@atproto/oauth-types 0.7.3 → 0.7.4

package/src/oauth-password-grant-token-request.ts

@@ -1,11 +0,0 @@
-import { z } from 'zod'
-
-export const oauthPasswordGrantTokenRequestSchema = z.object({
-  grant_type: z.literal('password'),
-  username: z.string(),
-  password: z.string(),
-})
-
-export type OAuthPasswordGrantTokenRequest = z.infer<
-  typeof oauthPasswordGrantTokenRequestSchema
->

package/src/oauth-prompt-mode.ts

@@ -1,18 +0,0 @@
-import { z } from 'zod'
-
-/**
- * - "none" will only be allowed if the user already allowed the client on the same device
- * - "login" will force the user to login again, unless he very recently logged in
- * - "consent" will force the user to consent again
- * - "select_account" will force the user to select an account
- * - "create" will force the user registration screen
- */
-export const oauthPromptModeSchema = z.enum([
-  'none',
-  'login',
-  'consent',
-  'select_account',
-  'create',
-])
-
-export type OAuthPromptMode = z.infer<typeof oauthPromptModeSchema>

package/src/oauth-protected-resource-metadata.ts

@@ -1,94 +0,0 @@
-import { z } from 'zod'
-import { oauthIssuerIdentifierSchema } from './oauth-issuer-identifier.js'
-import { webUriSchema } from './uri.js'
-
-/**
- * @see {@link https://www.rfc-editor.org/rfc/rfc9728.html#section-3.2}
- */
-export const oauthProtectedResourceMetadataSchema = z.object({
-  /**
-   * REQUIRED. The protected resource's resource identifier, which is a URL that
-   * uses the https scheme and has no query or fragment components. Using these
-   * well-known resources is described in Section 3.
-   *
-   * @note This schema allows non https URLs for testing & development purposes.
-   * Make sure to validate the URL before using it in a production environment.
-   */
-  resource: webUriSchema
-    .refine((url) => !url.includes('?'), {
-      message: 'Resource URL must not contain query parameters',
-    })
-    .refine((url) => !url.includes('#'), {
-      message: 'Resource URL must not contain a fragment',
-    }),
-
-  /**
-   * OPTIONAL. JSON array containing a list of OAuth authorization server issuer
-   * identifiers, as defined in [RFC8414], for authorization servers that can be
-   * used with this protected resource. Protected resources MAY choose not to
-   * advertise some supported authorization servers even when this parameter is
-   * used. In some use cases, the set of authorization servers will not be
-   * enumerable, in which case this metadata parameter would not be used.
-   */
-  authorization_servers: z.array(oauthIssuerIdentifierSchema).optional(),
-
-  /**
-   * OPTIONAL. URL of the protected resource's JWK Set [JWK] document. This
-   * contains public keys belonging to the protected resource, such as signing
-   * key(s) that the resource server uses to sign resource responses. This URL
-   * MUST use the https scheme. When both signing and encryption keys are made
-   * available, a use (public key use) parameter value is REQUIRED for all keys
-   * in the referenced JWK Set to indicate each key's intended usage.
-   */
-  jwks_uri: webUriSchema.optional(),
-
-  /**
-   * RECOMMENDED. JSON array containing a list of the OAuth 2.0 [RFC6749] scope
-   * values that are used in authorization requests to request access to this
-   * protected resource. Protected resources MAY choose not to advertise some
-   * scope values supported even when this parameter is used.
-   */
-  scopes_supported: z.array(z.string()).optional(),
-
-  /**
-   * OPTIONAL. JSON array containing a list of the supported methods of sending
-   * an OAuth 2.0 Bearer Token [RFC6750] to the protected resource. Defined
-   * values are ["header", "body", "query"], corresponding to Sections 2.1, 2.2,
-   * and 2.3 of RFC 6750.
-   */
-  bearer_methods_supported: z
-    .array(z.enum(['header', 'body', 'query']))
-    .optional(),
-
-  /**
-   * OPTIONAL. JSON array containing a list of the JWS [JWS] signing algorithms
-   * (alg values) [JWA] supported by the protected resource for signing resource
-   * responses, for instance, as described in [FAPI.MessageSigning]. No default
-   * algorithms are implied if this entry is omitted. The value none MUST NOT be
-   * used.
-   */
-  resource_signing_alg_values_supported: z.array(z.string()).optional(),
-
-  /**
-   * OPTIONAL. URL of a page containing human-readable information that
-   * developers might want or need to know when using the protected resource
-   */
-  resource_documentation: webUriSchema.optional(),
-
-  /**
-   * OPTIONAL. URL that the protected resource provides to read about the
-   * protected resource's requirements on how the client can use the data
-   * provided by the protected resource
-   */
-  resource_policy_uri: webUriSchema.optional(),
-
-  /**
-   * OPTIONAL. URL that the protected resource provides to read about the
-   * protected resource's terms of service
-   */
-  resource_tos_uri: webUriSchema.optional(),
-})
-
-export type OAuthProtectedResourceMetadata = z.infer<
-  typeof oauthProtectedResourceMetadataSchema
->

package/src/oauth-redirect-uri.ts

@@ -1,73 +0,0 @@
-import { TypeOf, ZodIssueCode, z } from 'zod'
-import {
-  HttpsUri,
-  LoopbackUri,
-  PrivateUseUri,
-  httpsUriSchema,
-  loopbackUriSchema,
-  privateUseUriSchema,
-} from './uri.js'
-
-/**
- * This is a {@link loopbackUriSchema} with the additional restriction that
- * the hostname `localhost` is not allowed.
- *
- * @see {@link https://datatracker.ietf.org/doc/html/rfc8252#section-8.3 Loopback Redirect Considerations} RFC8252
- *
- * > While redirect URIs using localhost (i.e.,
- * > "http://localhost:{port}/{path}") function similarly to loopback IP
- * > redirects described in Section 7.3, the use of localhost is NOT
- * > RECOMMENDED. Specifying a redirect URI with the loopback IP literal rather
- * > than localhost avoids inadvertently listening on network interfaces other
- * > than the loopback interface.  It is also less susceptible to client-side
- * > firewalls and misconfigured host name resolution on the user's device.
- */
-export const loopbackRedirectURISchema = loopbackUriSchema.superRefine(
-  (value, ctx): value is Exclude<LoopbackUri, `http://localhost${string}`> => {
-    if (value.startsWith('http://localhost')) {
-      ctx.addIssue({
-        code: ZodIssueCode.custom,
-        message:
-          'Use of "localhost" hostname is not allowed (RFC 8252), use a loopback IP such as "127.0.0.1" instead',
-      })
-      return false
-    }
-
-    return true
-  },
-)
-export type LoopbackRedirectURI = TypeOf<typeof loopbackRedirectURISchema>
-
-export const oauthLoopbackClientRedirectUriSchema = loopbackRedirectURISchema
-export type OAuthLoopbackRedirectURI = TypeOf<
-  typeof oauthLoopbackClientRedirectUriSchema
->
-
-export const oauthRedirectUriSchema = z
-  .string()
-  .superRefine(
-    (value, ctx): value is HttpsUri | LoopbackRedirectURI | PrivateUseUri => {
-      if (value.startsWith('https:')) {
-        const result = httpsUriSchema.safeParse(value)
-        if (!result.success) result.error.issues.forEach(ctx.addIssue, ctx)
-        return result.success
-      } else if (value.startsWith('http:')) {
-        const result = loopbackRedirectURISchema.safeParse(value)
-        if (!result.success) result.error.issues.forEach(ctx.addIssue, ctx)
-        return result.success
-      } else if (/^[^.:]+(?:\.[^.:]+)+:/.test(value)) {
-        const result = privateUseUriSchema.safeParse(value)
-        if (!result.success) result.error.issues.forEach(ctx.addIssue, ctx)
-        return result.success
-      } else {
-        ctx.addIssue({
-          code: ZodIssueCode.custom,
-          message:
-            'URL must use the "https:" or "http:" protocol, or a private-use URI scheme (RFC 8252)',
-        })
-        return false
-      }
-    },
-  )
-
-export type OAuthRedirectUri = TypeOf<typeof oauthRedirectUriSchema>

package/src/oauth-refresh-token-grant-token-request.ts

@@ -1,11 +0,0 @@
-import { z } from 'zod'
-import { oauthRefreshTokenSchema } from './oauth-refresh-token.js'
-
-export const oauthRefreshTokenGrantTokenRequestSchema = z.object({
-  grant_type: z.literal('refresh_token'),
-  refresh_token: oauthRefreshTokenSchema,
-})
-
-export type OAuthRefreshTokenGrantTokenRequest = z.infer<
-  typeof oauthRefreshTokenGrantTokenRequestSchema
->

package/src/oauth-refresh-token.ts

@@ -1,4 +0,0 @@
-import { z } from 'zod'
-
-export const oauthRefreshTokenSchema = z.string().min(1)
-export type OAuthRefreshToken = z.infer<typeof oauthRefreshTokenSchema>

package/src/oauth-request-uri.ts

@@ -1,5 +0,0 @@
-import { z } from 'zod'
-
-export const oauthRequestUriSchema = z.string().min(1)
-
-export type OAuthRequestUri = z.infer<typeof oauthRequestUriSchema>

package/src/oauth-response-mode.ts

@@ -1,9 +0,0 @@
-import { z } from 'zod'
-
-export const oauthResponseModeSchema = z.enum([
-  'query',
-  'fragment',
-  'form_post',
-])
-
-export type OAuthResponseMode = z.infer<typeof oauthResponseModeSchema>

package/src/oauth-response-type.ts

@@ -1,17 +0,0 @@
-import { z } from 'zod'
-
-export const oauthResponseTypeSchema = z.enum([
-  // OAuth2 (https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-10#section-4.1.1)
-  'code', // Authorization Code Grant
-  'token', // Implicit Grant
-
-  // OIDC (https://openid.net/specs/oauth-v2-multiple-response-types-1_0.html)
-  'none',
-  'code id_token token',
-  'code id_token',
-  'code token',
-  'id_token token',
-  'id_token',
-])
-
-export type OAuthResponseType = z.infer<typeof oauthResponseTypeSchema>

package/src/oauth-scope.ts

@@ -1,21 +0,0 @@
-import { z } from 'zod'
-
-// scope       = scope-token *( SP scope-token )
-// scope-token = 1*( %x21 / %x23-5B / %x5D-7E )
-export const OAUTH_SCOPE_REGEXP =
-  /^[\x21\x23-\x5B\x5D-\x7E]+(?: [\x21\x23-\x5B\x5D-\x7E]+)*$/
-
-export const isOAuthScope = (input: string): boolean =>
-  OAUTH_SCOPE_REGEXP.test(input)
-
-/**
- * A (single) space separated list of non empty printable ASCII char string
- * (except backslash and double quote).
- *
- * @see {@link https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-11#section-1.4.1}
- */
-export const oauthScopeSchema = z.string().refine(isOAuthScope, {
-  message: 'Invalid OAuth scope',
-})
-
-export type OAuthScope = z.infer<typeof oauthScopeSchema>

package/src/oauth-token-identification.ts

@@ -1,12 +0,0 @@
-import { z } from 'zod'
-import { oauthAccessTokenSchema } from './oauth-access-token.js'
-import { oauthRefreshTokenSchema } from './oauth-refresh-token.js'
-
-export const oauthTokenIdentificationSchema = z.object({
-  token: z.union([oauthAccessTokenSchema, oauthRefreshTokenSchema]),
-  token_type_hint: z.enum(['access_token', 'refresh_token']).optional(),
-})
-
-export type OAuthTokenIdentification = z.infer<
-  typeof oauthTokenIdentificationSchema
->

package/src/oauth-token-request.ts

@@ -1,14 +0,0 @@
-import { z } from 'zod'
-import { oauthAuthorizationCodeGrantTokenRequestSchema } from './oauth-authorization-code-grant-token-request.js'
-import { oauthClientCredentialsGrantTokenRequestSchema } from './oauth-client-credentials-grant-token-request.js'
-import { oauthPasswordGrantTokenRequestSchema } from './oauth-password-grant-token-request.js'
-import { oauthRefreshTokenGrantTokenRequestSchema } from './oauth-refresh-token-grant-token-request.js'
-
-export const oauthTokenRequestSchema = z.discriminatedUnion('grant_type', [
-  oauthAuthorizationCodeGrantTokenRequestSchema,
-  oauthRefreshTokenGrantTokenRequestSchema,
-  oauthPasswordGrantTokenRequestSchema,
-  oauthClientCredentialsGrantTokenRequestSchema,
-])
-
-export type OAuthTokenRequest = z.infer<typeof oauthTokenRequestSchema>

package/src/oauth-token-response.ts

@@ -1,29 +0,0 @@
-import { z } from 'zod'
-import { signedJwtSchema } from '@atproto/jwk'
-import { oauthAuthorizationDetailsSchema } from './oauth-authorization-details.js'
-import { oauthTokenTypeSchema } from './oauth-token-type.js'
-
-/**
- * @see {@link https://www.rfc-editor.org/rfc/rfc6749.html#section-5.1 | RFC 6749 (OAuth2), Section 5.1}
- */
-export const oauthTokenResponseSchema = z
-  .object({
-    // https://www.rfc-editor.org/rfc/rfc6749.html#section-5.1
-    access_token: z.string(),
-    token_type: oauthTokenTypeSchema,
-    scope: z.string().optional(),
-    refresh_token: z.string().optional(),
-    expires_in: z.number().optional(),
-    // https://openid.net/specs/openid-connect-core-1_0.html#TokenResponse
-    id_token: signedJwtSchema.optional(),
-    // https://datatracker.ietf.org/doc/html/rfc9396#name-enriched-authorization-deta
-    authorization_details: oauthAuthorizationDetailsSchema.optional(),
-  })
-  // https://www.rfc-editor.org/rfc/rfc6749.html#section-5.1
-  // > The client MUST ignore unrecognized value names in the response.
-  .passthrough()
-
-/**
- * @see {@link oauthTokenResponseSchema}
- */
-export type OAuthTokenResponse = z.infer<typeof oauthTokenResponseSchema>

package/src/oauth-token-type.ts

@@ -1,15 +0,0 @@
-import { z } from 'zod'
-
-// Case insensitive input, normalized output
-export const oauthTokenTypeSchema = z.union([
-  z
-    .string()
-    .regex(/^DPoP$/i)
-    .transform(() => 'DPoP' as const),
-  z
-    .string()
-    .regex(/^Bearer$/i)
-    .transform(() => 'Bearer' as const),
-])
-
-export type OAuthTokenType = z.infer<typeof oauthTokenTypeSchema>

package/src/oidc-authorization-error-response.ts

@@ -1,29 +0,0 @@
-import { z } from 'zod'
-
-/**
- * @see {@link https://openid.net/specs/openid-connect-core-1_0.html#AuthError}
- */
-export const oidcAuthorizationResponseErrorSchema = z.enum([
-  // The Authorization Server requires End-User interaction of some form to proceed. This error MAY be returned when the prompt parameter value in the Authentication Request is none, but the Authentication Request cannot be completed without displaying a user interface for End-User interaction.
-  'interaction_required',
-  // The Authorization Server requires End-User authentication. This error MAY be returned when the prompt parameter value in the Authentication Request is none, but the Authentication Request cannot be completed without displaying a user interface for End-User authentication.
-  'login_required',
-  // The End-User is REQUIRED to select a session at the Authorization Server. The End-User MAY be authenticated at the Authorization Server with different associated accounts, but the End-User did not select a session. This error MAY be returned when the prompt parameter value in the Authentication Request is none, but the Authentication Request cannot be completed without displaying a user interface to prompt for a session to use.
-  'account_selection_required',
-  // The Authorization Server requires End-User consent. This error MAY be returned when the prompt parameter value in the Authentication Request is none, but the Authentication Request cannot be completed without displaying a user interface for End-User consent.
-  'consent_required',
-  // The request_uri in the Authorization Request returns an error or contains invalid data.
-  'invalid_request_uri',
-  // The request parameter contains an invalid Request Object.
-  'invalid_request_object',
-  // The OP does not support use of the request parameter defined in Section 6.
-  'request_not_supported',
-  // The OP does not support use of the request_uri parameter defined in Section 6.
-  'request_uri_not_supported',
-  // The OP does not support use of the registration parameter defined in Section 7.2.1.
-  'registration_not_supported',
-])
-
-export type OidcAuthorizationResponseError = z.infer<
-  typeof oidcAuthorizationResponseErrorSchema
->

package/src/oidc-claims-parameter.ts

@@ -1,40 +0,0 @@
-import { z } from 'zod'
-
-export const oidcClaimsParameterSchema = z.enum([
-  // https://openid.net/specs/openid-provider-authentication-policy-extension-1_0.html#rfc.section.5.2
-  // if client metadata "require_auth_time" is true, this *must* be provided
-  'auth_time',
-
-  // OIDC
-  'nonce',
-  'acr',
-
-  // OpenID: "profile" scope
-  'name',
-  'family_name',
-  'given_name',
-  'middle_name',
-  'nickname',
-  'preferred_username',
-  'gender',
-  'picture',
-  'profile',
-  'website',
-  'birthdate',
-  'zoneinfo',
-  'locale',
-  'updated_at',
-
-  // OpenID: "email" scope
-  'email',
-  'email_verified',
-
-  // OpenID: "phone" scope
-  'phone_number',
-  'phone_number_verified',
-
-  // OpenID: "address" scope
-  'address',
-])
-
-export type OidcClaimsParameter = z.infer<typeof oidcClaimsParameterSchema>

package/src/oidc-claims-properties.ts

@@ -1,11 +0,0 @@
-import { z } from 'zod'
-
-const oidcClaimsValueSchema = z.union([z.string(), z.number(), z.boolean()])
-
-export const oidcClaimsPropertiesSchema = z.object({
-  essential: z.boolean().optional(),
-  value: oidcClaimsValueSchema.optional(),
-  values: z.array(oidcClaimsValueSchema).optional(),
-})
-
-export type OidcClaimsProperties = z.infer<typeof oidcClaimsPropertiesSchema>

package/src/oidc-entity-type.ts

@@ -1,5 +0,0 @@
-import { z } from 'zod'
-
-export const oidcEntityTypeSchema = z.enum(['userinfo', 'id_token'])
-
-export type OidcEntityType = z.infer<typeof oidcEntityTypeSchema>

package/src/oidc-userinfo.ts

@@ -1,15 +0,0 @@
-import { z } from 'zod'
-
-export const oidcUserinfoSchema = z.object({
-  sub: z.string(),
-  iss: z.string().url().optional(),
-  aud: z.union([z.string(), z.array(z.string()).min(1)]).optional(),
-
-  email: z.string().email().optional(),
-  email_verified: z.boolean().optional(),
-  name: z.string().optional(),
-  preferred_username: z.string().optional(),
-  picture: z.string().url().optional(),
-})
-
-export type OidcUserinfo = z.infer<typeof oidcUserinfoSchema>