@hatk/hatk 0.0.1-alpha.77 → 0.0.1-alpha.78
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/pds-proxy.d.ts.map +1 -1
- package/dist/pds-proxy.js +27 -2
- package/package.json +1 -1
package/dist/pds-proxy.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"pds-proxy.d.ts","sourceRoot":"","sources":["../src/pds-proxy.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAU9C,qBAAa,UAAW,SAAQ,KAAK;IAE1B,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM;CAIlB;AAED,qBAAa,sBAAuB,SAAQ,UAAU;;CAIrD;
|
|
1
|
+
{"version":3,"file":"pds-proxy.d.ts","sourceRoot":"","sources":["../src/pds-proxy.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAU9C,qBAAa,UAAW,SAAQ,KAAK;IAE1B,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM;CAIlB;AAED,qBAAa,sBAAuB,SAAQ,UAAU;;CAIrD;AAuKD,MAAM,WAAW,cAAc;IAC7B,iEAAiE;IACjE,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;IACvB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAA;IACzE,0CAA0C;IAC1C,IAAI,CAAC,EAAE,OAAO,CAAA;CACf;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,OAAO,CAC3B,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACvB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAoBlC;AAED,wBAAsB,eAAe,CACnC,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACvB,KAAK,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAC3F,OAAO,CAAC;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAwCzC;AAED,wBAAsB,eAAe,CACnC,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACvB,KAAK,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC1C,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAyBlC;AAED,wBAAsB,YAAY,CAChC,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACvB,KAAK,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1F,OAAO,CAAC;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAqCzC;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAChC;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAYD,wBAAsB,cAAc,CAClC,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACvB,KAAK,EAAE;IAAE,MAAM,EAAE,aAAa,EAAE,CAAA;CAAE,GACjC,OAAO,CAAC;IAAE,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAA;CAAE,CAAC,CAgE5C;AAED,wBAAsB,aAAa,CACjC,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACvB,IAAI,EAAE,UAAU,EAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,CAS5B"}
|
package/dist/pds-proxy.js
CHANGED
|
@@ -27,7 +27,7 @@ async function withDpopRetry(oauthConfig, session, doFetch) {
|
|
|
27
27
|
return result;
|
|
28
28
|
let nonce;
|
|
29
29
|
// Step 1: handle DPoP nonce requirement
|
|
30
|
-
if (result
|
|
30
|
+
if (isNonceChallenge(result)) {
|
|
31
31
|
nonce = result.headers.get('DPoP-Nonce') || undefined;
|
|
32
32
|
if (nonce) {
|
|
33
33
|
result = await doFetch(accessToken, nonce);
|
|
@@ -48,7 +48,7 @@ async function withDpopRetry(oauthConfig, session, doFetch) {
|
|
|
48
48
|
result = await doFetch(accessToken, nonce);
|
|
49
49
|
if (result.ok)
|
|
50
50
|
return result;
|
|
51
|
-
if (result
|
|
51
|
+
if (isNonceChallenge(result)) {
|
|
52
52
|
nonce = result.headers.get('DPoP-Nonce') || undefined;
|
|
53
53
|
if (nonce)
|
|
54
54
|
result = await doFetch(accessToken, nonce);
|
|
@@ -71,6 +71,31 @@ async function withDpopRetry(oauthConfig, session, doFetch) {
|
|
|
71
71
|
}
|
|
72
72
|
return result;
|
|
73
73
|
}
|
|
74
|
+
/**
|
|
75
|
+
* Is this refusal a DPoP nonce challenge — a request to retry, not a dead token?
|
|
76
|
+
*
|
|
77
|
+
* A nonce challenge is the one 401 that costs nothing to satisfy: the server
|
|
78
|
+
* hands back the nonce it wants in the same response. Miss it and the failure
|
|
79
|
+
* falls through to the token-error branch below, which refreshes, replays the
|
|
80
|
+
* identical proof, is refused identically, and drops the user's session — a
|
|
81
|
+
* re-authorization to fix a header.
|
|
82
|
+
*
|
|
83
|
+
* So it is read the way RFC 9449 §8 writes it, from
|
|
84
|
+
* `WWW-Authenticate: DPoP error="use_dpop_nonce"`, and only then from the body.
|
|
85
|
+
* The body is not always available to read: zds sends that header but an
|
|
86
|
+
* `InvalidToken` body, because its XRPC error handler overwrites the
|
|
87
|
+
* `UseDpopNonce` one on the way out.
|
|
88
|
+
*
|
|
89
|
+
* The `DPoP-Nonce` header alone is not the signal. A server may attach one to
|
|
90
|
+
* every 401 it sends, including 401s about a genuinely invalid token, and
|
|
91
|
+
* treating those as challenges would replay every dead token once for nothing.
|
|
92
|
+
*/
|
|
93
|
+
function isNonceChallenge(result) {
|
|
94
|
+
const error = result.body.error;
|
|
95
|
+
if (error === 'use_dpop_nonce' || error === 'UseDpopNonce')
|
|
96
|
+
return true;
|
|
97
|
+
return result.status === 401 && (result.headers.get('WWW-Authenticate') ?? '').includes('use_dpop_nonce');
|
|
98
|
+
}
|
|
74
99
|
/**
|
|
75
100
|
* The PDS returns 'InvalidToken' or 'ExpiredToken' (AT Proto PascalCase
|
|
76
101
|
* convention) while the OAuth spec uses 'invalid_token' (RFC 6750 snake_case).
|