@atproto/oauth-provider 0.18.4 → 0.19.0

package/src/token/token-manager.ts

@@ -1,3 +1,4 @@
+import type { Did } from '@atproto/did'
 import { SignedJwt, isSignedJwt } from '@atproto/jwk'
 import { LexResolverError } from '@atproto/lex-resolver'
 import type { Account } from '@atproto/oauth-provider-api'
@@ -20,7 +21,6 @@ import { LexiconManager } from '../lexicon/lexicon-manager.js'
 import { RequestMetadata } from '../lib/http/request.js'
 import { dateToEpoch, dateToRelativeSeconds } from '../lib/util/date.js'
 import { OAuthHooks } from '../oauth-hooks.js'
-import { Sub } from '../oidc/sub.js'
 import { Code, isCode } from '../request/code.js'
 import { AccessTokenPayload } from '../signer/access-token-payload.js'
 import { Signer } from '../signer/signer.js'
@@ -61,10 +61,10 @@ export class TokenManager {
   ): Promise<OAuthAccessToken> {
     const claims: TokenClaims = {
       jti: tokenId,
-      sub: account.sub,
+      sub: account.did,
       iat: dateToEpoch(issuedAt),
       exp: dateToEpoch(expiresAt),
-      aud: account.aud,
+      aud: account.pds,
 
       ...(parameters.dpop_jkt && {
         cnf: { jkt: parameters.dpop_jkt },
@@ -136,7 +136,7 @@ export class TokenManager {
       accessToken,
       refreshToken,
       expiresAt,
-      account.sub,
+      account.did,
       scope,
     )
 
@@ -147,7 +147,7 @@ export class TokenManager {
       clientId: client.id,
       clientAuth,
       deviceId,
-      sub: account.sub,
+      did: account.did,
       parameters,
       details: null,
       scope,
@@ -191,7 +191,7 @@ export class TokenManager {
     accessToken: OAuthAccessToken,
     refreshToken: string | undefined,
     expiresAt: Date,
-    sub: Sub,
+    did: Did,
     scope: string,
   ): OAuthTokenResponse {
     return {
@@ -209,7 +209,7 @@ export class TokenManager {
       // ATPROTO extension: add the sub claim to the token response to allow
       // clients to resolve the PDS url (audience) using the did resolution
       // mechanism.
-      sub,
+      sub: did,
     }
   }
 
@@ -263,7 +263,7 @@ export class TokenManager {
       accessToken,
       nextRefreshToken,
       expiresAt,
-      account.sub,
+      account.did,
       scope,
     )
 
@@ -305,10 +305,10 @@ export class TokenManager {
     if (!tokenInfo) return null
 
     // Fool-proof: Invalid store implementation ?
-    if (payload.sub !== tokenInfo.account.sub) {
+    if (payload.sub !== tokenInfo.account.did) {
       await this.deleteToken(tokenInfo.id)
       throw new Error(
-        `Account sub (${tokenInfo.account.sub}) does not match token sub (${payload.sub})`,
+        `Account sub (${tokenInfo.account.did}) does not match token sub (${payload.sub})`,
       )
     }
 
@@ -395,20 +395,20 @@ export class TokenManager {
 
     return {
       jti: tokenId,
-      sub: account.sub,
+      sub: account.did,
       iat: dateToEpoch(data.updatedAt),
       exp: dateToEpoch(data.expiresAt),
-      aud: account.aud,
+      aud: account.pds,
       scope: data.scope ?? data.parameters.scope,
       // https://datatracker.ietf.org/doc/html/rfc8693#section-4.3
       client_id: data.clientId,
     }
   }
 
-  async listAccountTokens(sub: Sub): Promise<TokenInfo[]> {
-    const results = await this.store.listAccountTokens(sub)
+  async listAccountTokens(did: Did): Promise<TokenInfo[]> {
+    const results = await this.store.listAccountTokens(did)
     return results
-      .filter((tokenInfo) => tokenInfo.account.sub === sub) // Fool proof
+      .filter((tokenInfo) => tokenInfo.account.did === did) // Fool proof
       .filter((tokenInfo) => !isCurrentTokenExpired(tokenInfo))
   }
 }

package/src/token/token-store.ts

@@ -1,6 +1,6 @@
+import type { Did } from '@atproto/did'
 import type { Account } from '@atproto/oauth-provider-api'
 import { Awaitable, buildInterfaceChecker } from '../lib/util/type.js'
-import { Sub } from '../oidc/sub.js'
 import { Code } from '../request/code.js'
 import { RefreshToken } from './refresh-token.js'
 import { TokenData } from './token-data.js'
@@ -10,7 +10,7 @@ import { TokenId } from './token-id.js'
 export * from './refresh-token.js'
 export * from './token-data.js'
 export * from './token-id.js'
-export type { Account, Awaitable, Sub }
+export type { Account, Awaitable, Did }
 
 export type TokenInfo = {
   id: TokenId
@@ -65,7 +65,7 @@ export interface TokenStore {
 
   findTokenByCode(code: Code): Awaitable<null | TokenInfo>
 
-  listAccountTokens(sub: Sub): Awaitable<TokenInfo[]>
+  listAccountTokens(did: Did): Awaitable<TokenInfo[]>
 }
 
 export const isTokenStore = buildInterfaceChecker<TokenStore>([

package/src/types/handle.ts

@@ -1,18 +1,23 @@
 import { z } from 'zod'
-import { ensureValidHandle, normalizeHandle } from '@atproto/syntax'
+import {
+  HandleString,
+  ensureValidHandle,
+  normalizeHandle,
+} from '@atproto/syntax'
 
-export const handleSchema = z
-  .string()
-  // @NOTE: We only check against validity towards ATProto's syntax. Additional
-  // rules may be imposed by the store implementation.
-  .superRefine((value, ctx) => {
-    try {
-      ensureValidHandle(value)
-    } catch (err) {
-      ctx.addIssue({
-        code: z.ZodIssueCode.custom,
-        message: err instanceof Error ? err.message : 'Invalid handle',
-      })
-    }
-  })
-  .transform(normalizeHandle)
+/**
+ * @note Only validates again AT Protocol's syntax. Additional rules (specific
+ * domains, slurs, etc.) may be imposed through the store implementation.
+ */
+export const handleSchema = z.string().transform((value, ctx): HandleString => {
+  try {
+    ensureValidHandle(value)
+    return normalizeHandle(value)
+  } catch (err) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: err instanceof Error ? err.message : 'Invalid handle',
+    })
+    return z.NEVER
+  }
+})

package/tsconfig.build.tsbuildinfo

@@ -1 +1 @@
-{"version":"7.0.0-dev.20260614.1","root":["./src/constants.ts","./src/index.ts","./src/oauth-client.ts","./src/oauth-dpop.ts","./src/oauth-errors.ts","./src/oauth-hooks.ts","./src/oauth-middleware.ts","./src/oauth-provider.ts","./src/oauth-store.ts","./src/oauth-verifier.ts","./src/access-token/access-token-mode.ts","./src/account/account-manager.ts","./src/account/account-store.ts","./src/account/sign-in-data.ts","./src/account/sign-up-input.ts","./src/client/client-auth.ts","./src/client/client-data.ts","./src/client/client-id.ts","./src/client/client-info.ts","./src/client/client-manager.ts","./src/client/client-store.ts","./src/client/client-utils.ts","./src/client/client.ts","./src/customization/branding.ts","./src/customization/build-customization-css.ts","./src/customization/build-customization-data.ts","./src/customization/colors.ts","./src/customization/customization.ts","./src/customization/links.ts","./src/device/device-data.ts","./src/device/device-id.ts","./src/device/device-manager.ts","./src/device/device-store.ts","./src/device/session-id.ts","./src/dpop/dpop-manager.ts","./src/dpop/dpop-nonce.ts","./src/dpop/dpop-proof.ts","./src/errors/access-denied-error.ts","./src/errors/account-selection-required-error.ts","./src/errors/authorization-error.ts","./src/errors/consent-required-error.ts","./src/errors/error-parser.ts","./src/errors/handle-unavailable-error.ts","./src/errors/invalid-authorization-details-error.ts","./src/errors/invalid-client-error.ts","./src/errors/invalid-client-id-error.ts","./src/errors/invalid-client-metadata-error.ts","./src/errors/invalid-credentials-error.ts","./src/errors/invalid-dpop-key-binding-error.ts","./src/errors/invalid-dpop-proof-error.ts","./src/errors/invalid-grant-error.ts","./src/errors/invalid-invite-code-error.ts","./src/errors/invalid-redirect-uri-error.ts","./src/errors/invalid-request-error.ts","./src/errors/invalid-scope-error.ts","./src/errors/invalid-token-error.ts","./src/errors/login-required-error.ts","./src/errors/oauth-error.ts","./src/errors/second-authentication-factor-required-error.ts","./src/errors/unauthorized-client-error.ts","./src/errors/use-dpop-nonce-error.ts","./src/errors/www-authenticate-error.ts","./src/lexicon/lexicon-data.ts","./src/lexicon/lexicon-getter.ts","./src/lexicon/lexicon-manager.ts","./src/lexicon/lexicon-store.ts","./src/lib/hcaptcha.ts","./src/lib/nsid.ts","./src/lib/redis.ts","./src/lib/write-form-redirect.ts","./src/lib/write-html.ts","./src/lib/csp/index.ts","./src/lib/html/build-document.ts","./src/lib/html/escapers.ts","./src/lib/html/html.ts","./src/lib/html/hydration-data.ts","./src/lib/html/index.ts","./src/lib/html/tags.ts","./src/lib/html/util.ts","./src/lib/http/accept.ts","./src/lib/http/context.ts","./src/lib/http/headers.ts","./src/lib/http/index.ts","./src/lib/http/method.ts","./src/lib/http/middleware.ts","./src/lib/http/parser.ts","./src/lib/http/path.ts","./src/lib/http/request.ts","./src/lib/http/response.ts","./src/lib/http/route.ts","./src/lib/http/router.ts","./src/lib/http/security-headers.ts","./src/lib/http/stream.ts","./src/lib/http/types.ts","./src/lib/http/url.ts","./src/lib/util/authorization-header.ts","./src/lib/util/cast.ts","./src/lib/util/color.ts","./src/lib/util/crypto.ts","./src/lib/util/date.ts","./src/lib/util/error.ts","./src/lib/util/function.ts","./src/lib/util/locale.ts","./src/lib/util/object.ts","./src/lib/util/redirect-uri.ts","./src/lib/util/time.ts","./src/lib/util/type.ts","./src/lib/util/ui8.ts","./src/lib/util/well-known.ts","./src/lib/util/zod-error.ts","./src/metadata/build-metadata.ts","./src/oidc/sub.ts","./src/replay/replay-manager.ts","./src/replay/replay-store-memory.ts","./src/replay/replay-store-redis.ts","./src/replay/replay-store.ts","./src/request/code.ts","./src/request/request-data.ts","./src/request/request-id.ts","./src/request/request-manager.ts","./src/request/request-store.ts","./src/request/request-uri.ts","./src/result/authorization-redirect-parameters.ts","./src/result/authorization-result-authorize-page.ts","./src/result/authorization-result-redirect.ts","./src/router/create-account-page-middleware.ts","./src/router/create-api-middleware.ts","./src/router/create-authorization-page-middleware.ts","./src/router/create-oauth-middleware.ts","./src/router/error-handler.ts","./src/router/middleware-options.ts","./src/router/assets/assets-manifest.ts","./src/router/assets/assets.ts","./src/router/assets/csrf.ts","./src/router/assets/send-account-page.ts","./src/router/assets/send-authorization-page.ts","./src/router/assets/send-cookie-error-page.ts","./src/router/assets/send-error-page.ts","./src/router/assets/send-redirect.ts","./src/signer/access-token-payload.ts","./src/signer/api-token-payload.ts","./src/signer/signer.ts","./src/token/refresh-token.ts","./src/token/token-claims.ts","./src/token/token-data.ts","./src/token/token-id.ts","./src/token/token-manager.ts","./src/token/token-store.ts","./src/types/authorization-response-error.ts","./src/types/color-hue.ts","./src/types/email-otp.ts","./src/types/email.ts","./src/types/handle.ts","./src/types/invite-code.ts","./src/types/par-response-error.ts","./src/types/password.ts","./src/types/rgb-color.ts"]}
+{"version":"7.0.0-dev.20260614.1","root":["./src/constants.ts","./src/index.ts","./src/oauth-client.ts","./src/oauth-dpop.ts","./src/oauth-errors.ts","./src/oauth-hooks.ts","./src/oauth-middleware.ts","./src/oauth-provider.ts","./src/oauth-store.ts","./src/oauth-verifier.ts","./src/access-token/access-token-mode.ts","./src/account/account-manager.ts","./src/account/account-store.ts","./src/account/sign-in-data.ts","./src/account/sign-up-input.ts","./src/client/client-auth.ts","./src/client/client-data.ts","./src/client/client-id.ts","./src/client/client-info.ts","./src/client/client-manager.ts","./src/client/client-store.ts","./src/client/client-utils.ts","./src/client/client.ts","./src/customization/branding.ts","./src/customization/build-customization-css.ts","./src/customization/build-customization-data.ts","./src/customization/colors.ts","./src/customization/customization.ts","./src/customization/links.ts","./src/device/device-data.ts","./src/device/device-id.ts","./src/device/device-manager.ts","./src/device/device-store.ts","./src/device/session-id.ts","./src/dpop/dpop-manager.ts","./src/dpop/dpop-nonce.ts","./src/dpop/dpop-proof.ts","./src/errors/access-denied-error.ts","./src/errors/account-selection-required-error.ts","./src/errors/authorization-error.ts","./src/errors/consent-required-error.ts","./src/errors/error-parser.ts","./src/errors/handle-unavailable-error.ts","./src/errors/invalid-authorization-details-error.ts","./src/errors/invalid-client-error.ts","./src/errors/invalid-client-id-error.ts","./src/errors/invalid-client-metadata-error.ts","./src/errors/invalid-credentials-error.ts","./src/errors/invalid-dpop-key-binding-error.ts","./src/errors/invalid-dpop-proof-error.ts","./src/errors/invalid-grant-error.ts","./src/errors/invalid-invite-code-error.ts","./src/errors/invalid-redirect-uri-error.ts","./src/errors/invalid-request-error.ts","./src/errors/invalid-scope-error.ts","./src/errors/invalid-token-error.ts","./src/errors/login-required-error.ts","./src/errors/oauth-error.ts","./src/errors/second-authentication-factor-required-error.ts","./src/errors/unauthorized-client-error.ts","./src/errors/use-dpop-nonce-error.ts","./src/errors/www-authenticate-error.ts","./src/lexicon/lexicon-data.ts","./src/lexicon/lexicon-getter.ts","./src/lexicon/lexicon-manager.ts","./src/lexicon/lexicon-store.ts","./src/lib/hcaptcha.ts","./src/lib/nsid.ts","./src/lib/redis.ts","./src/lib/write-form-redirect.ts","./src/lib/write-html.ts","./src/lib/csp/index.ts","./src/lib/html/build-document.ts","./src/lib/html/escapers.ts","./src/lib/html/html.ts","./src/lib/html/hydration-data.ts","./src/lib/html/index.ts","./src/lib/html/tags.ts","./src/lib/html/util.ts","./src/lib/http/accept.ts","./src/lib/http/context.ts","./src/lib/http/headers.ts","./src/lib/http/index.ts","./src/lib/http/method.ts","./src/lib/http/middleware.ts","./src/lib/http/parser.ts","./src/lib/http/path.ts","./src/lib/http/request.ts","./src/lib/http/response.ts","./src/lib/http/route.ts","./src/lib/http/router.ts","./src/lib/http/security-headers.ts","./src/lib/http/stream.ts","./src/lib/http/types.ts","./src/lib/http/url.ts","./src/lib/util/authorization-header.ts","./src/lib/util/cast.ts","./src/lib/util/color.ts","./src/lib/util/crypto.ts","./src/lib/util/date.ts","./src/lib/util/error.ts","./src/lib/util/function.ts","./src/lib/util/locale.ts","./src/lib/util/object.ts","./src/lib/util/redirect-uri.ts","./src/lib/util/time.ts","./src/lib/util/type.ts","./src/lib/util/ui8.ts","./src/lib/util/well-known.ts","./src/lib/util/zod-error.ts","./src/metadata/build-metadata.ts","./src/replay/replay-manager.ts","./src/replay/replay-store-memory.ts","./src/replay/replay-store-redis.ts","./src/replay/replay-store.ts","./src/request/code.ts","./src/request/request-data.ts","./src/request/request-id.ts","./src/request/request-manager.ts","./src/request/request-store.ts","./src/request/request-uri.ts","./src/result/authorization-redirect-parameters.ts","./src/result/authorization-result-authorize-page.ts","./src/result/authorization-result-redirect.ts","./src/router/create-account-page-middleware.ts","./src/router/create-api-middleware.ts","./src/router/create-authorization-page-middleware.ts","./src/router/create-oauth-middleware.ts","./src/router/error-handler.ts","./src/router/middleware-options.ts","./src/router/assets/assets-manifest.ts","./src/router/assets/assets.ts","./src/router/assets/csrf.ts","./src/router/assets/send-account-page.ts","./src/router/assets/send-authorization-page.ts","./src/router/assets/send-cookie-error-page.ts","./src/router/assets/send-error-page.ts","./src/router/assets/send-redirect.ts","./src/signer/access-token-payload.ts","./src/signer/api-token-payload.ts","./src/signer/signer.ts","./src/token/refresh-token.ts","./src/token/token-claims.ts","./src/token/token-data.ts","./src/token/token-id.ts","./src/token/token-manager.ts","./src/token/token-store.ts","./src/types/authorization-response-error.ts","./src/types/color-hue.ts","./src/types/email-otp.ts","./src/types/email.ts","./src/types/handle.ts","./src/types/invite-code.ts","./src/types/par-response-error.ts","./src/types/password.ts","./src/types/rgb-color.ts"]}

package/dist/oidc/sub.d.ts

@@ -1,4 +0,0 @@
-import { z } from 'zod';
-export declare const subSchema: z.ZodString;
-export type Sub = z.infer<typeof subSchema>;
-//# sourceMappingURL=sub.d.ts.map

package/dist/oidc/sub.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sub.d.ts","sourceRoot":"","sources":["../../src/oidc/sub.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,eAAO,MAAM,SAAS,aAAoB,CAAA;AAC1C,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAA"}

package/dist/oidc/sub.js

@@ -1,3 +0,0 @@
-import { z } from 'zod';
-export const subSchema = z.string().min(1);
-//# sourceMappingURL=sub.js.map

package/dist/oidc/sub.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sub.js","sourceRoot":"","sources":["../../src/oidc/sub.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA","sourcesContent":["import { z } from 'zod'\n\nexport const subSchema = z.string().min(1)\nexport type Sub = z.infer<typeof subSchema>\n"]}

package/src/oidc/sub.ts

@@ -1,4 +0,0 @@
-import { z } from 'zod'
-
-export const subSchema = z.string().min(1)
-export type Sub = z.infer<typeof subSchema>