@atproto/xrpc-server 0.3.2 → 0.4.0

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # @atproto/xrpc-server
 
+## 0.4.0
+
+### Minor Changes
+
+- [#1801](https://github.com/bluesky-social/atproto/pull/1801) [`ce49743d`](https://github.com/bluesky-social/atproto/commit/ce49743d7f8800d33116b88001d7b512553c2c89) Thanks [@gaearon](https://github.com/gaearon)! - Methods that accepts lexicons now take `LexiconDoc` type instead of `unknown`
+
+### Patch Changes
+
+- [#1788](https://github.com/bluesky-social/atproto/pull/1788) [`84e2d4d2`](https://github.com/bluesky-social/atproto/commit/84e2d4d2b6694f344d80c18672c78b650189d423) Thanks [@bnewbold](https://github.com/bnewbold)! - update license to "MIT or Apache2"
+
+- Updated dependencies [[`ce49743d`](https://github.com/bluesky-social/atproto/commit/ce49743d7f8800d33116b88001d7b512553c2c89), [`84e2d4d2`](https://github.com/bluesky-social/atproto/commit/84e2d4d2b6694f344d80c18672c78b650189d423)]:
+  - @atproto/lexicon@0.3.0
+  - @atproto/common@0.3.3
+  - @atproto/crypto@0.2.3
+
+## 0.3.3
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @atproto/common@0.3.2
+  - @atproto/lexicon@0.2.3
+
 ## 0.3.2
 
 ### Patch Changes

package/LICENSE.txt

@@ -0,0 +1,7 @@
+Dual MIT/Apache-2.0 License
+
+Copyright (c) 2022-2023 Bluesky PBC, and Contributors
+
+Except as otherwise noted in individual files, this software is licensed under the MIT license (<http://opensource.org/licenses/MIT>), or the Apache License, Version 2.0 (<http://www.apache.org/licenses/LICENSE-2.0>).
+
+Downstream projects and end users may chose either license individually, or both together, at their discretion. The motivation for this dual-licensing is the additional software patent assurance provided by Apache 2.0.

package/README.md

@@ -8,11 +8,11 @@ TypeScript library for implementing [atproto](https://atproto.com) HTTP API serv
 ## Usage
 
 ```typescript
+import { LexiconDoc } from '@atproto/lexicon'
 import * as xrpc from '@atproto/xrpc-server'
 import express from 'express'
 
-// create xrpc server
-const server = xrpc.createServer([
+const lexicons: LexiconDoc[] = [
   {
     lexicon: 1,
     id: 'io.example.ping',
@@ -29,7 +29,10 @@ const server = xrpc.createServer([
       },
     },
   },
-])
+]
+
+// create xrpc server
+const server = xrpc.createServer(lexicons)
 
 function ping(ctx: {
   auth: xrpc.HandlerAuth | undefined
@@ -51,4 +54,9 @@ app.listen(8080)
 
 ## License
 
-MIT
+This project is dual-licensed under MIT and Apache 2.0 terms:
+
+- MIT license ([LICENSE-MIT.txt](https://github.com/bluesky-social/atproto/blob/main/LICENSE-MIT.txt) or http://opensource.org/licenses/MIT)
+- Apache License, Version 2.0, ([LICENSE-APACHE.txt](https://github.com/bluesky-social/atproto/blob/main/LICENSE-APACHE.txt) or http://www.apache.org/licenses/LICENSE-2.0)
+
+Downstream projects and end users may chose either license individually, or both together, at their discretion. The motivation for this dual-licensing is the additional software patent assurance provided by Apache 2.0.

package/dist/auth.d.ts

@@ -1,8 +1,10 @@
 import * as crypto from '@atproto/crypto';
-declare type ServiceJwtParams = {
+declare type ServiceJwtPayload = {
     iss: string;
     aud: string;
     exp?: number;
+};
+declare type ServiceJwtParams = ServiceJwtPayload & {
     keypair: crypto.Keypair;
 };
 export declare const createServiceJwt: (params: ServiceJwtParams) => Promise<string>;
@@ -11,5 +13,5 @@ export declare const createServiceAuthHeaders: (params: ServiceJwtParams) => Pro
         authorization: string;
     };
 }>;
-export declare const verifyJwt: (jwtStr: string, ownDid: string | null, getSigningKey: (did: string) => Promise<string>) => Promise<string>;
+export declare const verifyJwt: (jwtStr: string, ownDid: string | null, getSigningKey: (did: string, forceRefresh: boolean) => Promise<string>) => Promise<ServiceJwtPayload>;
 export {};

package/dist/index.js

@@ -44909,6 +44909,25 @@ var validateLanguage = (langTag) => {
 };
 var bcp47Regexp = /^((?<grandfathered>(en-GB-oed|i-ami|i-bnn|i-default|i-enochian|i-hak|i-klingon|i-lux|i-mingo|i-navajo|i-pwn|i-tao|i-tay|i-tsu|sgn-BE-FR|sgn-BE-NL|sgn-CH-DE)|(art-lojban|cel-gaulish|no-bok|no-nyn|zh-guoyu|zh-hakka|zh-min|zh-min-nan|zh-xiang))|((?<language>([A-Za-z]{2,3}(-(?<extlang>[A-Za-z]{3}(-[A-Za-z]{3}){0,2}))?)|[A-Za-z]{4}|[A-Za-z]{5,8})(-(?<script>[A-Za-z]{4}))?(-(?<region>[A-Za-z]{2}|[0-9]{3}))?(-(?<variant>[A-Za-z0-9]{5,8}|[0-9][A-Za-z0-9]{3}))*(-(?<extension>[0-9A-WY-Za-wy-z](-[A-Za-z0-9]{2,8})+))*(-(?<privateUseA>x(-[A-Za-z0-9]{1,8})+))?)|(?<privateUseB>x(-[A-Za-z0-9]{1,8})+))$/;
 
+// ../common-web/src/did-doc.ts
+var verificationMethod = z.object({
+  id: z.string(),
+  type: z.string(),
+  controller: z.string(),
+  publicKeyMultibase: z.string().optional()
+});
+var service = z.object({
+  id: z.string(),
+  type: z.string(),
+  serviceEndpoint: z.union([z.string(), z.record(z.unknown())])
+});
+var didDocument = z.object({
+  id: z.string(),
+  alsoKnownAs: z.array(z.string()).optional(),
+  verificationMethod: z.array(verificationMethod).optional(),
+  service: z.array(service).optional()
+});
+
 // ../lexicon/src/validators/formats.ts
 var import_iso_datestring_validator = __toESM(require_dist());
 function datetime(path, value) {
@@ -45754,15 +45773,6 @@ var discriminatedObject = z.object({ $type: z.string() });
 function isDiscriminatedObject(value) {
   return discriminatedObject.safeParse(value).success;
 }
-var LexiconDocMalformedError = class extends Error {
-  constructor(message, schemaDef, issues) {
-    super(message);
-    this.schemaDef = schemaDef;
-    this.issues = issues;
-    this.schemaDef = schemaDef;
-    this.issues = issues;
-  }
-};
 var ValidationError = class extends Error {
 };
 var InvalidLexiconError = class extends Error {
@@ -45843,23 +45853,13 @@ var Lexicons = class {
     }
   }
   add(doc) {
-    try {
-      lexiconDoc.parse(doc);
-    } catch (e) {
-      if (e instanceof ZodError) {
-        throw new LexiconDocMalformedError(`Failed to parse schema definition ${doc.id}`, doc, e.issues);
-      } else {
-        throw e;
-      }
-    }
-    const validatedDoc = doc;
-    const uri2 = toLexUri(validatedDoc.id);
+    const uri2 = toLexUri(doc.id);
     if (this.docs.has(uri2)) {
       throw new Error(`${uri2} has already been registered`);
     }
-    resolveRefUris(validatedDoc, uri2);
-    this.docs.set(uri2, validatedDoc);
-    for (const [defUri, def2] of iterDefs(validatedDoc)) {
+    resolveRefUris(doc, uri2);
+    this.docs.set(uri2, doc);
+    for (const [defUri, def2] of iterDefs(doc)) {
       this.defs.set(defUri, def2);
     }
   }
@@ -51917,16 +51917,18 @@ var decompressPubkey2 = (compressed) => {
 };
 
 // ../crypto/src/p256/operations.ts
-var verifyDidSig = async (did2, data, sig) => {
+var verifyDidSig = async (did2, data, sig, opts) => {
   const { jwtAlg, keyBytes } = parseDidKey(did2);
   if (jwtAlg !== P256_JWT_ALG) {
     throw new Error(`Not a P-256 did:key: ${did2}`);
   }
-  return verifySig(keyBytes, data, sig);
+  return verifySig(keyBytes, data, sig, opts);
 };
-var verifySig = async (publicKey, data, sig) => {
+var verifySig = async (publicKey, data, sig, opts) => {
   const msgHash = await sha2562(data);
-  return p256.verify(sig, msgHash, publicKey, { lowS: true });
+  return p256.verify(sig, msgHash, publicKey, {
+    lowS: opts?.lowS ?? true
+  });
 };
 
 // ../crypto/src/p256/plugin.ts
@@ -51938,16 +51940,18 @@ var p256Plugin = {
 var plugin_default = p256Plugin;
 
 // ../crypto/src/secp256k1/operations.ts
-var verifyDidSig2 = async (did2, data, sig) => {
+var verifyDidSig2 = async (did2, data, sig, opts) => {
   const { jwtAlg, keyBytes } = parseDidKey(did2);
   if (jwtAlg !== SECP256K1_JWT_ALG) {
     throw new Error(`Not a secp256k1 did:key: ${did2}`);
   }
-  return verifySig2(keyBytes, data, sig);
+  return verifySig2(keyBytes, data, sig, opts);
 };
-var verifySig2 = async (publicKey, data, sig) => {
+var verifySig2 = async (publicKey, data, sig, opts) => {
   const msgHash = await sha2562(data);
-  return secp256k1.verify(sig, msgHash, publicKey, { lowS: true });
+  return secp256k1.verify(sig, msgHash, publicKey, {
+    lowS: opts?.lowS ?? true
+  });
 };
 
 // ../crypto/src/secp256k1/plugin.ts
@@ -51994,13 +51998,13 @@ var hasPrefix = (bytes3, prefix) => {
 };
 
 // ../crypto/src/verify.ts
-var verifySignature = (didKey, data, sig) => {
+var verifySignature = (didKey, data, sig, opts) => {
   const parsed = parseDidKey(didKey);
   const plugin = plugins_default.find((p) => p.jwtAlg === parsed.jwtAlg);
   if (!plugin) {
-    throw new Error(`Unsupported signature alg: :${parsed.jwtAlg}`);
+    throw new Error(`Unsupported signature alg: ${parsed.jwtAlg}`);
   }
-  return plugin.verifySignature(didKey, data, sig);
+  return plugin.verifySignature(didKey, data, sig, opts);
 };
 
 // src/auth.ts
@@ -52045,17 +52049,30 @@ var verifyJwt = async (jwtStr, ownDid, getSigningKey) => {
   }
   const msgBytes = fromString2(parts.slice(0, 2).join("."), "utf8");
   const sigBytes = fromString2(sig, "base64url");
-  const signingKey = await getSigningKey(payload.iss);
+  const verifySignatureWithKey = (key) => {
+    return verifySignature(key, msgBytes, sigBytes, {
+      lowS: false
+    });
+  };
+  const signingKey = await getSigningKey(payload.iss, false);
   let validSig;
   try {
-    validSig = await verifySignature(signingKey, msgBytes, sigBytes);
+    validSig = await verifySignatureWithKey(signingKey);
   } catch (err) {
     throw new AuthRequiredError("could not verify jwt signature", "BadJwtSignature");
   }
+  if (!validSig) {
+    const freshSigningKey = await getSigningKey(payload.iss, true);
+    try {
+      validSig = freshSigningKey !== signingKey ? await verifySignatureWithKey(freshSigningKey) : false;
+    } catch (err) {
+      throw new AuthRequiredError("could not verify jwt signature", "BadJwtSignature");
+    }
+  }
   if (!validSig) {
     throw new AuthRequiredError("jwt signature does not match jwt issuer", "BadJwtSignature");
   }
-  return payload.iss;
+  return payload;
 };
 var parseB64UrlToJson = (b64) => {
   return JSON.parse(b64UrlToUtf8(b64));