@hatk/hatk 0.0.1-alpha.76 → 0.0.1-alpha.77
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/pds-proxy.d.ts.map +1 -1
- package/dist/pds-proxy.js +22 -4
- package/package.json +1 -1
package/dist/pds-proxy.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"pds-proxy.d.ts","sourceRoot":"","sources":["../src/pds-proxy.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAU9C,qBAAa,UAAW,SAAQ,KAAK;IAE1B,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM;CAIlB;AAED,qBAAa,sBAAuB,SAAQ,UAAU;;CAIrD;
|
|
1
|
+
{"version":3,"file":"pds-proxy.d.ts","sourceRoot":"","sources":["../src/pds-proxy.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAU9C,qBAAa,UAAW,SAAQ,KAAK;IAE1B,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM;CAIlB;AAED,qBAAa,sBAAuB,SAAQ,UAAU;;CAIrD;AA8ID,MAAM,WAAW,cAAc;IAC7B,iEAAiE;IACjE,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;IACvB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAA;IACzE,0CAA0C;IAC1C,IAAI,CAAC,EAAE,OAAO,CAAA;CACf;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,OAAO,CAC3B,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACvB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAoBlC;AAED,wBAAsB,eAAe,CACnC,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACvB,KAAK,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAC3F,OAAO,CAAC;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAwCzC;AAED,wBAAsB,eAAe,CACnC,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACvB,KAAK,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC1C,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAyBlC;AAED,wBAAsB,YAAY,CAChC,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACvB,KAAK,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1F,OAAO,CAAC;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAqCzC;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAChC;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAYD,wBAAsB,cAAc,CAClC,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACvB,KAAK,EAAE;IAAE,MAAM,EAAE,aAAa,EAAE,CAAA;CAAE,GACjC,OAAO,CAAC;IAAE,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAA;CAAE,CAAC,CAgE5C;AAED,wBAAsB,aAAa,CACjC,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACvB,IAAI,EAAE,UAAU,EAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,CAS5B"}
|
package/dist/pds-proxy.js
CHANGED
|
@@ -41,10 +41,7 @@ async function withDpopRetry(oauthConfig, session, doFetch) {
|
|
|
41
41
|
throw new ScopeMissingProxyError();
|
|
42
42
|
}
|
|
43
43
|
// Step 3: handle expired PDS token — refresh and retry
|
|
44
|
-
|
|
45
|
-
// while the OAuth spec uses 'invalid_token' (RFC 6750 snake_case)
|
|
46
|
-
const err = result.body.error;
|
|
47
|
-
if (err === 'invalid_token' || err === 'InvalidToken' || err === 'ExpiredToken') {
|
|
44
|
+
if (isTokenError(result.body.error)) {
|
|
48
45
|
const refreshed = await refreshPdsSession(oauthConfig, session);
|
|
49
46
|
if (refreshed) {
|
|
50
47
|
accessToken = refreshed.accessToken;
|
|
@@ -56,10 +53,31 @@ async function withDpopRetry(oauthConfig, session, doFetch) {
|
|
|
56
53
|
if (nonce)
|
|
57
54
|
result = await doFetch(accessToken, nonce);
|
|
58
55
|
}
|
|
56
|
+
// A token minted seconds ago cannot be expired, so a second refusal is
|
|
57
|
+
// about the grant rather than the token: the session was authorized
|
|
58
|
+
// before the app asked for the scope this call needs, and no number of
|
|
59
|
+
// refreshes will add it. Read as a scope problem it becomes the prompt to
|
|
60
|
+
// authorize again; read as expiry it was an opaque 500.
|
|
61
|
+
//
|
|
62
|
+
// Not every PDS names this case. The reference answers ScopeMissingError,
|
|
63
|
+
// handled above; pds.js answers InvalidToken for a scope its permissioned
|
|
64
|
+
// space endpoints refuse, which is indistinguishable from expiry until
|
|
65
|
+
// the refresh rules expiry out.
|
|
66
|
+
if (!result.ok && isTokenError(result.body.error)) {
|
|
67
|
+
await deleteSession(session.did);
|
|
68
|
+
throw new ScopeMissingProxyError();
|
|
69
|
+
}
|
|
59
70
|
}
|
|
60
71
|
}
|
|
61
72
|
return result;
|
|
62
73
|
}
|
|
74
|
+
/**
|
|
75
|
+
* The PDS returns 'InvalidToken' or 'ExpiredToken' (AT Proto PascalCase
|
|
76
|
+
* convention) while the OAuth spec uses 'invalid_token' (RFC 6750 snake_case).
|
|
77
|
+
*/
|
|
78
|
+
function isTokenError(error) {
|
|
79
|
+
return error === 'invalid_token' || error === 'InvalidToken' || error === 'ExpiredToken';
|
|
80
|
+
}
|
|
63
81
|
async function proxyToPds(oauthConfig, session, method, pdsUrl, body) {
|
|
64
82
|
const serverKey = await getServerKey('appview-oauth-key');
|
|
65
83
|
const privateJwk = JSON.parse(serverKey.privateKey);
|