthenticateError(
         'unauthorized',
-        `User ${this.input.sub} not authenticated on this device`,
+        `User ${this.input.did} not authenticated on this device`,
         { Bearer: {} },
         err,
       )
@@ -803,9 +864,9 @@ export function createApiMiddleware<
       }[keyof ApiEndpoints],
     S extends // A schema that validates the POST input or GET params
       ApiEndpoints[E] extends { method: 'POST'; input: infer I }
-        ? z.ZodType<I>
+        ? z.ZodType<I, z.ZodTypeDef, unknown>
         : ApiEndpoints[E] extends { method: 'GET'; params: infer P }
-          ? z.ZodType<P>
+          ? z.ZodType<P, z.ZodTypeDef, unknown>
           : void,
   >(options: {
     method: M

package/src/signer/access-token-payload.ts

@@ -1,7 +1,7 @@
 import { z } from 'zod'
+import { didSchema } from '@atproto/did'
 import { jwtPayloadSchema } from '@atproto/jwk'
 import { clientIdSchema } from '../client/client-id.js'
-import { subSchema } from '../oidc/sub.js'
 import { tokenIdSchema } from '../token/token-id.js'
 
 export const accessTokenPayloadSchema = jwtPayloadSchema
@@ -9,7 +9,7 @@ export const accessTokenPayloadSchema = jwtPayloadSchema
   .extend({
     // Following are required
     jti: tokenIdSchema,
-    sub: subSchema,
+    sub: didSchema,
     exp: z.number().int(),
     iat: z.number().int(),
     iss: z.string().min(1),

package/src/signer/api-token-payload.ts

@@ -1,12 +1,12 @@
 import { z } from 'zod'
+import { didSchema } from '@atproto/did'
 import { jwtPayloadSchema } from '@atproto/jwk'
 import { deviceIdSchema } from '../oauth-store.js'
-import { subSchema } from '../oidc/sub.js'
 import { requestUriSchema } from '../request/request-uri.js'
 
 export const apiTokenPayloadSchema = jwtPayloadSchema
   .extend({
-    sub: subSchema,
+    sub: didSchema,
 
     deviceId: deviceIdSchema,
     // If the token is bound to a particular authorization request, it can only

package/src/signer/signer.ts

@@ -1,10 +1,13 @@
 import {
+  JwtHeader,
   JwtPayload,
   JwtPayloadGetter,
   JwtSignHeader,
+  Key,
   Keyset,
   SignedJwt,
   VerifyOptions,
+  VerifyResult,
 } from '@atproto/jwk'
 import { EPHEMERAL_SESSION_MAX_AGE } from '../constants.js'
 import { dateToEpoch } from '../lib/util/date.js'
@@ -29,7 +32,7 @@ export class Signer {
   async verify<C extends string = never>(
     token: SignedJwt,
     options?: Omit<VerifyOptions<C>, 'issuer'>,
-  ) {
+  ): Promise<VerifyResult<C> & { key: Key }> {
     return this.keyset.verifyJwt<C>(token, {
       ...options,
       issuer: [this.issuer],
@@ -64,7 +67,10 @@ export class Signer {
   async verifyAccessToken<C extends string = never>(
     token: SignedJwt,
     options?: Omit<VerifyOptions<C>, 'issuer' | 'typ'>,
-  ) {
+  ): Promise<{
+    protectedHeader: JwtHeader
+    payload: RequiredKey<AccessTokenPayload, C>
+  }> {
     const result = await this.verify<C>(token, { ...options, typ: 'at+jwt' })
     return {
       protectedHeader: result.protectedHeader,
@@ -77,7 +83,7 @@ export class Signer {
 
   async createEphemeralToken(
     payload: OmitKey<ApiTokenPayload, 'iss' | 'aud' | 'iat'>,
-  ) {
+  ): Promise<SignedJwt> {
     return this.sign(
       {
         alg: undefined,
@@ -94,7 +100,10 @@ export class Signer {
   async verifyEphemeralToken<C extends string = never>(
     token: SignedJwt,
     options?: Omit<VerifyOptions<C>, 'issuer' | 'audience' | 'typ'>,
-  ) {
+  ): Promise<{
+    protectedHeader: JwtHeader
+    payload: RequiredKey<ApiTokenPayload, C>
+  }> {
     const result = await this.verify<C>(token, {
       ...options,
       maxTokenAge: options?.maxTokenAge ?? EPHEMERAL_SESSION_MAX_AGE / 1e3,

package/src/token/token-claims.ts

@@ -1,3 +1,4 @@
+import { Did } from '@atproto/did'
 import { OAuthScope } from '@atproto/oauth-types'
 import { ClientId } from '../client/client-id.js'
 import { TokenId } from './token-id.js'
@@ -11,7 +12,7 @@ import { TokenId } from './token-id.js'
  */
 export type TokenClaims = {
   jti: TokenId
-  sub: string
+  sub: Did
   iat: number
   exp: number
   aud: string | [string, ...string[]]

package/src/token/token-data.ts

@@ -1,3 +1,4 @@
+import { Did } from '@atproto/did'
 import {
   OAuthAuthorizationDetails,
   OAuthAuthorizationRequestParameters,
@@ -5,7 +6,6 @@ import {
 import { ClientAuth, ClientAuthLegacy } from '../client/client-auth.js'
 import { ClientId } from '../client/client-id.js'
 import { DeviceId } from '../device/device-id.js'
-import { Sub } from '../oidc/sub.js'
 import { Code } from '../request/code.js'
 
 export type {
@@ -13,9 +13,9 @@ export type {
   ClientId,
   Code,
   DeviceId,
+  Did,
   OAuthAuthorizationDetails,
   OAuthAuthorizationRequestParameters,
-  Sub,
 }
 
 export type TokenData = {
@@ -25,7 +25,7 @@ export type TokenData = {
   clientId: ClientId
   clientAuth: ClientAuth | ClientAuthLegacy
   deviceId: DeviceId | null
-  sub: Sub
+  did: Did
   parameters: OAuthAuthorizationRequestParameters
   details?: null // Legacy field, not used
   code: Code | null