@atproto/pds 0.4.103 → 0.4.105

package/src/context.ts

@@ -1,5 +1,6 @@
 import assert from 'node:assert'
 import * as plc from '@did-plc/lib'
+import express from 'express'
 import { Redis } from 'ioredis'
 import * as nodemailer from 'nodemailer'
 import * as undici from 'undici'
@@ -7,7 +8,12 @@ import { AtpAgent } from '@atproto/api'
 import { KmsKeypair, S3BlobStore } from '@atproto/aws'
 import * as crypto from '@atproto/crypto'
 import { IdResolver } from '@atproto/identity'
-import { JoseKey, OAuthVerifier } from '@atproto/oauth-provider'
+import {
+  AccessTokenType,
+  JoseKey,
+  OAuthProvider,
+  OAuthVerifier,
+} from '@atproto/oauth-provider'
 import { BlobStore } from '@atproto/repo'
 import {
   RateLimiter,
@@ -23,8 +29,10 @@ import {
   safeFetchWrap,
   unicastLookup,
 } from '@atproto-labs/fetch-node'
-import { AccountManager } from './account-manager'
+import { AccountManager } from './account-manager/account-manager'
+import { OAuthStore } from './account-manager/oauth-store'
 import { ActorStore } from './actor-store/actor-store'
+import { authPassthru, forwardedFor } from './api/proxy'
 import {
   AuthVerifier,
   createPublicKeyObject,
@@ -40,7 +48,6 @@ import { ImageUrlBuilder } from './image/image-url-builder'
 import { fetchLogger } from './logger'
 import { ServerMailer } from './mailer'
 import { ModerationMailer } from './mailer/moderation'
-import { PdsOAuthProvider } from './oauth/provider'
 import { LocalViewer, LocalViewerCreator } from './read-after-write/viewer'
 import { getRedisClient } from './redis'
 import { Sequencer } from './sequencer'
@@ -66,7 +73,7 @@ export type AppContextOptions = {
   entrywayAgent?: AtpAgent
   proxyAgent: undici.Dispatcher
   safeFetch: Fetch
-  authProvider?: PdsOAuthProvider
+  oauthProvider?: OAuthProvider
   authVerifier: AuthVerifier
   plcRotationKey: crypto.Keypair
   cfg: ServerConfig
@@ -94,7 +101,7 @@ export class AppContext {
   public proxyAgent: undici.Dispatcher
   public safeFetch: Fetch
   public authVerifier: AuthVerifier
-  public authProvider?: PdsOAuthProvider
+  public oauthProvider?: OAuthProvider
   public plcRotationKey: crypto.Keypair
   public cfg: ServerConfig
 
@@ -120,7 +127,7 @@ export class AppContext {
     this.proxyAgent = opts.proxyAgent
     this.safeFetch = opts.safeFetch
     this.authVerifier = opts.authVerifier
-    this.authProvider = opts.authProvider
+    this.oauthProvider = opts.oauthProvider
     this.plcRotationKey = opts.plcRotationKey
     this.cfg = opts.cfg
   }
@@ -245,13 +252,11 @@ export class AppContext {
     })
 
     const accountManager = new AccountManager(
-      actorStore,
-      imageUrlBuilder,
-      backgroundQueue,
-      cfg.db.accountDbLoc,
+      idResolver,
       jwtSecretKey,
       cfg.service.did,
-      cfg.db.disableWalAutoCheckpoint,
+      cfg.identity.serviceHandleDomains,
+      cfg.db,
     )
     await accountManager.migrateOrThrow()
 
@@ -321,26 +326,43 @@ export class AppContext {
       logError: false,
     })
 
-    const authProvider = cfg.oauth.provider
-      ? new PdsOAuthProvider({
+    const oauthProvider = cfg.oauth.provider
+      ? new OAuthProvider({
           issuer: cfg.oauth.issuer,
-          keyset: [
-            // Note: OpenID compatibility would require an RS256 private key in this list
-            await JoseKey.fromKeyLike(jwtSecretKey, undefined, 'HS256'),
-          ],
-          accountManager,
+          keyset: [await JoseKey.fromKeyLike(jwtSecretKey, undefined, 'HS256')],
+          store: new OAuthStore(
+            accountManager,
+            actorStore,
+            imageUrlBuilder,
+            backgroundQueue,
+            mailer,
+            sequencer,
+            plcClient,
+            plcRotationKey,
+            cfg.service.publicUrl,
+            cfg.identity.recoveryDidKey,
+          ),
           redis: redisScratch,
           dpopSecret: secrets.dpopSecret,
-          customization: cfg.oauth.provider.customization,
+          inviteCodeRequired: cfg.invites.required,
+          availableUserDomains: cfg.identity.serviceHandleDomains,
+          hcaptcha: cfg.oauth.provider.hcaptcha,
+          branding: cfg.oauth.provider.branding,
           safeFetch,
-          // @TODO: Make this configurable. The legacy implementation used to
-          // blindly trust the X-Forwarded-For header.
-          trustProxy: (_addr: string, _i: number) => true,
+          metadata: {
+            protected_resources: [new URL(cfg.oauth.issuer).origin],
+            scopes_supported: ['transition:generic', 'transition:chat.bsky'],
+          },
+          // If the PDS is both an authorization server & resource server (no
+          // entryway), there is no need to use JWTs as access tokens. Instead,
+          // the PDS can use tokenId as access tokens. This allows the PDS to
+          // always use up-to-date token data from the token store.
+          accessTokenType: AccessTokenType.id,
         })
       : undefined
 
     const oauthVerifier: OAuthVerifier =
-      authProvider ?? // OAuthProvider extends OAuthVerifier
+      oauthProvider ?? // OAuthProvider extends OAuthVerifier
       new OAuthVerifier({
         issuer: cfg.oauth.issuer,
         keyset: [await JoseKey.fromKeyLike(jwtPublicKey!, undefined, 'ES256K')],
@@ -386,7 +408,7 @@ export class AppContext {
       proxyAgent,
       safeFetch,
       authVerifier,
-      authProvider,
+      oauthProvider,
       plcRotationKey,
       cfg,
       ...(overrides ?? {}),
@@ -398,6 +420,20 @@ export class AppContext {
     return this.serviceAuthHeaders(did, this.bskyAppView.did, lxm)
   }
 
+  async entrywayAuthHeaders(req: express.Request, did: string, lxm: string) {
+    assert(this.cfg.entryway)
+    const headers = await this.serviceAuthHeaders(
+      did,
+      this.cfg.entryway.did,
+      lxm,
+    )
+    return forwardedFor(req, headers)
+  }
+
+  entrywayPassthruHeaders(req: express.Request) {
+    return forwardedFor(req, authPassthru(req))
+  }
+
   async serviceAuthHeaders(did: string, aud: string, lxm: string) {
     const keypair = await this.actorStore.keypair(did)
     return createServiceAuthHeaders({

package/src/handle/index.ts

@@ -1,61 +1,15 @@
-import * as ident from '@atproto/syntax'
+import {
+  InvalidHandleError,
+  normalizeAndEnsureValidHandle,
+} from '@atproto/syntax'
 import { InvalidRequestError } from '@atproto/xrpc-server'
-import { AppContext } from '../context'
-import { hasExplicitSlur } from './explicit-slurs'
 import { reservedSubdomains } from './reserved'
 
-export const normalizeAndValidateHandle = async (opts: {
-  ctx: AppContext
-  handle: string
-  did?: string
-  allowReserved?: boolean
-}): Promise<string> => {
-  const { ctx, did, allowReserved } = opts
-  // base formatting validation
-  const handle = baseNormalizeAndValidate(opts.handle)
-  // tld validation
-  if (!ident.isValidTld(handle)) {
-    throw new InvalidRequestError(
-      'Handle TLD is invalid or disallowed',
-      'InvalidHandle',
-    )
-  }
-  // slur check
-  if (hasExplicitSlur(handle)) {
-    throw new InvalidRequestError(
-      'Inappropriate language in handle',
-      'InvalidHandle',
-    )
-  }
-  if (isServiceDomain(handle, ctx.cfg.identity.serviceHandleDomains)) {
-    // verify constraints on a service domain
-    ensureHandleServiceConstraints(
-      handle,
-      ctx.cfg.identity.serviceHandleDomains,
-      allowReserved,
-    )
-  } else {
-    if (opts.did === undefined) {
-      throw new InvalidRequestError(
-        'Not a supported handle domain',
-        'UnsupportedDomain',
-      )
-    }
-    // verify resolution of a non-service domain
-    const resolvedDid = await ctx.idResolver.handle.resolve(handle)
-    if (resolvedDid !== did) {
-      throw new InvalidRequestError('External handle did not resolve to DID')
-    }
-  }
-  return handle
-}
-
 export const baseNormalizeAndValidate = (handle: string) => {
   try {
-    const normalized = ident.normalizeAndEnsureValidHandle(handle)
-    return normalized
+    return normalizeAndEnsureValidHandle(handle)
   } catch (err) {
-    if (err instanceof ident.InvalidHandleError) {
+    if (err instanceof InvalidHandleError) {
       throw new InvalidRequestError(err.message, 'InvalidHandle')
     }
     throw err

package/src/image/image-url.ts

@@ -0,0 +1,16 @@
+import { AppView } from '../app-view'
+import { ids } from '../lexicon/lexicons'
+
+export class ImageUrlBuilder {
+  constructor(
+    readonly pdsHostname: string,
+    readonly appview?: AppView,
+  ) {}
+
+  build(pattern: string, did: string, cid: string): string {
+    return (
+      this.appview?.getImageUrl(pattern, did, cid) ??
+      `https://${this.pdsHostname}/xrpc/${ids.ComAtprotoSyncGetBlob}?did=${did}&cid=${cid}`
+    )
+  }
+}

package/src/index.ts

@@ -122,7 +122,7 @@ export class PDS {
     server = API(server, ctx)
 
     const app = express()
-    app.set('trust proxy', true)
+    app.set('trust proxy', ['loopback', 'linklocal', 'uniquelocal'])
     app.use(loggerMiddleware)
     app.use(compression())
     app.use(authRoutes.createRouter(ctx)) // Before CORS

package/src/lexicon/index.ts

@@ -24,8 +24,11 @@ import * as ComAtprotoAdminUpdateAccountHandle from './types/com/atproto/admin/u
 import * as ComAtprotoAdminUpdateAccountPassword from './types/com/atproto/admin/updateAccountPassword.js'
 import * as ComAtprotoAdminUpdateSubjectStatus from './types/com/atproto/admin/updateSubjectStatus.js'
 import * as ComAtprotoIdentityGetRecommendedDidCredentials from './types/com/atproto/identity/getRecommendedDidCredentials.js'
+import * as ComAtprotoIdentityRefreshIdentity from './types/com/atproto/identity/refreshIdentity.js'
 import * as ComAtprotoIdentityRequestPlcOperationSignature from './types/com/atproto/identity/requestPlcOperationSignature.js'
+import * as ComAtprotoIdentityResolveDid from './types/com/atproto/identity/resolveDid.js'
 import * as ComAtprotoIdentityResolveHandle from './types/com/atproto/identity/resolveHandle.js'
+import * as ComAtprotoIdentityResolveIdentity from './types/com/atproto/identity/resolveIdentity.js'
 import * as ComAtprotoIdentitySignPlcOperation from './types/com/atproto/identity/signPlcOperation.js'
 import * as ComAtprotoIdentitySubmitPlcOperation from './types/com/atproto/identity/submitPlcOperation.js'
 import * as ComAtprotoIdentityUpdateHandle from './types/com/atproto/identity/updateHandle.js'
@@ -480,6 +483,17 @@ export class ComAtprotoIdentityNS {
     return this._server.xrpc.method(nsid, cfg)
   }
 
+  refreshIdentity<AV extends AuthVerifier>(
+    cfg: ConfigOf<
+      AV,
+      ComAtprotoIdentityRefreshIdentity.Handler<ExtractAuth<AV>>,
+      ComAtprotoIdentityRefreshIdentity.HandlerReqCtx<ExtractAuth<AV>>
+    >,
+  ) {
+    const nsid = 'com.atproto.identity.refreshIdentity' // @ts-ignore
+    return this._server.xrpc.method(nsid, cfg)
+  }
+
   requestPlcOperationSignature<AV extends AuthVerifier>(
     cfg: ConfigOf<
       AV,
@@ -493,6 +507,17 @@ export class ComAtprotoIdentityNS {
     return this._server.xrpc.method(nsid, cfg)
   }
 
+  resolveDid<AV extends AuthVerifier>(
+    cfg: ConfigOf<
+      AV,
+      ComAtprotoIdentityResolveDid.Handler<ExtractAuth<AV>>,
+      ComAtprotoIdentityResolveDid.HandlerReqCtx<ExtractAuth<AV>>
+    >,
+  ) {
+    const nsid = 'com.atproto.identity.resolveDid' // @ts-ignore
+    return this._server.xrpc.method(nsid, cfg)
+  }
+
   resolveHandle<AV extends AuthVerifier>(
     cfg: ConfigOf<
       AV,
@@ -504,6 +529,17 @@ export class ComAtprotoIdentityNS {
     return this._server.xrpc.method(nsid, cfg)
   }
 
+  resolveIdentity<AV extends AuthVerifier>(
+    cfg: ConfigOf<
+      AV,
+      ComAtprotoIdentityResolveIdentity.Handler<ExtractAuth<AV>>,
+      ComAtprotoIdentityResolveIdentity.HandlerReqCtx<ExtractAuth<AV>>
+    >,
+  ) {
+    const nsid = 'com.atproto.identity.resolveIdentity' // @ts-ignore
+    return this._server.xrpc.method(nsid, cfg)
+  }
+
   signPlcOperation<AV extends AuthVerifier>(
     cfg: ConfigOf<
       AV,