@atproto/pds 0.4.218 → 0.4.220

package/src/pipethrough.ts

@@ -91,7 +91,7 @@ export const proxyHandler = (ctx: AppContext): CatchallHandler => {
         headers,
       }
 
-      await pipethroughStream(ctx, dispatchOptions, (upstream) => {
+      await pipethroughStream(ctx, req, dispatchOptions, (upstream) => {
         res.status(upstream.statusCode)
 
         for (const [name, val] of responseHeaders(upstream.headers)) {
@@ -188,7 +188,7 @@ export async function pipethrough(
     highWaterMark: 2 * 65536, // twice the default (64KiB)
   }
 
-  const { headers, body } = await pipethroughRequest(ctx, dispatchOptions)
+  const { headers, body } = await pipethroughRequest(ctx, req, dispatchOptions)
 
   return {
     encoding: safeString(headers['content-type']) ?? 'application/json',
@@ -291,6 +291,7 @@ export const parseProxyHeader = async (
  */
 async function pipethroughStream(
   ctx: AppContext,
+  req: Request,
   dispatchOptions: Dispatcher.RequestOptions,
   successStreamFactory: Dispatcher.StreamFactory,
 ): Promise<void> {
@@ -327,7 +328,7 @@ async function pipethroughStream(
       // or writable stream errors. In the latter case, the promise will already
       // be resolved, and reject()ing it there after will have no effect. Those
       // error would still be logged by the successStreamFactory() function.
-      .catch(handleUpstreamRequestError)
+      .catch(handleUpstreamRequestError.bind(req))
       .catch(reject)
   })
 }
@@ -338,6 +339,7 @@ async function pipethroughStream(
  */
 async function pipethroughRequest(
   ctx: AppContext,
+  req: Request,
   dispatchOptions: Dispatcher.RequestOptions,
 ) {
   // HandlerPipeThroughStream requires a readable stream to be returned, so we
@@ -345,7 +347,7 @@ async function pipethroughRequest(
 
   const upstream = await ctx.proxyAgent
     .request(dispatchOptions)
-    .catch(handleUpstreamRequestError)
+    .catch(handleUpstreamRequestError.bind(req))
 
   if (upstream.statusCode >= 400) {
     const parsed = await tryParsingError(upstream.headers, upstream.body)
@@ -359,15 +361,23 @@ async function pipethroughRequest(
 }
 
 function handleUpstreamRequestError(
+  this: Request,
   err: unknown,
   message = 'Upstream service unreachable',
 ): never {
-  httpLogger.error({ err }, message)
+  const logger = isPinoHttpRequest(this) ? this.log : httpLogger
+  logger.error({ err }, message)
   throw new XRPCServerError(ResponseType.UpstreamFailure, message, undefined, {
     cause: err,
   })
 }
 
+function isPinoHttpRequest(req: Request): req is Request & {
+  log: { error: (obj: unknown, msg: string) => void }
+} {
+  return typeof (req as { log?: any }).log?.error === 'function'
+}
+
 // Request parsing/forwarding
 // -------------------
 

package/tests/_oauth_client_assets_middleware.ts

@@ -0,0 +1,23 @@
+import { IncomingMessage, ServerResponse } from 'node:http'
+import files from '@atproto/oauth-client-browser-example' with { type: 'json' }
+
+export function oauthClientAssetsMiddleware(
+  req: IncomingMessage,
+  res: ServerResponse,
+  next?: (err?: unknown) => void,
+): void {
+  const path = req.url?.split('?')[0].slice(1) || 'index.html'
+  const file = Object.hasOwn(files, path) ? files[path] : null
+
+  if (file) {
+    res
+      .writeHead(200, 'OK', { 'content-type': file.mime })
+      .end(Buffer.from(file.data, 'base64'))
+  } else if (next) {
+    next()
+  } else {
+    res
+      .writeHead(404, 'Not Found', { 'content-type': 'text/plain' })
+      .end('Page not found')
+  }
+}

package/tests/_puppeteer.ts

@@ -1,27 +1,71 @@
 import assert from 'node:assert'
-import { type Browser, type Page } from 'puppeteer'
+import { type Browser, Handler, type Page, Target, TargetType } from 'puppeteer'
 
 export class PageHelper implements AsyncDisposable {
   constructor(protected readonly page: Page) {}
 
-  async goto(url: string) {
-    await this.page.goto(url)
+  async goto(url: string | URL) {
+    await this.page.goto(url.toString())
+  }
+
+  isClosed() {
+    return this.page.isClosed()
+  }
+
+  async title() {
+    await this.waitForNetworkIdle()
+    return this.page.title()
   }
 
   async waitForNetworkIdle() {
     await this.page.waitForNetworkIdle()
   }
 
-  async navigationAction(run: () => Promise<unknown>): Promise<void> {
-    const promise = this.page.waitForNavigation()
+  async waitForPopup(run: () => Promise<unknown>): Promise<PageHelper> {
+    const browser = this.page.browser()
+    const popupPromise = new Promise<Page | null>((resolve, reject) => {
+      const cleanup = () => {
+        clearTimeout(timeout)
+        browser.off('targetcreated', targetcreated)
+      }
+
+      const timeout = setTimeout(() => {
+        cleanup()
+        reject(new Error('Timeout waiting for popup'))
+      }, 5_000)
+
+      const targetcreated: Handler<Target> = async (target) => {
+        switch (target.type()) {
+          case TargetType.BACKGROUND_PAGE:
+          case TargetType.PAGE: {
+            cleanup()
+            resolve(target.page())
+          }
+        }
+      }
+
+      browser.once('targetcreated', targetcreated)
+    })
+
+    await run()
+    const popup = await popupPromise
+    assert(popup, 'Popup page not found')
+
+    return new PageHelper(popup)
+  }
+
+  async navigationAction(run: () => unknown | Promise<unknown>): Promise<void> {
+    const promise = this.page.waitForNavigation({ timeout: 10_000 })
     await run()
     await promise
-    await this.waitForNetworkIdle()
   }
 
-  async checkTitle(expected: string) {
-    await this.waitForNetworkIdle()
-    await expect(this.page.title()).resolves.toBe(expected)
+  async navigationClick(text: string, tag = 'button') {
+    return this.navigationAction(() => this.clickOnText(text, tag))
+  }
+
+  async assertTitle(expected: string) {
+    await expect(this.title()).resolves.toBe(expected)
   }
 
   async clickOn(selector: string) {
@@ -30,8 +74,12 @@ export class PageHelper implements AsyncDisposable {
     return elementHandle
   }
 
-  async clickOnButton(text: string) {
-    return this.clickOn(`button::-p-text(${JSON.stringify(text)})`)
+  async clickOnText(text: string, tag = 'button') {
+    return this.clickOn(`${tag}::-p-text(${JSON.stringify(text)})`)
+  }
+
+  async clickOnAriaLabel(label: string, tag = 'button') {
+    return this.clickOn(`${tag}[aria-label=${JSON.stringify(label)}]`)
   }
 
   async typeIn(selector: string, text: string) {
@@ -46,16 +94,22 @@ export class PageHelper implements AsyncDisposable {
   }
 
   async ensureTextVisibility(text: string, tag = 'p') {
-    await this.page.waitForSelector(`${tag}::-p-text(${JSON.stringify(text)})`)
+    await this.page.waitForSelector(
+      `${tag}::-p-text(${JSON.stringify(text)})`,
+      {
+        visible: true,
+        timeout: 5_000,
+      },
+    )
   }
 
   protected async getVisibleElement(selector: string) {
-    const elementHandle = await this.page.waitForSelector(selector)
-
-    expect(elementHandle).not.toBeNull()
-    assert(elementHandle)
+    const elementHandle = await this.page.waitForSelector(selector, {
+      visible: true,
+      timeout: 5_000,
+    })
 
-    await expect(elementHandle.isVisible()).resolves.toBe(true)
+    assert(elementHandle, `Element not found: ${selector}`)
 
     return elementHandle
   }

package/tests/auth.test.ts

@@ -1,4 +1,5 @@
 import * as jose from 'jose'
+import { request as undiciRequest } from 'undici'
 import { AtpAgent } from '@atproto/api'
 import { SeedClient, TestNetworkNoAppView } from '@atproto/dev-env'
 import { createRefreshToken } from '../src/account-manager/helpers/auth'
@@ -121,6 +122,94 @@ describe('auth', () => {
     )
   })
 
+  it('returns identical error responses for unknown identifier and known-identifier-with-wrong-password.', async () => {
+    const probe = async (info: { identifier: string; password: string }) => {
+      const res = await fetch(
+        `${network.pds.url}/xrpc/com.atproto.server.createSession`,
+        {
+          method: 'POST',
+          headers: { 'content-type': 'application/json' },
+          body: JSON.stringify(info),
+        },
+      )
+      return { status: res.status, body: await res.json() }
+    }
+
+    // bob.test was created above with password 'password'.
+    const unknownIdentifier = await probe({
+      identifier: 'no-such-user.test',
+      password: 'any-password',
+    })
+    const knownIdentifierWrongPassword = await probe({
+      identifier: 'bob.test',
+      password: 'wrong-password',
+    })
+
+    expect(knownIdentifierWrongPassword).toEqual(unknownIdentifier)
+    expect(unknownIdentifier).toEqual({
+      status: 401,
+      body: {
+        error: 'AuthenticationRequired',
+        message: 'Invalid identifier or password',
+      },
+    })
+  })
+
+  it('returns identical error responses for unknown identifier and known-identifier-with-wrong-password in the OAuth sign-in flow.', async () => {
+    const issuer = new URL(network.pds.url)
+    const csrfToken = 'a'.repeat(24)
+    const probe = async (credentials: {
+      username: string
+      password: string
+    }) => {
+      // @NOTE We use undici's low-level `request` rather than fetch(),
+      // because the WHATWG fetch API treats `sec-fetch-*` as forbidden
+      // request headers and silently overwrites them with its own values
+      // (notably `sec-fetch-mode: cors` in Node). The endpoint requires
+      // `same-origin` here, so we need raw header control.
+      const res = await undiciRequest(
+        `${issuer.origin}/@atproto/oauth-provider/~api/sign-in`,
+        {
+          method: 'POST',
+          headers: {
+            'content-type': 'application/json',
+            // The endpoint restricts fetches to same-origin navigations
+            // from either `/oauth/authorize` or `/account[/*]`. Use the
+            // first-party `/account` path so we don't need a live OAuth
+            // authorization request to exist in the request store.
+            'sec-fetch-mode': 'same-origin',
+            'sec-fetch-site': 'same-origin',
+            origin: issuer.origin,
+            referer: `${issuer.origin}/account`,
+            'x-csrf-token': csrfToken,
+            cookie: `csrf-token=${csrfToken}`,
+          },
+          body: JSON.stringify({ locale: 'en', ...credentials }),
+        },
+      )
+      return { status: res.statusCode, body: await res.body.json() }
+    }
+
+    // bob.test was created above with password 'password'.
+    const unknownIdentifier = await probe({
+      username: 'no-such-user.test',
+      password: 'any-password',
+    })
+    const knownIdentifierWrongPassword = await probe({
+      username: 'bob.test',
+      password: 'wrong-password',
+    })
+
+    expect(knownIdentifierWrongPassword).toEqual(unknownIdentifier)
+    expect(unknownIdentifier).toEqual({
+      status: 400,
+      body: {
+        error: 'invalid_request',
+        error_description: 'Invalid identifier or password',
+      },
+    })
+  })
+
   it('provides valid access and refresh token on session refresh.', async () => {
     const email = 'carol@test.com'
     const account = await createAccount({

package/tests/oauth.test.ts

@@ -1,14 +1,9 @@
 import { once } from 'node:events'
-import {
-  IncomingMessage,
-  Server,
-  ServerResponse,
-  createServer,
-} from 'node:http'
+import { Server, createServer } from 'node:http'
 import { AddressInfo } from 'node:net'
 import { type Browser, launch } from 'puppeteer'
 import { TestNetworkNoAppView } from '@atproto/dev-env'
-import files from '@atproto/oauth-client-browser-example' with { type: 'json' }
+import { oauthClientAssetsMiddleware } from './_oauth_client_assets_middleware.js'
 import { PageHelper } from './_puppeteer.js'
 
 describe('oauth', () => {
@@ -44,7 +39,7 @@ describe('oauth', () => {
       password: 'alice-pass',
     })
 
-    server = createServer(clientHandler)
+    server = createServer(oauthClientAssetsMiddleware)
     server.listen(0)
     await once(server, 'listening')
 
@@ -67,26 +62,24 @@ describe('oauth', () => {
 
   // This uses prompt=create under the hood:
   it('Allows to sign-up through OAuth', async () => {
-    const page = await PageHelper.from(browser, { languages })
+    await using page = await PageHelper.from(browser, { languages })
 
     await page.goto(appUrl)
 
-    await page.checkTitle('OAuth Client Example')
+    await page.assertTitle('OAuth Client Example')
 
-    await page.navigationAction(async () => {
-      await page.clickOnButton(`Sign up with ${new URL(network.pds.url).host}`)
-    })
+    await page.navigationClick(`Sign up with ${new URL(network.pds.url).host}`)
 
-    await page.checkTitle('Créer un compte')
+    await page.assertTitle("S'inscrire")
 
     await page.typeInInput('handle', 'bob')
 
-    await page.clickOnButton('Suivant')
+    await page.clickOnText('Suivant')
 
     await page.typeInInput('email', 'bob@test.com')
     await page.typeInInput('password', 'bob-pass')
 
-    await page.clickOnButton("S'inscrire")
+    await page.clickOnText("S'inscrire")
 
     await page.ensureTextVisibility(
       `L'application demande un contrôle total sur votre identité, ce qui signifie qu'elle pourrait casser de façon permanente, ou même usurper, votre compte. N'authorisez l'accès qu'aux applications auxquelles vous faites vraiment confiance.`,
@@ -96,54 +89,38 @@ describe('oauth', () => {
     // the client to resolve the account's did
     await network.processAll()
 
-    await page.navigationAction(async () => {
-      await page.clickOnButton("Authoriser l'accès")
-    })
+    await page.navigationClick('Autoriser')
 
-    await page.checkTitle('OAuth Client Example')
+    await page.assertTitle('OAuth Client Example')
 
     await page.ensureTextVisibility('Token info', 'h2')
 
-    await page.clickOn('button[aria-label="User menu"]')
+    await page.clickOnAriaLabel('User menu')
 
-    await page.clickOnButton('Sign out')
+    await page.clickOnText('Sign out')
 
     await page.waitForNetworkIdle()
-
-    // TODO: Find out why we can't use "using" here
-    await page[Symbol.asyncDispose]()
   })
 
-  it('Allows login or signup through OAuth via a choice', async () => {
-    const page = await PageHelper.from(browser, { languages })
+  it('Allows canceling the OAuth flow', async () => {
+    await using page = await PageHelper.from(browser, { languages })
 
     await page.goto(appUrl)
 
-    await page.checkTitle('OAuth Client Example')
-
-    await page.navigationAction(async () => {
-      await page.clickOnButton(`Login with ${new URL(network.pds.url).host}`)
-    })
+    await page.assertTitle('OAuth Client Example')
 
-    await page.checkTitle('Authentification')
+    await page.navigationClick(`Login with ${new URL(network.pds.url).host}`)
 
-    await page.ensureTextVisibility('Annuler', 'button')
-    await page.ensureTextVisibility('Se connecter', 'button')
-    await page.ensureTextVisibility('Créer un nouveau compte', 'button')
+    await page.assertTitle("S'identifier")
 
     // Cancel the OAuth flow:
-    await page.navigationAction(async () => {
-      await page.clickOnButton('Annuler')
-    })
+    await page.navigationClick('Annuler')
 
-    await page.checkTitle('OAuth Client Example')
+    await page.assertTitle('OAuth Client Example')
 
     await page.ensureTextVisibility('Login with the Atmosphere', 'h2')
 
     await page.waitForNetworkIdle()
-
-    // TODO: Find out why we can't use "using" here
-    await page[Symbol.asyncDispose]()
   })
 
   it('allows resetting the password', async () => {
@@ -153,31 +130,29 @@ describe('oauth', () => {
         // noop
       })
 
-    const page = await PageHelper.from(browser, { languages })
+    await using page = await PageHelper.from(browser, { languages })
 
     await page.goto(appUrl)
 
-    await page.checkTitle('OAuth Client Example')
+    await page.assertTitle('OAuth Client Example')
 
-    await page.navigationAction(async () => {
-      const input = await page.typeIn('input[name="identifier"]', 'alice.test')
+    const input = await page.typeInInput('identifier', 'alice.test')
 
-      await input.press('Enter')
-    })
+    await page.navigationAction(async () => input.press('Enter'))
 
-    await page.checkTitle('Connexion')
+    await page.assertTitle('Connexion')
 
-    await page.clickOnButton('Oublié ?')
+    await page.clickOnText('Oublié ?')
 
-    await page.checkTitle('Mot de passe oublié')
+    await page.assertTitle('Mot de passe oublié')
 
     await page.typeInInput('email', 'alice@test.com')
 
     expect(sendTemplateMock).toHaveBeenCalledTimes(0)
 
-    await page.clickOnButton('Suivant')
+    await page.clickOnText('Suivant')
 
-    await page.checkTitle('Réinitialiser le mot de passe')
+    await page.assertTitle('Réinitialiser le mot de passe')
 
     expect(sendTemplateMock).toHaveBeenCalledTimes(1)
 
@@ -191,34 +166,29 @@ describe('oauth', () => {
 
     await page.typeInInput('password', 'alice-new-pass')
 
-    await page.clickOnButton('Suivant')
+    await page.clickOnText('Suivant')
 
-    await page.checkTitle('Mot de passe mis à jour')
+    await page.assertTitle('Mot de passe mis à jour')
 
     await page.ensureTextVisibility('Mot de passe mis à jour !', 'h2')
 
-    // TODO: Find out why we can't use "using" here
-    await page[Symbol.asyncDispose]()
-
     sendTemplateMock.mockRestore()
   })
 
   it('Allows to sign-in through OAuth', async () => {
-    const page = await PageHelper.from(browser, { languages })
+    await using page = await PageHelper.from(browser, { languages })
 
     await page.goto(appUrl)
 
-    await page.checkTitle('OAuth Client Example')
+    await page.assertTitle('OAuth Client Example')
 
-    await page.navigationAction(async () => {
-      const input = await page.typeIn('input[name="identifier"]', 'alice.test')
+    const input = await page.typeInInput('identifier', 'alice.test')
 
-      await input.press('Enter')
-    })
+    await page.navigationAction(async () => input.press('Enter'))
 
-    await page.checkTitle('Connexion')
+    await page.assertTitle('Connexion')
 
-    await page.typeIn('input[type="password"]', 'alice-new-pass')
+    await page.typeInInput('password', 'alice-new-pass')
 
     // Make sure the warning is visible
     await page.ensureTextVisibility('Avertissement', 'h3')
@@ -227,79 +197,46 @@ describe('oauth', () => {
       'label::-p-text(Se souvenir de ce compte sur cet appareil)',
     )
 
-    await page.clickOnButton('Se connecter')
+    await page.clickOnText('Se connecter')
 
-    await page.checkTitle("Authoriser l'accès")
+    await page.assertTitle('Autoriser')
 
-    await page.navigationAction(async () => {
-      await page.clickOnButton("Authoriser l'accès")
-    })
+    await page.navigationClick('Autoriser')
 
-    await page.checkTitle('OAuth Client Example')
+    await page.assertTitle('OAuth Client Example')
 
     await page.ensureTextVisibility('Token info', 'h2')
 
-    await page.clickOn('button[aria-label="User menu"]')
+    await page.clickOnAriaLabel('User menu')
 
-    await page.clickOnButton('Sign out')
+    await page.clickOnText('Sign out')
 
     await page.waitForNetworkIdle()
-
-    // TODO: Find out why we can't use "using" here
-    await page[Symbol.asyncDispose]()
   })
 
   it('remembers the session', async () => {
-    const page = await PageHelper.from(browser, { languages })
+    await using page = await PageHelper.from(browser, { languages })
 
     await page.goto(appUrl)
 
-    await page.checkTitle('OAuth Client Example')
+    await page.assertTitle('OAuth Client Example')
 
-    await page.navigationAction(async () => {
-      const input = await page.typeIn('input[name="identifier"]', 'alice.test')
+    const input = await page.typeInInput('identifier', 'alice.test')
 
-      await input.press('Enter')
-    })
+    await page.navigationAction(async () => input.press('Enter'))
 
-    await page.checkTitle("Authoriser l'accès")
+    await page.assertTitle('Autoriser')
 
-    await page.navigationAction(async () => {
-      await page.clickOnButton("Authoriser l'accès")
-    })
+    await page.navigationClick('Autoriser')
 
-    await page.checkTitle('OAuth Client Example')
+    await page.assertTitle('OAuth Client Example')
 
     await page.ensureTextVisibility('Token info', 'h2')
 
-    await page.clickOn('button[aria-label="User menu"]')
+    await page.clickOnAriaLabel('User menu')
 
-    await page.clickOnButton('Sign out')
+    await page.clickOnText('Sign out')
 
     await page.waitForNetworkIdle()
-
-    // TODO: Find out why we can't use "using" here
-    await page[Symbol.asyncDispose]()
   })
 })
-
-function clientHandler(
-  req: IncomingMessage,
-  res: ServerResponse,
-  next?: (err?: unknown) => void,
-): void {
-  const path = req.url?.split('?')[0].slice(1) || 'index.html'
-  const file = Object.hasOwn(files, path) ? files[path] : null
-
-  if (file) {
-    res
-      .writeHead(200, 'OK', { 'content-type': file.mime })
-      .end(Buffer.from(file.data, 'base64'))
-  } else if (next) {
-    next()
-  } else {
-    res
-      .writeHead(404, 'Not Found', { 'content-type': 'text/plain' })
-      .end('Page not found')
-  }
-}