@atproto/oauth-client
Version:
OAuth client for ATPROTO PDS. This package serves as common base for environment-specific implementations (NodeJS, Browser, React-Native).
430 lines • 24 kB
TypeScript
import { type TypeOf, z } from 'zod';
import { type OAuthAuthorizationRequestParameters } from '@atproto/oauth-types';
import type { Simplify } from './util.js';
export type AuthorizeOptions = Simplify<Omit<OAuthAuthorizationRequestParameters, 'client_id' | 'response_mode' | 'response_type' | 'login_hint' | 'code_challenge' | 'code_challenge_method'> & {
signal?: AbortSignal;
}>;
export type CallbackOptions = Simplify<Partial<Pick<OAuthAuthorizationRequestParameters, 'redirect_uri'>>>;
export declare const clientMetadataSchema: z.ZodObject<z.objectUtil.extendShape<{
redirect_uris: z.ZodArray<z.ZodEffects<z.ZodString, "http://127.0.0.1" | `${string}.${string}:/${string}` | `http://127.0.0.1#${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}` | `http://127.0.0.1?${string}` | `http://[::1]${string}` | `https://${string}`, string>, "atleastone">;
response_types: z.ZodDefault<z.ZodArray<z.ZodEnum<["code", "token", "none", "code id_token token", "code id_token", "code token", "id_token token", "id_token"]>, "atleastone">>;
grant_types: z.ZodDefault<z.ZodArray<z.ZodEnum<["authorization_code", "implicit", "refresh_token", "password", "client_credentials", "urn:ietf:params:oauth:grant-type:jwt-bearer", "urn:ietf:params:oauth:grant-type:saml2-bearer"]>, "atleastone">>;
scope: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
token_endpoint_auth_method: z.ZodDefault<z.ZodEnum<["client_secret_basic", "client_secret_jwt", "client_secret_post", "none", "private_key_jwt", "self_signed_tls_client_auth", "tls_client_auth"]>>;
token_endpoint_auth_signing_alg: z.ZodOptional<z.ZodString>;
userinfo_signed_response_alg: z.ZodOptional<z.ZodString>;
userinfo_encrypted_response_alg: z.ZodOptional<z.ZodString>;
jwks_uri: z.ZodOptional<z.ZodEffects<z.ZodString, "http://127.0.0.1" | "http://localhost" | `http://127.0.0.1#${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}` | `http://127.0.0.1?${string}` | `http://[::1]${string}` | `http://localhost#${string}` | `http://localhost/${string}` | `http://localhost:${string}` | `http://localhost?${string}` | `https://${string}`, string>>;
jwks: z.ZodOptional<z.ZodObject<{
keys: z.ZodEffects<z.ZodArray<z.ZodUnknown, "many">, ((({
kid?: string | undefined;
use?: "enc" | "sig" | undefined;
key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
x5c?: string[] | undefined;
x5t?: string | undefined;
'x5t#S256'?: string | undefined;
x5u?: string | undefined;
ext?: boolean | undefined;
iat?: number | undefined;
exp?: number | undefined;
nbf?: number | undefined;
revoked?: {
revoked_at: number;
reason?: string | undefined;
} | undefined;
kty: "RSA";
alg?: "PS256" | "PS384" | "PS512" | "RS256" | "RS384" | "RS512" | undefined;
n: string;
e: string;
d?: string | undefined;
p?: string | undefined;
q?: string | undefined;
dp?: string | undefined;
dq?: string | undefined;
qi?: string | undefined;
oth?: {
r?: string | undefined;
d?: string | undefined;
t?: string | undefined;
}[] | undefined;
} & {
kid: NonNullable<unknown>;
}) | ({
kid?: string | undefined;
use?: "enc" | "sig" | undefined;
key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
x5c?: string[] | undefined;
x5t?: string | undefined;
'x5t#S256'?: string | undefined;
x5u?: string | undefined;
ext?: boolean | undefined;
iat?: number | undefined;
exp?: number | undefined;
nbf?: number | undefined;
revoked?: {
revoked_at: number;
reason?: string | undefined;
} | undefined;
kty: "EC";
alg?: "ES256" | "ES384" | "ES512" | undefined;
crv: "P-256" | "P-384" | "P-521";
x: string;
y: string;
d?: string | undefined;
} & {
kid: NonNullable<unknown>;
}) | ({
kid?: string | undefined;
use?: "enc" | "sig" | undefined;
key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
x5c?: string[] | undefined;
x5t?: string | undefined;
'x5t#S256'?: string | undefined;
x5u?: string | undefined;
ext?: boolean | undefined;
iat?: number | undefined;
exp?: number | undefined;
nbf?: number | undefined;
revoked?: {
revoked_at: number;
reason?: string | undefined;
} | undefined;
kty: "EC";
alg?: "ES256K" | undefined;
crv: "secp256k1";
x: string;
y: string;
d?: string | undefined;
} & {
kid: NonNullable<unknown>;
}) | ({
kid?: string | undefined;
use?: "enc" | "sig" | undefined;
key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
x5c?: string[] | undefined;
x5t?: string | undefined;
'x5t#S256'?: string | undefined;
x5u?: string | undefined;
ext?: boolean | undefined;
iat?: number | undefined;
exp?: number | undefined;
nbf?: number | undefined;
revoked?: {
revoked_at: number;
reason?: string | undefined;
} | undefined;
kty: "OKP";
alg?: "EdDSA" | undefined;
crv: "Ed25519" | "Ed448";
x: string;
d?: string | undefined;
} & {
kid: NonNullable<unknown>;
})) & {
d?: never;
})[], unknown[]>;
}, "strip", z.ZodTypeAny, {
keys: ((({
kid?: string | undefined;
use?: "enc" | "sig" | undefined;
key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
x5c?: string[] | undefined;
x5t?: string | undefined;
'x5t#S256'?: string | undefined;
x5u?: string | undefined;
ext?: boolean | undefined;
iat?: number | undefined;
exp?: number | undefined;
nbf?: number | undefined;
revoked?: {
revoked_at: number;
reason?: string | undefined;
} | undefined;
kty: "RSA";
alg?: "PS256" | "PS384" | "PS512" | "RS256" | "RS384" | "RS512" | undefined;
n: string;
e: string;
d?: string | undefined;
p?: string | undefined;
q?: string | undefined;
dp?: string | undefined;
dq?: string | undefined;
qi?: string | undefined;
oth?: {
r?: string | undefined;
d?: string | undefined;
t?: string | undefined;
}[] | undefined;
} & {
kid: NonNullable<unknown>;
}) | ({
kid?: string | undefined;
use?: "enc" | "sig" | undefined;
key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
x5c?: string[] | undefined;
x5t?: string | undefined;
'x5t#S256'?: string | undefined;
x5u?: string | undefined;
ext?: boolean | undefined;
iat?: number | undefined;
exp?: number | undefined;
nbf?: number | undefined;
revoked?: {
revoked_at: number;
reason?: string | undefined;
} | undefined;
kty: "EC";
alg?: "ES256" | "ES384" | "ES512" | undefined;
crv: "P-256" | "P-384" | "P-521";
x: string;
y: string;
d?: string | undefined;
} & {
kid: NonNullable<unknown>;
}) | ({
kid?: string | undefined;
use?: "enc" | "sig" | undefined;
key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
x5c?: string[] | undefined;
x5t?: string | undefined;
'x5t#S256'?: string | undefined;
x5u?: string | undefined;
ext?: boolean | undefined;
iat?: number | undefined;
exp?: number | undefined;
nbf?: number | undefined;
revoked?: {
revoked_at: number;
reason?: string | undefined;
} | undefined;
kty: "EC";
alg?: "ES256K" | undefined;
crv: "secp256k1";
x: string;
y: string;
d?: string | undefined;
} & {
kid: NonNullable<unknown>;
}) | ({
kid?: string | undefined;
use?: "enc" | "sig" | undefined;
key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
x5c?: string[] | undefined;
x5t?: string | undefined;
'x5t#S256'?: string | undefined;
x5u?: string | undefined;
ext?: boolean | undefined;
iat?: number | undefined;
exp?: number | undefined;
nbf?: number | undefined;
revoked?: {
revoked_at: number;
reason?: string | undefined;
} | undefined;
kty: "OKP";
alg?: "EdDSA" | undefined;
crv: "Ed25519" | "Ed448";
x: string;
d?: string | undefined;
} & {
kid: NonNullable<unknown>;
})) & {
d?: never;
})[];
}, {
keys: unknown[];
}>>;
application_type: z.ZodDefault<z.ZodEnum<["web", "native"]>>;
subject_type: z.ZodDefault<z.ZodEnum<["public", "pairwise"]>>;
request_object_signing_alg: z.ZodOptional<z.ZodString>;
id_token_signed_response_alg: z.ZodOptional<z.ZodString>;
authorization_signed_response_alg: z.ZodDefault<z.ZodString>;
authorization_encrypted_response_enc: z.ZodOptional<z.ZodEnum<["A128CBC-HS256"]>>;
authorization_encrypted_response_alg: z.ZodOptional<z.ZodString>;
client_id: z.ZodOptional<z.ZodString>;
client_name: z.ZodOptional<z.ZodString>;
client_uri: z.ZodOptional<z.ZodEffects<z.ZodString, "http://127.0.0.1" | "http://localhost" | `http://127.0.0.1#${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}` | `http://127.0.0.1?${string}` | `http://[::1]${string}` | `http://localhost#${string}` | `http://localhost/${string}` | `http://localhost:${string}` | `http://localhost?${string}` | `https://${string}`, string>>;
policy_uri: z.ZodOptional<z.ZodEffects<z.ZodString, "http://127.0.0.1" | "http://localhost" | `http://127.0.0.1#${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}` | `http://127.0.0.1?${string}` | `http://[::1]${string}` | `http://localhost#${string}` | `http://localhost/${string}` | `http://localhost:${string}` | `http://localhost?${string}` | `https://${string}`, string>>;
tos_uri: z.ZodOptional<z.ZodEffects<z.ZodString, "http://127.0.0.1" | "http://localhost" | `http://127.0.0.1#${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}` | `http://127.0.0.1?${string}` | `http://[::1]${string}` | `http://localhost#${string}` | `http://localhost/${string}` | `http://localhost:${string}` | `http://localhost?${string}` | `https://${string}`, string>>;
logo_uri: z.ZodOptional<z.ZodEffects<z.ZodString, "http://127.0.0.1" | "http://localhost" | `http://127.0.0.1#${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}` | `http://127.0.0.1?${string}` | `http://[::1]${string}` | `http://localhost#${string}` | `http://localhost/${string}` | `http://localhost:${string}` | `http://localhost?${string}` | `https://${string}`, string>>;
default_max_age: z.ZodOptional<z.ZodNumber>;
require_auth_time: z.ZodOptional<z.ZodBoolean>;
contacts: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
tls_client_certificate_bound_access_tokens: z.ZodOptional<z.ZodBoolean>;
dpop_bound_access_tokens: z.ZodOptional<z.ZodBoolean>;
authorization_details_types: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
}, {
client_id: z.ZodUnion<[z.ZodEffects<z.ZodIntersection<z.ZodString, z.ZodEffects<z.ZodEffects<z.ZodString, `${string}:${string}`, string>, `https://${string}`, string>>, `https://${string}/${string}`, string>, z.ZodEffects<z.ZodString, "http://localhost" | "http://localhost/" | `http://localhost/?${string}` | `http://localhost?${string}`, string>]>;
}>, "strip", z.ZodTypeAny, {
redirect_uris: ["http://127.0.0.1" | `${string}.${string}:/${string}` | `http://127.0.0.1#${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}` | `http://127.0.0.1?${string}` | `http://[::1]${string}` | `https://${string}`, ...("http://127.0.0.1" | `${string}.${string}:/${string}` | `http://127.0.0.1#${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}` | `http://127.0.0.1?${string}` | `http://[::1]${string}` | `https://${string}`)[]];
response_types: ["code" | "code id_token" | "code id_token token" | "code token" | "id_token" | "id_token token" | "none" | "token", ...("code" | "code id_token" | "code id_token token" | "code token" | "id_token" | "id_token token" | "none" | "token")[]];
grant_types: ["authorization_code" | "client_credentials" | "implicit" | "password" | "refresh_token" | "urn:ietf:params:oauth:grant-type:jwt-bearer" | "urn:ietf:params:oauth:grant-type:saml2-bearer", ...("authorization_code" | "client_credentials" | "implicit" | "password" | "refresh_token" | "urn:ietf:params:oauth:grant-type:jwt-bearer" | "urn:ietf:params:oauth:grant-type:saml2-bearer")[]];
scope?: string | undefined;
token_endpoint_auth_method: "client_secret_basic" | "client_secret_jwt" | "client_secret_post" | "none" | "private_key_jwt" | "self_signed_tls_client_auth" | "tls_client_auth";
token_endpoint_auth_signing_alg?: string | undefined;
userinfo_signed_response_alg?: string | undefined;
userinfo_encrypted_response_alg?: string | undefined;
jwks_uri?: "http://127.0.0.1" | "http://localhost" | `http://127.0.0.1#${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}` | `http://127.0.0.1?${string}` | `http://[::1]${string}` | `http://localhost#${string}` | `http://localhost/${string}` | `http://localhost:${string}` | `http://localhost?${string}` | `https://${string}` | undefined;
jwks?: {
keys: ((({
kid?: string | undefined;
use?: "enc" | "sig" | undefined;
key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
x5c?: string[] | undefined;
x5t?: string | undefined;
'x5t#S256'?: string | undefined;
x5u?: string | undefined;
ext?: boolean | undefined;
iat?: number | undefined;
exp?: number | undefined;
nbf?: number | undefined;
revoked?: {
revoked_at: number;
reason?: string | undefined;
} | undefined;
kty: "RSA";
alg?: "PS256" | "PS384" | "PS512" | "RS256" | "RS384" | "RS512" | undefined;
n: string;
e: string;
d?: string | undefined;
p?: string | undefined;
q?: string | undefined;
dp?: string | undefined;
dq?: string | undefined;
qi?: string | undefined;
oth?: {
r?: string | undefined;
d?: string | undefined;
t?: string | undefined;
}[] | undefined;
} & {
kid: NonNullable<unknown>;
}) | ({
kid?: string | undefined;
use?: "enc" | "sig" | undefined;
key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
x5c?: string[] | undefined;
x5t?: string | undefined;
'x5t#S256'?: string | undefined;
x5u?: string | undefined;
ext?: boolean | undefined;
iat?: number | undefined;
exp?: number | undefined;
nbf?: number | undefined;
revoked?: {
revoked_at: number;
reason?: string | undefined;
} | undefined;
kty: "EC";
alg?: "ES256" | "ES384" | "ES512" | undefined;
crv: "P-256" | "P-384" | "P-521";
x: string;
y: string;
d?: string | undefined;
} & {
kid: NonNullable<unknown>;
}) | ({
kid?: string | undefined;
use?: "enc" | "sig" | undefined;
key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
x5c?: string[] | undefined;
x5t?: string | undefined;
'x5t#S256'?: string | undefined;
x5u?: string | undefined;
ext?: boolean | undefined;
iat?: number | undefined;
exp?: number | undefined;
nbf?: number | undefined;
revoked?: {
revoked_at: number;
reason?: string | undefined;
} | undefined;
kty: "EC";
alg?: "ES256K" | undefined;
crv: "secp256k1";
x: string;
y: string;
d?: string | undefined;
} & {
kid: NonNullable<unknown>;
}) | ({
kid?: string | undefined;
use?: "enc" | "sig" | undefined;
key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
x5c?: string[] | undefined;
x5t?: string | undefined;
'x5t#S256'?: string | undefined;
x5u?: string | undefined;
ext?: boolean | undefined;
iat?: number | undefined;
exp?: number | undefined;
nbf?: number | undefined;
revoked?: {
revoked_at: number;
reason?: string | undefined;
} | undefined;
kty: "OKP";
alg?: "EdDSA" | undefined;
crv: "Ed25519" | "Ed448";
x: string;
d?: string | undefined;
} & {
kid: NonNullable<unknown>;
})) & {
d?: never;
})[];
} | undefined;
application_type: "native" | "web";
subject_type: "pairwise" | "public";
request_object_signing_alg?: string | undefined;
id_token_signed_response_alg?: string | undefined;
authorization_signed_response_alg: string;
authorization_encrypted_response_enc?: "A128CBC-HS256" | undefined;
authorization_encrypted_response_alg?: string | undefined;
client_name?: string | undefined;
client_uri?: "http://127.0.0.1" | "http://localhost" | `http://127.0.0.1#${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}` | `http://127.0.0.1?${string}` | `http://[::1]${string}` | `http://localhost#${string}` | `http://localhost/${string}` | `http://localhost:${string}` | `http://localhost?${string}` | `https://${string}` | undefined;
policy_uri?: "http://127.0.0.1" | "http://localhost" | `http://127.0.0.1#${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}` | `http://127.0.0.1?${string}` | `http://[::1]${string}` | `http://localhost#${string}` | `http://localhost/${string}` | `http://localhost:${string}` | `http://localhost?${string}` | `https://${string}` | undefined;
tos_uri?: "http://127.0.0.1" | "http://localhost" | `http://127.0.0.1#${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}` | `http://127.0.0.1?${string}` | `http://[::1]${string}` | `http://localhost#${string}` | `http://localhost/${string}` | `http://localhost:${string}` | `http://localhost?${string}` | `https://${string}` | undefined;
logo_uri?: "http://127.0.0.1" | "http://localhost" | `http://127.0.0.1#${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}` | `http://127.0.0.1?${string}` | `http://[::1]${string}` | `http://localhost#${string}` | `http://localhost/${string}` | `http://localhost:${string}` | `http://localhost?${string}` | `https://${string}` | undefined;
default_max_age?: number | undefined;
require_auth_time?: boolean | undefined;
contacts?: string[] | undefined;
tls_client_certificate_bound_access_tokens?: boolean | undefined;
dpop_bound_access_tokens?: boolean | undefined;
authorization_details_types?: string[] | undefined;
client_id: "http://localhost" | "http://localhost/" | `http://localhost/?${string}` | `http://localhost?${string}` | `https://${string}/${string}`;
}, {
redirect_uris: [string, ...string[]];
response_types?: ["code" | "code id_token" | "code id_token token" | "code token" | "id_token" | "id_token token" | "none" | "token", ...("code" | "code id_token" | "code id_token token" | "code token" | "id_token" | "id_token token" | "none" | "token")[]] | undefined;
grant_types?: ["authorization_code" | "client_credentials" | "implicit" | "password" | "refresh_token" | "urn:ietf:params:oauth:grant-type:jwt-bearer" | "urn:ietf:params:oauth:grant-type:saml2-bearer", ...("authorization_code" | "client_credentials" | "implicit" | "password" | "refresh_token" | "urn:ietf:params:oauth:grant-type:jwt-bearer" | "urn:ietf:params:oauth:grant-type:saml2-bearer")[]] | undefined;
scope?: string | undefined;
token_endpoint_auth_method?: "client_secret_basic" | "client_secret_jwt" | "client_secret_post" | "none" | "private_key_jwt" | "self_signed_tls_client_auth" | "tls_client_auth" | undefined;
token_endpoint_auth_signing_alg?: string | undefined;
userinfo_signed_response_alg?: string | undefined;
userinfo_encrypted_response_alg?: string | undefined;
jwks_uri?: string | undefined;
jwks?: {
keys: unknown[];
} | undefined;
application_type?: "native" | "web" | undefined;
subject_type?: "pairwise" | "public" | undefined;
request_object_signing_alg?: string | undefined;
id_token_signed_response_alg?: string | undefined;
authorization_signed_response_alg?: string | undefined;
authorization_encrypted_response_enc?: "A128CBC-HS256" | undefined;
authorization_encrypted_response_alg?: string | undefined;
client_name?: string | undefined;
client_uri?: string | undefined;
policy_uri?: string | undefined;
tos_uri?: string | undefined;
logo_uri?: string | undefined;
default_max_age?: number | undefined;
require_auth_time?: boolean | undefined;
contacts?: string[] | undefined;
tls_client_certificate_bound_access_tokens?: boolean | undefined;
dpop_bound_access_tokens?: boolean | undefined;
authorization_details_types?: string[] | undefined;
client_id: string;
}>;
export type ClientMetadata = TypeOf<typeof clientMetadataSchema>;
//# sourceMappingURL=types.d.ts.map