@atproto/oauth-types 0.7.3 → 0.7.5

package/src/oauth-redirect-uri.ts

@@ -1,73 +0,0 @@
-import { TypeOf, ZodIssueCode, z } from 'zod'
-import {
-  HttpsUri,
-  LoopbackUri,
-  PrivateUseUri,
-  httpsUriSchema,
-  loopbackUriSchema,
-  privateUseUriSchema,
-} from './uri.js'
-
-/**
- * This is a {@link loopbackUriSchema} with the additional restriction that
- * the hostname `localhost` is not allowed.
- *
- * @see {@link https://datatracker.ietf.org/doc/html/rfc8252#section-8.3 Loopback Redirect Considerations} RFC8252
- *
- * > While redirect URIs using localhost (i.e.,
- * > "http://localhost:{port}/{path}") function similarly to loopback IP
- * > redirects described in Section 7.3, the use of localhost is NOT
- * > RECOMMENDED. Specifying a redirect URI with the loopback IP literal rather
- * > than localhost avoids inadvertently listening on network interfaces other
- * > than the loopback interface.  It is also less susceptible to client-side
- * > firewalls and misconfigured host name resolution on the user's device.
- */
-export const loopbackRedirectURISchema = loopbackUriSchema.superRefine(
-  (value, ctx): value is Exclude<LoopbackUri, `http://localhost${string}`> => {
-    if (value.startsWith('http://localhost')) {
-      ctx.addIssue({
-        code: ZodIssueCode.custom,
-        message:
-          'Use of "localhost" hostname is not allowed (RFC 8252), use a loopback IP such as "127.0.0.1" instead',
-      })
-      return false
-    }
-
-    return true
-  },
-)
-export type LoopbackRedirectURI = TypeOf<typeof loopbackRedirectURISchema>
-
-export const oauthLoopbackClientRedirectUriSchema = loopbackRedirectURISchema
-export type OAuthLoopbackRedirectURI = TypeOf<
-  typeof oauthLoopbackClientRedirectUriSchema
->
-
-export const oauthRedirectUriSchema = z
-  .string()
-  .superRefine(
-    (value, ctx): value is HttpsUri | LoopbackRedirectURI | PrivateUseUri => {
-      if (value.startsWith('https:')) {
-        const result = httpsUriSchema.safeParse(value)
-        if (!result.success) result.error.issues.forEach(ctx.addIssue, ctx)
-        return result.success
-      } else if (value.startsWith('http:')) {
-        const result = loopbackRedirectURISchema.safeParse(value)
-        if (!result.success) result.error.issues.forEach(ctx.addIssue, ctx)
-        return result.success
-      } else if (/^[^.:]+(?:\.[^.:]+)+:/.test(value)) {
-        const result = privateUseUriSchema.safeParse(value)
-        if (!result.success) result.error.issues.forEach(ctx.addIssue, ctx)
-        return result.success
-      } else {
-        ctx.addIssue({
-          code: ZodIssueCode.custom,
-          message:
-            'URL must use the "https:" or "http:" protocol, or a private-use URI scheme (RFC 8252)',
-        })
-        return false
-      }
-    },
-  )
-
-export type OAuthRedirectUri = TypeOf<typeof oauthRedirectUriSchema>

package/src/oauth-refresh-token-grant-token-request.ts

@@ -1,11 +0,0 @@
-import { z } from 'zod'
-import { oauthRefreshTokenSchema } from './oauth-refresh-token.js'
-
-export const oauthRefreshTokenGrantTokenRequestSchema = z.object({
-  grant_type: z.literal('refresh_token'),
-  refresh_token: oauthRefreshTokenSchema,
-})
-
-export type OAuthRefreshTokenGrantTokenRequest = z.infer<
-  typeof oauthRefreshTokenGrantTokenRequestSchema
->

package/src/oauth-refresh-token.ts

@@ -1,4 +0,0 @@
-import { z } from 'zod'
-
-export const oauthRefreshTokenSchema = z.string().min(1)
-export type OAuthRefreshToken = z.infer<typeof oauthRefreshTokenSchema>

package/src/oauth-request-uri.ts

@@ -1,5 +0,0 @@
-import { z } from 'zod'
-
-export const oauthRequestUriSchema = z.string().min(1)
-
-export type OAuthRequestUri = z.infer<typeof oauthRequestUriSchema>

package/src/oauth-response-mode.ts

@@ -1,9 +0,0 @@
-import { z } from 'zod'
-
-export const oauthResponseModeSchema = z.enum([
-  'query',
-  'fragment',
-  'form_post',
-])
-
-export type OAuthResponseMode = z.infer<typeof oauthResponseModeSchema>

package/src/oauth-response-type.ts

@@ -1,17 +0,0 @@
-import { z } from 'zod'
-
-export const oauthResponseTypeSchema = z.enum([
-  // OAuth2 (https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-10#section-4.1.1)
-  'code', // Authorization Code Grant
-  'token', // Implicit Grant
-
-  // OIDC (https://openid.net/specs/oauth-v2-multiple-response-types-1_0.html)
-  'none',
-  'code id_token token',
-  'code id_token',
-  'code token',
-  'id_token token',
-  'id_token',
-])
-
-export type OAuthResponseType = z.infer<typeof oauthResponseTypeSchema>

package/src/oauth-scope.ts

@@ -1,21 +0,0 @@
-import { z } from 'zod'
-
-// scope       = scope-token *( SP scope-token )
-// scope-token = 1*( %x21 / %x23-5B / %x5D-7E )
-export const OAUTH_SCOPE_REGEXP =
-  /^[\x21\x23-\x5B\x5D-\x7E]+(?: [\x21\x23-\x5B\x5D-\x7E]+)*$/
-
-export const isOAuthScope = (input: string): boolean =>
-  OAUTH_SCOPE_REGEXP.test(input)
-
-/**
- * A (single) space separated list of non empty printable ASCII char string
- * (except backslash and double quote).
- *
- * @see {@link https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-11#section-1.4.1}
- */
-export const oauthScopeSchema = z.string().refine(isOAuthScope, {
-  message: 'Invalid OAuth scope',
-})
-
-export type OAuthScope = z.infer<typeof oauthScopeSchema>

package/src/oauth-token-identification.ts

@@ -1,12 +0,0 @@
-import { z } from 'zod'
-import { oauthAccessTokenSchema } from './oauth-access-token.js'
-import { oauthRefreshTokenSchema } from './oauth-refresh-token.js'
-
-export const oauthTokenIdentificationSchema = z.object({
-  token: z.union([oauthAccessTokenSchema, oauthRefreshTokenSchema]),
-  token_type_hint: z.enum(['access_token', 'refresh_token']).optional(),
-})
-
-export type OAuthTokenIdentification = z.infer<
-  typeof oauthTokenIdentificationSchema
->

package/src/oauth-token-request.ts

@@ -1,14 +0,0 @@
-import { z } from 'zod'
-import { oauthAuthorizationCodeGrantTokenRequestSchema } from './oauth-authorization-code-grant-token-request.js'
-import { oauthClientCredentialsGrantTokenRequestSchema } from './oauth-client-credentials-grant-token-request.js'
-import { oauthPasswordGrantTokenRequestSchema } from './oauth-password-grant-token-request.js'
-import { oauthRefreshTokenGrantTokenRequestSchema } from './oauth-refresh-token-grant-token-request.js'
-
-export const oauthTokenRequestSchema = z.discriminatedUnion('grant_type', [
-  oauthAuthorizationCodeGrantTokenRequestSchema,
-  oauthRefreshTokenGrantTokenRequestSchema,
-  oauthPasswordGrantTokenRequestSchema,
-  oauthClientCredentialsGrantTokenRequestSchema,
-])
-
-export type OAuthTokenRequest = z.infer<typeof oauthTokenRequestSchema>

package/src/oauth-token-response.ts

@@ -1,29 +0,0 @@
-import { z } from 'zod'
-import { signedJwtSchema } from '@atproto/jwk'
-import { oauthAuthorizationDetailsSchema } from './oauth-authorization-details.js'
-import { oauthTokenTypeSchema } from './oauth-token-type.js'
-
-/**
- * @see {@link https://www.rfc-editor.org/rfc/rfc6749.html#section-5.1 | RFC 6749 (OAuth2), Section 5.1}
- */
-export const oauthTokenResponseSchema = z
-  .object({
-    // https://www.rfc-editor.org/rfc/rfc6749.html#section-5.1
-    access_token: z.string(),
-    token_type: oauthTokenTypeSchema,
-    scope: z.string().optional(),
-    refresh_token: z.string().optional(),
-    expires_in: z.number().optional(),
-    // https://openid.net/specs/openid-connect-core-1_0.html#TokenResponse
-    id_token: signedJwtSchema.optional(),
-    // https://datatracker.ietf.org/doc/html/rfc9396#name-enriched-authorization-deta
-    authorization_details: oauthAuthorizationDetailsSchema.optional(),
-  })
-  // https://www.rfc-editor.org/rfc/rfc6749.html#section-5.1
-  // > The client MUST ignore unrecognized value names in the response.
-  .passthrough()
-
-/**
- * @see {@link oauthTokenResponseSchema}
- */
-export type OAuthTokenResponse = z.infer<typeof oauthTokenResponseSchema>

package/src/oauth-token-type.ts

@@ -1,15 +0,0 @@
-import { z } from 'zod'
-
-// Case insensitive input, normalized output
-export const oauthTokenTypeSchema = z.union([
-  z
-    .string()
-    .regex(/^DPoP$/i)
-    .transform(() => 'DPoP' as const),
-  z
-    .string()
-    .regex(/^Bearer$/i)
-    .transform(() => 'Bearer' as const),
-])
-
-export type OAuthTokenType = z.infer<typeof oauthTokenTypeSchema>

package/src/oidc-authorization-error-response.ts

@@ -1,29 +0,0 @@
-import { z } from 'zod'
-
-/**
- * @see {@link https://openid.net/specs/openid-connect-core-1_0.html#AuthError}
- */
-export const oidcAuthorizationResponseErrorSchema = z.enum([
-  // The Authorization Server requires End-User interaction of some form to proceed. This error MAY be returned when the prompt parameter value in the Authentication Request is none, but the Authentication Request cannot be completed without displaying a user interface for End-User interaction.
-  'interaction_required',
-  // The Authorization Server requires End-User authentication. This error MAY be returned when the prompt parameter value in the Authentication Request is none, but the Authentication Request cannot be completed without displaying a user interface for End-User authentication.
-  'login_required',
-  // The End-User is REQUIRED to select a session at the Authorization Server. The End-User MAY be authenticated at the Authorization Server with different associated accounts, but the End-User did not select a session. This error MAY be returned when the prompt parameter value in the Authentication Request is none, but the Authentication Request cannot be completed without displaying a user interface to prompt for a session to use.
-  'account_selection_required',
-  // The Authorization Server requires End-User consent. This error MAY be returned when the prompt parameter value in the Authentication Request is none, but the Authentication Request cannot be completed without displaying a user interface for End-User consent.
-  'consent_required',
-  // The request_uri in the Authorization Request returns an error or contains invalid data.
-  'invalid_request_uri',
-  // The request parameter contains an invalid Request Object.
-  'invalid_request_object',
-  // The OP does not support use of the request parameter defined in Section 6.
-  'request_not_supported',
-  // The OP does not support use of the request_uri parameter defined in Section 6.
-  'request_uri_not_supported',
-  // The OP does not support use of the registration parameter defined in Section 7.2.1.
-  'registration_not_supported',
-])
-
-export type OidcAuthorizationResponseError = z.infer<
-  typeof oidcAuthorizationResponseErrorSchema
->

package/src/oidc-claims-parameter.ts

@@ -1,40 +0,0 @@
-import { z } from 'zod'
-
-export const oidcClaimsParameterSchema = z.enum([
-  // https://openid.net/specs/openid-provider-authentication-policy-extension-1_0.html#rfc.section.5.2
-  // if client metadata "require_auth_time" is true, this *must* be provided
-  'auth_time',
-
-  // OIDC
-  'nonce',
-  'acr',
-
-  // OpenID: "profile" scope
-  'name',
-  'family_name',
-  'given_name',
-  'middle_name',
-  'nickname',
-  'preferred_username',
-  'gender',
-  'picture',
-  'profile',
-  'website',
-  'birthdate',
-  'zoneinfo',
-  'locale',
-  'updated_at',
-
-  // OpenID: "email" scope
-  'email',
-  'email_verified',
-
-  // OpenID: "phone" scope
-  'phone_number',
-  'phone_number_verified',
-
-  // OpenID: "address" scope
-  'address',
-])
-
-export type OidcClaimsParameter = z.infer<typeof oidcClaimsParameterSchema>

package/src/oidc-claims-properties.ts

@@ -1,11 +0,0 @@
-import { z } from 'zod'
-
-const oidcClaimsValueSchema = z.union([z.string(), z.number(), z.boolean()])
-
-export const oidcClaimsPropertiesSchema = z.object({
-  essential: z.boolean().optional(),
-  value: oidcClaimsValueSchema.optional(),
-  values: z.array(oidcClaimsValueSchema).optional(),
-})
-
-export type OidcClaimsProperties = z.infer<typeof oidcClaimsPropertiesSchema>

package/src/oidc-entity-type.ts

@@ -1,5 +0,0 @@
-import { z } from 'zod'
-
-export const oidcEntityTypeSchema = z.enum(['userinfo', 'id_token'])
-
-export type OidcEntityType = z.infer<typeof oidcEntityTypeSchema>

package/src/oidc-userinfo.ts

@@ -1,15 +0,0 @@
-import { z } from 'zod'
-
-export const oidcUserinfoSchema = z.object({
-  sub: z.string(),
-  iss: z.string().url().optional(),
-  aud: z.union([z.string(), z.array(z.string()).min(1)]).optional(),
-
-  email: z.string().email().optional(),
-  email_verified: z.boolean().optional(),
-  name: z.string().optional(),
-  preferred_username: z.string().optional(),
-  picture: z.string().url().optional(),
-})
-
-export type OidcUserinfo = z.infer<typeof oidcUserinfoSchema>

package/src/uri.ts

@@ -1,221 +0,0 @@
-import { TypeOf, ZodIssueCode, z } from 'zod'
-import {
-  canParseUrl,
-  isHostnameIP,
-  isLocalHostname,
-  isLoopbackHost,
-} from './util.js'
-
-/**
- * Valid, but potentially dangerous URL (`data:`, `file:`, `javascript:`, etc.).
- *
- * Any value that matches this schema is safe to parse using `new URL()`.
- */
-export const dangerousUriSchema = z
-  .string()
-  .refine(
-    (data): data is `${string}:${string}` =>
-      data.includes(':') && canParseUrl(data),
-    {
-      message: 'Invalid URL',
-    },
-  )
-
-/**
- * Valid, but potentially dangerous URL (`data:`, `file:`, `javascript:`, etc.).
- */
-export type DangerousUrl = TypeOf<typeof dangerousUriSchema>
-
-export const loopbackUriSchema = dangerousUriSchema.superRefine(
-  (
-    value,
-    ctx,
-  ): value is
-    | `http://[::1]${string}`
-    | `http://localhost${'' | `${':' | '/' | '?' | '#'}${string}`}`
-    | `http://127.0.0.1${'' | `${':' | '/' | '?' | '#'}${string}`}` => {
-    // Loopback url must use the "http:" protocol
-    if (!value.startsWith('http://')) {
-      ctx.addIssue({
-        code: ZodIssueCode.custom,
-        message: 'URL must use the "http:" protocol',
-      })
-      return false
-    }
-
-    const url = new URL(value)
-
-    if (!isLoopbackHost(url.hostname)) {
-      ctx.addIssue({
-        code: ZodIssueCode.custom,
-        message: 'URL must use "localhost", "127.0.0.1" or "[::1]" as hostname',
-      })
-      return false
-    }
-
-    return true
-  },
-)
-
-export type LoopbackUri = TypeOf<typeof loopbackUriSchema>
-
-export const httpsUriSchema = dangerousUriSchema.superRefine(
-  (value, ctx): value is `https://${string}` => {
-    if (!value.startsWith('https://')) {
-      ctx.addIssue({
-        code: ZodIssueCode.custom,
-        message: 'URL must use the "https:" protocol',
-      })
-      return false
-    }
-
-    const url = new URL(value)
-
-    // Disallow loopback URLs with the `https:` protocol
-    if (isLoopbackHost(url.hostname)) {
-      ctx.addIssue({
-        code: ZodIssueCode.custom,
-        message: 'https: URL must not use a loopback host',
-      })
-      return false
-    }
-
-    if (isHostnameIP(url.hostname)) {
-      // Hostname is an IP address
-    } else {
-      // Hostname is a domain name
-      if (!url.hostname.includes('.')) {
-        // we don't depend on PSL here, so we only check for a dot
-        ctx.addIssue({
-          code: ZodIssueCode.custom,
-          message: 'Domain name must contain at least two segments',
-        })
-        return false
-      }
-
-      if (url.hostname.endsWith('.local')) {
-        ctx.addIssue({
-          code: ZodIssueCode.custom,
-          message: 'Domain name must not end with ".local"',
-        })
-        return false
-      }
-    }
-
-    return true
-  },
-)
-
-export type HttpsUri = TypeOf<typeof httpsUriSchema>
-
-export const webUriSchema = z
-  .string()
-  .superRefine((value, ctx): value is LoopbackUri | HttpsUri => {
-    // discriminated union of `loopbackUriSchema` and `httpsUriSchema`
-    if (value.startsWith('http://')) {
-      const result = loopbackUriSchema.safeParse(value)
-      if (!result.success) result.error.issues.forEach(ctx.addIssue, ctx)
-      return result.success
-    }
-
-    if (value.startsWith('https://')) {
-      const result = httpsUriSchema.safeParse(value)
-      if (!result.success) result.error.issues.forEach(ctx.addIssue, ctx)
-      return result.success
-    }
-
-    ctx.addIssue({
-      code: ZodIssueCode.custom,
-      message: 'URL must use the "http:" or "https:" protocol',
-    })
-    return false
-  })
-
-export type WebUri = TypeOf<typeof webUriSchema>
-
-export const privateUseUriSchema = dangerousUriSchema.superRefine(
-  (value, ctx): value is `${string}.${string}:/${string}` => {
-    const dotIdx = value.indexOf('.')
-    const colonIdx = value.indexOf(':')
-
-    // Optimization: avoid parsing the URL if the protocol does not contain a "."
-    if (dotIdx === -1 || colonIdx === -1 || dotIdx > colonIdx) {
-      ctx.addIssue({
-        code: ZodIssueCode.custom,
-        message:
-          'Private-use URI scheme requires a "." as part of the protocol',
-      })
-      return false
-    }
-
-    const url = new URL(value)
-
-    // Should be covered by the check before, but let's be extra sure
-    if (!url.protocol.includes('.')) {
-      ctx.addIssue({
-        code: ZodIssueCode.custom,
-        message: 'Invalid private-use URI scheme',
-      })
-      return false
-    }
-
-    // https://datatracker.ietf.org/doc/html/rfc8252#section-7.1
-    //
-    // > When choosing a URI scheme to associate with the app, apps MUST use a
-    // > URI scheme based on a domain name under their control, expressed in
-    // > reverse order
-    //
-    // https://datatracker.ietf.org/doc/html/rfc8252#section-8.4
-    //
-    // > In addition to the collision-resistant properties, requiring a URI
-    // > scheme based on a domain name that is under the control of the app can
-    // > help to prove ownership in the event of a dispute where two apps claim
-    // > the same private-use URI scheme (where one app is acting maliciously).
-    //
-    // We can't check for ownership here (as there is no concept of proven
-    // ownership in a generic validation logic), besides excluding local domains
-    // as they can't be controlled/owned by the app.
-    //
-    // https://atproto.com/specs/oauth
-    //
-    // > Any custom scheme must match the `client_id` hostname in reverse-domain
-    // > order.
-    //
-    // This ATPROTO specific requirement cannot be enforced here, (as there is
-    // no concept of `client_id` in this context).
-
-    const uriScheme = url.protocol.slice(0, -1) // remove trailing ":"
-    const urlDomain = uriScheme.split('.').reverse().join('.')
-
-    if (isLocalHostname(urlDomain)) {
-      ctx.addIssue({
-        code: ZodIssueCode.custom,
-        message: `Private-use URI Scheme redirect URI must not be a local hostname`,
-      })
-    }
-
-    // https://datatracker.ietf.org/doc/html/rfc8252#section-7.1
-    //
-    // > Following the requirements of Section 3.2 of [RFC3986], as there is no
-    // > naming authority for private-use URI scheme redirects, only a single
-    // > slash ("/") appears after the scheme component.
-    if (
-      url.href.startsWith(`${url.protocol}//`) ||
-      url.username ||
-      url.password ||
-      url.hostname ||
-      url.port
-    ) {
-      ctx.addIssue({
-        code: ZodIssueCode.custom,
-        message:
-          'Private-Use URI Scheme must be in the form <scheme>:/{path} (notice the single slash!) as per RFC 8252',
-      })
-      return false
-    }
-
-    return true
-  },
-)
-
-export type PrivateUseUri = TypeOf<typeof privateUseUriSchema>