@startup-api/cloudflare 0.3.2 → 0.4.0

package/src/auth/atproto/identity.ts

@@ -0,0 +1,178 @@
+/**
+ * AT Protocol identity resolution. Given a user-supplied handle or DID we walk the full discovery
+ * chain — with NO hardcoded Bluesky/PDS hosts — to find the authorization server that owns the
+ * identity:
+ *
+ *   handle ──▶ DID            (HTTPS `.well-known/atproto-did`, then DNS TXT `_atproto.<handle>` via DoH)
+ *   DID    ──▶ DID document   (did:plc via a PLC directory, did:web via the domain's `.well-known`)
+ *   DID doc──▶ PDS endpoint   (the `#atproto_pds` service)
+ *   PDS    ──▶ auth server    (`.well-known/oauth-protected-resource` → `.well-known/oauth-authorization-server`)
+ *
+ * The PLC directory and DNS-over-HTTPS resolver are generic, swappable infrastructure (overridable via
+ * env), not identity providers — every account hosts its own PDS and authorization server, which we
+ * discover dynamically here.
+ */
+
+const DID_PREFIX = /^did:(plc|web):/;
+
+export interface AuthServerMetadata {
+  issuer: string;
+  authorization_endpoint: string;
+  token_endpoint: string;
+  pushed_authorization_request_endpoint: string;
+  [key: string]: unknown;
+}
+
+export interface ResolvedIdentity {
+  did: string;
+  handle?: string;
+  pds: string;
+  authServer: AuthServerMetadata;
+}
+
+export interface ResolverOptions {
+  /** PLC directory base URL for resolving did:plc. Defaults to the canonical https://plc.directory. */
+  plcUrl?: string;
+  /** DNS-over-HTTPS endpoint (RFC 8484 JSON) for the `_atproto.<handle>` TXT fallback. */
+  dohUrl?: string;
+}
+
+const DEFAULT_PLC_URL = 'https://plc.directory';
+const DEFAULT_DOH_URL = 'https://cloudflare-dns.com/dns-query';
+
+async function fetchJson(url: string, init?: RequestInit): Promise<any> {
+  const res = await fetch(url, init);
+  if (!res.ok) throw new Error(`Request to ${url} failed: ${res.status} ${res.statusText}`);
+  return res.json();
+}
+
+/** Resolve a handle to a DID via the HTTPS well-known method, falling back to DNS TXT over DoH. */
+async function resolveHandleToDid(handle: string, options: ResolverOptions): Promise<string> {
+  // 1. HTTPS well-known (works for any host that serves it; no third-party dependency).
+  try {
+    const res = await fetch(`https://${handle}/.well-known/atproto-did`, { redirect: 'error' });
+    if (res.ok) {
+      const did = (await res.text()).trim();
+      if (DID_PREFIX.test(did)) return did;
+    }
+  } catch {
+    // Fall through to DNS-based resolution.
+  }
+
+  // 2. DNS TXT `_atproto.<handle>` via DNS-over-HTTPS.
+  try {
+    const dohUrl = new URL(options.dohUrl || DEFAULT_DOH_URL);
+    dohUrl.searchParams.set('name', `_atproto.${handle}`);
+    dohUrl.searchParams.set('type', 'TXT');
+    const data = await fetchJson(dohUrl.toString(), { headers: { accept: 'application/dns-json' } });
+    for (const answer of data.Answer ?? []) {
+      const txt = String(answer.data ?? '').replace(/^"|"$/g, '');
+      if (txt.startsWith('did=')) {
+        const did = txt.slice(4).trim();
+        if (DID_PREFIX.test(did)) return did;
+      }
+    }
+  } catch {
+    // Fall through to the error below.
+  }
+
+  throw new Error(`Could not resolve handle "${handle}" to a DID`);
+}
+
+/** Fetch and return the DID document for a did:plc or did:web identifier. */
+async function resolveDidDocument(did: string, options: ResolverOptions): Promise<any> {
+  if (did.startsWith('did:plc:')) {
+    const base = (options.plcUrl || DEFAULT_PLC_URL).replace(/\/$/, '');
+    return fetchJson(`${base}/${did}`);
+  }
+  if (did.startsWith('did:web:')) {
+    // did:web:example.com[:path...] → https://example.com[/path...]/did.json (or /.well-known/did.json).
+    const rest = did.slice('did:web:'.length);
+    const segments = rest.split(':').map((s) => decodeURIComponent(s));
+    const host = segments.shift();
+    if (!host) throw new Error(`Malformed did:web identifier: ${did}`);
+    const path = segments.length ? `/${segments.join('/')}/did.json` : '/.well-known/did.json';
+    return fetchJson(`https://${host}${path}`);
+  }
+  throw new Error(`Unsupported DID method: ${did}`);
+}
+
+/** Extract the PDS service endpoint from a DID document. */
+function getPdsEndpoint(didDoc: any): string {
+  const services: any[] = Array.isArray(didDoc?.service) ? didDoc.service : [];
+  const pds = services.find(
+    (s) => s?.id === '#atproto_pds' || (typeof s?.id === 'string' && s.id.endsWith('#atproto_pds')) || s?.type === 'AtprotoPersonalDataServer',
+  );
+  const endpoint = typeof pds?.serviceEndpoint === 'string' ? pds.serviceEndpoint : pds?.serviceEndpoint?.uri;
+  if (!endpoint) throw new Error('DID document does not advertise an atproto PDS endpoint');
+  return endpoint.replace(/\/$/, '');
+}
+
+/** Extract the primary handle (`at://<handle>`) from a DID document's alsoKnownAs, if present. */
+function getHandle(didDoc: any): string | undefined {
+  const aka: string[] = Array.isArray(didDoc?.alsoKnownAs) ? didDoc.alsoKnownAs : [];
+  const at = aka.find((a) => typeof a === 'string' && a.startsWith('at://'));
+  return at ? at.slice('at://'.length) : undefined;
+}
+
+/** Resolve a PDS to its authorization server metadata via the protected-resource indirection. */
+async function resolveAuthServer(pds: string): Promise<AuthServerMetadata> {
+  const protectedResource = await fetchJson(new URL('/.well-known/oauth-protected-resource', pds).toString());
+  const issuer: string | undefined = protectedResource?.authorization_servers?.[0];
+  if (!issuer) throw new Error(`PDS ${pds} does not declare an authorization server`);
+
+  const metadata = (await fetchJson(new URL('/.well-known/oauth-authorization-server', issuer).toString())) as AuthServerMetadata;
+  if (!metadata.authorization_endpoint || !metadata.token_endpoint || !metadata.pushed_authorization_request_endpoint) {
+    throw new Error(`Authorization server ${issuer} is missing required OAuth endpoints (PAR is mandatory for atproto)`);
+  }
+  return metadata;
+}
+
+/**
+ * Full identity → authorization-server resolution. Accepts a handle (optionally `@`-prefixed) or a DID.
+ */
+export async function resolveIdentity(input: string, options: ResolverOptions = {}): Promise<ResolvedIdentity> {
+  const cleaned = input.trim().replace(/^@/, '');
+  if (!cleaned) throw new Error('Empty atproto identifier');
+
+  const isDid = cleaned.startsWith('did:');
+  let handle: string | undefined = isDid ? undefined : cleaned;
+  const did = isDid ? cleaned : await resolveHandleToDid(cleaned, options);
+
+  const didDoc = await resolveDidDocument(did, options);
+  const pds = getPdsEndpoint(didDoc);
+  if (!handle) handle = getHandle(didDoc);
+
+  const authServer = await resolveAuthServer(pds);
+  return { did, handle, pds, authServer };
+}
+
+/**
+ * Fetch a public actor profile record from the user's PDS to populate display name and avatar. Best
+ * effort: getRecord is an unauthenticated read, and any failure falls back to the handle/DID.
+ */
+export async function fetchProfile(pds: string, did: string, handle?: string): Promise<{ name?: string; picture?: string }> {
+  try {
+    const url = new URL('/xrpc/com.atproto.repo.getRecord', pds);
+    url.searchParams.set('repo', did);
+    url.searchParams.set('collection', 'app.bsky.actor.profile');
+    url.searchParams.set('rkey', 'self');
+
+    const res = await fetch(url.toString());
+    if (!res.ok) return { name: handle };
+
+    const data = (await res.json()) as { value?: { displayName?: string; avatar?: { ref?: { $link?: string } } } };
+    const value = data.value ?? {};
+    let picture: string | undefined;
+    const cid = value.avatar?.ref?.$link;
+    if (cid) {
+      const blob = new URL('/xrpc/com.atproto.sync.getBlob', pds);
+      blob.searchParams.set('did', did);
+      blob.searchParams.set('cid', cid);
+      picture = blob.toString();
+    }
+    return { name: value.displayName || handle, picture };
+  } catch {
+    return { name: handle };
+  }
+}

package/src/auth/index.ts

@@ -4,6 +4,7 @@ import { CookieManager } from '../CookieManager';
 import { refreshEntitlements } from '../entitlements/service';
 import { computeRedirectBase, createProviders } from './providers';
 import type { ProviderConfigs } from './providers';
+import type { AuthContext, ExchangeResult, OAuthProvider } from './OAuthProvider';
 
 export async function handleAuth(
   request: Request,
@@ -25,21 +26,22 @@ export async function handleAuth(
   // Instantiate active providers
   const activeProviders = createProviders(env, redirectBase, providerConfigs);
 
+  const ctx: AuthContext = { request, env, url, redirectBase, authPath, usersPath, origin, cookieManager };
+
+  // Provider-specific auxiliary routes (e.g. the atproto client-metadata document).
+  for (const provider of activeProviders) {
+    const res = await provider.handleExtraRoute(ctx);
+    if (res) return res;
+  }
+
   // Handle Auth Start
   for (const provider of activeProviders) {
     if (provider.isMatch(path, authPath)) {
-      const returnUrl = url.searchParams.get('return_url');
-      const stateObj = {
-        nonce: Math.random().toString(36).substring(2),
-        return_url: returnUrl,
-      };
-      // Use robust base64 encoding for state
-      const state = btoa(unescape(encodeURIComponent(JSON.stringify(stateObj))))
-        .replace(/\+/g, '-')
-        .replace(/\//g, '_')
-        .replace(/=+$/, '');
-      const authUrl = provider.getAuthUrl(state);
-      return Response.redirect(authUrl, 302);
+      try {
+        return await provider.authorize(ctx);
+      } catch (e) {
+        return new Response(`Auth failed: ${e instanceof Error ? e.message : String(e)}`, { status: 500 });
+      }
     }
   }
 
@@ -47,207 +49,205 @@ export async function handleAuth(
   for (const provider of activeProviders) {
     if (provider.isCallback(path, authPath)) {
       console.log(`[Auth] Callback received for ${provider.name}`);
-      const code = url.searchParams.get('code');
-      if (!code) return new Response('Missing code', { status: 400 });
-
-      const stateBase64 = url.searchParams.get('state');
-      let returnUrl: string | null = null;
-      if (stateBase64) {
-        try {
-          // Robust base64 decoding
-          const base64 = stateBase64.replace(/-/g, '+').replace(/_/g, '/');
-          const stateJson = decodeURIComponent(escape(atob(base64)));
-          const stateObj = JSON.parse(stateJson);
-          returnUrl = stateObj.return_url;
-        } catch (e) {
-          console.error('Failed to parse state', e);
-        }
+      try {
+        const result = await provider.exchange(ctx);
+        return await finishLogin(provider, result, ctx);
+      } catch (e) {
+        const status = (e as { status?: number })?.status ?? 500;
+        return new Response(`Auth failed: ${e instanceof Error ? e.message : String(e)}`, { status });
       }
+    }
+  }
 
-      try {
-        const token = await provider.getToken(code);
-        const profile = await provider.getUserProfile(token.access_token);
-
-        const systemStub = env.SYSTEM.get(env.SYSTEM.idFromName('global'));
-
-        // 1. Try to resolve existing user by credential
-        const credentialStub = env.CREDENTIAL.get(env.CREDENTIAL.idFromName(provider.name));
-        const resolveData = await credentialStub.get(profile.id);
-
-        let userIdStr: string | null = null;
-        let staleSessionId: string | null = null;
-
-        if (resolveData) {
-          userIdStr = resolveData.user_id;
-        } else {
-          // 2. Not found, check if user is already logged in (to link account)
-          const cookieHeader = request.headers.get('Cookie');
-          if (cookieHeader) {
-            const cookies = cookieHeader.split(';').reduce(
-              (acc, cookie) => {
-                const [key, value] = cookie.split('=').map((c) => c.trim());
-                if (key && value) acc[key] = value;
-                return acc;
-              },
-              {} as Record<string, string>,
-            );
-            const sessionCookieEncrypted = cookies['session_id'];
-            if (sessionCookieEncrypted) {
-              const sessionCookie = await cookieManager.decrypt(sessionCookieEncrypted);
-              if (sessionCookie && sessionCookie.includes(':')) {
-                const parts = sessionCookie.split(':');
-                staleSessionId = parts[0];
-                userIdStr = parts[1];
-              }
-            }
-          }
-        }
+  return new Response('Auth route not found', { status: 404 });
+}
 
-        if (userIdStr) {
-          // Verify user still exists (has a profile)
-          const userStub = env.USER.get(env.USER.idFromString(userIdStr));
-          const profileData = await userStub.getProfile();
-          if (Object.keys(profileData).length === 0) {
-            // User was deleted!
-            if (staleSessionId) {
-              try {
-                await userStub.deleteSession(staleSessionId);
-              } catch (_e) {
-                // ignore
-              }
-            }
-            userIdStr = null;
-          }
+/**
+ * Shared post-exchange login finalization, provider-agnostic: resolve or create the user, link the
+ * credential, fetch login-time entitlements, ensure a personal account exists, mint a session and set
+ * the session cookie. `result.setCookies` lets a provider emit additional cookies (e.g. clearing
+ * transient flow state).
+ */
+async function finishLogin(provider: OAuthProvider, result: ExchangeResult, ctx: AuthContext): Promise<Response> {
+  const { env, request, usersPath, origin, cookieManager } = ctx;
+  const { token, profile, returnUrl } = result;
+
+  const systemStub = env.SYSTEM.get(env.SYSTEM.idFromName('global'));
+
+  // 1. Try to resolve existing user by credential
+  const credentialStub = env.CREDENTIAL.get(env.CREDENTIAL.idFromName(provider.name));
+  const resolveData = await credentialStub.get(profile.id);
+
+  let userIdStr: string | null = null;
+  let staleSessionId: string | null = null;
+
+  if (resolveData) {
+    userIdStr = resolveData.user_id;
+  } else {
+    // 2. Not found, check if user is already logged in (to link account)
+    const cookieHeader = request.headers.get('Cookie');
+    if (cookieHeader) {
+      const cookies = cookieHeader.split(';').reduce(
+        (acc, cookie) => {
+          const [key, value] = cookie.split('=').map((c) => c.trim());
+          if (key && value) acc[key] = value;
+          return acc;
+        },
+        {} as Record<string, string>,
+      );
+      const sessionCookieEncrypted = cookies['session_id'];
+      if (sessionCookieEncrypted) {
+        const sessionCookie = await cookieManager.decrypt(sessionCookieEncrypted);
+        if (sessionCookie && sessionCookie.includes(':')) {
+          const parts = sessionCookie.split(':');
+          staleSessionId = parts[0];
+          userIdStr = parts[1];
         }
+      }
+    }
+  }
 
-        const isNewUser = !userIdStr;
-        const id = userIdStr ? env.USER.idFromString(userIdStr) : env.USER.newUniqueId();
-        const userStub = env.USER.get(id);
-        userIdStr = id.toString();
-
-        // Fetch and Store Avatar (Only for new users)
-        if (isNewUser && profile.picture) {
-          try {
-            const picRes = await fetch(profile.picture);
-            if (picRes.ok) {
-              const picBlob = await picRes.arrayBuffer();
-              await userStub.storeImage('avatar', picBlob, picRes.headers.get('Content-Type') || 'image/jpeg');
-              // Update profile.picture to point to our worker
-              profile.picture = usersPath + 'me/avatar';
-            }
-          } catch (e) {
-            console.error('Failed to fetch avatar', e);
-          }
+  if (userIdStr) {
+    // Verify user still exists (has a profile)
+    const userStub = env.USER.get(env.USER.idFromString(userIdStr));
+    const profileData = await userStub.getProfile();
+    if (Object.keys(profileData).length === 0) {
+      // User was deleted!
+      if (staleSessionId) {
+        try {
+          await userStub.deleteSession(staleSessionId);
+        } catch (_e) {
+          // ignore
         }
+      }
+      userIdStr = null;
+    }
+  }
 
-        // Register credential in provider-specific CredentialDO
-        await credentialStub.put({
-          user_id: userIdStr,
+  const isNewUser = !userIdStr;
+  const id = userIdStr ? env.USER.idFromString(userIdStr) : env.USER.newUniqueId();
+  const userStub = env.USER.get(id);
+  userIdStr = id.toString();
+
+  // Fetch and Store Avatar (Only for new users)
+  if (isNewUser && profile.picture) {
+    try {
+      const picRes = await fetch(profile.picture);
+      if (picRes.ok) {
+        const picBlob = await picRes.arrayBuffer();
+        await userStub.storeImage('avatar', picBlob, picRes.headers.get('Content-Type') || 'image/jpeg');
+        // Update profile.picture to point to our worker
+        profile.picture = usersPath + 'me/avatar';
+      }
+    } catch (e) {
+      console.error('Failed to fetch avatar', e);
+    }
+  }
+
+  // Register credential in provider-specific CredentialDO
+  await credentialStub.put({
+    user_id: userIdStr,
+    subject_id: profile.id,
+    access_token: token.access_token,
+    refresh_token: token.refresh_token,
+    expires_at: token.expires_in ? Date.now() + token.expires_in * 1000 : undefined,
+    scope: token.scope,
+    profile_data: profile,
+  });
+
+  // Register credential mapping in UserDO
+  await userStub.addCredential(provider.name, profile.id);
+
+  // Login-time entitlement fetch: providers that support entitlements (e.g. Patreon) get an
+  // initial entitlement snapshot now, so gating works even when no freshness mechanism is
+  // configured. Best-effort — never block or fail login on an entitlement error.
+  if (provider.supportsEntitlements()) {
+    try {
+      await refreshEntitlements(
+        env,
+        provider,
+        {
           subject_id: profile.id,
+          user_id: userIdStr,
           access_token: token.access_token,
           refresh_token: token.refresh_token,
           expires_at: token.expires_in ? Date.now() + token.expires_in * 1000 : undefined,
-          scope: token.scope,
+          scope: typeof token.scope === 'string' ? token.scope : undefined,
           profile_data: profile,
-        });
-
-        // Register credential mapping in UserDO
-        await userStub.addCredential(provider.name, profile.id);
-
-        // Login-time entitlement fetch: providers that support entitlements (e.g. Patreon) get an
-        // initial entitlement snapshot now, so gating works even when no freshness mechanism is
-        // configured. Best-effort — never block or fail login on an entitlement error.
-        if (provider.supportsEntitlements()) {
-          try {
-            await refreshEntitlements(
-              env,
-              provider,
-              {
-                subject_id: profile.id,
-                user_id: userIdStr,
-                access_token: token.access_token,
-                refresh_token: token.refresh_token,
-                expires_at: token.expires_in ? Date.now() + token.expires_in * 1000 : undefined,
-                scope: typeof token.scope === 'string' ? token.scope : undefined,
-                profile_data: profile,
-              },
-              'oauth',
-            );
-          } catch (e) {
-            console.error('[auth] Login-time entitlement fetch failed', e);
-          }
-        }
+        },
+        'oauth',
+      );
+    } catch (e) {
+      console.error('[auth] Login-time entitlement fetch failed', e);
+    }
+  }
 
-        // Register User in SystemDO index (Only for new users)
-        if (isNewUser) {
-          await userStub.updateProfile(profile);
-          await systemStub.registerUser({
-            id: userIdStr,
-            name: profile.name || userIdStr,
-            email: profile.email,
-            provider: provider.name,
-          });
-        }
+  // Register User in SystemDO index (Only for new users)
+  if (isNewUser) {
+    await userStub.updateProfile(profile);
+    await systemStub.registerUser({
+      id: userIdStr,
+      name: profile.name || userIdStr,
+      email: profile.email,
+      provider: provider.name,
+    });
+  }
 
-        // Ensure user has at least one account
-        const memberships = await userStub.getMemberships();
-
-        if (memberships.length === 0) {
-          // Create a personal account
-          const accountId = env.ACCOUNT.newUniqueId();
-          const accountStub = env.ACCOUNT.get(accountId);
-          const accountIdStr = accountId.toString();
-
-          // Initialize account info
-          await accountStub.updateInfo({
-            name: `${profile.name || userIdStr}'s Account`,
-            personal: true,
-          });
-
-          // Register Account in SystemDO
-          await systemStub.registerAccount({
-            id: accountIdStr,
-            name: `${profile.name || profile.id}'s Account`,
-            status: 'active',
-            plan: 'free',
-          });
-
-          // Add user as ADMIN to the account
-          await accountStub.addMember(id.toString(), 1);
-
-          // Add membership to user
-          await userStub.addMembership(accountIdStr, 1, true);
-        }
+  // Ensure user has at least one account
+  const memberships = await userStub.getMemberships();
+
+  if (memberships.length === 0) {
+    // Create a personal account
+    const accountId = env.ACCOUNT.newUniqueId();
+    const accountStub = env.ACCOUNT.get(accountId);
+    const accountIdStr = accountId.toString();
+
+    // Initialize account info
+    await accountStub.updateInfo({
+      name: `${profile.name || userIdStr}'s Account`,
+      personal: true,
+    });
+
+    // Register Account in SystemDO
+    await systemStub.registerAccount({
+      id: accountIdStr,
+      name: `${profile.name || profile.id}'s Account`,
+      status: 'active',
+      plan: 'free',
+    });
+
+    // Add user as ADMIN to the account
+    await accountStub.addMember(id.toString(), 1);
+
+    // Add membership to user
+    await userStub.addMembership(accountIdStr, 1, true);
+  }
 
-        // Create Session
-        const session = await userStub.createSession({ provider: provider.name });
-
-        // Set cookie and redirect
-        const encryptedSession = await cookieManager.encrypt(`${session.sessionId}:${userIdStr}`);
-        const headers = new Headers();
-        headers.set('Set-Cookie', `session_id=${encryptedSession}; Path=/; HttpOnly; Secure; SameSite=Lax`);
-
-        let redirectUrl = !isNewUser ? usersPath + 'profile.html' : '/';
-        if (returnUrl) {
-          try {
-            const parsedReturn = new URL(returnUrl, origin);
-            if (parsedReturn.origin === origin) {
-              redirectUrl = parsedReturn.toString();
-            }
-          } catch (_e) {
-            if (returnUrl.startsWith('/')) {
-              redirectUrl = returnUrl;
-            }
-          }
-        }
+  // Create Session
+  const session = await userStub.createSession({ provider: provider.name });
 
-        headers.set('Location', redirectUrl);
-        return new Response(null, { status: 302, headers });
-      } catch (e) {
-        return new Response(`Auth failed: ${e instanceof Error ? e.message : String(e)}`, { status: 500 });
+  // Set cookie and redirect
+  const encryptedSession = await cookieManager.encrypt(`${session.sessionId}:${userIdStr}`);
+  const headers = new Headers();
+  headers.set('Set-Cookie', `session_id=${encryptedSession}; Path=/; HttpOnly; Secure; SameSite=Lax`);
+  for (const cookie of result.setCookies ?? []) {
+    headers.append('Set-Cookie', cookie);
+  }
+
+  let redirectUrl = !isNewUser ? usersPath + 'profile.html' : '/';
+  if (returnUrl) {
+    try {
+      const parsedReturn = new URL(returnUrl, origin);
+      if (parsedReturn.origin === origin) {
+        redirectUrl = parsedReturn.toString();
+      }
+    } catch (_e) {
+      if (returnUrl.startsWith('/')) {
+        redirectUrl = returnUrl;
       }
     }
   }
 
-  return new Response('Auth route not found', { status: 404 });
+  headers.set('Location', redirectUrl);
+  return new Response(null, { status: 302, headers });
 }

package/src/auth/providers.ts

@@ -4,6 +4,7 @@ import { OAuthProvider } from './OAuthProvider';
 import { GoogleProvider } from './GoogleProvider';
 import { TwitchProvider } from './TwitchProvider';
 import { PatreonProvider } from './PatreonProvider';
+import { AtprotoProvider } from './AtprotoProvider';
 
 export type ProviderConfigs = Record<string, ProviderOptions>;
 
@@ -25,6 +26,7 @@ export function createProviders(env: StartupAPIEnv, redirectBase: string, provid
     GoogleProvider.create(env, redirectBase, providerConfigs.google),
     TwitchProvider.create(env, redirectBase, providerConfigs.twitch),
     PatreonProvider.create(env, redirectBase, providerConfigs.patreon),
+    AtprotoProvider.create(env, redirectBase, providerConfigs.atproto),
   ].filter((p): p is OAuthProvider => p !== null);
 }
 

package/src/createStartupAPI.ts

@@ -167,7 +167,7 @@ export function createStartupAPI(config: StartupAPIConfig = {}) {
       const isAccounts = subPath === 'accounts.html' || subPath === 'accounts';
 
       if (isProfile || isAccounts) {
-        return handleSSR(request, env, url, usersPath, cookieManager);
+        return handleSSR(request, env, url, usersPath, cookieManager, providerConfigs);
       }
     }
 
@@ -262,7 +262,7 @@ export function createStartupAPI(config: StartupAPIConfig = {}) {
 
     // Admin Routes
     if (url.pathname.startsWith(usersPath + 'admin/')) {
-      return handleAdmin(request, env, usersPath, cookieManager);
+      return handleAdmin(request, env, usersPath, cookieManager, providerConfigs);
     }
 
     // Intercept requests to usersPath and serve them from the public/users directory.
@@ -336,7 +336,7 @@ export function createStartupAPI(config: StartupAPIConfig = {}) {
         return denyResponse(decision, {
           usersPath,
           returnUrl,
-          activeProviders: getActiveProviders(env),
+          activeProviders: getActiveProviders(env, providerConfigs),
           authenticated,
           request,
           env,
@@ -345,7 +345,7 @@ export function createStartupAPI(config: StartupAPIConfig = {}) {
       }
 
       const response = await originFetch(newRequest);
-      const providers = getActiveProviders(env);
+      const providers = getActiveProviders(env, providerConfigs);
       return injectPowerStrip(response, usersPath, providers);
     }