@onelyid/common 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,54 @@
+import { IncomingMessage } from 'node:http';
+import { Request, Response, NextFunction } from 'express';
+
+declare enum Environment {
+    Prod = "prod",
+    Uat = "uat"
+}
+
+declare function assertPath(path?: string): string;
+declare function assertOrigin(origin?: string): string;
+declare function assertRequestMode(mode?: string): Environment | undefined;
+
+type BaseDomain = {
+  baseDomain: string,
+  isLocalhost?: boolean,
+  isVerified?: boolean,
+}
+
+type AuthOrigin = {
+  authOrigin: string,
+  isLocalhost?: boolean,
+}
+
+declare function getCustomHeaderNames(): {
+    readonly proxyOrigin: "X-Onelyid-Proxy-Origin";
+    readonly requestMode: "X-Onelyid-Request-Mode";
+};
+declare function getAuthClientMountPath(): string;
+declare function getMainAuthDomainsList(): {
+    readonly prod: "atproto.id";
+    readonly uat: "atproto.is";
+};
+declare function getOrigin(req: IncomingMessage): string;
+declare function getHost(req: IncomingMessage): string;
+declare function getHostname(req: IncomingMessage): string;
+declare function isLocalHostname(hostname: string): boolean;
+declare function getMainAuthDomain(req: IncomingMessage): "atproto.id" | "atproto.is";
+declare function getMainAuthDomainVariants(req: IncomingMessage): {
+    mainAuthDomain: "atproto.id" | "atproto.is";
+    isMainAuthDomain: boolean;
+    isMainAuthDomainVariant: boolean;
+};
+declare function getBaseDomain(req: IncomingMessage): BaseDomain | undefined;
+declare function getAuthOrigin(req: Request): AuthOrigin | null;
+
+declare function packState(obj: object): string;
+declare function unpackState(state: string): any;
+
+declare function sealState(obj: object, secretKeyHex32Bytes: string): string;
+declare function openState(sealed: string, secretKeyHex32Bytes: string): any;
+
+declare function authBodyParser(req: Request, res: Response, next: NextFunction): Promise<void>;
+
+export { Environment, assertOrigin, assertPath, assertRequestMode, authBodyParser, getAuthClientMountPath, getAuthOrigin, getBaseDomain, getCustomHeaderNames, getHost, getHostname, getMainAuthDomain, getMainAuthDomainVariants, getMainAuthDomainsList, getOrigin, isLocalHostname, openState, packState, sealState, unpackState };

package/dist/index.js

@@ -0,0 +1,362 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  Environment: () => Environment,
+  assertOrigin: () => assertOrigin,
+  assertPath: () => assertPath,
+  assertRequestMode: () => assertRequestMode,
+  authBodyParser: () => authBodyParser,
+  getAuthClientMountPath: () => getAuthClientMountPath,
+  getAuthOrigin: () => getAuthOrigin,
+  getBaseDomain: () => getBaseDomain,
+  getCustomHeaderNames: () => getCustomHeaderNames,
+  getHost: () => getHost,
+  getHostname: () => getHostname,
+  getMainAuthDomain: () => getMainAuthDomain,
+  getMainAuthDomainVariants: () => getMainAuthDomainVariants,
+  getMainAuthDomainsList: () => getMainAuthDomainsList,
+  getOrigin: () => getOrigin,
+  isLocalHostname: () => isLocalHostname,
+  openState: () => openState,
+  packState: () => packState,
+  sealState: () => sealState,
+  unpackState: () => unpackState
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/const-export.ts
+var Environment = /* @__PURE__ */ ((Environment2) => {
+  Environment2["Prod"] = "prod";
+  Environment2["Uat"] = "uat";
+  return Environment2;
+})(Environment || {});
+
+// src/utils.ts
+function assertPath(path) {
+  let newPath = path ?? "";
+  newPath = newPath.trim();
+  if (!newPath) return newPath;
+  if (!newPath.startsWith("/")) {
+    newPath = `/${newPath}`;
+  }
+  if (newPath.length > 1 && newPath.endsWith("/")) {
+    newPath = newPath.substring(0, newPath.length - 1);
+  }
+  return newPath;
+}
+function assertOrigin(origin) {
+  let newOrigin = origin ?? "";
+  newOrigin = newOrigin.trim();
+  if (!newOrigin) return newOrigin;
+  try {
+    const url = new URL(newOrigin);
+    const parsedOrigin = `${url.protocol}//${url.host}`;
+    if (origin === parsedOrigin) {
+      return parsedOrigin;
+    }
+  } catch (e) {
+  }
+  return "";
+}
+function assertRequestMode(mode) {
+  if (mode === "prod" /* Prod */) {
+    return "prod" /* Prod */;
+  } else if (mode === "uat" /* Uat */) {
+    return "uat" /* Uat */;
+  }
+}
+
+// src/host.ts
+var import_node_net = __toESM(require("net"));
+var import_psl = __toESM(require("psl"));
+
+// src/const.ts
+var AUTH_CLIENT_MOUNT_PATH = "/@onelyid/client";
+var CUSTOM_HEADERS = {
+  proxyOrigin: "X-Onelyid-Proxy-Origin",
+  requestMode: "X-Onelyid-Request-Mode"
+};
+var MAIN_AUTH_DOMAINS = {
+  ["prod" /* Prod */]: "atproto.id",
+  ["uat" /* Uat */]: "atproto.is"
+};
+var VERIFIED_BASE_AUTH_DOMAINS = new Map(Object.entries({
+  "statusphere.dev": "auth.statusphere.dev"
+  // 'statusphere.social': 'auth.statusphere.social',
+}));
+for (const value of Object.values(MAIN_AUTH_DOMAINS)) {
+  VERIFIED_BASE_AUTH_DOMAINS.delete(value);
+}
+
+// src/host.ts
+function getCustomHeaderNames() {
+  return CUSTOM_HEADERS;
+}
+function getAuthClientMountPath() {
+  return AUTH_CLIENT_MOUNT_PATH;
+}
+function getMainAuthDomainsList() {
+  return MAIN_AUTH_DOMAINS;
+}
+function getOrigin(req) {
+  const _req = req;
+  let proxyOrigin = _req.get(CUSTOM_HEADERS.proxyOrigin);
+  proxyOrigin = assertOrigin(proxyOrigin);
+  if (proxyOrigin) {
+    return proxyOrigin;
+  }
+  const host = _req.get("host");
+  const origin = `${_req.protocol}://${host}`;
+  return origin;
+}
+function getHost(req) {
+  return new URL(getOrigin(req)).host;
+}
+function getHostname(req) {
+  return new URL(getOrigin(req)).hostname;
+}
+function isLocalHostname(hostname) {
+  if (!hostname) return false;
+  const host = hostname.toLowerCase();
+  if (host === "localhost") return true;
+  if (host.endsWith(".localhost")) return true;
+  const ipType = import_node_net.default.isIP(host);
+  if (!ipType) return false;
+  if (ipType === 4) {
+    return host.startsWith("127.") || // loopback
+    host.startsWith("10.") || // private
+    host.startsWith("192.168.") || // private
+    /^172\.(1[6-9]|2\d|3[0-1])\./.test(host);
+  }
+  if (ipType === 6) {
+    return host === "::1" || // loopback
+    host.startsWith("fc") || // unique local
+    host.startsWith("fd");
+  }
+  return false;
+}
+function getMainAuthDomain(req) {
+  const _req = req;
+  const requestMode = _req.mode;
+  if (!requestMode) {
+    throw new Error(`Request mode not set! mode: ${requestMode}`);
+  }
+  const mainAuthDomains = getMainAuthDomainsList();
+  const mainAuthDomain = mainAuthDomains[requestMode];
+  if (!mainAuthDomain) {
+    throw new Error(`Unable to resolve mainAuthDomain! mode: ${requestMode}`);
+  }
+  return mainAuthDomain;
+}
+function getMainAuthDomainVariants(req) {
+  const hostname = getHostname(req);
+  const mainAuthDomain = getMainAuthDomain(req);
+  const isMainAuthDomain = hostname === mainAuthDomain;
+  return {
+    mainAuthDomain,
+    isMainAuthDomain,
+    isMainAuthDomainVariant: isMainAuthDomain || hostname.endsWith(`.${mainAuthDomain}`) || mainAuthDomain.endsWith(`.${hostname}`)
+  };
+}
+function getPslBaseAuthDomain(appDomain) {
+  if (!import_psl.default.isValid(appDomain)) {
+    return null;
+  }
+  const appDomainObj = import_psl.default.parse(appDomain);
+  const pslBaseDomain = appDomainObj.domain;
+  if (!pslBaseDomain) {
+    return null;
+  }
+  const authDomain = VERIFIED_BASE_AUTH_DOMAINS.get(pslBaseDomain);
+  if (!authDomain) {
+    return null;
+  }
+  const authDomainObj = import_psl.default.parse(authDomain);
+  if (!authDomainObj.subdomain || authDomainObj.subdomain.includes(".")) {
+    return null;
+  }
+  if (pslBaseDomain === authDomainObj.domain) {
+    return [pslBaseDomain, authDomain];
+  }
+  return null;
+}
+function getDomainConfig(req) {
+  const hostname = getHostname(req);
+  if (!hostname) {
+    return null;
+  }
+  if (isLocalHostname(hostname)) {
+    return { baseDomain: hostname, authOrigin: getOrigin(req), isLocalhost: true };
+  }
+  const { mainAuthDomain, isMainAuthDomain, isMainAuthDomainVariant } = getMainAuthDomainVariants(req);
+  if (isMainAuthDomainVariant) {
+    if (isMainAuthDomain) {
+      const authOrigin = null;
+      return { baseDomain: mainAuthDomain, authOrigin };
+    } else {
+      return null;
+    }
+  }
+  const baseAuthPair = getPslBaseAuthDomain(hostname);
+  if (baseAuthPair) {
+    const [pslBaseDomain, authDomain] = baseAuthPair;
+    return { baseDomain: pslBaseDomain, authOrigin: `https://${authDomain}`, isVerified: true };
+  }
+  return { baseDomain: hostname, authOrigin: `https://${hostname}`, isVerified: false };
+}
+function getBaseDomain(req) {
+  const domainConfig = getDomainConfig(req);
+  if (!domainConfig) return void 0;
+  const { baseDomain, isLocalhost, isVerified } = domainConfig;
+  return { baseDomain, isLocalhost, isVerified };
+}
+function getAuthOrigin(req) {
+  const domainConfig = getDomainConfig(req);
+  if (!domainConfig) return null;
+  const { authOrigin, isLocalhost } = domainConfig;
+  if (!authOrigin) return null;
+  return { authOrigin, isLocalhost };
+}
+
+// src/convert.ts
+function toBase64Url(str) {
+  return Buffer.from(str).toString("base64url");
+}
+function fromBase64Url(b64url) {
+  return Buffer.from(b64url, "base64url").toString();
+}
+function packState(obj) {
+  return toBase64Url(JSON.stringify(obj));
+}
+function unpackState(state) {
+  return JSON.parse(fromBase64Url(state));
+}
+
+// src/crypto.ts
+var import_node_crypto = __toESM(require("crypto"));
+var ALGO = "aes-256-gcm";
+var EXPIRY_DURATION_SEC = 20;
+function sealState(obj, secretKeyHex32Bytes) {
+  if (!obj || !secretKeyHex32Bytes) {
+    const message = "[sealState] Invalid call!";
+    console.error(message, obj, !!secretKeyHex32Bytes);
+    throw new Error(message);
+  }
+  const secret = Buffer.from(secretKeyHex32Bytes, "hex");
+  if (secret.length !== 32) {
+    throw new Error(`[sealState] Invalid secret key length: ${secret.length}`);
+  }
+  const iv = import_node_crypto.default.randomBytes(12);
+  const cipher = import_node_crypto.default.createCipheriv(ALGO, secret, iv);
+  const expiry = Date.now() + EXPIRY_DURATION_SEC * 1e3;
+  const encryptedData = Buffer.concat([
+    cipher.update(JSON.stringify({ ...obj, expiry })),
+    cipher.final()
+  ]);
+  const sealed = Buffer.concat([
+    iv,
+    cipher.getAuthTag(),
+    encryptedData
+  ]);
+  return sealed.toString("base64url");
+}
+function openState(sealed, secretKeyHex32Bytes) {
+  if (!sealed || !secretKeyHex32Bytes) {
+    const message = "[openState] Invalid call!";
+    console.error(message, !!sealed, !!secretKeyHex32Bytes);
+    throw new Error(message);
+  }
+  const secret = Buffer.from(secretKeyHex32Bytes, "hex");
+  if (secret.length !== 32) {
+    throw new Error(`[openState] Invalid secret key length: ${secret.length}`);
+  }
+  const buf = Buffer.from(sealed, "base64url");
+  const iv = buf.subarray(0, 12);
+  const tag = buf.subarray(12, 28);
+  const encryptedData = buf.subarray(28);
+  const decipher = import_node_crypto.default.createDecipheriv(ALGO, secret, iv);
+  decipher.setAuthTag(tag);
+  const decrypted = Buffer.concat([
+    decipher.update(encryptedData),
+    decipher.final()
+  ]);
+  const plaintext = decrypted.toString();
+  const obj = JSON.parse(plaintext);
+  const expiry = obj.expiry;
+  delete obj.expiry;
+  const expiresIn = expiry - Date.now();
+  if (expiresIn > 0) {
+    return obj;
+  }
+  return null;
+}
+
+// src/parser.ts
+var import_express = __toESM(require("express"));
+var jsonParser = import_express.default.json();
+var urlencodedParser = import_express.default.urlencoded({ extended: true });
+async function authBodyParser(req, res, next) {
+  if (req.body !== void 0 || req.readableEnded) {
+    return next();
+  }
+  if (req.is("application/json")) {
+    return jsonParser(req, res, next);
+  }
+  if (req.is("application/x-www-form-urlencoded")) {
+    return urlencodedParser(req, res, next);
+  }
+  next();
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  Environment,
+  assertOrigin,
+  assertPath,
+  assertRequestMode,
+  authBodyParser,
+  getAuthClientMountPath,
+  getAuthOrigin,
+  getBaseDomain,
+  getCustomHeaderNames,
+  getHost,
+  getHostname,
+  getMainAuthDomain,
+  getMainAuthDomainVariants,
+  getMainAuthDomainsList,
+  getOrigin,
+  isLocalHostname,
+  openState,
+  packState,
+  sealState,
+  unpackState
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/const-export.ts","../src/utils.ts","../src/host.ts","../src/const.ts","../src/convert.ts","../src/crypto.ts","../src/parser.ts"],"sourcesContent":["export * from './const-export'\nexport * from './utils'\nexport * from './host'\nexport * from './convert'\nexport * from './crypto'\nexport * from './parser'\n","export enum Environment {\n  Prod = 'prod',\n  Uat = 'uat',\n}\n","import { Environment } from './const-export';\n\nexport function assertPath(path?: string) {\n  let newPath = path ?? '';\n  newPath = newPath.trim();\n  if (!newPath) return newPath;\n\n  if (!newPath.startsWith('/')) {\n    newPath = `/${newPath}`\n  }\n  if (newPath.length > 1 && newPath.endsWith('/')) {\n    newPath = newPath.substring(0, newPath.length-1)\n  }\n  return newPath;\n}\n\nexport function assertOrigin(origin?: string) {\n  let newOrigin = origin ?? '';\n  newOrigin = newOrigin.trim();\n  if (!newOrigin) return newOrigin;\n\n  try {\n    const url = new URL(newOrigin)\n    const parsedOrigin = `${url.protocol}//${url.host}`\n    if (origin === parsedOrigin) {\n      return parsedOrigin\n    }\n  } catch(e) {}\n\n  return '';\n}\n\nexport function assertRequestMode(mode?: string): Environment | undefined {\n  if (mode === Environment.Prod) {\n    return Environment.Prod\n  } else if (mode === Environment.Uat) {\n    return Environment.Uat\n  }\n}\n","import net from 'node:net'\nimport { IncomingMessage } from 'node:http'\nimport type { Request } from 'express'\nimport psl, { type ParsedDomain } from 'psl';\nimport { assertOrigin } from './utils'\nimport { Environment } from './const-export';\nimport { VERIFIED_BASE_AUTH_DOMAINS, AUTH_CLIENT_MOUNT_PATH, MAIN_AUTH_DOMAINS, CUSTOM_HEADERS } from './const'\nimport type { AuthOrigin, BaseDomain, DomainConfig } from './types';\n\nexport function getCustomHeaderNames() {\n  return CUSTOM_HEADERS\n}\n\nexport function getAuthClientMountPath() {\n  return AUTH_CLIENT_MOUNT_PATH\n}\n\nexport function getMainAuthDomainsList() {\n  return MAIN_AUTH_DOMAINS\n}\n\nexport function getOrigin(req: IncomingMessage) {\n  const _req = req as Request;\n\n  let proxyOrigin = _req.get(CUSTOM_HEADERS.proxyOrigin)\n  proxyOrigin = assertOrigin(proxyOrigin)\n  if (proxyOrigin) {\n    return proxyOrigin\n  }\n\n  // const host = req.get('X-Forwarded-Host') || req.get('host')\n  const host = _req.get('host')\n  const origin = `${_req.protocol}://${host}`\n  return origin\n}\n\nexport function getHost(req: IncomingMessage) {\n  return new URL(getOrigin(req)).host\n}\n\nexport function getHostname(req: IncomingMessage) {\n  return new URL(getOrigin(req)).hostname\n}\n\nexport function isLocalHostname(hostname: string): boolean {\n  if (!hostname) return false\n\n  // Normalize\n  const host = hostname.toLowerCase()\n\n  // Obvious local hostnames\n  if (host === \"localhost\") return true\n  if (host.endsWith(\".localhost\")) return true\n\n  // Check if it's an IP address\n  const ipType = net.isIP(host)\n  if (!ipType) return false\n\n  // IPv4\n  if (ipType === 4) {\n    return (\n      host.startsWith(\"127.\") ||        // loopback\n      host.startsWith(\"10.\") ||         // private\n      host.startsWith(\"192.168.\") ||    // private\n      /^172\\.(1[6-9]|2\\d|3[0-1])\\./.test(host) // private\n    )\n  }\n\n  // IPv6\n  if (ipType === 6) {\n    return (\n      host === \"::1\" ||                 // loopback\n      host.startsWith(\"fc\") ||          // unique local\n      host.startsWith(\"fd\")\n    )\n  }\n\n  return false\n}\n\nexport function getMainAuthDomain(req: IncomingMessage) {\n  const _req = req as Request;\n\n  const requestMode = (_req as any).mode as Environment\n  if (!requestMode) {\n    throw new Error(`Request mode not set! mode: ${requestMode}`)\n  }\n  \n  const mainAuthDomains = getMainAuthDomainsList()\n  const mainAuthDomain = mainAuthDomains[requestMode]\n  if (!mainAuthDomain) {\n    throw new Error(`Unable to resolve mainAuthDomain! mode: ${requestMode}`)\n  }\n\n  return mainAuthDomain\n}\n\nexport function getMainAuthDomainVariants(req: IncomingMessage) {\n  const hostname = getHostname(req)\n  const mainAuthDomain = getMainAuthDomain(req)\n  const isMainAuthDomain = hostname === mainAuthDomain\n  return {\n    mainAuthDomain,\n    isMainAuthDomain,\n    isMainAuthDomainVariant: isMainAuthDomain || hostname.endsWith(`.${mainAuthDomain}`) || mainAuthDomain.endsWith(`.${hostname}`),\n  }\n}\n\nfunction getPslBaseAuthDomain(appDomain: string): [string, string] | null {\n  if (!psl.isValid(appDomain)) { return null; }\n\n  const appDomainObj = psl.parse(appDomain) as ParsedDomain\n  const pslBaseDomain = appDomainObj.domain\n  if (!pslBaseDomain) { return null; }\n\n  const authDomain = VERIFIED_BASE_AUTH_DOMAINS.get(pslBaseDomain)\n  if (!authDomain) { return null; }\n\n  const authDomainObj = psl.parse(authDomain) as ParsedDomain\n  if (!authDomainObj.subdomain || authDomainObj.subdomain.includes('.')) {\n    return null\n  }\n\n  if (pslBaseDomain === authDomainObj.domain) {\n    return [pslBaseDomain, authDomain]\n  }\n  return null\n}\n\nfunction getDomainConfig(req: IncomingMessage): DomainConfig | null {\n  const hostname = getHostname(req)\n  if (!hostname) { return null; }\n\n  if (isLocalHostname(hostname)) {\n    return { baseDomain: hostname, authOrigin: getOrigin(req), isLocalhost: true }\n  }\n\n  const { mainAuthDomain, isMainAuthDomain, isMainAuthDomainVariant } = getMainAuthDomainVariants(req)\n  if (isMainAuthDomainVariant) {\n    if (isMainAuthDomain) {\n      // const authOrigin = `https://${mainAuthDomain}`\n      const authOrigin = null; // NOTE: Currently, no need to return auth origin for `mainAuthDomain`\n      return { baseDomain: mainAuthDomain, authOrigin };\n    } else {\n      return null;\n    }\n  }\n\n  const baseAuthPair = getPslBaseAuthDomain(hostname)\n  if (baseAuthPair) {\n    const [pslBaseDomain, authDomain] = baseAuthPair\n    return { baseDomain: pslBaseDomain, authOrigin: `https://${authDomain}`, isVerified: true }\n  }\n\n  return { baseDomain: hostname, authOrigin: `https://${hostname}`, isVerified: false }\n}\n\nexport function getBaseDomain(req: IncomingMessage): BaseDomain | undefined {\n  const domainConfig = getDomainConfig(req)\n  if (!domainConfig) return undefined\n\n  const { baseDomain, isLocalhost, isVerified } = domainConfig\n  return { baseDomain, isLocalhost, isVerified }\n}\n\nexport function getAuthOrigin(req: Request): AuthOrigin | null {\n  const domainConfig = getDomainConfig(req)\n  if (!domainConfig) return null\n\n  const { authOrigin, isLocalhost } = domainConfig\n  if (!authOrigin) return null\n\n  return { authOrigin, isLocalhost }\n}\n","import { Environment } from './const-export';\n\nexport const AUTH_CLIENT_MOUNT_PATH = '/@onelyid/client'\n\nexport const CUSTOM_HEADERS = {\n  proxyOrigin: 'X-Onelyid-Proxy-Origin',\n  requestMode: 'X-Onelyid-Request-Mode',\n} as const\n\nexport const MAIN_AUTH_DOMAINS = {\n  [Environment.Prod]: 'atproto.id',\n  [Environment.Uat]: 'atproto.is',\n} as const\n\nexport const VERIFIED_BASE_AUTH_DOMAINS = new Map<string, string>(Object.entries({\n  'statusphere.dev': 'auth.statusphere.dev',\n  // 'statusphere.social': 'auth.statusphere.social',\n}));\nfor (const value of Object.values(MAIN_AUTH_DOMAINS)) {\n  VERIFIED_BASE_AUTH_DOMAINS.delete(value)\n}\n","function toBase64Url(str: string) {\n  return Buffer.from(str).toString('base64url');\n\n  // return Buffer.from(str)\n  //   .toString('base64')\n  //   .replace(/\\+/g, '-')\n  //   .replace(/\\//g, '_')\n  //   .replace(/=+$/, '');\n}\n\nfunction fromBase64Url(b64url: string) {\n  return Buffer.from(b64url, 'base64url').toString();\n\n  // b64url = b64url.replace(/-/g, '+').replace(/_/g, '/');\n  // while (b64url.length % 4) b64url += '=';\n  // return Buffer.from(b64url, 'base64').toString();\n}\n\nexport function packState(obj: object) {\n  return toBase64Url(JSON.stringify(obj))\n}\n\nexport function unpackState(state: string) {\n  return JSON.parse(fromBase64Url(state))\n}\n","import crypto from 'node:crypto';\n\nconst ALGO = 'aes-256-gcm'\nconst EXPIRY_DURATION_SEC = 20\n\n// secret key must be exactly 32 bytes (256 bits)\n// `openssl rand -hex 32`\nexport function sealState(obj: object, secretKeyHex32Bytes: string) {\n  if (!obj || !secretKeyHex32Bytes) {\n    const message = '[sealState] Invalid call!'\n    console.error(message, obj, !!secretKeyHex32Bytes);\n    throw new Error(message)\n  }\n\n  const secret = Buffer.from(secretKeyHex32Bytes, 'hex');\n  if (secret.length !== 32) {\n    throw new Error(`[sealState] Invalid secret key length: ${secret.length}`)\n  }\n\n  const iv = crypto.randomBytes(12);\n  const cipher = crypto.createCipheriv(ALGO, secret, iv);\n\n  const expiry = Date.now() + EXPIRY_DURATION_SEC * 1000;\n  const encryptedData = Buffer.concat([\n    cipher.update(JSON.stringify({ ...obj, expiry })),\n    cipher.final()\n  ]);\n\n  const sealed = Buffer.concat([\n    iv,\n    cipher.getAuthTag(),\n    encryptedData\n  ]);\n\n  return sealed.toString('base64url');\n}\n\n// secret key must be exactly 32 bytes (256 bits)\n// `openssl rand -hex 32`\nexport function openState(sealed: string, secretKeyHex32Bytes: string) {\n  if (!sealed || !secretKeyHex32Bytes) {\n    const message = '[openState] Invalid call!'\n    console.error(message, !!sealed, !!secretKeyHex32Bytes);\n    throw new Error(message)\n  }\n\n  const secret = Buffer.from(secretKeyHex32Bytes, 'hex');\n  if (secret.length !== 32) {\n    throw new Error(`[openState] Invalid secret key length: ${secret.length}`)\n  }\n\n  const buf = Buffer.from(sealed, 'base64url');\n\n  const iv = buf.subarray(0, 12);\n  const tag = buf.subarray(12, 28);\n  const encryptedData = buf.subarray(28);\n\n  const decipher = crypto.createDecipheriv(ALGO, secret, iv);\n  decipher.setAuthTag(tag);\n\n  const decrypted = Buffer.concat([\n    decipher.update(encryptedData),\n    decipher.final()\n  ]);\n  const plaintext = decrypted.toString();\n\n  const obj = JSON.parse(plaintext);\n  const expiry = obj.expiry;\n  delete obj.expiry;\n\n  const expiresIn = expiry - Date.now()\n  if (expiresIn > 0) {\n    return obj;\n  }\n  return null;\n}\n","import express from 'express'\nimport type { Request, Response, NextFunction } from 'express'\n\nconst jsonParser = express.json();\nconst urlencodedParser = express.urlencoded({ extended: true });\n\nexport async function authBodyParser(req: Request, res: Response, next: NextFunction) {\n  if (req.body !== undefined || req.readableEnded) {\n    return next();\n  }\n\n  if (req.is('application/json')) {\n    return jsonParser(req, res, next);\n  }\n\n  if (req.is('application/x-www-form-urlencoded')) {\n    return urlencodedParser(req, res, next);\n  }\n\n  next();\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAO,IAAK,cAAL,kBAAKA,iBAAL;AACL,EAAAA,aAAA,UAAO;AACP,EAAAA,aAAA,SAAM;AAFI,SAAAA;AAAA,GAAA;;;ACEL,SAAS,WAAW,MAAe;AACxC,MAAI,UAAU,QAAQ;AACtB,YAAU,QAAQ,KAAK;AACvB,MAAI,CAAC,QAAS,QAAO;AAErB,MAAI,CAAC,QAAQ,WAAW,GAAG,GAAG;AAC5B,cAAU,IAAI,OAAO;AAAA,EACvB;AACA,MAAI,QAAQ,SAAS,KAAK,QAAQ,SAAS,GAAG,GAAG;AAC/C,cAAU,QAAQ,UAAU,GAAG,QAAQ,SAAO,CAAC;AAAA,EACjD;AACA,SAAO;AACT;AAEO,SAAS,aAAa,QAAiB;AAC5C,MAAI,YAAY,UAAU;AAC1B,cAAY,UAAU,KAAK;AAC3B,MAAI,CAAC,UAAW,QAAO;AAEvB,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,SAAS;AAC7B,UAAM,eAAe,GAAG,IAAI,QAAQ,KAAK,IAAI,IAAI;AACjD,QAAI,WAAW,cAAc;AAC3B,aAAO;AAAA,IACT;AAAA,EACF,SAAQ,GAAG;AAAA,EAAC;AAEZ,SAAO;AACT;AAEO,SAAS,kBAAkB,MAAwC;AACxE,MAAI,4BAA2B;AAC7B;AAAA,EACF,WAAW,0BAA0B;AACnC;AAAA,EACF;AACF;;;ACtCA,sBAAgB;AAGhB,iBAAuC;;;ACDhC,IAAM,yBAAyB;AAE/B,IAAM,iBAAiB;AAAA,EAC5B,aAAa;AAAA,EACb,aAAa;AACf;AAEO,IAAM,oBAAoB;AAAA,EAC/B,kBAAiB,GAAG;AAAA,EACpB,gBAAgB,GAAG;AACrB;AAEO,IAAM,6BAA6B,IAAI,IAAoB,OAAO,QAAQ;AAAA,EAC/E,mBAAmB;AAAA;AAErB,CAAC,CAAC;AACF,WAAW,SAAS,OAAO,OAAO,iBAAiB,GAAG;AACpD,6BAA2B,OAAO,KAAK;AACzC;;;ADXO,SAAS,uBAAuB;AACrC,SAAO;AACT;AAEO,SAAS,yBAAyB;AACvC,SAAO;AACT;AAEO,SAAS,yBAAyB;AACvC,SAAO;AACT;AAEO,SAAS,UAAU,KAAsB;AAC9C,QAAM,OAAO;AAEb,MAAI,cAAc,KAAK,IAAI,eAAe,WAAW;AACrD,gBAAc,aAAa,WAAW;AACtC,MAAI,aAAa;AACf,WAAO;AAAA,EACT;AAGA,QAAM,OAAO,KAAK,IAAI,MAAM;AAC5B,QAAM,SAAS,GAAG,KAAK,QAAQ,MAAM,IAAI;AACzC,SAAO;AACT;AAEO,SAAS,QAAQ,KAAsB;AAC5C,SAAO,IAAI,IAAI,UAAU,GAAG,CAAC,EAAE;AACjC;AAEO,SAAS,YAAY,KAAsB;AAChD,SAAO,IAAI,IAAI,UAAU,GAAG,CAAC,EAAE;AACjC;AAEO,SAAS,gBAAgB,UAA2B;AACzD,MAAI,CAAC,SAAU,QAAO;AAGtB,QAAM,OAAO,SAAS,YAAY;AAGlC,MAAI,SAAS,YAAa,QAAO;AACjC,MAAI,KAAK,SAAS,YAAY,EAAG,QAAO;AAGxC,QAAM,SAAS,gBAAAC,QAAI,KAAK,IAAI;AAC5B,MAAI,CAAC,OAAQ,QAAO;AAGpB,MAAI,WAAW,GAAG;AAChB,WACE,KAAK,WAAW,MAAM;AAAA,IACtB,KAAK,WAAW,KAAK;AAAA,IACrB,KAAK,WAAW,UAAU;AAAA,IAC1B,8BAA8B,KAAK,IAAI;AAAA,EAE3C;AAGA,MAAI,WAAW,GAAG;AAChB,WACE,SAAS;AAAA,IACT,KAAK,WAAW,IAAI;AAAA,IACpB,KAAK,WAAW,IAAI;AAAA,EAExB;AAEA,SAAO;AACT;AAEO,SAAS,kBAAkB,KAAsB;AACtD,QAAM,OAAO;AAEb,QAAM,cAAe,KAAa;AAClC,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI,MAAM,+BAA+B,WAAW,EAAE;AAAA,EAC9D;AAEA,QAAM,kBAAkB,uBAAuB;AAC/C,QAAM,iBAAiB,gBAAgB,WAAW;AAClD,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,MAAM,2CAA2C,WAAW,EAAE;AAAA,EAC1E;AAEA,SAAO;AACT;AAEO,SAAS,0BAA0B,KAAsB;AAC9D,QAAM,WAAW,YAAY,GAAG;AAChC,QAAM,iBAAiB,kBAAkB,GAAG;AAC5C,QAAM,mBAAmB,aAAa;AACtC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,yBAAyB,oBAAoB,SAAS,SAAS,IAAI,cAAc,EAAE,KAAK,eAAe,SAAS,IAAI,QAAQ,EAAE;AAAA,EAChI;AACF;AAEA,SAAS,qBAAqB,WAA4C;AACxE,MAAI,CAAC,WAAAC,QAAI,QAAQ,SAAS,GAAG;AAAE,WAAO;AAAA,EAAM;AAE5C,QAAM,eAAe,WAAAA,QAAI,MAAM,SAAS;AACxC,QAAM,gBAAgB,aAAa;AACnC,MAAI,CAAC,eAAe;AAAE,WAAO;AAAA,EAAM;AAEnC,QAAM,aAAa,2BAA2B,IAAI,aAAa;AAC/D,MAAI,CAAC,YAAY;AAAE,WAAO;AAAA,EAAM;AAEhC,QAAM,gBAAgB,WAAAA,QAAI,MAAM,UAAU;AAC1C,MAAI,CAAC,cAAc,aAAa,cAAc,UAAU,SAAS,GAAG,GAAG;AACrE,WAAO;AAAA,EACT;AAEA,MAAI,kBAAkB,cAAc,QAAQ;AAC1C,WAAO,CAAC,eAAe,UAAU;AAAA,EACnC;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,KAA2C;AAClE,QAAM,WAAW,YAAY,GAAG;AAChC,MAAI,CAAC,UAAU;AAAE,WAAO;AAAA,EAAM;AAE9B,MAAI,gBAAgB,QAAQ,GAAG;AAC7B,WAAO,EAAE,YAAY,UAAU,YAAY,UAAU,GAAG,GAAG,aAAa,KAAK;AAAA,EAC/E;AAEA,QAAM,EAAE,gBAAgB,kBAAkB,wBAAwB,IAAI,0BAA0B,GAAG;AACnG,MAAI,yBAAyB;AAC3B,QAAI,kBAAkB;AAEpB,YAAM,aAAa;AACnB,aAAO,EAAE,YAAY,gBAAgB,WAAW;AAAA,IAClD,OAAO;AACL,aAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,eAAe,qBAAqB,QAAQ;AAClD,MAAI,cAAc;AAChB,UAAM,CAAC,eAAe,UAAU,IAAI;AACpC,WAAO,EAAE,YAAY,eAAe,YAAY,WAAW,UAAU,IAAI,YAAY,KAAK;AAAA,EAC5F;AAEA,SAAO,EAAE,YAAY,UAAU,YAAY,WAAW,QAAQ,IAAI,YAAY,MAAM;AACtF;AAEO,SAAS,cAAc,KAA8C;AAC1E,QAAM,eAAe,gBAAgB,GAAG;AACxC,MAAI,CAAC,aAAc,QAAO;AAE1B,QAAM,EAAE,YAAY,aAAa,WAAW,IAAI;AAChD,SAAO,EAAE,YAAY,aAAa,WAAW;AAC/C;AAEO,SAAS,cAAc,KAAiC;AAC7D,QAAM,eAAe,gBAAgB,GAAG;AACxC,MAAI,CAAC,aAAc,QAAO;AAE1B,QAAM,EAAE,YAAY,YAAY,IAAI;AACpC,MAAI,CAAC,WAAY,QAAO;AAExB,SAAO,EAAE,YAAY,YAAY;AACnC;;;AE7KA,SAAS,YAAY,KAAa;AAChC,SAAO,OAAO,KAAK,GAAG,EAAE,SAAS,WAAW;AAO9C;AAEA,SAAS,cAAc,QAAgB;AACrC,SAAO,OAAO,KAAK,QAAQ,WAAW,EAAE,SAAS;AAKnD;AAEO,SAAS,UAAU,KAAa;AACrC,SAAO,YAAY,KAAK,UAAU,GAAG,CAAC;AACxC;AAEO,SAAS,YAAY,OAAe;AACzC,SAAO,KAAK,MAAM,cAAc,KAAK,CAAC;AACxC;;;ACxBA,yBAAmB;AAEnB,IAAM,OAAO;AACb,IAAM,sBAAsB;AAIrB,SAAS,UAAU,KAAa,qBAA6B;AAClE,MAAI,CAAC,OAAO,CAAC,qBAAqB;AAChC,UAAM,UAAU;AAChB,YAAQ,MAAM,SAAS,KAAK,CAAC,CAAC,mBAAmB;AACjD,UAAM,IAAI,MAAM,OAAO;AAAA,EACzB;AAEA,QAAM,SAAS,OAAO,KAAK,qBAAqB,KAAK;AACrD,MAAI,OAAO,WAAW,IAAI;AACxB,UAAM,IAAI,MAAM,0CAA0C,OAAO,MAAM,EAAE;AAAA,EAC3E;AAEA,QAAM,KAAK,mBAAAC,QAAO,YAAY,EAAE;AAChC,QAAM,SAAS,mBAAAA,QAAO,eAAe,MAAM,QAAQ,EAAE;AAErD,QAAM,SAAS,KAAK,IAAI,IAAI,sBAAsB;AAClD,QAAM,gBAAgB,OAAO,OAAO;AAAA,IAClC,OAAO,OAAO,KAAK,UAAU,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC;AAAA,IAChD,OAAO,MAAM;AAAA,EACf,CAAC;AAED,QAAM,SAAS,OAAO,OAAO;AAAA,IAC3B;AAAA,IACA,OAAO,WAAW;AAAA,IAClB;AAAA,EACF,CAAC;AAED,SAAO,OAAO,SAAS,WAAW;AACpC;AAIO,SAAS,UAAU,QAAgB,qBAA6B;AACrE,MAAI,CAAC,UAAU,CAAC,qBAAqB;AACnC,UAAM,UAAU;AAChB,YAAQ,MAAM,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,mBAAmB;AACtD,UAAM,IAAI,MAAM,OAAO;AAAA,EACzB;AAEA,QAAM,SAAS,OAAO,KAAK,qBAAqB,KAAK;AACrD,MAAI,OAAO,WAAW,IAAI;AACxB,UAAM,IAAI,MAAM,0CAA0C,OAAO,MAAM,EAAE;AAAA,EAC3E;AAEA,QAAM,MAAM,OAAO,KAAK,QAAQ,WAAW;AAE3C,QAAM,KAAK,IAAI,SAAS,GAAG,EAAE;AAC7B,QAAM,MAAM,IAAI,SAAS,IAAI,EAAE;AAC/B,QAAM,gBAAgB,IAAI,SAAS,EAAE;AAErC,QAAM,WAAW,mBAAAA,QAAO,iBAAiB,MAAM,QAAQ,EAAE;AACzD,WAAS,WAAW,GAAG;AAEvB,QAAM,YAAY,OAAO,OAAO;AAAA,IAC9B,SAAS,OAAO,aAAa;AAAA,IAC7B,SAAS,MAAM;AAAA,EACjB,CAAC;AACD,QAAM,YAAY,UAAU,SAAS;AAErC,QAAM,MAAM,KAAK,MAAM,SAAS;AAChC,QAAM,SAAS,IAAI;AACnB,SAAO,IAAI;AAEX,QAAM,YAAY,SAAS,KAAK,IAAI;AACpC,MAAI,YAAY,GAAG;AACjB,WAAO;AAAA,EACT;AACA,SAAO;AACT;;;AC3EA,qBAAoB;AAGpB,IAAM,aAAa,eAAAC,QAAQ,KAAK;AAChC,IAAM,mBAAmB,eAAAA,QAAQ,WAAW,EAAE,UAAU,KAAK,CAAC;AAE9D,eAAsB,eAAe,KAAc,KAAe,MAAoB;AACpF,MAAI,IAAI,SAAS,UAAa,IAAI,eAAe;AAC/C,WAAO,KAAK;AAAA,EACd;AAEA,MAAI,IAAI,GAAG,kBAAkB,GAAG;AAC9B,WAAO,WAAW,KAAK,KAAK,IAAI;AAAA,EAClC;AAEA,MAAI,IAAI,GAAG,mCAAmC,GAAG;AAC/C,WAAO,iBAAiB,KAAK,KAAK,IAAI;AAAA,EACxC;AAEA,OAAK;AACP;","names":["Environment","net","psl","crypto","express"]}

package/package.json

@@ -0,0 +1,58 @@
+{
+  "name": "@onelyid/common",
+  "version": "0.1.0",
+  "description": "ATProto OAuth provider",
+  "author": "abraj",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "type": "commonjs",
+  "files": [
+    "dist"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/baadal/onelyid.git"
+  },
+  "keywords": [
+    "onelyid",
+    "atproto",
+    "login",
+    "auth",
+    "authentication",
+    "express",
+    "bluesky",
+    "oauth",
+    "oauth2",
+    "server",
+    "node",
+    "backend"
+  ],
+  "dependencies": {
+    "psl": "^1.15.0"
+  },
+  "peerDependencies": {
+    "express": "^4.17.2"
+  },
+  "devDependencies": {
+    "@types/express": "^4.17.13",
+    "express": "^4.17.2"
+  },
+  "tsup": {
+    "entry": [
+      "src/index.ts"
+    ],
+    "splitting": false,
+    "sourcemap": true,
+    "clean": true
+  },
+  "scripts": {
+    "tsc": "tsc -b",
+    "build": "tsup --dts",
+    "build:server": "tsup",
+    "clean": "rm -rf node_modules dist tsconfig.tsbuildinfo"
+  }
+}