@atproto/xrpc-server 0.4.2 → 0.4.4-next.0

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @atproto/xrpc-server
 
+## 0.4.4-next.0
+
+### Patch Changes
+
+- Overhaul of package builds, no longer bundling deps.
+
+- Updated dependencies []:
+  - @atproto/lexicon@0.3.3-next.0
+  - @atproto/common@0.3.4-next.0
+  - @atproto/crypto@0.3.1-next.0
+
+## 0.4.3
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @atproto/lexicon@0.3.2
+
 ## 0.4.2
 
 ### Patch Changes

package/LICENSE.txt

@@ -1,6 +1,6 @@
 Dual MIT/Apache-2.0 License
 
-Copyright (c) 2022-2023 Bluesky PBC, and Contributors
+Copyright (c) 2022-2024 Bluesky PBC, and Contributors
 
 Except as otherwise noted in individual files, this software is licensed under the MIT license (<http://opensource.org/licenses/MIT>), or the Apache License, Version 2.0 (<http://www.apache.org/licenses/LICENSE-2.0>).
 

package/dist/auth.d.ts

@@ -1,10 +1,10 @@
 import * as crypto from '@atproto/crypto';
-declare type ServiceJwtPayload = {
+type ServiceJwtPayload = {
     iss: string;
     aud: string;
     exp?: number;
 };
-declare type ServiceJwtParams = ServiceJwtPayload & {
+type ServiceJwtParams = ServiceJwtPayload & {
     keypair: crypto.Keypair;
 };
 export declare const createServiceJwt: (params: ServiceJwtParams) => Promise<string>;
@@ -15,3 +15,4 @@ export declare const createServiceAuthHeaders: (params: ServiceJwtParams) => Pro
 }>;
 export declare const verifyJwt: (jwtStr: string, ownDid: string | null, getSigningKey: (did: string, forceRefresh: boolean) => Promise<string>) => Promise<ServiceJwtPayload>;
 export {};
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,MAAM,MAAM,iBAAiB,CAAA;AAIzC,KAAK,iBAAiB,GAAG;IACvB,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,CAAA;AAED,KAAK,gBAAgB,GAAG,iBAAiB,GAAG;IAC1C,OAAO,EAAE,MAAM,CAAC,OAAO,CAAA;CACxB,CAAA;AAED,eAAO,MAAM,gBAAgB,WACnB,gBAAgB,KACvB,QAAQ,MAAM,CAgBhB,CAAA;AAED,eAAO,MAAM,wBAAwB,WAAkB,gBAAgB;;;;EAKtE,CAAA;AAMD,eAAO,MAAM,SAAS,WACZ,MAAM,UACN,MAAM,GAAG,IAAI,uBACA,MAAM,gBAAgB,OAAO,KAAK,QAAQ,MAAM,CAAC,KACrE,QAAQ,iBAAiB,CA8D3B,CAAA"}

package/dist/auth.js

@@ -0,0 +1,124 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyJwt = exports.createServiceAuthHeaders = exports.createServiceJwt = void 0;
+const common = __importStar(require("@atproto/common"));
+const common_1 = require("@atproto/common");
+const crypto = __importStar(require("@atproto/crypto"));
+const ui8 = __importStar(require("uint8arrays"));
+const types_1 = require("./types");
+const createServiceJwt = async (params) => {
+    const { iss, aud, keypair } = params;
+    const exp = params.exp ?? Math.floor((Date.now() + common_1.MINUTE) / 1000);
+    const header = {
+        typ: 'JWT',
+        alg: keypair.jwtAlg,
+    };
+    const payload = {
+        iss,
+        aud,
+        exp,
+    };
+    const toSignStr = `${jsonToB64Url(header)}.${jsonToB64Url(payload)}`;
+    const toSign = ui8.fromString(toSignStr, 'utf8');
+    const sig = await keypair.sign(toSign);
+    return `${toSignStr}.${ui8.toString(sig, 'base64url')}`;
+};
+exports.createServiceJwt = createServiceJwt;
+const createServiceAuthHeaders = async (params) => {
+    const jwt = await (0, exports.createServiceJwt)(params);
+    return {
+        headers: { authorization: `Bearer ${jwt}` },
+    };
+};
+exports.createServiceAuthHeaders = createServiceAuthHeaders;
+const jsonToB64Url = (json) => {
+    return common.utf8ToB64Url(JSON.stringify(json));
+};
+const verifyJwt = async (jwtStr, ownDid, // null indicates to skip the audience check
+getSigningKey) => {
+    const parts = jwtStr.split('.');
+    if (parts.length !== 3) {
+        throw new types_1.AuthRequiredError('poorly formatted jwt', 'BadJwt');
+    }
+    const payload = parsePayload(parts[1]);
+    const sig = parts[2];
+    if (Date.now() / 1000 > payload.exp) {
+        throw new types_1.AuthRequiredError('jwt expired', 'JwtExpired');
+    }
+    if (ownDid !== null && payload.aud !== ownDid) {
+        throw new types_1.AuthRequiredError('jwt audience does not match service did', 'BadJwtAudience');
+    }
+    const msgBytes = ui8.fromString(parts.slice(0, 2).join('.'), 'utf8');
+    const sigBytes = ui8.fromString(sig, 'base64url');
+    const verifySignatureWithKey = (key) => {
+        return crypto.verifySignature(key, msgBytes, sigBytes, {
+            allowMalleableSig: true,
+        });
+    };
+    const signingKey = await getSigningKey(payload.iss, false);
+    let validSig;
+    try {
+        validSig = await verifySignatureWithKey(signingKey);
+    }
+    catch (err) {
+        throw new types_1.AuthRequiredError('could not verify jwt signature', 'BadJwtSignature');
+    }
+    if (!validSig) {
+        // get fresh signing key in case it failed due to a recent rotation
+        const freshSigningKey = await getSigningKey(payload.iss, true);
+        try {
+            validSig =
+                freshSigningKey !== signingKey
+                    ? await verifySignatureWithKey(freshSigningKey)
+                    : false;
+        }
+        catch (err) {
+            throw new types_1.AuthRequiredError('could not verify jwt signature', 'BadJwtSignature');
+        }
+    }
+    if (!validSig) {
+        throw new types_1.AuthRequiredError('jwt signature does not match jwt issuer', 'BadJwtSignature');
+    }
+    return payload;
+};
+exports.verifyJwt = verifyJwt;
+const parseB64UrlToJson = (b64) => {
+    return JSON.parse(common.b64UrlToUtf8(b64));
+};
+const parsePayload = (b64) => {
+    const payload = parseB64UrlToJson(b64);
+    if (!payload || typeof payload !== 'object') {
+        throw new types_1.AuthRequiredError('poorly formatted jwt', 'BadJwt');
+    }
+    else if (typeof payload.exp !== 'number') {
+        throw new types_1.AuthRequiredError('poorly formatted jwt', 'BadJwt');
+    }
+    else if (typeof payload.iss !== 'string') {
+        throw new types_1.AuthRequiredError('poorly formatted jwt', 'BadJwt');
+    }
+    return payload;
+};
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,wDAAyC;AACzC,4CAAwC;AACxC,wDAAyC;AACzC,iDAAkC;AAClC,mCAA2C;AAYpC,MAAM,gBAAgB,GAAG,KAAK,EACnC,MAAwB,EACP,EAAE;IACnB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,CAAA;IACpC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,eAAM,CAAC,GAAG,IAAI,CAAC,CAAA;IAClE,MAAM,MAAM,GAAG;QACb,GAAG,EAAE,KAAK;QACV,GAAG,EAAE,OAAO,CAAC,MAAM;KACpB,CAAA;IACD,MAAM,OAAO,GAAG;QACd,GAAG;QACH,GAAG;QACH,GAAG;KACJ,CAAA;IACD,MAAM,SAAS,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,OAAO,CAAC,EAAE,CAAA;IACpE,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;IAChD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACtC,OAAO,GAAG,SAAS,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAA;AACzD,CAAC,CAAA;AAlBY,QAAA,gBAAgB,oBAkB5B;AAEM,MAAM,wBAAwB,GAAG,KAAK,EAAE,MAAwB,EAAE,EAAE;IACzE,MAAM,GAAG,GAAG,MAAM,IAAA,wBAAgB,EAAC,MAAM,CAAC,CAAA;IAC1C,OAAO;QACL,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;KAC5C,CAAA;AACH,CAAC,CAAA;AALY,QAAA,wBAAwB,4BAKpC;AAED,MAAM,YAAY,GAAG,CAAC,IAA6B,EAAU,EAAE;IAC7D,OAAO,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;AAClD,CAAC,CAAA;AAEM,MAAM,SAAS,GAAG,KAAK,EAC5B,MAAc,EACd,MAAqB,EAAE,4CAA4C;AACnE,aAAsE,EAC1C,EAAE;IAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,yBAAiB,CAAC,sBAAsB,EAAE,QAAQ,CAAC,CAAA;IAC/D,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IACtC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;IAEpB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QACpC,MAAM,IAAI,yBAAiB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAA;IAC1D,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;QAC9C,MAAM,IAAI,yBAAiB,CACzB,yCAAyC,EACzC,gBAAgB,CACjB,CAAA;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAA;IACpE,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;IACjD,MAAM,sBAAsB,GAAG,CAAC,GAAW,EAAE,EAAE;QAC7C,OAAO,MAAM,CAAC,eAAe,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE;YACrD,iBAAiB,EAAE,IAAI;SACxB,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAE1D,IAAI,QAAiB,CAAA;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,sBAAsB,CAAC,UAAU,CAAC,CAAA;IACrD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,yBAAiB,CACzB,gCAAgC,EAChC,iBAAiB,CAClB,CAAA;IACH,CAAC;IAED,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,mEAAmE;QACnE,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC9D,IAAI,CAAC;YACH,QAAQ;gBACN,eAAe,KAAK,UAAU;oBAC5B,CAAC,CAAC,MAAM,sBAAsB,CAAC,eAAe,CAAC;oBAC/C,CAAC,CAAC,KAAK,CAAA;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,yBAAiB,CACzB,gCAAgC,EAChC,iBAAiB,CAClB,CAAA;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,yBAAiB,CACzB,yCAAyC,EACzC,iBAAiB,CAClB,CAAA;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAlEY,QAAA,SAAS,aAkErB;AAED,MAAM,iBAAiB,GAAG,CAAC,GAAW,EAAE,EAAE;IACxC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;AAC7C,CAAC,CAAA;AAED,MAAM,YAAY,GAAG,CAAC,GAAW,EAAc,EAAE;IAC/C,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;IACtC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,yBAAiB,CAAC,sBAAsB,EAAE,QAAQ,CAAC,CAAA;IAC/D,CAAC;SAAM,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,IAAI,yBAAiB,CAAC,sBAAsB,EAAE,QAAQ,CAAC,CAAA;IAC/D,CAAC;SAAM,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,IAAI,yBAAiB,CAAC,sBAAsB,EAAE,QAAQ,CAAC,CAAA;IAC/D,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/dist/index.d.ts

@@ -5,3 +5,4 @@ export * from './stream';
 export * from './rate-limiter';
 export type { ServerTiming } from './util';
 export { serverTimingHeader, ServerTimer } from './util';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAA;AACvB,cAAc,QAAQ,CAAA;AACtB,cAAc,UAAU,CAAA;AACxB,cAAc,UAAU,CAAA;AACxB,cAAc,gBAAgB,CAAA;AAE9B,YAAY,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAA;AAC1C,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAA"}