@atproto/oauth-provider 0.19.6 → 0.19.8

package/src/oauth-store.ts

@@ -1,12 +0,0 @@
-/**
- * Every store file exports all the types needed to implement that store. This
- * files re-exports all the types from the x-store files.
- */
-
-export * from './account/account-store.js'
-export * from './client/client-store.js'
-export * from './device/device-store.js'
-export * from './lexicon/lexicon-store.js'
-export * from './replay/replay-store.js'
-export * from './request/request-store.js'
-export * from './token/token-store.js'

package/src/oauth-verifier.ts

@@ -1,260 +0,0 @@
-import type { Redis, RedisOptions } from 'ioredis'
-import { Key, Keyset, isSignedJwt } from '@atproto/jwk'
-import {
-  OAuthAccessToken,
-  OAuthIssuerIdentifier,
-  OAuthTokenType,
-  oauthIssuerIdentifierSchema,
-} from '@atproto/oauth-types'
-import { DpopManager, DpopManagerOptions } from './dpop/dpop-manager.js'
-import { DpopNonce } from './dpop/dpop-nonce.js'
-import { DpopProof } from './dpop/dpop-proof.js'
-import { InvalidDpopKeyBindingError } from './errors/invalid-dpop-key-binding-error.js'
-import { InvalidDpopProofError } from './errors/invalid-dpop-proof-error.js'
-import { InvalidTokenError } from './errors/invalid-token-error.js'
-import { UseDpopNonceError } from './errors/use-dpop-nonce-error.js'
-import { WWWAuthenticateError } from './errors/www-authenticate-error.js'
-import { parseAuthorizationHeader } from './lib/util/authorization-header.js'
-import { includedIn } from './lib/util/function.js'
-import { OAuthHooks } from './oauth-hooks.js'
-import { ReplayManager } from './replay/replay-manager.js'
-import { ReplayStoreMemory } from './replay/replay-store-memory.js'
-import { ReplayStoreRedis } from './replay/replay-store-redis.js'
-import { ReplayStore } from './replay/replay-store.js'
-import { AccessTokenPayload } from './signer/access-token-payload.js'
-import { Signer } from './signer/signer.js'
-
-export type DecodeTokenHook = OAuthHooks['onDecodeToken']
-
-export type OAuthVerifierOptions = DpopManagerOptions & {
-  /**
-   * The "issuer" identifier of the OAuth provider, this is the base URL of the
-   * OAuth provider.
-   */
-  issuer: URL | string
-
-  /**
-   * The keyset used to sign access tokens.
-   */
-  keyset: Keyset | Iterable<Key | undefined | null | false>
-
-  /**
-   * A redis instance to use for replay protection. If not provided, replay
-   * protection will use memory storage.
-   */
-  redis?: Redis | RedisOptions | string
-
-  replayStore?: ReplayStore
-
-  onDecodeToken?: DecodeTokenHook
-}
-
-export type VerifyTokenPayloadOptions = {
-  /** One of these audience must be included in the token audience(s) */
-  audience?: [string, ...string[]]
-  /** One of these scope must be included in the token scope(s) */
-  scope?: [string, ...string[]]
-}
-
-export { DpopNonce, Key, Keyset }
-export type {
-  AccessTokenPayload,
-  DpopProof,
-  OAuthTokenType,
-  RedisOptions,
-  ReplayStore,
-}
-
-export class OAuthVerifier {
-  private readonly onDecodeToken?: DecodeTokenHook
-
-  public readonly issuer: OAuthIssuerIdentifier
-  public readonly keyset: Keyset
-
-  public readonly dpopManager: DpopManager
-  public readonly replayManager: ReplayManager
-  public readonly signer: Signer
-
-  constructor({
-    redis,
-    issuer,
-    keyset,
-    replayStore = redis != null
-      ? new ReplayStoreRedis({ redis })
-      : new ReplayStoreMemory(),
-    onDecodeToken,
-
-    ...rest
-  }: OAuthVerifierOptions) {
-    const dpopMgrOptions: DpopManagerOptions = rest
-
-    const issuerParsed = oauthIssuerIdentifierSchema.parse(issuer)
-    const issuerUrl = new URL(issuerParsed)
-
-    // @TODO (?) support issuer with path
-    if (issuerUrl.pathname !== '/') {
-      throw new TypeError(
-        `"issuer" must be an URL with no path, search or hash (${issuerUrl})`,
-      )
-    }
-
-    this.issuer = issuerParsed
-    this.keyset = keyset instanceof Keyset ? keyset : new Keyset(keyset)
-
-    this.dpopManager = new DpopManager(dpopMgrOptions)
-    this.replayManager = new ReplayManager(replayStore)
-    this.signer = new Signer(this.issuer, this.keyset)
-
-    this.onDecodeToken = onDecodeToken
-  }
-
-  public nextDpopNonce() {
-    return this.dpopManager.nextNonce()
-  }
-
-  public async checkDpopProof(
-    httpMethod: string,
-    httpUrl: Readonly<URL>,
-    httpHeaders: Record<string, undefined | string | string[]>,
-    accessToken?: string,
-  ): Promise<null | DpopProof> {
-    const dpopProof = await this.dpopManager.checkProof(
-      httpMethod,
-      httpUrl,
-      httpHeaders,
-      accessToken,
-    )
-
-    if (dpopProof) {
-      const unique = await this.replayManager.uniqueDpop(dpopProof.jti)
-      if (!unique) throw new InvalidDpopProofError('DPoP proof replayed')
-    }
-
-    return dpopProof
-  }
-
-  protected async decodeToken(
-    tokenType: OAuthTokenType,
-    token: OAuthAccessToken,
-    dpopProof: null | DpopProof,
-  ): Promise<AccessTokenPayload> {
-    if (!isSignedJwt(token)) {
-      throw new InvalidTokenError(tokenType, `Malformed token`)
-    }
-
-    const { payload } = await this.signer
-      .verifyAccessToken(token)
-      .catch((err) => {
-        throw InvalidTokenError.from(err, tokenType)
-      })
-
-    if (payload.cnf?.jkt) {
-      // An access token with a cnf.jkt claim must be a DPoP token
-      if (tokenType !== 'DPoP') {
-        throw new InvalidTokenError(
-          'DPoP',
-          `Access token is bound to a DPoP proof, but token type is ${tokenType}`,
-        )
-      }
-
-      // DPoP token type must be used with a DPoP proof
-      if (!dpopProof) {
-        throw new InvalidDpopProofError(`DPoP proof required`)
-      }
-
-      // DPoP proof must be signed with the key that matches the "cnf" claim
-      if (payload.cnf.jkt !== dpopProof.jkt) {
-        throw new InvalidDpopKeyBindingError()
-      }
-    } else {
-      // An access token without a cnf.jkt claim must be a Bearer token
-      if (tokenType !== 'Bearer') {
-        throw new InvalidTokenError(
-          'Bearer',
-          `Bearer token type must be used without a DPoP proof`,
-        )
-      }
-
-      // @NOTE We ignore (but allow) DPoP proofs for Bearer tokens
-    }
-
-    const payloadOverride = await this.onDecodeToken?.call(null, {
-      tokenType,
-      token,
-      payload,
-      dpopProof,
-    })
-
-    return payloadOverride ?? payload
-  }
-
-  /**
-   * @throws {WWWAuthenticateError}
-   * @throws {InvalidTokenError}
-   */
-  public async authenticateRequest(
-    httpMethod: string,
-    httpUrl: Readonly<URL>,
-    httpHeaders: Record<string, undefined | string | string[]>,
-    verifyOptions?: VerifyTokenPayloadOptions,
-  ): Promise<AccessTokenPayload> {
-    const [tokenType, token] = parseAuthorizationHeader(
-      httpHeaders['authorization'],
-    )
-    try {
-      const dpopProof = await this.checkDpopProof(
-        httpMethod,
-        httpUrl,
-        httpHeaders,
-        token,
-      )
-
-      const tokenPayload = await this.decodeToken(tokenType, token, dpopProof)
-
-      this.verifyTokenPayload(tokenType, tokenPayload, verifyOptions)
-
-      return tokenPayload
-    } catch (err) {
-      if (err instanceof UseDpopNonceError) throw err.toWwwAuthenticateError()
-      if (err instanceof WWWAuthenticateError) throw err
-
-      throw InvalidTokenError.from(err, tokenType)
-    }
-  }
-
-  protected verifyTokenPayload(
-    tokenType: OAuthTokenType,
-    tokenPayload: AccessTokenPayload,
-    options?: VerifyTokenPayloadOptions,
-  ): void {
-    if (options?.audience) {
-      const { aud } = tokenPayload
-      const hasMatch =
-        aud != null &&
-        (Array.isArray(aud)
-          ? options.audience.some(includedIn, aud)
-          : options.audience.includes(aud))
-      if (!hasMatch) {
-        const details = `(got: ${aud}, expected one of: ${options.audience})`
-        throw new InvalidTokenError(tokenType, `Invalid audience ${details}`)
-      }
-    }
-
-    if (options?.scope) {
-      const { scope } = tokenPayload
-      const scopes = scope?.split(' ')
-      if (!scopes || !options.scope.some(includedIn, scopes)) {
-        const details = `(got: ${scope}, expected one of: ${options.scope})`
-        throw new InvalidTokenError(tokenType, `Invalid scope ${details}`)
-      }
-    }
-
-    if (tokenPayload.exp != null && tokenPayload.exp * 1000 <= Date.now()) {
-      const expirationDate = new Date(tokenPayload.exp * 1000).toISOString()
-      throw new InvalidTokenError(
-        tokenType,
-        `Token expired at ${expirationDate}`,
-      )
-    }
-  }
-}

package/src/replay/replay-manager.ts

@@ -1,51 +0,0 @@
-import { ClientId } from '../client/client-id.js'
-import {
-  CLIENT_ASSERTION_MAX_AGE,
-  CODE_CHALLENGE_REPLAY_TIMEFRAME,
-  DPOP_NONCE_MAX_AGE,
-  JAR_MAX_AGE,
-} from '../constants.js'
-import { ReplayStore } from './replay-store.js'
-
-const SECURITY_RATIO = 1.1 // 10% extra time for security
-const asTimeFrame = (timeFrame: number) => Math.ceil(timeFrame * SECURITY_RATIO)
-
-export class ReplayManager {
-  constructor(protected readonly replayStore: ReplayStore) {}
-
-  async uniqueAuth(
-    jti: string,
-    clientId: ClientId,
-    exp?: number,
-  ): Promise<boolean> {
-    const timeFrame =
-      exp == null
-        ? asTimeFrame(CLIENT_ASSERTION_MAX_AGE)
-        : exp * 1000 - Date.now()
-    return this.replayStore.unique(`Auth@${clientId}`, jti, timeFrame)
-  }
-
-  async uniqueJar(jti: string, clientId: ClientId): Promise<boolean> {
-    return this.replayStore.unique(
-      `JAR@${clientId}`,
-      jti,
-      asTimeFrame(JAR_MAX_AGE),
-    )
-  }
-
-  async uniqueDpop(jti: string, clientId?: ClientId): Promise<boolean> {
-    return this.replayStore.unique(
-      clientId ? `DPoP@${clientId}` : `DPoP`,
-      jti,
-      asTimeFrame(DPOP_NONCE_MAX_AGE),
-    )
-  }
-
-  async uniqueCodeChallenge(challenge: string): Promise<boolean> {
-    return this.replayStore.unique(
-      'CodeChallenge',
-      challenge,
-      asTimeFrame(CODE_CHALLENGE_REPLAY_TIMEFRAME),
-    )
-  }
-}

package/src/replay/replay-store-memory.ts

@@ -1,36 +0,0 @@
-import type { ReplayStore } from './replay-store.js'
-
-export class ReplayStoreMemory implements ReplayStore {
-  private lastCleanup = Date.now()
-  private nonces = new Map<string, number>()
-
-  /**
-   * Returns true if the nonce is unique within the given time frame.
-   */
-  async unique(
-    namespace: string,
-    nonce: string,
-    timeFrame: number,
-  ): Promise<boolean> {
-    this.cleanup()
-    const key = `${namespace}:${nonce}`
-
-    const now = Date.now()
-
-    const exp = this.nonces.get(key)
-    this.nonces.set(key, now + timeFrame)
-
-    return exp == null || exp < now
-  }
-
-  private cleanup() {
-    const now = Date.now()
-
-    if (this.lastCleanup < now - 60_000) {
-      for (const [key, expires] of this.nonces) {
-        if (expires < now) this.nonces.delete(key)
-      }
-      this.lastCleanup = now
-    }
-  }
-}

package/src/replay/replay-store-redis.ts

@@ -1,30 +0,0 @@
-import type { Redis } from 'ioredis'
-import { CreateRedisOptions, createRedis } from '../lib/redis.js'
-import type { ReplayStore } from './replay-store.js'
-
-export type { CreateRedisOptions, Redis }
-
-export type ReplayStoreRedisOptions = {
-  redis: CreateRedisOptions
-}
-
-export class ReplayStoreRedis implements ReplayStore {
-  private readonly redis: Redis
-
-  constructor(options: ReplayStoreRedisOptions) {
-    this.redis = createRedis(options.redis)
-  }
-
-  /**
-   * Returns true if the nonce is unique within the given time frame.
-   */
-  async unique(
-    namespace: string,
-    nonce: string,
-    timeFrame: number,
-  ): Promise<boolean> {
-    const key = `nonces:${namespace}:${nonce}`
-    const prev = await this.redis.set(key, '1', 'PX', timeFrame, 'GET')
-    return prev == null
-  }
-}

package/src/replay/replay-store.ts

@@ -1,44 +0,0 @@
-import { Awaitable } from '../lib/util/type.js'
-
-// Export all types needed to implement the ReplayStore interface
-export type { Awaitable }
-
-export interface ReplayStore {
-  /**
-   * Returns true if the nonce is unique within the given time frame. While not
-   * strictly necessary for security purposes, the namespace should be used to
-   * mitigate denial of service attacks from one client to the other.
-   *
-   * @param timeFrame expressed in milliseconds.
-   */
-  unique(
-    namespace: string,
-    nonce: string,
-    timeFrame: number,
-  ): Awaitable<boolean>
-}
-
-export function isReplayStore(
-  implementation: Record<string, unknown> & Partial<ReplayStore>,
-): implementation is Record<string, unknown> & ReplayStore {
-  return typeof implementation.unique === 'function'
-}
-
-export function ifReplayStore(
-  implementation?: Record<string, unknown> & Partial<ReplayStore>,
-): ReplayStore | undefined {
-  if (implementation && isReplayStore(implementation)) {
-    return implementation
-  }
-
-  return undefined
-}
-
-export function asReplayStore(
-  implementation?: Record<string, unknown> & Partial<ReplayStore>,
-): ReplayStore {
-  const store = ifReplayStore(implementation)
-  if (store) return store
-
-  throw new Error('Invalid ReplayStore implementation')
-}

package/src/request/code.ts

@@ -1,23 +0,0 @@
-import { z } from 'zod'
-import { CODE_BYTES_LENGTH, CODE_PREFIX } from '../constants.js'
-import { randomHexId } from '../lib/util/crypto.js'
-
-export const CODE_LENGTH = CODE_PREFIX.length + CODE_BYTES_LENGTH * 2 // hex encoding
-
-export const codeSchema = z
-  .string()
-  .length(CODE_LENGTH) // hex encoding
-  .refine(
-    (v): v is `${typeof CODE_PREFIX}${string}` => v.startsWith(CODE_PREFIX),
-    {
-      message: `Invalid code format`,
-    },
-  )
-
-export const isCode = (data: unknown): data is Code =>
-  codeSchema.safeParse(data).success
-
-export type Code = z.infer<typeof codeSchema>
-export const generateCode = async (): Promise<Code> => {
-  return `${CODE_PREFIX}${await randomHexId(CODE_BYTES_LENGTH)}`
-}

package/src/request/request-data.ts

@@ -1,36 +0,0 @@
-import { Did } from '@atproto/did'
-import { OAuthAuthorizationRequestParameters } from '@atproto/oauth-types'
-import { ClientAuth, ClientAuthLegacy } from '../client/client-auth.js'
-import { ClientId } from '../client/client-id.js'
-import { DeviceId } from '../device/device-id.js'
-import { NonNullableKeys } from '../lib/util/type.js'
-import { Code } from './code.js'
-
-export type {
-  ClientAuth,
-  ClientAuthLegacy,
-  ClientId,
-  Code,
-  DeviceId,
-  Did,
-  OAuthAuthorizationRequestParameters,
-}
-
-export type RequestData = {
-  clientId: ClientId
-  clientAuth: null | ClientAuth | ClientAuthLegacy
-  parameters: Readonly<OAuthAuthorizationRequestParameters>
-  expiresAt: Date
-  deviceId: DeviceId | null
-  did: Did | null
-  code: Code | null
-}
-
-export type RequestDataAuthorized = NonNullableKeys<
-  RequestData,
-  'did' | 'deviceId'
->
-
-export const isRequestDataAuthorized = (
-  data: RequestData,
-): data is RequestDataAuthorized => data.did !== null && data.deviceId !== null

package/src/request/request-id.ts

@@ -1,22 +0,0 @@
-import { z } from 'zod'
-import { REQUEST_ID_BYTES_LENGTH, REQUEST_ID_PREFIX } from '../constants.js'
-import { randomHexId } from '../lib/util/crypto.js'
-
-export const REQUEST_ID_LENGTH =
-  REQUEST_ID_PREFIX.length + REQUEST_ID_BYTES_LENGTH * 2 // hex encoding
-
-export const requestIdSchema = z
-  .string()
-  .length(REQUEST_ID_LENGTH)
-  .refine(
-    (v): v is `${typeof REQUEST_ID_PREFIX}${string}` =>
-      v.startsWith(REQUEST_ID_PREFIX),
-    {
-      message: `Invalid request ID format`,
-    },
-  )
-
-export type RequestId = z.infer<typeof requestIdSchema>
-export const generateRequestId = async (): Promise<RequestId> => {
-  return `${REQUEST_ID_PREFIX}${await randomHexId(REQUEST_ID_BYTES_LENGTH)}`
-}