npm - @atproto/pds - Versions diffs - 0.4.223 → 0.4.224 - Mend

@atproto/pds 0.4.223 → 0.4.224

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (2641) hide show

package/dist/auth-verifier.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth-verifier.js","sourceRoot":"","sources":["../src/auth-verifier.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsjBA,sCAWC;AAjkBD,6CAAyE;AAEzE,2CAA4B;AAC5B,8DAAoC;AACpC,4CAAyD;AACzD,gDAAsE;AACtE,sCAAyE;AACzE,4DAKgC;AAChC,wDAG8B;AAC9B,sDAW6B;AAY7B,6CAAsE;AACtE,6BAAkC;AAClC,sCAAwC;AAiDxC,MAAa,YAAY;IAMvB,YACS,cAA8B,EAC9B,UAAsB,EACtB,aAA4B,EACnC,IAAsB;QAHtB;;;;mBAAO,cAAc;WAAgB;QACrC;;;;mBAAO,UAAU;WAAY;QAC7B;;;;mBAAO,aAAa;WAAe;QAR7B;;;;;WAAkB;QAClB;;;;;WAAkB;QAClB;;;;;WAAkB;QACnB;;;;;WAA8B;QAcrC,0CAA0C;QAEnC;;;;mBAA6D,CAAC,GAAG,EAAE,EAAE;gBAC1E,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBAEvB,0EAA0E;gBAC1E,2EAA2E;gBAC3E,2EAA2E;gBAC3E,uBAAuB;gBACvB,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;oBACrC,MAAM,IAAI,+BAAiB,CAAC,8BAA8B,CAAC,CAAA;gBAC7D,CAAC;gBAED,OAAO;oBACL,WAAW,EAAE,IAAI;iBAClB,CAAA;YACH,CAAC;WAAA;QAEM;;;;mBAAmD,KAAK,EAAE,GAAG,EAAE,EAAE;gBACtE,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBACvB,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBACtC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,IAAI,+BAAiB,EAAE,CAAA;gBAC/B,CAAC;gBACD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAA;gBACrC,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;oBACzD,MAAM,IAAI,+BAAiB,EAAE,CAAA;gBAC/B,CAAC;gBAED,OAAO,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CAAA;YACjD,CAAC;WAAA;QAEM;;;;mBAAmD,KAAK,EAAE,GAAG,EAAE,EAAE;gBACtE,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBACvB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;oBAC1B,MAAM,IAAI,+BAAiB,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAA;gBACjE,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE;oBACnD,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,kBAAkB,CAAC;iBACvE,CAAC,CAAA;gBACF,OAAO;oBACL,WAAW,EAAE;wBACX,IAAI,EAAE,aAAa;wBACnB,GAAG,EAAE,OAAO,CAAC,GAAG;qBACjB;iBACF,CAAA;YACH,CAAC;WAAA;QAEM;;;;mBACL,KAAK,EAAE,GAAG,EAAE,EAAE;gBACZ,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBACrC,IAAI,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;oBAC7B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;gBAC7B,CAAC;qBAAM,CAAC;oBACN,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;gBAC7B,CAAC;YACH,CAAC;WAAA;QAgII;;;;mBAA6D,KAAK,EACvE,GAAG,EACH,EAAE;gBACF,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBACvB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBACpD,OAAO;oBACL,WAAW,EAAE;wBACX,IAAI,EAAE,mBAAmB;wBACzB,GAAG,EAAE,OAAO,CAAC,GAAG;qBACjB;iBACF,CAAA;YACH,CAAC;WAAA;QAEM;;;;mBAEH,KAAK,EAAE,GAAG,EAAE,EAAE;gBAChB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBACrC,IAAI,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;oBAC7B,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;gBACxC,CAAC;qBAAM,CAAC;oBACN,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;gBAClC,CAAC;YACH,CAAC;WAAA;QApNC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAA;QAChC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAA;QAC1B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAA;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;IACvB,CAAC;IA4DS,MAAM,CACd,OAAqD;QAErD,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,EAAE,GAAG,OAAO,CAAA;QAE5C,MAAM,gBAAgB,GAA8B;YAClD,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG;YACvB,GAAG,EAAE,QAAQ;YACb,MAAM;YACJ,mEAAmE;YACnE,0BAA0B;YAC1B,aAAa,CAAC,aAAa,IAAI,MAAM,CAAC,QAAQ,CAAC,sBAAS,CAAC,SAAc,CAAC;gBACtE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,sBAAS,CAAC,SAAS,CAAC;gBACjD,CAAC,CAAC,MAAM;SACb,CAAA;QAED,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CACpD,GAAG,CAAC,GAAG,EACP,gBAAgB,CACjB,CAAA;YAED,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;YAE3C,OAAO;gBACL,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE;aAC5C,CAAA;QACH,CAAC,CAAA;IACH,CAAC;IAEM,OAAO,CAAC,OAEd;QACC,MAAM,aAAa,GAA8C;YAC/D,cAAc,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;YAC5D,GAAG,EAAE,aAAa;YAClB,oDAAoD;YACpD,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACjE,MAAM,EAAE,CAAC,sBAAS,CAAC,OAAO,CAAC;SAC5B,CAAA;QAED,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;YAEjE,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAA;YAC1B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,+BAAiB,CACzB,qCAAqC,EACrC,gBAAgB,CACjB,CAAA;YACH,CAAC;YAED,OAAO;gBACL,WAAW,EAAE;oBACX,IAAI,EAAE,SAAS;oBACf,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,OAAO;iBACR;aACF,CAAA;QACH,CAAC,CAAA;IACH,CAAC;IAEM,aAAa,CAAmB,EACrC,MAAM,GAAG,4BAAe,EACxB,UAAU,GAAG,EAAE,EACf,GAAG,OAAO,EAIU;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YACzB,GAAG,OAAO;YACV,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,UAAU,CAAC;SACnC,CAAC,CAAA;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAEjC,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAErC,IAAI,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC7B,OAAO,MAAM,CAAC,GAAG,CAAC,CAAA;YACpB,CAAC;YAED,IAAI,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAC3B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAA;YACnB,CAAC;YAED,uEAAuE;YACvE,+CAA+C;YAC/C,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,iCAAmB,CAC3B,+BAA+B,EAC/B,cAAc,CACf,CAAA;YACH,CAAC;YAED,MAAM,IAAI,+BAAiB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;QACvD,CAAC,CAAA;IACH,CAAC;IAEM,iCAAiC,CACtC,IAAiE;QAKjE,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;QAC9C,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACrC,IAAI,IAAI,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACvD,OAAO,aAAa,CAAC,GAAG,CAAC,CAAA;YAC3B,CAAC;iBAAM,IAAI,IAAI,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACnC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;YAC7B,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YAClC,CAAC;QACH,CAAC,CAAA;IACH,CAAC;IA0BM,8BAA8B,CACnC,OAGsB;QAEtB,MAAM,qBAAqB,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;QACzD,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,IAAI,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrC,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YAClC,CAAC;iBAAM,CAAC;gBACN,OAAO,qBAAqB,CAAC,GAAG,CAAC,CAAA;YACnC,CAAC;QACH,CAAC,CAAA;IACH,CAAC;IAES,KAAK,CAAmB,EAChC,SAAS,EACT,GAAG,mBAAmB,EACiB;QAIvC,MAAM,kBAAkB,GAA8B;YACpD,QAAQ,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YACzB,KAAK,EAAE,CAAC,SAAS,CAAC;SACnB,CAAA;QAED,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,CAAA;YAExB,4DAA4D;YAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,CAAA;YACpD,IAAI,SAAS,EAAE,CAAC;gBACd,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,SAAS,CAAC,CAAA;gBACtC,GAAG,CAAC,YAAY,CAAC,+BAA+B,EAAE,YAAY,CAAC,CAAA;YACjE,CAAC;YAED,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAA;YACrD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;YAEjD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa;iBACjD,mBAAmB,CAClB,GAAG,CAAC,MAAM,IAAI,KAAK,EACnB,GAAG,EACH,GAAG,CAAC,OAAO,EACX,kBAAkB,CACnB;iBACA,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACb,mEAAmE;gBACnE,0DAA0D;gBAC1D,IAAI,GAAG,YAAY,qCAAoB,EAAE,CAAC;oBACxC,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,GAAG,CAAC,qBAAqB,CAAC,CAAA;oBAC5D,GAAG,CAAC,YAAY,CACd,+BAA+B,EAC/B,kBAAkB,CACnB,CAAA;gBACH,CAAC;gBAED,IAAI,GAAG,YAAY,2BAAU,EAAE,CAAC;oBAC9B,MAAM,IAAI,uBAAS,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,iBAAiB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAA;gBACnE,CAAC;gBAED,MAAM,GAAG,CAAA;YACX,CAAC,CAAC,CAAA;YAEJ,IAAI,CAAC,IAAA,iBAAW,EAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,iCAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;YAClE,CAAC;YAED,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAA;YAEjD,MAAM,WAAW,GAAG,IAAI,yCAA0B,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;YAErE,sBAAsB;YACtB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,iCAAmB,CAC3B,2CAA2C,EAC3C,cAAc,CACf,CAAA;YACH,CAAC;YAED,MAAM,SAAS,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;YAEjC,OAAO;gBACL,WAAW,EAAE;oBACX,IAAI,EAAE,OAAO;oBACb,GAAG;oBACH,WAAW;iBACZ;aACF,CAAA;QACH,CAAC,CAAA;IACH,CAAC;IAES,KAAK,CAAC,YAAY,CAC1B,GAAc,EACd,OAAwB;QAExB,IAAI,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YACtD,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QACtC,CAAC;IACH,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,WAAW,CACtB,WAA+B,EAC/B,OAAwB;QAExB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,WAAW,EAAE;YAChE,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,yEAAyE;YACzE,MAAM,IAAI,4BAAc,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,CAAC,aAAa,IAAI,IAAA,gBAAW,EAAC,OAAO,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,+BAAiB,CACzB,6BAA6B,EAC7B,iBAAiB,CAClB,CAAA;QACH,CAAC;QACD,IAAI,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YACtD,MAAM,IAAI,+BAAiB,CACzB,wBAAwB,EACxB,oBAAoB,CACrB,CAAA;QACH,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IAED;;;OAGG;IACO,KAAK,CAAC,eAAe,CAC7B,GAAoB,EACpB,EAAE,MAAM,EAAE,GAAG,OAAO,EAA6B;QAEjD,MAAM,KAAK,GAAG,IAAA,0BAAkB,EAAC,GAAG,CAAC,CAAA;QACrC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,+BAAiB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;QACvD,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI;aAC3B,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;aACvC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACf,IAAI,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC5C,MAAM,IAAI,iCAAmB,CAAC,mBAAmB,EAAE,cAAc,EAAE;oBACjE,KAAK;iBACN,CAAC,CAAA;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,iCAAmB,CAC3B,6BAA6B,EAC7B,cAAc,EACd,EAAE,KAAK,EAAE,CACV,CAAA;YACH,CAAC;QACH,CAAC,CAAC,CAAA;QAEJ,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;QAElD,IAAI,OAAO,GAAG,KAAK,WAAW,EAAE,CAAC;YAC/B,sEAAsE;YACtE,yEAAyE;YACzE,+DAA+D;YAC/D,yEAAyE;YACzE,mBAAmB;YACnB,MAAM,IAAI,iCAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,WAAW,EAAE,CAAC;YAC/B,wDAAwD;YACxD,8CAA8C;YAC9C,MAAM,IAAI,iCAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,IAAA,iBAAW,EAAC,GAAG,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,iCAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,iCAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,WAAW,EAAE,CAAC;YAC1D,MAAM,IAAI,iCAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,CAAC,IAAA,wBAAW,EAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAY,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,iCAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QAED,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,KAAU,EAAE,CAAA;IAC7C,CAAC;IAES,KAAK,CAAC,gBAAgB,CAC9B,GAAoB,EACpB,IAAyB;QAEzB,MAAM,MAAM,GAAG,IAAA,0BAAkB,EAAC,GAAG,CAAC,CAAA;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,+BAAiB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAA;QAC1D,CAAC;QAED,MAAM,IAAI,GAAG,IAAA,0BAAY,EAAC,GAAG,CAAC,CAAA;QAC9B,MAAM,OAAO,GAAG,MAAM,IAAA,uBAAgB,EACpC,MAAM,EACN,IAAI,EACJ,IAAI,EACJ,KAAK,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE;YAC1B,IAAI,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,+BAAiB,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAA;YACjE,CAAC;YACD,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACvC,MAAM,KAAK,GACT,SAAS,KAAK,iBAAiB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAA;YAC/D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;YACnE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,+BAAiB,CAAC,2BAA2B,CAAC,CAAA;YAC1D,CAAC;YACD,MAAM,SAAS,GAAG,IAAA,gCAAuB,EAAC,MAAM,EAAE,KAAK,CAAC,CAAA;YACxD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,+BAAiB,CAAC,+BAA+B,CAAC,CAAA;YAC9D,CAAC;YACD,MAAM,MAAM,GAAG,IAAA,iCAAsB,EAAC,SAAS,CAAC,CAAA;YAChD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,+BAAiB,CAAC,+BAA+B,CAAC,CAAA;YAC9D,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC,CACF,CAAA;QACD,IACE,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG;YAC7B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAC3D,CAAC;YACD,MAAM,IAAI,+BAAiB,CACzB,yCAAyC,EACzC,gBAAgB,CACjB,CAAA;QACH,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;CACF;AAtdD,oCAsdC;AAED,UAAU;AACV,YAAY;AAEZ,SAAgB,aAAa,CAC3B,IAA2E,EAC3E,GAAW;IAEX,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtB,OAAO,KAAK,CAAA;IACd,CAAC;SAAM,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACnD,OAAO,IAAI,CAAA;IACb,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,KAAK,GAAG,CAAA;IACrC,CAAC;AACH,CAAC;AAED,IAAK,QAIJ;AAJD,WAAK,QAAQ;IACX,2BAAe,CAAA;IACf,6BAAiB,CAAA;IACjB,yBAAa,CAAA;AACf,CAAC,EAJI,QAAQ,KAAR,QAAQ,QAIZ;AAED,MAAM,wBAAwB,GAAG,CAC/B,GAAoB,EAC4B,EAAE;IAClD,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;IAClD,IAAI,CAAC,aAAa;QAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACvC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,iCAAmB,CAC3B,gCAAgC,EAChC,cAAc,CACf,CAAA;IACH,CAAC;IAED,yCAAyC;IACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;IAExC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC1E,IAAI,IAAI;QAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;IAElC,MAAM,IAAI,iCAAmB,CAC3B,mCAAmC,MAAM,CAAC,CAAC,CAAC,EAAE,EAC9C,cAAc,CACf,CAAA;AACH,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,uBAAuB,GAAG,CAAC,GAAoB,EAAW,EAAE;IAChE,MAAM,KAAK,GAAG,IAAA,0BAAkB,EAAC,GAAG,CAAC,CAAA;IACrC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IACxB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IACrC,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,CAAA;AAC/B,CAAC,CAAA;AAED,MAAM,eAAe,GAAG,CAAC,GAAoB,EAAmB,EAAE;IAChE,MAAM,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAA;IAC5C,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAEM,MAAM,kBAAkB,GAAG,CAAC,GAAoB,EAAE,EAAE;IACzD,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAA;IACnD,OAAO,IAAI,KAAK,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AAChD,CAAC,CAAA;AAHY,QAAA,kBAAkB,sBAG9B;AAED,MAAM,cAAc,GAAG,CACrB,GAAoB,EAC2B,EAAE;IACjD,IAAI,CAAC;QACH,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAA;QACjD,IAAI,IAAI,KAAK,QAAQ,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACxC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAC3D,qEAAqE;QACrE,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAA;QAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;QACzC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAA;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAEM,MAAM,qBAAqB,GAAG,CAAC,MAAc,EAAa,EAAE;IACjE,OAAO,IAAA,6BAAe,EAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;AAC7C,CAAC,CAAA;AAFY,QAAA,qBAAqB,yBAEjC;AAED,MAAM,UAAU,GAAG,IAAI,qBAAU,CAAC,WAAW,CAAC,CAAA;AACvC,MAAM,qBAAqB,GAAG,CAAC,YAAoB,EAAa,EAAE;IACvE,MAAM,GAAG,GAAG,UAAU,CAAC,YAAY,CAAC,YAAY,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;IAC/D,OAAO,IAAA,6BAAe,EAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;AAChD,CAAC,CAAA;AAHY,QAAA,qBAAqB,yBAGjC;AAED,SAAS,cAAc,CAAC,GAAmB;IACzC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,SAAS,CAAC,CAAA;IACzC,IAAA,iBAAU,EAAC,GAAG,EAAE,eAAe,CAAC,CAAA;AAClC,CAAC","sourcesContent":["import { KeyObject, createPublicKey, createSecretKey } from 'node:crypto'\nimport { IncomingMessage, ServerResponse } from 'node:http'\nimport * as jose from 'jose'\nimport KeyEncoder from 'key-encoder'\nimport { getVerificationMaterial } from '@atproto/common'\nimport { IdResolver, getDidKeyFromMultibase } from '@atproto/identity'\nimport { AtIdentifierString, DidString, isDidString } from '@atproto/lex'\nimport {\n OAuthError,\n OAuthVerifier,\n VerifyTokenPayloadOptions,\n WWWAuthenticateError,\n} from '@atproto/oauth-provider'\nimport {\n ScopePermissions,\n ScopePermissionsTransition,\n} from '@atproto/oauth-scopes'\nimport {\n AuthRequiredError,\n Awaitable,\n ForbiddenError,\n InvalidRequestError,\n MethodAuthContext,\n MethodAuthVerifier,\n Params,\n XRPCError,\n parseReqNsid,\n verifyJwt as verifyServiceJwt,\n} from '@atproto/xrpc-server'\nimport { AccountManager } from './account-manager/account-manager'\nimport { ActorAccount } from './account-manager/helpers/account'\nimport {\n AccessOutput,\n AdminTokenOutput,\n ModServiceOutput,\n OAuthOutput,\n RefreshOutput,\n UnauthenticatedOutput,\n UserServiceAuthOutput,\n} from './auth-output'\nimport { ACCESS_STANDARD, AuthScope, isAuthScope } from './auth-scope'\nimport { softDeleted } from './db'\nimport { appendVary } from './util/http'\nimport { WithRequired } from './util/types'\n\nexport type VerifiedOptions = {\n checkTakedown?: boolean\n checkDeactivated?: boolean\n}\n\nexport type ScopedOptions<S extends AuthScope = AuthScope> = {\n scopes?: readonly S[]\n}\n\nexport type ExtraScopedOptions<S extends AuthScope = AuthScope> = {\n additional?: readonly S[]\n}\n\nexport type AuthorizedOptions<P extends Params = Params> = {\n authorize: (\n permissions: ScopePermissions,\n ctx: MethodAuthContext<P>,\n ) => Awaitable<void>\n}\n\nexport type AuthVerifierOpts = {\n publicUrl: string\n jwtKey: KeyObject\n adminPass: string\n dids: {\n pds: string\n entryway?: string\n modService?: string\n }\n}\n\nexport type VerifyBearerJwtOptions<S extends AuthScope = AuthScope> =\n WithRequired<\n Omit<jose.JWTVerifyOptions, 'scopes'> & {\n scopes: readonly S[]\n },\n 'audience' \| 'typ'\n >\n\nexport type VerifyBearerJwtResult<S extends AuthScope = AuthScope> = {\n sub: DidString\n aud: string\n jti: string \| undefined\n scope: S\n}\n\nexport class AuthVerifier {\n private _publicUrl: string\n private _jwtKey: KeyObject\n private _adminPass: string\n public dids: AuthVerifierOpts['dids']\n\n constructor(\n public accountManager: AccountManager,\n public idResolver: IdResolver,\n public oauthVerifier: OAuthVerifier,\n opts: AuthVerifierOpts,\n ) {\n this._publicUrl = opts.publicUrl\n this._jwtKey = opts.jwtKey\n this._adminPass = opts.adminPass\n this.dids = opts.dids\n }\n\n // verifiers (arrow fns to preserve scope)\n\n public unauthenticated: MethodAuthVerifier<UnauthenticatedOutput> = (ctx) => {\n setAuthHeaders(ctx.res)\n\n // @NOTE this auth method is typically used as fallback when no other auth\n // method is applicable. This means that the presence of an \"authorization\"\n // header means that that header is invalid (as it did not match any of the\n // other auth methods).\n if (ctx.req.headers['authorization']) {\n throw new AuthRequiredError('Invalid authorization header')\n }\n\n return {\n credentials: null,\n }\n }\n\n public adminToken: MethodAuthVerifier<AdminTokenOutput> = async (ctx) => {\n setAuthHeaders(ctx.res)\n const parsed = parseBasicAuth(ctx.req)\n if (!parsed) {\n throw new AuthRequiredError()\n }\n const { username, password } = parsed\n if (username !== 'admin' \|\| password !== this._adminPass) {\n throw new AuthRequiredError()\n }\n\n return { credentials: { type: 'admin_token' } }\n }\n\n public modService: MethodAuthVerifier<ModServiceOutput> = async (ctx) => {\n setAuthHeaders(ctx.res)\n if (!this.dids.modService) {\n throw new AuthRequiredError('Untrusted issuer', 'UntrustedIss')\n }\n const payload = await this.verifyServiceJwt(ctx.req, {\n iss: [this.dids.modService, `${this.dids.modService}#atproto_labeler`],\n })\n return {\n credentials: {\n type: 'mod_service',\n did: payload.iss,\n },\n }\n }\n\n public moderator: MethodAuthVerifier<AdminTokenOutput \| ModServiceOutput> =\n async (ctx) => {\n const type = extractAuthType(ctx.req)\n if (type === AuthType.BEARER) {\n return this.modService(ctx)\n } else {\n return this.adminToken(ctx)\n }\n }\n\n protected access<S extends AuthScope>(\n options: VerifiedOptions & Required<ScopedOptions<S>>,\n ): MethodAuthVerifier<AccessOutput<S>> {\n const { scopes, ...statusOptions } = options\n\n const verifyJwtOptions: VerifyBearerJwtOptions<S> = {\n audience: this.dids.pds,\n typ: 'at+jwt',\n scopes:\n // @NOTE We can reject taken down credentials based on the scope if\n // \"checkTakedown\" is set.\n statusOptions.checkTakedown && scopes.includes(AuthScope.Takendown as S)\n ? scopes.filter((s) => s !== AuthScope.Takendown)\n : scopes,\n }\n\n return async (ctx) => {\n setAuthHeaders(ctx.res)\n\n const { sub: did, scope } = await this.verifyBearerJwt(\n ctx.req,\n verifyJwtOptions,\n )\n\n await this.verifyStatus(did, statusOptions)\n\n return {\n credentials: { type: 'access', did, scope },\n }\n }\n }\n\n public refresh(options?: {\n allowExpired?: boolean\n }): MethodAuthVerifier<RefreshOutput> {\n const verifyOptions: VerifyBearerJwtOptions<AuthScope.Refresh> = {\n clockTolerance: options?.allowExpired ? Infinity : undefined,\n typ: 'refresh+jwt',\n // when using entryway, proxying refresh credentials\n audience: this.dids.entryway ? this.dids.entryway : this.dids.pds,\n scopes: [AuthScope.Refresh],\n }\n\n return async (ctx) => {\n setAuthHeaders(ctx.res)\n\n const result = await this.verifyBearerJwt(ctx.req, verifyOptions)\n\n const tokenId = result.jti\n if (!tokenId) {\n throw new AuthRequiredError(\n 'Unexpected missing refresh token id',\n 'MissingTokenId',\n )\n }\n\n return {\n credentials: {\n type: 'refresh',\n did: result.sub,\n scope: result.scope,\n tokenId,\n },\n }\n }\n }\n\n public authorization<P extends Params>({\n scopes = ACCESS_STANDARD,\n additional = [],\n ...options\n }: VerifiedOptions &\n ScopedOptions &\n ExtraScopedOptions &\n AuthorizedOptions<P>): MethodAuthVerifier<AccessOutput \| OAuthOutput, P> {\n const access = this.access({\n ...options,\n scopes: [...scopes, ...additional],\n })\n const oauth = this.oauth(options)\n\n return async (ctx) => {\n const type = extractAuthType(ctx.req)\n\n if (type === AuthType.BEARER) {\n return access(ctx)\n }\n\n if (type === AuthType.DPOP) {\n return oauth(ctx)\n }\n\n // Auth headers are set through the access and oauth methods so we only\n // need to set them here if we reach this point\n setAuthHeaders(ctx.res)\n\n if (type !== null) {\n throw new InvalidRequestError(\n 'Unexpected authorization type',\n 'InvalidToken',\n )\n }\n\n throw new AuthRequiredError(undefined, 'AuthMissing')\n }\n }\n\n public authorizationOrAdminTokenOptional<P extends Params>(\n opts: VerifiedOptions & ExtraScopedOptions & AuthorizedOptions<P>,\n ): MethodAuthVerifier<\n OAuthOutput \| AccessOutput \| AdminTokenOutput \| UnauthenticatedOutput,\n P\n > {\n const authorization = this.authorization(opts)\n return async (ctx) => {\n const type = extractAuthType(ctx.req)\n if (type === AuthType.BEARER \|\| type === AuthType.DPOP) {\n return authorization(ctx)\n } else if (type === AuthType.BASIC) {\n return this.adminToken(ctx)\n } else {\n return this.unauthenticated(ctx)\n }\n }\n }\n\n public userServiceAuth: MethodAuthVerifier<UserServiceAuthOutput> = async (\n ctx,\n ) => {\n setAuthHeaders(ctx.res)\n const payload = await this.verifyServiceJwt(ctx.req)\n return {\n credentials: {\n type: 'user_service_auth',\n did: payload.iss,\n },\n }\n }\n\n public userServiceAuthOptional: MethodAuthVerifier<\n UserServiceAuthOutput \| UnauthenticatedOutput\n > = async (ctx) => {\n const type = extractAuthType(ctx.req)\n if (type === AuthType.BEARER) {\n return await this.userServiceAuth(ctx)\n } else {\n return this.unauthenticated(ctx)\n }\n }\n\n public authorizationOrUserServiceAuth<P extends Params>(\n options: VerifiedOptions &\n ScopedOptions &\n ExtraScopedOptions &\n AuthorizedOptions<P>,\n ): MethodAuthVerifier<UserServiceAuthOutput \| OAuthOutput \| AccessOutput, P> {\n const authorizationVerifier = this.authorization(options)\n return async (ctx) => {\n if (isDefinitelyServiceAuth(ctx.req)) {\n return this.userServiceAuth(ctx)\n } else {\n return authorizationVerifier(ctx)\n }\n }\n }\n\n protected oauth<P extends Params>({\n authorize,\n ...verifyStatusOptions\n }: VerifiedOptions & AuthorizedOptions<P>): MethodAuthVerifier<\n OAuthOutput,\n P\n > {\n const verifyTokenOptions: VerifyTokenPayloadOptions = {\n audience: [this.dids.pds],\n scope: ['atproto'],\n }\n\n return async (ctx) => {\n setAuthHeaders(ctx.res)\n\n const { req, res } = ctx\n\n // https://datatracker.ietf.org/doc/html/rfc9449#section-8.2\n const dpopNonce = this.oauthVerifier.nextDpopNonce()\n if (dpopNonce) {\n res.setHeader('DPoP-Nonce', dpopNonce)\n res.appendHeader('Access-Control-Expose-Headers', 'DPoP-Nonce')\n }\n\n const originalUrl = req.originalUrl \|\| req.url \|\| '/'\n const url = new URL(originalUrl, this._publicUrl)\n\n const { scope, sub: did } = await this.oauthVerifier\n .authenticateRequest(\n req.method \|\| 'GET',\n url,\n req.headers,\n verifyTokenOptions,\n )\n .catch((err) => {\n // Make sure to include any WWW-Authenticate header in the response\n // (particularly useful for DPoP's \"use_dpop_nonce\" error)\n if (err instanceof WWWAuthenticateError) {\n res.setHeader('WWW-Authenticate', err.wwwAuthenticateHeader)\n res.appendHeader(\n 'Access-Control-Expose-Headers',\n 'WWW-Authenticate',\n )\n }\n\n if (err instanceof OAuthError) {\n throw new XRPCError(err.status, err.error_description, err.error)\n }\n\n throw err\n })\n\n if (!isDidString(did)) {\n throw new InvalidRequestError('Malformed token', 'InvalidToken')\n }\n\n await this.verifyStatus(did, verifyStatusOptions)\n\n const permissions = new ScopePermissionsTransition(scope?.split(' '))\n\n // Should never happen\n if (!permissions.scopes.has('atproto')) {\n throw new InvalidRequestError(\n 'OAuth token does not have \"atproto\" scope',\n 'InvalidToken',\n )\n }\n\n await authorize(permissions, ctx)\n\n return {\n credentials: {\n type: 'oauth',\n did,\n permissions,\n },\n }\n }\n }\n\n protected async verifyStatus(\n did: DidString,\n options: VerifiedOptions,\n ): Promise<void> {\n if (options.checkDeactivated \|\| options.checkTakedown) {\n await this.findAccount(did, options)\n }\n }\n\n /*\n Finds an account by its handle or DID, returning possibly deactivated or\n * taken down accounts (unless `options.checkDeactivated` or\n * `options.checkTakedown` are set to true, respectively).\n /\n public async findAccount(\n handleOrDid: AtIdentifierString,\n options: VerifiedOptions,\n ): Promise<ActorAccount> {\n const account = await this.accountManager.getAccount(handleOrDid, {\n includeDeactivated: true,\n includeTakenDown: true,\n })\n if (!account) {\n // will be turned into ExpiredToken for the client if proxied by entryway\n throw new ForbiddenError('Account not found', 'AccountNotFound')\n }\n if (options.checkTakedown && softDeleted(account)) {\n throw new AuthRequiredError(\n 'Account has been taken down',\n 'AccountTakedown',\n )\n }\n if (options.checkDeactivated && account.deactivatedAt) {\n throw new AuthRequiredError(\n 'Account is deactivated',\n 'AccountDeactivated',\n )\n }\n return account\n }\n\n /\n Wraps {@link jose.jwtVerify} into a function that also validates the token\n * payload's type and wraps errors into {@link InvalidRequestError}.\n /\n protected async verifyBearerJwt<S extends AuthScope = AuthScope>(\n req: IncomingMessage,\n { scopes, ...options }: VerifyBearerJwtOptions<S>,\n ): Promise<VerifyBearerJwtResult<S>> {\n const token = bearerTokenFromReq(req)\n if (!token) {\n throw new AuthRequiredError(undefined, 'AuthMissing')\n }\n\n const { payload } = await jose\n .jwtVerify(token, this._jwtKey, options)\n .catch((cause) => {\n if (cause instanceof jose.errors.JWTExpired) {\n throw new InvalidRequestError('Token has expired', 'ExpiredToken', {\n cause,\n })\n } else {\n throw new InvalidRequestError(\n 'Token could not be verified',\n 'InvalidToken',\n { cause },\n )\n }\n })\n\n const { sub, aud, scope, lxm, cnf, jti } = payload\n\n if (typeof lxm !== 'undefined') {\n // Service auth tokens should never make it to here. But since service\n // auth tokens do not have a \"typ\" header, the \"typ\" check above will not\n // catch them. This check here is mainly to protect against the\n // hypothetical case in which a PDS would issue service auth tokens using\n // its private key.\n throw new InvalidRequestError('Malformed token', 'InvalidToken')\n }\n if (typeof cnf !== 'undefined') {\n // Proof-of-Possession (PoP) tokens are not allowed here\n // https://www.rfc-editor.org/rfc/rfc7800.html\n throw new InvalidRequestError('Malformed token', 'InvalidToken')\n }\n if (typeof sub !== 'string' \|\| !isDidString(sub)) {\n throw new InvalidRequestError('Malformed token', 'InvalidToken')\n }\n if (typeof aud !== 'string' \|\| !aud.startsWith('did:')) {\n throw new InvalidRequestError('Malformed token', 'InvalidToken')\n }\n if (typeof jti !== 'string' && typeof jti !== 'undefined') {\n throw new InvalidRequestError('Malformed token', 'InvalidToken')\n }\n if (!isAuthScope(scope) \|\| !scopes.includes(scope as any)) {\n throw new InvalidRequestError('Bad token scope', 'InvalidToken')\n }\n\n return { sub, aud, jti, scope: scope as S }\n }\n\n protected async verifyServiceJwt(\n req: IncomingMessage,\n opts?: { iss?: string[] },\n ) {\n const jwtStr = bearerTokenFromReq(req)\n if (!jwtStr) {\n throw new AuthRequiredError('missing jwt', 'MissingJwt')\n }\n\n const nsid = parseReqNsid(req)\n const payload = await verifyServiceJwt(\n jwtStr,\n null,\n nsid,\n async (iss, forceRefresh) => {\n if (opts?.iss && !opts.iss.includes(iss)) {\n throw new AuthRequiredError('Untrusted issuer', 'UntrustedIss')\n }\n const [did, serviceId] = iss.split('#')\n const keyId =\n serviceId === 'atproto_labeler' ? 'atproto_label' : 'atproto'\n const didDoc = await this.idResolver.did.resolve(did, forceRefresh)\n if (!didDoc) {\n throw new AuthRequiredError('could not resolve iss did')\n }\n const parsedKey = getVerificationMaterial(didDoc, keyId)\n if (!parsedKey) {\n throw new AuthRequiredError('missing or bad key in did doc')\n }\n const didKey = getDidKeyFromMultibase(parsedKey)\n if (!didKey) {\n throw new AuthRequiredError('missing or bad key in did doc')\n }\n return didKey\n },\n )\n if (\n payload.aud !== this.dids.pds &&\n (!this.dids.entryway \|\| payload.aud !== this.dids.entryway)\n ) {\n throw new AuthRequiredError(\n 'jwt audience does not match service did',\n 'BadJwtAudience',\n )\n }\n return payload\n }\n}\n\n// HELPERS\n// ---------\n\nexport function isUserOrAdmin(\n auth: AccessOutput \| OAuthOutput \| AdminTokenOutput \| UnauthenticatedOutput,\n did: string,\n): boolean {\n if (!auth.credentials) {\n return false\n } else if (auth.credentials.type === 'admin_token') {\n return true\n } else {\n return auth.credentials.did === did\n }\n}\n\nenum AuthType {\n BASIC = 'Basic',\n BEARER = 'Bearer',\n DPOP = 'DPoP',\n}\n\nconst parseAuthorizationHeader = (\n req: IncomingMessage,\n): [type: null] \| [type: AuthType, token: string] => {\n const authorization = req.headers['authorization']\n if (!authorization) return [null]\n\n const result = authorization.split(' ')\n if (result.length !== 2) {\n throw new InvalidRequestError(\n 'Malformed authorization header',\n 'InvalidToken',\n )\n }\n\n // authorization type is case-insensitive\n const authType = result[0].toUpperCase()\n\n const type = Object.hasOwn(AuthType, authType) ? AuthType[authType] : null\n if (type) return [type, result[1]]\n\n throw new InvalidRequestError(\n `Unsupported authorization type: ${result[0]}`,\n 'InvalidToken',\n )\n}\n\n/\n @note Not all service auth tokens are guaranteed to have \"lxm\" claim, so this\n * function should not be used to verify service auth tokens. It is only used to\n * check if a token is definitely a service auth token.\n */\nconst isDefinitelyServiceAuth = (req: IncomingMessage): boolean => {\n const token = bearerTokenFromReq(req)\n if (!token) return false\n const payload = jose.decodeJwt(token)\n return payload['lxm'] != null\n}\n\nconst extractAuthType = (req: IncomingMessage): AuthType \| null => {\n const [type] = parseAuthorizationHeader(req)\n return type\n}\n\nexport const bearerTokenFromReq = (req: IncomingMessage) => {\n const [type, token] = parseAuthorizationHeader(req)\n return type === AuthType.BEARER ? token : null\n}\n\nconst parseBasicAuth = (\n req: IncomingMessage,\n): { username: string; password: string } \| null => {\n try {\n const [type, b64] = parseAuthorizationHeader(req)\n if (type !== AuthType.BASIC) return null\n const decoded = Buffer.from(b64, 'base64').toString('utf8')\n // We must not use split(':') because the password can contain colons\n const colon = decoded.indexOf(':')\n if (colon === -1) return null\n const username = decoded.slice(0, colon)\n const password = decoded.slice(colon + 1)\n return { username, password }\n } catch (err) {\n return null\n }\n}\n\nexport const createSecretKeyObject = (secret: string): KeyObject => {\n return createSecretKey(Buffer.from(secret))\n}\n\nconst keyEncoder = new KeyEncoder('secp256k1')\nexport const createPublicKeyObject = (publicKeyHex: string): KeyObject => {\n const key = keyEncoder.encodePublic(publicKeyHex, 'raw', 'pem')\n return createPublicKey({ format: 'pem', key })\n}\n\nfunction setAuthHeaders(res: ServerResponse) {\n res.setHeader('Cache-Control', 'private')\n appendVary(res, 'Authorization')\n}\n"]}
1	+ {"version":3,"file":"auth-verifier.js","sourceRoot":"","sources":["../src/auth-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,eAAe,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAEzE,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,gBAAgB,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAA;AACzD,OAAO,EAAc,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AACtE,OAAO,EAAiC,WAAW,EAAE,MAAM,cAAc,CAAA;AACzE,OAAO,EACL,UAAU,EAGV,oBAAoB,GACrB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAEL,0BAA0B,GAC3B,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,iBAAiB,EAEjB,cAAc,EACd,mBAAmB,EAInB,SAAS,EACT,YAAY,EACZ,SAAS,IAAI,gBAAgB,GAC9B,MAAM,sBAAsB,CAAA;AAY7B,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAG3C,2FAA2F;AAC3F,MAAM,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAA;AAgD5D,MAAM,OAAO,YAAY;IAMvB,YACS,cAA8B,EAC9B,UAAsB,EACtB,aAA4B,EACnC,IAAsB;QAHf,mBAAc,GAAd,cAAc,CAAgB;QAC9B,eAAU,GAAV,UAAU,CAAY;QACtB,kBAAa,GAAb,aAAa,CAAe;QASrC,0CAA0C;QAEnC,oBAAe,GAA8C,CAAC,GAAG,EAAE,EAAE;YAC1E,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,0EAA0E;YAC1E,2EAA2E;YAC3E,2EAA2E;YAC3E,uBAAuB;YACvB,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,iBAAiB,CAAC,8BAA8B,CAAC,CAAA;YAC7D,CAAC;YAED,OAAO;gBACL,WAAW,EAAE,IAAI;aAClB,CAAA;QACH,CAAC,CAAA;QAEM,eAAU,GAAyC,KAAK,EAAE,GAAG,EAAE,EAAE;YACtE,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACvB,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACtC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,iBAAiB,EAAE,CAAA;YAC/B,CAAC;YACD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAA;YACrC,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;gBACzD,MAAM,IAAI,iBAAiB,EAAE,CAAA;YAC/B,CAAC;YAED,OAAO,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CAAA;QACjD,CAAC,CAAA;QAEM,eAAU,GAAyC,KAAK,EAAE,GAAG,EAAE,EAAE;YACtE,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACvB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC1B,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAA;YACjE,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE;gBACnD,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,kBAAkB,CAAC;aACvE,CAAC,CAAA;YACF,OAAO;gBACL,WAAW,EAAE;oBACX,IAAI,EAAE,aAAa;oBACnB,GAAG,EAAE,OAAO,CAAC,GAAG;iBACjB;aACF,CAAA;QACH,CAAC,CAAA;QAEM,cAAS,GACd,KAAK,EAAE,GAAG,EAAE,EAAE;YACZ,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACrC,IAAI,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;YAC7B,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;YAC7B,CAAC;QACH,CAAC,CAAA;QAgII,oBAAe,GAA8C,KAAK,EACvE,GAAG,EACH,EAAE;YACF,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACvB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACpD,OAAO;gBACL,WAAW,EAAE;oBACX,IAAI,EAAE,mBAAmB;oBACzB,GAAG,EAAE,OAAO,CAAC,GAAG;iBACjB;aACF,CAAA;QACH,CAAC,CAAA;QAEM,4BAAuB,GAE1B,KAAK,EAAE,GAAG,EAAE,EAAE;YAChB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACrC,IAAI,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC7B,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YACxC,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YAClC,CAAC;QACH,CAAC,CAAA;QApNC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAA;QAChC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAA;QAC1B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAA;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;IACvB,CAAC;IA4DS,MAAM,CACd,OAAqD;QAErD,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,EAAE,GAAG,OAAO,CAAA;QAE5C,MAAM,gBAAgB,GAA8B;YAClD,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG;YACvB,GAAG,EAAE,QAAQ;YACb,MAAM;YACJ,mEAAmE;YACnE,0BAA0B;YAC1B,aAAa,CAAC,aAAa,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAc,CAAC;gBACtE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,SAAS,CAAC;gBACjD,CAAC,CAAC,MAAM;SACb,CAAA;QAED,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CACpD,GAAG,CAAC,GAAG,EACP,gBAAgB,CACjB,CAAA;YAED,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;YAE3C,OAAO;gBACL,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE;aAC5C,CAAA;QACH,CAAC,CAAA;IACH,CAAC;IAEM,OAAO,CAAC,OAEd;QACC,MAAM,aAAa,GAA8C;YAC/D,cAAc,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;YAC5D,GAAG,EAAE,aAAa;YAClB,oDAAoD;YACpD,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACjE,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC;SAC5B,CAAA;QAED,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;YAEjE,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAA;YAC1B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,iBAAiB,CACzB,qCAAqC,EACrC,gBAAgB,CACjB,CAAA;YACH,CAAC;YAED,OAAO;gBACL,WAAW,EAAE;oBACX,IAAI,EAAE,SAAS;oBACf,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,OAAO;iBACR;aACF,CAAA;QACH,CAAC,CAAA;IACH,CAAC;IAEM,aAAa,CAAmB,EACrC,MAAM,GAAG,eAAe,EACxB,UAAU,GAAG,EAAE,EACf,GAAG,OAAO,EAIU;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YACzB,GAAG,OAAO;YACV,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,UAAU,CAAC;SACnC,CAAC,CAAA;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAEjC,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAErC,IAAI,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC7B,OAAO,MAAM,CAAC,GAAG,CAAC,CAAA;YACpB,CAAC;YAED,IAAI,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAC3B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAA;YACnB,CAAC;YAED,uEAAuE;YACvE,+CAA+C;YAC/C,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,mBAAmB,CAC3B,+BAA+B,EAC/B,cAAc,CACf,CAAA;YACH,CAAC;YAED,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;QACvD,CAAC,CAAA;IACH,CAAC;IAEM,iCAAiC,CACtC,IAAiE;QAKjE,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;QAC9C,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACrC,IAAI,IAAI,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACvD,OAAO,aAAa,CAAC,GAAG,CAAC,CAAA;YAC3B,CAAC;iBAAM,IAAI,IAAI,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACnC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;YAC7B,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YAClC,CAAC;QACH,CAAC,CAAA;IACH,CAAC;IA0BM,8BAA8B,CACnC,OAGsB;QAEtB,MAAM,qBAAqB,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;QACzD,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,IAAI,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrC,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YAClC,CAAC;iBAAM,CAAC;gBACN,OAAO,qBAAqB,CAAC,GAAG,CAAC,CAAA;YACnC,CAAC;QACH,CAAC,CAAA;IACH,CAAC;IAES,KAAK,CAAmB,EAChC,SAAS,EACT,GAAG,mBAAmB,EACiB;QAIvC,MAAM,kBAAkB,GAA8B;YACpD,QAAQ,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YACzB,KAAK,EAAE,CAAC,SAAS,CAAC;SACnB,CAAA;QAED,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,CAAA;YAExB,4DAA4D;YAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,CAAA;YACpD,IAAI,SAAS,EAAE,CAAC;gBACd,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,SAAS,CAAC,CAAA;gBACtC,GAAG,CAAC,YAAY,CAAC,+BAA+B,EAAE,YAAY,CAAC,CAAA;YACjE,CAAC;YAED,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAA;YACrD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;YAEjD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa;iBACjD,mBAAmB,CAClB,GAAG,CAAC,MAAM,IAAI,KAAK,EACnB,GAAG,EACH,GAAG,CAAC,OAAO,EACX,kBAAkB,CACnB;iBACA,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACb,mEAAmE;gBACnE,0DAA0D;gBAC1D,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;oBACxC,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,GAAG,CAAC,qBAAqB,CAAC,CAAA;oBAC5D,GAAG,CAAC,YAAY,CACd,+BAA+B,EAC/B,kBAAkB,CACnB,CAAA;gBACH,CAAC;gBAED,IAAI,GAAG,YAAY,UAAU,EAAE,CAAC;oBAC9B,MAAM,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,iBAAiB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAA;gBACnE,CAAC;gBAED,MAAM,GAAG,CAAA;YACX,CAAC,CAAC,CAAA;YAEJ,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;YAClE,CAAC;YAED,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAA;YAEjD,MAAM,WAAW,GAAG,IAAI,0BAA0B,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;YAErE,sBAAsB;YACtB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,mBAAmB,CAC3B,2CAA2C,EAC3C,cAAc,CACf,CAAA;YACH,CAAC;YAED,MAAM,SAAS,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;YAEjC,OAAO;gBACL,WAAW,EAAE;oBACX,IAAI,EAAE,OAAO;oBACb,GAAG;oBACH,WAAW;iBACZ;aACF,CAAA;QACH,CAAC,CAAA;IACH,CAAC;IAES,KAAK,CAAC,YAAY,CAC1B,GAAc,EACd,OAAwB;QAExB,IAAI,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YACtD,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QACtC,CAAC;IACH,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,WAAW,CACtB,WAA+B,EAC/B,OAAwB;QAExB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,WAAW,EAAE;YAChE,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,yEAAyE;YACzE,MAAM,IAAI,cAAc,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,CAAC,aAAa,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,iBAAiB,CACzB,6BAA6B,EAC7B,iBAAiB,CAClB,CAAA;QACH,CAAC;QACD,IAAI,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YACtD,MAAM,IAAI,iBAAiB,CACzB,wBAAwB,EACxB,oBAAoB,CACrB,CAAA;QACH,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IAED;;;OAGG;IACO,KAAK,CAAC,eAAe,CAC7B,GAAoB,EACpB,EAAE,MAAM,EAAE,GAAG,OAAO,EAA6B;QAEjD,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;QACrC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;QACvD,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI;aAC3B,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;aACvC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACf,IAAI,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC5C,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,EAAE,cAAc,EAAE;oBACjE,KAAK;iBACN,CAAC,CAAA;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,mBAAmB,CAC3B,6BAA6B,EAC7B,cAAc,EACd,EAAE,KAAK,EAAE,CACV,CAAA;YACH,CAAC;QACH,CAAC,CAAC,CAAA;QAEJ,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;QAElD,IAAI,OAAO,GAAG,KAAK,WAAW,EAAE,CAAC;YAC/B,sEAAsE;YACtE,yEAAyE;YACzE,+DAA+D;YAC/D,yEAAyE;YACzE,mBAAmB;YACnB,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,WAAW,EAAE,CAAC;YAC/B,wDAAwD;YACxD,8CAA8C;YAC9C,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,WAAW,EAAE,CAAC;YAC1D,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAY,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QAED,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,KAAU,EAAE,CAAA;IAC7C,CAAC;IAES,KAAK,CAAC,gBAAgB,CAC9B,GAAoB,EACpB,IAAyB;QAEzB,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,iBAAiB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAA;QAC1D,CAAC;QAED,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;QAC9B,MAAM,OAAO,GAAG,MAAM,gBAAgB,CACpC,MAAM,EACN,IAAI,EACJ,IAAI,EACJ,KAAK,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE;YAC1B,IAAI,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAA;YACjE,CAAC;YACD,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACvC,MAAM,KAAK,GACT,SAAS,KAAK,iBAAiB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAA;YAC/D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;YACnE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,iBAAiB,CAAC,2BAA2B,CAAC,CAAA;YAC1D,CAAC;YACD,MAAM,SAAS,GAAG,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;YACxD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,iBAAiB,CAAC,+BAA+B,CAAC,CAAA;YAC9D,CAAC;YACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAA;YAChD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,iBAAiB,CAAC,+BAA+B,CAAC,CAAA;YAC9D,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC,CACF,CAAA;QACD,IACE,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG;YAC7B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAC3D,CAAC;YACD,MAAM,IAAI,iBAAiB,CACzB,yCAAyC,EACzC,gBAAgB,CACjB,CAAA;QACH,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;CACF;AAED,UAAU;AACV,YAAY;AAEZ,MAAM,UAAU,aAAa,CAC3B,IAA2E,EAC3E,GAAW;IAEX,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtB,OAAO,KAAK,CAAA;IACd,CAAC;SAAM,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACnD,OAAO,IAAI,CAAA;IACb,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,KAAK,GAAG,CAAA;IACrC,CAAC;AACH,CAAC;AAED,IAAK,QAIJ;AAJD,WAAK,QAAQ;IACX,2BAAe,CAAA;IACf,6BAAiB,CAAA;IACjB,yBAAa,CAAA;AACf,CAAC,EAJI,QAAQ,KAAR,QAAQ,QAIZ;AAED,MAAM,wBAAwB,GAAG,CAC/B,GAAoB,EAC4B,EAAE;IAClD,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;IAClD,IAAI,CAAC,aAAa;QAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACvC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,mBAAmB,CAC3B,gCAAgC,EAChC,cAAc,CACf,CAAA;IACH,CAAC;IAED,yCAAyC;IACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;IAExC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC1E,IAAI,IAAI;QAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;IAElC,MAAM,IAAI,mBAAmB,CAC3B,mCAAmC,MAAM,CAAC,CAAC,CAAC,EAAE,EAC9C,cAAc,CACf,CAAA;AACH,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,uBAAuB,GAAG,CAAC,GAAoB,EAAW,EAAE;IAChE,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;IACrC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IACxB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IACrC,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,CAAA;AAC/B,CAAC,CAAA;AAED,MAAM,eAAe,GAAG,CAAC,GAAoB,EAAmB,EAAE;IAChE,MAAM,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAA;IAC5C,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAoB,EAAE,EAAE;IACzD,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAA;IACnD,OAAO,IAAI,KAAK,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AAChD,CAAC,CAAA;AAED,MAAM,cAAc,GAAG,CACrB,GAAoB,EAC2B,EAAE;IACjD,IAAI,CAAC;QACH,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAA;QACjD,IAAI,IAAI,KAAK,QAAQ,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACxC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAC3D,qEAAqE;QACrE,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAA;QAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;QACzC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAA;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,MAAc,EAAa,EAAE;IACjE,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;AAC7C,CAAC,CAAA;AAED,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,CAAA;AAC9C,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,YAAoB,EAAa,EAAE;IACvE,MAAM,GAAG,GAAG,UAAU,CAAC,YAAY,CAAC,YAAY,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;IAC/D,OAAO,eAAe,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;AAChD,CAAC,CAAA;AAED,SAAS,cAAc,CAAC,GAAmB;IACzC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,SAAS,CAAC,CAAA;IACzC,UAAU,CAAC,GAAG,EAAE,eAAe,CAAC,CAAA;AAClC,CAAC","sourcesContent":["import { KeyObject, createPublicKey, createSecretKey } from 'node:crypto'\nimport { IncomingMessage, ServerResponse } from 'node:http'\nimport * as jose from 'jose'\nimport KeyEncoderModule from 'key-encoder'\nimport { getVerificationMaterial } from '@atproto/common'\nimport { IdResolver, getDidKeyFromMultibase } from '@atproto/identity'\nimport { AtIdentifierString, DidString, isDidString } from '@atproto/lex'\nimport {\n OAuthError,\n OAuthVerifier,\n VerifyTokenPayloadOptions,\n WWWAuthenticateError,\n} from '@atproto/oauth-provider'\nimport {\n ScopePermissions,\n ScopePermissionsTransition,\n} from '@atproto/oauth-scopes'\nimport {\n AuthRequiredError,\n Awaitable,\n ForbiddenError,\n InvalidRequestError,\n MethodAuthContext,\n MethodAuthVerifier,\n Params,\n XRPCError,\n parseReqNsid,\n verifyJwt as verifyServiceJwt,\n} from '@atproto/xrpc-server'\nimport { AccountManager } from './account-manager/account-manager.js'\nimport { ActorAccount } from './account-manager/helpers/account.js'\nimport {\n AccessOutput,\n AdminTokenOutput,\n ModServiceOutput,\n OAuthOutput,\n RefreshOutput,\n UnauthenticatedOutput,\n UserServiceAuthOutput,\n} from './auth-output.js'\nimport { ACCESS_STANDARD, AuthScope, isAuthScope } from './auth-scope.js'\nimport { softDeleted } from './db/index.js'\nimport { appendVary } from './util/http.js'\nimport { WithRequired } from './util/types.js'\n\n// key-encoder is CJS with exports.default; Node ESM interop wraps it as { default: Class }\nconst KeyEncoder = ((m) => m.default ?? m)(KeyEncoderModule)\n\nexport type VerifiedOptions = {\n checkTakedown?: boolean\n checkDeactivated?: boolean\n}\n\nexport type ScopedOptions<S extends AuthScope = AuthScope> = {\n scopes?: readonly S[]\n}\n\nexport type ExtraScopedOptions<S extends AuthScope = AuthScope> = {\n additional?: readonly S[]\n}\n\nexport type AuthorizedOptions<P extends Params = Params> = {\n authorize: (\n permissions: ScopePermissions,\n ctx: MethodAuthContext<P>,\n ) => Awaitable<void>\n}\n\nexport type AuthVerifierOpts = {\n publicUrl: string\n jwtKey: KeyObject\n adminPass: string\n dids: {\n pds: string\n entryway?: string\n modService?: string\n }\n}\n\nexport type VerifyBearerJwtOptions<S extends AuthScope = AuthScope> =\n WithRequired<\n Omit<jose.JWTVerifyOptions, 'scopes'> & {\n scopes: readonly S[]\n },\n 'audience' \| 'typ'\n >\n\nexport type VerifyBearerJwtResult<S extends AuthScope = AuthScope> = {\n sub: DidString\n aud: string\n jti: string \| undefined\n scope: S\n}\n\nexport class AuthVerifier {\n private _publicUrl: string\n private _jwtKey: KeyObject\n private _adminPass: string\n public dids: AuthVerifierOpts['dids']\n\n constructor(\n public accountManager: AccountManager,\n public idResolver: IdResolver,\n public oauthVerifier: OAuthVerifier,\n opts: AuthVerifierOpts,\n ) {\n this._publicUrl = opts.publicUrl\n this._jwtKey = opts.jwtKey\n this._adminPass = opts.adminPass\n this.dids = opts.dids\n }\n\n // verifiers (arrow fns to preserve scope)\n\n public unauthenticated: MethodAuthVerifier<UnauthenticatedOutput> = (ctx) => {\n setAuthHeaders(ctx.res)\n\n // @NOTE this auth method is typically used as fallback when no other auth\n // method is applicable. This means that the presence of an \"authorization\"\n // header means that that header is invalid (as it did not match any of the\n // other auth methods).\n if (ctx.req.headers['authorization']) {\n throw new AuthRequiredError('Invalid authorization header')\n }\n\n return {\n credentials: null,\n }\n }\n\n public adminToken: MethodAuthVerifier<AdminTokenOutput> = async (ctx) => {\n setAuthHeaders(ctx.res)\n const parsed = parseBasicAuth(ctx.req)\n if (!parsed) {\n throw new AuthRequiredError()\n }\n const { username, password } = parsed\n if (username !== 'admin' \|\| password !== this._adminPass) {\n throw new AuthRequiredError()\n }\n\n return { credentials: { type: 'admin_token' } }\n }\n\n public modService: MethodAuthVerifier<ModServiceOutput> = async (ctx) => {\n setAuthHeaders(ctx.res)\n if (!this.dids.modService) {\n throw new AuthRequiredError('Untrusted issuer', 'UntrustedIss')\n }\n const payload = await this.verifyServiceJwt(ctx.req, {\n iss: [this.dids.modService, `${this.dids.modService}#atproto_labeler`],\n })\n return {\n credentials: {\n type: 'mod_service',\n did: payload.iss,\n },\n }\n }\n\n public moderator: MethodAuthVerifier<AdminTokenOutput \| ModServiceOutput> =\n async (ctx) => {\n const type = extractAuthType(ctx.req)\n if (type === AuthType.BEARER) {\n return this.modService(ctx)\n } else {\n return this.adminToken(ctx)\n }\n }\n\n protected access<S extends AuthScope>(\n options: VerifiedOptions & Required<ScopedOptions<S>>,\n ): MethodAuthVerifier<AccessOutput<S>> {\n const { scopes, ...statusOptions } = options\n\n const verifyJwtOptions: VerifyBearerJwtOptions<S> = {\n audience: this.dids.pds,\n typ: 'at+jwt',\n scopes:\n // @NOTE We can reject taken down credentials based on the scope if\n // \"checkTakedown\" is set.\n statusOptions.checkTakedown && scopes.includes(AuthScope.Takendown as S)\n ? scopes.filter((s) => s !== AuthScope.Takendown)\n : scopes,\n }\n\n return async (ctx) => {\n setAuthHeaders(ctx.res)\n\n const { sub: did, scope } = await this.verifyBearerJwt(\n ctx.req,\n verifyJwtOptions,\n )\n\n await this.verifyStatus(did, statusOptions)\n\n return {\n credentials: { type: 'access', did, scope },\n }\n }\n }\n\n public refresh(options?: {\n allowExpired?: boolean\n }): MethodAuthVerifier<RefreshOutput> {\n const verifyOptions: VerifyBearerJwtOptions<AuthScope.Refresh> = {\n clockTolerance: options?.allowExpired ? Infinity : undefined,\n typ: 'refresh+jwt',\n // when using entryway, proxying refresh credentials\n audience: this.dids.entryway ? this.dids.entryway : this.dids.pds,\n scopes: [AuthScope.Refresh],\n }\n\n return async (ctx) => {\n setAuthHeaders(ctx.res)\n\n const result = await this.verifyBearerJwt(ctx.req, verifyOptions)\n\n const tokenId = result.jti\n if (!tokenId) {\n throw new AuthRequiredError(\n 'Unexpected missing refresh token id',\n 'MissingTokenId',\n )\n }\n\n return {\n credentials: {\n type: 'refresh',\n did: result.sub,\n scope: result.scope,\n tokenId,\n },\n }\n }\n }\n\n public authorization<P extends Params>({\n scopes = ACCESS_STANDARD,\n additional = [],\n ...options\n }: VerifiedOptions &\n ScopedOptions &\n ExtraScopedOptions &\n AuthorizedOptions<P>): MethodAuthVerifier<AccessOutput \| OAuthOutput, P> {\n const access = this.access({\n ...options,\n scopes: [...scopes, ...additional],\n })\n const oauth = this.oauth(options)\n\n return async (ctx) => {\n const type = extractAuthType(ctx.req)\n\n if (type === AuthType.BEARER) {\n return access(ctx)\n }\n\n if (type === AuthType.DPOP) {\n return oauth(ctx)\n }\n\n // Auth headers are set through the access and oauth methods so we only\n // need to set them here if we reach this point\n setAuthHeaders(ctx.res)\n\n if (type !== null) {\n throw new InvalidRequestError(\n 'Unexpected authorization type',\n 'InvalidToken',\n )\n }\n\n throw new AuthRequiredError(undefined, 'AuthMissing')\n }\n }\n\n public authorizationOrAdminTokenOptional<P extends Params>(\n opts: VerifiedOptions & ExtraScopedOptions & AuthorizedOptions<P>,\n ): MethodAuthVerifier<\n OAuthOutput \| AccessOutput \| AdminTokenOutput \| UnauthenticatedOutput,\n P\n > {\n const authorization = this.authorization(opts)\n return async (ctx) => {\n const type = extractAuthType(ctx.req)\n if (type === AuthType.BEARER \|\| type === AuthType.DPOP) {\n return authorization(ctx)\n } else if (type === AuthType.BASIC) {\n return this.adminToken(ctx)\n } else {\n return this.unauthenticated(ctx)\n }\n }\n }\n\n public userServiceAuth: MethodAuthVerifier<UserServiceAuthOutput> = async (\n ctx,\n ) => {\n setAuthHeaders(ctx.res)\n const payload = await this.verifyServiceJwt(ctx.req)\n return {\n credentials: {\n type: 'user_service_auth',\n did: payload.iss,\n },\n }\n }\n\n public userServiceAuthOptional: MethodAuthVerifier<\n UserServiceAuthOutput \| UnauthenticatedOutput\n > = async (ctx) => {\n const type = extractAuthType(ctx.req)\n if (type === AuthType.BEARER) {\n return await this.userServiceAuth(ctx)\n } else {\n return this.unauthenticated(ctx)\n }\n }\n\n public authorizationOrUserServiceAuth<P extends Params>(\n options: VerifiedOptions &\n ScopedOptions &\n ExtraScopedOptions &\n AuthorizedOptions<P>,\n ): MethodAuthVerifier<UserServiceAuthOutput \| OAuthOutput \| AccessOutput, P> {\n const authorizationVerifier = this.authorization(options)\n return async (ctx) => {\n if (isDefinitelyServiceAuth(ctx.req)) {\n return this.userServiceAuth(ctx)\n } else {\n return authorizationVerifier(ctx)\n }\n }\n }\n\n protected oauth<P extends Params>({\n authorize,\n ...verifyStatusOptions\n }: VerifiedOptions & AuthorizedOptions<P>): MethodAuthVerifier<\n OAuthOutput,\n P\n > {\n const verifyTokenOptions: VerifyTokenPayloadOptions = {\n audience: [this.dids.pds],\n scope: ['atproto'],\n }\n\n return async (ctx) => {\n setAuthHeaders(ctx.res)\n\n const { req, res } = ctx\n\n // https://datatracker.ietf.org/doc/html/rfc9449#section-8.2\n const dpopNonce = this.oauthVerifier.nextDpopNonce()\n if (dpopNonce) {\n res.setHeader('DPoP-Nonce', dpopNonce)\n res.appendHeader('Access-Control-Expose-Headers', 'DPoP-Nonce')\n }\n\n const originalUrl = req.originalUrl \|\| req.url \|\| '/'\n const url = new URL(originalUrl, this._publicUrl)\n\n const { scope, sub: did } = await this.oauthVerifier\n .authenticateRequest(\n req.method \|\| 'GET',\n url,\n req.headers,\n verifyTokenOptions,\n )\n .catch((err) => {\n // Make sure to include any WWW-Authenticate header in the response\n // (particularly useful for DPoP's \"use_dpop_nonce\" error)\n if (err instanceof WWWAuthenticateError) {\n res.setHeader('WWW-Authenticate', err.wwwAuthenticateHeader)\n res.appendHeader(\n 'Access-Control-Expose-Headers',\n 'WWW-Authenticate',\n )\n }\n\n if (err instanceof OAuthError) {\n throw new XRPCError(err.status, err.error_description, err.error)\n }\n\n throw err\n })\n\n if (!isDidString(did)) {\n throw new InvalidRequestError('Malformed token', 'InvalidToken')\n }\n\n await this.verifyStatus(did, verifyStatusOptions)\n\n const permissions = new ScopePermissionsTransition(scope?.split(' '))\n\n // Should never happen\n if (!permissions.scopes.has('atproto')) {\n throw new InvalidRequestError(\n 'OAuth token does not have \"atproto\" scope',\n 'InvalidToken',\n )\n }\n\n await authorize(permissions, ctx)\n\n return {\n credentials: {\n type: 'oauth',\n did,\n permissions,\n },\n }\n }\n }\n\n protected async verifyStatus(\n did: DidString,\n options: VerifiedOptions,\n ): Promise<void> {\n if (options.checkDeactivated \|\| options.checkTakedown) {\n await this.findAccount(did, options)\n }\n }\n\n /*\n Finds an account by its handle or DID, returning possibly deactivated or\n * taken down accounts (unless `options.checkDeactivated` or\n * `options.checkTakedown` are set to true, respectively).\n /\n public async findAccount(\n handleOrDid: AtIdentifierString,\n options: VerifiedOptions,\n ): Promise<ActorAccount> {\n const account = await this.accountManager.getAccount(handleOrDid, {\n includeDeactivated: true,\n includeTakenDown: true,\n })\n if (!account) {\n // will be turned into ExpiredToken for the client if proxied by entryway\n throw new ForbiddenError('Account not found', 'AccountNotFound')\n }\n if (options.checkTakedown && softDeleted(account)) {\n throw new AuthRequiredError(\n 'Account has been taken down',\n 'AccountTakedown',\n )\n }\n if (options.checkDeactivated && account.deactivatedAt) {\n throw new AuthRequiredError(\n 'Account is deactivated',\n 'AccountDeactivated',\n )\n }\n return account\n }\n\n /\n Wraps {@link jose.jwtVerify} into a function that also validates the token\n * payload's type and wraps errors into {@link InvalidRequestError}.\n /\n protected async verifyBearerJwt<S extends AuthScope = AuthScope>(\n req: IncomingMessage,\n { scopes, ...options }: VerifyBearerJwtOptions<S>,\n ): Promise<VerifyBearerJwtResult<S>> {\n const token = bearerTokenFromReq(req)\n if (!token) {\n throw new AuthRequiredError(undefined, 'AuthMissing')\n }\n\n const { payload } = await jose\n .jwtVerify(token, this._jwtKey, options)\n .catch((cause) => {\n if (cause instanceof jose.errors.JWTExpired) {\n throw new InvalidRequestError('Token has expired', 'ExpiredToken', {\n cause,\n })\n } else {\n throw new InvalidRequestError(\n 'Token could not be verified',\n 'InvalidToken',\n { cause },\n )\n }\n })\n\n const { sub, aud, scope, lxm, cnf, jti } = payload\n\n if (typeof lxm !== 'undefined') {\n // Service auth tokens should never make it to here. But since service\n // auth tokens do not have a \"typ\" header, the \"typ\" check above will not\n // catch them. This check here is mainly to protect against the\n // hypothetical case in which a PDS would issue service auth tokens using\n // its private key.\n throw new InvalidRequestError('Malformed token', 'InvalidToken')\n }\n if (typeof cnf !== 'undefined') {\n // Proof-of-Possession (PoP) tokens are not allowed here\n // https://www.rfc-editor.org/rfc/rfc7800.html\n throw new InvalidRequestError('Malformed token', 'InvalidToken')\n }\n if (typeof sub !== 'string' \|\| !isDidString(sub)) {\n throw new InvalidRequestError('Malformed token', 'InvalidToken')\n }\n if (typeof aud !== 'string' \|\| !aud.startsWith('did:')) {\n throw new InvalidRequestError('Malformed token', 'InvalidToken')\n }\n if (typeof jti !== 'string' && typeof jti !== 'undefined') {\n throw new InvalidRequestError('Malformed token', 'InvalidToken')\n }\n if (!isAuthScope(scope) \|\| !scopes.includes(scope as any)) {\n throw new InvalidRequestError('Bad token scope', 'InvalidToken')\n }\n\n return { sub, aud, jti, scope: scope as S }\n }\n\n protected async verifyServiceJwt(\n req: IncomingMessage,\n opts?: { iss?: string[] },\n ) {\n const jwtStr = bearerTokenFromReq(req)\n if (!jwtStr) {\n throw new AuthRequiredError('missing jwt', 'MissingJwt')\n }\n\n const nsid = parseReqNsid(req)\n const payload = await verifyServiceJwt(\n jwtStr,\n null,\n nsid,\n async (iss, forceRefresh) => {\n if (opts?.iss && !opts.iss.includes(iss)) {\n throw new AuthRequiredError('Untrusted issuer', 'UntrustedIss')\n }\n const [did, serviceId] = iss.split('#')\n const keyId =\n serviceId === 'atproto_labeler' ? 'atproto_label' : 'atproto'\n const didDoc = await this.idResolver.did.resolve(did, forceRefresh)\n if (!didDoc) {\n throw new AuthRequiredError('could not resolve iss did')\n }\n const parsedKey = getVerificationMaterial(didDoc, keyId)\n if (!parsedKey) {\n throw new AuthRequiredError('missing or bad key in did doc')\n }\n const didKey = getDidKeyFromMultibase(parsedKey)\n if (!didKey) {\n throw new AuthRequiredError('missing or bad key in did doc')\n }\n return didKey\n },\n )\n if (\n payload.aud !== this.dids.pds &&\n (!this.dids.entryway \|\| payload.aud !== this.dids.entryway)\n ) {\n throw new AuthRequiredError(\n 'jwt audience does not match service did',\n 'BadJwtAudience',\n )\n }\n return payload\n }\n}\n\n// HELPERS\n// ---------\n\nexport function isUserOrAdmin(\n auth: AccessOutput \| OAuthOutput \| AdminTokenOutput \| UnauthenticatedOutput,\n did: string,\n): boolean {\n if (!auth.credentials) {\n return false\n } else if (auth.credentials.type === 'admin_token') {\n return true\n } else {\n return auth.credentials.did === did\n }\n}\n\nenum AuthType {\n BASIC = 'Basic',\n BEARER = 'Bearer',\n DPOP = 'DPoP',\n}\n\nconst parseAuthorizationHeader = (\n req: IncomingMessage,\n): [type: null] \| [type: AuthType, token: string] => {\n const authorization = req.headers['authorization']\n if (!authorization) return [null]\n\n const result = authorization.split(' ')\n if (result.length !== 2) {\n throw new InvalidRequestError(\n 'Malformed authorization header',\n 'InvalidToken',\n )\n }\n\n // authorization type is case-insensitive\n const authType = result[0].toUpperCase()\n\n const type = Object.hasOwn(AuthType, authType) ? AuthType[authType] : null\n if (type) return [type, result[1]]\n\n throw new InvalidRequestError(\n `Unsupported authorization type: ${result[0]}`,\n 'InvalidToken',\n )\n}\n\n/\n @note Not all service auth tokens are guaranteed to have \"lxm\" claim, so this\n * function should not be used to verify service auth tokens. It is only used to\n * check if a token is definitely a service auth token.\n */\nconst isDefinitelyServiceAuth = (req: IncomingMessage): boolean => {\n const token = bearerTokenFromReq(req)\n if (!token) return false\n const payload = jose.decodeJwt(token)\n return payload['lxm'] != null\n}\n\nconst extractAuthType = (req: IncomingMessage): AuthType \| null => {\n const [type] = parseAuthorizationHeader(req)\n return type\n}\n\nexport const bearerTokenFromReq = (req: IncomingMessage) => {\n const [type, token] = parseAuthorizationHeader(req)\n return type === AuthType.BEARER ? token : null\n}\n\nconst parseBasicAuth = (\n req: IncomingMessage,\n): { username: string; password: string } \| null => {\n try {\n const [type, b64] = parseAuthorizationHeader(req)\n if (type !== AuthType.BASIC) return null\n const decoded = Buffer.from(b64, 'base64').toString('utf8')\n // We must not use split(':') because the password can contain colons\n const colon = decoded.indexOf(':')\n if (colon === -1) return null\n const username = decoded.slice(0, colon)\n const password = decoded.slice(colon + 1)\n return { username, password }\n } catch (err) {\n return null\n }\n}\n\nexport const createSecretKeyObject = (secret: string): KeyObject => {\n return createSecretKey(Buffer.from(secret))\n}\n\nconst keyEncoder = new KeyEncoder('secp256k1')\nexport const createPublicKeyObject = (publicKeyHex: string): KeyObject => {\n const key = keyEncoder.encodePublic(publicKeyHex, 'raw', 'pem')\n return createPublicKey({ format: 'pem', key })\n}\n\nfunction setAuthHeaders(res: ServerResponse) {\n res.setHeader('Cache-Control', 'private')\n appendVary(res, 'Authorization')\n}\n"]}

package/dist/background.d.ts CHANGED Viewed

@@ -1,6 +1,6 @@
 import PQueue from 'p-queue';
 export declare class BackgroundQueue {
-    queue: PQueue<import("p-queue/dist/priority-queue").default, import("p-queue").DefaultAddOptions>;
+    queue: InstanceType<typeof PQueue>;
     destroyed: boolean;
     constructor();
     add(task: Task): void;

package/dist/background.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"background.d.ts","sourceRoot":"","sources":["../src/background.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,SAAS,CAAA;AAK5B,qBAAa,eAAe;IAC1B,KAAK,~~6FAAiC~~;~~IACtC~~,SAAS,UAAQ;;IAGjB,GAAG,CAAC,IAAI,EAAE,IAAI;IAWR,UAAU;IAMV,OAAO;CAId;AAED,KAAK,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA"}
1	+ {"version":3,"file":"background.d.ts","sourceRoot":"","sources":["../src/background.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,SAAS,CAAA;AAK5B,qBAAa,eAAe;IAC1B,KAAK,EAAE,YAAY,CAAC,OAAO,MAAM,CAAC,CAAiC;IACnE,SAAS,UAAQ;;IAGjB,GAAG,CAAC,IAAI,EAAE,IAAI;IAWR,UAAU;IAMV,OAAO;CAId;AAED,KAAK,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA"}

package/dist/background.js CHANGED Viewed

@@ -1,26 +1,10 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.BackgroundQueue = void 0;
-const p_queue_1 = __importDefault(require("p-queue"));
-const logger_1 = require("./logger");
+import PQueue from 'p-queue';
+import { dbLogger } from './logger.js';
 // A simple queue for in-process, out-of-band/backgrounded work
-class BackgroundQueue {
+export class BackgroundQueue {
     constructor() {
-        Object.defineProperty(this, "queue", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: new p_queue_1.default({ concurrency: 5 })
-        });
-        Object.defineProperty(this, "destroyed", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: false
-        });
+        this.queue = new PQueue({ concurrency: 5 });
+        this.destroyed = false;
     }
     add(task) {
         if (this.destroyed) {
@@ -29,7 +13,7 @@ class BackgroundQueue {
         this.queue
             .add(() => task())
             .catch((err) => {
-            logger_1.dbLogger.error({ err }, 'background queue task failed');
+            dbLogger.error({ err }, 'background queue task failed');
         });
     }
     async processAll() {
@@ -42,5 +26,4 @@ class BackgroundQueue {
         await this.queue.onIdle();
     }
 }
-exports.BackgroundQueue = BackgroundQueue;
 //# sourceMappingURL=background.js.map

package/dist/background.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"background.js","sourceRoot":"","sources":["../src/background.ts"],"names":[],"mappings":"~~;;;;;;~~AAAA,~~sDAA4B~~;AAC5B,~~qCAAmC~~;~~AAEnC~~,+DAA+D;AAE/D,~~MAAa~~,eAAe;IAG1B;QAFA~~;;;;mBAAQ~~,IAAI,~~iBAAM~~,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;~~WAAA;QACtC;;;;mBAAY~~,KAAK;~~WAAA;~~IACF,CAAC;IAEhB,GAAG,CAAC,IAAU;QACZ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,OAAM;QACR,CAAC;QACD,IAAI,CAAC,KAAK;aACP,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;aACjB,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,~~iBAAQ~~,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,8BAA8B,CAAC,CAAA;QACzD,CAAC,CAAC,CAAA;IACN,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;IAC3B,CAAC;IAED,sFAAsF;IACtF,oGAAoG;IACpG,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,SAAS,GAAG,IAAI,CAAA;QACrB,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;IAC3B,CAAC;CACF~~;AA1BD,0CA0BC~~","sourcesContent":["import PQueue from 'p-queue'\nimport { dbLogger } from './logger'\n\n// A simple queue for in-process, out-of-band/backgrounded work\n\nexport class BackgroundQueue {\n queue = new PQueue({ concurrency: 5 })\n destroyed = false\n constructor() {}\n\n add(task: Task) {\n if (this.destroyed) {\n return\n }\n this.queue\n .add(() => task())\n .catch((err) => {\n dbLogger.error({ err }, 'background queue task failed')\n })\n }\n\n async processAll() {\n await this.queue.onIdle()\n }\n\n // On destroy we stop accepting new tasks, but complete all pending/in-progress tasks.\n // The application calls this only once http connections have drained (tasks no longer being added).\n async destroy() {\n this.destroyed = true\n await this.queue.onIdle()\n }\n}\n\ntype Task = () => Promise<void>\n"]}
1	+ {"version":3,"file":"background.js","sourceRoot":"","sources":["../src/background.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,SAAS,CAAA;AAC5B,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAEtC,+DAA+D;AAE/D,MAAM,OAAO,eAAe;IAG1B;QAFA,UAAK,GAAgC,IAAI,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAA;QACnE,cAAS,GAAG,KAAK,CAAA;IACF,CAAC;IAEhB,GAAG,CAAC,IAAU;QACZ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,OAAM;QACR,CAAC;QACD,IAAI,CAAC,KAAK;aACP,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;aACjB,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,QAAQ,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,8BAA8B,CAAC,CAAA;QACzD,CAAC,CAAC,CAAA;IACN,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;IAC3B,CAAC;IAED,sFAAsF;IACtF,oGAAoG;IACpG,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,SAAS,GAAG,IAAI,CAAA;QACrB,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;IAC3B,CAAC;CACF","sourcesContent":["import PQueue from 'p-queue'\nimport { dbLogger } from './logger.js'\n\n// A simple queue for in-process, out-of-band/backgrounded work\n\nexport class BackgroundQueue {\n queue: InstanceType<typeof PQueue> = new PQueue({ concurrency: 5 })\n destroyed = false\n constructor() {}\n\n add(task: Task) {\n if (this.destroyed) {\n return\n }\n this.queue\n .add(() => task())\n .catch((err) => {\n dbLogger.error({ err }, 'background queue task failed')\n })\n }\n\n async processAll() {\n await this.queue.onIdle()\n }\n\n // On destroy we stop accepting new tasks, but complete all pending/in-progress tasks.\n // The application calls this only once http connections have drained (tasks no longer being added).\n async destroy() {\n this.destroyed = true\n await this.queue.onIdle()\n }\n}\n\ntype Task = () => Promise<void>\n"]}

package/dist/basic-routes.d.ts CHANGED Viewed

@@ -1,4 +1,4 @@
 import { Router } from 'express';
-import { AppContext } from './context';
+import { AppContext } from './context.js';
 export declare const createRouter: (ctx: AppContext) => Router;
 //# sourceMappingURL=basic-routes.d.ts.map

package/dist/basic-routes.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"basic-routes.d.ts","sourceRoot":"","sources":["../src/basic-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAEhC,OAAO,EAAE,UAAU,EAAE,MAAM,~~WAAW~~,CAAA;~~AAEtC~~,eAAO,MAAM,YAAY,GAAI,KAAK,UAAU,KAAG,MA+C9C,CAAA"}
1	+ {"version":3,"file":"basic-routes.d.ts","sourceRoot":"","sources":["../src/basic-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAEhC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAEzC,eAAO,MAAM,YAAY,GAAI,KAAK,UAAU,KAAG,MA+C9C,CAAA"}

package/dist/basic-routes.js CHANGED Viewed

@@ -1,10 +1,7 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createRouter = void 0;
-const express_1 = require("express");
-const kysely_1 = require("kysely");
-const createRouter = (ctx) => {
-    const router = (0, express_1.Router)();
+import { Router } from 'express';
+import { sql } from 'kysely';
+export const createRouter = (ctx) => {
+    const router = Router();
     router.get('/', function (req, res) {
         res.type('text/plain');
         res.send(`
@@ -35,7 +32,7 @@ Most API routes are under /xrpc/
     router.get('/xrpc/_health', async function (req, res) {
         const { version } = ctx.cfg.service;
         try {
-            await (0, kysely_1.sql) `select 1`.execute(ctx.accountManager.db.db);
+            await sql `select 1`.execute(ctx.accountManager.db.db);
         }
         catch (err) {
             req.log.error({ err }, 'failed health check');
@@ -46,5 +43,4 @@ Most API routes are under /xrpc/
     });
     return router;
 };
-exports.createRouter = createRouter;
 //# sourceMappingURL=basic-routes.js.map

package/dist/basic-routes.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"basic-routes.js","sourceRoot":"","sources":["../src/basic-routes.ts"],"names":[],"mappings":"~~;;;~~AAAA,~~qCAAgC~~;AAChC,~~mCAA4B~~;~~AAGrB~~,MAAM,YAAY,GAAG,CAAC,GAAe,EAAU,EAAE;IACtD,MAAM,MAAM,GAAG,~~IAAA~~,~~gBAAM~~,~~GAAE,~~CAAA;IAEvB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,GAAG,EAAE,GAAG;QAChC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACtB,GAAG,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;CAmBZ,CAAC,CAAA;IACA,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,GAAG,EAAE,GAAG;QAC1C,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACtB,GAAG,CAAC,IAAI,CACN,2EAA2E,CAC5E,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,WAAW,GAAG,EAAE,GAAG;QAClD,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAA;QACnC,IAAI,CAAC;YACH,MAAM,~~IAAA~~,~~YAAG~~,~~EAAA,~~UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,qBAAqB,CAAC,CAAA;YAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAA;YAC/D,OAAM;QACR,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IACvB,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC,CAAA~~;AA/CY,QAAA,YAAY,gBA+CxB~~","sourcesContent":["import { Router } from 'express'\nimport { sql } from 'kysely'\nimport { AppContext } from './context'\n\nexport const createRouter = (ctx: AppContext): Router => {\n const router = Router()\n\n router.get('/', function (req, res) {\n res.type('text/plain')\n res.send(`\n __ __\n /\\\\ \\\\__ /\\\\ \\\\__\n __ \\\\ \\\\ ,_\\\\ _____ _ __ ___\\\\ \\\\ ,_\\\\ ___\n /'__'\\\\ \\\\ \\\\ \\\\/ /\\\\ '__'\\\\/\\\\''__\\\\/ __'\\\\ \\\\ \\\\/ / __'\\\\\n /\\\\ \\\\L\\\\.\\\\_\\\\ \\\\ \\\\_\\\\ \\\\ \\\\L\\\\ \\\\ \\\\ \\\\//\\\\ \\\\L\\\\ \\\\ \\\\ \\\\_/\\\\ \\\\L\\\\ \\\\\n \\\\ \\\\__/.\\\\_\\\\\\\\ \\\\__\\\\\\\\ \\\\ ,__/\\\\ \\\\_\\\\\\\\ \\\\____/\\\\ \\\\__\\\\ \\\\____/\n \\\\/__/\\\\/_/ \\\\/__/ \\\\ \\\\ \\\\/ \\\\/_/ \\\\/___/ \\\\/__/\\\\/___/\n \\\\ \\\\_\\\\\n \\\\/_/\n\n\nThis is an AT Protocol Personal Data Server (aka, an atproto PDS)\n\nMost API routes are under /xrpc/\n\n Code: https://github.com/bluesky-social/atproto\n Self-Host: https://github.com/bluesky-social/pds\n Protocol: https://atproto.com\n`)\n })\n\n router.get('/robots.txt', function (req, res) {\n res.type('text/plain')\n res.send(\n '# Hello!\\n\\n# Crawling the public API is allowed\\nUser-agent: *\\nAllow: /',\n )\n })\n\n router.get('/xrpc/_health', async function (req, res) {\n const { version } = ctx.cfg.service\n try {\n await sql`select 1`.execute(ctx.accountManager.db.db)\n } catch (err) {\n req.log.error({ err }, 'failed health check')\n res.status(503).send({ version, error: 'Service Unavailable' })\n return\n }\n res.send({ version })\n })\n\n return router\n}\n"]}
1	+ {"version":3,"file":"basic-routes.js","sourceRoot":"","sources":["../src/basic-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAA;AAG5B,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAe,EAAU,EAAE;IACtD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAA;IAEvB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,GAAG,EAAE,GAAG;QAChC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACtB,GAAG,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;CAmBZ,CAAC,CAAA;IACA,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,GAAG,EAAE,GAAG;QAC1C,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACtB,GAAG,CAAC,IAAI,CACN,2EAA2E,CAC5E,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,WAAW,GAAG,EAAE,GAAG;QAClD,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAA;QACnC,IAAI,CAAC;YACH,MAAM,GAAG,CAAA,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,qBAAqB,CAAC,CAAA;YAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAA;YAC/D,OAAM;QACR,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IACvB,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC,CAAA","sourcesContent":["import { Router } from 'express'\nimport { sql } from 'kysely'\nimport { AppContext } from './context.js'\n\nexport const createRouter = (ctx: AppContext): Router => {\n const router = Router()\n\n router.get('/', function (req, res) {\n res.type('text/plain')\n res.send(`\n __ __\n /\\\\ \\\\__ /\\\\ \\\\__\n __ \\\\ \\\\ ,_\\\\ _____ _ __ ___\\\\ \\\\ ,_\\\\ ___\n /'__'\\\\ \\\\ \\\\ \\\\/ /\\\\ '__'\\\\/\\\\''__\\\\/ __'\\\\ \\\\ \\\\/ / __'\\\\\n /\\\\ \\\\L\\\\.\\\\_\\\\ \\\\ \\\\_\\\\ \\\\ \\\\L\\\\ \\\\ \\\\ \\\\//\\\\ \\\\L\\\\ \\\\ \\\\ \\\\_/\\\\ \\\\L\\\\ \\\\\n \\\\ \\\\__/.\\\\_\\\\\\\\ \\\\__\\\\\\\\ \\\\ ,__/\\\\ \\\\_\\\\\\\\ \\\\____/\\\\ \\\\__\\\\ \\\\____/\n \\\\/__/\\\\/_/ \\\\/__/ \\\\ \\\\ \\\\/ \\\\/_/ \\\\/___/ \\\\/__/\\\\/___/\n \\\\ \\\\_\\\\\n \\\\/_/\n\n\nThis is an AT Protocol Personal Data Server (aka, an atproto PDS)\n\nMost API routes are under /xrpc/\n\n Code: https://github.com/bluesky-social/atproto\n Self-Host: https://github.com/bluesky-social/pds\n Protocol: https://atproto.com\n`)\n })\n\n router.get('/robots.txt', function (req, res) {\n res.type('text/plain')\n res.send(\n '# Hello!\\n\\n# Crawling the public API is allowed\\nUser-agent: *\\nAllow: /',\n )\n })\n\n router.get('/xrpc/_health', async function (req, res) {\n const { version } = ctx.cfg.service\n try {\n await sql`select 1`.execute(ctx.accountManager.db.db)\n } catch (err) {\n req.log.error({ err }, 'failed health check')\n res.status(503).send({ version, error: 'Service Unavailable' })\n return\n }\n res.send({ version })\n })\n\n return router\n}\n"]}

package/dist/bsky-app-view.js CHANGED Viewed

@@ -1,37 +1,10 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.BskyAppView = void 0;
-const node_util_1 = require("node:util");
-const lex_1 = require("@atproto/lex");
-class BskyAppView {
+import { format } from 'node:util';
+import { Client } from '@atproto/lex';
+export class BskyAppView {
     constructor(options) {
-        Object.defineProperty(this, "did", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        Object.defineProperty(this, "url", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        Object.defineProperty(this, "client", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        Object.defineProperty(this, "cdnUrlPattern", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
         this.did = options.did;
         this.url = options.url;
-        this.client = new lex_1.Client({ service: options.url }, {
+        this.client = new Client({ service: options.url }, {
             strictResponseProcessing: false,
             validateResponse: options.validateResponse ?? false,
         });
@@ -39,8 +12,7 @@ class BskyAppView {
     }
     getImageUrl(pattern, did, cid) {
         if (this.cdnUrlPattern)
-            return (0, node_util_1.format)(this.cdnUrlPattern, pattern, did, cid);
+            return format(this.cdnUrlPattern, pattern, did, cid);
     }
 }
-exports.BskyAppView = BskyAppView;
 //# sourceMappingURL=bsky-app-view.js.map

package/dist/bsky-app-view.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"bsky-app-view.js","sourceRoot":"","sources":["../src/bsky-app-view.ts"],"names":[],"mappings":"~~;;;~~AAAA,~~yCAAkC~~;AAClC,~~sCAAqC~~;AASrC,~~MAAa~~,WAAW;IAMtB,YAAY,OAAuB;~~QAL5B;;;;;WAAW;QACX;;;;;WAAW;QACX;;;;;WAAc;QACb;;;;;WAAsB;QAG5B~~,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;QACtB,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;QACtB,IAAI,CAAC,MAAM,GAAG,IAAI,~~YAAM~~,CACtB,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,EACxB;YACE,wBAAwB,EAAE,KAAK;YAC/B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,KAAK;SACpD,CACF,CAAA;QACD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAA;IAC5C,CAAC;IAED,WAAW,CAAC,OAAe,EAAE,GAAW,EAAE,GAAW;QACnD,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,~~IAAA~~,~~kBAAM~~,~~EAAC,~~IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IAC9E,CAAC;CACF~~;AAtBD,kCAsBC~~","sourcesContent":["import { format } from 'node:util'\nimport { Client } from '@atproto/lex'\n\nexport type AppViewOptions = {\n url: string\n did: string\n cdnUrlPattern?: string\n validateResponse?: boolean\n}\n\nexport class BskyAppView {\n public did: string\n public url: string\n public client: Client\n private cdnUrlPattern?: string\n\n constructor(options: AppViewOptions) {\n this.did = options.did\n this.url = options.url\n this.client = new Client(\n { service: options.url },\n {\n strictResponseProcessing: false,\n validateResponse: options.validateResponse ?? false,\n },\n )\n this.cdnUrlPattern = options.cdnUrlPattern\n }\n\n getImageUrl(pattern: string, did: string, cid: string): string \| undefined {\n if (this.cdnUrlPattern) return format(this.cdnUrlPattern, pattern, did, cid)\n }\n}\n"]}
1	+ {"version":3,"file":"bsky-app-view.js","sourceRoot":"","sources":["../src/bsky-app-view.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AASrC,MAAM,OAAO,WAAW;IAMtB,YAAY,OAAuB;QACjC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;QACtB,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;QACtB,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CACtB,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,EACxB;YACE,wBAAwB,EAAE,KAAK;YAC/B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,KAAK;SACpD,CACF,CAAA;QACD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAA;IAC5C,CAAC;IAED,WAAW,CAAC,OAAe,EAAE,GAAW,EAAE,GAAW;QACnD,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IAC9E,CAAC;CACF","sourcesContent":["import { format } from 'node:util'\nimport { Client } from '@atproto/lex'\n\nexport type AppViewOptions = {\n url: string\n did: string\n cdnUrlPattern?: string\n validateResponse?: boolean\n}\n\nexport class BskyAppView {\n public did: string\n public url: string\n public client: Client\n private cdnUrlPattern?: string\n\n constructor(options: AppViewOptions) {\n this.did = options.did\n this.url = options.url\n this.client = new Client(\n { service: options.url },\n {\n strictResponseProcessing: false,\n validateResponse: options.validateResponse ?? false,\n },\n )\n this.cdnUrlPattern = options.cdnUrlPattern\n }\n\n getImageUrl(pattern: string, did: string, cid: string): string \| undefined {\n if (this.cdnUrlPattern) return format(this.cdnUrlPattern, pattern, did, cid)\n }\n}\n"]}

package/dist/config/config.d.ts CHANGED Viewed

@@ -1,5 +1,5 @@
 import { BrandingInput, HcaptchaConfig } from '@atproto/oauth-provider';
-import { ServerEnvironment } from './env';
+import { ServerEnvironment } from './env.js';
 export declare const envToCfg: (env: ServerEnvironment) => ServerConfig;
 export type ServerConfig = {
     service: ServiceConfig;

package/dist/config/config.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAEvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,~~OAAO~~,CAAA;~~AAKzC~~,eAAO,MAAM,QAAQ,GAAI,KAAK,iBAAiB,KAAG,YAgWjD,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,aAAa,CAAA;IACtB,EAAE,EAAE,cAAc,CAAA;IAClB,UAAU,EAAE,gBAAgB,CAAA;IAC5B,SAAS,EAAE,iBAAiB,GAAG,mBAAmB,CAAA;IAClD,QAAQ,EAAE,cAAc,CAAA;IACxB,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAA;IAC/B,OAAO,EAAE,aAAa,CAAA;IACtB,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;IACzB,eAAe,EAAE,WAAW,GAAG,IAAI,CAAA;IACnC,YAAY,EAAE,kBAAkB,CAAA;IAChC,WAAW,EAAE,iBAAiB,GAAG,IAAI,CAAA;IACrC,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAA;IACnC,aAAa,EAAE,mBAAmB,GAAG,IAAI,CAAA;IACzC,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAAA;IAChC,UAAU,EAAE,gBAAgB,CAAA;IAC5B,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,KAAK,EAAE,WAAW,CAAA;IAClB,KAAK,EAAE,WAAW,CAAA;IAClB,KAAK,EAAE,WAAW,CAAA;IAClB,OAAO,EAAE,qBAAqB,CAAA;CAC/B,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,gBAAgB,EAAE,OAAO,CAAA;IACzB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,eAAe,EAAE,MAAM,CAAA;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,OAAO,EAAE,OAAO,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,MAAM,CAAA;IACtB,aAAa,EAAE,MAAM,CAAA;IACrB,wBAAwB,EAAE,OAAO,CAAA;CAClC,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,wBAAwB,EAAE,OAAO,CAAA;CAClC,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,EAAE,IAAI,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,WAAW,CAAC,EAAE;QACZ,WAAW,EAAE,MAAM,CAAA;QACnB,eAAe,EAAE,MAAM,CAAA;KACxB,CAAA;CACF,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,eAAe,EAAE,MAAM,CAAA;IACvB,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,oBAAoB,EAAE,MAAM,EAAE,CAAA;IAC9B,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAA;IAClC,uBAAuB,EAAE,OAAO,CAAA;CACjC,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,EAAE,MAAM,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,qBAAqB,EAAE,OAAO,CAAA;IAC9B,eAAe,EAAE,MAAM,CAAA;CACxB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,qBAAqB,EAAE,OAAO,CAAA;IAC9B,UAAU,EAAE,OAAO,CAAA;IACnB,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,CAAA;IACvB,UAAU,EAAE,MAAM,CAAA;IAElB;;;;;;OAMG;IACH,gBAAgB,EAAE,OAAO,CAAA;CAC1B,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE;QACT,QAAQ,CAAC,EAAE,cAAc,CAAA;QACzB,QAAQ,EAAE,aAAa,CAAA;QACvB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;KAC1B,CAAA;CACF,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,YAAY,CAAC,EAAE,OAAO,MAAM,IAAI,MAAM,EAAE,CAAA;CACzC,CAAA;AAED,MAAM,MAAM,aAAa,GACrB;IACE,QAAQ,EAAE,IAAI,CAAA;IACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,KAAK,EAAE,MAAM,CAAA;CACd,GACD;IACE,QAAQ,EAAE,KAAK,CAAA;CAChB,CAAA;AAEL,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,mBAAmB,EAAE,MAAM,CAAA;CAC5B,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,gBAAgB,GACxB;IACE,OAAO,EAAE,IAAI,CAAA;IACb,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;CACrB,GACD;IAAE,OAAO,EAAE,KAAK,CAAA;CAAE,CAAA;AAEtB,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA"}
1	+ {"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAEvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAA;AAK5C,eAAO,MAAM,QAAQ,GAAI,KAAK,iBAAiB,KAAG,YAgWjD,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,aAAa,CAAA;IACtB,EAAE,EAAE,cAAc,CAAA;IAClB,UAAU,EAAE,gBAAgB,CAAA;IAC5B,SAAS,EAAE,iBAAiB,GAAG,mBAAmB,CAAA;IAClD,QAAQ,EAAE,cAAc,CAAA;IACxB,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAA;IAC/B,OAAO,EAAE,aAAa,CAAA;IACtB,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;IACzB,eAAe,EAAE,WAAW,GAAG,IAAI,CAAA;IACnC,YAAY,EAAE,kBAAkB,CAAA;IAChC,WAAW,EAAE,iBAAiB,GAAG,IAAI,CAAA;IACrC,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAA;IACnC,aAAa,EAAE,mBAAmB,GAAG,IAAI,CAAA;IACzC,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAAA;IAChC,UAAU,EAAE,gBAAgB,CAAA;IAC5B,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,KAAK,EAAE,WAAW,CAAA;IAClB,KAAK,EAAE,WAAW,CAAA;IAClB,KAAK,EAAE,WAAW,CAAA;IAClB,OAAO,EAAE,qBAAqB,CAAA;CAC/B,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,gBAAgB,EAAE,OAAO,CAAA;IACzB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,eAAe,EAAE,MAAM,CAAA;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,OAAO,EAAE,OAAO,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,MAAM,CAAA;IACtB,aAAa,EAAE,MAAM,CAAA;IACrB,wBAAwB,EAAE,OAAO,CAAA;CAClC,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,wBAAwB,EAAE,OAAO,CAAA;CAClC,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,EAAE,IAAI,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,WAAW,CAAC,EAAE;QACZ,WAAW,EAAE,MAAM,CAAA;QACnB,eAAe,EAAE,MAAM,CAAA;KACxB,CAAA;CACF,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,eAAe,EAAE,MAAM,CAAA;IACvB,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,oBAAoB,EAAE,MAAM,EAAE,CAAA;IAC9B,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAA;IAClC,uBAAuB,EAAE,OAAO,CAAA;CACjC,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,EAAE,MAAM,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,qBAAqB,EAAE,OAAO,CAAA;IAC9B,eAAe,EAAE,MAAM,CAAA;CACxB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,qBAAqB,EAAE,OAAO,CAAA;IAC9B,UAAU,EAAE,OAAO,CAAA;IACnB,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,CAAA;IACvB,UAAU,EAAE,MAAM,CAAA;IAElB;;;;;;OAMG;IACH,gBAAgB,EAAE,OAAO,CAAA;CAC1B,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE;QACT,QAAQ,CAAC,EAAE,cAAc,CAAA;QACzB,QAAQ,EAAE,aAAa,CAAA;QACvB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;KAC1B,CAAA;CACF,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,YAAY,CAAC,EAAE,OAAO,MAAM,IAAI,MAAM,EAAE,CAAA;CACzC,CAAA;AAED,MAAM,MAAM,aAAa,GACrB;IACE,QAAQ,EAAE,IAAI,CAAA;IACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,KAAK,EAAE,MAAM,CAAA;CACd,GACD;IACE,QAAQ,EAAE,KAAK,CAAA;CAChB,CAAA;AAEL,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,mBAAmB,EAAE,MAAM,CAAA;CAC5B,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,gBAAgB,GACxB;IACE,OAAO,EAAE,IAAI,CAAA;IACb,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;CACrB,GACD;IAAE,OAAO,EAAE,KAAK,CAAA;CAAE,CAAA;AAEtB,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA"}

package/dist/config/config.js CHANGED Viewed

@@ -1,16 +1,10 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.envToCfg = void 0;
-const node_assert_1 = __importDefault(require("node:assert"));
-const node_path_1 = __importDefault(require("node:path"));
-const common_1 = require("@atproto/common");
-const syntax_1 = require("@atproto/syntax");
+import assert from 'node:assert';
+import path from 'node:path';
+import { DAY, HOUR, SECOND } from '@atproto/common';
+import { ensureValidDid } from '@atproto/syntax';
 // off-config but still from env:
 // logging: LOG_LEVEL, LOG_SYSTEMS, LOG_ENABLED, LOG_DESTINATION
-const envToCfg = (env) => {
+export const envToCfg = (env) => {
     const port = env.port ?? 2583;
     const hostname = env.hostname ?? 'localhost';
     const publicUrl = hostname === 'localhost'
@@ -32,7 +26,7 @@ const envToCfg = (env) => {
         devMode: env.devMode ?? false,
     };
     const dbLoc = (name) => {
-        return env.dataDirectory ? node_path_1.default.join(env.dataDirectory, name) : name;
+        return env.dataDirectory ? path.join(env.dataDirectory, name) : name;
     };
     const disableWalAutoCheckpoint = env.disableWalAutoCheckpoint ?? false;
     const dbCfg = {
@@ -97,9 +91,9 @@ const envToCfg = (env) => {
     }
     const identityCfg = {
         plcUrl: env.didPlcUrl ?? 'https://plc.directory',
-        cacheMaxTTL: env.didCacheMaxTTL ?? common_1.DAY,
-        cacheStaleTTL: env.didCacheStaleTTL ?? common_1.HOUR,
-        resolverTimeout: env.resolverTimeout ?? 3 * common_1.SECOND,
+        cacheMaxTTL: env.didCacheMaxTTL ?? DAY,
+        cacheStaleTTL: env.didCacheStaleTTL ?? HOUR,
+        resolverTimeout: env.resolverTimeout ?? 3 * SECOND,
         recoveryDidKey: env.recoveryDidKey ?? null,
         serviceHandleDomains,
         handleBackupNameservers: env.handleBackupNameservers,
@@ -107,7 +101,7 @@ const envToCfg = (env) => {
     };
     let entrywayCfg = null;
     if (env.entrywayUrl) {
-        (0, node_assert_1.default)(env.entrywayJwtVerifyKeyK256PublicKeyHex &&
+        assert(env.entrywayJwtVerifyKeyK256PublicKeyHex &&
             env.entrywayPlcRotationKey &&
             env.entrywayDid, 'if entryway url is configured, must include all required entryway configuration');
         entrywayCfg = {
@@ -155,11 +149,11 @@ const envToCfg = (env) => {
     }
     const subscriptionCfg = {
         maxBuffer: env.maxSubscriptionBuffer ?? 500,
-        repoBackfillLimitMs: env.repoBackfillLimitMs ?? common_1.DAY,
+        repoBackfillLimitMs: env.repoBackfillLimitMs ?? DAY,
     };
     let bskyAppViewCfg = null;
     if (env.bskyAppViewUrl) {
-        (0, node_assert_1.default)(env.bskyAppViewDid, 'if bsky appview service url is configured, must configure its did as well.');
+        assert(env.bskyAppViewDid, 'if bsky appview service url is configured, must configure its did as well.');
         bskyAppViewCfg = {
             url: env.bskyAppViewUrl,
             did: env.bskyAppViewDid,
@@ -168,7 +162,7 @@ const envToCfg = (env) => {
     }
     let modServiceCfg = null;
     if (env.modServiceUrl) {
-        (0, node_assert_1.default)(env.modServiceDid, 'if mod service url is configured, must configure its did as well.');
+        assert(env.modServiceDid, 'if mod service url is configured, must configure its did as well.');
         modServiceCfg = {
             url: env.modServiceUrl,
             did: env.modServiceDid,
@@ -176,7 +170,7 @@ const envToCfg = (env) => {
     }
     let reportServiceCfg = null;
     if (env.reportServiceUrl) {
-        (0, node_assert_1.default)(env.reportServiceDid, 'if report service url is configured, must configure its did as well.');
+        assert(env.reportServiceDid, 'if report service url is configured, must configure its did as well.');
         reportServiceCfg = {
             url: env.reportServiceUrl,
             did: env.reportServiceDid,
@@ -283,7 +277,7 @@ const envToCfg = (env) => {
         };
     const lexiconCfg = {};
     if (env.lexiconDidAuthority != null) {
-        (0, syntax_1.ensureValidDid)(env.lexiconDidAuthority);
+        ensureValidDid(env.lexiconDidAuthority);
         lexiconCfg.didAuthority = env.lexiconDidAuthority;
     }
     return {
@@ -309,5 +303,4 @@ const envToCfg = (env) => {
         oauth: oauthCfg,
     };
 };
-exports.envToCfg = envToCfg;
 //# sourceMappingURL=config.js.map