@atproto/oauth-provider 0.19.6 → 0.19.8

package/src/customization/customization.ts

@@ -1,29 +0,0 @@
-import { z } from 'zod'
-import { hcaptchaConfigSchema } from '../lib/hcaptcha.js'
-import { brandingSchema } from './branding.js'
-
-export const customizationSchema = z.object({
-  /**
-   * Available user domains that can be used to sign up. A non-empty array
-   * is required to enable the sign-up feature.
-   */
-  availableUserDomains: z.array(z.string()).optional(),
-  /**
-   * UI customizations
-   */
-  branding: brandingSchema.optional(),
-  /**
-   * Is an invite code required to sign up?
-   */
-  inviteCodeRequired: z.boolean().optional(),
-  /**
-   * Show a warning about 2FA being disabled when updating email address
-   */
-  show2FaWarningOnEmailUpdate: z.boolean().optional(),
-  /**
-   * Enables hCaptcha during sign-up.
-   */
-  hcaptcha: hcaptchaConfigSchema.optional(),
-})
-export type CustomizationInput = z.input<typeof customizationSchema>
-export type Customization = z.infer<typeof customizationSchema>

package/src/customization/links.ts

@@ -1,10 +0,0 @@
-import { z } from 'zod'
-import { isLinkRel } from '../lib/html/build-document.js'
-import { multiLangStringSchema } from '../lib/util/locale.js'
-
-export const linksSchema = z.object({
-  title: z.union([z.string(), multiLangStringSchema]),
-  href: z.string().url(),
-  rel: z.string().refine(isLinkRel, 'Invalid link rel').optional(),
-})
-export type Links = z.infer<typeof linksSchema>

package/src/device/device-data.ts

@@ -1,11 +0,0 @@
-import { z } from 'zod'
-import { sessionIdSchema } from './session-id.js'
-
-export const deviceDataSchema = z.object({
-  sessionId: sessionIdSchema,
-  lastSeenAt: z.date(),
-  userAgent: z.string().nullable(),
-  ipAddress: z.string(),
-})
-
-export type DeviceData = z.infer<typeof deviceDataSchema>

package/src/device/device-id.ts

@@ -1,27 +0,0 @@
-import { z } from 'zod'
-import { DEVICE_ID_BYTES_LENGTH, DEVICE_ID_PREFIX } from '../constants.js'
-import { randomHexId } from '../lib/util/crypto.js'
-
-export const DEVICE_ID_LENGTH =
-  DEVICE_ID_PREFIX.length + DEVICE_ID_BYTES_LENGTH * 2 // hex encoding
-
-export const deviceIdSchema = z
-  .string()
-  .length(DEVICE_ID_LENGTH)
-  .refine(
-    (v): v is `${typeof DEVICE_ID_PREFIX}${string}` =>
-      v.startsWith(DEVICE_ID_PREFIX),
-    {
-      message: `Invalid device ID format`,
-    },
-  )
-
-export type DeviceId = z.infer<typeof deviceIdSchema>
-
-export function isDeviceId(value: unknown): value is DeviceId {
-  return deviceIdSchema.safeParse(value).success
-}
-
-export const generateDeviceId = async (): Promise<DeviceId> => {
-  return `${DEVICE_ID_PREFIX}${await randomHexId(DEVICE_ID_BYTES_LENGTH)}`
-}

package/src/device/device-manager.ts

@@ -1,292 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http'
-import { z } from 'zod'
-import { SESSION_FIXATION_MAX_AGE } from '../constants.js'
-import { parseHttpCookies } from '../lib/http/index.js'
-import {
-  RequestMetadata,
-  extractRequestMetadata,
-  setCookie,
-} from '../lib/http/request.js'
-import { DeviceData } from './device-data.js'
-import { DeviceId, deviceIdSchema, generateDeviceId } from './device-id.js'
-import { DeviceStore } from './device-store.js'
-import { generateSessionId, sessionIdSchema } from './session-id.js'
-
-/**
- * @see {@link https://www.npmjs.com/package/keygrip | Keygrip}
- */
-export const keygripSchema = z.object({
-  sign: z.function().args(z.any()).returns(z.string()),
-  verify: z.function().args(z.any(), z.string()).returns(z.boolean()),
-  index: z.function().args(z.any(), z.string()).returns(z.number()),
-})
-
-export const deviceManagerOptionsSchema = z.object({
-  /**
-   * Controls whether the IP address is read from the `X-Forwarded-For` header
-   * (if `true`), or from the `req.socket.remoteAddress` property (if `false`).
-   */
-  trustProxy: z
-    .function()
-    .args<[addr: z.ZodString, i: z.ZodNumber]>(z.string(), z.number())
-    .returns(z.boolean())
-    .optional(),
-
-  /**
-   * Amount of time (in ms) after which session IDs will be rotated
-   *
-   * @default 300e3 // (5 minutes)
-   */
-  rotationRate: z.number().default(300e3),
-  /**
-   * Cookie options
-   */
-  cookie: z
-    .object({
-      keys: keygripSchema.optional(),
-      /**
-       * Amount of time (in ms) after which the session cookie will expire.
-       * If set to `null`, the cookie will be a session cookie (deleted when the
-       * browser is closed).
-       *
-       * @default 10 years
-       */
-      age: z
-        .number()
-        .nullable()
-        .default(10 * 365.2 * 24 * 60 * 60e3),
-      /**
-       * Controls whether the cookie is only sent over HTTPS (if `true`), or also
-       * over HTTP (if `false`). This should **NOT** be set to `false` in
-       * production.
-       */
-      secure: z.boolean().default(true),
-      /**
-       * Controls whether the cookie is sent along with cross-site requests.
-       *
-       * @default 'lax'
-       */
-      sameSite: z.enum(['lax', 'strict']).default('lax'),
-    })
-    .default({}),
-})
-
-export type DeviceManagerOptions = z.input<typeof deviceManagerOptionsSchema>
-
-type CookieValue = {
-  deviceId: DeviceId
-  sessionId: string
-}
-
-export type DeviceInfo = {
-  deviceId: DeviceId
-  deviceMetadata: RequestMetadata
-}
-
-/**
- * This class provides an abstraction for keeping track of DEVICE sessions. It
- * relies on a {@link DeviceStore} to persist session data and a cookie to
- * identify the session.
- */
-export class DeviceManager {
-  private readonly options: z.output<typeof deviceManagerOptionsSchema>
-
-  constructor(
-    private readonly store: DeviceStore,
-    options: DeviceManagerOptions = {},
-  ) {
-    this.options = deviceManagerOptionsSchema.parse(options)
-  }
-
-  public async hasSession(req: IncomingMessage): Promise<boolean> {
-    const cookies = await this.getCookies(req)
-    return cookies !== null
-  }
-
-  public async load(
-    req: IncomingMessage,
-    res: ServerResponse,
-    forceRotate = false,
-  ): Promise<DeviceInfo> {
-    const cookie = await this.getCookies(req)
-    if (cookie) {
-      return this.refresh(
-        req,
-        res,
-        cookie.value,
-        forceRotate || cookie.mustRotate,
-      )
-    } else {
-      return this.create(req, res)
-    }
-  }
-
-  private async create(
-    req: IncomingMessage,
-    res: ServerResponse,
-  ): Promise<DeviceInfo> {
-    const deviceMetadata = this.getRequestMetadata(req)
-
-    const [deviceId, sessionId] = await Promise.all([
-      generateDeviceId(),
-      generateSessionId(),
-    ] as const)
-
-    await this.store.createDevice(deviceId, {
-      sessionId,
-      lastSeenAt: new Date(),
-      userAgent: deviceMetadata.userAgent ?? null,
-      ipAddress: deviceMetadata.ipAddress,
-    })
-
-    await this.setCookies(req, res, { deviceId, sessionId })
-
-    return { deviceId, deviceMetadata }
-  }
-
-  private async refresh(
-    req: IncomingMessage,
-    res: ServerResponse,
-    { deviceId, sessionId }: CookieValue,
-    forceRotate = false,
-  ): Promise<DeviceInfo> {
-    const data = await this.store.readDevice(deviceId)
-    if (!data) return this.create(req, res)
-
-    const lastSeenAt = new Date(data.lastSeenAt)
-    const age = Date.now() - lastSeenAt.getTime()
-
-    if (sessionId !== data.sessionId) {
-      if (age <= SESSION_FIXATION_MAX_AGE) {
-        // The cookie was probably rotated by a concurrent request. Let's
-        // update the cookie with the new sessionId.
-        forceRotate = true
-      } else {
-        // Something's wrong. Let's create a new session.
-        await this.store.deleteDevice(deviceId)
-        return this.create(req, res)
-      }
-    }
-
-    const deviceMetadata = this.getRequestMetadata(req)
-
-    const shouldRotate =
-      forceRotate ||
-      deviceMetadata.ipAddress !== data.ipAddress ||
-      deviceMetadata.userAgent !== data.userAgent ||
-      age > this.options.rotationRate
-
-    if (shouldRotate) {
-      await this.rotate(req, res, deviceId, {
-        ipAddress: deviceMetadata.ipAddress,
-        userAgent: deviceMetadata.userAgent || data.userAgent,
-      })
-    }
-
-    return { deviceId, deviceMetadata }
-  }
-
-  private async rotate(
-    req: IncomingMessage,
-    res: ServerResponse,
-    deviceId: DeviceId,
-    data?: Partial<Omit<DeviceData, 'sessionId' | 'lastSeenAt'>>,
-  ): Promise<void> {
-    const sessionId = await generateSessionId()
-
-    await this.store.updateDevice(deviceId, {
-      ...data,
-      sessionId,
-      lastSeenAt: new Date(),
-    })
-
-    await this.setCookies(req, res, { deviceId, sessionId })
-  }
-
-  private async getCookies(
-    req: IncomingMessage,
-  ): Promise<{ value: CookieValue; mustRotate: boolean } | null> {
-    const cookies = parseHttpCookies(req)
-
-    const device = this.parseCookie(cookies, `dev-id`, deviceIdSchema)
-    const session = this.parseCookie(cookies, `ses-id`, sessionIdSchema)
-
-    const deviceId = device?.value
-    const sessionId = session?.value
-
-    // Silently ignore invalid cookies
-    if (!deviceId || !sessionId) {
-      // If the device cookie is still present, let's cleanup the DB
-      if (deviceId) await this.store.deleteDevice(deviceId)
-
-      return null
-    }
-
-    return {
-      value: { deviceId, sessionId },
-      mustRotate: device.mustRotate || session.mustRotate,
-    }
-  }
-
-  private parseCookie<T>(
-    cookies: Record<string, string | undefined>,
-    name: string,
-    schema: z.ZodType<T> | z.ZodEffects<z.ZodTypeAny, T, string>,
-  ): null | { value: T; mustRotate: boolean } {
-    const rawValue = Object.hasOwn(cookies, name) ? cookies[name] : null
-    if (!rawValue) return null
-
-    const result = schema.safeParse(rawValue)
-    if (!result.success) return null
-
-    const value = result.data
-
-    if (this.options.cookie.keys) {
-      const hashName = `${name}:hash`
-
-      const hash = Object.hasOwn(cookies, hashName) ? cookies[hashName] : null
-      if (!hash) return null
-
-      const idx = this.options.cookie.keys.index(rawValue, hash)
-      if (idx < 0) return null
-
-      return { value, mustRotate: idx !== 0 }
-    }
-
-    return { value, mustRotate: false }
-  }
-
-  private async setCookies(
-    req: IncomingMessage,
-    res: ServerResponse,
-    { deviceId, sessionId }: CookieValue,
-  ) {
-    this.writeCookie(res, `dev-id`, deviceId)
-    this.writeCookie(res, `ses-id`, sessionId)
-  }
-
-  private writeCookie(res: ServerResponse, name: string, value?: string) {
-    const cookieOptions = {
-      maxAge: value
-        ? this.options.cookie.age == null
-          ? undefined
-          : this.options.cookie.age / 1000
-        : 0,
-      httpOnly: true,
-      path: '/',
-      secure: this.options.cookie.secure !== false,
-      sameSite: this.options.cookie.sameSite,
-    } as const
-
-    setCookie(res, name, value || '', cookieOptions)
-
-    if (this.options.cookie.keys) {
-      const hash = value ? this.options.cookie.keys.sign(value) : ''
-      setCookie(res, `${name}:hash`, hash, cookieOptions)
-    }
-  }
-
-  public getRequestMetadata(req: IncomingMessage) {
-    return extractRequestMetadata(req, this.options)
-  }
-}

package/src/device/device-store.ts

@@ -1,31 +0,0 @@
-import { Awaitable, buildInterfaceChecker } from '../lib/util/type.js'
-import { DeviceData } from './device-data.js'
-import { DeviceId } from './device-id.js'
-
-// Export all types needed to implement the DeviceStore interface
-export * from './device-data.js'
-export * from './device-id.js'
-export * from './session-id.js'
-
-export type { Awaitable }
-
-export interface DeviceStore {
-  createDevice(deviceId: DeviceId, data: DeviceData): Awaitable<void>
-  readDevice(deviceId: DeviceId): Awaitable<DeviceData | null>
-  updateDevice(deviceId: DeviceId, data: Partial<DeviceData>): Awaitable<void>
-  deleteDevice(deviceId: DeviceId): Awaitable<void>
-}
-
-export const isDeviceStore = buildInterfaceChecker<DeviceStore>([
-  'createDevice',
-  'deleteDevice',
-  'readDevice',
-  'updateDevice',
-])
-
-export function asDeviceStore<V>(implementation: V): V & DeviceStore {
-  if (!implementation || !isDeviceStore(implementation)) {
-    throw new Error('Invalid DeviceStore implementation')
-  }
-  return implementation
-}

package/src/device/session-id.ts

@@ -1,21 +0,0 @@
-import { z } from 'zod'
-import { SESSION_ID_BYTES_LENGTH, SESSION_ID_PREFIX } from '../constants.js'
-import { randomHexId } from '../lib/util/crypto.js'
-
-export const SESSION_ID_LENGTH =
-  SESSION_ID_PREFIX.length + SESSION_ID_BYTES_LENGTH * 2 // hex encoding
-
-export const sessionIdSchema = z
-  .string()
-  .length(SESSION_ID_LENGTH)
-  .refine(
-    (v): v is `${typeof SESSION_ID_PREFIX}${string}` =>
-      v.startsWith(SESSION_ID_PREFIX),
-    {
-      message: `Invalid session ID format`,
-    },
-  )
-export type SessionId = z.infer<typeof sessionIdSchema>
-export const generateSessionId = async (): Promise<SessionId> => {
-  return `${SESSION_ID_PREFIX}${await randomHexId(SESSION_ID_BYTES_LENGTH)}`
-}

package/src/dpop/dpop-manager.ts

@@ -1,214 +0,0 @@
-import { createHash } from 'node:crypto'
-import { EmbeddedJWK, calculateJwkThumbprint, errors, jwtVerify } from 'jose'
-import { z } from 'zod'
-import { ValidationError } from '@atproto/jwk'
-import { DPOP_NONCE_MAX_AGE } from '../constants.js'
-import { InvalidDpopProofError } from '../errors/invalid-dpop-proof-error.js'
-import { UseDpopNonceError } from '../errors/use-dpop-nonce-error.js'
-import { ifURL } from '../lib/util/cast.js'
-import {
-  DpopNonce,
-  DpopSecret,
-  dpopSecretSchema,
-  rotationIntervalSchema,
-} from './dpop-nonce.js'
-import { DpopProof } from './dpop-proof.js'
-
-const { JOSEError } = errors
-
-export { DpopNonce, type DpopSecret }
-
-export const dpopManagerOptionsSchema = z.object({
-  /**
-   * Set this to `false` to disable the use of nonces in DPoP proofs. Set this
-   * to a secret Uint8Array or hex encoded string to use a predictable seed for
-   * all nonces (typically useful when multiple instances are running). Leave
-   * undefined to generate a random seed at startup.
-   */
-  dpopSecret: z.union([z.literal(false), dpopSecretSchema]).optional(),
-  dpopRotationInterval: rotationIntervalSchema.optional(),
-})
-export type DpopManagerOptions = z.input<typeof dpopManagerOptionsSchema>
-
-export class DpopManager {
-  protected readonly dpopNonce?: DpopNonce
-
-  constructor(options: DpopManagerOptions = {}) {
-    const { dpopSecret, dpopRotationInterval } =
-      dpopManagerOptionsSchema.parse(options)
-    this.dpopNonce =
-      dpopSecret === false
-        ? undefined
-        : new DpopNonce(dpopSecret, dpopRotationInterval)
-  }
-
-  nextNonce(): string | undefined {
-    return this.dpopNonce?.next()
-  }
-
-  /**
-   * @see {@link https://datatracker.ietf.org/doc/html/rfc9449#section-4.3}
-   */
-  async checkProof(
-    httpMethod: string,
-    httpUrl: Readonly<URL>,
-    httpHeaders: Record<string, undefined | string | string[]>,
-    accessToken?: string,
-  ): Promise<null | DpopProof> {
-    // Fool proofing against use of empty string
-    if (!httpMethod) {
-      throw new TypeError('HTTP method is required')
-    }
-
-    const proof = extractProof(httpHeaders)
-    if (!proof) return null
-
-    const { protectedHeader, payload } = await jwtVerify(proof, EmbeddedJWK, {
-      typ: 'dpop+jwt',
-      maxTokenAge: 10, // Will ensure presence & validity of "iat" claim
-      clockTolerance: DPOP_NONCE_MAX_AGE / 1e3,
-    }).catch((err) => {
-      throw wrapInvalidDpopProofError(err, 'Failed to verify DPoP proof')
-    })
-
-    // @NOTE For legacy & backwards compatibility reason, we cannot use
-    // `jwtPayloadSchema` here as it will reject DPoP proofs containing a query
-    // or fragment component in the "htu" claim.
-
-    // const { ath, htm, htu, jti, nonce } = await jwtPayloadSchema
-    //   .parseAsync(payload)
-    //   .catch((err) => {
-    //     throw buildInvalidDpopProofError('Invalid DPoP proof', err)
-    //   })
-
-    // @TODO Uncomment previous lines (and remove redundant checks bellow) once
-    // we decide to drop legacy support.
-    const { ath, htm, htu, jti, nonce } = payload
-
-    if (nonce !== undefined && typeof nonce !== 'string') {
-      throw new InvalidDpopProofError('Invalid DPoP "nonce" type')
-    }
-
-    if (!jti || typeof jti !== 'string') {
-      throw new InvalidDpopProofError('DPoP "jti" missing')
-    }
-
-    // Note rfc9110#section-9.1 states that the method name is case-sensitive
-    if (!htm || htm !== httpMethod) {
-      throw new InvalidDpopProofError('DPoP "htm" mismatch')
-    }
-
-    if (!htu || typeof htu !== 'string') {
-      throw new InvalidDpopProofError('Invalid DPoP "htu" type')
-    }
-
-    // > To reduce the likelihood of false negatives, servers SHOULD employ
-    // > syntax-based normalization (Section 6.2.2 of [RFC3986]) and
-    // > scheme-based normalization (Section 6.2.3 of [RFC3986]) before
-    // > comparing the htu claim.
-    //
-    // RFC9449 section 4.3. Checking DPoP Proofs - https://datatracker.ietf.org/doc/html/rfc9449#section-4.3
-    if (!htu || parseHtu(htu) !== normalizeHtuUrl(httpUrl)) {
-      throw new InvalidDpopProofError('DPoP "htu" mismatch')
-    }
-
-    if (!nonce && this.dpopNonce) {
-      throw new UseDpopNonceError()
-    }
-
-    if (nonce && !this.dpopNonce?.check(nonce)) {
-      throw new UseDpopNonceError('DPoP "nonce" mismatch')
-    }
-
-    if (accessToken) {
-      const accessTokenHash = createHash('sha256').update(accessToken).digest()
-      if (ath !== accessTokenHash.toString('base64url')) {
-        throw new InvalidDpopProofError('DPoP "ath" mismatch')
-      }
-    } else if (ath !== undefined) {
-      throw new InvalidDpopProofError('DPoP "ath" claim not allowed')
-    }
-
-    // @NOTE we can assert there is a jwk because the jwtVerify used the
-    // EmbeddedJWK key getter mechanism.
-    const jwk = protectedHeader.jwk!
-    const jkt = await calculateJwkThumbprint(jwk, 'sha256').catch((err) => {
-      throw wrapInvalidDpopProofError(err, 'Failed to calculate jkt')
-    })
-
-    // @NOTE We freeze the proof to prevent accidental modification (esp. from
-    // hooks).
-    return Object.freeze({ jti, jkt, htm, htu })
-  }
-}
-
-function extractProof(
-  httpHeaders: Record<string, undefined | string | string[]>,
-): string | null {
-  const dpopHeader = httpHeaders['dpop']
-  switch (typeof dpopHeader) {
-    case 'string':
-      if (dpopHeader) return dpopHeader
-      throw new InvalidDpopProofError('DPoP header cannot be empty')
-    case 'object':
-      // @NOTE the "0" case should never happen a node.js HTTP server will only
-      // return an array if the header is set multiple times.
-      if (dpopHeader.length === 1 && dpopHeader[0]) return dpopHeader[0]!
-      throw new InvalidDpopProofError('DPoP header must contain a single proof')
-    default:
-      return null
-  }
-}
-
-/**
- * Constructs the HTTP URI (htu) claim as defined in RFC9449.
- *
- * The htu claim is the normalized URL of the HTTP request, excluding the query
- * string and fragment. This function ensures that the URL is normalized by
- * removing the search and hash components, as well as by using an URL object to
- * simplify the pathname (e.g. removing dot segments).
- *
- * @returns The normalized URL as a string.
- * @see {@link https://datatracker.ietf.org/doc/html/rfc9449#section-4.3}
- */
-function normalizeHtuUrl(url: Readonly<URL>): string {
-  // NodeJS's `URL` normalizes the pathname, so we can just use that.
-  return url.origin + url.pathname
-}
-
-function parseHtu(htu: string): string {
-  const url = ifURL(htu)
-  if (!url) {
-    throw new InvalidDpopProofError('DPoP "htu" is not a valid URL')
-  }
-
-  // @NOTE the checks bellow can be removed once once jwtPayloadSchema is used
-  // to validate the DPoP proof payload as it already performs these checks
-  // (though the htuSchema).
-
-  if (url.password || url.username) {
-    throw new InvalidDpopProofError('DPoP "htu" must not contain credentials')
-  }
-
-  if (url.protocol !== 'http:' && url.protocol !== 'https:') {
-    throw new InvalidDpopProofError('DPoP "htu" must be http or https')
-  }
-
-  // @NOTE For legacy & backwards compatibility reason, we allow a query and
-  // fragment in the DPoP proof's htu. This is not a standard behavior as the
-  // htu is not supposed to contain query or fragment.
-
-  // NodeJS's `URL` normalizes the pathname.
-  return normalizeHtuUrl(url)
-}
-
-function wrapInvalidDpopProofError(
-  err: unknown,
-  title: string,
-): InvalidDpopProofError {
-  const msg =
-    err instanceof JOSEError || err instanceof ValidationError
-      ? `${title}: ${err.message}`
-      : title
-  return new InvalidDpopProofError(msg, err)
-}