@atproto/pds 0.5.12 → 0.5.15

package/tests/app-passwords.test.ts

@@ -1,262 +0,0 @@
-import * as jose from 'jose'
-import { AtpAgent } from '@atproto/api'
-import { TestNetworkNoAppView } from '@atproto/dev-env'
-
-describe('app_passwords', () => {
-  let network: TestNetworkNoAppView
-  let accntAgent: AtpAgent
-  let appAgent: AtpAgent
-  let priviAgent: AtpAgent
-
-  beforeAll(async () => {
-    network = await TestNetworkNoAppView.create({
-      dbPostgresSchema: 'app_passwords',
-    })
-    accntAgent = network.pds.getAgent()
-    appAgent = network.pds.getAgent()
-    priviAgent = network.pds.getAgent()
-
-    await accntAgent.createAccount({
-      handle: 'alice.test',
-      email: 'alice@test.com',
-      password: 'alice-pass',
-    })
-  })
-
-  afterAll(async () => {
-    await network?.close()
-  })
-
-  let appPass: string
-  let privilegedAppPass: string
-
-  it('creates an app-specific password', async () => {
-    const res = await accntAgent.api.com.atproto.server.createAppPassword({
-      name: 'test-pass',
-    })
-    expect(res.data.name).toBe('test-pass')
-    expect(res.data.privileged).toBe(false)
-    appPass = res.data.password
-  })
-
-  it('creates a privileged app-specific password', async () => {
-    const res = await accntAgent.api.com.atproto.server.createAppPassword({
-      name: 'privi-pass',
-      privileged: true,
-    })
-    expect(res.data.name).toBe('privi-pass')
-    expect(res.data.privileged).toBe(true)
-    privilegedAppPass = res.data.password
-  })
-
-  it('creates a session with an app-specific password', async () => {
-    const res1 = await appAgent.login({
-      identifier: 'alice.test',
-      password: appPass,
-    })
-    expect(res1.data.did).toEqual(accntAgent.session?.did)
-    const res2 = await priviAgent.login({
-      identifier: 'alice.test',
-      password: privilegedAppPass,
-    })
-    expect(res2.data.did).toEqual(accntAgent.session?.did)
-  })
-
-  it('creates an access token for an app with a restricted scope', () => {
-    const decoded = jose.decodeJwt(appAgent.session?.accessJwt ?? '')
-    expect(decoded?.scope).toEqual('com.atproto.appPass')
-
-    const decodedPrivi = jose.decodeJwt(priviAgent.session?.accessJwt ?? '')
-    expect(decodedPrivi?.scope).toEqual('com.atproto.appPassPrivileged')
-  })
-
-  it('allows actions to be performed from app', async () => {
-    await appAgent.api.app.bsky.feed.post.create(
-      {
-        repo: appAgent.assertDid,
-      },
-      {
-        text: 'Testing testing',
-        createdAt: new Date().toISOString(),
-      },
-    )
-    await priviAgent.api.app.bsky.feed.post.create(
-      {
-        repo: priviAgent.assertDid,
-      },
-      {
-        text: 'testing again',
-        createdAt: new Date().toISOString(),
-      },
-    )
-  })
-
-  it('restricts full access actions', async () => {
-    const attempt1 = appAgent.api.com.atproto.server.createAppPassword({
-      name: 'another-one',
-    })
-    await expect(attempt1).rejects.toThrow('Bad token scope')
-    const attempt2 = priviAgent.api.com.atproto.server.createAppPassword({
-      name: 'another-one',
-    })
-    await expect(attempt2).rejects.toThrow('Bad token scope')
-  })
-
-  it('restricts privileged app password actions', async () => {
-    const attempt = appAgent.api.chat.bsky.convo.listConvos({})
-    await expect(attempt).rejects.toThrow('Bad token method')
-  })
-
-  it('restricts privileged app password actions', async () => {
-    const attempt = appAgent.api.chat.bsky.convo.listConvos()
-    await expect(attempt).rejects.toThrow('Bad token method')
-  })
-
-  it('restricts service auth token methods for non-privileged access tokens', async () => {
-    const attemptCaseSensitive = appAgent.api.com.atproto.server.getServiceAuth(
-      {
-        aud: network.pds.ctx.cfg.service.did,
-        lxm: 'com.atproto.server.createAccount',
-      },
-    )
-    await expect(attemptCaseSensitive).rejects.toThrow(
-      /insufficient access to request a service auth token for the following method/,
-    )
-    const attemptCaseInsensitive =
-      appAgent.api.com.atproto.server.getServiceAuth({
-        aud: network.pds.ctx.cfg.service.did,
-        lxm: 'com.atproto.server.createaccount',
-      })
-    await expect(attemptCaseInsensitive).rejects.toThrow(
-      /insufficient access to request a service auth token for the following method/,
-    )
-  })
-
-  it('allows privileged service auth token scopes for privileged access tokens', async () => {
-    await priviAgent.api.com.atproto.server.getServiceAuth({
-      aud: network.pds.ctx.cfg.service.did,
-      lxm: 'com.atproto.server.createAccount',
-    })
-  })
-
-  it('persists scope across refreshes', async () => {
-    const session = await appAgent.api.com.atproto.server.refreshSession(
-      undefined,
-      {
-        headers: {
-          authorization: `Bearer ${appAgent.session?.refreshJwt}`,
-        },
-      },
-    )
-
-    // allows any access auth
-    await appAgent.api.app.bsky.feed.post.create(
-      {
-        repo: appAgent.assertDid,
-      },
-      {
-        text: 'Testing testing',
-        createdAt: new Date().toISOString(),
-      },
-      {
-        authorization: `Bearer ${session.data.accessJwt}`,
-      },
-    )
-
-    // allows privileged app passwords or higher
-    const priviAttempt = appAgent.api.com.atproto.server.getServiceAuth({
-      aud: network.pds.ctx.cfg.service.did,
-      lxm: 'com.atproto.server.createAccount',
-    })
-    await expect(priviAttempt).rejects.toThrow(
-      /insufficient access to request a service auth token for the following method/,
-    )
-
-    // allows only full access auth
-    const fullAttempt = appAgent.api.com.atproto.server.createAppPassword(
-      {
-        name: 'another-one',
-      },
-      {
-        encoding: 'application/json',
-        headers: { authorization: `Bearer ${session.data.accessJwt}` },
-      },
-    )
-    await expect(fullAttempt).rejects.toThrow('Bad token scope')
-  })
-
-  it('persists privileged scope across refreshes', async () => {
-    const session = await priviAgent.api.com.atproto.server.refreshSession(
-      undefined,
-      {
-        headers: {
-          authorization: `Bearer ${priviAgent.session?.refreshJwt}`,
-        },
-      },
-    )
-
-    // allows any access auth
-    await priviAgent.api.app.bsky.feed.post.create(
-      {
-        repo: priviAgent.assertDid,
-      },
-      {
-        text: 'Testing testing',
-        createdAt: new Date().toISOString(),
-      },
-      {
-        authorization: `Bearer ${session.data.accessJwt}`,
-      },
-    )
-
-    // allows privileged app passwords or higher
-    await priviAgent.api.com.atproto.server.getServiceAuth({
-      aud: network.pds.ctx.cfg.service.did,
-    })
-
-    // allows only full access auth
-    const attempt = priviAgent.api.com.atproto.server.createAppPassword(
-      {
-        name: 'another-one',
-      },
-      {
-        encoding: 'application/json',
-        headers: { authorization: `Bearer ${session.data.accessJwt}` },
-      },
-    )
-    await expect(attempt).rejects.toThrow('Bad token scope')
-  })
-
-  it('lists available app-specific passwords', async () => {
-    const res = await appAgent.api.com.atproto.server.listAppPasswords()
-    expect(res.data.passwords.length).toBe(2)
-    expect(res.data.passwords[0].name).toEqual('privi-pass')
-    expect(res.data.passwords[0].privileged).toEqual(true)
-    expect(res.data.passwords[1].name).toEqual('test-pass')
-    expect(res.data.passwords[1].privileged).toEqual(false)
-  })
-
-  it('revokes an app-specific password', async () => {
-    await appAgent.api.com.atproto.server.revokeAppPassword({
-      name: 'test-pass',
-    })
-  })
-
-  it('no longer allows session refresh after revocation', async () => {
-    const attempt = appAgent.api.com.atproto.server.refreshSession(undefined, {
-      headers: {
-        authorization: `Bearer ${appAgent.session?.refreshJwt}`,
-      },
-    })
-    await expect(attempt).rejects.toThrow('Token has been revoked')
-  })
-
-  it('no longer allows session creation after revocation', async () => {
-    const newAgent = network.pds.getAgent()
-    const attempt = newAgent.login({
-      identifier: 'alice.test',
-      password: appPass,
-    })
-    await expect(attempt).rejects.toThrow('Invalid identifier or password')
-  })
-})

package/tests/auth.test.ts

@@ -1,405 +0,0 @@
-import * as jose from 'jose'
-import { request as undiciRequest } from 'undici'
-import { AtpAgent } from '@atproto/api'
-import { SeedClient, TestNetworkNoAppView } from '@atproto/dev-env'
-import { createRefreshToken } from '../src/account-manager/helpers/auth.js'
-
-describe('auth', () => {
-  let network: TestNetworkNoAppView
-  let agent: AtpAgent
-
-  beforeAll(async () => {
-    network = await TestNetworkNoAppView.create({
-      dbPostgresSchema: 'auth',
-    })
-    agent = network.pds.getAgent()
-  })
-
-  afterAll(async () => {
-    await network?.close()
-  })
-
-  const createAccount = async (info) => {
-    const { data } = await agent.com.atproto.server.createAccount(info)
-    return data
-  }
-  const getSession = async (jwt) => {
-    const { data } = await agent.com.atproto.server.getSession(
-      {},
-      {
-        headers: SeedClient.getHeaders(jwt),
-      },
-    )
-    return data
-  }
-  const createSession = async (info) => {
-    const { data } = await agent.com.atproto.server.createSession(info)
-    return data
-  }
-  const deleteSession = async (jwt) => {
-    await agent.com.atproto.server.deleteSession(undefined, {
-      headers: SeedClient.getHeaders(jwt),
-    })
-  }
-  const refreshSession = async (jwt: string) => {
-    const { data } = await agent.com.atproto.server.refreshSession(undefined, {
-      headers: SeedClient.getHeaders(jwt),
-    })
-    return data
-  }
-
-  it('provides valid access and refresh token on account creation.', async () => {
-    const email = 'alice@test.com'
-    const account = await createAccount({
-      handle: 'alice.test',
-      email,
-      password: 'password',
-    })
-    // Valid access token
-    const sessionInfo = await getSession(account.accessJwt)
-    expect(sessionInfo).toEqual({
-      did: account.did,
-      handle: account.handle,
-      email,
-      emailConfirmed: false,
-      active: true,
-    })
-    // Valid refresh token
-    const nextSession = await refreshSession(account.refreshJwt)
-    expect(nextSession).toEqual(
-      expect.objectContaining({
-        did: account.did,
-        handle: account.handle,
-      }),
-    )
-  })
-
-  it('provides valid access and refresh token on session creation.', async () => {
-    const email = 'bob@test.com'
-    await createAccount({
-      handle: 'bob.test',
-      email,
-      password: 'password',
-    })
-    const session = await createSession({
-      identifier: 'bob.test',
-      password: 'password',
-    })
-    // Valid access token
-    const sessionInfo = await getSession(session.accessJwt)
-    expect(sessionInfo).toEqual({
-      did: session.did,
-      handle: session.handle,
-      email,
-      emailConfirmed: false,
-      active: true,
-    })
-    // Valid refresh token
-    const nextSession = await refreshSession(session.refreshJwt)
-    expect(nextSession).toEqual(
-      expect.objectContaining({
-        did: session.did,
-        handle: session.handle,
-      }),
-    )
-  })
-
-  it('allows session creation using email address.', async () => {
-    const session = await createSession({
-      identifier: 'bob@TEST.com',
-      password: 'password',
-    })
-    expect(session.handle).toEqual('bob.test')
-  })
-
-  it('fails on session creation with a bad password.', async () => {
-    const sessionPromise = createSession({
-      identifier: 'bob.test',
-      password: 'wrong-pass',
-    })
-    await expect(sessionPromise).rejects.toThrow(
-      'Invalid identifier or password',
-    )
-  })
-
-  it('returns identical error responses for unknown identifier and known-identifier-with-wrong-password.', async () => {
-    const probe = async (info: { identifier: string; password: string }) => {
-      const res = await fetch(
-        `${network.pds.url}/xrpc/com.atproto.server.createSession`,
-        {
-          method: 'POST',
-          headers: { 'content-type': 'application/json' },
-          body: JSON.stringify(info),
-        },
-      )
-      return { status: res.status, body: await res.json() }
-    }
-
-    // bob.test was created above with password 'password'.
-    const unknownIdentifier = await probe({
-      identifier: 'no-such-user.test',
-      password: 'any-password',
-    })
-    const knownIdentifierWrongPassword = await probe({
-      identifier: 'bob.test',
-      password: 'wrong-password',
-    })
-
-    expect(knownIdentifierWrongPassword).toEqual(unknownIdentifier)
-    expect(unknownIdentifier).toEqual({
-      status: 401,
-      body: {
-        error: 'AuthenticationRequired',
-        message: 'Invalid identifier or password',
-      },
-    })
-  })
-
-  it('returns identical error responses for unknown identifier and known-identifier-with-wrong-password in the OAuth sign-in flow.', async () => {
-    const issuer = new URL(network.pds.url)
-    const csrfToken = 'a'.repeat(24)
-    const probe = async (credentials: {
-      username: string
-      password: string
-    }) => {
-      // @NOTE We use undici's low-level `request` rather than fetch(),
-      // because the WHATWG fetch API treats `sec-fetch-*` as forbidden
-      // request headers and silently overwrites them with its own values
-      // (notably `sec-fetch-mode: cors` in Node). The endpoint requires
-      // `same-origin` here, so we need raw header control.
-      const res = await undiciRequest(
-        `${issuer.origin}/@atproto/oauth-provider/~api/sign-in`,
-        {
-          method: 'POST',
-          headers: {
-            'content-type': 'application/json',
-            // The endpoint restricts fetches to same-origin navigations
-            // from either `/oauth/authorize` or `/account[/*]`. Use the
-            // first-party `/account` path so we don't need a live OAuth
-            // authorization request to exist in the request store.
-            'sec-fetch-mode': 'same-origin',
-            'sec-fetch-site': 'same-origin',
-            origin: issuer.origin,
-            referer: `${issuer.origin}/account`,
-            'x-csrf-token': csrfToken,
-            cookie: `csrf-token=${csrfToken}`,
-          },
-          body: JSON.stringify({ locale: 'en', ...credentials }),
-        },
-      )
-      return { status: res.statusCode, body: await res.body.json() }
-    }
-
-    // bob.test was created above with password 'password'.
-    const unknownIdentifier = await probe({
-      username: 'no-such-user.test',
-      password: 'any-password',
-    })
-    const knownIdentifierWrongPassword = await probe({
-      username: 'bob.test',
-      password: 'wrong-password',
-    })
-
-    expect(knownIdentifierWrongPassword).toEqual(unknownIdentifier)
-    expect(unknownIdentifier).toEqual({
-      status: 400,
-      body: {
-        error: 'invalid_request',
-        error_description: 'Invalid identifier or password',
-      },
-    })
-  })
-
-  it('provides valid access and refresh token on session refresh.', async () => {
-    const email = 'carol@test.com'
-    const account = await createAccount({
-      handle: 'carol.test',
-      password: 'password',
-      email,
-    })
-    const session = await refreshSession(account.refreshJwt)
-    // Valid access token
-    const sessionInfo = await getSession(session.accessJwt)
-    expect(sessionInfo).toEqual({
-      did: session.did,
-      handle: session.handle,
-      email,
-      emailConfirmed: false,
-      active: true,
-    })
-    // Valid refresh token
-    const nextSession = await refreshSession(session.refreshJwt)
-    expect(nextSession).toEqual(
-      expect.objectContaining({
-        did: session.did,
-        handle: session.handle,
-      }),
-    )
-  })
-
-  it('handles racing refreshes', async () => {
-    const email = 'dan@test.com'
-    const account = await createAccount({
-      handle: 'dan.test',
-      password: 'password',
-      email,
-    })
-    const tokenIdPromises: Promise<string>[] = []
-    const doRefresh = async () => {
-      const res = await refreshSession(account.refreshJwt)
-      const decoded = jose.decodeJwt(res.refreshJwt)
-      if (!decoded?.jti) {
-        throw new Error('undefined jti on refresh token')
-      }
-      return decoded.jti
-    }
-    for (let i = 0; i < 10; i++) {
-      tokenIdPromises.push(doRefresh())
-    }
-    const tokenIds = await Promise.all(tokenIdPromises)
-    for (let i = 0; i < 10; i++) {
-      expect(tokenIds[i]).toEqual(tokenIds[0])
-    }
-  })
-
-  it('refresh token provides new token with same id on multiple uses during grace period.', async () => {
-    const account = await createAccount({
-      handle: 'eve.test',
-      email: 'eve@test.com',
-      password: 'password',
-    })
-    const refresh1 = await refreshSession(account.refreshJwt)
-    const refresh2 = await refreshSession(account.refreshJwt)
-
-    const token0 = jose.decodeJwt(account.refreshJwt)
-    const token1 = jose.decodeJwt(refresh1.refreshJwt)
-    const token2 = jose.decodeJwt(refresh2.refreshJwt)
-
-    expect(typeof token1?.jti).toEqual('string')
-    expect(token1?.jti).toEqual(token2?.jti)
-    expect(token1?.jti).not.toEqual(token0?.jti)
-    expect(token2?.jti).not.toEqual(token0?.jti)
-  })
-
-  it('refresh token is revoked after grace period completes.', async () => {
-    const { db } = network.pds.ctx.accountManager
-    const account = await createAccount({
-      handle: 'evan.test',
-      email: 'evan@test.com',
-      password: 'password',
-    })
-    await refreshSession(account.refreshJwt)
-    const token = jose.decodeJwt(account.refreshJwt)
-
-    // Update expiration (i.e. grace period) to end immediately
-    const refreshUpdated = await db.db
-      .updateTable('refresh_token')
-      .set({ expiresAt: new Date().toISOString() })
-      .where('id', '=', token?.jti ?? '')
-      .executeTakeFirst()
-    expect(Number(refreshUpdated.numUpdatedRows)).toEqual(1)
-
-    // Token can no longer be used
-    const refreshAgain = refreshSession(account.refreshJwt)
-    await expect(refreshAgain).rejects.toThrow('Token has been revoked')
-
-    // Ensure that token was cleaned-up
-    const refreshInfo = await db.db
-      .selectFrom('refresh_token')
-      .selectAll()
-      .where('id', '=', token?.jti ?? '')
-      .executeTakeFirst()
-    expect(refreshInfo).toBeUndefined()
-  })
-
-  it('refresh token is revoked when session is deleted.', async () => {
-    const account = await createAccount({
-      handle: 'finn.test',
-      email: 'finn@test.com',
-      password: 'password',
-    })
-    await deleteSession(account.refreshJwt)
-    const refreshDeleted = refreshSession(account.refreshJwt)
-    await expect(refreshDeleted).rejects.toThrow('Token has been revoked')
-    await deleteSession(account.refreshJwt) // No problem double-revoking a token
-  })
-
-  it('access token cannot be used to refresh a session.', async () => {
-    const account = await createAccount({
-      handle: 'gordon.test',
-      email: 'gordon@test.com',
-      password: 'password',
-    })
-    const refreshWithAccess = refreshSession(account.accessJwt)
-    await expect(refreshWithAccess).rejects.toThrow(
-      'Token could not be verified',
-    )
-  })
-
-  it('expired refresh token cannot be used to refresh a session.', async () => {
-    const account = await createAccount({
-      handle: 'holga.test',
-      email: 'holga@test.com',
-      password: 'password',
-    })
-    const refreshJwt = await createRefreshToken({
-      did: account.did,
-      jwtKey: network.pds.jwtSecretKey(),
-      serviceDid: network.pds.ctx.cfg.service.did,
-      expiresIn: -1,
-    })
-    const refreshExpired = refreshSession(refreshJwt)
-    await expect(refreshExpired).rejects.toThrow('Token has expired')
-    await deleteSession(refreshJwt) // No problem revoking an expired token
-  })
-
-  it('actor takedown disallows fresh session.', async () => {
-    const account = await createAccount({
-      handle: 'iris.test',
-      email: 'iris@test.com',
-      password: 'password',
-    })
-    await agent.com.atproto.admin.updateSubjectStatus(
-      {
-        subject: {
-          $type: 'com.atproto.admin.defs#repoRef',
-          did: account.did,
-        },
-        takedown: { applied: true },
-      },
-      {
-        encoding: 'application/json',
-        headers: { authorization: network.pds.adminAuth() },
-      },
-    )
-    await expect(
-      createSession({ identifier: 'iris.test', password: 'password' }),
-    ).rejects.toMatchObject({
-      error: 'AccountTakedown',
-    })
-  })
-
-  it('actor takedown disallows refresh session.', async () => {
-    const account = await createAccount({
-      handle: 'jared.test',
-      email: 'jared@test.com',
-      password: 'password',
-    })
-    await agent.com.atproto.admin.updateSubjectStatus(
-      {
-        subject: {
-          $type: 'com.atproto.admin.defs#repoRef',
-          did: account.did,
-        },
-        takedown: { applied: true },
-      },
-      {
-        encoding: 'application/json',
-        headers: { authorization: network.pds.adminAuth() },
-      },
-    )
-    await expect(refreshSession(account.refreshJwt)).rejects.toMatchObject({
-      error: 'AccountTakedown',
-    })
-  })
-})