npm - @atproto/pds - Versions diffs - 0.5.34 → 0.5.36 - Mend

@atproto/pds 0.5.34 → 0.5.36

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (187) hide show

package/dist/api/com/atproto/server/createAccount.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"createAccount.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/createAccount.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,cAAc,CAAA;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAC/D,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,EAGL,gBAAgB,GACjB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAoB,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAEvE,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GAEpB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAA;AAEvF,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAA;AACtE,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAE7C,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;QAC3C,SAAS,EAAE;YACT,UAAU,EAAE,CAAC,GAAG,MAAM;YACtB,MAAM,EAAE,GAAG;SACZ;QACD,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,uBAAuB;QAC9C,OAAO,EAAE,KAAK,EAAE,EACd,KAAK,EACL,IAAI,EACJ,GAAG,GACJ,EAAqD,EAAE;YACtD,iEAAiE;YACjE,0EAA0E;YAE1E,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,GAAG,IAAI,IAAI,CAAA;YAC/C,MAAM,EACJ,GAAG,EACH,MAAM,EACN,KAAK,EACL,QAAQ,EACR,UAAU,EACV,UAAU,EACV,KAAK,EACL,WAAW,GACZ,GAAG,GAAG,CAAC,cAAc;gBACpB,CAAC,CAAC,MAAM,4BAA4B,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC;gBACrD,CAAC,CAAC,MAAM,yBAAyB,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;YAE/D,MAAM,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;YAE5C,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE;oBAC7D,OAAO,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;gBACrC,CAAC,CAAC,CAAA;gBAEF,MAAM,YAAY;gBAChB,qEAAqE;gBACrE,oEAAoE;gBACpE,kBAAkB;gBAClB,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAA;gBAEnD,+BAA+B;gBAC/B,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;gBAC/C,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;oBAEtD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,uBAAuB,CAAC;wBAC7D,GAAG;wBACH,MAAM;wBACN,KAAK;wBACL,QAAQ;wBACR,OAAO,EAAE,MAAM,CAAC,GAAG;wBACnB,OAAO,EAAE,MAAM,CAAC,GAAG;wBACnB,UAAU;wBACV,WAAW;qBACZ,CAAC,CAAA;oBAEF,IAAI,CAAC;wBACH,MAAM,WAAW,GAAG,CAAC,WAAW,CAAA;wBAChC,IAAI,WAAW,EAAE,CAAC;4BAChB,MAAM,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;wBAClE,CAAC;wBAED,IAAI,CAAC;4BACH,MAAM,GAAG,CAAC,UAAU;iCACjB,oBAAoB,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC;iCAC3C,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gCACb,+DAA+D;gCAC/D,+CAA+C;gCAC/C,GAAG,CAAC,GAAG,CAAC,KAAK,CACX,EAAE,GAAG,EAAE,aAAa,EAAE,UAAU,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,EAC7C,kCAAkC,CACnC,CAAA;4BACH,CAAC,CAAC,CAAA;4BAEJ,MAAM,CAAC,cAAc,CAAC;gCACpB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI;gCAC7C,GAAG;gCACH,OAAO,EAAE,CAAC,CAAC,UAAU;gCACrB,WAAW;6BACZ,CAAC,CAAA;4BACF,MAAM,CAAC,cAAc,CAAC;gCACpB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI;gCAC7C,GAAG;6BACJ,CAAC,CAAA;4BAEF,OAAO;gCACL,QAAQ,EAAE,kBAA2B;gCACrC,IAAI,EAAE;oCACJ,MAAM;oCACN,GAAG,EAAE,GAAG;oCACR,uEAAuE;oCACvE,MAAM;oCACN,SAAS,EAAE,KAAK,CAAC,SAAS;oCAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;iCAC7B;6BACF,CAAA;wBACH,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,IAAI,WAAW;gCAAE,MAAM,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;4BACjE,MAAM,GAAG,CAAA;wBACX,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,GAAG,CAAC,cAAc,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;wBAC3C,MAAM,GAAG,CAAA;oBACX,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,YAAY,EAAE,CAAC;wBACjB,MAAM,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,cAAc,CAAC,CAAA;oBACxD,CAAC;oBACD,MAAM,GAAG,CAAA;gBACX,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;gBACjC,MAAM,GAAG,CAAA;YACX,CAAC;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,4BAA4B,GAAG,KAAK,EACxC,GAAe,EACf,KAAkD,EAClD,EAAE;IACF,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAErD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,KAAK,CAAA;IAC5B,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,mBAAmB,CAC3B,oDAAoD,CACrD,CAAA;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,EAAE,oBAAoB,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,cAAc,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAA;IACvD,IAAI,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,mBAAmB,CAC3B,+CAA+C,EAC/C,oBAAoB,CACrB,CAAA;IACH,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;QAC9B,MAAM,GAAG,CAAC,cAAc,CAAC,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAA;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,EAAE,oBAAoB,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAA;IAC/C,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;IAEnC,IAAI,UAAyC,CAAA;IAC7C,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACjE,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACvE,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC,qCAAqC,CAAC,CAAA;IACtE,CAAC;IAED,mBAAmB,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS;QAC9B,UAAU,EAAE,UAAU,CAAC,GAAG,EAAE;KAC7B,CAAC,CAAA;IAEF,OAAO;QACL,GAAG;QACH,MAAM;QACN,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,SAAS;QACrB,UAAU;QACV,KAAK;QACL,WAAW,EAAE,KAAK;KACnB,CAAA;AACH,CAAC,CAAA;AAED,MAAM,yBAAyB,GAAG,KAAK,EACrC,GAAe,EACf,KAAkD,EAClD,SAAwB,EACxB,EAAE;IACF,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,KAAK,CAAA;IAC7C,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC,4BAA4B,CAAC,CAAA;IAC7D,CAAC;IAED,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QAC1D,MAAM,IAAI,mBAAmB,CAC3B,wCAAwC,uBAAuB,cAAc,CAC9E,CAAA;IACH,CAAC;IAED,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;QAC5C,MAAM,IAAI,mBAAmB,CAC3B,yBAAyB,EACzB,mBAAmB,CACpB,CAAA;IACH,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;IACpD,CAAC;SAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,mBAAmB,CAC3B,oEAAoE,CACrE,CAAA;IACH,CAAC;IAED,kCAAkC;IAClC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,0BAA0B,CAChE,KAAK,CAAC,MAAM,EACZ,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CACnB,CAAA;IAED,4CAA4C;IAC5C,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,UAAU,EAAE,CAAC;QAC3C,MAAM,GAAG,CAAC,cAAc,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAA;IAC9D,CAAC;IAED,gDAAgD;IAChD,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACjD,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC;QACrC,GAAG,CAAC,cAAc,CAAC,iBAAiB,CAAC,KAAK,CAAC;KAC5C,CAAC,CAAA;IACF,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC,yBAAyB,MAAM,EAAE,CAAC,CAAA;IAClE,CAAC;SAAM,IAAI,SAAS,EAAE,CAAC;QACrB,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,kDAAkD;IAClD,yDAAyD;IACzD,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;IAEtE,IAAI,GAAc,CAAA;IAClB,IAAI,KAA2B,CAAA;IAC/B,IAAI,WAAW,GAAG,KAAK,CAAA;IACvB,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,iBAAiB,CACzB,4CAA4C,KAAK,CAAC,GAAG,EAAE,CACxD,CAAA;QACH,CAAC;QACD,GAAG,GAAG,KAAK,CAAC,GAAG,CAAA;QACf,KAAK,GAAG,IAAI,CAAA;QACZ,WAAW,GAAG,IAAI,CAAA;IACpB,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,CAAA;QACzE,GAAG,GAAG,SAAS,CAAC,GAAgB,CAAA;QAChC,KAAK,GAAG,SAAS,CAAC,EAAE,CAAA;IACtB,CAAC;IAED,OAAO;QACL,GAAG;QACH,MAAM;QACN,KAAK;QACL,QAAQ;QACR,UAAU;QACV,UAAU;QACV,KAAK;QACL,WAAW;KACZ,CAAA;AACH,CAAC,CAAA;AAED,MAAM,iBAAiB,GAAG,KAAK,EAC7B,GAAe,EACf,MAAc,EACd,KAAkD,EAClD,UAAmB,EACnB,EAAE;IACF,wEAAwE;IACxE,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,CAAA;IAC/C,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QACpC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;IACvD,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IACzC,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,CAAC;QAClB,UAAU,EAAE,UAAU,CAAC,GAAG,EAAE;QAC5B,YAAY;QACZ,MAAM;QACN,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS;QAC9B,MAAM,EAAE,GAAG,CAAC,cAAc;KAC3B,CAAC,CAAA;AACJ,CAAC,CAAA;AACD,MAAM,mBAAmB,GAAG,CAC1B,IAAiB,EACjB,QAIC,EACD,EAAE;IACF,yCAAyC;IACzC,qEAAqE;IACrE,mEAAmE;IACnE,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,IAAI,mBAAmB,CAC3B,oDAAoD,EACpD,oBAAoB,CACrB,CAAA;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC;QACrC,MAAM,IAAI,mBAAmB,CAC3B,2DAA2D,EAC3D,oBAAoB,CACrB,CAAA;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;QACnD,MAAM,IAAI,mBAAmB,CAC3B,6DAA6D,EAC7D,oBAAoB,CACrB,CAAA;IACH,CAAC;AACH,CAAC,CAAA","sourcesContent":["import * as plc from '@did-plc/lib'\nimport { isEmailValid } from '@hapi/address'\nimport { isDisposableEmail } from 'disposable-email-domains-js'\nimport { MINUTE, check } from '@atproto/common'\nimport {\n type ExportableKeypair,\n type Keypair,\n Secp256k1Keypair,\n} from '@atproto/crypto'\nimport { type AtprotoData, ensureAtpDocument } from '@atproto/identity'\nimport type { DidString } from '@atproto/syntax'\nimport {\n AuthRequiredError,\n InvalidRequestError,\n type Server,\n} from '@atproto/xrpc-server'\nimport { NEW_PASSWORD_MAX_LENGTH } from '../../../../account-manager/helpers/scrypt.js'\nimport type { AppContext } from '../../../../context.js'\nimport { events } from '../../../../events.js'\nimport { baseNormalizeAndValidate } from '../../../../handle/index.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { safeResolveDidDoc } from './util.js'\n\nexport default function (server: Server, ctx: AppContext) {\n server.add(com.atproto.server.createAccount, {\n rateLimit: {\n durationMs: 5 * MINUTE,\n points: 100,\n },\n auth: ctx.authVerifier.userServiceAuthOptional,\n handler: async ({\n input,\n auth,\n req,\n }): Promise<com.atproto.server.createAccount.$Output> => {\n // @NOTE Until this code and the OAuthStore's `createAccount` are\n // refactored together, any change made here must be reflected over there.\n\n const requester = auth.credentials?.did ?? null\n const {\n did,\n handle,\n email,\n password,\n inviteCode,\n signingKey,\n plcOp,\n deactivated,\n } = ctx.entrywayClient\n ? await validateInputsForEntrywayPds(ctx, input.body)\n : await validateInputsForLocalPds(ctx, input.body, requester)\n\n await ctx.actorStore.create(did, signingKey)\n\n try {\n const commit = await ctx.actorStore.transact(did, (actorTxn) => {\n return actorTxn.repo.createRepo([])\n })\n\n const canTombstone =\n // @NOTE IMPORTANT Because the user may be bringing their own did, we\n // must make sure not to tombstone their did on failure if we didn't\n // create it here.\n !ctx.entrywayClient && !input.body.did && !!plcOp\n\n // Generate a real did with PLC\n if (plcOp) {\n await ctx.plcClient.sendOperation(did, plcOp)\n }\n\n try {\n const didDoc = await safeResolveDidDoc(ctx, did, true)\n\n const creds = await ctx.accountManager.createAccountAndSession({\n did,\n handle,\n email,\n password,\n repoCid: commit.cid,\n repoRev: commit.rev,\n inviteCode,\n deactivated,\n })\n\n try {\n const sequenceEvt = !deactivated\n if (sequenceEvt) {\n await ctx.sequencer.sequenceAccountCreation(did, handle, commit)\n }\n\n try {\n await ctx.actorStore\n .clearReservedKeypair(signingKey.did(), did)\n .catch((err) => {\n // @NOTE This is a cleanup operation so we won't fail the whole\n // flow if it fails, but we log it just in case\n req.log.error(\n { did, signingKeyDid: signingKey.did(), err },\n 'Failed to clear reserved keypair',\n )\n })\n\n events.accountCreated({\n source: com.atproto.server.createAccount.$lxm,\n did,\n invited: !!inviteCode,\n deactivated,\n })\n events.sessionCreated({\n source: com.atproto.server.createAccount.$lxm,\n did,\n })\n\n return {\n encoding: 'application/json' as const,\n body: {\n handle,\n did: did,\n // @ts-expect-error https://github.com/bluesky-social/atproto/pull/4406\n didDoc,\n accessJwt: creds.accessJwt,\n refreshJwt: creds.refreshJwt,\n },\n }\n } catch (err) {\n if (sequenceEvt) await ctx.sequencer.sequenceAccountDeletion(did)\n throw err\n }\n } catch (err) {\n await ctx.accountManager.deleteAccount(did)\n throw err\n }\n } catch (err) {\n if (canTombstone) {\n await ctx.plcClient.tombstone(did, ctx.plcRotationKey)\n }\n throw err\n }\n } catch (err) {\n await ctx.actorStore.destroy(did)\n throw err\n }\n },\n })\n}\n\nconst validateInputsForEntrywayPds = async (\n ctx: AppContext,\n input: com.atproto.server.createAccount.$InputBody,\n) => {\n const handle = baseNormalizeAndValidate(input.handle)\n\n const { did, plcOp } = input\n if (!did \|\| !plcOp) {\n throw new InvalidRequestError(\n 'non-entryway pds requires bringing a DID and plcOp',\n )\n }\n if (!check.is(plcOp, plc.def.operation)) {\n throw new InvalidRequestError('invalid plc operation', 'IncompatibleDidDoc')\n }\n const plcRotationKey = ctx.cfg.entryway?.plcRotationKey\n if (!plcRotationKey \|\| !plcOp.rotationKeys.includes(plcRotationKey)) {\n throw new InvalidRequestError(\n 'PLC DID does not include service rotation key',\n 'IncompatibleDidDoc',\n )\n }\n try {\n await plc.assureValidOp(plcOp)\n await plc.assureValidSig([plcRotationKey], plcOp)\n } catch (err) {\n throw new InvalidRequestError('invalid plc operation', 'IncompatibleDidDoc')\n }\n const doc = plc.formatDidDoc({ did, ...plcOp })\n const data = ensureAtpDocument(doc)\n\n let signingKey: ExportableKeypair \| undefined\n if (input.did) {\n signingKey = await ctx.actorStore.getReservedKeypair(input.did)\n }\n if (!signingKey) {\n signingKey = await ctx.actorStore.getReservedKeypair(data.signingKey)\n }\n if (!signingKey) {\n throw new InvalidRequestError('reserved signing key does not exist')\n }\n\n validateAtprotoData(data, {\n handle,\n pds: ctx.cfg.service.publicUrl,\n signingKey: signingKey.did(),\n })\n\n return {\n did,\n handle,\n email: undefined,\n password: undefined,\n inviteCode: undefined,\n signingKey,\n plcOp,\n deactivated: false,\n }\n}\n\nconst validateInputsForLocalPds = async (\n ctx: AppContext,\n input: com.atproto.server.createAccount.$InputBody,\n requester: string \| null,\n) => {\n const { email, password, inviteCode } = input\n if (input.plcOp) {\n throw new InvalidRequestError('Unsupported input: \"plcOp\"')\n }\n\n if (password && password.length > NEW_PASSWORD_MAX_LENGTH) {\n throw new InvalidRequestError(\n `Password too long. Maximum length is ${NEW_PASSWORD_MAX_LENGTH} characters.`,\n )\n }\n\n if (ctx.cfg.invites.required && !inviteCode) {\n throw new InvalidRequestError(\n 'No invite code provided',\n 'InvalidInviteCode',\n )\n }\n\n if (!email) {\n throw new InvalidRequestError('Email is required')\n } else if (!isEmailValid(email) \|\| isDisposableEmail(email)) {\n throw new InvalidRequestError(\n 'This email address is not supported, please use a different email.',\n )\n }\n\n // normalize & ensure valid handle\n const handle = await ctx.accountManager.normalizeAndValidateHandle(\n input.handle,\n { did: input.did },\n )\n\n // check that the invite code still has uses\n if (ctx.cfg.invites.required && inviteCode) {\n await ctx.accountManager.ensureInviteIsAvailable(inviteCode)\n }\n\n // check that the handle and email are available\n const [handleAccnt, emailAcct] = await Promise.all([\n ctx.accountManager.getAccount(handle),\n ctx.accountManager.getAccountByEmail(email),\n ])\n if (handleAccnt) {\n throw new InvalidRequestError(`Handle already taken: ${handle}`)\n } else if (emailAcct) {\n throw new InvalidRequestError(`Email already taken: ${email}`)\n }\n\n // determine the did & any plc ops we need to send\n // if the provided did document is poorly setup, we throw\n const signingKey = await Secp256k1Keypair.create({ exportable: true })\n\n let did: DidString\n let plcOp: plc.Operation \| null\n let deactivated = false\n if (input.did) {\n if (input.did !== requester) {\n throw new AuthRequiredError(\n `Missing auth to create account with did: ${input.did}`,\n )\n }\n did = input.did\n plcOp = null\n deactivated = true\n } else {\n const formatted = await formatDidAndPlcOp(ctx, handle, input, signingKey)\n did = formatted.did as DidString\n plcOp = formatted.op\n }\n\n return {\n did,\n handle,\n email,\n password,\n inviteCode,\n signingKey,\n plcOp,\n deactivated,\n }\n}\n\nconst formatDidAndPlcOp = async (\n ctx: AppContext,\n handle: string,\n input: com.atproto.server.createAccount.$InputBody,\n signingKey: Keypair,\n) => {\n // if the user is not bringing a DID, then we format a create op for PLC\n const rotationKeys = [ctx.plcRotationKey.did()]\n if (ctx.cfg.identity.recoveryDidKey) {\n rotationKeys.unshift(ctx.cfg.identity.recoveryDidKey)\n }\n if (input.recoveryKey) {\n rotationKeys.unshift(input.recoveryKey)\n }\n return plc.createOp({\n signingKey: signingKey.did(),\n rotationKeys,\n handle,\n pds: ctx.cfg.service.publicUrl,\n signer: ctx.plcRotationKey,\n })\n}\nconst validateAtprotoData = (\n data: AtprotoData,\n expected: {\n handle: string\n pds: string\n signingKey: string\n },\n) => {\n // if the user is bringing their own did:\n // resolve the user's did doc data, including rotationKeys if did:plc\n // determine if we have the capability to make changes to their DID\n if (data.handle !== expected.handle) {\n throw new InvalidRequestError(\n 'provided handle does not match DID document handle',\n 'IncompatibleDidDoc',\n )\n } else if (data.pds !== expected.pds) {\n throw new InvalidRequestError(\n 'DID document pds endpoint does not match service endpoint',\n 'IncompatibleDidDoc',\n )\n } else if (data.signingKey !== expected.signingKey) {\n throw new InvalidRequestError(\n 'DID document signing key does not match service signing key',\n 'IncompatibleDidDoc',\n )\n }\n}\n"]}
1	+ {"version":3,"file":"createAccount.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/createAccount.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,cAAc,CAAA;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAC/D,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,EAGL,gBAAgB,GACjB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAoB,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAEvE,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GAEpB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAA;AAEvF,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAA;AACtE,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAE7C,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;QAC3C,SAAS,EAAE;YACT,UAAU,EAAE,CAAC,GAAG,MAAM;YACtB,MAAM,EAAE,GAAG;SACZ;QACD,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,uBAAuB;QAC9C,OAAO,EAAE,KAAK,EAAE,EACd,KAAK,EACL,IAAI,EACJ,GAAG,GACJ,EAAqD,EAAE;YACtD,iEAAiE;YACjE,0EAA0E;YAE1E,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,GAAG,IAAI,IAAI,CAAA;YAC/C,MAAM,EACJ,GAAG,EACH,MAAM,EACN,KAAK,EACL,QAAQ,EACR,UAAU,EACV,UAAU,EACV,KAAK,EACL,WAAW,GACZ,GAAG,GAAG,CAAC,cAAc;gBACpB,CAAC,CAAC,MAAM,4BAA4B,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC;gBACrD,CAAC,CAAC,MAAM,yBAAyB,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;YAE/D,MAAM,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;YAE5C,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE;oBAC7D,OAAO,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;gBACrC,CAAC,CAAC,CAAA;gBAEF,MAAM,YAAY;gBAChB,qEAAqE;gBACrE,oEAAoE;gBACpE,kBAAkB;gBAClB,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAA;gBAEnD,+BAA+B;gBAC/B,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;gBAC/C,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;oBAEtD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,uBAAuB,CAAC;wBAC7D,GAAG;wBACH,MAAM;wBACN,KAAK;wBACL,QAAQ;wBACR,OAAO,EAAE,MAAM,CAAC,GAAG;wBACnB,OAAO,EAAE,MAAM,CAAC,GAAG;wBACnB,UAAU;wBACV,WAAW;qBACZ,CAAC,CAAA;oBAEF,IAAI,CAAC;wBACH,MAAM,WAAW,GAAG,CAAC,WAAW,CAAA;wBAChC,IAAI,WAAW,EAAE,CAAC;4BAChB,MAAM,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;wBAClE,CAAC;wBAED,IAAI,CAAC;4BACH,MAAM,GAAG,CAAC,UAAU;iCACjB,oBAAoB,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC;iCAC3C,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gCACb,+DAA+D;gCAC/D,+CAA+C;gCAC/C,GAAG,CAAC,GAAG,CAAC,KAAK,CACX,EAAE,GAAG,EAAE,aAAa,EAAE,UAAU,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,EAC7C,kCAAkC,CACnC,CAAA;4BACH,CAAC,CAAC,CAAA;4BAEJ,MAAM,CAAC,cAAc,CAAC;gCACpB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI;gCAC7C,GAAG;gCACH,OAAO,EAAE,CAAC,CAAC,UAAU;gCACrB,WAAW;6BACZ,CAAC,CAAA;4BACF,MAAM,CAAC,cAAc,CAAC;gCACpB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI;gCAC7C,GAAG;6BACJ,CAAC,CAAA;4BAEF,OAAO;gCACL,QAAQ,EAAE,kBAA2B;gCACrC,IAAI,EAAE;oCACJ,MAAM;oCACN,GAAG,EAAE,GAAG;oCACR,uEAAuE;oCACvE,MAAM;oCACN,SAAS,EAAE,KAAK,CAAC,SAAS;oCAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;iCAC7B;6BACF,CAAA;wBACH,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,IAAI,WAAW;gCAAE,MAAM,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;4BACjE,MAAM,GAAG,CAAA;wBACX,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,GAAG,CAAC,cAAc,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;wBAC3C,MAAM,GAAG,CAAA;oBACX,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,YAAY,EAAE,CAAC;wBACjB,MAAM,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,cAAc,CAAC,CAAA;oBACxD,CAAC;oBACD,MAAM,GAAG,CAAA;gBACX,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;gBACjC,MAAM,GAAG,CAAA;YACX,CAAC;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,4BAA4B,GAAG,KAAK,EACxC,GAAe,EACf,KAAkD,EAClD,EAAE;IACF,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAErD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,KAAK,CAAA;IAC5B,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,mBAAmB,CAC3B,oDAAoD,CACrD,CAAA;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,EAAE,oBAAoB,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,cAAc,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAA;IACvD,IAAI,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,mBAAmB,CAC3B,+CAA+C,EAC/C,oBAAoB,CACrB,CAAA;IACH,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;QAC9B,MAAM,GAAG,CAAC,cAAc,CAAC,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAA;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,EAAE,oBAAoB,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAA;IAC/C,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;IAEnC,IAAI,UAAyC,CAAA;IAC7C,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACjE,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACvE,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC,qCAAqC,CAAC,CAAA;IACtE,CAAC;IAED,mBAAmB,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS;QAC9B,UAAU,EAAE,UAAU,CAAC,GAAG,EAAE;KAC7B,CAAC,CAAA;IAEF,OAAO;QACL,GAAG;QACH,MAAM;QACN,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,SAAS;QACrB,UAAU;QACV,KAAK;QACL,WAAW,EAAE,KAAK;KACnB,CAAA;AACH,CAAC,CAAA;AAED,MAAM,yBAAyB,GAAG,KAAK,EACrC,GAAe,EACf,KAAkD,EAClD,SAAwB,EACxB,EAAE;IACF,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,KAAK,CAAA;IAC7C,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC,4BAA4B,CAAC,CAAA;IAC7D,CAAC;IAED,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QAC1D,MAAM,IAAI,mBAAmB,CAC3B,wCAAwC,uBAAuB,cAAc,CAC9E,CAAA;IACH,CAAC;IAED,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;QAC5C,MAAM,IAAI,mBAAmB,CAC3B,yBAAyB,EACzB,mBAAmB,CACpB,CAAA;IACH,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;IACpD,CAAC;SAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,mBAAmB,CAC3B,oEAAoE,CACrE,CAAA;IACH,CAAC;IAED,kCAAkC;IAClC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,0BAA0B,CAChE,KAAK,CAAC,MAAM,EACZ,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CACnB,CAAA;IAED,4CAA4C;IAC5C,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,UAAU,EAAE,CAAC;QAC3C,MAAM,GAAG,CAAC,cAAc,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAA;IAC9D,CAAC;IAED,gDAAgD;IAChD,EAAE;IACF,4EAA4E;IAC5E,6EAA6E;IAC7E,0DAA0D;IAC1D,MAAM,YAAY,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAA;IACzE,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACjD,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC;QACnD,GAAG,CAAC,cAAc,CAAC,iBAAiB,CAAC,KAAK,EAAE,YAAY,CAAC;KAC1D,CAAC,CAAA;IACF,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC,yBAAyB,MAAM,EAAE,CAAC,CAAA;IAClE,CAAC;SAAM,IAAI,SAAS,EAAE,CAAC;QACrB,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,kDAAkD;IAClD,yDAAyD;IACzD,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;IAEtE,IAAI,GAAc,CAAA;IAClB,IAAI,KAA2B,CAAA;IAC/B,IAAI,WAAW,GAAG,KAAK,CAAA;IACvB,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,iBAAiB,CACzB,4CAA4C,KAAK,CAAC,GAAG,EAAE,CACxD,CAAA;QACH,CAAC;QACD,GAAG,GAAG,KAAK,CAAC,GAAG,CAAA;QACf,KAAK,GAAG,IAAI,CAAA;QACZ,WAAW,GAAG,IAAI,CAAA;IACpB,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,CAAA;QACzE,GAAG,GAAG,SAAS,CAAC,GAAgB,CAAA;QAChC,KAAK,GAAG,SAAS,CAAC,EAAE,CAAA;IACtB,CAAC;IAED,OAAO;QACL,GAAG;QACH,MAAM;QACN,KAAK;QACL,QAAQ;QACR,UAAU;QACV,UAAU;QACV,KAAK;QACL,WAAW;KACZ,CAAA;AACH,CAAC,CAAA;AAED,MAAM,iBAAiB,GAAG,KAAK,EAC7B,GAAe,EACf,MAAc,EACd,KAAkD,EAClD,UAAmB,EACnB,EAAE;IACF,wEAAwE;IACxE,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,CAAA;IAC/C,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QACpC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;IACvD,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IACzC,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,CAAC;QAClB,UAAU,EAAE,UAAU,CAAC,GAAG,EAAE;QAC5B,YAAY;QACZ,MAAM;QACN,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS;QAC9B,MAAM,EAAE,GAAG,CAAC,cAAc;KAC3B,CAAC,CAAA;AACJ,CAAC,CAAA;AACD,MAAM,mBAAmB,GAAG,CAC1B,IAAiB,EACjB,QAIC,EACD,EAAE;IACF,yCAAyC;IACzC,qEAAqE;IACrE,mEAAmE;IACnE,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,IAAI,mBAAmB,CAC3B,oDAAoD,EACpD,oBAAoB,CACrB,CAAA;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC;QACrC,MAAM,IAAI,mBAAmB,CAC3B,2DAA2D,EAC3D,oBAAoB,CACrB,CAAA;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;QACnD,MAAM,IAAI,mBAAmB,CAC3B,6DAA6D,EAC7D,oBAAoB,CACrB,CAAA;IACH,CAAC;AACH,CAAC,CAAA","sourcesContent":["import * as plc from '@did-plc/lib'\nimport { isEmailValid } from '@hapi/address'\nimport { isDisposableEmail } from 'disposable-email-domains-js'\nimport { MINUTE, check } from '@atproto/common'\nimport {\n type ExportableKeypair,\n type Keypair,\n Secp256k1Keypair,\n} from '@atproto/crypto'\nimport { type AtprotoData, ensureAtpDocument } from '@atproto/identity'\nimport type { DidString } from '@atproto/syntax'\nimport {\n AuthRequiredError,\n InvalidRequestError,\n type Server,\n} from '@atproto/xrpc-server'\nimport { NEW_PASSWORD_MAX_LENGTH } from '../../../../account-manager/helpers/scrypt.js'\nimport type { AppContext } from '../../../../context.js'\nimport { events } from '../../../../events.js'\nimport { baseNormalizeAndValidate } from '../../../../handle/index.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { safeResolveDidDoc } from './util.js'\n\nexport default function (server: Server, ctx: AppContext) {\n server.add(com.atproto.server.createAccount, {\n rateLimit: {\n durationMs: 5 * MINUTE,\n points: 100,\n },\n auth: ctx.authVerifier.userServiceAuthOptional,\n handler: async ({\n input,\n auth,\n req,\n }): Promise<com.atproto.server.createAccount.$Output> => {\n // @NOTE Until this code and the OAuthStore's `createAccount` are\n // refactored together, any change made here must be reflected over there.\n\n const requester = auth.credentials?.did ?? null\n const {\n did,\n handle,\n email,\n password,\n inviteCode,\n signingKey,\n plcOp,\n deactivated,\n } = ctx.entrywayClient\n ? await validateInputsForEntrywayPds(ctx, input.body)\n : await validateInputsForLocalPds(ctx, input.body, requester)\n\n await ctx.actorStore.create(did, signingKey)\n\n try {\n const commit = await ctx.actorStore.transact(did, (actorTxn) => {\n return actorTxn.repo.createRepo([])\n })\n\n const canTombstone =\n // @NOTE IMPORTANT Because the user may be bringing their own did, we\n // must make sure not to tombstone their did on failure if we didn't\n // create it here.\n !ctx.entrywayClient && !input.body.did && !!plcOp\n\n // Generate a real did with PLC\n if (plcOp) {\n await ctx.plcClient.sendOperation(did, plcOp)\n }\n\n try {\n const didDoc = await safeResolveDidDoc(ctx, did, true)\n\n const creds = await ctx.accountManager.createAccountAndSession({\n did,\n handle,\n email,\n password,\n repoCid: commit.cid,\n repoRev: commit.rev,\n inviteCode,\n deactivated,\n })\n\n try {\n const sequenceEvt = !deactivated\n if (sequenceEvt) {\n await ctx.sequencer.sequenceAccountCreation(did, handle, commit)\n }\n\n try {\n await ctx.actorStore\n .clearReservedKeypair(signingKey.did(), did)\n .catch((err) => {\n // @NOTE This is a cleanup operation so we won't fail the whole\n // flow if it fails, but we log it just in case\n req.log.error(\n { did, signingKeyDid: signingKey.did(), err },\n 'Failed to clear reserved keypair',\n )\n })\n\n events.accountCreated({\n source: com.atproto.server.createAccount.$lxm,\n did,\n invited: !!inviteCode,\n deactivated,\n })\n events.sessionCreated({\n source: com.atproto.server.createAccount.$lxm,\n did,\n })\n\n return {\n encoding: 'application/json' as const,\n body: {\n handle,\n did: did,\n // @ts-expect-error https://github.com/bluesky-social/atproto/pull/4406\n didDoc,\n accessJwt: creds.accessJwt,\n refreshJwt: creds.refreshJwt,\n },\n }\n } catch (err) {\n if (sequenceEvt) await ctx.sequencer.sequenceAccountDeletion(did)\n throw err\n }\n } catch (err) {\n await ctx.accountManager.deleteAccount(did)\n throw err\n }\n } catch (err) {\n if (canTombstone) {\n await ctx.plcClient.tombstone(did, ctx.plcRotationKey)\n }\n throw err\n }\n } catch (err) {\n await ctx.actorStore.destroy(did)\n throw err\n }\n },\n })\n}\n\nconst validateInputsForEntrywayPds = async (\n ctx: AppContext,\n input: com.atproto.server.createAccount.$InputBody,\n) => {\n const handle = baseNormalizeAndValidate(input.handle)\n\n const { did, plcOp } = input\n if (!did \|\| !plcOp) {\n throw new InvalidRequestError(\n 'non-entryway pds requires bringing a DID and plcOp',\n )\n }\n if (!check.is(plcOp, plc.def.operation)) {\n throw new InvalidRequestError('invalid plc operation', 'IncompatibleDidDoc')\n }\n const plcRotationKey = ctx.cfg.entryway?.plcRotationKey\n if (!plcRotationKey \|\| !plcOp.rotationKeys.includes(plcRotationKey)) {\n throw new InvalidRequestError(\n 'PLC DID does not include service rotation key',\n 'IncompatibleDidDoc',\n )\n }\n try {\n await plc.assureValidOp(plcOp)\n await plc.assureValidSig([plcRotationKey], plcOp)\n } catch (err) {\n throw new InvalidRequestError('invalid plc operation', 'IncompatibleDidDoc')\n }\n const doc = plc.formatDidDoc({ did, ...plcOp })\n const data = ensureAtpDocument(doc)\n\n let signingKey: ExportableKeypair \| undefined\n if (input.did) {\n signingKey = await ctx.actorStore.getReservedKeypair(input.did)\n }\n if (!signingKey) {\n signingKey = await ctx.actorStore.getReservedKeypair(data.signingKey)\n }\n if (!signingKey) {\n throw new InvalidRequestError('reserved signing key does not exist')\n }\n\n validateAtprotoData(data, {\n handle,\n pds: ctx.cfg.service.publicUrl,\n signingKey: signingKey.did(),\n })\n\n return {\n did,\n handle,\n email: undefined,\n password: undefined,\n inviteCode: undefined,\n signingKey,\n plcOp,\n deactivated: false,\n }\n}\n\nconst validateInputsForLocalPds = async (\n ctx: AppContext,\n input: com.atproto.server.createAccount.$InputBody,\n requester: string \| null,\n) => {\n const { email, password, inviteCode } = input\n if (input.plcOp) {\n throw new InvalidRequestError('Unsupported input: \"plcOp\"')\n }\n\n if (password && password.length > NEW_PASSWORD_MAX_LENGTH) {\n throw new InvalidRequestError(\n `Password too long. Maximum length is ${NEW_PASSWORD_MAX_LENGTH} characters.`,\n )\n }\n\n if (ctx.cfg.invites.required && !inviteCode) {\n throw new InvalidRequestError(\n 'No invite code provided',\n 'InvalidInviteCode',\n )\n }\n\n if (!email) {\n throw new InvalidRequestError('Email is required')\n } else if (!isEmailValid(email) \|\| isDisposableEmail(email)) {\n throw new InvalidRequestError(\n 'This email address is not supported, please use a different email.',\n )\n }\n\n // normalize & ensure valid handle\n const handle = await ctx.accountManager.normalizeAndValidateHandle(\n input.handle,\n { did: input.did },\n )\n\n // check that the invite code still has uses\n if (ctx.cfg.invites.required && inviteCode) {\n await ctx.accountManager.ensureInviteIsAvailable(inviteCode)\n }\n\n // check that the handle and email are available\n //\n // `actor_handle_lower_idx` and `account_email_lower_idx` enforce handle and\n // email uniqueness across taken down and deactivated accounts as well, so we\n // must check for them when surfacing handle availability.\n const availability = { includeTakenDown: true, includeDeactivated: true }\n const [handleAccnt, emailAcct] = await Promise.all([\n ctx.accountManager.getAccount(handle, availability),\n ctx.accountManager.getAccountByEmail(email, availability),\n ])\n if (handleAccnt) {\n throw new InvalidRequestError(`Handle already taken: ${handle}`)\n } else if (emailAcct) {\n throw new InvalidRequestError(`Email already taken: ${email}`)\n }\n\n // determine the did & any plc ops we need to send\n // if the provided did document is poorly setup, we throw\n const signingKey = await Secp256k1Keypair.create({ exportable: true })\n\n let did: DidString\n let plcOp: plc.Operation \| null\n let deactivated = false\n if (input.did) {\n if (input.did !== requester) {\n throw new AuthRequiredError(\n `Missing auth to create account with did: ${input.did}`,\n )\n }\n did = input.did\n plcOp = null\n deactivated = true\n } else {\n const formatted = await formatDidAndPlcOp(ctx, handle, input, signingKey)\n did = formatted.did as DidString\n plcOp = formatted.op\n }\n\n return {\n did,\n handle,\n email,\n password,\n inviteCode,\n signingKey,\n plcOp,\n deactivated,\n }\n}\n\nconst formatDidAndPlcOp = async (\n ctx: AppContext,\n handle: string,\n input: com.atproto.server.createAccount.$InputBody,\n signingKey: Keypair,\n) => {\n // if the user is not bringing a DID, then we format a create op for PLC\n const rotationKeys = [ctx.plcRotationKey.did()]\n if (ctx.cfg.identity.recoveryDidKey) {\n rotationKeys.unshift(ctx.cfg.identity.recoveryDidKey)\n }\n if (input.recoveryKey) {\n rotationKeys.unshift(input.recoveryKey)\n }\n return plc.createOp({\n signingKey: signingKey.did(),\n rotationKeys,\n handle,\n pds: ctx.cfg.service.publicUrl,\n signer: ctx.plcRotationKey,\n })\n}\nconst validateAtprotoData = (\n data: AtprotoData,\n expected: {\n handle: string\n pds: string\n signingKey: string\n },\n) => {\n // if the user is bringing their own did:\n // resolve the user's did doc data, including rotationKeys if did:plc\n // determine if we have the capability to make changes to their DID\n if (data.handle !== expected.handle) {\n throw new InvalidRequestError(\n 'provided handle does not match DID document handle',\n 'IncompatibleDidDoc',\n )\n } else if (data.pds !== expected.pds) {\n throw new InvalidRequestError(\n 'DID document pds endpoint does not match service endpoint',\n 'IncompatibleDidDoc',\n )\n } else if (data.signingKey !== expected.signingKey) {\n throw new InvalidRequestError(\n 'DID document signing key does not match service signing key',\n 'IncompatibleDidDoc',\n )\n }\n}\n"]}

package/dist/api/com/atproto/server/createSession.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"createSession.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/createSession.ts"],"names":[],"mappings":"AAMA,OAAO,EAGL,KAAK,MAAM,EACZ,MAAM,sBAAsB,CAAA;AAG7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAKxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,~~QAwFvD~~"}
1	+ {"version":3,"file":"createSession.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/createSession.ts"],"names":[],"mappings":"AAMA,OAAO,EAGL,KAAK,MAAM,EACZ,MAAM,sBAAsB,CAAA;AAG7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAKxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAgGvD"}

package/dist/api/com/atproto/server/createSession.js CHANGED Viewed

@@ -39,7 +39,13 @@ export default function (server, ctx) {
                 if (body.password.length > OLD_PASSWORD_MAX_LENGTH) {
                     throw new AuthRequiredError('Password too long. Consider resetting your password.');
                 }
-                const { user, isSoftDeleted, appPassword } = await ctx.accountManager.login(body);
+                // @TODO get the locale somehow (either by adding a field in the request
+                // body, or by using the `Accept-Language` header).
+                const locale = undefined;
+                // @NOTE No translation needed for the second-factor challenge: `login()`
+                // throws `AuthFactorRequiredError`, already an `AuthRequiredError`
+                // carrying this method's declared `AuthFactorTokenRequired` error name.
+                const { user, isSoftDeleted, appPassword } = await ctx.accountManager.login({ ...body, locale });
                 if (!body.allowTakendown && isSoftDeleted) {
                     throw new AuthRequiredError('Account has been taken down', 'AccountTakedown');
                 }
@@ -63,6 +69,7 @@ export default function (server, ctx) {
                         handle: (user.handle ?? INVALID_HANDLE),
                         email: user.email ?? undefined,
                         emailConfirmed: !!user.emailConfirmedAt,
+                        emailAuthFactor: !!user.emailAuthFactorAt,
                         active,
                         status,
                     },

package/dist/api/com/atproto/server/createSession.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"createSession.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/createSession.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,EAGL,cAAc,GACf,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,iBAAiB,GAGlB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAA;AACpF,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAA;AAEvF,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAE5C,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,EAAE,cAAc,EAAE,GAAG,GAAG,CAAA;IAE9B,MAAM,SAAS,GAIX;QACF;YACE,UAAU,EAAE,GAAG;YACf,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC,EAAE,EAAE;SAClE;QACD;YACE,UAAU,EAAE,CAAC,GAAG,MAAM;YACtB,MAAM,EAAE,EAAE;YACV,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC,EAAE,EAAE;SAClE;KACF,CAAA;IAED,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;YAC3C,SAAS;YACT,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;gBAC1C,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;gBACpD,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;oBAC3D,OAAO;oBACP,IAAI;iBACL,CAAC,CAAA;YACJ,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;YAC3C,SAAS;YACT,OAAO,EAAE,KAAK,EAAE,EACd,KAAK,EAAE,EAAE,IAAI,EAAE,GAChB,EAAqD,EAAE;gBACtD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;oBACnD,MAAM,IAAI,iBAAiB,CACzB,sDAAsD,CACvD,CAAA;gBACH,CAAC;gBAED,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,GACxC,MAAM,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;~~gBAEtC~~,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,aAAa,EAAE,CAAC;oBAC1C,MAAM,IAAI,iBAAiB,CACzB,6BAA6B,EAC7B,iBAAiB,CAClB,CAAA;gBACH,CAAC;gBAED,MAAM,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBAC5D,GAAG,CAAC,cAAc,CAAC,aAAa,CAC9B,IAAI,CAAC,GAAG,EACR,WAAW,EACX,aAAa,CACd;oBACD,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;iBAChC,CAAC,CAAA;gBAEF,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;gBAEpD,MAAM,CAAC,cAAc,CAAC;oBACpB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI;oBAC7C,GAAG,EAAE,IAAI,CAAC,GAAG;iBACd,CAAC,CAAA;gBAEF,OAAO;oBACL,QAAQ,EAAE,kBAAkB;oBAC5B,IAAI,EAAE;wBACJ,SAAS;wBACT,UAAU;wBAEV,GAAG,EAAE,IAAI,CAAC,GAAgB;wBAC1B,uEAAuE;wBACvE,MAAM;wBACN,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,cAAc,CAAiB;wBACvD,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;wBAC9B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB;wBACvC,MAAM;wBACN,MAAM;qBACP;iBACF,CAAA;YACH,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { DAY, MINUTE } from '@atproto/common'\nimport {\n type DidString,\n type HandleString,\n INVALID_HANDLE,\n} from '@atproto/syntax'\nimport {\n AuthRequiredError,\n type MethodRateLimit,\n type Server,\n} from '@atproto/xrpc-server'\nimport { formatAccountStatus } from '../../../../account-manager/account-manager.js'\nimport { OLD_PASSWORD_MAX_LENGTH } from '../../../../account-manager/helpers/scrypt.js'\nimport type { AppContext } from '../../../../context.js'\nimport { events } from '../../../../events.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { didDocForSession } from './util.js'\n\nexport default function (server: Server, ctx: AppContext) {\n const { entrywayClient } = ctx\n\n const rateLimit: MethodRateLimit<\n void,\n com.atproto.server.createSession.$Params,\n com.atproto.server.createSession.$Input\n > = [\n {\n durationMs: DAY,\n points: 300,\n calcKey: ({ input, req }) => `${input.body.identifier}-${req.ip}`,\n },\n {\n durationMs: 5 * MINUTE,\n points: 30,\n calcKey: ({ input, req }) => `${input.body.identifier}-${req.ip}`,\n },\n ]\n\n if (entrywayClient) {\n server.add(com.atproto.server.createSession, {\n rateLimit,\n handler: async ({ input: { body }, req }) => {\n const { headers } = ctx.entrywayPassthruHeaders(req)\n return entrywayClient.xrpc(com.atproto.server.createSession, {\n headers,\n body,\n })\n },\n })\n } else {\n server.add(com.atproto.server.createSession, {\n rateLimit,\n handler: async ({\n input: { body },\n }): Promise<com.atproto.server.createSession.$Output> => {\n if (body.password.length > OLD_PASSWORD_MAX_LENGTH) {\n throw new AuthRequiredError(\n 'Password too long. Consider resetting your password.',\n )\n }\n\n const { user, isSoftDeleted, appPassword } =\n await ctx.accountManager.login(body)\n\n if (!body.allowTakendown && isSoftDeleted) {\n throw new AuthRequiredError(\n 'Account has been taken down',\n 'AccountTakedown',\n )\n }\n\n const [{ accessJwt, refreshJwt }, didDoc] = await Promise.all([\n ctx.accountManager.createSession(\n user.did,\n appPassword,\n isSoftDeleted,\n ),\n didDocForSession(ctx, user.did),\n ])\n\n const { status, active } = formatAccountStatus(user)\n\n events.sessionCreated({\n source: com.atproto.server.createSession.$lxm,\n did: user.did,\n })\n\n return {\n encoding: 'application/json',\n body: {\n accessJwt,\n refreshJwt,\n\n did: user.did as DidString,\n // @ts-expect-error https://github.com/bluesky-social/atproto/pull/4406\n didDoc,\n handle: (user.handle ?? INVALID_HANDLE) as HandleString,\n email: user.email ?? undefined,\n emailConfirmed: !!user.emailConfirmedAt,\n active,\n status,\n },\n }\n },\n })\n }\n}\n"]}
1	+ {"version":3,"file":"createSession.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/createSession.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,EAGL,cAAc,GACf,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,iBAAiB,GAGlB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAA;AACpF,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAA;AAEvF,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAE5C,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,EAAE,cAAc,EAAE,GAAG,GAAG,CAAA;IAE9B,MAAM,SAAS,GAIX;QACF;YACE,UAAU,EAAE,GAAG;YACf,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC,EAAE,EAAE;SAClE;QACD;YACE,UAAU,EAAE,CAAC,GAAG,MAAM;YACtB,MAAM,EAAE,EAAE;YACV,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC,EAAE,EAAE;SAClE;KACF,CAAA;IAED,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;YAC3C,SAAS;YACT,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;gBAC1C,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;gBACpD,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;oBAC3D,OAAO;oBACP,IAAI;iBACL,CAAC,CAAA;YACJ,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;YAC3C,SAAS;YACT,OAAO,EAAE,KAAK,EAAE,EACd,KAAK,EAAE,EAAE,IAAI,EAAE,GAChB,EAAqD,EAAE;gBACtD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;oBACnD,MAAM,IAAI,iBAAiB,CACzB,sDAAsD,CACvD,CAAA;gBACH,CAAC;gBAED,wEAAwE;gBACxE,mDAAmD;gBACnD,MAAM,MAAM,GAAG,SAAS,CAAA;gBAExB,yEAAyE;gBACzE,mEAAmE;gBACnE,wEAAwE;gBACxE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,GACxC,MAAM,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;gBAErD,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,aAAa,EAAE,CAAC;oBAC1C,MAAM,IAAI,iBAAiB,CACzB,6BAA6B,EAC7B,iBAAiB,CAClB,CAAA;gBACH,CAAC;gBAED,MAAM,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBAC5D,GAAG,CAAC,cAAc,CAAC,aAAa,CAC9B,IAAI,CAAC,GAAG,EACR,WAAW,EACX,aAAa,CACd;oBACD,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;iBAChC,CAAC,CAAA;gBAEF,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;gBAEpD,MAAM,CAAC,cAAc,CAAC;oBACpB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI;oBAC7C,GAAG,EAAE,IAAI,CAAC,GAAG;iBACd,CAAC,CAAA;gBAEF,OAAO;oBACL,QAAQ,EAAE,kBAAkB;oBAC5B,IAAI,EAAE;wBACJ,SAAS;wBACT,UAAU;wBAEV,GAAG,EAAE,IAAI,CAAC,GAAgB;wBAC1B,uEAAuE;wBACvE,MAAM;wBACN,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,cAAc,CAAiB;wBACvD,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;wBAC9B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB;wBACvC,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB;wBACzC,MAAM;wBACN,MAAM;qBACP;iBACF,CAAA;YACH,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { DAY, MINUTE } from '@atproto/common'\nimport {\n type DidString,\n type HandleString,\n INVALID_HANDLE,\n} from '@atproto/syntax'\nimport {\n AuthRequiredError,\n type MethodRateLimit,\n type Server,\n} from '@atproto/xrpc-server'\nimport { formatAccountStatus } from '../../../../account-manager/account-manager.js'\nimport { OLD_PASSWORD_MAX_LENGTH } from '../../../../account-manager/helpers/scrypt.js'\nimport type { AppContext } from '../../../../context.js'\nimport { events } from '../../../../events.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { didDocForSession } from './util.js'\n\nexport default function (server: Server, ctx: AppContext) {\n const { entrywayClient } = ctx\n\n const rateLimit: MethodRateLimit<\n void,\n com.atproto.server.createSession.$Params,\n com.atproto.server.createSession.$Input\n > = [\n {\n durationMs: DAY,\n points: 300,\n calcKey: ({ input, req }) => `${input.body.identifier}-${req.ip}`,\n },\n {\n durationMs: 5 * MINUTE,\n points: 30,\n calcKey: ({ input, req }) => `${input.body.identifier}-${req.ip}`,\n },\n ]\n\n if (entrywayClient) {\n server.add(com.atproto.server.createSession, {\n rateLimit,\n handler: async ({ input: { body }, req }) => {\n const { headers } = ctx.entrywayPassthruHeaders(req)\n return entrywayClient.xrpc(com.atproto.server.createSession, {\n headers,\n body,\n })\n },\n })\n } else {\n server.add(com.atproto.server.createSession, {\n rateLimit,\n handler: async ({\n input: { body },\n }): Promise<com.atproto.server.createSession.$Output> => {\n if (body.password.length > OLD_PASSWORD_MAX_LENGTH) {\n throw new AuthRequiredError(\n 'Password too long. Consider resetting your password.',\n )\n }\n\n // @TODO get the locale somehow (either by adding a field in the request\n // body, or by using the `Accept-Language` header).\n const locale = undefined\n\n // @NOTE No translation needed for the second-factor challenge: `login()`\n // throws `AuthFactorRequiredError`, already an `AuthRequiredError`\n // carrying this method's declared `AuthFactorTokenRequired` error name.\n const { user, isSoftDeleted, appPassword } =\n await ctx.accountManager.login({ ...body, locale })\n\n if (!body.allowTakendown && isSoftDeleted) {\n throw new AuthRequiredError(\n 'Account has been taken down',\n 'AccountTakedown',\n )\n }\n\n const [{ accessJwt, refreshJwt }, didDoc] = await Promise.all([\n ctx.accountManager.createSession(\n user.did,\n appPassword,\n isSoftDeleted,\n ),\n didDocForSession(ctx, user.did),\n ])\n\n const { status, active } = formatAccountStatus(user)\n\n events.sessionCreated({\n source: com.atproto.server.createSession.$lxm,\n did: user.did,\n })\n\n return {\n encoding: 'application/json',\n body: {\n accessJwt,\n refreshJwt,\n\n did: user.did as DidString,\n // @ts-expect-error https://github.com/bluesky-social/atproto/pull/4406\n didDoc,\n handle: (user.handle ?? INVALID_HANDLE) as HandleString,\n email: user.email ?? undefined,\n emailConfirmed: !!user.emailConfirmedAt,\n emailAuthFactor: !!user.emailAuthFactorAt,\n active,\n status,\n },\n }\n },\n })\n }\n}\n"]}

package/dist/api/com/atproto/server/deactivateAccount.d.ts CHANGED Viewed

@@ -1,4 +1,4 @@
-import { type Server } from '@atproto/xrpc-server';
+import type { Server } from '@atproto/xrpc-server';
 import type { AppContext } from '../../../../context.js';
 export default function (server: Server, ctx: AppContext): void;
 //# sourceMappingURL=deactivateAccount.d.ts.map

package/dist/api/com/atproto/server/deactivateAccount.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"deactivateAccount.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/deactivateAccount.ts"],"names":[],"mappings":"AAAA,OAAO,~~EAAkB,~~KAAK,MAAM,EAAE,MAAM,sBAAsB,CAAA;~~AAElE~~,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAGxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,~~QAmCvD~~"}
1	+ {"version":3,"file":"deactivateAccount.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/deactivateAccount.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAElD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAGxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QA6CvD"}

package/dist/api/com/atproto/server/deactivateAccount.js CHANGED Viewed

@@ -1,4 +1,3 @@
-import { ForbiddenError } from '@atproto/xrpc-server';
 import { ACCESS_FULL, AuthScope } from '../../../../auth-scope.js';
 import { com } from '../../../../lexicons/index.js';
 export default function (server, ctx) {
@@ -6,16 +5,18 @@ export default function (server, ctx) {
     const auth = ctx.authVerifier.authorization({
         additional: [AuthScope.Takendown],
         scopes: ACCESS_FULL,
-        authorize: () => {
-            throw new ForbiddenError('OAuth credentials are not supported for this endpoint');
+        authorize: (permissions) => {
+            permissions.assertAccount({ attr: 'status', action: 'manage' });
         },
     });
     if (entrywayClient) {
         server.add(com.atproto.server.deactivateAccount, {
             auth,
             // in the case of entryway, the full flow is deactivateAccount (PDS) -> deactivateAccount (Entryway) -> updateSubjectStatus(PDS)
-            handler: async ({ input: { body }, req }) => {
-                const { headers } = ctx.entrywayPassthruHeaders(req);
+            handler: async ({ input: { body }, auth, req }) => {
+                // DPoP bound credentials cannot be forwarded as-is, so OAuth callers
+                // are authenticated towards the entryway using entryway auth instead.
+                const { headers } = await ctx.entrywayAuthHeaders(req, auth.credentials.did, com.atproto.server.deactivateAccount.$lxm);
                 await entrywayClient.xrpc(com.atproto.server.deactivateAccount, {
                     headers,
                     body,
@@ -28,6 +29,11 @@ export default function (server, ctx) {
             auth,
             handler: async ({ input: { body }, auth }) => {
                 await ctx.accountManager.deactivateAccount(auth.credentials.did, {
+                    // For legacy reasons we check if it's an oauth credential before passing
+                    // deleteCredentials since it did not before.
+                    // @TODO Investiage why the deleteCredentials was not passed previously and
+                    // address it in a different line of work
+                    deleteCredentials: auth.credentials.type === 'oauth',
                     deleteAfter: body.deleteAfter ?? null,
                 });
             },

package/dist/api/com/atproto/server/deactivateAccount.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"deactivateAccount.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/deactivateAccount.ts"],"names":[],"mappings":"~~AAAA~~,OAAO,EAAE,~~cAAc,EAAe,MAAM,sBAAsB,CAAA;AAClE,OAAO,EAAE,~~WAAW,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAElE,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AAEnD,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,EAAE,cAAc,EAAE,GAAG,GAAG,CAAA;IAE9B,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,aAAa,CAAC;QAC1C,UAAU,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC;QACjC,MAAM,EAAE,WAAW;QACnB,SAAS,EAAE,~~GAAG~~,EAAE;~~YACd~~,~~MAAM~~,IAAI,~~cAAc~~,~~CACtB~~,~~uDAAuD~~,~~CACxD~~,CAAA;~~QACH~~,CAAC;KACF,CAAC,CAAA;IAEF,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE;YAC/C,IAAI;YACJ,gIAAgI;YAChI,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;~~gBAC1C~~,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,~~uBAAuB~~,CAAC,GAAG,CAAC,CAAA;~~gBACpD~~,MAAM,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE;oBAC9D,OAAO;oBACP,IAAI;iBACL,CAAC,CAAA;YACJ,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE;YAC/C,IAAI;YACJ,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;gBAC3C,MAAM,GAAG,CAAC,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE;oBAC/D,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;iBACtC,CAAC,CAAA;YACJ,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { ~~ForbiddenError, type~~ Server } from '@atproto/xrpc-server'\nimport { ACCESS_FULL, AuthScope } from '../../../../auth-scope.js'\nimport type { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\n\nexport default function (server: Server, ctx: AppContext) {\n const { entrywayClient } = ctx\n\n const auth = ctx.authVerifier.authorization({\n additional: [AuthScope.Takendown],\n scopes: ACCESS_FULL,\n authorize: () => {\n ~~throw~~ ~~new~~ ~~ForbiddenError(\n~~ '~~OAuth~~ ~~credentials~~ ~~are~~ ~~not supported for this endpoint',\n~~ )\n },\n })\n\n if (entrywayClient) {\n server.add(com.atproto.server.deactivateAccount, {\n auth,\n // in the case of entryway, the full flow is deactivateAccount (PDS) -> deactivateAccount (Entryway) -> updateSubjectStatus(PDS)\n handler: async ({ input: { body }, req }) => {\n const { headers } = ctx.~~entrywayPassthruHeaders~~(req)\n await entrywayClient.xrpc(com.atproto.server.deactivateAccount, {\n headers,\n body,\n })\n },\n })\n } else {\n server.add(com.atproto.server.deactivateAccount, {\n auth,\n handler: async ({ input: { body }, auth }) => {\n await ctx.accountManager.deactivateAccount(auth.credentials.did, {\n deleteAfter: body.deleteAfter ?? null,\n })\n },\n })\n }\n}\n"]}
1	+ {"version":3,"file":"deactivateAccount.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/deactivateAccount.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAElE,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AAEnD,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,EAAE,cAAc,EAAE,GAAG,GAAG,CAAA;IAE9B,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,aAAa,CAAC;QAC1C,UAAU,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC;QACjC,MAAM,EAAE,WAAW;QACnB,SAAS,EAAE,CAAC,WAAW,EAAE,EAAE;YACzB,WAAW,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;QACjE,CAAC;KACF,CAAC,CAAA;IAEF,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE;YAC/C,IAAI;YACJ,gIAAgI;YAChI,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;gBAChD,qEAAqE;gBACrE,sEAAsE;gBACtE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,mBAAmB,CAC/C,GAAG,EACH,IAAI,CAAC,WAAW,CAAC,GAAG,EACpB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAC1C,CAAA;gBAED,MAAM,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE;oBAC9D,OAAO;oBACP,IAAI;iBACL,CAAC,CAAA;YACJ,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE;YAC/C,IAAI;YACJ,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;gBAC3C,MAAM,GAAG,CAAC,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE;oBAC/D,yEAAyE;oBACzE,6CAA6C;oBAC7C,2EAA2E;oBAC3E,yCAAyC;oBACzC,iBAAiB,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,KAAK,OAAO;oBACpD,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;iBACtC,CAAC,CAAA;YACJ,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC","sourcesContent":["import type { Server } from '@atproto/xrpc-server'\nimport { ACCESS_FULL, AuthScope } from '../../../../auth-scope.js'\nimport type { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\n\nexport default function (server: Server, ctx: AppContext) {\n const { entrywayClient } = ctx\n\n const auth = ctx.authVerifier.authorization({\n additional: [AuthScope.Takendown],\n scopes: ACCESS_FULL,\n authorize: (permissions) => {\n permissions.assertAccount({ attr: 'status', action: 'manage' })\n },\n })\n\n if (entrywayClient) {\n server.add(com.atproto.server.deactivateAccount, {\n auth,\n // in the case of entryway, the full flow is deactivateAccount (PDS) -> deactivateAccount (Entryway) -> updateSubjectStatus(PDS)\n handler: async ({ input: { body }, auth, req }) => {\n // DPoP bound credentials cannot be forwarded as-is, so OAuth callers\n // are authenticated towards the entryway using entryway auth instead.\n const { headers } = await ctx.entrywayAuthHeaders(\n req,\n auth.credentials.did,\n com.atproto.server.deactivateAccount.$lxm,\n )\n\n await entrywayClient.xrpc(com.atproto.server.deactivateAccount, {\n headers,\n body,\n })\n },\n })\n } else {\n server.add(com.atproto.server.deactivateAccount, {\n auth,\n handler: async ({ input: { body }, auth }) => {\n await ctx.accountManager.deactivateAccount(auth.credentials.did, {\n // For legacy reasons we check if it's an oauth credential before passing\n // deleteCredentials since it did not before.\n // @TODO Investiage why the deleteCredentials was not passed previously and\n // address it in a different line of work\n deleteCredentials: auth.credentials.type === 'oauth',\n deleteAfter: body.deleteAfter ?? null,\n })\n },\n })\n }\n}\n"]}

package/dist/api/com/atproto/server/getSession.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"getSession.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/getSession.ts"],"names":[],"mappings":"AAKA,OAAO,EAAuB,KAAK,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAIvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAIxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,~~QAuDvD~~"}
1	+ {"version":3,"file":"getSession.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/getSession.ts"],"names":[],"mappings":"AAKA,OAAO,EAAuB,KAAK,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAIvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAIxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAwDvD"}

package/dist/api/com/atproto/server/getSession.js CHANGED Viewed

@@ -39,6 +39,7 @@ export default function (server, ctx) {
                     handle: (user.handle ?? INVALID_HANDLE),
                     email: user.email ?? undefined,
                     emailConfirmed: !!user.emailConfirmedAt,
+                    emailAuthFactor: !!user.emailAuthFactorAt,
                     active,
                     status,
                 }),

package/dist/api/com/atproto/server/getSession.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"getSession.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/getSession.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,cAAc,GACf,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,mBAAmB,EAAe,MAAM,sBAAsB,CAAA;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAA;AAEpF,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAErD,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAE5C,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE;QACxC,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,aAAa,CAAC;YACnC,UAAU,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC;YACpC,SAAS,EAAE,GAAG,EAAE;gBACd,4DAA4D;YAC9D,CAAC;SACF,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;YAC/B,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;gBACvB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,mBAAmB,CAC/C,GAAG,EACH,IAAI,CAAC,WAAW,CAAC,GAAG,EACpB,+BAA+B,CAChC,CAAA;gBAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,IAAI,CAC5C,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,EAC7B,EAAE,OAAO,EAAE,CACZ,CAAA;gBAED,OAAO;oBACL,QAAQ,EAAE,kBAA2B;oBACrC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC;iBACzB,CAAA;YACH,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAA;YAChC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACvC,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;gBAChE,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC;aAC3B,CAAC,CAAA;YACF,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,mBAAmB,CAC3B,yCAAyC,GAAG,EAAE,CAC/C,CAAA;YACH,CAAC;YAED,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;YAEpD,OAAO;gBACL,QAAQ,EAAE,kBAA2B;gBACrC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;oBACjB,GAAG,EAAE,IAAI,CAAC,GAAgB;oBAC1B,uEAAuE;oBACvE,MAAM;oBACN,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,cAAc,CAAiB;oBACvD,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;oBAC9B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB;oBACvC,MAAM;oBACN,MAAM;iBACP,CAAC;aACH,CAAA;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,MAAM,CACb,EAAE,WAAW,EAA8B,EAC3C,IAA+C;IAE/C,IACE,WAAW,CAAC,IAAI,KAAK,OAAO;QAC5B,CAAC,WAAW,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EACzE,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAA;QAChE,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC","sourcesContent":["import {\n type DidString,\n type HandleString,\n INVALID_HANDLE,\n} from '@atproto/syntax'\nimport { InvalidRequestError, type Server } from '@atproto/xrpc-server'\nimport { formatAccountStatus } from '../../../../account-manager/account-manager.js'\nimport type { AccessOutput, OAuthOutput } from '../../../../auth-output.js'\nimport { AuthScope } from '../../../../auth-scope.js'\nimport type { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { didDocForSession } from './util.js'\n\nexport default function (server: Server, ctx: AppContext) {\n server.add(com.atproto.server.getSession, {\n auth: ctx.authVerifier.authorization({\n additional: [AuthScope.SignupQueued],\n authorize: () => {\n // Always allowed. \"email\" access is checked in the handler.\n },\n }),\n handler: async ({ auth, req }) => {\n if (ctx.entrywayClient) {\n const { headers } = await ctx.entrywayAuthHeaders(\n req,\n auth.credentials.did,\n 'com.atproto.server.getSession',\n )\n\n const { body } = await ctx.entrywayClient.xrpc(\n com.atproto.server.getSession,\n { headers },\n )\n\n return {\n encoding: 'application/json' as const,\n body: output(auth, body),\n }\n }\n\n const did = auth.credentials.did\n const [user, didDoc] = await Promise.all([\n ctx.accountManager.getAccount(did, { includeDeactivated: true }),\n didDocForSession(ctx, did),\n ])\n if (!user) {\n throw new InvalidRequestError(\n `Could not find user info for account: ${did}`,\n )\n }\n\n const { status, active } = formatAccountStatus(user)\n\n return {\n encoding: 'application/json' as const,\n body: output(auth, {\n did: user.did as DidString,\n // @ts-expect-error https://github.com/bluesky-social/atproto/pull/4406\n didDoc,\n handle: (user.handle ?? INVALID_HANDLE) as HandleString,\n email: user.email ?? undefined,\n emailConfirmed: !!user.emailConfirmedAt,\n active,\n status,\n }),\n }\n },\n })\n}\n\nfunction output(\n { credentials }: OAuthOutput \| AccessOutput,\n data: com.atproto.server.getSession.$OutputBody,\n): com.atproto.server.getSession.$OutputBody {\n if (\n credentials.type === 'oauth' &&\n !credentials.permissions.allowsAccount({ attr: 'email', action: 'read' })\n ) {\n const { email, emailAuthFactor, emailConfirmed, ...rest } = data\n return rest\n }\n\n return data\n}\n"]}
1	+ {"version":3,"file":"getSession.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/getSession.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,cAAc,GACf,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,mBAAmB,EAAe,MAAM,sBAAsB,CAAA;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAA;AAEpF,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAErD,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAE5C,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE;QACxC,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,aAAa,CAAC;YACnC,UAAU,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC;YACpC,SAAS,EAAE,GAAG,EAAE;gBACd,4DAA4D;YAC9D,CAAC;SACF,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;YAC/B,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;gBACvB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,mBAAmB,CAC/C,GAAG,EACH,IAAI,CAAC,WAAW,CAAC,GAAG,EACpB,+BAA+B,CAChC,CAAA;gBAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,IAAI,CAC5C,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,EAC7B,EAAE,OAAO,EAAE,CACZ,CAAA;gBAED,OAAO;oBACL,QAAQ,EAAE,kBAA2B;oBACrC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC;iBACzB,CAAA;YACH,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAA;YAChC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACvC,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;gBAChE,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC;aAC3B,CAAC,CAAA;YACF,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,mBAAmB,CAC3B,yCAAyC,GAAG,EAAE,CAC/C,CAAA;YACH,CAAC;YAED,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;YAEpD,OAAO;gBACL,QAAQ,EAAE,kBAA2B;gBACrC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;oBACjB,GAAG,EAAE,IAAI,CAAC,GAAgB;oBAC1B,uEAAuE;oBACvE,MAAM;oBACN,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,cAAc,CAAiB;oBACvD,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;oBAC9B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB;oBACvC,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB;oBACzC,MAAM;oBACN,MAAM;iBACP,CAAC;aACH,CAAA;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,MAAM,CACb,EAAE,WAAW,EAA8B,EAC3C,IAA+C;IAE/C,IACE,WAAW,CAAC,IAAI,KAAK,OAAO;QAC5B,CAAC,WAAW,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EACzE,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAA;QAChE,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC","sourcesContent":["import {\n type DidString,\n type HandleString,\n INVALID_HANDLE,\n} from '@atproto/syntax'\nimport { InvalidRequestError, type Server } from '@atproto/xrpc-server'\nimport { formatAccountStatus } from '../../../../account-manager/account-manager.js'\nimport type { AccessOutput, OAuthOutput } from '../../../../auth-output.js'\nimport { AuthScope } from '../../../../auth-scope.js'\nimport type { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { didDocForSession } from './util.js'\n\nexport default function (server: Server, ctx: AppContext) {\n server.add(com.atproto.server.getSession, {\n auth: ctx.authVerifier.authorization({\n additional: [AuthScope.SignupQueued],\n authorize: () => {\n // Always allowed. \"email\" access is checked in the handler.\n },\n }),\n handler: async ({ auth, req }) => {\n if (ctx.entrywayClient) {\n const { headers } = await ctx.entrywayAuthHeaders(\n req,\n auth.credentials.did,\n 'com.atproto.server.getSession',\n )\n\n const { body } = await ctx.entrywayClient.xrpc(\n com.atproto.server.getSession,\n { headers },\n )\n\n return {\n encoding: 'application/json' as const,\n body: output(auth, body),\n }\n }\n\n const did = auth.credentials.did\n const [user, didDoc] = await Promise.all([\n ctx.accountManager.getAccount(did, { includeDeactivated: true }),\n didDocForSession(ctx, did),\n ])\n if (!user) {\n throw new InvalidRequestError(\n `Could not find user info for account: ${did}`,\n )\n }\n\n const { status, active } = formatAccountStatus(user)\n\n return {\n encoding: 'application/json' as const,\n body: output(auth, {\n did: user.did as DidString,\n // @ts-expect-error https://github.com/bluesky-social/atproto/pull/4406\n didDoc,\n handle: (user.handle ?? INVALID_HANDLE) as HandleString,\n email: user.email ?? undefined,\n emailConfirmed: !!user.emailConfirmedAt,\n emailAuthFactor: !!user.emailAuthFactorAt,\n active,\n status,\n }),\n }\n },\n })\n}\n\nfunction output(\n { credentials }: OAuthOutput \| AccessOutput,\n data: com.atproto.server.getSession.$OutputBody,\n): com.atproto.server.getSession.$OutputBody {\n if (\n credentials.type === 'oauth' &&\n !credentials.permissions.allowsAccount({ attr: 'email', action: 'read' })\n ) {\n const { email, emailAuthFactor, emailConfirmed, ...rest } = data\n return rest\n }\n\n return data\n}\n"]}

package/dist/api/com/atproto/server/refreshSession.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"refreshSession.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/refreshSession.ts"],"names":[],"mappings":"AAKA,OAAO,EAGL,KAAK,MAAM,EACZ,MAAM,sBAAsB,CAAA;AAE7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAMxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,~~QAgEvD~~"}
1	+ {"version":3,"file":"refreshSession.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/refreshSession.ts"],"names":[],"mappings":"AAKA,OAAO,EAGL,KAAK,MAAM,EACZ,MAAM,sBAAsB,CAAA;AAE7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAMxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QAiEvD"}

package/dist/api/com/atproto/server/refreshSession.js CHANGED Viewed

@@ -49,6 +49,7 @@ export default function (server, ctx) {
                     handle: (user.handle ?? INVALID_HANDLE),
                     email: user.email ?? undefined,
                     emailConfirmed: !!user.emailConfirmedAt,
+                    emailAuthFactor: !!user.emailAuthFactorAt,
                     active,
                     status,
                 },

package/dist/api/com/atproto/server/refreshSession.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"refreshSession.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/refreshSession.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,cAAc,GACf,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GAEpB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAA;AAEpF,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAE5C,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE;QAC5C,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE;QAChC,OAAO,EAAE,KAAK,EAAE,EACd,IAAI,EACJ,GAAG,GACJ,EAAsD,EAAE;YACvD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAA;YAChC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE;gBACpD,kBAAkB,EAAE,IAAI;gBACxB,gBAAgB,EAAE,IAAI;aACvB,CAAC,CAAA;YACF,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,mBAAmB,CAC3B,yCAAyC,GAAG,EAAE,CAC/C,CAAA;YACH,CAAC;YACD,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,iBAAiB,CACzB,6BAA6B,EAC7B,iBAAiB,CAClB,CAAA;YACH,CAAC;YAED,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;gBACvB,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;gBACpD,OAAO,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE;oBAChE,OAAO;iBACR,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC1C,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;gBAC/B,GAAG,CAAC,cAAc,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;aAChE,CAAC,CAAA;YACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,EAAE,cAAc,CAAC,CAAA;YACzE,CAAC;YAED,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;YAEpD,MAAM,CAAC,gBAAgB,CAAC;gBACtB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI;gBAC9C,GAAG,EAAE,IAAI,CAAC,GAAG;aACd,CAAC,CAAA;YAEF,OAAO;gBACL,QAAQ,EAAE,kBAA2B;gBACrC,IAAI,EAAE;oBACJ,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;oBAE9B,GAAG,EAAE,IAAI,CAAC,GAAgB;oBAC1B,uEAAuE;oBACvE,MAAM;oBACN,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,cAAc,CAAiB;oBACvD,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;oBAC9B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB;oBACvC,MAAM;oBACN,MAAM;iBACP;aACF,CAAA;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import {\n type DidString,\n type HandleString,\n INVALID_HANDLE,\n} from '@atproto/syntax'\nimport {\n AuthRequiredError,\n InvalidRequestError,\n type Server,\n} from '@atproto/xrpc-server'\nimport { formatAccountStatus } from '../../../../account-manager/account-manager.js'\nimport type { AppContext } from '../../../../context.js'\nimport { softDeleted } from '../../../../db/util.js'\nimport { events } from '../../../../events.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { didDocForSession } from './util.js'\n\nexport default function (server: Server, ctx: AppContext) {\n server.add(com.atproto.server.refreshSession, {\n auth: ctx.authVerifier.refresh(),\n handler: async ({\n auth,\n req,\n }): Promise<com.atproto.server.refreshSession.$Output> => {\n const did = auth.credentials.did\n const user = await ctx.accountManager.getAccount(did, {\n includeDeactivated: true,\n includeTakenDown: true,\n })\n if (!user) {\n throw new InvalidRequestError(\n `Could not find user info for account: ${did}`,\n )\n }\n if (softDeleted(user)) {\n throw new AuthRequiredError(\n 'Account has been taken down',\n 'AccountTakedown',\n )\n }\n\n if (ctx.entrywayClient) {\n const { headers } = ctx.entrywayPassthruHeaders(req)\n return ctx.entrywayClient.xrpc(com.atproto.server.refreshSession, {\n headers,\n })\n }\n\n const [didDoc, rotated] = await Promise.all([\n didDocForSession(ctx, user.did),\n ctx.accountManager.rotateRefreshToken(auth.credentials.tokenId),\n ])\n if (rotated === null) {\n throw new InvalidRequestError('Token has been revoked', 'ExpiredToken')\n }\n\n const { status, active } = formatAccountStatus(user)\n\n events.sessionRefreshed({\n source: com.atproto.server.refreshSession.$lxm,\n did: user.did,\n })\n\n return {\n encoding: 'application/json' as const,\n body: {\n accessJwt: rotated.accessJwt,\n refreshJwt: rotated.refreshJwt,\n\n did: user.did as DidString,\n // @ts-expect-error https://github.com/bluesky-social/atproto/pull/4406\n didDoc,\n handle: (user.handle ?? INVALID_HANDLE) as HandleString,\n email: user.email ?? undefined,\n emailConfirmed: !!user.emailConfirmedAt,\n active,\n status,\n },\n }\n },\n })\n}\n"]}
1	+ {"version":3,"file":"refreshSession.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/refreshSession.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,cAAc,GACf,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GAEpB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAA;AAEpF,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAE5C,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE;QAC5C,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE;QAChC,OAAO,EAAE,KAAK,EAAE,EACd,IAAI,EACJ,GAAG,GACJ,EAAsD,EAAE;YACvD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAA;YAChC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE;gBACpD,kBAAkB,EAAE,IAAI;gBACxB,gBAAgB,EAAE,IAAI;aACvB,CAAC,CAAA;YACF,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,mBAAmB,CAC3B,yCAAyC,GAAG,EAAE,CAC/C,CAAA;YACH,CAAC;YACD,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,iBAAiB,CACzB,6BAA6B,EAC7B,iBAAiB,CAClB,CAAA;YACH,CAAC;YAED,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;gBACvB,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;gBACpD,OAAO,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE;oBAChE,OAAO;iBACR,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC1C,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;gBAC/B,GAAG,CAAC,cAAc,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;aAChE,CAAC,CAAA;YACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,EAAE,cAAc,CAAC,CAAA;YACzE,CAAC;YAED,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;YAEpD,MAAM,CAAC,gBAAgB,CAAC;gBACtB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI;gBAC9C,GAAG,EAAE,IAAI,CAAC,GAAG;aACd,CAAC,CAAA;YAEF,OAAO;gBACL,QAAQ,EAAE,kBAA2B;gBACrC,IAAI,EAAE;oBACJ,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;oBAE9B,GAAG,EAAE,IAAI,CAAC,GAAgB;oBAC1B,uEAAuE;oBACvE,MAAM;oBACN,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,cAAc,CAAiB;oBACvD,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;oBAC9B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB;oBACvC,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB;oBACzC,MAAM;oBACN,MAAM;iBACP;aACF,CAAA;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import {\n type DidString,\n type HandleString,\n INVALID_HANDLE,\n} from '@atproto/syntax'\nimport {\n AuthRequiredError,\n InvalidRequestError,\n type Server,\n} from '@atproto/xrpc-server'\nimport { formatAccountStatus } from '../../../../account-manager/account-manager.js'\nimport type { AppContext } from '../../../../context.js'\nimport { softDeleted } from '../../../../db/util.js'\nimport { events } from '../../../../events.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { didDocForSession } from './util.js'\n\nexport default function (server: Server, ctx: AppContext) {\n server.add(com.atproto.server.refreshSession, {\n auth: ctx.authVerifier.refresh(),\n handler: async ({\n auth,\n req,\n }): Promise<com.atproto.server.refreshSession.$Output> => {\n const did = auth.credentials.did\n const user = await ctx.accountManager.getAccount(did, {\n includeDeactivated: true,\n includeTakenDown: true,\n })\n if (!user) {\n throw new InvalidRequestError(\n `Could not find user info for account: ${did}`,\n )\n }\n if (softDeleted(user)) {\n throw new AuthRequiredError(\n 'Account has been taken down',\n 'AccountTakedown',\n )\n }\n\n if (ctx.entrywayClient) {\n const { headers } = ctx.entrywayPassthruHeaders(req)\n return ctx.entrywayClient.xrpc(com.atproto.server.refreshSession, {\n headers,\n })\n }\n\n const [didDoc, rotated] = await Promise.all([\n didDocForSession(ctx, user.did),\n ctx.accountManager.rotateRefreshToken(auth.credentials.tokenId),\n ])\n if (rotated === null) {\n throw new InvalidRequestError('Token has been revoked', 'ExpiredToken')\n }\n\n const { status, active } = formatAccountStatus(user)\n\n events.sessionRefreshed({\n source: com.atproto.server.refreshSession.$lxm,\n did: user.did,\n })\n\n return {\n encoding: 'application/json' as const,\n body: {\n accessJwt: rotated.accessJwt,\n refreshJwt: rotated.refreshJwt,\n\n did: user.did as DidString,\n // @ts-expect-error https://github.com/bluesky-social/atproto/pull/4406\n didDoc,\n handle: (user.handle ?? INVALID_HANDLE) as HandleString,\n email: user.email ?? undefined,\n emailConfirmed: !!user.emailConfirmedAt,\n emailAuthFactor: !!user.emailAuthFactorAt,\n active,\n status,\n },\n }\n },\n })\n}\n"]}

package/dist/api/com/atproto/server/updateEmail.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"updateEmail.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/updateEmail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,KAAK,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAEvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAIxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,~~QA6CvD~~"}
1	+ {"version":3,"file":"updateEmail.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/updateEmail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,KAAK,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAEvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAIxD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QA6FvD"}

package/dist/api/com/atproto/server/updateEmail.js CHANGED Viewed

@@ -23,10 +23,54 @@ export default function (server, ctx) {
             auth,
             handler: async ({ auth, input: { body } }) => {
                 const did = auth.credentials.did;
-                const { token, email } = body;
+                const account = await ctx.accountManager.getAccount(did, {
+                    includeDeactivated: true,
+                    includeTakenDown: true,
+                });
+                if (!account) {
+                    throw new InvalidRequestError(`Could not find user info for account: ${did}`);
+                }
+                const { token } = body;
+                const email = body.email.toLowerCase();
                 // @TODO get the locale somehow (either by adding a field in the request
                 // body, or by using the `Accept-Language` header).
                 const locale = undefined;
+                // @NOTE Handle explicit toggles even when the factor already matches:
+                // updating the email would clear its confirmation and disable 2FA.
+                if (body.emailAuthFactor != null) {
+                    if (body.emailAuthFactor) {
+                        // User is trying to enable email OTP
+                        if (account.emailConfirmedAt && account.email === email) {
+                            // Enabling only adds protection: immediate, no token required.
+                            await ctx.accountManager.enableEmailAuthFactor({ did });
+                            return; // no need to continue to email change since email is not being changed
+                        }
+                        else {
+                            // @NOTE updating the user email address has the effect of resetting the
+                            // email OTP status, reverting any action we would be performing here.
+                            // Instead of silently ignoring a request to enable email OTP while updating
+                            // the email, we provide an error message.
+                            throw new InvalidRequestError('Please change and verify your email before enabling OTP');
+                        }
+                    }
+                    else {
+                        // User is trying to disable email OTP
+                        if (account.email === email) {
+                            // Disabling removes a second factor, so it's gated by an
+                            // `update_email` OTP: the first call (no token) emails a code and
+                            // makes no change; the second (with token) verifies and disables.
+                            await ctx.accountManager.disableEmailAuthFactor({
+                                did,
+                                token,
+                                locale,
+                            });
+                            return; // no need to continue to email change since email is not being changed
+                        }
+                        else {
+                            // No-op: changing email address always disables OTP
+                        }
+                    }
+                }
                 try {
                     await ctx.accountManager.updateEmail(did, email, token, { locale });
                 }

package/dist/api/com/atproto/server/updateEmail.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"updateEmail.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/updateEmail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAe,MAAM,sBAAsB,CAAA;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gDAAgD,CAAA;AAEvF,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA;AAEhE,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,EAAE,cAAc,EAAE,GAAG,GAAG,CAAA;IAE9B,qEAAqE;IACrE,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAA;IAExC,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;YACzC,IAAI;YACJ,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;gBAChD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,mBAAmB,CAC/C,GAAG,EACH,IAAI,CAAC,WAAW,CAAC,GAAG,EACpB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CACpC,CAAA;gBAED,MAAM,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;oBACxD,OAAO;oBACP,IAAI;iBACL,CAAC,CAAA;YACJ,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;YACzC,IAAI;YACJ,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE;gBAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAA;gBAChC,MAAM,EAAE,~~KAAK~~,EAAE,KAAK,EAAE,GAAG,IAAI,CAAA;~~gBAE7B~~,wEAAwE;gBACxE,mDAAmD;gBACnD,MAAM,MAAM,GAAG,SAAS,CAAA;gBAExB,IAAI,CAAC;oBACH,MAAM,GAAG,CAAC,cAAc,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;gBACrE,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,KAAK,YAAY,sBAAsB,EAAE,CAAC;wBAC5C,MAAM,IAAI,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;oBACpE,CAAC;oBAED,MAAM,KAAK,CAAA;gBACb,CAAC;YACH,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { InvalidRequestError, type Server } from '@atproto/xrpc-server'\nimport { UserAlreadyExistsError } from '../../../../account-manager/helpers/account.js'\nimport type { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { requestEmailUpdateAuth } from './requestEmailUpdate.js'\n\nexport default function (server: Server, ctx: AppContext) {\n const { entrywayClient } = ctx\n\n // @NOTE Ensure that both endpoints use the same authentication logic\n const auth = requestEmailUpdateAuth(ctx)\n\n if (entrywayClient) {\n server.add(com.atproto.server.updateEmail, {\n auth,\n handler: async ({ auth, input: { body }, req }) => {\n const { headers } = await ctx.entrywayAuthHeaders(\n req,\n auth.credentials.did,\n com.atproto.server.updateEmail.$lxm,\n )\n\n await entrywayClient.xrpc(com.atproto.server.updateEmail, {\n headers,\n body,\n })\n },\n })\n } else {\n server.add(com.atproto.server.updateEmail, {\n auth,\n handler: async ({ auth, input: { body } }) => {\n const did = auth.credentials.did\n const { ~~token~~, ~~email~~ } = body\n\n // @TODO get the locale somehow (either by adding a field in the request\n // body, or by using the `Accept-Language` header).\n const locale = undefined\n\n try {\n await ctx.accountManager.updateEmail(did, email, token, { locale })\n } catch (cause) {\n if (cause instanceof UserAlreadyExistsError) {\n throw new InvalidRequestError(cause.message, undefined, { cause })\n }\n\n throw cause\n }\n },\n })\n }\n}\n"]}
1	+ {"version":3,"file":"updateEmail.js","sourceRoot":"","sources":["../../../../../src/api/com/atproto/server/updateEmail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAe,MAAM,sBAAsB,CAAA;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gDAAgD,CAAA;AAEvF,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA;AAEhE,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,EAAE,cAAc,EAAE,GAAG,GAAG,CAAA;IAE9B,qEAAqE;IACrE,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAA;IAExC,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;YACzC,IAAI;YACJ,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;gBAChD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,mBAAmB,CAC/C,GAAG,EACH,IAAI,CAAC,WAAW,CAAC,GAAG,EACpB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CACpC,CAAA;gBAED,MAAM,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;oBACxD,OAAO;oBACP,IAAI;iBACL,CAAC,CAAA;YACJ,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;YACzC,IAAI;YACJ,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE;gBAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAA;gBAChC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE;oBACvD,kBAAkB,EAAE,IAAI;oBACxB,gBAAgB,EAAE,IAAI;iBACvB,CAAC,CAAA;gBACF,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,mBAAmB,CAC3B,yCAAyC,GAAG,EAAE,CAC/C,CAAA;gBACH,CAAC;gBAED,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAA;gBACtB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAA;gBACtC,wEAAwE;gBACxE,mDAAmD;gBACnD,MAAM,MAAM,GAAG,SAAS,CAAA;gBAExB,sEAAsE;gBACtE,mEAAmE;gBACnE,IAAI,IAAI,CAAC,eAAe,IAAI,IAAI,EAAE,CAAC;oBACjC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;wBACzB,qCAAqC;wBACrC,IAAI,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;4BACxD,+DAA+D;4BAC/D,MAAM,GAAG,CAAC,cAAc,CAAC,qBAAqB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;4BAEvD,OAAM,CAAC,uEAAuE;wBAChF,CAAC;6BAAM,CAAC;4BACN,wEAAwE;4BACxE,sEAAsE;4BACtE,4EAA4E;4BAC5E,0CAA0C;4BAC1C,MAAM,IAAI,mBAAmB,CAC3B,yDAAyD,CAC1D,CAAA;wBACH,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,sCAAsC;wBACtC,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;4BAC5B,yDAAyD;4BACzD,kEAAkE;4BAClE,kEAAkE;4BAClE,MAAM,GAAG,CAAC,cAAc,CAAC,sBAAsB,CAAC;gCAC9C,GAAG;gCACH,KAAK;gCACL,MAAM;6BACP,CAAC,CAAA;4BAEF,OAAM,CAAC,uEAAuE;wBAChF,CAAC;6BAAM,CAAC;4BACN,oDAAoD;wBACtD,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,GAAG,CAAC,cAAc,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;gBACrE,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,KAAK,YAAY,sBAAsB,EAAE,CAAC;wBAC5C,MAAM,IAAI,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;oBACpE,CAAC;oBAED,MAAM,KAAK,CAAA;gBACb,CAAC;YACH,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { InvalidRequestError, type Server } from '@atproto/xrpc-server'\nimport { UserAlreadyExistsError } from '../../../../account-manager/helpers/account.js'\nimport type { AppContext } from '../../../../context.js'\nimport { com } from '../../../../lexicons/index.js'\nimport { requestEmailUpdateAuth } from './requestEmailUpdate.js'\n\nexport default function (server: Server, ctx: AppContext) {\n const { entrywayClient } = ctx\n\n // @NOTE Ensure that both endpoints use the same authentication logic\n const auth = requestEmailUpdateAuth(ctx)\n\n if (entrywayClient) {\n server.add(com.atproto.server.updateEmail, {\n auth,\n handler: async ({ auth, input: { body }, req }) => {\n const { headers } = await ctx.entrywayAuthHeaders(\n req,\n auth.credentials.did,\n com.atproto.server.updateEmail.$lxm,\n )\n\n await entrywayClient.xrpc(com.atproto.server.updateEmail, {\n headers,\n body,\n })\n },\n })\n } else {\n server.add(com.atproto.server.updateEmail, {\n auth,\n handler: async ({ auth, input: { body } }) => {\n const did = auth.credentials.did\n const account = await ctx.accountManager.getAccount(did, {\n includeDeactivated: true,\n includeTakenDown: true,\n })\n if (!account) {\n throw new InvalidRequestError(\n `Could not find user info for account: ${did}`,\n )\n }\n\n const { token } = body\n const email = body.email.toLowerCase()\n // @TODO get the locale somehow (either by adding a field in the request\n // body, or by using the `Accept-Language` header).\n const locale = undefined\n\n // @NOTE Handle explicit toggles even when the factor already matches:\n // updating the email would clear its confirmation and disable 2FA.\n if (body.emailAuthFactor != null) {\n if (body.emailAuthFactor) {\n // User is trying to enable email OTP\n if (account.emailConfirmedAt && account.email === email) {\n // Enabling only adds protection: immediate, no token required.\n await ctx.accountManager.enableEmailAuthFactor({ did })\n\n return // no need to continue to email change since email is not being changed\n } else {\n // @NOTE updating the user email address has the effect of resetting the\n // email OTP status, reverting any action we would be performing here.\n // Instead of silently ignoring a request to enable email OTP while updating\n // the email, we provide an error message.\n throw new InvalidRequestError(\n 'Please change and verify your email before enabling OTP',\n )\n }\n } else {\n // User is trying to disable email OTP\n if (account.email === email) {\n // Disabling removes a second factor, so it's gated by an\n // `update_email` OTP: the first call (no token) emails a code and\n // makes no change; the second (with token) verifies and disables.\n await ctx.accountManager.disableEmailAuthFactor({\n did,\n token,\n locale,\n })\n\n return // no need to continue to email change since email is not being changed\n } else {\n // No-op: changing email address always disables OTP\n }\n }\n }\n\n try {\n await ctx.accountManager.updateEmail(did, email, token, { locale })\n } catch (cause) {\n if (cause instanceof UserAlreadyExistsError) {\n throw new InvalidRequestError(cause.message, undefined, { cause })\n }\n\n throw cause\n }\n },\n })\n }\n}\n"]}

package/dist/auth-verifier.d.ts CHANGED Viewed

@@ -93,6 +93,7 @@ export declare class AuthVerifier {
 }
 export declare function isUserOrAdmin(auth: AccessOutput | OAuthOutput | AdminTokenOutput | UnauthenticatedOutput, did: string): boolean;
 export declare const bearerTokenFromReq: (req: IncomingMessage) => string | null;
+export { type KeyObject };
 export declare const createSecretKeyObject: (secret: string) => KeyObject;
 export declare const createPublicKeyObject: (publicKeyHex: string) => KeyObject;
 //# sourceMappingURL=auth-verifier.d.ts.map

package/dist/auth-verifier.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth-verifier.d.ts","sourceRoot":"","sources":["../src/auth-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAoC,MAAM,aAAa,CAAA;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAkB,MAAM,WAAW,CAAA;AAEhE,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,OAAO,EAAE,KAAK,UAAU,EAA0B,MAAM,mBAAmB,CAAA;AAC3E,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,SAAS,EAEf,MAAM,cAAc,CAAA;AAKrB,OAAO,KAAK,EACV,aAAa,EAEd,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACL,KAAK,gBAAgB,EAEtB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAEL,KAAK,SAAS,EAGd,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,MAAM,EAIZ,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAA;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAA;AACxE,OAAO,KAAK,EACV,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,qBAAqB,EACrB,qBAAqB,EACtB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAmB,SAAS,EAAe,MAAM,iBAAiB,CAAA;AAGzE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAEnD,MAAM,MAAM,eAAe,GAAG;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAC3B,CAAA;AAED,MAAM,MAAM,aAAa,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAAI;IAC3D,MAAM,CAAC,EAAE,SAAS,CAAC,EAAE,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,kBAAkB,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAAI;IAChE,UAAU,CAAC,EAAE,SAAS,CAAC,EAAE,CAAA;CAC1B,CAAA;AAED,MAAM,MAAM,iBAAiB,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI;IACzD,SAAS,EAAE,CACT,WAAW,EAAE,gBAAgB,EAC7B,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC,KACtB,SAAS,CAAC,IAAI,CAAC,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,SAAS,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE;QACJ,GAAG,EAAE,MAAM,CAAA;QACX,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,UAAU,CAAC,EAAE,MAAM,CAAA;KACpB,CAAA;CACF,CAAA;AAED,MAAM,MAAM,sBAAsB,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAChE,YAAY,CACV,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,GAAG;IACtC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAA;CACrB,EACD,UAAU,GAAG,KAAK,CACnB,CAAA;AAEH,MAAM,MAAM,qBAAqB,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAAI;IACnE,GAAG,EAAE,SAAS,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IACvB,KAAK,EAAE,CAAC,CAAA;CACT,CAAA;AAED,qBAAa,YAAY;IAOd,cAAc,EAAE,cAAc;IAC9B,UAAU,EAAE,UAAU;IACtB,aAAa,EAAE,aAAa;IARrC,OAAO,CAAC,UAAU,CAAQ;IAC1B,OAAO,CAAC,OAAO,CAAW;IAC1B,OAAO,CAAC,UAAU,CAAQ;IACnB,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAA;IAErC,YACS,cAAc,EAAE,cAAc,EAC9B,UAAU,EAAE,UAAU,EACtB,aAAa,EAAE,aAAa,EACnC,IAAI,EAAE,gBAAgB,EAMvB;IAIM,eAAe,EAAE,kBAAkB,CAAC,qBAAqB,CAAC,CAchE;IAED,6DAA6D;IACtD,UAAU,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,CAYtD;IAEM,UAAU,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,CActD;IAED,qGAAqG;IAC9F,SAAS,EAAE,kBAAkB,CAAC,gBAAgB,GAAG,gBAAgB,CAAC,CAQtE;IAEH,SAAS,CAAC,MAAM,CAAC,CAAC,SAAS,SAAS,EAClC,OAAO,EAAE,eAAe,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GACpD,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CA4BrC;IAEM,OAAO,CAAC,OAAO,CAAC,EAAE;QACvB,YAAY,CAAC,EAAE,OAAO,CAAA;KACvB,GAAG,kBAAkB,CAAC,aAAa,CAAC,CA+BpC;IAEM,aAAa,CAAC,CAAC,SAAS,MAAM,EAAE,EACrC,MAAwB,EACxB,UAAe,EACf,GAAG,OAAO,EACX,EAAE,eAAe,GAChB,aAAa,GACb,kBAAkB,GAClB,iBAAiB,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,YAAY,GAAG,WAAW,EAAE,CAAC,CAAC,CA+BzE;IAEM,yBAAyB,CAAC,CAAC,SAAS,MAAM,EAC/C,IAAI,EAAE,eAAe,GAAG,kBAAkB,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAChE,kBAAkB,CAAC,YAAY,GAAG,WAAW,GAAG,gBAAgB,EAAE,CAAC,CAAC,CAYtE;IAEM,iCAAiC,CAAC,CAAC,SAAS,MAAM,EACvD,IAAI,EAAE,eAAe,GAAG,kBAAkB,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAChE,kBAAkB,CACnB,WAAW,GAAG,YAAY,GAAG,gBAAgB,GAAG,qBAAqB,EACrE,CAAC,CACF,CAYA;IAEM,eAAe,EAAE,kBAAkB,CAAC,qBAAqB,CAAC,CAWhE;IAEM,uBAAuB,EAAE,kBAAkB,CAChD,qBAAqB,GAAG,qBAAqB,CAC9C,CAOA;IAEM,8BAA8B,CAAC,CAAC,SAAS,MAAM,EACpD,OAAO,EAAE,eAAe,GACtB,aAAa,GACb,kBAAkB,GAClB,iBAAiB,CAAC,CAAC,CAAC,GACrB,kBAAkB,CAAC,qBAAqB,GAAG,WAAW,GAAG,YAAY,EAAE,CAAC,CAAC,CAS3E;IAED,SAAS,CAAC,KAAK,CAAC,CAAC,SAAS,MAAM,EAAE,EAChC,SAAS,EACT,GAAG,mBAAmB,EACvB,EAAE,eAAe,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAC5D,WAAW,EACX,CAAC,CACF,CAwEA;IAED,UAAgB,YAAY,CAC1B,GAAG,EAAE,SAAS,EACd,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,IAAI,CAAC,CAIf;IAED;;;;OAIG;IACU,WAAW,CACtB,WAAW,EAAE,kBAAkB,EAC/B,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,YAAY,CAAC,CAsBvB;IAED;;;OAGG;IACH,UAAgB,eAAe,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,EAC7D,GAAG,EAAE,eAAe,EACpB,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC,GAChD,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAmDnC;IAED,UAAgB,gBAAgB,CAC9B,GAAG,EAAE,eAAe,EACpB,IAAI,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE;;;;;;OA4C1B;CACF;AAKD,wBAAgB,aAAa,CAC3B,IAAI,EAAE,YAAY,GAAG,WAAW,GAAG,gBAAgB,GAAG,qBAAqB,EAC3E,GAAG,EAAE,MAAM,GACV,OAAO,CAQT;AAmDD,eAAO,MAAM,kBAAkB,QAAS,eAAe,kBAGtD,CAAA;AAoBD,eAAO,MAAM,qBAAqB,WAAY,MAAM,KAAG,SAEtD,CAAA;AAED,eAAO,MAAM,qBAAqB,iBAAkB,MAAM,KAAG,SAa5D,CAAA"}
1	+ {"version":3,"file":"auth-verifier.d.ts","sourceRoot":"","sources":["../src/auth-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAoC,MAAM,aAAa,CAAA;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAkB,MAAM,WAAW,CAAA;AAEhE,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,OAAO,EAAE,KAAK,UAAU,EAA0B,MAAM,mBAAmB,CAAA;AAC3E,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,SAAS,EAEf,MAAM,cAAc,CAAA;AAKrB,OAAO,KAAK,EACV,aAAa,EAEd,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACL,KAAK,gBAAgB,EAEtB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAEL,KAAK,SAAS,EAGd,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,MAAM,EAIZ,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAA;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAA;AACxE,OAAO,KAAK,EACV,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,qBAAqB,EACrB,qBAAqB,EACtB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAmB,SAAS,EAAe,MAAM,iBAAiB,CAAA;AAGzE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAEnD,MAAM,MAAM,eAAe,GAAG;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAC3B,CAAA;AAED,MAAM,MAAM,aAAa,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAAI;IAC3D,MAAM,CAAC,EAAE,SAAS,CAAC,EAAE,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,kBAAkB,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAAI;IAChE,UAAU,CAAC,EAAE,SAAS,CAAC,EAAE,CAAA;CAC1B,CAAA;AAED,MAAM,MAAM,iBAAiB,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI;IACzD,SAAS,EAAE,CACT,WAAW,EAAE,gBAAgB,EAC7B,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC,KACtB,SAAS,CAAC,IAAI,CAAC,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,SAAS,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE;QACJ,GAAG,EAAE,MAAM,CAAA;QACX,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,UAAU,CAAC,EAAE,MAAM,CAAA;KACpB,CAAA;CACF,CAAA;AAED,MAAM,MAAM,sBAAsB,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAChE,YAAY,CACV,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,GAAG;IACtC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAA;CACrB,EACD,UAAU,GAAG,KAAK,CACnB,CAAA;AAEH,MAAM,MAAM,qBAAqB,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAAI;IACnE,GAAG,EAAE,SAAS,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IACvB,KAAK,EAAE,CAAC,CAAA;CACT,CAAA;AAED,qBAAa,YAAY;IAOd,cAAc,EAAE,cAAc;IAC9B,UAAU,EAAE,UAAU;IACtB,aAAa,EAAE,aAAa;IARrC,OAAO,CAAC,UAAU,CAAQ;IAC1B,OAAO,CAAC,OAAO,CAAW;IAC1B,OAAO,CAAC,UAAU,CAAQ;IACnB,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAA;IAErC,YACS,cAAc,EAAE,cAAc,EAC9B,UAAU,EAAE,UAAU,EACtB,aAAa,EAAE,aAAa,EACnC,IAAI,EAAE,gBAAgB,EAMvB;IAIM,eAAe,EAAE,kBAAkB,CAAC,qBAAqB,CAAC,CAchE;IAED,6DAA6D;IACtD,UAAU,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,CAYtD;IAEM,UAAU,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,CActD;IAED,qGAAqG;IAC9F,SAAS,EAAE,kBAAkB,CAAC,gBAAgB,GAAG,gBAAgB,CAAC,CAQtE;IAEH,SAAS,CAAC,MAAM,CAAC,CAAC,SAAS,SAAS,EAClC,OAAO,EAAE,eAAe,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GACpD,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CA4BrC;IAEM,OAAO,CAAC,OAAO,CAAC,EAAE;QACvB,YAAY,CAAC,EAAE,OAAO,CAAA;KACvB,GAAG,kBAAkB,CAAC,aAAa,CAAC,CA+BpC;IAEM,aAAa,CAAC,CAAC,SAAS,MAAM,EAAE,EACrC,MAAwB,EACxB,UAAe,EACf,GAAG,OAAO,EACX,EAAE,eAAe,GAChB,aAAa,GACb,kBAAkB,GAClB,iBAAiB,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,YAAY,GAAG,WAAW,EAAE,CAAC,CAAC,CA+BzE;IAEM,yBAAyB,CAAC,CAAC,SAAS,MAAM,EAC/C,IAAI,EAAE,eAAe,GAAG,kBAAkB,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAChE,kBAAkB,CAAC,YAAY,GAAG,WAAW,GAAG,gBAAgB,EAAE,CAAC,CAAC,CAYtE;IAEM,iCAAiC,CAAC,CAAC,SAAS,MAAM,EACvD,IAAI,EAAE,eAAe,GAAG,kBAAkB,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAChE,kBAAkB,CACnB,WAAW,GAAG,YAAY,GAAG,gBAAgB,GAAG,qBAAqB,EACrE,CAAC,CACF,CAYA;IAEM,eAAe,EAAE,kBAAkB,CAAC,qBAAqB,CAAC,CAWhE;IAEM,uBAAuB,EAAE,kBAAkB,CAChD,qBAAqB,GAAG,qBAAqB,CAC9C,CAOA;IAEM,8BAA8B,CAAC,CAAC,SAAS,MAAM,EACpD,OAAO,EAAE,eAAe,GACtB,aAAa,GACb,kBAAkB,GAClB,iBAAiB,CAAC,CAAC,CAAC,GACrB,kBAAkB,CAAC,qBAAqB,GAAG,WAAW,GAAG,YAAY,EAAE,CAAC,CAAC,CAS3E;IAED,SAAS,CAAC,KAAK,CAAC,CAAC,SAAS,MAAM,EAAE,EAChC,SAAS,EACT,GAAG,mBAAmB,EACvB,EAAE,eAAe,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAC5D,WAAW,EACX,CAAC,CACF,CAwEA;IAED,UAAgB,YAAY,CAC1B,GAAG,EAAE,SAAS,EACd,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,IAAI,CAAC,CAIf;IAED;;;;OAIG;IACU,WAAW,CACtB,WAAW,EAAE,kBAAkB,EAC/B,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,YAAY,CAAC,CAsBvB;IAED;;;OAGG;IACH,UAAgB,eAAe,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,EAC7D,GAAG,EAAE,eAAe,EACpB,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC,GAChD,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAmDnC;IAED,UAAgB,gBAAgB,CAC9B,GAAG,EAAE,eAAe,EACpB,IAAI,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE;;;;;;OA4C1B;CACF;AAKD,wBAAgB,aAAa,CAC3B,IAAI,EAAE,YAAY,GAAG,WAAW,GAAG,gBAAgB,GAAG,qBAAqB,EAC3E,GAAG,EAAE,MAAM,GACV,OAAO,CAQT;AAmDD,eAAO,MAAM,kBAAkB,QAAS,eAAe,kBAGtD,CAAA;AAoBD,OAAO,EAAE,KAAK,SAAS,EAAE,CAAA;AAEzB,eAAO,MAAM,qBAAqB,WAAY,MAAM,KAAG,SAEtD,CAAA;AAED,eAAO,MAAM,qBAAqB,iBAAkB,MAAM,KAAG,SAa5D,CAAA"}

package/dist/auth-verifier.js CHANGED Viewed

@@ -430,6 +430,7 @@ const parseBasicAuth = (req) => {
         return null;
     }
 };
+export {};
 export const createSecretKeyObject = (secret) => {
     return createSecretKey(Buffer.from(secret));
 };