@atproto/pds 0.4.219 → 0.4.220

package/dist/lexicons/chat/bsky/moderation/subscribeModEvents.js

@@ -0,0 +1,45 @@
+"use strict";
+/*
+ * THIS FILE WAS GENERATED BY "@atproto/lex". DO NOT EDIT.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.$defs = void 0;
+__exportStar(require("./subscribeModEvents.defs.js"), exports);
+exports.$defs = __importStar(require("./subscribeModEvents.defs.js"));
+//# sourceMappingURL=subscribeModEvents.js.map

package/dist/lexicons/chat/bsky/moderation/subscribeModEvents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subscribeModEvents.js","sourceRoot":"","sources":["../../../../../src/lexicons/chat/bsky/moderation/subscribeModEvents.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,+DAA4C;AAC5C,sEAAqD","sourcesContent":["/*\n * THIS FILE WAS GENERATED BY \"@atproto/lex\". DO NOT EDIT.\n */\n\nexport * from './subscribeModEvents.defs.js'\nexport * as $defs from './subscribeModEvents.defs.js'\n"]}

package/dist/lexicons/chat/bsky/moderation.d.ts

@@ -1,4 +1,5 @@
 export * as getActorMetadata from './moderation/getActorMetadata.js';
 export * as getMessageContext from './moderation/getMessageContext.js';
+export * as subscribeModEvents from './moderation/subscribeModEvents.js';
 export * as updateActorAccess from './moderation/updateActorAccess.js';
 //# sourceMappingURL=moderation.d.ts.map

package/dist/lexicons/chat/bsky/moderation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"moderation.d.ts","sourceRoot":"","sources":["../../../../src/lexicons/chat/bsky/moderation.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,gBAAgB,MAAM,kCAAkC,CAAA;AACpE,OAAO,KAAK,iBAAiB,MAAM,mCAAmC,CAAA;AACtE,OAAO,KAAK,iBAAiB,MAAM,mCAAmC,CAAA"}
+{"version":3,"file":"moderation.d.ts","sourceRoot":"","sources":["../../../../src/lexicons/chat/bsky/moderation.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,gBAAgB,MAAM,kCAAkC,CAAA;AACpE,OAAO,KAAK,iBAAiB,MAAM,mCAAmC,CAAA;AACtE,OAAO,KAAK,kBAAkB,MAAM,oCAAoC,CAAA;AACxE,OAAO,KAAK,iBAAiB,MAAM,mCAAmC,CAAA"}

package/dist/lexicons/chat/bsky/moderation.js

@@ -36,8 +36,9 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.updateActorAccess = exports.getMessageContext = exports.getActorMetadata = void 0;
+exports.updateActorAccess = exports.subscribeModEvents = exports.getMessageContext = exports.getActorMetadata = void 0;
 exports.getActorMetadata = __importStar(require("./moderation/getActorMetadata.js"));
 exports.getMessageContext = __importStar(require("./moderation/getMessageContext.js"));
+exports.subscribeModEvents = __importStar(require("./moderation/subscribeModEvents.js"));
 exports.updateActorAccess = __importStar(require("./moderation/updateActorAccess.js"));
 //# sourceMappingURL=moderation.js.map

package/dist/lexicons/chat/bsky/moderation.js.map

@@ -1 +1 @@
-{"version":3,"file":"moderation.js","sourceRoot":"","sources":["../../../../src/lexicons/chat/bsky/moderation.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,qFAAoE;AACpE,uFAAsE;AACtE,uFAAsE","sourcesContent":["/*\n * THIS FILE WAS GENERATED BY \"@atproto/lex\". DO NOT EDIT.\n */\n\nexport * as getActorMetadata from './moderation/getActorMetadata.js'\nexport * as getMessageContext from './moderation/getMessageContext.js'\nexport * as updateActorAccess from './moderation/updateActorAccess.js'\n"]}
+{"version":3,"file":"moderation.js","sourceRoot":"","sources":["../../../../src/lexicons/chat/bsky/moderation.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,qFAAoE;AACpE,uFAAsE;AACtE,yFAAwE;AACxE,uFAAsE","sourcesContent":["/*\n * THIS FILE WAS GENERATED BY \"@atproto/lex\". DO NOT EDIT.\n */\n\nexport * as getActorMetadata from './moderation/getActorMetadata.js'\nexport * as getMessageContext from './moderation/getMessageContext.js'\nexport * as subscribeModEvents from './moderation/subscribeModEvents.js'\nexport * as updateActorAccess from './moderation/updateActorAccess.js'\n"]}

package/dist/lexicons/chat/bsky.d.ts

@@ -1,5 +1,6 @@
 export * as actor from './bsky/actor.js';
 export * as authFullChatClient from './bsky/authFullChatClient.js';
 export * as convo from './bsky/convo.js';
+export * as group from './bsky/group.js';
 export * as moderation from './bsky/moderation.js';
 //# sourceMappingURL=bsky.d.ts.map

package/dist/lexicons/chat/bsky.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bsky.d.ts","sourceRoot":"","sources":["../../../src/lexicons/chat/bsky.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,KAAK,MAAM,iBAAiB,CAAA;AACxC,OAAO,KAAK,kBAAkB,MAAM,8BAA8B,CAAA;AAClE,OAAO,KAAK,KAAK,MAAM,iBAAiB,CAAA;AACxC,OAAO,KAAK,UAAU,MAAM,sBAAsB,CAAA"}
+{"version":3,"file":"bsky.d.ts","sourceRoot":"","sources":["../../../src/lexicons/chat/bsky.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,KAAK,MAAM,iBAAiB,CAAA;AACxC,OAAO,KAAK,kBAAkB,MAAM,8BAA8B,CAAA;AAClE,OAAO,KAAK,KAAK,MAAM,iBAAiB,CAAA;AACxC,OAAO,KAAK,KAAK,MAAM,iBAAiB,CAAA;AACxC,OAAO,KAAK,UAAU,MAAM,sBAAsB,CAAA"}

package/dist/lexicons/chat/bsky.js

@@ -36,9 +36,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.moderation = exports.convo = exports.authFullChatClient = exports.actor = void 0;
+exports.moderation = exports.group = exports.convo = exports.authFullChatClient = exports.actor = void 0;
 exports.actor = __importStar(require("./bsky/actor.js"));
 exports.authFullChatClient = __importStar(require("./bsky/authFullChatClient.js"));
 exports.convo = __importStar(require("./bsky/convo.js"));
+exports.group = __importStar(require("./bsky/group.js"));
 exports.moderation = __importStar(require("./bsky/moderation.js"));
 //# sourceMappingURL=bsky.js.map

package/dist/lexicons/chat/bsky.js.map

@@ -1 +1 @@
-{"version":3,"file":"bsky.js","sourceRoot":"","sources":["../../../src/lexicons/chat/bsky.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,yDAAwC;AACxC,mFAAkE;AAClE,yDAAwC;AACxC,mEAAkD","sourcesContent":["/*\n * THIS FILE WAS GENERATED BY \"@atproto/lex\". DO NOT EDIT.\n */\n\nexport * as actor from './bsky/actor.js'\nexport * as authFullChatClient from './bsky/authFullChatClient.js'\nexport * as convo from './bsky/convo.js'\nexport * as moderation from './bsky/moderation.js'\n"]}
+{"version":3,"file":"bsky.js","sourceRoot":"","sources":["../../../src/lexicons/chat/bsky.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,yDAAwC;AACxC,mFAAkE;AAClE,yDAAwC;AACxC,yDAAwC;AACxC,mEAAkD","sourcesContent":["/*\n * THIS FILE WAS GENERATED BY \"@atproto/lex\". DO NOT EDIT.\n */\n\nexport * as actor from './bsky/actor.js'\nexport * as authFullChatClient from './bsky/authFullChatClient.js'\nexport * as convo from './bsky/convo.js'\nexport * as group from './bsky/group.js'\nexport * as moderation from './bsky/moderation.js'\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atproto/pds",
-  "version": "0.4.219",
+  "version": "0.4.220",
   "license": "MIT",
   "description": "Reference implementation of atproto Personal Data Server (PDS)",
   "keywords": [
@@ -45,24 +45,24 @@
     "undici": "^6.19.8",
     "zod": "^3.23.8",
     "@atproto-labs/fetch-node": "^0.2.0",
-    "@atproto-labs/simple-store": "^0.3.0",
-    "@atproto-labs/simple-store-memory": "^0.1.4",
     "@atproto-labs/simple-store-redis": "^0.0.1",
+    "@atproto-labs/simple-store-memory": "^0.1.4",
+    "@atproto-labs/simple-store": "^0.3.0",
     "@atproto-labs/xrpc-utils": "^0.0.24",
-    "@atproto/aws": "^0.2.32",
     "@atproto/common": "^0.5.16",
     "@atproto/crypto": "^0.4.5",
     "@atproto/identity": "^0.4.12",
     "@atproto/lex": "^0.0.25",
+    "@atproto/aws": "^0.2.32",
     "@atproto/lex-cbor": "^0.0.16",
-    "@atproto/lex-data": "^0.0.15",
     "@atproto/lex-json": "^0.0.16",
-    "@atproto/oauth-provider": "^0.16.0",
+    "@atproto/lex-data": "^0.0.15",
     "@atproto/oauth-scopes": "^0.3.2",
-    "@atproto/repo": "^0.9.1",
-    "@atproto/syntax": "^0.5.4",
+    "@atproto/oauth-provider": "^0.16.1",
     "@atproto/xrpc": "^0.7.7",
-    "@atproto/xrpc-server": "^0.10.20"
+    "@atproto/syntax": "^0.5.4",
+    "@atproto/xrpc-server": "^0.10.20",
+    "@atproto/repo": "^0.9.1"
   },
   "devDependencies": {
     "@atproto/pds-entryway": "npm:@atproto/pds@0.3.0-entryway.3",
@@ -80,7 +80,7 @@
     "ts-node": "^10.8.2",
     "typescript": "^5.6.3",
     "ws": "^8.12.0",
-    "@atproto/api": "^0.19.8",
+    "@atproto/api": "^0.19.9",
     "@atproto/bsky": "^0.0.226",
     "@atproto/lex-document": "^0.0.20",
     "@atproto/oauth-client-browser-example": "^0.0.10"

package/src/account-manager/account-manager.ts

@@ -32,6 +32,27 @@ import * as token from './helpers/token'
 
 export { AccountStatus, formatAccountStatus } from './helpers/account'
 
+/**
+ * Thrown by {@link AccountManager.login} when the identifier resolved to a
+ * known account but the supplied credentials (account password / app
+ * password) did not match. The matched `did` is attached so downstream
+ * callers can distinguish "identifier known, credentials wrong" from
+ * "identifier unknown" (which continues to throw a plain
+ * {@link AuthRequiredError}).
+ *
+ * Callers should take care that remote clients *cannot* distinguish the above,
+ * to prevent enumeration attacks. (Tested for in
+ * packages/pds/tests/auth.test.ts)
+ */
+export class InvalidPasswordError extends AuthRequiredError {
+  constructor(
+    public readonly did: string,
+    errorMessage = 'Invalid identifier or password',
+  ) {
+    super(errorMessage)
+  }
+}
+
 export type AccountManagerDbConfig = {
   accountDbLoc: string
   disableWalAutoCheckpoint: boolean
@@ -400,11 +421,11 @@ export class AccountManager {
       if (!validAccountPass) {
         // takendown/suspended accounts cannot login with app password
         if (isSoftDeleted) {
-          throw new AuthRequiredError('Invalid identifier or password')
+          throw new InvalidPasswordError(user.did)
         }
         appPassword = await this.verifyAppPassword(user.did, password)
         if (appPassword === null) {
-          throw new AuthRequiredError('Invalid identifier or password')
+          throw new InvalidPasswordError(user.did)
         }
       }
 

package/src/account-manager/oauth-store.ts

@@ -23,6 +23,7 @@ import {
   DeviceStore,
   FoundRequestResult,
   HandleUnavailableError,
+  InvalidCredentialsError,
   InvalidInviteCodeError,
   InvalidRequestError,
   LexiconData,
@@ -53,7 +54,7 @@ import { ImageUrlBuilder } from '../image/image-url-builder'
 import { dbLogger } from '../logger'
 import { ServerMailer } from '../mailer'
 import { Sequencer, syncEvtDataFromCommit } from '../sequencer'
-import { AccountManager } from './account-manager'
+import { AccountManager, InvalidPasswordError } from './account-manager'
 import * as schemas from './db/schema'
 import * as accountHelper from './helpers/account'
 import { AccountStatus } from './helpers/account'
@@ -236,8 +237,15 @@ export class OAuthStore
 
       return this.buildAccount(user)
     } catch (err) {
+      // `InvalidPasswordError` is a subclass of `XrpcAuthRequiredError`,
+      // so it must be checked first. Surfacing the matched `did` as the
+      // `sub` lets the oauth-provider's `onSignInFailed` hook distinguish
+      // "identifier known, credentials wrong" from "identifier unknown".
+      if (err instanceof InvalidPasswordError) {
+        throw new InvalidCredentialsError(err.message, err.did, err)
+      }
       if (err instanceof XrpcAuthRequiredError) {
-        throw new InvalidRequestError(err.message, err)
+        throw new InvalidCredentialsError(err.message, undefined, err)
       }
       throw err
     }

package/tests/auth.test.ts

@@ -1,4 +1,5 @@
 import * as jose from 'jose'
+import { request as undiciRequest } from 'undici'
 import { AtpAgent } from '@atproto/api'
 import { SeedClient, TestNetworkNoAppView } from '@atproto/dev-env'
 import { createRefreshToken } from '../src/account-manager/helpers/auth'
@@ -121,6 +122,94 @@ describe('auth', () => {
     )
   })
 
+  it('returns identical error responses for unknown identifier and known-identifier-with-wrong-password.', async () => {
+    const probe = async (info: { identifier: string; password: string }) => {
+      const res = await fetch(
+        `${network.pds.url}/xrpc/com.atproto.server.createSession`,
+        {
+          method: 'POST',
+          headers: { 'content-type': 'application/json' },
+          body: JSON.stringify(info),
+        },
+      )
+      return { status: res.status, body: await res.json() }
+    }
+
+    // bob.test was created above with password 'password'.
+    const unknownIdentifier = await probe({
+      identifier: 'no-such-user.test',
+      password: 'any-password',
+    })
+    const knownIdentifierWrongPassword = await probe({
+      identifier: 'bob.test',
+      password: 'wrong-password',
+    })
+
+    expect(knownIdentifierWrongPassword).toEqual(unknownIdentifier)
+    expect(unknownIdentifier).toEqual({
+      status: 401,
+      body: {
+        error: 'AuthenticationRequired',
+        message: 'Invalid identifier or password',
+      },
+    })
+  })
+
+  it('returns identical error responses for unknown identifier and known-identifier-with-wrong-password in the OAuth sign-in flow.', async () => {
+    const issuer = new URL(network.pds.url)
+    const csrfToken = 'a'.repeat(24)
+    const probe = async (credentials: {
+      username: string
+      password: string
+    }) => {
+      // @NOTE We use undici's low-level `request` rather than fetch(),
+      // because the WHATWG fetch API treats `sec-fetch-*` as forbidden
+      // request headers and silently overwrites them with its own values
+      // (notably `sec-fetch-mode: cors` in Node). The endpoint requires
+      // `same-origin` here, so we need raw header control.
+      const res = await undiciRequest(
+        `${issuer.origin}/@atproto/oauth-provider/~api/sign-in`,
+        {
+          method: 'POST',
+          headers: {
+            'content-type': 'application/json',
+            // The endpoint restricts fetches to same-origin navigations
+            // from either `/oauth/authorize` or `/account[/*]`. Use the
+            // first-party `/account` path so we don't need a live OAuth
+            // authorization request to exist in the request store.
+            'sec-fetch-mode': 'same-origin',
+            'sec-fetch-site': 'same-origin',
+            origin: issuer.origin,
+            referer: `${issuer.origin}/account`,
+            'x-csrf-token': csrfToken,
+            cookie: `csrf-token=${csrfToken}`,
+          },
+          body: JSON.stringify({ locale: 'en', ...credentials }),
+        },
+      )
+      return { status: res.statusCode, body: await res.body.json() }
+    }
+
+    // bob.test was created above with password 'password'.
+    const unknownIdentifier = await probe({
+      username: 'no-such-user.test',
+      password: 'any-password',
+    })
+    const knownIdentifierWrongPassword = await probe({
+      username: 'bob.test',
+      password: 'wrong-password',
+    })
+
+    expect(knownIdentifierWrongPassword).toEqual(unknownIdentifier)
+    expect(unknownIdentifier).toEqual({
+      status: 400,
+      body: {
+        error: 'invalid_request',
+        error_description: 'Invalid identifier or password',
+      },
+    })
+  })
+
   it('provides valid access and refresh token on session refresh.', async () => {
     const email = 'carol@test.com'
     const account = await createAccount({