@atproto/pds 0.4.164 → 0.4.166

package/src/api/com/atproto/sync/getBlocks.ts

@@ -2,20 +2,21 @@ import { CID } from 'multiformats/cid'
 import { byteIterableToStream } from '@atproto/common'
 import { blocksToCarStream } from '@atproto/repo'
 import { InvalidRequestError } from '@atproto/xrpc-server'
+import { isUserOrAdmin } from '../../../../auth-verifier'
 import { AppContext } from '../../../../context'
 import { Server } from '../../../../lexicon'
 import { assertRepoAvailability } from './util'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.sync.getBlocks({
-    auth: ctx.authVerifier.optionalAccessOrAdminToken(),
+    auth: ctx.authVerifier.authorizationOrAdminTokenOptional({
+      authorize: () => {
+        // always allow
+      },
+    }),
     handler: async ({ params, auth }) => {
       const { did } = params
-      await assertRepoAvailability(
-        ctx,
-        did,
-        ctx.authVerifier.isUserOrAdmin(auth, did),
-      )
+      await assertRepoAvailability(ctx, did, isUserOrAdmin(auth, did))
 
       const cids = params.cids.map((c) => CID.parse(c))
       const got = await ctx.actorStore.read(did, (store) =>

package/src/api/com/atproto/sync/getLatestCommit.ts

@@ -1,18 +1,19 @@
 import { InvalidRequestError } from '@atproto/xrpc-server'
+import { isUserOrAdmin } from '../../../../auth-verifier'
 import { AppContext } from '../../../../context'
 import { Server } from '../../../../lexicon'
 import { assertRepoAvailability } from './util'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.sync.getLatestCommit({
-    auth: ctx.authVerifier.optionalAccessOrAdminToken(),
+    auth: ctx.authVerifier.authorizationOrAdminTokenOptional({
+      authorize: () => {
+        // always allow
+      },
+    }),
     handler: async ({ params, auth }) => {
       const { did } = params
-      await assertRepoAvailability(
-        ctx,
-        did,
-        ctx.authVerifier.isUserOrAdmin(auth, did),
-      )
+      await assertRepoAvailability(ctx, did, isUserOrAdmin(auth, did))
 
       const root = await ctx.actorStore.read(did, (store) =>
         store.repo.storage.getRootDetailed(),

package/src/api/com/atproto/sync/getRecord.ts

@@ -3,20 +3,21 @@ import { byteIterableToStream } from '@atproto/common'
 import * as repo from '@atproto/repo'
 import { InvalidRequestError } from '@atproto/xrpc-server'
 import { SqlRepoReader } from '../../../../actor-store/repo/sql-repo-reader'
+import { isUserOrAdmin } from '../../../../auth-verifier'
 import { AppContext } from '../../../../context'
 import { Server } from '../../../../lexicon'
 import { assertRepoAvailability } from './util'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.sync.getRecord({
-    auth: ctx.authVerifier.optionalAccessOrAdminToken(),
+    auth: ctx.authVerifier.authorizationOrAdminTokenOptional({
+      authorize: () => {
+        // always allow
+      },
+    }),
     handler: async ({ params, auth }) => {
       const { did, collection, rkey } = params
-      await assertRepoAvailability(
-        ctx,
-        did,
-        ctx.authVerifier.isUserOrAdmin(auth, did),
-      )
+      await assertRepoAvailability(ctx, did, isUserOrAdmin(auth, did))
 
       // must open up the db outside of store interface so that we can close the file handle after finished streaming
       const actorDb = await ctx.actorStore.openDb(did)

package/src/api/com/atproto/sync/getRepo.ts

@@ -5,23 +5,23 @@ import {
   RepoRootNotFoundError,
   SqlRepoReader,
 } from '../../../../actor-store/repo/sql-repo-reader'
-import { AuthScope } from '../../../../auth-verifier'
+import { AuthScope } from '../../../../auth-scope'
+import { isUserOrAdmin } from '../../../../auth-verifier'
 import { AppContext } from '../../../../context'
 import { Server } from '../../../../lexicon'
 import { assertRepoAvailability } from './util'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.sync.getRepo({
-    auth: ctx.authVerifier.optionalAccessOrAdminToken({
+    auth: ctx.authVerifier.authorizationOrAdminTokenOptional({
       additional: [AuthScope.Takendown],
+      authorize: () => {
+        // always allow
+      },
     }),
     handler: async ({ params, auth }) => {
       const { did, since } = params
-      await assertRepoAvailability(
-        ctx,
-        did,
-        ctx.authVerifier.isUserOrAdmin(auth, did),
-      )
+      await assertRepoAvailability(ctx, did, isUserOrAdmin(auth, did))
 
       const carStream = await getCarStream(ctx, did, since)
 

package/src/api/com/atproto/sync/listBlobs.ts

@@ -1,20 +1,20 @@
-import { AuthScope } from '../../../../auth-verifier'
+import { AuthScope } from '../../../../auth-scope'
+import { isUserOrAdmin } from '../../../../auth-verifier'
 import { AppContext } from '../../../../context'
 import { Server } from '../../../../lexicon'
 import { assertRepoAvailability } from './util'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.sync.listBlobs({
-    auth: ctx.authVerifier.optionalAccessOrAdminToken({
+    auth: ctx.authVerifier.authorizationOrAdminTokenOptional({
       additional: [AuthScope.Takendown],
+      authorize: () => {
+        // always allow
+      },
     }),
     handler: async ({ params, auth }) => {
       const { did, since, limit, cursor } = params
-      await assertRepoAvailability(
-        ctx,
-        did,
-        ctx.authVerifier.isUserOrAdmin(auth, did),
-      )
+      await assertRepoAvailability(ctx, did, isUserOrAdmin(auth, did))
 
       const blobCids = await ctx.actorStore.read(did, (store) =>
         store.repo.blob.listBlobs({ since, limit, cursor }),

package/src/api/com/atproto/temp/checkSignupQueue.ts

@@ -1,4 +1,5 @@
-import { AuthScope } from '../../../../auth-verifier'
+import { ForbiddenError } from '@atproto/xrpc-server'
+import { AuthScope } from '../../../../auth-scope'
 import { AppContext } from '../../../../context'
 import { Server } from '../../../../lexicon'
 import { resultPassthru } from '../../../proxy'
@@ -6,8 +7,13 @@ import { resultPassthru } from '../../../proxy'
 // THIS IS A TEMPORARY UNSPECCED ROUTE
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.temp.checkSignupQueue({
-    auth: ctx.authVerifier.accessStandard({
+    auth: ctx.authVerifier.authorization({
       additional: [AuthScope.SignupQueued],
+      authorize: () => {
+        throw new ForbiddenError(
+          'OAuth credentials are not supported for this endpoint',
+        )
+      },
     }),
     handler: async ({ req }) => {
       if (!ctx.entrywayAgent) {

package/src/auth-output.ts

@@ -0,0 +1,51 @@
+import { PermissionSet } from '@atproto/oauth-scopes'
+import { AuthScope } from './auth-scope'
+
+export type UnauthenticatedOutput = {
+  credentials: null
+}
+
+export type AdminTokenOutput = {
+  credentials: {
+    type: 'admin_token'
+  }
+}
+
+export type ModServiceOutput = {
+  credentials: {
+    type: 'mod_service'
+    did: string
+  }
+}
+
+export type AccessOutput<S extends AuthScope = AuthScope> = {
+  credentials: {
+    type: 'access'
+    did: string
+    scope: S
+  }
+}
+
+export type OAuthOutput = {
+  credentials: {
+    type: 'oauth'
+    did: string
+    permissions: PermissionSet
+  }
+}
+
+export type RefreshOutput = {
+  credentials: {
+    type: 'refresh'
+    did: string
+    scope: AuthScope.Refresh
+    tokenId: string
+  }
+}
+
+export type UserServiceAuthOutput = {
+  credentials: {
+    type: 'user_service_auth'
+    did: string
+  }
+}

package/src/auth-scope.ts

@@ -0,0 +1,40 @@
+// @TODO sync-up with current method names, consider backwards compat.
+export enum AuthScope {
+  Access = 'com.atproto.access',
+  Refresh = 'com.atproto.refresh',
+  AppPass = 'com.atproto.appPass',
+  AppPassPrivileged = 'com.atproto.appPassPrivileged',
+  SignupQueued = 'com.atproto.signupQueued',
+  Takendown = 'com.atproto.takendown',
+}
+
+export const ACCESS_FULL = [AuthScope.Access] as const
+export const ACCESS_PRIVILEGED = [
+  ...ACCESS_FULL,
+  AuthScope.AppPassPrivileged,
+] as const
+export const ACCESS_STANDARD = [
+  ...ACCESS_PRIVILEGED,
+  AuthScope.AppPass,
+] as const
+
+const authScopesValues = new Set(Object.values(AuthScope))
+export function isAuthScope(val: unknown): val is AuthScope {
+  return (authScopesValues as Set<unknown>).has(val)
+}
+
+export function isAccessFull(
+  scope: AuthScope,
+): scope is (typeof ACCESS_FULL)[number] {
+  return (ACCESS_FULL as readonly string[]).includes(scope)
+}
+
+export function isAccessPrivileged(
+  scope: AuthScope,
+): scope is (typeof ACCESS_PRIVILEGED)[number] {
+  return (ACCESS_PRIVILEGED as readonly string[]).includes(scope)
+}
+
+export function isTakendown(scope: unknown): scope is AuthScope.Takendown {
+  return scope === AuthScope.Takendown
+}