Code

🚧 OAuth2 - Authorization Server#1958

Code

Closed

matthieusieben wants to merge 140 commits intobluesky-social:mainbluesky-social/atproto:mainfrom matthieusieben:feat-oauth-servermatthieusieben/atproto:feat-oauth-serverCopy head branch name to clipboard

+32,712-4,894

Commits

Commits on Apr 9, 2024

• fix(loggerMiddleware): avoid 500 when invalid jwt used as bearer & add support for DPoP auth scheme

  matthieusieben

  committed
  cc29615

• refactor(pds): add refreshExpired auth verifier

  matthieusieben

  committed
  604dce4

• refactor(pds:auth-verifier): add jwtVerify instance method

  matthieusieben

  committed
  6386333

• eat(oauth-provider): initial implementation

  matthieusieben

  committed
  4af72bc

• add oauth provider capability to PDS

  matthieusieben

  committed
  813d614

• feat(pds): split tracer code in own file

  matthieusieben

  committed
  9368180

• chore(dev): add dev script

  matthieusieben

  committed
  8db0d74

• dps: update example .env file

  matthieusieben

  committed
  fb6fed6

• build: disable allowImportingTsExtensions

  matthieusieben

  committed
  9c56ed4

• feat(oauth-provider): render login errors using HTML

  Show description for fb84144
  matthieusieben

  committed
  fb84144

• feat(pds): prepare account enrichment

  matthieusieben

  committed
  75b134f

• fix(pds): better type ReqCtx

  matthieusieben

  committed
  ff749ea

• small improvements to the fetch-node package

  matthieusieben

  committed
  e15e675

• feat(oauth-provider): allow customizing branding of the login page

  matthieusieben

  committed
  500eaa2

• feat(pds): use Bluesky blue as primary color

  matthieusieben

  committed
  084e629

• feat(oauth-provider): improve customizability

  matthieusieben

  committed
  55bd204

• feat(pds): change login column color

  matthieusieben

  committed
  77d0ad3

• feat: prepare for branding page

  matthieusieben

  committed
  583cbab

• feat: add welcome page

  Show description for aa55960
  matthieusieben

  committed
  aa55960

• fix: minor ux improvement

  matthieusieben

  committed
  576722e

• feat(pds): load branding from env

  matthieusieben

  committed
  6cbcc58

• chore: use "default" instead of "require" export condition

  matthieusieben

  committed
  70b1256

• chore: update rollupjs

  matthieusieben

  committed
  480a3d3

• feat: improve error management

  matthieusieben

  committed
  a7423b5

• chore(deps): remove unused lru-cache

  matthieusieben

  committed
  811d28e

• chore(dev): add blobs to ignored files

  matthieusieben

  committed
  02a5688

• fix(oauth-provider): various UI improvements

  matthieusieben

  committed
  c162268

• feat(dps): add profile info to oauth account selector

  matthieusieben

  committed
  d12a897

• fix(oauth-provider): do not throw when essential claims are not available (with exceptions)

  matthieusieben

  committed
  490dc87

• fix(oauth-provider): use InvalidRequestError instead AccessDeniedError during token requests

  matthieusieben

  committed
  8aa42d8

• fix(oauth-provider): throw invalid_client_metadata if require_auth_time cannot be fulfilled

  matthieusieben

  committed
  7af0c68

• docs(oauth-provider): clarify comment

  matthieusieben

  committed
  eb0f86d

• fix(oauth-provider): throw UnauthorizedError (401) error if login fails

  matthieusieben

  committed
  5297899

• feat(oauth-provider): redirect the user to the client whenever possible when an error occurs

  matthieusieben

  committed
  d6d98b8

• feat(html): allow nullish & false values in template literal variables

  matthieusieben

  committed
  433867e

• refactor: split html page generation logic

  matthieusieben

  committed
  a0c9710

• fix(oauth-provider): remove support for password grant

  matthieusieben

  committed
  27f0400

• refactor(oauth-provider)!: authentication step returns entire account info

  matthieusieben

  committed
  9231564

• style: minor changes to signIn method

  matthieusieben

  committed
  f3cb3ff

• refactor: rename "branding" into "customization"

  matthieusieben

  committed
  544f22e

• refactor(oauth-provider): split accept view in own file

  matthieusieben

  committed
  b085fec

• fix(oauth-provider): improve welcome view UI

  matthieusieben

  committed
  204376e

• feat(oauth-provider): add customization links as <link> html elements

  matthieusieben

  committed
  7552930

• fix(oauth-provider): add csp headers to post redirect page

  matthieusieben

  committed
  a479226

• perf(html): avoid generating fragments when concatenating Html

  matthieusieben

  committed
  abe073d

• style(oauth-provider): improve separation of concerns

  matthieusieben

  committed
  34107cb

• refactor: group code

  matthieusieben

  committed
  3047920

• feat(oauth-provider): allow customization of sign-in fields

  matthieusieben

  committed
  2abda74

• wip: sign-up

  matthieusieben

  committed
  47f6207

• feat: allow dpopSecret to be left empty

  matthieusieben

  committed
  8bae593

• feat(fetch): add timeout in safe fetch mode

  matthieusieben

  committed
  a622709

• refactor: factorize client-metadata in own lib

  matthieusieben

  committed
  0ce839c

• feat(caching): add generic caching utils

  matthieusieben

  committed
  d24bb08

• feat(oauth-provider-client-uri): cache http responses

  matthieusieben

  committed
  60c0861

• feat(oauth-server-metadata): add OAuth server metadata validation utilities

  matthieusieben

  committed
  0f6a30c

• refactor(oauth-provider): use shared oauth-server-metadata lib

  matthieusieben

  committed
  3f54b6d

• feat(oauth-server-metadata-resolver): utility class that allows fetching OAuth server metadata

  matthieusieben

  committed
  23c6e38

• feat(jwk): allow searching keys using multiple kids

  matthieusieben

  committed
  b2bde5d

• fix(oauth-provider): read pushed_authorization_request_endpoint_auth_method on PAR endpoint

  matthieusieben

  committed
  b5fdcd6

• feat(fetch)!: expose response object in json processor result

  matthieusieben

  committed
  e53c45b

• feat(did): create isomorphic DID utility lib

  matthieusieben

  committed
  6346096

• feat(handle-resolver): isomorphic and node specific handle resolution utilities

  matthieusieben

  committed
  bf2c755

• docs(oauth-provider): add toto comment

  matthieusieben

  committed
  d5f1230

• chore(ts): allow fall through in switch

  matthieusieben

  committed
  a0e82a6

• feat(b64): add base64-url encoding util

  matthieusieben

  committed
  91d0b1e

• refactor(jwk)!: extract JOSE specific code in own package

  matthieusieben

  committed
  05c256c

• docs(oauth-provider): order response_types_supported by category

  matthieusieben

  committed
  5b6fcdd

• fix(fetch): cancel timeout on end of response

  matthieusieben

  committed
  20474b5

• feat(fetch-dpop): add dpop fetch util

  matthieusieben

  committed
  3335da0

• feat(identity-resolver): add identity resolver package

  matthieusieben

  committed
  ecffdc3

• fix(oauth-provider): limit dpop validity time

  matthieusieben

  committed
  9dda100

• feat(disposable-polyfill): init

  matthieusieben

  committed
  0c9a980

• feat(jwk-webcrypto): init

  matthieusieben

  committed
  455c026

• feat(indexed-db): init

  matthieusieben

  committed
  087fa2f

• style(oauth-provider): lint

  matthieusieben

  committed
  d3862ed

• feat(oauth-client): oauth client

  matthieusieben

  committed
  49afd67

• docs(oauth-provider): improve jsdoc

  matthieusieben

  committed
  08814d1

• feat(oauth-provider): better define "signIn" API argument

  matthieusieben

  committed
  885fc51

• refactor(pds): implement BasicProfileGetter using CachedGetter

  matthieusieben

  committed
  2ade64a

• feat(oauth-client): support working with dev-env

  matthieusieben

  committed
  9e263f7

• feat(dev-env): add oauth config

  matthieusieben

  committed
  fc612a8

• feat(dev): run dev-env as part of "pnpm dev"

  matthieusieben

  committed
  fe7e54f

• fix(oauth-provider): do not require "implicit" grant_type for response_types including "code"

  matthieusieben

  committed
  4f9d70e

• feat(oauth-provider): expose allowed redirect_uris in "invalid redirect_uri" error description

  matthieusieben

  committed
  7038535

• docs(oauth-provider): improve comments in redirect_uri matching algorithm

  matthieusieben

  committed
  373e154

• fix(pds:oauth): add missing "openid" scope for localhost clients

  matthieusieben

  committed
  08810b8

• fix(oauth-provider-client-uri): improve validation of client id

  matthieusieben

  committed
  eb1bfa8

• fix(oauth-client): improve validation of client metadata

  matthieusieben

  committed
  892a3ef

• fix(oauth-client-browser): allow customizing the atprotoLexiconUrl

  matthieusieben

  committed
  d2e29a7

• feat(oauth-client-browser-example): use loopback client metadata

  matthieusieben

  committed
  6311aa7

• fix(deps): update pnpm-lock

  matthieusieben

  committed
  9750371

• fix(pds:oauth): typings

  matthieusieben

  committed
  14fa216

Commits on Apr 10, 2024

• chore(build): use tsc --build mode

  matthieusieben

  committed
  a3a0c2b

• fix(oauth-provider): better align errors with spec

  matthieusieben

  committed
  a2b5863

• fix(fetch): make sure the body is consumed in case of http error

  matthieusieben

  committed
  ec5201e

• fix(dpop-fetch): properly parse "use_dpop_nonce" error in response

  Show description for f9bdc6c
  matthieusieben

  committed
  f9bdc6c

• fix(handle-resolver): any invalid payload should be considered as "null"

  matthieusieben

  committed
  85ad5b0

• feat(http-util): expose context utilities

  matthieusieben

  committed
  af71160

• fix(pds): type cast json.parse result

  matthieusieben

  committed
  1c3633e

• fix(pds): expose "use_dpop_nonce" error in WWW-Authenticate header

  matthieusieben

  committed
  9afaa6e

Commits on Apr 11, 2024

• feat(oauth-server-metadata): expose issuer schema

  matthieusieben

  committed
  9594589

• fix(oauth-server-metadata-resolver): use private ts fields instead of private js fields

  matthieusieben

  committed
  1574b4d

• refactor(oauth-server-metadata-resolver)!: use named export instead of default

  matthieusieben

  committed
  f902845

• refactor(oauth-client)!: use ISO Dates to convey session expiry

  matthieusieben

  committed
  22a4830

• fix(dev-env): move oauth pds config to TestPds

  matthieusieben

  committed
  3c7c5fb

• feat(oauth-provider): add onAccountAddAuthorizedClient hook

  matthieusieben

  committed
  b319f04

• fix(oauth-provider): add missing scopes_supported

  matthieusieben

  committed
  d44abef

• fix(oauth-provider): avoid throwing "resource owner interaction" related errors from PAR endpoint

  matthieusieben

  committed
  549978e

• docs(oauth-provider): better document AuthorizationRequestHook

  matthieusieben

  committed
  dfcfb9b

• feat(oauth-provider): export Client class

  matthieusieben

  committed
  d3ff07d

• fix(pds): prevent loopback clients from obtaining refresh tokens

  matthieusieben

  committed
  572a41e

• fix(pds): prevent un-authenticated clients from obtaining refresh tokens

  Show description for 0ac74eb
  matthieusieben

  committed
  0ac74eb

• fix(oauth-client): use "invalid_grant" oauth error to detect that refresh token was denied

  matthieusieben

  committed
  60295c8

• fix(oauth-server-metadata): ensure response_types_supported includes "code"

  matthieusieben

  committed
  9853a7c

• feat(oauth-client-metadata): export response type and grant type schemas & types

  matthieusieben

  committed
  ecd7be3

• fix(oauth-client): use OAuthResponseType from oauth-client-metadata

  matthieusieben

  committed
  5b6935b

• fix(oauth-client): negotiate response_type request param with server

  matthieusieben

  committed
  8f8f8c6

• fix(oauth-client): remove unused import

  matthieusieben

  committed
  cf5f82d

• fix(oauth-client-browser): remove "responseType" from factory config

  matthieusieben

  committed
  20d4255

Commits on Apr 12, 2024

• feat(identity-resolver): expose typed used in options

  matthieusieben

  committed
  d157fdb

• fix(oauth-client-browser): typo in options type

  matthieusieben

  committed
  fc35a35

• feat(oauth-client-react-native): shell

  matthieusieben

  committed
  a1bd979

• fix(fetch): avoid relying on .blob()

  matthieusieben

  committed
  812b60f

• docs(oauth-client-react-native): add implementation details

  matthieusieben

  committed
  56aa243

• fix(jwk-webcrypto): remove unused code

  matthieusieben

  committed
  718b387

• fix(jwk-webcrypto): prefer jwk algorithms that yield smaller signatures

  matthieusieben

  committed
  5241de0

• fix(oauth-client): prefer jwk algorithms that yield smaller signatures

  matthieusieben

  committed
  4cc3257

• feat(jwk): export jwkValidator that validates "use" and "key_ops" claims

  matthieusieben

  committed
  316b5f6

• feat(oauth-client-react-native): validate native jwk

  matthieusieben

  committed
  d8748be

• fix(jose-key): remove un-necessary code

  matthieusieben

  committed
  065e0b6

• fix(fetch): do not attempts to cancel the body if it was used

  matthieusieben

  committed
  8d14b78

• fix(oauth-provider): do not expose account info in browser

  matthieusieben

  committed
  7e9b72e

• feat(jwk): simplify VerifyOptions interface

  matthieusieben

  committed
  e316117

• feat(oauth-client-react-native): improve typings

  matthieusieben

  committed
  f55c1bd

• docs(oauth-client-react-native): add jsdoc

  matthieusieben

  committed
  3eefb79

Commits on Apr 15, 2024

• refactor(oauth-provider): merge session and device concepts

  matthieusieben

  committed
  fdfe438

• fix(pds): adapt to latest oauth-provider refactor

  matthieusieben

  committed
  9c794e0

• fixup! refactor(oauth-provider): merge session and device concepts

  matthieusieben

  committed
  17fc0fc

• fixup! refactor(oauth-provider): merge session and device concepts

  matthieusieben

  committed
  b01e289

• feat(oauth-client-browser): simplify login ux & allow popup mode

  matthieusieben

  committed
  6aa38d7