@atproto/oauth-provider 0.19.7 → 0.19.8

package/src/token/token-store.ts

@@ -1,88 +0,0 @@
-import type { Did } from '@atproto/did'
-import type { Account } from '@atproto/oauth-provider-api'
-import { Awaitable, buildInterfaceChecker } from '../lib/util/type.js'
-import { Code } from '../request/code.js'
-import { RefreshToken } from './refresh-token.js'
-import { TokenData } from './token-data.js'
-import { TokenId } from './token-id.js'
-
-// Export all types needed to implement the TokenStore interface
-export * from './refresh-token.js'
-export * from './token-data.js'
-export * from './token-id.js'
-export type { Account, Awaitable, Did }
-
-export type TokenInfo = {
-  id: TokenId
-  data: TokenData
-  account: Account
-  currentRefreshToken: null | RefreshToken
-}
-
-export type NewTokenData = {
-  clientAuth: TokenData['clientAuth']
-  expiresAt: TokenData['expiresAt']
-  updatedAt: TokenData['updatedAt']
-  scope: NonNullable<TokenData['scope']>
-}
-
-export type CreateTokenData = TokenData & {
-  scope: NonNullable<TokenData['scope']>
-}
-
-/**
- * @param data historically, {@link TokenData.scope} was not present in
- * {@link TokenData}, causing it to be "nullable" when returned from
- * {@link TokenStore.readToken}. We use {@link CreateTokenData} here to allow
- * the store implementation to expect its presence.
- */
-export interface TokenStore {
-  createToken(
-    tokenId: TokenId,
-    data: CreateTokenData,
-    refreshToken?: RefreshToken,
-  ): Awaitable<void>
-
-  readToken(tokenId: TokenId): Awaitable<null | TokenInfo>
-
-  deleteToken(tokenId: TokenId): Awaitable<void>
-
-  rotateToken(
-    tokenId: TokenId,
-    newTokenId: TokenId,
-    newRefreshToken: RefreshToken,
-    newData: NewTokenData,
-  ): Awaitable<void>
-
-  /**
-   * Find a token by its refresh token. Note that previous refresh tokens
-   * should also return the token. The data model is responsible for storing
-   * old refresh tokens when a new one is issued.
-   */
-  findTokenByRefreshToken(
-    refreshToken: RefreshToken,
-  ): Awaitable<null | TokenInfo>
-
-  findTokenByCode(code: Code): Awaitable<null | TokenInfo>
-
-  listAccountTokens(did: Did): Awaitable<TokenInfo[]>
-}
-
-export const isTokenStore = buildInterfaceChecker<TokenStore>([
-  'createToken',
-  'deleteToken',
-  'findTokenByCode',
-  'findTokenByRefreshToken',
-  'listAccountTokens',
-  'readToken',
-  'rotateToken',
-])
-
-export function asTokenStore<V extends Partial<TokenStore>>(
-  implementation?: V,
-): V & TokenStore {
-  if (!implementation || !isTokenStore(implementation)) {
-    throw new Error('Invalid TokenStore implementation')
-  }
-  return implementation
-}

package/src/types/authorization-response-error.ts

@@ -1,27 +0,0 @@
-import { z } from 'zod'
-import {
-  oauthAuthorizationResponseErrorSchema,
-  oidcAuthorizationResponseErrorSchema,
-} from '@atproto/oauth-types'
-
-export const authorizationResponseErrorSchema = z.union([
-  oauthAuthorizationResponseErrorSchema,
-  // OIDC authentication error response are not part of the ATproto flavoured
-  // OAuth but we allow them because they provide better feedback to the client
-  // (in particular when SSO is used).
-  oidcAuthorizationResponseErrorSchema,
-  // This error is defined by rfc9396 (not part of the OAuth 2.1 or OIDC). But
-  // since, in ATproto flavoured OAuth, client registration is a dynamic part of
-  // the authorization process, we allow it.
-  z.literal('invalid_authorization_details'),
-])
-
-export type AuthorizationResponseError = z.infer<
-  typeof authorizationResponseErrorSchema
->
-
-export function isAuthorizationResponseError<T>(
-  value: T,
-): value is T & AuthorizationResponseError {
-  return authorizationResponseErrorSchema.safeParse(value).success
-}

package/src/types/color-hue.ts

@@ -1,3 +0,0 @@
-import { z } from 'zod'
-
-export const colorHueSchema = z.number().min(0).max(360)

package/src/types/email-otp.ts

@@ -1,3 +0,0 @@
-import { z } from 'zod'
-
-export const emailOtpSchema = z.string().min(1)

package/src/types/email.ts

@@ -1,26 +0,0 @@
-import { isEmailValid } from '@hapi/address'
-import { isDisposableEmail } from 'disposable-email-domains-js'
-import { z } from 'zod'
-
-export const emailSchema = z
-  .string()
-  .email()
-  // @NOTE Internally, `zod` uses a regexp for validating emails.. This
-  // validation strategy *could* be less permissive in some (edge) cases than
-  // `@hapi/address` as the latter uses an algorithm based on the spec. Truth
-  // is, it is kinda hard to know if the set of emails allowed by
-  // `@hapi/address` is covered by the set of emails allowed by `zod`.
-  // Additionally, this could change with future changes in either libraries.
-  //
-  // Because of this uncertainty, and because other part of the Bluesky/ATProto
-  // codebases rely solely on `zod`, this code only allows emails that are valid
-  // according to both libraries ensuring that we never encounter a case where
-  // an email allowed here is in a format that would be rejected by other parts
-  // of our systems.
-  .refine(isEmailValid, {
-    message: 'Invalid email address',
-  })
-  .refine((email) => !isDisposableEmail(email), {
-    message: 'Disposable email addresses are not allowed',
-  })
-  .transform((value) => value.toLowerCase())

package/src/types/handle.ts

@@ -1,23 +0,0 @@
-import { z } from 'zod'
-import {
-  HandleString,
-  ensureValidHandle,
-  normalizeHandle,
-} from '@atproto/syntax'
-
-/**
- * @note Only validates again AT Protocol's syntax. Additional rules (specific
- * domains, slurs, etc.) may be imposed through the store implementation.
- */
-export const handleSchema = z.string().transform((value, ctx): HandleString => {
-  try {
-    ensureValidHandle(value)
-    return normalizeHandle(value)
-  } catch (err) {
-    ctx.addIssue({
-      code: z.ZodIssueCode.custom,
-      message: err instanceof Error ? err.message : 'Invalid handle',
-    })
-    return z.NEVER
-  }
-})

package/src/types/invite-code.ts

@@ -1,4 +0,0 @@
-import { z } from 'zod'
-
-export const inviteCodeSchema = z.string().min(1)
-export type InviteCode = z.infer<typeof inviteCodeSchema>

package/src/types/par-response-error.ts

@@ -1,25 +0,0 @@
-import { z } from 'zod'
-import { authorizationResponseErrorSchema } from './authorization-response-error.js'
-
-// https://datatracker.ietf.org/doc/html/rfc9126#section-2.3-1
-// > Since initial processing of the pushed authorization request does not
-// > involve resource owner interaction, error codes related to user
-// > interaction, such as "access_denied", are never returned.
-
-export const parResponseErrorSchema = z.intersection(
-  authorizationResponseErrorSchema,
-  z.enum([
-    'invalid_request',
-    'unauthorized_client',
-    'unsupported_response_type',
-    'invalid_scope',
-    'server_error',
-    'temporarily_unavailable',
-  ]),
-)
-
-export type PARResponseError = z.infer<typeof parResponseErrorSchema>
-
-export function isPARResponseError<T>(value: T): value is T & PARResponseError {
-  return parResponseErrorSchema.safeParse(value).success
-}

package/src/types/password.ts

@@ -1,4 +0,0 @@
-import { z } from 'zod'
-
-export const oldPasswordSchema = z.string().min(1).max(512)
-export const newPasswordSchema = z.string().min(8).max(256)

package/src/types/rgb-color.ts

@@ -1,21 +0,0 @@
-import { z } from 'zod'
-import { RgbColor, parseColor } from '../lib/util/color.js'
-
-export const rgbColorSchema = z.string().transform((value, ctx): RgbColor => {
-  try {
-    const parsed = parseColor(value)
-    if ('a' in parsed && parsed.a !== undefined) {
-      ctx.addIssue({
-        code: z.ZodIssueCode.custom,
-        message: 'Alpha values are not supported',
-      })
-    }
-    return parsed
-  } catch (e) {
-    ctx.addIssue({
-      code: z.ZodIssueCode.custom,
-      message: e instanceof Error ? e.message : 'Invalid color value',
-    })
-    return z.NEVER
-  }
-})

package/tsconfig.build.json

@@ -1,8 +0,0 @@
-{
-  "extends": ["../../../tsconfig/nodenext.json"],
-  "compilerOptions": {
-    "outDir": "dist",
-    "rootDir": "src",
-  },
-  "include": ["src"],
-}

package/tsconfig.build.tsbuildinfo

@@ -1 +0,0 @@
-{"version":"7.0.0-dev.20260614.1","root":["./src/constants.ts","./src/index.ts","./src/oauth-client.ts","./src/oauth-dpop.ts","./src/oauth-errors.ts","./src/oauth-hooks.ts","./src/oauth-middleware.ts","./src/oauth-provider.ts","./src/oauth-store.ts","./src/oauth-verifier.ts","./src/access-token/access-token-mode.ts","./src/account/account-manager.ts","./src/account/account-store.ts","./src/account/sign-in-data.ts","./src/account/sign-up-input.ts","./src/client/client-auth.ts","./src/client/client-data.ts","./src/client/client-id.ts","./src/client/client-info.ts","./src/client/client-manager.ts","./src/client/client-store.ts","./src/client/client-utils.ts","./src/client/client.ts","./src/customization/branding.ts","./src/customization/build-customization-css.ts","./src/customization/build-customization-data.ts","./src/customization/colors.ts","./src/customization/customization.ts","./src/customization/links.ts","./src/device/device-data.ts","./src/device/device-id.ts","./src/device/device-manager.ts","./src/device/device-store.ts","./src/device/session-id.ts","./src/dpop/dpop-manager.ts","./src/dpop/dpop-nonce.ts","./src/dpop/dpop-proof.ts","./src/errors/access-denied-error.ts","./src/errors/account-selection-required-error.ts","./src/errors/authorization-error.ts","./src/errors/consent-required-error.ts","./src/errors/error-parser.ts","./src/errors/handle-unavailable-error.ts","./src/errors/invalid-authorization-details-error.ts","./src/errors/invalid-client-error.ts","./src/errors/invalid-client-id-error.ts","./src/errors/invalid-client-metadata-error.ts","./src/errors/invalid-credentials-error.ts","./src/errors/invalid-dpop-key-binding-error.ts","./src/errors/invalid-dpop-proof-error.ts","./src/errors/invalid-grant-error.ts","./src/errors/invalid-invite-code-error.ts","./src/errors/invalid-redirect-uri-error.ts","./src/errors/invalid-request-error.ts","./src/errors/invalid-scope-error.ts","./src/errors/invalid-token-error.ts","./src/errors/login-required-error.ts","./src/errors/oauth-error.ts","./src/errors/second-authentication-factor-required-error.ts","./src/errors/unauthorized-client-error.ts","./src/errors/use-dpop-nonce-error.ts","./src/errors/www-authenticate-error.ts","./src/lexicon/lexicon-data.ts","./src/lexicon/lexicon-getter.ts","./src/lexicon/lexicon-manager.ts","./src/lexicon/lexicon-store.ts","./src/lib/hcaptcha.ts","./src/lib/nsid.ts","./src/lib/redis.ts","./src/lib/write-form-redirect.ts","./src/lib/write-html.ts","./src/lib/csp/index.ts","./src/lib/html/build-document.ts","./src/lib/html/escapers.ts","./src/lib/html/html.ts","./src/lib/html/hydration-data.ts","./src/lib/html/index.ts","./src/lib/html/tags.ts","./src/lib/html/util.ts","./src/lib/http/accept.ts","./src/lib/http/context.ts","./src/lib/http/headers.ts","./src/lib/http/index.ts","./src/lib/http/method.ts","./src/lib/http/middleware.ts","./src/lib/http/parser.ts","./src/lib/http/path.ts","./src/lib/http/request.ts","./src/lib/http/response.ts","./src/lib/http/route.ts","./src/lib/http/router.ts","./src/lib/http/security-headers.ts","./src/lib/http/stream.ts","./src/lib/http/types.ts","./src/lib/http/url.ts","./src/lib/util/authorization-header.ts","./src/lib/util/cast.ts","./src/lib/util/color.ts","./src/lib/util/crypto.ts","./src/lib/util/date.ts","./src/lib/util/error.ts","./src/lib/util/function.ts","./src/lib/util/locale.ts","./src/lib/util/object.ts","./src/lib/util/redirect-uri.ts","./src/lib/util/time.ts","./src/lib/util/type.ts","./src/lib/util/ui8.ts","./src/lib/util/well-known.ts","./src/lib/util/zod-error.ts","./src/metadata/build-metadata.ts","./src/replay/replay-manager.ts","./src/replay/replay-store-memory.ts","./src/replay/replay-store-redis.ts","./src/replay/replay-store.ts","./src/request/code.ts","./src/request/request-data.ts","./src/request/request-id.ts","./src/request/request-manager.ts","./src/request/request-store.ts","./src/request/request-uri.ts","./src/result/authorization-redirect-parameters.ts","./src/result/authorization-result-authorize-page.ts","./src/result/authorization-result-redirect.ts","./src/router/create-account-page-middleware.ts","./src/router/create-api-middleware.ts","./src/router/create-authorization-page-middleware.ts","./src/router/create-oauth-middleware.ts","./src/router/error-handler.ts","./src/router/middleware-options.ts","./src/router/assets/assets-manifest.ts","./src/router/assets/assets.ts","./src/router/assets/csrf.ts","./src/router/assets/send-account-page.ts","./src/router/assets/send-authorization-page.ts","./src/router/assets/send-cookie-error-page.ts","./src/router/assets/send-error-page.ts","./src/router/assets/send-redirect.ts","./src/signer/access-token-payload.ts","./src/signer/api-token-payload.ts","./src/signer/signer.ts","./src/token/refresh-token.ts","./src/token/token-claims.ts","./src/token/token-data.ts","./src/token/token-id.ts","./src/token/token-manager.ts","./src/token/token-store.ts","./src/types/authorization-response-error.ts","./src/types/color-hue.ts","./src/types/email-otp.ts","./src/types/email.ts","./src/types/handle.ts","./src/types/invite-code.ts","./src/types/par-response-error.ts","./src/types/password.ts","./src/types/rgb-color.ts"]}

package/tsconfig.json

@@ -1,4 +0,0 @@
-{
-  "include": [],
-  "references": [{ "path": "./tsconfig.build.json" }],
-}