@atproto/oauth-client
Version:
OAuth client for ATPROTO PDS. This package serves as common base for environment-specific implementations (NodeJS, Browser, React-Native).
338 lines • 17.6 kB
TypeScript
import { Key, Keyset } from '@atproto/jwk';
import { type OAuthClientIdDiscoverable, type OAuthClientMetadata, type OAuthClientMetadataInput, type OAuthResponseMode } from '@atproto/oauth-types';
import { type AtprotoDid, type DidCache } from '@atproto-labs/did-resolver';
import type { Fetch } from '@atproto-labs/fetch';
import type { HandleCache, HandleResolver } from '@atproto-labs/handle-resolver';
import { type CreateIdentityResolverOptions } from './identity-resolver.js';
import { type AuthorizationServerMetadataCache } from './oauth-authorization-server-metadata-resolver.js';
import { type ProtectedResourceMetadataCache } from './oauth-protected-resource-metadata-resolver.js';
import { OAuthResolver } from './oauth-resolver.js';
import type { DpopNonceCache, OAuthServerAgent } from './oauth-server-agent.js';
import { OAuthServerFactory } from './oauth-server-factory.js';
import { OAuthSession } from './oauth-session.js';
import type { RuntimeImplementation } from './runtime-implementation.js';
import { Runtime } from './runtime.js';
import { SessionGetter, type SessionGetterOptions, type SessionStore } from './session-getter.js';
import type { InternalStateData, StateStore } from './state-store.js';
import type { AuthorizeOptions, CallbackOptions, ClientMetadata } from './types.js';
export type { AuthorizationServerMetadataCache, CreateIdentityResolverOptions, DidCache, DpopNonceCache, Fetch, HandleCache, HandleResolver, InternalStateData, OAuthClientMetadata, OAuthClientMetadataInput, OAuthResponseMode, ProtectedResourceMetadataCache, RuntimeImplementation, SessionGetterOptions, SessionStore, StateStore, };
export { Key, Keyset };
export type OAuthClientOptions = {
responseMode: OAuthResponseMode;
clientMetadata: Readonly<OAuthClientMetadataInput>;
keyset?: Keyset | Iterable<Key | undefined | null | false>;
/**
* Determines if the client will allow communicating with the OAuth Servers
* (Authorization & Resource), or to retrieve "did:web" documents, over
* unsafe HTTP connections. It is recommended to set this to `true` only for
* development purposes.
*
* @note This does not affect the identity resolution mechanism, which will
* allow HTTP connections to the PLC Directory (if the provided directory url
* is "http:" based).
* @default false
* @see {@link OAuthProtectedResourceMetadataResolver.allowHttpResource}
* @see {@link OAuthAuthorizationServerMetadataResolver.allowHttpIssuer}
* @see {@link DidResolverCommonOptions.allowHttp}
*/
allowHttp?: boolean;
stateStore: StateStore;
sessionStore: SessionStore;
authorizationServerMetadataCache?: AuthorizationServerMetadataCache;
protectedResourceMetadataCache?: ProtectedResourceMetadataCache;
dpopNonceCache?: DpopNonceCache;
runtimeImplementation: RuntimeImplementation;
fetch?: Fetch;
} & CreateIdentityResolverOptions & SessionGetterOptions;
export type OAuthClientFetchMetadataOptions = {
clientId: OAuthClientIdDiscoverable;
fetch?: Fetch;
signal?: AbortSignal;
};
export declare class OAuthClient {
static fetchMetadata({ clientId, fetch, signal, }: OAuthClientFetchMetadataOptions): Promise<{
redirect_uris: ["http://127.0.0.1" | `${string}.${string}:/${string}` | `http://127.0.0.1#${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}` | `http://127.0.0.1?${string}` | `http://[::1]${string}` | `https://${string}`, ...("http://127.0.0.1" | `${string}.${string}:/${string}` | `http://127.0.0.1#${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}` | `http://127.0.0.1?${string}` | `http://[::1]${string}` | `https://${string}`)[]];
response_types: ["code" | "code id_token" | "code id_token token" | "code token" | "id_token" | "id_token token" | "none" | "token", ...("code" | "code id_token" | "code id_token token" | "code token" | "id_token" | "id_token token" | "none" | "token")[]];
grant_types: ["authorization_code" | "client_credentials" | "implicit" | "password" | "refresh_token" | "urn:ietf:params:oauth:grant-type:jwt-bearer" | "urn:ietf:params:oauth:grant-type:saml2-bearer", ...("authorization_code" | "client_credentials" | "implicit" | "password" | "refresh_token" | "urn:ietf:params:oauth:grant-type:jwt-bearer" | "urn:ietf:params:oauth:grant-type:saml2-bearer")[]];
scope?: string | undefined;
token_endpoint_auth_method: "client_secret_basic" | "client_secret_jwt" | "client_secret_post" | "none" | "private_key_jwt" | "self_signed_tls_client_auth" | "tls_client_auth";
token_endpoint_auth_signing_alg?: string | undefined;
userinfo_signed_response_alg?: string | undefined;
userinfo_encrypted_response_alg?: string | undefined;
jwks_uri?: "http://127.0.0.1" | "http://localhost" | `http://127.0.0.1#${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}` | `http://127.0.0.1?${string}` | `http://[::1]${string}` | `http://localhost#${string}` | `http://localhost/${string}` | `http://localhost:${string}` | `http://localhost?${string}` | `https://${string}` | undefined;
jwks?: {
keys: ((({
kid?: string | undefined;
use?: "enc" | "sig" | undefined;
key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
x5c?: string[] | undefined;
x5t?: string | undefined;
'x5t#S256'?: string | undefined;
x5u?: string | undefined;
ext?: boolean | undefined;
iat?: number | undefined;
exp?: number | undefined;
nbf?: number | undefined;
revoked?: {
revoked_at: number;
reason?: string | undefined;
} | undefined;
kty: "RSA";
alg?: "PS256" | "PS384" | "PS512" | "RS256" | "RS384" | "RS512" | undefined;
n: string;
e: string;
d?: string | undefined;
p?: string | undefined;
q?: string | undefined;
dp?: string | undefined;
dq?: string | undefined;
qi?: string | undefined;
oth?: {
r?: string | undefined;
d?: string | undefined;
t?: string | undefined;
}[] | undefined;
} & {
kid: NonNullable<unknown>;
}) | ({
kid?: string | undefined;
use?: "enc" | "sig" | undefined;
key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
x5c?: string[] | undefined;
x5t?: string | undefined;
'x5t#S256'?: string | undefined;
x5u?: string | undefined;
ext?: boolean | undefined;
iat?: number | undefined;
exp?: number | undefined;
nbf?: number | undefined;
revoked?: {
revoked_at: number;
reason?: string | undefined;
} | undefined;
kty: "EC";
alg?: "ES256" | "ES384" | "ES512" | undefined;
crv: "P-256" | "P-384" | "P-521";
x: string;
y: string;
d?: string | undefined;
} & {
kid: NonNullable<unknown>;
}) | ({
kid?: string | undefined;
use?: "enc" | "sig" | undefined;
key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
x5c?: string[] | undefined;
x5t?: string | undefined;
'x5t#S256'?: string | undefined;
x5u?: string | undefined;
ext?: boolean | undefined;
iat?: number | undefined;
exp?: number | undefined;
nbf?: number | undefined;
revoked?: {
revoked_at: number;
reason?: string | undefined;
} | undefined;
kty: "EC";
alg?: "ES256K" | undefined;
crv: "secp256k1";
x: string;
y: string;
d?: string | undefined;
} & {
kid: NonNullable<unknown>;
}) | ({
kid?: string | undefined;
use?: "enc" | "sig" | undefined;
key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
x5c?: string[] | undefined;
x5t?: string | undefined;
'x5t#S256'?: string | undefined;
x5u?: string | undefined;
ext?: boolean | undefined;
iat?: number | undefined;
exp?: number | undefined;
nbf?: number | undefined;
revoked?: {
revoked_at: number;
reason?: string | undefined;
} | undefined;
kty: "OKP";
alg?: "EdDSA" | undefined;
crv: "Ed25519" | "Ed448";
x: string;
d?: string | undefined;
} & {
kid: NonNullable<unknown>;
})) & {
d?: never;
})[];
} | undefined;
application_type: "native" | "web";
subject_type: "pairwise" | "public";
request_object_signing_alg?: string | undefined;
id_token_signed_response_alg?: string | undefined;
authorization_signed_response_alg: string;
authorization_encrypted_response_enc?: "A128CBC-HS256" | undefined;
authorization_encrypted_response_alg?: string | undefined;
client_id?: string | undefined;
client_name?: string | undefined;
client_uri?: "http://127.0.0.1" | "http://localhost" | `http://127.0.0.1#${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}` | `http://127.0.0.1?${string}` | `http://[::1]${string}` | `http://localhost#${string}` | `http://localhost/${string}` | `http://localhost:${string}` | `http://localhost?${string}` | `https://${string}` | undefined;
policy_uri?: "http://127.0.0.1" | "http://localhost" | `http://127.0.0.1#${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}` | `http://127.0.0.1?${string}` | `http://[::1]${string}` | `http://localhost#${string}` | `http://localhost/${string}` | `http://localhost:${string}` | `http://localhost?${string}` | `https://${string}` | undefined;
tos_uri?: "http://127.0.0.1" | "http://localhost" | `http://127.0.0.1#${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}` | `http://127.0.0.1?${string}` | `http://[::1]${string}` | `http://localhost#${string}` | `http://localhost/${string}` | `http://localhost:${string}` | `http://localhost?${string}` | `https://${string}` | undefined;
logo_uri?: "http://127.0.0.1" | "http://localhost" | `http://127.0.0.1#${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}` | `http://127.0.0.1?${string}` | `http://[::1]${string}` | `http://localhost#${string}` | `http://localhost/${string}` | `http://localhost:${string}` | `http://localhost?${string}` | `https://${string}` | undefined;
default_max_age?: number | undefined;
require_auth_time?: boolean | undefined;
contacts?: string[] | undefined;
tls_client_certificate_bound_access_tokens?: boolean | undefined;
dpop_bound_access_tokens?: boolean | undefined;
authorization_details_types?: string[] | undefined;
}>;
readonly clientMetadata: ClientMetadata;
readonly responseMode: OAuthResponseMode;
readonly keyset?: Keyset;
readonly runtime: Runtime;
readonly fetch: Fetch;
readonly oauthResolver: OAuthResolver;
readonly serverFactory: OAuthServerFactory;
protected readonly sessionGetter: SessionGetter;
protected readonly stateStore: StateStore;
constructor(options: OAuthClientOptions);
get identityResolver(): import("@atproto-labs/identity-resolver").IdentityResolver;
get jwks(): Readonly<{
keys: readonly (Readonly<{
kid?: string | undefined;
use?: "enc" | "sig" | undefined;
key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
x5c?: string[] | undefined;
x5t?: string | undefined;
'x5t#S256'?: string | undefined;
x5u?: string | undefined;
ext?: boolean | undefined;
iat?: number | undefined;
exp?: number | undefined;
nbf?: number | undefined;
revoked?: {
revoked_at: number;
reason?: string | undefined;
} | undefined;
kty: "RSA";
alg?: "PS256" | "PS384" | "PS512" | "RS256" | "RS384" | "RS512" | undefined;
n: string;
e: string;
d?: string | undefined;
p?: string | undefined;
q?: string | undefined;
dp?: string | undefined;
dq?: string | undefined;
qi?: string | undefined;
oth?: {
r?: string | undefined;
d?: string | undefined;
t?: string | undefined;
}[] | undefined;
} & {
kid: NonNullable<unknown>;
} & {
d?: never;
}> | Readonly<{
kid?: string | undefined;
use?: "enc" | "sig" | undefined;
key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
x5c?: string[] | undefined;
x5t?: string | undefined;
'x5t#S256'?: string | undefined;
x5u?: string | undefined;
ext?: boolean | undefined;
iat?: number | undefined;
exp?: number | undefined;
nbf?: number | undefined;
revoked?: {
revoked_at: number;
reason?: string | undefined;
} | undefined;
kty: "EC";
alg?: "ES256" | "ES384" | "ES512" | undefined;
crv: "P-256" | "P-384" | "P-521";
x: string;
y: string;
d?: string | undefined;
} & {
kid: NonNullable<unknown>;
} & {
d?: never;
}> | Readonly<{
kid?: string | undefined;
use?: "enc" | "sig" | undefined;
key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
x5c?: string[] | undefined;
x5t?: string | undefined;
'x5t#S256'?: string | undefined;
x5u?: string | undefined;
ext?: boolean | undefined;
iat?: number | undefined;
exp?: number | undefined;
nbf?: number | undefined;
revoked?: {
revoked_at: number;
reason?: string | undefined;
} | undefined;
kty: "EC";
alg?: "ES256K" | undefined;
crv: "secp256k1";
x: string;
y: string;
d?: string | undefined;
} & {
kid: NonNullable<unknown>;
} & {
d?: never;
}> | Readonly<{
kid?: string | undefined;
use?: "enc" | "sig" | undefined;
key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
x5c?: string[] | undefined;
x5t?: string | undefined;
'x5t#S256'?: string | undefined;
x5u?: string | undefined;
ext?: boolean | undefined;
iat?: number | undefined;
exp?: number | undefined;
nbf?: number | undefined;
revoked?: {
revoked_at: number;
reason?: string | undefined;
} | undefined;
kty: "OKP";
alg?: "EdDSA" | undefined;
crv: "Ed25519" | "Ed448";
x: string;
d?: string | undefined;
} & {
kid: NonNullable<unknown>;
} & {
d?: never;
}>)[];
}>;
authorize(input: string, { signal, ...options }?: AuthorizeOptions): Promise<URL>;
/**
* This method allows the client to proactively revoke the request_uri it
* created through PAR.
*/
abortRequest(authorizeUrl: URL): Promise<void>;
callback(params: URLSearchParams, options?: CallbackOptions): Promise<{
session: OAuthSession;
state: string | null;
}>;
/**
* Load a stored session. This will refresh the token only if needed (about to
* expire) by default.
*
* @see {@link SessionGetter.restore}
*/
restore(sub: string, refresh?: boolean | 'auto'): Promise<OAuthSession>;
revoke(sub: string): Promise<void>;
protected createSession(server: OAuthServerAgent, sub: AtprotoDid): OAuthSession;
}
//# sourceMappingURL=oauth-client.d.ts.map