npm - @atproto/pds - Versions diffs - 0.5.24 → 0.5.26 - Mend

@atproto/pds 0.5.24 → 0.5.26

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1604) hide show

package/dist/api/com/atproto/server/createAccount.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"createAccount.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/createAccount.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,cAAc,CAAA;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAC/D,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,EAGL,gBAAgB,GACjB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAoB,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAEvE,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GAEpB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAA;AAEvF,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAA;AACtE,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAE7C,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;QAC3C,SAAS,EAAE;YACT,UAAU,EAAE,CAAC,GAAG,MAAM;YACtB,MAAM,EAAE,GAAG;SACZ;QACD,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,uBAAuB;QAC9C,OAAO,EAAE,KAAK,EAAE,EACd,KAAK,EACL,IAAI,EACJ,GAAG,GACJ,EAAqD,EAAE;YACtD,iEAAiE;YACjE,0EAA0E;YAE1E,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,GAAG,IAAI,IAAI,CAAA;YAC/C,MAAM,EACJ,GAAG,EACH,MAAM,EACN,KAAK,EACL,QAAQ,EACR,UAAU,EACV,UAAU,EACV,KAAK,EACL,WAAW,GACZ,GAAG,GAAG,CAAC,cAAc;gBACpB,CAAC,CAAC,MAAM,4BAA4B,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC;gBACrD,CAAC,CAAC,MAAM,yBAAyB,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;YAE/D,MAAM,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;YAE5C,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE;oBAC7D,OAAO,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;gBACrC,CAAC,CAAC,CAAA;gBAEF,MAAM,YAAY;gBAChB,qEAAqE;gBACrE,oEAAoE;gBACpE,kBAAkB;gBAClB,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAA;gBAEnD,+BAA+B;gBAC/B,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;gBAC/C,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;oBAEtD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,uBAAuB,CAAC;wBAC7D,GAAG;wBACH,MAAM;wBACN,KAAK;wBACL,QAAQ;wBACR,OAAO,EAAE,MAAM,CAAC,GAAG;wBACnB,OAAO,EAAE,MAAM,CAAC,GAAG;wBACnB,UAAU;wBACV,WAAW;qBACZ,CAAC,CAAA;oBAEF,IAAI,CAAC;wBACH,MAAM,WAAW,GAAG,CAAC,WAAW,CAAA;wBAChC,IAAI,WAAW,EAAE,CAAC;4BAChB,MAAM,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;wBAClE,CAAC;wBAED,IAAI,CAAC;4BACH,MAAM,GAAG,CAAC,UAAU;iCACjB,oBAAoB,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC;iCAC3C,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gCACb,+DAA+D;gCAC/D,+CAA+C;gCAC/C,GAAG,CAAC,GAAG,CAAC,KAAK,CACX,EAAE,GAAG,EAAE,aAAa,EAAE,UAAU,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,EAC7C,kCAAkC,CACnC,CAAA;4BACH,CAAC,CAAC,CAAA;4BAEJ,OAAO;gCACL,QAAQ,EAAE,kBAA2B;gCACrC,IAAI,EAAE;oCACJ,MAAM;oCACN,GAAG,EAAE,GAAG;oCACR,uEAAuE;oCACvE,MAAM;oCACN,SAAS,EAAE,KAAK,CAAC,SAAS;oCAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;iCAC7B;6BACF,CAAA;wBACH,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,IAAI,WAAW;gCAAE,MAAM,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;4BACjE,MAAM,GAAG,CAAA;wBACX,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,GAAG,CAAC,cAAc,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;wBAC3C,MAAM,GAAG,CAAA;oBACX,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,YAAY,EAAE,CAAC;wBACjB,MAAM,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,cAAc,CAAC,CAAA;oBACxD,CAAC;oBACD,MAAM,GAAG,CAAA;gBACX,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;gBACjC,MAAM,GAAG,CAAA;YACX,CAAC;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,4BAA4B,GAAG,KAAK,EACxC,GAAe,EACf,KAAkD,EAClD,EAAE;IACF,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAErD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,KAAK,CAAA;IAC5B,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,mBAAmB,CAC3B,oDAAoD,CACrD,CAAA;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,EAAE,oBAAoB,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,cAAc,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAA;IACvD,IAAI,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,mBAAmB,CAC3B,+CAA+C,EAC/C,oBAAoB,CACrB,CAAA;IACH,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;QAC9B,MAAM,GAAG,CAAC,cAAc,CAAC,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAA;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,EAAE,oBAAoB,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAA;IAC/C,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;IAEnC,IAAI,UAAyC,CAAA;IAC7C,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACjE,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACvE,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC,qCAAqC,CAAC,CAAA;IACtE,CAAC;IAED,mBAAmB,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS;QAC9B,UAAU,EAAE,UAAU,CAAC,GAAG,EAAE;KAC7B,CAAC,CAAA;IAEF,OAAO;QACL,GAAG;QACH,MAAM;QACN,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,SAAS;QACrB,UAAU;QACV,KAAK;QACL,WAAW,EAAE,KAAK;KACnB,CAAA;AACH,CAAC,CAAA;AAED,MAAM,yBAAyB,GAAG,KAAK,EACrC,GAAe,EACf,KAAkD,EAClD,SAAwB,EACxB,EAAE;IACF,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,KAAK,CAAA;IAC7C,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC,4BAA4B,CAAC,CAAA;IAC7D,CAAC;IAED,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QAC1D,MAAM,IAAI,mBAAmB,CAC3B,wCAAwC,uBAAuB,cAAc,CAC9E,CAAA;IACH,CAAC;IAED,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;QAC5C,MAAM,IAAI,mBAAmB,CAC3B,yBAAyB,EACzB,mBAAmB,CACpB,CAAA;IACH,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;IACpD,CAAC;SAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,mBAAmB,CAC3B,oEAAoE,CACrE,CAAA;IACH,CAAC;IAED,kCAAkC;IAClC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,0BAA0B,CAChE,KAAK,CAAC,MAAM,EACZ,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CACnB,CAAA;IAED,4CAA4C;IAC5C,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,UAAU,EAAE,CAAC;QAC3C,MAAM,GAAG,CAAC,cAAc,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAA;IAC9D,CAAC;IAED,gDAAgD;IAChD,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACjD,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC;QACrC,GAAG,CAAC,cAAc,CAAC,iBAAiB,CAAC,KAAK,CAAC;KAC5C,CAAC,CAAA;IACF,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC,yBAAyB,MAAM,EAAE,CAAC,CAAA;IAClE,CAAC;SAAM,IAAI,SAAS,EAAE,CAAC;QACrB,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,kDAAkD;IAClD,yDAAyD;IACzD,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;IAEtE,IAAI,GAAc,CAAA;IAClB,IAAI,KAA2B,CAAA;IAC/B,IAAI,WAAW,GAAG,KAAK,CAAA;IACvB,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,iBAAiB,CACzB,4CAA4C,KAAK,CAAC,GAAG,EAAE,CACxD,CAAA;QACH,CAAC;QACD,GAAG,GAAG,KAAK,CAAC,GAAG,CAAA;QACf,KAAK,GAAG,IAAI,CAAA;QACZ,WAAW,GAAG,IAAI,CAAA;IACpB,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,CAAA;QACzE,GAAG,GAAG,SAAS,CAAC,GAAgB,CAAA;QAChC,KAAK,GAAG,SAAS,CAAC,EAAE,CAAA;IACtB,CAAC;IAED,OAAO;QACL,GAAG;QACH,MAAM;QACN,KAAK;QACL,QAAQ;QACR,UAAU;QACV,UAAU;QACV,KAAK;QACL,WAAW;KACZ,CAAA;AACH,CAAC,CAAA;AAED,MAAM,iBAAiB,GAAG,KAAK,EAC7B,GAAe,EACf,MAAc,EACd,KAAkD,EAClD,UAAmB,EACnB,EAAE;IACF,wEAAwE;IACxE,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,CAAA;IAC/C,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QACpC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;IACvD,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IACzC,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,CAAC;QAClB,UAAU,EAAE,UAAU,CAAC,GAAG,EAAE;QAC5B,YAAY;QACZ,MAAM;QACN,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS;QAC9B,MAAM,EAAE,GAAG,CAAC,cAAc;KAC3B,CAAC,CAAA;AACJ,CAAC,CAAA;AACD,MAAM,mBAAmB,GAAG,CAC1B,IAAiB,EACjB,QAIC,EACD,EAAE;IACF,yCAAyC;IACzC,qEAAqE;IACrE,mEAAmE;IACnE,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,IAAI,mBAAmB,CAC3B,oDAAoD,EACpD,oBAAoB,CACrB,CAAA;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC;QACrC,MAAM,IAAI,mBAAmB,CAC3B,2DAA2D,EAC3D,oBAAoB,CACrB,CAAA;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;QACnD,MAAM,IAAI,mBAAmB,CAC3B,6DAA6D,EAC7D,oBAAoB,CACrB,CAAA;IACH,CAAC;AACH,CAAC,CAAA","sourcesContent":["import * as plc from '@did-plc/lib'\nimport { isEmailValid } from '@hapi/address'\nimport { isDisposableEmail } from 'disposable-email-domains-js'\nimport { MINUTE, check } from '@atproto/common'\nimport {\n type ExportableKeypair,\n type Keypair,\n Secp256k1Keypair,\n} from '@atproto/crypto'\nimport { type AtprotoData, ensureAtpDocument } from '@atproto/identity'\nimport type { DidString } from '@atproto/syntax'\nimport {\n AuthRequiredError,\n InvalidRequestError,\n type Server,\n} from '@atproto/xrpc-server'\nimport { NEW_PASSWORD_MAX_LENGTH } from '../../../../account-manager/helpers/scrypt.js'\nimport type { AppContext } from '../../../../context.js'\nimport { baseNormalizeAndValidate } from '../../../../handle/index.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { safeResolveDidDoc } from './util.js'\n\nexport default function (server: Server, ctx: AppContext) {\n server.add(com.atproto.server.createAccount, {\n rateLimit: {\n durationMs: 5 * MINUTE,\n points: 100,\n },\n auth: ctx.authVerifier.userServiceAuthOptional,\n handler: async ({\n input,\n auth,\n req,\n }): Promise<com.atproto.server.createAccount.$Output> => {\n // @NOTE Until this code and the OAuthStore's `createAccount` are\n // refactored together, any change made here must be reflected over there.\n\n const requester = auth.credentials?.did ?? null\n const {\n did,\n handle,\n email,\n password,\n inviteCode,\n signingKey,\n plcOp,\n deactivated,\n } = ctx.entrywayClient\n ? await validateInputsForEntrywayPds(ctx, input.body)\n : await validateInputsForLocalPds(ctx, input.body, requester)\n\n await ctx.actorStore.create(did, signingKey)\n\n try {\n const commit = await ctx.actorStore.transact(did, (actorTxn) => {\n return actorTxn.repo.createRepo([])\n })\n\n const canTombstone =\n // @NOTE IMPORTANT Because the user may be bringing their own did, we\n // must make sure not to tombstone their did on failure if we didn't\n // create it here.\n !ctx.entrywayClient && !input.body.did && !!plcOp\n\n // Generate a real did with PLC\n if (plcOp) {\n await ctx.plcClient.sendOperation(did, plcOp)\n }\n\n try {\n const didDoc = await safeResolveDidDoc(ctx, did, true)\n\n const creds = await ctx.accountManager.createAccountAndSession({\n did,\n handle,\n email,\n password,\n repoCid: commit.cid,\n repoRev: commit.rev,\n inviteCode,\n deactivated,\n })\n\n try {\n const sequenceEvt = !deactivated\n if (sequenceEvt) {\n await ctx.sequencer.sequenceAccountCreation(did, handle, commit)\n }\n\n try {\n await ctx.actorStore\n .clearReservedKeypair(signingKey.did(), did)\n .catch((err) => {\n // @NOTE This is a cleanup operation so we won't fail the whole\n // flow if it fails, but we log it just in case\n req.log.error(\n { did, signingKeyDid: signingKey.did(), err },\n 'Failed to clear reserved keypair',\n )\n })\n\n return {\n encoding: 'application/json' as const,\n body: {\n handle,\n did: did,\n // @ts-expect-error https://github.com/bluesky-social/atproto/pull/4406\n didDoc,\n accessJwt: creds.accessJwt,\n refreshJwt: creds.refreshJwt,\n },\n }\n } catch (err) {\n if (sequenceEvt) await ctx.sequencer.sequenceAccountDeletion(did)\n throw err\n }\n } catch (err) {\n await ctx.accountManager.deleteAccount(did)\n throw err\n }\n } catch (err) {\n if (canTombstone) {\n await ctx.plcClient.tombstone(did, ctx.plcRotationKey)\n }\n throw err\n }\n } catch (err) {\n await ctx.actorStore.destroy(did)\n throw err\n }\n },\n })\n}\n\nconst validateInputsForEntrywayPds = async (\n ctx: AppContext,\n input: com.atproto.server.createAccount.$InputBody,\n) => {\n const handle = baseNormalizeAndValidate(input.handle)\n\n const { did, plcOp } = input\n if (!did \|\| !plcOp) {\n throw new InvalidRequestError(\n 'non-entryway pds requires bringing a DID and plcOp',\n )\n }\n if (!check.is(plcOp, plc.def.operation)) {\n throw new InvalidRequestError('invalid plc operation', 'IncompatibleDidDoc')\n }\n const plcRotationKey = ctx.cfg.entryway?.plcRotationKey\n if (!plcRotationKey \|\| !plcOp.rotationKeys.includes(plcRotationKey)) {\n throw new InvalidRequestError(\n 'PLC DID does not include service rotation key',\n 'IncompatibleDidDoc',\n )\n }\n try {\n await plc.assureValidOp(plcOp)\n await plc.assureValidSig([plcRotationKey], plcOp)\n } catch (err) {\n throw new InvalidRequestError('invalid plc operation', 'IncompatibleDidDoc')\n }\n const doc = plc.formatDidDoc({ did, ...plcOp })\n const data = ensureAtpDocument(doc)\n\n let signingKey: ExportableKeypair \| undefined\n if (input.did) {\n signingKey = await ctx.actorStore.getReservedKeypair(input.did)\n }\n if (!signingKey) {\n signingKey = await ctx.actorStore.getReservedKeypair(data.signingKey)\n }\n if (!signingKey) {\n throw new InvalidRequestError('reserved signing key does not exist')\n }\n\n validateAtprotoData(data, {\n handle,\n pds: ctx.cfg.service.publicUrl,\n signingKey: signingKey.did(),\n })\n\n return {\n did,\n handle,\n email: undefined,\n password: undefined,\n inviteCode: undefined,\n signingKey,\n plcOp,\n deactivated: false,\n }\n}\n\nconst validateInputsForLocalPds = async (\n ctx: AppContext,\n input: com.atproto.server.createAccount.$InputBody,\n requester: string \| null,\n) => {\n const { email, password, inviteCode } = input\n if (input.plcOp) {\n throw new InvalidRequestError('Unsupported input: \"plcOp\"')\n }\n\n if (password && password.length > NEW_PASSWORD_MAX_LENGTH) {\n throw new InvalidRequestError(\n `Password too long. Maximum length is ${NEW_PASSWORD_MAX_LENGTH} characters.`,\n )\n }\n\n if (ctx.cfg.invites.required && !inviteCode) {\n throw new InvalidRequestError(\n 'No invite code provided',\n 'InvalidInviteCode',\n )\n }\n\n if (!email) {\n throw new InvalidRequestError('Email is required')\n } else if (!isEmailValid(email) \|\| isDisposableEmail(email)) {\n throw new InvalidRequestError(\n 'This email address is not supported, please use a different email.',\n )\n }\n\n // normalize & ensure valid handle\n const handle = await ctx.accountManager.normalizeAndValidateHandle(\n input.handle,\n { did: input.did },\n )\n\n // check that the invite code still has uses\n if (ctx.cfg.invites.required && inviteCode) {\n await ctx.accountManager.ensureInviteIsAvailable(inviteCode)\n }\n\n // check that the handle and email are available\n const [handleAccnt, emailAcct] = await Promise.all([\n ctx.accountManager.getAccount(handle),\n ctx.accountManager.getAccountByEmail(email),\n ])\n if (handleAccnt) {\n throw new InvalidRequestError(`Handle already taken: ${handle}`)\n } else if (emailAcct) {\n throw new InvalidRequestError(`Email already taken: ${email}`)\n }\n\n // determine the did & any plc ops we need to send\n // if the provided did document is poorly setup, we throw\n const signingKey = await Secp256k1Keypair.create({ exportable: true })\n\n let did: DidString\n let plcOp: plc.Operation \| null\n let deactivated = false\n if (input.did) {\n if (input.did !== requester) {\n throw new AuthRequiredError(\n `Missing auth to create account with did: ${input.did}`,\n )\n }\n did = input.did\n plcOp = null\n deactivated = true\n } else {\n const formatted = await formatDidAndPlcOp(ctx, handle, input, signingKey)\n did = formatted.did as DidString\n plcOp = formatted.op\n }\n\n return {\n did,\n handle,\n email,\n password,\n inviteCode,\n signingKey,\n plcOp,\n deactivated,\n }\n}\n\nconst formatDidAndPlcOp = async (\n ctx: AppContext,\n handle: string,\n input: com.atproto.server.createAccount.$InputBody,\n signingKey: Keypair,\n) => {\n // if the user is not bringing a DID, then we format a create op for PLC\n const rotationKeys = [ctx.plcRotationKey.did()]\n if (ctx.cfg.identity.recoveryDidKey) {\n rotationKeys.unshift(ctx.cfg.identity.recoveryDidKey)\n }\n if (input.recoveryKey) {\n rotationKeys.unshift(input.recoveryKey)\n }\n return plc.createOp({\n signingKey: signingKey.did(),\n rotationKeys,\n handle,\n pds: ctx.cfg.service.publicUrl,\n signer: ctx.plcRotationKey,\n })\n}\nconst validateAtprotoData = (\n data: AtprotoData,\n expected: {\n handle: string\n pds: string\n signingKey: string\n },\n) => {\n // if the user is bringing their own did:\n // resolve the user's did doc data, including rotationKeys if did:plc\n // determine if we have the capability to make changes to their DID\n if (data.handle !== expected.handle) {\n throw new InvalidRequestError(\n 'provided handle does not match DID document handle',\n 'IncompatibleDidDoc',\n )\n } else if (data.pds !== expected.pds) {\n throw new InvalidRequestError(\n 'DID document pds endpoint does not match service endpoint',\n 'IncompatibleDidDoc',\n )\n } else if (data.signingKey !== expected.signingKey) {\n throw new InvalidRequestError(\n 'DID document signing key does not match service signing key',\n 'IncompatibleDidDoc',\n )\n }\n}\n"]}
1	+ {"version":3,"file":"createAccount.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/createAccount.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,cAAc,CAAA;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAC/D,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,EAGL,gBAAgB,GACjB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAoB,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAEvE,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GAEpB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAA;AAEvF,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAA;AACtE,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAE7C,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;QAC3C,SAAS,EAAE;YACT,UAAU,EAAE,CAAC,GAAG,MAAM;YACtB,MAAM,EAAE,GAAG;SACZ;QACD,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,uBAAuB;QAC9C,OAAO,EAAE,KAAK,EAAE,EACd,KAAK,EACL,IAAI,EACJ,GAAG,GACJ,EAAqD,EAAE;YACtD,iEAAiE;YACjE,0EAA0E;YAE1E,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,GAAG,IAAI,IAAI,CAAA;YAC/C,MAAM,EACJ,GAAG,EACH,MAAM,EACN,KAAK,EACL,QAAQ,EACR,UAAU,EACV,UAAU,EACV,KAAK,EACL,WAAW,GACZ,GAAG,GAAG,CAAC,cAAc;gBACpB,CAAC,CAAC,MAAM,4BAA4B,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC;gBACrD,CAAC,CAAC,MAAM,yBAAyB,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;YAE/D,MAAM,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;YAE5C,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE;oBAC7D,OAAO,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;gBACrC,CAAC,CAAC,CAAA;gBAEF,MAAM,YAAY;gBAChB,qEAAqE;gBACrE,oEAAoE;gBACpE,kBAAkB;gBAClB,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAA;gBAEnD,+BAA+B;gBAC/B,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;gBAC/C,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;oBAEtD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,uBAAuB,CAAC;wBAC7D,GAAG;wBACH,MAAM;wBACN,KAAK;wBACL,QAAQ;wBACR,OAAO,EAAE,MAAM,CAAC,GAAG;wBACnB,OAAO,EAAE,MAAM,CAAC,GAAG;wBACnB,UAAU;wBACV,WAAW;qBACZ,CAAC,CAAA;oBAEF,IAAI,CAAC;wBACH,MAAM,WAAW,GAAG,CAAC,WAAW,CAAA;wBAChC,IAAI,WAAW,EAAE,CAAC;4BAChB,MAAM,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;wBAClE,CAAC;wBAED,IAAI,CAAC;4BACH,MAAM,GAAG,CAAC,UAAU;iCACjB,oBAAoB,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC;iCAC3C,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gCACb,+DAA+D;gCAC/D,+CAA+C;gCAC/C,GAAG,CAAC,GAAG,CAAC,KAAK,CACX,EAAE,GAAG,EAAE,aAAa,EAAE,UAAU,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,EAC7C,kCAAkC,CACnC,CAAA;4BACH,CAAC,CAAC,CAAA;4BAEJ,MAAM,CAAC,cAAc,CAAC;gCACpB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI;gCAC7C,GAAG;gCACH,OAAO,EAAE,CAAC,CAAC,UAAU;gCACrB,WAAW;6BACZ,CAAC,CAAA;4BACF,MAAM,CAAC,cAAc,CAAC;gCACpB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI;gCAC7C,GAAG;6BACJ,CAAC,CAAA;4BAEF,OAAO;gCACL,QAAQ,EAAE,kBAA2B;gCACrC,IAAI,EAAE;oCACJ,MAAM;oCACN,GAAG,EAAE,GAAG;oCACR,uEAAuE;oCACvE,MAAM;oCACN,SAAS,EAAE,KAAK,CAAC,SAAS;oCAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;iCAC7B;6BACF,CAAA;wBACH,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,IAAI,WAAW;gCAAE,MAAM,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;4BACjE,MAAM,GAAG,CAAA;wBACX,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,GAAG,CAAC,cAAc,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;wBAC3C,MAAM,GAAG,CAAA;oBACX,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,YAAY,EAAE,CAAC;wBACjB,MAAM,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,cAAc,CAAC,CAAA;oBACxD,CAAC;oBACD,MAAM,GAAG,CAAA;gBACX,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;gBACjC,MAAM,GAAG,CAAA;YACX,CAAC;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,4BAA4B,GAAG,KAAK,EACxC,GAAe,EACf,KAAkD,EAClD,EAAE;IACF,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAErD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,KAAK,CAAA;IAC5B,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,mBAAmB,CAC3B,oDAAoD,CACrD,CAAA;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,EAAE,oBAAoB,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,cAAc,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAA;IACvD,IAAI,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,mBAAmB,CAC3B,+CAA+C,EAC/C,oBAAoB,CACrB,CAAA;IACH,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;QAC9B,MAAM,GAAG,CAAC,cAAc,CAAC,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAA;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,EAAE,oBAAoB,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAA;IAC/C,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;IAEnC,IAAI,UAAyC,CAAA;IAC7C,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACjE,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACvE,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC,qCAAqC,CAAC,CAAA;IACtE,CAAC;IAED,mBAAmB,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS;QAC9B,UAAU,EAAE,UAAU,CAAC,GAAG,EAAE;KAC7B,CAAC,CAAA;IAEF,OAAO;QACL,GAAG;QACH,MAAM;QACN,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,SAAS;QACrB,UAAU;QACV,KAAK;QACL,WAAW,EAAE,KAAK;KACnB,CAAA;AACH,CAAC,CAAA;AAED,MAAM,yBAAyB,GAAG,KAAK,EACrC,GAAe,EACf,KAAkD,EAClD,SAAwB,EACxB,EAAE;IACF,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,KAAK,CAAA;IAC7C,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC,4BAA4B,CAAC,CAAA;IAC7D,CAAC;IAED,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QAC1D,MAAM,IAAI,mBAAmB,CAC3B,wCAAwC,uBAAuB,cAAc,CAC9E,CAAA;IACH,CAAC;IAED,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;QAC5C,MAAM,IAAI,mBAAmB,CAC3B,yBAAyB,EACzB,mBAAmB,CACpB,CAAA;IACH,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;IACpD,CAAC;SAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,mBAAmB,CAC3B,oEAAoE,CACrE,CAAA;IACH,CAAC;IAED,kCAAkC;IAClC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,0BAA0B,CAChE,KAAK,CAAC,MAAM,EACZ,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CACnB,CAAA;IAED,4CAA4C;IAC5C,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,UAAU,EAAE,CAAC;QAC3C,MAAM,GAAG,CAAC,cAAc,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAA;IAC9D,CAAC;IAED,gDAAgD;IAChD,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACjD,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC;QACrC,GAAG,CAAC,cAAc,CAAC,iBAAiB,CAAC,KAAK,CAAC;KAC5C,CAAC,CAAA;IACF,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC,yBAAyB,MAAM,EAAE,CAAC,CAAA;IAClE,CAAC;SAAM,IAAI,SAAS,EAAE,CAAC;QACrB,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,kDAAkD;IAClD,yDAAyD;IACzD,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;IAEtE,IAAI,GAAc,CAAA;IAClB,IAAI,KAA2B,CAAA;IAC/B,IAAI,WAAW,GAAG,KAAK,CAAA;IACvB,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,iBAAiB,CACzB,4CAA4C,KAAK,CAAC,GAAG,EAAE,CACxD,CAAA;QACH,CAAC;QACD,GAAG,GAAG,KAAK,CAAC,GAAG,CAAA;QACf,KAAK,GAAG,IAAI,CAAA;QACZ,WAAW,GAAG,IAAI,CAAA;IACpB,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,CAAA;QACzE,GAAG,GAAG,SAAS,CAAC,GAAgB,CAAA;QAChC,KAAK,GAAG,SAAS,CAAC,EAAE,CAAA;IACtB,CAAC;IAED,OAAO;QACL,GAAG;QACH,MAAM;QACN,KAAK;QACL,QAAQ;QACR,UAAU;QACV,UAAU;QACV,KAAK;QACL,WAAW;KACZ,CAAA;AACH,CAAC,CAAA;AAED,MAAM,iBAAiB,GAAG,KAAK,EAC7B,GAAe,EACf,MAAc,EACd,KAAkD,EAClD,UAAmB,EACnB,EAAE;IACF,wEAAwE;IACxE,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,CAAA;IAC/C,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QACpC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;IACvD,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IACzC,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,CAAC;QAClB,UAAU,EAAE,UAAU,CAAC,GAAG,EAAE;QAC5B,YAAY;QACZ,MAAM;QACN,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS;QAC9B,MAAM,EAAE,GAAG,CAAC,cAAc;KAC3B,CAAC,CAAA;AACJ,CAAC,CAAA;AACD,MAAM,mBAAmB,GAAG,CAC1B,IAAiB,EACjB,QAIC,EACD,EAAE;IACF,yCAAyC;IACzC,qEAAqE;IACrE,mEAAmE;IACnE,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,IAAI,mBAAmB,CAC3B,oDAAoD,EACpD,oBAAoB,CACrB,CAAA;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC;QACrC,MAAM,IAAI,mBAAmB,CAC3B,2DAA2D,EAC3D,oBAAoB,CACrB,CAAA;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;QACnD,MAAM,IAAI,mBAAmB,CAC3B,6DAA6D,EAC7D,oBAAoB,CACrB,CAAA;IACH,CAAC;AACH,CAAC,CAAA","sourcesContent":["import * as plc from '@did-plc/lib'\nimport { isEmailValid } from '@hapi/address'\nimport { isDisposableEmail } from 'disposable-email-domains-js'\nimport { MINUTE, check } from '@atproto/common'\nimport {\n type ExportableKeypair,\n type Keypair,\n Secp256k1Keypair,\n} from '@atproto/crypto'\nimport { type AtprotoData, ensureAtpDocument } from '@atproto/identity'\nimport type { DidString } from '@atproto/syntax'\nimport {\n AuthRequiredError,\n InvalidRequestError,\n type Server,\n} from '@atproto/xrpc-server'\nimport { NEW_PASSWORD_MAX_LENGTH } from '../../../../account-manager/helpers/scrypt.js'\nimport type { AppContext } from '../../../../context.js'\nimport { events } from '../../../../events.js'\nimport { baseNormalizeAndValidate } from '../../../../handle/index.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { safeResolveDidDoc } from './util.js'\n\nexport default function (server: Server, ctx: AppContext) {\n server.add(com.atproto.server.createAccount, {\n rateLimit: {\n durationMs: 5 * MINUTE,\n points: 100,\n },\n auth: ctx.authVerifier.userServiceAuthOptional,\n handler: async ({\n input,\n auth,\n req,\n }): Promise<com.atproto.server.createAccount.$Output> => {\n // @NOTE Until this code and the OAuthStore's `createAccount` are\n // refactored together, any change made here must be reflected over there.\n\n const requester = auth.credentials?.did ?? null\n const {\n did,\n handle,\n email,\n password,\n inviteCode,\n signingKey,\n plcOp,\n deactivated,\n } = ctx.entrywayClient\n ? await validateInputsForEntrywayPds(ctx, input.body)\n : await validateInputsForLocalPds(ctx, input.body, requester)\n\n await ctx.actorStore.create(did, signingKey)\n\n try {\n const commit = await ctx.actorStore.transact(did, (actorTxn) => {\n return actorTxn.repo.createRepo([])\n })\n\n const canTombstone =\n // @NOTE IMPORTANT Because the user may be bringing their own did, we\n // must make sure not to tombstone their did on failure if we didn't\n // create it here.\n !ctx.entrywayClient && !input.body.did && !!plcOp\n\n // Generate a real did with PLC\n if (plcOp) {\n await ctx.plcClient.sendOperation(did, plcOp)\n }\n\n try {\n const didDoc = await safeResolveDidDoc(ctx, did, true)\n\n const creds = await ctx.accountManager.createAccountAndSession({\n did,\n handle,\n email,\n password,\n repoCid: commit.cid,\n repoRev: commit.rev,\n inviteCode,\n deactivated,\n })\n\n try {\n const sequenceEvt = !deactivated\n if (sequenceEvt) {\n await ctx.sequencer.sequenceAccountCreation(did, handle, commit)\n }\n\n try {\n await ctx.actorStore\n .clearReservedKeypair(signingKey.did(), did)\n .catch((err) => {\n // @NOTE This is a cleanup operation so we won't fail the whole\n // flow if it fails, but we log it just in case\n req.log.error(\n { did, signingKeyDid: signingKey.did(), err },\n 'Failed to clear reserved keypair',\n )\n })\n\n events.accountCreated({\n source: com.atproto.server.createAccount.$lxm,\n did,\n invited: !!inviteCode,\n deactivated,\n })\n events.sessionCreated({\n source: com.atproto.server.createAccount.$lxm,\n did,\n })\n\n return {\n encoding: 'application/json' as const,\n body: {\n handle,\n did: did,\n // @ts-expect-error https://github.com/bluesky-social/atproto/pull/4406\n didDoc,\n accessJwt: creds.accessJwt,\n refreshJwt: creds.refreshJwt,\n },\n }\n } catch (err) {\n if (sequenceEvt) await ctx.sequencer.sequenceAccountDeletion(did)\n throw err\n }\n } catch (err) {\n await ctx.accountManager.deleteAccount(did)\n throw err\n }\n } catch (err) {\n if (canTombstone) {\n await ctx.plcClient.tombstone(did, ctx.plcRotationKey)\n }\n throw err\n }\n } catch (err) {\n await ctx.actorStore.destroy(did)\n throw err\n }\n },\n })\n}\n\nconst validateInputsForEntrywayPds = async (\n ctx: AppContext,\n input: com.atproto.server.createAccount.$InputBody,\n) => {\n const handle = baseNormalizeAndValidate(input.handle)\n\n const { did, plcOp } = input\n if (!did \|\| !plcOp) {\n throw new InvalidRequestError(\n 'non-entryway pds requires bringing a DID and plcOp',\n )\n }\n if (!check.is(plcOp, plc.def.operation)) {\n throw new InvalidRequestError('invalid plc operation', 'IncompatibleDidDoc')\n }\n const plcRotationKey = ctx.cfg.entryway?.plcRotationKey\n if (!plcRotationKey \|\| !plcOp.rotationKeys.includes(plcRotationKey)) {\n throw new InvalidRequestError(\n 'PLC DID does not include service rotation key',\n 'IncompatibleDidDoc',\n )\n }\n try {\n await plc.assureValidOp(plcOp)\n await plc.assureValidSig([plcRotationKey], plcOp)\n } catch (err) {\n throw new InvalidRequestError('invalid plc operation', 'IncompatibleDidDoc')\n }\n const doc = plc.formatDidDoc({ did, ...plcOp })\n const data = ensureAtpDocument(doc)\n\n let signingKey: ExportableKeypair \| undefined\n if (input.did) {\n signingKey = await ctx.actorStore.getReservedKeypair(input.did)\n }\n if (!signingKey) {\n signingKey = await ctx.actorStore.getReservedKeypair(data.signingKey)\n }\n if (!signingKey) {\n throw new InvalidRequestError('reserved signing key does not exist')\n }\n\n validateAtprotoData(data, {\n handle,\n pds: ctx.cfg.service.publicUrl,\n signingKey: signingKey.did(),\n })\n\n return {\n did,\n handle,\n email: undefined,\n password: undefined,\n inviteCode: undefined,\n signingKey,\n plcOp,\n deactivated: false,\n }\n}\n\nconst validateInputsForLocalPds = async (\n ctx: AppContext,\n input: com.atproto.server.createAccount.$InputBody,\n requester: string \| null,\n) => {\n const { email, password, inviteCode } = input\n if (input.plcOp) {\n throw new InvalidRequestError('Unsupported input: \"plcOp\"')\n }\n\n if (password && password.length > NEW_PASSWORD_MAX_LENGTH) {\n throw new InvalidRequestError(\n `Password too long. Maximum length is ${NEW_PASSWORD_MAX_LENGTH} characters.`,\n )\n }\n\n if (ctx.cfg.invites.required && !inviteCode) {\n throw new InvalidRequestError(\n 'No invite code provided',\n 'InvalidInviteCode',\n )\n }\n\n if (!email) {\n throw new InvalidRequestError('Email is required')\n } else if (!isEmailValid(email) \|\| isDisposableEmail(email)) {\n throw new InvalidRequestError(\n 'This email address is not supported, please use a different email.',\n )\n }\n\n // normalize & ensure valid handle\n const handle = await ctx.accountManager.normalizeAndValidateHandle(\n input.handle,\n { did: input.did },\n )\n\n // check that the invite code still has uses\n if (ctx.cfg.invites.required && inviteCode) {\n await ctx.accountManager.ensureInviteIsAvailable(inviteCode)\n }\n\n // check that the handle and email are available\n const [handleAccnt, emailAcct] = await Promise.all([\n ctx.accountManager.getAccount(handle),\n ctx.accountManager.getAccountByEmail(email),\n ])\n if (handleAccnt) {\n throw new InvalidRequestError(`Handle already taken: ${handle}`)\n } else if (emailAcct) {\n throw new InvalidRequestError(`Email already taken: ${email}`)\n }\n\n // determine the did & any plc ops we need to send\n // if the provided did document is poorly setup, we throw\n const signingKey = await Secp256k1Keypair.create({ exportable: true })\n\n let did: DidString\n let plcOp: plc.Operation \| null\n let deactivated = false\n if (input.did) {\n if (input.did !== requester) {\n throw new AuthRequiredError(\n `Missing auth to create account with did: ${input.did}`,\n )\n }\n did = input.did\n plcOp = null\n deactivated = true\n } else {\n const formatted = await formatDidAndPlcOp(ctx, handle, input, signingKey)\n did = formatted.did as DidString\n plcOp = formatted.op\n }\n\n return {\n did,\n handle,\n email,\n password,\n inviteCode,\n signingKey,\n plcOp,\n deactivated,\n }\n}\n\nconst formatDidAndPlcOp = async (\n ctx: AppContext,\n handle: string,\n input: com.atproto.server.createAccount.$InputBody,\n signingKey: Keypair,\n) => {\n // if the user is not bringing a DID, then we format a create op for PLC\n const rotationKeys = [ctx.plcRotationKey.did()]\n if (ctx.cfg.identity.recoveryDidKey) {\n rotationKeys.unshift(ctx.cfg.identity.recoveryDidKey)\n }\n if (input.recoveryKey) {\n rotationKeys.unshift(input.recoveryKey)\n }\n return plc.createOp({\n signingKey: signingKey.did(),\n rotationKeys,\n handle,\n pds: ctx.cfg.service.publicUrl,\n signer: ctx.plcRotationKey,\n })\n}\nconst validateAtprotoData = (\n data: AtprotoData,\n expected: {\n handle: string\n pds: string\n signingKey: string\n },\n) => {\n // if the user is bringing their own did:\n // resolve the user's did doc data, including rotationKeys if did:plc\n // determine if we have the capability to make changes to their DID\n if (data.handle !== expected.handle) {\n throw new InvalidRequestError(\n 'provided handle does not match DID document handle',\n 'IncompatibleDidDoc',\n )\n } else if (data.pds !== expected.pds) {\n throw new InvalidRequestError(\n 'DID document pds endpoint does not match service endpoint',\n 'IncompatibleDidDoc',\n )\n } else if (data.signingKey !== expected.signingKey) {\n throw new InvalidRequestError(\n 'DID document signing key does not match service signing key',\n 'IncompatibleDidDoc',\n )\n }\n}\n"]}

package/dist/api/com/atproto/server/createSession.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"createSession.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/createSession.ts"],"names":[],"mappings":"AAMA,OAAO,EAGL,KAAK,MAAM,EACZ,MAAM,sBAAsB,CAAA;AAG7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;~~AAIxD~~,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,~~QAmFvD~~"}
1	+ {"version":3,"file":"createSession.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/createSession.ts"],"names":[],"mappings":"AAMA,OAAO,EAGL,KAAK,MAAM,EACZ,MAAM,sBAAsB,CAAA;AAG7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAKxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAwFvD"}

package/dist/api/com/atproto/server/createSession.js CHANGED Viewed

@@ -3,6 +3,7 @@ import { INVALID_HANDLE, } from '@atproto/syntax';
 import { AuthRequiredError, } from '@atproto/xrpc-server';
 import { formatAccountStatus } from '../../../../account-manager/account-manager.js';
 import { OLD_PASSWORD_MAX_LENGTH } from '../../../../account-manager/helpers/scrypt.js';
+import { events } from '../../../../events.js';
 import { com } from '../../../../lexicons/index.js';
 import { didDocForSession } from './util.js';
 export default function (server, ctx) {
@@ -47,6 +48,10 @@ export default function (server, ctx) {
                     didDocForSession(ctx, user.did),
                 ]);
                 const { status, active } = formatAccountStatus(user);
+                events.sessionCreated({
+                    source: com.atproto.server.createSession.$lxm,
+                    did: user.did,
+                });
                 return {
                     encoding: 'application/json',
                     body: {

package/dist/api/com/atproto/server/createSession.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"createSession.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/createSession.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,EAGL,cAAc,GACf,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,iBAAiB,GAGlB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAA;AACpF,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAA;AAEvF,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAE5C,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,EAAE,cAAc,EAAE,GAAG,GAAG,CAAA;IAE9B,MAAM,SAAS,GAIX;QACF;YACE,UAAU,EAAE,GAAG;YACf,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC,EAAE,EAAE;SAClE;QACD;YACE,UAAU,EAAE,CAAC,GAAG,MAAM;YACtB,MAAM,EAAE,EAAE;YACV,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC,EAAE,EAAE;SAClE;KACF,CAAA;IAED,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;YAC3C,SAAS;YACT,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;gBAC1C,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;gBACpD,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;oBAC3D,OAAO;oBACP,IAAI;iBACL,CAAC,CAAA;YACJ,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;YAC3C,SAAS;YACT,OAAO,EAAE,KAAK,EAAE,EACd,KAAK,EAAE,EAAE,IAAI,EAAE,GAChB,EAAqD,EAAE;gBACtD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;oBACnD,MAAM,IAAI,iBAAiB,CACzB,sDAAsD,CACvD,CAAA;gBACH,CAAC;gBAED,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,GACxC,MAAM,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;gBAEtC,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,aAAa,EAAE,CAAC;oBAC1C,MAAM,IAAI,iBAAiB,CACzB,6BAA6B,EAC7B,iBAAiB,CAClB,CAAA;gBACH,CAAC;gBAED,MAAM,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBAC5D,GAAG,CAAC,cAAc,CAAC,aAAa,CAC9B,IAAI,CAAC,GAAG,EACR,WAAW,EACX,aAAa,CACd;oBACD,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;iBAChC,CAAC,CAAA;gBAEF,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;gBAEpD,OAAO;oBACL,QAAQ,EAAE,kBAAkB;oBAC5B,IAAI,EAAE;wBACJ,SAAS;wBACT,UAAU;wBAEV,GAAG,EAAE,IAAI,CAAC,GAAgB;wBAC1B,uEAAuE;wBACvE,MAAM;wBACN,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,cAAc,CAAiB;wBACvD,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;wBAC9B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB;wBACvC,MAAM;wBACN,MAAM;qBACP;iBACF,CAAA;YACH,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { DAY, MINUTE } from '@atproto/common'\nimport {\n type DidString,\n type HandleString,\n INVALID_HANDLE,\n} from '@atproto/syntax'\nimport {\n AuthRequiredError,\n type MethodRateLimit,\n type Server,\n} from '@atproto/xrpc-server'\nimport { formatAccountStatus } from '../../../../account-manager/account-manager.js'\nimport { OLD_PASSWORD_MAX_LENGTH } from '../../../../account-manager/helpers/scrypt.js'\nimport type { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { didDocForSession } from './util.js'\n\nexport default function (server: Server, ctx: AppContext) {\n const { entrywayClient } = ctx\n\n const rateLimit: MethodRateLimit<\n void,\n com.atproto.server.createSession.$Params,\n com.atproto.server.createSession.$Input\n > = [\n {\n durationMs: DAY,\n points: 300,\n calcKey: ({ input, req }) => `${input.body.identifier}-${req.ip}`,\n },\n {\n durationMs: 5 * MINUTE,\n points: 30,\n calcKey: ({ input, req }) => `${input.body.identifier}-${req.ip}`,\n },\n ]\n\n if (entrywayClient) {\n server.add(com.atproto.server.createSession, {\n rateLimit,\n handler: async ({ input: { body }, req }) => {\n const { headers } = ctx.entrywayPassthruHeaders(req)\n return entrywayClient.xrpc(com.atproto.server.createSession, {\n headers,\n body,\n })\n },\n })\n } else {\n server.add(com.atproto.server.createSession, {\n rateLimit,\n handler: async ({\n input: { body },\n }): Promise<com.atproto.server.createSession.$Output> => {\n if (body.password.length > OLD_PASSWORD_MAX_LENGTH) {\n throw new AuthRequiredError(\n 'Password too long. Consider resetting your password.',\n )\n }\n\n const { user, isSoftDeleted, appPassword } =\n await ctx.accountManager.login(body)\n\n if (!body.allowTakendown && isSoftDeleted) {\n throw new AuthRequiredError(\n 'Account has been taken down',\n 'AccountTakedown',\n )\n }\n\n const [{ accessJwt, refreshJwt }, didDoc] = await Promise.all([\n ctx.accountManager.createSession(\n user.did,\n appPassword,\n isSoftDeleted,\n ),\n didDocForSession(ctx, user.did),\n ])\n\n const { status, active } = formatAccountStatus(user)\n\n return {\n encoding: 'application/json',\n body: {\n accessJwt,\n refreshJwt,\n\n did: user.did as DidString,\n // @ts-expect-error https://github.com/bluesky-social/atproto/pull/4406\n didDoc,\n handle: (user.handle ?? INVALID_HANDLE) as HandleString,\n email: user.email ?? undefined,\n emailConfirmed: !!user.emailConfirmedAt,\n active,\n status,\n },\n }\n },\n })\n }\n}\n"]}
1	+ {"version":3,"file":"createSession.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/createSession.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,EAGL,cAAc,GACf,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,iBAAiB,GAGlB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAA;AACpF,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAA;AAEvF,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAE5C,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,EAAE,cAAc,EAAE,GAAG,GAAG,CAAA;IAE9B,MAAM,SAAS,GAIX;QACF;YACE,UAAU,EAAE,GAAG;YACf,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC,EAAE,EAAE;SAClE;QACD;YACE,UAAU,EAAE,CAAC,GAAG,MAAM;YACtB,MAAM,EAAE,EAAE;YACV,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC,EAAE,EAAE;SAClE;KACF,CAAA;IAED,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;YAC3C,SAAS;YACT,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;gBAC1C,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;gBACpD,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;oBAC3D,OAAO;oBACP,IAAI;iBACL,CAAC,CAAA;YACJ,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;YAC3C,SAAS;YACT,OAAO,EAAE,KAAK,EAAE,EACd,KAAK,EAAE,EAAE,IAAI,EAAE,GAChB,EAAqD,EAAE;gBACtD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;oBACnD,MAAM,IAAI,iBAAiB,CACzB,sDAAsD,CACvD,CAAA;gBACH,CAAC;gBAED,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,GACxC,MAAM,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;gBAEtC,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,aAAa,EAAE,CAAC;oBAC1C,MAAM,IAAI,iBAAiB,CACzB,6BAA6B,EAC7B,iBAAiB,CAClB,CAAA;gBACH,CAAC;gBAED,MAAM,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBAC5D,GAAG,CAAC,cAAc,CAAC,aAAa,CAC9B,IAAI,CAAC,GAAG,EACR,WAAW,EACX,aAAa,CACd;oBACD,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;iBAChC,CAAC,CAAA;gBAEF,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;gBAEpD,MAAM,CAAC,cAAc,CAAC;oBACpB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI;oBAC7C,GAAG,EAAE,IAAI,CAAC,GAAG;iBACd,CAAC,CAAA;gBAEF,OAAO;oBACL,QAAQ,EAAE,kBAAkB;oBAC5B,IAAI,EAAE;wBACJ,SAAS;wBACT,UAAU;wBAEV,GAAG,EAAE,IAAI,CAAC,GAAgB;wBAC1B,uEAAuE;wBACvE,MAAM;wBACN,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,cAAc,CAAiB;wBACvD,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;wBAC9B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB;wBACvC,MAAM;wBACN,MAAM;qBACP;iBACF,CAAA;YACH,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { DAY, MINUTE } from '@atproto/common'\nimport {\n type DidString,\n type HandleString,\n INVALID_HANDLE,\n} from '@atproto/syntax'\nimport {\n AuthRequiredError,\n type MethodRateLimit,\n type Server,\n} from '@atproto/xrpc-server'\nimport { formatAccountStatus } from '../../../../account-manager/account-manager.js'\nimport { OLD_PASSWORD_MAX_LENGTH } from '../../../../account-manager/helpers/scrypt.js'\nimport type { AppContext } from '../../../../context.js'\nimport { events } from '../../../../events.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { didDocForSession } from './util.js'\n\nexport default function (server: Server, ctx: AppContext) {\n const { entrywayClient } = ctx\n\n const rateLimit: MethodRateLimit<\n void,\n com.atproto.server.createSession.$Params,\n com.atproto.server.createSession.$Input\n > = [\n {\n durationMs: DAY,\n points: 300,\n calcKey: ({ input, req }) => `${input.body.identifier}-${req.ip}`,\n },\n {\n durationMs: 5 * MINUTE,\n points: 30,\n calcKey: ({ input, req }) => `${input.body.identifier}-${req.ip}`,\n },\n ]\n\n if (entrywayClient) {\n server.add(com.atproto.server.createSession, {\n rateLimit,\n handler: async ({ input: { body }, req }) => {\n const { headers } = ctx.entrywayPassthruHeaders(req)\n return entrywayClient.xrpc(com.atproto.server.createSession, {\n headers,\n body,\n })\n },\n })\n } else {\n server.add(com.atproto.server.createSession, {\n rateLimit,\n handler: async ({\n input: { body },\n }): Promise<com.atproto.server.createSession.$Output> => {\n if (body.password.length > OLD_PASSWORD_MAX_LENGTH) {\n throw new AuthRequiredError(\n 'Password too long. Consider resetting your password.',\n )\n }\n\n const { user, isSoftDeleted, appPassword } =\n await ctx.accountManager.login(body)\n\n if (!body.allowTakendown && isSoftDeleted) {\n throw new AuthRequiredError(\n 'Account has been taken down',\n 'AccountTakedown',\n )\n }\n\n const [{ accessJwt, refreshJwt }, didDoc] = await Promise.all([\n ctx.accountManager.createSession(\n user.did,\n appPassword,\n isSoftDeleted,\n ),\n didDocForSession(ctx, user.did),\n ])\n\n const { status, active } = formatAccountStatus(user)\n\n events.sessionCreated({\n source: com.atproto.server.createSession.$lxm,\n did: user.did,\n })\n\n return {\n encoding: 'application/json',\n body: {\n accessJwt,\n refreshJwt,\n\n did: user.did as DidString,\n // @ts-expect-error https://github.com/bluesky-social/atproto/pull/4406\n didDoc,\n handle: (user.handle ?? INVALID_HANDLE) as HandleString,\n email: user.email ?? undefined,\n emailConfirmed: !!user.emailConfirmedAt,\n active,\n status,\n },\n }\n },\n })\n }\n}\n"]}

package/dist/api/com/atproto/server/refreshSession.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"refreshSession.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/refreshSession.ts"],"names":[],"mappings":"AAKA,OAAO,EAGL,KAAK,MAAM,EACZ,MAAM,sBAAsB,CAAA;AAE7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;~~AAKxD~~,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,~~QA2DvD~~"}
1	+ {"version":3,"file":"refreshSession.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/refreshSession.ts"],"names":[],"mappings":"AAKA,OAAO,EAGL,KAAK,MAAM,EACZ,MAAM,sBAAsB,CAAA;AAE7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAMxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAgEvD"}

package/dist/api/com/atproto/server/refreshSession.js CHANGED Viewed

@@ -2,6 +2,7 @@ import { INVALID_HANDLE, } from '@atproto/syntax';
 import { AuthRequiredError, InvalidRequestError, } from '@atproto/xrpc-server';
 import { formatAccountStatus } from '../../../../account-manager/account-manager.js';
 import { softDeleted } from '../../../../db/util.js';
+import { events } from '../../../../events.js';
 import { com } from '../../../../lexicons/index.js';
 import { didDocForSession } from './util.js';
 export default function (server, ctx) {
@@ -33,6 +34,10 @@ export default function (server, ctx) {
                 throw new InvalidRequestError('Token has been revoked', 'ExpiredToken');
             }
             const { status, active } = formatAccountStatus(user);
+            events.sessionRefreshed({
+                source: com.atproto.server.refreshSession.$lxm,
+                did: user.did,
+            });
             return {
                 encoding: 'application/json',
                 body: {

package/dist/api/com/atproto/server/refreshSession.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"refreshSession.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/refreshSession.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,cAAc,GACf,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GAEpB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAA;AAEpF,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAE5C,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE;QAC5C,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE;QAChC,OAAO,EAAE,KAAK,EAAE,EACd,IAAI,EACJ,GAAG,GACJ,EAAsD,EAAE;YACvD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAA;YAChC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE;gBACpD,kBAAkB,EAAE,IAAI;gBACxB,gBAAgB,EAAE,IAAI;aACvB,CAAC,CAAA;YACF,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,mBAAmB,CAC3B,yCAAyC,GAAG,EAAE,CAC/C,CAAA;YACH,CAAC;YACD,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,iBAAiB,CACzB,6BAA6B,EAC7B,iBAAiB,CAClB,CAAA;YACH,CAAC;YAED,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;gBACvB,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;gBACpD,OAAO,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE;oBAChE,OAAO;iBACR,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC1C,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;gBAC/B,GAAG,CAAC,cAAc,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;aAChE,CAAC,CAAA;YACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,EAAE,cAAc,CAAC,CAAA;YACzE,CAAC;YAED,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;YAEpD,OAAO;gBACL,QAAQ,EAAE,kBAA2B;gBACrC,IAAI,EAAE;oBACJ,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;oBAE9B,GAAG,EAAE,IAAI,CAAC,GAAgB;oBAC1B,uEAAuE;oBACvE,MAAM;oBACN,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,cAAc,CAAiB;oBACvD,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;oBAC9B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB;oBACvC,MAAM;oBACN,MAAM;iBACP;aACF,CAAA;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import {\n type DidString,\n type HandleString,\n INVALID_HANDLE,\n} from '@atproto/syntax'\nimport {\n AuthRequiredError,\n InvalidRequestError,\n type Server,\n} from '@atproto/xrpc-server'\nimport { formatAccountStatus } from '../../../../account-manager/account-manager.js'\nimport type { AppContext } from '../../../../context.js'\nimport { softDeleted } from '../../../../db/util.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { didDocForSession } from './util.js'\n\nexport default function (server: Server, ctx: AppContext) {\n server.add(com.atproto.server.refreshSession, {\n auth: ctx.authVerifier.refresh(),\n handler: async ({\n auth,\n req,\n }): Promise<com.atproto.server.refreshSession.$Output> => {\n const did = auth.credentials.did\n const user = await ctx.accountManager.getAccount(did, {\n includeDeactivated: true,\n includeTakenDown: true,\n })\n if (!user) {\n throw new InvalidRequestError(\n `Could not find user info for account: ${did}`,\n )\n }\n if (softDeleted(user)) {\n throw new AuthRequiredError(\n 'Account has been taken down',\n 'AccountTakedown',\n )\n }\n\n if (ctx.entrywayClient) {\n const { headers } = ctx.entrywayPassthruHeaders(req)\n return ctx.entrywayClient.xrpc(com.atproto.server.refreshSession, {\n headers,\n })\n }\n\n const [didDoc, rotated] = await Promise.all([\n didDocForSession(ctx, user.did),\n ctx.accountManager.rotateRefreshToken(auth.credentials.tokenId),\n ])\n if (rotated === null) {\n throw new InvalidRequestError('Token has been revoked', 'ExpiredToken')\n }\n\n const { status, active } = formatAccountStatus(user)\n\n return {\n encoding: 'application/json' as const,\n body: {\n accessJwt: rotated.accessJwt,\n refreshJwt: rotated.refreshJwt,\n\n did: user.did as DidString,\n // @ts-expect-error https://github.com/bluesky-social/atproto/pull/4406\n didDoc,\n handle: (user.handle ?? INVALID_HANDLE) as HandleString,\n email: user.email ?? undefined,\n emailConfirmed: !!user.emailConfirmedAt,\n active,\n status,\n },\n }\n },\n })\n}\n"]}
1	+ {"version":3,"file":"refreshSession.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/refreshSession.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,cAAc,GACf,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GAEpB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAA;AAEpF,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAE5C,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE;QAC5C,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE;QAChC,OAAO,EAAE,KAAK,EAAE,EACd,IAAI,EACJ,GAAG,GACJ,EAAsD,EAAE;YACvD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAA;YAChC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE;gBACpD,kBAAkB,EAAE,IAAI;gBACxB,gBAAgB,EAAE,IAAI;aACvB,CAAC,CAAA;YACF,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,mBAAmB,CAC3B,yCAAyC,GAAG,EAAE,CAC/C,CAAA;YACH,CAAC;YACD,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,iBAAiB,CACzB,6BAA6B,EAC7B,iBAAiB,CAClB,CAAA;YACH,CAAC;YAED,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;gBACvB,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;gBACpD,OAAO,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE;oBAChE,OAAO;iBACR,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC1C,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;gBAC/B,GAAG,CAAC,cAAc,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;aAChE,CAAC,CAAA;YACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,EAAE,cAAc,CAAC,CAAA;YACzE,CAAC;YAED,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;YAEpD,MAAM,CAAC,gBAAgB,CAAC;gBACtB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI;gBAC9C,GAAG,EAAE,IAAI,CAAC,GAAG;aACd,CAAC,CAAA;YAEF,OAAO;gBACL,QAAQ,EAAE,kBAA2B;gBACrC,IAAI,EAAE;oBACJ,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;oBAE9B,GAAG,EAAE,IAAI,CAAC,GAAgB;oBAC1B,uEAAuE;oBACvE,MAAM;oBACN,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,cAAc,CAAiB;oBACvD,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;oBAC9B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB;oBACvC,MAAM;oBACN,MAAM;iBACP;aACF,CAAA;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import {\n type DidString,\n type HandleString,\n INVALID_HANDLE,\n} from '@atproto/syntax'\nimport {\n AuthRequiredError,\n InvalidRequestError,\n type Server,\n} from '@atproto/xrpc-server'\nimport { formatAccountStatus } from '../../../../account-manager/account-manager.js'\nimport type { AppContext } from '../../../../context.js'\nimport { softDeleted } from '../../../../db/util.js'\nimport { events } from '../../../../events.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { didDocForSession } from './util.js'\n\nexport default function (server: Server, ctx: AppContext) {\n server.add(com.atproto.server.refreshSession, {\n auth: ctx.authVerifier.refresh(),\n handler: async ({\n auth,\n req,\n }): Promise<com.atproto.server.refreshSession.$Output> => {\n const did = auth.credentials.did\n const user = await ctx.accountManager.getAccount(did, {\n includeDeactivated: true,\n includeTakenDown: true,\n })\n if (!user) {\n throw new InvalidRequestError(\n `Could not find user info for account: ${did}`,\n )\n }\n if (softDeleted(user)) {\n throw new AuthRequiredError(\n 'Account has been taken down',\n 'AccountTakedown',\n )\n }\n\n if (ctx.entrywayClient) {\n const { headers } = ctx.entrywayPassthruHeaders(req)\n return ctx.entrywayClient.xrpc(com.atproto.server.refreshSession, {\n headers,\n })\n }\n\n const [didDoc, rotated] = await Promise.all([\n didDocForSession(ctx, user.did),\n ctx.accountManager.rotateRefreshToken(auth.credentials.tokenId),\n ])\n if (rotated === null) {\n throw new InvalidRequestError('Token has been revoked', 'ExpiredToken')\n }\n\n const { status, active } = formatAccountStatus(user)\n\n events.sessionRefreshed({\n source: com.atproto.server.refreshSession.$lxm,\n did: user.did,\n })\n\n return {\n encoding: 'application/json' as const,\n body: {\n accessJwt: rotated.accessJwt,\n refreshJwt: rotated.refreshJwt,\n\n did: user.did as DidString,\n // @ts-expect-error https://github.com/bluesky-social/atproto/pull/4406\n didDoc,\n handle: (user.handle ?? INVALID_HANDLE) as HandleString,\n email: user.email ?? undefined,\n emailConfirmed: !!user.emailConfirmedAt,\n active,\n status,\n },\n }\n },\n })\n}\n"]}

package/dist/auth-routes.js CHANGED Viewed

@@ -2,7 +2,7 @@ import { Router } from 'express';
 import { HandleUnavailableError, InvalidRequestError, SecondAuthenticationFactorRequiredError, UseDpopNonceError, } from '@atproto/oauth-provider/errors';
 import { oauthMiddleware } from '@atproto/oauth-provider/middleware';
 import { buildProtectedResourceMetadata } from '@atproto/oauth-provider/utils';
-import { oauthLogger, reqSerializer } from './logger.js';
+import { oauthLogger } from './logger.js';
 export const createRouter = ({ oauthProvider, cfg }) => {
     const router = Router();
     const oauthProtectedResourceMetadata = buildProtectedResourceMetadata({
@@ -26,7 +26,7 @@ export const createRouter = ({ oauthProvider, cfg }) => {
         router.use(oauthMiddleware(oauthProvider, {
             onError: (req, res, err, msg) => {
                 if (!ignoreError(err)) {
-                    oauthLogger.error({ err, req: reqSerializer(req) }, msg);
+                    oauthLogger.error({ err, req }, msg);
                 }
             },
         }));

package/dist/auth-routes.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth-routes.js","sourceRoot":"","sources":["../src/auth-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,uCAAuC,EACvC,iBAAiB,GAClB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAA;AACpE,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAA;AAE9E,OAAO,EAAE,WAAW,EAAE,~~aAAa,EAAE,~~MAAM,aAAa,CAAA;~~AAExD~~,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,EAAE,aAAa,EAAE,GAAG,EAAc,EAAU,EAAE;IACzE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAA;IAEvB,MAAM,8BAA8B,GAAG,8BAA8B,CAAC;QACpE,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS;QAC/B,qBAAqB,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC;QACnE,wBAAwB,EAAE,CAAC,QAAQ,CAAC;QACpC,gBAAgB,EAAE,EAAE;QACpB,sBAAsB,EAAE,qBAAqB;KAC9C,CAAC,CAAA;IAEF,IACE,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO;QACpB,CAAC,8BAA8B,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAC/D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3D,CAAC;IAED,MAAM,CAAC,GAAG,CAAC,uCAAuC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/D,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAA;QACjD,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAA;QACjD,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAA;QAClD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAA;IACtD,CAAC,CAAC,CAAA;IAEF,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,CAAC,GAAG,CACR,eAAe,CAAC,aAAa,EAAE;YAC7B,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;gBAC9B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;oBACtB,WAAW,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,~~aAAa,CAAC,GAAG,CAAC,~~EAAE,~~EAAE,~~GAAG,CAAC,CAAA;~~gBAC1D~~,CAAC;YACH,CAAC;SACF,CAAC,CACH,CAAA;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;QACvC,OAAO,GAAG,CAAC,iBAAiB,KAAK,gCAAgC,CAAA;IACnE,CAAC;IAED,OAAO,CACL,GAAG,YAAY,iBAAiB;QAChC,GAAG,YAAY,sBAAsB;QACrC,GAAG,YAAY,uCAAuC,CACvD,CAAA;AACH,CAAC","sourcesContent":["import { Router } from 'express'\nimport {\n HandleUnavailableError,\n InvalidRequestError,\n SecondAuthenticationFactorRequiredError,\n UseDpopNonceError,\n} from '@atproto/oauth-provider/errors'\nimport { oauthMiddleware } from '@atproto/oauth-provider/middleware'\nimport { buildProtectedResourceMetadata } from '@atproto/oauth-provider/utils'\nimport type { AppContext } from './context.js'\nimport { oauthLogger, ~~reqSerializer~~ } from './logger.js'\n\nexport const createRouter = ({ oauthProvider, cfg }: AppContext): Router => {\n const router = Router()\n\n const oauthProtectedResourceMetadata = buildProtectedResourceMetadata({\n resource: cfg.service.publicUrl,\n authorization_servers: [cfg.entryway?.url ?? cfg.service.publicUrl],\n bearer_methods_supported: ['header'],\n scopes_supported: [],\n resource_documentation: 'https://atproto.com',\n })\n\n if (\n !cfg.service.devMode &&\n !oauthProtectedResourceMetadata.resource.startsWith('https://')\n ) {\n throw new Error('Resource URL must use the https scheme')\n }\n\n router.get('/.well-known/oauth-protected-resource', (req, res) => {\n res.setHeader('Access-Control-Allow-Origin', '')\n res.setHeader('Access-Control-Allow-Method', '')\n res.setHeader('Access-Control-Allow-Headers', '*')\n res.status(200).json(oauthProtectedResourceMetadata)\n })\n\n if (oauthProvider) {\n router.use(\n oauthMiddleware(oauthProvider, {\n onError: (req, res, err, msg) => {\n if (!ignoreError(err)) {\n oauthLogger.error({ err, req: ~~reqSerializer(req)~~ }, msg)\n }\n },\n }),\n )\n }\n\n return router\n}\n\nfunction ignoreError(err: unknown): boolean {\n if (err instanceof InvalidRequestError) {\n return err.error_description === 'Invalid identifier or password'\n }\n\n return (\n err instanceof UseDpopNonceError \|\|\n err instanceof HandleUnavailableError \|\|\n err instanceof SecondAuthenticationFactorRequiredError\n )\n}\n"]}
1	+ {"version":3,"file":"auth-routes.js","sourceRoot":"","sources":["../src/auth-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,uCAAuC,EACvC,iBAAiB,GAClB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAA;AACpE,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAA;AAE9E,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEzC,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,EAAE,aAAa,EAAE,GAAG,EAAc,EAAU,EAAE;IACzE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAA;IAEvB,MAAM,8BAA8B,GAAG,8BAA8B,CAAC;QACpE,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS;QAC/B,qBAAqB,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC;QACnE,wBAAwB,EAAE,CAAC,QAAQ,CAAC;QACpC,gBAAgB,EAAE,EAAE;QACpB,sBAAsB,EAAE,qBAAqB;KAC9C,CAAC,CAAA;IAEF,IACE,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO;QACpB,CAAC,8BAA8B,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAC/D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3D,CAAC;IAED,MAAM,CAAC,GAAG,CAAC,uCAAuC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/D,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAA;QACjD,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAA;QACjD,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAA;QAClD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAA;IACtD,CAAC,CAAC,CAAA;IAEF,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,CAAC,GAAG,CACR,eAAe,CAAC,aAAa,EAAE;YAC7B,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;gBAC9B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;oBACtB,WAAW,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAA;gBACtC,CAAC;YACH,CAAC;SACF,CAAC,CACH,CAAA;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;QACvC,OAAO,GAAG,CAAC,iBAAiB,KAAK,gCAAgC,CAAA;IACnE,CAAC;IAED,OAAO,CACL,GAAG,YAAY,iBAAiB;QAChC,GAAG,YAAY,sBAAsB;QACrC,GAAG,YAAY,uCAAuC,CACvD,CAAA;AACH,CAAC","sourcesContent":["import { Router } from 'express'\nimport {\n HandleUnavailableError,\n InvalidRequestError,\n SecondAuthenticationFactorRequiredError,\n UseDpopNonceError,\n} from '@atproto/oauth-provider/errors'\nimport { oauthMiddleware } from '@atproto/oauth-provider/middleware'\nimport { buildProtectedResourceMetadata } from '@atproto/oauth-provider/utils'\nimport type { AppContext } from './context.js'\nimport { oauthLogger } from './logger.js'\n\nexport const createRouter = ({ oauthProvider, cfg }: AppContext): Router => {\n const router = Router()\n\n const oauthProtectedResourceMetadata = buildProtectedResourceMetadata({\n resource: cfg.service.publicUrl,\n authorization_servers: [cfg.entryway?.url ?? cfg.service.publicUrl],\n bearer_methods_supported: ['header'],\n scopes_supported: [],\n resource_documentation: 'https://atproto.com',\n })\n\n if (\n !cfg.service.devMode &&\n !oauthProtectedResourceMetadata.resource.startsWith('https://')\n ) {\n throw new Error('Resource URL must use the https scheme')\n }\n\n router.get('/.well-known/oauth-protected-resource', (req, res) => {\n res.setHeader('Access-Control-Allow-Origin', '')\n res.setHeader('Access-Control-Allow-Method', '')\n res.setHeader('Access-Control-Allow-Headers', '*')\n res.status(200).json(oauthProtectedResourceMetadata)\n })\n\n if (oauthProvider) {\n router.use(\n oauthMiddleware(oauthProvider, {\n onError: (req, res, err, msg) => {\n if (!ignoreError(err)) {\n oauthLogger.error({ err, req }, msg)\n }\n },\n }),\n )\n }\n\n return router\n}\n\nfunction ignoreError(err: unknown): boolean {\n if (err instanceof InvalidRequestError) {\n return err.error_description === 'Invalid identifier or password'\n }\n\n return (\n err instanceof UseDpopNonceError \|\|\n err instanceof HandleUnavailableError \|\|\n err instanceof SecondAuthenticationFactorRequiredError\n )\n}\n"]}

package/dist/auth-verifier.d.ts CHANGED Viewed

@@ -53,14 +53,17 @@ export declare class AuthVerifier {
     dids: AuthVerifierOpts['dids'];
     constructor(accountManager: AccountManager, idResolver: IdResolver, oauthVerifier: OAuthVerifier, opts: AuthVerifierOpts);
     unauthenticated: MethodAuthVerifier<UnauthenticatedOutput>;
+    /** @deprecated We are steering away from this auth method */
     adminToken: MethodAuthVerifier<AdminTokenOutput>;
     modService: MethodAuthVerifier<ModServiceOutput>;
+    /** @deprecated We are steering away from {@link adminToken} auth. Use {@link modService} instead. */
     moderator: MethodAuthVerifier<AdminTokenOutput | ModServiceOutput>;
     protected access<S extends AuthScope>(options: VerifiedOptions & Required<ScopedOptions<S>>): MethodAuthVerifier<AccessOutput<S>>;
     refresh(options?: {
         allowExpired?: boolean;
     }): MethodAuthVerifier<RefreshOutput>;
     authorization<P extends Params>({ scopes, additional, ...options }: VerifiedOptions & ScopedOptions & ExtraScopedOptions & AuthorizedOptions<P>): MethodAuthVerifier<AccessOutput | OAuthOutput, P>;
+    authorizationOrModService<P extends Params>(opts: VerifiedOptions & ExtraScopedOptions & AuthorizedOptions<P>): MethodAuthVerifier<AccessOutput | OAuthOutput | ModServiceOutput, P>;
     authorizationOrAdminTokenOptional<P extends Params>(opts: VerifiedOptions & ExtraScopedOptions & AuthorizedOptions<P>): MethodAuthVerifier<OAuthOutput | AccessOutput | AdminTokenOutput | UnauthenticatedOutput, P>;
     userServiceAuth: MethodAuthVerifier<UserServiceAuthOutput>;
     userServiceAuthOptional: MethodAuthVerifier<UserServiceAuthOutput | UnauthenticatedOutput>;

package/dist/auth-verifier.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth-verifier.d.ts","sourceRoot":"","sources":["../src/auth-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAoC,MAAM,aAAa,CAAA;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAkB,MAAM,WAAW,CAAA;AAChE,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAG5B,OAAO,EAAE,KAAK,UAAU,EAA0B,MAAM,mBAAmB,CAAA;AAC3E,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,SAAS,EAEf,MAAM,cAAc,CAAA;AAKrB,OAAO,KAAK,EACV,aAAa,EAEd,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACL,KAAK,gBAAgB,EAEtB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAEL,KAAK,SAAS,EAGd,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,MAAM,EAIZ,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAA;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAA;AACxE,OAAO,KAAK,EACV,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,qBAAqB,EACrB,qBAAqB,EACtB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAmB,SAAS,EAAe,MAAM,iBAAiB,CAAA;AAGzE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAKnD,MAAM,MAAM,eAAe,GAAG;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAC3B,CAAA;AAED,MAAM,MAAM,aAAa,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAAI;IAC3D,MAAM,CAAC,EAAE,SAAS,CAAC,EAAE,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,kBAAkB,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAAI;IAChE,UAAU,CAAC,EAAE,SAAS,CAAC,EAAE,CAAA;CAC1B,CAAA;AAED,MAAM,MAAM,iBAAiB,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI;IACzD,SAAS,EAAE,CACT,WAAW,EAAE,gBAAgB,EAC7B,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC,KACtB,SAAS,CAAC,IAAI,CAAC,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,SAAS,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE;QACJ,GAAG,EAAE,MAAM,CAAA;QACX,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,UAAU,CAAC,EAAE,MAAM,CAAA;KACpB,CAAA;CACF,CAAA;AAED,MAAM,MAAM,sBAAsB,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAChE,YAAY,CACV,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,GAAG;IACtC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAA;CACrB,EACD,UAAU,GAAG,KAAK,CACnB,CAAA;AAEH,MAAM,MAAM,qBAAqB,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAAI;IACnE,GAAG,EAAE,SAAS,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IACvB,KAAK,EAAE,CAAC,CAAA;CACT,CAAA;AAED,qBAAa,YAAY;IAOd,cAAc,EAAE,cAAc;IAC9B,UAAU,EAAE,UAAU;IACtB,aAAa,EAAE,aAAa;IARrC,OAAO,CAAC,UAAU,CAAQ;IAC1B,OAAO,CAAC,OAAO,CAAW;IAC1B,OAAO,CAAC,UAAU,CAAQ;IACnB,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAA;IAErC,YACS,cAAc,EAAE,cAAc,EAC9B,UAAU,EAAE,UAAU,EACtB,aAAa,EAAE,aAAa,EACnC,IAAI,EAAE,gBAAgB,EAMvB;IAIM,eAAe,EAAE,kBAAkB,CAAC,qBAAqB,CAAC,CAchE;~~IAEM~~,UAAU,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,CAYtD;IAEM,UAAU,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,CActD;~~IAEM~~,SAAS,EAAE,kBAAkB,CAAC,gBAAgB,GAAG,gBAAgB,CAAC,CAQtE;IAEH,SAAS,CAAC,MAAM,CAAC,CAAC,SAAS,SAAS,EAClC,OAAO,EAAE,eAAe,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GACpD,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CA4BrC;IAEM,OAAO,CAAC,OAAO,CAAC,EAAE;QACvB,YAAY,CAAC,EAAE,OAAO,CAAA;KACvB,GAAG,kBAAkB,CAAC,aAAa,CAAC,CA+BpC;IAEM,aAAa,CAAC,CAAC,SAAS,MAAM,EAAE,EACrC,MAAwB,EACxB,UAAe,EACf,GAAG,OAAO,EACX,EAAE,eAAe,GAChB,aAAa,GACb,kBAAkB,GAClB,iBAAiB,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,YAAY,GAAG,WAAW,EAAE,CAAC,CAAC,CA+BzE;IAEM,iCAAiC,CAAC,CAAC,SAAS,MAAM,EACvD,IAAI,EAAE,eAAe,GAAG,kBAAkB,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAChE,kBAAkB,CACnB,WAAW,GAAG,YAAY,GAAG,gBAAgB,GAAG,qBAAqB,EACrE,CAAC,CACF,CAYA;IAEM,eAAe,EAAE,kBAAkB,CAAC,qBAAqB,CAAC,CAWhE;IAEM,uBAAuB,EAAE,kBAAkB,CAChD,qBAAqB,GAAG,qBAAqB,CAC9C,CAOA;IAEM,8BAA8B,CAAC,CAAC,SAAS,MAAM,EACpD,OAAO,EAAE,eAAe,GACtB,aAAa,GACb,kBAAkB,GAClB,iBAAiB,CAAC,CAAC,CAAC,GACrB,kBAAkB,CAAC,qBAAqB,GAAG,WAAW,GAAG,YAAY,EAAE,CAAC,CAAC,CAS3E;IAED,SAAS,CAAC,KAAK,CAAC,CAAC,SAAS,MAAM,EAAE,EAChC,SAAS,EACT,GAAG,mBAAmB,EACvB,EAAE,eAAe,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAC5D,WAAW,EACX,CAAC,CACF,CAwEA;IAED,UAAgB,YAAY,CAC1B,GAAG,EAAE,SAAS,EACd,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,IAAI,CAAC,CAIf;IAED;;;;OAIG;IACU,WAAW,CACtB,WAAW,EAAE,kBAAkB,EAC/B,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,YAAY,CAAC,CAsBvB;IAED;;;OAGG;IACH,UAAgB,eAAe,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,EAC7D,GAAG,EAAE,eAAe,EACpB,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC,GAChD,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAmDnC;IAED,UAAgB,gBAAgB,CAC9B,GAAG,EAAE,eAAe,EACpB,IAAI,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE;;;;;;OA4C1B;CACF;AAKD,wBAAgB,aAAa,CAC3B,IAAI,EAAE,YAAY,GAAG,WAAW,GAAG,gBAAgB,GAAG,qBAAqB,EAC3E,GAAG,EAAE,MAAM,GACV,OAAO,CAQT;AAmDD,eAAO,MAAM,kBAAkB,QAAS,eAAe,kBAGtD,CAAA;AAoBD,eAAO,MAAM,qBAAqB,WAAY,MAAM,KAAG,SAEtD,CAAA;AAGD,eAAO,MAAM,qBAAqB,iBAAkB,MAAM,KAAG,SAG5D,CAAA"}
1	+ {"version":3,"file":"auth-verifier.d.ts","sourceRoot":"","sources":["../src/auth-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAoC,MAAM,aAAa,CAAA;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAkB,MAAM,WAAW,CAAA;AAChE,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAG5B,OAAO,EAAE,KAAK,UAAU,EAA0B,MAAM,mBAAmB,CAAA;AAC3E,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,SAAS,EAEf,MAAM,cAAc,CAAA;AAKrB,OAAO,KAAK,EACV,aAAa,EAEd,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACL,KAAK,gBAAgB,EAEtB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAEL,KAAK,SAAS,EAGd,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,MAAM,EAIZ,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAA;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAA;AACxE,OAAO,KAAK,EACV,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,qBAAqB,EACrB,qBAAqB,EACtB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAmB,SAAS,EAAe,MAAM,iBAAiB,CAAA;AAGzE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAKnD,MAAM,MAAM,eAAe,GAAG;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAC3B,CAAA;AAED,MAAM,MAAM,aAAa,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAAI;IAC3D,MAAM,CAAC,EAAE,SAAS,CAAC,EAAE,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,kBAAkB,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAAI;IAChE,UAAU,CAAC,EAAE,SAAS,CAAC,EAAE,CAAA;CAC1B,CAAA;AAED,MAAM,MAAM,iBAAiB,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI;IACzD,SAAS,EAAE,CACT,WAAW,EAAE,gBAAgB,EAC7B,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC,KACtB,SAAS,CAAC,IAAI,CAAC,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,SAAS,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE;QACJ,GAAG,EAAE,MAAM,CAAA;QACX,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,UAAU,CAAC,EAAE,MAAM,CAAA;KACpB,CAAA;CACF,CAAA;AAED,MAAM,MAAM,sBAAsB,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAChE,YAAY,CACV,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,GAAG;IACtC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAA;CACrB,EACD,UAAU,GAAG,KAAK,CACnB,CAAA;AAEH,MAAM,MAAM,qBAAqB,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAAI;IACnE,GAAG,EAAE,SAAS,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IACvB,KAAK,EAAE,CAAC,CAAA;CACT,CAAA;AAED,qBAAa,YAAY;IAOd,cAAc,EAAE,cAAc;IAC9B,UAAU,EAAE,UAAU;IACtB,aAAa,EAAE,aAAa;IARrC,OAAO,CAAC,UAAU,CAAQ;IAC1B,OAAO,CAAC,OAAO,CAAW;IAC1B,OAAO,CAAC,UAAU,CAAQ;IACnB,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAA;IAErC,YACS,cAAc,EAAE,cAAc,EAC9B,UAAU,EAAE,UAAU,EACtB,aAAa,EAAE,aAAa,EACnC,IAAI,EAAE,gBAAgB,EAMvB;IAIM,eAAe,EAAE,kBAAkB,CAAC,qBAAqB,CAAC,CAchE;IAED,6DAA6D;IACtD,UAAU,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,CAYtD;IAEM,UAAU,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,CActD;IAED,qGAAqG;IAC9F,SAAS,EAAE,kBAAkB,CAAC,gBAAgB,GAAG,gBAAgB,CAAC,CAQtE;IAEH,SAAS,CAAC,MAAM,CAAC,CAAC,SAAS,SAAS,EAClC,OAAO,EAAE,eAAe,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GACpD,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CA4BrC;IAEM,OAAO,CAAC,OAAO,CAAC,EAAE;QACvB,YAAY,CAAC,EAAE,OAAO,CAAA;KACvB,GAAG,kBAAkB,CAAC,aAAa,CAAC,CA+BpC;IAEM,aAAa,CAAC,CAAC,SAAS,MAAM,EAAE,EACrC,MAAwB,EACxB,UAAe,EACf,GAAG,OAAO,EACX,EAAE,eAAe,GAChB,aAAa,GACb,kBAAkB,GAClB,iBAAiB,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,YAAY,GAAG,WAAW,EAAE,CAAC,CAAC,CA+BzE;IAEM,yBAAyB,CAAC,CAAC,SAAS,MAAM,EAC/C,IAAI,EAAE,eAAe,GAAG,kBAAkB,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAChE,kBAAkB,CAAC,YAAY,GAAG,WAAW,GAAG,gBAAgB,EAAE,CAAC,CAAC,CAYtE;IAEM,iCAAiC,CAAC,CAAC,SAAS,MAAM,EACvD,IAAI,EAAE,eAAe,GAAG,kBAAkB,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAChE,kBAAkB,CACnB,WAAW,GAAG,YAAY,GAAG,gBAAgB,GAAG,qBAAqB,EACrE,CAAC,CACF,CAYA;IAEM,eAAe,EAAE,kBAAkB,CAAC,qBAAqB,CAAC,CAWhE;IAEM,uBAAuB,EAAE,kBAAkB,CAChD,qBAAqB,GAAG,qBAAqB,CAC9C,CAOA;IAEM,8BAA8B,CAAC,CAAC,SAAS,MAAM,EACpD,OAAO,EAAE,eAAe,GACtB,aAAa,GACb,kBAAkB,GAClB,iBAAiB,CAAC,CAAC,CAAC,GACrB,kBAAkB,CAAC,qBAAqB,GAAG,WAAW,GAAG,YAAY,EAAE,CAAC,CAAC,CAS3E;IAED,SAAS,CAAC,KAAK,CAAC,CAAC,SAAS,MAAM,EAAE,EAChC,SAAS,EACT,GAAG,mBAAmB,EACvB,EAAE,eAAe,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAC5D,WAAW,EACX,CAAC,CACF,CAwEA;IAED,UAAgB,YAAY,CAC1B,GAAG,EAAE,SAAS,EACd,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,IAAI,CAAC,CAIf;IAED;;;;OAIG;IACU,WAAW,CACtB,WAAW,EAAE,kBAAkB,EAC/B,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,YAAY,CAAC,CAsBvB;IAED;;;OAGG;IACH,UAAgB,eAAe,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,EAC7D,GAAG,EAAE,eAAe,EACpB,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC,GAChD,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAmDnC;IAED,UAAgB,gBAAgB,CAC9B,GAAG,EAAE,eAAe,EACpB,IAAI,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE;;;;;;OA4C1B;CACF;AAKD,wBAAgB,aAAa,CAC3B,IAAI,EAAE,YAAY,GAAG,WAAW,GAAG,gBAAgB,GAAG,qBAAqB,EAC3E,GAAG,EAAE,MAAM,GACV,OAAO,CAQT;AAmDD,eAAO,MAAM,kBAAkB,QAAS,eAAe,kBAGtD,CAAA;AAoBD,eAAO,MAAM,qBAAqB,WAAY,MAAM,KAAG,SAEtD,CAAA;AAGD,eAAO,MAAM,qBAAqB,iBAAkB,MAAM,KAAG,SAG5D,CAAA"}

package/dist/auth-verifier.js CHANGED Viewed

@@ -31,6 +31,7 @@ export class AuthVerifier {
                 credentials: null,
             };
         };
+        /** @deprecated We are steering away from this auth method */
         this.adminToken = async (ctx) => {
             setAuthHeaders(ctx.res);
             const parsed = parseBasicAuth(ctx.req);
@@ -58,6 +59,7 @@ export class AuthVerifier {
                 },
             };
         };
+        /** @deprecated We are steering away from {@link adminToken} auth. Use {@link modService} instead. */
         this.moderator = async (ctx) => {
             const type = extractAuthType(ctx.req);
             if (type === AuthType.BEARER) {
@@ -160,6 +162,20 @@ export class AuthVerifier {
             throw new AuthRequiredError(undefined, 'AuthMissing');
         };
     }
+    authorizationOrModService(opts) {
+        const authorization = this.authorization(opts);
+        return async (ctx) => {
+            try {
+                return await this.modService(ctx);
+            }
+            catch (err) {
+                if (err instanceof AuthRequiredError) {
+                    return authorization(ctx);
+                }
+                throw err;
+            }
+        };
+    }
     authorizationOrAdminTokenOptional(opts) {
         const authorization = this.authorization(opts);
         return async (ctx) => {

package/dist/auth-verifier.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth-verifier.js","sourceRoot":"","sources":["../src/auth-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,eAAe,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAE9E,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,gBAAgB,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAA;AACzD,OAAO,EAAmB,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAC3E,OAAO,EAGL,WAAW,GACZ,MAAM,cAAc,CAAA;AACrB,OAAO,EACL,UAAU,EACV,oBAAoB,GACrB,MAAM,gCAAgC,CAAA;AAKvC,OAAO,EAEL,0BAA0B,GAC3B,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,iBAAiB,EAEjB,cAAc,EACd,mBAAmB,EAInB,SAAS,EACT,YAAY,EACZ,SAAS,IAAI,gBAAgB,GAC9B,MAAM,sBAAsB,CAAA;AAY7B,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAG3C,2FAA2F;AAC3F,MAAM,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAA;AAgD5D,MAAM,OAAO,YAAY;IAMvB,YACS,cAA8B,EAC9B,UAAsB,EACtB,aAA4B,EACnC,IAAsB;QAHf,mBAAc,GAAd,cAAc,CAAgB;QAC9B,eAAU,GAAV,UAAU,CAAY;QACtB,kBAAa,GAAb,aAAa,CAAe;QASrC,0CAA0C;QAEnC,oBAAe,GAA8C,CAAC,GAAG,EAAE,EAAE;YAC1E,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,0EAA0E;YAC1E,2EAA2E;YAC3E,2EAA2E;YAC3E,uBAAuB;YACvB,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,iBAAiB,CAAC,8BAA8B,CAAC,CAAA;YAC7D,CAAC;YAED,OAAO;gBACL,WAAW,EAAE,IAAI;aAClB,CAAA;QACH,CAAC,CAAA;QAEM,eAAU,GAAyC,KAAK,EAAE,GAAG,EAAE,EAAE;YACtE,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACvB,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACtC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,iBAAiB,EAAE,CAAA;YAC/B,CAAC;YACD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAA;YACrC,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;gBACzD,MAAM,IAAI,iBAAiB,EAAE,CAAA;YAC/B,CAAC;YAED,OAAO,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CAAA;QACjD,CAAC,CAAA;QAEM,eAAU,GAAyC,KAAK,EAAE,GAAG,EAAE,EAAE;YACtE,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACvB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC1B,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAA;YACjE,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE;gBACnD,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,kBAAkB,CAAC;aACvE,CAAC,CAAA;YACF,OAAO;gBACL,WAAW,EAAE;oBACX,IAAI,EAAE,aAAa;oBACnB,GAAG,EAAE,OAAO,CAAC,GAAG;iBACjB;aACF,CAAA;QACH,CAAC,CAAA;QAEM,cAAS,GACd,KAAK,EAAE,GAAG,EAAE,EAAE;YACZ,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACrC,IAAI,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;YAC7B,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;YAC7B,CAAC;QACH,CAAC,CAAA;QAgII,oBAAe,GAA8C,KAAK,EACvE,GAAG,EACH,EAAE;YACF,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACvB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACpD,OAAO;gBACL,WAAW,EAAE;oBACX,IAAI,EAAE,mBAAmB;oBACzB,GAAG,EAAE,OAAO,CAAC,GAAG;iBACjB;aACF,CAAA;QACH,CAAC,CAAA;QAEM,4BAAuB,GAE1B,KAAK,EAAE,GAAG,EAAE,EAAE;YAChB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACrC,IAAI,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC7B,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YACxC,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YAClC,CAAC;QACH,CAAC,CAAA;QApNC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAA;QAChC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAA;QAC1B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAA;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;IACvB,CAAC;IA4DS,MAAM,CACd,OAAqD;QAErD,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,EAAE,GAAG,OAAO,CAAA;QAE5C,MAAM,gBAAgB,GAA8B;YAClD,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG;YACvB,GAAG,EAAE,QAAQ;YACb,MAAM;YACJ,mEAAmE;YACnE,0BAA0B;YAC1B,aAAa,CAAC,aAAa,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAc,CAAC;gBACtE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,SAAS,CAAC;gBACjD,CAAC,CAAC,MAAM;SACb,CAAA;QAED,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CACpD,GAAG,CAAC,GAAG,EACP,gBAAgB,CACjB,CAAA;YAED,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;YAE3C,OAAO;gBACL,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE;aAC5C,CAAA;QACH,CAAC,CAAA;IACH,CAAC;IAEM,OAAO,CAAC,OAEd;QACC,MAAM,aAAa,GAA8C;YAC/D,cAAc,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;YAC5D,GAAG,EAAE,aAAa;YAClB,oDAAoD;YACpD,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACjE,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC;SAC5B,CAAA;QAED,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;YAEjE,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAA;YAC1B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,iBAAiB,CACzB,qCAAqC,EACrC,gBAAgB,CACjB,CAAA;YACH,CAAC;YAED,OAAO;gBACL,WAAW,EAAE;oBACX,IAAI,EAAE,SAAS;oBACf,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,OAAO;iBACR;aACF,CAAA;QACH,CAAC,CAAA;IACH,CAAC;IAEM,aAAa,CAAmB,EACrC,MAAM,GAAG,eAAe,EACxB,UAAU,GAAG,EAAE,EACf,GAAG,OAAO,EAIU;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YACzB,GAAG,OAAO;YACV,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,UAAU,CAAC;SACnC,CAAC,CAAA;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAEjC,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAErC,IAAI,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC7B,OAAO,MAAM,CAAC,GAAG,CAAC,CAAA;YACpB,CAAC;YAED,IAAI,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAC3B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAA;YACnB,CAAC;YAED,uEAAuE;YACvE,+CAA+C;YAC/C,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,mBAAmB,CAC3B,+BAA+B,EAC/B,cAAc,CACf,CAAA;YACH,CAAC;YAED,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;QACvD,CAAC,CAAA;IACH,CAAC;IAEM,iCAAiC,CACtC,IAAiE;QAKjE,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;QAC9C,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACrC,IAAI,IAAI,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACvD,OAAO,aAAa,CAAC,GAAG,CAAC,CAAA;YAC3B,CAAC;iBAAM,IAAI,IAAI,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACnC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;YAC7B,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YAClC,CAAC;QACH,CAAC,CAAA;IACH,CAAC;IA0BM,8BAA8B,CACnC,OAGsB;QAEtB,MAAM,qBAAqB,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;QACzD,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,IAAI,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrC,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YAClC,CAAC;iBAAM,CAAC;gBACN,OAAO,qBAAqB,CAAC,GAAG,CAAC,CAAA;YACnC,CAAC;QACH,CAAC,CAAA;IACH,CAAC;IAES,KAAK,CAAmB,EAChC,SAAS,EACT,GAAG,mBAAmB,EACiB;QAIvC,MAAM,kBAAkB,GAA8B;YACpD,QAAQ,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YACzB,KAAK,EAAE,CAAC,SAAS,CAAC;SACnB,CAAA;QAED,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,CAAA;YAExB,4DAA4D;YAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,CAAA;YACpD,IAAI,SAAS,EAAE,CAAC;gBACd,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,SAAS,CAAC,CAAA;gBACtC,GAAG,CAAC,YAAY,CAAC,+BAA+B,EAAE,YAAY,CAAC,CAAA;YACjE,CAAC;YAED,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAA;YACrD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;YAEjD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa;iBACjD,mBAAmB,CAClB,GAAG,CAAC,MAAM,IAAI,KAAK,EACnB,GAAG,EACH,GAAG,CAAC,OAAO,EACX,kBAAkB,CACnB;iBACA,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACb,mEAAmE;gBACnE,0DAA0D;gBAC1D,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;oBACxC,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,GAAG,CAAC,qBAAqB,CAAC,CAAA;oBAC5D,GAAG,CAAC,YAAY,CACd,+BAA+B,EAC/B,kBAAkB,CACnB,CAAA;gBACH,CAAC;gBAED,IAAI,GAAG,YAAY,UAAU,EAAE,CAAC;oBAC9B,MAAM,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,iBAAiB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAA;gBACnE,CAAC;gBAED,MAAM,GAAG,CAAA;YACX,CAAC,CAAC,CAAA;YAEJ,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;YAClE,CAAC;YAED,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAA;YAEjD,MAAM,WAAW,GAAG,IAAI,0BAA0B,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;YAErE,sBAAsB;YACtB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,mBAAmB,CAC3B,2CAA2C,EAC3C,cAAc,CACf,CAAA;YACH,CAAC;YAED,MAAM,SAAS,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;YAEjC,OAAO;gBACL,WAAW,EAAE;oBACX,IAAI,EAAE,OAAO;oBACb,GAAG;oBACH,WAAW;iBACZ;aACF,CAAA;QACH,CAAC,CAAA;IACH,CAAC;IAES,KAAK,CAAC,YAAY,CAC1B,GAAc,EACd,OAAwB;QAExB,IAAI,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YACtD,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QACtC,CAAC;IACH,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,WAAW,CACtB,WAA+B,EAC/B,OAAwB;QAExB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,WAAW,EAAE;YAChE,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,yEAAyE;YACzE,MAAM,IAAI,cAAc,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,CAAC,aAAa,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,iBAAiB,CACzB,6BAA6B,EAC7B,iBAAiB,CAClB,CAAA;QACH,CAAC;QACD,IAAI,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YACtD,MAAM,IAAI,iBAAiB,CACzB,wBAAwB,EACxB,oBAAoB,CACrB,CAAA;QACH,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IAED;;;OAGG;IACO,KAAK,CAAC,eAAe,CAC7B,GAAoB,EACpB,EAAE,MAAM,EAAE,GAAG,OAAO,EAA6B;QAEjD,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;QACrC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;QACvD,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI;aAC3B,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;aACvC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACf,IAAI,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC5C,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,EAAE,cAAc,EAAE;oBACjE,KAAK;iBACN,CAAC,CAAA;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,mBAAmB,CAC3B,6BAA6B,EAC7B,cAAc,EACd,EAAE,KAAK,EAAE,CACV,CAAA;YACH,CAAC;QACH,CAAC,CAAC,CAAA;QAEJ,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;QAElD,IAAI,OAAO,GAAG,KAAK,WAAW,EAAE,CAAC;YAC/B,sEAAsE;YACtE,yEAAyE;YACzE,+DAA+D;YAC/D,yEAAyE;YACzE,mBAAmB;YACnB,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,WAAW,EAAE,CAAC;YAC/B,wDAAwD;YACxD,8CAA8C;YAC9C,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,WAAW,EAAE,CAAC;YAC1D,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAY,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QAED,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,KAAU,EAAE,CAAA;IAC7C,CAAC;IAES,KAAK,CAAC,gBAAgB,CAC9B,GAAoB,EACpB,IAAyB;QAEzB,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,iBAAiB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAA;QAC1D,CAAC;QAED,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;QAC9B,MAAM,OAAO,GAAG,MAAM,gBAAgB,CACpC,MAAM,EACN,IAAI,EACJ,IAAI,EACJ,KAAK,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE;YAC1B,IAAI,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAA;YACjE,CAAC;YACD,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACvC,MAAM,KAAK,GACT,SAAS,KAAK,iBAAiB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAA;YAC/D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;YACnE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,iBAAiB,CAAC,2BAA2B,CAAC,CAAA;YAC1D,CAAC;YACD,MAAM,SAAS,GAAG,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;YACxD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,iBAAiB,CAAC,+BAA+B,CAAC,CAAA;YAC9D,CAAC;YACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAA;YAChD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,iBAAiB,CAAC,+BAA+B,CAAC,CAAA;YAC9D,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC,CACF,CAAA;QACD,IACE,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG;YAC7B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAC3D,CAAC;YACD,MAAM,IAAI,iBAAiB,CACzB,yCAAyC,EACzC,gBAAgB,CACjB,CAAA;QACH,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;CACF;AAED,UAAU;AACV,YAAY;AAEZ,MAAM,UAAU,aAAa,CAC3B,IAA2E,EAC3E,GAAW;IAEX,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtB,OAAO,KAAK,CAAA;IACd,CAAC;SAAM,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACnD,OAAO,IAAI,CAAA;IACb,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,KAAK,GAAG,CAAA;IACrC,CAAC;AACH,CAAC;AAED,IAAK,QAIJ;AAJD,WAAK,QAAQ;IACX,2BAAe,CAAA;IACf,6BAAiB,CAAA;IACjB,yBAAa,CAAA;AACf,CAAC,EAJI,QAAQ,KAAR,QAAQ,QAIZ;AAED,MAAM,wBAAwB,GAAG,CAC/B,GAAoB,EAC4B,EAAE;IAClD,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;IAClD,IAAI,CAAC,aAAa;QAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACvC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,mBAAmB,CAC3B,gCAAgC,EAChC,cAAc,CACf,CAAA;IACH,CAAC;IAED,yCAAyC;IACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;IAExC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC1E,IAAI,IAAI;QAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;IAElC,MAAM,IAAI,mBAAmB,CAC3B,mCAAmC,MAAM,CAAC,CAAC,CAAC,EAAE,EAC9C,cAAc,CACf,CAAA;AACH,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,uBAAuB,GAAG,CAAC,GAAoB,EAAW,EAAE;IAChE,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;IACrC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IACxB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IACrC,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,CAAA;AAC/B,CAAC,CAAA;AAED,MAAM,eAAe,GAAG,CAAC,GAAoB,EAAmB,EAAE;IAChE,MAAM,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAA;IAC5C,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAoB,EAAE,EAAE;IACzD,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAA;IACnD,OAAO,IAAI,KAAK,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AAChD,CAAC,CAAA;AAED,MAAM,cAAc,GAAG,CACrB,GAAoB,EAC2B,EAAE;IACjD,IAAI,CAAC;QACH,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAA;QACjD,IAAI,IAAI,KAAK,QAAQ,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACxC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAC3D,qEAAqE;QACrE,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAA;QAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;QACzC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAA;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,MAAc,EAAa,EAAE;IACjE,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;AAC7C,CAAC,CAAA;AAED,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,CAAA;AAC9C,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,YAAoB,EAAa,EAAE;IACvE,MAAM,GAAG,GAAG,UAAU,CAAC,YAAY,CAAC,YAAY,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;IAC/D,OAAO,eAAe,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;AAChD,CAAC,CAAA;AAED,SAAS,cAAc,CAAC,GAAmB;IACzC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,SAAS,CAAC,CAAA;IACzC,UAAU,CAAC,GAAG,EAAE,eAAe,CAAC,CAAA;AAClC,CAAC","sourcesContent":["import { type KeyObject, createPublicKey, createSecretKey } from 'node:crypto'\nimport type { IncomingMessage, ServerResponse } from 'node:http'\nimport * as jose from 'jose'\nimport KeyEncoderModule from 'key-encoder'\nimport { getVerificationMaterial } from '@atproto/common'\nimport { type IdResolver, getDidKeyFromMultibase } from '@atproto/identity'\nimport {\n type AtIdentifierString,\n type DidString,\n isDidString,\n} from '@atproto/lex'\nimport {\n OAuthError,\n WWWAuthenticateError,\n} from '@atproto/oauth-provider/errors'\nimport type {\n OAuthVerifier,\n VerifyTokenPayloadOptions,\n} from '@atproto/oauth-provider/verifier'\nimport {\n type ScopePermissions,\n ScopePermissionsTransition,\n} from '@atproto/oauth-scopes'\nimport {\n AuthRequiredError,\n type Awaitable,\n ForbiddenError,\n InvalidRequestError,\n type MethodAuthContext,\n type MethodAuthVerifier,\n type Params,\n XRPCError,\n parseReqNsid,\n verifyJwt as verifyServiceJwt,\n} from '@atproto/xrpc-server'\nimport type { AccountManager } from './account-manager/account-manager.js'\nimport type { ActorAccount } from './account-manager/helpers/account.js'\nimport type {\n AccessOutput,\n AdminTokenOutput,\n ModServiceOutput,\n OAuthOutput,\n RefreshOutput,\n UnauthenticatedOutput,\n UserServiceAuthOutput,\n} from './auth-output.js'\nimport { ACCESS_STANDARD, AuthScope, isAuthScope } from './auth-scope.js'\nimport { softDeleted } from './db/index.js'\nimport { appendVary } from './util/http.js'\nimport type { WithRequired } from './util/types.js'\n\n// key-encoder is CJS with exports.default; Node ESM interop wraps it as { default: Class }\nconst KeyEncoder = ((m) => m.default ?? m)(KeyEncoderModule)\n\nexport type VerifiedOptions = {\n checkTakedown?: boolean\n checkDeactivated?: boolean\n}\n\nexport type ScopedOptions<S extends AuthScope = AuthScope> = {\n scopes?: readonly S[]\n}\n\nexport type ExtraScopedOptions<S extends AuthScope = AuthScope> = {\n additional?: readonly S[]\n}\n\nexport type AuthorizedOptions<P extends Params = Params> = {\n authorize: (\n permissions: ScopePermissions,\n ctx: MethodAuthContext<P>,\n ) => Awaitable<void>\n}\n\nexport type AuthVerifierOpts = {\n publicUrl: string\n jwtKey: KeyObject\n adminPass: string\n dids: {\n pds: string\n entryway?: string\n modService?: string\n }\n}\n\nexport type VerifyBearerJwtOptions<S extends AuthScope = AuthScope> =\n WithRequired<\n Omit<jose.JWTVerifyOptions, 'scopes'> & {\n scopes: readonly S[]\n },\n 'audience' \| 'typ'\n >\n\nexport type VerifyBearerJwtResult<S extends AuthScope = AuthScope> = {\n sub: DidString\n aud: string\n jti: string \| undefined\n scope: S\n}\n\nexport class AuthVerifier {\n private _publicUrl: string\n private _jwtKey: KeyObject\n private _adminPass: string\n public dids: AuthVerifierOpts['dids']\n\n constructor(\n public accountManager: AccountManager,\n public idResolver: IdResolver,\n public oauthVerifier: OAuthVerifier,\n opts: AuthVerifierOpts,\n ) {\n this._publicUrl = opts.publicUrl\n this._jwtKey = opts.jwtKey\n this._adminPass = opts.adminPass\n this.dids = opts.dids\n }\n\n // verifiers (arrow fns to preserve scope)\n\n public unauthenticated: MethodAuthVerifier<UnauthenticatedOutput> = (ctx) => {\n setAuthHeaders(ctx.res)\n\n // @NOTE this auth method is typically used as fallback when no other auth\n // method is applicable. This means that the presence of an \"authorization\"\n // header means that that header is invalid (as it did not match any of the\n // other auth methods).\n if (ctx.req.headers['authorization']) {\n throw new AuthRequiredError('Invalid authorization header')\n }\n\n return {\n credentials: null,\n }\n }\n\n public adminToken: MethodAuthVerifier<AdminTokenOutput> = async (ctx) => {\n setAuthHeaders(ctx.res)\n const parsed = parseBasicAuth(ctx.req)\n if (!parsed) {\n throw new AuthRequiredError()\n }\n const { username, password } = parsed\n if (username !== 'admin' \|\| password !== this._adminPass) {\n throw new AuthRequiredError()\n }\n\n return { credentials: { type: 'admin_token' } }\n }\n\n public modService: MethodAuthVerifier<ModServiceOutput> = async (ctx) => {\n setAuthHeaders(ctx.res)\n if (!this.dids.modService) {\n throw new AuthRequiredError('Untrusted issuer', 'UntrustedIss')\n }\n const payload = await this.verifyServiceJwt(ctx.req, {\n iss: [this.dids.modService, `${this.dids.modService}#atproto_labeler`],\n })\n return {\n credentials: {\n type: 'mod_service',\n did: payload.iss,\n },\n }\n }\n\n public moderator: MethodAuthVerifier<AdminTokenOutput \| ModServiceOutput> =\n async (ctx) => {\n const type = extractAuthType(ctx.req)\n if (type === AuthType.BEARER) {\n return this.modService(ctx)\n } else {\n return this.adminToken(ctx)\n }\n }\n\n protected access<S extends AuthScope>(\n options: VerifiedOptions & Required<ScopedOptions<S>>,\n ): MethodAuthVerifier<AccessOutput<S>> {\n const { scopes, ...statusOptions } = options\n\n const verifyJwtOptions: VerifyBearerJwtOptions<S> = {\n audience: this.dids.pds,\n typ: 'at+jwt',\n scopes:\n // @NOTE We can reject taken down credentials based on the scope if\n // \"checkTakedown\" is set.\n statusOptions.checkTakedown && scopes.includes(AuthScope.Takendown as S)\n ? scopes.filter((s) => s !== AuthScope.Takendown)\n : scopes,\n }\n\n return async (ctx) => {\n setAuthHeaders(ctx.res)\n\n const { sub: did, scope } = await this.verifyBearerJwt(\n ctx.req,\n verifyJwtOptions,\n )\n\n await this.verifyStatus(did, statusOptions)\n\n return {\n credentials: { type: 'access', did, scope },\n }\n }\n }\n\n public refresh(options?: {\n allowExpired?: boolean\n }): MethodAuthVerifier<RefreshOutput> {\n const verifyOptions: VerifyBearerJwtOptions<AuthScope.Refresh> = {\n clockTolerance: options?.allowExpired ? Infinity : undefined,\n typ: 'refresh+jwt',\n // when using entryway, proxying refresh credentials\n audience: this.dids.entryway ? this.dids.entryway : this.dids.pds,\n scopes: [AuthScope.Refresh],\n }\n\n return async (ctx) => {\n setAuthHeaders(ctx.res)\n\n const result = await this.verifyBearerJwt(ctx.req, verifyOptions)\n\n const tokenId = result.jti\n if (!tokenId) {\n throw new AuthRequiredError(\n 'Unexpected missing refresh token id',\n 'MissingTokenId',\n )\n }\n\n return {\n credentials: {\n type: 'refresh',\n did: result.sub,\n scope: result.scope,\n tokenId,\n },\n }\n }\n }\n\n public authorization<P extends Params>({\n scopes = ACCESS_STANDARD,\n additional = [],\n ...options\n }: VerifiedOptions &\n ScopedOptions &\n ExtraScopedOptions &\n AuthorizedOptions<P>): MethodAuthVerifier<AccessOutput \| OAuthOutput, P> {\n const access = this.access({\n ...options,\n scopes: [...scopes, ...additional],\n })\n const oauth = this.oauth(options)\n\n return async (ctx) => {\n const type = extractAuthType(ctx.req)\n\n if (type === AuthType.BEARER) {\n return access(ctx)\n }\n\n if (type === AuthType.DPOP) {\n return oauth(ctx)\n }\n\n // Auth headers are set through the access and oauth methods so we only\n // need to set them here if we reach this point\n setAuthHeaders(ctx.res)\n\n if (type !== null) {\n throw new InvalidRequestError(\n 'Unexpected authorization type',\n 'InvalidToken',\n )\n }\n\n throw new AuthRequiredError(undefined, 'AuthMissing')\n }\n }\n\n public authorizationOrAdminTokenOptional<P extends Params>(\n opts: VerifiedOptions & ExtraScopedOptions & AuthorizedOptions<P>,\n ): MethodAuthVerifier<\n OAuthOutput \| AccessOutput \| AdminTokenOutput \| UnauthenticatedOutput,\n P\n > {\n const authorization = this.authorization(opts)\n return async (ctx) => {\n const type = extractAuthType(ctx.req)\n if (type === AuthType.BEARER \|\| type === AuthType.DPOP) {\n return authorization(ctx)\n } else if (type === AuthType.BASIC) {\n return this.adminToken(ctx)\n } else {\n return this.unauthenticated(ctx)\n }\n }\n }\n\n public userServiceAuth: MethodAuthVerifier<UserServiceAuthOutput> = async (\n ctx,\n ) => {\n setAuthHeaders(ctx.res)\n const payload = await this.verifyServiceJwt(ctx.req)\n return {\n credentials: {\n type: 'user_service_auth',\n did: payload.iss,\n },\n }\n }\n\n public userServiceAuthOptional: MethodAuthVerifier<\n UserServiceAuthOutput \| UnauthenticatedOutput\n > = async (ctx) => {\n const type = extractAuthType(ctx.req)\n if (type === AuthType.BEARER) {\n return await this.userServiceAuth(ctx)\n } else {\n return this.unauthenticated(ctx)\n }\n }\n\n public authorizationOrUserServiceAuth<P extends Params>(\n options: VerifiedOptions &\n ScopedOptions &\n ExtraScopedOptions &\n AuthorizedOptions<P>,\n ): MethodAuthVerifier<UserServiceAuthOutput \| OAuthOutput \| AccessOutput, P> {\n const authorizationVerifier = this.authorization(options)\n return async (ctx) => {\n if (isDefinitelyServiceAuth(ctx.req)) {\n return this.userServiceAuth(ctx)\n } else {\n return authorizationVerifier(ctx)\n }\n }\n }\n\n protected oauth<P extends Params>({\n authorize,\n ...verifyStatusOptions\n }: VerifiedOptions & AuthorizedOptions<P>): MethodAuthVerifier<\n OAuthOutput,\n P\n > {\n const verifyTokenOptions: VerifyTokenPayloadOptions = {\n audience: [this.dids.pds],\n scope: ['atproto'],\n }\n\n return async (ctx) => {\n setAuthHeaders(ctx.res)\n\n const { req, res } = ctx\n\n // https://datatracker.ietf.org/doc/html/rfc9449#section-8.2\n const dpopNonce = this.oauthVerifier.nextDpopNonce()\n if (dpopNonce) {\n res.setHeader('DPoP-Nonce', dpopNonce)\n res.appendHeader('Access-Control-Expose-Headers', 'DPoP-Nonce')\n }\n\n const originalUrl = req.originalUrl \|\| req.url \|\| '/'\n const url = new URL(originalUrl, this._publicUrl)\n\n const { scope, sub: did } = await this.oauthVerifier\n .authenticateRequest(\n req.method \|\| 'GET',\n url,\n req.headers,\n verifyTokenOptions,\n )\n .catch((err) => {\n // Make sure to include any WWW-Authenticate header in the response\n // (particularly useful for DPoP's \"use_dpop_nonce\" error)\n if (err instanceof WWWAuthenticateError) {\n res.setHeader('WWW-Authenticate', err.wwwAuthenticateHeader)\n res.appendHeader(\n 'Access-Control-Expose-Headers',\n 'WWW-Authenticate',\n )\n }\n\n if (err instanceof OAuthError) {\n throw new XRPCError(err.status, err.error_description, err.error)\n }\n\n throw err\n })\n\n if (!isDidString(did)) {\n throw new InvalidRequestError('Malformed token', 'InvalidToken')\n }\n\n await this.verifyStatus(did, verifyStatusOptions)\n\n const permissions = new ScopePermissionsTransition(scope?.split(' '))\n\n // Should never happen\n if (!permissions.scopes.has('atproto')) {\n throw new InvalidRequestError(\n 'OAuth token does not have \"atproto\" scope',\n 'InvalidToken',\n )\n }\n\n await authorize(permissions, ctx)\n\n return {\n credentials: {\n type: 'oauth',\n did,\n permissions,\n },\n }\n }\n }\n\n protected async verifyStatus(\n did: DidString,\n options: VerifiedOptions,\n ): Promise<void> {\n if (options.checkDeactivated \|\| options.checkTakedown) {\n await this.findAccount(did, options)\n }\n }\n\n /*\n Finds an account by its handle or DID, returning possibly deactivated or\n * taken down accounts (unless `options.checkDeactivated` or\n * `options.checkTakedown` are set to true, respectively).\n /\n public async findAccount(\n handleOrDid: AtIdentifierString,\n options: VerifiedOptions,\n ): Promise<ActorAccount> {\n const account = await this.accountManager.getAccount(handleOrDid, {\n includeDeactivated: true,\n includeTakenDown: true,\n })\n if (!account) {\n // will be turned into ExpiredToken for the client if proxied by entryway\n throw new ForbiddenError('Account not found', 'AccountNotFound')\n }\n if (options.checkTakedown && softDeleted(account)) {\n throw new AuthRequiredError(\n 'Account has been taken down',\n 'AccountTakedown',\n )\n }\n if (options.checkDeactivated && account.deactivatedAt) {\n throw new AuthRequiredError(\n 'Account is deactivated',\n 'AccountDeactivated',\n )\n }\n return account\n }\n\n /\n Wraps {@link jose.jwtVerify} into a function that also validates the token\n * payload's type and wraps errors into {@link InvalidRequestError}.\n /\n protected async verifyBearerJwt<S extends AuthScope = AuthScope>(\n req: IncomingMessage,\n { scopes, ...options }: VerifyBearerJwtOptions<S>,\n ): Promise<VerifyBearerJwtResult<S>> {\n const token = bearerTokenFromReq(req)\n if (!token) {\n throw new AuthRequiredError(undefined, 'AuthMissing')\n }\n\n const { payload } = await jose\n .jwtVerify(token, this._jwtKey, options)\n .catch((cause) => {\n if (cause instanceof jose.errors.JWTExpired) {\n throw new InvalidRequestError('Token has expired', 'ExpiredToken', {\n cause,\n })\n } else {\n throw new InvalidRequestError(\n 'Token could not be verified',\n 'InvalidToken',\n { cause },\n )\n }\n })\n\n const { sub, aud, scope, lxm, cnf, jti } = payload\n\n if (typeof lxm !== 'undefined') {\n // Service auth tokens should never make it to here. But since service\n // auth tokens do not have a \"typ\" header, the \"typ\" check above will not\n // catch them. This check here is mainly to protect against the\n // hypothetical case in which a PDS would issue service auth tokens using\n // its private key.\n throw new InvalidRequestError('Malformed token', 'InvalidToken')\n }\n if (typeof cnf !== 'undefined') {\n // Proof-of-Possession (PoP) tokens are not allowed here\n // https://www.rfc-editor.org/rfc/rfc7800.html\n throw new InvalidRequestError('Malformed token', 'InvalidToken')\n }\n if (typeof sub !== 'string' \|\| !isDidString(sub)) {\n throw new InvalidRequestError('Malformed token', 'InvalidToken')\n }\n if (typeof aud !== 'string' \|\| !aud.startsWith('did:')) {\n throw new InvalidRequestError('Malformed token', 'InvalidToken')\n }\n if (typeof jti !== 'string' && typeof jti !== 'undefined') {\n throw new InvalidRequestError('Malformed token', 'InvalidToken')\n }\n if (!isAuthScope(scope) \|\| !scopes.includes(scope as any)) {\n throw new InvalidRequestError('Bad token scope', 'InvalidToken')\n }\n\n return { sub, aud, jti, scope: scope as S }\n }\n\n protected async verifyServiceJwt(\n req: IncomingMessage,\n opts?: { iss?: string[] },\n ) {\n const jwtStr = bearerTokenFromReq(req)\n if (!jwtStr) {\n throw new AuthRequiredError('missing jwt', 'MissingJwt')\n }\n\n const nsid = parseReqNsid(req)\n const payload = await verifyServiceJwt(\n jwtStr,\n null,\n nsid,\n async (iss, forceRefresh) => {\n if (opts?.iss && !opts.iss.includes(iss)) {\n throw new AuthRequiredError('Untrusted issuer', 'UntrustedIss')\n }\n const [did, serviceId] = iss.split('#')\n const keyId =\n serviceId === 'atproto_labeler' ? 'atproto_label' : 'atproto'\n const didDoc = await this.idResolver.did.resolve(did, forceRefresh)\n if (!didDoc) {\n throw new AuthRequiredError('could not resolve iss did')\n }\n const parsedKey = getVerificationMaterial(didDoc, keyId)\n if (!parsedKey) {\n throw new AuthRequiredError('missing or bad key in did doc')\n }\n const didKey = getDidKeyFromMultibase(parsedKey)\n if (!didKey) {\n throw new AuthRequiredError('missing or bad key in did doc')\n }\n return didKey\n },\n )\n if (\n payload.aud !== this.dids.pds &&\n (!this.dids.entryway \|\| payload.aud !== this.dids.entryway)\n ) {\n throw new AuthRequiredError(\n 'jwt audience does not match service did',\n 'BadJwtAudience',\n )\n }\n return payload\n }\n}\n\n// HELPERS\n// ---------\n\nexport function isUserOrAdmin(\n auth: AccessOutput \| OAuthOutput \| AdminTokenOutput \| UnauthenticatedOutput,\n did: string,\n): boolean {\n if (!auth.credentials) {\n return false\n } else if (auth.credentials.type === 'admin_token') {\n return true\n } else {\n return auth.credentials.did === did\n }\n}\n\nenum AuthType {\n BASIC = 'Basic',\n BEARER = 'Bearer',\n DPOP = 'DPoP',\n}\n\nconst parseAuthorizationHeader = (\n req: IncomingMessage,\n): [type: null] \| [type: AuthType, token: string] => {\n const authorization = req.headers['authorization']\n if (!authorization) return [null]\n\n const result = authorization.split(' ')\n if (result.length !== 2) {\n throw new InvalidRequestError(\n 'Malformed authorization header',\n 'InvalidToken',\n )\n }\n\n // authorization type is case-insensitive\n const authType = result[0].toUpperCase()\n\n const type = Object.hasOwn(AuthType, authType) ? AuthType[authType] : null\n if (type) return [type, result[1]]\n\n throw new InvalidRequestError(\n `Unsupported authorization type: ${result[0]}`,\n 'InvalidToken',\n )\n}\n\n/\n @note Not all service auth tokens are guaranteed to have \"lxm\" claim, so this\n * function should not be used to verify service auth tokens. It is only used to\n * check if a token is definitely a service auth token.\n */\nconst isDefinitelyServiceAuth = (req: IncomingMessage): boolean => {\n const token = bearerTokenFromReq(req)\n if (!token) return false\n const payload = jose.decodeJwt(token)\n return payload['lxm'] != null\n}\n\nconst extractAuthType = (req: IncomingMessage): AuthType \| null => {\n const [type] = parseAuthorizationHeader(req)\n return type\n}\n\nexport const bearerTokenFromReq = (req: IncomingMessage) => {\n const [type, token] = parseAuthorizationHeader(req)\n return type === AuthType.BEARER ? token : null\n}\n\nconst parseBasicAuth = (\n req: IncomingMessage,\n): { username: string; password: string } \| null => {\n try {\n const [type, b64] = parseAuthorizationHeader(req)\n if (type !== AuthType.BASIC) return null\n const decoded = Buffer.from(b64, 'base64').toString('utf8')\n // We must not use split(':') because the password can contain colons\n const colon = decoded.indexOf(':')\n if (colon === -1) return null\n const username = decoded.slice(0, colon)\n const password = decoded.slice(colon + 1)\n return { username, password }\n } catch (err) {\n return null\n }\n}\n\nexport const createSecretKeyObject = (secret: string): KeyObject => {\n return createSecretKey(Buffer.from(secret))\n}\n\nconst keyEncoder = new KeyEncoder('secp256k1')\nexport const createPublicKeyObject = (publicKeyHex: string): KeyObject => {\n const key = keyEncoder.encodePublic(publicKeyHex, 'raw', 'pem')\n return createPublicKey({ format: 'pem', key })\n}\n\nfunction setAuthHeaders(res: ServerResponse) {\n res.setHeader('Cache-Control', 'private')\n appendVary(res, 'Authorization')\n}\n"]}
1	+ {"version":3,"file":"auth-verifier.js","sourceRoot":"","sources":["../src/auth-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,eAAe,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAE9E,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,gBAAgB,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAA;AACzD,OAAO,EAAmB,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAC3E,OAAO,EAGL,WAAW,GACZ,MAAM,cAAc,CAAA;AACrB,OAAO,EACL,UAAU,EACV,oBAAoB,GACrB,MAAM,gCAAgC,CAAA;AAKvC,OAAO,EAEL,0BAA0B,GAC3B,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,iBAAiB,EAEjB,cAAc,EACd,mBAAmB,EAInB,SAAS,EACT,YAAY,EACZ,SAAS,IAAI,gBAAgB,GAC9B,MAAM,sBAAsB,CAAA;AAY7B,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAG3C,2FAA2F;AAC3F,MAAM,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAA;AAgD5D,MAAM,OAAO,YAAY;IAMvB,YACS,cAA8B,EAC9B,UAAsB,EACtB,aAA4B,EACnC,IAAsB;QAHf,mBAAc,GAAd,cAAc,CAAgB;QAC9B,eAAU,GAAV,UAAU,CAAY;QACtB,kBAAa,GAAb,aAAa,CAAe;QASrC,0CAA0C;QAEnC,oBAAe,GAA8C,CAAC,GAAG,EAAE,EAAE;YAC1E,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,0EAA0E;YAC1E,2EAA2E;YAC3E,2EAA2E;YAC3E,uBAAuB;YACvB,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,iBAAiB,CAAC,8BAA8B,CAAC,CAAA;YAC7D,CAAC;YAED,OAAO;gBACL,WAAW,EAAE,IAAI;aAClB,CAAA;QACH,CAAC,CAAA;QAED,6DAA6D;QACtD,eAAU,GAAyC,KAAK,EAAE,GAAG,EAAE,EAAE;YACtE,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACvB,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACtC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,iBAAiB,EAAE,CAAA;YAC/B,CAAC;YACD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAA;YACrC,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;gBACzD,MAAM,IAAI,iBAAiB,EAAE,CAAA;YAC/B,CAAC;YAED,OAAO,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CAAA;QACjD,CAAC,CAAA;QAEM,eAAU,GAAyC,KAAK,EAAE,GAAG,EAAE,EAAE;YACtE,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACvB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC1B,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAA;YACjE,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE;gBACnD,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,kBAAkB,CAAC;aACvE,CAAC,CAAA;YACF,OAAO;gBACL,WAAW,EAAE;oBACX,IAAI,EAAE,aAAa;oBACnB,GAAG,EAAE,OAAO,CAAC,GAAG;iBACjB;aACF,CAAA;QACH,CAAC,CAAA;QAED,qGAAqG;QAC9F,cAAS,GACd,KAAK,EAAE,GAAG,EAAE,EAAE;YACZ,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACrC,IAAI,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;YAC7B,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;YAC7B,CAAC;QACH,CAAC,CAAA;QAgJI,oBAAe,GAA8C,KAAK,EACvE,GAAG,EACH,EAAE;YACF,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACvB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACpD,OAAO;gBACL,WAAW,EAAE;oBACX,IAAI,EAAE,mBAAmB;oBACzB,GAAG,EAAE,OAAO,CAAC,GAAG;iBACjB;aACF,CAAA;QACH,CAAC,CAAA;QAEM,4BAAuB,GAE1B,KAAK,EAAE,GAAG,EAAE,EAAE;YAChB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACrC,IAAI,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC7B,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YACxC,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YAClC,CAAC;QACH,CAAC,CAAA;QAtOC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAA;QAChC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAA;QAC1B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAA;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;IACvB,CAAC;IA8DS,MAAM,CACd,OAAqD;QAErD,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,EAAE,GAAG,OAAO,CAAA;QAE5C,MAAM,gBAAgB,GAA8B;YAClD,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG;YACvB,GAAG,EAAE,QAAQ;YACb,MAAM;YACJ,mEAAmE;YACnE,0BAA0B;YAC1B,aAAa,CAAC,aAAa,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAc,CAAC;gBACtE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,SAAS,CAAC;gBACjD,CAAC,CAAC,MAAM;SACb,CAAA;QAED,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CACpD,GAAG,CAAC,GAAG,EACP,gBAAgB,CACjB,CAAA;YAED,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;YAE3C,OAAO;gBACL,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE;aAC5C,CAAA;QACH,CAAC,CAAA;IACH,CAAC;IAEM,OAAO,CAAC,OAEd;QACC,MAAM,aAAa,GAA8C;YAC/D,cAAc,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;YAC5D,GAAG,EAAE,aAAa;YAClB,oDAAoD;YACpD,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACjE,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC;SAC5B,CAAA;QAED,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;YAEjE,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAA;YAC1B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,iBAAiB,CACzB,qCAAqC,EACrC,gBAAgB,CACjB,CAAA;YACH,CAAC;YAED,OAAO;gBACL,WAAW,EAAE;oBACX,IAAI,EAAE,SAAS;oBACf,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,OAAO;iBACR;aACF,CAAA;QACH,CAAC,CAAA;IACH,CAAC;IAEM,aAAa,CAAmB,EACrC,MAAM,GAAG,eAAe,EACxB,UAAU,GAAG,EAAE,EACf,GAAG,OAAO,EAIU;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YACzB,GAAG,OAAO;YACV,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,UAAU,CAAC;SACnC,CAAC,CAAA;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAEjC,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAErC,IAAI,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC7B,OAAO,MAAM,CAAC,GAAG,CAAC,CAAA;YACpB,CAAC;YAED,IAAI,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAC3B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAA;YACnB,CAAC;YAED,uEAAuE;YACvE,+CAA+C;YAC/C,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,mBAAmB,CAC3B,+BAA+B,EAC/B,cAAc,CACf,CAAA;YACH,CAAC;YAED,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;QACvD,CAAC,CAAA;IACH,CAAC;IAEM,yBAAyB,CAC9B,IAAiE;QAEjE,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;QAC9C,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;YACnC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;oBACrC,OAAO,aAAa,CAAC,GAAG,CAAC,CAAA;gBAC3B,CAAC;gBACD,MAAM,GAAG,CAAA;YACX,CAAC;QACH,CAAC,CAAA;IACH,CAAC;IAEM,iCAAiC,CACtC,IAAiE;QAKjE,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;QAC9C,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACrC,IAAI,IAAI,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACvD,OAAO,aAAa,CAAC,GAAG,CAAC,CAAA;YAC3B,CAAC;iBAAM,IAAI,IAAI,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACnC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;YAC7B,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YAClC,CAAC;QACH,CAAC,CAAA;IACH,CAAC;IA0BM,8BAA8B,CACnC,OAGsB;QAEtB,MAAM,qBAAqB,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;QACzD,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,IAAI,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrC,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;YAClC,CAAC;iBAAM,CAAC;gBACN,OAAO,qBAAqB,CAAC,GAAG,CAAC,CAAA;YACnC,CAAC;QACH,CAAC,CAAA;IACH,CAAC;IAES,KAAK,CAAmB,EAChC,SAAS,EACT,GAAG,mBAAmB,EACiB;QAIvC,MAAM,kBAAkB,GAA8B;YACpD,QAAQ,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YACzB,KAAK,EAAE,CAAC,SAAS,CAAC;SACnB,CAAA;QAED,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAEvB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,CAAA;YAExB,4DAA4D;YAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,CAAA;YACpD,IAAI,SAAS,EAAE,CAAC;gBACd,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,SAAS,CAAC,CAAA;gBACtC,GAAG,CAAC,YAAY,CAAC,+BAA+B,EAAE,YAAY,CAAC,CAAA;YACjE,CAAC;YAED,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAA;YACrD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;YAEjD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa;iBACjD,mBAAmB,CAClB,GAAG,CAAC,MAAM,IAAI,KAAK,EACnB,GAAG,EACH,GAAG,CAAC,OAAO,EACX,kBAAkB,CACnB;iBACA,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACb,mEAAmE;gBACnE,0DAA0D;gBAC1D,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;oBACxC,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,GAAG,CAAC,qBAAqB,CAAC,CAAA;oBAC5D,GAAG,CAAC,YAAY,CACd,+BAA+B,EAC/B,kBAAkB,CACnB,CAAA;gBACH,CAAC;gBAED,IAAI,GAAG,YAAY,UAAU,EAAE,CAAC;oBAC9B,MAAM,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,iBAAiB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAA;gBACnE,CAAC;gBAED,MAAM,GAAG,CAAA;YACX,CAAC,CAAC,CAAA;YAEJ,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;YAClE,CAAC;YAED,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAA;YAEjD,MAAM,WAAW,GAAG,IAAI,0BAA0B,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;YAErE,sBAAsB;YACtB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,mBAAmB,CAC3B,2CAA2C,EAC3C,cAAc,CACf,CAAA;YACH,CAAC;YAED,MAAM,SAAS,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;YAEjC,OAAO;gBACL,WAAW,EAAE;oBACX,IAAI,EAAE,OAAO;oBACb,GAAG;oBACH,WAAW;iBACZ;aACF,CAAA;QACH,CAAC,CAAA;IACH,CAAC;IAES,KAAK,CAAC,YAAY,CAC1B,GAAc,EACd,OAAwB;QAExB,IAAI,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YACtD,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QACtC,CAAC;IACH,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,WAAW,CACtB,WAA+B,EAC/B,OAAwB;QAExB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,WAAW,EAAE;YAChE,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,yEAAyE;YACzE,MAAM,IAAI,cAAc,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,CAAC,aAAa,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,iBAAiB,CACzB,6BAA6B,EAC7B,iBAAiB,CAClB,CAAA;QACH,CAAC;QACD,IAAI,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YACtD,MAAM,IAAI,iBAAiB,CACzB,wBAAwB,EACxB,oBAAoB,CACrB,CAAA;QACH,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IAED;;;OAGG;IACO,KAAK,CAAC,eAAe,CAC7B,GAAoB,EACpB,EAAE,MAAM,EAAE,GAAG,OAAO,EAA6B;QAEjD,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;QACrC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;QACvD,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI;aAC3B,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;aACvC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACf,IAAI,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC5C,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,EAAE,cAAc,EAAE;oBACjE,KAAK;iBACN,CAAC,CAAA;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,mBAAmB,CAC3B,6BAA6B,EAC7B,cAAc,EACd,EAAE,KAAK,EAAE,CACV,CAAA;YACH,CAAC;QACH,CAAC,CAAC,CAAA;QAEJ,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;QAElD,IAAI,OAAO,GAAG,KAAK,WAAW,EAAE,CAAC;YAC/B,sEAAsE;YACtE,yEAAyE;YACzE,+DAA+D;YAC/D,yEAAyE;YACzE,mBAAmB;YACnB,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,WAAW,EAAE,CAAC;YAC/B,wDAAwD;YACxD,8CAA8C;YAC9C,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,WAAW,EAAE,CAAC;YAC1D,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAY,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;QAClE,CAAC;QAED,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,KAAU,EAAE,CAAA;IAC7C,CAAC;IAES,KAAK,CAAC,gBAAgB,CAC9B,GAAoB,EACpB,IAAyB;QAEzB,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,iBAAiB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAA;QAC1D,CAAC;QAED,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;QAC9B,MAAM,OAAO,GAAG,MAAM,gBAAgB,CACpC,MAAM,EACN,IAAI,EACJ,IAAI,EACJ,KAAK,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE;YAC1B,IAAI,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAA;YACjE,CAAC;YACD,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACvC,MAAM,KAAK,GACT,SAAS,KAAK,iBAAiB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAA;YAC/D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;YACnE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,iBAAiB,CAAC,2BAA2B,CAAC,CAAA;YAC1D,CAAC;YACD,MAAM,SAAS,GAAG,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;YACxD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,iBAAiB,CAAC,+BAA+B,CAAC,CAAA;YAC9D,CAAC;YACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAA;YAChD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,iBAAiB,CAAC,+BAA+B,CAAC,CAAA;YAC9D,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC,CACF,CAAA;QACD,IACE,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG;YAC7B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAC3D,CAAC;YACD,MAAM,IAAI,iBAAiB,CACzB,yCAAyC,EACzC,gBAAgB,CACjB,CAAA;QACH,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;CACF;AAED,UAAU;AACV,YAAY;AAEZ,MAAM,UAAU,aAAa,CAC3B,IAA2E,EAC3E,GAAW;IAEX,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtB,OAAO,KAAK,CAAA;IACd,CAAC;SAAM,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACnD,OAAO,IAAI,CAAA;IACb,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,KAAK,GAAG,CAAA;IACrC,CAAC;AACH,CAAC;AAED,IAAK,QAIJ;AAJD,WAAK,QAAQ;IACX,2BAAe,CAAA;IACf,6BAAiB,CAAA;IACjB,yBAAa,CAAA;AACf,CAAC,EAJI,QAAQ,KAAR,QAAQ,QAIZ;AAED,MAAM,wBAAwB,GAAG,CAC/B,GAAoB,EAC4B,EAAE;IAClD,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;IAClD,IAAI,CAAC,aAAa;QAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACvC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,mBAAmB,CAC3B,gCAAgC,EAChC,cAAc,CACf,CAAA;IACH,CAAC;IAED,yCAAyC;IACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;IAExC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC1E,IAAI,IAAI;QAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;IAElC,MAAM,IAAI,mBAAmB,CAC3B,mCAAmC,MAAM,CAAC,CAAC,CAAC,EAAE,EAC9C,cAAc,CACf,CAAA;AACH,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,uBAAuB,GAAG,CAAC,GAAoB,EAAW,EAAE;IAChE,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;IACrC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IACxB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IACrC,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,CAAA;AAC/B,CAAC,CAAA;AAED,MAAM,eAAe,GAAG,CAAC,GAAoB,EAAmB,EAAE;IAChE,MAAM,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAA;IAC5C,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAoB,EAAE,EAAE;IACzD,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAA;IACnD,OAAO,IAAI,KAAK,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AAChD,CAAC,CAAA;AAED,MAAM,cAAc,GAAG,CACrB,GAAoB,EAC2B,EAAE;IACjD,IAAI,CAAC;QACH,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAA;QACjD,IAAI,IAAI,KAAK,QAAQ,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACxC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAC3D,qEAAqE;QACrE,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAA;QAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;QACzC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAA;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,MAAc,EAAa,EAAE;IACjE,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;AAC7C,CAAC,CAAA;AAED,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,CAAA;AAC9C,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,YAAoB,EAAa,EAAE;IACvE,MAAM,GAAG,GAAG,UAAU,CAAC,YAAY,CAAC,YAAY,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;IAC/D,OAAO,eAAe,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;AAChD,CAAC,CAAA;AAED,SAAS,cAAc,CAAC,GAAmB;IACzC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,SAAS,CAAC,CAAA;IACzC,UAAU,CAAC,GAAG,EAAE,eAAe,CAAC,CAAA;AAClC,CAAC","sourcesContent":["import { type KeyObject, createPublicKey, createSecretKey } from 'node:crypto'\nimport type { IncomingMessage, ServerResponse } from 'node:http'\nimport * as jose from 'jose'\nimport KeyEncoderModule from 'key-encoder'\nimport { getVerificationMaterial } from '@atproto/common'\nimport { type IdResolver, getDidKeyFromMultibase } from '@atproto/identity'\nimport {\n type AtIdentifierString,\n type DidString,\n isDidString,\n} from '@atproto/lex'\nimport {\n OAuthError,\n WWWAuthenticateError,\n} from '@atproto/oauth-provider/errors'\nimport type {\n OAuthVerifier,\n VerifyTokenPayloadOptions,\n} from '@atproto/oauth-provider/verifier'\nimport {\n type ScopePermissions,\n ScopePermissionsTransition,\n} from '@atproto/oauth-scopes'\nimport {\n AuthRequiredError,\n type Awaitable,\n ForbiddenError,\n InvalidRequestError,\n type MethodAuthContext,\n type MethodAuthVerifier,\n type Params,\n XRPCError,\n parseReqNsid,\n verifyJwt as verifyServiceJwt,\n} from '@atproto/xrpc-server'\nimport type { AccountManager } from './account-manager/account-manager.js'\nimport type { ActorAccount } from './account-manager/helpers/account.js'\nimport type {\n AccessOutput,\n AdminTokenOutput,\n ModServiceOutput,\n OAuthOutput,\n RefreshOutput,\n UnauthenticatedOutput,\n UserServiceAuthOutput,\n} from './auth-output.js'\nimport { ACCESS_STANDARD, AuthScope, isAuthScope } from './auth-scope.js'\nimport { softDeleted } from './db/index.js'\nimport { appendVary } from './util/http.js'\nimport type { WithRequired } from './util/types.js'\n\n// key-encoder is CJS with exports.default; Node ESM interop wraps it as { default: Class }\nconst KeyEncoder = ((m) => m.default ?? m)(KeyEncoderModule)\n\nexport type VerifiedOptions = {\n checkTakedown?: boolean\n checkDeactivated?: boolean\n}\n\nexport type ScopedOptions<S extends AuthScope = AuthScope> = {\n scopes?: readonly S[]\n}\n\nexport type ExtraScopedOptions<S extends AuthScope = AuthScope> = {\n additional?: readonly S[]\n}\n\nexport type AuthorizedOptions<P extends Params = Params> = {\n authorize: (\n permissions: ScopePermissions,\n ctx: MethodAuthContext<P>,\n ) => Awaitable<void>\n}\n\nexport type AuthVerifierOpts = {\n publicUrl: string\n jwtKey: KeyObject\n adminPass: string\n dids: {\n pds: string\n entryway?: string\n modService?: string\n }\n}\n\nexport type VerifyBearerJwtOptions<S extends AuthScope = AuthScope> =\n WithRequired<\n Omit<jose.JWTVerifyOptions, 'scopes'> & {\n scopes: readonly S[]\n },\n 'audience' \| 'typ'\n >\n\nexport type VerifyBearerJwtResult<S extends AuthScope = AuthScope> = {\n sub: DidString\n aud: string\n jti: string \| undefined\n scope: S\n}\n\nexport class AuthVerifier {\n private _publicUrl: string\n private _jwtKey: KeyObject\n private _adminPass: string\n public dids: AuthVerifierOpts['dids']\n\n constructor(\n public accountManager: AccountManager,\n public idResolver: IdResolver,\n public oauthVerifier: OAuthVerifier,\n opts: AuthVerifierOpts,\n ) {\n this._publicUrl = opts.publicUrl\n this._jwtKey = opts.jwtKey\n this._adminPass = opts.adminPass\n this.dids = opts.dids\n }\n\n // verifiers (arrow fns to preserve scope)\n\n public unauthenticated: MethodAuthVerifier<UnauthenticatedOutput> = (ctx) => {\n setAuthHeaders(ctx.res)\n\n // @NOTE this auth method is typically used as fallback when no other auth\n // method is applicable. This means that the presence of an \"authorization\"\n // header means that that header is invalid (as it did not match any of the\n // other auth methods).\n if (ctx.req.headers['authorization']) {\n throw new AuthRequiredError('Invalid authorization header')\n }\n\n return {\n credentials: null,\n }\n }\n\n /** @deprecated We are steering away from this auth method /\n public adminToken: MethodAuthVerifier<AdminTokenOutput> = async (ctx) => {\n setAuthHeaders(ctx.res)\n const parsed = parseBasicAuth(ctx.req)\n if (!parsed) {\n throw new AuthRequiredError()\n }\n const { username, password } = parsed\n if (username !== 'admin' \|\| password !== this._adminPass) {\n throw new AuthRequiredError()\n }\n\n return { credentials: { type: 'admin_token' } }\n }\n\n public modService: MethodAuthVerifier<ModServiceOutput> = async (ctx) => {\n setAuthHeaders(ctx.res)\n if (!this.dids.modService) {\n throw new AuthRequiredError('Untrusted issuer', 'UntrustedIss')\n }\n const payload = await this.verifyServiceJwt(ctx.req, {\n iss: [this.dids.modService, `${this.dids.modService}#atproto_labeler`],\n })\n return {\n credentials: {\n type: 'mod_service',\n did: payload.iss,\n },\n }\n }\n\n /* @deprecated We are steering away from {@link adminToken} auth. Use {@link modService} instead. /\n public moderator: MethodAuthVerifier<AdminTokenOutput \| ModServiceOutput> =\n async (ctx) => {\n const type = extractAuthType(ctx.req)\n if (type === AuthType.BEARER) {\n return this.modService(ctx)\n } else {\n return this.adminToken(ctx)\n }\n }\n\n protected access<S extends AuthScope>(\n options: VerifiedOptions & Required<ScopedOptions<S>>,\n ): MethodAuthVerifier<AccessOutput<S>> {\n const { scopes, ...statusOptions } = options\n\n const verifyJwtOptions: VerifyBearerJwtOptions<S> = {\n audience: this.dids.pds,\n typ: 'at+jwt',\n scopes:\n // @NOTE We can reject taken down credentials based on the scope if\n // \"checkTakedown\" is set.\n statusOptions.checkTakedown && scopes.includes(AuthScope.Takendown as S)\n ? scopes.filter((s) => s !== AuthScope.Takendown)\n : scopes,\n }\n\n return async (ctx) => {\n setAuthHeaders(ctx.res)\n\n const { sub: did, scope } = await this.verifyBearerJwt(\n ctx.req,\n verifyJwtOptions,\n )\n\n await this.verifyStatus(did, statusOptions)\n\n return {\n credentials: { type: 'access', did, scope },\n }\n }\n }\n\n public refresh(options?: {\n allowExpired?: boolean\n }): MethodAuthVerifier<RefreshOutput> {\n const verifyOptions: VerifyBearerJwtOptions<AuthScope.Refresh> = {\n clockTolerance: options?.allowExpired ? Infinity : undefined,\n typ: 'refresh+jwt',\n // when using entryway, proxying refresh credentials\n audience: this.dids.entryway ? this.dids.entryway : this.dids.pds,\n scopes: [AuthScope.Refresh],\n }\n\n return async (ctx) => {\n setAuthHeaders(ctx.res)\n\n const result = await this.verifyBearerJwt(ctx.req, verifyOptions)\n\n const tokenId = result.jti\n if (!tokenId) {\n throw new AuthRequiredError(\n 'Unexpected missing refresh token id',\n 'MissingTokenId',\n )\n }\n\n return {\n credentials: {\n type: 'refresh',\n did: result.sub,\n scope: result.scope,\n tokenId,\n },\n }\n }\n }\n\n public authorization<P extends Params>({\n scopes = ACCESS_STANDARD,\n additional = [],\n ...options\n }: VerifiedOptions &\n ScopedOptions &\n ExtraScopedOptions &\n AuthorizedOptions<P>): MethodAuthVerifier<AccessOutput \| OAuthOutput, P> {\n const access = this.access({\n ...options,\n scopes: [...scopes, ...additional],\n })\n const oauth = this.oauth(options)\n\n return async (ctx) => {\n const type = extractAuthType(ctx.req)\n\n if (type === AuthType.BEARER) {\n return access(ctx)\n }\n\n if (type === AuthType.DPOP) {\n return oauth(ctx)\n }\n\n // Auth headers are set through the access and oauth methods so we only\n // need to set them here if we reach this point\n setAuthHeaders(ctx.res)\n\n if (type !== null) {\n throw new InvalidRequestError(\n 'Unexpected authorization type',\n 'InvalidToken',\n )\n }\n\n throw new AuthRequiredError(undefined, 'AuthMissing')\n }\n }\n\n public authorizationOrModService<P extends Params>(\n opts: VerifiedOptions & ExtraScopedOptions & AuthorizedOptions<P>,\n ): MethodAuthVerifier<AccessOutput \| OAuthOutput \| ModServiceOutput, P> {\n const authorization = this.authorization(opts)\n return async (ctx) => {\n try {\n return await this.modService(ctx)\n } catch (err) {\n if (err instanceof AuthRequiredError) {\n return authorization(ctx)\n }\n throw err\n }\n }\n }\n\n public authorizationOrAdminTokenOptional<P extends Params>(\n opts: VerifiedOptions & ExtraScopedOptions & AuthorizedOptions<P>,\n ): MethodAuthVerifier<\n OAuthOutput \| AccessOutput \| AdminTokenOutput \| UnauthenticatedOutput,\n P\n > {\n const authorization = this.authorization(opts)\n return async (ctx) => {\n const type = extractAuthType(ctx.req)\n if (type === AuthType.BEARER \|\| type === AuthType.DPOP) {\n return authorization(ctx)\n } else if (type === AuthType.BASIC) {\n return this.adminToken(ctx)\n } else {\n return this.unauthenticated(ctx)\n }\n }\n }\n\n public userServiceAuth: MethodAuthVerifier<UserServiceAuthOutput> = async (\n ctx,\n ) => {\n setAuthHeaders(ctx.res)\n const payload = await this.verifyServiceJwt(ctx.req)\n return {\n credentials: {\n type: 'user_service_auth',\n did: payload.iss,\n },\n }\n }\n\n public userServiceAuthOptional: MethodAuthVerifier<\n UserServiceAuthOutput \| UnauthenticatedOutput\n > = async (ctx) => {\n const type = extractAuthType(ctx.req)\n if (type === AuthType.BEARER) {\n return await this.userServiceAuth(ctx)\n } else {\n return this.unauthenticated(ctx)\n }\n }\n\n public authorizationOrUserServiceAuth<P extends Params>(\n options: VerifiedOptions &\n ScopedOptions &\n ExtraScopedOptions &\n AuthorizedOptions<P>,\n ): MethodAuthVerifier<UserServiceAuthOutput \| OAuthOutput \| AccessOutput, P> {\n const authorizationVerifier = this.authorization(options)\n return async (ctx) => {\n if (isDefinitelyServiceAuth(ctx.req)) {\n return this.userServiceAuth(ctx)\n } else {\n return authorizationVerifier(ctx)\n }\n }\n }\n\n protected oauth<P extends Params>({\n authorize,\n ...verifyStatusOptions\n }: VerifiedOptions & AuthorizedOptions<P>): MethodAuthVerifier<\n OAuthOutput,\n P\n > {\n const verifyTokenOptions: VerifyTokenPayloadOptions = {\n audience: [this.dids.pds],\n scope: ['atproto'],\n }\n\n return async (ctx) => {\n setAuthHeaders(ctx.res)\n\n const { req, res } = ctx\n\n // https://datatracker.ietf.org/doc/html/rfc9449#section-8.2\n const dpopNonce = this.oauthVerifier.nextDpopNonce()\n if (dpopNonce) {\n res.setHeader('DPoP-Nonce', dpopNonce)\n res.appendHeader('Access-Control-Expose-Headers', 'DPoP-Nonce')\n }\n\n const originalUrl = req.originalUrl \|\| req.url \|\| '/'\n const url = new URL(originalUrl, this._publicUrl)\n\n const { scope, sub: did } = await this.oauthVerifier\n .authenticateRequest(\n req.method \|\| 'GET',\n url,\n req.headers,\n verifyTokenOptions,\n )\n .catch((err) => {\n // Make sure to include any WWW-Authenticate header in the response\n // (particularly useful for DPoP's \"use_dpop_nonce\" error)\n if (err instanceof WWWAuthenticateError) {\n res.setHeader('WWW-Authenticate', err.wwwAuthenticateHeader)\n res.appendHeader(\n 'Access-Control-Expose-Headers',\n 'WWW-Authenticate',\n )\n }\n\n if (err instanceof OAuthError) {\n throw new XRPCError(err.status, err.error_description, err.error)\n }\n\n throw err\n })\n\n if (!isDidString(did)) {\n throw new InvalidRequestError('Malformed token', 'InvalidToken')\n }\n\n await this.verifyStatus(did, verifyStatusOptions)\n\n const permissions = new ScopePermissionsTransition(scope?.split(' '))\n\n // Should never happen\n if (!permissions.scopes.has('atproto')) {\n throw new InvalidRequestError(\n 'OAuth token does not have \"atproto\" scope',\n 'InvalidToken',\n )\n }\n\n await authorize(permissions, ctx)\n\n return {\n credentials: {\n type: 'oauth',\n did,\n permissions,\n },\n }\n }\n }\n\n protected async verifyStatus(\n did: DidString,\n options: VerifiedOptions,\n ): Promise<void> {\n if (options.checkDeactivated \|\| options.checkTakedown) {\n await this.findAccount(did, options)\n }\n }\n\n /\n Finds an account by its handle or DID, returning possibly deactivated or\n * taken down accounts (unless `options.checkDeactivated` or\n * `options.checkTakedown` are set to true, respectively).\n /\n public async findAccount(\n handleOrDid: AtIdentifierString,\n options: VerifiedOptions,\n ): Promise<ActorAccount> {\n const account = await this.accountManager.getAccount(handleOrDid, {\n includeDeactivated: true,\n includeTakenDown: true,\n })\n if (!account) {\n // will be turned into ExpiredToken for the client if proxied by entryway\n throw new ForbiddenError('Account not found', 'AccountNotFound')\n }\n if (options.checkTakedown && softDeleted(account)) {\n throw new AuthRequiredError(\n 'Account has been taken down',\n 'AccountTakedown',\n )\n }\n if (options.checkDeactivated && account.deactivatedAt) {\n throw new AuthRequiredError(\n 'Account is deactivated',\n 'AccountDeactivated',\n )\n }\n return account\n }\n\n /\n Wraps {@link jose.jwtVerify} into a function that also validates the token\n * payload's type and wraps errors into {@link InvalidRequestError}.\n /\n protected async verifyBearerJwt<S extends AuthScope = AuthScope>(\n req: IncomingMessage,\n { scopes, ...options }: VerifyBearerJwtOptions<S>,\n ): Promise<VerifyBearerJwtResult<S>> {\n const token = bearerTokenFromReq(req)\n if (!token) {\n throw new AuthRequiredError(undefined, 'AuthMissing')\n }\n\n const { payload } = await jose\n .jwtVerify(token, this._jwtKey, options)\n .catch((cause) => {\n if (cause instanceof jose.errors.JWTExpired) {\n throw new InvalidRequestError('Token has expired', 'ExpiredToken', {\n cause,\n })\n } else {\n throw new InvalidRequestError(\n 'Token could not be verified',\n 'InvalidToken',\n { cause },\n )\n }\n })\n\n const { sub, aud, scope, lxm, cnf, jti } = payload\n\n if (typeof lxm !== 'undefined') {\n // Service auth tokens should never make it to here. But since service\n // auth tokens do not have a \"typ\" header, the \"typ\" check above will not\n // catch them. This check here is mainly to protect against the\n // hypothetical case in which a PDS would issue service auth tokens using\n // its private key.\n throw new InvalidRequestError('Malformed token', 'InvalidToken')\n }\n if (typeof cnf !== 'undefined') {\n // Proof-of-Possession (PoP) tokens are not allowed here\n // https://www.rfc-editor.org/rfc/rfc7800.html\n throw new InvalidRequestError('Malformed token', 'InvalidToken')\n }\n if (typeof sub !== 'string' \|\| !isDidString(sub)) {\n throw new InvalidRequestError('Malformed token', 'InvalidToken')\n }\n if (typeof aud !== 'string' \|\| !aud.startsWith('did:')) {\n throw new InvalidRequestError('Malformed token', 'InvalidToken')\n }\n if (typeof jti !== 'string' && typeof jti !== 'undefined') {\n throw new InvalidRequestError('Malformed token', 'InvalidToken')\n }\n if (!isAuthScope(scope) \|\| !scopes.includes(scope as any)) {\n throw new InvalidRequestError('Bad token scope', 'InvalidToken')\n }\n\n return { sub, aud, jti, scope: scope as S }\n }\n\n protected async verifyServiceJwt(\n req: IncomingMessage,\n opts?: { iss?: string[] },\n ) {\n const jwtStr = bearerTokenFromReq(req)\n if (!jwtStr) {\n throw new AuthRequiredError('missing jwt', 'MissingJwt')\n }\n\n const nsid = parseReqNsid(req)\n const payload = await verifyServiceJwt(\n jwtStr,\n null,\n nsid,\n async (iss, forceRefresh) => {\n if (opts?.iss && !opts.iss.includes(iss)) {\n throw new AuthRequiredError('Untrusted issuer', 'UntrustedIss')\n }\n const [did, serviceId] = iss.split('#')\n const keyId =\n serviceId === 'atproto_labeler' ? 'atproto_label' : 'atproto'\n const didDoc = await this.idResolver.did.resolve(did, forceRefresh)\n if (!didDoc) {\n throw new AuthRequiredError('could not resolve iss did')\n }\n const parsedKey = getVerificationMaterial(didDoc, keyId)\n if (!parsedKey) {\n throw new AuthRequiredError('missing or bad key in did doc')\n }\n const didKey = getDidKeyFromMultibase(parsedKey)\n if (!didKey) {\n throw new AuthRequiredError('missing or bad key in did doc')\n }\n return didKey\n },\n )\n if (\n payload.aud !== this.dids.pds &&\n (!this.dids.entryway \|\| payload.aud !== this.dids.entryway)\n ) {\n throw new AuthRequiredError(\n 'jwt audience does not match service did',\n 'BadJwtAudience',\n )\n }\n return payload\n }\n}\n\n// HELPERS\n// ---------\n\nexport function isUserOrAdmin(\n auth: AccessOutput \| OAuthOutput \| AdminTokenOutput \| UnauthenticatedOutput,\n did: string,\n): boolean {\n if (!auth.credentials) {\n return false\n } else if (auth.credentials.type === 'admin_token') {\n return true\n } else {\n return auth.credentials.did === did\n }\n}\n\nenum AuthType {\n BASIC = 'Basic',\n BEARER = 'Bearer',\n DPOP = 'DPoP',\n}\n\nconst parseAuthorizationHeader = (\n req: IncomingMessage,\n): [type: null] \| [type: AuthType, token: string] => {\n const authorization = req.headers['authorization']\n if (!authorization) return [null]\n\n const result = authorization.split(' ')\n if (result.length !== 2) {\n throw new InvalidRequestError(\n 'Malformed authorization header',\n 'InvalidToken',\n )\n }\n\n // authorization type is case-insensitive\n const authType = result[0].toUpperCase()\n\n const type = Object.hasOwn(AuthType, authType) ? AuthType[authType] : null\n if (type) return [type, result[1]]\n\n throw new InvalidRequestError(\n `Unsupported authorization type: ${result[0]}`,\n 'InvalidToken',\n )\n}\n\n/\n @note Not all service auth tokens are guaranteed to have \"lxm\" claim, so this\n * function should not be used to verify service auth tokens. It is only used to\n * check if a token is definitely a service auth token.\n */\nconst isDefinitelyServiceAuth = (req: IncomingMessage): boolean => {\n const token = bearerTokenFromReq(req)\n if (!token) return false\n const payload = jose.decodeJwt(token)\n return payload['lxm'] != null\n}\n\nconst extractAuthType = (req: IncomingMessage): AuthType \| null => {\n const [type] = parseAuthorizationHeader(req)\n return type\n}\n\nexport const bearerTokenFromReq = (req: IncomingMessage) => {\n const [type, token] = parseAuthorizationHeader(req)\n return type === AuthType.BEARER ? token : null\n}\n\nconst parseBasicAuth = (\n req: IncomingMessage,\n): { username: string; password: string } \| null => {\n try {\n const [type, b64] = parseAuthorizationHeader(req)\n if (type !== AuthType.BASIC) return null\n const decoded = Buffer.from(b64, 'base64').toString('utf8')\n // We must not use split(':') because the password can contain colons\n const colon = decoded.indexOf(':')\n if (colon === -1) return null\n const username = decoded.slice(0, colon)\n const password = decoded.slice(colon + 1)\n return { username, password }\n } catch (err) {\n return null\n }\n}\n\nexport const createSecretKeyObject = (secret: string): KeyObject => {\n return createSecretKey(Buffer.from(secret))\n}\n\nconst keyEncoder = new KeyEncoder('secp256k1')\nexport const createPublicKeyObject = (publicKeyHex: string): KeyObject => {\n const key = keyEncoder.encodePublic(publicKeyHex, 'raw', 'pem')\n return createPublicKey({ format: 'pem', key })\n}\n\nfunction setAuthHeaders(res: ServerResponse) {\n res.setHeader('Cache-Control', 'private')\n appendVary(res, 'Authorization')\n}\n"]}

package/dist/config/config.d.ts CHANGED Viewed

@@ -31,7 +31,7 @@ export type ServiceConfig = {
     hostname: string;
     publicUrl: string;
     did: DidString;
-    version?: string;
+    version: string;
     privacyPolicyUrl?: string;
     termsOfServiceUrl?: string;
     acceptingImports: boolean;

package/dist/config/config.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,cAAc,EACd,cAAc,EACf,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,KAAK,SAAS,EAA8B,MAAM,iBAAiB,CAAA;~~AAC5E~~,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAA;AAEjD,YAAY,EAAE,cAAc,EAAE,CAAA;AAK9B,eAAO,MAAM,QAAQ,QAAS,iBAAiB,KAAG,~~YA4WjD~~,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,aAAa,CAAA;IACtB,EAAE,EAAE,cAAc,CAAA;IAClB,UAAU,EAAE,gBAAgB,CAAA;IAC5B,SAAS,EAAE,iBAAiB,GAAG,mBAAmB,CAAA;IAClD,QAAQ,EAAE,cAAc,CAAA;IACxB,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAA;IAC/B,OAAO,EAAE,aAAa,CAAA;IACtB,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;IACzB,eAAe,EAAE,WAAW,GAAG,IAAI,CAAA;IACnC,YAAY,EAAE,kBAAkB,CAAA;IAChC,WAAW,EAAE,iBAAiB,GAAG,IAAI,CAAA;IACrC,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAA;IACnC,aAAa,EAAE,mBAAmB,GAAG,IAAI,CAAA;IACzC,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAAA;IAChC,UAAU,EAAE,gBAAgB,CAAA;IAC5B,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,KAAK,EAAE,WAAW,CAAA;IAClB,KAAK,EAAE,WAAW,CAAA;IAClB,QAAQ,EAAE,cAAc,CAAA;IACxB,KAAK,EAAE,WAAW,CAAA;IAClB,OAAO,EAAE,qBAAqB,CAAA;CAC/B,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,GAAG,EAAE,SAAS,CAAA;IACd,OAAO,~~CAAC,~~EAAE,MAAM,CAAA;~~IAChB~~,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,gBAAgB,EAAE,OAAO,CAAA;IACzB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,eAAe,EAAE,MAAM,CAAA;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,OAAO,EAAE,OAAO,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,MAAM,CAAA;IACtB,aAAa,EAAE,MAAM,CAAA;IACrB,wBAAwB,EAAE,OAAO,CAAA;CAClC,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,wBAAwB,EAAE,OAAO,CAAA;CAClC,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,EAAE,IAAI,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,WAAW,CAAC,EAAE;QACZ,WAAW,EAAE,MAAM,CAAA;QACnB,eAAe,EAAE,MAAM,CAAA;KACxB,CAAA;CACF,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,eAAe,EAAE,MAAM,CAAA;IACvB,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,oBAAoB,EAAE,MAAM,EAAE,CAAA;IAC9B,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAA;IAClC,uBAAuB,EAAE,OAAO,CAAA;CACjC,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,EAAE,MAAM,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,qBAAqB,EAAE,OAAO,CAAA;IAC9B,eAAe,EAAE,MAAM,CAAA;CACxB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,qBAAqB,EAAE,OAAO,CAAA;IAC9B,UAAU,EAAE,OAAO,CAAA;IACnB,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,CAAA;IACvB,UAAU,EAAE,MAAM,CAAA;IAElB;;;;;;OAMG;IACH,gBAAgB,EAAE,OAAO,CAAA;CAC1B,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE;QACT,QAAQ,CAAC,EAAE,cAAc,CAAA;QACzB,QAAQ,EAAE,cAAc,CAAA;QACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;KAC1B,CAAA;CACF,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,YAAY,CAAC,EAAE,OAAO,MAAM,IAAI,MAAM,EAAE,CAAA;CACzC,CAAA;AAED,MAAM,MAAM,aAAa,GACrB;IACE,QAAQ,EAAE,IAAI,CAAA;IACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,KAAK,EAAE,MAAM,CAAA;CACd,GACD;IACE,QAAQ,EAAE,KAAK,CAAA;CAChB,CAAA;AAEL,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,uBAAuB,EAAE,OAAO,CAAA;CACjC,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,mBAAmB,EAAE,MAAM,CAAA;CAC5B,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,gBAAgB,GACxB;IACE,OAAO,EAAE,IAAI,CAAA;IACb,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;CACrB,GACD;IAAE,OAAO,EAAE,KAAK,CAAA;CAAE,CAAA;AAEtB,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA"}
1	+ {"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,cAAc,EACd,cAAc,EACf,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,KAAK,SAAS,EAA8B,MAAM,iBAAiB,CAAA;AAE5E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAA;AAEjD,YAAY,EAAE,cAAc,EAAE,CAAA;AAK9B,eAAO,MAAM,QAAQ,QAAS,iBAAiB,KAAG,YA8VjD,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,aAAa,CAAA;IACtB,EAAE,EAAE,cAAc,CAAA;IAClB,UAAU,EAAE,gBAAgB,CAAA;IAC5B,SAAS,EAAE,iBAAiB,GAAG,mBAAmB,CAAA;IAClD,QAAQ,EAAE,cAAc,CAAA;IACxB,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAA;IAC/B,OAAO,EAAE,aAAa,CAAA;IACtB,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;IACzB,eAAe,EAAE,WAAW,GAAG,IAAI,CAAA;IACnC,YAAY,EAAE,kBAAkB,CAAA;IAChC,WAAW,EAAE,iBAAiB,GAAG,IAAI,CAAA;IACrC,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAA;IACnC,aAAa,EAAE,mBAAmB,GAAG,IAAI,CAAA;IACzC,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAAA;IAChC,UAAU,EAAE,gBAAgB,CAAA;IAC5B,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,KAAK,EAAE,WAAW,CAAA;IAClB,KAAK,EAAE,WAAW,CAAA;IAClB,QAAQ,EAAE,cAAc,CAAA;IACxB,KAAK,EAAE,WAAW,CAAA;IAClB,OAAO,EAAE,qBAAqB,CAAA;CAC/B,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,GAAG,EAAE,SAAS,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,gBAAgB,EAAE,OAAO,CAAA;IACzB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,eAAe,EAAE,MAAM,CAAA;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,OAAO,EAAE,OAAO,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,MAAM,CAAA;IACtB,aAAa,EAAE,MAAM,CAAA;IACrB,wBAAwB,EAAE,OAAO,CAAA;CAClC,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,wBAAwB,EAAE,OAAO,CAAA;CAClC,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,EAAE,IAAI,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,WAAW,CAAC,EAAE;QACZ,WAAW,EAAE,MAAM,CAAA;QACnB,eAAe,EAAE,MAAM,CAAA;KACxB,CAAA;CACF,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,eAAe,EAAE,MAAM,CAAA;IACvB,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,oBAAoB,EAAE,MAAM,EAAE,CAAA;IAC9B,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAA;IAClC,uBAAuB,EAAE,OAAO,CAAA;CACjC,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,EAAE,MAAM,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,qBAAqB,EAAE,OAAO,CAAA;IAC9B,eAAe,EAAE,MAAM,CAAA;CACxB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,qBAAqB,EAAE,OAAO,CAAA;IAC9B,UAAU,EAAE,OAAO,CAAA;IACnB,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,CAAA;IACvB,UAAU,EAAE,MAAM,CAAA;IAElB;;;;;;OAMG;IACH,gBAAgB,EAAE,OAAO,CAAA;CAC1B,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE;QACT,QAAQ,CAAC,EAAE,cAAc,CAAA;QACzB,QAAQ,EAAE,cAAc,CAAA;QACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;KAC1B,CAAA;CACF,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,YAAY,CAAC,EAAE,OAAO,MAAM,IAAI,MAAM,EAAE,CAAA;CACzC,CAAA;AAED,MAAM,MAAM,aAAa,GACrB;IACE,QAAQ,EAAE,IAAI,CAAA;IACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,KAAK,EAAE,MAAM,CAAA;CACd,GACD;IACE,QAAQ,EAAE,KAAK,CAAA;CAChB,CAAA;AAEL,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,uBAAuB,EAAE,OAAO,CAAA;CACjC,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,mBAAmB,EAAE,MAAM,CAAA;CAC5B,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,gBAAgB,GACxB;IACE,OAAO,EAAE,IAAI,CAAA;IACb,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;CACrB,GACD;IAAE,OAAO,EAAE,KAAK,CAAA;CAAE,CAAA;AAEtB,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA"}

package/dist/config/config.js CHANGED Viewed

@@ -2,6 +2,7 @@ import assert from 'node:assert';
 import path from 'node:path';
 import { DAY, HOUR, SECOND } from '@atproto/common';
 import { ensureValidDid, isValidDid } from '@atproto/syntax';
+import pkg from '../../package.json' with { type: 'json' };
 // off-config but still from env:
 // logging: LOG_LEVEL, LOG_SYSTEMS, LOG_ENABLED, LOG_DESTINATION
 export const envToCfg = (env) => {
@@ -19,7 +20,7 @@ export const envToCfg = (env) => {
         hostname,
         publicUrl,
         did,
-        version: env.version, // default?
+        version: env.version || pkg.version,
         privacyPolicyUrl: env.privacyPolicyUrl,
         termsOfServiceUrl: env.termsOfServiceUrl,
         contactEmailAddress: env.contactEmailAddress,
@@ -220,24 +221,15 @@ export const envToCfg = (env) => {
         name: env.serviceName ?? `${hostname} PDS`,
         logo: env.logoUrl,
         colors: {
-            light: env.lightColor,
-            dark: env.darkColor,
-            contrastSaturation: env.contrastSaturation,
             primary: env.primaryColor,
-            primaryContrast: env.primaryColorContrast,
-            primaryHue: env.primaryColorHue,
             error: env.errorColor,
-            errorContrast: env.errorColorContrast,
-            errorHue: env.errorColorHue,
             warning: env.warningColor,
-            warningContrast: env.warningColorContrast,
-            warningHue: env.warningColorHue,
             info: env.infoColor,
-            infoContrast: env.infoColorContrast,
-            infoHue: env.infoColorHue,
             success: env.successColor,
-            successContrast: env.successColorContrast,
-            successHue: env.successColorHue,
+        },
+        background: {
+            light: env.backgroundLightUrl,
+            dark: env.backgroundDarkUrl,
         },
         links: [
             {