@atproto/pds 0.4.219 → 0.4.221

package/tests/auth.test.ts

@@ -1,4 +1,5 @@
 import * as jose from 'jose'
+import { request as undiciRequest } from 'undici'
 import { AtpAgent } from '@atproto/api'
 import { SeedClient, TestNetworkNoAppView } from '@atproto/dev-env'
 import { createRefreshToken } from '../src/account-manager/helpers/auth'
@@ -121,6 +122,94 @@ describe('auth', () => {
     )
   })
 
+  it('returns identical error responses for unknown identifier and known-identifier-with-wrong-password.', async () => {
+    const probe = async (info: { identifier: string; password: string }) => {
+      const res = await fetch(
+        `${network.pds.url}/xrpc/com.atproto.server.createSession`,
+        {
+          method: 'POST',
+          headers: { 'content-type': 'application/json' },
+          body: JSON.stringify(info),
+        },
+      )
+      return { status: res.status, body: await res.json() }
+    }
+
+    // bob.test was created above with password 'password'.
+    const unknownIdentifier = await probe({
+      identifier: 'no-such-user.test',
+      password: 'any-password',
+    })
+    const knownIdentifierWrongPassword = await probe({
+      identifier: 'bob.test',
+      password: 'wrong-password',
+    })
+
+    expect(knownIdentifierWrongPassword).toEqual(unknownIdentifier)
+    expect(unknownIdentifier).toEqual({
+      status: 401,
+      body: {
+        error: 'AuthenticationRequired',
+        message: 'Invalid identifier or password',
+      },
+    })
+  })
+
+  it('returns identical error responses for unknown identifier and known-identifier-with-wrong-password in the OAuth sign-in flow.', async () => {
+    const issuer = new URL(network.pds.url)
+    const csrfToken = 'a'.repeat(24)
+    const probe = async (credentials: {
+      username: string
+      password: string
+    }) => {
+      // @NOTE We use undici's low-level `request` rather than fetch(),
+      // because the WHATWG fetch API treats `sec-fetch-*` as forbidden
+      // request headers and silently overwrites them with its own values
+      // (notably `sec-fetch-mode: cors` in Node). The endpoint requires
+      // `same-origin` here, so we need raw header control.
+      const res = await undiciRequest(
+        `${issuer.origin}/@atproto/oauth-provider/~api/sign-in`,
+        {
+          method: 'POST',
+          headers: {
+            'content-type': 'application/json',
+            // The endpoint restricts fetches to same-origin navigations
+            // from either `/oauth/authorize` or `/account[/*]`. Use the
+            // first-party `/account` path so we don't need a live OAuth
+            // authorization request to exist in the request store.
+            'sec-fetch-mode': 'same-origin',
+            'sec-fetch-site': 'same-origin',
+            origin: issuer.origin,
+            referer: `${issuer.origin}/account`,
+            'x-csrf-token': csrfToken,
+            cookie: `csrf-token=${csrfToken}`,
+          },
+          body: JSON.stringify({ locale: 'en', ...credentials }),
+        },
+      )
+      return { status: res.statusCode, body: await res.body.json() }
+    }
+
+    // bob.test was created above with password 'password'.
+    const unknownIdentifier = await probe({
+      username: 'no-such-user.test',
+      password: 'any-password',
+    })
+    const knownIdentifierWrongPassword = await probe({
+      username: 'bob.test',
+      password: 'wrong-password',
+    })
+
+    expect(knownIdentifierWrongPassword).toEqual(unknownIdentifier)
+    expect(unknownIdentifier).toEqual({
+      status: 400,
+      body: {
+        error: 'invalid_request',
+        error_description: 'Invalid identifier or password',
+      },
+    })
+  })
+
   it('provides valid access and refresh token on session refresh.', async () => {
     const email = 'carol@test.com'
     const account = await createAccount({
@@ -242,7 +331,9 @@ describe('auth', () => {
       password: 'password',
     })
     const refreshWithAccess = refreshSession(account.accessJwt)
-    await expect(refreshWithAccess).rejects.toThrow('Invalid token type')
+    await expect(refreshWithAccess).rejects.toThrow(
+      'Token could not be verified',
+    )
   })
 
   it('expired refresh token cannot be used to refresh a session.', async () => {

package/tests/entryway-mock.ts

@@ -0,0 +1,317 @@
+import { createPrivateKey } from 'node:crypto'
+import * as http from 'node:http'
+import * as plcLib from '@did-plc/lib'
+import { HttpTerminator, createHttpTerminator } from 'http-terminator'
+import * as jose from 'jose'
+import KeyEncoder from 'key-encoder'
+import * as ui8 from 'uint8arrays'
+import { AtpAgent } from '@atproto/api'
+import { getVerificationMaterial } from '@atproto/common'
+import { Secp256k1Keypair, randomStr } from '@atproto/crypto'
+import { IdResolver, getDidKeyFromMultibase } from '@atproto/identity'
+import { DidString, HandleString } from '@atproto/syntax'
+import {
+  AuthRequiredError,
+  createServer,
+  parseReqNsid,
+  verifyJwt as verifyServiceJwt,
+} from '@atproto/xrpc-server'
+import { bearerTokenFromReq, createPublicKeyObject } from '../src/auth-verifier'
+import { com } from '../src/lexicons/index.js'
+
+interface Account {
+  did: DidString
+  handle: HandleString
+  email?: string
+}
+
+interface MockEntrywayOpts {
+  port: number
+  serviceDid: string
+  plcUrl: string
+  pdsUrl: string
+  pdsDid: string
+  adminPassword: string
+  jwtSigningKey: Secp256k1Keypair
+  plcRotationKey: Secp256k1Keypair
+}
+
+type AccessAuthResult = { credentials: { did: string; type: 'access' } }
+type ServiceAuthResult = { credentials: { did: string; type: 'service' } }
+
+export class MockEntryway {
+  public url: string
+  public serviceDid: string
+  public plcRotationKey: Secp256k1Keypair
+  public idResolver: IdResolver
+
+  private server: http.Server
+  private terminator: HttpTerminator
+  private accounts = new Map<string, Account>()
+
+  private constructor(
+    server: http.Server,
+    terminator: HttpTerminator,
+    idResolver: IdResolver,
+    opts: MockEntrywayOpts,
+  ) {
+    this.server = server
+    this.terminator = terminator
+    this.url = `http://localhost:${opts.port}`
+    this.serviceDid = opts.serviceDid
+    this.plcRotationKey = opts.plcRotationKey
+    this.idResolver = idResolver
+  }
+
+  static async create(opts: MockEntrywayOpts): Promise<MockEntryway> {
+    const keyEncoder = new KeyEncoder('secp256k1')
+    const privateKeyHex = ui8.toString(await opts.jwtSigningKey.export(), 'hex')
+    const privatePem = keyEncoder.encodePrivate(privateKeyHex, 'raw', 'pem')
+    const jwtPrivateKey = createPrivateKey({ format: 'pem', key: privatePem })
+    const jwtPublicKey = createPublicKeyObject(
+      opts.jwtSigningKey.publicKeyStr('hex'),
+    )
+
+    const plcClient = new plcLib.Client(opts.plcUrl)
+    const pdsAgent = new AtpAgent({ service: opts.pdsUrl })
+    const idResolver = new IdResolver({ plcUrl: opts.plcUrl })
+
+    const accounts = new Map<string, Account>()
+
+    const getSigningKey = async (
+      iss: string,
+      forceRefresh: boolean,
+    ): Promise<string> => {
+      const [did, serviceId] = iss.split('#')
+      if (serviceId) {
+        throw new AuthRequiredError('no service id expected in iss claim')
+      }
+      const didDoc = await idResolver.did.resolve(did, forceRefresh)
+      if (!didDoc) {
+        throw new AuthRequiredError(`could not resolve did: ${did}`)
+      }
+      const parsedKey = getVerificationMaterial(didDoc, 'atproto')
+      if (!parsedKey) {
+        throw new AuthRequiredError('missing or bad key in did doc')
+      }
+      const didKey = getDidKeyFromMultibase(parsedKey)
+      if (!didKey) {
+        throw new AuthRequiredError('missing or bad key in did doc')
+      }
+      return didKey
+    }
+
+    const bearerToken = (req: http.IncomingMessage): string => {
+      const token = bearerTokenFromReq(req)
+      if (!token) {
+        throw new AuthRequiredError('missing bearer token')
+      }
+      return token
+    }
+
+    // Auth: verify user access token (typ: 'at+jwt') signed by entryway
+    const accessAuth = async ({
+      req,
+    }: {
+      req: http.IncomingMessage
+    }): Promise<AccessAuthResult> => {
+      try {
+        const token = bearerToken(req)
+        const { protectedHeader, payload } = await jose.jwtVerify(
+          token,
+          jwtPublicKey,
+        )
+        if (protectedHeader.typ !== 'at+jwt') {
+          throw new AuthRequiredError('expected typ: at+jwt')
+        }
+        if (!payload.sub) {
+          throw new AuthRequiredError('missing sub in token')
+        }
+        return { credentials: { did: payload.sub, type: 'access' } }
+      } catch (err) {
+        console.log(err)
+        throw err
+      }
+    }
+
+    // Auth: verify service auth token from PDS (no typ / typ !== 'at+jwt')
+    const serviceAuth = async ({
+      req,
+    }: {
+      req: http.IncomingMessage
+    }): Promise<ServiceAuthResult> => {
+      try {
+        const token = bearerToken(req)
+        const { typ } = jose.decodeProtectedHeader(token)
+        if (typ === 'at+jwt') {
+          throw new AuthRequiredError(
+            'expected service auth: typ must not be at+jwt',
+          )
+        }
+        const nsid = parseReqNsid(req)
+        const payload = await verifyServiceJwt(
+          token,
+          opts.serviceDid,
+          nsid,
+          getSigningKey,
+        )
+        return { credentials: { did: payload.iss, type: 'service' } }
+      } catch (err) {
+        console.log(err)
+        throw err
+      }
+    }
+
+    // Auth: accept either access token or service auth
+    const accessOrServiceAuth = async ({
+      req,
+    }: {
+      req: http.IncomingMessage
+    }): Promise<AccessAuthResult | ServiceAuthResult> => {
+      const token = bearerToken(req)
+      const { typ } = jose.decodeProtectedHeader(token)
+      if (typ === 'at+jwt') {
+        return accessAuth({ req })
+      }
+      return serviceAuth({ req })
+    }
+
+    const server = createServer()
+
+    server.add(com.atproto.server.createAccount, {
+      handler: async ({ input }) => {
+        const { email, handle } = input.body
+
+        // Reserve a signing key on the PDS
+        const {
+          data: { signingKey },
+        } = await pdsAgent.com.atproto.server.reserveSigningKey({})
+
+        // Create PLC operation
+        const plcCreate = await plcLib.createOp({
+          signingKey,
+          rotationKeys: [opts.plcRotationKey.did()],
+          handle,
+          pds: opts.pdsUrl,
+          signer: opts.plcRotationKey,
+        })
+
+        // Create account on PDS (no auth needed — userServiceAuthOptional)
+        await pdsAgent.com.atproto.server.createAccount({
+          did: plcCreate.did,
+          handle,
+          plcOp: plcCreate.op,
+        })
+
+        // Store account in memory
+        accounts.set(plcCreate.did, {
+          did: plcCreate.did as DidString,
+          handle,
+          email,
+        })
+
+        // Sign access + refresh JWTs
+        const now = Math.floor(Date.now() / 1000)
+        const accessJwt = await new jose.SignJWT({
+          scope: 'com.atproto.access',
+        })
+          .setProtectedHeader({ alg: 'ES256K', typ: 'at+jwt' })
+          .setSubject(plcCreate.did)
+          .setAudience(opts.pdsDid)
+          .setIssuedAt(now)
+          .setExpirationTime(now + 60 * 60)
+          .setJti(randomStr(16, 'base32'))
+          .sign(jwtPrivateKey)
+
+        const refreshJwt = await new jose.SignJWT({
+          scope: 'com.atproto.refresh',
+        })
+          .setProtectedHeader({ alg: 'ES256K', typ: 'at+jwt' })
+          .setSubject(plcCreate.did)
+          .setAudience(opts.pdsDid)
+          .setIssuedAt(now)
+          .setExpirationTime(now + 90 * 24 * 60 * 60)
+          .setJti(randomStr(16, 'base32'))
+          .sign(jwtPrivateKey)
+
+        return {
+          encoding: 'application/json' as const,
+          body: {
+            did: plcCreate.did as DidString,
+            handle,
+            accessJwt,
+            refreshJwt,
+          },
+        }
+      },
+    })
+
+    server.add(com.atproto.server.getSession, {
+      auth: accessOrServiceAuth,
+      handler: async ({ auth }) => {
+        const account = accounts.get(auth.credentials.did)
+        if (!account) {
+          throw new Error(
+            `Could not find account for DID: ${auth.credentials.did}`,
+          )
+        }
+        return {
+          encoding: 'application/json' as const,
+          body: {
+            did: account.did,
+            handle: account.handle,
+            email: account.email,
+            emailConfirmed: false,
+          },
+        }
+      },
+    })
+
+    server.add(com.atproto.identity.updateHandle, {
+      auth: serviceAuth,
+      handler: async ({ auth, input }) => {
+        // The PDS sends { did, handle } where did is the target user
+        const body = input.body as typeof input.body & { did?: string }
+        const targetDid = body.did || auth.credentials.did
+        const newHandle = body.handle
+
+        // Update handle in PLC
+        await plcClient.updateHandle(targetDid, opts.plcRotationKey, newHandle)
+
+        // Update in-memory account
+        const account = accounts.get(targetDid)
+        if (account) {
+          account.handle = newHandle
+        }
+
+        // Notify PDS via admin endpoint
+        const adminAuth = Buffer.from(`admin:${opts.adminPassword}`).toString(
+          'base64',
+        )
+        await pdsAgent.com.atproto.admin.updateAccountHandle(
+          { did: targetDid, handle: newHandle },
+          {
+            headers: { authorization: `Basic ${adminAuth}` },
+            encoding: 'application/json',
+          },
+        )
+      },
+    })
+
+    const httpServer = server.listen(opts.port)
+    const terminator = createHttpTerminator({ server: httpServer })
+
+    const instance = new MockEntryway(httpServer, terminator, idResolver, opts)
+    instance.accounts = accounts
+
+    return instance
+  }
+
+  getAccount(did: string): Account | undefined {
+    return this.accounts.get(did)
+  }
+
+  async destroy(): Promise<void> {
+    await this.terminator.terminate()
+  }
+}

package/tests/entryway.test.ts

@@ -1,22 +1,17 @@
 import assert from 'node:assert'
-import * as os from 'node:os'
-import * as path from 'node:path'
 import * as plcLib from '@did-plc/lib'
 import getPort from 'get-port'
-import { decodeJwt } from 'jose'
-import * as ui8 from 'uint8arrays'
 import { AtpAgent } from '@atproto/api'
-import { Secp256k1Keypair, randomStr } from '@atproto/crypto'
+import { Secp256k1Keypair } from '@atproto/crypto'
 import { SeedClient, TestPds, TestPlc, mockResolvers } from '@atproto/dev-env'
 import { isDidString } from '@atproto/lex'
-import * as pdsEntryway from '@atproto/pds-entryway'
 import { DidString } from '@atproto/syntax'
-import { parseReqNsid } from '@atproto/xrpc-server'
+import { MockEntryway } from './entryway-mock'
 
 describe('entryway', () => {
   let plc: TestPlc
   let pds: TestPds
-  let entryway: pdsEntryway.PDS
+  let entryway: MockEntryway
   let pdsAgent: AtpAgent
   let entrywayAgent: AtpAgent
   let alice: DidString
@@ -30,7 +25,7 @@ describe('entryway', () => {
     pds = await TestPds.create({
       entrywayUrl: `http://localhost:${entrywayPort}`,
       entrywayDid: 'did:example:entryway',
-      entrywayJwtVerifyKeyK256PublicKeyHex: getPublicHex(jwtSigningKey),
+      entrywayJwtVerifyKeyK256PublicKeyHex: jwtSigningKey.publicKeyStr('hex'),
       entrywayPlcRotationKey: plcRotationKey.did(),
       adminPassword: 'admin-pass',
       serviceHandleDomains: [],
@@ -38,29 +33,21 @@ describe('entryway', () => {
       serviceDid: 'did:example:pds',
       inviteRequired: false,
     })
-    entryway = await createEntryway({
-      dbPostgresSchema: 'entryway',
+    entryway = await MockEntryway.create({
       port: entrywayPort,
-      adminPassword: 'admin-pass',
-      jwtSigningKeyK256PrivateKeyHex: await getPrivateHex(jwtSigningKey),
-      plcRotationKeyK256PrivateKeyHex: await getPrivateHex(plcRotationKey),
-      inviteRequired: false,
       serviceDid: 'did:example:entryway',
-      didPlcUrl: plc.url,
+      plcUrl: plc.url,
+      pdsUrl: pds.url,
+      pdsDid: 'did:example:pds',
+      adminPassword: 'admin-pass',
+      jwtSigningKey,
+      plcRotationKey,
     })
     mockResolvers(pds.ctx.idResolver, pds)
-    mockResolvers(entryway.ctx.idResolver, pds)
-    await entryway.ctx.db.db
-      .insertInto('pds')
-      .values({
-        did: pds.ctx.cfg.service.did,
-        host: new URL(pds.ctx.cfg.service.publicUrl).host,
-        weight: 1,
-      })
-      .execute()
+    mockResolvers(entryway.idResolver, pds)
     pdsAgent = pds.getAgent()
     entrywayAgent = new AtpAgent({
-      service: entryway.ctx.cfg.service.publicUrl,
+      service: entryway.url,
     })
   })
 
@@ -110,9 +97,7 @@ describe('entryway', () => {
     const doc = await pds.ctx.idResolver.did.resolve(alice)
     const handleToDid = await pds.ctx.idResolver.handle.resolve('alice2.test')
     const accountFromPds = await pds.ctx.accountManager.getAccount(alice)
-    const accountFromEntryway = await entryway.ctx.services
-      .account(entryway.ctx.db)
-      .getAccount(alice)
+    const accountFromEntryway = entryway.getAccount(alice)
     expect(doc?.alsoKnownAs).toEqual(['at://alice2.test'])
     expect(handleToDid).toEqual(alice)
     expect(accountFromPds?.handle).toEqual('alice2.test')
@@ -128,13 +113,10 @@ describe('entryway', () => {
         'com.atproto.identity.updateHandle',
       ),
     )
-    const doc = await entryway.ctx.idResolver.did.resolve(alice)
-    const handleToDid =
-      await entryway.ctx.idResolver.handle.resolve('alice3.test')
+    const doc = await entryway.idResolver.did.resolve(alice)
+    const handleToDid = await entryway.idResolver.handle.resolve('alice3.test')
     const accountFromPds = await pds.ctx.accountManager.getAccount(alice)
-    const accountFromEntryway = await entryway.ctx.services
-      .account(entryway.ctx.db)
-      .getAccount(alice)
+    const accountFromEntryway = entryway.getAccount(alice)
     expect(doc?.alsoKnownAs).toEqual(['at://alice3.test'])
     expect(handleToDid).toEqual(alice)
     expect(accountFromPds?.handle).toEqual('alice3.test')
@@ -148,7 +130,7 @@ describe('entryway', () => {
     const rotationKey = await Secp256k1Keypair.create()
     const plcCreate = await plcLib.createOp({
       signingKey,
-      rotationKeys: [rotationKey.did(), entryway.ctx.plcRotationKey.did()],
+      rotationKeys: [rotationKey.did(), entryway.plcRotationKey.did()],
       handle: 'weirdalice.test',
       pds: pds.ctx.cfg.service.publicUrl,
       signer: rotationKey,
@@ -161,67 +143,3 @@ describe('entryway', () => {
     await expect(tryCreateAccount).rejects.toThrow('invalid plc operation')
   })
 })
-
-const createEntryway = async (
-  config: pdsEntryway.ServerEnvironment & {
-    adminPassword: string
-    jwtSigningKeyK256PrivateKeyHex: string
-    plcRotationKeyK256PrivateKeyHex: string
-  },
-) => {
-  const signingKey = await Secp256k1Keypair.create({ exportable: true })
-  const recoveryKey = await Secp256k1Keypair.create({ exportable: true })
-  const env: pdsEntryway.ServerEnvironment = {
-    isEntryway: true,
-    recoveryDidKey: recoveryKey.did(),
-    serviceHandleDomains: ['.test'],
-    dbPostgresUrl: process.env.DB_POSTGRES_URL,
-    blobstoreDiskLocation: path.join(os.tmpdir(), randomStr(8, 'base32')),
-    bskyAppViewUrl: 'https://appview.invalid',
-    bskyAppViewDid: 'did:example:invalid',
-    bskyAppViewCdnUrlPattern: 'http://cdn.appview.com/%s/%s/%s',
-    jwtSecret: randomStr(8, 'base32'),
-    repoSigningKeyK256PrivateKeyHex: await getPrivateHex(signingKey),
-    modServiceUrl: 'https://mod.invalid',
-    modServiceDid: 'did:example:invalid',
-    ...config,
-  }
-  const cfg = pdsEntryway.envToCfg(env)
-  const secrets = pdsEntryway.envToSecrets(env)
-  const server = await pdsEntryway.PDS.create(cfg, secrets)
-  await server.ctx.db.migrateToLatestOrThrow()
-  await server.start()
-  // patch entryway access token verification to handle internal service auth pds -> entryway
-  const origValidateAccessToken =
-    server.ctx.authVerifier.validateAccessToken.bind(server.ctx.authVerifier)
-  server.ctx.authVerifier.validateAccessToken = async (req, scopes) => {
-    const jwt = req.headers.authorization?.replace('Bearer ', '') ?? ''
-    const claims = decodeJwt(jwt)
-    if (claims.aud === 'did:example:entryway') {
-      assert(claims.lxm === parseReqNsid(req), 'bad lxm claim in service auth')
-      assert(claims.aud, 'missing aud claim in service auth')
-      assert(claims.iss, 'missing iss claim in service auth')
-      return {
-        artifacts: jwt,
-        credentials: {
-          type: 'access',
-          scope: 'com.atproto.access' as any,
-          audience: claims.aud,
-          did: claims.iss,
-        },
-      }
-    }
-    return origValidateAccessToken(req, scopes)
-  }
-  // @TODO temp hack because entryway teardown calls signupActivator.run() by mistake
-  server.ctx.signupActivator.run = server.ctx.signupActivator.destroy
-  return server
-}
-
-const getPublicHex = (key: Secp256k1Keypair) => {
-  return key.publicKeyStr('hex')
-}
-
-const getPrivateHex = async (key: Secp256k1Keypair) => {
-  return ui8.toString(await key.export(), 'hex')
-}