@hatk/hatk 0.0.1-alpha.82 → 0.0.1-alpha.84
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/database/db.d.ts.map +1 -1
- package/dist/database/db.js +15 -0
- package/dist/oauth/db.d.ts +5 -1
- package/dist/oauth/db.d.ts.map +1 -1
- package/dist/oauth/db.js +10 -4
- package/dist/oauth/server.d.ts +1 -0
- package/dist/oauth/server.d.ts.map +1 -1
- package/dist/oauth/server.js +69 -7
- package/dist/oauth/service-describe.d.ts +18 -7
- package/dist/oauth/service-describe.d.ts.map +1 -1
- package/dist/oauth/service-describe.js +52 -5
- package/package.json +1 -1
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/database/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,WAAW,EAAkB,MAAM,aAAa,CAAA;AAC9D,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAA;AAI1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,EAAc,KAAK,UAAU,EAAE,MAAM,cAAc,CAAA;AAM1D,wBAAgB,eAAe,IAAI,YAAY,CAE9C;AACD,wBAAgB,aAAa,IAAI,UAAU,CAE1C;AAED,wBAAgB,aAAa,IAAI,IAAI,CAEpC;AAMD,wBAAsB,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,EAAE,CAAA;CAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAcnG;AAMD,wBAAsB,YAAY,CAChC,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,WAAW,EAAE,EAC3B,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,IAAI,CAAC,
|
|
1
|
+
{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/database/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,WAAW,EAAkB,MAAM,aAAa,CAAA;AAC9D,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAA;AAI1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,EAAc,KAAK,UAAU,EAAE,MAAM,cAAc,CAAA;AAM1D,wBAAgB,eAAe,IAAI,YAAY,CAE9C;AACD,wBAAgB,aAAa,IAAI,UAAU,CAE1C;AAED,wBAAgB,aAAa,IAAI,IAAI,CAEpC;AAMD,wBAAsB,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,EAAE,CAAA;CAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAcnG;AAMD,wBAAsB,YAAY,CAChC,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,WAAW,EAAE,EAC3B,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,IAAI,CAAC,CAiJf;AAED,UAAU,eAAe;IACvB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAA;IACjC,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAoED,wBAAsB,aAAa,CAAC,YAAY,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CA6F3F;AA0CD,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAGnE;AAED,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEzE;AAED,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAGvE;AAED,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,GAAG,CAAC,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAC1E,OAAO,CAAC,IAAI,CAAC,CA0Bf;AAED,0DAA0D;AAC1D,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEjF;AAED,wBAAsB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAGpE;AAED,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAO9G;AAED,wBAAsB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAOlF;AAED,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAG1D;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAG5D;AAED,wBAAsB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE3D;AAED,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAGvE;AAED,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAE3F;AAED,wBAAsB,kBAAkB,CACtC,IAAI,GAAE;IACJ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,CAAC,CAAC,EAAE,MAAM,CAAA;CACN,GACL,OAAO,CAAC;IAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CA8B1C;AAED,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAmB3E;AAED,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAO3E;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAcvE;AAED,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAKhE;AAED,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAI/D;AAED,wBAAsB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAQxF;AAED,wBAAsB,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC,CAiCrD;AAED,wBAAgB,aAAa,CAC3B,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC1B;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,GAAG,EAAE,CAAA;CAAE,CA+BhC;AAED,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC1B,OAAO,CAAC,IAAI,CAAC,CAqGf;AAWD,wBAAsB,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBjF;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAClG,OAAO,CAAC,IAAI,CAAC,CAmBf;AAED,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EAAE,GACb,OAAO,CACR,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAAC,CAC7G,CAqBA;AAED,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAA;IAClB,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAC5B;AAED,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAqN9E;AAuCD,UAAU,SAAS;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;CACvB;AAED,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,SAAc,GACnB,OAAO,CAAC;IAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAoF9C;AAED,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAgCrE;AAED,wBAAsB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAqCzF;AAED,qEAAqE;AACrE,wBAAsB,aAAa,CAAC,CAAC,GAAG,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CASjH;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,aAAa,CACjC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAC9D,OAAO,CAAC;IAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA2H9C;AAGD,wBAAsB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,GAAE,OAAO,EAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAEtF;AAED,wBAAsB,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,GAAE,OAAO,EAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/E;AAED,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAClE,OAAO,CAAC,OAAO,YAAY,EAAE,YAAY,CAAC,CAE5C;AAED,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAErE;AAED,wBAAsB,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOpG;AAED,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EAAE,GACf,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAc9B;AAED,wBAAsB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAKvG;AAED,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EAAE,GACf,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CA6B7B;AAED,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EAAE,GACf,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CASpC;AAED,wBAAsB,eAAe,CACnC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE,GAC7C,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAOxB;AAKD,wBAAgB,cAAc,CAAC,CAAC,EAAE,GAAG,GAAG,GAAG,CAI1C;AAED,wBAAsB,YAAY,CAAC,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAc5G;AAED,wBAAgB,UAAU,CACxB,GAAG,EAAE,GAAG,EACR,SAAS,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAC3C,SAAS,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,GACvD,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,CAiGrB;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAGhE;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CASpF;AAED,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAIlE;AAED,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,GAAE,MAAW,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAKtF;AAED,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOxE;AAED,wBAAsB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAO3E;AAED,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGlE;AAED,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAW9E;AAED,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAOvF;AAED,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAI/E;AAED,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAQ9E;AAED,wBAAsB,YAAY,CAAC,MAAM,EAAE;IACzC,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;CACnB,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC,CAO1B;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE;IACvC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CA8B7C;AAED,wBAAsB,aAAa,CACjC,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,UAAU,GAAG,WAAW,EAChC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAevD;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,MAAM,CAAC,CAK1D"}
|
package/dist/database/db.js
CHANGED
|
@@ -161,6 +161,21 @@ export async function initDatabase(adapter, dbPath, tableSchemas, ddlStatements)
|
|
|
161
161
|
await run(`ALTER TABLE _oauth_sessions ADD COLUMN pds_auth_server TEXT`);
|
|
162
162
|
}
|
|
163
163
|
catch { }
|
|
164
|
+
// Endpoints read from the auth server's metadata document. NULL on rows that
|
|
165
|
+
// predate this, and the OAuth code falls back to the paths it used to
|
|
166
|
+
// hardcode, so sessions authorized before the upgrade still refresh.
|
|
167
|
+
try {
|
|
168
|
+
await run(`ALTER TABLE _oauth_sessions ADD COLUMN pds_token_endpoint TEXT`);
|
|
169
|
+
}
|
|
170
|
+
catch { }
|
|
171
|
+
try {
|
|
172
|
+
await run(`ALTER TABLE _oauth_requests ADD COLUMN pds_authorization_endpoint TEXT`);
|
|
173
|
+
}
|
|
174
|
+
catch { }
|
|
175
|
+
try {
|
|
176
|
+
await run(`ALTER TABLE _oauth_requests ADD COLUMN pds_token_endpoint TEXT`);
|
|
177
|
+
}
|
|
178
|
+
catch { }
|
|
164
179
|
}
|
|
165
180
|
/** Normalize SQL type names to handle dialect differences (e.g. VARCHAR → TEXT) */
|
|
166
181
|
function normalizeType(type) {
|
package/dist/oauth/db.d.ts
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
export declare const OAUTH_DDL = "\nCREATE TABLE IF NOT EXISTS _oauth_keys (\n kid TEXT PRIMARY KEY,\n private_key TEXT NOT NULL,\n public_key TEXT NOT NULL,\n created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP\n);\n\nCREATE TABLE IF NOT EXISTS _oauth_sessions (\n did TEXT PRIMARY KEY,\n pds_endpoint TEXT NOT NULL,\n pds_auth_server TEXT,\n access_token TEXT NOT NULL,\n refresh_token TEXT,\n dpop_jkt TEXT NOT NULL,\n token_expires_at INTEGER,\n created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,\n updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP\n);\n\nCREATE TABLE IF NOT EXISTS _oauth_requests (\n request_uri TEXT PRIMARY KEY,\n client_id TEXT NOT NULL,\n redirect_uri TEXT NOT NULL,\n scope TEXT,\n state TEXT,\n code_challenge TEXT NOT NULL,\n code_challenge_method TEXT NOT NULL DEFAULT 'S256',\n dpop_jkt TEXT NOT NULL,\n pds_request_uri TEXT,\n pds_auth_server TEXT,\n pds_endpoint TEXT,\n pds_code_verifier TEXT,\n pds_state TEXT,\n did TEXT,\n login_hint TEXT,\n expires_at INTEGER NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS _oauth_codes (\n code TEXT PRIMARY KEY,\n request_uri TEXT NOT NULL,\n created_at INTEGER NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS _oauth_refresh_tokens (\n token TEXT PRIMARY KEY,\n client_id TEXT NOT NULL,\n did TEXT NOT NULL,\n dpop_jkt TEXT NOT NULL,\n scope TEXT,\n created_at INTEGER NOT NULL,\n expires_at INTEGER,\n revoked INTEGER NOT NULL DEFAULT 0\n);\n\nCREATE TABLE IF NOT EXISTS _oauth_dpop_jtis (\n jti TEXT PRIMARY KEY,\n expires_at INTEGER NOT NULL\n);\n";
|
|
1
|
+
export declare const OAUTH_DDL = "\nCREATE TABLE IF NOT EXISTS _oauth_keys (\n kid TEXT PRIMARY KEY,\n private_key TEXT NOT NULL,\n public_key TEXT NOT NULL,\n created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP\n);\n\nCREATE TABLE IF NOT EXISTS _oauth_sessions (\n did TEXT PRIMARY KEY,\n pds_endpoint TEXT NOT NULL,\n pds_auth_server TEXT,\n pds_token_endpoint TEXT,\n access_token TEXT NOT NULL,\n refresh_token TEXT,\n dpop_jkt TEXT NOT NULL,\n token_expires_at INTEGER,\n created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,\n updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP\n);\n\nCREATE TABLE IF NOT EXISTS _oauth_requests (\n request_uri TEXT PRIMARY KEY,\n client_id TEXT NOT NULL,\n redirect_uri TEXT NOT NULL,\n scope TEXT,\n state TEXT,\n code_challenge TEXT NOT NULL,\n code_challenge_method TEXT NOT NULL DEFAULT 'S256',\n dpop_jkt TEXT NOT NULL,\n pds_request_uri TEXT,\n pds_auth_server TEXT,\n pds_authorization_endpoint TEXT,\n pds_token_endpoint TEXT,\n pds_endpoint TEXT,\n pds_code_verifier TEXT,\n pds_state TEXT,\n did TEXT,\n login_hint TEXT,\n expires_at INTEGER NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS _oauth_codes (\n code TEXT PRIMARY KEY,\n request_uri TEXT NOT NULL,\n created_at INTEGER NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS _oauth_refresh_tokens (\n token TEXT PRIMARY KEY,\n client_id TEXT NOT NULL,\n did TEXT NOT NULL,\n dpop_jkt TEXT NOT NULL,\n scope TEXT,\n created_at INTEGER NOT NULL,\n expires_at INTEGER,\n revoked INTEGER NOT NULL DEFAULT 0\n);\n\nCREATE TABLE IF NOT EXISTS _oauth_dpop_jtis (\n jti TEXT PRIMARY KEY,\n expires_at INTEGER NOT NULL\n);\n";
|
|
2
2
|
export declare function getServerKey(kid: string): Promise<{
|
|
3
3
|
privateKey: string;
|
|
4
4
|
publicKey: string;
|
|
@@ -14,6 +14,8 @@ export declare function storeOAuthRequest(requestUri: string, data: {
|
|
|
14
14
|
dpopJkt: string;
|
|
15
15
|
pdsRequestUri?: string;
|
|
16
16
|
pdsAuthServer?: string;
|
|
17
|
+
pdsAuthorizationEndpoint?: string;
|
|
18
|
+
pdsTokenEndpoint?: string;
|
|
17
19
|
pdsEndpoint?: string;
|
|
18
20
|
pdsCodeVerifier?: string;
|
|
19
21
|
pdsState?: string;
|
|
@@ -28,6 +30,8 @@ export declare function consumeAuthCode(code: string): Promise<string | null>;
|
|
|
28
30
|
export declare function storeSession(did: string, data: {
|
|
29
31
|
pdsEndpoint: string;
|
|
30
32
|
pdsAuthServer?: string;
|
|
33
|
+
/** From the auth server's metadata, so refreshes don't guess the path. */
|
|
34
|
+
pdsTokenEndpoint?: string;
|
|
31
35
|
accessToken: string;
|
|
32
36
|
refreshToken?: string;
|
|
33
37
|
dpopJkt: string;
|
package/dist/oauth/db.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/oauth/db.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,SAAS,
|
|
1
|
+
{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/oauth/db.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,SAAS,ykDA+DrB,CAAA;AAID,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAOzG;AAED,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMtG;AAID,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE;IACJ,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,aAAa,EAAE,MAAM,CAAA;IACrB,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,aAAa,CAAC,EAAE,MAAM,CAAA;IAItB,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;CAClB,GACA,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED,wBAAsB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAM7E;AAED,wBAAsB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1E;AAID,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMnF;AAED,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAO1E;AAID,wBAAsB,YAAY,CAChC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IACJ,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,OAAO,EAAE,MAAM,CAAA;IACf,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB,GACA,OAAO,CAAC,IAAI,CAAC,CAef;AAED,wBAAsB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAGjE;AAED,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9D;AAID,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IACJ,QAAQ,EAAE,MAAM,CAAA;IAChB,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,GACA,OAAO,CAAC,IAAI,CAAC,CAQf;AAED,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAGxE;AAED,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAErE;AAID,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAK3F;AAED,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC,CAQzD"}
|
package/dist/oauth/db.js
CHANGED
|
@@ -13,6 +13,7 @@ CREATE TABLE IF NOT EXISTS _oauth_sessions (
|
|
|
13
13
|
did TEXT PRIMARY KEY,
|
|
14
14
|
pds_endpoint TEXT NOT NULL,
|
|
15
15
|
pds_auth_server TEXT,
|
|
16
|
+
pds_token_endpoint TEXT,
|
|
16
17
|
access_token TEXT NOT NULL,
|
|
17
18
|
refresh_token TEXT,
|
|
18
19
|
dpop_jkt TEXT NOT NULL,
|
|
@@ -32,6 +33,8 @@ CREATE TABLE IF NOT EXISTS _oauth_requests (
|
|
|
32
33
|
dpop_jkt TEXT NOT NULL,
|
|
33
34
|
pds_request_uri TEXT,
|
|
34
35
|
pds_auth_server TEXT,
|
|
36
|
+
pds_authorization_endpoint TEXT,
|
|
37
|
+
pds_token_endpoint TEXT,
|
|
35
38
|
pds_endpoint TEXT,
|
|
36
39
|
pds_code_verifier TEXT,
|
|
37
40
|
pds_state TEXT,
|
|
@@ -78,8 +81,8 @@ export async function storeServerKey(kid, privateKey, publicKey) {
|
|
|
78
81
|
}
|
|
79
82
|
// --- OAuth Request Storage ---
|
|
80
83
|
export async function storeOAuthRequest(requestUri, data) {
|
|
81
|
-
await runSQL(`INSERT INTO _oauth_requests (request_uri, client_id, redirect_uri, scope, state, code_challenge, code_challenge_method, dpop_jkt, pds_request_uri, pds_auth_server, pds_endpoint, pds_code_verifier, pds_state, did, login_hint, expires_at)
|
|
82
|
-
VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16)`, [
|
|
84
|
+
await runSQL(`INSERT INTO _oauth_requests (request_uri, client_id, redirect_uri, scope, state, code_challenge, code_challenge_method, dpop_jkt, pds_request_uri, pds_auth_server, pds_authorization_endpoint, pds_token_endpoint, pds_endpoint, pds_code_verifier, pds_state, did, login_hint, expires_at)
|
|
85
|
+
VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18)`, [
|
|
83
86
|
requestUri,
|
|
84
87
|
data.clientId,
|
|
85
88
|
data.redirectUri,
|
|
@@ -90,6 +93,8 @@ export async function storeOAuthRequest(requestUri, data) {
|
|
|
90
93
|
data.dpopJkt,
|
|
91
94
|
data.pdsRequestUri || null,
|
|
92
95
|
data.pdsAuthServer || null,
|
|
96
|
+
data.pdsAuthorizationEndpoint || null,
|
|
97
|
+
data.pdsTokenEndpoint || null,
|
|
93
98
|
data.pdsEndpoint || null,
|
|
94
99
|
data.pdsCodeVerifier || null,
|
|
95
100
|
data.pdsState || null,
|
|
@@ -125,11 +130,12 @@ export async function consumeAuthCode(code) {
|
|
|
125
130
|
}
|
|
126
131
|
// --- Sessions ---
|
|
127
132
|
export async function storeSession(did, data) {
|
|
128
|
-
await runSQL(`INSERT OR REPLACE INTO _oauth_sessions (did, pds_endpoint, pds_auth_server, access_token, refresh_token, dpop_jkt, token_expires_at, updated_at)
|
|
129
|
-
VALUES ($1,$2,$3,$4,$5,$6,$7,CURRENT_TIMESTAMP)`, [
|
|
133
|
+
await runSQL(`INSERT OR REPLACE INTO _oauth_sessions (did, pds_endpoint, pds_auth_server, pds_token_endpoint, access_token, refresh_token, dpop_jkt, token_expires_at, updated_at)
|
|
134
|
+
VALUES ($1,$2,$3,$4,$5,$6,$7,$8,CURRENT_TIMESTAMP)`, [
|
|
130
135
|
did,
|
|
131
136
|
data.pdsEndpoint,
|
|
132
137
|
data.pdsAuthServer || null,
|
|
138
|
+
data.pdsTokenEndpoint || null,
|
|
133
139
|
data.accessToken,
|
|
134
140
|
data.refreshToken || null,
|
|
135
141
|
data.dpopJkt,
|
package/dist/oauth/server.d.ts
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/oauth/server.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;
|
|
1
|
+
{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/oauth/server.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAgD/C;;;;;;;GAOG;AACH,qBAAa,UAAW,SAAQ,KAAK;aAEjB,IAAI,EAChB,iBAAiB,GACjB,gBAAgB,GAChB,eAAe,GACf,qBAAqB,GACrB,wBAAwB,GACxB,eAAe;aACH,WAAW,EAAE,MAAM;aACnB,MAAM,EAAE,MAAM;gBARd,IAAI,EAChB,iBAAiB,GACjB,gBAAgB,GAChB,eAAe,GACf,qBAAqB,GACrB,wBAAwB,GACxB,eAAe,EACH,WAAW,EAAE,MAAM,EACnB,MAAM,GAAE,MAAY;CAKvC;AA4FD,wBAAsB,SAAS,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAwCrG;AAID,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW;;;;;;;;;;;;;;;;;;;EAqBxE;AAED,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW;;;;;EAO/E;AAED,wBAAgB,OAAO;;;;;;;;;;;;;;;;;;;;;;EAWtB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED,sFAAsF;AACtF,wBAAgB,aAAa;;;;;;;;;;;;;;;;;;;;;;EAW5B;AA0CD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW;;;;;;;;;;;;;;;;;;;;EAuBpE;AAID;;;;;;;;;;GAUG;AACH,wBAAsB,SAAS,CAC7B,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAwLtD;AAID,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,GAAG,MAAM,CAYhF;AAID;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1C,OAAO,CAAC,MAAM,CAAC,CAuIjB;AAID,wBAAsB,cAAc,CAClC,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,GAAG,EAAE,MAAM,GAAG,IAAI,GACjB,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAmIrG;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,MAAM,EACb,gBAAgB,EAAE,MAAM,GAAG,IAAI,EAC/B,KAAK,EAAE,MAAM,GAAG,IAAI,GACnB,OAAO,CAAC,MAAM,CAAC,CAsBjB;AAID,wBAAsB,WAAW,CAC/B,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,GAAG,CAAC,CAUd;AA4JD,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE;IACP,GAAG,EAAE,MAAM,CAAA;IACX,YAAY,EAAE,MAAM,CAAA;IACpB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;CACjB,GACA,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAoFpF;AAID,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CA0BjC"}
|
package/dist/oauth/server.js
CHANGED
|
@@ -58,6 +58,52 @@ function pdsClientId(issuer, config) {
|
|
|
58
58
|
}
|
|
59
59
|
return `${issuer}/oauth-client-metadata.json`;
|
|
60
60
|
}
|
|
61
|
+
/**
|
|
62
|
+
* The endpoints a remote auth server advertises, taken from its metadata rather
|
|
63
|
+
* than rebuilt from its issuer.
|
|
64
|
+
*
|
|
65
|
+
* RFC 8414 requires `authorization_endpoint` and `token_endpoint` and the
|
|
66
|
+
* atproto OAuth profile requires PAR on top of that, so an auth server is free
|
|
67
|
+
* to serve any of them from a path of its choosing. Concatenating `/oauth/...`
|
|
68
|
+
* onto the issuer only ever worked because bsky.social and the reference PDS
|
|
69
|
+
* happen to use those paths.
|
|
70
|
+
*
|
|
71
|
+
* PAR keeps its legacy fallback: it was already read from metadata, and the
|
|
72
|
+
* fallback is what deployments without it have been relying on.
|
|
73
|
+
*/
|
|
74
|
+
function authServerEndpoints(metadata, authServer) {
|
|
75
|
+
if (!metadata.authorization_endpoint) {
|
|
76
|
+
throw new Error(`Auth server ${authServer} advertises no authorization_endpoint`);
|
|
77
|
+
}
|
|
78
|
+
if (!metadata.token_endpoint) {
|
|
79
|
+
throw new Error(`Auth server ${authServer} advertises no token_endpoint`);
|
|
80
|
+
}
|
|
81
|
+
return {
|
|
82
|
+
authorizationEndpoint: metadata.authorization_endpoint,
|
|
83
|
+
tokenEndpoint: metadata.token_endpoint,
|
|
84
|
+
parEndpoint: metadata.pushed_authorization_request_endpoint || `${authServer}/oauth/par`,
|
|
85
|
+
};
|
|
86
|
+
}
|
|
87
|
+
/**
|
|
88
|
+
* Endpoint stored on a request or session row, falling back to the path this
|
|
89
|
+
* used to hardcode. The fallback is for rows written before those columns
|
|
90
|
+
* existed, not for fresh discovery — a login started after the upgrade always
|
|
91
|
+
* has the advertised endpoint.
|
|
92
|
+
*/
|
|
93
|
+
function storedEndpoint(stored, authServer, legacyPath) {
|
|
94
|
+
return stored || `${authServer}${legacyPath}`;
|
|
95
|
+
}
|
|
96
|
+
/**
|
|
97
|
+
* Append query parameters to an endpoint URL. RFC 6749 §3.1 lets an
|
|
98
|
+
* authorization endpoint carry its own query component, which a bare
|
|
99
|
+
* `${endpoint}?${params}` would corrupt.
|
|
100
|
+
*/
|
|
101
|
+
function withQuery(endpoint, params) {
|
|
102
|
+
const url = new URL(endpoint);
|
|
103
|
+
for (const [key, value] of params)
|
|
104
|
+
url.searchParams.set(key, value);
|
|
105
|
+
return url.toString();
|
|
106
|
+
}
|
|
61
107
|
let serverPrivateJwk;
|
|
62
108
|
let serverPublicJwk;
|
|
63
109
|
let serverPrivateKey;
|
|
@@ -268,6 +314,8 @@ export async function handlePar(config, body, dpopHeader, requestUrl) {
|
|
|
268
314
|
let did = body.login_hint;
|
|
269
315
|
let pdsRequestUri;
|
|
270
316
|
let pdsAuthServer;
|
|
317
|
+
let pdsAuthorizationEndpoint;
|
|
318
|
+
let pdsTokenEndpoint;
|
|
271
319
|
let pdsCodeVerifier;
|
|
272
320
|
let pdsState;
|
|
273
321
|
let pdsEndpoint;
|
|
@@ -306,12 +354,17 @@ export async function handlePar(config, body, dpopHeader, requestUrl) {
|
|
|
306
354
|
}
|
|
307
355
|
if (pdsAuthServer) {
|
|
308
356
|
const authServerMetadata = await fetchAuthServerMetadata(pdsAuthServer);
|
|
357
|
+
const endpoints = authServerEndpoints(authServerMetadata, pdsAuthServer);
|
|
358
|
+
// Held for the authorize redirect and the token exchange, which run on
|
|
359
|
+
// later requests with only this row to go on.
|
|
360
|
+
pdsAuthorizationEndpoint = endpoints.authorizationEndpoint;
|
|
361
|
+
pdsTokenEndpoint = endpoints.tokenEndpoint;
|
|
309
362
|
// Create PKCE for our PAR to the PDS
|
|
310
363
|
pdsCodeVerifier = randomToken();
|
|
311
364
|
const pdsCodeChallenge = base64UrlEncode(await sha256(pdsCodeVerifier));
|
|
312
365
|
pdsState = randomToken(); // unique state to correlate callback
|
|
313
366
|
// PAR to the PDS
|
|
314
|
-
const parEndpoint =
|
|
367
|
+
const parEndpoint = endpoints.parEndpoint;
|
|
315
368
|
const serverDpopProof = await createDpopProof(serverPrivateJwk, serverPublicJwk, 'POST', parEndpoint);
|
|
316
369
|
const pdsScope = await negotiateScope(config, body.scope || 'atproto transition:generic', pdsEndpoint, isLoopbackClient(config.issuer));
|
|
317
370
|
const pdsParParams = {
|
|
@@ -391,6 +444,8 @@ export async function handlePar(config, body, dpopHeader, requestUrl) {
|
|
|
391
444
|
dpopJkt: dpop.jkt,
|
|
392
445
|
pdsRequestUri,
|
|
393
446
|
pdsAuthServer,
|
|
447
|
+
pdsAuthorizationEndpoint,
|
|
448
|
+
pdsTokenEndpoint,
|
|
394
449
|
pdsEndpoint,
|
|
395
450
|
pdsCodeVerifier,
|
|
396
451
|
pdsState,
|
|
@@ -409,7 +464,7 @@ export function buildAuthorizeRedirect(config, request) {
|
|
|
409
464
|
request_uri: request.pds_request_uri,
|
|
410
465
|
client_id: pdsClientId(config.issuer, config),
|
|
411
466
|
});
|
|
412
|
-
return
|
|
467
|
+
return withQuery(storedEndpoint(request.pds_authorization_endpoint, request.pds_auth_server, '/oauth/authorize'), params);
|
|
413
468
|
}
|
|
414
469
|
// --- Server-initiated login (no DPoP required from browser) ---
|
|
415
470
|
/**
|
|
@@ -447,12 +502,13 @@ export async function serverLogin(config, handle, options) {
|
|
|
447
502
|
pdsEndpoint = discovery.pdsEndpoint;
|
|
448
503
|
}
|
|
449
504
|
const authServerMetadata = await fetchAuthServerMetadata(pdsAuthServer);
|
|
505
|
+
const endpoints = authServerEndpoints(authServerMetadata, pdsAuthServer);
|
|
450
506
|
// Create PKCE for PAR to PDS
|
|
451
507
|
const pdsCodeVerifier = randomToken();
|
|
452
508
|
const pdsCodeChallenge = base64UrlEncode(await sha256(pdsCodeVerifier));
|
|
453
509
|
const pdsState = randomToken();
|
|
454
510
|
// PAR to the PDS
|
|
455
|
-
const parEndpoint =
|
|
511
|
+
const parEndpoint = endpoints.parEndpoint;
|
|
456
512
|
const serverDpopProof = await createDpopProof(serverPrivateJwk, serverPublicJwk, 'POST', parEndpoint);
|
|
457
513
|
const scope = await negotiateScope(config, config.scopes?.join(' ') || 'atproto transition:generic', pdsEndpoint, isLoopbackClient(config.issuer));
|
|
458
514
|
const pdsParParams = {
|
|
@@ -517,6 +573,8 @@ export async function serverLogin(config, handle, options) {
|
|
|
517
573
|
dpopJkt: serverJkt,
|
|
518
574
|
pdsRequestUri,
|
|
519
575
|
pdsAuthServer,
|
|
576
|
+
pdsAuthorizationEndpoint: endpoints.authorizationEndpoint,
|
|
577
|
+
pdsTokenEndpoint: endpoints.tokenEndpoint,
|
|
520
578
|
pdsEndpoint,
|
|
521
579
|
pdsCodeVerifier,
|
|
522
580
|
pdsState,
|
|
@@ -529,7 +587,7 @@ export async function serverLogin(config, handle, options) {
|
|
|
529
587
|
request_uri: pdsRequestUri,
|
|
530
588
|
client_id: pdsClientId(config.issuer, config),
|
|
531
589
|
});
|
|
532
|
-
return
|
|
590
|
+
return withQuery(endpoints.authorizationEndpoint, params);
|
|
533
591
|
}
|
|
534
592
|
// --- OAuth Callback (PDS redirects here) ---
|
|
535
593
|
export async function handleCallback(config, code, state, iss) {
|
|
@@ -551,7 +609,7 @@ export async function handleCallback(config, code, state, iss) {
|
|
|
551
609
|
if (!request)
|
|
552
610
|
throw new Error('No matching authorization request found');
|
|
553
611
|
// Exchange code at PDS token endpoint
|
|
554
|
-
const tokenEndpoint =
|
|
612
|
+
const tokenEndpoint = storedEndpoint(request.pds_token_endpoint, request.pds_auth_server, '/oauth/token');
|
|
555
613
|
const serverDpopProof = await createDpopProof(serverPrivateJwk, serverPublicJwk, 'POST', tokenEndpoint);
|
|
556
614
|
const tokenBody = new URLSearchParams(await withClientAuth({
|
|
557
615
|
grant_type: 'authorization_code',
|
|
@@ -612,6 +670,7 @@ export async function handleCallback(config, code, state, iss) {
|
|
|
612
670
|
await storeSession(did, {
|
|
613
671
|
pdsEndpoint: request.pds_endpoint,
|
|
614
672
|
pdsAuthServer: request.pds_auth_server,
|
|
673
|
+
pdsTokenEndpoint: tokenEndpoint,
|
|
615
674
|
accessToken: tokenData.access_token,
|
|
616
675
|
refreshToken: tokenData.refresh_token,
|
|
617
676
|
dpopJkt: serverJkt,
|
|
@@ -804,8 +863,10 @@ async function handleRefreshTokenGrant(config, body, dpopHeader, requestUrl) {
|
|
|
804
863
|
export async function refreshPdsSession(config, session) {
|
|
805
864
|
if (!session.refresh_token)
|
|
806
865
|
return null;
|
|
807
|
-
//
|
|
808
|
-
|
|
866
|
+
// Prefer the endpoint the auth server advertised when this session was
|
|
867
|
+
// authorized. Sessions predating that column fall back to the auth server
|
|
868
|
+
// (or, older still, the PDS) with the path this used to hardcode.
|
|
869
|
+
const tokenEndpoint = storedEndpoint(session.pds_token_endpoint, session.pds_auth_server || session.pds_endpoint, '/oauth/token');
|
|
809
870
|
const clientId = pdsClientId(config.issuer, config);
|
|
810
871
|
const dpopProof = await createDpopProof(serverPrivateJwk, serverPublicJwk, 'POST', tokenEndpoint);
|
|
811
872
|
const body = new URLSearchParams(await withClientAuth({
|
|
@@ -847,6 +908,7 @@ export async function refreshPdsSession(config, session) {
|
|
|
847
908
|
await storeSession(session.did, {
|
|
848
909
|
pdsEndpoint: session.pds_endpoint,
|
|
849
910
|
pdsAuthServer: session.pds_auth_server,
|
|
911
|
+
pdsTokenEndpoint: session.pds_token_endpoint,
|
|
850
912
|
accessToken: tokenData.access_token,
|
|
851
913
|
refreshToken: tokenData.refresh_token || session.refresh_token,
|
|
852
914
|
dpopJkt: session.dpop_jkt,
|
|
@@ -2,20 +2,31 @@
|
|
|
2
2
|
* What a PDS says it serves, and the scopes worth asking it for.
|
|
3
3
|
*
|
|
4
4
|
* `community.lexicon.service.describe` answers with a service's roles and every
|
|
5
|
-
* XRPC method it routes. It is the
|
|
6
|
-
*
|
|
7
|
-
*
|
|
5
|
+
* XRPC method it routes. It is the direct question and the answer to trust when
|
|
6
|
+
* it comes — but it is still a proposal, and implementations exist that serve
|
|
7
|
+
* the features while serving no describe. The reference spaces build of
|
|
8
|
+
* `@atproto/pds` is one: it routes every space method and does not contain the
|
|
9
|
+
* describe NSID at all. Reading its silence as "no optional features" denies it
|
|
10
|
+
* scopes it could honor.
|
|
11
|
+
*
|
|
12
|
+
* So when describe says nothing, the methods a caller actually cares about are
|
|
13
|
+
* probed directly. Calling one and reading the failure cannot tell a missing
|
|
14
|
+
* feature from a broken server *on its own* — but it can against a control: ask
|
|
15
|
+
* for an NSID that certainly does not exist, learn how this server says "no such
|
|
16
|
+
* method", and a different answer for a real method is evidence it has one.
|
|
8
17
|
*
|
|
9
18
|
* Used before pushing an authorization request, so a PDS is asked for a
|
|
10
19
|
* feature's scopes only when it implements the feature.
|
|
11
20
|
*/
|
|
12
21
|
import type { OAuthConfig } from '../config.ts';
|
|
13
22
|
/**
|
|
14
|
-
* Every XRPC method a PDS serves
|
|
15
|
-
*
|
|
16
|
-
*
|
|
23
|
+
* Every XRPC method a PDS serves, as far as it can be established.
|
|
24
|
+
*
|
|
25
|
+
* `candidates` are the methods the caller needs an answer about. They are only
|
|
26
|
+
* used when describe says nothing — an explicit list is always preferred to
|
|
27
|
+
* inference, and a server that answers describe is taken at its word.
|
|
17
28
|
*/
|
|
18
|
-
export declare function describeMethods(pdsEndpoint: string): Promise<Set<string>>;
|
|
29
|
+
export declare function describeMethods(pdsEndpoint: string, candidates?: string[]): Promise<Set<string>>;
|
|
19
30
|
/**
|
|
20
31
|
* The scope string to request from this PDS: `base`, plus any conditional set
|
|
21
32
|
* whose `whenMethod` the server serves.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"service-describe.d.ts","sourceRoot":"","sources":["../../src/oauth/service-describe.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"service-describe.d.ts","sourceRoot":"","sources":["../../src/oauth/service-describe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAkD/C;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,GAAE,MAAM,EAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CA+B1G;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,UAAU,EAAE,OAAO,GAClB,OAAO,CAAC,MAAM,CAAC,CAajB;AAED,+CAA+C;AAC/C,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC"}
|
|
@@ -4,12 +4,53 @@ const PROBE_TIMEOUT_MS = 5000;
|
|
|
4
4
|
const CACHE_TTL_MS = 60 * 60 * 1000;
|
|
5
5
|
/** Answers are a property of the server, so one entry covers every account on it. */
|
|
6
6
|
const cache = new Map();
|
|
7
|
+
/** An NSID no server routes, for learning how one says "no such method". */
|
|
8
|
+
const CONTROL_NSID = 'dev.hatk.unspecced.methodThatDoesNotExist';
|
|
9
|
+
/** How a server answered, as a comparable string: status and error code. */
|
|
10
|
+
async function signature(pdsEndpoint, nsid) {
|
|
11
|
+
try {
|
|
12
|
+
const res = await fetch(`${pdsEndpoint.replace(/\/$/, '')}/xrpc/${nsid}`, {
|
|
13
|
+
headers: { accept: 'application/json' },
|
|
14
|
+
signal: AbortSignal.timeout(PROBE_TIMEOUT_MS),
|
|
15
|
+
});
|
|
16
|
+
const body = (await res.json().catch(() => null));
|
|
17
|
+
return `${res.status}:${body?.error ?? ''}`;
|
|
18
|
+
}
|
|
19
|
+
catch {
|
|
20
|
+
return null;
|
|
21
|
+
}
|
|
22
|
+
}
|
|
7
23
|
/**
|
|
8
|
-
*
|
|
9
|
-
*
|
|
10
|
-
*
|
|
24
|
+
* Which of `candidates` this server appears to route, judged against how it
|
|
25
|
+
* answers for a method that does not exist.
|
|
26
|
+
*
|
|
27
|
+
* Conservative by construction. A server that answers identically either way —
|
|
28
|
+
* bsky.social returns `401 AuthMissing` for both — yields nothing, so a feature
|
|
29
|
+
* it does not have is never claimed. The cost is failing to see support that
|
|
30
|
+
* cannot be distinguished, which is where this started anyway.
|
|
11
31
|
*/
|
|
12
|
-
|
|
32
|
+
async function probeMethods(pdsEndpoint, candidates) {
|
|
33
|
+
const control = await signature(pdsEndpoint, CONTROL_NSID);
|
|
34
|
+
// Unreachable is not evidence about the server, so claim nothing.
|
|
35
|
+
if (control === null)
|
|
36
|
+
return new Set();
|
|
37
|
+
const answers = await Promise.all(candidates.map((n) => signature(pdsEndpoint, n)));
|
|
38
|
+
const found = new Set();
|
|
39
|
+
candidates.forEach((nsid, i) => {
|
|
40
|
+
const a = answers[i];
|
|
41
|
+
if (a !== null && a !== control)
|
|
42
|
+
found.add(nsid);
|
|
43
|
+
});
|
|
44
|
+
return found;
|
|
45
|
+
}
|
|
46
|
+
/**
|
|
47
|
+
* Every XRPC method a PDS serves, as far as it can be established.
|
|
48
|
+
*
|
|
49
|
+
* `candidates` are the methods the caller needs an answer about. They are only
|
|
50
|
+
* used when describe says nothing — an explicit list is always preferred to
|
|
51
|
+
* inference, and a server that answers describe is taken at its word.
|
|
52
|
+
*/
|
|
53
|
+
export async function describeMethods(pdsEndpoint, candidates = []) {
|
|
13
54
|
const cached = cache.get(pdsEndpoint);
|
|
14
55
|
if (cached && cached.expires > Date.now())
|
|
15
56
|
return cached.methods;
|
|
@@ -32,6 +73,12 @@ export async function describeMethods(pdsEndpoint) {
|
|
|
32
73
|
catch {
|
|
33
74
|
methods = new Set();
|
|
34
75
|
}
|
|
76
|
+
// No describe, or one that listed nothing: fall back to asking about the
|
|
77
|
+
// methods this caller actually needs. Only those — a probe per method is a
|
|
78
|
+
// request per method, and the conditional sets name two.
|
|
79
|
+
if (methods.size === 0 && candidates.length > 0) {
|
|
80
|
+
methods = await probeMethods(pdsEndpoint, candidates);
|
|
81
|
+
}
|
|
35
82
|
cache.set(pdsEndpoint, { methods, expires: Date.now() + CACHE_TTL_MS });
|
|
36
83
|
return methods;
|
|
37
84
|
}
|
|
@@ -48,7 +95,7 @@ export async function negotiateScope(config, base, pdsEndpoint, isLoopback) {
|
|
|
48
95
|
const conditional = config.conditionalScopes ?? [];
|
|
49
96
|
if (conditional.length === 0 || !pdsEndpoint || isLoopback)
|
|
50
97
|
return base;
|
|
51
|
-
const methods = await describeMethods(pdsEndpoint);
|
|
98
|
+
const methods = await describeMethods(pdsEndpoint, conditional.map((c) => c.whenMethod));
|
|
52
99
|
const granted = conditional.filter((c) => methods.has(c.whenMethod)).flatMap((c) => c.scopes);
|
|
53
100
|
if (granted.length === 0)
|
|
54
101
|
return base;
|