@atproto/oauth-scopes 0.0.2 → 0.2.0

package/dist/scopes/rpc-permission.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RpcPermission = exports.isAudParam = exports.isLxmParam = exports.isNsid = exports.isAtprotoAudience = void 0;
+const did_1 = require("@atproto/did");
+Object.defineProperty(exports, "isAtprotoAudience", { enumerable: true, get: function () { return did_1.isAtprotoAudience; } });
+const nsid_js_1 = require("../lib/nsid.js");
+Object.defineProperty(exports, "isNsid", { enumerable: true, get: function () { return nsid_js_1.isNsid; } });
+const parser_js_1 = require("../lib/parser.js");
+const syntax_string_js_1 = require("../lib/syntax-string.js");
+const syntax_js_1 = require("../lib/syntax.js");
+const isLxmParam = (value) => value === '*' || (0, nsid_js_1.isNsid)(value);
+exports.isLxmParam = isLxmParam;
+const isAudParam = (value) => value === '*' || (0, did_1.isAtprotoAudience)(value);
+exports.isAudParam = isAudParam;
+class RpcPermission {
+    constructor(aud, lxm) {
+        Object.defineProperty(this, "aud", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: aud
+        });
+        Object.defineProperty(this, "lxm", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: lxm
+        });
+    }
+    matches(options) {
+        const { aud, lxm } = this;
+        return ((aud === '*' || aud === options.aud) &&
+            (lxm.includes('*') || lxm.includes(options.lxm)));
+    }
+    toString() {
+        return RpcPermission.parser.format(this);
+    }
+    static fromString(scope) {
+        if (!(0, syntax_js_1.isScopeStringFor)(scope, 'rpc'))
+            return null;
+        const syntax = syntax_string_js_1.ScopeStringSyntax.fromString(scope);
+        return RpcPermission.fromSyntax(syntax);
+    }
+    static fromSyntax(syntax) {
+        const result = RpcPermission.parser.parse(syntax);
+        if (!result)
+            return null;
+        // rpc:*?aud=* is forbidden
+        if (result.aud === '*' && result.lxm.includes('*'))
+            return null;
+        return new RpcPermission(result.aud, result.lxm);
+    }
+    static scopeNeededFor(options) {
+        return RpcPermission.parser.format({
+            aud: options.aud,
+            lxm: [options.lxm],
+        });
+    }
+}
+exports.RpcPermission = RpcPermission;
+Object.defineProperty(RpcPermission, "parser", {
+    enumerable: true,
+    configurable: true,
+    writable: true,
+    value: new parser_js_1.Parser('rpc', {
+        lxm: {
+            multiple: true,
+            required: true,
+            validate: exports.isLxmParam,
+            normalize: (value) => value.length > 1 && value.includes('*')
+                ? ['*']
+                : [...new Set(value)].sort(),
+        },
+        aud: {
+            multiple: false,
+            required: true,
+            validate: exports.isAudParam,
+        },
+    }, 'lxm')
+});
+//# sourceMappingURL=rpc-permission.js.map

package/dist/scopes/rpc-permission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rpc-permission.js","sourceRoot":"","sources":["../../src/scopes/rpc-permission.ts"],"names":[],"mappings":";;;AAAA,sCAAiE;AAOvB,kGAPhB,uBAAiB,OAOgB;AAN3D,4CAA6C;AAMgB,uFAN9C,gBAAM,OAM8C;AALnE,gDAAyC;AAEzC,8DAA2D;AAC3D,gDAA2E;AAKpE,MAAM,UAAU,GAAG,CAAC,KAAc,EAAqB,EAAE,CAC9D,KAAK,KAAK,GAAG,IAAI,IAAA,gBAAM,EAAC,KAAK,CAAC,CAAA;AADnB,QAAA,UAAU,cACS;AAEzB,MAAM,UAAU,GAAG,CAAC,KAAc,EAAqB,EAAE,CAC9D,KAAK,KAAK,GAAG,IAAI,IAAA,uBAAiB,EAAC,KAAK,CAAC,CAAA;AAD9B,QAAA,UAAU,cACoB;AAO3C,MAAa,aAAa;IAGxB,YACkB,GAA0B,EAC1B,GAA0B;QAD1C;;;;mBAAgB,GAAG;WAAuB;QAC1C;;;;mBAAgB,GAAG;WAAuB;IACzC,CAAC;IAEJ,OAAO,CAAC,OAA2B;QACjC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;QACzB,OAAO,CACL,CAAC,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC;YACpC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAK,GAAyB,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CACxE,CAAA;IACH,CAAC;IAED,QAAQ;QACN,OAAO,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAC1C,CAAC;IAuBD,MAAM,CAAC,UAAU,CAAC,KAAa;QAC7B,IAAI,CAAC,IAAA,4BAAgB,EAAC,KAAK,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QAChD,MAAM,MAAM,GAAG,oCAAiB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QAClD,OAAO,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IACzC,CAAC;IAED,MAAM,CAAC,UAAU,CAAC,MAA0B;QAC1C,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACjD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QAExB,2BAA2B;QAC3B,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAA;QAE/D,OAAO,IAAI,aAAa,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAA;IAClD,CAAC;IAED,MAAM,CAAC,cAAc,CAAC,OAA2B;QAC/C,OAAO,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC;YACjC,GAAG,EAAE,OAAO,CAAC,GAAsB;YACnC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAW,CAAC;SAC3B,CAAC,CAAA;IACJ,CAAC;;AA9DH,sCA+DC;AA3C2B;;;;WAAS,IAAI,kBAAM,CAC3C,KAAK,EACL;QACE,GAAG,EAAE;YACH,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,kBAAU;YACpB,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CACnB,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;gBACrC,CAAC,CAAE,CAAC,GAAG,CAAW;gBAClB,CAAC,CAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAwB;SACxD;QACD,GAAG,EAAE;YACH,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,kBAAU;SACrB;KACF,EACD,KAAK,CACN;EAnB+B,CAmB/B"}

package/dist/scopes-set.d.ts

@@ -1,6 +1,17 @@
 import { ScopeMissingError } from './scope-missing-error.js';
-import { ScopeMatchingOptionsByResource } from './utilities.js';
+import { AccountPermissionMatch } from './scopes/account-permission.js';
+import { BlobPermissionMatch } from './scopes/blob-permission.js';
+import { IdentityPermissionMatch } from './scopes/identity-permission.js';
+import { RepoPermissionMatch } from './scopes/repo-permission.js';
+import { RpcPermissionMatch } from './scopes/rpc-permission.js';
 export { ScopeMissingError };
+export type ScopeMatchingOptionsByResource = {
+    account: AccountPermissionMatch;
+    identity: IdentityPermissionMatch;
+    repo: RepoPermissionMatch;
+    rpc: RpcPermissionMatch;
+    blob: BlobPermissionMatch;
+};
 /**
  * Utility class to manage a set of scopes and check if they match specific
  * options for a given resource.

package/dist/scopes-set.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scopes-set.d.ts","sourceRoot":"","sources":["../src/scopes-set.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC5D,OAAO,EACL,8BAA8B,EAG/B,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,iBAAiB,EAAE,CAAA;AAE5B;;;GAGG;AACH,qBAAa,SAAU,SAAQ,GAAG,CAAC,MAAM,CAAC;IACxC;;;OAGG;IACI,OAAO,CAAC,CAAC,SAAS,MAAM,8BAA8B,EAC3D,QAAQ,EAAE,CAAC,EACX,OAAO,EAAE,8BAA8B,CAAC,CAAC,CAAC,GACzC,OAAO;IAOH,MAAM,CAAC,CAAC,SAAS,MAAM,8BAA8B,EAC1D,QAAQ,EAAE,CAAC,EACX,OAAO,EAAE,8BAA8B,CAAC,CAAC,CAAC;IAQrC,IAAI,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO;IAK7C,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO;IAK7C,MAAM,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO;IAIrC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,CAAC;IAIvC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS;CAG9C"}
+{"version":3,"file":"scopes-set.d.ts","sourceRoot":"","sources":["../src/scopes-set.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC5D,OAAO,EAEL,sBAAsB,EACvB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAEL,mBAAmB,EACpB,MAAM,6BAA6B,CAAA;AACpC,OAAO,EAEL,uBAAuB,EACxB,MAAM,iCAAiC,CAAA;AACxC,OAAO,EAEL,mBAAmB,EACpB,MAAM,6BAA6B,CAAA;AACpC,OAAO,EAAiB,kBAAkB,EAAE,MAAM,4BAA4B,CAAA;AAE9E,OAAO,EAAE,iBAAiB,EAAE,CAAA;AAE5B,MAAM,MAAM,8BAA8B,GAAG;IAC3C,OAAO,EAAE,sBAAsB,CAAA;IAC/B,QAAQ,EAAE,uBAAuB,CAAA;IACjC,IAAI,EAAE,mBAAmB,CAAA;IACzB,GAAG,EAAE,kBAAkB,CAAA;IACvB,IAAI,EAAE,mBAAmB,CAAA;CAC1B,CAAA;AAED;;;GAGG;AACH,qBAAa,SAAU,SAAQ,GAAG,CAAC,MAAM,CAAC;IACxC;;;OAGG;IACI,OAAO,CAAC,CAAC,SAAS,MAAM,8BAA8B,EAC3D,QAAQ,EAAE,CAAC,EACX,OAAO,EAAE,8BAA8B,CAAC,CAAC,CAAC,GACzC,OAAO;IAOH,MAAM,CAAC,CAAC,SAAS,MAAM,8BAA8B,EAC1D,QAAQ,EAAE,CAAC,EACX,OAAO,EAAE,8BAA8B,CAAC,CAAC,CAAC;IAQrC,IAAI,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO;IAK7C,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO;IAK7C,MAAM,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO;IAIrC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,CAAC;IAIvC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS;CAG9C"}

package/dist/scopes-set.js

@@ -3,7 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ScopesSet = exports.ScopeMissingError = void 0;
 const scope_missing_error_js_1 = require("./scope-missing-error.js");
 Object.defineProperty(exports, "ScopeMissingError", { enumerable: true, get: function () { return scope_missing_error_js_1.ScopeMissingError; } });
-const utilities_js_1 = require("./utilities.js");
+const account_permission_js_1 = require("./scopes/account-permission.js");
+const blob_permission_js_1 = require("./scopes/blob-permission.js");
+const identity_permission_js_1 = require("./scopes/identity-permission.js");
+const repo_permission_js_1 = require("./scopes/repo-permission.js");
+const rpc_permission_js_1 = require("./scopes/rpc-permission.js");
 /**
  * Utility class to manage a set of scopes and check if they match specific
  * options for a given resource.
@@ -15,14 +19,14 @@ class ScopesSet extends Set {
      */
     matches(resource, options) {
         for (const scope of this) {
-            if ((0, utilities_js_1.scopeMatches)(scope, resource, options))
+            if (permissionScopeMatches(scope, resource, options))
                 return true;
         }
         return false;
     }
     assert(resource, options) {
         if (!this.matches(resource, options)) {
-            const scope = (0, utilities_js_1.scopeNeededFor)(resource, options);
+            const scope = scopeNeededFor(resource, options);
             throw new scope_missing_error_js_1.ScopeMissingError(scope);
         }
     }
@@ -52,4 +56,46 @@ class ScopesSet extends Set {
     }
 }
 exports.ScopesSet = ScopesSet;
+function scopeNeededFor(resource, options) {
+    switch (resource) {
+        case 'account':
+            return account_permission_js_1.AccountPermission.scopeNeededFor(options);
+        case 'identity':
+            return identity_permission_js_1.IdentityPermission.scopeNeededFor(options);
+        case 'repo':
+            return repo_permission_js_1.RepoPermission.scopeNeededFor(options);
+        case 'rpc':
+            return rpc_permission_js_1.RpcPermission.scopeNeededFor(options);
+        case 'blob':
+            return blob_permission_js_1.BlobPermission.scopeNeededFor(options);
+    }
+    // @ts-expect-error
+    throw new TypeError(`Unknown resource: ${resource}`);
+}
+function permissionScopeMatches(scope, resource, options) {
+    // @NOTE we might want to cache the parsed scopes though, in practice, a
+    // single scope is unlikely to be parsed multiple times during a single
+    // request.
+    const permission = parsePermissionScope(resource, scope);
+    if (!permission)
+        return false;
+    // @ts-expect-error
+    return permission.matches(options);
+}
+function parsePermissionScope(resource, scope) {
+    switch (resource) {
+        case 'account':
+            return account_permission_js_1.AccountPermission.fromString(scope);
+        case 'identity':
+            return identity_permission_js_1.IdentityPermission.fromString(scope);
+        case 'repo':
+            return repo_permission_js_1.RepoPermission.fromString(scope);
+        case 'rpc':
+            return rpc_permission_js_1.RpcPermission.fromString(scope);
+        case 'blob':
+            return blob_permission_js_1.BlobPermission.fromString(scope);
+        default:
+            return null;
+    }
+}
 //# sourceMappingURL=scopes-set.js.map

package/dist/scopes-set.js.map

@@ -1 +1 @@
-{"version":3,"file":"scopes-set.js","sourceRoot":"","sources":["../src/scopes-set.ts"],"names":[],"mappings":";;;AAAA,qEAA4D;AAOnD,kGAPA,0CAAiB,OAOA;AAN1B,iDAIuB;AAIvB;;;GAGG;AACH,MAAa,SAAU,SAAQ,GAAW;IACxC;;;OAGG;IACI,OAAO,CACZ,QAAW,EACX,OAA0C;QAE1C,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;YACzB,IAAI,IAAA,2BAAY,EAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAA;QACzD,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAEM,MAAM,CACX,QAAW,EACX,OAA0C;QAE1C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,IAAA,6BAAc,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;YAC/C,MAAM,IAAI,0CAAiB,CAAC,KAAK,CAAC,CAAA;QACpC,CAAC;IACH,CAAC;IAEM,IAAI,CAAC,EAA8B;QACxC,KAAK,MAAM,KAAK,IAAI,IAAI;YAAE,IAAI,EAAE,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAA;QACpD,OAAO,KAAK,CAAA;IACd,CAAC;IAEM,KAAK,CAAC,EAA8B;QACzC,KAAK,MAAM,KAAK,IAAI,IAAI;YAAE,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAA;QACtD,OAAO,IAAI,CAAA;IACb,CAAC;IAEM,CAAC,MAAM,CAAC,EAA8B;QAC3C,KAAK,MAAM,KAAK,IAAI,IAAI;YAAE,IAAI,EAAE,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAA;IACtD,CAAC;IAEM,CAAC,GAAG,CAAI,EAAwB;QACrC,KAAK,MAAM,KAAK,IAAI,IAAI;YAAE,MAAM,EAAE,CAAC,KAAK,CAAC,CAAA;IAC3C,CAAC;IAED,MAAM,CAAC,UAAU,CAAC,MAAe;QAC/B,OAAO,IAAI,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;IAC1C,CAAC;CACF;AA9CD,8BA8CC"}
+{"version":3,"file":"scopes-set.js","sourceRoot":"","sources":["../src/scopes-set.ts"],"names":[],"mappings":";;;AAAA,qEAA4D;AAmBnD,kGAnBA,0CAAiB,OAmBA;AAlB1B,0EAGuC;AACvC,oEAGoC;AACpC,4EAGwC;AACxC,oEAGoC;AACpC,kEAA8E;AAY9E;;;GAGG;AACH,MAAa,SAAU,SAAQ,GAAW;IACxC;;;OAGG;IACI,OAAO,CACZ,QAAW,EACX,OAA0C;QAE1C,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;YACzB,IAAI,sBAAsB,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAA;QACnE,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAEM,MAAM,CACX,QAAW,EACX,OAA0C;QAE1C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;YAC/C,MAAM,IAAI,0CAAiB,CAAC,KAAK,CAAC,CAAA;QACpC,CAAC;IACH,CAAC;IAEM,IAAI,CAAC,EAA8B;QACxC,KAAK,MAAM,KAAK,IAAI,IAAI;YAAE,IAAI,EAAE,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAA;QACpD,OAAO,KAAK,CAAA;IACd,CAAC;IAEM,KAAK,CAAC,EAA8B;QACzC,KAAK,MAAM,KAAK,IAAI,IAAI;YAAE,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAA;QACtD,OAAO,IAAI,CAAA;IACb,CAAC;IAEM,CAAC,MAAM,CAAC,EAA8B;QAC3C,KAAK,MAAM,KAAK,IAAI,IAAI;YAAE,IAAI,EAAE,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAA;IACtD,CAAC;IAEM,CAAC,GAAG,CAAI,EAAwB;QACrC,KAAK,MAAM,KAAK,IAAI,IAAI;YAAE,MAAM,EAAE,CAAC,KAAK,CAAC,CAAA;IAC3C,CAAC;IAED,MAAM,CAAC,UAAU,CAAC,MAAe;QAC/B,OAAO,IAAI,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;IAC1C,CAAC;CACF;AA9CD,8BA8CC;AAED,SAAS,cAAc,CACrB,QAAW,EACX,OAA0C;IAE1C,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,SAAS;YACZ,OAAO,yCAAiB,CAAC,cAAc,CAAC,OAAiC,CAAC,CAAA;QAC5E,KAAK,UAAU;YACb,OAAO,2CAAkB,CAAC,cAAc,CACtC,OAAkC,CACnC,CAAA;QACH,KAAK,MAAM;YACT,OAAO,mCAAc,CAAC,cAAc,CAAC,OAA8B,CAAC,CAAA;QACtE,KAAK,KAAK;YACR,OAAO,iCAAa,CAAC,cAAc,CAAC,OAA6B,CAAC,CAAA;QACpE,KAAK,MAAM;YACT,OAAO,mCAAc,CAAC,cAAc,CAAC,OAA8B,CAAC,CAAA;IACxE,CAAC;IACD,mBAAmB;IACnB,MAAM,IAAI,SAAS,CAAC,qBAAqB,QAAQ,EAAE,CAAC,CAAA;AACtD,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAAa,EACb,QAAW,EACX,OAA0C;IAE1C,wEAAwE;IACxE,uEAAuE;IACvE,WAAW;IACX,MAAM,UAAU,GAAG,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IACxD,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAA;IAE7B,mBAAmB;IACnB,OAAO,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;AACpC,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAgB,EAAE,KAAa;IAC3D,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,SAAS;YACZ,OAAO,yCAAiB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QAC5C,KAAK,UAAU;YACb,OAAO,2CAAkB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QAC7C,KAAK,MAAM;YACT,OAAO,mCAAc,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QACzC,KAAK,KAAK;YACR,OAAO,iCAAa,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QACxC,KAAK,MAAM;YACT,OAAO,mCAAc,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QACzC;YACE,OAAO,IAAI,CAAA;IACf,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atproto/oauth-scopes",
-  "version": "0.0.2",
+  "version": "0.2.0",
   "license": "MIT",
   "description": "A library for manipulating and validating ATproto OAuth scopes in TypeScript.",
   "keywords": [
@@ -24,13 +24,17 @@
       "default": "./dist/index.js"
     }
   },
-  "dependencies": {},
+  "dependencies": {
+    "@atproto/did": "^0.2.0",
+    "@atproto/lexicon": "^0.5.1",
+    "@atproto/syntax": "^0.4.1"
+  },
   "devDependencies": {
     "jest": "^28.1.2",
     "typescript": "^5.6.3"
   },
   "scripts": {
-    "build": "tsc --build tsconfig.json",
+    "build": "tsc --build tsconfig.build.json",
     "test": "jest"
   }
 }

package/src/atproto-oauth-scope.ts

@@ -0,0 +1,79 @@
+import { ScopeStringFor, isScopeStringFor } from './lib/syntax.js'
+import { isNonNullable } from './lib/util.js'
+import { AccountPermission } from './scopes/account-permission.js'
+import { BlobPermission } from './scopes/blob-permission.js'
+import { IdentityPermission } from './scopes/identity-permission.js'
+import { IncludeScope } from './scopes/include-scope.js'
+import { RepoPermission } from './scopes/repo-permission.js'
+import { RpcPermission } from './scopes/rpc-permission.js'
+
+export { type ScopeStringFor, isScopeStringFor }
+
+export const STATIC_SCOPE_VALUES = Object.freeze([
+  'atproto',
+  'transition:email',
+  'transition:generic',
+  'transition:chat.bsky',
+] as const)
+
+export type StaticScopeValue = (typeof STATIC_SCOPE_VALUES)[number]
+export function isStaticScopeValue(value: string): value is StaticScopeValue {
+  return (STATIC_SCOPE_VALUES as readonly string[]).includes(value)
+}
+
+export type AtprotoOauthScope =
+  | StaticScopeValue
+  | ScopeStringFor<'account'>
+  | ScopeStringFor<'blob'>
+  | ScopeStringFor<'identity'>
+  | ScopeStringFor<'include'>
+  | ScopeStringFor<'repo'>
+  | ScopeStringFor<'rpc'>
+
+/**
+ * @note This function does not only verify the scope string format (with
+ * {@link isScopeStringFor}), but also checks if the provided parameters are
+ * valid according to the respective scope syntax definition. This allows
+ * excluding scopes that cannot be fully interpreted by the current version of
+ * the code.
+ */
+export function isAtprotoOauthScope(value: string): value is AtprotoOauthScope {
+  return (
+    isStaticScopeValue(value) ||
+    AccountPermission.fromString(value) != null ||
+    BlobPermission.fromString(value) != null ||
+    IdentityPermission.fromString(value) != null ||
+    IncludeScope.fromString(value) != null ||
+    RepoPermission.fromString(value) != null ||
+    RpcPermission.fromString(value) != null
+  )
+}
+
+export function normalizeAtprotoOauthScope(scope: string) {
+  return scope
+    .split(' ')
+    .map(normalizeAtprotoOauthScopeValue)
+    .filter(isNonNullable)
+    .sort()
+    .join(' ')
+}
+
+export function normalizeAtprotoOauthScopeValue(
+  value: string,
+): AtprotoOauthScope | null {
+  if (isStaticScopeValue(value)) return value
+
+  for (const Scope of [
+    AccountPermission,
+    BlobPermission,
+    IdentityPermission,
+    IncludeScope,
+    RepoPermission,
+    RpcPermission,
+  ]) {
+    const parsed = Scope.fromString(value)
+    if (parsed) return parsed.toString()
+  }
+
+  return null
+}

package/src/index.ts

@@ -1,17 +1,13 @@
+export * from './atproto-oauth-scope.js'
+
 export * from './scope-missing-error.js'
-export * from './permission-set.js'
-export * from './permission-set-transition.js'
+export * from './scope-permissions-transition.js'
+export * from './scope-permissions.js'
 export * from './scopes-set.js'
-export * from './parser.js'
-export * from './syntax.js'
-export * from './utilities.js'
-
-export * from './resources/account-scope.js'
-export * from './resources/blob-scope.js'
-export * from './resources/identity-scope.js'
-export * from './resources/repo-scope.js'
-export * from './resources/rpc-scope.js'
 
-export * from './lib/mime.js'
-export * from './lib/did.js'
-export * from './lib/nsid.js'
+export * from './scopes/account-permission.js'
+export * from './scopes/blob-permission.js'
+export * from './scopes/identity-permission.js'
+export * from './scopes/include-scope.js'
+export * from './scopes/repo-permission.js'
+export * from './scopes/rpc-permission.js'

package/src/lib/lexicon.ts

@@ -0,0 +1 @@
+export type { LexPermission, LexPermissionSet } from '@atproto/lexicon'

package/src/lib/mime.ts

@@ -20,7 +20,8 @@ export function isMime(value: string): value is Mime {
 
 export type Accept = '*/*' | `${string}/*` | Mime
 
-export function isAccept(value: string): value is Accept {
+export function isAccept(value: unknown): value is Accept {
+  if (typeof value !== 'string') return false
   if (value === '*/*') return true // Fast path for the most common case
   if (!isStringSlashString(value)) return false
   return !value.includes('*') || value.endsWith('/*')

package/src/lib/nsid.ts

@@ -1,6 +1,5 @@
-export type NSID = `${string}.${string}`
-export const isNSID = (value: string): value is NSID =>
-  value.includes('.') &&
-  !value.includes(' ') &&
-  !value.startsWith('.') &&
-  !value.endsWith('.')
+import { isValidNsid } from '@atproto/syntax'
+
+export type Nsid = `${string}.${string}.${string}`
+export const isNsid = (v: unknown): v is Nsid =>
+  typeof v === 'string' && isValidNsid(v)

package/src/lib/parser.ts

@@ -0,0 +1,176 @@
+import { ScopeStringSyntax } from './syntax-string.js'
+import { NeRoArray, ParamValue, ScopeSyntax } from './syntax.js'
+
+type InferParamPredicate<T extends (value: ParamValue) => boolean> =
+  T extends ((value: ParamValue) => value is infer U extends ParamValue)
+    ? U
+    : ParamValue
+
+type ParamsSchema = Record<
+  string,
+  | {
+      multiple: false
+      required: boolean
+      default?: ParamValue
+      normalize?: (value: ParamValue) => ParamValue
+      validate: (value: ParamValue) => boolean
+    }
+  | {
+      multiple: true
+      required: boolean
+      default?: NeRoArray<ParamValue>
+      normalize?: (value: NeRoArray<ParamValue>) => NeRoArray<ParamValue>
+      validate: (value: ParamValue) => boolean
+    }
+>
+
+type InferParams<S extends ParamsSchema> = {
+  [K in keyof S]:
+    | (S[K]['required'] extends true
+        ? never
+        : 'default' extends keyof S[K]
+          ? S[K]['default']
+          : undefined)
+    | (S[K]['multiple'] extends true
+        ? NeRoArray<InferParamPredicate<S[K]['validate']>>
+        : InferParamPredicate<S[K]['validate']>)
+} & NonNullable<unknown>
+
+export class Parser<P extends string, S extends ParamsSchema> {
+  public readonly schemaKeys: ReadonlySet<keyof S & string>
+
+  constructor(
+    public readonly prefix: P,
+    public readonly schema: S,
+    public readonly positionalName?: keyof S & string,
+  ) {
+    this.schemaKeys = new Set(Object.keys(schema))
+  }
+
+  format(values: InferParams<S>) {
+    const params = new URLSearchParams()
+    let positional: string | undefined = undefined
+
+    for (const key of this.schemaKeys) {
+      const value = values[key]
+      // Ignore undefined values
+      if (value === undefined) continue
+
+      const schema = this.schema[key]
+
+      // Normalize the value if a normalization function is provided
+      const normalized = schema.normalize
+        ? schema.normalize(value as any)
+        : value
+
+      // Ignore values that are equal to the default value
+      if (!schema.required) {
+        if (schema.default === normalized) continue
+        if (
+          schema.multiple &&
+          schema.default &&
+          arrayParamEquals(schema.default, normalized as NeRoArray<string>)
+        ) {
+          continue
+        }
+      }
+
+      if (Array.isArray(normalized)) {
+        if (key === this.positionalName && normalized.length === 1) {
+          positional = String(normalized[0]!)
+        } else {
+          // remove duplicates
+          const unique = new Set(normalized.map(String))
+          for (const v of unique) params.append(key, v)
+        }
+      } else {
+        if (key === this.positionalName) {
+          positional = String(normalized)
+        } else {
+          params.set(key, String(normalized))
+        }
+      }
+    }
+
+    return new ScopeStringSyntax(this.prefix, positional, params).toString()
+  }
+
+  // @NOTE If we needed to ever have more detailed reason as to why parsing
+  // fails, this function could easily be updated to return a
+  // ValidationResult<T> type that explains the reason for failure.
+  parse(syntax: ScopeSyntax<P>) {
+    // @NOTE no need to check prefix, since the typing (P generic) already
+    // ensures it matches
+
+    for (const key of syntax.keys()) {
+      if (!this.schemaKeys.has(key)) return null
+    }
+
+    const result: Record<
+      string,
+      undefined | ParamValue | NeRoArray<ParamValue>
+    > = Object.create(null)
+
+    for (const key of this.schemaKeys) {
+      const definition = this.schema[key]
+
+      const param = definition.multiple
+        ? syntax.getMulti(key)
+        : syntax.getSingle(key)
+
+      if (param === null) {
+        return null // Value is not valid
+      } else if (param !== undefined) {
+        if (key === this.positionalName && syntax.positional !== undefined) {
+          // Positional parameter cannot be used with named parameters
+          return null
+        }
+
+        if (definition.multiple) {
+          // Empty array is not valid
+          if (!(param as ParamValue[]).length) return null
+          if (!(param as ParamValue[]).every(definition.validate)) {
+            return null
+          }
+        } else {
+          if (!definition.validate(param as ParamValue)) {
+            return null
+          }
+        }
+
+        result[key] = param as ParamValue | NeRoArray<ParamValue>
+      } else if (
+        key === this.positionalName &&
+        syntax.positional !== undefined
+      ) {
+        // No named parameters found, but there is a positional parameter
+        const { positional } = syntax
+        if (!definition.validate(positional)) {
+          return null
+        }
+        result[key] = definition.multiple ? [positional] : positional
+      } else if (definition.required) {
+        return null
+      } else {
+        result[key] = definition.default
+      }
+    }
+
+    return result as InferParams<S>
+  }
+}
+
+/**
+ * Two param arrays are considered equal if they contain the same values,
+ * regardless of the order and duplicates.
+ * @param a - The first array to compare.
+ * @param b - The second array to compare.
+ */
+function arrayParamEquals(
+  a: readonly unknown[],
+  b: readonly unknown[],
+): boolean {
+  for (const item of a) if (!b.includes(item)) return false
+  for (const item of b) if (!a.includes(item)) return false
+  return true
+}

package/src/lib/resource-permission.ts

@@ -0,0 +1,10 @@
+import { ScopeStringFor } from './syntax.js'
+import { Matchable } from './util.js'
+
+/**
+ * Interface destined to provide consistency across parsed permission scopes for
+ * resources (blob, repo, etc.).
+ */
+export interface ResourcePermission<R extends string, T> extends Matchable<T> {
+  toString(): ScopeStringFor<R>
+}

package/src/lib/syntax-lexicon.ts

@@ -0,0 +1,55 @@
+import { LexPermission } from './lexicon.js'
+import { ScopeSyntax } from './syntax.js'
+
+/**
+ * Translates a {@link LexPermission} into a {@link ScopeSyntax}.
+ */
+export class LexPermissionSyntax<P extends string = string>
+  implements ScopeSyntax<P>
+{
+  constructor(
+    readonly lexPermission: Readonly<LexPermission & { resource: P }>,
+  ) {}
+
+  get prefix() {
+    return this.lexPermission.resource
+  }
+
+  get positional() {
+    return undefined
+  }
+
+  get(key: string) {
+    // Ignore reserved keywords
+    if (key === 'type') return undefined
+    if (key === 'resource') return undefined
+
+    // Ignore inherited properties (toString(), etc.)
+    if (!Object.hasOwn(this.lexPermission, key)) return undefined
+
+    return this.lexPermission[key]
+  }
+
+  *keys() {
+    for (const key of Object.keys(this.lexPermission)) {
+      if (this.get(key) !== undefined) yield key
+    }
+  }
+
+  getSingle(key: string) {
+    const value = this.get(key)
+    if (Array.isArray(value)) return null
+    return value
+  }
+
+  getMulti(key: string) {
+    const value = this.get(key)
+    if (value === undefined) return undefined
+    if (!Array.isArray(value)) return null
+    return value
+  }
+
+  toJSON() {
+    return this.lexPermission
+  }
+}