@atproto/oauth-provider 0.3.1 → 0.5.0

package/dist/oauth-provider.js

@@ -4,7 +4,6 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OAuthProvider = exports.Keyset = void 0;
-const accept_1 = require("@hapi/accept");
 const http_errors_1 = __importDefault(require("http-errors"));
 const zod_1 = require("zod");
 const jwk_1 = require("@atproto/jwk");
@@ -15,9 +14,10 @@ const simple_store_memory_1 = require("@atproto-labs/simple-store-memory");
 const access_token_type_js_1 = require("./access-token/access-token-type.js");
 const account_manager_js_1 = require("./account/account-manager.js");
 const account_store_js_1 = require("./account/account-store.js");
+const sign_in_data_js_1 = require("./account/sign-in-data.js");
+const sign_up_data_js_1 = require("./account/sign-up-data.js");
 const assets_middleware_js_1 = require("./assets/assets-middleware.js");
 const client_auth_js_1 = require("./client/client-auth.js");
-const client_id_js_1 = require("./client/client-id.js");
 const client_manager_js_1 = require("./client/client-manager.js");
 const client_store_js_1 = require("./client/client-store.js");
 const constants_js_1 = require("./constants.js");
@@ -31,13 +31,14 @@ const invalid_grant_error_js_1 = require("./errors/invalid-grant-error.js");
 const invalid_parameters_error_js_1 = require("./errors/invalid-parameters-error.js");
 const invalid_request_error_js_1 = require("./errors/invalid-request-error.js");
 const login_required_error_js_1 = require("./errors/login-required-error.js");
-const oauth_error_js_1 = require("./errors/oauth-error.js");
 const unauthorized_client_error_js_1 = require("./errors/unauthorized-client-error.js");
 const www_authenticate_error_js_1 = require("./errors/www-authenticate-error.js");
 const index_js_1 = require("./lib/http/index.js");
+const request_js_1 = require("./lib/http/request.js");
 const date_js_1 = require("./lib/util/date.js");
 const build_metadata_js_1 = require("./metadata/build-metadata.js");
 const oauth_verifier_js_1 = require("./oauth-verifier.js");
+const build_customization_data_js_1 = require("./output/build-customization-data.js");
 const build_error_payload_js_1 = require("./output/build-error-payload.js");
 const output_manager_js_1 = require("./output/output-manager.js");
 const send_authorize_redirect_js_1 = require("./output/send-authorize-redirect.js");
@@ -53,14 +54,14 @@ const token_manager_js_1 = require("./token/token-manager.js");
 const token_store_js_1 = require("./token/token-store.js");
 class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
     metadata;
-    customization;
     authenticationMaxAge;
     accountManager;
-    deviceStore;
+    deviceManager;
     clientManager;
     requestManager;
     tokenManager;
-    constructor({ metadata, customization = undefined, authenticationMaxAge = constants_js_1.AUTHENTICATION_MAX_AGE, tokenMaxAge = constants_js_1.TOKEN_MAX_AGE, safeFetch = (0, fetch_node_1.safeFetchWrap)(), redis, store, // compound store implementation
+    outputManager;
+    constructor({ metadata, authenticationMaxAge = constants_js_1.AUTHENTICATION_MAX_AGE, tokenMaxAge = constants_js_1.TOKEN_MAX_AGE, safeFetch = (0, fetch_node_1.safeFetchWrap)(), redis, store, // compound store implementation
     // Requires stores
     accountStore = (0, account_store_js_1.asAccountStore)(store), deviceStore = (0, device_store_js_1.asDeviceStore)(store), tokenStore = (0, token_store_js_1.asTokenStore)(store), 
     // These are optional
@@ -71,20 +72,36 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
         maxSize: 50_000_000,
         ttl: 600e3,
     }), loopbackMetadata = oauth_types_1.atprotoLoopbackClientMetadata, 
-    // OAuthHooks & OAuthVerifierOptions
+    // OAuthHooks &
+    // OAuthVerifierOptions &
+    // DeviceManagerOptions &
+    // Customization
     ...rest }) {
-        super({ replayStore, redis, ...rest });
+        const customization = build_customization_data_js_1.customizationSchema.parse(rest);
+        const deviceManagerOptions = device_manager_js_1.deviceManagerOptionsSchema.parse(rest);
+        // @NOTE: hooks don't really need a type parser, as all zod can actually
+        // check at runtime is the fact that the values are functions. The only way
+        // we would benefit from zod here would be to wrap the functions with a
+        // validator for the provided function's return types, which we do not add
+        // because it would impact runtime performance and we trust the users of
+        // this lib (basically ourselves) to rely on the typing system to ensure the
+        // correct types are returned.
+        const hooks = rest;
+        // @NOTE: validation of super params (if we wanted to implement it) should
+        // be the responsibility of the super class.
+        const superOptions = rest;
+        super({ replayStore, redis, ...superOptions });
         requestStore ??= redis
             ? new request_store_redis_js_1.RequestStoreRedis({ redis })
             : new request_store_memory_js_1.RequestStoreMemory();
         this.authenticationMaxAge = authenticationMaxAge;
         this.metadata = (0, build_metadata_js_1.buildMetadata)(this.issuer, this.keyset, metadata);
-        this.customization = customization;
-        this.deviceStore = deviceStore;
-        this.accountManager = new account_manager_js_1.AccountManager(accountStore);
-        this.clientManager = new client_manager_js_1.ClientManager(this.metadata, this.keyset, rest, clientStore || null, loopbackMetadata || null, safeFetch, clientJwksCache, clientMetadataCache);
-        this.requestManager = new request_manager_js_1.RequestManager(requestStore, this.signer, this.metadata, rest);
-        this.tokenManager = new token_manager_js_1.TokenManager(tokenStore, this.signer, rest, this.accessTokenType, tokenMaxAge);
+        this.deviceManager = new device_manager_js_1.DeviceManager(deviceStore, deviceManagerOptions);
+        this.outputManager = new output_manager_js_1.OutputManager(customization);
+        this.accountManager = new account_manager_js_1.AccountManager(this.issuer, accountStore, hooks, customization);
+        this.clientManager = new client_manager_js_1.ClientManager(this.metadata, this.keyset, hooks, clientStore || null, loopbackMetadata || null, safeFetch, clientJwksCache, clientMetadataCache);
+        this.requestManager = new request_manager_js_1.RequestManager(requestStore, this.signer, this.metadata, hooks);
+        this.tokenManager = new token_manager_js_1.TokenManager(tokenStore, this.signer, hooks, this.accessTokenType, tokenMaxAge);
     }
     get jwks() {
         return this.keyset.publicJwks;
@@ -170,8 +187,7 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
             // https://datatracker.ietf.org/doc/html/rfc9126#section-2.3-1
             // > Since initial processing of the pushed authorization request does not
             // > involve resource owner interaction, error codes related to user
-            // > interaction, such as consent_required defined by [OIDC], are never
-            // > returned.
+            // > interaction, such as "access_denied", are never returned.
             if (err instanceof access_denied_error_js_1.AccessDeniedError) {
                 throw new invalid_request_error_js_1.InvalidRequestError(err.error_description, err);
             }
@@ -183,7 +199,7 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
             const requestUri = await request_uri_js_1.requestUriSchema
                 .parseAsync(query.request_uri, { path: ['query', 'request_uri'] })
                 .catch(throwInvalidRequest);
-            return this.requestManager.get(requestUri, client.id, deviceId);
+            return this.requestManager.get(requestUri, deviceId, client.id);
         }
         if ('request' in query) {
             const requestObject = await this.decodeJAR(client, query);
@@ -202,9 +218,9 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
         }
         return this.requestManager.createAuthorizationRequest(client, { method: 'none' }, query, deviceId, null);
     }
-    async deleteRequest(uri, parameters) {
+    async deleteRequest(requestUri, parameters) {
         try {
-            await this.requestManager.delete(uri);
+            await this.requestManager.delete(requestUri);
         }
         catch (err) {
             throw access_denied_error_js_1.AccessDeniedError.from(parameters, err);
@@ -310,12 +326,21 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
             matchesHint: hint == null || matchesHint(account),
         }));
     }
-    async signIn(deviceId, uri, clientId, credentials) {
+    async signUp({ requestUri, deviceId, deviceMetadata }, data) {
+        const { clientId } = await this.requestManager.get(requestUri, deviceId);
         const client = await this.clientManager.getClient(clientId);
+        const { account } = await this.accountManager.signUp(data, deviceId, deviceMetadata);
+        return {
+            account,
+            consentRequired: !client.info.isFirstParty,
+        };
+    }
+    async signIn({ requestUri, deviceId, deviceMetadata }, data) {
         // Ensure the request is still valid (and update the request expiration)
         // @TODO use the returned scopes to determine if consent is required
-        await this.requestManager.get(uri, clientId, deviceId);
-        const { account, info } = await this.accountManager.signIn(credentials, deviceId);
+        const { clientId } = await this.requestManager.get(requestUri, deviceId);
+        const client = await this.clientManager.getClient(clientId);
+        const { account, info } = await this.accountManager.signIn(data, deviceId, deviceMetadata);
         return {
             account,
             consentRequired: client.info.isFirstParty
@@ -326,28 +351,30 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
                     !info.authorizedClients.includes(client.id),
         };
     }
-    async acceptRequest(uri, clientId, sub, deviceId, deviceMetadata) {
+    async acceptRequest({ requestUri, deviceId, deviceMetadata }, sub) {
         const { issuer } = this;
+        const { parameters, clientId, clientAuth } = await this.requestManager.get(requestUri, deviceId);
         const client = await this.clientManager.getClient(clientId);
-        const { parameters, clientAuth } = await this.requestManager.get(uri, clientId, deviceId);
         try {
+            // @TODO Currently, a user can "accept" a request for any did that sing-in
+            // on the device, even if "remember" was set to false.
             const { account, info } = await this.accountManager.get(deviceId, sub);
             // The user is trying to authorize without a fresh login
             if (this.loginRequired(client, parameters, info)) {
                 throw new login_required_error_js_1.LoginRequiredError(parameters, 'Account authentication required.');
             }
-            const code = await this.requestManager.setAuthorized(uri, client, account, deviceId, deviceMetadata);
+            const code = await this.requestManager.setAuthorized(requestUri, client, account, deviceId, deviceMetadata);
             await this.accountManager.addAuthorizedClient(deviceId, account, client, clientAuth);
             return { issuer, parameters, redirect: { code } };
         }
         catch (err) {
-            await this.deleteRequest(uri, parameters);
+            await this.deleteRequest(requestUri, parameters);
             throw access_denied_error_js_1.AccessDeniedError.from(parameters, err);
         }
     }
-    async rejectRequest(deviceId, uri, clientId) {
-        const { parameters } = await this.requestManager.get(uri, clientId, deviceId);
-        await this.deleteRequest(uri, parameters);
+    async rejectRequest({ requestUri, deviceId, }) {
+        const { parameters } = await this.requestManager.get(requestUri, deviceId);
+        await this.deleteRequest(requestUri, parameters);
         return {
             issuer: this.issuer,
             parameters: parameters,
@@ -478,52 +505,60 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
         return router.buildHandler();
     }
     buildRouter(options) {
-        const deviceManager = new device_manager_js_1.DeviceManager(this.deviceStore, options);
-        const outputManager = new output_manager_js_1.OutputManager(this.customization);
         // eslint-disable-next-line @typescript-eslint/no-this-alias
         const server = this;
         const issuerUrl = new URL(server.issuer);
         const issuerOrigin = issuerUrl.origin;
         const router = new index_js_1.Router(issuerUrl);
         // Utils
-        const csrfCookie = (uri) => `csrf-${uri}`;
+        const csrfCookie = (requestUri) => `csrf-${requestUri}`;
         const onError = options?.onError ??
             (process.env['NODE_ENV'] === 'development'
-                ? (req, res, err, msg) => console.error(`OAuthProvider error (${msg}):`, err)
-                : undefined);
-        /**
-         * Creates a middleware that will serve static JSON content.
-         */
-        const staticJson = (json) => (0, index_js_1.combineMiddlewares)([
-            function (req, res, next) {
-                res.setHeader('Access-Control-Allow-Origin', '*');
-                res.setHeader('Access-Control-Allow-Headers', '*');
-                res.setHeader('Cache-Control', 'max-age=300');
-                next();
+                ? (req, res, err, msg) => {
+                    console.error(`OAuthProvider error (${msg}):`, err);
+                }
+                : null);
+        // CORS preflight
+        const corsHeaders = function (req, res, next) {
+            res.setHeader('Access-Control-Max-Age', '86400'); // 1 day
+            // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin
+            //
+            // > For requests without credentials, the literal value "*" can be
+            // > specified as a wildcard; the value tells browsers to allow
+            // > requesting code from any origin to access the resource.
+            // > Attempting to use the wildcard with credentials results in an
+            // > error.
+            //
+            // A "*" is safer to use than reflecting the request origin.
+            res.setHeader('Access-Control-Allow-Origin', '*');
+            // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Methods
+            // > The value "*" only counts as a special wildcard value for
+            // > requests without credentials (requests without HTTP cookies or
+            // > HTTP authentication information). In requests with credentials,
+            // > it is treated as the literal method name "*" without special
+            // > semantics.
+            res.setHeader('Access-Control-Allow-Methods', '*');
+            res.setHeader('Access-Control-Allow-Headers', 'Content-Type,DPoP');
+            next();
+        };
+        const corsPreflight = (0, index_js_1.combineMiddlewares)([
+            corsHeaders,
+            (req, res) => {
+                res.writeHead(200).end();
             },
-            (0, index_js_1.staticJsonMiddleware)(json),
         ]);
         /**
          * Wrap an OAuth endpoint in a middleware that will set the appropriate
          * response headers and format the response as JSON.
          */
         const jsonHandler = (buildJson, status) => async function (req, res) {
-            res.setHeader('Access-Control-Allow-Origin', '*');
-            res.setHeader('Access-Control-Allow-Headers', '*');
-            // https://www.rfc-editor.org/rfc/rfc6749.html#section-5.1
-            res.setHeader('Cache-Control', 'no-store');
-            res.setHeader('Pragma', 'no-cache');
-            // https://datatracker.ietf.org/doc/html/rfc9449#section-8.2
-            const dpopNonce = server.nextDpopNonce();
-            if (dpopNonce) {
-                const name = 'DPoP-Nonce';
-                res.setHeader(name, dpopNonce);
-                res.appendHeader('Access-Control-Expose-Headers', name);
-            }
             try {
+                // https://www.rfc-editor.org/rfc/rfc6749.html#section-5.1
+                res.setHeader('Cache-Control', 'no-store');
+                res.setHeader('Pragma', 'no-cache');
                 // Ensure we can agree on a content encoding & type before starting to
                 // build the JSON response.
-                if (!(0, accept_1.mediaType)(req.headers['accept'], ['application/json'])) {
+                if (!(0, request_js_1.negotiateResponseContent)(req, ['application/json'])) {
                     throw (0, http_errors_1.default)(406, 'Unsupported media type');
                 }
                 const result = await buildJson.call(this, req, res);
@@ -535,12 +570,8 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
                 }
             }
             catch (err) {
+                onError?.(req, res, err, 'OAuth request error');
                 if (!res.headersSent) {
-                    if (err instanceof www_authenticate_error_js_1.WWWAuthenticateError) {
-                        const name = 'WWW-Authenticate';
-                        res.setHeader(name, err.wwwAuthenticateHeader);
-                        res.appendHeader('Access-Control-Expose-Headers', name);
-                    }
                     const payload = (0, build_error_payload_js_1.buildErrorPayload)(err);
                     const status = (0, build_error_payload_js_1.buildErrorStatus)(err);
                     (0, index_js_1.writeJson)(res, payload, { status });
@@ -548,19 +579,52 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
                 else {
                     res.destroy();
                 }
-                // OAuthError are used to build expected responses, so we don't log
-                // them as errors.
-                if (!(err instanceof oauth_error_js_1.OAuthError) || err.statusCode >= 500) {
-                    onError?.(req, res, err, 'Unexpected error');
-                }
             }
         };
+        const oauthHandler = (buildOAuthResponse, status) => (0, index_js_1.combineMiddlewares)([
+            corsHeaders,
+            jsonHandler(async function (req, res) {
+                try {
+                    // https://datatracker.ietf.org/doc/html/rfc9449#section-8.2
+                    const dpopNonce = server.nextDpopNonce();
+                    if (dpopNonce) {
+                        const name = 'DPoP-Nonce';
+                        res.setHeader(name, dpopNonce);
+                        res.appendHeader('Access-Control-Expose-Headers', name);
+                    }
+                    return await buildOAuthResponse.call(this, req, res);
+                }
+                catch (err) {
+                    if (!res.headersSent && err instanceof www_authenticate_error_js_1.WWWAuthenticateError) {
+                        const name = 'WWW-Authenticate';
+                        res.setHeader(name, err.wwwAuthenticateHeader);
+                        res.appendHeader('Access-Control-Expose-Headers', name);
+                    }
+                    throw err;
+                }
+            }, status),
+        ]);
+        const apiHandler = (inputSchema, buildJson, status) => jsonHandler(async function (req, res) {
+            (0, index_js_1.validateFetchMode)(req, res, ['same-origin']);
+            (0, index_js_1.validateFetchSite)(req, res, ['same-origin']);
+            (0, index_js_1.validateSameOrigin)(req, res, issuerOrigin);
+            const referer = (0, index_js_1.validateReferer)(req, res, {
+                origin: issuerOrigin,
+                pathname: '/oauth/authorize',
+            });
+            const requestUri = await request_uri_js_1.requestUriSchema.parseAsync(referer.searchParams.get('request_uri'), { path: ['query', 'request_uri'] });
+            (0, index_js_1.validateCsrfToken)(req, res, req.headers['x-csrf-token'], csrfCookie(requestUri));
+            const { deviceId, deviceMetadata } = await server.deviceManager.load(req, res);
+            const payload = await (0, index_js_1.parseHttpRequest)(req, ['json']);
+            const input = await inputSchema.parseAsync(payload, { path: ['body'] });
+            const context = { requestUri, deviceId, deviceMetadata };
+            return buildJson.call(this, req, res, input, context);
+        }, status);
         const navigationHandler = (handler) => async function (req, res) {
-            res.setHeader('Access-Control-Allow-Origin', '*');
-            res.setHeader('Access-Control-Allow-Headers', '*');
-            res.setHeader('Cache-Control', 'no-store');
-            res.setHeader('Pragma', 'no-cache');
             try {
+                res.setHeader('Cache-Control', 'no-store');
+                res.setHeader('Pragma', 'no-cache');
+                res.setHeader('Referrer-Policy', 'same-origin');
                 (0, index_js_1.validateFetchMode)(req, res, ['navigate']);
                 (0, index_js_1.validateFetchDest)(req, res, ['document']);
                 (0, index_js_1.validateSameOrigin)(req, res, issuerOrigin);
@@ -569,10 +633,42 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
             catch (err) {
                 onError?.(req, res, err, `Failed to handle navigation request to "${req.url}"`);
                 if (!res.headersSent) {
-                    await outputManager.sendErrorPage(res, err);
+                    await server.outputManager.sendErrorPage(res, err, {
+                        preferredLocales: (0, request_js_1.extractLocales)(req),
+                    });
                 }
             }
         };
+        // Simple GET requests fall under the category of "no-cors" request, meaning
+        // that the browser will allow any cross-origin request, with credentials,
+        // to be sent to the oauth server. The OAuth Server will, however:
+        // 1) validate the request origin (see navigationHandler),
+        // 2) validate the CSRF token,
+        // 3) validate the referer,
+        // 4) validate the sec-fetch-site header,
+        // 4) validate the sec-fetch-mode header (see navigationHandler),
+        // 5) validate the sec-fetch-dest header (see navigationHandler).
+        // And will error (refuse to serve the request) if any of these checks fail.
+        const sameOriginNavigationHandler = (handler) => navigationHandler(async function (req, res) {
+            (0, index_js_1.validateFetchSite)(req, res, ['same-origin']);
+            const deviceInfo = await server.deviceManager.load(req, res);
+            return handler.call(this, req, res, deviceInfo);
+        });
+        const authorizeRedirectNavigationHandler = (handler) => sameOriginNavigationHandler(async function (req, res, deviceInfo) {
+            const referer = (0, index_js_1.validateReferer)(req, res, {
+                origin: issuerOrigin,
+                pathname: '/oauth/authorize',
+            });
+            const requestUri = await request_uri_js_1.requestUriSchema.parseAsync(referer.searchParams.get('request_uri'));
+            const csrfToken = this.url.searchParams.get('csrf_token');
+            const csrfCookieName = csrfCookie(requestUri);
+            // Next line will "clear" the CSRF token cookie, preventing replay of
+            // this request (navigating "back" will result in an error).
+            (0, index_js_1.validateCsrfToken)(req, res, csrfToken, csrfCookieName, true);
+            const context = { ...deviceInfo, requestUri };
+            const redirect = await handler.call(this, req, res, context);
+            return (0, send_authorize_redirect_js_1.sendAuthorizeRedirect)(res, redirect);
+        });
         /**
          * Provides a better UX when a request is denied by redirecting to the
          * client with the error details. This will also log any error that caused
@@ -592,36 +688,12 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
             throw err;
         };
         //- Public OAuth endpoints
-        router.get('/.well-known/oauth-authorization-server', staticJson(server.metadata));
-        // CORS preflight
-        const corsPreflight = function (req, res, _next) {
-            res
-                .writeHead(204, {
-                // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin
-                //
-                // > For requests without credentials, the literal value "*" can be
-                // > specified as a wildcard; the value tells browsers to allow
-                // > requesting code from any origin to access the resource.
-                // > Attempting to use the wildcard with credentials results in an
-                // > error.
-                //
-                // A "*" is safer to use than reflecting the request origin.
-                'Access-Control-Allow-Origin': '*',
-                // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Methods
-                // > The value "*" only counts as a special wildcard value for
-                // > requests without credentials (requests without HTTP cookies or
-                // > HTTP authentication information). In requests with credentials,
-                // > it is treated as the literal method name "*" without special
-                // > semantics.
-                'Access-Control-Allow-Methods': '*',
-                'Access-Control-Allow-Headers': 'Content-Type,Authorization,DPoP',
-                'Access-Control-Max-Age': '86400', // 1 day
-            })
-                .end();
-        };
-        router.get('/oauth/jwks', staticJson(server.jwks));
+        router.options('/.well-known/oauth-authorization-server', corsPreflight);
+        router.get('/.well-known/oauth-authorization-server', corsHeaders, (0, index_js_1.cacheControlMiddleware)(300), (0, index_js_1.staticJsonMiddleware)(server.metadata));
+        router.options('/oauth/jwks', corsPreflight);
+        router.get('/oauth/jwks', corsHeaders, (0, index_js_1.cacheControlMiddleware)(300), (0, index_js_1.staticJsonMiddleware)(server.jwks));
         router.options('/oauth/par', corsPreflight);
-        router.post('/oauth/par', jsonHandler(async function (req, _res) {
+        router.post('/oauth/par', oauthHandler(async function (req, _res) {
             const payload = await (0, index_js_1.parseHttpRequest)(req, ['json', 'urlencoded']);
             const credentials = await oauth_types_1.oauthClientCredentialsSchema
                 .parseAsync(payload, { path: ['body'] })
@@ -635,14 +707,13 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
         // https://datatracker.ietf.org/doc/html/rfc9126#section-2.3
         // > If the request did not use the POST method, the authorization server
         // > responds with an HTTP 405 (Method Not Allowed) status code.
-        router.options('/oauth/par', corsPreflight);
         router.all('/oauth/par', (req, res) => {
             res.writeHead(405).end();
         });
         router.options('/oauth/token', corsPreflight);
-        router.post('/oauth/token', jsonHandler(async function (req, _res) {
+        router.post('/oauth/token', oauthHandler(async function (req, _res) {
             const payload = await (0, index_js_1.parseHttpRequest)(req, ['json', 'urlencoded']);
-            const clientMetadata = await deviceManager.getRequestMetadata(req);
+            const clientMetadata = await server.deviceManager.getRequestMetadata(req);
             const clientCredentials = await oauth_types_1.oauthClientCredentialsSchema
                 .parseAsync(payload, { path: ['body'] })
                 .catch(throwInvalidClient);
@@ -653,7 +724,7 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
             return server.token(clientCredentials, clientMetadata, tokenRequest, dpopJkt);
         }));
         router.options('/oauth/revoke', corsPreflight);
-        router.post('/oauth/revoke', jsonHandler(async function (req, res) {
+        router.post('/oauth/revoke', oauthHandler(async function (req, res) {
             const payload = await (0, index_js_1.parseHttpRequest)(req, ['json', 'urlencoded']);
             const tokenIdentification = await oauth_types_1.oauthTokenIdentificationSchema
                 .parseAsync(payload, { path: ['body'] })
@@ -665,7 +736,6 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
                 onError?.(req, res, err, 'Failed to revoke token');
             }
         }));
-        router.options('/oauth/revoke', corsPreflight);
         router.get('/oauth/revoke', navigationHandler(async function (req, res) {
             const query = Object.fromEntries(this.url.searchParams);
             const tokenIdentification = await oauth_types_1.oauthTokenIdentificationSchema
@@ -681,7 +751,8 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
             // todo: generate JSONP response (if "callback" is provided)
             throw new Error('You are successfully logged out. Redirect not implemented');
         }));
-        router.post('/oauth/introspect', jsonHandler(async function (req, _res) {
+        router.options('/oauth/introspect', corsPreflight);
+        router.post('/oauth/introspect', oauthHandler(async function (req, _res) {
             const payload = await (0, index_js_1.parseHttpRequest)(req, ['json', 'urlencoded']);
             const credentials = await oauth_types_1.oauthClientCredentialsSchema
                 .parseAsync(payload, { path: ['body'] })
@@ -697,7 +768,7 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
             (0, index_js_1.validateFetchSite)(req, res, ['cross-site', 'none']);
             const query = Object.fromEntries(this.url.searchParams);
             const clientCredentials = await oauth_types_1.oauthClientCredentialsSchema
-                .parseAsync(query, { path: ['body'] })
+                .parseAsync(query, { path: ['query'] })
                 .catch(throwInvalidRequest);
             if ('client_secret' in clientCredentials) {
                 throw new invalid_request_error_js_1.InvalidRequestError('Client secret must not be provided');
@@ -705,117 +776,47 @@ class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
             const authorizationRequest = await oauth_types_1.oauthAuthorizationRequestQuerySchema
                 .parseAsync(query, { path: ['query'] })
                 .catch(throwInvalidRequest);
-            const { deviceId, deviceMetadata } = await deviceManager.load(req, res);
-            const data = await server
+            const { deviceId, deviceMetadata } = await server.deviceManager.load(req, res);
+            const result = await server
                 .authorize(clientCredentials, authorizationRequest, deviceId, deviceMetadata)
                 .catch((err) => accessDeniedToRedirectCatcher(req, res, err));
-            switch (true) {
-                case 'redirect' in data: {
-                    return (0, send_authorize_redirect_js_1.sendAuthorizeRedirect)(res, data);
-                }
-                case 'authorize' in data: {
-                    await (0, index_js_1.setupCsrfToken)(req, res, csrfCookie(data.authorize.uri));
-                    return outputManager.sendAuthorizePage(res, data);
-                }
-                default: {
-                    // Should never happen
-                    throw new Error('Unexpected authorization result');
-                }
+            if ('redirect' in result) {
+                return (0, send_authorize_redirect_js_1.sendAuthorizeRedirect)(res, result);
+            }
+            else {
+                await (0, index_js_1.setupCsrfToken)(req, res, csrfCookie(result.authorize.uri));
+                return server.outputManager.sendAuthorizePage(res, result, {
+                    preferredLocales: (0, request_js_1.extractLocales)(req),
+                });
             }
         }));
-        const signInPayloadSchema = zod_1.z.object({
-            csrf_token: zod_1.z.string(),
-            request_uri: request_uri_js_1.requestUriSchema,
-            client_id: client_id_js_1.clientIdSchema,
-            credentials: account_store_js_1.signInCredentialsSchema,
-        });
-        router.options('/oauth/authorize/sign-in', corsPreflight);
-        router.post('/oauth/authorize/sign-in', jsonHandler(async function (req, res) {
-            (0, index_js_1.validateFetchMode)(req, res, ['same-origin']);
-            (0, index_js_1.validateFetchSite)(req, res, ['same-origin']);
-            (0, index_js_1.validateSameOrigin)(req, res, issuerOrigin);
-            const payload = await (0, index_js_1.parseHttpRequest)(req, ['json']);
-            const input = await signInPayloadSchema.parseAsync(payload, {
-                path: ['body'],
-            });
-            (0, index_js_1.validateReferer)(req, res, {
-                origin: issuerOrigin,
-                pathname: '/oauth/authorize',
-            });
-            (0, index_js_1.validateCsrfToken)(req, res, input.csrf_token, csrfCookie(input.request_uri));
-            const { deviceId } = await deviceManager.load(req, res, true);
-            return server.signIn(deviceId, input.request_uri, input.client_id, input.credentials);
+        router.post('/oauth/authorize/verify-handle-availability', apiHandler(zod_1.z.object({ handle: account_store_js_1.handleSchema }).strict(), async function (req, res, data) {
+            return server.accountManager.verifyHandleAvailability(data.handle);
         }));
-        const acceptQuerySchema = zod_1.z.object({
-            csrf_token: zod_1.z.string(),
-            request_uri: request_uri_js_1.requestUriSchema,
-            client_id: client_id_js_1.clientIdSchema,
-            account_sub: zod_1.z.string(),
-        });
-        // Though this is a "no-cors" request, meaning that the browser will allow
-        // any cross-origin request, with credentials, to be sent, the handler will
-        // 1) validate the request origin,
-        // 2) validate the CSRF token,
-        // 3) validate the referer,
-        // 4) validate the sec-fetch-site header,
-        // 4) validate the sec-fetch-mode header,
-        // 5) validate the sec-fetch-dest header (see navigationHandler).
-        // And will error if any of these checks fail.
-        router.get('/oauth/authorize/accept', navigationHandler(async function (req, res) {
-            (0, index_js_1.validateFetchSite)(req, res, ['same-origin']);
-            const query = Object.fromEntries(this.url.searchParams);
-            const input = await acceptQuerySchema.parseAsync(query, {
-                path: ['query'],
-            });
-            (0, index_js_1.validateReferer)(req, res, {
-                origin: issuerOrigin,
-                pathname: '/oauth/authorize',
-                searchParams: [
-                    ['request_uri', input.request_uri],
-                    ['client_id', input.client_id],
-                ],
-            });
-            (0, index_js_1.validateCsrfToken)(req, res, input.csrf_token, csrfCookie(input.request_uri), true);
-            const { deviceId, deviceMetadata } = await deviceManager.load(req, res);
-            const data = await server
-                .acceptRequest(input.request_uri, input.client_id, input.account_sub, deviceId, deviceMetadata)
+        router.post('/oauth/authorize/sign-up', apiHandler(sign_up_data_js_1.signUpDataSchema, async function (req, res, data, ctx) {
+            return server.signUp(ctx, data);
+        }));
+        router.post('/oauth/authorize/sign-in', apiHandler(sign_in_data_js_1.signInDataSchema, async function (req, res, data, ctx) {
+            return server.signIn(ctx, data);
+        }));
+        router.post('/oauth/authorize/reset-password-request', apiHandler(account_store_js_1.resetPasswordRequestDataSchema, async function (req, res, data) {
+            await server.accountManager.resetPasswordRequest(data);
+        }));
+        router.post('/oauth/authorize/reset-password-confirm', apiHandler(account_store_js_1.resetPasswordConfirmDataSchema, async function (req, res, data) {
+            await server.accountManager.resetPasswordConfirm(data);
+        }));
+        router.get('/oauth/authorize/accept', authorizeRedirectNavigationHandler(async function (req, res, ctx) {
+            const sub = this.url.searchParams.get('account_sub');
+            if (!sub)
+                throw new invalid_request_error_js_1.InvalidRequestError('Account sub not provided');
+            return server
+                .acceptRequest(ctx, sub)
                 .catch((err) => accessDeniedToRedirectCatcher(req, res, err));
-            return await (0, send_authorize_redirect_js_1.sendAuthorizeRedirect)(res, data);
         }));
-        const rejectQuerySchema = zod_1.z.object({
-            csrf_token: zod_1.z.string(),
-            request_uri: request_uri_js_1.requestUriSchema,
-            client_id: client_id_js_1.clientIdSchema,
-        });
-        // Though this is a "no-cors" request, meaning that the browser will allow
-        // any cross-origin request, with credentials, to be sent, the handler will
-        // 1) validate the request origin,
-        // 2) validate the CSRF token,
-        // 3) validate the referer,
-        // 4) validate the sec-fetch-site header,
-        // 4) validate the sec-fetch-mode header,
-        // 5) validate the sec-fetch-dest header (see navigationHandler).
-        // And will error if any of these checks fail.
-        router.get('/oauth/authorize/reject', navigationHandler(async function (req, res) {
-            (0, index_js_1.validateFetchSite)(req, res, ['same-origin']);
-            const query = Object.fromEntries(this.url.searchParams);
-            const input = await rejectQuerySchema.parseAsync(query, {
-                path: ['query'],
-            });
-            (0, index_js_1.validateReferer)(req, res, {
-                origin: issuerOrigin,
-                pathname: '/oauth/authorize',
-                searchParams: [
-                    ['request_uri', input.request_uri],
-                    ['client_id', input.client_id],
-                ],
-            });
-            (0, index_js_1.validateCsrfToken)(req, res, input.csrf_token, csrfCookie(input.request_uri), true);
-            const { deviceId } = await deviceManager.load(req, res);
-            const data = await server
-                .rejectRequest(deviceId, input.request_uri, input.client_id)
+        router.get('/oauth/authorize/reject', authorizeRedirectNavigationHandler(async function (req, res, ctx) {
+            return server
+                .rejectRequest(ctx)
                 .catch((err) => accessDeniedToRedirectCatcher(req, res, err));
-            return await (0, send_authorize_redirect_js_1.sendAuthorizeRedirect)(res, data);
         }));
         return router;
     }