@atproto/oauth-provider 0.19.6 → 0.19.8

package/src/lib/http/stream.ts

@@ -1,57 +0,0 @@
-import type { IncomingMessage } from 'node:http'
-import { Readable } from 'node:stream'
-import createHttpError from 'http-errors'
-import { decodeStream, streamToNodeBuffer } from '@atproto/common'
-import {
-  KnownNames,
-  KnownParser,
-  ParserResult,
-  parseContentType,
-  parsers,
-} from './parser.js'
-
-export function decodeHttpRequest(req: IncomingMessage): Readable {
-  try {
-    return decodeStream(req, req.headers['content-encoding'])
-  } catch (cause) {
-    const message =
-      cause instanceof TypeError ? cause.message : `Invalid content-encoding`
-    throw createHttpError(415, message, { cause })
-  }
-}
-
-/**
- * Generic method that parses a stream of unknown nature (HTTP request/response,
- * socket, file, etc.), but of known mime type, into a parsed object.
- *
- * @throws {TypeError} If the content-type is not valid or supported.
- */
-
-export async function parseHttpRequest<A extends readonly KnownNames[]>(
-  req: IncomingMessage,
-  allow: A,
-) {
-  const type = parseContentType(
-    req.headers['content-type'] ?? 'application/octet-stream',
-  )
-
-  const parser = parsers.find(
-    (parser) => allow.includes(parser.name) && parser.test(type.mime),
-  )
-
-  if (!parser) {
-    throw createHttpError(415, `Unsupported content-type: ${type.mime}`)
-  }
-
-  const stream = decodeHttpRequest(req)
-  const buffer = await streamToNodeBuffer(stream)
-  return parser.parse(buffer, type) as ParserResult<
-    Extract<KnownParser, { name: A[number] }>
-  >
-}
-
-export async function flushStream(stream: AsyncIterable<any>): Promise<void> {
-  for await (const _ of stream) {
-    // Consume the stream to completion
-  }
-}

package/src/lib/http/types.ts

@@ -1,16 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http'
-
-export type NextFunction = (err?: unknown) => void
-
-export type Middleware<
-  T = void,
-  Req = IncomingMessage,
-  Res = ServerResponse,
-> = (this: T, req: Req, res: Res, next: NextFunction) => void
-
-export type Handler<T = void, Req = IncomingMessage, Res = ServerResponse> = (
-  this: T,
-  req: Req,
-  res: Res,
-  next?: NextFunction,
-) => void

package/src/lib/http/url.ts

@@ -1,23 +0,0 @@
-export type UrlReference = {
-  origin?: string
-  pathname?: string
-  searchParams?: Iterable<readonly [string, string]> // compatible with URLSearchParams
-}
-
-export function urlMatch(url: URL, reference: UrlReference) {
-  if (reference.origin !== undefined) {
-    if (url.origin !== reference.origin) return false
-  }
-
-  if (reference.pathname !== undefined) {
-    if (url.pathname !== reference.pathname) return false
-  }
-
-  if (reference.searchParams !== undefined) {
-    for (const [key, value] of reference.searchParams) {
-      if (url.searchParams.get(key) !== value) return false
-    }
-  }
-
-  return true
-}

package/src/lib/nsid.ts

@@ -1,10 +0,0 @@
-import { NSID } from '@atproto/syntax'
-export { NSID }
-
-export function parseNSID(value: string): NSID | null {
-  try {
-    return NSID.parse(value)
-  } catch {
-    return null
-  }
-}

package/src/lib/redis.ts

@@ -1,25 +0,0 @@
-import { Redis, type RedisOptions } from 'ioredis'
-
-export type { Redis, RedisOptions }
-
-export type CreateRedisOptions = Redis | RedisOptions | string
-
-export function createRedis(options: CreateRedisOptions): Redis {
-  if (typeof options === 'string') {
-    const url = new URL(
-      options.startsWith('redis://') ? options : `redis://${options}`,
-    )
-
-    return new Redis({
-      host: url.hostname,
-      port: parseInt(url.port, 10),
-      password: url.password,
-    })
-  } else if ('on' in options && 'call' in options && 'acl' in options) {
-    // Not using "instanceof" here in case the options is an instance of another
-    // version of ioredis (Redis is both a class and an interface).
-    return options
-  } else {
-    return new Redis(options)
-  }
-}

package/src/lib/util/authorization-header.ts

@@ -1,28 +0,0 @@
-import { z } from 'zod'
-import {
-  oauthAccessTokenSchema,
-  oauthTokenTypeSchema,
-} from '@atproto/oauth-types'
-import { InvalidRequestError } from '../../errors/invalid-request-error.js'
-import { WWWAuthenticateError } from '../../errors/www-authenticate-error.js'
-
-export const authorizationHeaderSchema = z.tuple([
-  oauthTokenTypeSchema,
-  oauthAccessTokenSchema,
-])
-
-export const parseAuthorizationHeader = (header: unknown) => {
-  if (typeof header !== 'string') {
-    throw new WWWAuthenticateError(
-      'invalid_request',
-      'Authorization header required',
-      { Bearer: {}, DPoP: {} },
-    )
-  }
-
-  const parsed = authorizationHeaderSchema.safeParse(header.split(' '))
-  if (!parsed.success) {
-    throw new InvalidRequestError('Invalid authorization header')
-  }
-  return parsed.data
-}

package/src/lib/util/cast.ts

@@ -1,18 +0,0 @@
-export function asArray<T>(value: T | T[]): T[] {
-  if (value == null) return []
-  return Array.isArray(value) ? value : [value]
-}
-
-export function asURL(value: string | { toString: () => string }): URL {
-  return new URL(value)
-}
-
-export function ifURL(
-  value: string | { toString: () => string },
-): URL | undefined {
-  try {
-    return asURL(value)
-  } catch {
-    return undefined
-  }
-}

package/src/lib/util/color.ts

@@ -1,168 +0,0 @@
-import { parseUi8Dec, parseUi8Hex } from './ui8.js'
-
-export type RgbColor = { r: number; g: number; b: number }
-export type HslColor = { h: number; s: number; l: number }
-export type RgbaColor = { r: number; g: number; b: number; a: number }
-export type HslaColor = { h: number; s: number; l: number; a: number }
-
-export type Color = RgbColor | HslColor | RgbaColor | HslaColor
-
-export function parseColor(color: string): RgbColor | RgbaColor {
-  if (color.startsWith('#')) {
-    return parseHexColor(color)
-  }
-
-  if (color.startsWith('rgba(')) {
-    return parseRgbaColor(color)
-  }
-
-  if (color.startsWith('rgb(')) {
-    return parseRgbColor(color)
-  }
-
-  // Should never happen (as long as the input is a validated WebColor)
-  throw new TypeError(`Invalid color value: ${color}`)
-}
-
-export function parseHexColor(v: string): RgbColor | RgbaColor {
-  // parseInt('az', 16) does not return NaN so we need to check the format
-  if (!/^#[0-9a-f]+$/i.test(v)) {
-    throw new TypeError(`Invalid hex color value: ${v}`)
-  }
-
-  if (v.length === 4 || v.length === 5) {
-    const r = parseUi8Hex(v[1].repeat(2))
-    const g = parseUi8Hex(v[2].repeat(2))
-    const b = parseUi8Hex(v[3].repeat(2))
-    const a = v.length > 4 ? parseUi8Hex(v[4].repeat(2)) : undefined
-    return a == null ? { r, g, b } : { r, g, b, a }
-  }
-
-  if (v.length === 7 || v.length === 9) {
-    const r = parseUi8Hex(v.slice(1, 3))
-    const g = parseUi8Hex(v.slice(3, 5))
-    const b = parseUi8Hex(v.slice(5, 7))
-    const a = v.length > 8 ? parseUi8Hex(v.slice(7, 9)) : undefined
-    return a == null ? { r, g, b } : { r, g, b, a }
-  }
-
-  throw new TypeError(`Invalid hex color value: ${v}`)
-}
-
-export function parseRgbColor(v: string): RgbColor {
-  const matches = v.match(/^\s*rgb\(\s*(\d+)\s*,\s*(\d+)\s*,\s*(\d+)\s*\)\s*$/)
-  if (!matches) throw new TypeError(`Invalid rgb color value: ${v}`)
-
-  const r = parseUi8Dec(matches[1])
-  const g = parseUi8Dec(matches[2])
-  const b = parseUi8Dec(matches[3])
-  return { r, g, b }
-}
-
-export function parseRgbaColor(v: string): RgbaColor {
-  const matches = v.match(
-    /^\s*rgba\(\s*(\d+)\s*,\s*(\d+)\s*,\s*(\d+)\s*,\s*(\d+)\s*\)\s*$/,
-  )
-  if (!matches) throw new TypeError(`Invalid rgba color value: ${v}`)
-
-  const r = parseUi8Dec(matches[1])
-  const g = parseUi8Dec(matches[2])
-  const b = parseUi8Dec(matches[3])
-  const a = parseUi8Dec(matches[4])
-  return { r, g, b, a }
-}
-
-/**
- * Return the color that has the best contrast with the reference color.
- */
-export function pickContrastColor(ref: RgbColor, a: RgbColor, b: RgbColor) {
-  return computeContrastRatio(ref, a) > computeContrastRatio(ref, b) ? a : b
-}
-
-export function hslToRgb({ h, s, l }: HslColor): RgbColor
-export function hslToRgb({ h, s, l, a }: HslaColor): RgbaColor
-export function hslToRgb(input: HslaColor | HslColor): RgbColor | RgbaColor {
-  const { h, s, l } = input
-
-  // Achromatic (gray)
-  if (s === 0) {
-    const gray = Math.round(l * 255)
-    return 'a' in input
-      ? { r: gray, g: gray, b: gray, a: input.a }
-      : { r: gray, g: gray, b: gray }
-  }
-
-  const hueToRgb = (p: number, q: number, t: number): number => {
-    if (t < 0) t += 1
-    if (t > 1) t -= 1
-    if (t < 1 / 6) return p + (q - p) * 6 * t
-    if (t < 1 / 2) return q
-    if (t < 2 / 3) return p + (q - p) * (2 / 3 - t) * 6
-    return p
-  }
-
-  const q = l < 0.5 ? l * (1 + s) : l + s - l * s
-  const p = 2 * l - q
-  const hNorm = h / 360
-
-  const r = Math.round(hueToRgb(p, q, hNorm + 1 / 3) * 255)
-  const g = Math.round(hueToRgb(p, q, hNorm) * 255)
-  const b = Math.round(hueToRgb(p, q, hNorm - 1 / 3) * 255)
-
-  return 'a' in input ? { r, g, b, a: input.a } : { r, g, b }
-}
-
-/**
- * @see {@link https://www.w3.org/TR/2008/REC-WCAG20-20081211/#relativeluminancedef}
- */
-function relativeLuminance(color: HslColor | RgbColor) {
-  const { r, g, b } = 'h' in color ? hslToRgb(color) : color
-  return rgbLum(r) * 0.2126 + rgbLum(g) * 0.7152 + rgbLum(b) * 0.0722
-}
-
-function rgbLum(value) {
-  const rgb = value / 255
-  return rgb < 0.03928 ? rgb / 12.92 : Math.pow((rgb + 0.055) / 1.055, 2.4)
-}
-
-/**
- * @see {@link https://www.w3.org/TR/2008/REC-WCAG20-20081211/#contrast-ratiodef}
- */
-function computeContrastRatio(a: RgbColor, b: RgbColor) {
-  const aLum = relativeLuminance(a)
-  const bLum = relativeLuminance(b)
-  const [lighter, darker] = aLum > bLum ? [aLum, bLum] : [bLum, aLum]
-  return (lighter + 0.05) / (darker + 0.05)
-}
-
-export function extractHue(input: RgbColor): number {
-  const r = input.r / 255
-  const g = input.g / 255
-  const b = input.b / 255
-
-  const max = Math.max(r, g, b)
-  const min = Math.min(r, g, b)
-
-  const chroma = max - min
-
-  switch (max) {
-    case min:
-      return 0 // Achromatic
-    case r: {
-      const segment = (g - b) / chroma
-      const shift = segment < 0 ? 360 / 60 : 0 / 60
-      return 60 * (segment + shift)
-    }
-    case g: {
-      const segment = (b - r) / chroma
-      const shift = 120 / 60
-      return 60 * (segment + shift)
-    }
-    // "default" needed for type safety. In practice, should be same as "case b:"
-    default: {
-      const segment = (r - g) / chroma
-      const shift = 240 / 60
-      return 60 * (segment + shift)
-    }
-  }
-}

package/src/lib/util/crypto.ts

@@ -1,32 +0,0 @@
-import { randomBytes } from 'node:crypto'
-
-export async function randomBuffer(bytesLength = 16) {
-  return new Promise<Buffer>((resolve, reject) => {
-    randomBytes(bytesLength, (err, buf) => {
-      if (err) return reject(err)
-      resolve(buf)
-    })
-  })
-}
-
-export async function randomHexId(bytesLength = 16) {
-  const buffer = await randomBuffer(bytesLength)
-  return buffer.toString('hex')
-}
-
-// Basically all algorithms supported by "jose"'s jwtVerify().
-// @TODO Is there a way to get this list from the runtime instead of hardcoding it?
-export const VERIFY_ALGOS = [
-  'RS256',
-  'RS384',
-  'RS512',
-
-  'PS256',
-  'PS384',
-  'PS512',
-
-  'ES256',
-  'ES256K',
-  'ES384',
-  'ES512',
-] as const

package/src/lib/util/date.ts

@@ -1,7 +0,0 @@
-export function dateToEpoch(date: Date = new Date()) {
-  return Math.floor(date.getTime() / 1000)
-}
-
-export function dateToRelativeSeconds(date: Date) {
-  return Math.floor((date.getTime() - Date.now()) / 1000)
-}

package/src/lib/util/error.ts

@@ -1,7 +0,0 @@
-import { ZodError } from 'zod'
-import { formatZodError } from './zod-error.js'
-
-export function formatError(err: unknown, prefix: string): string {
-  if (err instanceof ZodError) return formatZodError(err, prefix)
-  return prefix
-}

package/src/lib/util/function.ts

@@ -1,39 +0,0 @@
-/**
- * This function serves two purposes:
- * - It ensures that the return value is a Promise, even if the function returns
- *   a "thenable" (i.e. a Promise-like object).
- * - It allows to avoid assigning a `this` context to the function, which is
- *   particularly useful when the function is a member of a "private" object.
- */
-export async function callAsync<F extends (...args: any[]) => unknown>(
-  fn: F,
-  ...args: Parameters<F>
-): Promise<Awaited<ReturnType<F>>>
-export async function callAsync<F extends (...args: any[]) => unknown>(
-  fn?: F,
-  ...args: Parameters<F>
-): Promise<Awaited<ReturnType<F>> | undefined>
-export async function callAsync<F extends (...args: any[]) => unknown>(
-  fn?: F,
-  ...args: Parameters<F>
-): Promise<unknown> {
-  return fn?.(...args)
-}
-
-export function invokeOnce<T extends (this: any, ...a: any[]) => any>(
-  fn: T,
-): T {
-  let fnNullable: T | null = fn
-  return function (...args) {
-    if (fnNullable) {
-      const fn = fnNullable
-      fnNullable = null
-      return fn.call(this, ...args)
-    }
-    throw new Error('Function called multiple times')
-  } as T
-}
-
-export function includedIn<T>(this: readonly T[], value: T): boolean {
-  return this.includes(value)
-}

package/src/lib/util/locale.ts

@@ -1,12 +0,0 @@
-import { z } from 'zod'
-
-export const localeSchema = z
-  .string()
-  .regex(/^[a-z]{2,3}(-[A-Z]{2})?$/, 'Invalid locale')
-export type Locale = z.infer<typeof localeSchema>
-
-export const multiLangStringSchema = z.record(
-  localeSchema,
-  z.string().optional(),
-)
-export type MultiLangString = z.infer<typeof multiLangStringSchema>

package/src/lib/util/object.ts

@@ -1,23 +0,0 @@
-export function mergeDefaults<T extends object>(
-  defaults: T,
-  ...overrides: (T | undefined)[]
-): T {
-  // @NOTE Not using the spread operator here because TS allows "undefined"
-  // values to be spread, which can lead to defaults being overwritten with
-  // "undefined". This function ensures that only defined values in "options"
-  // will overwrite the corresponding values in "defaults".
-  if (!overrides.length) return defaults
-  if (!overrides.some(Boolean)) return defaults
-  const result: T = { ...defaults } as T
-  for (const options of overrides) {
-    if (options) {
-      for (const key in options) {
-        const value = options[key]
-        if (value !== undefined) {
-          result[key] = value
-        }
-      }
-    }
-  }
-  return result
-}

package/src/lib/util/redirect-uri.ts

@@ -1,46 +0,0 @@
-import { isLoopbackHost } from '@atproto/oauth-types'
-
-/**
- *
- * @see {@link https://datatracker.ietf.org/doc/html/rfc8252#section-8.4}
- * @see {@link https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-11#section-8.4.2}
- */
-export function compareRedirectUri(
-  allowed_uri: string,
-  request_uri: string,
-): boolean {
-  // https://datatracker.ietf.org/doc/html/rfc8252#section-8.4
-  //
-  // > Authorization servers MUST require clients to register their complete
-  // > redirect URI (including the path component) and reject authorization
-  // > requests that specify a redirect URI that doesn't exactly match the
-  // > one that was registered; the exception is loopback redirects, where
-  // > an exact match is required except for the port URI component.
-  if (allowed_uri === request_uri) return true
-
-  // https://datatracker.ietf.org/doc/html/rfc8252#section-7.3
-  const allowedUri = new URL(allowed_uri)
-  if (isLoopbackHost(allowedUri.hostname)) {
-    const requestUri = new URL(request_uri)
-
-    return (
-      // > The authorization server MUST allow any port to be specified at the
-      // > time of the request for loopback IP redirect URIs, to accommodate
-      // > clients that obtain an available ephemeral port from the operating
-      // > system at the time of the request
-      //
-      // Note: We only apply this rule if the allowed URI does not have a port
-      // specified.
-      (!allowedUri.port || allowedUri.port === requestUri.port) &&
-      allowedUri.hostname === requestUri.hostname &&
-      allowedUri.pathname === requestUri.pathname &&
-      allowedUri.protocol === requestUri.protocol &&
-      allowedUri.search === requestUri.search &&
-      allowedUri.hash === requestUri.hash &&
-      allowedUri.username === requestUri.username &&
-      allowedUri.password === requestUri.password
-    )
-  }
-
-  return false
-}

package/src/lib/util/time.ts

@@ -1,49 +0,0 @@
-import { setTimeout as sleep } from 'node:timers/promises'
-import { Awaitable } from './type.js'
-
-export function onOvertimeDefault(options: {
-  start: number
-  end: number
-  elapsed: number
-  time: number
-}): void {
-  console.warn(
-    `constantTime: execution time was ${options.elapsed}ms (which is greater than ${options.time}ms). You should increase the "time" to properly defend against timing attacks.`,
-  )
-}
-
-/**
- * Utility function to protect against timing attacks.
- */
-export async function constantTime<R>(
-  time: number,
-  fn: () => Awaitable<R>,
-  onOvertime = onOvertimeDefault,
-): Promise<R> {
-  if (!Number.isFinite(time) || time <= 0) {
-    throw new TypeError(`"time" must be a positive number`)
-  }
-
-  const start = Date.now()
-  try {
-    return await fn()
-  } finally {
-    const end = Date.now()
-    const elapsed = end - start
-
-    const remaining = time - elapsed
-    if (remaining >= 0) {
-      // Happy path, execution time was smaller than "time"
-      await sleep(remaining)
-    } else {
-      // The function execution took longer than "time"
-      onOvertime({ start, end, elapsed, time })
-
-      // Sleep until the next multiple of "time" to mitigate any attack
-      const multiplier = Math.ceil(elapsed / time)
-      const remaining = multiplier * time - elapsed
-
-      await sleep(remaining)
-    }
-  }
-}