@atproto/xrpc-server 0.11.5 → 0.11.6

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # @atproto/xrpc-server
 
+## 0.11.6
+
+### Patch Changes
+
+- [#5099](https://github.com/bluesky-social/atproto/pull/5099) [`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Update TypeScript build to rely on references to composite internal projects
+
+- [#5099](https://github.com/bluesky-social/atproto/pull/5099) [`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Bundle only necessary files in the NPM tarball, including the `CHANGELOG.md` and `README.md` files (if present).
+
+- Updated dependencies [[`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07), [`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07), [`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07), [`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07)]:
+  - @atproto/lex-client@0.2.1
+  - @atproto/lex-schema@0.1.6
+  - @atproto/lex-cbor@0.1.3
+  - @atproto/lex-data@0.1.4
+  - @atproto/lex-json@0.1.3
+  - @atproto/ws-client@0.1.4
+  - @atproto/lexicon@0.7.4
+  - @atproto/common@0.6.5
+  - @atproto/crypto@0.5.3
+  - @atproto/xrpc@0.8.3
+
 ## 0.11.5
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atproto/xrpc-server",
-  "version": "0.11.5",
+  "version": "0.11.6",
   "license": "MIT",
   "description": "atproto HTTP API (XRPC) server library",
   "keywords": [
@@ -13,6 +13,18 @@
     "url": "https://github.com/bluesky-social/atproto",
     "directory": "packages/xrpc-server"
   },
+  "files": [
+    "./dist",
+    "./README.md",
+    "./CHANGELOG.md"
+  ],
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
   "engines": {
     "node": ">=22"
   },
@@ -22,16 +34,16 @@
     "mime-types": "^2.1.35",
     "rate-limiter-flexible": "^2.4.1",
     "ws": "^8.12.0",
-    "@atproto/common": "^0.6.4",
-    "@atproto/crypto": "^0.5.2",
-    "@atproto/lex-data": "^0.1.3",
-    "@atproto/lex-json": "^0.1.2",
-    "@atproto/lex-schema": "^0.1.5",
-    "@atproto/lex-client": "^0.2.0",
-    "@atproto/ws-client": "^0.1.3",
-    "@atproto/xrpc": "^0.8.2",
-    "@atproto/lexicon": "^0.7.3",
-    "@atproto/lex-cbor": "^0.1.2"
+    "@atproto/common": "^0.6.5",
+    "@atproto/lex-cbor": "^0.1.3",
+    "@atproto/crypto": "^0.5.3",
+    "@atproto/lex-data": "^0.1.4",
+    "@atproto/lex-client": "^0.2.1",
+    "@atproto/lex-schema": "^0.1.6",
+    "@atproto/lexicon": "^0.7.4",
+    "@atproto/lex-json": "^0.1.3",
+    "@atproto/xrpc": "^0.8.3",
+    "@atproto/ws-client": "^0.1.4"
   },
   "devDependencies": {
     "@jest/globals": "^30.0.0",
@@ -45,16 +57,9 @@
     "jose": "^5.0.1",
     "key-encoder": "^2.0.3",
     "multiformats": "^13.0.0",
-    "@atproto/crypto": "^0.5.2",
-    "@atproto/lex": "^0.1.6",
-    "@atproto/lex-document": "^0.1.2"
-  },
-  "type": "module",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "default": "./dist/index.js"
-    }
+    "@atproto/crypto": "^0.5.3",
+    "@atproto/lex": "^0.1.7",
+    "@atproto/lex-document": "^0.1.3"
   },
   "scripts": {
     "test": "NODE_OPTIONS=--experimental-vm-modules jest",

package/jest.config.cjs

@@ -1,21 +0,0 @@
-/** @type {import('jest').Config} */
-module.exports = {
-  displayName: 'XRPC Server',
-  transform: {
-    '^.+\\.(t|j)s$': [
-      '@swc/jest',
-      {
-        jsc: {
-          parser: { syntax: 'typescript', importAttributes: true },
-          experimental: { keepImportAttributes: true },
-          transform: {},
-        },
-        module: { type: 'es6' },
-      },
-    ],
-  },
-  extensionsToTreatAsEsm: ['.ts'],
-  transformIgnorePatterns: [],
-  setupFiles: ['<rootDir>/../../test.setup.ts'],
-  moduleNameMapper: { '^(\\.\\.?\\/.+)\\.js$': ['$1.ts', '$1.js'] },
-}

package/src/auth.ts

@@ -1,235 +0,0 @@
-import * as common from '@atproto/common'
-import { MINUTE } from '@atproto/common'
-import * as crypto from '@atproto/crypto'
-import { DidString, isDidString } from '@atproto/lex-schema'
-import { AuthRequiredError } from './errors.js'
-
-type ServiceJwtParams = {
-  iss: string
-  aud: string
-  iat?: number
-  exp?: number
-  lxm: string | null
-  keypair: crypto.Keypair
-}
-
-type ServiceJwtHeaders = {
-  alg: string
-} & Record<string, unknown>
-
-type ServiceJwtPayload = {
-  iss: DidString | `${DidString}#${string}`
-  aud: string
-  exp: number
-  lxm?: string
-  jti?: string
-}
-
-export const createServiceJwt = async (
-  params: ServiceJwtParams,
-): Promise<string> => {
-  const { iss, aud, keypair } = params
-  const iat = params.iat ?? Math.floor(Date.now() / 1e3)
-  const exp = params.exp ?? iat + MINUTE / 1e3
-  const lxm = params.lxm ?? undefined
-  const jti = await crypto.randomStr(16, 'hex')
-  const header = {
-    typ: 'JWT',
-    alg: keypair.jwtAlg,
-  }
-  const payload = common.noUndefinedVals({
-    iat,
-    iss,
-    aud,
-    exp,
-    lxm,
-    jti,
-  })
-  const toSignStr = `${jsonToB64Url(header)}.${jsonToB64Url(payload)}`
-  const toSign = Buffer.from(toSignStr, 'utf8')
-  const sig = Buffer.from(await keypair.sign(toSign))
-  return `${toSignStr}.${sig.toString('base64url')}`
-}
-
-export const createServiceAuthHeaders = async (params: ServiceJwtParams) => {
-  const jwt = await createServiceJwt(params)
-  return {
-    headers: { authorization: `Bearer ${jwt}` },
-  }
-}
-
-const jsonToB64Url = (json: Record<string, unknown>): string => {
-  return Buffer.from(JSON.stringify(json)).toString('base64url')
-}
-
-export type VerifySignatureWithKeyFn = (
-  key: string,
-  msgBytes: Uint8Array,
-  sigBytes: Uint8Array,
-  alg: string,
-) => Promise<boolean>
-
-export const verifyJwt = async (
-  jwtStr: string,
-  ownDid: string | null, // null indicates to skip the audience check
-  lxm: string | null, // null indicates to skip the lxm check
-  getSigningKey: (
-    iss: DidString | `${DidString}#${string}`,
-    forceRefresh: boolean,
-  ) => Promise<string>,
-  verifySignatureWithKey: VerifySignatureWithKeyFn = cryptoVerifySignatureWithKey,
-): Promise<ServiceJwtPayload> => {
-  const parts = jwtStr.split('.')
-  if (parts.length !== 3) {
-    throw new AuthRequiredError('poorly formatted jwt', 'BadJwt')
-  }
-
-  const header = parseHeader(parts[0])
-
-  // The spec does not describe what to do with the "typ" claim. We can,
-  // however, forbid some values that are not compatible with our use case.
-  if (
-    // service tokens are not OAuth 2.0 access tokens
-    // https://datatracker.ietf.org/doc/html/rfc9068
-    header['typ'] === 'at+jwt' ||
-    // "refresh+jwt" is a non-standard type used by the @atproto packages
-    header['typ'] === 'refresh+jwt' ||
-    // "DPoP" proofs are not meant to be used as service tokens
-    // https://datatracker.ietf.org/doc/html/rfc9449
-    header['typ'] === 'dpop+jwt'
-  ) {
-    throw new AuthRequiredError(
-      `Invalid jwt type "${header['typ']}"`,
-      'BadJwtType',
-    )
-  }
-
-  const payload = parsePayload(parts[1])
-  const sig = parts[2]
-
-  if (Date.now() / 1000 > payload.exp) {
-    throw new AuthRequiredError('jwt expired', 'JwtExpired')
-  }
-  if (ownDid !== null && payload.aud !== ownDid) {
-    throw new AuthRequiredError(
-      'jwt audience does not match service did',
-      'BadJwtAudience',
-    )
-  }
-  if (lxm !== null && payload.lxm !== lxm) {
-    throw new AuthRequiredError(
-      payload.lxm !== undefined
-        ? `bad jwt lexicon method ("lxm"). must match: ${lxm}`
-        : `missing jwt lexicon method ("lxm"). must match: ${lxm}`,
-      'BadJwtLexiconMethod',
-    )
-  }
-  if (!payload.iss || !isDidStringOrService(payload.iss)) {
-    throw new AuthRequiredError('jwt iss is not a valid did', 'BadJwtIss')
-  }
-
-  const msgBytes = Buffer.from(parts.slice(0, 2).join('.'), 'utf8')
-  const sigBytes = Buffer.from(sig, 'base64url')
-
-  const signingKey = await getSigningKey(payload.iss, false)
-  const { alg } = header
-
-  let validSig: boolean
-  try {
-    validSig = await verifySignatureWithKey(signingKey, msgBytes, sigBytes, alg)
-  } catch (err) {
-    throw new AuthRequiredError(
-      'could not verify jwt signature',
-      'BadJwtSignature',
-    )
-  }
-
-  if (!validSig) {
-    // get fresh signing key in case it failed due to a recent rotation
-    const freshSigningKey = await getSigningKey(payload.iss, true)
-    try {
-      validSig =
-        freshSigningKey !== signingKey
-          ? await verifySignatureWithKey(
-              freshSigningKey,
-              msgBytes,
-              sigBytes,
-              alg,
-            )
-          : false
-    } catch (err) {
-      throw new AuthRequiredError(
-        'could not verify jwt signature',
-        'BadJwtSignature',
-      )
-    }
-  }
-
-  if (!validSig) {
-    throw new AuthRequiredError(
-      'jwt signature does not match jwt issuer',
-      'BadJwtSignature',
-    )
-  }
-
-  return payload
-}
-
-export const cryptoVerifySignatureWithKey: VerifySignatureWithKeyFn = async (
-  key: string,
-  msgBytes: Uint8Array,
-  sigBytes: Uint8Array,
-  alg: string,
-) => {
-  return crypto.verifySignature(key, msgBytes, sigBytes, {
-    jwtAlg: alg,
-    allowMalleableSig: true,
-  })
-}
-
-const parseB64UrlToJson = (b64: string) => {
-  return JSON.parse(Buffer.from(b64, 'base64url').toString('utf8'))
-}
-
-const parseHeader = (b64: string): ServiceJwtHeaders => {
-  const header = parseB64UrlToJson(b64)
-  if (!header || typeof header !== 'object' || typeof header.alg !== 'string') {
-    throw new AuthRequiredError('poorly formatted jwt', 'BadJwt')
-  }
-  return header
-}
-
-const parsePayload = (b64: string): ServiceJwtPayload => {
-  const payload = parseB64UrlToJson(b64)
-  if (
-    !payload ||
-    typeof payload !== 'object' ||
-    typeof payload.iss !== 'string' ||
-    typeof payload.aud !== 'string' ||
-    typeof payload.exp !== 'number' ||
-    (payload.lxm && typeof payload.lxm !== 'string') ||
-    (payload.nonce && typeof payload.nonce !== 'string')
-  ) {
-    throw new AuthRequiredError('poorly formatted jwt', 'BadJwt')
-  }
-  return payload
-}
-
-function isDidStringOrService(
-  value: string,
-): value is DidString | `${DidString}#${string}` {
-  const hashIdx = value.indexOf('#')
-  if (hashIdx === -1) {
-    return isDidString(value)
-  }
-
-  // basic validation of the fragment part
-  const fragmentLen = value.length - hashIdx - 1
-  if (fragmentLen < 1 || value.includes('#', hashIdx + 1)) {
-    return false
-  }
-
-  // Validate the did part
-  const didPart = value.slice(0, hashIdx)
-  return isDidString(didPart)
-}

package/src/errors.ts

@@ -1,312 +0,0 @@
-// eslint-disable-next-line import/default, import/no-named-as-default-member
-import httpErrors from 'http-errors'
-// eslint-disable-next-line import/no-named-as-default-member
-const { isHttpError } = httpErrors
-import { LexError, XrpcError } from '@atproto/lex-client'
-import { l } from '@atproto/lex-schema'
-import {
-  ResponseType,
-  ResponseTypeStrings,
-  XRPCError as XRPCClientError,
-  httpResponseCodeToName,
-  httpResponseCodeToString,
-} from '@atproto/xrpc'
-
-// @NOTE Do not depend (directly or indirectly) on "./types" here, as it would
-// create a circular dependency.
-
-export const errorResult = l.object({
-  status: l.integer({ minimum: 400 }),
-  error: l.optional(l.string()),
-  message: l.optional(l.string()),
-})
-export type ErrorResult = l.Infer<typeof errorResult>
-
-export function isErrorResult(v: unknown): v is ErrorResult {
-  return errorResult.safeParse(v).success
-}
-
-export function excludeErrorResult<V>(v: V) {
-  if (isErrorResult(v)) throw XRPCError.fromErrorResult(v)
-  return v as Exclude<V, ErrorResult>
-}
-
-export { ResponseType }
-
-export class XRPCError extends Error {
-  constructor(
-    public type: ResponseType,
-    public errorMessage?: string,
-    public customErrorName?: string,
-    options?: ErrorOptions,
-  ) {
-    super(errorMessage, options)
-  }
-
-  get statusCode(): number {
-    const { type } = this
-
-    // Fool-proofing. `new XRPCError(123.5 as number, '')` does not generate a TypeScript error.
-    // Because of this, we can end-up with any numeric value instead of an actual `ResponseType`.
-    // For legacy reasons, the `type` argument is not checked in the constructor, so we check it here.
-    if (type < 400 || type >= 600 || !Number.isFinite(type)) {
-      return 500
-    }
-
-    return type
-  }
-
-  get error(): string | undefined {
-    return this.customErrorName ?? this.typeName
-  }
-
-  get payload() {
-    return {
-      error: this.error,
-      message:
-        this.type === ResponseType.InternalServerError
-          ? this.typeStr // Do not respond with error details for 500s
-          : this.errorMessage || this.typeStr,
-    }
-  }
-
-  get typeName(): string | undefined {
-    return ResponseType[this.type]
-  }
-
-  get typeStr(): string | undefined {
-    return ResponseTypeStrings[this.type]
-  }
-
-  static fromError(cause: unknown): XRPCError {
-    if (cause instanceof XRPCError) {
-      return cause
-    }
-
-    if (cause instanceof XRPCClientError) {
-      const { error, message, type } = mapFromClientError(cause)
-      return new XRPCError(type, message, error, { cause })
-    }
-
-    if (cause instanceof XrpcError) {
-      const { status, body } = cause.toDownstreamError()
-      return new XRPCError(status, body.message, body.error, { cause })
-    }
-
-    if (cause instanceof LexError) {
-      const data = cause.toJSON()
-      const type = ResponseType.InternalServerError
-      return new XRPCError(type, data.message, data.error, { cause })
-    }
-
-    if (isHttpError(cause)) {
-      return new XRPCError(cause.status, cause.message, cause.name, { cause })
-    }
-
-    if (isErrorResult(cause)) {
-      return this.fromErrorResult(cause)
-    }
-
-    if (cause instanceof Error) {
-      return new InternalServerError(cause.message, undefined, { cause })
-    }
-
-    return new InternalServerError(
-      'Unexpected internal server error',
-      undefined,
-      { cause },
-    )
-  }
-
-  static fromErrorResult(err: ErrorResult): XRPCError {
-    return new XRPCError(err.status, err.message, err.error, { cause: err })
-  }
-}
-
-export class InvalidRequestError extends XRPCError {
-  constructor(
-    errorMessage?: string,
-    customErrorName?: string,
-    options?: ErrorOptions,
-  ) {
-    super(ResponseType.InvalidRequest, errorMessage, customErrorName, options)
-  }
-
-  [Symbol.hasInstance](instance: unknown): boolean {
-    return (
-      instance instanceof XRPCError &&
-      instance.type === ResponseType.InvalidRequest
-    )
-  }
-}
-
-export class AuthRequiredError extends XRPCError {
-  constructor(
-    errorMessage?: string,
-    customErrorName?: string,
-    options?: ErrorOptions,
-  ) {
-    super(
-      ResponseType.AuthenticationRequired,
-      errorMessage,
-      customErrorName,
-      options,
-    )
-  }
-
-  [Symbol.hasInstance](instance: unknown): boolean {
-    return (
-      instance instanceof XRPCError &&
-      instance.type === ResponseType.AuthenticationRequired
-    )
-  }
-}
-
-export class ForbiddenError extends XRPCError {
-  constructor(
-    errorMessage?: string,
-    customErrorName?: string,
-    options?: ErrorOptions,
-  ) {
-    super(ResponseType.Forbidden, errorMessage, customErrorName, options)
-  }
-
-  [Symbol.hasInstance](instance: unknown): boolean {
-    return (
-      instance instanceof XRPCError && instance.type === ResponseType.Forbidden
-    )
-  }
-}
-
-export class InternalServerError extends XRPCError {
-  constructor(
-    errorMessage?: string,
-    customErrorName?: string,
-    options?: ErrorOptions,
-  ) {
-    super(
-      ResponseType.InternalServerError,
-      errorMessage,
-      customErrorName,
-      options,
-    )
-  }
-
-  [Symbol.hasInstance](instance: unknown): boolean {
-    return (
-      instance instanceof XRPCError &&
-      instance.type === ResponseType.InternalServerError
-    )
-  }
-}
-
-export class UpstreamFailureError extends XRPCError {
-  constructor(
-    errorMessage?: string,
-    customErrorName?: string,
-    options?: ErrorOptions,
-  ) {
-    super(ResponseType.UpstreamFailure, errorMessage, customErrorName, options)
-  }
-
-  [Symbol.hasInstance](instance: unknown): boolean {
-    return (
-      instance instanceof XRPCError &&
-      instance.type === ResponseType.UpstreamFailure
-    )
-  }
-}
-
-export class NotEnoughResourcesError extends XRPCError {
-  constructor(
-    errorMessage?: string,
-    customErrorName?: string,
-    options?: ErrorOptions,
-  ) {
-    super(
-      ResponseType.NotEnoughResources,
-      errorMessage,
-      customErrorName,
-      options,
-    )
-  }
-
-  [Symbol.hasInstance](instance: unknown): boolean {
-    return (
-      instance instanceof XRPCError &&
-      instance.type === ResponseType.NotEnoughResources
-    )
-  }
-}
-
-export class UpstreamTimeoutError extends XRPCError {
-  constructor(
-    errorMessage?: string,
-    customErrorName?: string,
-    options?: ErrorOptions,
-  ) {
-    super(ResponseType.UpstreamTimeout, errorMessage, customErrorName, options)
-  }
-
-  [Symbol.hasInstance](instance: unknown): boolean {
-    return (
-      instance instanceof XRPCError &&
-      instance.type === ResponseType.UpstreamTimeout
-    )
-  }
-}
-
-export class MethodNotImplementedError extends XRPCError {
-  constructor(
-    errorMessage?: string,
-    customErrorName?: string,
-    options?: ErrorOptions,
-  ) {
-    super(
-      ResponseType.MethodNotImplemented,
-      errorMessage,
-      customErrorName,
-      options,
-    )
-  }
-
-  [Symbol.hasInstance](instance: unknown): boolean {
-    return (
-      instance instanceof XRPCError &&
-      instance.type === ResponseType.MethodNotImplemented
-    )
-  }
-}
-
-/**
- * Converts an upstream XRPC {@link ResponseType} into a downstream {@link ResponseType}.
- */
-function mapFromClientError(error: XRPCClientError): {
-  error: string
-  message: string
-  type: ResponseType
-} {
-  switch (error.status) {
-    case ResponseType.InvalidResponse:
-      // Upstream server returned an XRPC response that is not compatible with our internal lexicon definitions for that XRPC method.
-      // @NOTE This could be reflected as both a 500 ("we" are at fault) and 502 ("they" are at fault). Let's be gents about it.
-      return {
-        error: httpResponseCodeToName(ResponseType.InternalServerError),
-        message: httpResponseCodeToString(ResponseType.InternalServerError),
-        type: ResponseType.InternalServerError,
-      }
-    case ResponseType.Unknown:
-      // Typically a network error / unknown host
-      return {
-        error: httpResponseCodeToName(ResponseType.InternalServerError),
-        message: httpResponseCodeToString(ResponseType.InternalServerError),
-        type: ResponseType.InternalServerError,
-      }
-    default:
-      return {
-        error: error.error,
-        message: error.message,
-        type: error.status,
-      }
-  }
-}

package/src/index.ts

@@ -1,14 +0,0 @@
-export * from './auth.js'
-export * from './errors.js'
-export * from './rate-limiter.js'
-export * from './server.js'
-export * from './stream/index.js'
-export * from './types.js'
-
-export {
-  ServerTimer,
-  parseReqEncoding,
-  parseReqNsid,
-  serverTimingHeader,
-} from './util.js'
-export type { ServerTiming } from './util.js'

package/src/logger.ts

@@ -1,8 +0,0 @@
-import { subsystemLogger } from '@atproto/common'
-
-export const LOGGER_NAME = 'xrpc-server'
-
-export const logger: ReturnType<typeof subsystemLogger> =
-  subsystemLogger(LOGGER_NAME)
-
-export default logger