@atproto/pds 0.4.165 → 0.4.167

package/src/config/config.ts

@@ -255,7 +255,7 @@ export const envToCfg = (env: ServerEnvironment): ServerConfig => {
   const oauthCfg: ServerConfig['oauth'] = entrywayCfg
     ? {
         issuer: entrywayCfg.url,
-        provider: false,
+        provider: undefined,
       }
     : {
         issuer: serviceCfg.publicUrl,
@@ -315,6 +315,7 @@ export const envToCfg = (env: ServerEnvironment): ServerConfig => {
                 f.href != null && f.href !== '',
             ),
           },
+          trustedClients: env.trustedOAuthClients,
         },
       }
 
@@ -452,12 +453,11 @@ export type ProxyConfig = {
 
 export type OAuthConfig = {
   issuer: string
-  provider:
-    | false
-    | {
-        hcaptcha?: HcaptchaConfig
-        branding: BrandingInput
-      }
+  provider?: {
+    hcaptcha?: HcaptchaConfig
+    branding: BrandingInput
+    trustedClients?: string[]
+  }
 }
 
 export type InvitesConfig =

package/src/config/env.ts

@@ -18,11 +18,14 @@ export const readEnv = (): ServerEnvironment => {
     blobUploadLimit: envInt('PDS_BLOB_UPLOAD_LIMIT'),
     devMode: envBool('PDS_DEV_MODE'),
 
-    // OAuth
+    // hCaptcha
     hcaptchaSiteKey: envStr('PDS_HCAPTCHA_SITE_KEY'),
     hcaptchaSecretKey: envStr('PDS_HCAPTCHA_SECRET_KEY'),
     hcaptchaTokenSalt: envStr('PDS_HCAPTCHA_TOKEN_SALT'),
 
+    // OAuth
+    trustedOAuthClients: envList('PDS_OAUTH_TRUSTED_CLIENTS'),
+
     // branding
     lightColor: envStr('PDS_LIGHT_COLOR'),
     darkColor: envStr('PDS_DARK_COLOR'),
@@ -171,6 +174,7 @@ export type ServerEnvironment = {
   hcaptchaSiteKey?: string
   hcaptchaSecretKey?: string
   hcaptchaTokenSalt?: string
+  trustedOAuthClients?: string[]
 
   // branding
   lightColor?: string

package/src/context.ts

@@ -333,17 +333,18 @@ export class AppContext {
           safeFetch,
           metadata: {
             protected_resources: [new URL(cfg.oauth.issuer).origin],
-            scopes_supported: [
-              'transition:email',
-              'transition:generic',
-              'transition:chat.bsky',
-            ],
           },
           // If the PDS is both an authorization server & resource server (no
           // entryway), there is no need to use JWTs as access tokens. Instead,
           // the PDS can use tokenId as access tokens. This allows the PDS to
           // always use up-to-date token data from the token store.
           accessTokenMode: AccessTokenMode.light,
+
+          getClientInfo(clientId) {
+            return {
+              isTrusted: cfg.oauth.provider?.trustedClients?.includes(clientId),
+            }
+          },
         })
       : undefined