@atproto/pds 0.5.0 → 0.5.2

package/tests/account-manager.test.ts

@@ -18,7 +18,7 @@ describe('account manager', () => {
       // For debugging:
       // headless: false,
       // devtools: true,
-      // slowMo: 150,
+      // slowMo: 25,
     })
 
     network = await TestNetworkNoAppView.create({
@@ -34,6 +34,10 @@ describe('account manager', () => {
     })
   })
 
+  afterEach(async () => {
+    await network.processAll()
+  })
+
   afterAll(async () => {
     await network?.close()
     await browser?.close()
@@ -44,7 +48,7 @@ describe('account manager', () => {
 
     await page.goto(new URL('/account', network.pds.url))
 
-    await page.assertTitle(`S'identifier`)
+    await page.assertTitle(`Se connecter`)
 
     await page.clickOnText('Créer un nouveau compte')
 
@@ -55,12 +59,14 @@ describe('account manager', () => {
     await page.typeInInput('email', 'bob@test.com')
     await page.typeInInput('password', 'bob-pass')
 
-    await page.clickOnText("S'inscrire")
+    await page.clickOnText('Inscription')
 
-    await page.assertTitle(`Compte utilisateur`)
+    await page.waitForNetworkIdle()
 
     await page.ensureTextVisibility('bob.test', 'span')
     await page.ensureTextVisibility('Votre compte Atmosphère est hébergé chez')
+
+    await page.assertTitle('Mon compte Atmosphère')
   })
 
   it('allows switching accounts', async () => {
@@ -68,7 +74,7 @@ describe('account manager', () => {
 
     await page.goto(new URL('/account', network.pds.url))
 
-    await page.assertTitle(`Compte utilisateur`)
+    await page.assertTitle('Mon compte Atmosphère')
 
     await page.clickOnAriaLabel(`Sélecteur de compte`)
     await page.clickOnText('Sélectionner un autre compte')
@@ -93,18 +99,13 @@ describe('account manager', () => {
 
     await page.goto(new URL('/account', network.pds.url))
 
-    await page.assertTitle(`Compte utilisateur`)
+    await page.assertTitle('Mon compte Atmosphère')
 
     await page.ensureTextVisibility('bob.test', 'span')
 
-    await page.ensureTextVisibility('alice.test', 'span').then(
-      () => {
-        throw new Error('Should not be visible')
-      },
-      (err) => {
-        expect(err).toBeInstanceOf(Error)
-      },
-    )
+    await expect(async () => {
+      await page.ensureTextVisibility('alice.test', 'span', 500)
+    }).rejects.toThrow('Waiting for selector')
   })
 
   it('allows changing the password', async () => {
@@ -112,9 +113,11 @@ describe('account manager', () => {
 
     await page.goto(new URL('/account', network.pds.url))
 
-    await page.assertTitle(`Compte utilisateur`)
+    await page.assertTitle('Mon compte Atmosphère')
 
-    await page.clickOnText('Mot de passe', 'a')
+    await page.clickOnText('Compte utilisateur', 'a')
+
+    await page.clickOnText('Mot de passe')
 
     using sendResetPasswordMock = jest
       .spyOn(network.pds.ctx.mailer, 'sendResetPassword')
@@ -122,7 +125,7 @@ describe('account manager', () => {
         // noop
       })
 
-    await page.clickOnText('Envoyer le code')
+    await page.clickOnText('Envoyer le code de vérification')
 
     await page.waitForNetworkIdle()
 
@@ -137,20 +140,23 @@ describe('account manager', () => {
     await page.typeInInput('code', params.token)
     await page.typeInInput('password', 'bob-new-pass')
 
-    await page.clickOnText('Soumettre')
+    await page.clickOnText('Valider')
 
-    await page.ensureTextVisibility(
-      'Réinitialisation du mot de passe réussie',
-      'div',
-    )
+    await page.ensureNotification('Réinitialisation du mot de passe réussie')
   })
 
-  it('allows validating the email address', async () => {
+  it('allows verifying the email address', async () => {
     await using page = await PageHelper.from(browser, { languages })
 
     await page.goto(new URL('/account', network.pds.url))
 
-    await page.clickOnText('Vérifier maintenant', 'button')
+    await page.assertTitle('Mon compte Atmosphère')
+
+    await page.clickOnText('Compte utilisateur', 'a')
+
+    await page.ensureTextVisibility('Votre adresse email doit être vérifiée.')
+
+    await page.clickOnText('Vérifier')
 
     using sendConfirmEmailMock = jest
       .spyOn(network.pds.ctx.mailer, 'sendConfirmEmail')
@@ -158,7 +164,7 @@ describe('account manager', () => {
         // noop
       })
 
-    await page.clickOnText('Envoyer le code', 'button')
+    await page.clickOnText('Envoyer le code de vérification', 'button')
 
     await page.waitForNetworkIdle()
 
@@ -171,9 +177,31 @@ describe('account manager', () => {
     })
 
     await page.typeInInput('code', params.token)
-    await page.clickOnText('Soumettre')
+    await page.clickOnText('Valider')
+
+    await page.ensureNotification('Adresse email vérifiée')
+  })
+
+  it('allows changing the username', async () => {
+    await using page = await PageHelper.from(browser, { languages })
+
+    await page.goto(new URL('/account', network.pds.url))
+
+    await page.assertTitle('Mon compte Atmosphère')
 
-    await page.ensureTextVisibility('Adresse email vérifiée', 'div')
+    await page.clickOnText('Compte utilisateur', 'a')
+
+    await page.clickOnText("Nom d'utilisateur")
+
+    await page.clickOnText("Utiliser un nom d'utilisateur par défaut")
+
+    await page.typeInInput('handle', 'bob-renamed')
+
+    await page.clickOnText('Valider')
+
+    await page.waitForNetworkIdle()
+
+    await page.ensureTextVisibility('bob-renamed.test', 'span')
   })
 
   it('allows changing the email address', async () => {
@@ -181,7 +209,11 @@ describe('account manager', () => {
 
     await page.goto(new URL('/account', network.pds.url))
 
-    await page.clickOnText('Email', 'a')
+    await page.assertTitle('Mon compte Atmosphère')
+
+    await page.clickOnText('Compte utilisateur', 'a')
+
+    await page.clickOnText('Adresse email')
 
     using sendUpdateEmailMock = jest
       .spyOn(network.pds.ctx.mailer, 'sendUpdateEmail')
@@ -189,13 +221,11 @@ describe('account manager', () => {
         // noop
       })
 
-    using sendConfirmEmailMock = jest
-      .spyOn(network.pds.ctx.mailer, 'sendConfirmEmail')
-      .mockImplementation(async () => {
-        // noop
-      })
-
-    await page.clickOnText('Envoyer le code', 'button')
+    const emailInput = await page.typeInInput(
+      'email',
+      'bob-new-email@example.com',
+    )
+    emailInput.press('Enter')
 
     await page.waitForNetworkIdle()
 
@@ -207,26 +237,69 @@ describe('account manager', () => {
       token: expect.any(String),
     })
 
-    await page.typeInInput('code', updateParams.token)
-    await page.typeInInput('email', 'bob-new-email@example.com')
-    await page.clickOnText('Soumettre')
+    const codeInput = await page.typeInInput('code', updateParams.token)
+    codeInput.press('Enter')
+
+    await page.ensureNotification("Modification de l'adresse email réussie")
 
-    await page.ensureTextVisibility(
-      "Modification de l'adresse email réussie",
-      'div',
+    // The email needs to be verified again
+    await page.ensureTextVisibility('Votre adresse email doit être vérifiée.')
+  })
+
+  it('allows signing out & signing back in', async () => {
+    await using page = await PageHelper.from(browser, { languages })
+
+    await page.goto(new URL('/account', network.pds.url))
+
+    await page.assertTitle('Mon compte Atmosphère')
+
+    await page.clickOnAriaLabel(`Sélecteur de compte`)
+    await page.clickOnText('Se déconnecter')
+
+    await page.assertTitle(`Se connecter`)
+    await page.clickOnText('Se connecter')
+
+    await page.clickOnText('Se souvenir de ce compte sur cet appareil', 'label')
+    await page.typeInInput('username', 'bob-new-email@example.com')
+    const input = await page.typeInInput('password', 'bob-new-pass')
+
+    input.press('Enter')
+
+    await page.ensureTextVisibility('bob-renamed.test', 'span')
+  })
+
+  it('does not ask for a token when changing a non-verified email', async () => {
+    await using page = await PageHelper.from(browser, { languages })
+
+    await page.goto(new URL('/account', network.pds.url))
+
+    await page.assertTitle('Mon compte Atmosphère')
+
+    await page.clickOnText('Compte utilisateur', 'a')
+
+    await page.clickOnText('Adresse email')
+
+    using sendUpdateEmailMock = jest
+      .spyOn(network.pds.ctx.mailer, 'sendUpdateEmail')
+      .mockImplementation(async () => {
+        // noop
+      })
+
+    const emailInput = await page.typeInInput(
+      'email',
+      'bob-new-email@example.com',
     )
+    emailInput.press('Enter')
 
-    expect(sendConfirmEmailMock).toHaveBeenCalledTimes(1)
+    await page.waitForNetworkIdle()
 
-    const [confirmParams] = sendConfirmEmailMock.mock.lastCall!
-    expect(confirmParams).toEqual({
-      locale: 'fr',
-      token: expect.any(String),
-    })
+    expect(sendUpdateEmailMock).not.toHaveBeenCalled()
+
+    await page.clickOnText('Plus tard')
 
-    await page.typeInInput('code', confirmParams.token)
-    await page.clickOnText('Soumettre')
+    await page.ensureNotification("Modification de l'adresse email réussie")
 
-    await page.ensureTextVisibility('Adresse email vérifiée', 'div')
+    // The email needs to be verified again
+    await page.ensureTextVisibility('Votre adresse email doit être vérifiée.')
   })
 })

package/tests/app-passwords.test.ts

@@ -115,7 +115,7 @@ describe('app_passwords', () => {
   it('restricts service auth token methods for non-privileged access tokens', async () => {
     const attemptCaseSensitive = appAgent.api.com.atproto.server.getServiceAuth(
       {
-        aud: 'did:example:test',
+        aud: network.pds.ctx.cfg.service.did,
         lxm: 'com.atproto.server.createAccount',
       },
     )
@@ -124,7 +124,7 @@ describe('app_passwords', () => {
     )
     const attemptCaseInsensitive =
       appAgent.api.com.atproto.server.getServiceAuth({
-        aud: 'did:example:test',
+        aud: network.pds.ctx.cfg.service.did,
         lxm: 'com.atproto.server.createaccount',
       })
     await expect(attemptCaseInsensitive).rejects.toThrow(
@@ -134,7 +134,7 @@ describe('app_passwords', () => {
 
   it('allows privileged service auth token scopes for privileged access tokens', async () => {
     await priviAgent.api.com.atproto.server.getServiceAuth({
-      aud: 'did:example:test',
+      aud: network.pds.ctx.cfg.service.did,
       lxm: 'com.atproto.server.createAccount',
     })
   })
@@ -165,7 +165,7 @@ describe('app_passwords', () => {
 
     // allows privileged app passwords or higher
     const priviAttempt = appAgent.api.com.atproto.server.getServiceAuth({
-      aud: 'did:example:test',
+      aud: network.pds.ctx.cfg.service.did,
       lxm: 'com.atproto.server.createAccount',
     })
     await expect(priviAttempt).rejects.toThrow(
@@ -211,7 +211,7 @@ describe('app_passwords', () => {
 
     // allows privileged app passwords or higher
     await priviAgent.api.com.atproto.server.getServiceAuth({
-      aud: 'did:example:test',
+      aud: network.pds.ctx.cfg.service.did,
     })
 
     // allows only full access auth

package/tests/get-service-auth.test.ts

@@ -0,0 +1,81 @@
+import * as jose from 'jose'
+import { AtpAgent } from '@atproto/api'
+import { TestNetworkNoAppView } from '@atproto/dev-env'
+
+describe('com.atproto.server.getServiceAuth', () => {
+  let network: TestNetworkNoAppView
+  let agent: AtpAgent
+  let aliceDid: string
+  let pdsDid: string
+
+  beforeAll(async () => {
+    network = await TestNetworkNoAppView.create({
+      dbPostgresSchema: 'get_service_auth',
+    })
+    pdsDid = network.pds.ctx.cfg.service.did
+    agent = network.pds.getAgent()
+    const session = await agent.createAccount({
+      handle: 'alice.test',
+      email: 'alice@test.com',
+      password: 'alice-pass',
+    })
+    aliceDid = session.data.did
+  })
+
+  afterAll(async () => {
+    await network.close()
+  })
+
+  it('issues a token whose aud matches a bare-DID input', async () => {
+    const res = await agent.api.com.atproto.server.getServiceAuth({
+      aud: pdsDid,
+      lxm: 'com.atproto.server.describeServer',
+    })
+    const decoded = jose.decodeJwt(res.data.token)
+    expect(decoded.aud).toBe(pdsDid)
+    expect(decoded.iss).toBe(aliceDid)
+    expect(decoded.lxm).toBe('com.atproto.server.describeServer')
+  })
+
+  it('issues a token whose aud matches a combined did#serviceId input', async () => {
+    const aud = `${pdsDid}#atproto_pds`
+    const res = await agent.api.com.atproto.server.getServiceAuth({
+      aud,
+      lxm: 'com.atproto.server.describeServer',
+    })
+    const decoded = jose.decodeJwt(res.data.token)
+    expect(decoded.aud).toBe(aud)
+    expect(decoded.iss).toBe(aliceDid)
+    expect(decoded.lxm).toBe('com.atproto.server.describeServer')
+  })
+
+  it('rejects malformed aud with InvalidRequest', async () => {
+    const attempt = agent.api.com.atproto.server.getServiceAuth({
+      aud: 'not-a-did',
+      lxm: 'com.atproto.server.describeServer',
+    })
+    await expect(attempt).rejects.toThrow(
+      /aud must be a valid atproto DID or did#serviceId reference/,
+    )
+  })
+
+  it('rejects an aud with a non-atproto DID method', async () => {
+    const attempt = agent.api.com.atproto.server.getServiceAuth({
+      aud: 'did:foo:bar',
+      lxm: 'com.atproto.server.describeServer',
+    })
+    await expect(attempt).rejects.toThrow(
+      /aud must be a valid atproto DID or did#serviceId reference/,
+    )
+  })
+
+  it('rejects an aud with empty fragment', async () => {
+    const attempt = agent.api.com.atproto.server.getServiceAuth({
+      aud: `${pdsDid}#`,
+      lxm: 'com.atproto.server.describeServer',
+    })
+    await expect(attempt).rejects.toThrow(
+      /aud must be a valid atproto DID or did#serviceId reference/,
+    )
+  })
+})

package/tests/oauth.test.ts

@@ -25,7 +25,7 @@ describe('oauth', () => {
       // For debugging:
       // headless: false,
       // devtools: true,
-      // slowMo: 250,
+      // slowMo: 25,
     })
 
     network = await TestNetworkNoAppView.create({
@@ -71,7 +71,7 @@ describe('oauth', () => {
 
     await page.navigationClick(`Sign up with ${new URL(network.pds.url).host}`)
 
-    await page.assertTitle("S'inscrire")
+    await page.assertTitle('Inscription')
 
     await page.typeInInput('handle', 'bob')
 
@@ -80,10 +80,10 @@ describe('oauth', () => {
     await page.typeInInput('email', 'bob@test.com')
     await page.typeInInput('password', 'bob-pass')
 
-    await page.clickOnText("S'inscrire")
+    await page.clickOnText('Inscription')
 
     await page.ensureTextVisibility(
-      `L'application demande un contrôle total sur votre identité, ce qui signifie qu'elle pourrait casser de façon permanente, ou même usurper, votre compte. N'authorisez l'accès qu'aux applications auxquelles vous faites vraiment confiance.`,
+      `L'application demande un contrôle total sur votre identité, ce qui signifie qu'elle pourrait casser de façon permanente, ou même usurper, votre compte. N'autorisez l'accès qu'aux applications auxquelles vous faites vraiment confiance.`,
     )
 
     // Make sure the new account is propagated to the PLC directory, allowing
@@ -112,7 +112,7 @@ describe('oauth', () => {
 
     await page.navigationClick(`Login with ${new URL(network.pds.url).host}`)
 
-    await page.assertTitle("S'identifier")
+    await page.assertTitle('Se connecter')
 
     // Cancel the OAuth flow:
     await page.navigationClick('Annuler')

package/tests/proxied/proxy-header.test.ts

@@ -77,6 +77,7 @@ describe('proxy header', () => {
     ).resolves.toEqual({
       did: proxyServer.did,
       url: proxyServer.url,
+      serviceId: 'atproto_test',
     })
   })
 

package/tests/proxied/proxy-oauth-aud.test.ts

@@ -0,0 +1,175 @@
+import { once } from 'node:events'
+import http from 'node:http'
+import { AddressInfo } from 'node:net'
+import * as plc from '@did-plc/lib'
+import express from 'express'
+import { Keypair } from '@atproto/crypto'
+import { SeedClient, TestNetworkNoAppView, usersSeed } from '@atproto/dev-env'
+import { ScopePermissions } from '@atproto/oauth-scopes'
+import { DidString } from '@atproto/syntax'
+import { AppContext } from '../../src/context.js'
+import { proxyHandler } from '../../src/pipethrough.js'
+
+// Regression test for the OAuth service-proxying audience fix.
+//
+// Before the fix, proxyHandler passed a bare DID as `aud` to the rpc scope
+// check. An OAuth caller granted `rpc:<lxm>?aud=<did>#<serviceId>` (the
+// canonical scope shape used in atproto OAuth) had no way to match, so
+// proxied calls failed at the scope check. The fix combines the proxied
+// service id into the scope-check audience as `<did>#<serviceId>`.
+//
+// We use a real PDS AppContext (so every field is real-typed). Only the
+// `authVerifier.authorization` method is replaced, with a thin stub that
+// drives the OAuth path off an `x-test-scope` request header — letting us
+// exercise the rpc scope check without minting a real OAuth token. A
+// separate express app mounts a fresh proxyHandler against the real ctx
+// and forwards to a real upstream ProxyServer.
+
+describe('proxy oauth audience', () => {
+  let network: TestNetworkNoAppView
+  let sc: SeedClient
+  let alice: string
+  let upstream: ProxyServer
+  let server: http.Server
+  let serverUrl: string
+
+  beforeAll(async () => {
+    network = await TestNetworkNoAppView.create({
+      dbPostgresSchema: 'proxy_oauth_aud',
+    })
+    sc = network.getSeedClient()
+    await usersSeed(sc)
+    alice = sc.dids.alice
+    upstream = await ProxyServer.create(
+      network.pds.ctx.plcClient,
+      network.pds.ctx.plcRotationKey,
+      'atproto_test',
+    )
+
+    // Replace only the `authorization` method on the real AuthVerifier so
+    // every other ctx field stays real and real-typed. The override's
+    // signature is constrained by AuthVerifier['authorization']: an OAuth
+    // shape change in the real verifier breaks the body of this stub at
+    // compile time.
+    const stubAuthorization: typeof network.pds.ctx.authVerifier.authorization =
+      ({ authorize }) => {
+        return async (ctx) => {
+          const scopeHeader = ctx.req.headers['x-test-scope'] as
+            | string
+            | undefined
+          const permissions = new ScopePermissions(
+            scopeHeader?.split(' ') ?? [],
+          )
+          await authorize(permissions, ctx)
+          return {
+            credentials: {
+              type: 'oauth',
+              did: alice as DidString,
+              permissions,
+            },
+          }
+        }
+      }
+    network.pds.ctx.authVerifier.authorization = stubAuthorization
+
+    const app = express()
+    // dev-env exports AppContext from its built dist/, while we import
+    // proxyHandler from src/. Cast at this boundary to bridge the two
+    // identical shapes; downstream behavior is real.
+    app.all('/xrpc/*', proxyHandler(network.pds.ctx as unknown as AppContext))
+    app.use(
+      (
+        err: Error & { status?: number; statusCode?: number },
+        _req: express.Request,
+        res: express.Response,
+        _next: express.NextFunction,
+      ) => {
+        if (res.headersSent) return
+        res.status(err.status ?? err.statusCode ?? 500).end()
+      },
+    )
+    server = app.listen(0)
+    await once(server, 'listening')
+    serverUrl = `http://localhost:${(server.address() as AddressInfo).port}`
+  })
+
+  afterAll(async () => {
+    await new Promise<void>((resolve) => server.close(() => resolve()))
+    await upstream.close()
+    await network.close()
+  })
+
+  it('matches an OAuth rpc scope granted with combined did#serviceId aud', async () => {
+    // Pre-fix this would have rejected because the scope check received
+    // bare-DID aud and never matched the combined-form scope. A 200 here
+    // implies the scope check ran with combined-form aud.
+    const res = await fetch(`${serverUrl}/xrpc/app.bsky.feed.getFeed`, {
+      headers: {
+        'atproto-proxy': `${upstream.did}#atproto_test`,
+        'x-test-scope': `rpc:app.bsky.feed.getFeed?aud=${encodeURIComponent(`${upstream.did}#atproto_test`)}`,
+      },
+    })
+    expect(res.status).toBe(200)
+  })
+
+  it('rejects an OAuth rpc scope granted for a different service id', async () => {
+    // Same DID, different service id — both forms parse as valid scope
+    // audiences, but the runtime aud (`upstream.did#atproto_test`) doesn't
+    // match the granted aud (`upstream.did#atproto_other`).
+    const res = await fetch(`${serverUrl}/xrpc/app.bsky.feed.getFeed`, {
+      headers: {
+        'atproto-proxy': `${upstream.did}#atproto_test`,
+        'x-test-scope': `rpc:app.bsky.feed.getFeed?aud=${encodeURIComponent(`${upstream.did}#atproto_other`)}`,
+      },
+    })
+    expect([401, 403]).toContain(res.status)
+  })
+})
+
+class ProxyServer {
+  constructor(
+    public server: http.Server,
+    public url: string,
+    public did: string,
+  ) {}
+
+  static async create(
+    plcClient: plc.Client,
+    keypair: Keypair,
+    serviceId: string,
+  ): Promise<ProxyServer> {
+    const app = express()
+    app.all('*', (_req, res) => res.sendStatus(200))
+
+    const server = app.listen(0)
+    await once(server, 'listening')
+
+    const { port } = server.address() as AddressInfo
+    const url = `http://localhost:${port}`
+    const plcOp = await plc.signOperation(
+      {
+        type: 'plc_operation',
+        rotationKeys: [keypair.did()],
+        alsoKnownAs: [],
+        verificationMethods: {},
+        services: {
+          [serviceId]: {
+            type: 'TestAtprotoService',
+            endpoint: url,
+          },
+        },
+        prev: null,
+      },
+      keypair,
+    )
+    const did = await plc.didForCreateOp(plcOp)
+    await plcClient.sendOperation(did, plcOp)
+    return new ProxyServer(server, url, did)
+  }
+
+  close(): Promise<void> {
+    return new Promise<void>((resolve) => {
+      this.server.close(() => resolve())
+    })
+  }
+}