atproto-better-auth 0.1.0

package/dist/index.js

@@ -0,0 +1,534 @@
+// src/server.ts
+import { NodeOAuthClient, JoseKey } from "@atproto/oauth-client-node";
+import { Agent } from "@atproto/api";
+import { createAuthEndpoint } from "better-auth/api";
+import { z } from "zod";
+
+// src/schema.ts
+var atprotoUserSchema = {
+  user: {
+    fields: {
+      atprotoDid: {
+        type: "string",
+        required: false,
+        unique: true
+      },
+      atprotoHandle: {
+        type: "string",
+        required: false
+      },
+      atprotoBio: {
+        type: "string",
+        required: false
+      },
+      atprotoBanner: {
+        type: "string",
+        required: false
+      }
+    }
+  }
+};
+var atprotoStateSchema = {
+  atprotoState: {
+    fields: {
+      key: {
+        type: "string",
+        required: true,
+        unique: true
+      },
+      state: {
+        type: "string",
+        required: true
+      },
+      expiresAt: {
+        type: "date",
+        required: true
+      }
+    }
+  }
+};
+var atprotoSessionSchema = {
+  atprotoSession: {
+    fields: {
+      did: {
+        type: "string",
+        required: true,
+        unique: true
+      },
+      session: {
+        type: "string",
+        required: true
+      },
+      userId: {
+        type: "string",
+        required: true,
+        references: {
+          model: "user",
+          field: "id"
+        }
+      },
+      updatedAt: {
+        type: "date",
+        required: true
+      }
+    }
+  }
+};
+var atprotoSchema = {
+  ...atprotoUserSchema,
+  ...atprotoStateSchema,
+  ...atprotoSessionSchema
+};
+
+// src/server.ts
+function getAppOrigin(authBaseURL) {
+  try {
+    return new URL(authBaseURL).origin;
+  } catch {
+    return authBaseURL;
+  }
+}
+function atprotoAuth(options) {
+  const {
+    clientMetadata,
+    privateKey,
+    mapProfileToUser
+  } = options;
+  let oauthClient = null;
+  let keysetPromise = null;
+  let resolvedClientMetadata = null;
+  function buildClientMetadata(authBaseURL) {
+    if (resolvedClientMetadata)
+      return resolvedClientMetadata;
+    const appOrigin = getAppOrigin(authBaseURL);
+    resolvedClientMetadata = {
+      client_id: clientMetadata.clientId ?? `${appOrigin}/client-metadata.json`,
+      client_name: clientMetadata.clientName,
+      client_uri: clientMetadata.clientUri ?? appOrigin,
+      logo_uri: clientMetadata.logoUri,
+      tos_uri: clientMetadata.tosUri,
+      policy_uri: clientMetadata.policyUri,
+      redirect_uris: clientMetadata.redirectUris ?? [`${authBaseURL}/callback/atproto`],
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      scope: clientMetadata.scope ?? "atproto transition:generic",
+      dpop_bound_access_tokens: true,
+      application_type: "web",
+      token_endpoint_auth_method: clientMetadata.jwksUri ?? `${appOrigin}/jwks.json` ? "private_key_jwt" : "none",
+      token_endpoint_auth_signing_alg: clientMetadata.jwksUri ?? `${appOrigin}/jwks.json` ? "ES256" : undefined,
+      jwks_uri: clientMetadata.jwksUri ?? `${appOrigin}/jwks.json`
+    };
+    return resolvedClientMetadata;
+  }
+  async function getOAuthClient(adapter, authBaseURL) {
+    if (oauthClient)
+      return oauthClient;
+    if (!keysetPromise) {
+      keysetPromise = Promise.all([
+        JoseKey.fromImportable(JSON.stringify(privateKey))
+      ]);
+    }
+    const keyset = await keysetPromise;
+    const fullClientMetadata = buildClientMetadata(authBaseURL);
+    oauthClient = new NodeOAuthClient({
+      clientMetadata: {
+        ...fullClientMetadata,
+        redirect_uris: fullClientMetadata.redirect_uris
+      },
+      keyset,
+      stateStore: {
+        async set(key, state) {
+          try {
+            await adapter.delete({
+              model: "atprotoState",
+              where: [{ field: "key", value: key }]
+            });
+          } catch {}
+          await adapter.create({
+            model: "atprotoState",
+            data: {
+              key,
+              state: JSON.stringify(state),
+              expiresAt: new Date(Date.now() + 10 * 60 * 1000)
+            }
+          });
+        },
+        async get(key) {
+          const record = await adapter.findOne({
+            model: "atprotoState",
+            where: [{ field: "key", value: key }]
+          });
+          if (!record)
+            return;
+          if (new Date(record.expiresAt) < new Date) {
+            await adapter.delete({
+              model: "atprotoState",
+              where: [{ field: "key", value: key }]
+            });
+            return;
+          }
+          return JSON.parse(record.state);
+        },
+        async del(key) {
+          await adapter.delete({
+            model: "atprotoState",
+            where: [{ field: "key", value: key }]
+          });
+        }
+      },
+      sessionStore: {
+        async set(did, session) {
+          const existing = await adapter.findOne({
+            model: "atprotoSession",
+            where: [{ field: "did", value: did }]
+          });
+          if (existing) {
+            await adapter.update({
+              model: "atprotoSession",
+              where: [{ field: "did", value: did }],
+              update: {
+                session: JSON.stringify(session),
+                updatedAt: new Date
+              }
+            });
+          } else {
+            await adapter.create({
+              model: "atprotoSession",
+              data: {
+                did,
+                session: JSON.stringify(session),
+                userId: "",
+                updatedAt: new Date
+              }
+            });
+          }
+        },
+        async get(did) {
+          const record = await adapter.findOne({
+            model: "atprotoSession",
+            where: [{ field: "did", value: did }]
+          });
+          if (!record || !record.session)
+            return;
+          return JSON.parse(record.session);
+        },
+        async del(did) {
+          await adapter.delete({
+            model: "atprotoSession",
+            where: [{ field: "did", value: did }]
+          });
+        }
+      }
+    });
+    return oauthClient;
+  }
+  return {
+    id: "atproto",
+    schema: atprotoSchema,
+    endpoints: {
+      signInAtproto: createAuthEndpoint("/atproto/sign-in", {
+        method: "GET",
+        query: z.object({
+          handle: z.string().min(1),
+          callbackURL: z.string().optional()
+        })
+      }, async (ctx) => {
+        const { handle, callbackURL } = ctx.query;
+        const client = await getOAuthClient(ctx.context.adapter, ctx.context.baseURL);
+        const state = callbackURL ? JSON.stringify({ callbackURL }) : undefined;
+        const authUrl = await client.authorize(handle, { state });
+        throw ctx.redirect(authUrl.toString());
+      }),
+      callbackAtproto: createAuthEndpoint("/callback/atproto", {
+        method: "GET",
+        query: z.object({
+          code: z.string().optional(),
+          state: z.string().optional(),
+          iss: z.string().optional(),
+          error: z.string().optional(),
+          error_description: z.string().optional()
+        })
+      }, async (ctx) => {
+        const client = await getOAuthClient(ctx.context.adapter, ctx.context.baseURL);
+        const url = new URL(ctx.request?.url ?? "", "http://localhost");
+        const params = url.searchParams;
+        const { session: atprotoSession, state } = await client.callback(params);
+        let callbackURL = "/";
+        if (state) {
+          try {
+            const parsed = JSON.parse(state);
+            if (parsed.callbackURL) {
+              callbackURL = parsed.callbackURL;
+            }
+          } catch {}
+        }
+        const agent = new Agent(atprotoSession);
+        const profileResponse = await agent.getProfile({
+          actor: atprotoSession.did
+        });
+        const profile = {
+          did: atprotoSession.did,
+          handle: profileResponse.data.handle,
+          displayName: profileResponse.data.displayName,
+          avatar: profileResponse.data.avatar,
+          description: profileResponse.data.description,
+          banner: profileResponse.data.banner
+        };
+        const existingAccount = await ctx.context.adapter.findOne({
+          model: "account",
+          where: [
+            { field: "providerId", value: "atproto" },
+            { field: "accountId", value: profile.did }
+          ]
+        });
+        let userId;
+        if (existingAccount) {
+          userId = existingAccount.userId;
+          await ctx.context.adapter.update({
+            model: "account",
+            where: [{ field: "id", value: existingAccount.id }],
+            update: {
+              accessToken: "atproto-session",
+              updatedAt: new Date
+            }
+          });
+          await ctx.context.adapter.update({
+            model: "user",
+            where: [{ field: "id", value: userId }],
+            update: {
+              atprotoHandle: profile.handle,
+              atprotoBio: profile.description,
+              atprotoBanner: profile.banner,
+              image: profile.avatar,
+              name: profile.displayName ?? profile.handle,
+              updatedAt: new Date
+            }
+          });
+        } else {
+          const currentSession = ctx.context.session;
+          if (currentSession?.user) {
+            userId = currentSession.user.id;
+          } else {
+            const userFields = mapProfileToUser ? mapProfileToUser(profile) : {};
+            const newUser = await ctx.context.internalAdapter.createUser({
+              name: profile.displayName ?? profile.handle,
+              email: `${profile.did}@atproto.invalid`,
+              image: profile.avatar,
+              emailVerified: false,
+              atprotoDid: profile.did,
+              atprotoHandle: profile.handle,
+              atprotoBio: profile.description,
+              atprotoBanner: profile.banner,
+              ...userFields
+            });
+            userId = newUser.id;
+          }
+          await ctx.context.adapter.create({
+            model: "account",
+            data: {
+              userId,
+              providerId: "atproto",
+              accountId: profile.did,
+              accessToken: "atproto-session",
+              refreshToken: null,
+              expiresAt: null,
+              scope: clientMetadata.scope ?? "atproto transition:generic",
+              createdAt: new Date,
+              updatedAt: new Date
+            }
+          });
+        }
+        const existingAtprotoSession = await ctx.context.adapter.findOne({
+          model: "atprotoSession",
+          where: [{ field: "did", value: profile.did }]
+        });
+        if (existingAtprotoSession) {
+          await ctx.context.adapter.update({
+            model: "atprotoSession",
+            where: [{ field: "did", value: profile.did }],
+            update: {
+              userId,
+              updatedAt: new Date
+            }
+          });
+        } else {
+          await ctx.context.adapter.create({
+            model: "atprotoSession",
+            data: {
+              did: profile.did,
+              session: "",
+              userId,
+              updatedAt: new Date
+            }
+          });
+        }
+        const session = await ctx.context.internalAdapter.createSession(userId, undefined, undefined);
+        const sessionCookie = ctx.context.authCookies.sessionToken;
+        await ctx.setSignedCookie(sessionCookie.name, session.token, ctx.context.secret, sessionCookie.attributes);
+        throw ctx.redirect(callbackURL);
+      }),
+      getAtprotoSession: createAuthEndpoint("/atproto/session", {
+        method: "GET"
+      }, async (ctx) => {
+        const currentSession = ctx.context.session;
+        if (!currentSession?.user) {
+          return ctx.json({ session: null });
+        }
+        const account = await ctx.context.adapter.findOne({
+          model: "account",
+          where: [
+            { field: "userId", value: currentSession.user.id },
+            { field: "providerId", value: "atproto" }
+          ]
+        });
+        if (!account) {
+          return ctx.json({ session: null });
+        }
+        const client = await getOAuthClient(ctx.context.adapter, ctx.context.baseURL);
+        try {
+          const atprotoSession = await client.restore(account.accountId);
+          const agent = new Agent(atprotoSession);
+          const profileResponse = await agent.getProfile({
+            actor: atprotoSession.did
+          });
+          const sessionInfo = {
+            did: atprotoSession.did,
+            handle: profileResponse.data.handle,
+            displayName: profileResponse.data.displayName,
+            avatar: profileResponse.data.avatar,
+            active: true
+          };
+          return ctx.json({ session: sessionInfo });
+        } catch {
+          return ctx.json({
+            session: {
+              did: account.accountId,
+              handle: "",
+              active: false
+            }
+          });
+        }
+      }),
+      restoreAtprotoAgent: createAuthEndpoint("/atproto/restore", {
+        method: "POST"
+      }, async (ctx) => {
+        const currentSession = ctx.context.session;
+        if (!currentSession?.user) {
+          return ctx.json({ error: "Not authenticated" }, { status: 401 });
+        }
+        const account = await ctx.context.adapter.findOne({
+          model: "account",
+          where: [
+            { field: "userId", value: currentSession.user.id },
+            { field: "providerId", value: "atproto" }
+          ]
+        });
+        if (!account) {
+          return ctx.json({ error: "No ATProto account linked" }, { status: 404 });
+        }
+        const client = await getOAuthClient(ctx.context.adapter, ctx.context.baseURL);
+        try {
+          const atprotoSession = await client.restore(account.accountId);
+          return ctx.json({
+            did: atprotoSession.did,
+            active: true
+          });
+        } catch (error) {
+          return ctx.json({
+            error: "Failed to restore ATProto session",
+            details: error instanceof Error ? error.message : "Unknown error"
+          }, { status: 400 });
+        }
+      })
+    }
+  };
+}
+// src/utils.ts
+function getPublicJwk(privateKey) {
+  const { d: _privateComponent, ...publicKey } = privateKey;
+  return publicKey;
+}
+function createJwks(privateKey) {
+  return {
+    keys: [getPublicJwk(privateKey)]
+  };
+}
+function createClientMetadata(options) {
+  const { clientMetadata } = options;
+  const hasJwks = !!clientMetadata.jwksUri;
+  return {
+    client_id: clientMetadata.clientId,
+    client_name: clientMetadata.clientName,
+    client_uri: clientMetadata.clientUri,
+    logo_uri: clientMetadata.logoUri,
+    tos_uri: clientMetadata.tosUri,
+    policy_uri: clientMetadata.policyUri,
+    redirect_uris: clientMetadata.redirectUris,
+    grant_types: ["authorization_code", "refresh_token"],
+    response_types: ["code"],
+    scope: clientMetadata.scope ?? "atproto transition:generic",
+    dpop_bound_access_tokens: true,
+    application_type: "web",
+    token_endpoint_auth_method: hasJwks ? "private_key_jwt" : "none",
+    token_endpoint_auth_signing_alg: hasJwks ? "ES256" : undefined,
+    jwks_uri: clientMetadata.jwksUri
+  };
+}
+async function generateES256Key() {
+  const keyPair = await crypto.subtle.generateKey({
+    name: "ECDSA",
+    namedCurve: "P-256"
+  }, true, ["sign", "verify"]);
+  const privateJwk = await crypto.subtle.exportKey("jwk", keyPair.privateKey);
+  return {
+    kty: "EC",
+    crv: "P-256",
+    x: privateJwk.x,
+    y: privateJwk.y,
+    d: privateJwk.d,
+    alg: "ES256",
+    kid: crypto.randomUUID()
+  };
+}
+function isValidES256PrivateKey(jwk) {
+  if (!jwk || typeof jwk !== "object")
+    return false;
+  const key = jwk;
+  return key.kty === "EC" && key.crv === "P-256" && typeof key.x === "string" && typeof key.y === "string" && typeof key.d === "string";
+}
+function createClientMetadataHandler(options) {
+  const metadata = createClientMetadata(options);
+  return () => {
+    return new Response(JSON.stringify(metadata), {
+      headers: {
+        "Content-Type": "application/json"
+      }
+    });
+  };
+}
+function createJwksHandler(privateKey) {
+  const jwks = createJwks(privateKey);
+  return () => {
+    return new Response(JSON.stringify(jwks), {
+      headers: {
+        "Content-Type": "application/json"
+      }
+    });
+  };
+}
+var DEFAULT_ATPROTO_SCOPES = "atproto transition:generic";
+export {
+  isValidES256PrivateKey,
+  getPublicJwk,
+  generateES256Key,
+  createJwksHandler,
+  createJwks,
+  createClientMetadataHandler,
+  createClientMetadata,
+  atprotoUserSchema,
+  atprotoStateSchema,
+  atprotoSessionSchema,
+  atprotoSchema,
+  atprotoAuth,
+  DEFAULT_ATPROTO_SCOPES
+};

package/dist/schema.d.ts

@@ -0,0 +1,155 @@
+/**
+ * Database schema definitions for the ATProto better-auth plugin.
+ * These tables store OAuth state and session data required by @atproto/oauth-client-node.
+ */
+/**
+ * Schema extensions for the user table.
+ * Adds ATProto-specific fields to store profile data.
+ */
+export declare const atprotoUserSchema: {
+    readonly user: {
+        readonly fields: {
+            readonly atprotoDid: {
+                readonly type: "string";
+                readonly required: false;
+                readonly unique: true;
+            };
+            readonly atprotoHandle: {
+                readonly type: "string";
+                readonly required: false;
+            };
+            readonly atprotoBio: {
+                readonly type: "string";
+                readonly required: false;
+            };
+            readonly atprotoBanner: {
+                readonly type: "string";
+                readonly required: false;
+            };
+        };
+    };
+};
+/**
+ * Schema for the atprotoState table.
+ * Stores temporary OAuth state during the authorization flow.
+ */
+export declare const atprotoStateSchema: {
+    readonly atprotoState: {
+        readonly fields: {
+            readonly key: {
+                readonly type: "string";
+                readonly required: true;
+                readonly unique: true;
+            };
+            readonly state: {
+                readonly type: "string";
+                readonly required: true;
+            };
+            readonly expiresAt: {
+                readonly type: "date";
+                readonly required: true;
+            };
+        };
+    };
+};
+/**
+ * Schema for the atprotoSession table.
+ * Stores ATProto OAuth sessions including tokens, DPoP keys, etc.
+ * This is separate from better-auth's session table because ATProto
+ * sessions contain additional cryptographic material needed for API calls.
+ */
+export declare const atprotoSessionSchema: {
+    readonly atprotoSession: {
+        readonly fields: {
+            readonly did: {
+                readonly type: "string";
+                readonly required: true;
+                readonly unique: true;
+            };
+            readonly session: {
+                readonly type: "string";
+                readonly required: true;
+            };
+            readonly userId: {
+                readonly type: "string";
+                readonly required: true;
+                readonly references: {
+                    readonly model: "user";
+                    readonly field: "id";
+                };
+            };
+            readonly updatedAt: {
+                readonly type: "date";
+                readonly required: true;
+            };
+        };
+    };
+};
+/**
+ * Combined schema for the plugin
+ */
+export declare const atprotoSchema: {
+    readonly atprotoSession: {
+        readonly fields: {
+            readonly did: {
+                readonly type: "string";
+                readonly required: true;
+                readonly unique: true;
+            };
+            readonly session: {
+                readonly type: "string";
+                readonly required: true;
+            };
+            readonly userId: {
+                readonly type: "string";
+                readonly required: true;
+                readonly references: {
+                    readonly model: "user";
+                    readonly field: "id";
+                };
+            };
+            readonly updatedAt: {
+                readonly type: "date";
+                readonly required: true;
+            };
+        };
+    };
+    readonly atprotoState: {
+        readonly fields: {
+            readonly key: {
+                readonly type: "string";
+                readonly required: true;
+                readonly unique: true;
+            };
+            readonly state: {
+                readonly type: "string";
+                readonly required: true;
+            };
+            readonly expiresAt: {
+                readonly type: "date";
+                readonly required: true;
+            };
+        };
+    };
+    readonly user: {
+        readonly fields: {
+            readonly atprotoDid: {
+                readonly type: "string";
+                readonly required: false;
+                readonly unique: true;
+            };
+            readonly atprotoHandle: {
+                readonly type: "string";
+                readonly required: false;
+            };
+            readonly atprotoBio: {
+                readonly type: "string";
+                readonly required: false;
+            };
+            readonly atprotoBanner: {
+                readonly type: "string";
+                readonly required: false;
+            };
+        };
+    };
+};

package/dist/server.d.ts

@@ -0,0 +1,7 @@
+import type { BetterAuthPlugin } from "better-auth";
+import type { AtprotoAuthOptions } from "./types.js";
+/**
+ * Creates the ATProto better-auth plugin for server-side use.
+ */
+export declare function atprotoAuth(options: AtprotoAuthOptions): BetterAuthPlugin;
+export type { AtprotoAuthOptions };