@pdsjs/spaces 2.0.1 → 2.0.3

package/src/handlers/auth.js

@@ -15,6 +15,7 @@ import {
   spaceHostEndpoint,
   spaceSigningKey,
 } from '../authority.js';
+import { credentialBindingFromProof, verifyCredentialProof } from '../dpop.js';
 import { createServiceAuth } from '../service-auth.js';
 import {
   createSpaceToken,
@@ -61,8 +62,8 @@ async function readJson(request) {
  * @param {Object} ctx
  * @param {import('@pdsjs/core/ports').SpaceStoragePort} ctx.spaceStorage
  * @param {() => Promise<string|null>} ctx.getDid
- * @param {() => Promise<{sign: (bytes: Uint8Array) => Promise<Uint8Array>}>} ctx.getSigner
- * @param {(did: string) => Promise<any>} ctx.resolveDid
+ * @param {() => Promise<import('../token.js').SpaceSigner>} ctx.getSigner
+ * @param {import('@pdsjs/core/ports').DidResolverPort} ctx.resolveDid
  * @param {import('@pdsjs/core/ports').SignatureVerifierPort} ctx.verifier
  * @param {typeof fetch} [ctx.fetch]
  * @returns {import('@pdsjs/core/pds').Routes}
@@ -142,7 +143,7 @@ export function createAuthRoutes(ctx) {
       handler: async (request) => {
         const body = await readJson(request);
         if (!body) return errorResponse('InvalidRequest', 'Invalid JSON body');
-        const { space, clientAttestation } = body;
+        const { space, dpopJkt, clientAttestation } = body;
         if (typeof space !== 'string') {
           return errorResponse('InvalidRequest', 'space is required');
         }
@@ -181,6 +182,38 @@ export function createAuthRoutes(ctx) {
           return tokenErrorResponse(err);
         }
 
+        // Checked after the token, so a caller with no credentials at all reads
+        // 401 rather than a complaint about their request. Required, because an
+        // unbound credential is a bearer token for the whole space and every
+        // repo host in it would accept a replay of it.
+        //
+        // The key arrives two ways. A DPoP proof demonstrates it, which is what
+        // the Rust implementation sends; a `dpopJkt` body field asserts it,
+        // which is what the reference implementation reads. Both are accepted,
+        // and a caller sending both must agree with itself.
+        /** @type {string|null} */
+        let boundJkt;
+        try {
+          boundJkt = await credentialBindingFromProof(request);
+        } catch (err) {
+          return tokenErrorResponse(err);
+        }
+        if (typeof dpopJkt === 'string' && dpopJkt) {
+          if (boundJkt && boundJkt !== dpopJkt) {
+            return errorResponse(
+              'InvalidRequest',
+              'dpopJkt names a different key than the DPoP proof proves',
+            );
+          }
+          boundJkt ??= dpopJkt;
+        }
+        if (!boundJkt) {
+          return errorResponse(
+            'InvalidRequest',
+            'A DPoP proof or a dpopJkt is required',
+          );
+        }
+
         // Structural validation only. Full verification means resolving the
         // client_id to its client-metadata.json, fetching the published JWKS,
         // and checking the signature against the key named by `kid`. Until then
@@ -209,9 +242,12 @@ export function createAuthRoutes(ctx) {
           return errorResponse('SpaceDeleted', 'Space has been deleted');
         }
 
-        // User perimeter.
+        // User perimeter. The authority is the only party who can reconfigure
+        // the space, so no policy may lock it out of its own space.
         let userAuthorized;
-        if (spaceRow.policy === 'public') {
+        if (userDid === authorityDid) {
+          userAuthorized = true;
+        } else if (spaceRow.policy === 'public') {
           userAuthorized = true;
         } else if (spaceRow.policy === 'member-list') {
           userAuthorized = await spaceStorage.isMember(space, userDid);
@@ -253,40 +289,13 @@ export function createAuthRoutes(ctx) {
 
         const credential = await createSpaceToken(
           'credential',
-          { iss: authorityDid, sub: space },
+          { iss: authorityDid, sub: space, dpopJkt: boundJkt },
           await getSigner(),
         );
         return Response.json({ credential });
       },
     },
 
-    // Authority role: describe a space.
-    '/xrpc/com.atproto.space.getSpace': {
-      handler: async (_request, url) => {
-        const space = url.searchParams.get('space');
-        if (!space) return errorResponse('InvalidRequest', 'space is required');
-        const row = await spaceStorage.getSpace(space);
-        if (!row?.isOwner) {
-          return errorResponse('SpaceNotFound', 'Space not found', 404);
-        }
-        return Response.json({
-          uri: row.uri,
-          config: {
-            $type: 'com.atproto.simplespace.defs#spaceConfig',
-            policy: row.policy,
-            ...(row.managingApp ? { managingApp: row.managingApp } : {}),
-            appAccess:
-              row.appAccessType === 'allowList'
-                ? {
-                    $type: 'com.atproto.simplespace.defs#allowList',
-                    allowed: row.appAllowed,
-                  }
-                : { $type: 'com.atproto.simplespace.defs#open' },
-          },
-        });
-      },
-    },
-
     // Authority role: the writer set, which is the sync boundary. Accounts that
     // have written at least one record — not the broader set allowed to write,
     // which the authority may not even track.
@@ -338,15 +347,107 @@ function toJsonBytes(bytes) {
 }
 
 /**
- * Verify a space credential presented to a repo host.
+ * Build the read check the space endpoints share: the hosted account's own
+ * session, or a space credential for the space being read.
+ *
+ * @param {Object} ctx
+ * @param {() => Promise<string|null>} ctx.getDid
+ * @param {import('@pdsjs/core/ports').DidResolverPort} ctx.resolveDid
+ * @param {import('@pdsjs/core/ports').SignatureVerifierPort} ctx.verifier
+ * @returns {(request: Request, space: string, auth: {did: string}|null) => Promise<Response|null>}
+ *   a Response to return, or null to proceed
+ */
+export function createReadAuthorizer({ getDid, resolveDid, verifier }) {
+  return async (request, space, auth) => {
+    const hosted = await getDid();
+    if (auth && auth.did === hosted) return null;
+
+    const credential = credentialFromRequest(request);
+    if (!credential) {
+      return errorResponse(
+        'AuthenticationRequired',
+        'A session or space credential is required',
+        401,
+      );
+    }
+    try {
+      await verifyPresentedCredential({
+        request,
+        credential,
+        space,
+        resolveDid,
+        verifier,
+      });
+      return null;
+    } catch (err) {
+      if (err instanceof SpaceTokenError) {
+        return errorResponse(err.code, err.message, 401);
+      }
+      throw err;
+    }
+  };
+}
+
+/**
+ * The space credential a request presents, or null.
+ *
+ * `DPoP`, never `Bearer`: a credential names the key it is bound to, and a
+ * presentation that proves nothing about that key is what the binding exists to
+ * refuse.
+ *
+ * @param {Request} request
+ * @returns {string|null}
+ */
+export function credentialFromRequest(request) {
+  const match = (request.headers.get('authorization') ?? '').match(
+    /^DPoP\s+(.+)$/i,
+  );
+  return match ? match[1] : null;
+}
+
+/**
+ * Check a presented space credential: the token itself, then the caller's
+ * possession of the key it names.
+ *
+ * The two questions are one function so that no endpoint accepting a credential
+ * can answer the first and forget the second.
  *
  * @param {Object} opts
+ * @param {Request} opts.request - the request the DPoP proof must cover
  * @param {string} opts.credential - the raw JWT
  * @param {string} opts.space - the space the request targets
- * @param {(did: string) => Promise<any>} opts.resolveDid
+ * @param {import('@pdsjs/core/ports').DidResolverPort} opts.resolveDid
  * @param {import('@pdsjs/core/ports').SignatureVerifierPort} opts.verifier
  * @returns {Promise<{iss: string}>}
  */
+export async function verifyPresentedCredential({
+  request,
+  credential,
+  space,
+  resolveDid,
+  verifier,
+}) {
+  const { iss, jkt } = await verifySpaceCredential({
+    credential,
+    space,
+    resolveDid,
+    verifier,
+  });
+  await verifyCredentialProof({ request, credential, jkt });
+  return { iss };
+}
+
+/**
+ * Verify a space credential presented to a repo host.
+ *
+ * @param {Object} opts
+ * @param {string} opts.credential - the raw JWT
+ * @param {string} opts.space - the space the request targets
+ * @param {import('@pdsjs/core/ports').DidResolverPort} opts.resolveDid
+ * @param {import('@pdsjs/core/ports').SignatureVerifierPort} opts.verifier
+ * @returns {Promise<{iss: string, jkt: string}>} the authority, and the key the
+ *   holder must prove possession of
+ */
 export async function verifySpaceCredential({
   credential,
   space,
@@ -373,7 +474,14 @@ export async function verifySpaceCredential({
       'BadJwtIss',
     );
   }
-  return { iss: payload.iss };
+  // parseSpaceToken refuses a credential without one, so this is reachable only
+  // if that check is relaxed. It stays because the cost of it being wrong is a
+  // credential for a whole space that anyone holding a copy may present.
+  const jkt = payload.cnf?.jkt;
+  if (!jkt) {
+    throw new SpaceTokenError('Credential is not bound to a key', 'BadJwtCnf');
+  }
+  return { iss: payload.iss, jkt };
 }
 
 /**
@@ -388,8 +496,8 @@ export async function verifySpaceCredential({
  * @param {string} opts.space
  * @param {string} opts.userDid
  * @param {string|undefined} opts.clientId
- * @param {(did: string) => Promise<any>} opts.resolveDid
- * @param {() => Promise<{sign: (bytes: Uint8Array) => Promise<Uint8Array>}>} opts.getSigner
+ * @param {import('@pdsjs/core/ports').DidResolverPort} opts.resolveDid
+ * @param {() => Promise<import('../token.js').SpaceSigner>} opts.getSigner
  * @param {typeof fetch} [opts.fetch]
  * @returns {Promise<boolean>}
  */

package/src/handlers/manage.d.ts

@@ -2,8 +2,8 @@
  * @param {Object} ctx
  * @param {import('@pdsjs/core/ports').SpaceStoragePort} ctx.spaceStorage
  * @param {() => Promise<string|null>} ctx.getDid
- * @param {() => Promise<{sign: (bytes: Uint8Array) => Promise<Uint8Array>}>} ctx.getSigner
- * @param {(did: string) => Promise<any>} ctx.resolveDid
+ * @param {() => Promise<import('../token.js').SpaceSigner>} ctx.getSigner
+ * @param {import('@pdsjs/core/ports').DidResolverPort} ctx.resolveDid
  * @param {import('@pdsjs/core/ports').SignatureVerifierPort} ctx.verifier
  * @param {typeof fetch} [ctx.fetch]
  * @returns {import('@pdsjs/core/pds').Routes}
@@ -11,10 +11,8 @@
 export declare function createManageRoutes(ctx: {
     spaceStorage: import('@pdsjs/core/ports').SpaceStoragePort;
     getDid: () => Promise<string | null>;
-    getSigner: () => Promise<{
-        sign: (bytes: Uint8Array) => Promise<Uint8Array>;
-    }>;
-    resolveDid: (did: string) => Promise<any>;
+    getSigner: () => Promise<import('../token.js').SpaceSigner>;
+    resolveDid: import('@pdsjs/core/ports').DidResolverPort;
     verifier: import('@pdsjs/core/ports').SignatureVerifierPort;
     fetch?: typeof fetch;
 }): import('@pdsjs/core/pds').Routes;