@atproto/xrpc-server 0.3.2 → 0.4.0

package/dist/server.d.ts

@@ -1,8 +1,8 @@
 import express, { NextFunction, RequestHandler } from 'express';
-import { Lexicons, LexXrpcProcedure, LexXrpcQuery, LexXrpcSubscription } from '@atproto/lexicon';
+import { LexiconDoc, Lexicons, LexXrpcProcedure, LexXrpcQuery, LexXrpcSubscription } from '@atproto/lexicon';
 import { XrpcStreamServer } from './stream';
 import { XRPCHandler, XRPCHandlerConfig, Options, XRPCStreamHandlerConfig, XRPCStreamHandler, RateLimiterI, RateLimiterConsume } from './types';
-export declare function createServer(lexicons?: unknown[], options?: Options): Server;
+export declare function createServer(lexicons?: LexiconDoc[], options?: Options): Server;
 export declare class Server {
     router: import("express-serve-static-core").Express;
     routes: import("express-serve-static-core").Router;
@@ -13,13 +13,13 @@ export declare class Server {
     globalRateLimiters: RateLimiterI[];
     sharedRateLimiters: Record<string, RateLimiterI>;
     routeRateLimiterFns: Record<string, RateLimiterConsume[]>;
-    constructor(lexicons?: unknown[], opts?: Options);
+    constructor(lexicons?: LexiconDoc[], opts?: Options);
     method(nsid: string, configOrFn: XRPCHandlerConfig | XRPCHandler): void;
     addMethod(nsid: string, configOrFn: XRPCHandlerConfig | XRPCHandler): void;
     streamMethod(nsid: string, configOrFn: XRPCStreamHandlerConfig | XRPCStreamHandler): void;
     addStreamMethod(nsid: string, configOrFn: XRPCStreamHandlerConfig | XRPCStreamHandler): void;
-    addLexicon(doc: unknown): void;
-    addLexicons(docs: unknown[]): void;
+    addLexicon(doc: LexiconDoc): void;
+    addLexicons(docs: LexiconDoc[]): void;
     protected addRoute(nsid: string, def: LexXrpcQuery | LexXrpcProcedure, config: XRPCHandlerConfig): Promise<void>;
     catchall(req: express.Request, _res: express.Response, next: NextFunction): Promise<void>;
     createHandler(nsid: string, def: LexXrpcQuery | LexXrpcProcedure, handler: XRPCHandler): RequestHandler;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atproto/xrpc-server",
-  "version": "0.3.2",
+  "version": "0.4.0",
   "license": "MIT",
   "description": "atproto HTTP API (XRPC) server library",
   "keywords": [
@@ -23,9 +23,9 @@
     "uint8arrays": "3.0.0",
     "ws": "^8.12.0",
     "zod": "^3.21.4",
-    "@atproto/common": "^0.3.1",
-    "@atproto/crypto": "^0.2.2",
-    "@atproto/lexicon": "^0.2.2"
+    "@atproto/common": "^0.3.3",
+    "@atproto/crypto": "^0.2.3",
+    "@atproto/lexicon": "^0.3.0"
   },
   "devDependencies": {
     "@types/express": "^4.17.13",
@@ -33,9 +33,11 @@
     "@types/http-errors": "^2.0.1",
     "@types/ws": "^8.5.4",
     "get-port": "^6.1.2",
+    "jose": "^4.15.4",
+    "key-encoder": "^2.0.3",
     "multiformats": "^9.9.0",
-    "@atproto/crypto": "^0.2.2",
-    "@atproto/xrpc": "^0.3.2"
+    "@atproto/crypto": "^0.2.3",
+    "@atproto/xrpc": "^0.4.0"
   },
   "scripts": {
     "test": "jest",

package/src/auth.ts

@@ -4,10 +4,13 @@ import * as crypto from '@atproto/crypto'
 import * as ui8 from 'uint8arrays'
 import { AuthRequiredError } from './types'
 
-type ServiceJwtParams = {
+type ServiceJwtPayload = {
   iss: string
   aud: string
   exp?: number
+}
+
+type ServiceJwtParams = ServiceJwtPayload & {
   keypair: crypto.Keypair
 }
 
@@ -45,8 +48,8 @@ const jsonToB64Url = (json: Record<string, unknown>): string => {
 export const verifyJwt = async (
   jwtStr: string,
   ownDid: string | null, // null indicates to skip the audience check
-  getSigningKey: (did: string) => Promise<string>,
-): Promise<string> => {
+  getSigningKey: (did: string, forceRefresh: boolean) => Promise<string>,
+): Promise<ServiceJwtPayload> => {
   const parts = jwtStr.split('.')
   if (parts.length !== 3) {
     throw new AuthRequiredError('poorly formatted jwt', 'BadJwt')
@@ -66,18 +69,40 @@ export const verifyJwt = async (
 
   const msgBytes = ui8.fromString(parts.slice(0, 2).join('.'), 'utf8')
   const sigBytes = ui8.fromString(sig, 'base64url')
+  const verifySignatureWithKey = (key: string) => {
+    return crypto.verifySignature(key, msgBytes, sigBytes, {
+      lowS: false,
+    })
+  }
 
-  const signingKey = await getSigningKey(payload.iss)
+  const signingKey = await getSigningKey(payload.iss, false)
 
   let validSig: boolean
   try {
-    validSig = await crypto.verifySignature(signingKey, msgBytes, sigBytes)
+    validSig = await verifySignatureWithKey(signingKey)
   } catch (err) {
     throw new AuthRequiredError(
       'could not verify jwt signature',
       'BadJwtSignature',
     )
   }
+
+  if (!validSig) {
+    // get fresh signing key in case it failed due to a recent rotation
+    const freshSigningKey = await getSigningKey(payload.iss, true)
+    try {
+      validSig =
+        freshSigningKey !== signingKey
+          ? await verifySignatureWithKey(freshSigningKey)
+          : false
+    } catch (err) {
+      throw new AuthRequiredError(
+        'could not verify jwt signature',
+        'BadJwtSignature',
+      )
+    }
+  }
+
   if (!validSig) {
     throw new AuthRequiredError(
       'jwt signature does not match jwt issuer',
@@ -85,7 +110,7 @@ export const verifyJwt = async (
     )
   }
 
-  return payload.iss
+  return payload
 }
 
 const parseB64UrlToJson = (b64: string) => {

package/src/server.ts

@@ -5,6 +5,7 @@ import express, {
   RequestHandler,
 } from 'express'
 import {
+  LexiconDoc,
   Lexicons,
   lexToJson,
   LexXrpcProcedure,
@@ -45,7 +46,7 @@ import {
 import log from './logger'
 import { consumeMany } from './rate-limiter'
 
-export function createServer(lexicons?: unknown[], options?: Options) {
+export function createServer(lexicons?: LexiconDoc[], options?: Options) {
   return new Server(lexicons, options)
 }
 
@@ -60,7 +61,7 @@ export class Server {
   sharedRateLimiters: Record<string, RateLimiterI>
   routeRateLimiterFns: Record<string, RateLimiterConsume[]>
 
-  constructor(lexicons?: unknown[], opts?: Options) {
+  constructor(lexicons?: LexiconDoc[], opts?: Options) {
     if (lexicons) {
       this.addLexicons(lexicons)
     }
@@ -140,11 +141,11 @@ export class Server {
   // schemas
   // =
 
-  addLexicon(doc: unknown) {
+  addLexicon(doc: LexiconDoc) {
     this.lex.add(doc)
   }
 
-  addLexicons(docs: unknown[]) {
+  addLexicons(docs: LexiconDoc[]) {
     for (const doc of docs) {
       this.addLexicon(doc)
     }

package/tests/auth.test.ts

@@ -1,5 +1,12 @@
-import * as http from 'http'
+import * as http from 'node:http'
+import { KeyObject, createPrivateKey } from 'node:crypto'
 import getPort from 'get-port'
+import * as jose from 'jose'
+import KeyEncoder from 'key-encoder'
+import * as ui8 from 'uint8arrays'
+import { MINUTE } from '@atproto/common'
+import { Secp256k1Keypair } from '@atproto/crypto'
+import { LexiconDoc } from '@atproto/lexicon'
 import xrpc, { ServiceClient, XRPCError } from '@atproto/xrpc'
 import * as xrpcServer from '../src'
 import {
@@ -9,7 +16,7 @@ import {
   basicAuthHeaders,
 } from './_util'
 
-const LEXICONS = [
+const LEXICONS: LexiconDoc[] = [
   {
     lexicon: 1,
     id: 'io.example.authTest',
@@ -131,4 +138,104 @@ describe('Auth', () => {
       original: 'YWRtaW46cGFzc3dvcmQ=',
     })
   })
+
+  describe('verifyJwt()', () => {
+    it('fails on expired jwt.', async () => {
+      const keypair = await Secp256k1Keypair.create()
+      const jwt = await xrpcServer.createServiceJwt({
+        aud: 'did:example:aud',
+        iss: 'did:example:iss',
+        keypair,
+        exp: Math.floor((Date.now() - MINUTE) / 1000),
+      })
+      const tryVerify = xrpcServer.verifyJwt(
+        jwt,
+        'did:example:aud',
+        async () => {
+          return keypair.did()
+        },
+      )
+      await expect(tryVerify).rejects.toThrow('jwt expired')
+    })
+
+    it('fails on bad audience.', async () => {
+      const keypair = await Secp256k1Keypair.create()
+      const jwt = await xrpcServer.createServiceJwt({
+        aud: 'did:example:aud1',
+        iss: 'did:example:iss',
+        keypair,
+      })
+      const tryVerify = xrpcServer.verifyJwt(
+        jwt,
+        'did:example:aud2',
+        async () => {
+          return keypair.did()
+        },
+      )
+      await expect(tryVerify).rejects.toThrow(
+        'jwt audience does not match service did',
+      )
+    })
+
+    it('refreshes key on verification failure.', async () => {
+      const keypair1 = await Secp256k1Keypair.create()
+      const keypair2 = await Secp256k1Keypair.create()
+      const jwt = await xrpcServer.createServiceJwt({
+        aud: 'did:example:aud',
+        iss: 'did:example:iss',
+        keypair: keypair2,
+      })
+      let usedKeypair1 = false
+      let usedKeypair2 = false
+      const tryVerify = xrpcServer.verifyJwt(
+        jwt,
+        'did:example:aud',
+        async (_did, forceRefresh) => {
+          if (forceRefresh) {
+            usedKeypair2 = true
+            return keypair2.did()
+          } else {
+            usedKeypair1 = true
+            return keypair1.did()
+          }
+        },
+      )
+      await expect(tryVerify).resolves.toMatchObject({
+        aud: 'did:example:aud',
+        iss: 'did:example:iss',
+      })
+      expect(usedKeypair1).toBe(true)
+      expect(usedKeypair2).toBe(true)
+    })
+
+    it('interoperates with jwts signed by other libraries.', async () => {
+      const keypair = await Secp256k1Keypair.create({ exportable: true })
+      const signingKey = await createPrivateKeyObject(keypair)
+      const payload = {
+        aud: 'did:example:aud',
+        iss: 'did:example:iss',
+        exp: Math.floor((Date.now() + MINUTE) / 1000),
+      }
+      const jwt = await new jose.SignJWT(payload)
+        .setProtectedHeader({ typ: 'JWT', alg: keypair.jwtAlg })
+        .sign(signingKey)
+      const tryVerify = xrpcServer.verifyJwt(
+        jwt,
+        'did:example:aud',
+        async () => {
+          return keypair.did()
+        },
+      )
+      await expect(tryVerify).resolves.toEqual(payload)
+    })
+  })
 })
+
+const createPrivateKeyObject = async (
+  privateKey: Secp256k1Keypair,
+): Promise<KeyObject> => {
+  const raw = await privateKey.export()
+  const encoder = new KeyEncoder('secp256k1')
+  const key = encoder.encodePrivate(ui8.toString(raw, 'hex'), 'raw', 'pem')
+  return createPrivateKey({ format: 'pem', key })
+}

package/tests/bodies.test.ts

@@ -2,6 +2,7 @@ import * as http from 'http'
 import { Readable } from 'stream'
 import { gzipSync } from 'zlib'
 import getPort from 'get-port'
+import { LexiconDoc } from '@atproto/lexicon'
 import xrpc, { ServiceClient } from '@atproto/xrpc'
 import { bytesToStream, cidForCbor } from '@atproto/common'
 import { randomBytes } from '@atproto/crypto'
@@ -9,7 +10,7 @@ import { createServer, closeServer } from './_util'
 import * as xrpcServer from '../src'
 import logger from '../src/logger'
 
-const LEXICONS = [
+const LEXICONS: LexiconDoc[] = [
   {
     lexicon: 1,
     id: 'io.example.validationTest',

package/tests/errors.test.ts

@@ -1,5 +1,6 @@
 import * as http from 'http'
 import getPort from 'get-port'
+import { LexiconDoc } from '@atproto/lexicon'
 import { createServer, closeServer } from './_util'
 import * as xrpcServer from '../src'
 import xrpc, {
@@ -9,7 +10,7 @@ import xrpc, {
   XRPCInvalidResponseError,
 } from '@atproto/xrpc'
 
-const LEXICONS = [
+const LEXICONS: LexiconDoc[] = [
   {
     lexicon: 1,
     id: 'io.example.error',

package/tests/ipld.test.ts

@@ -1,11 +1,12 @@
 import * as http from 'http'
+import { LexiconDoc } from '@atproto/lexicon'
 import xrpc, { ServiceClient } from '@atproto/xrpc'
 import { CID } from 'multiformats/cid'
 import getPort from 'get-port'
 import { createServer, closeServer } from './_util'
 import * as xrpcServer from '../src'
 
-const LEXICONS = [
+const LEXICONS: LexiconDoc[] = [
   {
     lexicon: 1,
     id: 'io.example.ipld',

package/tests/parameters.test.ts

@@ -1,10 +1,11 @@
 import * as http from 'http'
 import getPort from 'get-port'
+import { LexiconDoc } from '@atproto/lexicon'
 import xrpc, { ServiceClient } from '@atproto/xrpc'
 import { createServer, closeServer } from './_util'
 import * as xrpcServer from '../src'
 
-const LEXICONS = [
+const LEXICONS: LexiconDoc[] = [
   {
     lexicon: 1,
     id: 'io.example.paramTest',

package/tests/procedures.test.ts

@@ -1,11 +1,12 @@
 import * as http from 'http'
 import { Readable } from 'stream'
+import { LexiconDoc } from '@atproto/lexicon'
 import xrpc, { ServiceClient } from '@atproto/xrpc'
 import getPort from 'get-port'
 import { createServer, closeServer } from './_util'
 import * as xrpcServer from '../src'
 
-const LEXICONS = [
+const LEXICONS: LexiconDoc[] = [
   {
     lexicon: 1,
     id: 'io.example.pingOne',

package/tests/queries.test.ts

@@ -1,10 +1,11 @@
 import * as http from 'http'
 import getPort from 'get-port'
+import { LexiconDoc } from '@atproto/lexicon'
 import xrpc, { ServiceClient } from '@atproto/xrpc'
 import { createServer, closeServer } from './_util'
 import * as xrpcServer from '../src'
 
-const LEXICONS = [
+const LEXICONS: LexiconDoc[] = [
   {
     lexicon: 1,
     id: 'io.example.pingOne',

package/tests/rate-limiter.test.ts

@@ -1,12 +1,13 @@
 import * as http from 'http'
 import getPort from 'get-port'
+import { LexiconDoc } from '@atproto/lexicon'
 import xrpc, { ServiceClient } from '@atproto/xrpc'
 import { createServer, closeServer } from './_util'
 import * as xrpcServer from '../src'
 import { RateLimiter } from '../src'
 import { MINUTE } from '@atproto/common'
 
-const LEXICONS = [
+const LEXICONS: LexiconDoc[] = [
   {
     lexicon: 1,
     id: 'io.example.routeLimit',

package/tests/responses.test.ts

@@ -1,11 +1,12 @@
 import * as http from 'http'
 import getPort from 'get-port'
+import { LexiconDoc } from '@atproto/lexicon'
 import xrpc, { ServiceClient } from '@atproto/xrpc'
 import { byteIterableToStream } from '@atproto/common'
 import { createServer, closeServer } from './_util'
 import * as xrpcServer from '../src'
 
-const LEXICONS = [
+const LEXICONS: LexiconDoc[] = [
   {
     lexicon: 1,
     id: 'io.example.readableStream',

package/tests/subscriptions.test.ts

@@ -2,6 +2,7 @@ import * as http from 'http'
 import { WebSocket, WebSocketServer, createWebSocketStream } from 'ws'
 import getPort from 'get-port'
 import { wait } from '@atproto/common'
+import { LexiconDoc } from '@atproto/lexicon'
 import { byFrame, MessageFrame, ErrorFrame, Frame, Subscription } from '../src'
 import {
   createServer,
@@ -11,7 +12,7 @@ import {
 } from './_util'
 import * as xrpcServer from '../src'
 
-const LEXICONS = [
+const LEXICONS: LexiconDoc[] = [
   {
     lexicon: 1,
     id: 'io.example.streamOne',

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2022-2023 Bluesky PBC
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.