@atproto/oauth-provider 0.19.7 → 0.19.8

package/src/router/create-authorization-page-middleware.ts

@@ -1,281 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http'
-import {
-  OAuthAuthorizationRequestQuery,
-  oauthAuthorizationRequestQuerySchema,
-} from '@atproto/oauth-types'
-import { AuthorizationError } from '../errors/authorization-error.js'
-import { InvalidRequestError } from '../errors/invalid-request-error.js'
-import {
-  Middleware,
-  Router,
-  RouterCtx,
-  getCookie,
-  setCookie,
-  validateFetchDest,
-  validateFetchMode,
-  validateFetchSite,
-  validateOrigin,
-  validateReferrer,
-} from '../lib/http/index.js'
-import { SecurityHeadersOptions } from '../lib/http/security-headers.js'
-import { formatError } from '../lib/util/error.js'
-import type { Awaitable } from '../lib/util/type.js'
-import { writeFormRedirect } from '../lib/write-form-redirect.js'
-import type { OAuthProvider } from '../oauth-provider.js'
-import { parseRequestUri, requestUriSchema } from '../request/request-uri.js'
-import { sendAuthorizePageFactory } from './assets/send-authorization-page.js'
-import { sendCookieErrorPageFactory } from './assets/send-cookie-error-page.js'
-import { sendErrorPageFactory } from './assets/send-error-page.js'
-import {
-  sendAuthorizationResultRedirect,
-  sendRedirect,
-} from './assets/send-redirect.js'
-import { parseRedirectUrl } from './create-api-middleware.js'
-import type { MiddlewareOptions } from './middleware-options.js'
-
-export function createAuthorizationPageMiddleware<
-  Ctx extends object | void = void,
-  Req extends IncomingMessage = IncomingMessage,
-  Res extends ServerResponse = ServerResponse,
->(
-  server: OAuthProvider,
-  { onError }: MiddlewareOptions<Req, Res>,
-): Middleware<Ctx, Req, Res> {
-  const issuerUrl = new URL(server.issuer)
-  const issuerOrigin = issuerUrl.origin
-
-  const securityOptions: SecurityHeadersOptions = {
-    hsts: issuerUrl.protocol === 'http:' ? false : undefined,
-  }
-
-  const sendAuthorizePage = sendAuthorizePageFactory(
-    server.customization,
-    securityOptions,
-  )
-  const sendErrorPage = sendErrorPageFactory(
-    server.customization,
-    securityOptions,
-  )
-  const sendCookieErrorPage = sendCookieErrorPageFactory(
-    server.customization,
-    securityOptions,
-  )
-
-  const router = new Router<Ctx, Req, Res>(issuerUrl)
-
-  router.get(
-    '/oauth/authorize',
-    withErrorHandler(async function (req, res) {
-      res.setHeader('Cache-Control', 'no-store')
-      res.setHeader('Pragma', 'no-cache')
-
-      // "same-origin" is required to support the redirect test logic below (as
-      // well as refreshing the authorization page).
-      // "same-site" supports hosting PDS and app on the same site but different
-      // origins (different subdomains).
-      validateFetchSite(req, ['same-origin', 'same-site', 'cross-site', 'none'])
-      validateFetchMode(req, ['navigate'])
-      validateFetchDest(req, ['document'])
-      validateOrigin(req, issuerOrigin)
-
-      // Do not perform any of the following logic if the request is invalid
-      const query = parseOAuthAuthorizationRequestQuery(this.url)
-
-      // @NOTE For some reason, even when loaded through a
-      // ASWebAuthenticationSession, iOS will sometimes fail to properly save
-      // cookies set during the rendering of the page. When this happens, the
-      // authorization page logic, which relies on cookies to maintain the session,
-      // will fail. To work around this, we perform an initial redirect to ourselves
-      // using a form GET submit, in an attempt to verify if the browser saves
-      // cookies on redirect or not. If it does, we proceed as normal. If it
-      // doesn't, we redirect the user back to the client with an error message.
-      if (
-        // Only for iOS users
-        req.headers['user-agent']?.includes('iPhone OS') &&
-        // Disabled if the user already passed the test, which means their browser preserves cookies on redirect
-        !(getCookie(req, 'cookie-test') === 'succeeded') &&
-        // Disabled if the user already has a session
-        !(await server.deviceManager.hasSession(req))
-      ) {
-        // @TODO Another possible solution would be to avoid relying on cookies if we
-        // detect that they are not being preserved. This would mean that preserving
-        // sessions (SSO) would not be possible for browsers that don't preserve
-        // cookies on redirect, but at least the authorization request could still be
-        // completed. This was not implemented yet due to the extra complexity
-        // involved in supporting this.
-
-        // 1) When the user first comes here, we will test if their browser
-        // preserves cookies by redirecting back to ourselves
-        if (!this.url.searchParams.has('redirect-test')) {
-          // 2) Set a testing cookie
-          setCookie(res, 'cookie-test', 'testing', {
-            sameSite: 'lax',
-            httpOnly: true,
-          })
-
-          // 3) And send an auto-submit form redirecting back to ourselves
-          return writeFormRedirect(
-            res,
-            'get',
-            this.url.href,
-            // 4) We add an extra query parameter to trigger the test logic after
-            // the redirect occurred.
-            [...this.url.searchParams, ['redirect-test', '1']],
-            securityOptions,
-          )
-        } else {
-          // 5) We just got redirected back to ourselves. Verify that the
-          // browser preserved cookies during the redirect
-          if (getCookie(req, 'cookie-test')) {
-            // 6) Success! The browser preserved cookies. Proceed with the
-            // normal authorization flow.
-
-            // 7) Set a long lasting cookie to skip the test next time
-            setCookie(res, 'cookie-test', 'succeeded', {
-              sameSite: 'lax',
-              maxAge: 31 * 24 * 60 * 60,
-              httpOnly: true,
-            })
-          } else {
-            // The browser did NOT preserve cookies. We have to abort the
-            // authorization request.
-
-            if (this.url.searchParams.get('redirect-test') === '1') {
-              // 8) Show an error page to the user explaining the situation
-
-              // Give the browser another chance to save cookies after the use
-              // pressed "Continue"
-              setCookie(res, 'cookie-test', 'testing', {
-                sameSite: 'lax',
-                httpOnly: true,
-              })
-
-              // Make sure next time we reach the other branch and redirect back
-              // to the client
-              const continueUrl = new URL(this.url.href)
-              continueUrl.searchParams.set('redirect-test', '2')
-              return sendCookieErrorPage(req, res, { continueUrl })
-            } else {
-              // 9) Once the use acknowledges the error, redirect them back to
-              // the client with an error message.
-
-              // Allow the client to understand what happened (the `error`
-              // response parameter value is constrained by the OAuth2 spec)
-              const message = 'ERR_COOKIES_UNSUPPORTED'
-
-              // @NOTE AuthorizationError thrown here will be caught by the
-              // error handler middleware defined below, and cause a redirect
-              // back to the client with the error parameters.
-              if ('request_uri' in query) {
-                // Load and delete the authorization request
-                const requestUri = parseRequestUri(query.request_uri, {
-                  path: ['query', 'request_uri'],
-                })
-                const data = await server.requestManager.get(
-                  requestUri,
-                  undefined,
-                  query.client_id,
-                )
-                await server.requestManager.delete(requestUri)
-                throw new AuthorizationError(data.parameters, message)
-              } else if ('request' in query) {
-                const client = await server.clientManager.getClient(
-                  query.client_id,
-                )
-                const parameters = await server.decodeJAR(client, query)
-                throw new AuthorizationError(parameters, message)
-              } else {
-                throw new AuthorizationError(query, message)
-              }
-            }
-          }
-        }
-      }
-
-      // Normal authorization flow
-      const device = await server.deviceManager.load(req, res)
-
-      const result = await server.authorize(query, device)
-
-      if ('redirect' in result) {
-        return sendAuthorizationResultRedirect(res, result, securityOptions)
-      } else {
-        return sendAuthorizePage(req, res, result)
-      }
-    }),
-  )
-
-  // This is a private endpoint that will be called by the user after the
-  // authorization request was either approved or denied. The logic performed
-  // here **could** be performed directly in the frontend. We decided to
-  // implement it here to avoid duplicating the logic.
-  router.get(
-    '/oauth/authorize/redirect',
-    withErrorHandler(async function (req, res) {
-      // Ensure we come from the authorization page
-      validateFetchSite(req, ['same-origin'])
-      validateFetchMode(req, ['navigate'])
-      validateFetchDest(req, ['document'])
-      validateOrigin(req, issuerOrigin)
-
-      const referrer = validateReferrer(req, {
-        origin: issuerOrigin,
-        pathname: '/oauth/authorize',
-      })
-
-      // Ensure we are coming from the authorization page
-      requestUriSchema.parse(referrer.searchParams.get('request_uri'))
-
-      return sendRedirect(res, parseRedirectUrl(this.url), securityOptions)
-    }),
-  )
-
-  return router.buildMiddleware()
-
-  function withErrorHandler<T extends RouterCtx>(
-    handler: (this: T, req: Req, res: Res) => Awaitable<void>,
-  ): Middleware<T, Req, Res> {
-    return async function (req, res) {
-      try {
-        await handler.call(this, req, res)
-      } catch (err) {
-        onError?.(req, res, err, `Authorization Request Error`)
-
-        if (!res.headersSent) {
-          if (err instanceof AuthorizationError) {
-            return sendAuthorizationResultRedirect(
-              res,
-              {
-                issuer: server.issuer,
-                parameters: err.parameters,
-                redirect: err.toJSON(),
-              },
-              securityOptions,
-            )
-          } else {
-            return sendErrorPage(req, res, err)
-          }
-        } else if (!res.destroyed) {
-          res.end()
-        }
-      }
-    }
-  }
-}
-
-function parseOAuthAuthorizationRequestQuery(
-  url: URL,
-): OAuthAuthorizationRequestQuery {
-  const query = Object.fromEntries(url.searchParams)
-  const result = oauthAuthorizationRequestQuerySchema.safeParse(query, {
-    path: ['query'],
-  })
-
-  if (!result.success) {
-    const message = 'Invalid request parameters'
-    const err = result.error
-    throw new InvalidRequestError(formatError(err, message), err)
-  }
-
-  return result.data
-}

package/src/router/create-oauth-middleware.ts

@@ -1,257 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http'
-import {
-  oauthAuthorizationRequestParSchema,
-  oauthClientCredentialsSchema,
-  oauthTokenIdentificationSchema,
-  oauthTokenRequestSchema,
-} from '@atproto/oauth-types'
-import { buildErrorPayload, buildErrorStatus } from '../errors/error-parser.js'
-import { InvalidClientError } from '../errors/invalid-client-error.js'
-import { InvalidGrantError } from '../errors/invalid-grant-error.js'
-import { InvalidRequestError } from '../errors/invalid-request-error.js'
-import { WWWAuthenticateError } from '../errors/www-authenticate-error.js'
-import {
-  Middleware,
-  Router,
-  cacheControlMiddleware,
-  combineMiddlewares,
-  jsonHandler,
-  parseHttpRequest,
-  staticJsonMiddleware,
-} from '../lib/http/index.js'
-import { formatError } from '../lib/util/error.js'
-import { OAuthError } from '../oauth-errors.js'
-import type { OAuthProvider } from '../oauth-provider.js'
-import type { MiddlewareOptions } from './middleware-options.js'
-
-// CORS preflight
-const corsHeaders: Middleware = function (req, res, next) {
-  res.setHeader('Access-Control-Max-Age', '86400') // 1 day
-
-  // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin
-  //
-  // > For requests without credentials, the literal value "*" can be
-  // > specified as a wildcard; the value tells browsers to allow
-  // > requesting code from any origin to access the resource.
-  // > Attempting to use the wildcard with credentials results in an
-  // > error.
-  //
-  // A "*" is safer to use than reflecting the request origin.
-  res.setHeader('Access-Control-Allow-Origin', '*')
-
-  // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Methods
-  // > The value "*" only counts as a special wildcard value for
-  // > requests without credentials (requests without HTTP cookies or
-  // > HTTP authentication information). In requests with credentials,
-  // > it is treated as the literal method name "*" without special
-  // > semantics.
-  res.setHeader('Access-Control-Allow-Methods', '*')
-
-  res.setHeader('Access-Control-Allow-Headers', 'Content-Type,DPoP')
-
-  next()
-}
-
-const corsPreflight: Middleware = combineMiddlewares([
-  corsHeaders,
-  (req, res) => {
-    res.writeHead(200).end()
-  },
-])
-
-export function createOAuthMiddleware<
-  Ctx extends object | void = void,
-  Req extends IncomingMessage = IncomingMessage,
-  Res extends ServerResponse = ServerResponse,
->(
-  server: OAuthProvider,
-  { onError }: MiddlewareOptions<Req, Res>,
-): Middleware<Ctx, Req, Res> {
-  const router = new Router<Ctx, Req, Res>(new URL(server.issuer))
-
-  //- Public OAuth endpoints
-
-  router.options('/.well-known/oauth-authorization-server', corsPreflight)
-  router.get(
-    '/.well-known/oauth-authorization-server',
-    corsHeaders,
-    cacheControlMiddleware(300),
-    staticJsonMiddleware(server.metadata),
-  )
-
-  router.options('/oauth/jwks', corsPreflight)
-  router.get(
-    '/oauth/jwks',
-    corsHeaders,
-    cacheControlMiddleware(300),
-    staticJsonMiddleware(server.jwks),
-  )
-
-  router.options('/oauth/par', corsPreflight)
-  router.post(
-    '/oauth/par',
-    corsHeaders,
-    oauthHandler(async function (req) {
-      const payload = await parseHttpRequest(req, ['json', 'urlencoded'])
-
-      // https://datatracker.ietf.org/doc/html/rfc9126#name-error-response
-      // https://datatracker.ietf.org/doc/html/rfc6749#autoid-56
-
-      const credentials = await oauthClientCredentialsSchema
-        .parseAsync(payload, { path: ['body'] })
-        .catch((err) => throwInvalidClient(err, 'Client credentials missing'))
-
-      const authorizationRequest = await oauthAuthorizationRequestParSchema
-        .parseAsync(payload, { path: ['body'] })
-        .catch((err) =>
-          throwInvalidRequest(err, 'Invalid authorization request'),
-        )
-
-      const dpopProof = await server.checkDpopProof(
-        req.method!,
-        this.url,
-        req.headers,
-      )
-
-      return server.pushedAuthorizationRequest(
-        credentials,
-        authorizationRequest,
-        dpopProof,
-      )
-    }, 201),
-  )
-  // https://datatracker.ietf.org/doc/html/rfc9126#section-2.3
-  // > If the request did not use the POST method, the authorization server
-  // > responds with an HTTP 405 (Method Not Allowed) status code.
-  router.all('/oauth/par', (req, res) => {
-    res.writeHead(405).end()
-  })
-
-  router.options('/oauth/token', corsPreflight)
-  router.post(
-    '/oauth/token',
-    corsHeaders,
-    oauthHandler(async function (req) {
-      const payload = await parseHttpRequest(req, ['json', 'urlencoded'])
-
-      const clientMetadata = await server.deviceManager.getRequestMetadata(req)
-
-      const clientCredentials = await oauthClientCredentialsSchema
-        .parseAsync(payload, { path: ['body'] })
-        .catch((err) => throwInvalidGrant(err, 'Client credentials missing'))
-
-      const tokenRequest = await oauthTokenRequestSchema
-        .parseAsync(payload, { path: ['body'] })
-        .catch((err) => throwInvalidGrant(err, 'Invalid request payload'))
-
-      const dpopProof = await server.checkDpopProof(
-        req.method!,
-        this.url,
-        req.headers,
-      )
-
-      return server.token(
-        clientCredentials,
-        clientMetadata,
-        tokenRequest,
-        dpopProof,
-      )
-    }),
-  )
-
-  router.options('/oauth/revoke', corsPreflight)
-  router.post(
-    '/oauth/revoke',
-    corsHeaders,
-    oauthHandler(async function (req, res) {
-      const payload = await parseHttpRequest(req, ['json', 'urlencoded'])
-
-      const credentials = await oauthClientCredentialsSchema
-        .parseAsync(payload, { path: ['body'] })
-        .catch((err) => throwInvalidRequest(err, 'Client credentials missing'))
-
-      const tokenIdentification = await oauthTokenIdentificationSchema
-        .parseAsync(payload, { path: ['body'] })
-        .catch((err) => throwInvalidRequest(err, 'Invalid request payload'))
-
-      const dpopProof = await server.checkDpopProof(
-        req.method!,
-        this.url,
-        req.headers,
-      )
-
-      try {
-        await server.revoke(credentials, tokenIdentification, dpopProof)
-      } catch (err) {
-        // > Note: invalid tokens do not cause an error response since the
-        // > client cannot handle such an error in a reasonable way.  Moreover,
-        // > the purpose of the revocation request, invalidating the particular
-        // > token, is already achieved.
-        //
-        // https://datatracker.ietf.org/doc/html/rfc7009#section-2.2
-
-        onError?.(req, res, err, 'Failed to revoke token')
-      }
-
-      return {}
-    }),
-  )
-
-  return router.buildMiddleware()
-
-  function oauthHandler<T>(
-    buildOAuthResponse: (this: T, req: Req, res: Res) => unknown,
-    status?: number,
-  ): Middleware<T, Req, Res> {
-    return jsonHandler<T, Req, Res>(async function (req, res) {
-      try {
-        // https://www.rfc-editor.org/rfc/rfc6749.html#section-5.1
-        res.setHeader('Cache-Control', 'no-store')
-        res.setHeader('Pragma', 'no-cache')
-
-        // https://datatracker.ietf.org/doc/html/rfc9449#section-8.2
-        const dpopNonce = server.nextDpopNonce()
-        if (dpopNonce) {
-          const name = 'DPoP-Nonce'
-          res.setHeader(name, dpopNonce)
-          res.appendHeader('Access-Control-Expose-Headers', name)
-        }
-
-        const json = await buildOAuthResponse.call(this, req, res)
-        return { json, status }
-      } catch (err) {
-        onError?.(
-          req,
-          res,
-          err,
-          err instanceof OAuthError
-            ? `OAuth "${err.error}" error`
-            : 'Unexpected error',
-        )
-
-        if (!res.headersSent && err instanceof WWWAuthenticateError) {
-          const name = 'WWW-Authenticate'
-          res.setHeader(name, err.wwwAuthenticateHeader)
-          res.appendHeader('Access-Control-Expose-Headers', name)
-        }
-
-        const status = buildErrorStatus(err)
-        const json = buildErrorPayload(err)
-
-        return { json, status }
-      }
-    })
-  }
-}
-
-function throwInvalidGrant(err: unknown, prefix: string): never {
-  throw new InvalidGrantError(formatError(err, prefix), err)
-}
-
-function throwInvalidClient(err: unknown, prefix: string): never {
-  throw new InvalidClientError(formatError(err, prefix), err)
-}
-
-function throwInvalidRequest(err: unknown, prefix: string): never {
-  throw new InvalidRequestError(formatError(err, prefix), err)
-}

package/src/router/error-handler.ts

@@ -1,6 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http'
-
-export type ErrorHandler<
-  Req extends IncomingMessage = IncomingMessage,
-  Res extends ServerResponse = ServerResponse,
-> = (req: Req, res: Res, err: unknown, message: string) => void

package/src/router/middleware-options.ts

@@ -1,9 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http'
-import type { ErrorHandler } from './error-handler.js'
-
-export type MiddlewareOptions<
-  Req extends IncomingMessage = IncomingMessage,
-  Res extends ServerResponse = ServerResponse,
-> = {
-  onError?: ErrorHandler<Req, Res>
-}

package/src/signer/access-token-payload.ts

@@ -1,25 +0,0 @@
-import { z } from 'zod'
-import { didSchema } from '@atproto/did'
-import { jwtPayloadSchema } from '@atproto/jwk'
-import { clientIdSchema } from '../client/client-id.js'
-import { tokenIdSchema } from '../token/token-id.js'
-
-export const accessTokenPayloadSchema = jwtPayloadSchema
-  .partial()
-  .extend({
-    // Following are required
-    jti: tokenIdSchema,
-    sub: didSchema,
-    exp: z.number().int(),
-    iat: z.number().int(),
-    iss: z.string().min(1),
-
-    // @NOTE "aud", "scope", "client_id" are not required, as are stored in the
-    // DB in 'light' access token mode.
-
-    // Restrict type of following
-    client_id: clientIdSchema.optional(),
-  })
-  .passthrough()
-
-export type AccessTokenPayload = z.infer<typeof accessTokenPayloadSchema>

package/src/signer/api-token-payload.ts

@@ -1,18 +0,0 @@
-import { z } from 'zod'
-import { didSchema } from '@atproto/did'
-import { jwtPayloadSchema } from '@atproto/jwk'
-import { deviceIdSchema } from '../oauth-store.js'
-import { requestUriSchema } from '../request/request-uri.js'
-
-export const apiTokenPayloadSchema = jwtPayloadSchema
-  .extend({
-    sub: didSchema,
-
-    deviceId: deviceIdSchema,
-    // If the token is bound to a particular authorization request, it can only
-    // be used in the context of that request.
-    requestUri: requestUriSchema.optional(),
-  })
-  .passthrough()
-
-export type ApiTokenPayload = z.infer<typeof apiTokenPayloadSchema>