@atproto/oauth-provider 0.19.7 → 0.19.8

package/src/errors/invalid-request-error.ts

@@ -1,32 +0,0 @@
-import { OAuthError } from './oauth-error.js'
-
-/**
- * @see
- * {@link https://datatracker.ietf.org/doc/html/rfc6749#section-5.2 | RFC6749 - Issuing an Access Token}
- * : The request is missing a required parameter, includes an unsupported
- * parameter value (other than grant type), repeats a parameter, includes
- * multiple credentials, utilizes more than one mechanism for authenticating the
- * client, or is otherwise malformed.
- *
- * @see
- * {@link https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2.1 | RFC6749 - Authorization Code Grant, Authorization Request}
- * : The request is missing a required parameter, includes an invalid parameter
- * value, includes a parameter more than once, or is otherwise malformed.
- *
- * @see
- * {@link https://datatracker.ietf.org/doc/html/rfc6750#section-3.1 | RFC6750 - The WWW-Authenticate Response Header Field}
- * : The request is missing a required parameter, includes an unsupported
- * parameter or parameter value, repeats the same parameter, uses more than one
- * method for including an access token, or is otherwise malformed. The resource
- * server SHOULD respond with the HTTP 400 (Bad Request) status code.
- */
-export class InvalidRequestError extends OAuthError {
-  constructor(error_description: string, cause?: unknown) {
-    super('invalid_request', error_description, 400, cause)
-  }
-
-  static from(err: unknown, message = 'Invalid request data'): OAuthError {
-    if (err instanceof OAuthError) return err
-    return new InvalidRequestError(message, err)
-  }
-}

package/src/errors/invalid-scope-error.ts

@@ -1,15 +0,0 @@
-import { OAuthAuthorizationRequestParameters } from '@atproto/oauth-types'
-import { AuthorizationError } from './authorization-error.js'
-
-/**
- * @see {@link https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-11#section-4.1.2.1}
- */
-export class InvalidScopeError extends AuthorizationError {
-  constructor(
-    parameters: OAuthAuthorizationRequestParameters,
-    error_description: string,
-    cause?: unknown,
-  ) {
-    super(parameters, error_description, 'invalid_scope', cause)
-  }
-}

package/src/errors/invalid-token-error.ts

@@ -1,60 +0,0 @@
-import { errors } from 'jose'
-import { ZodError } from 'zod'
-import { JwtVerifyError } from '@atproto/jwk'
-import { OAuthError } from './oauth-error.js'
-import { WWWAuthenticateError } from './www-authenticate-error.js'
-
-const { JOSEError } = errors
-
-/**
- * @see
- * {@link https://datatracker.ietf.org/doc/html/rfc6750#section-3.1 | RFC6750 - The WWW-Authenticate Response Header Field }
- *
- * The access token provided is expired, revoked, malformed, or invalid for
- * other reasons.  The resource SHOULD respond with the HTTP 401 (Unauthorized)
- * status code.  The client MAY request a new access token and retry the
- * protected resource request.
- */
-export class InvalidTokenError extends WWWAuthenticateError {
-  static from(
-    err: unknown,
-    tokenType: string,
-    fallbackMessage = 'Invalid token',
-  ): InvalidTokenError {
-    if (err instanceof InvalidTokenError) {
-      return err
-    }
-
-    if (err instanceof OAuthError) {
-      return new InvalidTokenError(tokenType, err.error_description, err)
-    }
-
-    if (err instanceof JOSEError) {
-      return new InvalidTokenError(tokenType, err.message, err)
-    }
-
-    if (err instanceof JwtVerifyError) {
-      return new InvalidTokenError(tokenType, err.message, err)
-    }
-
-    if (err instanceof ZodError) {
-      return new InvalidTokenError(tokenType, err.message, err)
-    }
-
-    return new InvalidTokenError(tokenType, fallbackMessage, err)
-  }
-
-  constructor(
-    readonly tokenType: string,
-    error_description: string,
-    cause?: unknown,
-  ) {
-    const error = 'invalid_token'
-    super(
-      error,
-      error_description,
-      { [tokenType]: { error, error_description } },
-      cause,
-    )
-  }
-}

package/src/errors/login-required-error.ts

@@ -1,12 +0,0 @@
-import { OAuthAuthorizationRequestParameters } from '@atproto/oauth-types'
-import { AuthorizationError } from './authorization-error.js'
-
-export class LoginRequiredError extends AuthorizationError {
-  constructor(
-    parameters: OAuthAuthorizationRequestParameters,
-    error_description = 'Login is required',
-    cause?: unknown,
-  ) {
-    super(parameters, error_description, 'login_required', cause)
-  }
-}

package/src/errors/oauth-error.ts

@@ -1,28 +0,0 @@
-export class OAuthError extends Error {
-  public expose: boolean
-
-  constructor(
-    public readonly error: string,
-    public readonly error_description: string,
-    public readonly status = 400,
-    cause?: unknown,
-  ) {
-    super(error_description, { cause })
-
-    Error.captureStackTrace?.(this, this.constructor)
-
-    this.name = this.constructor.name
-    this.expose = status < 500
-  }
-
-  get statusCode() {
-    return this.status
-  }
-
-  toJSON() {
-    return {
-      error: this.error,
-      error_description: this.error_description,
-    }
-  }
-}

package/src/errors/second-authentication-factor-required-error.ts

@@ -1,25 +0,0 @@
-import { OAuthError } from './oauth-error.js'
-
-export class SecondAuthenticationFactorRequiredError extends OAuthError {
-  constructor(
-    public type: 'emailOtp',
-    public hint: string,
-    cause?: unknown,
-  ) {
-    const error = 'second_authentication_factor_required'
-    super(
-      error,
-      `${type} authentication factor required (hint: ${hint})`,
-      401,
-      cause,
-    )
-  }
-
-  toJSON() {
-    return {
-      ...super.toJSON(),
-      type: this.type,
-      hint: this.hint,
-    } as const
-  }
-}

package/src/errors/unauthorized-client-error.ts

@@ -1,20 +0,0 @@
-import { OAuthError } from './oauth-error.js'
-
-/**
- * @see
- * {@link https://datatracker.ietf.org/doc/html/rfc6749#section-5.2 | RFC6749 - Issuing an Access Token }
- *
- * The authenticated client is not authorized to use this authorization grant
- * type.
- *
- * @see
- * {@link https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2.1 | RFC6749 - Authorization Code Grant, Authorization Request}
- *
- * The client is not authorized to request an authorization code using this
- * method.
- */
-export class UnauthorizedClientError extends OAuthError {
-  constructor(error_description: string, cause?: unknown) {
-    super('unauthorized_client', error_description, 400, cause)
-  }
-}

package/src/errors/use-dpop-nonce-error.ts

@@ -1,32 +0,0 @@
-import { OAuthError } from './oauth-error.js'
-import { WWWAuthenticateError } from './www-authenticate-error.js'
-
-/**
- * @see
- * {@link https://datatracker.ietf.org/doc/html/rfc9449#section-8 | RFC9449 - Section 8. Authorization Server-Provided Nonce}
- */
-export class UseDpopNonceError extends OAuthError {
-  constructor(
-    error_description = 'Authorization server requires nonce in DPoP proof',
-    cause?: unknown,
-  ) {
-    super('use_dpop_nonce', error_description, 400, cause)
-  }
-
-  /**
-   * Convert this error into an error meant to be used as "Resource
-   * Server-Provided Nonce" error.
-   *
-   * @see
-   * {@link https://datatracker.ietf.org/doc/html/rfc9449#section-9 | RFC9449 - Section 9. Resource Server-Provided Nonce}
-   */
-  toWwwAuthenticateError(): WWWAuthenticateError {
-    const { error, error_description } = this
-    return new WWWAuthenticateError(
-      error,
-      error_description,
-      { DPoP: { error, error_description } },
-      this,
-    )
-  }
-}

package/src/errors/www-authenticate-error.ts

@@ -1,64 +0,0 @@
-import { VERIFY_ALGOS } from '../lib/util/crypto.js'
-import { OAuthError } from './oauth-error.js'
-
-export type WWWAuthenticateParams = Record<string, string | undefined>
-export type WWWAuthenticate = Record<string, undefined | WWWAuthenticateParams>
-
-export class WWWAuthenticateError extends OAuthError {
-  public readonly wwwAuthenticate: WWWAuthenticate
-
-  constructor(
-    error: string,
-    error_description: string,
-    wwwAuthenticate: WWWAuthenticate,
-    cause?: unknown,
-  ) {
-    super(error, error_description, 401, cause)
-
-    this.wwwAuthenticate =
-      wwwAuthenticate['DPoP'] != null
-        ? {
-            ...wwwAuthenticate,
-            DPoP: { algs: VERIFY_ALGOS.join(' '), ...wwwAuthenticate['DPoP'] },
-          }
-        : wwwAuthenticate
-  }
-
-  get wwwAuthenticateHeader() {
-    return formatWWWAuthenticateHeader(this.wwwAuthenticate)
-  }
-}
-
-function formatWWWAuthenticateHeader(wwwAuthenticate: WWWAuthenticate): string {
-  return Object.entries(wwwAuthenticate)
-    .filter(isWWWAuthenticateEntry)
-    .map(wwwAuthenticateEntryToString)
-    .join(', ')
-}
-
-type WWWAuthenticateEntry = [type: string, params: WWWAuthenticateParams]
-function isWWWAuthenticateEntry(
-  entry: [string, unknown],
-): entry is WWWAuthenticateEntry {
-  const [, value] = entry
-  return value != null && typeof value === 'object'
-}
-
-function wwwAuthenticateEntryToString([type, params]: WWWAuthenticateEntry) {
-  const paramsEnc = Object.entries(params)
-    .filter(isParamEntry)
-    .map(paramEntryToString)
-
-  return paramsEnc.length ? `${type} ${paramsEnc.join(', ')}` : type
-}
-
-type ParamEntry = [name: string, value: string]
-
-function isParamEntry(entry: [string, unknown]): entry is ParamEntry {
-  const [, value] = entry
-  return typeof value === 'string' && value !== '' && !value.includes('"')
-}
-
-function paramEntryToString([name, value]: ParamEntry): string {
-  return `${name}="${value}"`
-}

package/src/index.ts

@@ -1,16 +0,0 @@
-// Avoid having to explicitly depend sub dependencies
-export * from '@atproto-labs/fetch'
-export * from '@atproto-labs/fetch-node'
-export * from '@atproto/jwk'
-export * from '@atproto/jwk-jose'
-export * from '@atproto/oauth-types'
-
-export * from './constants.js'
-export * from './oauth-client.js'
-export * from './oauth-dpop.js'
-export * from './oauth-errors.js'
-export * from './oauth-hooks.js'
-export * from './oauth-middleware.js'
-export * from './oauth-provider.js'
-export * from './oauth-store.js'
-export * from './oauth-verifier.js'

package/src/lexicon/lexicon-data.ts

@@ -1,11 +0,0 @@
-import { LexiconDocument } from '@atproto/lex-document'
-
-export type { LexiconDocument }
-
-export type LexiconData = {
-  createdAt: Date
-  updatedAt: Date
-  lastSucceededAt: null | Date
-  uri: null | string
-  lexicon: null | LexiconDocument
-}

package/src/lexicon/lexicon-getter.ts

@@ -1,55 +0,0 @@
-import { LexResolver, LexResolverError } from '@atproto/lex-resolver'
-import { Nsid } from '@atproto/oauth-scopes'
-import { CachedGetter } from '@atproto-labs/simple-store'
-import { LEXICON_REFRESH_FREQUENCY } from '../constants.js'
-import { LexiconData, LexiconStore } from './lexicon-store.js'
-
-/**
- * This utility class handles the retrieval and caching of lexicon
- * data. In particular, it handles failed retrieval attempts by returning cached
- * data.
- *
- * @private
- */
-export class LexiconGetter extends CachedGetter<Nsid, LexiconData> {
-  constructor(store: LexiconStore, lexResolver: LexResolver) {
-    super(
-      async (input, options, storedData) => {
-        const now = new Date()
-        const result = await lexResolver.get(input, options).catch((err) => {
-          // We swallow LexiconResolutionError errors, returning potentially
-          // "null" values here to avoid hammering the resolver with requests
-          // for the same lexicon that is known to be unavailable. The getter
-          // should be called again based on the isStale() function below.
-          if (err instanceof LexResolverError) return undefined
-
-          // Unexpected error are propagated
-          throw err
-        })
-
-        return {
-          // Keep original createdAt, if available
-          createdAt: storedData?.createdAt ?? now,
-          // Always update updatedAt
-          updatedAt: now,
-          // Update the data with fresh data, if available, or keep cached
-          // values (if any) otherwise.
-          lastSucceededAt: result ? now : storedData?.lastSucceededAt ?? null,
-          uri: result ? result.uri.toString() : storedData?.uri ?? null,
-          lexicon: result ? result.lexicon : storedData?.lexicon ?? null,
-        }
-      },
-      {
-        set: async (nsid, data) => store.storeLexicon(nsid, data),
-        get: async (nsid) => (await store.findLexicon(nsid)) ?? undefined,
-        del: async (nsid) => store.deleteLexicon(nsid),
-      },
-      {
-        isStale: (nsid, data) => {
-          const timeSinceLastUpdate = Date.now() - data.updatedAt.getTime()
-          return timeSinceLastUpdate >= LEXICON_REFRESH_FREQUENCY
-        },
-      },
-    )
-  }
-}

package/src/lexicon/lexicon-manager.ts

@@ -1,116 +0,0 @@
-import { LexiconPermissionSet } from '@atproto/lex-document'
-import { LexResolver, LexResolverError } from '@atproto/lex-resolver'
-import { IncludeScope, Nsid } from '@atproto/oauth-scopes'
-import { LexiconGetter } from './lexicon-getter.js'
-import { LexiconStore } from './lexicon-store.js'
-
-export * from './lexicon-store.js'
-
-export class LexiconManager {
-  protected readonly lexiconGetter: LexiconGetter
-
-  constructor(store: LexiconStore, lexResolver: LexResolver) {
-    this.lexiconGetter = new LexiconGetter(store, lexResolver)
-  }
-
-  public async getPermissionSetsFromScope(scope?: string) {
-    const { includeScopes } = parseScope(scope)
-    return this.extractPermissionSets(includeScopes)
-  }
-
-  /**
-   * Transforms a scope string from an authorization request into a scope
-   * composed solely of granular permission scopes, transforming any NSID
-   * into its corresponding permission scopes.
-   */
-  public async buildTokenScope(scope: string): Promise<string> {
-    const { includeScopes, otherScopes } = parseScope(scope)
-
-    // If the scope does not contain any "include:<nsid>" scopes, return it as-is.
-    if (!includeScopes.length) return scope
-
-    const permissionSets = await this.extractPermissionSets(includeScopes)
-
-    return Array.from(includeScopes)
-      .flatMap(nsidToPermissionScopes, permissionSets)
-      .concat(otherScopes)
-      .join(' ')
-  }
-
-  /**
-   * Given a list of scope values, extract those that are NSIDs and return their
-   * corresponding permission sets.
-   */
-  protected async extractPermissionSets(includeScopes: IncludeScope[]) {
-    const nsids = extractNsids(includeScopes)
-    return this.getPermissionSets(nsids)
-  }
-
-  protected async getPermissionSets(nsids: Set<Nsid>) {
-    return new Map<string, LexiconPermissionSet>(
-      await Promise.all(Array.from(nsids, this.getPermissionSetEntry, this)),
-    )
-  }
-
-  protected async getPermissionSetEntry(
-    nsid: Nsid,
-  ): Promise<[nsid: Nsid, permissionSet: LexiconPermissionSet]> {
-    const permissionSet = await this.getPermissionSet(nsid)
-    return [nsid, permissionSet]
-  }
-
-  protected async getPermissionSet(nsid: Nsid): Promise<LexiconPermissionSet> {
-    const { lexicon } = await this.lexiconGetter.get(nsid)
-
-    if (!lexicon) {
-      throw LexResolverError.from(nsid)
-    }
-
-    if (lexicon.defs.main?.type !== 'permission-set') {
-      const description = 'Lexicon document is not a permission set'
-      throw LexResolverError.from(nsid, description)
-    }
-
-    return lexicon.defs.main
-  }
-}
-
-function parseScope(scope?: string) {
-  const includeScopes: IncludeScope[] = []
-  const otherScopes: string[] = []
-
-  if (scope) {
-    for (const scopeValue of scope.split(' ')) {
-      const parsed = IncludeScope.fromString(scopeValue)
-      if (parsed) {
-        includeScopes.push(parsed)
-      } else {
-        otherScopes.push(scopeValue)
-      }
-    }
-  }
-
-  return {
-    includeScopes,
-    otherScopes,
-  }
-}
-
-function extractNsids(includeScopes: IncludeScope[]): Set<Nsid> {
-  return new Set(Array.from(includeScopes, extractNsid))
-}
-
-function extractNsid(nsidScope: IncludeScope): Nsid {
-  return nsidScope.nsid
-}
-
-export function nsidToPermissionScopes(
-  this: Map<string, LexiconPermissionSet>,
-  includeScope: IncludeScope,
-): string[] {
-  const permissionSet = this.get(includeScope.nsid)
-  if (permissionSet) return includeScope.toScopes(permissionSet)
-
-  // Should never happen (mostly there for type safety & future proofing)
-  throw new Error(`Missing permission set for NSID: ${includeScope.nsid}`)
-}

package/src/lexicon/lexicon-store.ts

@@ -1,35 +0,0 @@
-import { Awaitable, buildInterfaceChecker } from '../lib/util/type.js'
-import { LexiconData, LexiconDocument } from './lexicon-data.js'
-
-export type { Awaitable, LexiconData, LexiconDocument }
-
-export interface LexiconStore {
-  findLexicon(nsid: string): Awaitable<LexiconData | null>
-  storeLexicon(nsid: string, data: LexiconData): Awaitable<void>
-  deleteLexicon(nsid: string): Awaitable<void>
-}
-
-export const isLexiconStore = buildInterfaceChecker<LexiconStore>([
-  'deleteLexicon',
-  'findLexicon',
-  'storeLexicon',
-])
-
-export function ifLexiconStore<V extends Partial<LexiconStore>>(
-  implementation?: V,
-): (V & LexiconStore) | undefined {
-  if (implementation && isLexiconStore(implementation)) {
-    return implementation
-  }
-
-  return undefined
-}
-
-export function asLexiconStore<V extends Partial<LexiconStore>>(
-  implementation?: V,
-): V & LexiconStore {
-  const store = ifLexiconStore(implementation)
-  if (store) return store
-
-  throw new Error('Invalid LexiconStore implementation')
-}

package/src/lib/csp/index.ts

@@ -1,101 +0,0 @@
-import { CombinedTuple, Simplify } from '../util/type.js'
-
-export type CspValue =
-  | `data:`
-  | `http:${string}`
-  | `https:${string}`
-  | `'none'`
-  | `'self'`
-  | `'sha256-${string}'`
-  | `'nonce-${string}'`
-  | `'unsafe-inline'`
-  | `'unsafe-eval'`
-  | `'strict-dynamic'`
-  | `'report-sample'`
-  | `'unsafe-hashes'`
-
-const STRING_DIRECTIVES = ['base-uri'] as const
-const BOOLEAN_DIRECTIVES = [
-  'upgrade-insecure-requests',
-  'block-all-mixed-content',
-] as const
-const ARRAY_DIRECTIVES = [
-  'connect-src',
-  'default-src',
-  'form-action',
-  'frame-ancestors',
-  'frame-src',
-  'img-src',
-  'script-src',
-  'style-src',
-] as const
-
-export type CspConfig = Simplify<
-  {
-    [K in (typeof BOOLEAN_DIRECTIVES)[number]]?: boolean
-  } & {
-    [K in (typeof STRING_DIRECTIVES)[number]]?: CspValue
-  } & {
-    [K in (typeof ARRAY_DIRECTIVES)[number]]?: Iterable<CspValue>
-  }
->
-
-const NONE = "'none'"
-
-export function buildCsp(config: CspConfig): string {
-  const values: string[] = []
-
-  for (const name of BOOLEAN_DIRECTIVES) {
-    if (config[name] === true) values.push(name)
-  }
-
-  for (const name of STRING_DIRECTIVES) {
-    if (config[name]) values.push(`${name} ${config[name]}`)
-  }
-
-  for (const name of ARRAY_DIRECTIVES) {
-    // Remove duplicate values by using a Set
-    const val = config[name] ? new Set(config[name]) : undefined
-    if (val?.size) values.push(`${name} ${Array.from(val).join(' ')}`)
-  }
-
-  return values.join('; ')
-}
-
-export function mergeCsp<C extends (CspConfig | null | undefined)[]>(
-  ...configs: C
-) {
-  return configs.filter((v) => v != null).reduce(combineCsp) as CombinedTuple<C>
-}
-
-export function combineCsp(a: CspConfig, b: CspConfig): CspConfig {
-  const result: CspConfig = {}
-
-  for (const name of BOOLEAN_DIRECTIVES) {
-    // @NOTE b (if defined) takes precedence
-    const value = b[name] ?? a[name]
-    if (value != null) result[name] = value
-  }
-
-  for (const name of STRING_DIRECTIVES) {
-    if (a[name] || b[name]) {
-      const aNotNone = a[name] === NONE ? undefined : a[name]
-      const bNotNone = b[name] === NONE ? undefined : b[name]
-      // @NOTE b takes precedence
-      result[name] = bNotNone || aNotNone || NONE
-    }
-  }
-
-  for (const name of ARRAY_DIRECTIVES) {
-    if (a[name] && b[name]) {
-      const set = new Set(a[name])
-      if (b[name]) for (const value of b[name]) set.add(value)
-      if (set.size > 1 && set.has(NONE)) set.delete(NONE)
-      result[name] = [...set]
-    } else if (a[name] || b[name]) {
-      result[name] = a[name] || b[name]
-    }
-  }
-
-  return result
-}