@atproto/xrpc-server 0.11.4 → 0.11.6

package/tests/_util.ts

@@ -1,124 +0,0 @@
-import { once } from 'node:events'
-import * as http from 'node:http'
-import express from 'express'
-import {
-  LexiconDocument,
-  LexiconIterableIndexer,
-  LexiconSchemaBuilder,
-} from '@atproto/lex-document'
-import { LexiconDoc } from '@atproto/lexicon'
-import {
-  AuthRequiredError,
-  MethodConfigOrHandler,
-  Options,
-  Server,
-  StreamConfigOrHandler,
-} from '../src/index.js'
-
-// @ts-expect-error
-Symbol.asyncDispose ??= Symbol.for('nodejs.asyncDispose')
-
-export async function createServer({ router }: Server): Promise<http.Server> {
-  const app = express()
-  app.use(router)
-  const httpServer = app.listen(0)
-  await once(httpServer, 'listening')
-  // @NOTE Types define `http.Server` as `AsyncDisposable`, but not all
-  // environments seem to support it.
-  if (!(Symbol.asyncDispose in httpServer)) {
-    Object.defineProperty(httpServer, Symbol.asyncDispose, {
-      value: async function (this: http.Server) {
-        return closeServer(this)
-      },
-    })
-  }
-  return httpServer
-}
-
-export async function closeServer(httpServer: http.Server) {
-  await new Promise((r) => {
-    httpServer.close(() => r(undefined))
-  })
-}
-
-export function createBasicAuth(allowed: {
-  username: string
-  password: string
-}) {
-  return function (ctx: { req: http.IncomingMessage }) {
-    const header = ctx.req.headers.authorization ?? ''
-    if (!header.startsWith('Basic ')) {
-      throw new AuthRequiredError()
-    }
-    const original = header.replace('Basic ', '')
-    const [username, password] = Buffer.from(original, 'base64')
-      .toString()
-      .split(':')
-    if (username !== allowed.username || password !== allowed.password) {
-      throw new AuthRequiredError()
-    }
-    return {
-      credentials: { username },
-      artifacts: { original },
-    }
-  }
-}
-
-export function basicAuthHeaders(creds: {
-  username: string
-  password: string
-}) {
-  return {
-    authorization:
-      'Basic ' +
-      Buffer.from(`${creds.username}:${creds.password}`).toString('base64'),
-  }
-}
-
-/**
- * Builds a lexicon server based on an `@atproto/lexicon`
- * {@link import('@atproto/lexicon').Lexicons} instance. Validation will be
- * performed by {@link import('@atproto/lexicon').Lexicons}'s various assertion
- * methods. This allows for testing the server's integration with
- * `@atproto/lexicon`.
- */
-export async function buildMethodLexicons(
-  lexicons: LexiconDoc[],
-  handlers: Record<string, MethodConfigOrHandler | StreamConfigOrHandler>,
-  options?: Options,
-) {
-  const server = new Server(structuredClone(lexicons), options)
-  for (const [id, handler] of Object.entries(handlers)) {
-    const def = server.lex.getDef(id)
-    if (def?.type === 'subscription') {
-      server.addStreamMethod(id, handler as StreamConfigOrHandler)
-    } else {
-      server.method(id, handler as MethodConfigOrHandler)
-    }
-  }
-  return server
-}
-
-/**
- * Builds a lexicon server based on `@atproto/lex`'s
- * {@link import('@atproto/lex').Query},
- * {@link import('@atproto/lex').Procedure}, and
- * {@link import('@atproto/lex').Subscription} method definitions. Validation
- * will be performed through built schema verifiers created by
- * {@link LexiconSchemaBuilder}. This helper allows for testing the server's
- * integration with `@atproto/lex`.
- */
-export async function buildAddLexicons(
-  lexicons: LexiconDocument[],
-  handlers: Record<string, MethodConfigOrHandler | StreamConfigOrHandler>,
-  options?: Options,
-) {
-  const server = new Server(undefined, options)
-  await using indexer = new LexiconIterableIndexer(structuredClone(lexicons))
-  await using builder = new LexiconSchemaBuilder(indexer)
-  for (const [id, handler] of Object.entries(handlers)) {
-    const schema = await builder.buildFullRef(`${id}#main`)
-    server.add(schema as any, handler as any)
-  }
-  return server
-}

package/tests/auth.test.ts

@@ -1,333 +0,0 @@
-import { KeyObject, createPrivateKey } from 'node:crypto'
-import * as http from 'node:http'
-import { AddressInfo } from 'node:net'
-import * as jose from 'jose'
-import KeyEncoderModule from 'key-encoder'
-import { MINUTE } from '@atproto/common'
-import { Secp256k1Keypair } from '@atproto/crypto'
-import { LexiconDoc } from '@atproto/lexicon'
-import { XRPCError, XrpcClient } from '@atproto/xrpc'
-import * as xrpcServer from '../src/index.js'
-import {
-  basicAuthHeaders,
-  closeServer,
-  createBasicAuth,
-  createServer,
-} from './_util.js'
-
-// key-encoder is CJS with exports.default; Node ESM interop wraps it as { default: Class }
-const KeyEncoder = ((m) => m.default ?? m)(KeyEncoderModule)
-
-const LEXICONS: LexiconDoc[] = [
-  {
-    lexicon: 1,
-    id: 'io.example.authTest',
-    defs: {
-      main: {
-        type: 'procedure',
-        input: {
-          encoding: 'application/json',
-          schema: {
-            type: 'object',
-            properties: {
-              present: { type: 'boolean', const: true },
-            },
-          },
-        },
-        output: {
-          encoding: 'application/json',
-          schema: {
-            type: 'object',
-            properties: {
-              username: { type: 'string' },
-              original: { type: 'string' },
-            },
-          },
-        },
-      },
-    },
-  },
-]
-
-describe('Auth', () => {
-  let s: http.Server
-  const server = xrpcServer.createServer(LEXICONS)
-  server.method('io.example.authTest', {
-    auth: createBasicAuth({ username: 'admin', password: 'password' }),
-    handler: ({ auth }) => {
-      return {
-        encoding: 'application/json',
-        body: {
-          username: auth.credentials.username,
-          original: auth.artifacts.original,
-        },
-      }
-    },
-  })
-
-  let client: XrpcClient
-  beforeAll(async () => {
-    s = await createServer(server)
-    const { port } = s.address() as AddressInfo
-    client = new XrpcClient(`http://localhost:${port}`, LEXICONS)
-  })
-
-  afterAll(async () => {
-    await closeServer(s)
-  })
-
-  it('creates and validates service auth headers', async () => {
-    const keypair = await Secp256k1Keypair.create()
-    const iss = 'did:example:alice'
-    const aud = 'did:example:bob'
-    const token = await xrpcServer.createServiceJwt({
-      iss,
-      aud,
-      keypair,
-      lxm: null,
-    })
-    const validated = await xrpcServer.verifyJwt(token, null, null, async () =>
-      keypair.did(),
-    )
-    expect(validated.iss).toEqual(iss)
-    expect(validated.aud).toEqual(aud)
-    // should expire within the minute when no exp is provided
-    expect(validated.exp).toBeGreaterThan(Date.now() / 1000)
-    expect(validated.exp).toBeLessThan(Date.now() / 1000 + 60)
-    expect(typeof validated.jti).toBe('string')
-    expect(validated.lxm).toBeUndefined()
-  })
-
-  it('creates and validates service auth headers bound to a particular method', async () => {
-    const keypair = await Secp256k1Keypair.create()
-    const iss = 'did:example:alice'
-    const aud = 'did:example:bob'
-    const lxm = 'com.atproto.repo.createRecord'
-    const token = await xrpcServer.createServiceJwt({
-      iss,
-      aud,
-      keypair,
-      lxm,
-    })
-    const validated = await xrpcServer.verifyJwt(token, null, lxm, async () =>
-      keypair.did(),
-    )
-    expect(validated.iss).toEqual(iss)
-    expect(validated.aud).toEqual(aud)
-    expect(validated.lxm).toEqual(lxm)
-  })
-
-  it('fails on bad auth before invalid request payload.', async () => {
-    try {
-      await client.call(
-        'io.example.authTest',
-        {},
-        { present: false },
-        {
-          headers: basicAuthHeaders({
-            username: 'admin',
-            password: 'wrong',
-          }),
-        },
-      )
-      throw new Error('Didnt throw')
-    } catch (e: any) {
-      expect(e).toBeInstanceOf(XRPCError)
-      expect(e.success).toBeFalsy()
-      expect(e.error).toBe('AuthenticationRequired')
-      expect(e.message).toBe('Authentication Required')
-      expect(e.status).toBe(401)
-    }
-  })
-
-  it('fails on invalid request payload after good auth.', async () => {
-    try {
-      await client.call(
-        'io.example.authTest',
-        {},
-        { present: false },
-        {
-          headers: basicAuthHeaders({
-            username: 'admin',
-            password: 'password',
-          }),
-        },
-      )
-      throw new Error('Didnt throw')
-    } catch (e: any) {
-      expect(e).toBeInstanceOf(XRPCError)
-      expect(e.success).toBeFalsy()
-      expect(e.error).toBe('InvalidRequest')
-      expect(e.message).toBe('Input/present must be true')
-      expect(e.status).toBe(400)
-    }
-  })
-
-  it('succeeds on good auth and payload.', async () => {
-    const res = await client.call(
-      'io.example.authTest',
-      {},
-      { present: true },
-      {
-        headers: basicAuthHeaders({
-          username: 'admin',
-          password: 'password',
-        }),
-      },
-    )
-    expect(res.success).toBe(true)
-    expect(res.data).toEqual({
-      username: 'admin',
-      original: 'YWRtaW46cGFzc3dvcmQ=',
-    })
-  })
-
-  describe('verifyJwt()', () => {
-    it('fails on expired jwt.', async () => {
-      const keypair = await Secp256k1Keypair.create()
-      const jwt = await xrpcServer.createServiceJwt({
-        aud: 'did:example:aud',
-        iss: 'did:example:iss',
-        keypair,
-        exp: Math.floor((Date.now() - MINUTE) / 1000),
-        lxm: null,
-      })
-      const tryVerify = xrpcServer.verifyJwt(
-        jwt,
-        'did:example:aud',
-        null,
-        async () => {
-          return keypair.did()
-        },
-      )
-      await expect(tryVerify).rejects.toThrow('jwt expired')
-    })
-
-    it('fails on bad audience.', async () => {
-      const keypair = await Secp256k1Keypair.create()
-      const jwt = await xrpcServer.createServiceJwt({
-        aud: 'did:example:aud1',
-        iss: 'did:example:iss',
-        keypair,
-        lxm: null,
-      })
-      const tryVerify = xrpcServer.verifyJwt(
-        jwt,
-        'did:example:aud2',
-        null,
-        async () => {
-          return keypair.did()
-        },
-      )
-      await expect(tryVerify).rejects.toThrow(
-        'jwt audience does not match service did',
-      )
-    })
-
-    it('fails on bad lxm', async () => {
-      const keypair = await Secp256k1Keypair.create()
-      const jwt = await xrpcServer.createServiceJwt({
-        aud: 'did:example:aud1',
-        iss: 'did:example:iss',
-        keypair,
-        lxm: 'com.atproto.repo.createRecord',
-      })
-      const tryVerify = xrpcServer.verifyJwt(
-        jwt,
-        'did:example:aud1',
-        'com.atproto.repo.putRecord',
-        async () => {
-          return keypair.did()
-        },
-      )
-      await expect(tryVerify).rejects.toThrow(/bad jwt lexicon method/)
-    })
-
-    it('fails on null lxm when lxm is required', async () => {
-      const keypair = await Secp256k1Keypair.create()
-      const jwt = await xrpcServer.createServiceJwt({
-        aud: 'did:example:aud1',
-        iss: 'did:example:iss',
-        keypair,
-        lxm: null,
-      })
-      const tryVerify = xrpcServer.verifyJwt(
-        jwt,
-        'did:example:aud1',
-        'com.atproto.repo.putRecord',
-        async () => {
-          return keypair.did()
-        },
-      )
-      await expect(tryVerify).rejects.toThrow(/missing jwt lexicon method/)
-    })
-
-    it('refreshes key on verification failure.', async () => {
-      const keypair1 = await Secp256k1Keypair.create()
-      const keypair2 = await Secp256k1Keypair.create()
-      const jwt = await xrpcServer.createServiceJwt({
-        aud: 'did:example:aud',
-        iss: 'did:example:iss',
-        keypair: keypair2,
-        lxm: null,
-      })
-      let usedKeypair1 = false
-      let usedKeypair2 = false
-      const tryVerify = xrpcServer.verifyJwt(
-        jwt,
-        'did:example:aud',
-        null,
-        async (_did, forceRefresh) => {
-          if (forceRefresh) {
-            usedKeypair2 = true
-            return keypair2.did()
-          } else {
-            usedKeypair1 = true
-            return keypair1.did()
-          }
-        },
-      )
-      await expect(tryVerify).resolves.toMatchObject({
-        aud: 'did:example:aud',
-        iss: 'did:example:iss',
-      })
-      expect(usedKeypair1).toBe(true)
-      expect(usedKeypair2).toBe(true)
-    })
-
-    it('interoperates with jwts signed by other libraries.', async () => {
-      const keypair = await Secp256k1Keypair.create({ exportable: true })
-      const signingKey = await createPrivateKeyObject(keypair)
-      const payload = {
-        aud: 'did:example:aud',
-        iss: 'did:example:iss',
-        exp: Math.floor((Date.now() + MINUTE) / 1000),
-      }
-      const jwt = await new jose.SignJWT(payload)
-        .setProtectedHeader({ typ: 'JWT', alg: keypair.jwtAlg })
-        .sign(signingKey)
-      const tryVerify = xrpcServer.verifyJwt(
-        jwt,
-        'did:example:aud',
-        null,
-        async () => {
-          return keypair.did()
-        },
-      )
-      await expect(tryVerify).resolves.toEqual(payload)
-    })
-  })
-})
-
-const createPrivateKeyObject = async (
-  privateKey: Secp256k1Keypair,
-): Promise<KeyObject> => {
-  const raw = await privateKey.export()
-  const encoder = new KeyEncoder('secp256k1')
-  const key = encoder.encodePrivate(
-    Buffer.from(raw).toString('hex'),
-    'raw',
-    'pem',
-  )
-  return createPrivateKey({ format: 'pem', key })
-}