@graffiti-garden/implementation-decentralized 0.0.1

package/src/1-services/1-authorization.ts

@@ -0,0 +1,399 @@
+import {
+  discovery,
+  randomState,
+  buildAuthorizationUrl,
+  authorizationCodeGrant,
+  tokenRevocation,
+} from "openid-client";
+import {
+  type infer as infer_,
+  string,
+  url,
+  array,
+  object,
+  optional,
+  nullable,
+  instanceof as instanceof_,
+  undefined as undefined_,
+  intersection,
+  union,
+} from "zod/mini";
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { Socket } from "node:net";
+
+const AUTHORIZATION_ENDPOINT_METHOD_PREFIX_OAUTH2 = "oauth2:";
+const LOCAL_STORAGE_OAUTH2_KEY = "graffiti-auth-oauth2-data";
+
+export class Authorization {
+  eventTarget: EventTarget = new EventTarget();
+
+  constructor() {
+    // Extract oauth redirect synchronously so the route
+    // can be changed before any SPA routers (e.g. vue router)
+    // start messing with things
+    const oauthPromise = this.completeOauth();
+
+    (async () => {
+      // Allow listeners to be added first
+      await new Promise((resolve) => setTimeout(resolve, 0));
+
+      // Complete the oauth flow
+      await oauthPromise;
+
+      // Send an initialized event
+      const initializedEvent: InitializedEvent = new CustomEvent("initialized");
+      this.eventTarget.dispatchEvent(initializedEvent);
+    })();
+  }
+
+  async login(...args: Parameters<typeof this.login_>): Promise<void> {
+    try {
+      await this.login_(...args);
+    } catch (e) {
+      const error = e instanceof Error ? e : new Error("Unknown error");
+      const detail: LoginEvent["detail"] = { loginId: args[1], error };
+      this.eventTarget.dispatchEvent(new CustomEvent("login", { detail }));
+    }
+  }
+  protected async login_(
+    authorizationEndpoint: string,
+    loginId: string,
+    serviceEndpoints: string[],
+  ): Promise<void> {
+    const configuration = await this.getAuthorizationConfiguration(
+      authorizationEndpoint,
+    );
+
+    const scope = serviceEndpoints.map(encodeURIComponent).join(" ");
+    const state = randomState();
+
+    let redirectUri: string;
+    let waitForCallback: Promise<void> | undefined = undefined;
+    if (typeof window !== "undefined") {
+      // If in a browser, prepare for a redirect by
+      // storing the configuration, expected state,
+      // current URL, and endpoints in local storage
+      redirectUri = window.location.href;
+      const data: infer_<typeof OAuth2LoginDataSchema> = {
+        loginId,
+        redirectUri,
+        authorizationEndpoint,
+        state,
+        serviceEndpoints,
+      };
+      window.localStorage.setItem(
+        LOCAL_STORAGE_OAUTH2_KEY,
+        JSON.stringify(data),
+      );
+    } else {
+      // Otherwise, in node, start a local server to receive the callback
+      const http = await import("node:http").catch((e) => {
+        throw new Error(
+          "Unrecognized environment: cannot find window or node:http",
+        );
+      });
+      const server = http.createServer();
+
+      try {
+        await new Promise<void>((resolve, reject) => {
+          server.once("error", reject);
+          server.listen(0, "::1", resolve);
+        });
+      } catch (e) {
+        try {
+          server.close();
+        } catch {}
+        throw new Error("Failed to start local oauth callback server.");
+      }
+
+      const address = server.address();
+      if (!address) {
+        try {
+          server.close();
+        } catch {}
+        throw new Error("Failed to get local oauth callback server address.");
+      }
+      redirectUri =
+        typeof address === "string"
+          ? `http://${address}`
+          : `http://${address.family === "IPv6" ? `[${address.address}]` : address.address}:${address.port}`;
+
+      // Wait for a callback request
+      waitForCallback = new Promise<void>((resolve, reject) => {
+        const timeout = setTimeout(
+          () => {
+            try {
+              server.close();
+            } catch {}
+            reject("Oauth callback timed out.");
+          },
+          5 * 60 * 1000, // 5 minutes
+        );
+
+        const sockets = new Set<Socket>();
+        server.on("connection", (socket: Socket) => {
+          sockets.add(socket);
+          socket.on("close", () => {
+            sockets.delete(socket);
+          });
+        });
+
+        // Set up the actual request handler
+        const onRequest = async (req: IncomingMessage, res: ServerResponse) => {
+          try {
+            const callbackUrl = new URL(req.url ?? "/", redirectUri);
+            await this.onCallbackUrl({
+              loginId,
+              callbackUrl,
+              configuration,
+              expectedState: state,
+              serviceEndpoints,
+            });
+
+            res.statusCode = 200;
+            res.setHeader("Content-Type", "text/plain");
+            res.end("You may now close this window.");
+          } catch (e) {
+            res.statusCode = 500;
+            res.setHeader("Content-Type", "text/plain");
+            res.end("Error processing OAuth callback.");
+
+            throw e;
+          } finally {
+            clearTimeout(timeout);
+            server.off("request", onRequest);
+
+            for (const socket of sockets) {
+              socket.destroy();
+            }
+
+            server.close(() => resolve());
+          }
+        };
+
+        server.on("request", onRequest);
+      });
+    }
+
+    // Construct the authorization URL
+    const redirectUriStripped = new URL(redirectUri);
+    redirectUriStripped.hash = "";
+    redirectUriStripped.search = "";
+
+    const redirectTo = buildAuthorizationUrl(configuration, {
+      scope,
+      redirect_uri: redirectUriStripped.toString(),
+      state,
+    });
+
+    // Either redirect (browser) or print the URL and wait (node)
+    if (typeof window !== "undefined") {
+      window.location.href = redirectTo.toString();
+    } else {
+      console.log("Please open the following URL in your browser:");
+      console.log(redirectTo.toString());
+      await waitForCallback;
+    }
+  }
+
+  protected completeOauth() {
+    if (typeof window === "undefined") return;
+
+    // Look in local storage to see if we have a pending login
+    const data = window.localStorage.getItem(LOCAL_STORAGE_OAUTH2_KEY);
+    if (!data) return;
+
+    let json: unknown;
+    try {
+      json = JSON.parse(data);
+    } catch {
+      console.error("Invalid OAuth2 login data in local storage.");
+      window.localStorage.removeItem(LOCAL_STORAGE_OAUTH2_KEY);
+      return;
+    }
+
+    const parseResult = OAuth2LoginDataSchema.safeParse(json);
+    if (!parseResult.success) {
+      console.error(
+        "Invalid OAuth2 login data structure in local storage.",
+        parseResult.error,
+      );
+      window.localStorage.removeItem(LOCAL_STORAGE_OAUTH2_KEY);
+      return;
+    }
+
+    const {
+      loginId,
+      redirectUri,
+      authorizationEndpoint,
+      state,
+      serviceEndpoints,
+    } = parseResult.data;
+
+    try {
+      // Make sure that we redirected back to the correct page
+      const expectedUrl = new URL(redirectUri);
+      const callbackUrl = new URL(window.location.href);
+      if (expectedUrl.pathname !== callbackUrl.pathname) return;
+      // Make sure it is actually an oauth call
+      const params = callbackUrl.searchParams;
+      if (!params.has("code") && !params.has("error")) return;
+
+      // Restore the hash and query parameters to the expected URL,
+      // removing the code, state, and error parameters
+      window.history.replaceState({}, document.title, expectedUrl.toString());
+      window.localStorage.removeItem(LOCAL_STORAGE_OAUTH2_KEY);
+
+      return new Promise<void>((resolve) => setTimeout(resolve, 0))
+        .then(() => this.getAuthorizationConfiguration(authorizationEndpoint))
+        .then((configuration) =>
+          this.onCallbackUrl({
+            loginId,
+            callbackUrl,
+            configuration,
+            expectedState: state,
+            serviceEndpoints,
+          }),
+        )
+        .catch((e) => {
+          const error = e instanceof Error ? e : new Error("Unknown error");
+          const detail: LoginEvent["detail"] = { loginId, error };
+          this.eventTarget.dispatchEvent(new CustomEvent("login", { detail }));
+        });
+    } catch (e) {
+      console.error(e);
+    }
+  }
+
+  protected async onCallbackUrl(args: {
+    loginId: string;
+    callbackUrl: URL;
+    configuration: any;
+    expectedState: string;
+    serviceEndpoints: string[];
+  }) {
+    const {
+      loginId,
+      callbackUrl,
+      configuration,
+      expectedState,
+      serviceEndpoints,
+    } = args;
+
+    const response = await authorizationCodeGrant(configuration, callbackUrl, {
+      expectedState,
+    });
+
+    const token = response.access_token;
+    const scope = response.scope;
+    const grantedEndpoints =
+      scope?.split(" ").map(decodeURIComponent) || serviceEndpoints;
+
+    // Make sure granted endpoints cover the requested endpoints
+    if (
+      !serviceEndpoints.every((endpoint) => grantedEndpoints.includes(endpoint))
+    ) {
+      throw new Error("Not all requested service endpoints were granted.");
+    }
+
+    // Send a logged in event
+    const loginEvent: LoginEvent = new CustomEvent("login", {
+      detail: {
+        loginId,
+        token,
+      },
+    });
+    this.eventTarget.dispatchEvent(loginEvent);
+  }
+
+  async logout(
+    authorizationEndpoint: string,
+    logoutId: string,
+    token: string,
+  ): Promise<void> {
+    try {
+      await this.logout_(authorizationEndpoint, logoutId, token);
+    } catch (e) {
+      const error = e instanceof Error ? e : new Error("Unknown error");
+      const detail: LogoutEvent["detail"] = { logoutId, error };
+      this.eventTarget.dispatchEvent(new CustomEvent("logout", { detail }));
+    }
+  }
+  protected async logout_(
+    authorizationEndpoint: string,
+    logoutId: string,
+    token: string,
+  ): Promise<void> {
+    const configuration = await this.getAuthorizationConfiguration(
+      authorizationEndpoint,
+    );
+    await tokenRevocation(configuration, token);
+    const detail: LogoutEvent["detail"] = { logoutId };
+    this.eventTarget.dispatchEvent(new CustomEvent("logout", { detail }));
+  }
+
+  protected async getAuthorizationConfiguration(
+    authorizationEndpoint: string,
+  ): Promise<any> {
+    // Parse the authorization endpoint
+    if (
+      !authorizationEndpoint.startsWith(
+        AUTHORIZATION_ENDPOINT_METHOD_PREFIX_OAUTH2,
+      )
+    ) {
+      throw new Error(
+        `Unrecognized authorization endpoint method: ${authorizationEndpoint}`,
+      );
+    }
+    const issuer = authorizationEndpoint.slice(
+      AUTHORIZATION_ENDPOINT_METHOD_PREFIX_OAUTH2.length,
+    );
+
+    // Look up the oauth configuration
+    let issuerUrl: URL;
+    try {
+      issuerUrl = new URL(issuer);
+    } catch (e) {
+      throw new Error("Invalid issuer URL.");
+    }
+
+    return await discovery(issuerUrl, "graffiti-client");
+  }
+}
+
+export const LoginEventDetailSchema = intersection(
+  object({
+    loginId: string(),
+  }),
+  union([
+    object({ token: string(), error: optional(undefined_()) }),
+    object({ error: instanceof_(Error) }),
+  ]),
+);
+
+export const LogoutEventDetailSchema = object({
+  logoutId: string(),
+  error: optional(instanceof_(Error)),
+});
+
+export const InitializedEventDetailSchema = optional(
+  nullable(
+    object({
+      error: optional(instanceof_(Error)),
+    }),
+  ),
+);
+
+export type LoginEvent = CustomEvent<infer_<typeof LoginEventDetailSchema>>;
+export type LogoutEvent = CustomEvent<infer_<typeof LogoutEventDetailSchema>>;
+export type InitializedEvent = CustomEvent<
+  infer_<typeof InitializedEventDetailSchema>
+>;
+
+const OAuth2LoginDataSchema = object({
+  loginId: string(),
+  redirectUri: url(),
+  authorizationEndpoint: url(),
+  state: string(),
+  serviceEndpoints: array(url()),
+});

package/src/1-services/2-dids-tests.ts

@@ -0,0 +1,24 @@
+import { describe, expect, test } from "vitest";
+import { DecentralizedIdentifiers } from "./2-dids";
+
+export function didTests() {
+  return describe("DecentralizedIdentifiers", () => {
+    const dids = new DecentralizedIdentifiers();
+
+    test("invalid method", async () => {
+      await expect(dids.resolve("did:invalid:12345")).rejects.toThrowError();
+    });
+
+    test("did:web", async () => {
+      const did = "did:web:identity.foundation";
+      const result = await dids.resolve(did);
+      expect(result).toHaveProperty("id", did);
+    });
+
+    test("did:plc", async () => {
+      const did = "did:plc:44ybard66vv44zksje25o7dz";
+      const result = await dids.resolve(did);
+      expect(result).toHaveProperty("id", did);
+    });
+  });
+}

package/src/1-services/2-dids.ts

@@ -0,0 +1,30 @@
+import { GraffitiErrorNotFound } from "@graffiti-garden/api";
+import { Resolver, type DIDDocument } from "did-resolver";
+import { getResolver as plcResolver } from "plc-did-resolver";
+import { getResolver as webResolver } from "web-did-resolver";
+
+export class DecentralizedIdentifiers {
+  protected readonly methods = {
+    ...plcResolver(),
+    ...webResolver(),
+  };
+
+  protected readonly resolver = new Resolver(this.methods, { cache: true });
+
+  async resolve(did: string): Promise<DIDDocument> {
+    if (
+      !Object.keys(this.methods).some((method) =>
+        did.startsWith(`did:${method}:`),
+      )
+    ) {
+      throw new Error(`Unrecognized DID method: ${did}`);
+    }
+
+    const { didDocument } = await this.resolver.resolve(did);
+    if (!didDocument) {
+      throw new GraffitiErrorNotFound(`DID not found: ${did}`);
+    }
+
+    return didDocument;
+  }
+}

package/src/1-services/3-storage-buckets-tests.ts

@@ -0,0 +1,121 @@
+import { describe, expect, test } from "vitest";
+import { StorageBuckets } from "./3-storage-buckets";
+import { GraffitiErrorUnauthorized } from "./utilities";
+import { GraffitiErrorNotFound } from "@graffiti-garden/api";
+
+export function storageBucketTests(
+  storageBucketEndpoint: string,
+  storageBucketToken: string,
+) {
+  describe("Storage buckets", async () => {
+    const storageBuckets = new StorageBuckets();
+
+    test("put, get, delete", async () => {
+      const key = Math.random().toString(36).substring(2, 15);
+      const input = "Hello world";
+      const bytes = new TextEncoder().encode(input);
+
+      await expect(
+        storageBuckets.get(storageBucketEndpoint, key),
+      ).rejects.toThrow(GraffitiErrorNotFound);
+
+      await storageBuckets.put(
+        storageBucketEndpoint,
+        key,
+        bytes,
+        storageBucketToken,
+      );
+
+      const resultBytes = await storageBuckets.get(
+        storageBucketEndpoint,
+        key,
+        bytes.length,
+      );
+      const result = new TextDecoder().decode(resultBytes);
+      expect(result).toEqual(input);
+
+      await storageBuckets.delete(
+        storageBucketEndpoint,
+        key,
+        storageBucketToken,
+      );
+
+      await expect(
+        storageBuckets.get(storageBucketEndpoint, key),
+      ).rejects.toThrow(GraffitiErrorNotFound);
+    });
+
+    test("get with limit less than object", async () => {
+      const key = Math.random().toString(36).substring(2, 15);
+      const input = "Hello world";
+      const bytes = new TextEncoder().encode(input);
+
+      await storageBuckets.put(
+        storageBucketEndpoint,
+        key,
+        bytes,
+        storageBucketToken,
+      );
+
+      await expect(
+        storageBuckets.get(storageBucketEndpoint, key, bytes.length - 1),
+      ).rejects.toThrow();
+    });
+
+    test("unauthorized", async () => {
+      const key = Math.random().toString(36).substring(2, 15);
+      const input = "Hello world";
+      const bytes = new TextEncoder().encode(input);
+
+      await expect(
+        storageBuckets.put(storageBucketEndpoint, key, bytes, "invalid-token"),
+      ).rejects.toThrow(GraffitiErrorUnauthorized);
+      await expect(
+        storageBuckets.delete(storageBucketEndpoint, key, "invalid-token"),
+      ).rejects.toThrow(GraffitiErrorUnauthorized);
+      await expect(
+        storageBuckets.export(storageBucketEndpoint, "invalid-token").next(),
+      ).rejects.toThrow(GraffitiErrorUnauthorized);
+    });
+
+    test("export", async () => {
+      // Put a whole bunch of stuff so the export needs to page
+      const keys = new Set<string>();
+      for (let i = 0; i < 256; i++) {
+        const key = Math.random().toString(36).substring(2, 15);
+        keys.add(key);
+
+        const input = "Hello world " + i;
+        const bytes = new TextEncoder().encode(input);
+        await storageBuckets.put(
+          storageBucketEndpoint,
+          key,
+          bytes,
+          storageBucketToken,
+        );
+      }
+
+      // Export
+      const retrievedKeys = new Set<string>();
+      const iterator = storageBuckets.export(
+        storageBucketEndpoint,
+        storageBucketToken,
+      );
+      for await (const result of iterator) {
+        if (keys.has(result.key)) {
+          retrievedKeys.add(result.key);
+        }
+      }
+      expect(retrievedKeys.size).toEqual(keys.size);
+
+      // Delete all the keys
+      for (const key of keys) {
+        await storageBuckets.delete(
+          storageBucketEndpoint,
+          key,
+          storageBucketToken,
+        );
+      }
+    }, 1000000);
+  });
+}