@atproto/oauth-provider 0.19.7 → 0.19.8

package/src/dpop/dpop-nonce.ts

@@ -1,121 +0,0 @@
-import { createHmac, randomBytes } from 'node:crypto'
-import { z } from 'zod'
-import { DPOP_NONCE_MAX_AGE } from '../constants.js'
-
-const MAX_ROTATION_INTERVAL = DPOP_NONCE_MAX_AGE / 3
-const MIN_ROTATION_INTERVAL = Math.min(1000, MAX_ROTATION_INTERVAL)
-
-export const rotationIntervalSchema = z
-  .number()
-  .int()
-  .min(MIN_ROTATION_INTERVAL)
-  .max(MAX_ROTATION_INTERVAL)
-
-const SECRET_BYTE_LENGTH = 32
-
-export const secretBytesSchema = z
-  .instanceof(Uint8Array<ArrayBufferLike>)
-  .refine((secret) => secret.length === SECRET_BYTE_LENGTH, {
-    message: `Secret must be exactly ${SECRET_BYTE_LENGTH} bytes long`,
-  })
-
-export const secretHexSchema = z
-  .string()
-  .regex(
-    /^[0-9a-f]+$/i,
-    `Secret must be a ${SECRET_BYTE_LENGTH * 2} chars hex string`,
-  )
-  .length(SECRET_BYTE_LENGTH * 2)
-  .transform((hex): Uint8Array => Buffer.from(hex, 'hex'))
-
-export const dpopSecretSchema = z.union([secretBytesSchema, secretHexSchema])
-export type DpopSecret = z.input<typeof dpopSecretSchema>
-
-export class DpopNonce {
-  readonly #rotationInterval: number
-  readonly #secret: Uint8Array
-
-  // Nonce state
-  #counter: number
-  #prev: string
-  #now: string
-  #next: string
-
-  constructor(
-    secret: DpopSecret = randomBytes(SECRET_BYTE_LENGTH),
-    rotationInterval = MAX_ROTATION_INTERVAL,
-  ) {
-    this.#rotationInterval = rotationIntervalSchema.parse(rotationInterval)
-    this.#secret = Uint8Array.from(dpopSecretSchema.parse(secret))
-
-    this.#counter = this.currentCounter
-    this.#prev = this.compute(this.#counter - 1)
-    this.#now = this.compute(this.#counter)
-    this.#next = this.compute(this.#counter + 1)
-  }
-
-  /**
-   * Returns the number of full rotations since the epoch
-   */
-  protected get currentCounter() {
-    return (Date.now() / this.#rotationInterval) | 0
-  }
-
-  protected rotate() {
-    const counter = this.currentCounter
-    switch (counter - this.#counter) {
-      case 0:
-        // counter === this.#counter => nothing to do
-        return
-      case 1:
-        // Optimization: avoid recomputing #prev & #now
-        this.#prev = this.#now
-        this.#now = this.#next
-        this.#next = this.compute(counter + 1)
-        break
-      case 2:
-        // Optimization: avoid recomputing #prev
-        this.#prev = this.#next
-        this.#now = this.compute(counter)
-        this.#next = this.compute(counter + 1)
-        break
-      default:
-        // All nonces are outdated, so we recompute all of them
-        this.#prev = this.compute(counter - 1)
-        this.#now = this.compute(counter)
-        this.#next = this.compute(counter + 1)
-        break
-    }
-    this.#counter = counter
-  }
-
-  protected compute(counter: number) {
-    return createHmac('sha256', this.#secret)
-      .update(numTo64bits(counter))
-      .digest()
-      .toString('base64url')
-  }
-
-  public next() {
-    this.rotate()
-    return this.#next
-  }
-
-  public check(nonce: string) {
-    return this.#next === nonce || this.#now === nonce || this.#prev === nonce
-  }
-}
-
-function numTo64bits(num: number) {
-  const arr = new Uint8Array(8)
-  // @NOTE Assigning to an uint8 will only keep the last 8 int bits
-  arr[7] = num |= 0
-  arr[6] = num >>= 8
-  arr[5] = num >>= 8
-  arr[4] = num >>= 8
-  arr[3] = num >>= 8
-  arr[2] = num >>= 8
-  arr[1] = num >>= 8
-  arr[0] = num >>= 8
-  return arr
-}

package/src/dpop/dpop-proof.ts

@@ -1,6 +0,0 @@
-export type DpopProof = Readonly<{
-  jti: string
-  jkt: string
-  htm: string
-  htu: string
-}>

package/src/errors/access-denied-error.ts

@@ -1,12 +0,0 @@
-import { OAuthAuthorizationRequestParameters } from '@atproto/oauth-types'
-import { AuthorizationError } from './authorization-error.js'
-
-export class AccessDeniedError extends AuthorizationError {
-  constructor(
-    parameters: OAuthAuthorizationRequestParameters,
-    error_description = 'Access denied',
-    cause?: unknown,
-  ) {
-    super(parameters, error_description, 'access_denied', cause)
-  }
-}

package/src/errors/account-selection-required-error.ts

@@ -1,12 +0,0 @@
-import { OAuthAuthorizationRequestParameters } from '@atproto/oauth-types'
-import { AuthorizationError } from './authorization-error.js'
-
-export class AccountSelectionRequiredError extends AuthorizationError {
-  constructor(
-    parameters: OAuthAuthorizationRequestParameters,
-    error_description = 'Account selection required',
-    cause?: unknown,
-  ) {
-    super(parameters, error_description, 'account_selection_required', cause)
-  }
-}

package/src/errors/authorization-error.ts

@@ -1,45 +0,0 @@
-import { OAuthAuthorizationRequestParameters } from '@atproto/oauth-types'
-import {
-  AuthorizationResponseError,
-  isAuthorizationResponseError,
-} from '../types/authorization-response-error.js'
-import { buildErrorPayload } from './error-parser.js'
-import { OAuthError } from './oauth-error.js'
-
-export type { AuthorizationResponseError, OAuthAuthorizationRequestParameters }
-
-export class AuthorizationError extends OAuthError {
-  constructor(
-    public readonly parameters: OAuthAuthorizationRequestParameters,
-    error_description: string,
-    error: AuthorizationResponseError = 'invalid_request',
-    cause?: unknown,
-  ) {
-    super(error, error_description, 400, cause)
-  }
-
-  static from(
-    parameters: OAuthAuthorizationRequestParameters,
-    cause: unknown,
-  ): AuthorizationError {
-    if (cause instanceof AuthorizationError) return cause
-    const payload = buildErrorPayload(cause)
-    return new AuthorizationError(
-      parameters,
-      payload.error_description,
-      isAuthorizationResponseError(payload.error)
-        ? payload.error // Propagate "error" derived from the cause
-        : rootCause(cause) instanceof OAuthError
-          ? 'invalid_request'
-          : 'server_error',
-      cause,
-    )
-  }
-}
-
-function rootCause(err: unknown): unknown {
-  while (err instanceof Error && err.cause != null) {
-    err = err.cause
-  }
-  return err
-}

package/src/errors/consent-required-error.ts

@@ -1,12 +0,0 @@
-import { OAuthAuthorizationRequestParameters } from '@atproto/oauth-types'
-import { AuthorizationError } from './authorization-error.js'
-
-export class ConsentRequiredError extends AuthorizationError {
-  constructor(
-    parameters: OAuthAuthorizationRequestParameters,
-    error_description = 'User consent required',
-    cause?: unknown,
-  ) {
-    super(parameters, error_description, 'consent_required', cause)
-  }
-}

package/src/errors/error-parser.ts

@@ -1,147 +0,0 @@
-import { errors } from 'jose'
-import { ZodError } from 'zod'
-import { JwtVerifyError } from '@atproto/jwk'
-import { formatZodError } from '../lib/util/zod-error.js'
-import { OAuthError } from './oauth-error.js'
-
-const { JOSEError } = errors
-
-const INVALID_REQUEST = 'invalid_request'
-const SERVER_ERROR = 'server_error'
-
-export function buildErrorStatus(error: unknown): number {
-  if (error instanceof OAuthError) {
-    return error.statusCode
-  }
-
-  if (error instanceof JwtVerifyError) {
-    return 400
-  }
-
-  if (error instanceof ZodError) {
-    return 400
-  }
-
-  if (error instanceof JOSEError) {
-    return 400
-  }
-
-  if (error instanceof TypeError) {
-    return 400
-  }
-
-  if (isBoom(error)) {
-    return error.output.statusCode
-  }
-
-  if (isXrpcError(error)) {
-    return error.type
-  }
-
-  const status = (error as any)?.status
-  if (
-    typeof status === 'number' &&
-    status === (status | 0) &&
-    status >= 400 &&
-    status < 600
-  ) {
-    return status
-  }
-
-  return 500
-}
-
-export type ErrorPayload = {
-  error: string
-  error_description: string
-}
-
-export function buildErrorPayload(error: unknown): ErrorPayload {
-  if (error instanceof OAuthError) {
-    return error.toJSON()
-  }
-
-  if (error instanceof ZodError) {
-    return {
-      error: INVALID_REQUEST,
-      error_description: formatZodError(error, 'Validation error'),
-    }
-  }
-
-  if (error instanceof JOSEError) {
-    return {
-      error: INVALID_REQUEST,
-      error_description: error.message,
-    }
-  }
-
-  if (error instanceof TypeError) {
-    return {
-      error: INVALID_REQUEST,
-      error_description: error.message,
-    }
-  }
-
-  if (isBoom(error)) {
-    return {
-      error: error.output.statusCode <= 500 ? INVALID_REQUEST : SERVER_ERROR,
-      error_description:
-        error.output.statusCode <= 500
-          ? isPayloadLike(error.output?.payload)
-            ? error.output.payload.message
-            : error.message
-          : 'Server error',
-    }
-  }
-
-  if (isXrpcError(error)) {
-    return {
-      error: error.type <= 500 ? INVALID_REQUEST : SERVER_ERROR,
-      error_description: error.payload.message,
-    }
-  }
-
-  const status = buildErrorStatus(error)
-  return {
-    error: status < 500 ? INVALID_REQUEST : SERVER_ERROR,
-    error_description:
-      error instanceof Error && (error as any)?.expose === true
-        ? error.message
-        : 'Server error',
-  }
-}
-
-function isBoom(v: unknown): v is Error & {
-  isBoom: true
-  output: { statusCode: number; payload: unknown }
-} {
-  return (
-    v instanceof Error &&
-    (v as any).isBoom === true &&
-    isHttpErrorCode(v['output']?.['statusCode'])
-  )
-}
-
-function isXrpcError(v: unknown): v is Error & {
-  type: number
-  payload: { error: string; message: string }
-} {
-  return (
-    v instanceof Error &&
-    isHttpErrorCode(v['type']) &&
-    isPayloadLike(v['payload'])
-  )
-}
-
-function isHttpErrorCode(v: unknown): v is number {
-  return typeof v === 'number' && v >= 400 && v < 600 && v === (v | 0)
-}
-
-function isPayloadLike(v: unknown): v is { error: string; message: string } {
-  return (
-    v != null &&
-    typeof v === 'object' &&
-    typeof v['error'] === 'string' &&
-    typeof v['message'] === 'string'
-  )
-}

package/src/errors/handle-unavailable-error.ts

@@ -1,23 +0,0 @@
-import { HandleUnavailableReason } from '@atproto/oauth-provider-api'
-import { OAuthError } from './oauth-error.js'
-
-// @TODO this is *not* and "OAuthError" error but rather an ApiError.
-
-export type { HandleUnavailableReason }
-
-export class HandleUnavailableError extends OAuthError {
-  constructor(
-    readonly reason: HandleUnavailableReason,
-    details: string = 'That handle is not available',
-    cause?: unknown,
-  ) {
-    super('handle_unavailable', details, 400, cause)
-  }
-
-  toJSON() {
-    return {
-      ...super.toJSON(),
-      reason: this.reason,
-    } as const
-  }
-}

package/src/errors/invalid-authorization-details-error.ts

@@ -1,27 +0,0 @@
-import { OAuthAuthorizationRequestParameters } from '@atproto/oauth-types'
-import { AuthorizationError } from './authorization-error.js'
-
-/**
- * @see
- * {@link https://datatracker.ietf.org/doc/html/rfc9396#section-14.6 | RFC 9396 - OAuth Dynamic Client Registration Metadata Registration Error}
- *
- * The AS MUST refuse to process any unknown authorization details type or
- * authorization details not conforming to the respective type definition. The
- * AS MUST abort processing and respond with an error
- * invalid_authorization_details to the client if any of the following are true
- * of the objects in the authorization_details structure:
- *  - contains an unknown authorization details type value,
- *  - is an object of known type but containing unknown fields,
- *  - contains fields of the wrong type for the authorization details type,
- *  - contains fields with invalid values for the authorization details type, or
- *  - is missing required fields for the authorization details type.
- */
-export class InvalidAuthorizationDetailsError extends AuthorizationError {
-  constructor(
-    parameters: OAuthAuthorizationRequestParameters,
-    error_description: string,
-    cause?: unknown,
-  ) {
-    super(parameters, error_description, 'invalid_authorization_details', cause)
-  }
-}

package/src/errors/invalid-client-error.ts

@@ -1,20 +0,0 @@
-import { OAuthError } from './oauth-error.js'
-
-/**
- * @see
- * {@link https://datatracker.ietf.org/doc/html/rfc6749#section-5.2 | RFC6749 - Issuing an Access Token }
- *
- * Client authentication failed (e.g., unknown client, no client authentication
- * included, or unsupported authentication method). The authorization server MAY
- * return an HTTP 401 (Unauthorized) status code to indicate which HTTP
- * authentication schemes are supported.  If the client attempted to
- * authenticate via the "Authorization" request header field, the authorization
- * server MUST respond with an HTTP 401 (Unauthorized) status code and include
- * the "WWW-Authenticate" response header field matching the authentication
- * scheme used by the client.
- */
-export class InvalidClientError extends OAuthError {
-  constructor(error_description: string, cause?: unknown) {
-    super('invalid_client', error_description, 400, cause)
-  }
-}

package/src/errors/invalid-client-id-error.ts

@@ -1,31 +0,0 @@
-import { OAuthError } from './oauth-error.js'
-
-/**
- * @see {@link https://datatracker.ietf.org/doc/html/rfc7591#section-3.2.2 | RFC7591 - Client Registration Error Response}
- *
- * The value of one of the client metadata fields is invalid and the server has
- * rejected this request.  Note that an authorization server MAY choose to
- * substitute a valid value for any requested parameter of a client's metadata.
- */
-export class InvalidClientIdError extends OAuthError {
-  constructor(error_description: string, cause?: unknown) {
-    super('invalid_client_id', error_description, 400, cause)
-  }
-
-  static from(
-    cause: unknown,
-    fallbackMessage = 'Invalid client identifier',
-  ): InvalidClientIdError {
-    if (cause instanceof InvalidClientIdError) {
-      return cause
-    }
-    if (cause instanceof TypeError) {
-      // This method is meant to be used in the context of parsing & validating
-      // a client client metadata. In that context, a TypeError would more
-      // likely represent a problem with the data (e.g. invalid URL constructor
-      // arg) and not a programming error.
-      return new InvalidClientIdError(cause.message, cause)
-    }
-    return new InvalidClientIdError(fallbackMessage, cause)
-  }
-}

package/src/errors/invalid-client-metadata-error.ts

@@ -1,68 +0,0 @@
-import { ZodError } from 'zod'
-import { FetchError } from '@atproto-labs/fetch'
-import { OAuthError } from './oauth-error.js'
-
-/**
- * @see {@link https://datatracker.ietf.org/doc/html/rfc7591#section-3.2.2 | RFC7591 - Client Registration Error Response}
- *
- * The value of one of the client metadata fields is invalid and the server has
- * rejected this request.  Note that an authorization server MAY choose to
- * substitute a valid value for any requested parameter of a client's metadata.
- */
-export class InvalidClientMetadataError extends OAuthError {
-  constructor(error_description: string, cause?: unknown) {
-    super('invalid_client_metadata', error_description, 400, cause)
-  }
-
-  static from(cause: unknown, message = 'Invalid client metadata'): OAuthError {
-    if (cause instanceof OAuthError) {
-      return cause
-    }
-
-    if (cause instanceof FetchError) {
-      throw new InvalidClientMetadataError(
-        cause.expose ? `${message}: ${cause.message}` : message,
-        cause,
-      )
-    }
-
-    if (cause instanceof ZodError) {
-      const causeMessage =
-        cause.issues
-          .map(
-            ({ path, message }) =>
-              `Validation${path.length ? ` of "${path.join('.')}"` : ''} failed with error: ${message}`,
-          )
-          .join(' ') || cause.message
-
-      throw new InvalidClientMetadataError(
-        causeMessage ? `${message}: ${causeMessage}` : message,
-        cause,
-      )
-    }
-
-    if (
-      cause instanceof Error &&
-      'code' in cause &&
-      cause.code === 'DEPTH_ZERO_SELF_SIGNED_CERT'
-    ) {
-      throw new InvalidClientMetadataError(
-        `${message}: Self-signed certificate`,
-        cause,
-      )
-    }
-
-    if (cause instanceof TypeError) {
-      // This method is meant to be used in the context of parsing & validating
-      // a client client metadata. In that context, a TypeError would more
-      // likely represent a problem with the data (e.g. invalid URL constructor
-      // arg) and not a programming error.
-      return new InvalidClientMetadataError(
-        `${message}: ${cause.message}`,
-        cause,
-      )
-    }
-
-    return new InvalidClientMetadataError(message, cause)
-  }
-}

package/src/errors/invalid-credentials-error.ts

@@ -1,29 +0,0 @@
-import { Did } from '@atproto/did'
-import { InvalidRequestError } from './invalid-request-error.js'
-
-/**
- * Thrown by {@link AccountStore.authenticateAccount} implementations to signal
- * that a sign-in attempt was rejected because the provided credentials did not
- * match a known account.
- *
- * Stores should populate {@link did}. when the identifier resolved to an
- * existing account but e.g. the password or OTP was incorrect. The
- * identifier-unknown case should leave {@link did} unset. This information is
- * surfaced to the `onSignInFailed` hook and never sent back to the client, so
- * populating it does not affect the client-visible response.
- *
- * Only the subject identifier (DID) is carried — not a full `Account` — to
- * avoid embedding PII (email, name, etc.) in an error that may be serialized
- * by loggers or monitoring tools walking the `.cause` chain. Hook consumers
- * that need richer profile info can resolve it from their own account store
- * using {@link did}.
- */
-export class InvalidCredentialsError extends InvalidRequestError {
-  constructor(
-    message = 'Invalid identifier or password',
-    public readonly did?: Did,
-    cause?: unknown,
-  ) {
-    super(message, cause)
-  }
-}

package/src/errors/invalid-dpop-key-binding-error.ts

@@ -1,21 +0,0 @@
-import { WWWAuthenticateError } from './www-authenticate-error.js'
-
-/**
- * @see
- * {@link https://datatracker.ietf.org/doc/html/rfc6750#section-3.1 | RFC6750 - The WWW-Authenticate Response Header Field}
- *
- * @see
- * {@link https://datatracker.ietf.org/doc/html/rfc9449#name-the-dpop-authentication-sch | RFC9449 - The DPoP Authentication Scheme}
- */
-export class InvalidDpopKeyBindingError extends WWWAuthenticateError {
-  constructor(cause?: unknown) {
-    const error = 'invalid_token'
-    const error_description = 'Invalid DPoP key binding'
-    super(
-      error,
-      error_description,
-      { DPoP: { error, error_description } },
-      cause,
-    )
-  }
-}

package/src/errors/invalid-dpop-proof-error.ts

@@ -1,13 +0,0 @@
-import { WWWAuthenticateError } from './www-authenticate-error.js'
-
-export class InvalidDpopProofError extends WWWAuthenticateError {
-  constructor(error_description: string, cause?: unknown) {
-    const error = 'invalid_dpop_proof'
-    super(
-      error,
-      error_description,
-      { DPoP: { error, error_description } },
-      cause,
-    )
-  }
-}

package/src/errors/invalid-grant-error.ts

@@ -1,21 +0,0 @@
-import { OAuthError } from './oauth-error.js'
-
-/**
- * @see
- * {@link https://datatracker.ietf.org/doc/html/rfc6749#section-5.2 | RFC6749 - Issuing an Access Token }
- *
- * The provided authorization grant (e.g., authorization code, resource owner
- * credentials) or refresh token is invalid, expired, revoked, does not match
- * the redirection URI used in the authorization request, or was issued to
- * another client.
- */
-export class InvalidGrantError extends OAuthError {
-  constructor(error_description: string, cause?: unknown) {
-    super('invalid_grant', error_description, 400, cause)
-  }
-
-  static from(err: unknown, error_description: string): InvalidGrantError {
-    if (err instanceof InvalidGrantError) return err
-    return new InvalidGrantError(error_description, err)
-  }
-}

package/src/errors/invalid-invite-code-error.ts

@@ -1,10 +0,0 @@
-import { InvalidRequestError } from './invalid-request-error.js'
-
-export class InvalidInviteCodeError extends InvalidRequestError {
-  constructor(details?: string, cause?: unknown) {
-    super(
-      'This invite code is invalid.' + (details ? ` ${details}` : ''),
-      cause,
-    )
-  }
-}

package/src/errors/invalid-redirect-uri-error.ts

@@ -1,17 +0,0 @@
-import { OAuthError } from './oauth-error.js'
-
-/**
- * @see {@link https://datatracker.ietf.org/doc/html/rfc7591#section-3.2.2 | RFC7591}
- *
- * The value of one or more redirection URIs is invalid.
- */
-export class InvalidRedirectUriError extends OAuthError {
-  constructor(error_description: string, cause?: unknown) {
-    super('invalid_redirect_uri', error_description, 400, cause)
-  }
-
-  static from(cause?: unknown): InvalidRedirectUriError {
-    if (cause instanceof InvalidRedirectUriError) return cause
-    return new InvalidRedirectUriError('Invalid redirect URI', cause)
-  }
-}