@atproto/oauth-provider 0.3.1 → 0.5.0

package/dist/request/request-store.js

@@ -14,21 +14,22 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isRequestStore = isRequestStore;
+exports.isRequestStore = void 0;
 exports.ifRequestStore = ifRequestStore;
+const type_js_1 = require("../lib/util/type.js");
 // Export all types needed to implement the RequestStore interface
 __exportStar(require("./code.js"), exports);
-__exportStar(require("./request-id.js"), exports);
 __exportStar(require("./request-data.js"), exports);
-function isRequestStore(implementation) {
-    return (typeof implementation.createRequest === 'function' &&
-        typeof implementation.readRequest === 'function' &&
-        typeof implementation.updateRequest === 'function' &&
-        typeof implementation.deleteRequest === 'function' &&
-        typeof implementation.findRequestByCode === 'function');
-}
+__exportStar(require("./request-id.js"), exports);
+exports.isRequestStore = (0, type_js_1.buildInterfaceChecker)([
+    'createRequest',
+    'readRequest',
+    'updateRequest',
+    'deleteRequest',
+    'findRequestByCode',
+]);
 function ifRequestStore(implementation) {
-    if (implementation && isRequestStore(implementation)) {
+    if (implementation && (0, exports.isRequestStore)(implementation)) {
         return implementation;
     }
     return undefined;

package/dist/request/request-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"request-store.js","sourceRoot":"","sources":["../../src/request/request-store.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAiCA,wCAUC;AAED,wCAQC;AAhDD,kEAAkE;AAClE,4CAAyB;AACzB,kDAA+B;AAC/B,oDAAiC;AAyBjC,SAAgB,cAAc,CAC5B,cAA+D;IAE/D,OAAO,CACL,OAAO,cAAc,CAAC,aAAa,KAAK,UAAU;QAClD,OAAO,cAAc,CAAC,WAAW,KAAK,UAAU;QAChD,OAAO,cAAc,CAAC,aAAa,KAAK,UAAU;QAClD,OAAO,cAAc,CAAC,aAAa,KAAK,UAAU;QAClD,OAAO,cAAc,CAAC,iBAAiB,KAAK,UAAU,CACvD,CAAA;AACH,CAAC;AAED,SAAgB,cAAc,CAC5B,cAAgE;IAEhE,IAAI,cAAc,IAAI,cAAc,CAAC,cAAc,CAAC,EAAE,CAAC;QACrD,OAAO,cAAc,CAAA;IACvB,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC"}
+{"version":3,"file":"request-store.js","sourceRoot":"","sources":["../../src/request/request-store.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAyCA,wCAQC;AAjDD,iDAAsE;AAKtE,kEAAkE;AAClE,4CAAyB;AACzB,oDAAiC;AACjC,kDAA+B;AAyBlB,QAAA,cAAc,GAAG,IAAA,+BAAqB,EAAe;IAChE,eAAe;IACf,aAAa;IACb,eAAe;IACf,eAAe;IACf,mBAAmB;CACpB,CAAC,CAAA;AAEF,SAAgB,cAAc,CAC5B,cAAkB;IAElB,IAAI,cAAc,IAAI,IAAA,sBAAc,EAAC,cAAc,CAAC,EAAE,CAAC;QACrD,OAAO,cAAc,CAAA;IACvB,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/dist/token/token-store.d.ts

@@ -5,9 +5,9 @@ import { Code } from '../request/code.js';
 import { RefreshToken } from './refresh-token.js';
 import { TokenData } from './token-data.js';
 import { TokenId } from './token-id.js';
-export * from './token-id.js';
-export * from './token-data.js';
 export * from './refresh-token.js';
+export * from './token-data.js';
+export * from './token-id.js';
 export type { Awaitable };
 export type TokenInfo = {
     id: TokenId;
@@ -30,6 +30,6 @@ export interface TokenStore {
     findTokenByRefreshToken(refreshToken: RefreshToken): Awaitable<null | TokenInfo>;
     findTokenByCode(code: Code): Awaitable<null | TokenInfo>;
 }
-export declare function isTokenStore(implementation: Record<string, unknown> & Partial<TokenStore>): implementation is Record<string, unknown> & TokenStore;
-export declare function asTokenStore(implementation?: Record<string, unknown> & Partial<TokenStore>): TokenStore;
+export declare const isTokenStore: <V extends Partial<TokenStore>>(value: V) => value is V & import("../lib/util/type.js").RequiredDefined<TokenStore>;
+export declare function asTokenStore<V extends Partial<TokenStore>>(implementation?: V): V & TokenStore;
 //# sourceMappingURL=token-store.d.ts.map

package/dist/token/token-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../../src/token/token-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAA;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAA;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAGvC,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,YAAY,EAAE,SAAS,EAAE,CAAA;AAEzB,MAAM,MAAM,SAAS,GAAG;IACtB,EAAE,EAAE,OAAO,CAAA;IACX,IAAI,EAAE,SAAS,CAAA;IACf,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,CAAC,EAAE,iBAAiB,CAAA;IACxB,mBAAmB,EAAE,IAAI,GAAG,YAAY,CAAA;CACzC,CAAA;AAED,MAAM,MAAM,YAAY,GAAG,IAAI,CAC7B,SAAS,EACT,YAAY,GAAG,WAAW,GAAG,WAAW,CACzC,CAAA;AAED,MAAM,WAAW,UAAU;IACzB,WAAW,CACT,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,SAAS,EACf,YAAY,CAAC,EAAE,YAAY,GAC1B,SAAS,CAAC,IAAI,CAAC,CAAA;IAElB,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,SAAS,CAAC,IAAI,GAAG,SAAS,CAAC,CAAA;IAExD,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAE9C,WAAW,CACT,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,OAAO,EACnB,eAAe,EAAE,YAAY,EAC7B,OAAO,EAAE,YAAY,GACpB,SAAS,CAAC,IAAI,CAAC,CAAA;IAElB;;;;OAIG;IACH,uBAAuB,CACrB,YAAY,EAAE,YAAY,GACzB,SAAS,CAAC,IAAI,GAAG,SAAS,CAAC,CAAA;IAE9B,eAAe,CAAC,IAAI,EAAE,IAAI,GAAG,SAAS,CAAC,IAAI,GAAG,SAAS,CAAC,CAAA;CACzD;AAED,wBAAgB,YAAY,CAC1B,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,GAC5D,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CASxD;AAED,wBAAgB,YAAY,CAC1B,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,GAC7D,UAAU,CAKZ"}
+{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../../src/token/token-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAA;AAC/C,OAAO,EAAE,SAAS,EAAyB,MAAM,qBAAqB,CAAA;AACtE,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAA;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAGvC,cAAc,oBAAoB,CAAA;AAClC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,eAAe,CAAA;AAC7B,YAAY,EAAE,SAAS,EAAE,CAAA;AAEzB,MAAM,MAAM,SAAS,GAAG;IACtB,EAAE,EAAE,OAAO,CAAA;IACX,IAAI,EAAE,SAAS,CAAA;IACf,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,CAAC,EAAE,iBAAiB,CAAA;IACxB,mBAAmB,EAAE,IAAI,GAAG,YAAY,CAAA;CACzC,CAAA;AAED,MAAM,MAAM,YAAY,GAAG,IAAI,CAC7B,SAAS,EACT,YAAY,GAAG,WAAW,GAAG,WAAW,CACzC,CAAA;AAED,MAAM,WAAW,UAAU;IACzB,WAAW,CACT,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,SAAS,EACf,YAAY,CAAC,EAAE,YAAY,GAC1B,SAAS,CAAC,IAAI,CAAC,CAAA;IAElB,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,SAAS,CAAC,IAAI,GAAG,SAAS,CAAC,CAAA;IAExD,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAE9C,WAAW,CACT,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,OAAO,EACnB,eAAe,EAAE,YAAY,EAC7B,OAAO,EAAE,YAAY,GACpB,SAAS,CAAC,IAAI,CAAC,CAAA;IAElB;;;;OAIG;IACH,uBAAuB,CACrB,YAAY,EAAE,YAAY,GACzB,SAAS,CAAC,IAAI,GAAG,SAAS,CAAC,CAAA;IAE9B,eAAe,CAAC,IAAI,EAAE,IAAI,GAAG,SAAS,CAAC,IAAI,GAAG,SAAS,CAAC,CAAA;CACzD;AAED,eAAO,MAAM,YAAY,qHAOvB,CAAA;AAEF,wBAAgB,YAAY,CAAC,CAAC,SAAS,OAAO,CAAC,UAAU,CAAC,EACxD,cAAc,CAAC,EAAE,CAAC,GACjB,CAAC,GAAG,UAAU,CAKhB"}

package/dist/token/token-store.js

@@ -14,22 +14,23 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isTokenStore = isTokenStore;
+exports.isTokenStore = void 0;
 exports.asTokenStore = asTokenStore;
+const type_js_1 = require("../lib/util/type.js");
 // Export all types needed to implement the TokenStore interface
-__exportStar(require("./token-id.js"), exports);
-__exportStar(require("./token-data.js"), exports);
 __exportStar(require("./refresh-token.js"), exports);
-function isTokenStore(implementation) {
-    return (typeof implementation.createToken === 'function' &&
-        typeof implementation.readToken === 'function' &&
-        typeof implementation.rotateToken === 'function' &&
-        typeof implementation.deleteToken === 'function' &&
-        typeof implementation.findTokenByCode === 'function' &&
-        typeof implementation.findTokenByRefreshToken === 'function');
-}
+__exportStar(require("./token-data.js"), exports);
+__exportStar(require("./token-id.js"), exports);
+exports.isTokenStore = (0, type_js_1.buildInterfaceChecker)([
+    'createToken',
+    'readToken',
+    'deleteToken',
+    'rotateToken',
+    'findTokenByRefreshToken',
+    'findTokenByCode',
+]);
 function asTokenStore(implementation) {
-    if (!implementation || !isTokenStore(implementation)) {
+    if (!implementation || !(0, exports.isTokenStore)(implementation)) {
         throw new Error('Invalid TokenStore implementation');
     }
     return implementation;

package/dist/token/token-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-store.js","sourceRoot":"","sources":["../../src/token/token-store.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAyDA,oCAWC;AAED,oCAOC;AArED,gEAAgE;AAChE,gDAA6B;AAC7B,kDAA+B;AAC/B,qDAAkC;AA8ClC,SAAgB,YAAY,CAC1B,cAA6D;IAE7D,OAAO,CACL,OAAO,cAAc,CAAC,WAAW,KAAK,UAAU;QAChD,OAAO,cAAc,CAAC,SAAS,KAAK,UAAU;QAC9C,OAAO,cAAc,CAAC,WAAW,KAAK,UAAU;QAChD,OAAO,cAAc,CAAC,WAAW,KAAK,UAAU;QAChD,OAAO,cAAc,CAAC,eAAe,KAAK,UAAU;QACpD,OAAO,cAAc,CAAC,uBAAuB,KAAK,UAAU,CAC7D,CAAA;AACH,CAAC;AAED,SAAgB,YAAY,CAC1B,cAA8D;IAE9D,IAAI,CAAC,cAAc,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;IACtD,CAAC;IACD,OAAO,cAAc,CAAA;AACvB,CAAC"}
+{"version":3,"file":"token-store.js","sourceRoot":"","sources":["../../src/token/token-store.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAkEA,oCAOC;AAvED,iDAAsE;AAMtE,gEAAgE;AAChE,qDAAkC;AAClC,kDAA+B;AAC/B,gDAA6B;AA8ChB,QAAA,YAAY,GAAG,IAAA,+BAAqB,EAAa;IAC5D,aAAa;IACb,WAAW;IACX,aAAa;IACb,aAAa;IACb,yBAAyB;IACzB,iBAAiB;CAClB,CAAC,CAAA;AAEF,SAAgB,YAAY,CAC1B,cAAkB;IAElB,IAAI,CAAC,cAAc,IAAI,CAAC,IAAA,oBAAY,EAAC,cAAc,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;IACtD,CAAC;IACD,OAAO,cAAc,CAAA;AACvB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atproto/oauth-provider",
-  "version": "0.3.1",
+  "version": "0.5.0",
   "license": "MIT",
   "description": "Generic OAuth2 and OpenID Connect provider for Node.js. Currently only supports features needed for Atproto.",
   "keywords": [
@@ -32,50 +32,75 @@
   },
   "dependencies": {
     "@hapi/accept": "^6.0.3",
+    "@hapi/address": "^5.1.1",
     "@hapi/bourne": "^3.0.0",
     "@hapi/content": "^6.0.0",
     "cookie": "^0.6.0",
+    "disposable-email-domains-js": "^1.5.0",
+    "forwarded": "^0.2.0",
     "http-errors": "^2.0.0",
     "ioredis": "^5.3.2",
     "jose": "^5.2.0",
     "psl": "^1.9.0",
     "zod": "^3.23.8",
-    "@atproto-labs/fetch": "0.2.1",
-    "@atproto-labs/fetch-node": "0.1.7",
+    "@atproto-labs/fetch": "0.2.2",
+    "@atproto-labs/fetch-node": "0.1.8",
+    "@atproto-labs/pipe": "0.1.0",
     "@atproto-labs/simple-store": "0.1.2",
     "@atproto-labs/simple-store-memory": "0.1.2",
-    "@atproto-labs/pipe": "0.1.0",
     "@atproto/common": "^0.4.8",
-    "@atproto/jwk": "0.1.3",
-    "@atproto/jwk-jose": "0.1.4",
-    "@atproto/oauth-types": "0.2.3"
+    "@atproto/jwk": "0.1.4",
+    "@atproto/jwk-jose": "0.1.5",
+    "@atproto/oauth-types": "0.2.4"
   },
   "devDependencies": {
-    "@rollup/plugin-commonjs": "^25.0.7",
-    "@rollup/plugin-node-resolve": "^15.2.3",
-    "@rollup/plugin-replace": "^5.0.5",
-    "@rollup/plugin-terser": "^0.4.4",
-    "@rollup/plugin-typescript": "^11.1.6",
+    "@hcaptcha/react-hcaptcha": "^1.11.2",
+    "@lingui/cli": "^5.2.0",
+    "@lingui/core": "^5.2.0",
+    "@lingui/react": "^5.2.0",
+    "@lingui/swc-plugin": "^5.4.0",
+    "@lingui/vite-plugin": "^5.2.0",
+    "@rollup/plugin-commonjs": "^28.0.2",
+    "@rollup/plugin-dynamic-import-vars": "^2.1.5",
+    "@rollup/plugin-node-resolve": "^16.0.0",
+    "@rollup/plugin-swc": "^0.4.0",
+    "@swc/core": "^1.10.18",
+    "@swc/helpers": "^0.5.15",
     "@types/cookie": "^0.6.0",
+    "@types/forwarded": "0.1.3",
     "@types/psl": "1.1.3",
-    "@types/react": "^18.2.50",
-    "@types/react-dom": "^18.2.18",
+    "@types/react": "^19.0.10",
+    "@types/react-dom": "^19.0.4",
     "@types/send": "^0.17.4",
+    "@vitejs/plugin-react-swc": "^3.8.0",
     "@web/rollup-plugin-import-meta-assets": "^2.2.1",
     "autoprefixer": "^10.4.17",
-    "postcss": "^8.4.33",
-    "react": "^18.2.0",
-    "react-dom": "^18.2.0",
+    "postcss": "^8.4.38",
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0",
+    "react-error-boundary": "^5.0.0",
     "rollup": "^4.13.0",
     "rollup-plugin-postcss": "^4.0.2",
-    "tailwindcss": "^3.4.1",
+    "tailwindcss": "^3.4.3",
     "typescript": "^5.6.3",
-    "@atproto-labs/rollup-plugin-bundle-manifest": "0.1.1"
+    "vite": "^6.2.0",
+    "@atproto-labs/rollup-plugin-bundle-manifest": "0.1.2"
+  },
+  "postcss": {
+    "plugins": {
+      "tailwindcss": {},
+      "autoprefixer": {}
+    }
   },
   "scripts": {
+    "po:extract": "lingui extract --clean",
+    "po:compile": "lingui compile --typescript",
+    "prebuild:frontend": "pnpm po:compile",
     "build:frontend": "rollup --config rollup.config.js",
     "build:backend": "tsc --build --force tsconfig.backend.json",
-    "build": "pnpm --parallel --stream '/^build:.+$/'",
-    "dev": "rollup --config rollup.config.js --watch"
+    "start:ui": "vite",
+    "dev:frontend": "pnpm run build:frontend --watch",
+    "dev:catalogs": "pnpm run po:extract --debounce 250 --watch > /dev/null",
+    "dev:messages": "pnpm run po:compile --debounce 500 --watch"
   }
 }

package/rollup.config.js

@@ -1,10 +1,11 @@
 /* eslint-env node */
 
 const { default: commonjs } = require('@rollup/plugin-commonjs')
+const {
+  default: dynamicImportVars,
+} = require('@rollup/plugin-dynamic-import-vars')
 const { default: nodeResolve } = require('@rollup/plugin-node-resolve')
-const { default: replace } = require('@rollup/plugin-replace')
-const { default: terser } = require('@rollup/plugin-terser')
-const { default: typescript } = require('@rollup/plugin-typescript')
+const { default: swc } = require('@rollup/plugin-swc')
 const { defineConfig } = require('rollup')
 const {
   default: manifest,
@@ -16,34 +17,77 @@ module.exports = defineConfig((commandLineArguments) => {
     process.env['NODE_ENV'] ??
     (commandLineArguments.watch ? 'development' : 'production')
 
-  const minify = NODE_ENV !== 'development'
+  const devMode = NODE_ENV === 'development'
 
   return {
-    input: 'src/assets/app/main.tsx',
+    input: ['src/assets/app/main.tsx', 'src/assets/app/main.css'],
     output: {
       manualChunks: undefined,
       sourcemap: true,
-      file: 'dist/assets/app/main.js',
-      format: 'iife',
+      dir: 'dist/assets/app',
+      format: 'module',
+      entryFileNames: 'main-[hash].js',
     },
     plugins: [
-      nodeResolve({ preferBuiltins: false, browser: true }),
-      commonjs(),
-      postcss({ config: true, extract: true, minimize: minify }),
-      typescript({
-        tsconfig: './tsconfig.frontend.json',
-        outputToFilesystem: true,
+      {
+        name: 'resolve-swc-helpers',
+        resolveId(src) {
+          // For some reason, "nodeResolve" doesn't resolve these:
+          if (src.startsWith('@swc/helpers/')) return require.resolve(src)
+        },
+      },
+      nodeResolve({
+        preferBuiltins: false,
+        browser: true,
+        exportConditions: ['browser', 'module', 'import', 'default'],
       }),
-      replace({
-        preventAssignment: true,
-        values: { 'process.env.NODE_ENV': JSON.stringify(NODE_ENV) },
+      commonjs(),
+      postcss({ config: true, extract: true, minimize: !devMode }),
+      swc({
+        swc: {
+          swcrc: false,
+          configFile: false,
+          sourceMaps: true,
+          minify: !devMode,
+          jsc: {
+            experimental: {
+              // @NOTE Because of the experimental nature of SWC plugins, A
+              // very particular version of @swc/core needs to be used. The
+              // link below allows to determine with version of @swc/core is
+              // compatible based on the version of @lingui/swc-plugin used
+              // (click on the swc_core version in the right column to see
+              // which version of the @swc/core is compatible)
+              //
+              // https://github.com/lingui/swc-plugin?tab=readme-ov-file#compatibility
+              plugins: [['@lingui/swc-plugin', {}]],
+            },
+            minify: {
+              compress: true,
+              mangle: true,
+            },
+            externalHelpers: true,
+            target: 'es2020',
+            parser: { syntax: 'typescript', tsx: true },
+            transform: {
+              useDefineForClassFields: true,
+              react: { runtime: 'automatic' },
+              optimizer: {
+                simplify: true,
+                globals: {
+                  vars: { 'process.env.NODE_ENV': JSON.stringify(NODE_ENV) },
+                },
+              },
+            },
+          },
+        },
       }),
+      dynamicImportVars({ errorWhenNoFilesFound: true }),
+
       // Change `data` to `true` to include assets data in the manifest,
       // allowing for easier bundling of the backend code (eg. using esbuild) as
       // bundlers know how to bundle JSON files but not how to bundle assets
       // referenced at runtime.
       manifest({ data: false }),
-      minify && terser({}),
     ],
     onwarn(warning, warn) {
       // 'use client' directives are fine

package/src/account/account-manager.ts

@@ -1,31 +1,164 @@
-import { isOAuthClientIdLoopback } from '@atproto/oauth-types'
+import {
+  OAuthIssuerIdentifier,
+  isOAuthClientIdLoopback,
+} from '@atproto/oauth-types'
 import { Client } from '../client/client.js'
 import { DeviceId } from '../device/device-id.js'
+import { InvalidRequestError } from '../errors/invalid-request-error.js'
+import { HCaptchaClient, HcaptchaVerifyResult } from '../lib/hcaptcha.js'
+import { callAsync } from '../lib/util/function.js'
 import { constantTime } from '../lib/util/time.js'
-import { InvalidRequestError } from '../oauth-errors.js'
+import { OAuthHooks, RequestMetadata } from '../oauth-hooks.js'
+import { Customization } from '../oauth-provider.js'
 import { Sub } from '../oidc/sub.js'
 import { ClientAuth } from '../token/token-store.js'
 import {
   Account,
   AccountInfo,
   AccountStore,
-  SignInCredentials,
+  ResetPasswordConfirmData,
+  ResetPasswordRequestData,
 } from './account-store.js'
+import { SignInData } from './sign-in-data.js'
+import { SignUpData } from './sign-up-data.js'
 
 const TIMING_ATTACK_MITIGATION_DELAY = 400
+const BRUTE_FORCE_MITIGATION_DELAY = 300
 
 export class AccountManager {
-  constructor(protected readonly store: AccountStore) {}
+  protected readonly inviteCodeRequired: boolean
+  protected readonly hcaptchaClient?: HCaptchaClient
+
+  constructor(
+    issuer: OAuthIssuerIdentifier,
+    protected readonly store: AccountStore,
+    protected readonly hooks: OAuthHooks,
+    customization: Customization,
+  ) {
+    this.inviteCodeRequired = customization.inviteCodeRequired !== false
+    this.hcaptchaClient = customization.hcaptcha
+      ? new HCaptchaClient(new URL(issuer).hostname, customization.hcaptcha)
+      : undefined
+  }
+
+  protected async verifySignupData(
+    data: SignUpData,
+    deviceId: DeviceId,
+    deviceMetadata: RequestMetadata,
+  ): Promise<void> {
+    let hcaptchaResult: undefined | HcaptchaVerifyResult
+
+    if (this.inviteCodeRequired && !data.inviteCode) {
+      throw new InvalidRequestError('Invite code is required')
+    }
+
+    if (this.hcaptchaClient) {
+      if (!data.hcaptchaToken) {
+        throw new InvalidRequestError('hCaptcha token is required')
+      }
+
+      const { allowed, result } = await this.hcaptchaClient.verify(
+        'signup',
+        data.hcaptchaToken,
+        deviceMetadata.ipAddress,
+        data.handle,
+        deviceMetadata.userAgent,
+      )
+
+      await callAsync(this.hooks.onSignupHcaptchaResult, {
+        data,
+        allowed,
+        result,
+        deviceId,
+        deviceMetadata,
+      })
+
+      if (!allowed) {
+        throw new InvalidRequestError('hCaptcha verification failed')
+      }
+
+      hcaptchaResult = result
+    }
+
+    await callAsync(this.hooks.onSignupAttempt, {
+      data,
+      deviceId,
+      deviceMetadata,
+      hcaptchaResult,
+    })
+  }
+
+  public async signUp(
+    data: SignUpData,
+    deviceId: DeviceId,
+    deviceMetadata: RequestMetadata,
+  ): Promise<AccountInfo> {
+    await this.verifySignupData(data, deviceId, deviceMetadata)
+
+    // Mitigation against brute forcing email of users.
+    // @TODO Add rate limit to all the OAuth routes.
+    return constantTime(BRUTE_FORCE_MITIGATION_DELAY, async () => {
+      let account: Account
+      try {
+        account = await this.store.createAccount(data)
+      } catch (err) {
+        throw InvalidRequestError.from(err, 'Account creation failed')
+      }
+
+      try {
+        const info = await this.store.addDeviceAccount(
+          deviceId,
+          account.sub,
+          false,
+        )
+
+        await callAsync(this.hooks.onSignedUp, {
+          data,
+          info,
+          account,
+          deviceId,
+          deviceMetadata,
+        })
+
+        return { account, info }
+      } catch (err) {
+        throw InvalidRequestError.from(
+          err,
+          'Something went wrong, try singing-in',
+        )
+      }
+    })
+  }
 
   public async signIn(
-    credentials: SignInCredentials,
+    data: SignInData,
     deviceId: DeviceId,
+    deviceMetadata: RequestMetadata,
   ): Promise<AccountInfo> {
     return constantTime(TIMING_ATTACK_MITIGATION_DELAY, async () => {
-      const result = await this.store.authenticateAccount(credentials, deviceId)
-      if (result) return result
+      try {
+        const account = await this.store.authenticateAccount(data)
+        const info = await this.store.addDeviceAccount(
+          deviceId,
+          account.sub,
+          data.remember,
+        )
 
-      throw new InvalidRequestError('Invalid credentials')
+        await callAsync(this.hooks.onSignedIn, {
+          data,
+          info,
+          account,
+          deviceId,
+          deviceMetadata,
+        })
+
+        return { account, info }
+      } catch (err) {
+        throw InvalidRequestError.from(
+          err,
+          'Unable to sign-in due to an unexpected server error',
+        )
+      }
     })
   }
 
@@ -52,4 +185,22 @@ export class AccountManager {
     const results = await this.store.listDeviceAccounts(deviceId)
     return results.filter((result) => result.info.remembered)
   }
+
+  public async resetPasswordRequest(data: ResetPasswordRequestData) {
+    return constantTime(TIMING_ATTACK_MITIGATION_DELAY, async () => {
+      await this.store.resetPasswordRequest(data)
+    })
+  }
+
+  public async resetPasswordConfirm(data: ResetPasswordConfirmData) {
+    return constantTime(TIMING_ATTACK_MITIGATION_DELAY, async () => {
+      await this.store.resetPasswordConfirm(data)
+    })
+  }
+
+  public async verifyHandleAvailability(handle: string): Promise<void> {
+    return constantTime(TIMING_ATTACK_MITIGATION_DELAY, async () => {
+      return this.store.verifyHandleAvailability(handle)
+    })
+  }
 }