@atproto/oauth-provider 0.19.6 → 0.19.8

package/src/lib/util/type.ts

@@ -1,182 +0,0 @@
-export type Simplify<T> = { [K in keyof T]: T[K] } & {}
-export type Override<T, V> = Simplify<{
-  [K in keyof (V & T)]: K extends keyof V
-    ? V[K]
-    : K extends keyof T
-      ? T[K]
-      : never
-}>
-export type Awaitable<T> = T | Promise<T>
-export type NonNullableKeys<T, K extends keyof T> = Simplify<
-  OmitKey<T, K> & {
-    [P in K]-?: NonNullable<T[P]>
-  }
->
-/**
- * When a type has an `[x: string]: unknown` index signature, in addition to
- * some known properties, using {@link Omit} will result in a type that only has
- * the index signature, and no known properties.
- *
- * ```ts
- * Omit<{ a: 3; b: 4; [x: string]: unknown }, 'a'> // { [x: string]: unknown }
- * ```
- *
- * In order to properly omit specific known properties from a type with an index
- * signature, we need to use another utility type that will behave correctly.
- *
- * ```ts
- * OmitKey<{ a: 3; b: 4; [x: string]: unknown }, 'a'> // { b: 4; [x: string]: unknown }
- * ```
- */
-export type OmitKey<T, K extends keyof T> = {
-  [K2 in keyof T as K2 extends K ? never : K2]: T[K2]
-}
-
-export type RequiredKey<T, K extends keyof T = never> = Simplify<
-  T & {
-    [L in K]-?: unknown extends T[L]
-      ? NonNullable<unknown> | null
-      : Exclude<T[L], undefined>
-  }
->
-
-/**
- * Converts a tuple to the equivalent type of combining every item into a single
- * one. If any of the item in the tuple is non nullish, the result will be non
- * nullish.
- */
-export type CombinedTuple<T extends readonly unknown[]> = T extends []
-  ? undefined
-  : Exclude<
-      T[number],
-      // If any item in the tuple is never `null` (resp. `undefined`), exclude
-      // `null` (resp. `undefined`) from `T[number]`
-      {
-        [K in keyof T]-?:
-          | (null extends T[K] ? never : null)
-          | (undefined extends T[K] ? never : undefined)
-      }[keyof T]
-    >
-
-/**
- * Similar to {@link Required} but also ensures that all values are defined.
- */
-export type RequiredDefined<T> = { [K in keyof T]-?: Exclude<T[K], undefined> }
-
-// <hardcore-mode> (don't touch this)
-
-/**
- * @example
- * ```ts
- * type F = UnionToFnUnion<'a' | 'b'> // (() => 'a') | (() => 'b')
- * ```
- */
-type UnionToFnUnion<T> = T extends any ? () => T : never
-
-/**
- * @example
- * ```ts
- * type A = UnionToIntersection<(() => 'a') | (() => 'b')> // (() => 'a') & (() => 'b')
- *
- * UnionToIntersection<{ foo: string | number } | { foo: number; bar: 4 }> // { foo: number; bar: 4 }
- * ```
- */
-type UnionToIntersection<T> = (T extends any ? (x: T) => void : never) extends (
-  x: infer U,
-) => void
-  ? U
-  : never
-
-/**
- * @example
- * ```ts
- * type B = ExtractUnionItem<'a' | 'b'> // 'b'
- * ```
- */
-type ExtractUnionItem<T> =
-  // There exists a quirk in the way TypeScript works when inferring return
-  // types of an (disjoined) intersection of functions:
-  //
-  // type AnB = (() => 'a') & (() => 'b')
-  // type B = AnB extends () => infer R ? R : never // 'b'
-  //
-  // By turning the input union T (e.g. 'a' | 'b') into a union of function
-  // (() => 'a') | (() => 'b') and then into an intersection of those functions
-  // (() => 'a') & (() => 'b'), we can exploit the special TypeScript behavior
-  // to infer only the last return type from the functions, which is effectively
-  // equal to the last item of the input union T.
-  UnionToIntersection<UnionToFnUnion<T>> extends () => infer R ? R : never
-
-/**
- * Utility that turn a union of types (`'a' | 'b'`) into a tuple with matching
- * types (`['a', 'b']`).
- *
- * @note this only work with unions of "const" types. Using this with globals
- * types (`string`, etc.) will yield unexpected results.
- *
- * @example
- * ```ts
- * type T = UnionToTuple<'a' | 'b'> // ['a', 'b']
- * type T = UnionToTuple<'a' | 'b' | 'c'> // ['a', 'b', 'c']
- * ```
- */
-type UnionToTuple<T> = UnionToTupleInternal<T>
-
-type UnionToTupleInternal<
-  T,
-  // Accumulator for terminal recursivity (initialized to empty tuple)
-  Acc extends readonly any[] = [],
-  // Get the next item from the union (if any)
-  Next = ExtractUnionItem<T>,
-> =
-  // If there were no more items to extract from the union T, then we are done
-  [Next] extends [never]
-    ? // Return result of previous recursive calls
-      Acc
-    : // Recursively call UnionToTupleInternal by Exclude'ing the Next item from
-      // the union (T) and adding it to the accumulator.
-      UnionToTupleInternal<Exclude<T, Next>, readonly [Next, ...Acc]>
-
-/**
- * This utility allows to create an assertion function that checks if a
- * particular interface is fully implemented by some value.
- *
- * The use of the (rather complex) {@link UnionToTuple} allows to ensure that,
- * at runtime, all the required interface keys are indeed checked, and that
- * future additions to the interface do not result in a false sense of type
- * safety.
- *
- * @note This function should not be made public, as it relies on a quirk of
- * TypeScript to work properly.
- *
- * @example Valid use
- *
- * ```ts
- * const isFoo = buildInterfaceChecker<{ foo: string }>(['foo'])
- * const isFooBar = buildInterfaceChecker<{ foo: string; bar: boolean }>([
- *   'foo',
- *   'bar',
- * ])
- *
- * declare const val: { foo?: string }
- *
- * if (isFoo(val)) {
- *   val // { foo: string }
- * }
- * ```
- *
- * @example Use cases where the runtime keys do not match the interface keys
- *
- * ```ts
- * buildInterfaceChecker<{ foo: string }>([])
- * buildInterfaceChecker<{ foo: string }>(['fee'])
- * buildInterfaceChecker<{ foo: string; bar: string }>(['foo'])
- * buildInterfaceChecker<{ foo: string; bar: string }>(['foo', 'baz'])
- * ```
- */
-export const buildInterfaceChecker =
-  <I extends object>(keys: readonly string[] & UnionToTuple<keyof I>) =>
-  <V extends Partial<I>>(value: V): value is V & RequiredDefined<I> =>
-    keys.every((name) => value[name] !== undefined)
-
-// </hardcore-mode>

package/src/lib/util/ui8.ts

@@ -1,14 +0,0 @@
-export function parseUi8Hex(v: string) {
-  return asUi8(parseInt(v, 16))
-}
-
-export function parseUi8Dec(v: string) {
-  return asUi8(parseInt(v, 10))
-}
-
-export function asUi8(v: number) {
-  if (v >= 0 && v <= 255 && Number.isInteger(v)) return v
-  throw new TypeError(
-    `Invalid value "${v}" (expected an integer between 0 and 255)`,
-  )
-}

package/src/lib/util/well-known.ts

@@ -1,8 +0,0 @@
-export function buildWellknownUrl(url: URL, name: string): URL {
-  const path =
-    url.pathname === '/'
-      ? `/.well-known/${name}`
-      : `${url.pathname.replace(/\/+$/, '')}/${name}`
-
-  return new URL(path, url)
-}

package/src/lib/util/zod-error.ts

@@ -1,26 +0,0 @@
-import { ZodError, ZodIssue, ZodIssueCode } from 'zod'
-
-export function formatZodError(err: ZodError, prefix?: string): string {
-  const message = err.issues.length
-    ? err.issues.map(formatZodIssue).join('; ')
-    : err.message // Should never happen (issues should never be empty)
-  return prefix ? `${prefix}: ${message}` : message
-}
-
-export function formatZodIssue(issue: ZodIssue): string {
-  if (issue.code === ZodIssueCode.invalid_union) {
-    return issue.unionErrors
-      .map((err) => err.issues.map(formatZodIssue).join('; '))
-      .join(', or ')
-  }
-
-  if (issue.path.length === 1 && typeof issue.path[0] === 'number') {
-    return `${issue.message} at index ${issue.path[0]}`
-  }
-
-  if (issue.path.length) {
-    return `${issue.message} at ${issue.path.join('.')}`
-  }
-
-  return issue.message
-}

package/src/lib/write-form-redirect.ts

@@ -1,58 +0,0 @@
-import type { ServerResponse } from 'node:http'
-import { html, js } from './html/index.js'
-import { setCookie } from './http/request.js'
-import { SecurityHeadersOptions } from './http/security-headers.js'
-import { writeHtml } from './write-html.js'
-
-export type WriteFormRedirectOptions = SecurityHeadersOptions
-
-// We prevent the user from coming "back" to this page and resubmitting the form
-// repeatedly by disabling the submit button after the first submission.
-const SCRIPT = js`
-const form = document.forms[0];
-
-let canSubmit = true;
-
-form.addEventListener('submit', (event) => {
-  if (!canSubmit) {
-    event.preventDefault();
-  } else {
-    canSubmit = false;
-  }
-});
-
-setTimeout(() => {
-  form.submit();
-}, 1);
-`
-
-// @NOTE If translations and design are needed, consider replacing this with a
-// web app page.
-
-export function writeFormRedirect(
-  res: ServerResponse,
-  method: 'post' | 'get',
-  uri: string,
-  params: Iterable<[string, string]>,
-  options?: WriteFormRedirectOptions,
-): void {
-  res.setHeader('Cache-Control', 'no-store')
-
-  // Prevent the Chrome from caching this page
-  // see: https://latesthackingnews.com/2023/12/12/google-updates-chrome-bfcache-for-faster-page-viewing/
-  setCookie(res, 'bfCacheBypass', 'foo', { maxAge: 1, sameSite: 'lax' })
-
-  return writeHtml(res, {
-    ...options,
-    htmlAttrs: { lang: 'en' },
-    scripts: [SCRIPT],
-    body: html`
-      <form method="${method}" action="${uri}">
-        ${Array.from(params, ([key, value]) => [
-          html`<input type="hidden" name="${key}" value="${value}" />`,
-        ])}
-        <input type="submit" value="Continue" />
-      </form>
-    `,
-  })
-}

package/src/lib/write-html.ts

@@ -1,70 +0,0 @@
-import { createHash } from 'node:crypto'
-import type { ServerResponse } from 'node:http'
-import { CspValue, mergeCsp } from './csp/index.js'
-import {
-  AssetRef,
-  BuildDocumentOptions,
-  Html,
-  buildDocument,
-} from './html/index.js'
-import { WriteResponseOptions, writeBuffer } from './http/response.js'
-import {
-  SecurityHeadersOptions,
-  setSecurityHeaders,
-} from './http/security-headers.js'
-
-export type WriteHtmlOptions = BuildDocumentOptions &
-  WriteResponseOptions &
-  SecurityHeadersOptions
-
-export function writeHtml(
-  res: ServerResponse,
-  options: WriteHtmlOptions,
-): void {
-  // @NOTE the csp string might be quite long. In that case it might be tempting
-  // to set it through the http-equiv <meta> in the HTML. However, some
-  // directives cannot be enforced by browsers when set through the meta tag
-  // (e.g. 'frame-ancestors'). Therefore, it's better to set the CSP through the
-  // HTTP header.
-  const csp = mergeCsp(
-    {
-      // Keep "upgrade-insecure-requests" in sync with HSTS setting. HSTS is
-      // typically set to false for localhost endpoints. Chrome and FF will
-      // ignore "upgrade-insecure-requests" from localhost, but Safari will
-      // enforce it, requiring to be explicitly disable it for localhost.
-      'upgrade-insecure-requests': options.hsts !== false,
-      'default-src': ["'none'"],
-      'base-uri': options.base?.origin as undefined | `https://${string}`,
-      'script-src': options.scripts?.map(assetToCsp).filter((v) => v != null),
-      'style-src': options.styles?.map(assetToCsp).filter((v) => v != null),
-    },
-    options.csp,
-  )
-
-  const html = buildDocument(options).toString()
-
-  // HTML pages should always be served with safety protection headers
-  setSecurityHeaders(res, { ...options, csp })
-  writeBuffer(res, html, {
-    ...options,
-    contentType: options?.contentType ?? 'text/html; charset=utf-8',
-  })
-}
-
-function assetToCsp(asset?: Html | AssetRef): undefined | CspValue {
-  if (asset == null) return undefined
-  if (asset instanceof Html) {
-    // Inline assets are "allowed" by their hash
-    const hash = createHash('sha256')
-    for (const fragment of asset) hash.update(fragment)
-    return `'sha256-${hash.digest('base64')}'`
-  } else {
-    // External assets are referenced by their origin
-    if (asset.url.startsWith('https:') || asset.url.startsWith('http:')) {
-      return new URL(asset.url).origin as `https:${string}` | `http:${string}`
-    }
-
-    // Internal assets are served from the same origin
-    return `'self'`
-  }
-}

package/src/metadata/build-metadata.ts

@@ -1,141 +0,0 @@
-import { Keyset } from '@atproto/jwk'
-import {
-  OAuthAuthorizationServerMetadata,
-  OAuthIssuerIdentifier,
-  oauthAuthorizationServerMetadataValidator,
-} from '@atproto/oauth-types'
-import { Client } from '../client/client.js'
-import { VERIFY_ALGOS } from '../lib/util/crypto.js'
-
-export type CustomMetadata = {
-  authorization_details_types_supported?: string[]
-  protected_resources?: string[]
-}
-
-/**
- * @see {@link https://datatracker.ietf.org/doc/html/rfc8414#section-2}
- * @see {@link https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata}
- * @see {@link https://openid.net/specs/openid-connect-prompt-create-1_0.html}
- */
-export function buildMetadata(
-  issuer: OAuthIssuerIdentifier,
-  keyset: Keyset,
-  customMetadata?: CustomMetadata,
-): OAuthAuthorizationServerMetadata {
-  return oauthAuthorizationServerMetadataValidator.parse({
-    issuer,
-
-    scopes_supported: [
-      'atproto',
-
-      // These serve as hint that this server supports the transitional scopes.
-      // This is not a specced behavior.
-      'transition:email',
-      'transition:generic',
-      'transition:chat.bsky',
-
-      // Other atproto scopes can't be enumerated as they are dynamic.
-    ],
-    subject_types_supported: [
-      //
-      'public', // The same "sub" is returned for all clients
-      // 'pairwise', // A different "sub" is returned for each client
-    ],
-    response_types_supported: [
-      // OAuth
-      'code',
-      // 'token',
-
-      // OpenID
-      // 'none',
-      // 'code id_token token',
-      // 'code id_token',
-      // 'code token',
-      // 'id_token token',
-      // 'id_token',
-    ],
-    response_modes_supported: [
-      // https://openid.net/specs/oauth-v2-multiple-response-types-1_0.html#ResponseModes
-      'query',
-      'fragment',
-      // https://openid.net/specs/oauth-v2-form-post-response-mode-1_0.html#FormPostResponseMode
-      'form_post',
-    ],
-    grant_types_supported: [
-      //
-      'authorization_code',
-      'refresh_token',
-    ],
-    code_challenge_methods_supported: [
-      // https://www.iana.org/assignments/oauth-parameters/oauth-parameters.xhtml#pkce-code-challenge-method
-      'S256',
-
-      // atproto does not allow "plain"
-      // 'plain',
-    ],
-    ui_locales_supported: [
-      //
-      'en-US',
-    ],
-    display_values_supported: [
-      //
-      'page',
-      'popup',
-      'touch',
-      // 'wap', LoL
-    ],
-
-    // https://openid.net/specs/openid-connect-prompt-create-1_0.html
-    prompt_values_supported: [
-      'none',
-      'login',
-      'consent',
-      'select_account',
-      'create',
-    ],
-
-    // https://datatracker.ietf.org/doc/html/rfc9207
-    authorization_response_iss_parameter_supported: true,
-
-    // https://datatracker.ietf.org/doc/html/rfc9101#section-4
-    request_object_signing_alg_values_supported: [...VERIFY_ALGOS, 'none'],
-    request_object_encryption_alg_values_supported: [], // None
-    request_object_encryption_enc_values_supported: [], // None
-
-    request_parameter_supported: true,
-    request_uri_parameter_supported: true,
-    require_request_uri_registration: true,
-
-    jwks_uri: new URL('/oauth/jwks', issuer).href,
-
-    authorization_endpoint: new URL('/oauth/authorize', issuer).href,
-
-    token_endpoint: new URL('/oauth/token', issuer).href,
-    token_endpoint_auth_methods_supported: [...Client.AUTH_METHODS_SUPPORTED],
-    token_endpoint_auth_signing_alg_values_supported: [...VERIFY_ALGOS],
-
-    revocation_endpoint: new URL('/oauth/revoke', issuer).href,
-
-    // @TODO Should we implement these endpoints?
-    // introspection_endpoint: new URL('/oauth/introspect', issuer).href,
-    // end_session_endpoint: new URL('/oauth/logout', issuer).href,
-
-    // https://datatracker.ietf.org/doc/html/rfc9126#section-5
-    pushed_authorization_request_endpoint: new URL('/oauth/par', issuer).href,
-
-    require_pushed_authorization_requests: true,
-
-    // https://datatracker.ietf.org/doc/html/rfc9449#section-5.1
-    dpop_signing_alg_values_supported: [...VERIFY_ALGOS],
-
-    // https://datatracker.ietf.org/doc/html/rfc9396#section-14.4
-    authorization_details_types_supported:
-      customMetadata?.authorization_details_types_supported,
-
-    // https://www.rfc-editor.org/rfc/rfc9728.html#section-4
-    protected_resources: customMetadata?.protected_resources,
-
-    // https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-00.html
-    client_id_metadata_document_supported: true,
-  })
-}

package/src/oauth-client.ts

@@ -1,3 +0,0 @@
-export * from '@atproto/oauth-types'
-export type * from './client/client.js'
-export * from './client/client-utils.js'

package/src/oauth-dpop.ts

@@ -1,2 +0,0 @@
-export * from './dpop/dpop-nonce.js'
-export * from './dpop/dpop-manager.js'

package/src/oauth-errors.ts

@@ -1,26 +0,0 @@
-// Root Error class
-export { OAuthError } from './errors/oauth-error.js'
-
-export * from './errors/access-denied-error.js'
-export * from './errors/account-selection-required-error.js'
-export * from './errors/authorization-error.js'
-export * from './errors/consent-required-error.js'
-export * from './errors/handle-unavailable-error.js'
-export * from './errors/invalid-authorization-details-error.js'
-export * from './errors/invalid-client-error.js'
-export * from './errors/invalid-client-id-error.js'
-export * from './errors/invalid-client-metadata-error.js'
-export * from './errors/invalid-credentials-error.js'
-export * from './errors/invalid-dpop-key-binding-error.js'
-export * from './errors/invalid-dpop-proof-error.js'
-export * from './errors/invalid-grant-error.js'
-export * from './errors/invalid-invite-code-error.js'
-export * from './errors/invalid-redirect-uri-error.js'
-export * from './errors/invalid-request-error.js'
-export * from './errors/invalid-scope-error.js'
-export * from './errors/invalid-token-error.js'
-export * from './errors/login-required-error.js'
-export * from './errors/second-authentication-factor-required-error.js'
-export * from './errors/unauthorized-client-error.js'
-export * from './errors/use-dpop-nonce-error.js'
-export * from './errors/www-authenticate-error.js'