PDS software with bells & whistles you didn’t even know you needed. will move this to its own account when ready.
fix "localhost client" support and use in frontend when in dev mode
authored by
nelind
and committed by
tangled.org
c69c7749
68e7f4ee
+41
-35
+18
-21
frontend/src/lib/oauth.ts
+18
-21
frontend/src/lib/oauth.ts
···
1
1
const OAUTH_STATE_KEY = 'tranquil_pds_oauth_state'
2
2
const OAUTH_VERIFIER_KEY = 'tranquil_pds_oauth_verifier'
3
+
const SCOPES = [
4
+
'atproto',
5
+
'repo:*?action=create',
6
+
'repo:*?action=update',
7
+
'repo:*?action=delete',
8
+
'blob:*/*',
9
+
].join(' ')
10
+
const CLIENT_ID = !(import.meta.env.DEV)
11
+
? `${window.location.origin}/oauth/client-metadata.json`
12
+
: `http://localhost/oauth/client-metadata.json?scope=${SCOPES}`
13
+
const REDIRECT_URI = `${window.location.origin}/`
3
14
4
15
interface OAuthState {
5
16
state: string
···
65
76
66
77
saveOAuthState({ state, codeVerifier })
67
78
68
-
const clientId = `${window.location.origin}/oauth/client-metadata.json`
69
-
const redirectUri = `${window.location.origin}/`
70
-
71
79
const parResponse = await fetch('/oauth/par', {
72
80
method: 'POST',
73
81
headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
74
82
body: new URLSearchParams({
75
-
client_id: clientId,
76
-
redirect_uri: redirectUri,
83
+
client_id: CLIENT_ID,
84
+
redirect_uri: REDIRECT_URI,
77
85
response_type: 'code',
78
-
scope: [
79
-
'atproto',
80
-
'repo:*?action=create',
81
-
'repo:*?action=update',
82
-
'repo:*?action=delete',
83
-
'blob:*/*',
84
-
].join(' '),
86
+
scope: SCOPES,
85
87
state: state,
86
88
code_challenge: codeChallenge,
87
89
code_challenge_method: 'S256',
···
96
98
const { request_uri } = await parResponse.json()
97
99
98
100
const authorizeUrl = new URL('/oauth/authorize', window.location.origin)
99
-
authorizeUrl.searchParams.set('client_id', clientId)
101
+
authorizeUrl.searchParams.set('client_id', CLIENT_ID)
100
102
authorizeUrl.searchParams.set('request_uri', request_uri)
101
103
102
104
window.location.href = authorizeUrl.toString()
···
122
124
throw new Error('OAuth state mismatch. Please try logging in again.')
123
125
}
124
126
125
-
const clientId = `${window.location.origin}/oauth/client-metadata.json`
126
-
const redirectUri = `${window.location.origin}/`
127
-
128
127
const tokenResponse = await fetch('/oauth/token', {
129
128
method: 'POST',
130
129
headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
131
130
body: new URLSearchParams({
132
131
grant_type: 'authorization_code',
133
-
client_id: clientId,
132
+
client_id: CLIENT_ID,
134
133
code: code,
135
-
redirect_uri: redirectUri,
134
+
redirect_uri: REDIRECT_URI,
136
135
code_verifier: savedState.codeVerifier,
137
136
}),
138
137
})
···
148
147
}
149
148
150
149
export async function refreshOAuthToken(refreshToken: string): Promise<OAuthTokens> {
151
-
const clientId = `${window.location.origin}/oauth/client-metadata.json`
152
-
153
150
const tokenResponse = await fetch('/oauth/token', {
154
151
method: 'POST',
155
152
headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
156
153
body: new URLSearchParams({
157
154
grant_type: 'refresh_token',
158
-
client_id: clientId,
155
+
client_id: CLIENT_ID,
159
156
refresh_token: refreshToken,
160
157
}),
161
158
})
+23
-14
src/oauth/client.rs
+23
-14
src/oauth/client.rs
···
89
89
fn is_loopback_client(client_id: &str) -> bool {
90
90
if let Ok(url) = reqwest::Url::parse(client_id) {
91
91
url.scheme() == "http"
92
-
&& matches!(url.host_str(), Some("localhost") | Some("127.0.0.1"))
93
-
&& url.query().is_some()
92
+
&& url.host_str() == Some("localhost")
93
+
&& url.port().is_none()
94
+
&& url.path().is_empty()
94
95
} else {
95
96
false
96
97
}
···
98
99
99
100
fn build_loopback_metadata(client_id: &str) -> Result<ClientMetadata, OAuthError> {
100
101
let url = reqwest::Url::parse(client_id)
101
-
.map_err(|_| OAuthError::InvalidClient("Invalid loopback client_id URL".to_string()))?;
102
-
let mut redirect_uris = Vec::new();
102
+
.map_err(|_| OAuthError::InvalidClient("Invalid loopback client_id URL".into()))?;
103
+
let mut redirect_uris = Vec::<String>::new();
104
+
let mut scope: Option<String> = None;
103
105
for (key, value) in url.query_pairs() {
104
106
if key == "redirect_uri" {
105
107
redirect_uris.push(value.to_string());
108
+
break;
109
+
}
110
+
if key == "scope" {
111
+
scope = Some(value.into());
112
+
break;
106
113
}
107
114
}
108
115
if redirect_uris.is_empty() {
109
-
redirect_uris.push("http://127.0.0.1/callback".to_string());
110
-
redirect_uris.push("http://localhost/callback".to_string());
116
+
redirect_uris.push("http://127.0.0.1/".into());
117
+
redirect_uris.push("http://[::1]/".into());
118
+
}
119
+
if scope.is_none() {
120
+
scope = Some("atproto".into());
111
121
}
112
-
let scope = Some("atproto transition:generic transition:chat.bsky".to_string());
113
122
Ok(ClientMetadata {
114
-
client_id: client_id.to_string(),
115
-
client_name: Some("Loopback Client".to_string()),
123
+
client_id: client_id.into(),
124
+
client_name: Some("Loopback Client".into()),
116
125
client_uri: None,
117
126
logo_uri: None,
118
127
redirect_uris,
119
128
grant_types: vec![
120
-
"authorization_code".to_string(),
121
-
"refresh_token".to_string(),
129
+
"authorization_code".into(),
130
+
"refresh_token".into(),
122
131
],
123
-
response_types: vec!["code".to_string()],
132
+
response_types: vec!["code".into()],
124
133
scope,
125
-
token_endpoint_auth_method: Some("none".to_string()),
134
+
token_endpoint_auth_method: Some("none".into()),
126
135
dpop_bound_access_tokens: Some(false),
127
136
jwks: None,
128
137
jwks_uri: None,
129
-
application_type: Some("native".to_string()),
138
+
application_type: Some("native".into()),
130
139
})
131
140
}
132
141