@atproto/oauth-types 0.7.2 → 0.7.4

package/src/uri.ts

@@ -1,221 +0,0 @@
-import { TypeOf, ZodIssueCode, z } from 'zod'
-import {
-  canParseUrl,
-  isHostnameIP,
-  isLocalHostname,
-  isLoopbackHost,
-} from './util.js'
-
-/**
- * Valid, but potentially dangerous URL (`data:`, `file:`, `javascript:`, etc.).
- *
- * Any value that matches this schema is safe to parse using `new URL()`.
- */
-export const dangerousUriSchema = z
-  .string()
-  .refine(
-    (data): data is `${string}:${string}` =>
-      data.includes(':') && canParseUrl(data),
-    {
-      message: 'Invalid URL',
-    },
-  )
-
-/**
- * Valid, but potentially dangerous URL (`data:`, `file:`, `javascript:`, etc.).
- */
-export type DangerousUrl = TypeOf<typeof dangerousUriSchema>
-
-export const loopbackUriSchema = dangerousUriSchema.superRefine(
-  (
-    value,
-    ctx,
-  ): value is
-    | `http://[::1]${string}`
-    | `http://localhost${'' | `${':' | '/' | '?' | '#'}${string}`}`
-    | `http://127.0.0.1${'' | `${':' | '/' | '?' | '#'}${string}`}` => {
-    // Loopback url must use the "http:" protocol
-    if (!value.startsWith('http://')) {
-      ctx.addIssue({
-        code: ZodIssueCode.custom,
-        message: 'URL must use the "http:" protocol',
-      })
-      return false
-    }
-
-    const url = new URL(value)
-
-    if (!isLoopbackHost(url.hostname)) {
-      ctx.addIssue({
-        code: ZodIssueCode.custom,
-        message: 'URL must use "localhost", "127.0.0.1" or "[::1]" as hostname',
-      })
-      return false
-    }
-
-    return true
-  },
-)
-
-export type LoopbackUri = TypeOf<typeof loopbackUriSchema>
-
-export const httpsUriSchema = dangerousUriSchema.superRefine(
-  (value, ctx): value is `https://${string}` => {
-    if (!value.startsWith('https://')) {
-      ctx.addIssue({
-        code: ZodIssueCode.custom,
-        message: 'URL must use the "https:" protocol',
-      })
-      return false
-    }
-
-    const url = new URL(value)
-
-    // Disallow loopback URLs with the `https:` protocol
-    if (isLoopbackHost(url.hostname)) {
-      ctx.addIssue({
-        code: ZodIssueCode.custom,
-        message: 'https: URL must not use a loopback host',
-      })
-      return false
-    }
-
-    if (isHostnameIP(url.hostname)) {
-      // Hostname is an IP address
-    } else {
-      // Hostname is a domain name
-      if (!url.hostname.includes('.')) {
-        // we don't depend on PSL here, so we only check for a dot
-        ctx.addIssue({
-          code: ZodIssueCode.custom,
-          message: 'Domain name must contain at least two segments',
-        })
-        return false
-      }
-
-      if (url.hostname.endsWith('.local')) {
-        ctx.addIssue({
-          code: ZodIssueCode.custom,
-          message: 'Domain name must not end with ".local"',
-        })
-        return false
-      }
-    }
-
-    return true
-  },
-)
-
-export type HttpsUri = TypeOf<typeof httpsUriSchema>
-
-export const webUriSchema = z
-  .string()
-  .superRefine((value, ctx): value is LoopbackUri | HttpsUri => {
-    // discriminated union of `loopbackUriSchema` and `httpsUriSchema`
-    if (value.startsWith('http://')) {
-      const result = loopbackUriSchema.safeParse(value)
-      if (!result.success) result.error.issues.forEach(ctx.addIssue, ctx)
-      return result.success
-    }
-
-    if (value.startsWith('https://')) {
-      const result = httpsUriSchema.safeParse(value)
-      if (!result.success) result.error.issues.forEach(ctx.addIssue, ctx)
-      return result.success
-    }
-
-    ctx.addIssue({
-      code: ZodIssueCode.custom,
-      message: 'URL must use the "http:" or "https:" protocol',
-    })
-    return false
-  })
-
-export type WebUri = TypeOf<typeof webUriSchema>
-
-export const privateUseUriSchema = dangerousUriSchema.superRefine(
-  (value, ctx): value is `${string}.${string}:/${string}` => {
-    const dotIdx = value.indexOf('.')
-    const colonIdx = value.indexOf(':')
-
-    // Optimization: avoid parsing the URL if the protocol does not contain a "."
-    if (dotIdx === -1 || colonIdx === -1 || dotIdx > colonIdx) {
-      ctx.addIssue({
-        code: ZodIssueCode.custom,
-        message:
-          'Private-use URI scheme requires a "." as part of the protocol',
-      })
-      return false
-    }
-
-    const url = new URL(value)
-
-    // Should be covered by the check before, but let's be extra sure
-    if (!url.protocol.includes('.')) {
-      ctx.addIssue({
-        code: ZodIssueCode.custom,
-        message: 'Invalid private-use URI scheme',
-      })
-      return false
-    }
-
-    // https://datatracker.ietf.org/doc/html/rfc8252#section-7.1
-    //
-    // > When choosing a URI scheme to associate with the app, apps MUST use a
-    // > URI scheme based on a domain name under their control, expressed in
-    // > reverse order
-    //
-    // https://datatracker.ietf.org/doc/html/rfc8252#section-8.4
-    //
-    // > In addition to the collision-resistant properties, requiring a URI
-    // > scheme based on a domain name that is under the control of the app can
-    // > help to prove ownership in the event of a dispute where two apps claim
-    // > the same private-use URI scheme (where one app is acting maliciously).
-    //
-    // We can't check for ownership here (as there is no concept of proven
-    // ownership in a generic validation logic), besides excluding local domains
-    // as they can't be controlled/owned by the app.
-    //
-    // https://atproto.com/specs/oauth
-    //
-    // > Any custom scheme must match the `client_id` hostname in reverse-domain
-    // > order.
-    //
-    // This ATPROTO specific requirement cannot be enforced here, (as there is
-    // no concept of `client_id` in this context).
-
-    const uriScheme = url.protocol.slice(0, -1) // remove trailing ":"
-    const urlDomain = uriScheme.split('.').reverse().join('.')
-
-    if (isLocalHostname(urlDomain)) {
-      ctx.addIssue({
-        code: ZodIssueCode.custom,
-        message: `Private-use URI Scheme redirect URI must not be a local hostname`,
-      })
-    }
-
-    // https://datatracker.ietf.org/doc/html/rfc8252#section-7.1
-    //
-    // > Following the requirements of Section 3.2 of [RFC3986], as there is no
-    // > naming authority for private-use URI scheme redirects, only a single
-    // > slash ("/") appears after the scheme component.
-    if (
-      url.href.startsWith(`${url.protocol}//`) ||
-      url.username ||
-      url.password ||
-      url.hostname ||
-      url.port
-    ) {
-      ctx.addIssue({
-        code: ZodIssueCode.custom,
-        message:
-          'Private-Use URI Scheme must be in the form <scheme>:/{path} (notice the single slash!) as per RFC 8252',
-      })
-      return false
-    }
-
-    return true
-  },
-)
-
-export type PrivateUseUri = TypeOf<typeof privateUseUriSchema>

package/src/util.ts

@@ -1,170 +0,0 @@
-export const canParseUrl =
-  // eslint-disable-next-line n/no-unsupported-features/node-builtins
-  URL.canParse?.bind(URL) ??
-  // URL.canParse is not available in Node.js < 18.7.0
-  ((urlStr: string): boolean => {
-    try {
-      new URL(urlStr)
-      return true
-    } catch {
-      return false
-    }
-  })
-
-export function isHostnameIP(hostname: string) {
-  // IPv4
-  if (hostname.match(/^\d+\.\d+\.\d+\.\d+$/)) return true
-
-  // IPv6
-  if (hostname.startsWith('[') && hostname.endsWith(']')) return true
-
-  return false
-}
-
-export type LoopbackHost = 'localhost' | '127.0.0.1' | '[::1]'
-
-export function isLoopbackHost(host: unknown): host is LoopbackHost {
-  return host === 'localhost' || host === '127.0.0.1' || host === '[::1]'
-}
-
-export function isLocalHostname(hostname: string): boolean {
-  const parts = hostname.split('.')
-  if (parts.length < 2) return true
-
-  const tld = parts.at(-1)!.toLowerCase()
-  return (
-    tld === 'test' ||
-    tld === 'local' ||
-    tld === 'localhost' ||
-    tld === 'invalid' ||
-    tld === 'example'
-  )
-}
-
-export function safeUrl(input: URL | string): URL | null {
-  try {
-    return new URL(input)
-  } catch {
-    return null
-  }
-}
-
-export function extractUrlPath(url) {
-  // Extracts the path from a URL, without relying on the URL constructor
-  // (because it normalizes the URL)
-  const endOfProtocol = url.startsWith('https://')
-    ? 8
-    : url.startsWith('http://')
-      ? 7
-      : -1
-  if (endOfProtocol === -1) {
-    throw new TypeError('URL must use the "https:" or "http:" protocol')
-  }
-
-  const hashIdx = url.indexOf('#', endOfProtocol)
-  const questionIdx = url.indexOf('?', endOfProtocol)
-
-  const queryStrIdx =
-    questionIdx !== -1 && (hashIdx === -1 || questionIdx < hashIdx)
-      ? questionIdx
-      : -1
-
-  const pathEnd =
-    hashIdx === -1
-      ? queryStrIdx === -1
-        ? url.length
-        : queryStrIdx
-      : queryStrIdx === -1
-        ? hashIdx
-        : Math.min(hashIdx, queryStrIdx)
-
-  const slashIdx = url.indexOf('/', endOfProtocol)
-
-  const pathStart = slashIdx === -1 || slashIdx > pathEnd ? pathEnd : slashIdx
-
-  if (endOfProtocol === pathStart) {
-    throw new TypeError('URL must contain a host')
-  }
-
-  return url.substring(pathStart, pathEnd)
-}
-
-export const jsonObjectPreprocess = (val: unknown) => {
-  if (typeof val === 'string' && val.startsWith('{') && val.endsWith('}')) {
-    try {
-      return JSON.parse(val)
-    } catch {
-      return val
-    }
-  }
-
-  return val
-}
-
-export const numberPreprocess = (val: unknown): unknown => {
-  if (typeof val === 'string') {
-    const number = Number(val)
-    if (!Number.isNaN(number)) return number
-  }
-  return val
-}
-
-/**
- * Returns true if the two arrays contain the same elements, regardless of order
- * or duplicates.
- */
-export function arrayEquivalent<T>(a: readonly T[], b: readonly T[]) {
-  if (a === b) return true
-  return a.every(includedIn, b) && b.every(includedIn, a)
-}
-
-export function includedIn<T>(this: readonly T[], item: T) {
-  return this.includes(item)
-}
-
-export function asArray<T>(
-  value: Iterable<T> | undefined,
-): undefined | readonly T[] {
-  if (value == null) return undefined
-  if (Array.isArray(value)) return value // already a (possibly readonly) array
-  return Array.from(value)
-}
-
-export type SpaceSeparatedValue<Value extends string> =
-  `${'' | `${string} `}${Value}${'' | ` ${string}`}`
-
-export const isSpaceSeparatedValue = <Value extends string>(
-  value: Value,
-  input: string,
-): input is SpaceSeparatedValue<Value> => {
-  if (value.length === 0) throw new TypeError('Value cannot be empty')
-  if (value.includes(' ')) throw new TypeError('Value cannot contain spaces')
-
-  // Optimized version of:
-  // return input.split(' ').includes(value)
-
-  const inputLength = input.length
-  const valueLength = value.length
-
-  if (inputLength < valueLength) return false
-
-  let idx = input.indexOf(value)
-  let idxEnd: number
-
-  while (idx !== -1) {
-    idxEnd = idx + valueLength
-
-    if (
-      // at beginning or preceded by space
-      (idx === 0 || input.charCodeAt(idx - 1) === 32) &&
-      // at end or followed by space
-      (idxEnd === inputLength || input.charCodeAt(idxEnd) === 32)
-    ) {
-      return true
-    }
-
-    idx = input.indexOf(value, idxEnd + 1)
-  }
-
-  return false
-}

package/tsconfig.build.json

@@ -1,8 +0,0 @@
-{
-  "extends": "../../../tsconfig/isomorphic.json",
-  "compilerOptions": {
-    "rootDir": "./src",
-    "outDir": "./dist",
-  },
-  "include": ["./src"],
-}

package/tsconfig.build.tsbuildinfo

@@ -1 +0,0 @@
-{"version":"7.0.0-dev.20260614.1","root":["./src/atproto-loopback-client-id.ts","./src/atproto-loopback-client-metadata.ts","./src/atproto-loopback-client-redirect-uris.ts","./src/atproto-oauth-scope.ts","./src/atproto-oauth-token-response.ts","./src/constants.ts","./src/index.ts","./src/oauth-access-token.ts","./src/oauth-authorization-code-grant-token-request.ts","./src/oauth-authorization-details.ts","./src/oauth-authorization-request-jar.ts","./src/oauth-authorization-request-par.ts","./src/oauth-authorization-request-parameters.ts","./src/oauth-authorization-request-query.ts","./src/oauth-authorization-request-uri.ts","./src/oauth-authorization-response-error.ts","./src/oauth-authorization-server-metadata.ts","./src/oauth-client-credentials-grant-token-request.ts","./src/oauth-client-credentials.ts","./src/oauth-client-id-discoverable.ts","./src/oauth-client-id-loopback.ts","./src/oauth-client-id.ts","./src/oauth-client-metadata.ts","./src/oauth-code-challenge-method.ts","./src/oauth-endpoint-auth-method.ts","./src/oauth-endpoint-name.ts","./src/oauth-grant-type.ts","./src/oauth-introspection-response.ts","./src/oauth-issuer-identifier.ts","./src/oauth-par-response.ts","./src/oauth-password-grant-token-request.ts","./src/oauth-prompt-mode.ts","./src/oauth-protected-resource-metadata.ts","./src/oauth-redirect-uri.ts","./src/oauth-refresh-token-grant-token-request.ts","./src/oauth-refresh-token.ts","./src/oauth-request-uri.ts","./src/oauth-response-mode.ts","./src/oauth-response-type.ts","./src/oauth-scope.ts","./src/oauth-token-identification.ts","./src/oauth-token-request.ts","./src/oauth-token-response.ts","./src/oauth-token-type.ts","./src/oidc-authorization-error-response.ts","./src/oidc-claims-parameter.ts","./src/oidc-claims-properties.ts","./src/oidc-entity-type.ts","./src/oidc-userinfo.ts","./src/uri.ts","./src/util.ts"]}

package/tsconfig.json

@@ -1,4 +0,0 @@
-{
-  "include": [],
-  "references": [{ "path": "./tsconfig.build.json" }],
-}