@atproto/oauth-provider 0.19.6 → 0.19.8

package/src/router/assets/assets-manifest.ts

@@ -1,117 +0,0 @@
-import { createReadStream } from 'node:fs'
-import { createRequire } from 'node:module'
-import { join } from 'node:path'
-import { Readable } from 'node:stream'
-import type { Manifest } from '@atproto-labs/rollup-plugin-bundle-manifest'
-import { AssetRef } from '../../lib/html/build-document.js'
-import {
-  Middleware,
-  validateFetchDest,
-  validateFetchSite,
-  writeStream,
-} from '../../lib/http/index.js'
-
-type Asset =
-  | {
-      type: 'asset'
-      mime?: string
-      sha256: string
-      stream: () => Readable
-    }
-  | {
-      type: 'chunk'
-      mime: string
-      sha256: string
-      dynamicImports: string[]
-      isDynamicEntry: boolean
-      isEntry: boolean
-      isImplicitEntry: boolean
-      name: string
-      stream: () => Readable
-    }
-
-const ASSETS_URL_PREFIX = '/@atproto/oauth-provider/~assets/'
-
-export function parseAssetsManifest(manifestPath: string) {
-  // Using `require` instead of `JSON.parse(readFileSync())` so that node's
-  // watch mode can pick up changes to the manifest file.
-  const require = createRequire(import.meta.url)
-
-  // eslint-disable-next-line import/no-dynamic-require
-  const manifest = require(manifestPath) as Manifest
-
-  const assets = new Map<string, Asset>(
-    Object.entries(manifest).map(([filename, { data, ...item }]) => {
-      const buffer = data ? Buffer.from(data, 'base64') : null
-      const filepath = join(manifestPath, '..', filename)
-      const stream = buffer
-        ? () => Readable.from(buffer)
-        : () => createReadStream(filepath)
-      return [filename, { ...item, stream }]
-    }),
-  )
-
-  const assetsMiddleware: Middleware = (req, res, next) => {
-    if (req.method !== 'GET' && req.method !== 'HEAD') return next()
-    if (!req.url?.startsWith(ASSETS_URL_PREFIX)) return next()
-
-    const filename = decodeURIComponent(req.url.slice(ASSETS_URL_PREFIX.length))
-    if (!filename) return next()
-
-    const asset = assets.get(filename)
-    if (!asset) return next()
-
-    try {
-      // Allow "null" (ie. no header) to allow loading assets outside of a
-      // fetch context (not from a web page).
-      validateFetchSite(req, [null, 'none', 'cross-site', 'same-origin'])
-      validateFetchDest(req, [null, 'document', 'style', 'script'])
-    } catch (err) {
-      return next(err)
-    }
-
-    if (req.headers['if-none-match'] === asset.sha256) {
-      return void res.writeHead(304).end()
-    }
-
-    res.setHeader('ETag', asset.sha256)
-    res.setHeader('Cache-Control', 'public, max-age=31536000, immutable')
-
-    writeStream(res, asset.stream(), { contentType: asset.mime })
-  }
-
-  return {
-    getAssets,
-    assetsMiddleware,
-  }
-
-  function getAssets(entryName: string) {
-    const scripts = getScripts(entryName)
-    if (!scripts.length) return null
-    const styles = getStyles(entryName)
-    return { scripts, styles }
-  }
-
-  function getScripts(entryName: string) {
-    return Array.from(assets)
-      .filter(
-        ([, asset]) =>
-          asset.type === 'chunk' && asset.isEntry && asset.name === entryName,
-      )
-      .map(assetEntryUrl)
-  }
-
-  function getStyles(_entryName: string) {
-    return Array.from(assets)
-      .filter(([, asset]) => asset.mime === 'text/css')
-      .map(assetEntryUrl)
-  }
-}
-
-function assetEntryUrl([filename]: [string, Asset]): AssetRef {
-  return { url: assetUrl(filename) }
-}
-
-function assetUrl(filename: string) {
-  return `${ASSETS_URL_PREFIX}${encodeURIComponent(filename)}`
-}

package/src/router/assets/assets.ts

@@ -1,124 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http'
-import { createRequire } from 'node:module'
-import type { HydrationData as UiHydrationData } from '@atproto/oauth-provider-ui/hydration-data'
-import { buildCustomizationCss } from '../../customization/build-customization-css.js'
-import { buildCustomizationData } from '../../customization/build-customization-data.js'
-import { Customization } from '../../customization/customization.js'
-import { CspConfig, mergeCsp } from '../../lib/csp/index.js'
-import { declareHydrationData } from '../../lib/html/hydration-data.js'
-import { cssCode, html } from '../../lib/html/index.js'
-import { WriteResponseOptions } from '../../lib/http/response.js'
-import {
-  CrossOriginEmbedderPolicy,
-  SecurityHeadersOptions,
-} from '../../lib/http/security-headers.js'
-import { mergeDefaults } from '../../lib/util/object.js'
-import { Simplify } from '../../lib/util/type.js'
-import { WriteHtmlOptions, writeHtml } from '../../lib/write-html.js'
-import { parseAssetsManifest } from './assets-manifest.js'
-import { setupCsrfToken } from './csrf.js'
-
-// If the "ui" and "frontend" packages are ever unified, this can be replaced
-// with a single expression:
-//
-// const { getAssets, assetsMiddleware } = parseAssetsManifest(
-//   require.resolve('@atproto/oauth-provider-ui/bundle-manifest.json'),
-// )
-
-const require = createRequire(import.meta.url)
-const ui = parseAssetsManifest(
-  require.resolve('@atproto/oauth-provider-ui/bundle-manifest.json'),
-)
-
-type HydrationData = Simplify<UiHydrationData>
-
-function getAssets(entryName: keyof HydrationData) {
-  const assetRef = ui.getAssets(entryName)
-  if (assetRef) return assetRef
-
-  // Fool-proof. Should never happen.
-  throw new Error(`Entry "${entryName}" not found in assets`)
-}
-
-export const assetsMiddleware = ui.assetsMiddleware
-
-const SPA_CSP: CspConfig = {
-  // API calls are made to the same origin
-  'connect-src': ["'self'"],
-  // Allow loading of PDS logo & User avatars
-  'img-src': ['data:', 'https:'],
-  // Prevent embedding in iframes
-  'frame-ancestors': ["'none'"],
-}
-
-/**
- * @see {@link https://docs.hcaptcha.com/#content-security-policy-settings}
- */
-const HCAPTCHA_CSP: CspConfig = {
-  'script-src': ['https://hcaptcha.com', 'https://*.hcaptcha.com'],
-  'frame-src': ['https://hcaptcha.com', 'https://*.hcaptcha.com'],
-  'style-src': ['https://hcaptcha.com', 'https://*.hcaptcha.com'],
-  'connect-src': ['https://hcaptcha.com', 'https://*.hcaptcha.com'],
-}
-
-export type SendWebAppOptions = SecurityHeadersOptions & WriteResponseOptions
-
-export function sendWebAppFactory<P extends keyof HydrationData>(
-  page: P,
-  customization: Customization,
-  defaults: SendWebAppOptions = {},
-) {
-  // Pre-computed options:
-  const customizationData = buildCustomizationData(customization)
-  const customizationCss = cssCode(buildCustomizationCss(customization))
-  const { scripts, styles } = getAssets(page)
-
-  const csp = mergeCsp(
-    SPA_CSP,
-    customization.hcaptcha ? HCAPTCHA_CSP : undefined,
-  )
-
-  const coep = customization.hcaptcha
-    ? // hCaptcha's implementation of COEP is currently broken. Let's disable it
-      // to avoid breaking the entire page.
-      //
-      // https://github.com/hCaptcha/react-hcaptcha/issues/259
-      // https://github.com/hCaptcha/react-hcaptcha/issues/380
-      CrossOriginEmbedderPolicy.unsafeNone
-    : // Since we are loading avatars form other origins, which might not have
-      // CORP headers, we need to use the "credentialless" value, which allows
-      // loading cross-origin resources without credentials (cookies, client
-      // certificates, etc.). This is a more secure alternative to
-      // "unsafe-none". Ideally, we would want to set COEP to "require-corp" and
-      // ensure that all cross-origin resources have the appropriate CORP
-      // headers.
-      CrossOriginEmbedderPolicy.credentialless
-
-  return async function sendWebApp(
-    req: IncomingMessage,
-    res: ServerResponse,
-    options: SendWebAppOptions & {
-      data: Omit<HydrationData[P], '__customizationData'>
-    },
-  ): Promise<void> {
-    await setupCsrfToken(req, res)
-
-    const script = declareHydrationData({
-      ...options.data,
-      __customizationData: customizationData,
-    })
-
-    return writeHtml(
-      res,
-      mergeDefaults<WriteHtmlOptions>(defaults, options, {
-        bodyAttrs: { class: 'text-text-default bg-contrast-0' },
-        csp: options?.csp ? mergeCsp(csp, options.csp) : csp,
-        coep: options?.coep ?? coep,
-        meta: [{ name: 'robots', content: 'noindex' }],
-        body: html`<div id="root"></div>`,
-        scripts: [script, ...scripts],
-        styles: [...styles, customizationCss],
-      }),
-    )
-  }
-}

package/src/router/assets/csrf.ts

@@ -1,79 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http'
-import createHttpError from 'http-errors'
-import { CSRF_COOKIE_NAME, CSRF_HEADER_NAME } from '@atproto/oauth-provider-api'
-import {
-  CookieSerializeOptions,
-  getCookie,
-  setCookie,
-} from '../../lib/http/index.js'
-import { randomHexId } from '../../lib/util/crypto.js'
-
-const TOKEN_BYTE_LENGTH = 12
-const TOKEN_LENGTH = TOKEN_BYTE_LENGTH * 2 // 2 hex chars per byte
-
-// @NOTE Cookie based CSRF protection is redundant with session cookies using
-// `SameSite` and could probably be removed in the future.
-const CSRF_COOKIE_OPTIONS: Readonly<CookieSerializeOptions> = {
-  expires: undefined, // "session" cookie
-  secure: true,
-  httpOnly: false, // Need to be accessible from JavaScript
-  sameSite: 'lax',
-  path: `/`,
-}
-
-async function generateCsrfToken() {
-  return randomHexId(TOKEN_BYTE_LENGTH)
-}
-
-export async function setupCsrfToken(
-  req: IncomingMessage,
-  res: ServerResponse,
-): Promise<void> {
-  const token = getCookieCsrf(req) || (await generateCsrfToken())
-
-  // Refresh cookie (See Chrome's "Lax+POST" behavior)
-  setCookie(res, CSRF_COOKIE_NAME, token, CSRF_COOKIE_OPTIONS)
-}
-
-export async function validateCsrfToken(
-  req: IncomingMessage,
-  res: ServerResponse,
-) {
-  const cookieValue = getCookieCsrf(req)
-  const headerValue = getHeadersCsrf(req)
-
-  // Refresh cookie (See Chrome's "Lax+POST" behavior), or set a new one,
-  // allowing clients to retry with the new token.
-  setCookie(
-    res,
-    CSRF_COOKIE_NAME,
-    cookieValue || (await generateCsrfToken()),
-    CSRF_COOKIE_OPTIONS,
-  )
-
-  if (!headerValue) {
-    throw createHttpError(400, `Missing CSRF header`)
-  }
-  if (!cookieValue) {
-    throw createHttpError(400, `Missing CSRF cookie`)
-  }
-  if (cookieValue !== headerValue) {
-    throw createHttpError(400, `CSRF mismatch`)
-  }
-}
-
-export function getCookieCsrf(req: IncomingMessage) {
-  const cookieValue = getCookie(req, CSRF_COOKIE_NAME)
-  if (cookieValue?.length === TOKEN_LENGTH) {
-    return cookieValue
-  }
-  return undefined
-}
-
-export function getHeadersCsrf(req: IncomingMessage) {
-  const headerValue = req.headers[CSRF_HEADER_NAME]
-  if (typeof headerValue === 'string' && headerValue.length === TOKEN_LENGTH) {
-    return headerValue
-  }
-  return undefined
-}

package/src/router/assets/send-account-page.ts

@@ -1,23 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http'
-import type { ActiveDeviceSession } from '@atproto/oauth-provider-api'
-import { Customization } from '../../customization/customization.js'
-import { SendWebAppOptions, sendWebAppFactory } from './assets.js'
-
-export function sendAccountPageFactory(
-  customization: Customization,
-  options?: SendWebAppOptions,
-) {
-  const sendApp = sendWebAppFactory('account-page', customization, options)
-
-  return async function sendAccountPage(
-    req: IncomingMessage,
-    res: ServerResponse,
-    data: {
-      deviceSessions: readonly ActiveDeviceSession[]
-    },
-  ): Promise<void> {
-    return sendApp(req, res, {
-      data: { __deviceSessions: data.deviceSessions },
-    })
-  }
-}

package/src/router/assets/send-authorization-page.ts

@@ -1,42 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http'
-import { Customization } from '../../customization/customization.js'
-import { AuthorizationResultAuthorizePage } from '../../result/authorization-result-authorize-page.js'
-import { SendWebAppOptions, sendWebAppFactory } from './assets.js'
-
-export function sendAuthorizePageFactory(
-  customization: Customization,
-  options?: SendWebAppOptions,
-) {
-  const sendApp = sendWebAppFactory(
-    'authorization-page',
-    customization,
-    options,
-  )
-
-  return async function sendAuthorizePage(
-    req: IncomingMessage,
-    res: ServerResponse,
-    data: AuthorizationResultAuthorizePage,
-  ): Promise<void> {
-    return sendApp(req, res, {
-      data: {
-        __authorizeData: {
-          requestUri: data.requestUri,
-
-          clientId: data.client.id,
-          clientMetadata: data.client.metadata,
-          clientTrusted: data.client.info.isTrusted,
-          clientFirstParty: data.client.info.isFirstParty,
-
-          scope: data.parameters.scope,
-          uiLocales: data.parameters.ui_locales,
-          loginHint: data.parameters.login_hint,
-          promptMode: data.parameters.prompt,
-          permissionSets: Object.fromEntries(data.permissionSets),
-          selectedDid: data.selectedDid,
-        },
-        __sessions: data.sessions,
-      },
-    })
-  }
-}

package/src/router/assets/send-cookie-error-page.ts

@@ -1,21 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http'
-import { Customization } from '../../customization/customization.js'
-import { SendWebAppOptions, sendWebAppFactory } from './assets.js'
-
-export function sendCookieErrorPageFactory(
-  customization: Customization,
-  options?: SendWebAppOptions,
-) {
-  const sendApp = sendWebAppFactory('cookie-error-page', customization, options)
-
-  return async function sendCookieErrorPage(
-    req: IncomingMessage,
-    res: ServerResponse,
-    data: { continueUrl: URL },
-  ) {
-    return sendApp(req, res, {
-      status: 400,
-      data: { __continueUrl: data.continueUrl.toString() },
-    })
-  }
-}

package/src/router/assets/send-error-page.ts

@@ -1,25 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http'
-import { Customization } from '../../customization/customization.js'
-import {
-  buildErrorPayload,
-  buildErrorStatus,
-} from '../../errors/error-parser.js'
-import { SendWebAppOptions, sendWebAppFactory } from './assets.js'
-
-export function sendErrorPageFactory(
-  customization: Customization,
-  options?: SendWebAppOptions,
-) {
-  const sendApp = sendWebAppFactory('error-page', customization, options)
-
-  return async function sendErrorPage(
-    req: IncomingMessage,
-    res: ServerResponse,
-    err: unknown,
-  ): Promise<void> {
-    return sendApp(req, res, {
-      status: buildErrorStatus(err),
-      data: { __errorData: buildErrorPayload(err) },
-    })
-  }
-}

package/src/router/assets/send-redirect.ts

@@ -1,140 +0,0 @@
-import type { ServerResponse } from 'node:http'
-import {
-  OAuthAuthorizationRequestParameters,
-  OAuthResponseMode,
-} from '@atproto/oauth-types'
-import { AuthorizationError } from '../../errors/authorization-error.js'
-import {
-  WriteFormRedirectOptions,
-  writeFormRedirect,
-} from '../../lib/write-form-redirect.js'
-import { AuthorizationRedirectParameters } from '../../result/authorization-redirect-parameters.js'
-import { AuthorizationResultRedirect } from '../../result/authorization-result-redirect.js'
-
-// https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-11#section-7.5.4
-const REDIRECT_STATUS_CODE = 303
-
-export const SUCCESS_REDIRECT_KEYS = [
-  'code',
-  'id_token',
-  'access_token',
-  'expires_in',
-  'token_type',
-] as const
-
-export const ERROR_REDIRECT_KEYS = [
-  'error',
-  'error_description',
-  'error_uri',
-] as const
-
-export type OAuthRedirectQueryParameter =
-  | 'iss'
-  | 'state'
-  | (typeof SUCCESS_REDIRECT_KEYS)[number]
-  | (typeof ERROR_REDIRECT_KEYS)[number]
-
-export function buildRedirectUri(
-  parameters: OAuthAuthorizationRequestParameters,
-): string {
-  const uri = parameters.redirect_uri
-  if (uri) return uri
-
-  throw new AuthorizationError(parameters, 'No redirect_uri', 'invalid_request')
-}
-
-export function buildRedirectMode(
-  parameters: OAuthAuthorizationRequestParameters,
-): OAuthResponseMode {
-  const mode = parameters.response_mode || 'query' // @TODO default should depend on response_type
-  return mode
-}
-
-export function buildRedirectParams(
-  issuer: string,
-  parameters: OAuthAuthorizationRequestParameters,
-  redirect: AuthorizationRedirectParameters,
-): [OAuthRedirectQueryParameter, string][] {
-  const params: [OAuthRedirectQueryParameter, string][] = [
-    ['iss', issuer], // rfc9207
-  ]
-
-  if (parameters.state != null) {
-    params.push(['state', parameters.state])
-  }
-
-  const keys = 'code' in redirect ? SUCCESS_REDIRECT_KEYS : ERROR_REDIRECT_KEYS
-  for (const key of keys) {
-    const value = redirect[key]
-    if (value != null) params.push([key, value])
-  }
-
-  return params
-}
-
-export function sendAuthorizationResultRedirect(
-  res: ServerResponse,
-  result: AuthorizationResultRedirect,
-  options?: WriteFormRedirectOptions,
-) {
-  const { issuer, parameters, redirect } = result
-
-  return sendRedirect(
-    res,
-    {
-      redirectUri: buildRedirectUri(parameters),
-      mode: buildRedirectMode(parameters),
-      params: buildRedirectParams(issuer, parameters, redirect),
-    },
-    options,
-  )
-}
-
-export type OAuthRedirectOptions = {
-  mode: OAuthResponseMode
-  redirectUri: string
-  params: Iterable<[string, string]>
-}
-
-export function sendRedirect(
-  res: ServerResponse,
-  redirect: OAuthRedirectOptions,
-  options?: WriteFormRedirectOptions,
-): void {
-  res.setHeader('Cache-Control', 'no-store')
-
-  const { mode, redirectUri: uri, params } = redirect
-  switch (mode) {
-    case 'query':
-      return writeQuery(res, uri, params)
-    case 'fragment':
-      return writeFragment(res, uri, params)
-    case 'form_post':
-      return writeFormRedirect(res, 'post', uri, params, options)
-  }
-
-  // @ts-expect-error fool proof
-  throw new Error(`Unsupported mode: ${mode}`)
-}
-
-function writeQuery(
-  res: ServerResponse,
-  uri: string,
-  params: Iterable<[string, string]>,
-): void {
-  const url = new URL(uri)
-  for (const [key, value] of params) url.searchParams.set(key, value)
-  res.writeHead(REDIRECT_STATUS_CODE, { Location: url.href }).end()
-}
-
-function writeFragment(
-  res: ServerResponse,
-  uri: string,
-  params: Iterable<[string, string]>,
-): void {
-  const url = new URL(uri)
-  const searchParams = new URLSearchParams()
-  for (const [key, value] of params) searchParams.set(key, value)
-  url.hash = searchParams.toString()
-  res.writeHead(REDIRECT_STATUS_CODE, { Location: url.href }).end()
-}

package/src/router/create-account-page-middleware.ts

@@ -1,88 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http'
-import type { ActiveDeviceSession } from '@atproto/oauth-provider-api'
-import {
-  Middleware,
-  Router,
-  validateFetchDest,
-  validateFetchMode,
-  validateOrigin,
-  writeRedirect,
-} from '../lib/http/index.js'
-import { SecurityHeadersOptions } from '../lib/http/security-headers.js'
-import type { OAuthProvider } from '../oauth-provider.js'
-import { sendAccountPageFactory } from './assets/send-account-page.js'
-import { sendErrorPageFactory } from './assets/send-error-page.js'
-import type { MiddlewareOptions } from './middleware-options.js'
-
-export function createAccountPageMiddleware<
-  Ctx extends object | void = void,
-  Req extends IncomingMessage = IncomingMessage,
-  Res extends ServerResponse = ServerResponse,
->(
-  server: OAuthProvider,
-  { onError }: MiddlewareOptions<Req, Res>,
-): Middleware<Ctx, Req, Res> {
-  const issuerUrl = new URL(server.issuer)
-  const issuerOrigin = issuerUrl.origin
-
-  const securityOptions: SecurityHeadersOptions = {
-    hsts: issuerUrl.protocol === 'http:' ? false : undefined,
-  }
-
-  const sendAccountPage = sendAccountPageFactory(
-    server.customization,
-    securityOptions,
-  )
-  const sendErrorPage = sendErrorPageFactory(
-    server.customization,
-    securityOptions,
-  )
-
-  const router = new Router<Ctx, Req, Res>(issuerUrl)
-
-  // Create password reset discovery endpoint
-  // https://www.w3.org/TR/change-password-url/
-  router.get('/.well-known/change-password', (_req, res) => {
-    writeRedirect(res, new URL('/account/reset-password', issuerUrl).toString())
-  })
-
-  // Create frontend account pages
-  router.get<never>(/^\/account(?:\/.*)?$/, async function (req, res) {
-    try {
-      res.setHeader('Referrer-Policy', 'same-origin')
-
-      res.setHeader('Cache-Control', 'no-store')
-      res.setHeader('Pragma', 'no-cache')
-
-      validateFetchMode(req, ['navigate'])
-      validateFetchDest(req, ['document'])
-      validateOrigin(req, issuerOrigin)
-
-      const { deviceId } = await server.deviceManager.load(req, res)
-      const deviceAccounts =
-        await server.accountManager.listDeviceAccounts(deviceId)
-
-      sendAccountPage(req, res, {
-        deviceSessions: deviceAccounts.map(
-          (deviceAccount): ActiveDeviceSession => ({
-            account: deviceAccount.account,
-            loginRequired: server.checkLoginRequired(deviceAccount),
-          }),
-        ),
-      })
-    } catch (err) {
-      onError?.(
-        req,
-        res,
-        err,
-        `Failed to handle navigation request to "${req.url}"`,
-      )
-
-      if (!res.headersSent) {
-        return sendErrorPage(req, res, err)
-      }
-    }
-  })
-
-  return router.buildMiddleware()
-}