@atproto/oauth-provider 0.19.6 → 0.19.8

package/src/lib/http/request.ts

@@ -1,256 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http'
-// eslint-disable-next-line import/default, import/no-named-as-default-member
-import accept from '@hapi/accept'
-// eslint-disable-next-line import/no-named-as-default-member
-const { languages, mediaType } = accept
-import {
-  CookieSerializeOptions,
-  parse as parseCookie,
-  serialize as serializeCookie,
-} from 'cookie'
-import forwarded from 'forwarded'
-import createHttpError from 'http-errors'
-import { appendHeader } from './headers.js'
-import { UrlReference, urlMatch } from './url.js'
-
-export function validateHeaderValue(
-  req: IncomingMessage,
-  name: keyof IncomingMessage['headers'],
-  allowedValues: readonly (string | null)[],
-) {
-  const value = req.headers[name] ?? null
-
-  if (Array.isArray(value)) {
-    throw createHttpError(400, `Invalid ${name} header`)
-  }
-
-  if (!allowedValues.includes(value)) {
-    throw createHttpError(
-      400,
-      value
-        ? `Forbidden ${name} header "${value}" (expected ${allowedValues})`
-        : `Missing ${name} header`,
-    )
-  }
-}
-
-export function validateFetchMode(
-  req: IncomingMessage,
-  expectedMode: readonly (
-    | null
-    | 'navigate'
-    | 'same-origin'
-    | 'no-cors'
-    | 'cors'
-  )[],
-) {
-  validateHeaderValue(req, 'sec-fetch-mode', expectedMode)
-}
-
-export function validateFetchDest(
-  req: IncomingMessage,
-  expectedDest: readonly (
-    | null
-    | 'document'
-    | 'embed'
-    | 'font'
-    | 'image'
-    | 'manifest'
-    | 'media'
-    | 'object'
-    | 'report'
-    | 'script'
-    | 'serviceworker'
-    | 'sharedworker'
-    | 'style'
-    | 'worker'
-    | 'xslt'
-  )[],
-) {
-  validateHeaderValue(req, 'sec-fetch-dest', expectedDest)
-}
-
-export function validateFetchSite(
-  req: IncomingMessage,
-  expectedSite: readonly (
-    | null
-    | 'same-origin'
-    | 'same-site'
-    | 'cross-site'
-    | 'none'
-  )[],
-) {
-  validateHeaderValue(req, 'sec-fetch-site', expectedSite)
-}
-
-export function validateReferrer(
-  req: IncomingMessage,
-  reference: UrlReference,
-  allowNull: true,
-): URL | null
-export function validateReferrer(
-  req: IncomingMessage,
-  reference: UrlReference,
-  allowNull?: false,
-): URL
-export function validateReferrer(
-  req: IncomingMessage,
-  reference: UrlReference,
-  allowNull = false,
-) {
-  // @NOTE The header name "referer" is actually a misspelling of the word
-  // "referrer". https://en.wikipedia.org/wiki/HTTP_referer
-  const referrer = req.headers['referer']
-  const referrerUrl = referrer ? new URL(referrer) : null
-  if (referrerUrl ? !urlMatch(referrerUrl, reference) : !allowNull) {
-    throw createHttpError(400, `Invalid referrer ${referrer}`)
-  }
-  return referrerUrl
-}
-
-export function validateOrigin(
-  req: IncomingMessage,
-  expectedOrigin: string,
-  optional = true,
-) {
-  const reqOrigin = req.headers['origin']
-  if (reqOrigin ? reqOrigin !== expectedOrigin : !optional) {
-    throw createHttpError(400, `Invalid origin ${reqOrigin}`)
-  }
-}
-
-export type { CookieSerializeOptions }
-
-export function setCookie(
-  res: ServerResponse,
-  cookieName: string,
-  value: string,
-  options?: CookieSerializeOptions,
-) {
-  appendHeader(res, 'Set-Cookie', serializeCookie(cookieName, value, options))
-}
-
-export function getCookie(
-  req: IncomingMessage,
-  cookieName: string,
-): string | undefined {
-  const cookies = parseHttpCookies(req)
-  return Object.hasOwn(cookies, cookieName) ? cookies[cookieName] : undefined
-}
-
-export function clearCookie(
-  res: ServerResponse,
-  cookieName: string,
-  options?: Omit<CookieSerializeOptions, 'maxAge' | 'expires'>,
-) {
-  setCookie(res, cookieName, '', { ...options, maxAge: 0 })
-}
-
-export function parseHttpCookies(
-  req: IncomingMessage & { cookies?: any },
-): Record<string, undefined | string> {
-  req.cookies ??= req.headers['cookie']
-    ? { __proto__: null, ...parseCookie(req.headers['cookie']) }
-    : { __proto__: null }
-  return req.cookies
-}
-
-export type ExtractRequestMetadataOptions = {
-  /**
-   * A function that determines whether a given IP address is trusted. The
-   * function is called with the IP addresses and its index in the list of
-   * forwarded addresses (starting from 0, 0 corresponding to the ip of the
-   * incoming HTTP connection, and the last item being the first proxied IP
-   * address in the proxy chain, deduced from the `X-Forwarded-For` header). The
-   * function should return `true` if the IP address is trusted, and `false`
-   * otherwise.
-   *
-   * @see {@link https://www.npmjs.com/package/proxy-addr} for a utility that
-   * allows you to create a trust function.
-   */
-  trustProxy?: (addr: string, i: number) => boolean
-}
-
-export type RequestMetadata = {
-  userAgent?: string
-  ipAddress: string
-  port: number
-}
-
-export function extractRequestMetadata(
-  req: IncomingMessage,
-  options?: ExtractRequestMetadataOptions,
-): RequestMetadata {
-  const ip = extractIp(req, options)
-  return {
-    userAgent: req.headers['user-agent'],
-    ipAddress: ip,
-    port: extractPort(req, ip),
-  }
-}
-
-function extractIp(
-  req: IncomingMessage,
-  options?: ExtractRequestMetadataOptions,
-): string {
-  const trust = options?.trustProxy
-  if (trust) {
-    const ips = forwarded(req)
-    for (let i = 0; i < ips.length; i++) {
-      const isTrusted = trust(ips[i], i)
-      if (!isTrusted) return ips[i]
-    }
-    // Let's return the last ("furthest") IP address in the chain if all of them
-    // are trusted. Note that this may indicate an issue with either the trust
-    // function (too permissive), or the proxy configuration (one of them not
-    // setting the X-Forwarded-For header).
-    const ip = ips[ips.length - 1]
-    if (ip) return ip
-  }
-
-  // Express app compatibility (see "trust proxy" setting)
-  if ('ip' in req) {
-    const ip = req.ip
-    if (typeof ip === 'string') return ip
-  }
-
-  const ip = req.socket.remoteAddress
-  if (ip) return ip
-
-  throw new Error('Could not determine IP address')
-}
-
-function extractPort(req: IncomingMessage, ip: string): number {
-  if (ip !== req.socket.remoteAddress) {
-    // Trust the X-Forwarded-Port header only if the IP address was a trusted
-    // proxied IP.
-    const forwardedPort = req.headers['x-forwarded-port']
-    if (typeof forwardedPort === 'string') {
-      const port = Number(forwardedPort.trim())
-      if (!Number.isInteger(port) || port < 0 || port > 65535) {
-        throw new Error('Invalid forwarded port')
-      }
-      return port
-    }
-  }
-
-  const port = req.socket.remotePort
-  if (port != null) return port
-
-  throw new Error('Could not determine port')
-}
-
-export function extractLocales(req: IncomingMessage) {
-  const acceptLanguage = req.headers['accept-language']
-  return acceptLanguage ? languages(acceptLanguage) : []
-}
-
-export function negotiateResponseContent<T extends string>(
-  req: IncomingMessage,
-  types: readonly T[],
-): T | undefined {
-  const type = mediaType(req.headers['accept'], types)
-  if (type) return type as T
-
-  return undefined
-}

package/src/lib/http/response.ts

@@ -1,122 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http'
-import { type Readable, pipeline } from 'node:stream'
-import createHttpError from 'http-errors'
-import { Awaitable } from '../util/type.js'
-import { negotiateResponseContent } from './request.js'
-import type { Handler, Middleware } from './types.js'
-
-export function writeRedirect(
-  res: ServerResponse,
-  url: string,
-  status = 302,
-): void {
-  res.writeHead(status, { Location: url }).end()
-}
-
-export type WriteResponseOptions = {
-  status?: number
-  contentType?: string
-}
-
-export function writeStream(
-  res: ServerResponse,
-  stream: Readable,
-  {
-    status = 200,
-    contentType = 'application/octet-stream',
-  }: WriteResponseOptions = {},
-): void {
-  res.statusCode = status
-  res.setHeader('content-type', contentType)
-
-  if (res.req.method === 'HEAD') {
-    res.end()
-    stream.destroy()
-  } else {
-    pipeline([stream, res], (_err: Error | null) => {
-      // The error will be propagated through the streams
-    })
-  }
-}
-
-export function writeBuffer(
-  res: ServerResponse,
-  chunk: string | Buffer,
-  opts: WriteResponseOptions,
-): void {
-  if (opts?.status != null) res.statusCode = opts.status
-  res.setHeader('content-type', opts?.contentType || 'application/octet-stream')
-  res.end(chunk)
-}
-
-export function toJsonBuffer(value: unknown): Buffer {
-  try {
-    return Buffer.from(JSON.stringify(value))
-  } catch (cause) {
-    throw new Error(`Failed to serialize as JSON`, { cause })
-  }
-}
-
-export function writeJson(
-  res: ServerResponse,
-  payload: unknown,
-  { contentType = 'application/json', ...options }: WriteResponseOptions = {},
-): void {
-  const buffer = toJsonBuffer(payload)
-  writeBuffer(res, buffer, { ...options, contentType })
-}
-
-export function staticJsonMiddleware(
-  value: unknown,
-  { contentType = 'application/json', ...options }: WriteResponseOptions = {},
-): Handler<unknown> {
-  const buffer = toJsonBuffer(value)
-  const staticOptions: WriteResponseOptions = { ...options, contentType }
-  return function (req, res) {
-    writeBuffer(res, buffer, staticOptions)
-  }
-}
-
-export function cacheControlMiddleware(maxAge: number): Middleware<void> {
-  const header = `max-age=${maxAge}`
-  return function (req, res, next) {
-    res.setHeader('Cache-Control', header)
-    next()
-  }
-}
-
-export type JsonResponse<P = unknown> = WriteResponseOptions & {
-  json: P
-}
-
-export function jsonHandler<
-  T,
-  Req extends IncomingMessage = IncomingMessage,
-  Res extends ServerResponse = ServerResponse,
->(
-  buildJson: (this: T, req: Req, res: Res) => Awaitable<JsonResponse>,
-): Middleware<T, Req, Res> {
-  return function (req, res, next) {
-    // Ensure we can agree on a content encoding & type before starting to
-    // build the JSON response.
-    if (negotiateResponseContent(req, ['application/json'])) {
-      // A middleware should not be async, so we wrap the async operation in a
-      // promise and return it.
-      void (async () => {
-        try {
-          const jsonResponse = await buildJson.call(this, req, res)
-          const { json, status = 200, ...options } = jsonResponse
-          writeJson(res, json, { ...options, status })
-        } catch (err) {
-          next(asError(err, 'Failed to build JSON response'))
-        }
-      })()
-    } else {
-      next(createHttpError(406, 'Unsupported media type'))
-    }
-  }
-}
-
-function asError(cause: unknown, message: string): Error {
-  return cause instanceof Error ? cause : new Error(message, { cause })
-}

package/src/lib/http/route.ts

@@ -1,60 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http'
-import { SubCtx, subCtx } from './context.js'
-import { MethodMatcherInput, createMethodMatcher } from './method.js'
-import { combineMiddlewares } from './middleware.js'
-import { Params, Path, createPathMatcher } from './path.js'
-import { Middleware } from './types.js'
-
-export type RouteCtx<
-  T extends object | void,
-  P extends Params = Params,
-> = SubCtx<T, { params: Readonly<P> }>
-export type RouteMiddleware<
-  T extends object | void,
-  P extends Params,
-  Req = IncomingMessage,
-  Res = ServerResponse,
-> = Middleware<RouteCtx<T, P>, Req, Res>
-
-/**
- * @example
- * ```ts
- * createRoute<{ foo: string }>('GET', '/foo/:foo', function (req, res) {
- *   console.log(this.params.foo) // OK
- *   console.log(this.params.bar) // Error
- * })
- *
- * createRoute<{ foo: string }>(['POST', 'PUT'], '/foo/:foo', function (req, res) {
- *   console.log(this.params.foo) // OK
- *   console.log(this.params.bar) // Error
- * })
- * ```
- */
-export function createRoute<
-  P extends Params = Params,
-  T extends object | void = void,
-  Req extends IncomingMessage = IncomingMessage,
-  Res extends ServerResponse = ServerResponse,
->(
-  method: MethodMatcherInput,
-  path: Path<P>,
-  ...mw: RouteMiddleware<T, P, Req, Res>[]
-): Middleware<T, Req, Res> {
-  const paramsMatcher = createPathMatcher<P>(path)
-  const methodMatcher = createMethodMatcher(method)
-
-  const middleware = combineMiddlewares(mw, { skipKeyword: 'route' })
-
-  return function (req, res, next) {
-    if (methodMatcher(req)) {
-      const pathname = req.url?.split('?')[0] ?? '/'
-      const params = paramsMatcher(pathname)
-      if (params) {
-        const context = subCtx(this, { params })
-        return middleware.call(context, req, res, next)
-      }
-    }
-
-    return next()
-  }
-}

package/src/lib/http/router.ts

@@ -1,117 +0,0 @@
-import type {
-  IncomingHttpHeaders,
-  IncomingMessage,
-  ServerResponse,
-} from 'node:http'
-import { SubCtx, subCtx } from './context.js'
-import { MethodMatcherInput } from './method.js'
-import { combineMiddlewares } from './middleware.js'
-import { Params, Path } from './path.js'
-import { RouteMiddleware, createRoute } from './route.js'
-import { Middleware } from './types.js'
-
-export type RouterCtx<T extends object | void = void> = SubCtx<
-  T,
-  { url: Readonly<URL>; headers: IncomingHttpHeaders }
->
-
-export type RouterMiddleware<
-  T extends object | void = void,
-  Req = IncomingMessage,
-  Res = ServerResponse,
-> = Middleware<RouterCtx<T>, Req, Res>
-
-export type RouterConfig = {
-  /** Used to build the origin of the {@link RouterCtx['url']} context property */
-  protocol?: string
-  /** Used to build the origin of the {@link RouterCtx['url']} context property */
-  host?: string
-}
-
-export class Router<
-  T extends object | void = void,
-  Req extends IncomingMessage = IncomingMessage,
-  Res extends ServerResponse = ServerResponse,
-> {
-  private readonly middlewares: RouterMiddleware<T, Req, Res>[] = []
-
-  constructor(private readonly config?: RouterConfig) {}
-
-  use(...middlewares: RouterMiddleware<T, Req, Res>[]) {
-    this.middlewares.push(...middlewares)
-    return this
-  }
-
-  all<P extends Params = Params>(
-    path: Path<P>,
-    ...mw: RouteMiddleware<RouterCtx<T>, P, Req, Res>[]
-  ) {
-    return this.addRoute<P>('*', path, ...mw)
-  }
-
-  get<P extends Params = Params>(
-    path: Path<P>,
-    ...mw: RouteMiddleware<RouterCtx<T>, P, Req, Res>[]
-  ) {
-    return this.addRoute<P>('GET', path, ...mw)
-  }
-
-  post<P extends Params = Params>(
-    path: Path<P>,
-    ...mw: RouteMiddleware<RouterCtx<T>, P, Req, Res>[]
-  ) {
-    return this.addRoute<P>('POST', path, ...mw)
-  }
-
-  options<P extends Params = Params>(
-    path: Path<P>,
-    ...mw: RouteMiddleware<RouterCtx<T>, P, Req, Res>[]
-  ) {
-    return this.addRoute<P>('OPTIONS', path, ...mw)
-  }
-
-  addRoute<P extends Params>(
-    method: MethodMatcherInput,
-    path: Path<P>,
-    ...mw: RouteMiddleware<RouterCtx<T>, P, Req, Res>[]
-  ) {
-    return this.use(createRoute(method, path, ...mw))
-  }
-
-  /**
-   * @returns router middleware which dispatches a route matching the request.
-   */
-  buildMiddleware(): Middleware<T, Req, Res> {
-    const { config } = this
-
-    // Calling next('router') from a middleware will skip all the remaining
-    // middlewares in the stack.
-    const middleware = combineMiddlewares(this.middlewares, {
-      skipKeyword: 'router',
-    })
-
-    return function (this, req, res, next) {
-      // Parse the URL using node's URL parser.
-      const url = extractUrl(req, config)
-      if (url instanceof Error) return next(url)
-
-      // Any error thrown here will be uncaught/unhandled (a middleware should
-      // never throw)
-      const context = subCtx(this, { url, headers: req.headers })
-      middleware.call(context, req, res, next)
-    }
-  }
-}
-
-function extractUrl(req: IncomingMessage, config?: RouterConfig): URL | Error {
-  try {
-    const protocol = config?.protocol || 'https:'
-    const host = config?.host || req.headers.host || 'localhost'
-    const pathname = req.url || '/'
-    return new URL(pathname, `${protocol}//${host}`)
-  } catch (cause) {
-    const error =
-      cause instanceof Error ? cause : new Error('Invalid URL', { cause })
-    return Object.assign(error, { status: 400, statusCode: 400 })
-  }
-}

package/src/lib/http/security-headers.ts

@@ -1,100 +0,0 @@
-import type { ServerResponse } from 'node:http'
-import { type CspConfig, buildCsp } from '../csp/index.js'
-
-/**
- * @see {@link https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy COEP on MDN}
- */
-export enum CrossOriginEmbedderPolicy {
-  unsafeNone = 'unsafe-none',
-  requireCorp = 'require-corp',
-  credentialless = 'credentialless',
-}
-
-/**
- * @see {@link https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Resource-Policy CORP on MDN}
- */
-export enum CrossOriginResourcePolicy {
-  sameSite = 'same-site',
-  sameOrigin = 'same-origin',
-  crossOrigin = 'cross-origin',
-}
-
-/**
- * @see {@link https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Opener-Policy COOP on MDN}
- */
-export enum CrossOriginOpenerPolicy {
-  unsafeNone = 'unsafe-none',
-  sameOriginAllowPopups = 'same-origin-allow-popups',
-  sameOrigin = 'same-origin',
-  noopenerAllowPopups = 'noopener-allow-popups',
-}
-
-export type HTTPStrictTransportSecurityConfig = {
-  maxAge: number
-  includeSubDomains?: boolean
-  preload?: boolean
-}
-
-export type SecurityHeadersOptions = {
-  /**
-   * Defaults to `default-src: 'none'`. Use an empty object to disable CSP.
-   * @see {@link https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy CSP on MDN}
-   */
-  csp?: CspConfig
-  coep?: CrossOriginEmbedderPolicy
-  corp?: CrossOriginResourcePolicy
-  coop?: CrossOriginOpenerPolicy
-  /**
-   * Defaults to 2 years. Use `false` to disable HSTS.
-   */
-  hsts?: HTTPStrictTransportSecurityConfig | false
-}
-
-export function* buildSecurityHeaders({
-  csp = { 'default-src': ["'none'"] },
-  coep = CrossOriginEmbedderPolicy.requireCorp,
-  corp = CrossOriginResourcePolicy.sameOrigin,
-  coop = CrossOriginOpenerPolicy.sameOrigin,
-  hsts = { maxAge: 63072000 },
-}: SecurityHeadersOptions): Generator<[string, string], void, unknown> {
-  // @NOTE Never set CSP through http-equiv meta as not all directives will
-  // be honored. Always set it through the Content-Security-Policy header.
-  const cspString = buildCsp(csp)
-  if (cspString) {
-    yield ['Content-Security-Policy', cspString]
-  }
-
-  yield ['Cross-Origin-Embedder-Policy', coep]
-  yield ['Cross-Origin-Resource-Policy', corp]
-  yield ['Cross-Origin-Opener-Policy', coop]
-
-  if (hsts) {
-    yield ['Strict-Transport-Security', buildHstsValue(hsts)]
-  }
-
-  // @TODO make these headers configurable (?)
-  yield ['Permissions-Policy', 'otp-credentials=*, document-domain=()']
-  yield ['Referrer-Policy', 'same-origin']
-  yield ['X-Frame-Options', 'DENY']
-  yield ['X-Content-Type-Options', 'nosniff']
-  yield ['X-XSS-Protection', '0']
-}
-
-export function setSecurityHeaders(
-  res: ServerResponse,
-  options: SecurityHeadersOptions,
-): void {
-  for (const [header, value] of buildSecurityHeaders(options)) {
-    // Only set the header if it is not already set
-    if (!res.hasHeader(header)) {
-      res.setHeader(header, value)
-    }
-  }
-}
-
-function buildHstsValue(config: HTTPStrictTransportSecurityConfig): string {
-  let value = `max-age=${config.maxAge}`
-  if (config.includeSubDomains) value += '; includeSubDomains'
-  if (config.preload) value += '; preload'
-  return value
-}