@atproto/oauth-scopes 0.5.2 → 0.5.3

package/src/scopes/rpc-permission.test.ts

@@ -1,323 +0,0 @@
-import { RpcPermission } from './rpc-permission.js'
-
-describe('RpcPermission', () => {
-  describe('static', () => {
-    describe('fromString', () => {
-      it('should parse positional scope', () => {
-        const scope = RpcPermission.fromString(
-          'rpc:com.example.service?aud=did:web:example.com%23service_id',
-        )
-        expect(scope).not.toBeNull()
-        expect(scope!.aud).toBe('did:web:example.com#service_id')
-        expect(scope!.lxm).toEqual(['com.example.service'])
-      })
-
-      it('should parse strings correctly', () => {
-        expect(
-          RpcPermission.fromString('rpc?lxm=com.example.method1&aud=*'),
-        ).toEqual({
-          aud: '*',
-          lxm: ['com.example.method1'],
-        })
-        expect(
-          RpcPermission.fromString('rpc:com.example.method1?aud=*'),
-        ).toEqual({
-          aud: '*',
-          lxm: ['com.example.method1'],
-        })
-      })
-
-      it('should render strings correctly', () => {
-        expect(
-          new RpcPermission('did:web:example.com#service_id', [
-            'com.example.service',
-          ]).toString(),
-        ).toBe('rpc:com.example.service?aud=did:web:example.com%23service_id')
-        expect(new RpcPermission('*', ['com.example.method1']).toString()).toBe(
-          'rpc:com.example.method1?aud=*',
-        )
-        expect(
-          new RpcPermission('did:web:example.com#service_id', [
-            'com.example.method1',
-            'com.example.method2',
-          ]).toString(),
-        ).toBe(
-          'rpc?lxm=com.example.method1&lxm=com.example.method2&aud=did:web:example.com%23service_id',
-        )
-      })
-
-      it('should reject scopes without lxm', () => {
-        expect(
-          RpcPermission.fromString('rpc?aud=did:web:example.com%23service_id'),
-        ).toBeNull()
-        expect(
-          RpcPermission.fromString('rpc:?aud=did:web:example.com%23service_id'),
-        ).toBeNull()
-      })
-
-      it('should reject scopes without aud', () => {
-        expect(
-          RpcPermission.fromString('rpc?lxm=com.example.method1'),
-        ).toBeNull()
-        expect(RpcPermission.fromString('rpc:com.example.method1')).toBeNull()
-      })
-
-      it('should reject scopes with lxm in both positional and query form', () => {
-        expect(
-          RpcPermission.fromString(
-            'rpc:com.example.method1?aud=did:web:example.com&lxm=com.example.method2',
-          ),
-        ).toBeNull()
-      })
-
-      it('should parse valid rpc scope with multiple lxm', () => {
-        const scope = RpcPermission.fromString(
-          'rpc?aud=*&lxm=com.example.method1&lxm=com.example.method2',
-        )
-        expect(scope).not.toBeNull()
-        expect(scope!.aud).toBe('*')
-        expect(scope!.lxm).toEqual([
-          'com.example.method1',
-          'com.example.method2',
-        ])
-      })
-
-      it('should reject rpc scope without lxm', () => {
-        const scope = RpcPermission.fromString('rpc?aud=did:web:example.com')
-        expect(scope).toBeNull()
-      })
-
-      it('should reject rpc scope without aud', () => {
-        const scope = RpcPermission.fromString('rpc?lxm=com.example.method1')
-        expect(scope).toBeNull()
-      })
-
-      it('should reject any aud/any lxm', () => {
-        expect(RpcPermission.fromString('rpc?aud=*&lxm=*')).toBeNull()
-        expect(RpcPermission.fromString('rpc:*?aud=*')).toBeNull()
-      })
-
-      it('should reject missing aud', () => {
-        expect(RpcPermission.fromString('rpc:com.example.service')).toBeNull()
-      })
-
-      it('should reject invalid aud', () => {
-        expect(
-          RpcPermission.fromString('rpc:com.example.service?aud=invalid'),
-        ).toBeNull()
-      })
-
-      it('should reject invalid lxm', () => {
-        expect(RpcPermission.fromString('rpc:invalid')).toBeNull()
-        expect(RpcPermission.fromString('rpc?lxm=invalid')).toBeNull()
-      })
-
-      for (const invalid of [
-        'rpc:*',
-        'invalid',
-        'rpc:invalid',
-        'rpc:invalid?aud=did:web:example.com',
-        'rpc:invalid?aud=did:web:example.com%23service_id',
-        'rpc:foo.bar',
-        'rpc:com.example.service?aud=did:web:example.com%23service_id&invalid=param',
-        'rpc:foo.bar.baz?aud=did:web',
-        'rpc:foo.bar.baz?aud=did:web%23service_id',
-        'rpc:foo.bar.baz?aud=did:plc:111',
-        'rpc:foo.bar.baz?aud=did:plc:111%23service_id',
-        'rpc:foo.bar.baz?aud=did:foo:bar',
-        'rpc:foo.bar.baz?aud=did:foo:bar%23service_id',
-        'rpc:foo.bar.baz?aud=did:web:example.com%23service_id&lxm=foo.bar.baz',
-        'rpc:foo.bar.baz?aud=invalid',
-        'rpc:foo.bar.baz?aud=invalid',
-        'rpc:invalid?aud=did:web:example.com',
-        'rpc:invalid?aud=did:web:example.com%23service_id',
-        'rpc:com.example.service?aud=invalid',
-        'notrpc:com.example.service?aud=did:web:example.com%23service_id',
-        'rpc?lxm=invalid&aud=invalid',
-      ]) {
-        it(`should return null for invalid rpc scope: ${invalid}`, () => {
-          expect(RpcPermission.fromString(invalid)).toBeNull()
-        })
-      }
-    })
-
-    describe('scopeNeededFor', () => {
-      it('should return correct scope string for specific lxm and aud', () => {
-        const scope = RpcPermission.scopeNeededFor({
-          lxm: 'com.example.service',
-          aud: 'did:web:example.com#service_id',
-        })
-        expect(scope).toBe(
-          'rpc:com.example.service?aud=did:web:example.com%23service_id',
-        )
-      })
-
-      it('should return scope that accepts all aud with specific lxm', () => {
-        const scope = RpcPermission.scopeNeededFor({
-          lxm: 'com.example.method1',
-          aud: '*',
-        })
-        expect(scope).toBe('rpc:com.example.method1?aud=*')
-      })
-    })
-  })
-
-  describe('instance', () => {
-    describe('matches', () => {
-      it('should match exact lxm and aud', () => {
-        const scope = RpcPermission.fromString(
-          'rpc:com.example.service?aud=did:web:example.com%23service_id',
-        )
-        expect(scope).not.toBeNull()
-        expect(
-          scope!.matches({
-            lxm: 'com.example.service',
-            aud: 'did:web:example.com#service_id',
-          }),
-        ).toBe(true)
-      })
-
-      it('should not match different lxm', () => {
-        const scope = RpcPermission.fromString(
-          'rpc:com.example.service?aud=did:web:example.com%23service_id',
-        )
-        expect(scope).not.toBeNull()
-        expect(
-          scope!.matches({
-            lxm: 'com.example.OtherService',
-            aud: 'did:web:example.com#service_id',
-          }),
-        ).toBe(false)
-      })
-
-      it('should not match different aud', () => {
-        const scope = RpcPermission.fromString(
-          'rpc:com.example.service?aud=did:web:example.com%23service_id',
-        )
-        expect(scope).not.toBeNull()
-        expect(
-          scope!.matches({
-            lxm: 'com.example.service',
-            aud: 'did:example:456#service_id',
-          }),
-        ).toBe(false)
-      })
-
-      it('should match wildcard aud', () => {
-        const scope = RpcPermission.fromString('rpc:com.example.method1?aud=*')
-        expect(scope).not.toBeNull()
-        expect(
-          scope!.matches({
-            lxm: 'com.example.method1',
-            aud: 'did:web:example.com#service_id',
-          }),
-        ).toBe(true)
-      })
-
-      it('should match wildcard lxm', () => {
-        const scope = RpcPermission.fromString(
-          'rpc:*?aud=did:web:example.com%23service_id',
-        )
-        expect(scope).not.toBeNull()
-        expect(
-          scope!.matches({
-            lxm: 'com.example.method1',
-            aud: 'did:web:example.com#service_id',
-          }),
-        ).toBe(true)
-      })
-
-      it('should not match different lxm with wildcard aud', () => {
-        const scope = RpcPermission.fromString(
-          'rpc:*?aud=did:web:example.com%23service_id',
-        )
-        expect(scope).not.toBeNull()
-        expect(
-          scope!.matches({
-            lxm: 'com.example.anyMethod',
-            aud: 'did:web:example.com#service_id',
-          }),
-        ).toBe(true)
-      })
-    })
-
-    describe('toString', () => {
-      it('should format scope with lxm and aud', () => {
-        const scope = new RpcPermission('did:web:example.com#service_id', [
-          'com.example.service',
-        ])
-        expect(scope.toString()).toBe(
-          'rpc:com.example.service?aud=did:web:example.com%23service_id',
-        )
-      })
-
-      it('should format scope with wildcard aud', () => {
-        const scope = new RpcPermission('*', ['com.example.method1'])
-        expect(scope.toString()).toBe('rpc:com.example.method1?aud=*')
-      })
-
-      it('should format scope with wildcard lxm', () => {
-        const scope = new RpcPermission('did:web:example.com#service_id', ['*'])
-        expect(scope.toString()).toBe(
-          'rpc:*?aud=did:web:example.com%23service_id',
-        )
-      })
-
-      it('simplifies lxm if one of them is "*"', () => {
-        const scope = new RpcPermission('did:web:example.com#service_id', [
-          '*',
-          'com.example.method1',
-        ])
-        expect(scope.toString()).toBe(
-          'rpc:*?aud=did:web:example.com%23service_id',
-        )
-      })
-    })
-  })
-
-  describe('consistency', () => {
-    const testCases: { input: string; expected: string }[] = [
-      {
-        input: 'rpc:com.example.service?aud=did:web:example.com%23service_id',
-        expected:
-          'rpc:com.example.service?aud=did:web:example.com%23service_id',
-      },
-      {
-        input: 'rpc:com.example.service?aud=did:web:example.com#service_id',
-        expected:
-          'rpc:com.example.service?aud=did:web:example.com%23service_id',
-      },
-      {
-        input: 'rpc?lxm=com.example.method1&lxm=com.example.method2&aud=*',
-        expected: 'rpc?lxm=com.example.method1&lxm=com.example.method2&aud=*',
-      },
-      {
-        input:
-          'rpc?lxm=com.example.method1&lxm=com.example.method2&lxm=*&aud=did:web:example.com%23service_id',
-        expected: 'rpc:*?aud=did:web:example.com%23service_id',
-      },
-      {
-        input: 'rpc?aud=did:web:example.com%23foo&lxm=com.example.service',
-        expected: 'rpc:com.example.service?aud=did:web:example.com%23foo',
-      },
-      {
-        input: 'rpc?lxm=com.example.method1&aud=did:web:example.com#foo',
-        expected: 'rpc:com.example.method1?aud=did:web:example.com%23foo',
-      },
-      {
-        input: 'rpc?lxm=com.example.method1&aud=did:web:example.com%23bar',
-        expected: 'rpc:com.example.method1?aud=did:web:example.com%23bar',
-      },
-      {
-        input: 'rpc:com.example.method1?&aud=*',
-        expected: 'rpc:com.example.method1?aud=*',
-      },
-    ]
-
-    for (const { input, expected } of testCases) {
-      it(`should properly re-format ${input}`, () => {
-        expect(RpcPermission.fromString(input)?.toString()).toBe(expected)
-      })
-    }
-  })
-})

package/src/scopes/rpc-permission.ts

@@ -1,90 +0,0 @@
-import { AtprotoDidRefAbsolute, isAtprotoDidRefAbsolute } from '@atproto/did'
-import { Nsid, isNsid } from '../lib/nsid.js'
-import { Parser } from '../lib/parser.js'
-import { ResourcePermission } from '../lib/resource-permission.js'
-import { ScopeStringSyntax } from '../lib/syntax-string.js'
-import { NeRoArray, ScopeSyntax, isScopeStringFor } from '../lib/syntax.js'
-
-export {
-  type AtprotoDidRefAbsolute,
-  type Nsid,
-  isAtprotoDidRefAbsolute,
-  isNsid,
-}
-
-export type LxmParam = '*' | Nsid
-export const isLxmParam = (value: unknown): value is LxmParam =>
-  value === '*' || isNsid(value)
-export type AudParam = '*' | AtprotoDidRefAbsolute
-export const isAudParam = (value: unknown): value is AudParam =>
-  value === '*' || isAtprotoDidRefAbsolute(value)
-
-export type RpcPermissionMatch = {
-  lxm: string
-  aud: string
-}
-
-export class RpcPermission
-  implements ResourcePermission<'rpc', RpcPermissionMatch>
-{
-  constructor(
-    public readonly aud: AudParam,
-    public readonly lxm: NeRoArray<LxmParam>,
-  ) {}
-
-  matches(options: RpcPermissionMatch) {
-    const { aud, lxm } = this
-    return (
-      (aud === '*' || aud === options.aud) &&
-      (lxm.includes('*') || (lxm as readonly string[]).includes(options.lxm))
-    )
-  }
-
-  toString() {
-    return RpcPermission.parser.format(this)
-  }
-
-  protected static readonly parser = new Parser(
-    'rpc',
-    {
-      lxm: {
-        multiple: true,
-        required: true,
-        validate: isLxmParam,
-        normalize: (value) =>
-          value.length > 1 && value.includes('*')
-            ? (['*'] as const)
-            : ([...new Set(value)].sort() as [Nsid, ...Nsid[]]),
-      },
-      aud: {
-        multiple: false,
-        required: true,
-        validate: isAudParam,
-      },
-    },
-    'lxm',
-  )
-
-  static fromString(scope: string): RpcPermission | null {
-    if (!isScopeStringFor(scope, 'rpc')) return null
-    const syntax = ScopeStringSyntax.fromString(scope)
-    return RpcPermission.fromSyntax(syntax)
-  }
-
-  static fromSyntax(syntax: ScopeSyntax<'rpc'>): RpcPermission | null {
-    const result = RpcPermission.parser.parse(syntax)
-    if (!result) return null
-
-    // rpc:*?aud=* is forbidden
-    if (result.aud === '*' && result.lxm.includes('*')) return null
-
-    return new RpcPermission(result.aud, result.lxm)
-  }
-
-  static scopeNeededFor(options: RpcPermissionMatch): string {
-    return RpcPermission.parser.format({
-      aud: options.aud as AtprotoDidRefAbsolute,
-      lxm: [options.lxm as Nsid],
-    })
-  }
-}

package/src/scopes-set.test.ts

@@ -1,47 +0,0 @@
-import { ScopesSet } from './scopes-set.js'
-
-describe('ScopesSet', () => {
-  it('should initialize with an empty set', () => {
-    const set = new ScopesSet()
-    expect(set.size).toBe(0)
-  })
-
-  it('should add scopes correctly', () => {
-    const set = new ScopesSet()
-    set.add('repo:read')
-    expect(set.size).toBe(1)
-    expect(set.has('repo:read')).toBe(true)
-    expect(set.has('repo:write')).toBe(false)
-  })
-
-  it('should remove scopes correctly', () => {
-    const set = new ScopesSet(['repo:read'])
-    set.delete('repo:read')
-    expect(set.size).toBe(0)
-    expect(set.has('repo:read')).toBe(false)
-  })
-
-  it('should match included scopes', () => {
-    const set = new ScopesSet(['repo:com.example.foo'])
-    expect(
-      set.matches('repo', { action: 'create', collection: 'com.example.foo' }),
-    ).toBe(true)
-    expect(
-      set.matches('repo', { action: 'create', collection: 'com.example.bar' }),
-    ).toBe(false)
-  })
-
-  it('should not match missing scopes', () => {
-    const set = new ScopesSet(['repo:com.example.foo?action=create'])
-    expect(
-      set.matches('repo', { action: 'delete', collection: 'com.example.foo' }),
-    ).toBe(false)
-  })
-
-  it('should not match invalid scopes', () => {
-    const set = new ScopesSet(['repo:not-a-valid-nsid'])
-    expect(
-      set.matches('repo', { action: 'create', collection: 'not-a-valid-nsid' }),
-    ).toBe(false)
-  })
-})

package/src/scopes-set.ts

@@ -1,134 +0,0 @@
-import { ScopeMissingError } from './scope-missing-error.js'
-import {
-  AccountPermission,
-  AccountPermissionMatch,
-} from './scopes/account-permission.js'
-import {
-  BlobPermission,
-  BlobPermissionMatch,
-} from './scopes/blob-permission.js'
-import {
-  IdentityPermission,
-  IdentityPermissionMatch,
-} from './scopes/identity-permission.js'
-import {
-  RepoPermission,
-  RepoPermissionMatch,
-} from './scopes/repo-permission.js'
-import { RpcPermission, RpcPermissionMatch } from './scopes/rpc-permission.js'
-
-export { ScopeMissingError }
-
-export type ScopeMatchingOptionsByResource = {
-  account: AccountPermissionMatch
-  identity: IdentityPermissionMatch
-  repo: RepoPermissionMatch
-  rpc: RpcPermissionMatch
-  blob: BlobPermissionMatch
-}
-
-/**
- * Utility class to manage a set of scopes and check if they match specific
- * options for a given resource.
- */
-export class ScopesSet extends Set<string> {
-  /**
-   * Check if the container has a scope that matches the given options for a
-   * specific resource.
-   */
-  public matches<R extends keyof ScopeMatchingOptionsByResource>(
-    resource: R,
-    options: ScopeMatchingOptionsByResource[R],
-  ): boolean {
-    for (const scope of this) {
-      if (permissionScopeMatches(scope, resource, options)) return true
-    }
-    return false
-  }
-
-  public assert<R extends keyof ScopeMatchingOptionsByResource>(
-    resource: R,
-    options: ScopeMatchingOptionsByResource[R],
-  ) {
-    if (!this.matches(resource, options)) {
-      const scope = scopeNeededFor(resource, options)
-      throw new ScopeMissingError(scope)
-    }
-  }
-
-  public some(fn: (scope: string) => boolean): boolean {
-    for (const scope of this) if (fn(scope)) return true
-    return false
-  }
-
-  public every(fn: (scope: string) => boolean): boolean {
-    for (const scope of this) if (!fn(scope)) return false
-    return true
-  }
-
-  public *filter(fn: (scope: string) => boolean) {
-    for (const scope of this) if (fn(scope)) yield scope
-  }
-
-  public *map<O>(fn: (scope: string) => O) {
-    for (const scope of this) yield fn(scope)
-  }
-
-  static fromString(string?: string): ScopesSet {
-    return new ScopesSet(string?.split(' '))
-  }
-}
-
-function scopeNeededFor<R extends keyof ScopeMatchingOptionsByResource>(
-  resource: R,
-  options: ScopeMatchingOptionsByResource[R],
-): string {
-  switch (resource) {
-    case 'account':
-      return AccountPermission.scopeNeededFor(options as AccountPermissionMatch)
-    case 'identity':
-      return IdentityPermission.scopeNeededFor(
-        options as IdentityPermissionMatch,
-      )
-    case 'repo':
-      return RepoPermission.scopeNeededFor(options as RepoPermissionMatch)
-    case 'rpc':
-      return RpcPermission.scopeNeededFor(options as RpcPermissionMatch)
-    case 'blob':
-      return BlobPermission.scopeNeededFor(options as BlobPermissionMatch)
-  }
-  // @ts-expect-error
-  throw new TypeError(`Unknown resource: ${resource}`)
-}
-
-function permissionScopeMatches<R extends keyof ScopeMatchingOptionsByResource>(
-  scope: string,
-  resource: R,
-  options: ScopeMatchingOptionsByResource[R],
-): boolean {
-  // @NOTE we might want to cache the parsed scopes though, in practice, a
-  // single scope is unlikely to be parsed multiple times during a single
-  // request.
-  const permission = parsePermissionScope(resource, scope)
-  if (!permission) return false
-
-  // @ts-expect-error
-  return permission.matches(options)
-}
-
-function parsePermissionScope(resource: string, scope: string) {
-  switch (resource) {
-    case 'account':
-      return AccountPermission.fromString(scope)
-    case 'identity':
-      return IdentityPermission.fromString(scope)
-    case 'repo':
-      return RepoPermission.fromString(scope)
-    case 'rpc':
-      return RpcPermission.fromString(scope)
-    case 'blob':
-      return BlobPermission.fromString(scope)
-    default:
-      return null
-  }
-}

package/tsconfig.build.json

@@ -1,9 +0,0 @@
-{
-  "extends": ["../../../tsconfig/isomorphic.json"],
-  "compilerOptions": {
-    "outDir": "dist",
-    "rootDir": "src",
-  },
-  "include": ["src"],
-  "exclude": ["**/*.test.ts"],
-}

package/tsconfig.build.tsbuildinfo

@@ -1 +0,0 @@
-{"version":"7.0.0-dev.20260614.1","root":["./src/atproto-oauth-scope.ts","./src/index.ts","./src/scope-missing-error.ts","./src/scope-permissions-transition.ts","./src/scope-permissions.ts","./src/scopes-set.ts","./src/lib/lexicon.ts","./src/lib/mime.ts","./src/lib/nsid.ts","./src/lib/parser.ts","./src/lib/resource-permission.ts","./src/lib/syntax-lexicon.ts","./src/lib/syntax-string.ts","./src/lib/syntax.ts","./src/lib/util.ts","./src/scopes/account-permission.ts","./src/scopes/blob-permission.ts","./src/scopes/identity-permission.ts","./src/scopes/include-scope.ts","./src/scopes/repo-permission.ts","./src/scopes/rpc-permission.ts"]}

package/tsconfig.json

@@ -1,7 +0,0 @@
-{
-  "include": [],
-  "references": [
-    { "path": "./tsconfig.build.json" },
-    { "path": "./tsconfig.tests.json" },
-  ],
-}

package/tsconfig.tests.json

@@ -1,7 +0,0 @@
-{
-  "extends": "../../../tsconfig/tests.json",
-  "compilerOptions": {
-    "rootDir": "src",
-  },
-  "include": ["src"],
-}