@openverifiable/connector-bluesky 1.0.0 → 1.0.2

package/lib/client-assertion.js

@@ -1,50 +0,0 @@
-/**
- * Client Assertion Generation for private_key_jwt
- *
- * Generates JWT client assertion for OAuth token endpoint authentication
- * RFC 7523: https://datatracker.ietf.org/doc/html/rfc7523
- */
-import { SignJWT, importJWK } from 'jose';
-import { randomBytes } from 'crypto';
-/**
- * Generate client assertion JWT
- *
- * Note: This requires access to the private key, which should be:
- * 1. Stored in Logto connector config (encrypted by Logto), OR
- * 2. Retrieved from a secure server endpoint
- *
- * For now, we'll support both approaches - if privateKeyJwk is in config, use it.
- * Otherwise, the server should provide an endpoint to generate assertions.
- */
-export async function generateClientAssertion(clientId, tokenEndpoint, config) {
-    // Check if private key is available in config (for server-side connectors)
-    // In production, this would come from Vault via a server endpoint
-    const privateKeyJwkStr = config.privateKeyJwk;
-    if (!privateKeyJwkStr) {
-        // Private key not in config - would need to call server endpoint
-        // For now, return null to indicate assertion generation failed
-        return null;
-    }
-    try {
-        const privateKeyJwk = JSON.parse(privateKeyJwkStr);
-        const privateKey = await importJWK(privateKeyJwk, 'ES256');
-        const now = Math.floor(Date.now() / 1000);
-        const jti = randomBytes(16).toString('base64url');
-        const jwt = new SignJWT({
-            iss: clientId,
-            sub: clientId,
-            aud: tokenEndpoint,
-            jti,
-            exp: now + 600,
-            iat: now,
-        })
-            .setProtectedHeader({
-            alg: 'ES256',
-            typ: 'JWT',
-        });
-        return await jwt.sign(privateKey);
-    }
-    catch (error) {
-        throw new Error(`Failed to generate client assertion: ${error instanceof Error ? error.message : 'Unknown error'}`);
-    }
-}

package/lib/client-assertion.test.js

@@ -1,234 +0,0 @@
-/**
- * Client Assertion Tests
- * Tests for JWT client assertion generation (RFC 7523)
- */
-import { describe, it, expect } from '@jest/globals';
-import { jwtVerify } from 'jose';
-import { generateClientAssertion } from './client-assertion.js';
-import { generateTestKeyPair, exportPublicKeyAsJWK } from './test-utils.js';
-describe('Client Assertion Generation', () => {
-    describe('generateClientAssertion', () => {
-        it('should generate valid JWT client assertion', async () => {
-            const keyPair = await generateTestKeyPair();
-            const privateKeyJwk = await exportPublicKeyAsJWK(keyPair.privateKey);
-            // Add private key fields for signing
-            const crypto = globalThis.crypto;
-            const fullPrivateKeyJwk = await crypto.subtle.exportKey('jwk', keyPair.privateKey);
-            const config = {
-                clientMetadataUri: 'https://app.example.com/oauth/client-metadata.json',
-                clientId: 'https://app.example.com/client-id',
-                jwksUri: 'https://app.example.com/.well-known/jwks.json',
-                scope: 'atproto transition:generic',
-                tokenEndpointAuthMethod: 'private_key_jwt',
-                privateKeyJwk: JSON.stringify(fullPrivateKeyJwk),
-            };
-            const assertion = await generateClientAssertion(config.clientId, 'https://bsky.social/oauth/token', config);
-            expect(assertion).toBeDefined();
-            expect(typeof assertion).toBe('string');
-        });
-        it('should include required JWT header fields', async () => {
-            const keyPair = await generateTestKeyPair();
-            const crypto = globalThis.crypto;
-            const fullPrivateKeyJwk = await crypto.subtle.exportKey('jwk', keyPair.privateKey);
-            const config = {
-                clientMetadataUri: 'https://app.example.com/oauth/client-metadata.json',
-                clientId: 'https://app.example.com/client-id',
-                jwksUri: 'https://app.example.com/.well-known/jwks.json',
-                scope: 'atproto transition:generic',
-                tokenEndpointAuthMethod: 'private_key_jwt',
-                privateKeyJwk: JSON.stringify(fullPrivateKeyJwk),
-            };
-            const assertion = await generateClientAssertion(config.clientId, 'https://bsky.social/oauth/token', config);
-            expect(assertion).not.toBeNull();
-            if (assertion) {
-                const parts = assertion.split('.');
-                const header = JSON.parse(Buffer.from(parts[0], 'base64url').toString());
-                expect(header.alg).toBe('ES256');
-                expect(header.typ).toBe('JWT');
-            }
-        });
-        it('should include required JWT payload fields', async () => {
-            const keyPair = await generateTestKeyPair();
-            const crypto = globalThis.crypto;
-            const fullPrivateKeyJwk = await crypto.subtle.exportKey('jwk', keyPair.privateKey);
-            const clientId = 'https://app.example.com/client-id';
-            const tokenEndpoint = 'https://bsky.social/oauth/token';
-            const config = {
-                clientMetadataUri: 'https://app.example.com/oauth/client-metadata.json',
-                clientId,
-                jwksUri: 'https://app.example.com/.well-known/jwks.json',
-                scope: 'atproto transition:generic',
-                tokenEndpointAuthMethod: 'private_key_jwt',
-                privateKeyJwk: JSON.stringify(fullPrivateKeyJwk),
-            };
-            const assertion = await generateClientAssertion(clientId, tokenEndpoint, config);
-            expect(assertion).not.toBeNull();
-            if (assertion) {
-                const parts = assertion.split('.');
-                const decoded = JSON.parse(Buffer.from(parts[1], 'base64url').toString());
-                expect(decoded.iss).toBe(clientId);
-                expect(decoded.sub).toBe(clientId);
-                expect(decoded.aud).toBe(tokenEndpoint);
-                expect(decoded.jti).toBeDefined();
-                expect(decoded.iat).toBeDefined();
-                expect(decoded.exp).toBeDefined();
-            }
-        });
-        it('should sign assertion with ES256 algorithm', async () => {
-            const keyPair = await generateTestKeyPair();
-            const crypto = globalThis.crypto;
-            const fullPrivateKeyJwk = await crypto.subtle.exportKey('jwk', keyPair.privateKey);
-            const config = {
-                clientMetadataUri: 'https://app.example.com/oauth/client-metadata.json',
-                clientId: 'https://app.example.com/client-id',
-                jwksUri: 'https://app.example.com/.well-known/jwks.json',
-                scope: 'atproto transition:generic',
-                tokenEndpointAuthMethod: 'private_key_jwt',
-                privateKeyJwk: JSON.stringify(fullPrivateKeyJwk),
-            };
-            const assertion = await generateClientAssertion(config.clientId, 'https://bsky.social/oauth/token', config);
-            expect(assertion).not.toBeNull();
-            if (assertion) {
-                const parts = assertion.split('.');
-                const header = JSON.parse(Buffer.from(parts[0], 'base64url').toString());
-                expect(header.alg).toBe('ES256');
-            }
-        });
-        it('should include correct client_id in iss and sub', async () => {
-            const keyPair = await generateTestKeyPair();
-            const crypto = globalThis.crypto;
-            const fullPrivateKeyJwk = await crypto.subtle.exportKey('jwk', keyPair.privateKey);
-            const clientId = 'https://app.example.com/client-id';
-            const config = {
-                clientMetadataUri: 'https://app.example.com/oauth/client-metadata.json',
-                clientId,
-                jwksUri: 'https://app.example.com/.well-known/jwks.json',
-                scope: 'atproto transition:generic',
-                tokenEndpointAuthMethod: 'private_key_jwt',
-                privateKeyJwk: JSON.stringify(fullPrivateKeyJwk),
-            };
-            const assertion = await generateClientAssertion(clientId, 'https://bsky.social/oauth/token', config);
-            expect(assertion).not.toBeNull();
-            if (assertion) {
-                const parts = assertion.split('.');
-                const decoded = JSON.parse(Buffer.from(parts[1], 'base64url').toString());
-                expect(decoded.iss).toBe(clientId);
-                expect(decoded.sub).toBe(clientId);
-            }
-        });
-        it('should include token endpoint as audience', async () => {
-            const keyPair = await generateTestKeyPair();
-            const crypto = globalThis.crypto;
-            const fullPrivateKeyJwk = await crypto.subtle.exportKey('jwk', keyPair.privateKey);
-            const tokenEndpoint = 'https://bsky.social/oauth/token';
-            const config = {
-                clientMetadataUri: 'https://app.example.com/oauth/client-metadata.json',
-                clientId: 'https://app.example.com/client-id',
-                jwksUri: 'https://app.example.com/.well-known/jwks.json',
-                scope: 'atproto transition:generic',
-                tokenEndpointAuthMethod: 'private_key_jwt',
-                privateKeyJwk: JSON.stringify(fullPrivateKeyJwk),
-            };
-            const assertion = await generateClientAssertion(config.clientId, tokenEndpoint, config);
-            expect(assertion).not.toBeNull();
-            if (assertion) {
-                const parts = assertion.split('.');
-                const decoded = JSON.parse(Buffer.from(parts[1], 'base64url').toString());
-                expect(decoded.aud).toBe(tokenEndpoint);
-            }
-        });
-        it('should generate unique jti for each assertion', async () => {
-            const keyPair = await generateTestKeyPair();
-            const crypto = globalThis.crypto;
-            const fullPrivateKeyJwk = await crypto.subtle.exportKey('jwk', keyPair.privateKey);
-            const config = {
-                clientMetadataUri: 'https://app.example.com/oauth/client-metadata.json',
-                clientId: 'https://app.example.com/client-id',
-                jwksUri: 'https://app.example.com/.well-known/jwks.json',
-                scope: 'atproto transition:generic',
-                tokenEndpointAuthMethod: 'private_key_jwt',
-                privateKeyJwk: JSON.stringify(fullPrivateKeyJwk),
-            };
-            const assertion1 = await generateClientAssertion(config.clientId, 'https://bsky.social/oauth/token', config);
-            const assertion2 = await generateClientAssertion(config.clientId, 'https://bsky.social/oauth/token', config);
-            expect(assertion1).not.toBeNull();
-            expect(assertion2).not.toBeNull();
-            if (assertion1 && assertion2) {
-                const parts1 = assertion1.split('.');
-                const parts2 = assertion2.split('.');
-                const decoded1 = JSON.parse(Buffer.from(parts1[1], 'base64url').toString());
-                const decoded2 = JSON.parse(Buffer.from(parts2[1], 'base64url').toString());
-                expect(decoded1.jti).not.toBe(decoded2.jti);
-            }
-        });
-        it('should set appropriate expiration time', async () => {
-            const keyPair = await generateTestKeyPair();
-            const crypto = globalThis.crypto;
-            const fullPrivateKeyJwk = await crypto.subtle.exportKey('jwk', keyPair.privateKey);
-            const config = {
-                clientMetadataUri: 'https://app.example.com/oauth/client-metadata.json',
-                clientId: 'https://app.example.com/client-id',
-                jwksUri: 'https://app.example.com/.well-known/jwks.json',
-                scope: 'atproto transition:generic',
-                tokenEndpointAuthMethod: 'private_key_jwt',
-                privateKeyJwk: JSON.stringify(fullPrivateKeyJwk),
-            };
-            const now = Math.floor(Date.now() / 1000);
-            const assertion = await generateClientAssertion(config.clientId, 'https://bsky.social/oauth/token', config);
-            expect(assertion).not.toBeNull();
-            if (assertion) {
-                const parts = assertion.split('.');
-                const decoded = JSON.parse(Buffer.from(parts[1], 'base64url').toString());
-                const iat = decoded.iat;
-                const exp = decoded.exp;
-                // Should expire 10 minutes (600 seconds) after issued
-                expect(exp - iat).toBe(600);
-                expect(exp).toBeGreaterThan(now);
-            }
-        });
-        it('should handle missing private key gracefully', async () => {
-            const config = {
-                clientMetadataUri: 'https://app.example.com/oauth/client-metadata.json',
-                clientId: 'https://app.example.com/client-id',
-                jwksUri: 'https://app.example.com/.well-known/jwks.json',
-                scope: 'atproto transition:generic',
-                tokenEndpointAuthMethod: 'private_key_jwt',
-            };
-            const assertion = await generateClientAssertion(config.clientId, 'https://bsky.social/oauth/token', config);
-            expect(assertion).toBeNull();
-        });
-        it('should validate assertion can be verified with public key', async () => {
-            const keyPair = await generateTestKeyPair();
-            const crypto = globalThis.crypto;
-            const fullPrivateKeyJwk = await crypto.subtle.exportKey('jwk', keyPair.privateKey);
-            const config = {
-                clientMetadataUri: 'https://app.example.com/oauth/client-metadata.json',
-                clientId: 'https://app.example.com/client-id',
-                jwksUri: 'https://app.example.com/.well-known/jwks.json',
-                scope: 'atproto transition:generic',
-                tokenEndpointAuthMethod: 'private_key_jwt',
-                privateKeyJwk: JSON.stringify(fullPrivateKeyJwk),
-            };
-            const assertion = await generateClientAssertion(config.clientId, 'https://bsky.social/oauth/token', config);
-            expect(assertion).not.toBeNull();
-            if (assertion) {
-                // Verify signature with public key
-                const { payload } = await jwtVerify(assertion, keyPair.publicKey);
-                expect(payload).toBeDefined();
-                expect(payload.iss).toBe(config.clientId);
-                expect(payload.sub).toBe(config.clientId);
-            }
-        });
-        it('should throw error on invalid private key', async () => {
-            const config = {
-                clientMetadataUri: 'https://app.example.com/oauth/client-metadata.json',
-                clientId: 'https://app.example.com/client-id',
-                jwksUri: 'https://app.example.com/.well-known/jwks.json',
-                scope: 'atproto transition:generic',
-                tokenEndpointAuthMethod: 'private_key_jwt',
-                privateKeyJwk: JSON.stringify({ invalid: 'key' }),
-            };
-            await expect(generateClientAssertion(config.clientId, 'https://bsky.social/oauth/token', config)).rejects.toThrow();
-        });
-    });
-});

package/lib/constant.js

@@ -1,77 +0,0 @@
-import { ConnectorPlatform, ConnectorConfigFormItemType, } from '@logto/connector-kit';
-// AT Protocol OAuth endpoints (will be discovered from PDS metadata)
-export const defaultAuthorizationEndpoint = 'https://bsky.social/oauth/authorize';
-// Connector Metadata
-export const defaultMetadata = {
-    id: 'bluesky-web',
-    target: 'bluesky',
-    platform: ConnectorPlatform.Web,
-    name: {
-        en: 'Bluesky',
-    },
-    logo: './logo.svg',
-    logoDark: './logo-dark.svg',
-    description: {
-        en: 'Sign in with Bluesky via AT Protocol OAuth. Supports custom PDS instances with PAR, PKCE, and DPoP.',
-    },
-    readme: './README.md',
-    formItems: [
-        {
-            key: 'clientMetadataUri',
-            type: ConnectorConfigFormItemType.Text,
-            required: true,
-            label: 'Client Metadata URI',
-            placeholder: 'https://yourdomain.com/.well-known/oauth-client-metadata.json',
-            description: 'Publicly accessible URL to your OAuth client metadata',
-        },
-        {
-            key: 'clientId',
-            type: ConnectorConfigFormItemType.Text,
-            required: true,
-            label: 'Client ID',
-            placeholder: 'https://yourdomain.com/client-id',
-            description: 'OAuth client identifier (usually same as metadata URI)',
-        },
-        {
-            key: 'jwksUri',
-            type: ConnectorConfigFormItemType.Text,
-            required: true,
-            label: 'JWKS URI',
-            placeholder: 'https://yourdomain.com/.well-known/jwks.json',
-            description: 'Public key set for client authentication (required for confidential clients with private_key_jwt)',
-        },
-        {
-            key: 'scope',
-            type: ConnectorConfigFormItemType.Text,
-            required: false,
-            label: 'OAuth Scopes',
-            placeholder: 'atproto transition:generic',
-            defaultValue: 'atproto transition:generic',
-            description: 'Space-separated OAuth scopes',
-        },
-    ],
-};
-// Well-known paths for AT Protocol
-export const WELL_KNOWN_PATHS = {
-    OAUTH_CLIENT_METADATA: '/.well-known/oauth-client-metadata.json',
-    OAUTH_AUTHORIZATION_SERVER: '/.well-known/oauth-authorization-server',
-    OAUTH_PROTECTED_RESOURCE: '/.well-known/oauth-protected-resource',
-    ATPROTO_DID: '/.well-known/atproto-did',
-};
-// HTTP client settings for SSRF hardening
-export const HTTP_CLIENT_CONFIG = {
-    timeout: 10000,
-    maxRedirects: 3,
-    maxResponseSize: 1024 * 1024, // 1MB
-};
-// PKCE settings
-export const PKCE_CONFIG = {
-    codeVerifierLength: 43,
-    codeChallengeMethod: 'S256',
-};
-// DPoP settings
-export const DPOP_CONFIG = {
-    algorithm: 'ES256',
-    keyUsages: ['sign'],
-    jtiLength: 16, // Random token length
-};

package/lib/dpop.js

@@ -1,138 +0,0 @@
-import { SignJWT } from 'jose';
-import { randomBytes } from 'crypto';
-import { createHash } from 'crypto';
-import { DPOP_CONFIG } from './constant.js';
-/**
- * Generate ES256 DPoP key pair
- * Uses Web Crypto API (Node.js crypto.webcrypto)
- */
-export async function generateDPoPKeyPair() {
-    const crypto = globalThis.crypto || (await import('crypto')).webcrypto;
-    const keyPair = await crypto.subtle.generateKey({
-        name: 'ECDSA',
-        namedCurve: 'P-256', // ES256 uses P-256
-    }, true, // extractable (needed for server-side storage)
-    DPOP_CONFIG.keyUsages);
-    return {
-        publicKey: keyPair.publicKey,
-        privateKey: keyPair.privateKey,
-    };
-}
-/**
- * Export public key as JWK for inclusion in DPoP proof header
- */
-export async function exportPublicKeyAsJWK(publicKey) {
-    const crypto = globalThis.crypto || (await import('crypto')).webcrypto;
-    const jwk = await crypto.subtle.exportKey('jwk', publicKey);
-    // Remove private key fields if present
-    const { d, ...publicJwk } = jwk;
-    return publicJwk;
-}
-/**
- * Create DPoP proof JWT for token endpoint requests
- */
-export async function createDPoPProofForToken(keyPair, httpMethod, tokenEndpointUrl, nonce) {
-    const crypto = globalThis.crypto || (await import('crypto')).webcrypto;
-    const publicKeyJwk = await exportPublicKeyAsJWK(keyPair.publicKey);
-    // Generate unique jti
-    const jti = base64UrlEncode(randomBytes(DPOP_CONFIG.jtiLength));
-    const now = Math.floor(Date.now() / 1000);
-    const jwt = new SignJWT({
-        jti,
-        htm: httpMethod,
-        htu: tokenEndpointUrl,
-        iat: now,
-        exp: now + 60,
-        ...(nonce && { nonce }),
-    })
-        .setProtectedHeader({
-        typ: 'dpop+jwt',
-        alg: DPOP_CONFIG.algorithm,
-        jwk: publicKeyJwk,
-    });
-    // Sign with private key
-    // Note: jose library handles the signing, but we need to convert CryptoKey to JWK format
-    // For now, we'll use a workaround - in production, you'd use a proper JWT library
-    // that supports CryptoKey directly
-    // This is a simplified version - in production, use a library that supports CryptoKey
-    // For now, we'll need to export the private key and use it with jose
-    const privateKeyJwk = await crypto.subtle.exportKey('jwk', keyPair.privateKey);
-    // Ensure kty is defined and cast to JWK
-    if (!privateKeyJwk.kty || typeof privateKeyJwk.kty !== 'string') {
-        throw new Error('Private key JWK missing kty field');
-    }
-    // Import as JWK for jose - create a properly typed JWK object
-    const { importJWK } = await import('jose');
-    const jwkWithKty = {
-        ...privateKeyJwk,
-        kty: privateKeyJwk.kty,
-    };
-    const signingKey = await importJWK(jwkWithKty, DPOP_CONFIG.algorithm);
-    return await jwt.sign(signingKey);
-}
-/**
- * Create DPoP proof JWT for resource server (PDS) requests
- * Includes ath (access token hash) field
- */
-export async function createDPoPProofForResource(keyPair, httpMethod, resourceUrl, accessToken, nonce) {
-    const crypto = globalThis.crypto || (await import('crypto')).webcrypto;
-    const publicKeyJwk = await exportPublicKeyAsJWK(keyPair.publicKey);
-    // Hash access token for ath field (same as S256 PKCE challenge)
-    const tokenHash = createHash('sha256').update(accessToken).digest();
-    const ath = base64UrlEncode(tokenHash);
-    const jti = base64UrlEncode(randomBytes(DPOP_CONFIG.jtiLength));
-    const now = Math.floor(Date.now() / 1000);
-    const jwt = new SignJWT({
-        jti,
-        htm: httpMethod,
-        htu: resourceUrl,
-        iat: now,
-        exp: now + 60,
-        ath,
-        ...(nonce && { nonce }),
-    })
-        .setProtectedHeader({
-        typ: 'dpop+jwt',
-        alg: DPOP_CONFIG.algorithm,
-        jwk: publicKeyJwk,
-    });
-    const privateKeyJwk = await crypto.subtle.exportKey('jwk', keyPair.privateKey);
-    // Ensure kty is defined and cast to JWK
-    if (!privateKeyJwk.kty || typeof privateKeyJwk.kty !== 'string') {
-        throw new Error('Private key JWK missing kty field');
-    }
-    // Import as JWK for jose - create a properly typed JWK object
-    const { importJWK } = await import('jose');
-    const jwkWithKty = {
-        ...privateKeyJwk,
-        kty: privateKeyJwk.kty,
-    };
-    const signingKey = await importJWK(jwkWithKty, DPOP_CONFIG.algorithm);
-    return await jwt.sign(signingKey);
-}
-/**
- * Extract DPoP nonce from response headers
- */
-export function extractDPoPNonce(headers) {
-    if (headers instanceof Headers) {
-        return headers.get('dpop-nonce') || null;
-    }
-    const dpopNonce = headers['dpop-nonce'] || headers['DPoP-Nonce'];
-    if (typeof dpopNonce === 'string') {
-        return dpopNonce;
-    }
-    if (Array.isArray(dpopNonce) && dpopNonce.length > 0 && typeof dpopNonce[0] === 'string') {
-        return dpopNonce[0];
-    }
-    return null;
-}
-/**
- * Base64url encode
- */
-function base64UrlEncode(buffer) {
-    return buffer
-        .toString('base64')
-        .replace(/\+/g, '-')
-        .replace(/\//g, '_')
-        .replace(/=/g, '');
-}