···

       
10
       
 
       
# COOKIE_SECRET=""

     

       
11
       
 
       


     

       
12
       
 
       
# May be generated with `./bin/gen-jwk` (requires `npm install` once first)

     

       
13
       
-
       
# PRIVATE_JWKS='[{"kty":"EC","kid":"123",...}]'

     

···

       
10
       
 
       
# COOKIE_SECRET=""

     

       
11
       
 
       


     

       
12
       
 
       
# May be generated with `./bin/gen-jwk` (requires `npm install` once first)

     

       
13
       
+
       
# PRIVATE_KEYS='[{"kty":"EC","kid":"123",...}]'

     

···

       
12
       
 
       
import { SessionStore, StateStore } from './storage'

     

       
13
       
 
       


     

       
14
       
 
       
export async function createOAuthClient(db: Database) {

     

       
15
       
-
       
  assert(

     

       
16
       
-
       
    !env.PUBLIC_URL || env.PRIVATE_JWKS,

     

       
17
       
-
       
    'ATProto requires backend clients to be confidential',

     

       
18
       
-
       
  )

     

       
19
       
-
       


     

       
20
       
 
       
  // Confidential client require a keyset accessible on the internet. Non

     

       
21
       
 
       
  // internet clients (e.g. development) cannot expose a keyset on the internet

     

       
22
       
 
       
  // so they can't be private..

     

       
23
       
 
       
  const keyset =

     

       
24
       
-
       
    env.PUBLIC_URL && env.PRIVATE_JWKS

     

       
25
       
 
       
      ? new Keyset(

     

       
26
       
 
       
          await Promise.all(

     

       
27
       
-
       
            env.PRIVATE_JWKS.map((jwk) => JoseKey.fromJWK(jwk)),

     

       
28
       
 
       
          ),

     

       
29
       
 
       
        )

     

       
30
       
 
       
      : undefined

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
31
       
 
       


     

       
32
       
 
       
  // If a keyset is defined (meaning the client is confidential). Let's make

     

       
33
       
 
       
  // sure it has a private key for signing. Note: findPrivateKey will throw if

     
···

       
60
       
 
       
    clientMetadata,

     

       
61
       
 
       
    stateStore: new StateStore(db),

     

       
62
       
 
       
    sessionStore: new SessionStore(db),

     

       
63
       
-
       


     

       
64
       
-
       
    // XXX Staging

     

       
65
       
-
       
    plcDirectoryUrl: 'https://plc.staging.bsky.dev',

     

       
66
       
-
       
    handleResolver: 'https://staging.bsky.dev',

     

       
67
       
 
       
  })

     

       
68
       
 
       
}

     

···

       
12
       
 
       
import { SessionStore, StateStore } from './storage'

     

       
13
       
 
       


     

       
14
       
 
       
export async function createOAuthClient(db: Database) {

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
15
       
 
       
  // Confidential client require a keyset accessible on the internet. Non

     

       
16
       
 
       
  // internet clients (e.g. development) cannot expose a keyset on the internet

     

       
17
       
 
       
  // so they can't be private..

     

       
18
       
 
       
  const keyset =

     

       
19
       
+
       
    env.PUBLIC_URL && env.PRIVATE_KEYS

     

       
20
       
 
       
      ? new Keyset(

     

       
21
       
 
       
          await Promise.all(

     

       
22
       
+
       
            env.PRIVATE_KEYS.map((jwk) => JoseKey.fromJWK(jwk)),

     

       
23
       
 
       
          ),

     

       
24
       
 
       
        )

     

       
25
       
 
       
      : undefined

     

       
26
       
+
       


     

       
27
       
+
       
  assert(

     

       
28
       
+
       
    !env.PUBLIC_URL || keyset?.size,

     

       
29
       
+
       
    'ATProto requires backend clients to be confidential. Make sure to set the PRIVATE_KEYS environment variable.',

     

       
30
       
+
       
  )

     

       
31
       
 
       


     

       
32
       
 
       
  // If a keyset is defined (meaning the client is confidential). Let's make

     

       
33
       
 
       
  // sure it has a private key for signing. Note: findPrivateKey will throw if

     
···

       
60
       
 
       
    clientMetadata,

     

       
61
       
 
       
    stateStore: new StateStore(db),

     

       
62
       
 
       
    sessionStore: new SessionStore(db),

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
63
       
 
       
  })

     

       
64
       
 
       
}

     

···

       
13
       
 
       
  PUBLIC_URL: str({}),

     

       
14
       
 
       
  DB_PATH: str({ devDefault: ':memory:' }),

     

       
15
       
 
       
  COOKIE_SECRET: str({ devDefault: '00000000000000000000000000000000' }),

     

       
16
       
-
       
  PRIVATE_JWKS: envalidJsonWebKeys({ default: undefined }),

     

       
17
       
 
       
})

     

···

       
13
       
 
       
  PUBLIC_URL: str({}),

     

       
14
       
 
       
  DB_PATH: str({ devDefault: ':memory:' }),

     

       
15
       
 
       
  COOKIE_SECRET: str({ devDefault: '00000000000000000000000000000000' }),

     

       
16
       
+
       
  PRIVATE_KEYS: envalidJsonWebKeys({ default: undefined }),

     

       
17
       
 
       
})

     

···

       
21
       
 
       
import { home } from '#/pages/home'

     

       
22
       
 
       
import { login } from '#/pages/login'

     

       
23
       
 
       


     

       
24
       
-
       
type Session = { did: string }

     

       
25
       
 
       


     

       
26
       
 
       
// Helper function to get the Atproto Agent for the active session

     

       
27
       
 
       
async function getSessionAgent(

     
···

       
35
       
 
       
  })

     

       
36
       
 
       
  if (!session.did) return null

     

       
37
       
 
       
  try {

     

       
38
       
-
       
    const oauthSession = await ctx.oauthClient.restore(session.did)

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
39
       
 
       
    return oauthSession ? new Agent(oauthSession) : null

     

       
40
       
 
       
  } catch (err) {

     

       
41
       
 
       
    ctx.logger.warn({ err }, 'oauth restore failed')

     
···

       
139
       
 
       
        cookieName: 'sid',

     

       
140
       
 
       
        password: env.COOKIE_SECRET,

     

       
141
       
 
       
      })

     

       
142
       
-
       
      await session.destroy()

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
143
       
 
       
      return res.redirect('/')

     

       
144
       
 
       
    }),

     

       
145
       
 
       
  )

     

···

       
21
       
 
       
import { home } from '#/pages/home'

     

       
22
       
 
       
import { login } from '#/pages/login'

     

       
23
       
 
       


     

       
24
       
+
       
type Session = { did?: string }

     

       
25
       
 
       


     

       
26
       
 
       
// Helper function to get the Atproto Agent for the active session

     

       
27
       
 
       
async function getSessionAgent(

     
···

       
35
       
 
       
  })

     

       
36
       
 
       
  if (!session.did) return null

     

       
37
       
 
       
  try {

     

       
38
       
+
       
    // force rotating the credentials if the request has a no-cache header

     

       
39
       
+
       
    const refresh = req.headers['cache-control']?.includes('no-cache') || 'auto'

     

       
40
       
+
       


     

       
41
       
+
       
    const oauthSession = await ctx.oauthClient.restore(session.did, refresh)

     

       
42
       
 
       
    return oauthSession ? new Agent(oauthSession) : null

     

       
43
       
 
       
  } catch (err) {

     

       
44
       
 
       
    ctx.logger.warn({ err }, 'oauth restore failed')

     
···

       
142
       
 
       
        cookieName: 'sid',

     

       
143
       
 
       
        password: env.COOKIE_SECRET,

     

       
144
       
 
       
      })

     

       
145
       
+
       


     

       
146
       
+
       
      // Revoke credentials on the server

     

       
147
       
+
       
      if (session.did) {

     

       
148
       
+
       
        try {

     

       
149
       
+
       
          const oauthSession = await ctx.oauthClient.restore(session.did)

     

       
150
       
+
       
          if (oauthSession) await oauthSession.signOut()

     

       
151
       
+
       
        } catch (err) {

     

       
152
       
+
       
          ctx.logger.warn({ err }, 'Failed to revoke credentials')

     

       
153
       
+
       
        }

     

       
154
       
+
       
      }

     

       
155
       
+
       


     

       
156
       
+
       
      session.destroy()

     

       
157
       
+
       


     

       
158
       
 
       
      return res.redirect('/')

     

       
159
       
 
       
    }),

     

       
160
       
 
       
  )