@atproto/pds 0.4.158 → 0.4.160

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atproto/pds",
-  "version": "0.4.158",
+  "version": "0.4.160",
   "license": "MIT",
   "description": "Reference implementation of atproto Personal Data Server (PDS)",
   "keywords": [
@@ -48,18 +48,18 @@
     "undici": "^6.19.8",
     "zod": "^3.23.8",
     "@atproto-labs/fetch-node": "0.1.9",
-    "@atproto-labs/xrpc-utils": "0.0.16",
-    "@atproto/api": "^0.15.23",
-    "@atproto/aws": "^0.2.24",
+    "@atproto-labs/xrpc-utils": "0.0.17",
+    "@atproto/api": "^0.15.25",
+    "@atproto/aws": "^0.2.25",
     "@atproto/common": "^0.4.11",
     "@atproto/crypto": "^0.4.4",
     "@atproto/identity": "^0.4.8",
-    "@atproto/lexicon": "^0.4.11",
+    "@atproto/lexicon": "^0.4.12",
     "@atproto/oauth-provider": "^0.9.3",
-    "@atproto/repo": "^0.8.4",
+    "@atproto/repo": "^0.8.5",
     "@atproto/syntax": "^0.4.0",
-    "@atproto/xrpc": "^0.7.0",
-    "@atproto/xrpc-server": "^0.8.0"
+    "@atproto/xrpc": "^0.7.1",
+    "@atproto/xrpc-server": "^0.9.0"
   },
   "devDependencies": {
     "@atproto/pds-entryway": "npm:@atproto/pds@0.3.0-entryway.3",
@@ -77,10 +77,10 @@
     "ts-node": "^10.8.2",
     "typescript": "^5.6.3",
     "ws": "^8.12.0",
-    "@atproto/api": "^0.15.23",
-    "@atproto/bsky": "^0.0.169",
-    "@atproto/dev-env": "^0.3.152",
-    "@atproto/lex-cli": "^0.8.3",
+    "@atproto/api": "^0.15.25",
+    "@atproto/bsky": "^0.0.171",
+    "@atproto/dev-env": "^0.3.154",
+    "@atproto/lex-cli": "^0.9.0",
     "@atproto/oauth-client-browser-example": "0.0.5"
   },
   "scripts": {

package/src/api/com/atproto/server/getServiceAuth.ts

@@ -13,8 +13,7 @@ export default function (server: Server, ctx: AppContext) {
     }),
     handler: async ({ params, auth }) => {
       const did = auth.credentials.did
-      const { aud, lxm = null } = params
-      const exp = params.exp ? params.exp * 1000 : undefined
+      const { aud, exp, lxm = null } = params
 
       // Takendown accounts should not be able to generate service auth tokens except for methods necessary for account migration
       if (
@@ -25,7 +24,7 @@ export default function (server: Server, ctx: AppContext) {
       }
 
       if (exp) {
-        const diff = exp - Date.now()
+        const diff = exp * 1000 - Date.now()
         if (diff < 0) {
           throw new InvalidRequestError(
             'expiration is in past',

package/src/auth-verifier.ts

@@ -1,5 +1,6 @@
 import { KeyObject, createPublicKey, createSecretKey } from 'node:crypto'
 import { IncomingMessage, ServerResponse } from 'node:http'
+import { Request } from 'express'
 import * as jose from 'jose'
 import KeyEncoder from 'key-encoder'
 import { getVerificationMaterial } from '@atproto/common'
@@ -11,10 +12,8 @@ import {
 } from '@atproto/oauth-provider'
 import {
   AuthRequiredError,
-  AuthVerifierContext,
   ForbiddenError,
   InvalidRequestError,
-  StreamAuthVerifierContext,
   XRPCError,
   parseReqNsid,
   verifyJwt as verifyServiceJwt,
@@ -23,7 +22,7 @@ import { AccountManager } from './account-manager/account-manager'
 import { softDeleted } from './db'
 import { oauthLogger } from './logger'
 
-type ReqCtx = AuthVerifierContext | StreamAuthVerifierContext
+type ReqCtx = { req: IncomingMessage; res?: ServerResponse }
 
 // @TODO sync-up with current method names, consider backwards compat.
 export enum AuthScope {
@@ -489,7 +488,7 @@ export class AuthVerifier {
 
     try {
       const originalUrl =
-        ('originalUrl' in req && req.originalUrl) || req.url || '/'
+        ('originalUrl' in req && (req as Request).originalUrl) || req.url || '/'
       const url = new URL(originalUrl, this._publicUrl)
       const { tokenClaims, dpopProof } =
         await this.oauthVerifier.authenticateRequest(

package/src/index.ts

@@ -11,7 +11,13 @@ import cors from 'cors'
 import express from 'express'
 import { HttpTerminator, createHttpTerminator } from 'http-terminator'
 import { DAY, HOUR, MINUTE, SECOND } from '@atproto/common'
-import { RateLimiter, ResponseType, XRPCError } from '@atproto/xrpc-server'
+import {
+  MemoryRateLimiter,
+  MethodHandler,
+  RedisRateLimiter,
+  ResponseType,
+  XRPCError,
+} from '@atproto/xrpc-server'
 import apiRoutes from './api'
 import * as authRoutes from './auth-routes'
 import * as basicRoutes from './basic-routes'
@@ -19,23 +25,31 @@ import { ServerConfig, ServerSecrets } from './config'
 import { AppContext, AppContextOptions } from './context'
 import * as error from './error'
 import { createServer } from './lexicon'
+import * as AppBskyFeedGetFeedSkeleton from './lexicon/types/app/bsky/feed/getFeedSkeleton'
 import { loggerMiddleware } from './logger'
 import { proxyHandler } from './pipethrough'
 import compression from './util/compression'
 import * as wellKnown from './well-known'
 
+export { createSecretKeyObject } from './auth-verifier'
 export * from './config'
+export { AppContext } from './context'
 export { Database } from './db'
 export { DiskBlobStore } from './disk-blobstore'
-export { AppContext } from './context'
-export { httpLogger } from './logger'
-export { createSecretKeyObject } from './auth-verifier'
-export { type Handler as SkeletonHandler } from './lexicon/types/app/bsky/feed/getFeedSkeleton'
 export { createServer as createLexiconServer } from './lexicon'
-export * as sequencer from './sequencer'
+export { httpLogger } from './logger'
 export { type CommitDataWithOps, type PreparedWrite } from './repo'
 export * as repoPrepare from './repo/prepare'
 export { scripts } from './scripts'
+export * as sequencer from './sequencer'
+
+// Legacy export for backwards compatibility
+export type SkeletonHandler = MethodHandler<
+  void,
+  AppBskyFeedGetFeedSkeleton.QueryParams,
+  AppBskyFeedGetFeedSkeleton.HandlerInput,
+  AppBskyFeedGetFeedSkeleton.HandlerOutput
+>
 
 export class PDS {
   public ctx: AppContext
@@ -92,8 +106,8 @@ export class PDS {
       rateLimits: rateLimits.enabled
         ? {
             creator: ctx.redisScratch
-              ? (opts) => RateLimiter.redis(ctx.redisScratch, opts)
-              : (opts) => RateLimiter.memory(opts),
+              ? (opts) => new RedisRateLimiter(ctx.redisScratch, opts)
+              : (opts) => new MemoryRateLimiter(opts),
             bypass: ({ req }) => {
               const { bypassKey, bypassIps } = rateLimits
               if (