@atproto/pds 0.5.11 → 0.5.14

package/src/account-manager/helpers/auth.ts

@@ -1,222 +0,0 @@
-import assert from 'node:assert'
-import { KeyObject } from 'node:crypto'
-import * as jose from 'jose'
-import * as ui8 from 'uint8arrays'
-import * as crypto from '@atproto/crypto'
-import { AuthScope } from '../../auth-scope.js'
-import { AccountDb } from '../db/index.js'
-import { AppPassDescript } from './password.js'
-
-export type AuthToken = {
-  scope: AuthScope
-  sub: string
-  exp: number
-}
-
-export type RefreshToken = AuthToken & { scope: AuthScope.Refresh; jti: string }
-
-export const createTokens = async (opts: {
-  did: string
-  jwtKey: KeyObject
-  serviceDid: string
-  scope?: AuthScope
-  jti?: string
-  expiresIn?: string | number
-}) => {
-  const { did, jwtKey, serviceDid, scope, jti, expiresIn } = opts
-  const [accessJwt, refreshJwt] = await Promise.all([
-    createAccessToken({ did, jwtKey, serviceDid, scope, expiresIn }),
-    createRefreshToken({ did, jwtKey, serviceDid, jti, expiresIn }),
-  ])
-  return { accessJwt, refreshJwt }
-}
-
-export const createAccessToken = (opts: {
-  did: string
-  jwtKey: KeyObject
-  serviceDid: string
-  scope?: AuthScope
-  expiresIn?: string | number
-}): Promise<string> => {
-  const {
-    did,
-    jwtKey,
-    serviceDid,
-    scope = AuthScope.Access,
-    expiresIn = '120mins',
-  } = opts
-  const signer = new jose.SignJWT({ scope })
-    .setProtectedHeader({
-      typ: 'at+jwt', // https://www.rfc-editor.org/rfc/rfc9068.html
-      alg: 'HS256', // only symmetric keys supported
-    })
-    .setAudience(serviceDid)
-    .setSubject(did)
-    .setIssuedAt()
-    .setExpirationTime(expiresIn)
-  return signer.sign(jwtKey)
-}
-
-export const createRefreshToken = (opts: {
-  did: string
-  jwtKey: KeyObject
-  serviceDid: string
-  jti?: string
-  expiresIn?: string | number
-}): Promise<string> => {
-  const {
-    did,
-    jwtKey,
-    serviceDid,
-    jti = getRefreshTokenId(),
-    expiresIn = '90days',
-  } = opts
-  const signer = new jose.SignJWT({ scope: AuthScope.Refresh })
-    .setProtectedHeader({
-      typ: 'refresh+jwt',
-      alg: 'HS256', // only symmetric keys supported
-    })
-    .setAudience(serviceDid)
-    .setSubject(did)
-    .setJti(jti)
-    .setIssuedAt()
-    .setExpirationTime(expiresIn)
-  return signer.sign(jwtKey)
-}
-
-// @NOTE unsafe for verification, should only be used w/ direct output from createRefreshToken() or createTokens()
-export const decodeRefreshToken = (jwt: string) => {
-  const token = jose.decodeJwt(jwt)
-  assert.ok(token.scope === AuthScope.Refresh, 'not a refresh token')
-  return token as RefreshToken
-}
-
-export const storeRefreshToken = async (
-  db: AccountDb,
-  payload: RefreshToken,
-  appPassword: AppPassDescript | null,
-) => {
-  const [result] = await db.executeWithRetry(
-    db.db
-      .insertInto('refresh_token')
-      .values({
-        id: payload.jti,
-        did: payload.sub,
-        appPasswordName: appPassword?.name,
-        expiresAt: new Date(payload.exp * 1000).toISOString(),
-      })
-      .onConflict((oc) => oc.doNothing()), // E.g. when re-granting during a refresh grace period
-  )
-  return result
-}
-
-export const getRefreshToken = async (db: AccountDb, id: string) => {
-  const res = await db.db
-    .selectFrom('refresh_token')
-    .leftJoin('app_password', (join) =>
-      join
-        .onRef('app_password.did', '=', 'refresh_token.did')
-        .onRef('app_password.name', '=', 'refresh_token.appPasswordName'),
-    )
-    .where('id', '=', id)
-    .selectAll('refresh_token')
-    .select('app_password.privileged')
-    .executeTakeFirst()
-  if (!res) return null
-  const { did, expiresAt, appPasswordName, nextId, privileged } = res
-  return {
-    id,
-    did,
-    expiresAt,
-    nextId,
-    appPassword: appPasswordName
-      ? {
-          name: appPasswordName,
-          privileged: privileged === 1 ? true : false,
-        }
-      : null,
-  }
-}
-
-export const deleteExpiredRefreshTokens = async (
-  db: AccountDb,
-  did: string,
-  now: string,
-) => {
-  await db.executeWithRetry(
-    db.db
-      .deleteFrom('refresh_token')
-      .where('did', '=', did)
-      .where('expiresAt', '<=', now),
-  )
-}
-
-export const addRefreshGracePeriod = async (
-  db: AccountDb,
-  opts: {
-    id: string
-    expiresAt: string
-    nextId: string
-  },
-) => {
-  const { id, expiresAt, nextId } = opts
-  const [res] = await db.executeWithRetry(
-    db.db
-      .updateTable('refresh_token')
-      .where('id', '=', id)
-      .where((eb) =>
-        eb.or([eb('nextId', 'is', null), eb('nextId', '=', nextId)]),
-      )
-      .set({ expiresAt, nextId })
-      .returningAll(),
-  )
-  if (!res) {
-    throw new ConcurrentRefreshError()
-  }
-}
-
-export const revokeRefreshToken = async (db: AccountDb, id: string) => {
-  const [{ numDeletedRows }] = await db.executeWithRetry(
-    db.db.deleteFrom('refresh_token').where('id', '=', id),
-  )
-  return numDeletedRows > 0
-}
-
-export const revokeRefreshTokensByDid = async (db: AccountDb, did: string) => {
-  const [{ numDeletedRows }] = await db.executeWithRetry(
-    db.db.deleteFrom('refresh_token').where('did', '=', did),
-  )
-  return numDeletedRows > 0
-}
-
-export const revokeAppPasswordRefreshToken = async (
-  db: AccountDb,
-  did: string,
-  appPassName: string,
-) => {
-  const [{ numDeletedRows }] = await db.executeWithRetry(
-    db.db
-      .deleteFrom('refresh_token')
-      .where('did', '=', did)
-      .where('appPasswordName', '=', appPassName),
-  )
-
-  return numDeletedRows > 0
-}
-
-export const getRefreshTokenId = () => {
-  return ui8.toString(crypto.randomBytes(32), 'base64')
-}
-
-export const formatScope = (
-  appPassword: AppPassDescript | null,
-  isSoftDeleted?: boolean,
-): AuthScope => {
-  if (isSoftDeleted) return AuthScope.Takendown
-  if (!appPassword) return AuthScope.Access
-  return appPassword.privileged
-    ? AuthScope.AppPassPrivileged
-    : AuthScope.AppPass
-}
-
-export class ConcurrentRefreshError extends Error {}

package/src/account-manager/helpers/authorization-request.ts

@@ -1,90 +0,0 @@
-import assert from 'node:assert'
-import { Insertable, Selectable } from 'kysely'
-import {
-  Code,
-  FoundRequestResult,
-  RequestData,
-  RequestId,
-  UpdateRequestData,
-} from '@atproto/oauth-provider'
-import { fromDateISO, fromJson, toDateISO, toJson } from '../../db/index.js'
-import { AccountDb, AuthorizationRequest } from '../db/index.js'
-
-export const rowToRequestData = (
-  row: Selectable<AuthorizationRequest>,
-): RequestData => ({
-  clientId: row.clientId,
-  clientAuth: fromJson(row.clientAuth),
-  parameters: fromJson(row.parameters),
-  expiresAt: fromDateISO(row.expiresAt),
-  deviceId: row.deviceId,
-  did: row.did,
-  code: row.code,
-})
-
-export const rowToFoundRequestResult = (
-  row: Selectable<AuthorizationRequest>,
-): FoundRequestResult => ({
-  requestId: row.id,
-  data: rowToRequestData(row),
-})
-
-const requestDataToRow = (
-  id: RequestId,
-  data: RequestData,
-): Insertable<AuthorizationRequest> => ({
-  id,
-  did: data.did,
-  deviceId: data.deviceId,
-
-  clientId: data.clientId,
-  clientAuth: toJson(data.clientAuth),
-  parameters: toJson(data.parameters),
-  expiresAt: toDateISO(data.expiresAt),
-  code: data.code,
-})
-
-export const createQB = (db: AccountDb, id: RequestId, data: RequestData) =>
-  db.db.insertInto('authorization_request').values(requestDataToRow(id, data))
-
-export const readQB = (db: AccountDb, id: RequestId) =>
-  db.db.selectFrom('authorization_request').where('id', '=', id).selectAll()
-
-export const updateQB = (
-  db: AccountDb,
-  id: RequestId,
-  { code, did, deviceId, expiresAt, parameters, ...rest }: UpdateRequestData,
-) => {
-  assert(!Object.keys(rest).length, 'Unexpected fields in UpdateRequestData')
-  return db.db
-    .updateTable('authorization_request')
-    .$if(code !== undefined, (qb) => qb.set({ code }))
-    .$if(did !== undefined, (qb) => qb.set({ did }))
-    .$if(deviceId !== undefined, (qb) => qb.set({ deviceId }))
-    .$if(expiresAt != null, (qb) =>
-      qb.set({ expiresAt: toDateISO(expiresAt!) }),
-    )
-    .$if(parameters != null, (qb) =>
-      qb.set({ parameters: toJson(parameters!) }),
-    )
-    .where('id', '=', id)
-}
-
-export const removeOldExpiredQB = (db: AccountDb, delay = 600e3) =>
-  // We allow some delay for the expiration time so that expired requests
-  // can still be returned to the OAuthProvider library for error handling.
-  db.db
-    .deleteFrom('authorization_request')
-    // uses "authorization_request_expires_at_idx" index
-    .where('expiresAt', '<', toDateISO(new Date(Date.now() - delay)))
-
-export const removeByIdQB = (db: AccountDb, id: RequestId) =>
-  db.db.deleteFrom('authorization_request').where('id', '=', id)
-
-export const consumeByCodeQB = (db: AccountDb, code: Code) =>
-  db.db
-    .deleteFrom('authorization_request')
-    // uses "authorization_request_code_idx" partial index (hence the null check)
-    .where('code', '=', code)
-    .where('code', 'is not', null)
-    .returningAll()

package/src/account-manager/helpers/authorized-client.ts

@@ -1,75 +0,0 @@
-import {
-  AuthorizedClientData,
-  AuthorizedClients,
-  ClientId,
-  Did,
-} from '@atproto/oauth-provider'
-import { fromJson, toDateISO, toJson } from '../../db/index.js'
-import { AccountDb } from '../db/index.js'
-
-export async function upsert(
-  db: AccountDb,
-  did: Did,
-  clientId: ClientId,
-  data: AuthorizedClientData,
-) {
-  const now = new Date()
-
-  return db.db
-    .insertInto('authorized_client')
-    .values({
-      did,
-      clientId,
-      createdAt: toDateISO(now),
-      updatedAt: toDateISO(now),
-      data: toJson(data),
-    })
-    .onConflict((oc) =>
-      // uses "authorized_client_pk" idx
-      oc.columns(['did', 'clientId']).doUpdateSet({
-        updatedAt: toDateISO(now),
-        data: toJson(data),
-      }),
-    )
-    .executeTakeFirst()
-}
-
-export async function getAuthorizedClients(
-  db: AccountDb,
-  did: Did,
-): Promise<AuthorizedClients> {
-  return (await getAuthorizedClientsMulti(db, [did])).get(did)!
-}
-
-export async function deleteAllAuthorizedClients(db: AccountDb, did: Did) {
-  await db.executeWithRetry(
-    db.db.deleteFrom('authorized_client').where('did', '=', did),
-  )
-}
-
-export async function getAuthorizedClientsMulti(
-  db: AccountDb,
-  dids: Iterable<Did>,
-): Promise<Map<Did, AuthorizedClients>> {
-  // Using a Map will ensure unicity of dids (through unicity of keys)
-  const map = new Map<Did, AuthorizedClients>(
-    Array.from(dids, (did) => [did, new Map()]),
-  )
-
-  if (map.size) {
-    const found = await db.db
-      .selectFrom('authorized_client')
-      .select('did')
-      .select('clientId')
-      .select('data')
-      // uses "authorized_client_pk"
-      .where('did', 'in', [...map.keys()])
-      .execute()
-
-    for (const { did, clientId, data } of found) {
-      map.get(did)!.set(clientId, fromJson(data))
-    }
-  }
-
-  return map
-}

package/src/account-manager/helpers/device.ts

@@ -1,47 +0,0 @@
-import { Selectable } from 'kysely'
-import { DeviceData, DeviceId } from '@atproto/oauth-provider'
-import { fromDateISO, toDateISO } from '../../db/index.js'
-import { AccountDb, Device } from '../db/index.js'
-
-export const rowToDeviceData = (
-  row: Omit<Selectable<Device>, 'id'>,
-): DeviceData => ({
-  sessionId: row.sessionId,
-  userAgent: row.userAgent,
-  ipAddress: row.ipAddress,
-  lastSeenAt: fromDateISO(row.lastSeenAt),
-})
-
-export const createQB = (
-  db: AccountDb,
-  deviceId: DeviceId,
-  { sessionId, userAgent, ipAddress, lastSeenAt }: DeviceData,
-) =>
-  db.db.insertInto('device').values({
-    id: deviceId,
-    sessionId,
-    userAgent,
-    ipAddress,
-    lastSeenAt: toDateISO(lastSeenAt),
-  })
-
-export const readQB = (db: AccountDb, deviceId: DeviceId) =>
-  db.db.selectFrom('device').where('id', '=', deviceId).selectAll()
-
-export const updateQB = (
-  db: AccountDb,
-  deviceId: DeviceId,
-  { sessionId, userAgent, ipAddress, lastSeenAt }: Partial<DeviceData>,
-) =>
-  db.db
-    .updateTable('device')
-    .$if(sessionId != null, (qb) => qb.set({ sessionId }))
-    .$if(userAgent != null, (qb) => qb.set({ userAgent }))
-    .$if(ipAddress != null, (qb) => qb.set({ ipAddress }))
-    .$if(lastSeenAt != null, (qb) =>
-      qb.set({ lastSeenAt: toDateISO(lastSeenAt!) }),
-    )
-    .where('id', '=', deviceId)
-
-export const removeQB = (db: AccountDb, deviceId: DeviceId) =>
-  db.db.deleteFrom('device').where('id', '=', deviceId)

package/src/account-manager/helpers/email-token.ts

@@ -1,87 +0,0 @@
-import { MINUTE, lessThanAgoMs } from '@atproto/common'
-import { DidString, currentDatetimeString } from '@atproto/lex'
-import { InvalidRequestError } from '@atproto/xrpc-server'
-import { getRandomToken } from '../../api/com/atproto/server/util.js'
-import { AccountDb, EmailTokenPurpose } from '../db/index.js'
-
-export const createEmailToken = async (
-  db: AccountDb,
-  did: DidString,
-  purpose: EmailTokenPurpose,
-): Promise<string> => {
-  const token = getRandomToken().toUpperCase()
-  const now = currentDatetimeString()
-  await db.executeWithRetry(
-    db.db
-      .insertInto('email_token')
-      .values({ purpose, did, token, requestedAt: now })
-      .onConflict((oc) =>
-        oc.columns(['purpose', 'did']).doUpdateSet({ token, requestedAt: now }),
-      ),
-  )
-  return token
-}
-
-export const deleteEmailToken = async (
-  db: AccountDb,
-  did: DidString,
-  purpose: EmailTokenPurpose,
-) => {
-  await db.executeWithRetry(
-    db.db
-      .deleteFrom('email_token')
-      .where('did', '=', did)
-      .where('purpose', '=', purpose),
-  )
-}
-
-export const deleteAllEmailTokens = async (db: AccountDb, did: DidString) => {
-  await db.executeWithRetry(
-    db.db.deleteFrom('email_token').where('did', '=', did),
-  )
-}
-
-export const assertValidToken = async (
-  db: AccountDb,
-  did: DidString,
-  purpose: EmailTokenPurpose,
-  token: string,
-  expirationLen = 15 * MINUTE,
-) => {
-  const res = await db.db
-    .selectFrom('email_token')
-    .selectAll()
-    .where('purpose', '=', purpose)
-    .where('did', '=', did)
-    .where('token', '=', token.toUpperCase())
-    .executeTakeFirst()
-  if (!res) {
-    throw new InvalidRequestError('Token is invalid', 'InvalidToken')
-  }
-  const expired = !lessThanAgoMs(new Date(res.requestedAt), expirationLen)
-  if (expired) {
-    throw new InvalidRequestError('Token is expired', 'ExpiredToken')
-  }
-}
-
-export const assertValidTokenAndFindDid = async (
-  db: AccountDb,
-  purpose: EmailTokenPurpose,
-  token: string,
-  expirationLen = 15 * MINUTE,
-): Promise<DidString> => {
-  const res = await db.db
-    .selectFrom('email_token')
-    .select(['did', 'requestedAt'])
-    .where('purpose', '=', purpose)
-    .where('token', '=', token.toUpperCase())
-    .executeTakeFirst()
-  if (!res) {
-    throw new InvalidRequestError('Token is invalid', 'InvalidToken')
-  }
-  const expired = !lessThanAgoMs(new Date(res.requestedAt), expirationLen)
-  if (expired) {
-    throw new InvalidRequestError('Token is expired', 'ExpiredToken')
-  }
-  return res.did
-}