@atproto/oauth-provider 0.3.1 → 0.5.0

package/src/assets/app/lib/api.ts

@@ -1,98 +1,267 @@
-import { FetchResponseError, Json } from '@atproto-labs/fetch'
-import { Account, Session } from '../backend-data'
+import { Account } from '../backend-types.ts'
+import {
+  JsonClient,
+  JsonErrorPayload,
+  JsonErrorResponse,
+} from './json-client.ts'
 
-export class Api {
-  constructor(
-    private requestUri: string,
-    private clientId: string,
-    private csrfToken: string,
-    private newSessionsRequireConsent: boolean,
-  ) {}
-
-  async signIn(credentials: {
-    username: string
-    password: string
-    remember?: boolean
-  }): Promise<Session> {
-    const response = await fetch('/oauth/authorize/sign-in', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      mode: 'same-origin',
-      body: JSON.stringify({
-        csrf_token: this.csrfToken,
-        request_uri: this.requestUri,
-        client_id: this.clientId,
-        credentials,
-      }),
-    })
-
-    const json: Json = await response.json()
-
-    if (response.ok) {
-      const data = json as {
-        account: Account
-        consentRequired: boolean
-      }
-
-      return {
-        account: data.account,
-
-        selected: true,
-        loginRequired: false,
-        consentRequired: this.newSessionsRequireConsent || data.consentRequired,
-      }
-    } else if (
-      response.status === 400 &&
-      json?.['error'] === 'invalid_request' &&
-      json?.['error_description'] === 'Invalid credentials'
-    ) {
-      throw new InvalidCredentialsError()
-    } else if (
-      response.status === 401 &&
-      json?.['error'] === 'second_authentication_factor_required'
-    ) {
-      const data = json as {
-        type: 'emailOtp'
-        hint: string
-      }
-
-      throw new SecondAuthenticationFactorRequiredError(data.type, data.hint)
-    } else {
-      throw new FetchResponseError(response)
-    }
+export type { Options } from './json-client.ts'
+
+export type AcceptData = {
+  sub: string
+}
+
+export type SignInData = {
+  locale: string
+  username: string
+  password: string
+  emailOtp?: string
+  remember?: boolean
+}
+
+export type SignUpData = {
+  locale: string
+  handle: string
+  email: string
+  password: string
+  inviteCode?: string
+  hcaptchaToken?: string
+}
+
+export type InitiatePasswordResetData = {
+  locale: string
+  email: string
+}
+
+export type ConfirmResetPasswordData = {
+  token: string
+  password: string
+}
+
+export type VerifyHandleAvailabilityData = {
+  handle: string
+}
+
+export type SessionResponse = {
+  account: Account
+  consentRequired: boolean
+}
+
+export class Api extends JsonClient<{
+  '/verify-handle-availability': {
+    input: VerifyHandleAvailabilityData
+    output: void
+  }
+  '/sign-up': {
+    input: SignUpData
+    output: SessionResponse
+  }
+  '/sign-in': {
+    input: SignInData
+    output: SessionResponse
+  }
+  '/reset-password-request': {
+    input: InitiatePasswordResetData
+    output: void
+  }
+  '/reset-password-confirm': {
+    input: ConfirmResetPasswordData
+    output: void
+  }
+}> {
+  constructor(csrfToken: string) {
+    const baseUrl = new URL('/oauth/authorize', window.origin).toString()
+    super(baseUrl, csrfToken)
   }
 
-  async accept(account: Account): Promise<URL> {
-    const url = new URL('/oauth/authorize/accept', window.origin)
-    url.searchParams.set('request_uri', this.requestUri)
-    url.searchParams.set('account_sub', account.sub)
-    url.searchParams.set('client_id', this.clientId)
+  public buildAcceptUrl(data: AcceptData): URL {
+    const url = new URL(`${this.baseUrl}/accept`)
+    url.searchParams.set('account_sub', data.sub)
     url.searchParams.set('csrf_token', this.csrfToken)
-
     return url
   }
 
-  async reject(): Promise<URL> {
-    const url = new URL('/oauth/authorize/reject', window.origin)
-    url.searchParams.set('request_uri', this.requestUri)
-    url.searchParams.set('client_id', this.clientId)
+  public buildRejectUrl(): URL {
+    const url = new URL(`${this.baseUrl}/reject`)
     url.searchParams.set('csrf_token', this.csrfToken)
-
     return url
   }
+
+  public static override parseError(
+    json: unknown,
+  ): undefined | JsonErrorResponse {
+    // @NOTE Most specific errors first !
+    if (SecondAuthenticationFactorRequiredError.is(json)) {
+      return new SecondAuthenticationFactorRequiredError(json)
+    }
+    if (InvalidCredentialsError.is(json)) {
+      return new InvalidCredentialsError(json)
+    }
+    if (HandleUnavailableError.is(json)) {
+      return new HandleUnavailableError(json)
+    }
+    if (EmailTakenError.is(json)) {
+      return new EmailTakenError(json)
+    }
+    if (RequestExpiredError.is(json)) {
+      return new RequestExpiredError(json)
+    }
+    if (UnknownRequestUriError.is(json)) {
+      return new UnknownRequestUriError(json)
+    }
+    if (InvalidRequestError.is(json)) {
+      return new InvalidRequestError(json)
+    }
+    if (AccessDeniedError.is(json)) {
+      return new AccessDeniedError(json)
+    }
+    return super.parseError(json)
+  }
+}
+
+export type AccessDeniedPayload = JsonErrorPayload<'access_denied'>
+export class AccessDeniedError<
+  P extends AccessDeniedPayload = AccessDeniedPayload,
+> extends JsonErrorResponse<P> {
+  constructor(
+    payload: P,
+    message = payload.error_description || 'Access denied',
+  ) {
+    super(payload, message)
+  }
+
+  static is(json: unknown): json is AccessDeniedPayload {
+    return super.is(json) && json.error === 'access_denied'
+  }
+}
+
+export type InvalidRequestPayload = JsonErrorPayload<'invalid_request'>
+export class InvalidRequestError<
+  P extends InvalidRequestPayload = InvalidRequestPayload,
+> extends JsonErrorResponse<P> {
+  constructor(
+    payload: P,
+    message = payload.error_description || 'Invalid request',
+  ) {
+    super(payload, message)
+  }
+
+  static is(json: unknown): json is InvalidRequestPayload {
+    return super.is(json) && json.error === 'invalid_request'
+  }
+}
+
+export type RequestExpiredPayload = AccessDeniedPayload & {
+  error_description: 'This request has expired'
+}
+export class RequestExpiredError<
+  P extends RequestExpiredPayload = RequestExpiredPayload,
+> extends AccessDeniedError<P> {
+  static is(json: unknown): json is RequestExpiredPayload {
+    return (
+      super.is(json) && json.error_description === 'This request has expired'
+    )
+  }
+}
+
+export type InvalidCredentialsPayload = InvalidRequestPayload & {
+  error_description: 'Invalid identifier or password'
+}
+export class InvalidCredentialsError<
+  P extends InvalidCredentialsPayload = InvalidCredentialsPayload,
+> extends InvalidRequestError<P> {
+  static is(json: unknown): json is InvalidCredentialsPayload {
+    return (
+      super.is(json) &&
+      json.error_description === 'Invalid identifier or password'
+    )
+  }
+}
+
+export type UnknownRequestPayload = InvalidRequestPayload & {
+  error_description: 'Unknown request_uri'
+}
+export class UnknownRequestUriError<
+  P extends UnknownRequestPayload = UnknownRequestPayload,
+> extends InvalidRequestError<P> {
+  static is(json: unknown): json is UnknownRequestPayload {
+    return super.is(json) && json.error_description === 'Unknown request_uri'
+  }
+}
+export type EmailTakenPayload = InvalidRequestPayload & {
+  error_description: 'Email already taken'
+}
+export class EmailTakenError<
+  P extends EmailTakenPayload = EmailTakenPayload,
+> extends InvalidRequestError<P> {
+  static is(json: unknown): json is EmailTakenPayload {
+    return super.is(json) && json.error_description === 'Email already taken'
+  }
 }
 
-export class InvalidCredentialsError extends Error {
-  constructor() {
-    super('Invalid credentials')
+export type HandleUnavailablePayload =
+  JsonErrorPayload<'handle_unavailable'> & {
+    reason: 'syntax' | 'domain' | 'slur' | 'taken'
+  }
+export class HandleUnavailableError<
+  P extends HandleUnavailablePayload = HandleUnavailablePayload,
+> extends JsonErrorResponse<P> {
+  constructor(
+    payload: P,
+    message = payload.error_description || 'That handle cannot be used',
+  ) {
+    super(payload, message)
+  }
+
+  get reason() {
+    return this.payload.reason
+  }
+
+  static is(json: unknown): json is HandleUnavailablePayload {
+    return (
+      super.is(json) &&
+      json.error === 'handle_unavailable' &&
+      'reason' in json &&
+      (json.reason === 'syntax' ||
+        json.reason === 'domain' ||
+        json.reason === 'slur' ||
+        json.reason === 'taken')
+    )
   }
 }
 
-export class SecondAuthenticationFactorRequiredError extends Error {
+export type SecondAuthenticationFactorRequiredPayload =
+  JsonErrorPayload<'second_authentication_factor_required'> & {
+    type: 'emailOtp'
+    hint: string
+  }
+export class SecondAuthenticationFactorRequiredError<
+  P extends
+    SecondAuthenticationFactorRequiredPayload = SecondAuthenticationFactorRequiredPayload,
+> extends JsonErrorResponse<P> {
   constructor(
-    public type: 'emailOtp',
-    public hint: string,
+    payload: P,
+    message = payload.error_description ||
+      `${payload.type} authentication factor required (hint: ${payload.hint})`,
   ) {
-    super(`${type} authentication factor required (hint: ${hint})`)
+    super(payload, message)
+  }
+
+  get type() {
+    return this.payload.type
+  }
+  get hint() {
+    return this.payload.hint
+  }
+
+  static is(json: unknown): json is SecondAuthenticationFactorRequiredPayload {
+    return (
+      super.is(json) &&
+      json.error === 'second_authentication_factor_required' &&
+      'type' in json &&
+      json.type === 'emailOtp' &&
+      'hint' in json &&
+      typeof json.hint === 'string'
+    )
   }
 }

package/src/assets/app/lib/clsx.ts

@@ -1,9 +1,6 @@
-export function clsx(
-  a?: string,
-  ...args: readonly (string | undefined)[]
-): string | undefined {
-  if (args.length === 0) return a
-  const b = clsx(...args)
-  if (a && b) return `${a} ${b}`
-  return a || b
+type ClsxArg = string | false | undefined
+
+export function clsx(...args: [ClsxArg, ...ClsxArg[]]): string | undefined {
+  const filtered = args.filter(Boolean) as string[]
+  return filtered.length > 0 ? filtered.join(' ') : undefined
 }

package/src/assets/app/lib/json-client.ts

@@ -0,0 +1,94 @@
+// Using a type import to avoid bundling this lib
+import type { Json } from '@atproto-labs/fetch'
+
+export { type Json }
+
+export type Options = {
+  signal?: AbortSignal
+}
+
+export type EndpointDefinition = {
+  input: Json
+  output: Json | void
+}
+
+export class JsonClient<E extends { [Path: string]: EndpointDefinition }> {
+  constructor(
+    protected readonly baseUrl: string,
+    protected readonly csrfToken: string,
+  ) {}
+
+  public async fetch<P extends string & keyof E>(
+    path: P,
+    payload: E[P]['input'],
+    options?: Options,
+  ): Promise<E[P]['output']> {
+    const response = await fetch(`${this.baseUrl}${path}`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'X-CSRF-Token': this.csrfToken,
+      },
+      mode: 'same-origin',
+      body: JSON.stringify(payload),
+      signal: options?.signal,
+    })
+
+    if (response.status === 204) {
+      return undefined
+    }
+
+    return response.json().then((json: Json) => {
+      if (response.ok) return json as E[P]['output']
+      else throw this.parseError(response, json)
+    })
+  }
+
+  protected parseError(response: Response, json: Json): Error {
+    const Class = this.constructor as typeof JsonClient
+    const error = Class.parseError(json)
+    if (error) return error
+
+    return new Error('Invalid JSON response', { cause: response })
+  }
+
+  public static parseError(json: unknown): undefined | JsonErrorResponse {
+    if (JsonErrorResponse.is(json)) {
+      return new JsonErrorResponse(json)
+    }
+  }
+}
+
+export type JsonErrorPayload<E extends string = string> = {
+  error: E
+  error_description?: string
+}
+
+export class JsonErrorResponse<
+  P extends JsonErrorPayload = JsonErrorPayload,
+> extends Error {
+  constructor(
+    public readonly payload: P,
+    message = payload.error_description,
+  ) {
+    super(message || `Error "${payload.error}"`)
+  }
+
+  get error(): string {
+    return this.payload.error
+  }
+
+  get description(): string | undefined {
+    return this.payload.error_description
+  }
+
+  static is(json: unknown): json is JsonErrorPayload {
+    return (
+      json != null &&
+      typeof json === 'object' &&
+      typeof json['error'] === 'string' &&
+      (json['error_description'] === undefined ||
+        typeof json['error_description'] === 'string')
+    )
+  }
+}

package/src/assets/app/lib/password.ts

@@ -0,0 +1,98 @@
+export const MIN_PASSWORD_LENGTH = 8
+
+const EMOJI =
+  /(\ud83c[\ud000-\udfff]|\ud83d[\ud000-\udfff]|\ud83e[\ud000-\udfff])/
+const UPPER = /[A-Z]/
+const LOWER = /[a-z]/
+const DEC = /[0-9]/
+const SPECIAL = /[^a-zA-Z0-9]/
+
+export enum PasswordStrength {
+  weak = 1,
+  moderate = 2,
+  strong = 3,
+  extra = 4,
+}
+
+export function getPasswordStrength(pwd: string): PasswordStrength {
+  if (pwd.length < MIN_PASSWORD_LENGTH) {
+    return PasswordStrength.weak
+  }
+
+  // Very long passwords
+  if (pwd.length >= MIN_PASSWORD_LENGTH + 12) {
+    return PasswordStrength.extra
+  }
+
+  // Long passwords
+  if (pwd.length >= MIN_PASSWORD_LENGTH + 8) {
+    if (matches(pwd, [SPECIAL])) {
+      return PasswordStrength.extra
+    }
+    if (matches(pwd, [UPPER, LOWER, DEC], 2)) {
+      return PasswordStrength.extra
+    }
+    return PasswordStrength.strong
+  }
+
+  // Emojis make passwords strong
+  if (pwd.length >= MIN_PASSWORD_LENGTH) {
+    if (matches(pwd, [EMOJI])) {
+      return PasswordStrength.strong
+    }
+  }
+
+  // Pretty long passwords
+  if (pwd.length >= MIN_PASSWORD_LENGTH + 6) {
+    if (matches(pwd, [SPECIAL])) {
+      return PasswordStrength.strong
+    }
+    if (matches(pwd, [UPPER, LOWER, DEC], 2)) {
+      return PasswordStrength.strong
+    }
+    // Only 1 type of alpha-num characters
+    return PasswordStrength.moderate
+  }
+
+  // Longish password
+  if (pwd.length >= MIN_PASSWORD_LENGTH + 4) {
+    if (matches(pwd, [SPECIAL])) {
+      return PasswordStrength.moderate
+    }
+    if (matches(pwd, [UPPER, LOWER, DEC], 2)) {
+      return PasswordStrength.moderate
+    }
+
+    // Only 1 type of alpha-num characters
+    return PasswordStrength.weak
+  }
+
+  // Short password (8-11 characters)
+  if (pwd.length >= MIN_PASSWORD_LENGTH) {
+    if (matches(pwd, [SPECIAL])) {
+      return PasswordStrength.moderate
+    }
+    if (matches(pwd, [UPPER, LOWER, DEC])) {
+      return PasswordStrength.moderate
+    }
+  }
+
+  return PasswordStrength.weak
+}
+
+function matches(
+  pwd: string,
+  regexps: RegExp[],
+  regexpsCountToMatch: number = regexps.length,
+): boolean {
+  if (regexpsCountToMatch < 1 || regexpsCountToMatch > regexps.length) {
+    throw new TypeError('Invalid regexpsCountToMatch')
+  }
+  for (const regexp of regexps) {
+    if (regexp.test(pwd)) {
+      regexpsCountToMatch--
+      if (regexpsCountToMatch === 0) return true
+    }
+  }
+  return false
+}

package/src/assets/app/lib/ref.ts

@@ -0,0 +1,17 @@
+import { ForwardedRef } from 'react'
+
+export function updateRef<T>(ref: ForwardedRef<T>, value: T | null) {
+  if (typeof ref === 'function') {
+    ref(value)
+  } else if (ref) {
+    ref.current = value
+  }
+}
+
+export function mergeRefs<T>(refs: readonly (ForwardedRef<T> | undefined)[]) {
+  return (value: T | null) => {
+    for (const ref of refs) {
+      if (ref) updateRef(ref, value)
+    }
+  }
+}