@atproto/pds 0.4.226 → 0.5.1

package/dist/api/com/atproto/server/requestEmailConfirmation.js

@@ -1,46 +1,51 @@
 import { DAY, HOUR } from '@atproto/common';
-import { InvalidRequestError } from '@atproto/xrpc-server';
 import { com } from '../../../../lexicons/index.js';
+// Exposed as a utility to ensure auth in confirmEmail and requestEmailConfirmation
+export function requestEmailConfirmationAuth(ctx) {
+    return ctx.authVerifier.authorization({
+        checkTakedown: true,
+        authorize: (permissions) => {
+            permissions.assertAccount({ attr: 'email', action: 'manage' });
+        },
+    });
+}
+const rateLimit = [
+    {
+        durationMs: DAY,
+        points: 15,
+        calcKey: ({ auth }) => auth.credentials.did,
+    },
+    {
+        durationMs: HOUR,
+        points: 5,
+        calcKey: ({ auth }) => auth.credentials.did,
+    },
+];
 export default function (server, ctx) {
-    server.add(com.atproto.server.requestEmailConfirmation, {
-        rateLimit: [
-            {
-                durationMs: DAY,
-                points: 15,
-                calcKey: ({ auth }) => auth.credentials.did,
-            },
-            {
-                durationMs: HOUR,
-                points: 5,
-                calcKey: ({ auth }) => auth.credentials.did,
+    const { entrywayClient } = ctx;
+    const auth = requestEmailConfirmationAuth(ctx);
+    if (entrywayClient) {
+        server.add(com.atproto.server.requestEmailConfirmation, {
+            auth,
+            rateLimit,
+            handler: async ({ auth, req }) => {
+                const { headers } = await ctx.entrywayAuthHeaders(req, auth.credentials.did, com.atproto.server.requestEmailConfirmation.$lxm);
+                await entrywayClient.xrpc(com.atproto.server.requestEmailConfirmation, {
+                    headers,
+                });
             },
-        ],
-        auth: ctx.authVerifier.authorization({
-            checkTakedown: true,
-            authorize: (permissions) => {
-                permissions.assertAccount({ attr: 'email', action: 'manage' });
+        });
+    }
+    else {
+        server.add(com.atproto.server.requestEmailConfirmation, {
+            auth,
+            rateLimit,
+            handler: async ({ auth }) => {
+                const did = auth.credentials.did;
+                const locale = undefined; // @TODO get the locale somehow
+                await ctx.accountManager.requestEmailConfirmation(did, { locale });
             },
-        }),
-        handler: async ({ auth, req }) => {
-            const did = auth.credentials.did;
-            const account = await ctx.accountManager.getAccount(did, {
-                includeDeactivated: true,
-                includeTakenDown: true,
-            });
-            if (!account) {
-                throw new InvalidRequestError('account not found');
-            }
-            if (ctx.entrywayClient) {
-                const { headers } = await ctx.entrywayAuthHeaders(req, auth.credentials.did, com.atproto.server.requestEmailConfirmation.$lxm);
-                await ctx.entrywayClient.xrpc(com.atproto.server.requestEmailConfirmation, { headers });
-                return;
-            }
-            if (!account.email) {
-                throw new InvalidRequestError('account does not have an email address');
-            }
-            const token = await ctx.accountManager.createEmailToken(did, 'confirm_email');
-            await ctx.mailer.sendConfirmEmail({ token }, { to: account.email });
-        },
-    });
+        });
+    }
 }
 //# sourceMappingURL=requestEmailConfirmation.js.map

package/dist/api/com/atproto/server/requestEmailConfirmation.js.map

@@ -1 +1 @@
-{"version":3,"file":"requestEmailConfirmation.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/requestEmailConfirmation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,mBAAmB,EAAU,MAAM,sBAAsB,CAAA;AAElE,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AAEnD,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,wBAAwB,EAAE;QACtD,SAAS,EAAE;YACT;gBACE,UAAU,EAAE,GAAG;gBACf,MAAM,EAAE,EAAE;gBACV,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG;aAC5C;YACD;gBACE,UAAU,EAAE,IAAI;gBAChB,MAAM,EAAE,CAAC;gBACT,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG;aAC5C;SACF;QACD,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,aAAa,CAAC;YACnC,aAAa,EAAE,IAAI;YACnB,SAAS,EAAE,CAAC,WAAW,EAAE,EAAE;gBACzB,WAAW,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;YAChE,CAAC;SACF,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;YAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAA;YAChC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE;gBACvD,kBAAkB,EAAE,IAAI;gBACxB,gBAAgB,EAAE,IAAI;aACvB,CAAC,CAAA;YACF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;YACpD,CAAC;YAED,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;gBACvB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,mBAAmB,CAC/C,GAAG,EACH,IAAI,CAAC,WAAW,CAAC,GAAG,EACpB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,wBAAwB,CAAC,IAAI,CACjD,CAAA;gBAED,MAAM,GAAG,CAAC,cAAc,CAAC,IAAI,CAC3B,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,wBAAwB,EAC3C,EAAE,OAAO,EAAE,CACZ,CAAA;gBAED,OAAM;YACR,CAAC;YAED,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,IAAI,mBAAmB,CAAC,wCAAwC,CAAC,CAAA;YACzE,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,gBAAgB,CACrD,GAAG,EACH,eAAe,CAChB,CAAA;YACD,MAAM,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;QACrE,CAAC;KACF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { DAY, HOUR } from '@atproto/common'\nimport { InvalidRequestError, Server } from '@atproto/xrpc-server'\nimport { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.server.requestEmailConfirmation, {\n    rateLimit: [\n      {\n        durationMs: DAY,\n        points: 15,\n        calcKey: ({ auth }) => auth.credentials.did,\n      },\n      {\n        durationMs: HOUR,\n        points: 5,\n        calcKey: ({ auth }) => auth.credentials.did,\n      },\n    ],\n    auth: ctx.authVerifier.authorization({\n      checkTakedown: true,\n      authorize: (permissions) => {\n        permissions.assertAccount({ attr: 'email', action: 'manage' })\n      },\n    }),\n    handler: async ({ auth, req }) => {\n      const did = auth.credentials.did\n      const account = await ctx.accountManager.getAccount(did, {\n        includeDeactivated: true,\n        includeTakenDown: true,\n      })\n      if (!account) {\n        throw new InvalidRequestError('account not found')\n      }\n\n      if (ctx.entrywayClient) {\n        const { headers } = await ctx.entrywayAuthHeaders(\n          req,\n          auth.credentials.did,\n          com.atproto.server.requestEmailConfirmation.$lxm,\n        )\n\n        await ctx.entrywayClient.xrpc(\n          com.atproto.server.requestEmailConfirmation,\n          { headers },\n        )\n\n        return\n      }\n\n      if (!account.email) {\n        throw new InvalidRequestError('account does not have an email address')\n      }\n      const token = await ctx.accountManager.createEmailToken(\n        did,\n        'confirm_email',\n      )\n      await ctx.mailer.sendConfirmEmail({ token }, { to: account.email })\n    },\n  })\n}\n"]}
+{"version":3,"file":"requestEmailConfirmation.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/requestEmailConfirmation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AAQ3C,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AAEnD,mFAAmF;AACnF,MAAM,UAAU,4BAA4B,CAC1C,GAAe;IAEf,OAAO,GAAG,CAAC,YAAY,CAAC,aAAa,CAAC;QACpC,aAAa,EAAE,IAAI;QACnB,SAAS,EAAE,CAAC,WAAW,EAAE,EAAE;YACzB,WAAW,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;QAChE,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,SAAS,GAAgD;IAC7D;QACE,UAAU,EAAE,GAAG;QACf,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG;KAC5C;IACD;QACE,UAAU,EAAE,IAAI;QAChB,MAAM,EAAE,CAAC;QACT,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG;KAC5C;CACF,CAAA;AAED,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,EAAE,cAAc,EAAE,GAAG,GAAG,CAAA;IAE9B,MAAM,IAAI,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAA;IAE9C,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,wBAAwB,EAAE;YACtD,IAAI;YACJ,SAAS;YACT,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;gBAC/B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,mBAAmB,CAC/C,GAAG,EACH,IAAI,CAAC,WAAW,CAAC,GAAG,EACpB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,wBAAwB,CAAC,IAAI,CACjD,CAAA;gBAED,MAAM,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,wBAAwB,EAAE;oBACrE,OAAO;iBACR,CAAC,CAAA;YACJ,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,wBAAwB,EAAE;YACtD,IAAI;YACJ,SAAS;YACT,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;gBAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAA;gBAChC,MAAM,MAAM,GAAG,SAAS,CAAA,CAAC,+BAA+B;gBACxD,MAAM,GAAG,CAAC,cAAc,CAAC,wBAAwB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;YACpE,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { DAY, HOUR } from '@atproto/common'\nimport {\n  MethodAuthVerifier,\n  MethodRateLimit,\n  Server,\n} from '@atproto/xrpc-server'\nimport { AccessOutput, OAuthOutput } from '../../../../auth-output.js'\nimport { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\n\n// Exposed as a utility to ensure auth in confirmEmail and requestEmailConfirmation\nexport function requestEmailConfirmationAuth(\n  ctx: AppContext,\n): MethodAuthVerifier<AccessOutput | OAuthOutput> {\n  return ctx.authVerifier.authorization({\n    checkTakedown: true,\n    authorize: (permissions) => {\n      permissions.assertAccount({ attr: 'email', action: 'manage' })\n    },\n  })\n}\n\nconst rateLimit: MethodRateLimit<AccessOutput | OAuthOutput> = [\n  {\n    durationMs: DAY,\n    points: 15,\n    calcKey: ({ auth }) => auth.credentials.did,\n  },\n  {\n    durationMs: HOUR,\n    points: 5,\n    calcKey: ({ auth }) => auth.credentials.did,\n  },\n]\n\nexport default function (server: Server, ctx: AppContext) {\n  const { entrywayClient } = ctx\n\n  const auth = requestEmailConfirmationAuth(ctx)\n\n  if (entrywayClient) {\n    server.add(com.atproto.server.requestEmailConfirmation, {\n      auth,\n      rateLimit,\n      handler: async ({ auth, req }) => {\n        const { headers } = await ctx.entrywayAuthHeaders(\n          req,\n          auth.credentials.did,\n          com.atproto.server.requestEmailConfirmation.$lxm,\n        )\n\n        await entrywayClient.xrpc(com.atproto.server.requestEmailConfirmation, {\n          headers,\n        })\n      },\n    })\n  } else {\n    server.add(com.atproto.server.requestEmailConfirmation, {\n      auth,\n      rateLimit,\n      handler: async ({ auth }) => {\n        const did = auth.credentials.did\n        const locale = undefined // @TODO get the locale somehow\n        await ctx.accountManager.requestEmailConfirmation(did, { locale })\n      },\n    })\n  }\n}\n"]}

package/dist/api/com/atproto/server/requestEmailUpdate.d.ts

@@ -1,4 +1,6 @@
-import { Server } from '@atproto/xrpc-server';
+import { MethodAuthVerifier, Server } from '@atproto/xrpc-server';
+import { AccessOutput, OAuthOutput } from '../../../../auth-output.js';
 import { AppContext } from '../../../../context.js';
+export declare function requestEmailUpdateAuth(ctx: AppContext): MethodAuthVerifier<AccessOutput | OAuthOutput>;
 export default function (server: Server, ctx: AppContext): void;
 //# sourceMappingURL=requestEmailUpdate.d.ts.map

package/dist/api/com/atproto/server/requestEmailUpdate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"requestEmailUpdate.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/requestEmailUpdate.ts"],"names":[],"mappings":"AACA,OAAO,EAAuB,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAGnD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAgEvD"}
+{"version":3,"file":"requestEmailUpdate.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/requestEmailUpdate.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,kBAAkB,EAElB,MAAM,EACP,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AAEtE,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAKnD,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,UAAU,GACd,kBAAkB,CAAC,YAAY,GAAG,WAAW,CAAC,CAUhD;AAeD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QA4CvD"}

package/dist/api/com/atproto/server/requestEmailUpdate.js

@@ -1,57 +1,61 @@
 import { DAY, HOUR } from '@atproto/common';
-import { InvalidRequestError } from '@atproto/xrpc-server';
+import { ForbiddenError, } from '@atproto/xrpc-server';
+import { ACCESS_FULL } from '../../../../auth-scope.js';
 import { com } from '../../../../lexicons/index.js';
+// Exposed as a utility to ensure auth in updateEmail and requestEmailUpdate
+// stay consistent.
+export function requestEmailUpdateAuth(ctx) {
+    return ctx.authVerifier.authorization({
+        checkTakedown: true,
+        scopes: ACCESS_FULL,
+        authorize: () => {
+            throw new ForbiddenError('Use the account manager interface to update email address associated with an account');
+        },
+    });
+}
+const rateLimit = [
+    {
+        durationMs: DAY,
+        points: 15,
+        calcKey: ({ auth }) => auth.credentials.did,
+    },
+    {
+        durationMs: HOUR,
+        points: 5,
+        calcKey: ({ auth }) => auth.credentials.did,
+    },
+];
 export default function (server, ctx) {
     const { entrywayClient } = ctx;
-    server.add(com.atproto.server.requestEmailUpdate, {
-        rateLimit: [
-            {
-                durationMs: DAY,
-                points: 15,
-                calcKey: ({ auth }) => auth.credentials.did,
-            },
-            {
-                durationMs: HOUR,
-                points: 5,
-                calcKey: ({ auth }) => auth.credentials.did,
-            },
-        ],
-        auth: ctx.authVerifier.authorization({
-            checkTakedown: true,
-            authorize: (permissions) => {
-                permissions.assertAccount({ attr: 'email', action: 'manage' });
-            },
-        }),
-        handler: async ({ auth, req }) => {
-            const did = auth.credentials.did;
-            const account = await ctx.accountManager.getAccount(did, {
-                includeDeactivated: true,
-                includeTakenDown: true,
-            });
-            if (!account) {
-                throw new InvalidRequestError('account not found');
-            }
-            if (entrywayClient) {
+    const auth = requestEmailUpdateAuth(ctx);
+    if (entrywayClient) {
+        server.add(com.atproto.server.requestEmailUpdate, {
+            rateLimit,
+            auth,
+            handler: async ({ auth, req }) => {
                 const { headers } = await ctx.entrywayAuthHeaders(req, auth.credentials.did, com.atproto.server.requestEmailUpdate.$lxm);
                 return entrywayClient.xrpc(com.atproto.server.requestEmailUpdate, {
                     headers,
                 });
-            }
-            if (!account.email) {
-                throw new InvalidRequestError('account does not have an email address');
-            }
-            const tokenRequired = !!account.emailConfirmedAt;
-            if (tokenRequired) {
-                const token = await ctx.accountManager.createEmailToken(did, 'update_email');
-                await ctx.mailer.sendUpdateEmail({ token }, { to: account.email });
-            }
-            return {
-                encoding: 'application/json',
-                body: {
-                    tokenRequired,
-                },
-            };
-        },
-    });
+            },
+        });
+    }
+    else {
+        server.add(com.atproto.server.requestEmailUpdate, {
+            rateLimit,
+            auth,
+            handler: async ({ auth }) => {
+                const did = auth.credentials.did;
+                // @TODO get the locale somehow (either by adding a field in the request
+                // body, or by using the `Accept-Language` header).
+                const locale = undefined;
+                const { tokenRequired } = await ctx.accountManager.requestEmailUpdate(did, { locale });
+                return {
+                    encoding: 'application/json',
+                    body: { tokenRequired },
+                };
+            },
+        });
+    }
 }
 //# sourceMappingURL=requestEmailUpdate.js.map

package/dist/api/com/atproto/server/requestEmailUpdate.js.map

@@ -1 +1 @@
-{"version":3,"file":"requestEmailUpdate.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/requestEmailUpdate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,mBAAmB,EAAU,MAAM,sBAAsB,CAAA;AAElE,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AAEnD,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,EAAE,cAAc,EAAE,GAAG,GAAG,CAAA;IAE9B,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE;QAChD,SAAS,EAAE;YACT;gBACE,UAAU,EAAE,GAAG;gBACf,MAAM,EAAE,EAAE;gBACV,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG;aAC5C;YACD;gBACE,UAAU,EAAE,IAAI;gBAChB,MAAM,EAAE,CAAC;gBACT,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG;aAC5C;SACF;QACD,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,aAAa,CAAC;YACnC,aAAa,EAAE,IAAI;YACnB,SAAS,EAAE,CAAC,WAAW,EAAE,EAAE;gBACzB,WAAW,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;YAChE,CAAC;SACF,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;YAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAA;YAChC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE;gBACvD,kBAAkB,EAAE,IAAI;gBACxB,gBAAgB,EAAE,IAAI;aACvB,CAAC,CAAA;YACF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;YACpD,CAAC;YAED,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,mBAAmB,CAC/C,GAAG,EACH,IAAI,CAAC,WAAW,CAAC,GAAG,EACpB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAC3C,CAAA;gBACD,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE;oBAChE,OAAO;iBACR,CAAC,CAAA;YACJ,CAAC;YAED,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,IAAI,mBAAmB,CAAC,wCAAwC,CAAC,CAAA;YACzE,CAAC;YAED,MAAM,aAAa,GAAG,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAA;YAChD,IAAI,aAAa,EAAE,CAAC;gBAClB,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,gBAAgB,CACrD,GAAG,EACH,cAAc,CACf,CAAA;gBACD,MAAM,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;YACpE,CAAC;YAED,OAAO;gBACL,QAAQ,EAAE,kBAA2B;gBACrC,IAAI,EAAE;oBACJ,aAAa;iBACd;aACF,CAAA;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { DAY, HOUR } from '@atproto/common'\nimport { InvalidRequestError, Server } from '@atproto/xrpc-server'\nimport { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  const { entrywayClient } = ctx\n\n  server.add(com.atproto.server.requestEmailUpdate, {\n    rateLimit: [\n      {\n        durationMs: DAY,\n        points: 15,\n        calcKey: ({ auth }) => auth.credentials.did,\n      },\n      {\n        durationMs: HOUR,\n        points: 5,\n        calcKey: ({ auth }) => auth.credentials.did,\n      },\n    ],\n    auth: ctx.authVerifier.authorization({\n      checkTakedown: true,\n      authorize: (permissions) => {\n        permissions.assertAccount({ attr: 'email', action: 'manage' })\n      },\n    }),\n    handler: async ({ auth, req }) => {\n      const did = auth.credentials.did\n      const account = await ctx.accountManager.getAccount(did, {\n        includeDeactivated: true,\n        includeTakenDown: true,\n      })\n      if (!account) {\n        throw new InvalidRequestError('account not found')\n      }\n\n      if (entrywayClient) {\n        const { headers } = await ctx.entrywayAuthHeaders(\n          req,\n          auth.credentials.did,\n          com.atproto.server.requestEmailUpdate.$lxm,\n        )\n        return entrywayClient.xrpc(com.atproto.server.requestEmailUpdate, {\n          headers,\n        })\n      }\n\n      if (!account.email) {\n        throw new InvalidRequestError('account does not have an email address')\n      }\n\n      const tokenRequired = !!account.emailConfirmedAt\n      if (tokenRequired) {\n        const token = await ctx.accountManager.createEmailToken(\n          did,\n          'update_email',\n        )\n        await ctx.mailer.sendUpdateEmail({ token }, { to: account.email })\n      }\n\n      return {\n        encoding: 'application/json' as const,\n        body: {\n          tokenRequired,\n        },\n      }\n    },\n  })\n}\n"]}
+{"version":3,"file":"requestEmailUpdate.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/requestEmailUpdate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EACL,cAAc,GAIf,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AAEvD,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AAEnD,4EAA4E;AAC5E,mBAAmB;AACnB,MAAM,UAAU,sBAAsB,CACpC,GAAe;IAEf,OAAO,GAAG,CAAC,YAAY,CAAC,aAAa,CAAC;QACpC,aAAa,EAAE,IAAI;QACnB,MAAM,EAAE,WAAW;QACnB,SAAS,EAAE,GAAG,EAAE;YACd,MAAM,IAAI,cAAc,CACtB,sFAAsF,CACvF,CAAA;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,SAAS,GAAgD;IAC7D;QACE,UAAU,EAAE,GAAG;QACf,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG;KAC5C;IACD;QACE,UAAU,EAAE,IAAI;QAChB,MAAM,EAAE,CAAC;QACT,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG;KAC5C;CACF,CAAA;AAED,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,EAAE,cAAc,EAAE,GAAG,GAAG,CAAA;IAE9B,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAA;IAExC,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE;YAChD,SAAS;YACT,IAAI;YACJ,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;gBAC/B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,mBAAmB,CAC/C,GAAG,EACH,IAAI,CAAC,WAAW,CAAC,GAAG,EACpB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAC3C,CAAA;gBAED,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE;oBAChE,OAAO;iBACR,CAAC,CAAA;YACJ,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE;YAChD,SAAS;YACT,IAAI;YACJ,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;gBAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAA;gBAEhC,wEAAwE;gBACxE,mDAAmD;gBACnD,MAAM,MAAM,GAAG,SAAS,CAAA;gBAExB,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,kBAAkB,CACnE,GAAG,EACH,EAAE,MAAM,EAAE,CACX,CAAA;gBAED,OAAO;oBACL,QAAQ,EAAE,kBAA2B;oBACrC,IAAI,EAAE,EAAE,aAAa,EAAE;iBACxB,CAAA;YACH,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { DAY, HOUR } from '@atproto/common'\nimport {\n  ForbiddenError,\n  MethodAuthVerifier,\n  MethodRateLimit,\n  Server,\n} from '@atproto/xrpc-server'\nimport { AccessOutput, OAuthOutput } from '../../../../auth-output.js'\nimport { ACCESS_FULL } from '../../../../auth-scope.js'\nimport { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\n\n// Exposed as a utility to ensure auth in updateEmail and requestEmailUpdate\n// stay consistent.\nexport function requestEmailUpdateAuth(\n  ctx: AppContext,\n): MethodAuthVerifier<AccessOutput | OAuthOutput> {\n  return ctx.authVerifier.authorization({\n    checkTakedown: true,\n    scopes: ACCESS_FULL,\n    authorize: () => {\n      throw new ForbiddenError(\n        'Use the account manager interface to update email address associated with an account',\n      )\n    },\n  })\n}\n\nconst rateLimit: MethodRateLimit<AccessOutput | OAuthOutput> = [\n  {\n    durationMs: DAY,\n    points: 15,\n    calcKey: ({ auth }) => auth.credentials.did,\n  },\n  {\n    durationMs: HOUR,\n    points: 5,\n    calcKey: ({ auth }) => auth.credentials.did,\n  },\n]\n\nexport default function (server: Server, ctx: AppContext) {\n  const { entrywayClient } = ctx\n\n  const auth = requestEmailUpdateAuth(ctx)\n\n  if (entrywayClient) {\n    server.add(com.atproto.server.requestEmailUpdate, {\n      rateLimit,\n      auth,\n      handler: async ({ auth, req }) => {\n        const { headers } = await ctx.entrywayAuthHeaders(\n          req,\n          auth.credentials.did,\n          com.atproto.server.requestEmailUpdate.$lxm,\n        )\n\n        return entrywayClient.xrpc(com.atproto.server.requestEmailUpdate, {\n          headers,\n        })\n      },\n    })\n  } else {\n    server.add(com.atproto.server.requestEmailUpdate, {\n      rateLimit,\n      auth,\n      handler: async ({ auth }) => {\n        const did = auth.credentials.did\n\n        // @TODO get the locale somehow (either by adding a field in the request\n        // body, or by using the `Accept-Language` header).\n        const locale = undefined\n\n        const { tokenRequired } = await ctx.accountManager.requestEmailUpdate(\n          did,\n          { locale },\n        )\n\n        return {\n          encoding: 'application/json' as const,\n          body: { tokenRequired },\n        }\n      },\n    })\n  }\n}\n"]}

package/dist/api/com/atproto/server/updateEmail.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"updateEmail.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/updateEmail.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,MAAM,EACP,MAAM,sBAAsB,CAAA;AAG7B,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAGnD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAqEvD"}
+{"version":3,"file":"updateEmail.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/updateEmail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAElE,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAInD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QA6CvD"}

package/dist/api/com/atproto/server/updateEmail.js

@@ -1,57 +1,43 @@
-import { isEmailValid } from '@hapi/address';
-import { isDisposableEmail } from 'disposable-email-domains-js';
-import { ForbiddenError, InvalidRequestError, } from '@atproto/xrpc-server';
+import { InvalidRequestError } from '@atproto/xrpc-server';
 import { UserAlreadyExistsError } from '../../../../account-manager/helpers/account.js';
-import { ACCESS_FULL } from '../../../../auth-scope.js';
 import { com } from '../../../../lexicons/index.js';
+import { requestEmailUpdateAuth } from './requestEmailUpdate.js';
 export default function (server, ctx) {
-    server.add(com.atproto.server.updateEmail, {
-        auth: ctx.authVerifier.authorization({
-            checkTakedown: true,
-            scopes: ACCESS_FULL,
-            authorize: () => {
-                throw new ForbiddenError('OAuth credentials are not supported for this endpoint');
-            },
-        }),
-        handler: async ({ auth, input: { body }, req }) => {
-            const did = auth.credentials.did;
-            const { token, email } = body;
-            if (!isEmailValid(email) || isDisposableEmail(email)) {
-                throw new InvalidRequestError('This email address is not supported, please use a different email.');
-            }
-            const account = await ctx.accountManager.getAccount(did, {
-                includeDeactivated: true,
-            });
-            if (!account) {
-                throw new InvalidRequestError('account not found');
-            }
-            if (ctx.entrywayClient) {
+    const { entrywayClient } = ctx;
+    // @NOTE Ensure that both endpoints use the same authentication logic
+    const auth = requestEmailUpdateAuth(ctx);
+    if (entrywayClient) {
+        server.add(com.atproto.server.updateEmail, {
+            auth,
+            handler: async ({ auth, input: { body }, req }) => {
                 const { headers } = await ctx.entrywayAuthHeaders(req, auth.credentials.did, com.atproto.server.updateEmail.$lxm);
-                await ctx.entrywayClient.xrpc(com.atproto.server.updateEmail, {
+                await entrywayClient.xrpc(com.atproto.server.updateEmail, {
                     headers,
                     body,
                 });
-                return;
-            }
-            // require valid token if account email is confirmed
-            if (account.emailConfirmedAt) {
-                if (!token) {
-                    throw new InvalidRequestError('confirmation token required', 'TokenRequired');
-                }
-                await ctx.accountManager.assertValidEmailToken(did, 'update_email', token);
-            }
-            try {
-                await ctx.accountManager.updateEmail({ did, email });
-            }
-            catch (err) {
-                if (err instanceof UserAlreadyExistsError) {
-                    throw new InvalidRequestError('This email address is already in use, please use a different email.');
+            },
+        });
+    }
+    else {
+        server.add(com.atproto.server.updateEmail, {
+            auth,
+            handler: async ({ auth, input: { body } }) => {
+                const did = auth.credentials.did;
+                const { token, email } = body;
+                // @TODO get the locale somehow (either by adding a field in the request
+                // body, or by using the `Accept-Language` header).
+                const locale = undefined;
+                try {
+                    await ctx.accountManager.updateEmail(did, email, token, { locale });
                 }
-                else {
-                    throw err;
+                catch (cause) {
+                    if (cause instanceof UserAlreadyExistsError) {
+                        throw new InvalidRequestError(cause.message, undefined, { cause });
+                    }
+                    throw cause;
                 }
-            }
-        },
-    });
+            },
+        });
+    }
 }
 //# sourceMappingURL=updateEmail.js.map

package/dist/api/com/atproto/server/updateEmail.js.map

@@ -1 +1 @@
-{"version":3,"file":"updateEmail.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/updateEmail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAC/D,OAAO,EACL,cAAc,EACd,mBAAmB,GAEpB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,gDAAgD,CAAA;AACvF,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AAEvD,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AAEnD,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QACzC,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,aAAa,CAAC;YACnC,aAAa,EAAE,IAAI;YACnB,MAAM,EAAE,WAAW;YACnB,SAAS,EAAE,GAAG,EAAE;gBACd,MAAM,IAAI,cAAc,CACtB,uDAAuD,CACxD,CAAA;YACH,CAAC;SACF,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;YAChD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAA;YAChC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,CAAA;YAC7B,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrD,MAAM,IAAI,mBAAmB,CAC3B,oEAAoE,CACrE,CAAA;YACH,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE;gBACvD,kBAAkB,EAAE,IAAI;aACzB,CAAC,CAAA;YACF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;YACpD,CAAC;YAED,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;gBACvB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,mBAAmB,CAC/C,GAAG,EACH,IAAI,CAAC,WAAW,CAAC,GAAG,EACpB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CACpC,CAAA;gBAED,MAAM,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;oBAC5D,OAAO;oBACP,IAAI;iBACL,CAAC,CAAA;gBAEF,OAAM;YACR,CAAC;YAED,oDAAoD;YACpD,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;gBAC7B,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAI,mBAAmB,CAC3B,6BAA6B,EAC7B,eAAe,CAChB,CAAA;gBACH,CAAC;gBACD,MAAM,GAAG,CAAC,cAAc,CAAC,qBAAqB,CAC5C,GAAG,EACH,cAAc,EACd,KAAK,CACN,CAAA;YACH,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;YACtD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,sBAAsB,EAAE,CAAC;oBAC1C,MAAM,IAAI,mBAAmB,CAC3B,qEAAqE,CACtE,CAAA;gBACH,CAAC;qBAAM,CAAC;oBACN,MAAM,GAAG,CAAA;gBACX,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { isEmailValid } from '@hapi/address'\nimport { isDisposableEmail } from 'disposable-email-domains-js'\nimport {\n  ForbiddenError,\n  InvalidRequestError,\n  Server,\n} from '@atproto/xrpc-server'\nimport { UserAlreadyExistsError } from '../../../../account-manager/helpers/account.js'\nimport { ACCESS_FULL } from '../../../../auth-scope.js'\nimport { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(com.atproto.server.updateEmail, {\n    auth: ctx.authVerifier.authorization({\n      checkTakedown: true,\n      scopes: ACCESS_FULL,\n      authorize: () => {\n        throw new ForbiddenError(\n          'OAuth credentials are not supported for this endpoint',\n        )\n      },\n    }),\n    handler: async ({ auth, input: { body }, req }) => {\n      const did = auth.credentials.did\n      const { token, email } = body\n      if (!isEmailValid(email) || isDisposableEmail(email)) {\n        throw new InvalidRequestError(\n          'This email address is not supported, please use a different email.',\n        )\n      }\n      const account = await ctx.accountManager.getAccount(did, {\n        includeDeactivated: true,\n      })\n      if (!account) {\n        throw new InvalidRequestError('account not found')\n      }\n\n      if (ctx.entrywayClient) {\n        const { headers } = await ctx.entrywayAuthHeaders(\n          req,\n          auth.credentials.did,\n          com.atproto.server.updateEmail.$lxm,\n        )\n\n        await ctx.entrywayClient.xrpc(com.atproto.server.updateEmail, {\n          headers,\n          body,\n        })\n\n        return\n      }\n\n      // require valid token if account email is confirmed\n      if (account.emailConfirmedAt) {\n        if (!token) {\n          throw new InvalidRequestError(\n            'confirmation token required',\n            'TokenRequired',\n          )\n        }\n        await ctx.accountManager.assertValidEmailToken(\n          did,\n          'update_email',\n          token,\n        )\n      }\n\n      try {\n        await ctx.accountManager.updateEmail({ did, email })\n      } catch (err) {\n        if (err instanceof UserAlreadyExistsError) {\n          throw new InvalidRequestError(\n            'This email address is already in use, please use a different email.',\n          )\n        } else {\n          throw err\n        }\n      }\n    },\n  })\n}\n"]}
+{"version":3,"file":"updateEmail.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/updateEmail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAU,MAAM,sBAAsB,CAAA;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gDAAgD,CAAA;AAEvF,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA;AAEhE,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,EAAE,cAAc,EAAE,GAAG,GAAG,CAAA;IAE9B,qEAAqE;IACrE,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAA;IAExC,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;YACzC,IAAI;YACJ,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;gBAChD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,mBAAmB,CAC/C,GAAG,EACH,IAAI,CAAC,WAAW,CAAC,GAAG,EACpB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CACpC,CAAA;gBAED,MAAM,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;oBACxD,OAAO;oBACP,IAAI;iBACL,CAAC,CAAA;YACJ,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;YACzC,IAAI;YACJ,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE;gBAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAA;gBAChC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,CAAA;gBAE7B,wEAAwE;gBACxE,mDAAmD;gBACnD,MAAM,MAAM,GAAG,SAAS,CAAA;gBAExB,IAAI,CAAC;oBACH,MAAM,GAAG,CAAC,cAAc,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;gBACrE,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,KAAK,YAAY,sBAAsB,EAAE,CAAC;wBAC5C,MAAM,IAAI,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;oBACpE,CAAC;oBAED,MAAM,KAAK,CAAA;gBACb,CAAC;YACH,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { InvalidRequestError, Server } from '@atproto/xrpc-server'\nimport { UserAlreadyExistsError } from '../../../../account-manager/helpers/account.js'\nimport { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { requestEmailUpdateAuth } from './requestEmailUpdate.js'\n\nexport default function (server: Server, ctx: AppContext) {\n  const { entrywayClient } = ctx\n\n  // @NOTE Ensure that both endpoints use the same authentication logic\n  const auth = requestEmailUpdateAuth(ctx)\n\n  if (entrywayClient) {\n    server.add(com.atproto.server.updateEmail, {\n      auth,\n      handler: async ({ auth, input: { body }, req }) => {\n        const { headers } = await ctx.entrywayAuthHeaders(\n          req,\n          auth.credentials.did,\n          com.atproto.server.updateEmail.$lxm,\n        )\n\n        await entrywayClient.xrpc(com.atproto.server.updateEmail, {\n          headers,\n          body,\n        })\n      },\n    })\n  } else {\n    server.add(com.atproto.server.updateEmail, {\n      auth,\n      handler: async ({ auth, input: { body } }) => {\n        const did = auth.credentials.did\n        const { token, email } = body\n\n        // @TODO get the locale somehow (either by adding a field in the request\n        // body, or by using the `Accept-Language` header).\n        const locale = undefined\n\n        try {\n          await ctx.accountManager.updateEmail(did, email, token, { locale })\n        } catch (cause) {\n          if (cause instanceof UserAlreadyExistsError) {\n            throw new InvalidRequestError(cause.message, undefined, { cause })\n          }\n\n          throw cause\n        }\n      },\n    })\n  }\n}\n"]}

package/dist/config/config.d.ts

@@ -1,5 +1,6 @@
-import { BrandingInput, HcaptchaConfig } from '@atproto/oauth-provider';
+import { BrandingInput as BrandingConfig, HcaptchaConfig } from '@atproto/oauth-provider';
 import { ServerEnvironment } from './env.js';
+export type { BrandingConfig };
 export declare const envToCfg: (env: ServerEnvironment) => ServerConfig;
 export type ServerConfig = {
     service: ServiceConfig;
@@ -20,6 +21,7 @@ export type ServerConfig = {
     crawlers: string[];
     fetch: FetchConfig;
     proxy: ProxyConfig;
+    branding: BrandingConfig;
     oauth: OAuthConfig;
     lexicon: LexiconResolverConfig;
 };
@@ -105,7 +107,7 @@ export type OAuthConfig = {
     issuer: string;
     provider?: {
         hcaptcha?: HcaptchaConfig;
-        branding: BrandingInput;
+        branding: BrandingConfig;
         trustedClients?: string[];
     };
 };
@@ -122,6 +124,7 @@ export type InvitesConfig = {
 export type EmailConfig = {
     smtpUrl: string;
     fromAddress: string;
+    disableConfirmationLink: boolean;
 };
 export type SubscriptionConfig = {
     maxBuffer: number;

package/dist/config/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAEvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAA;AAK5C,eAAO,MAAM,QAAQ,GAAI,KAAK,iBAAiB,KAAG,YAgWjD,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,aAAa,CAAA;IACtB,EAAE,EAAE,cAAc,CAAA;IAClB,UAAU,EAAE,gBAAgB,CAAA;IAC5B,SAAS,EAAE,iBAAiB,GAAG,mBAAmB,CAAA;IAClD,QAAQ,EAAE,cAAc,CAAA;IACxB,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAA;IAC/B,OAAO,EAAE,aAAa,CAAA;IACtB,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;IACzB,eAAe,EAAE,WAAW,GAAG,IAAI,CAAA;IACnC,YAAY,EAAE,kBAAkB,CAAA;IAChC,WAAW,EAAE,iBAAiB,GAAG,IAAI,CAAA;IACrC,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAA;IACnC,aAAa,EAAE,mBAAmB,GAAG,IAAI,CAAA;IACzC,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAAA;IAChC,UAAU,EAAE,gBAAgB,CAAA;IAC5B,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,KAAK,EAAE,WAAW,CAAA;IAClB,KAAK,EAAE,WAAW,CAAA;IAClB,KAAK,EAAE,WAAW,CAAA;IAClB,OAAO,EAAE,qBAAqB,CAAA;CAC/B,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,gBAAgB,EAAE,OAAO,CAAA;IACzB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,eAAe,EAAE,MAAM,CAAA;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,OAAO,EAAE,OAAO,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,MAAM,CAAA;IACtB,aAAa,EAAE,MAAM,CAAA;IACrB,wBAAwB,EAAE,OAAO,CAAA;CAClC,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,wBAAwB,EAAE,OAAO,CAAA;CAClC,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,EAAE,IAAI,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,WAAW,CAAC,EAAE;QACZ,WAAW,EAAE,MAAM,CAAA;QACnB,eAAe,EAAE,MAAM,CAAA;KACxB,CAAA;CACF,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,eAAe,EAAE,MAAM,CAAA;IACvB,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,oBAAoB,EAAE,MAAM,EAAE,CAAA;IAC9B,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAA;IAClC,uBAAuB,EAAE,OAAO,CAAA;CACjC,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,EAAE,MAAM,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,qBAAqB,EAAE,OAAO,CAAA;IAC9B,eAAe,EAAE,MAAM,CAAA;CACxB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,qBAAqB,EAAE,OAAO,CAAA;IAC9B,UAAU,EAAE,OAAO,CAAA;IACnB,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,CAAA;IACvB,UAAU,EAAE,MAAM,CAAA;IAElB;;;;;;OAMG;IACH,gBAAgB,EAAE,OAAO,CAAA;CAC1B,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE;QACT,QAAQ,CAAC,EAAE,cAAc,CAAA;QACzB,QAAQ,EAAE,aAAa,CAAA;QACvB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;KAC1B,CAAA;CACF,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,YAAY,CAAC,EAAE,OAAO,MAAM,IAAI,MAAM,EAAE,CAAA;CACzC,CAAA;AAED,MAAM,MAAM,aAAa,GACrB;IACE,QAAQ,EAAE,IAAI,CAAA;IACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,KAAK,EAAE,MAAM,CAAA;CACd,GACD;IACE,QAAQ,EAAE,KAAK,CAAA;CAChB,CAAA;AAEL,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,mBAAmB,EAAE,MAAM,CAAA;CAC5B,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,gBAAgB,GACxB;IACE,OAAO,EAAE,IAAI,CAAA;IACb,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;CACrB,GACD;IAAE,OAAO,EAAE,KAAK,CAAA;CAAE,CAAA;AAEtB,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,aAAa,IAAI,cAAc,EAC/B,cAAc,EACf,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAA;AAE5C,YAAY,EAAE,cAAc,EAAE,CAAA;AAK9B,eAAO,MAAM,QAAQ,GAAI,KAAK,iBAAiB,KAAG,YAqWjD,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,aAAa,CAAA;IACtB,EAAE,EAAE,cAAc,CAAA;IAClB,UAAU,EAAE,gBAAgB,CAAA;IAC5B,SAAS,EAAE,iBAAiB,GAAG,mBAAmB,CAAA;IAClD,QAAQ,EAAE,cAAc,CAAA;IACxB,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAA;IAC/B,OAAO,EAAE,aAAa,CAAA;IACtB,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;IACzB,eAAe,EAAE,WAAW,GAAG,IAAI,CAAA;IACnC,YAAY,EAAE,kBAAkB,CAAA;IAChC,WAAW,EAAE,iBAAiB,GAAG,IAAI,CAAA;IACrC,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAA;IACnC,aAAa,EAAE,mBAAmB,GAAG,IAAI,CAAA;IACzC,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAAA;IAChC,UAAU,EAAE,gBAAgB,CAAA;IAC5B,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,KAAK,EAAE,WAAW,CAAA;IAClB,KAAK,EAAE,WAAW,CAAA;IAClB,QAAQ,EAAE,cAAc,CAAA;IACxB,KAAK,EAAE,WAAW,CAAA;IAClB,OAAO,EAAE,qBAAqB,CAAA;CAC/B,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,gBAAgB,EAAE,OAAO,CAAA;IACzB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,eAAe,EAAE,MAAM,CAAA;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,OAAO,EAAE,OAAO,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,MAAM,CAAA;IACtB,aAAa,EAAE,MAAM,CAAA;IACrB,wBAAwB,EAAE,OAAO,CAAA;CAClC,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,wBAAwB,EAAE,OAAO,CAAA;CAClC,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,EAAE,IAAI,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,WAAW,CAAC,EAAE;QACZ,WAAW,EAAE,MAAM,CAAA;QACnB,eAAe,EAAE,MAAM,CAAA;KACxB,CAAA;CACF,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,eAAe,EAAE,MAAM,CAAA;IACvB,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,oBAAoB,EAAE,MAAM,EAAE,CAAA;IAC9B,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAA;IAClC,uBAAuB,EAAE,OAAO,CAAA;CACjC,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,EAAE,MAAM,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,qBAAqB,EAAE,OAAO,CAAA;IAC9B,eAAe,EAAE,MAAM,CAAA;CACxB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,qBAAqB,EAAE,OAAO,CAAA;IAC9B,UAAU,EAAE,OAAO,CAAA;IACnB,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,CAAA;IACvB,UAAU,EAAE,MAAM,CAAA;IAElB;;;;;;OAMG;IACH,gBAAgB,EAAE,OAAO,CAAA;CAC1B,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE;QACT,QAAQ,CAAC,EAAE,cAAc,CAAA;QACzB,QAAQ,EAAE,cAAc,CAAA;QACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;KAC1B,CAAA;CACF,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,YAAY,CAAC,EAAE,OAAO,MAAM,IAAI,MAAM,EAAE,CAAA;CACzC,CAAA;AAED,MAAM,MAAM,aAAa,GACrB;IACE,QAAQ,EAAE,IAAI,CAAA;IACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,KAAK,EAAE,MAAM,CAAA;CACd,GACD;IACE,QAAQ,EAAE,KAAK,CAAA;CAChB,CAAA;AAEL,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,uBAAuB,EAAE,OAAO,CAAA;CACjC,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,mBAAmB,EAAE,MAAM,CAAA;CAC5B,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,gBAAgB,GACxB;IACE,OAAO,EAAE,IAAI,CAAA;IACb,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;CACrB,GACD;IAAE,OAAO,EAAE,KAAK,CAAA;CAAE,CAAA;AAEtB,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA"}

package/dist/config/config.js

@@ -132,6 +132,7 @@ export const envToCfg = (env) => {
         emailCfg = {
             smtpUrl: env.emailSmtpUrl,
             fromAddress: env.emailFromAddress,
+            disableConfirmationLink: env.emailDisableConfirmationLink ?? false,
         };
     }
     let moderationEmailCfg;
@@ -145,6 +146,7 @@ export const envToCfg = (env) => {
         moderationEmailCfg = {
             smtpUrl: env.moderationEmailSmtpUrl,
             fromAddress: env.moderationEmailAddress,
+            disableConfirmationLink: false,
         };
     }
     const subscriptionCfg = {
@@ -209,6 +211,52 @@ export const envToCfg = (env) => {
             : 0,
         preferCompressed: env.proxyPreferCompressed ?? false,
     };
+    const brandingCfg = {
+        name: env.serviceName ?? `${hostname} PDS`,
+        logo: env.logoUrl,
+        colors: {
+            light: env.lightColor,
+            dark: env.darkColor,
+            contrastSaturation: env.contrastSaturation,
+            primary: env.primaryColor,
+            primaryContrast: env.primaryColorContrast,
+            primaryHue: env.primaryColorHue,
+            error: env.errorColor,
+            errorContrast: env.errorColorContrast,
+            errorHue: env.errorColorHue,
+            warning: env.warningColor,
+            warningContrast: env.warningColorContrast,
+            warningHue: env.warningColorHue,
+            info: env.infoColor,
+            infoContrast: env.infoColorContrast,
+            infoHue: env.infoColorHue,
+            success: env.successColor,
+            successContrast: env.successColorContrast,
+            successHue: env.successColorHue,
+        },
+        links: [
+            {
+                title: { en: 'Home', fr: 'Accueil' },
+                href: env.homeUrl,
+                rel: 'canonical', // Prevents login page from being indexed
+            },
+            {
+                title: { en: 'Terms of Service' },
+                href: env.termsOfServiceUrl,
+                rel: 'terms-of-service',
+            },
+            {
+                title: { en: 'Privacy Policy' },
+                href: env.privacyPolicyUrl,
+                rel: 'privacy-policy',
+            },
+            {
+                title: { en: 'Support' },
+                href: env.supportUrl,
+                rel: 'help',
+            },
+        ].filter((f) => f.href != null && f.href !== ''),
+    };
     const oauthCfg = entrywayCfg
         ? {
             issuer: entrywayCfg.url,
@@ -226,52 +274,7 @@ export const envToCfg = (env) => {
                         tokenSalt: env.hcaptchaTokenSalt,
                     }
                     : undefined,
-                branding: {
-                    name: env.serviceName ?? `${hostname} PDS`,
-                    logo: env.logoUrl,
-                    colors: {
-                        light: env.lightColor,
-                        dark: env.darkColor,
-                        contrastSaturation: env.contrastSaturation,
-                        primary: env.primaryColor,
-                        primaryContrast: env.primaryColorContrast,
-                        primaryHue: env.primaryColorHue,
-                        error: env.errorColor,
-                        errorContrast: env.errorColorContrast,
-                        errorHue: env.errorColorHue,
-                        warning: env.warningColor,
-                        warningContrast: env.warningColorContrast,
-                        warningHue: env.warningColorHue,
-                        info: env.infoColor,
-                        infoContrast: env.infoColorContrast,
-                        infoHue: env.infoColorHue,
-                        success: env.successColor,
-                        successContrast: env.successColorContrast,
-                        successHue: env.successColorHue,
-                    },
-                    links: [
-                        {
-                            title: { en: 'Home', fr: 'Accueil' },
-                            href: env.homeUrl,
-                            rel: 'canonical', // Prevents login page from being indexed
-                        },
-                        {
-                            title: { en: 'Terms of Service' },
-                            href: env.termsOfServiceUrl,
-                            rel: 'terms-of-service',
-                        },
-                        {
-                            title: { en: 'Privacy Policy' },
-                            href: env.privacyPolicyUrl,
-                            rel: 'privacy-policy',
-                        },
-                        {
-                            title: { en: 'Support' },
-                            href: env.supportUrl,
-                            rel: 'help',
-                        },
-                    ].filter((f) => f.href != null && f.href !== ''),
-                },
+                branding: brandingCfg,
                 trustedClients: env.trustedOAuthClients,
             },
         };
@@ -300,6 +303,7 @@ export const envToCfg = (env) => {
         fetch: fetchCfg,
         lexicon: lexiconCfg,
         proxy: proxyCfg,
+        branding: brandingCfg,
         oauth: oauthCfg,
     };
 };