@atproto/pds 0.5.12 → 0.5.15

package/tests/oauth.test.ts

@@ -1,334 +0,0 @@
-import { once } from 'node:events'
-import { Server, createServer } from 'node:http'
-import { AddressInfo } from 'node:net'
-import { jest } from '@jest/globals'
-import { type Browser, launch } from 'puppeteer'
-import { TestNetworkNoAppView } from '@atproto/dev-env'
-import { oauthClientAssetsMiddleware } from './_oauth_client_assets_middleware.js'
-import { PageHelper } from './_puppeteer.js'
-
-describe('oauth', () => {
-  let browser: Browser
-  let network: TestNetworkNoAppView
-  let server: Server
-
-  let appUrl: string
-
-  // @NOTE We are using another language than "en" as default language to
-  // test the language negotiation.
-  const languages = ['fr-BE', 'fr', 'en-US', 'en']
-
-  beforeAll(async () => {
-    browser = await launch({
-      browser: 'chrome', // "firefox"
-
-      // For debugging:
-      // headless: false,
-      // devtools: true,
-      // slowMo: 25,
-    })
-
-    network = await TestNetworkNoAppView.create({
-      dbPostgresSchema: 'oauth',
-    })
-
-    const sc = network.getSeedClient()
-
-    await sc.createAccount('alice', {
-      email: 'alice@test.com',
-      handle: 'alice.test',
-      password: 'alice-pass',
-    })
-
-    server = createServer(oauthClientAssetsMiddleware)
-    server.listen(0)
-    await once(server, 'listening')
-
-    const { port } = server.address() as AddressInfo
-
-    appUrl = `http://127.0.0.1:${port}?${new URLSearchParams({
-      plc_directory_url: network.plc.url,
-      handle_resolver: network.pds.url,
-      sign_up_url: network.pds.url,
-      env: 'test',
-      scope: `account:email identity:* repo:*`,
-    })}`
-  })
-
-  afterAll(async () => {
-    await server?.close()
-    await network?.close()
-    await browser?.close()
-  })
-
-  // This uses prompt=create under the hood:
-  it('Allows to sign-up through OAuth', async () => {
-    await using page = await PageHelper.from(browser, { languages })
-
-    await page.goto(appUrl)
-
-    await page.assertTitle('OAuth Client Example')
-
-    await page.navigationClick(`Sign up with ${new URL(network.pds.url).host}`)
-
-    await page.assertTitle('Inscription')
-
-    await page.typeInInput('handle', 'bob')
-
-    await page.clickOnText('Suivant')
-
-    await page.typeInInput('email', 'bob@test.com')
-    await page.typeInInput('password', 'bob-pass')
-
-    await page.clickOnText('Inscription')
-
-    await page.ensureTextVisibility(
-      `L'application demande un contrôle total sur votre identité, ce qui signifie qu'elle pourrait casser de façon permanente, ou même usurper, votre compte. N'autorisez l'accès qu'aux applications auxquelles vous faites vraiment confiance.`,
-    )
-
-    // Make sure the new account is propagated to the PLC directory, allowing
-    // the client to resolve the account's did
-    await network.processAll()
-
-    await page.navigationClick('Autoriser')
-
-    await page.assertTitle('OAuth Client Example')
-
-    await page.ensureTextVisibility('Token info', 'h2')
-
-    await page.clickOnAriaLabel('User menu')
-
-    await page.clickOnText('Sign out')
-
-    await page.waitForNetworkIdle()
-  })
-
-  it('Allows canceling the OAuth flow', async () => {
-    await using page = await PageHelper.from(browser, { languages })
-
-    await page.goto(appUrl)
-
-    await page.assertTitle('OAuth Client Example')
-
-    await page.navigationClick(`Login with ${new URL(network.pds.url).host}`)
-
-    await page.assertTitle('Se connecter')
-
-    // Cancel the OAuth flow:
-    await page.navigationClick('Annuler')
-
-    await page.assertTitle('OAuth Client Example')
-
-    await page.ensureTextVisibility('Login with the Atmosphere', 'h2')
-
-    await page.waitForNetworkIdle()
-  })
-
-  it('allows resetting the password', async () => {
-    const sendTemplateMock = jest
-      .spyOn(network.pds.ctx.mailer, 'sendResetPassword')
-      .mockImplementation(async () => {
-        // noop
-      })
-
-    await using page = await PageHelper.from(browser, { languages })
-
-    await page.goto(appUrl)
-
-    await page.assertTitle('OAuth Client Example')
-
-    const input = await page.typeInInput('identifier', 'alice.test')
-
-    await page.navigationAction(async () => input.press('Enter'))
-
-    await page.assertTitle('Connexion')
-
-    await page.clickOnText('Oublié ?')
-
-    await page.assertTitle('Mot de passe oublié')
-
-    await page.typeInInput('email', 'alice@test.com')
-
-    expect(sendTemplateMock).toHaveBeenCalledTimes(0)
-
-    await page.clickOnText('Suivant')
-
-    await page.assertTitle('Réinitialiser le mot de passe')
-
-    expect(sendTemplateMock).toHaveBeenCalledTimes(1)
-
-    const [params] = sendTemplateMock.mock.lastCall!
-    expect(params).toEqual({
-      handle: 'alice.test',
-      locale: 'fr',
-      token: expect.any(String),
-    })
-
-    await page.typeInInput('code', params.token)
-
-    await page.typeInInput('password', 'alice-new-pass')
-
-    await page.clickOnText('Suivant')
-
-    await page.assertTitle('Mot de passe mis à jour')
-
-    await page.ensureTextVisibility('Mot de passe mis à jour !', 'h2')
-
-    sendTemplateMock.mockRestore()
-  })
-
-  it('Allows to sign-in through OAuth', async () => {
-    await using page = await PageHelper.from(browser, { languages })
-
-    await page.goto(appUrl)
-
-    await page.assertTitle('OAuth Client Example')
-
-    const input = await page.typeInInput('identifier', 'alice.test')
-
-    await page.navigationAction(async () => input.press('Enter'))
-
-    await page.assertTitle('Connexion')
-
-    await page.typeInInput('password', 'alice-new-pass')
-
-    // Make sure the warning is visible
-    await page.ensureTextVisibility('Avertissement', 'h3')
-
-    await page.clickOn(
-      'label::-p-text(Se souvenir de ce compte sur cet appareil)',
-    )
-
-    await page.clickOnText('Se connecter')
-
-    await page.assertTitle('Autoriser')
-
-    await page.navigationClick('Autoriser')
-
-    await page.assertTitle('OAuth Client Example')
-
-    await page.ensureTextVisibility('Token info', 'h2')
-
-    await page.clickOnAriaLabel('User menu')
-
-    await page.clickOnText('Sign out')
-
-    await page.waitForNetworkIdle()
-  })
-
-  it('remembers the session', async () => {
-    await using page = await PageHelper.from(browser, { languages })
-
-    await page.goto(appUrl)
-
-    await page.assertTitle('OAuth Client Example')
-
-    const input = await page.typeInInput('identifier', 'alice.test')
-
-    await page.navigationAction(async () => input.press('Enter'))
-
-    await page.assertTitle('Autoriser')
-
-    await page.navigationClick('Autoriser')
-
-    await page.assertTitle('OAuth Client Example')
-
-    await page.ensureTextVisibility('Token info', 'h2')
-
-    await page.clickOnAriaLabel('User menu')
-
-    await page.clickOnText('Sign out')
-
-    await page.waitForNetworkIdle()
-  })
-
-  it('revokes OAuth sessions on deactivation & requires re-activation on sign-in', async () => {
-    await using page = await PageHelper.from(browser, { languages })
-
-    // Sign into the client (the device session is remembered, so the flow
-    // jumps straight to the consent screen).
-    await page.goto(appUrl)
-
-    await page.assertTitle('OAuth Client Example')
-
-    await page.navigationAction(async () => {
-      const input = await page.typeInInput('identifier', 'alice.test')
-      await input.press('Enter')
-    })
-
-    await page.assertTitle('Autoriser')
-
-    await page.navigationClick('Autoriser')
-
-    await page.assertTitle('OAuth Client Example')
-
-    await page.ensureTextVisibility('Token info', 'h2')
-
-    // While the client page is still open, deactivate the account through
-    // the account manager in another page.
-    {
-      await using accountPage = await PageHelper.from(browser, { languages })
-
-      await accountPage.goto(new URL('/account', network.pds.url))
-
-      await accountPage.assertTitle('Mon compte Atmosphère')
-
-      await accountPage.clickOnText('Compte utilisateur', 'a')
-
-      await accountPage.clickOnText('Désactiver le compte')
-
-      await accountPage.clickOnText('Oui, désactiver')
-
-      await accountPage.waitForNetworkIdle()
-
-      await accountPage.ensureTextVisibility('Réactiver le compte', 'span')
-
-      await network.processAll()
-    }
-
-    // Back in the client: deactivation revoked every OAuth session, so
-    // refreshing the credentials logs the user out.
-    await page.clickOnText('refresh').catch((_err) => {
-      // The OAuth app may have refreshed the session on it's own, causing the
-      // page to reset before the click is processed, which throws an error.
-    })
-
-    await page.waitForNetworkIdle()
-
-    await page.ensureTextVisibility('Login with the Atmosphere', 'h2')
-
-    // Signing back in with the deactivated account asks the user to
-    // re-activate it before the flow can proceed.
-    // @NOTE The PDS is used directly as issuer (rather than resolving the
-    // handle) because handle resolution does not work for deactivated
-    // accounts.
-
-    await page.navigationClick(`Login with ${new URL(network.pds.url).host}`)
-
-    await page.ensureTextVisibility('Se connecter en tant que...')
-
-    await page.clickOnText('alice.test', 'span')
-
-    await page.assertTitle('Heureux de vous revoir!')
-
-    await page.ensureTextVisibility('Vous avez précédemment désactivé')
-
-    await page.clickOnText('Oui, réactiver mon compte')
-
-    // Deactivation also cleared the authorized clients, so consent is
-    // required again.
-    await page.assertTitle('Autoriser')
-
-    await page.navigationClick('Autoriser')
-
-    await page.assertTitle('OAuth Client Example')
-
-    await page.ensureTextVisibility('Token info', 'h2')
-
-    await page.clickOnAriaLabel('User menu')
-
-    await page.clickOnText('Sign out')
-
-    await page.waitForNetworkIdle()
-  })
-})

package/tests/plc-operations.test.ts

@@ -1,239 +0,0 @@
-import assert from 'node:assert'
-import { EventEmitter, once } from 'node:events'
-import * as plc from '@did-plc/lib'
-import { SendMailOptions } from 'nodemailer'
-import { AtpAgent } from '@atproto/api'
-import { check } from '@atproto/common'
-import { Secp256k1Keypair } from '@atproto/crypto'
-import { SeedClient, TestNetworkNoAppView, basicSeed } from '@atproto/dev-env'
-import type { DidString } from '@atproto/syntax'
-import { AppContext } from '../src/index.js'
-
-describe('plc operations', () => {
-  let network: TestNetworkNoAppView
-  let ctx: AppContext
-  let agent: AtpAgent
-  let sc: SeedClient
-
-  const mailCatcher = new EventEmitter()
-  let _origSendMail
-
-  let alice: DidString
-
-  let sampleKey: string
-
-  beforeAll(async () => {
-    network = await TestNetworkNoAppView.create({
-      dbPostgresSchema: 'plc_operations',
-    })
-    // @ts-expect-error Error due to circular dependency with the dev-env package
-    ctx = network.pds.ctx
-    const mailer = ctx.mailer
-
-    sc = network.getSeedClient()
-    agent = network.pds.getAgent()
-
-    await basicSeed(sc)
-    alice = sc.dids.alice
-    await network.processAll()
-
-    sampleKey = (await Secp256k1Keypair.create()).did()
-
-    // Catch emails for use in tests
-    _origSendMail = mailer.transporter.sendMail
-    mailer.transporter.sendMail = async (opts) => {
-      const result = await _origSendMail.call(mailer.transporter, opts)
-      mailCatcher.emit('mail', opts)
-      return result
-    }
-  })
-
-  afterAll(async () => {
-    await network?.close()
-  })
-
-  const getMailFrom = async (promise): Promise<SendMailOptions> => {
-    const result = await Promise.all([once(mailCatcher, 'mail'), promise])
-    return result[0][0]
-  }
-
-  const getTokenFromMail = (mail: SendMailOptions) =>
-    mail.html?.toString().match(/>([a-z0-9]{5}-[a-z0-9]{5})</i)?.[1]
-
-  const signOp = async (did: string, op: Partial<plc.Operation>) => {
-    const lastOp = await ctx.plcClient.getLastOp(did)
-    if (check.is(lastOp, plc.def.tombstone)) {
-      throw new Error('Did is tombstoned')
-    }
-    return plc.createUpdateOp(lastOp, ctx.plcRotationKey, (lastOp) => ({
-      ...lastOp,
-      rotationKeys: op.rotationKeys ?? lastOp.rotationKeys,
-      alsoKnownAs: op.alsoKnownAs ?? lastOp.alsoKnownAs,
-      verificationMethods: op.verificationMethods ?? lastOp.verificationMethods,
-      services: op.services ?? lastOp.services,
-    }))
-  }
-
-  const expectFailedOp = async (
-    did: string,
-    op: Partial<plc.Operation>,
-    expectedErr?: string,
-  ) => {
-    const operation = await signOp(did, op)
-    const attempt = agent.com.atproto.identity.submitPlcOperation(
-      { operation },
-      {
-        encoding: 'application/json',
-        headers: sc.getHeaders(alice),
-      },
-    )
-    await expect(attempt).rejects.toThrow(expectedErr)
-  }
-
-  it("prevents submitting an operation that removes the server's rotation key", async () => {
-    await expectFailedOp(
-      alice,
-      { rotationKeys: [sampleKey] },
-      "Rotation keys do not include server's rotation key",
-    )
-  })
-
-  it('prevents submitting an operation that incorrectly sets the signing key', async () => {
-    await expectFailedOp(
-      alice,
-      {
-        verificationMethods: {
-          atproto: sampleKey,
-        },
-      },
-      'Incorrect signing key',
-    )
-  })
-
-  it('prevents submitting an operation that incorrectly sets the handle', async () => {
-    await expectFailedOp(
-      alice,
-      {
-        alsoKnownAs: ['at://new-alice.test'],
-      },
-      'Incorrect handle in alsoKnownAs',
-    )
-  })
-
-  it('prevents submitting an operation that incorrectly sets the pds endpoint', async () => {
-    await expectFailedOp(
-      alice,
-      {
-        services: {
-          atproto_pds: {
-            type: 'AtprotoPersonalDataServer',
-            endpoint: 'https://example.com',
-          },
-        },
-      },
-      'Incorrect endpoint on atproto_pds service',
-    )
-  })
-
-  it('prevents submitting an operation that incorrectly sets the pds service type', async () => {
-    await expectFailedOp(
-      alice,
-      {
-        services: {
-          atproto_pds: {
-            type: 'NotAPersonalDataServer',
-            endpoint: ctx.cfg.service.publicUrl,
-          },
-        },
-      },
-      'Incorrect type on atproto_pds service',
-    )
-  })
-
-  it('does not allow signing plc operation without a token', async () => {
-    const attempt = agent.com.atproto.identity.signPlcOperation(
-      {
-        rotationKeys: [sampleKey],
-      },
-      { encoding: 'application/json', headers: sc.getHeaders(alice) },
-    )
-    await expect(attempt).rejects.toThrow(
-      'email confirmation token required to sign PLC operations',
-    )
-  })
-
-  let token: string
-
-  it('requests a plc signature', async () => {
-    const mail = await getMailFrom(
-      agent.api.com.atproto.identity.requestPlcOperationSignature(undefined, {
-        headers: sc.getHeaders(alice),
-      }),
-    )
-
-    expect(mail.to).toEqual(sc.accounts[alice].email)
-    expect(mail.html).toContain('PLC update requested')
-
-    const gotToken = getTokenFromMail(mail)
-    assert(gotToken)
-    token = gotToken
-  })
-
-  it('does not sign a plc operation with a bad token', async () => {
-    const attempt = agent.api.com.atproto.identity.signPlcOperation(
-      {
-        token: '123456',
-        rotationKeys: [sampleKey],
-      },
-      { encoding: 'application/json', headers: sc.getHeaders(alice) },
-    )
-    await expect(attempt).rejects.toThrow('Token is invalid')
-  })
-
-  let operation: any
-
-  it('signs a plc operation with a valid token', async () => {
-    const res = await agent.api.com.atproto.identity.signPlcOperation(
-      {
-        token,
-        rotationKeys: [sampleKey, ctx.plcRotationKey.did()],
-      },
-      { encoding: 'application/json', headers: sc.getHeaders(alice) },
-    )
-    const currData = await ctx.plcClient.getDocumentData(alice)
-    expect(res.data.operation['alsoKnownAs']).toEqual(currData.alsoKnownAs)
-    expect(res.data.operation['verificationMethods']).toEqual(
-      currData.verificationMethods,
-    )
-    expect(res.data.operation['services']).toEqual(currData.services)
-    expect(res.data.operation['rotationKeys']).toEqual([
-      sampleKey,
-      ctx.plcRotationKey.did(),
-    ])
-    operation = res.data.operation
-  })
-
-  it('submits a valid operation', async () => {
-    await agent.com.atproto.identity.submitPlcOperation(
-      { operation },
-      {
-        encoding: 'application/json',
-        headers: sc.getHeaders(alice),
-      },
-    )
-    const didData = await ctx.plcClient.getDocumentData(alice)
-    expect(didData.rotationKeys).toEqual([sampleKey, ctx.plcRotationKey.did()])
-  })
-
-  it('emits an identity event after a valid operation', async () => {
-    const lastEvt = await ctx.sequencer.db.db
-      .selectFrom('repo_seq')
-      .selectAll()
-      .orderBy('repo_seq.seq', 'desc')
-      .limit(1)
-      .executeTakeFirst()
-    assert(lastEvt)
-    expect(lastEvt.did).toBe(alice)
-    expect(lastEvt.eventType).toBe('identity')
-  })
-})