@atproto/oauth-provider 0.3.1 → 0.5.0

package/src/assets/index.ts

@@ -19,7 +19,7 @@ import type { ManifestItem } from '@atproto-labs/rollup-plugin-bundle-manifest'
 // @ts-expect-error: This file is generated at build time
 // eslint-disable-next-line import/no-unresolved
 import appBundleManifestJson from './app/bundle-manifest.json'
-import { Asset } from './asset'
+import { Asset } from './asset.js'
 
 const appBundleManifest: Map<string, ManifestItem> = new Map(
   Object.entries(appBundleManifestJson),
@@ -27,7 +27,15 @@ const appBundleManifest: Map<string, ManifestItem> = new Map(
 
 export const ASSETS_URL_PREFIX = '/@atproto/oauth-provider/~assets/'
 
-export async function getAsset(inputFilename: string): Promise<Asset> {
+export function* enumerateAssets(mime: string): IteratorObject<Asset, void> {
+  for (const [filename, manifest] of appBundleManifest) {
+    if (manifest.mime === mime) {
+      yield manifestItemToAsset(filename, manifest)
+    }
+  }
+}
+
+export function getAsset(inputFilename: string): Asset {
   const filename = posix.normalize(inputFilename)
 
   if (
@@ -41,6 +49,10 @@ export async function getAsset(inputFilename: string): Promise<Asset> {
   const manifest = appBundleManifest.get(filename)
   if (!manifest) throw new AssetNotFoundError(filename)
 
+  return manifestItemToAsset(filename, manifest)
+}
+
+function manifestItemToAsset(filename: string, manifest: ManifestItem): Asset {
   // When this package is used as a regular "node_modules" dependency, and gets
   // bundled by the consumer, the assets should be copied to the bundle's output
   // directory. In case the bundler does not support copying assets from the
@@ -53,6 +65,7 @@ export async function getAsset(inputFilename: string): Promise<Asset> {
   return {
     url: posix.join(ASSETS_URL_PREFIX, filename),
     type: manifest.mime,
+    isEntry: manifest.type === 'chunk' && manifest.isEntry,
     sha256: manifest.sha256,
     createStream: data
       ? () => Readable.from(Buffer.from(data, 'base64'))

package/src/client/client-store.ts

@@ -1,5 +1,5 @@
 import { OAuthClientMetadata } from '@atproto/oauth-types'
-import { Awaitable } from '../lib/util/type.js'
+import { Awaitable, buildInterfaceChecker } from '../lib/util/type.js'
 import { ClientId } from './client-id.js'
 
 // Export all types needed to implement the ClientStore interface
@@ -11,15 +11,13 @@ export interface ClientStore {
   findClient(clientId: ClientId): Awaitable<OAuthClientMetadata>
 }
 
-export function isClientStore(
-  implementation: Record<string, unknown> & Partial<ClientStore>,
-): implementation is Record<string, unknown> & ClientStore {
-  return typeof implementation.findClient === 'function'
-}
+export const isClientStore = buildInterfaceChecker<ClientStore>([
+  'findClient', //
+])
 
-export function ifClientStore(
-  implementation?: Record<string, unknown> & Partial<ClientStore>,
-): ClientStore | undefined {
+export function ifClientStore<V extends Partial<ClientStore>>(
+  implementation?: V,
+): (V & ClientStore) | undefined {
   if (implementation && isClientStore(implementation)) {
     return implementation
   }
@@ -27,9 +25,9 @@ export function ifClientStore(
   return undefined
 }
 
-export function asClientStore(
-  implementation?: Record<string, unknown> & Partial<ClientStore>,
-): ClientStore {
+export function asClientStore<V extends Partial<ClientStore>>(
+  implementation?: V,
+): V & ClientStore {
   const store = ifClientStore(implementation)
   if (store) return store
 

package/src/device/device-manager.ts

@@ -22,10 +22,13 @@ export const deviceManagerOptionsSchema = z.object({
   /**
    * Controls whether the IP address is read from the `X-Forwarded-For` header
    * (if `true`), or from the `req.socket.remoteAddress` property (if `false`).
-   *
-   * @default true // (nowadays, most requests are proxied)
    */
-  trustProxy: z.boolean().default(true),
+  trustProxy: z
+    .function()
+    .args<[addr: z.ZodString, i: z.ZodNumber]>(z.string(), z.number())
+    .returns(z.boolean())
+    .optional(),
+
   /**
    * Amount of time (in ms) after which session IDs will be rotated
    *
@@ -88,6 +91,11 @@ export type DeviceManagerOptions = z.input<typeof deviceManagerOptionsSchema>
 const cookieValueSchema = z.tuple([deviceIdSchema, sessionIdSchema])
 type CookieValue = z.infer<typeof cookieValueSchema>
 
+export type DeviceInfo = {
+  deviceId: DeviceId
+  deviceMetadata: RequestMetadata
+}
+
 /**
  * This class provides an abstraction for keeping track of DEVICE sessions. It
  * relies on a {@link DeviceStore} to persist session data and a cookie to
@@ -107,10 +115,7 @@ export class DeviceManager {
     req: IncomingMessage,
     res: ServerResponse,
     forceRotate = false,
-  ): Promise<{
-    deviceId: DeviceId
-    deviceMetadata: RequestMetadata
-  }> {
+  ): Promise<DeviceInfo> {
     const cookie = await this.getCookie(req)
     if (cookie) {
       return this.refresh(
@@ -127,10 +132,7 @@ export class DeviceManager {
   private async create(
     req: IncomingMessage,
     res: ServerResponse,
-  ): Promise<{
-    deviceId: DeviceId
-    deviceMetadata: RequestMetadata
-  }> {
+  ): Promise<DeviceInfo> {
     const deviceMetadata = this.getRequestMetadata(req)
 
     const [deviceId, sessionId] = await Promise.all([
@@ -155,10 +157,7 @@ export class DeviceManager {
     res: ServerResponse,
     [deviceId, sessionId]: CookieValue,
     forceRotate = false,
-  ): Promise<{
-    deviceId: DeviceId
-    deviceMetadata: RequestMetadata
-  }> {
+  ): Promise<DeviceInfo> {
     const data = await this.store.readDevice(deviceId)
     if (!data) return this.create(req, res)
 

package/src/device/device-store.ts

@@ -1,10 +1,10 @@
-import { Awaitable } from '../lib/util/type.js'
+import { Awaitable, buildInterfaceChecker } from '../lib/util/type.js'
 import { DeviceData } from './device-data.js'
 import { DeviceId } from './device-id.js'
 
 // Export all types needed to implement the DeviceStore interface
-export * from './device-id.js'
 export * from './device-data.js'
+export * from './device-id.js'
 export * from './session-id.js'
 
 export interface DeviceStore {
@@ -14,20 +14,14 @@ export interface DeviceStore {
   deleteDevice(deviceId: DeviceId): Awaitable<void>
 }
 
-export function isDeviceStore(
-  implementation: Record<string, unknown> & Partial<DeviceStore>,
-): implementation is Record<string, unknown> & DeviceStore {
-  return (
-    typeof implementation.createDevice === 'function' &&
-    typeof implementation.readDevice === 'function' &&
-    typeof implementation.updateDevice === 'function' &&
-    typeof implementation.deleteDevice === 'function'
-  )
-}
+export const isDeviceStore = buildInterfaceChecker<DeviceStore>([
+  'createDevice',
+  'readDevice',
+  'updateDevice',
+  'deleteDevice',
+])
 
-export function asDeviceStore(
-  implementation?: Record<string, unknown> & Partial<DeviceStore>,
-): DeviceStore {
+export function asDeviceStore<V>(implementation: V): V & DeviceStore {
   if (!implementation || !isDeviceStore(implementation)) {
     throw new Error('Invalid DeviceStore implementation')
   }

package/src/dpop/dpop-manager.ts

@@ -1,30 +1,42 @@
 import { createHash } from 'node:crypto'
 import { EmbeddedJWK, calculateJwkThumbprint, errors, jwtVerify } from 'jose'
+import { z } from 'zod'
 import { DPOP_NONCE_MAX_AGE } from '../constants.js'
 import { InvalidDpopProofError } from '../errors/invalid-dpop-proof-error.js'
 import { UseDpopNonceError } from '../errors/use-dpop-nonce-error.js'
-import { DpopNonce, DpopNonceInput } from './dpop-nonce.js'
+import {
+  DpopNonce,
+  DpopSecret,
+  dpopSecretSchema,
+  rotationIntervalSchema,
+} from './dpop-nonce.js'
 
 const { JOSEError } = errors
 
-export { DpopNonce, type DpopNonceInput }
-export type DpopManagerOptions = {
+export { DpopNonce, type DpopSecret }
+
+export const dpopManagerOptionsSchema = z.object({
   /**
    * Set this to `false` to disable the use of nonces in DPoP proofs. Set this
    * to a secret Uint8Array or hex encoded string to use a predictable seed for
    * all nonces (typically useful when multiple instances are running). Leave
    * undefined to generate a random seed at startup.
    */
-  dpopSecret?: false | DpopNonceInput
-  dpopStep?: number
-}
+  dpopSecret: z.union([z.literal(false), dpopSecretSchema]).optional(),
+  dpopRotationInterval: rotationIntervalSchema.optional(),
+})
+export type DpopManagerOptions = z.input<typeof dpopManagerOptionsSchema>
 
 export class DpopManager {
   protected readonly dpopNonce?: DpopNonce
 
-  constructor({ dpopSecret, dpopStep }: DpopManagerOptions = {}) {
+  constructor(options: DpopManagerOptions = {}) {
+    const { dpopSecret, dpopRotationInterval } =
+      dpopManagerOptionsSchema.parse(options)
     this.dpopNonce =
-      dpopSecret === false ? undefined : DpopNonce.from(dpopSecret, dpopStep)
+      dpopSecret === false
+        ? undefined
+        : new DpopNonce(dpopSecret, dpopRotationInterval)
   }
 
   nextNonce(): string | undefined {

package/src/dpop/dpop-nonce.ts

@@ -1,48 +1,68 @@
 import { createHmac, randomBytes } from 'node:crypto'
+import { z } from 'zod'
 import { DPOP_NONCE_MAX_AGE } from '../constants.js'
 
-function numTo64bits(num: number) {
-  const arr = new Uint8Array(8)
-  arr[7] = (num = num | 0) & 0xff
-  arr[6] = (num >>= 8) & 0xff
-  arr[5] = (num >>= 8) & 0xff
-  arr[4] = (num >>= 8) & 0xff
-  arr[3] = (num >>= 8) & 0xff
-  arr[2] = (num >>= 8) & 0xff
-  arr[1] = (num >>= 8) & 0xff
-  arr[0] = (num >>= 8) & 0xff
-  return arr
-}
+const MAX_ROTATION_INTERVAL = DPOP_NONCE_MAX_AGE / 3
+const MIN_ROTATION_INTERVAL = Math.min(1000, MAX_ROTATION_INTERVAL)
+
+export const rotationIntervalSchema = z
+  .number()
+  .int()
+  .min(MIN_ROTATION_INTERVAL)
+  .max(MAX_ROTATION_INTERVAL)
+
+const SECRET_BYTE_LENGTH = 32
 
-export type DpopNonceInput = string | Uint8Array | DpopNonce
+export const secretBytesSchema = z
+  .instanceof(Uint8Array)
+  .refine((secret) => secret.length === SECRET_BYTE_LENGTH, {
+    message: `Secret must be exactly ${SECRET_BYTE_LENGTH} bytes long`,
+  })
+
+export const secretHexSchema = z
+  .string()
+  .regex(
+    /^[0-9a-f]+$/i,
+    `Secret must be a ${SECRET_BYTE_LENGTH * 2} chars hex string`,
+  )
+  .length(SECRET_BYTE_LENGTH * 2)
+  .transform((hex): Uint8Array => Buffer.from(hex, 'hex'))
+
+export const dpopSecretSchema = z.union([secretBytesSchema, secretHexSchema])
+export type DpopSecret = z.input<typeof dpopSecretSchema>
 
 export class DpopNonce {
-  #secret: Uint8Array
-  #counter: number
+  readonly #rotationInterval: number
+  readonly #secret: Uint8Array
 
+  // Nonce state
+  #counter: number
   #prev: string
   #now: string
   #next: string
 
   constructor(
-    protected readonly secret: Uint8Array,
-    protected readonly step: number,
+    secret: DpopSecret = randomBytes(SECRET_BYTE_LENGTH),
+    rotationInterval = MAX_ROTATION_INTERVAL,
   ) {
-    if (secret.length !== 32) throw new TypeError('Expected 32 bytes')
-    if (this.step < 0 || this.step > DPOP_NONCE_MAX_AGE / 3) {
-      throw new TypeError('Invalid step')
-    }
-
-    this.#secret = Uint8Array.from(secret)
-    this.#counter = (Date.now() / step) | 0
+    this.#rotationInterval = rotationIntervalSchema.parse(rotationInterval)
+    this.#secret = Uint8Array.from(dpopSecretSchema.parse(secret))
 
+    this.#counter = this.currentCounter
     this.#prev = this.compute(this.#counter - 1)
     this.#now = this.compute(this.#counter)
     this.#next = this.compute(this.#counter + 1)
   }
 
+  /**
+   * Returns the number of full rotations since the epoch
+   */
+  protected get currentCounter() {
+    return (Date.now() / this.#rotationInterval) | 0
+  }
+
   protected rotate() {
-    const counter = (Date.now() / this.step) | 0
+    const counter = this.currentCounter
     switch (counter - this.#counter) {
       case 0:
         // counter === this.#counter => nothing to do
@@ -84,20 +104,18 @@ export class DpopNonce {
   public check(nonce: string) {
     return this.#next === nonce || this.#now === nonce || this.#prev === nonce
   }
+}
 
-  static from(
-    input: DpopNonceInput = randomBytes(32),
-    step = DPOP_NONCE_MAX_AGE / 3,
-  ): DpopNonce {
-    if (input instanceof DpopNonce) {
-      return input
-    }
-    if (input instanceof Uint8Array) {
-      return new DpopNonce(input, step)
-    }
-    if (typeof input === 'string') {
-      return new DpopNonce(Buffer.from(input, 'hex'), step)
-    }
-    return new DpopNonce(input, step)
-  }
+function numTo64bits(num: number) {
+  const arr = new Uint8Array(8)
+  // @NOTE Assigning to an uint8 will only keep the last 8 int bits
+  arr[7] = num |= 0
+  arr[6] = num >>= 8
+  arr[5] = num >>= 8
+  arr[4] = num >>= 8
+  arr[3] = num >>= 8
+  arr[2] = num >>= 8
+  arr[1] = num >>= 8
+  arr[0] = num >>= 8
+  return arr
 }

package/src/errors/handle-unavailable-error.ts

@@ -0,0 +1,18 @@
+import { OAuthError } from './oauth-error.js'
+
+export class HandleUnavailableError extends OAuthError {
+  constructor(
+    readonly reason: 'syntax' | 'domain' | 'slur' | 'taken',
+    details: string = 'That handle is not available',
+    cause?: unknown,
+  ) {
+    super('handle_unavailable', details, 400, cause)
+  }
+
+  toJSON() {
+    return {
+      ...super.toJSON(),
+      reason: this.reason,
+    } as const
+  }
+}

package/src/errors/invalid-request-error.ts

@@ -2,23 +2,20 @@ import { OAuthError } from './oauth-error.js'
 
 /**
  * @see
- * {@link https://datatracker.ietf.org/doc/html/rfc6749#section-5.2 | RFC6749 - Issuing an Access Token }
- *
- * The request is missing a required parameter, includes an unsupported
+ * {@link https://datatracker.ietf.org/doc/html/rfc6749#section-5.2 | RFC6749 - Issuing an Access Token}
+ * : The request is missing a required parameter, includes an unsupported
  * parameter value (other than grant type), repeats a parameter, includes
  * multiple credentials, utilizes more than one mechanism for authenticating the
  * client, or is otherwise malformed.
  *
  * @see
  * {@link https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2.1 | RFC6749 - Authorization Code Grant, Authorization Request}
- *
- * The request is missing a required parameter, includes an invalid parameter
+ * : The request is missing a required parameter, includes an invalid parameter
  * value, includes a parameter more than once, or is otherwise malformed.
  *
  * @see
- * {@link https://datatracker.ietf.org/doc/html/rfc6750#section-3.1 | RFC6750 - The WWW-Authenticate Response Header Field }
- *
- * The request is missing a required parameter, includes an unsupported
+ * {@link https://datatracker.ietf.org/doc/html/rfc6750#section-3.1 | RFC6750 - The WWW-Authenticate Response Header Field}
+ * : The request is missing a required parameter, includes an unsupported
  * parameter or parameter value, repeats the same parameter, uses more than one
  * method for including an access token, or is otherwise malformed. The resource
  * server SHOULD respond with the HTTP 400 (Bad Request) status code.
@@ -27,4 +24,9 @@ export class InvalidRequestError extends OAuthError {
   constructor(error_description: string, cause?: unknown) {
     super('invalid_request', error_description, 400, cause)
   }
+
+  static from(err: unknown, message = 'Invalid request data'): OAuthError {
+    if (err instanceof OAuthError) return err
+    return new InvalidRequestError(message, err)
+  }
 }

package/src/lib/csp/index.ts

@@ -0,0 +1,98 @@
+import { Simplify } from '../util/type.js'
+
+export type CspValue =
+  | `data:`
+  | `https:${string}`
+  | `'none'`
+  | `'self'`
+  | `'sha256-${string}'`
+  | `'nonce-${string}'`
+  | `'unsafe-inline'`
+  | `'unsafe-eval'`
+  | `'strict-dynamic'`
+  | `'report-sample'`
+  | `'unsafe-hashes'`
+
+const STRING_DIRECTIVES = ['base-uri'] as const
+const BOOLEAN_DIRECTIVES = [
+  'upgrade-insecure-requests',
+  'block-all-mixed-content',
+] as const
+const ARRAY_DIRECTIVES = [
+  'connect-src',
+  'default-src',
+  'form-action',
+  'frame-ancestors',
+  'frame-src',
+  'img-src',
+  'script-src',
+  'style-src',
+] as const
+
+export type CspConfig = Simplify<
+  {
+    [K in (typeof BOOLEAN_DIRECTIVES)[number]]?: boolean
+  } & {
+    [K in (typeof STRING_DIRECTIVES)[number]]?: CspValue
+  } & {
+    [K in (typeof ARRAY_DIRECTIVES)[number]]?: readonly CspValue[]
+  }
+>
+
+const NONE = "'none'"
+
+export function buildCsp(config: CspConfig): string {
+  const values: string[] = []
+
+  for (const name of BOOLEAN_DIRECTIVES) {
+    if (config[name] === true) values.push(name)
+  }
+
+  for (const name of STRING_DIRECTIVES) {
+    if (config[name]) values.push(`${name} ${config[name]}`)
+  }
+
+  for (const name of ARRAY_DIRECTIVES) {
+    if (config[name]?.length) values.push(`${name} ${config[name].join(' ')}`)
+  }
+
+  return values.join('; ')
+}
+
+export function mergeCsp(a: CspConfig, b?: CspConfig): CspConfig
+export function mergeCsp(a: CspConfig | undefined, b: CspConfig): CspConfig
+export function mergeCsp(a?: CspConfig, b?: CspConfig): CspConfig | undefined
+export function mergeCsp(a?: CspConfig, b?: CspConfig): CspConfig | undefined {
+  if (!a) return b
+  if (!b) return a
+
+  const result: CspConfig = {}
+
+  for (const name of BOOLEAN_DIRECTIVES) {
+    if (a[name] || b[name]) {
+      result[name] = true
+    }
+  }
+
+  for (const name of STRING_DIRECTIVES) {
+    if (a[name] || b[name]) {
+      const aNotNone = a[name] === NONE ? undefined : a[name]
+      const bNotNone = b[name] === NONE ? undefined : b[name]
+      // @NOTE b takes precedence
+      result[name] = bNotNone || aNotNone || NONE
+    }
+  }
+
+  for (const name of ARRAY_DIRECTIVES) {
+    if (a[name] && b[name]) {
+      const set = new Set(a[name])
+      if (b[name]) for (const value of b[name]) set.add(value)
+      if (set.size > 1 && set.has(NONE)) set.delete(NONE)
+      result[name] = [...set]
+    } else if (a[name] || b[name]) {
+      result[name] = Array.from((a[name] || b[name])!)
+    }
+  }
+
+  return result
+}