@atproto/pds 0.4.33 → 0.4.35

package/src/account-manager/helpers/device-account.ts

@@ -0,0 +1,135 @@
+import {
+  Account,
+  DeviceAccountInfo,
+  DeviceId,
+  OAuthClientId,
+} from '@atproto/oauth-provider'
+import { Insertable, Selectable } from 'kysely'
+
+import { fromDateISO, fromJsonArray, toDateISO, toJsonArray } from '../../db'
+import { AccountDb } from '../db'
+import { DeviceAccount } from '../db/schema/device-account'
+import { ActorAccount, selectAccountQB } from './account'
+
+export type SelectableDeviceAccount = Pick<
+  Selectable<DeviceAccount>,
+  'authenticatedAt' | 'authorizedClients' | 'remember'
+>
+
+const selectAccountInfoQB = (db: AccountDb, deviceId: DeviceId) =>
+  selectAccountQB(db, { includeDeactivated: true })
+    // note: query planner should use "device_account_pk" index
+    .innerJoin('device_account', 'device_account.did', 'actor.did')
+    .innerJoin('device', 'device.id', 'device_account.deviceId')
+    .where('device.id', '=', deviceId)
+    .select([
+      'device_account.authenticatedAt',
+      'device_account.remember',
+      'device_account.authorizedClients',
+    ])
+
+export type InsertableField = {
+  authenticatedAt: Date
+  authorizedClients: OAuthClientId[]
+  remember: boolean
+}
+
+function toInsertable<V extends Partial<InsertableField>>(
+  values: V,
+): Pick<Insertable<DeviceAccount>, keyof V & keyof Insertable<DeviceAccount>>
+function toInsertable(
+  values: Partial<InsertableField>,
+): Partial<Insertable<DeviceAccount>> {
+  const row: Partial<Insertable<DeviceAccount>> = {}
+  if (values.authenticatedAt) {
+    row.authenticatedAt = toDateISO(values.authenticatedAt)
+  }
+  if (values.remember !== undefined) {
+    row.remember = values.remember === true ? 1 : 0
+  }
+  if (values.authorizedClients) {
+    row.authorizedClients = toJsonArray(values.authorizedClients)
+  }
+  return row
+}
+
+export function toDeviceAccountInfo(
+  row: SelectableDeviceAccount,
+): DeviceAccountInfo {
+  return {
+    remembered: row.remember === 1,
+    authenticatedAt: fromDateISO(row.authenticatedAt),
+    authorizedClients: fromJsonArray<OAuthClientId>(row.authorizedClients),
+  }
+}
+
+export function toAccount(
+  row: Selectable<ActorAccount>,
+  audience: string,
+): Account {
+  return {
+    sub: row.did,
+    aud: audience,
+    email: row.email || undefined,
+    email_verified: row.email ? row.emailConfirmedAt != null : undefined,
+    preferred_username: row.handle || undefined,
+  }
+}
+
+export const readQB = (db: AccountDb, deviceId: DeviceId, did: string) =>
+  db.db
+    .selectFrom('device_account')
+    .where('did', '=', did)
+    .where('deviceId', '=', deviceId)
+    .select(['remember', 'authorizedClients', 'authenticatedAt'])
+
+export const updateQB = (
+  db: AccountDb,
+  deviceId: DeviceId,
+  did: string,
+  entry: {
+    authenticatedAt?: Date
+    authorizedClients?: OAuthClientId[]
+    remember?: boolean
+  },
+) =>
+  db.db
+    .updateTable('device_account')
+    .set(toInsertable(entry))
+    .where('did', '=', did)
+    .where('deviceId', '=', deviceId)
+
+export const createOrUpdateQB = (
+  db: AccountDb,
+  deviceId: DeviceId,
+  did: string,
+  remember: boolean,
+) => {
+  const { authorizedClients, ...values } = toInsertable({
+    remember,
+    authenticatedAt: new Date(),
+    authorizedClients: [],
+  })
+
+  return db.db
+    .insertInto('device_account')
+    .values({ did, deviceId, authorizedClients, ...values })
+    .onConflict((oc) => oc.columns(['deviceId', 'did']).doUpdateSet(values))
+}
+
+export const getAccountInfoQB = (
+  db: AccountDb,
+  deviceId: DeviceId,
+  did: string,
+) => {
+  return selectAccountInfoQB(db, deviceId).where('actor.did', '=', did)
+}
+
+export const listRememberedQB = (db: AccountDb, deviceId: DeviceId) =>
+  selectAccountInfoQB(db, deviceId).where('device_account.remember', '=', 1)
+
+export const removeQB = (db: AccountDb, deviceId: DeviceId, did: string) =>
+  db.db
+    .deleteFrom('device_account')
+    .where('deviceId', '=', deviceId)
+    .where('did', '=', did)

package/src/account-manager/helpers/device.ts

@@ -0,0 +1,45 @@
+import { DeviceId, DeviceData } from '@atproto/oauth-provider'
+import { AccountDb, Device } from '../db'
+import { fromDateISO, toDateISO } from '../../db'
+import { Selectable } from 'kysely'
+
+export const rowToDeviceData = (row: Selectable<Device>): DeviceData => ({
+  sessionId: row.sessionId,
+  userAgent: row.userAgent,
+  ipAddress: row.ipAddress,
+  lastSeenAt: fromDateISO(row.lastSeenAt),
+})
+
+export const createQB = (
+  db: AccountDb,
+  deviceId: DeviceId,
+  { sessionId, userAgent, ipAddress, lastSeenAt }: DeviceData,
+) =>
+  db.db.insertInto('device').values({
+    id: deviceId,
+    sessionId,
+    userAgent,
+    ipAddress,
+    lastSeenAt: toDateISO(lastSeenAt),
+  })
+
+export const readQB = (db: AccountDb, deviceId: DeviceId) =>
+  db.db.selectFrom('device').where('id', '=', deviceId).selectAll()
+
+export const updateQB = (
+  db: AccountDb,
+  deviceId: DeviceId,
+  { sessionId, userAgent, ipAddress, lastSeenAt }: Partial<DeviceData>,
+) =>
+  db.db
+    .updateTable('device')
+    .if(sessionId != null, (qb) => qb.set({ sessionId }))
+    .if(userAgent != null, (qb) => qb.set({ userAgent }))
+    .if(ipAddress != null, (qb) => qb.set({ ipAddress }))
+    .if(lastSeenAt != null, (qb) =>
+      qb.set({ lastSeenAt: toDateISO(lastSeenAt!) }),
+    )
+    .where('id', '=', deviceId)
+
+export const removeQB = (db: AccountDb, deviceId: DeviceId) =>
+  db.db.deleteFrom('device').where('id', '=', deviceId)

package/src/account-manager/helpers/token.ts

@@ -0,0 +1,185 @@
+import {
+  Code,
+  NewTokenData,
+  OAuthAuthorizationDetail,
+  RefreshToken,
+  TokenData,
+  TokenId,
+  TokenInfo,
+} from '@atproto/oauth-provider'
+import { Selectable } from 'kysely'
+import {
+  fromDateISO,
+  fromJsonArray,
+  fromJsonObject,
+  toDateISO,
+  toJsonArray,
+  toJsonObject,
+} from '../../db'
+import { AccountDb, Token } from '../db'
+import { ActorAccount, selectAccountQB } from './account'
+import {
+  SelectableDeviceAccount,
+  toAccount,
+  toDeviceAccountInfo,
+} from './device-account'
+
+type LeftJoined<T> = { [K in keyof T]: null | T[K] }
+
+export type ActorAccountToken = Selectable<ActorAccount> &
+  Selectable<Omit<Token, 'id' | 'did'>> &
+  LeftJoined<SelectableDeviceAccount>
+
+export const toTokenInfo = (
+  row: ActorAccountToken,
+  audience: string,
+): TokenInfo => ({
+  id: row.tokenId,
+  data: {
+    createdAt: fromDateISO(row.createdAt),
+    expiresAt: fromDateISO(row.expiresAt),
+    updatedAt: fromDateISO(row.updatedAt),
+    clientId: row.clientId,
+    clientAuth: fromJsonObject(row.clientAuth),
+    deviceId: row.deviceId,
+    sub: row.did,
+    parameters: fromJsonObject(row.parameters),
+    details: row.details
+      ? fromJsonArray<OAuthAuthorizationDetail>(row.details)
+      : null,
+    code: row.code,
+  },
+  account: toAccount(row, audience),
+  info:
+    row.authenticatedAt != null &&
+    row.authorizedClients != null &&
+    row.remember != null
+      ? toDeviceAccountInfo(row as SelectableDeviceAccount)
+      : undefined,
+  currentRefreshToken: row.currentRefreshToken,
+})
+
+const selectTokenInfoQB = (db: AccountDb) =>
+  selectAccountQB(db, { includeDeactivated: true })
+    // uses "token_did_idx" index (though unlikely in practice)
+    .innerJoin('token', 'token.did', 'actor.did')
+    .leftJoin('device_account', (join) =>
+      join
+        // uses "device_account_pk" index
+        .on('device_account.did', '=', 'token.did')
+        // @ts-expect-error "deviceId" is nullable in token
+        .on('device_account.deviceId', '=', 'token.deviceId'),
+    )
+    .select([
+      'token.tokenId',
+      'token.createdAt',
+      'token.updatedAt',
+      'token.expiresAt',
+      'token.clientId',
+      'token.clientAuth',
+      'token.deviceId',
+      'token.did',
+      'token.parameters',
+      'token.details',
+      'token.code',
+      'token.currentRefreshToken',
+      'device_account.authenticatedAt',
+      'device_account.authorizedClients',
+      'device_account.remember',
+    ])
+
+export const createQB = (
+  db: AccountDb,
+  tokenId: TokenId,
+  data: TokenData,
+  refreshToken?: RefreshToken,
+) =>
+  db.db.insertInto('token').values({
+    tokenId,
+    createdAt: toDateISO(data.createdAt),
+    expiresAt: toDateISO(data.expiresAt),
+    updatedAt: toDateISO(data.updatedAt),
+    clientId: data.clientId,
+    clientAuth: toJsonObject(data.clientAuth),
+    deviceId: data.deviceId,
+    did: data.sub,
+    parameters: toJsonObject(data.parameters),
+    details: data.details ? toJsonArray(data.details) : null,
+    code: data.code,
+    currentRefreshToken: refreshToken || null,
+  })
+
+export const forRotateQB = (db: AccountDb, id: TokenId) =>
+  db.db
+    .selectFrom('token')
+    .where('tokenId', '=', id)
+    .where('currentRefreshToken', 'is not', null)
+    .select(['id', 'currentRefreshToken'])
+
+export const findByQB = (
+  db: AccountDb,
+  search: {
+    id?: number
+    code?: Code
+    tokenId?: TokenId
+    currentRefreshToken?: RefreshToken
+  },
+) => {
+  if (
+    search.id === undefined &&
+    search.code === undefined &&
+    search.tokenId === undefined &&
+    search.currentRefreshToken === undefined
+  ) {
+    // Prevent accidental scan
+    throw new TypeError('At least one search parameter is required')
+  }
+
+  return selectTokenInfoQB(db)
+    .if(search.id !== undefined, (qb) =>
+      // uses primary key index
+      qb.where('token.id', '=', search.id!),
+    )
+    .if(search.code !== undefined, (qb) =>
+      // uses "token_code_idx" partial index (hence the null check)
+      qb
+        .where('token.code', '=', search.code!)
+        .where('token.code', 'is not', null),
+    )
+    .if(search.tokenId !== undefined, (qb) =>
+      // uses "token_token_id_idx"
+      qb.where('token.tokenId', '=', search.tokenId!),
+    )
+    .if(search.currentRefreshToken !== undefined, (qb) =>
+      // uses "token_refresh_token_unique_idx"
+      qb.where('token.currentRefreshToken', '=', search.currentRefreshToken!),
+    )
+}
+
+export const removeByDidQB = (db: AccountDb, did: string) =>
+  // uses "token_did_idx" index
+  db.db.deleteFrom('token').where('did', '=', did)
+
+export const rotateQB = (
+  db: AccountDb,
+  id: number,
+  newTokenId: TokenId,
+  newRefreshToken: RefreshToken,
+  newData: NewTokenData,
+) =>
+  db.db
+    .updateTable('token')
+    .set({
+      tokenId: newTokenId,
+      currentRefreshToken: newRefreshToken,
+
+      expiresAt: toDateISO(newData.expiresAt),
+      updatedAt: toDateISO(newData.updatedAt),
+      clientAuth: toJsonObject(newData.clientAuth),
+    })
+    // uses primary key index
+    .where('id', '=', id)
+
+export const removeQB = (db: AccountDb, tokenId: TokenId) =>
+  // uses "used_refresh_token_fk" to cascade delete
+  db.db.deleteFrom('token').where('tokenId', '=', tokenId)

package/src/account-manager/helpers/used-refresh-token.ts

@@ -0,0 +1,30 @@
+import { RefreshToken } from '@atproto/oauth-provider'
+import { AccountDb } from '../db'
+
+/**
+ * Note that the used refresh tokens will be removed once the token is revoked.
+ * This is done through the foreign key constraint in the database.
+ */
+export const insertQB = (
+  db: AccountDb,
+  tokenId: number,
+  refreshToken: RefreshToken,
+) =>
+  db.db
+    .insertInto('used_refresh_token')
+    .values({ tokenId, refreshToken })
+    .onConflict((oc) => oc.doNothing())
+
+export const findByTokenQB = (db: AccountDb, refreshToken: RefreshToken) =>
+  db.db
+    .selectFrom('used_refresh_token')
+    // uses primary key index
+    .where('refreshToken', '=', refreshToken)
+    .select('tokenId')
+
+export const countQB = (db: AccountDb, refreshToken: RefreshToken) =>
+  db.db
+    .selectFrom('used_refresh_token')
+    // uses primary key index
+    .where('refreshToken', '=', refreshToken)
+    .select((qb) => qb.fn.count<number>('refreshToken').as('count'))