commit d02398d16f5fb88197cd60c7a886a6854c99c7ab · zbrox.com/jacquard

Cargo.lock

···

       1680
       1680
        
       dependencies = [

     

       1681
       1681
        
        "async-trait",

     

       1682
       1682
        
        "base64 0.22.1",

     

       1683
       1683
       +
        "bytes",

     

       1683
       1684
        
        "chrono",

     

       1684
       1685
        
        "dashmap",

     

       1685
       1686
        
        "elliptic-curve",

+177 -14

crates/jacquard-common/src/types/xrpc.rs

···

       1
       1
       +
       //! Stateless XRPC utilities and request/response mapping

     

       2
       2
       +
       //!

     

       3
       3
       +
       //! Mapping overview:

     

       4
       4
       +
       //! - Success (2xx): parse body into the endpoint's typed output.

     

       5
       5
       +
       //! - 400: try typed error; on failure, fall back to a generic XRPC error (with

     

       6
       6
       +
       //!   `nsid`, `method`, and `http_status`) and map common auth errors.

     

       7
       7
       +
       //! - 401: if `WWW-Authenticate` is present, return

     

       8
       8
       +
       //!   `ClientError::Auth(AuthError::Other(header))` so higher layers (OAuth/DPoP)

     

       9
       9
       +
       //!   can inspect `error="invalid_token"` or `error="use_dpop_nonce"` and refresh/retry.

     

       10
       10
       +
       //!   If the header is absent, parse the body and map auth errors to

     

       11
       11
       +
       //!   `AuthError::TokenExpired`/`InvalidToken`.

     

       12
       12
       +
       //!

     

       1
       13
        
       use bytes::Bytes;

     

       2
       14
        
       use http::{

     

       3
       15
        
           HeaderName, HeaderValue, Request, StatusCode,

     
···

       251
       263
        
           }

     

       252
       264
        
       

     

       253
       265
        
           /// Send the given typed XRPC request and return a response wrapper.

     

       266
       266
       +
           ///

     

       267
       267
       +
           /// Note on 401 handling:

     

       268
       268
       +
           /// - When the server returns 401 with a `WWW-Authenticate` header, this surfaces as

     

       269
       269
       +
           ///   `ClientError::Auth(AuthError::Other(header))` so higher layers (e.g., OAuth/DPoP) can

     

       270
       270
       +
           ///   inspect the header for `error="invalid_token"` or `error="use_dpop_nonce"` and react

     

       271
       271
       +
           ///   (refresh/retry). If the header is absent, the 401 body flows through to `Response` and

     

       272
       272
       +
           ///   can be parsed/mapped to `AuthError` as appropriate.

     

       254
       273
        
           pub async fn send<R: XrpcRequest + Send>(self, request: &R) -> XrpcResult<Response<R>> {

     

       255
       274
        
               let http_request = build_http_request(&self.base, request, &self.opts)

     

       256
       275
        
                   .map_err(crate::error::TransportError::from)?;

     
···

       262
       281
        
                   .map_err(|e| crate::error::TransportError::Other(Box::new(e)))?;

     

       263
       282
        
       

     

       264
       283
        
               let status = http_response.status();

     

       284
       284
       +
               // If the server returned 401 with a WWW-Authenticate header, expose it so higher layers

     

       285
       285
       +
               // (e.g., DPoP handling) can detect `error="invalid_token"` and trigger refresh.

     

       286
       286
       +
               if status.as_u16() == 401 {

     

       287
       287
       +
                   if let Some(hv) = http_response.headers().get(http::header::WWW_AUTHENTICATE) {

     

       288
       288
       +
                       return Err(crate::error::ClientError::Auth(

     

       289
       289
       +
                           crate::error::AuthError::Other(hv.clone()),

     

       290
       290
       +
                       ));

     

       291
       291
       +
                   }

     

       292
       292
       +
               }

     

       265
       293
        
               let buffer = Bytes::from(http_response.into_body());

     

       266
       294
        
       

     

       267
       295
        
               if !status.is_success() && !matches!(status.as_u16(), 400 | 401) {

     
···

       430
       458
        
                       Err(_) => {

     

       431
       459
        
                           // Fallback to generic error (InvalidRequest, ExpiredToken, etc.)

     

       432
       460
        
                           match serde_json::from_slice::<GenericXrpcError>(&self.buffer) {

     

       433
       433
       -
                               Ok(generic) => {

     

       461
       461
       +
                               Ok(mut generic) => {

     

       462
       462
       +
                                   generic.nsid = R::NSID;

     

       463
       463
       +
                                   generic.method = R::METHOD.as_str();

     

       464
       464
       +
                                   generic.http_status = self.status;

     

       434
       465
        
                                   // Map auth-related errors to AuthError

     

       435
       466
        
                                   match generic.error.as_str() {

     

       436
       467
        
                                       "ExpiredToken" => Err(XrpcError::Auth(AuthError::TokenExpired)),

     
···

       445
       476
        
               // 401: always auth error

     

       446
       477
        
               } else {

     

       447
       478
        
                   match serde_json::from_slice::<GenericXrpcError>(&self.buffer) {

     

       448
       448
       -
                       Ok(generic) => match generic.error.as_str() {

     

       449
       449
       -
                           "ExpiredToken" => Err(XrpcError::Auth(AuthError::TokenExpired)),

     

       450
       450
       -
                           "InvalidToken" => Err(XrpcError::Auth(AuthError::InvalidToken)),

     

       451
       451
       -
                           _ => Err(XrpcError::Auth(AuthError::NotAuthenticated)),

     

       452
       452
       -
                       },

     

       479
       479
       +
                       Ok(mut generic) => {

     

       480
       480
       +
                           generic.nsid = R::NSID;

     

       481
       481
       +
                           generic.method = R::METHOD.as_str();

     

       482
       482
       +
                           generic.http_status = self.status;

     

       483
       483
       +
                           match generic.error.as_str() {

     

       484
       484
       +
                               "ExpiredToken" => Err(XrpcError::Auth(AuthError::TokenExpired)),

     

       485
       485
       +
                               "InvalidToken" => Err(XrpcError::Auth(AuthError::InvalidToken)),

     

       486
       486
       +
                               _ => Err(XrpcError::Auth(AuthError::NotAuthenticated)),

     

       487
       487
       +
                           }

     

       488
       488
       +
                       }

     

       453
       489
        
                       Err(e) => Err(XrpcError::Decode(e)),

     

       454
       490
        
                   }

     

       455
       491
        
               }

     
···

       487
       523
        
                       Err(_) => {

     

       488
       524
        
                           // Fallback to generic error (InvalidRequest, ExpiredToken, etc.)

     

       489
       525
        
                           match serde_json::from_slice::<GenericXrpcError>(&self.buffer) {

     

       490
       490
       -
                               Ok(generic) => {

     

       526
       526
       +
                               Ok(mut generic) => {

     

       527
       527
       +
                                   generic.nsid = R::NSID;

     

       528
       528
       +
                                   generic.method = R::METHOD.as_str();

     

       529
       529
       +
                                   generic.http_status = self.status;

     

       491
       530
        
                                   // Map auth-related errors to AuthError

     

       492
       531
        
                                   match generic.error.as_ref() {

     

       493
       532
        
                                       "ExpiredToken" => Err(XrpcError::Auth(AuthError::TokenExpired)),

     
···

       502
       541
        
               // 401: always auth error

     

       503
       542
        
               } else {

     

       504
       543
        
                   match serde_json::from_slice::<GenericXrpcError>(&self.buffer) {

     

       505
       505
       -
                       Ok(generic) => match generic.error.as_ref() {

     

       506
       506
       -
                           "ExpiredToken" => Err(XrpcError::Auth(AuthError::TokenExpired)),

     

       507
       507
       -
                           "InvalidToken" => Err(XrpcError::Auth(AuthError::InvalidToken)),

     

       508
       508
       -
                           _ => Err(XrpcError::Auth(AuthError::NotAuthenticated)),

     

       509
       509
       -
                       },

     

       544
       544
       +
                       Ok(mut generic) => {

     

       545
       545
       +
                           let status = self.status;

     

       546
       546
       +
                           generic.nsid = R::NSID;

     

       547
       547
       +
                           generic.method = R::METHOD.as_str();

     

       548
       548
       +
                           generic.http_status = status;

     

       549
       549
       +
                           match generic.error.as_ref() {

     

       550
       550
       +
                               "ExpiredToken" => Err(XrpcError::Auth(AuthError::TokenExpired)),

     

       551
       551
       +
                               "InvalidToken" => Err(XrpcError::Auth(AuthError::InvalidToken)),

     

       552
       552
       +
                               _ => Err(XrpcError::Auth(AuthError::NotAuthenticated)),

     

       553
       553
       +
                           }

     

       554
       554
       +
                       }

     

       510
       555
        
                       Err(e) => Err(XrpcError::Decode(e)),

     

       511
       556
        
                   }

     

       512
       557
        
               }

     
···

       527
       572
        
           pub error: SmolStr,

     

       528
       573
        
           /// Optional error message with details

     

       529
       574
        
           pub message: Option<SmolStr>,

     

       575
       575
       +
           /// XRPC method NSID that produced this error (context only; not serialized)

     

       576
       576
       +
           #[serde(skip)]

     

       577
       577
       +
           pub nsid: &'static str,

     

       578
       578
       +
           /// HTTP method used (GET/POST) (context only; not serialized)

     

       579
       579
       +
           #[serde(skip)]

     

       580
       580
       +
           pub method: &'static str,

     

       581
       581
       +
           /// HTTP status code (context only; not serialized)

     

       582
       582
       +
           #[serde(skip)]

     

       583
       583
       +
           pub http_status: StatusCode,

     

       530
       584
        
       }

     

       531
       585
        
       

     

       532
       586
        
       impl std::fmt::Display for GenericXrpcError {

     

       533
       587
        
           fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {

     

       534
       588
        
               if let Some(msg) = &self.message {

     

       535
       535
       -
                   write!(f, "{}: {}", self.error, msg)

     

       589
       589
       +
                   write!(

     

       590
       590
       +
                       f,

     

       591
       591
       +
                       "{}: {} (nsid={}, method={}, status={})",

     

       592
       592
       +
                       self.error, msg, self.nsid, self.method, self.http_status

     

       593
       593
       +
                   )

     

       536
       594
        
               } else {

     

       537
       537
       -
                   write!(f, "{}", self.error)

     

       595
       595
       +
                   write!(

     

       596
       596
       +
                       f,

     

       597
       597
       +
                       "{} (nsid={}, method={}, status={})",

     

       598
       598
       +
                       self.error, self.nsid, self.method, self.http_status

     

       599
       599
       +
                   )

     

       538
       600
        
               }

     

       539
       601
        
           }

     

       540
       602
        
       }

     
···

       549
       611
        
       pub enum XrpcError<E: std::error::Error + IntoStatic> {

     

       550
       612
        
           /// Typed XRPC error from the endpoint's specific error enum

     

       551
       613
        
           #[error("XRPC error: {0}")]

     

       614
       614
       +
           #[diagnostic(code(jacquard_common::xrpc::typed))]

     

       552
       615
        
           Xrpc(E),

     

       553
       616
        
       

     

       554
       617
        
           /// Authentication error (ExpiredToken, InvalidToken, etc.)

     

       555
       618
        
           #[error("Authentication error: {0}")]

     

       619
       619
       +
           #[diagnostic(code(jacquard_common::xrpc::auth))]

     

       556
       620
        
           Auth(#[from] AuthError),

     

       557
       621
        
       

     

       558
       622
        
           /// Generic XRPC error not in the endpoint's error enum (e.g., InvalidRequest)

     

       559
       623
        
           #[error("XRPC error: {0}")]

     

       624
       624
       +
           #[diagnostic(code(jacquard_common::xrpc::generic))]

     

       560
       625
        
           Generic(GenericXrpcError),

     

       561
       626
        
       

     

       562
       627
        
           /// Failed to decode the response body

     

       563
       628
        
           #[error("Failed to decode response: {0}")]

     

       629
       629
       +
           #[diagnostic(code(jacquard_common::xrpc::decode))]

     

       564
       630
        
           Decode(#[from] serde_json::Error),

     

       631
       631
       +
       }

     

       632
       632
       +
       

     

       633
       633
       +
       #[cfg(test)]

     

       634
       634
       +
       mod tests {

     

       635
       635
       +
           use super::*;

     

       636
       636
       +
           use serde::{Deserialize, Serialize};

     

       637
       637
       +
       

     

       638
       638
       +
           #[derive(Serialize)]

     

       639
       639
       +
           struct DummyReq;

     

       640
       640
       +
       

     

       641
       641
       +
           #[derive(Deserialize, Debug, thiserror::Error)]

     

       642
       642
       +
           #[error("{0}")]

     

       643
       643
       +
           struct DummyErr<'a>(#[serde(borrow)] CowStr<'a>);

     

       644
       644
       +
       

     

       645
       645
       +
           impl IntoStatic for DummyErr<'_> {

     

       646
       646
       +
               type Output = DummyErr<'static>;

     

       647
       647
       +
               fn into_static(self) -> Self::Output {

     

       648
       648
       +
                   DummyErr(self.0.into_static())

     

       649
       649
       +
               }

     

       650
       650
       +
           }

     

       651
       651
       +
       

     

       652
       652
       +
           impl XrpcRequest for DummyReq {

     

       653
       653
       +
               const NSID: &'static str = "test.dummy";

     

       654
       654
       +
               const METHOD: XrpcMethod = XrpcMethod::Procedure("application/json");

     

       655
       655
       +
               const OUTPUT_ENCODING: &'static str = "application/json";

     

       656
       656
       +
               type Output<'de> = ();

     

       657
       657
       +
               type Err<'de> = DummyErr<'de>;

     

       658
       658
       +
           }

     

       659
       659
       +
       

     

       660
       660
       +
           #[test]

     

       661
       661
       +
           fn generic_error_carries_context() {

     

       662
       662
       +
               let body = serde_json::json!({"error":"InvalidRequest","message":"missing"});

     

       663
       663
       +
               let buf = Bytes::from(serde_json::to_vec(&body).unwrap());

     

       664
       664
       +
               let resp: Response<DummyReq> = Response::new(buf, StatusCode::BAD_REQUEST);

     

       665
       665
       +
               match resp.parse().unwrap_err() {

     

       666
       666
       +
                   XrpcError::Generic(g) => {

     

       667
       667
       +
                       assert_eq!(g.error.as_str(), "InvalidRequest");

     

       668
       668
       +
                       assert_eq!(g.message.as_deref(), Some("missing"));

     

       669
       669
       +
                       assert_eq!(g.nsid, DummyReq::NSID);

     

       670
       670
       +
                       assert_eq!(g.method, DummyReq::METHOD.as_str());

     

       671
       671
       +
                       assert_eq!(g.http_status, StatusCode::BAD_REQUEST);

     

       672
       672
       +
                   }

     

       673
       673
       +
                   other => panic!("unexpected: {other:?}"),

     

       674
       674
       +
               }

     

       675
       675
       +
           }

     

       676
       676
       +
       

     

       677
       677
       +
           #[test]

     

       678
       678
       +
           fn auth_error_mapping() {

     

       679
       679
       +
               for (code, expect) in [

     

       680
       680
       +
                   ("ExpiredToken", AuthError::TokenExpired),

     

       681
       681
       +
                   ("InvalidToken", AuthError::InvalidToken),

     

       682
       682
       +
               ] {

     

       683
       683
       +
                   let body = serde_json::json!({"error": code});

     

       684
       684
       +
                   let buf = Bytes::from(serde_json::to_vec(&body).unwrap());

     

       685
       685
       +
                   let resp: Response<DummyReq> = Response::new(buf, StatusCode::UNAUTHORIZED);

     

       686
       686
       +
                   match resp.parse().unwrap_err() {

     

       687
       687
       +
                       XrpcError::Auth(e) => match (e, expect) {

     

       688
       688
       +
                           (AuthError::TokenExpired, AuthError::TokenExpired) => {}

     

       689
       689
       +
                           (AuthError::InvalidToken, AuthError::InvalidToken) => {}

     

       690
       690
       +
                           other => panic!("mismatch: {other:?}"),

     

       691
       691
       +
                       },

     

       692
       692
       +
                       other => panic!("unexpected: {other:?}"),

     

       693
       693
       +
                   }

     

       694
       694
       +
               }

     

       695
       695
       +
           }

     

       696
       696
       +
       

     

       697
       697
       +
           #[test]

     

       698
       698
       +
           fn no_double_slash_in_path() {

     

       699
       699
       +
               #[derive(Serialize)]

     

       700
       700
       +
               struct Req;

     

       701
       701
       +
               #[derive(Deserialize, Debug, thiserror::Error)]

     

       702
       702
       +
               #[error("{0}")]

     

       703
       703
       +
               struct Err<'a>(#[serde(borrow)] CowStr<'a>);

     

       704
       704
       +
               impl IntoStatic for Err<'_> {

     

       705
       705
       +
                   type Output = Err<'static>;

     

       706
       706
       +
                   fn into_static(self) -> Self::Output { Err(self.0.into_static()) }

     

       707
       707
       +
               }

     

       708
       708
       +
               impl XrpcRequest for Req {

     

       709
       709
       +
                   const NSID: &'static str = "com.example.test";

     

       710
       710
       +
                   const METHOD: XrpcMethod = XrpcMethod::Query;

     

       711
       711
       +
                   const OUTPUT_ENCODING: &'static str = "application/json";

     

       712
       712
       +
                   type Output<'de> = ();

     

       713
       713
       +
                   type Err<'de> = Err<'de>;

     

       714
       714
       +
               }

     

       715
       715
       +
       

     

       716
       716
       +
               let opts = CallOptions::default();

     

       717
       717
       +
               for base in [

     

       718
       718
       +
                   Url::parse("https://pds").unwrap(),

     

       719
       719
       +
                   Url::parse("https://pds/").unwrap(),

     

       720
       720
       +
                   Url::parse("https://pds/base/").unwrap(),

     

       721
       721
       +
               ] {

     

       722
       722
       +
                   let req = build_http_request(&base, &Req, &opts).unwrap();

     

       723
       723
       +
                   let uri = req.uri().to_string();

     

       724
       724
       +
                   assert!(uri.contains("/xrpc/com.example.test"));

     

       725
       725
       +
                   assert!(!uri.contains("//xrpc"));

     

       726
       726
       +
               }

     

       727
       727
       +
           }

     

       565
       728
        
       }

     

       566
       729
        
       

     

       567
       730
        
       /// Stateful XRPC call trait

+12

crates/jacquard-identity/src/resolver.rs

···

       36
       36
        
       #[allow(missing_docs)]

     

       37
       37
        
       pub enum IdentityError {

     

       38
       38
        
           #[error("unsupported DID method: {0}")]

     

       39
       39
       +
           #[diagnostic(code(jacquard_identity::unsupported_did_method), help("supported DID methods: did:web, did:plc"))]

     

       39
       40
        
           UnsupportedDidMethod(String),

     

       40
       41
        
           #[error("invalid well-known atproto-did content")]

     

       42
       42
       +
           #[diagnostic(code(jacquard_identity::invalid_well_known), help("expected first non-empty line to be a DID"))]

     

       41
       43
        
           InvalidWellKnown,

     

       42
       44
        
           #[error("missing PDS endpoint in DID document")]

     

       45
       45
       +
           #[diagnostic(code(jacquard_identity::missing_pds_endpoint))]

     

       43
       46
        
           MissingPdsEndpoint,

     

       44
       47
        
           #[error("HTTP error: {0}")]

     

       48
       48
       +
           #[diagnostic(code(jacquard_identity::http), help("check network connectivity and TLS configuration"))]

     

       45
       49
        
           Http(#[from] TransportError),

     

       46
       50
        
           #[error("HTTP status {0}")]

     

       51
       51
       +
           #[diagnostic(code(jacquard_identity::http_status), help("verify well-known paths or PDS XRPC endpoints"))]

     

       47
       52
        
           HttpStatus(StatusCode),

     

       48
       53
        
           #[error("XRPC error: {0}")]

     

       54
       54
       +
           #[diagnostic(code(jacquard_identity::xrpc), help("enable PDS fallback or public resolver if needed"))]

     

       49
       55
        
           Xrpc(String),

     

       50
       56
        
           #[error("URL parse error: {0}")]

     

       57
       57
       +
           #[diagnostic(code(jacquard_identity::url))]

     

       51
       58
        
           Url(#[from] url::ParseError),

     

       52
       59
        
           #[error("DNS error: {0}")]

     

       53
       60
        
           #[cfg(feature = "dns")]

     

       61
       61
       +
           #[diagnostic(code(jacquard_identity::dns))]

     

       54
       62
        
           Dns(#[from] hickory_resolver::error::ResolveError),

     

       55
       63
        
           #[error("serialize/deserialize error: {0}")]

     

       64
       64
       +
           #[diagnostic(code(jacquard_identity::serde))]

     

       56
       65
        
           Serde(#[from] serde_json::Error),

     

       57
       66
        
           #[error("invalid DID document: {0}")]

     

       67
       67
       +
           #[diagnostic(code(jacquard_identity::invalid_doc), help("validate keys and services; ensure AtprotoPersonalDataServer service exists"))]

     

       58
       68
        
           InvalidDoc(String),

     

       59
       69
        
           #[error(transparent)]

     

       70
       70
       +
           #[diagnostic(code(jacquard_identity::data))]

     

       60
       71
        
           Data(#[from] AtDataError),

     

       61
       72
        
           /// DID document id did not match requested DID; includes the fetched document

     

       62
       73
        
           #[error("DID doc id mismatch")]

     

       74
       74
       +
           #[diagnostic(code(jacquard_identity::doc_id_mismatch), help("document id differs from requested DID; do not trust this document"))]

     

       63
       75
        
           DocIdMismatch {

     

       64
       76
        
               expected: Did<'static>,

     

       65
       77
        
               doc: DidDocument<'static>,

crates/jacquard-oauth/Cargo.toml

···

       25
       25
        
       chrono = "0.4"

     

       26
       26
        
       elliptic-curve = "0.13.8"

     

       27
       27
        
       http.workspace = true

     

       28
       28
       +
       bytes.workspace = true

     

       28
       29
        
       rand = { version = "0.8.5", features = ["small_rng"] }

     

       29
       30
        
       async-trait = "0.1.89"

     

       30
       31
        
       dashmap = "6.1.0"

+77 -26

crates/jacquard-oauth/src/atproto.rs

···

       109
       109
        
               mut redirect_uris: Option<Vec<Url>>,

     

       110
       110
        
               scopes: Option<Vec<Scope<'m>>>,

     

       111
       111
        
           ) -> Self {

     

       112
       112
       -
               // coerce redirect uris to localhost

     

       112
       112
       +
               // Coerce provided redirect URIs to http://localhost while preserving path

     

       113
       113
        
               if let Some(redirect_uris) = &mut redirect_uris {

     

       114
       114
        
                   for redirect_uri in redirect_uris {

     

       115
       115
       -
                       redirect_uri.set_host(Some("http://localhost")).unwrap();

     

       115
       115
       +
                       let _ = redirect_uri.set_scheme("http");

     

       116
       116
       +
                       redirect_uri.set_host(Some("localhost")).unwrap();

     

       117
       117
       +
                       let _ = redirect_uri.set_port(None);

     

       116
       118
        
                   }

     

       117
       119
        
               }

     

       118
       120
        
               // determine client_id

     
···

       154
       156
        
           metadata: AtprotoClientMetadata<'m>,

     

       155
       157
        
           keyset: &Option<Keyset>,

     

       156
       158
        
       ) -> Result<OAuthClientMetadata<'m>> {

     

       159
       159
       +
           // For non-loopback clients, require a keyset/JWKs.

     

       160
       160
       +
           let is_loopback = metadata.client_id.scheme() == "http"

     

       161
       161
       +
               && metadata.client_id.host_str() == Some("localhost");

     

       162
       162
       +
           if !is_loopback && keyset.is_none() {

     

       163
       163
       +
               return Err(Error::EmptyJwks);

     

       164
       164
       +
           }

     

       157
       165
        
           if metadata.redirect_uris.is_empty() {

     

       158
       166
        
               return Err(Error::EmptyRedirectUris);

     

       159
       167
        
           }

     
···

       179
       187
        
               client_uri: metadata.client_uri,

     

       180
       188
        
               redirect_uris: metadata.redirect_uris,

     

       181
       189
        
               token_endpoint_auth_method: Some(auth_method.into()),

     

       182
       182
       -
               grant_types: Some(metadata.grant_types.into_iter().map(|v| v.into()).collect()),

     

       183
       183
       -
               scope: Some(Scope::serialize_multiple(metadata.scopes.as_slice())),

     

       184
       184
       -
               dpop_bound_access_tokens: Some(true),

     

       190
       190
       +
               grant_types: if keyset.is_some() {

     

       191
       191
       +
                   Some(metadata.grant_types.into_iter().map(|v| v.into()).collect())

     

       192
       192
       +
               } else {

     

       193
       193
       +
                   None

     

       194
       194
       +
               },

     

       195
       195
       +
               scope: if keyset.is_some() {

     

       196
       196
       +
                   Some(Scope::serialize_multiple(metadata.scopes.as_slice()))

     

       197
       197
       +
               } else {

     

       198
       198
       +
                   None

     

       199
       199
       +
               },

     

       200
       200
       +
               dpop_bound_access_tokens: if keyset.is_some() { Some(true) } else { None },

     

       185
       201
        
               jwks_uri,

     

       186
       202
        
               jwks,

     

       187
       203
        
               token_endpoint_auth_signing_alg: if keyset.is_some() {

     
···

       251
       267
        
                   .expect("failed to convert metadata"),

     

       252
       268
        
                   OAuthClientMetadata {

     

       253
       269
        
                       client_id: Url::from_str(

     

       254
       254
       -
                           "http://localhost?redirect_uri=http%3A%2F%2F127.0.0.1%2Fcallback&redirect_uri=http%3A%2F%2F%5B%3A%3A1%5D%2Fcallback&scope=account%3Aemail+atproto+transition%3Ageneric"

     

       270
       270
       +
                           "http://localhost?redirect_uri=http%3A%2F%2Flocalhost%2Fcallback&redirect_uri=http%3A%2F%2Flocalhost%2Fcallback&scope=account%3Aemail+atproto+transition%3Ageneric"

     

       255
       271
        
                       ).unwrap(),

     

       256
       272
        
                       client_uri: None,

     

       257
       273
        
                       redirect_uris: vec![

     

       258
       258
       -
                           Url::from_str("http://127.0.0.1/callback").unwrap(),

     

       259
       259
       -
                           Url::from_str("http://[::1]/callback").unwrap(),

     

       274
       274
       +
                           Url::from_str("http://localhost/callback").unwrap(),

     

       275
       275
       +
                           Url::from_str("http://localhost/callback").unwrap(),

     

       260
       276
        
                       ],

     

       261
       277
        
                       scope: None,

     

       262
       278
        
                       grant_types: None,

     
···

       271
       287
        
       

     

       272
       288
        
           #[test]

     

       273
       289
        
           fn test_localhost_client_metadata_invalid() {

     

       290
       290
       +
               // Invalid inputs are coerced to http://localhost rather than failing

     

       274
       291
        
               {

     

       275
       275
       -
                   let err = atproto_client_metadata(

     

       292
       292
       +
                   let out = atproto_client_metadata(

     

       276
       293
        
                       AtprotoClientMetadata::new_localhost(

     

       277
       294
        
                           Some(vec![Url::from_str("https://127.0.0.1/").unwrap()]),

     

       278
       295
        
                           None,

     

       279
       296
        
                       ),

     

       280
       297
        
                       &None,

     

       281
       298
        
                   )

     

       282
       282
       -
                   .expect_err("expected to fail");

     

       283
       283
       -
                   assert!(matches!(

     

       284
       284
       -
                       err,

     

       285
       285
       -
                       Error::LocalhostClient(LocalhostClientError::NotHttpScheme)

     

       286
       286
       -
                   ));

     

       299
       299
       +
                   .expect("should coerce to localhost");

     

       300
       300
       +
                   assert_eq!(

     

       301
       301
       +
                       out,

     

       302
       302
       +
                       OAuthClientMetadata {

     

       303
       303
       +
                           client_id: Url::from_str("http://localhost?redirect_uri=http%3A%2F%2Flocalhost%2F").unwrap(),

     

       304
       304
       +
                           client_uri: None,

     

       305
       305
       +
                           redirect_uris: vec![Url::from_str("http://localhost/").unwrap()],

     

       306
       306
       +
                           scope: None,

     

       307
       307
       +
                           grant_types: None,

     

       308
       308
       +
                           token_endpoint_auth_method: Some(AuthMethod::None.into()),

     

       309
       309
       +
                           dpop_bound_access_tokens: None,

     

       310
       310
       +
                           jwks_uri: None,

     

       311
       311
       +
                           jwks: None,

     

       312
       312
       +
                           token_endpoint_auth_signing_alg: None,

     

       313
       313
       +
                       }

     

       314
       314
       +
                   );

     

       287
       315
        
               }

     

       288
       316
        
               {

     

       289
       289
       -
                   let err = atproto_client_metadata(

     

       317
       317
       +
                   let out = atproto_client_metadata(

     

       290
       318
        
                       AtprotoClientMetadata::new_localhost(

     

       291
       319
        
                           Some(vec![Url::from_str("http://localhost:8000/").unwrap()]),

     

       292
       320
        
                           None,

     

       293
       321
        
                       ),

     

       294
       322
        
                       &None,

     

       295
       323
        
                   )

     

       296
       296
       -
                   .expect_err("expected to fail");

     

       297
       297
       -
                   assert!(matches!(

     

       298
       298
       -
                       err,

     

       299
       299
       -
                       Error::LocalhostClient(LocalhostClientError::Localhost)

     

       300
       300
       -
                   ));

     

       324
       324
       +
                   .expect("should coerce to localhost");

     

       325
       325
       +
                   assert_eq!(

     

       326
       326
       +
                       out,

     

       327
       327
       +
                       OAuthClientMetadata {

     

       328
       328
       +
                           client_id: Url::from_str("http://localhost?redirect_uri=http%3A%2F%2Flocalhost%2F").unwrap(),

     

       329
       329
       +
                           client_uri: None,

     

       330
       330
       +
                           redirect_uris: vec![Url::from_str("http://localhost/").unwrap()],

     

       331
       331
       +
                           scope: None,

     

       332
       332
       +
                           grant_types: None,

     

       333
       333
       +
                           token_endpoint_auth_method: Some(AuthMethod::None.into()),

     

       334
       334
       +
                           dpop_bound_access_tokens: None,

     

       335
       335
       +
                           jwks_uri: None,

     

       336
       336
       +
                           jwks: None,

     

       337
       337
       +
                           token_endpoint_auth_signing_alg: None,

     

       338
       338
       +
                       }

     

       339
       339
       +
                   );

     

       301
       340
        
               }

     

       302
       341
        
               {

     

       303
       303
       -
                   let err = atproto_client_metadata(

     

       342
       342
       +
                   let out = atproto_client_metadata(

     

       304
       343
        
                       AtprotoClientMetadata::new_localhost(

     

       305
       344
        
                           Some(vec![Url::from_str("http://192.168.0.0/").unwrap()]),

     

       306
       345
        
                           None,

     

       307
       346
        
                       ),

     

       308
       347
        
                       &None,

     

       309
       348
        
                   )

     

       310
       310
       -
                   .expect_err("expected to fail");

     

       311
       311
       -
                   assert!(matches!(

     

       312
       312
       -
                       err,

     

       313
       313
       -
                       Error::LocalhostClient(LocalhostClientError::NotLoopbackHost)

     

       314
       314
       -
                   ));

     

       349
       349
       +
                   .expect("should coerce to localhost");

     

       350
       350
       +
                   assert_eq!(

     

       351
       351
       +
                       out,

     

       352
       352
       +
                       OAuthClientMetadata {

     

       353
       353
       +
                           client_id: Url::from_str("http://localhost?redirect_uri=http%3A%2F%2Flocalhost%2F").unwrap(),

     

       354
       354
       +
                           client_uri: None,

     

       355
       355
       +
                           redirect_uris: vec![Url::from_str("http://localhost/").unwrap()],

     

       356
       356
       +
                           scope: None,

     

       357
       357
       +
                           grant_types: None,

     

       358
       358
       +
                           token_endpoint_auth_method: Some(AuthMethod::None.into()),

     

       359
       359
       +
                           dpop_bound_access_tokens: None,

     

       360
       360
       +
                           jwks_uri: None,

     

       361
       361
       +
                           jwks: None,

     

       362
       362
       +
                           token_endpoint_auth_signing_alg: None,

     

       363
       363
       +
                       }

     

       364
       364
       +
                   );

     

       315
       365
        
               }

     

       316
       366
        
           }

     

       317
       367
        
       

     
···

       326
       376
        
                   jwks_uri: None,

     

       327
       377
        
               };

     

       328
       378
        
               {

     

       379
       379
       +
                   // Non-loopback clients without a keyset should fail (must provide JWKS)

     

       329
       380
        
                   let metadata = metadata.clone();

     

       330
       381
        
                   let err = atproto_client_metadata(metadata, &None).expect_err("expected to fail");

     

       331
       382
        
                   assert!(matches!(err, Error::EmptyJwks));

+26 -22

crates/jacquard-oauth/src/client.rs

···

       2
       2
        
           atproto::atproto_client_metadata,

     

       3
       3
        
           authstore::ClientAuthStore,

     

       4
       4
        
           dpop::DpopExt,

     

       5
       5
       -
           error::{OAuthError, Result},

     

       5
       5
       +
           error::{CallbackError, Result},

     

       6
       6
        
           request::{OAuthMetadata, exchange_code, par},

     

       7
       7
        
           resolver::OAuthResolver,

     

       8
       8
        
           scopes::Scope,

     
···

       105
       105
        
       

     

       106
       106
        
           pub async fn callback(&self, params: CallbackParams<'_>) -> Result<OAuthSession<T, S>> {

     

       107
       107
        
               let Some(state_key) = params.state else {

     

       108
       108
       -
                   return Err(OAuthError::Callback("missing state parameter".into()));

     

       108
       108
       +
                   return Err(CallbackError::MissingState.into());

     

       109
       109
        
               };

     

       110
       110
        
       

     

       111
       111
        
               let Some(auth_req_info) = self.registry.store.get_auth_req_info(&state_key).await? else {

     

       112
       112
       -
                   return Err(OAuthError::Callback(format!(

     

       113
       113
       -
                       "unknown authorization state: {state_key}"

     

       114
       114
       -
                   )));

     

       112
       112
       +
                   return Err(CallbackError::MissingState.into());

     

       115
       113
        
               };

     

       116
       114
        
       

     

       117
       115
        
               self.registry.store.delete_auth_req_info(&state_key).await?;

     
···

       122
       120
        
                   .await?;

     

       123
       121
        
       

     

       124
       122
        
               if let Some(iss) = params.iss {

     

       125
       125
       -
                   if iss != metadata.issuer {

     

       126
       126
       -
                       return Err(OAuthError::Callback(format!(

     

       127
       127
       -
                           "issuer mismatch: expected {}, got {iss}",

     

       128
       128
       -
                           metadata.issuer

     

       129
       129
       -
                       )));

     

       123
       123
       +
                   if !crate::resolver::issuer_equivalent(&iss, &metadata.issuer) {

     

       124
       124
       +
                       return Err(CallbackError::IssuerMismatch { expected: metadata.issuer.to_string(), got: iss.to_string() }.into());

     

       130
       125
        
                   }

     

       131
       126
        
               } else if metadata.authorization_response_iss_parameter_supported == Some(true) {

     

       132
       132
       -
                   return Err(OAuthError::Callback("missing `iss` parameter".into()));

     

       127
       127
       +
                   return Err(CallbackError::MissingIssuer.into());

     

       133
       128
        
               }

     

       134
       129
        
               let metadata = OAuthMetadata {

     

       135
       130
        
                   server_metadata: metadata,

     
···

       257
       252
        
           }

     

       258
       253
        
       

     

       259
       254
        
           pub async fn refresh_token(&self) -> Option<AuthorizationToken<'_>> {

     

       260
       260
       -
               self.data

     

       261
       261
       -
                   .read()

     

       262
       262
       -
                   .await

     

       263
       263
       -
                   .token_set

     

       264
       264
       -
                   .refresh_token

     

       265
       265
       -
                   .as_ref()

     

       266
       266
       -
                   .map(|token| AuthorizationToken::Dpop(token.clone()))

     

       255
       255
       +
               self.data.read().await.token_set.refresh_token.as_ref().map(|t| AuthorizationToken::Dpop(t.clone()))

     

       267
       256
        
           }

     

       268
       257
        
       }

     

       269
       258
        
       impl<T, S> OAuthSession<T, S>

     
···

       272
       261
        
           T: OAuthResolver + DpopExt + Send + Sync + 'static,

     

       273
       262
        
       {

     

       274
       263
        
           pub async fn refresh(&self) -> Result<AuthorizationToken<'_>> {

     

       275
       275
       -
               let mut data = self.data.write().await;

     

       264
       264
       +
               // Read identifiers without holding the lock across await

     

       265
       265
       +
               let (did, sid) = {

     

       266
       266
       +
                   let data = self.data.read().await;

     

       267
       267
       +
                   (data.account_did.clone(), data.session_id.clone())

     

       268
       268
       +
               };

     

       276
       269
        
               let refreshed = self

     

       277
       270
        
                   .registry

     

       278
       271
        
                   .as_ref()

     

       279
       279
       -
                   .get(&data.account_did, &data.session_id, true)

     

       272
       272
       +
                   .get(&did, &sid, true)

     

       280
       273
        
                   .await?;

     

       281
       274
        
               let token = AuthorizationToken::Dpop(refreshed.token_set.access_token.clone());

     

       282
       282
       -
               *data = refreshed.into_static();

     

       275
       275
       +
               // Write back updated session

     

       276
       276
       +
               *self.data.write().await = refreshed.into_static();

     

       283
       277
        
               Ok(token)

     

       284
       278
        
           }

     

       285
       279
        
       }

     
···

       305
       299
        
           T: OAuthResolver + DpopExt + XrpcExt + Send + Sync + 'static,

     

       306
       300
        
       {

     

       307
       301
        
           fn base_uri(&self) -> Url {

     

       308
       308
       -
               self.data.blocking_read().host_url.clone()

     

       302
       302
       +
               // base_uri is a synchronous trait method; we must avoid async `.read().await`.

     

       303
       303
       +
               // Use `block_in_place` under Tokio to perform a blocking RwLock read safely.

     

       304
       304
       +
               if tokio::runtime::Handle::try_current().is_ok() {

     

       305
       305
       +
                   tokio::task::block_in_place(|| self.data.blocking_read().host_url.clone())

     

       306
       306
       +
               } else {

     

       307
       307
       +
                   self.data.blocking_read().host_url.clone()

     

       308
       308
       +
               }

     

       309
       309
        
           }

     

       310
       310
        
       

     

       311
       311
        
           async fn opts(&self) -> CallOptions<'_> {

     
···

       349
       349
        
               Err(ClientError::Auth(AuthError::Other(value))) => value

     

       350
       350
        
                   .to_str()

     

       351
       351
        
                   .is_ok_and(|s| s.starts_with("DPoP ") && s.contains("error=\"invalid_token\"")),

     

       352
       352
       +
               Ok(resp) => match resp.parse() {

     

       353
       353
       +
                   Err(jacquard_common::types::xrpc::XrpcError::Auth(AuthError::InvalidToken)) => true,

     

       354
       354
       +
                   _ => false,

     

       355
       355
       +
               },

     

       352
       356
        
               _ => false,

     

       353
       357
        
           }

     

       354
       358
        
       }

+50 -39

crates/jacquard-oauth/src/error.rs

···

       1
       1
        
       use jacquard_common::session::SessionStoreError;

     

       2
       2
        
       use miette::Diagnostic;

     

       3
       3
        
       

     

       4
       4
       +
       use crate::request::RequestError;

     

       4
       5
        
       use crate::resolver::ResolverError;

     

       5
       6
        
       

     

       6
       6
       -
       /// Errors emitted by OAuth helpers.

     

       7
       7
       +
       /// High-level errors emitted by OAuth helpers.

     

       7
       8
        
       #[derive(Debug, thiserror::Error, Diagnostic)]

     

       8
       9
        
       pub enum OAuthError {

     

       9
       9
       -
           /// Invalid or unsupported JWK

     

       10
       10
       -
           #[error("invalid JWK: {0}")]

     

       11
       11
       -
           #[diagnostic(

     

       12
       12
       -
               code(jacquard_oauth::jwk),

     

       13
       13
       -
               help("Ensure EC P-256 JWK with base64url x,y,d values")

     

       14
       14
       -
           )]

     

       15
       15
       -
           Jwk(String),

     

       16
       16
       -
           /// Signing error

     

       17
       17
       -
           #[error("signing error: {0}")]

     

       18
       18
       -
           #[diagnostic(

     

       19
       19
       -
               code(jacquard_oauth::signing),

     

       20
       20
       -
               help("Check ES256 key material and input payloads")

     

       21
       21
       -
           )]

     

       22
       22
       -
           Signing(String),

     

       23
       23
       -
           /// Serialization error

     

       10
       10
       +
           #[error(transparent)]

     

       11
       11
       +
           #[diagnostic(code(jacquard_oauth::resolver))]

     

       12
       12
       +
           Resolver(#[from] ResolverError),

     

       13
       13
       +
       

     

       14
       14
       +
           #[error(transparent)]

     

       15
       15
       +
           #[diagnostic(code(jacquard_oauth::request))]

     

       16
       16
       +
           Request(#[from] RequestError),

     

       17
       17
       +
       

     

       24
       18
        
           #[error(transparent)]

     

       25
       25
       -
           #[diagnostic(code(jacquard_oauth::serde))]

     

       26
       26
       -
           Serde(#[from] serde_json::Error),

     

       27
       27
       -
           /// URL error

     

       19
       19
       +
           #[diagnostic(code(jacquard_oauth::storage))]

     

       20
       20
       +
           Storage(#[from] SessionStoreError),

     

       21
       21
       +
       

     

       28
       22
        
           #[error(transparent)]

     

       29
       29
       -
           #[diagnostic(code(jacquard_oauth::url))]

     

       30
       30
       -
           Url(#[from] url::ParseError),

     

       31
       31
       -
           /// URL error

     

       23
       23
       +
           #[diagnostic(code(jacquard_oauth::dpop))]

     

       24
       24
       +
           Dpop(#[from] crate::dpop::Error),

     

       25
       25
       +
       

     

       32
       26
        
           #[error(transparent)]

     

       33
       33
       -
           #[diagnostic(code(jacquard_oauth::url))]

     

       34
       34
       -
           UrlEncoding(#[from] serde_html_form::ser::Error),

     

       35
       35
       -
           /// PKCE error

     

       36
       36
       -
           #[error("pkce error: {0}")]

     

       37
       37
       -
           #[diagnostic(

     

       38
       38
       -
               code(jacquard_oauth::pkce),

     

       39
       39
       -
               help("PKCE must use S256; ensure verifier/challenge generated")

     

       40
       40
       -
           )]

     

       41
       41
       -
           Pkce(String),

     

       42
       42
       -
           #[error("authorize error: {0}")]

     

       43
       43
       -
           Authorize(String),

     

       27
       27
       +
           #[diagnostic(code(jacquard_oauth::keyset))]

     

       28
       28
       +
           Keyset(#[from] crate::keyset::Error),

     

       29
       29
       +
       

     

       44
       30
        
           #[error(transparent)]

     

       31
       31
       +
           #[diagnostic(code(jacquard_oauth::atproto))]

     

       45
       32
        
           Atproto(#[from] crate::atproto::Error),

     

       46
       46
       -
           #[error("callback error: {0}")]

     

       47
       47
       -
           Callback(String),

     

       48
       48
       -
           #[error(transparent)]

     

       49
       49
       -
           Storage(#[from] SessionStoreError),

     

       33
       33
       +
       

     

       50
       34
        
           #[error(transparent)]

     

       35
       35
       +
           #[diagnostic(code(jacquard_oauth::session))]

     

       51
       36
        
           Session(#[from] crate::session::Error),

     

       37
       37
       +
       

     

       52
       38
        
           #[error(transparent)]

     

       53
       53
       -
           Request(#[from] crate::request::Error),

     

       39
       39
       +
           #[diagnostic(code(jacquard_oauth::serde_json))]

     

       40
       40
       +
           SerdeJson(#[from] serde_json::Error),

     

       41
       41
       +
       

     

       54
       42
        
           #[error(transparent)]

     

       55
       55
       -
           Client(#[from] ResolverError),

     

       43
       43
       +
           #[diagnostic(code(jacquard_oauth::url))]

     

       44
       44
       +
           Url(#[from] url::ParseError),

     

       45
       45
       +
       

     

       46
       46
       +
           #[error(transparent)]

     

       47
       47
       +
           #[diagnostic(code(jacquard_oauth::form))]

     

       48
       48
       +
           Form(#[from] serde_html_form::ser::Error),

     

       49
       49
       +
       

     

       50
       50
       +
           #[error(transparent)]

     

       51
       51
       +
           #[diagnostic(code(jacquard_oauth::callback))]

     

       52
       52
       +
           Callback(#[from] CallbackError),

     

       53
       53
       +
       }

     

       54
       54
       +
       

     

       55
       55
       +
       /// Typed callback validation errors (redirect handling).

     

       56
       56
       +
       #[derive(Debug, thiserror::Error, Diagnostic)]

     

       57
       57
       +
       pub enum CallbackError {

     

       58
       58
       +
           #[error("missing state parameter in callback")] 

     

       59
       59
       +
           #[diagnostic(code(jacquard_oauth::callback::missing_state))]

     

       60
       60
       +
           MissingState,

     

       61
       61
       +
           #[error("missing `iss` parameter")] 

     

       62
       62
       +
           #[diagnostic(code(jacquard_oauth::callback::missing_iss))]

     

       63
       63
       +
           MissingIssuer,

     

       64
       64
       +
           #[error("issuer mismatch: expected {expected}, got {got}")]

     

       65
       65
       +
           #[diagnostic(code(jacquard_oauth::callback::issuer_mismatch))]

     

       66
       66
       +
           IssuerMismatch { expected: String, got: String },

     

       56
       67
        
       }

     

       57
       68
        
       

     

       58
       69
        
       pub type Result<T> = core::result::Result<T, OAuthError>;

+207 -17

crates/jacquard-oauth/src/request.rs

···

       40
       40
        
       const CLIENT_ASSERTION_TYPE_JWT_BEARER: &str =

     

       41
       41
        
           "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";

     

       42
       42
        
       

     

       43
       43
       -
       #[derive(Error, Debug)]

     

       44
       44
       -
       pub enum Error {

     

       43
       43
       +
       #[derive(Error, Debug, miette::Diagnostic)]

     

       44
       44
       +
       pub enum RequestError {

     

       45
       45
        
           #[error("no {0} endpoint available")]

     

       46
       46
       +
           #[diagnostic(code(jacquard_oauth::request::no_endpoint), help("server does not advertise this endpoint"))]

     

       46
       47
        
           NoEndpoint(CowStr<'static>),

     

       47
       48
        
           #[error("token response verification failed")]

     

       48
       48
       -
           Token(CowStr<'static>),

     

       49
       49
       +
           #[diagnostic(code(jacquard_oauth::request::token_verification))]

     

       50
       50
       +
           TokenVerification,

     

       49
       51
        
           #[error("unsupported authentication method")]

     

       52
       52
       +
           #[diagnostic(

     

       53
       53
       +
               code(jacquard_oauth::request::unsupported_auth_method),

     

       54
       54
       +
               help("server must support `private_key_jwt` or `none`; configure client metadata accordingly")

     

       55
       55
       +
           )]

     

       50
       56
        
           UnsupportedAuthMethod,

     

       51
       57
        
           #[error("no refresh token available")]

     

       52
       52
       -
           TokenRefresh,

     

       58
       58
       +
           #[diagnostic(code(jacquard_oauth::request::no_refresh_token))]

     

       59
       59
       +
           NoRefreshToken,

     

       53
       60
        
           #[error("failed to parse DID: {0}")]

     

       61
       61
       +
           #[diagnostic(code(jacquard_oauth::request::invalid_did))]

     

       54
       62
        
           InvalidDid(#[from] AtStrError),

     

       55
       63
        
           #[error(transparent)]

     

       64
       64
       +
           #[diagnostic(code(jacquard_oauth::request::dpop))]

     

       56
       65
        
           DpopClient(#[from] crate::dpop::Error),

     

       57
       66
        
           #[error(transparent)]

     

       67
       67
       +
           #[diagnostic(code(jacquard_oauth::request::storage))]

     

       58
       68
        
           Storage(#[from] SessionStoreError),

     

       59
       69
        
       

     

       60
       70
        
           #[error(transparent)]

     

       71
       71
       +
           #[diagnostic(code(jacquard_oauth::request::resolver))]

     

       61
       72
        
           ResolverError(#[from] crate::resolver::ResolverError),

     

       62
       73
        
           // #[error(transparent)]

     

       63
       74
        
           // OAuthSession(#[from] crate::oauth_session::Error),

     

       64
       75
        
           #[error(transparent)]

     

       76
       76
       +
           #[diagnostic(code(jacquard_oauth::request::http_build))]

     

       65
       77
        
           Http(#[from] http::Error),

     

       66
       66
       -
           #[error("http client error: {0}")]

     

       67
       67
       -
           HttpClient(Box<dyn std::error::Error + Send + Sync + 'static>),

     

       68
       78
        
           #[error("http status: {0}")]

     

       79
       79
       +
           #[diagnostic(code(jacquard_oauth::request::http_status), help("see server response for details"))]

     

       69
       80
        
           HttpStatus(StatusCode),

     

       70
       81
        
           #[error("http status: {0}, body: {1:?}")]

     

       82
       82
       +
           #[diagnostic(code(jacquard_oauth::request::http_status_body), help("server returned error JSON; inspect fields like `error`, `error_description`"))]

     

       71
       83
        
           HttpStatusWithBody(StatusCode, Value),

     

       72
       84
        
           #[error(transparent)]

     

       85
       85
       +
           #[diagnostic(code(jacquard_oauth::request::identity))]

     

       73
       86
        
           Identity(#[from] IdentityError),

     

       74
       87
        
           #[error(transparent)]

     

       88
       88
       +
           #[diagnostic(code(jacquard_oauth::request::keyset))]

     

       75
       89
        
           Keyset(#[from] crate::keyset::Error),

     

       76
       90
        
           #[error(transparent)]

     

       91
       91
       +
           #[diagnostic(code(jacquard_oauth::request::serde_form))]

     

       77
       92
        
           SerdeHtmlForm(#[from] serde_html_form::ser::Error),

     

       78
       93
        
           #[error(transparent)]

     

       94
       94
       +
           #[diagnostic(code(jacquard_oauth::request::serde_json))]

     

       79
       95
        
           SerdeJson(#[from] serde_json::Error),

     

       80
       96
        
           #[error(transparent)]

     

       97
       97
       +
           #[diagnostic(code(jacquard_oauth::request::atproto))]

     

       81
       98
        
           Atproto(#[from] crate::atproto::Error),

     

       82
       99
        
       }

     

       83
       100
        
       

     

       84
       84
       -
       pub type Result<T> = core::result::Result<T, Error>;

     

       101
       101
       +
       pub type Result<T> = core::result::Result<T, RequestError>;

     

       85
       102
        
       

     

       86
       103
        
       #[allow(dead_code)]

     

       87
       104
        
       pub enum OAuthRequest<'a> {

     
···

       113
       130
        
           }

     

       114
       131
        
       }

     

       115
       132
        
       

     

       133
       133
       +
       #[cfg(test)]

     

       134
       134
       +
       mod tests {

     

       135
       135
       +
           use super::*;

     

       136
       136
       +
           use crate::types::{OAuthAuthorizationServerMetadata, OAuthClientMetadata};

     

       137
       137
       +
           use http::{Response as HttpResponse, StatusCode};

     

       138
       138
       +
           use bytes::Bytes;

     

       139
       139
       +
           use jacquard_common::http_client::HttpClient;

     

       140
       140
       +
           use jacquard_identity::resolver::IdentityResolver;

     

       141
       141
       +
           use std::sync::Arc;

     

       142
       142
       +
           use tokio::sync::Mutex;

     

       143
       143
       +
       

     

       144
       144
       +
           #[derive(Clone, Default)]

     

       145
       145
       +
           struct MockClient {

     

       146
       146
       +
               resp: Arc<Mutex<Option<HttpResponse<Vec<u8>>>>>,

     

       147
       147
       +
           }

     

       148
       148
       +
       

     

       149
       149
       +
           impl HttpClient for MockClient {

     

       150
       150
       +
               type Error = std::convert::Infallible;

     

       151
       151
       +
               fn send_http(

     

       152
       152
       +
                   &self,

     

       153
       153
       +
                   _request: http::Request<Vec<u8>>,

     

       154
       154
       +
               ) -> impl core::future::Future<

     

       155
       155
       +
                   Output = core::result::Result<http::Response<Vec<u8>>, Self::Error>,

     

       156
       156
       +
               > + Send {

     

       157
       157
       +
                   let resp = self.resp.clone();

     

       158
       158
       +
                   async move { Ok(resp.lock().await.take().unwrap()) }

     

       159
       159
       +
               }

     

       160
       160
       +
           }

     

       161
       161
       +
       

     

       162
       162
       +
           // IdentityResolver methods won't be called in these tests; provide stubs.

     

       163
       163
       +
           #[async_trait::async_trait]

     

       164
       164
       +
           impl IdentityResolver for MockClient {

     

       165
       165
       +
               fn options(&self) -> &jacquard_identity::resolver::ResolverOptions {

     

       166
       166
       +
                   use std::sync::LazyLock;

     

       167
       167
       +
                   static OPTS: LazyLock<jacquard_identity::resolver::ResolverOptions> =

     

       168
       168
       +
                       LazyLock::new(|| jacquard_identity::resolver::ResolverOptions::default());

     

       169
       169
       +
                   &OPTS

     

       170
       170
       +
               }

     

       171
       171
       +
               async fn resolve_handle(

     

       172
       172
       +
                   &self,

     

       173
       173
       +
                   _handle: &jacquard_common::types::string::Handle<'_>,

     

       174
       174
       +
               ) -> std::result::Result<

     

       175
       175
       +
                   jacquard_common::types::string::Did<'static>,

     

       176
       176
       +
                   jacquard_identity::resolver::IdentityError,

     

       177
       177
       +
               > {

     

       178
       178
       +
                   Ok(jacquard_common::types::string::Did::new_static("did:plc:alice").unwrap())

     

       179
       179
       +
               }

     

       180
       180
       +
               async fn resolve_did_doc(

     

       181
       181
       +
                   &self,

     

       182
       182
       +
                   _did: &jacquard_common::types::string::Did<'_>,

     

       183
       183
       +
               ) -> std::result::Result<

     

       184
       184
       +
                   jacquard_identity::resolver::DidDocResponse,

     

       185
       185
       +
                   jacquard_identity::resolver::IdentityError,

     

       186
       186
       +
               > {

     

       187
       187
       +
                   let doc = serde_json::json!({

     

       188
       188
       +
                       "id": "did:plc:alice",

     

       189
       189
       +
                       "service": [{

     

       190
       190
       +
                           "id": "#pds",

     

       191
       191
       +
                           "type": "AtprotoPersonalDataServer",

     

       192
       192
       +
                           "serviceEndpoint": "https://pds"

     

       193
       193
       +
                       }]

     

       194
       194
       +
                   });

     

       195
       195
       +
                   let buf = Bytes::from(serde_json::to_vec(&doc).unwrap());

     

       196
       196
       +
                   Ok(jacquard_identity::resolver::DidDocResponse {

     

       197
       197
       +
                       buffer: buf,

     

       198
       198
       +
                       status: StatusCode::OK,

     

       199
       199
       +
                       requested: None,

     

       200
       200
       +
                   })

     

       201
       201
       +
               }

     

       202
       202
       +
           }

     

       203
       203
       +
       

     

       204
       204
       +
           // Allow using DPoP helpers on MockClient

     

       205
       205
       +
           impl crate::dpop::DpopExt for MockClient {}

     

       206
       206
       +
           impl crate::resolver::OAuthResolver for MockClient {}

     

       207
       207
       +
       

     

       208
       208
       +
           fn base_metadata() -> OAuthMetadata {

     

       209
       209
       +
               let mut server = OAuthAuthorizationServerMetadata::default();

     

       210
       210
       +
               server.issuer = CowStr::from("https://issuer");

     

       211
       211
       +
               server.authorization_endpoint = CowStr::from("https://issuer/authorize");

     

       212
       212
       +
               server.token_endpoint = CowStr::from("https://issuer/token");

     

       213
       213
       +
               OAuthMetadata {

     

       214
       214
       +
                   server_metadata: server,

     

       215
       215
       +
                   client_metadata: OAuthClientMetadata {

     

       216
       216
       +
                       client_id: url::Url::parse("https://client").unwrap(),

     

       217
       217
       +
                       client_uri: None,

     

       218
       218
       +
                       redirect_uris: vec![url::Url::parse("https://client/cb").unwrap()],

     

       219
       219
       +
                       scope: Some(CowStr::from("atproto")),

     

       220
       220
       +
                       grant_types: None,

     

       221
       221
       +
                       token_endpoint_auth_method: Some(CowStr::from("none")),

     

       222
       222
       +
                       dpop_bound_access_tokens: None,

     

       223
       223
       +
                       jwks_uri: None,

     

       224
       224
       +
                       jwks: None,

     

       225
       225
       +
                       token_endpoint_auth_signing_alg: None,

     

       226
       226
       +
                   },

     

       227
       227
       +
                   keyset: None,

     

       228
       228
       +
               }

     

       229
       229
       +
           }

     

       230
       230
       +
       

     

       231
       231
       +
           #[tokio::test]

     

       232
       232
       +
           async fn par_missing_endpoint() {

     

       233
       233
       +
               let mut meta = base_metadata();

     

       234
       234
       +
               meta.server_metadata.require_pushed_authorization_requests = Some(true);

     

       235
       235
       +
               meta.server_metadata.pushed_authorization_request_endpoint = None;

     

       236
       236
       +
               // require_pushed_authorization_requests is true and no endpoint

     

       237
       237
       +
               let err = super::par(&MockClient::default(), None, None, &meta)

     

       238
       238
       +
                   .await

     

       239
       239
       +
                   .unwrap_err();

     

       240
       240
       +
               match err {

     

       241
       241
       +
                   RequestError::NoEndpoint(name) => {

     

       242
       242
       +
                       assert_eq!(name.as_ref(), "pushed_authorization_request");

     

       243
       243
       +
                   }

     

       244
       244
       +
                   other => panic!("unexpected: {other:?}"),

     

       245
       245
       +
               }

     

       246
       246
       +
           }

     

       247
       247
       +
       

     

       248
       248
       +
           #[tokio::test]

     

       249
       249
       +
           async fn refresh_no_refresh_token() {

     

       250
       250
       +
               let client = MockClient::default();

     

       251
       251
       +
               let meta = base_metadata();

     

       252
       252
       +
               let mut session = ClientSessionData {

     

       253
       253
       +
                   account_did: jacquard_common::types::string::Did::new_static("did:plc:alice").unwrap(),

     

       254
       254
       +
                   session_id: CowStr::from("state"),

     

       255
       255
       +
                   host_url: url::Url::parse("https://pds").unwrap(),

     

       256
       256
       +
                   authserver_url: url::Url::parse("https://issuer").unwrap(),

     

       257
       257
       +
                   authserver_token_endpoint: CowStr::from("https://issuer/token"),

     

       258
       258
       +
                   authserver_revocation_endpoint: None,

     

       259
       259
       +
                   scopes: vec![],

     

       260
       260
       +
                   dpop_data: DpopClientData {

     

       261
       261
       +
                       dpop_key: crate::utils::generate_key(&[CowStr::from("ES256")]).unwrap(),

     

       262
       262
       +
                       dpop_authserver_nonce: CowStr::from(""),

     

       263
       263
       +
                       dpop_host_nonce: CowStr::from(""),

     

       264
       264
       +
                   },

     

       265
       265
       +
                   token_set: crate::types::TokenSet {

     

       266
       266
       +
                       iss: CowStr::from("https://issuer"),

     

       267
       267
       +
                       sub: jacquard_common::types::string::Did::new_static("did:plc:alice").unwrap(),

     

       268
       268
       +
                       aud: CowStr::from("https://pds"),

     

       269
       269
       +
                       scope: None,

     

       270
       270
       +
                       refresh_token: None,

     

       271
       271
       +
                       access_token: CowStr::from("abc"),

     

       272
       272
       +
                       token_type: crate::types::OAuthTokenType::DPoP,

     

       273
       273
       +
                       expires_at: None,

     

       274
       274
       +
                   },

     

       275
       275
       +
               };

     

       276
       276
       +
               let err = super::refresh(&client, session, &meta).await.unwrap_err();

     

       277
       277
       +
               matches!(err, RequestError::NoRefreshToken);

     

       278
       278
       +
           }

     

       279
       279
       +
       

     

       280
       280
       +
           #[tokio::test]

     

       281
       281
       +
           async fn exchange_code_missing_sub() {

     

       282
       282
       +
               let client = MockClient::default();

     

       283
       283
       +
               // set mock HTTP response body: token response without `sub`

     

       284
       284
       +
               *client.resp.lock().await = Some(

     

       285
       285
       +
                   HttpResponse::builder()

     

       286
       286
       +
                       .status(StatusCode::OK)

     

       287
       287
       +
                       .body(serde_json::to_vec(&serde_json::json!({

     

       288
       288
       +
                           "access_token":"tok",

     

       289
       289
       +
                           "token_type":"DPoP",

     

       290
       290
       +
                           "expires_in": 3600

     

       291
       291
       +
                       })).unwrap())

     

       292
       292
       +
                       .unwrap(),

     

       293
       293
       +
               );

     

       294
       294
       +
               let meta = base_metadata();

     

       295
       295
       +
               let mut dpop = DpopReqData {

     

       296
       296
       +
                   dpop_key: crate::utils::generate_key(&[CowStr::from("ES256")]).unwrap(),

     

       297
       297
       +
                   dpop_authserver_nonce: None,

     

       298
       298
       +
               };

     

       299
       299
       +
               let err = super::exchange_code(&client, &mut dpop, "abc", "verifier", &meta)

     

       300
       300
       +
                   .await

     

       301
       301
       +
                   .unwrap_err();

     

       302
       302
       +
               matches!(err, RequestError::TokenVerification);

     

       303
       303
       +
           }

     

       304
       304
       +
       }

     

       305
       305
       +
       

     

       116
       306
        
       #[derive(Debug, Serialize)]

     

       117
       307
        
       pub struct RequestPayload<'a, T>

     

       118
       308
        
       where

     
···

       162
       352
        
           let (code_challenge, verifier) = generate_pkce();

     

       163
       353
        
       

     

       164
       354
        
           let Some(dpop_key) = generate_dpop_key(&metadata.server_metadata) else {

     

       165
       165
       -
               return Err(Error::Token("none of the algorithms worked".into()));

     

       355
       355
       +
               return Err(RequestError::TokenVerification);

     

       166
       356
        
           };

     

       167
       357
        
           let mut dpop_data = DpopReqData {

     

       168
       358
        
               dpop_key,

     
···

       218
       408
        
               .require_pushed_authorization_requests

     

       219
       409
        
               == Some(true)

     

       220
       410
        
           {

     

       221
       221
       -
               Err(Error::NoEndpoint(CowStr::new_static(

     

       222
       222
       -
                   "server requires PAR but no endpoint is available",

     

       411
       411
       +
               Err(RequestError::NoEndpoint(CowStr::new_static(

     

       412
       412
       +
                   "pushed_authorization_request",

     

       223
       413
        
               )))

     

       224
       414
        
           } else {

     

       225
       415
        
               todo!("use of PAR is mandatory")

     
···

       235
       425
        
           T: OAuthResolver + DpopExt + Send + Sync + 'static,

     

       236
       426
        
       {

     

       237
       427
        
           let Some(refresh_token) = session_data.token_set.refresh_token.as_ref() else {

     

       238
       238
       -
               return Err(Error::TokenRefresh);

     

       428
       428
       +
               return Err(RequestError::NoRefreshToken);

     

       239
       429
        
           };

     

       240
       430
        
       

     

       241
       431
        
           // /!\ IMPORTANT /!\

     
···

       312
       502
        
           )

     

       313
       503
        
           .await?;

     

       314
       504
        
           let Some(sub) = token_response.sub else {

     

       315
       315
       -
               return Err(Error::Token("missing `sub` in token response".into()));

     

       505
       505
       +
               return Err(RequestError::TokenVerification);

     

       316
       506
        
           };

     

       317
       507
        
           let sub = Did::new_owned(sub)?;

     

       318
       508
        
           let iss = metadata.server_metadata.issuer.clone();

     
···

       376
       566
        
           D: DpopDataSource,

     

       377
       567
        
       {

     

       378
       568
        
           let Some(url) = endpoint_for_req(&metadata.server_metadata, &request) else {

     

       379
       379
       -
               return Err(Error::NoEndpoint(request.name()));

     

       569
       569
       +
               return Err(RequestError::NoEndpoint(request.name()));

     

       380
       570
        
           };

     

       381
       571
        
           let client_assertions = build_auth(

     

       382
       572
        
               metadata.keyset.as_ref(),

     
···

       401
       591
        
               .dpop_server_call(data_source)

     

       402
       592
        
               .send(req)

     

       403
       593
        
               .await

     

       404
       404
       -
               .map_err(Error::DpopClient)?;

     

       594
       594
       +
               .map_err(RequestError::DpopClient)?;

     

       405
       595
        
           if res.status() == request.expected_status() {

     

       406
       596
        
               let body = res.body();

     

       407
       597
        
               if body.is_empty() {

     
···

       412
       602
        
                   Ok(output)

     

       413
       603
        
               }

     

       414
       604
        
           } else if res.status().is_client_error() {

     

       415
       415
       -
               Err(Error::HttpStatusWithBody(

     

       605
       605
       +
               Err(RequestError::HttpStatusWithBody(

     

       416
       606
        
                   res.status(),

     

       417
       607
        
                   serde_json::from_slice(res.body())?,

     

       418
       608
        
               ))

     

       419
       609
        
           } else {

     

       420
       420
       -
               Err(Error::HttpStatus(res.status()))

     

       610
       610
       +
               Err(RequestError::HttpStatus(res.status()))

     

       421
       611
        
           }

     

       422
       612
        
       }

     

       423
       613
        
       

     
···

       528
       718
        
               }

     

       529
       719
        
           }

     

       530
       720
        
       

     

       531
       531
       -
           Err(Error::UnsupportedAuthMethod)

     

       721
       721
       +
           Err(RequestError::UnsupportedAuthMethod)

     

       532
       722
        
       }

+129 -17

crates/jacquard-oauth/src/resolver.rs

···

       1
       1
        
       use crate::types::{OAuthAuthorizationServerMetadata, OAuthProtectedResourceMetadata};

     

       2
       2
        
       use http::{Request, StatusCode};

     

       3
       3
       -
       use jacquard_common::IntoStatic;

     

       3
       3
       +
       use jacquard_common::{IntoStatic, error::TransportError};

     

       4
       4
        
       use jacquard_common::types::did_doc::DidDocument;

     

       5
       5
        
       use jacquard_common::types::ident::AtIdentifier;

     

       6
       6
        
       use jacquard_common::{http_client::HttpClient, types::did::Did};

     

       7
       7
        
       use jacquard_identity::resolver::{IdentityError, IdentityResolver};

     

       8
       8
        
       use url::Url;

     

       9
       9
        
       

     

       10
       10
       +
       /// Compare two issuer strings strictly but without spuriously failing on trivial differences.

     

       11
       11
       +
       ///

     

       12
       12
       +
       /// Rules:

     

       13
       13
       +
       /// - Schemes must match exactly.

     

       14
       14
       +
       /// - Hostnames and effective ports must match (treat missing port the same as default port).

     

       15
       15
       +
       /// - Path must match, except that an empty path and `/` are equivalent.

     

       16
       16
       +
       /// - Query/fragment are not considered; if present on either side, the comparison fails.

     

       17
       17
       +
       pub(crate) fn issuer_equivalent(a: &str, b: &str) -> bool {

     

       18
       18
       +
           fn normalize(url: &Url) -> Option<(String, String, u16, String)> {

     

       19
       19
       +
               if url.query().is_some() || url.fragment().is_some() {

     

       20
       20
       +
                   return None;

     

       21
       21
       +
               }

     

       22
       22
       +
               let scheme = url.scheme().to_string();

     

       23
       23
       +
               let host = url.host_str()?.to_string();

     

       24
       24
       +
               let port = url.port_or_known_default()?;

     

       25
       25
       +
               let path = match url.path() {

     

       26
       26
       +
                   "" => "/".to_string(),

     

       27
       27
       +
                   "/" => "/".to_string(),

     

       28
       28
       +
                   other => other.to_string(),

     

       29
       29
       +
               };

     

       30
       30
       +
               Some((scheme, host, port, path))

     

       31
       31
       +
           }

     

       32
       32
       +
       

     

       33
       33
       +
           match (Url::parse(a), Url::parse(b)) {

     

       34
       34
       +
               (Ok(ua), Ok(ub)) => match (normalize(&ua), normalize(&ub)) {

     

       35
       35
       +
                   (Some((sa, ha, pa, pa_path)), Some((sb, hb, pb, pb_path))) => {

     

       36
       36
       +
                       if sa != sb || ha != hb || pa != pb {

     

       37
       37
       +
                           return false;

     

       38
       38
       +
                       }

     

       39
       39
       +
                       if pa_path == "/" && pb_path == "/" {

     

       40
       40
       +
                           return true;

     

       41
       41
       +
                       }

     

       42
       42
       +
                       pa_path == pb_path

     

       43
       43
       +
                   }

     

       44
       44
       +
                   _ => false,

     

       45
       45
       +
               },

     

       46
       46
       +
               _ => a == b,

     

       47
       47
       +
           }

     

       48
       48
       +
       }

     

       49
       49
       +
       

     

       10
       50
        
       #[derive(thiserror::Error, Debug, miette::Diagnostic)]

     

       11
       51
        
       pub enum ResolverError {

     

       12
       52
        
           #[error("resource not found")]

     

       53
       53
       +
           #[diagnostic(code(jacquard_oauth::resolver::not_found), help("check the base URL or identifier"))]

     

       13
       54
        
           NotFound,

     

       14
       55
        
           #[error("invalid at identifier: {0}")]

     

       56
       56
       +
           #[diagnostic(code(jacquard_oauth::resolver::at_identifier), help("ensure a valid handle or DID was provided"))]

     

       15
       57
        
           AtIdentifier(String),

     

       16
       58
        
           #[error("invalid did: {0}")]

     

       59
       59
       +
           #[diagnostic(code(jacquard_oauth::resolver::did), help("ensure DID is correctly formed (did:plc or did:web)"))]

     

       17
       60
        
           Did(String),

     

       18
       61
        
           #[error("invalid did document: {0}")]

     

       62
       62
       +
           #[diagnostic(code(jacquard_oauth::resolver::did_document), help("verify the DID document structure and service entries"))]

     

       19
       63
        
           DidDocument(String),

     

       20
       64
        
           #[error("protected resource metadata is invalid: {0}")]

     

       65
       65
       +
           #[diagnostic(code(jacquard_oauth::resolver::protected_resource_metadata), help("PDS must advertise an authorization server in its protected resource metadata"))]

     

       21
       66
        
           ProtectedResourceMetadata(String),

     

       22
       67
        
           #[error("authorization server metadata is invalid: {0}")]

     

       68
       68
       +
           #[diagnostic(code(jacquard_oauth::resolver::authorization_server_metadata), help("issuer must match and include the PDS resource"))]

     

       23
       69
        
           AuthorizationServerMetadata(String),

     

       24
       70
        
           #[error("error resolving identity: {0}")]

     

       71
       71
       +
           #[diagnostic(code(jacquard_oauth::resolver::identity))]

     

       25
       72
        
           IdentityResolverError(#[from] IdentityError),

     

       26
       73
        
           #[error("unsupported did method: {0:?}")]

     

       74
       74
       +
           #[diagnostic(code(jacquard_oauth::resolver::unsupported_did_method), help("supported DID methods: did:web, did:plc"))]

     

       27
       75
        
           UnsupportedDidMethod(Did<'static>),

     

       28
       76
        
           #[error(transparent)]

     

       29
       29
       -
           Http(#[from] http::Error),

     

       30
       30
       -
           #[error("http client error: {0}")]

     

       31
       31
       -
           HttpClient(Box<dyn std::error::Error + Send + Sync + 'static>),

     

       77
       77
       +
           #[diagnostic(code(jacquard_oauth::resolver::transport))]

     

       78
       78
       +
           Transport(#[from] TransportError),

     

       32
       79
        
           #[error("http status: {0:?}")]

     

       80
       80
       +
           #[diagnostic(code(jacquard_oauth::resolver::http_status), help("check well-known paths and server configuration"))]

     

       33
       81
        
           HttpStatus(StatusCode),

     

       34
       82
        
           #[error(transparent)]

     

       83
       83
       +
           #[diagnostic(code(jacquard_oauth::resolver::serde_json))]

     

       35
       84
        
           SerdeJson(#[from] serde_json::Error),

     

       36
       85
        
           #[error(transparent)]

     

       86
       86
       +
           #[diagnostic(code(jacquard_oauth::resolver::serde_form))]

     

       37
       87
        
           SerdeHtmlForm(#[from] serde_html_form::ser::Error),

     

       38
       88
        
           #[error(transparent)]

     

       89
       89
       +
           #[diagnostic(code(jacquard_oauth::resolver::url))]

     

       39
       90
        
           Uri(#[from] url::ParseError),

     

       40
       91
        
       }

     

       41
       92
        
       

     
···

       47
       98
        
               sub: &Did<'_>,

     

       48
       99
        
           ) -> Result<Url, ResolverError> {

     

       49
       100
        
               let (metadata, identity) = self.resolve_from_identity(sub).await?;

     

       50
       50
       -
               if metadata.issuer != server_metadata.issuer {

     

       51
       51
       -
                   return Err(ResolverError::Did(format!("DIDs did not match")));

     

       101
       101
       +
               if !issuer_equivalent(&metadata.issuer, &server_metadata.issuer) {

     

       102
       102
       +
                   return Err(ResolverError::AuthorizationServerMetadata(

     

       103
       103
       +
                       "issuer mismatch".to_string(),

     

       104
       104
       +
                   ));

     

       52
       105
        
               }

     

       53
       106
        
               Ok(identity

     

       54
       107
        
                   .pds_endpoint()

     
···

       110
       163
        
               &self,

     

       111
       164
        
               issuer: &Url,

     

       112
       165
        
           ) -> Result<OAuthAuthorizationServerMetadata<'static>, ResolverError> {

     

       113
       113
       -
               Ok(resolve_authorization_server(self, issuer).await?)

     

       166
       166
       +
               let mut md = resolve_authorization_server(self, issuer).await?;

     

       167
       167
       +
               // Normalize issuer string to the input URL representation to avoid slash quirks

     

       168
       168
       +
               md.issuer = jacquard_common::CowStr::from(issuer.as_str()).into_static();

     

       169
       169
       +
               Ok(md)

     

       114
       170
        
           }

     

       115
       171
        
           async fn get_resource_server_metadata(

     

       116
       172
        
               &self,

     
···

       166
       222
        
       ) -> Result<OAuthAuthorizationServerMetadata<'static>, ResolverError> {

     

       167
       223
        
           let url = server

     

       168
       224
        
               .join("/.well-known/oauth-authorization-server")

     

       169
       169
       -
               .map_err(|e| ResolverError::HttpClient(e.into()))?;

     

       225
       225
       +
               .map_err(|e| ResolverError::Transport(TransportError::Other(Box::new(e))))?;

     

       170
       226
        
       

     

       171
       227
        
           let req = Request::builder()

     

       172
       228
        
               .uri(url.to_string())

     

       173
       229
        
               .body(Vec::new())

     

       174
       174
       -
               .map_err(|e| ResolverError::HttpClient(e.into()))?;

     

       230
       230
       +
               .map_err(|e| ResolverError::Transport(TransportError::InvalidRequest(e.to_string())))?;

     

       175
       231
        
           let res = client

     

       176
       232
        
               .send_http(req)

     

       177
       233
        
               .await

     

       178
       178
       -
               .map_err(|e| ResolverError::HttpClient(e.into()))?;

     

       234
       234
       +
               .map_err(|e| ResolverError::Transport(TransportError::Other(Box::new(e))))?;

     

       179
       235
        
           if res.status() == StatusCode::OK {

     

       180
       180
       -
               let metadata = serde_json::from_slice::<OAuthAuthorizationServerMetadata>(res.body())

     

       236
       236
       +
               let mut metadata = serde_json::from_slice::<OAuthAuthorizationServerMetadata>(res.body())

     

       181
       237
        
                   .map_err(ResolverError::SerdeJson)?;

     

       182
       238
        
               // https://datatracker.ietf.org/doc/html/rfc8414#section-3.3

     

       183
       183
       -
               if metadata.issuer == server.as_str() {

     

       239
       239
       +
               // Accept semantically equivalent issuer (normalize to the requested URL form)

     

       240
       240
       +
               if issuer_equivalent(&metadata.issuer, server.as_str()) {

     

       241
       241
       +
                   metadata.issuer = server.as_str().into();

     

       184
       242
        
                   Ok(metadata.into_static())

     

       185
       243
        
               } else {

     

       186
       244
        
                   Err(ResolverError::AuthorizationServerMetadata(format!(

     
···

       199
       257
        
       ) -> Result<OAuthProtectedResourceMetadata<'static>, ResolverError> {

     

       200
       258
        
           let url = server

     

       201
       259
        
               .join("/.well-known/oauth-protected-resource")

     

       202
       202
       -
               .map_err(|e| ResolverError::HttpClient(e.into()))?;

     

       260
       260
       +
               .map_err(|e| ResolverError::Transport(TransportError::Other(Box::new(e))))?;

     

       203
       261
        
       

     

       204
       262
        
           let req = Request::builder()

     

       205
       263
        
               .uri(url.to_string())

     

       206
       264
        
               .body(Vec::new())

     

       207
       207
       -
               .map_err(|e| ResolverError::HttpClient(e.into()))?;

     

       265
       265
       +
               .map_err(|e| ResolverError::Transport(TransportError::InvalidRequest(e.to_string())))?;

     

       208
       266
        
           let res = client

     

       209
       267
        
               .send_http(req)

     

       210
       268
        
               .await

     

       211
       211
       -
               .map_err(|e| ResolverError::HttpClient(e.into()))?;

     

       269
       269
       +
               .map_err(|e| ResolverError::Transport(TransportError::Other(Box::new(e))))?;

     

       212
       270
        
           if res.status() == StatusCode::OK {

     

       213
       213
       -
               let metadata = serde_json::from_slice::<OAuthProtectedResourceMetadata>(res.body())

     

       271
       271
       +
               let mut metadata = serde_json::from_slice::<OAuthProtectedResourceMetadata>(res.body())

     

       214
       272
        
                   .map_err(ResolverError::SerdeJson)?;

     

       215
       273
        
               // https://datatracker.ietf.org/doc/html/rfc8414#section-3.3

     

       216
       216
       -
               if metadata.resource == server.as_str() {

     

       274
       274
       +
               // Accept semantically equivalent resource URL (normalize to the requested URL form)

     

       275
       275
       +
               if issuer_equivalent(&metadata.resource, server.as_str()) {

     

       276
       276
       +
                   metadata.resource = server.as_str().into();

     

       217
       277
        
                   Ok(metadata.into_static())

     

       218
       278
        
               } else {

     

       219
       279
        
                   Err(ResolverError::AuthorizationServerMetadata(format!(

     
···

       228
       288
        
       

     

       229
       289
        
       #[async_trait::async_trait]

     

       230
       290
        
       impl OAuthResolver for jacquard_identity::JacquardResolver {}

     

       291
       291
       +
       

     

       292
       292
       +
       #[cfg(test)]

     

       293
       293
       +
       mod tests {

     

       294
       294
       +
           use super::*;

     

       295
       295
       +
           use http::{Request as HttpRequest, Response as HttpResponse, StatusCode};

     

       296
       296
       +
           use jacquard_common::http_client::HttpClient;

     

       297
       297
       +
       

     

       298
       298
       +
           #[derive(Default, Clone)]

     

       299
       299
       +
           struct MockHttp {

     

       300
       300
       +
               next: std::sync::Arc<tokio::sync::Mutex<Option<HttpResponse<Vec<u8>>>>>,

     

       301
       301
       +
           }

     

       302
       302
       +
       

     

       303
       303
       +
           impl HttpClient for MockHttp {

     

       304
       304
       +
               type Error = std::convert::Infallible;

     

       305
       305
       +
               fn send_http(

     

       306
       306
       +
                   &self,

     

       307
       307
       +
                   _request: HttpRequest<Vec<u8>>,

     

       308
       308
       +
               ) -> impl core::future::Future<

     

       309
       309
       +
                   Output = core::result::Result<HttpResponse<Vec<u8>>, Self::Error>,

     

       310
       310
       +
               > + Send {

     

       311
       311
       +
                   let next = self.next.clone();

     

       312
       312
       +
                   async move { Ok(next.lock().await.take().unwrap()) }

     

       313
       313
       +
               }

     

       314
       314
       +
           }

     

       315
       315
       +
       

     

       316
       316
       +
           #[tokio::test]

     

       317
       317
       +
           async fn authorization_server_http_status() {

     

       318
       318
       +
               let client = MockHttp::default();

     

       319
       319
       +
               *client.next.lock().await = Some(HttpResponse::builder().status(StatusCode::NOT_FOUND).body(Vec::new()).unwrap());

     

       320
       320
       +
               let issuer = url::Url::parse("https://issuer").unwrap();

     

       321
       321
       +
               let err = super::resolve_authorization_server(&client, &issuer).await.unwrap_err();

     

       322
       322
       +
               matches!(err, ResolverError::HttpStatus(StatusCode::NOT_FOUND));

     

       323
       323
       +
           }

     

       324
       324
       +
       

     

       325
       325
       +
           #[tokio::test]

     

       326
       326
       +
           async fn authorization_server_bad_json() {

     

       327
       327
       +
               let client = MockHttp::default();

     

       328
       328
       +
               *client.next.lock().await = Some(HttpResponse::builder().status(StatusCode::OK).body(b"{not json}".to_vec()).unwrap());

     

       329
       329
       +
               let issuer = url::Url::parse("https://issuer").unwrap();

     

       330
       330
       +
               let err = super::resolve_authorization_server(&client, &issuer).await.unwrap_err();

     

       331
       331
       +
               matches!(err, ResolverError::SerdeJson(_));

     

       332
       332
       +
           }

     

       333
       333
       +
       

     

       334
       334
       +
           #[test]

     

       335
       335
       +
           fn issuer_equivalence_rules() {

     

       336
       336
       +
               assert!(super::issuer_equivalent("https://issuer", "https://issuer/"));

     

       337
       337
       +
               assert!(super::issuer_equivalent("https://issuer:443/", "https://issuer/"));

     

       338
       338
       +
               assert!(!super::issuer_equivalent("http://issuer/", "https://issuer/"));

     

       339
       339
       +
               assert!(!super::issuer_equivalent("https://issuer/foo", "https://issuer/"));

     

       340
       340
       +
               assert!(!super::issuer_equivalent("https://issuer/?q=1", "https://issuer/"));

     

       341
       341
       +
           }

     

       342
       342
       +
       }

+6 -3

crates/jacquard-oauth/src/session.rs

···

       263
       263
        
                   server_metadata: client

     

       264
       264
        
                       .get_authorization_server_metadata(&self.session_data.authserver_url)

     

       265
       265
        
                       .await

     

       266
       266
       -
                       .map_err(|e| Error::ServerAgent(crate::request::Error::ResolverError(e)))?,

     

       266
       266
       +
                       .map_err(|e| Error::ServerAgent(crate::request::RequestError::ResolverError(e)))?,

     

       267
       267
        
                   client_metadata: atproto_client_metadata(self.config.clone(), &self.keyset)

     

       268
       268
        
                       .unwrap()

     

       269
       269
        
                       .into_static(),

     
···

       272
       272
        
           }

     

       273
       273
        
       }

     

       274
       274
        
       

     

       275
       275
       -
       #[derive(thiserror::Error, Debug)]

     

       275
       275
       +
       #[derive(thiserror::Error, Debug, miette::Diagnostic)]

     

       276
       276
        
       pub enum Error {

     

       277
       277
        
           #[error(transparent)]

     

       278
       278
       -
           ServerAgent(#[from] crate::request::Error),

     

       278
       278
       +
           #[diagnostic(code(jacquard_oauth::session::request))]

     

       279
       279
       +
           ServerAgent(#[from] crate::request::RequestError),

     

       279
       280
        
           #[error(transparent)]

     

       281
       281
       +
           #[diagnostic(code(jacquard_oauth::session::storage))]

     

       280
       282
        
           Store(#[from] SessionStoreError),

     

       281
       283
        
           #[error("session does not exist")]

     

       284
       284
       +
           #[diagnostic(code(jacquard_oauth::session::not_found))]

     

       282
       285
        
           SessionNotFound,

     

       283
       286
        
       }

     

       284
       287

+7 -3

crates/jacquard/src/client.rs

···

       3
       3
        
       //! This module provides HTTP and XRPC client traits along with an authenticated

     

       4
       4
        
       //! client implementation that manages session tokens.

     

       5
       5
        
       

     

       6
       6
       +
       /// Stateful session client for app‑password auth with auto‑refresh.

     

       6
       7
        
       pub mod credential_session;

     

       8
       8
       +
       /// Token storage and on‑disk formats shared across app‑password and OAuth.

     

       7
       9
        
       pub mod token;

     

       8
       10
        
       

     

       9
       11
        
       use core::future::Future;

     
···

       72
       74
        
           }

     

       73
       75
        
       }

     

       74
       76
        
       

     

       75
       75
       -
       /// A unified indicator for the type of authenticated session.

     

       77
       77
       +
       /// Identifies the active authentication mode for an agent/session.

     

       76
       78
        
       #[derive(Debug, Clone, Copy, PartialEq, Eq)]

     

       77
       79
        
       pub enum AgentKind {

     

       78
       80
        
           /// App password (Bearer) session

     
···

       82
       84
        
       }

     

       83
       85
        
       

     

       84
       86
        
       /// Common interface for stateful sessions used by the Agent wrapper.

     

       87
       87
       +
       ///

     

       88
       88
       +
       /// Implemented by `CredentialSession` (app‑password) and `OAuthSession` (DPoP).

     

       85
       89
        
       pub trait AgentSession: XrpcClient + HttpClient + Send + Sync {

     

       86
       90
        
           /// Identify the kind of session.

     

       87
       91
        
           fn session_kind(&self) -> AgentKind;

     
···

       188
       192
        
           }

     

       189
       193
        
       }

     

       190
       194
        
       

     

       191
       191
       -
       /// Thin wrapper that erases the concrete session type while preserving type-safety.

     

       195
       195
       +
       /// Thin wrapper over a stateful session providing a uniform `XrpcClient`.

     

       192
       196
        
       pub struct Agent<A: AgentSession> {

     

       193
       197
        
           inner: A,

     

       194
       198
        
       }

     
···

       214
       218
        
               self.inner.endpoint().await

     

       215
       219
        
           }

     

       216
       220
        
       

     

       217
       217
       -
           /// Override call options.

     

       221
       221
       +
           /// Override call options for subsequent requests.

     

       218
       222
        
           pub async fn set_options(&self, opts: CallOptions<'_>) {

     

       219
       223
        
               self.inner.set_options(opts).await

     

       220
       224
        
           }

+41 -4

crates/jacquard/src/client/credential_session.rs

···

       18
       18
        
       use jacquard_identity::resolver::IdentityResolver;

     

       19
       19
        
       use std::any::Any;

     

       20
       20
        
       

     

       21
       21
       +
       /// Storage key for app‑password sessions: `(account DID, session id)`.

     

       21
       22
        
       pub type SessionKey = (Did<'static>, CowStr<'static>);

     

       22
       23
        
       

     

       24
       24
       +
       /// Stateful client for app‑password based sessions.

     

       25
       25
       +
       ///

     

       26
       26
       +
       /// - Persists sessions via a pluggable `SessionStore`.

     

       27
       27
       +
       /// - Automatically refreshes on token expiry.

     

       28
       28
       +
       /// - Tracks a base endpoint, defaulting to the public appview until login/restore.

     

       23
       29
        
       pub struct CredentialSession<S, T>

     

       24
       30
        
       where

     

       25
       31
        
           S: SessionStore<SessionKey, AtpSession>,

     

       26
       32
        
       {

     

       27
       33
        
           store: Arc<S>,

     

       28
       34
        
           client: Arc<T>,

     

       35
       35
       +
           /// Default call options applied to each request (auth/headers/labelers).

     

       29
       36
        
           pub options: RwLock<CallOptions<'static>>,

     

       37
       37
       +
           /// Active session key, if any.

     

       30
       38
        
           pub key: RwLock<Option<SessionKey>>,

     

       39
       39
       +
           /// Current base endpoint (PDS); defaults to public appview when unset.

     

       31
       40
        
           pub endpoint: RwLock<Option<Url>>,

     

       32
       41
        
       }

     

       33
       42
        
       

     
···

       35
       44
        
       where

     

       36
       45
        
           S: SessionStore<SessionKey, AtpSession>,

     

       37
       46
        
       {

     

       47
       47
       +
           /// Create a new credential session using the given store and client.

     

       38
       48
        
           pub fn new(store: Arc<S>, client: Arc<T>) -> Self {

     

       39
       49
        
               Self {

     

       40
       50
        
                   store,

     
···

       50
       60
        
       where

     

       51
       61
        
           S: SessionStore<SessionKey, AtpSession>,

     

       52
       62
        
       {

     

       63
       63
       +
           /// Return a copy configured with the provided default call options.

     

       53
       64
        
           pub fn with_options(self, options: CallOptions<'_>) -> Self {

     

       54
       65
        
               Self {

     

       55
       66
        
                   client: self.client,

     
···

       60
       71
        
               }

     

       61
       72
        
           }

     

       62
       73
        
       

     

       74
       74
       +
           /// Replace default call options.

     

       63
       75
        
           pub async fn set_options(&self, options: CallOptions<'_>) {

     

       64
       76
        
               *self.options.write().await = options.into_static();

     

       65
       77
        
           }

     

       66
       78
        
       

     

       79
       79
       +
           /// Get the active session key (account DID and session id), if any.

     

       67
       80
        
           pub async fn session_info(&self) -> Option<SessionKey> {

     

       68
       81
        
               self.key.read().await.clone()

     

       69
       82
        
           }

     

       70
       83
        
       

     

       84
       84
       +
           /// Current base endpoint. Defaults to the public appview when unset.

     

       71
       85
        
           pub async fn endpoint(&self) -> Url {

     

       72
       86
        
               self.endpoint.read().await.clone().unwrap_or(

     

       73
       87
        
                   Url::parse("https://public.bsky.app").expect("public appview should be valid url"),

     

       74
       88
        
               )

     

       75
       89
        
           }

     

       76
       90
        
       

     

       91
       91
       +
           /// Override the current base endpoint.

     

       77
       92
        
           pub async fn set_endpoint(&self, endpoint: Url) {

     

       78
       93
        
               *self.endpoint.write().await = Some(endpoint);

     

       79
       94
        
           }

     

       80
       95
        
       

     

       96
       96
       +
           /// Current access token (Bearer), if logged in.

     

       81
       97
        
           pub async fn access_token(&self) -> Option<AuthorizationToken<'_>> {

     

       82
       98
        
               let key = self.key.read().await.clone()?;

     

       83
       99
        
               let session = self.store.get(&key).await;

     

       84
       100
        
               session.map(|session| AuthorizationToken::Bearer(session.access_jwt))

     

       85
       101
        
           }

     

       86
       102
        
       

     

       103
       103
       +
           /// Current refresh token (Bearer), if logged in.

     

       87
       104
        
           pub async fn refresh_token(&self) -> Option<AuthorizationToken<'_>> {

     

       88
       105
        
               let key = self.key.read().await.clone()?;

     

       89
       106
        
               let session = self.store.get(&key).await;

     
···

       96
       113
        
           S: SessionStore<SessionKey, AtpSession>,

     

       97
       114
        
           T: HttpClient,

     

       98
       115
        
       {

     

       116
       116
       +
           /// Refresh the active session by calling `com.atproto.server.refreshSession`.

     

       99
       117
        
           pub async fn refresh(&self) -> Result<AuthorizationToken<'_>, ClientError> {

     

       100
       118
        
               let key = self.key.read().await.clone().ok_or(ClientError::Auth(

     

       101
       119
        
                   jacquard_common::error::AuthError::NotAuthenticated,

     
···

       134
       152
        
           ///

     

       135
       153
        
           /// - `identifier`: handle (preferred), DID, or `https://` PDS base URL.

     

       136
       154
        
           /// - `session_id`: optional session label; defaults to "session".

     

       155
       155
       +
           /// - Persists and activates the session, and updates the base endpoint to the user's PDS.

     

       137
       156
        
           pub async fn login(

     

       138
       157
        
               &self,

     

       139
       158
        
               identifier: CowStr<'_>,

     
···

       298
       317
        
               Ok(())

     

       299
       318
        
           }

     

       300
       319
        
       

     

       301
       301
       -
           /// Switch to a different stored session (and refresh endpoint from DID).

     

       320
       320
       +
           /// Switch to a different stored session (and refresh endpoint/PDS).

     

       302
       321
        
           pub async fn switch_session(

     

       303
       322
        
               &self,

     

       304
       323
        
               did: Did<'_>,

     
···

       380
       399
        
           T: HttpClient + XrpcExt + Send + Sync + 'static,

     

       381
       400
        
       {

     

       382
       401
        
           fn base_uri(&self) -> Url {

     

       383
       383
       -
               self.endpoint.blocking_read().clone().unwrap_or(

     

       384
       384
       -
                   Url::parse("https://public.bsky.app").expect("public appview should be valid url"),

     

       385
       385
       -
               )

     

       402
       402
       +
               // base_uri is a synchronous trait method; avoid `.await` here.

     

       403
       403
       +
               // Under Tokio, use `block_in_place` to make a blocking RwLock read safe.

     

       404
       404
       +
               if tokio::runtime::Handle::try_current().is_ok() {

     

       405
       405
       +
                   tokio::task::block_in_place(|| {

     

       406
       406
       +
                       self.endpoint

     

       407
       407
       +
                           .blocking_read()

     

       408
       408
       +
                           .clone()

     

       409
       409
       +
                           .unwrap_or(

     

       410
       410
       +
                               Url::parse("https://public.bsky.app")

     

       411
       411
       +
                                   .expect("public appview should be valid url"),

     

       412
       412
       +
                           )

     

       413
       413
       +
                   })

     

       414
       414
       +
               } else {

     

       415
       415
       +
                   self.endpoint

     

       416
       416
       +
                       .blocking_read()

     

       417
       417
       +
                       .clone()

     

       418
       418
       +
                       .unwrap_or(

     

       419
       419
       +
                           Url::parse("https://public.bsky.app")

     

       420
       420
       +
                               .expect("public appview should be valid url"),

     

       421
       421
       +
                       )

     

       422
       422
       +
               }

     

       386
       423
        
           }

     

       387
       424
        
           async fn send<R: jacquard_common::types::xrpc::XrpcRequest + Send>(

     

       388
       425
        
               self,

+95 -25

crates/jacquard/src/client/token.rs

···

       10
       10
        
       use serde_json::Value;

     

       11
       11
        
       use url::Url;

     

       12
       12
        
       

     

       13
       13
       +
       /// On-disk session records for app-password and OAuth flows, sharing a single JSON map.

     

       13
       14
        
       #[derive(Debug, Clone, PartialEq, Eq, serde::Serialize, serde::Deserialize)]

     

       14
       15
        
       pub enum StoredSession {

     

       16
       16
       +
           /// App-password session

     

       15
       17
        
           Atp(StoredAtSession),

     

       18
       18
       +
           /// OAuth client session

     

       16
       19
        
           OAuth(OAuthSession),

     

       20
       20
       +
           /// OAuth authorization request state

     

       17
       21
        
           OAuthState(OAuthState),

     

       18
       22
        
       }

     

       19
       23
        
       

     

       24
       24
       +
       /// Minimal persisted representation of an app‑password session.

     

       20
       25
        
       #[derive(Debug, Clone, PartialEq, Eq, serde::Serialize, serde::Deserialize)]

     

       21
       26
        
       pub struct StoredAtSession {

     

       27
       27
       +
           /// Access token (JWT)

     

       22
       28
        
           access_jwt: String,

     

       29
       29
       +
           /// Refresh token (JWT)

     

       23
       30
        
           refresh_jwt: String,

     

       31
       31
       +
           /// Account DID

     

       24
       32
        
           did: String,

     

       33
       33
       +
           /// Optional PDS endpoint for faster resume

     

       25
       34
        
           #[serde(skip_serializing_if = "std::option::Option::is_none")]

     

       26
       35
        
           pds: Option<String>,

     

       36
       36
       +
           /// Session id label (e.g., "session")

     

       27
       37
        
           session_id: String,

     

       38
       38
       +
           /// Last known handle

     

       28
       39
        
           handle: String,

     

       29
       40
        
       }

     

       30
       41
        
       

     

       42
       42
       +
       /// Persisted OAuth client session (on-disk format).

     

       31
       43
        
       #[derive(Debug, Clone, PartialEq, Eq, serde::Serialize, serde::Deserialize)]

     

       32
       44
        
       pub struct OAuthSession {

     

       45
       45
       +
           /// Account DID

     

       33
       46
        
           account_did: String,

     

       47
       47
       +
           /// Client-generated session id (usually auth `state`)

     

       34
       48
        
           session_id: String,

     

       35
       49
        
       

     

       36
       36
       -
           // Base URL of the "resource server" (eg, PDS). Should include scheme, hostname, port; no path or auth info.

     

       50
       50
       +
           /// Base URL of the resource server (PDS)

     

       37
       51
        
           host_url: Url,

     

       38
       52
        
       

     

       39
       39
       -
           // Base URL of the "auth server" (eg, PDS or entryway). Should include scheme, hostname, port; no path or auth info.

     

       53
       53
       +
           /// Base URL of the authorization server (PDS or entryway)

     

       40
       54
        
           authserver_url: Url,

     

       41
       55
        
       

     

       42
       42
       -
           // Full token endpoint

     

       56
       56
       +
           /// Full token endpoint URL

     

       43
       57
        
           authserver_token_endpoint: String,

     

       44
       58
        
       

     

       45
       45
       -
           // Full revocation endpoint, if it exists

     

       59
       59
       +
           /// Full revocation endpoint URL, if available

     

       46
       60
        
           #[serde(skip_serializing_if = "std::option::Option::is_none")]

     

       47
       61
        
           authserver_revocation_endpoint: Option<String>,

     

       48
       62
        
       

     

       49
       49
       -
           // The set of scopes approved for this session (returned in the initial token request)

     

       63
       63
       +
           /// Granted scopes

     

       50
       64
        
           scopes: Vec<String>,

     

       51
       65
        
       

     

       66
       66
       +
           /// Client DPoP key material

     

       52
       67
        
           pub dpop_key: Key,

     

       53
       53
       -
           // Current auth server DPoP nonce

     

       68
       68
       +
           /// Current auth server DPoP nonce

     

       54
       69
        
           pub dpop_authserver_nonce: String,

     

       55
       55
       -
           // Current host ("resource server", eg PDS) DPoP nonce

     

       70
       70
       +
           /// Current resource server (PDS) DPoP nonce

     

       56
       71
        
           pub dpop_host_nonce: String,

     

       57
       72
        
       

     

       73
       73
       +
           /// Token response issuer

     

       58
       74
        
           pub iss: String,

     

       75
       75
       +
           /// Token subject (DID)

     

       59
       76
        
           pub sub: String,

     

       77
       77
       +
           /// Token audience (verified PDS URL)

     

       60
       78
        
           pub aud: String,

     

       79
       79
       +
           /// Token scopes (raw) if provided

     

       61
       80
        
           pub scope: Option<String>,

     

       62
       81
        
       

     

       82
       82
       +
           /// Refresh token

     

       63
       83
        
           pub refresh_token: Option<String>,

     

       84
       84
       +
           /// Access token

     

       64
       85
        
           pub access_token: String,

     

       86
       86
       +
           /// Token type (e.g., DPoP)

     

       65
       87
        
           pub token_type: OAuthTokenType,

     

       66
       88
        
       

     

       89
       89
       +
           /// Expiration timestamp

     

       67
       90
        
           pub expires_at: Option<Datetime>,

     

       68
       91
        
       }

     

       69
       92
        
       

     
···

       130
       153
        
           }

     

       131
       154
        
       }

     

       132
       155
        
       

     

       156
       156
       +
       /// Persisted OAuth authorization request state.

     

       133
       157
        
       #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]

     

       134
       158
        
       pub struct OAuthState {

     

       135
       135
       -
           // The random identifier generated by the client for the auth request flow. Can be used as "primary key" for storing and retrieving this information.

     

       159
       159
       +
           /// Random identifier generated for the authorization flow (`state`)

     

       136
       160
        
           pub state: String,

     

       137
       161
        
       

     

       138
       138
       -
           // URL of the auth server (eg, PDS or entryway)

     

       162
       162
       +
           /// Base URL of the authorization server (PDS or entryway)

     

       139
       163
        
           pub authserver_url: Url,

     

       140
       164
        
       

     

       141
       141
       -
           // If the flow started with an account identifier (DID or handle), it should be persisted, to verify against the initial token response.

     

       165
       165
       +
           /// Optional pre-known account DID

     

       142
       166
        
           #[serde(skip_serializing_if = "std::option::Option::is_none")]

     

       143
       167
        
           pub account_did: Option<String>,

     

       144
       168
        
       

     

       145
       145
       -
           // OAuth scope strings

     

       169
       169
       +
           /// Requested scopes

     

       146
       170
        
           pub scopes: Vec<String>,

     

       147
       171
        
       

     

       148
       148
       -
           // unique token in URI format, which will be used by the client in the auth flow redirect

     

       172
       172
       +
           /// Request URI for the authorization step

     

       149
       173
        
           pub request_uri: String,

     

       150
       174
        
       

     

       151
       151
       -
           // Full token endpoint URL

     

       175
       175
       +
           /// Full token endpoint URL

     

       152
       176
        
           pub authserver_token_endpoint: String,

     

       153
       177
        
       

     

       154
       154
       -
           // Full revocation endpoint, if it exists

     

       178
       178
       +
           /// Full revocation endpoint URL, if available

     

       155
       179
        
           #[serde(skip_serializing_if = "std::option::Option::is_none")]

     

       156
       180
        
           pub authserver_revocation_endpoint: Option<String>,

     

       157
       181
        
       

     

       158
       158
       -
           // The secret token/nonce which a code challenge was generated from

     

       182
       182
       +
           /// PKCE verifier

     

       159
       183
        
           pub pkce_verifier: String,

     

       160
       184
        
       

     

       185
       185
       +
           /// Client DPoP key material

     

       161
       186
        
           pub dpop_key: Key,

     

       162
       162
       -
           // Current auth server DPoP nonce

     

       187
       187
       +
           /// Auth server DPoP nonce at PAR time

     

       163
       188
        
           #[serde(skip_serializing_if = "std::option::Option::is_none")]

     

       164
       189
        
           pub dpop_authserver_nonce: Option<String>,

     

       165
       190
        
       }

     
···

       211
       236
        
           }

     

       212
       237
        
       }

     

       213
       238
        
       

     

       239
       239
       +
       /// Convenience wrapper over `FileTokenStore` offering unified storage across auth modes.

     

       214
       240
        
       pub struct FileAuthStore(FileTokenStore);

     

       215
       241
        
       

     

       216
       242
        
       impl FileAuthStore {

     
···

       326
       352
        
               let mut store: Value = serde_json::from_str(&file)?;

     

       327
       353
        
               if let Some(map) = store.as_object_mut() {

     

       328
       354
        
                   if let Some(value) = map.get_mut(&key_str) {

     

       329
       329
       -
                       if let Some(obj) = value.as_object_mut() {

     

       330
       330
       -
                           obj.insert(

     

       331
       331
       -
                               "pds".to_string(),

     

       332
       332
       -
                               serde_json::Value::String(pds.to_string()),

     

       333
       333
       -
                           );

     

       334
       334
       -
                           std::fs::write(&self.0.path, serde_json::to_string_pretty(&store)?)?;

     

       335
       335
       -
                           return Ok(());

     

       355
       355
       +
                       if let Some(outer) = value.as_object_mut() {

     

       356
       356
       +
                           if let Some(inner) = outer.get_mut("Atp").and_then(|v| v.as_object_mut()) {

     

       357
       357
       +
                               inner.insert(

     

       358
       358
       +
                                   "pds".to_string(),

     

       359
       359
       +
                                   serde_json::Value::String(pds.to_string()),

     

       360
       360
       +
                               );

     

       361
       361
       +
                               std::fs::write(&self.0.path, serde_json::to_string_pretty(&store)?)?;

     

       362
       362
       +
                               return Ok(());

     

       363
       363
       +
                           }

     

       336
       364
        
                       }

     

       337
       365
        
                   }

     

       338
       366
        
               }

     
···

       349
       377
        
               let store: Value = serde_json::from_str(&file)?;

     

       350
       378
        
               if let Some(value) = store.get(&key_str) {

     

       351
       379
        
                   if let Some(obj) = value.as_object() {

     

       352
       352
       -
                       if let Some(serde_json::Value::String(pds)) = obj.get("pds") {

     

       353
       353
       -
                           return Ok(Url::parse(pds).ok());

     

       380
       380
       +
                       if let Some(serde_json::Value::Object(inner)) = obj.get("Atp") {

     

       381
       381
       +
                           if let Some(serde_json::Value::String(pds)) = inner.get("pds") {

     

       382
       382
       +
                               return Ok(Url::parse(pds).ok());

     

       383
       383
       +
                           }

     

       354
       384
        
                       }

     

       355
       385
        
                   }

     

       356
       386
        
               }

     
···

       418
       448
        
               }

     

       419
       449
        
           }

     

       420
       450
        
       }

     

       451
       451
       +
       

     

       452
       452
       +
       #[cfg(test)]

     

       453
       453
       +
       mod tests {

     

       454
       454
       +
           use super::*;

     

       455
       455
       +
           use crate::client::credential_session::SessionKey;

     

       456
       456
       +
           use crate::client::AtpSession;

     

       457
       457
       +
           use jacquard_common::types::string::{Did, Handle};

     

       458
       458
       +
           use std::fs;

     

       459
       459
       +
           use std::path::PathBuf;

     

       460
       460
       +
       

     

       461
       461
       +
           fn temp_file() -> PathBuf {

     

       462
       462
       +
               let mut p = std::env::temp_dir();

     

       463
       463
       +
               p.push(format!("jacquard-test-{}.json", std::process::id()));

     

       464
       464
       +
               p

     

       465
       465
       +
           }

     

       466
       466
       +
       

     

       467
       467
       +
           #[tokio::test]

     

       468
       468
       +
           async fn file_auth_store_roundtrip_atp() {

     

       469
       469
       +
               let path = temp_file();

     

       470
       470
       +
               // initialize empty store file

     

       471
       471
       +
               fs::write(&path, "{}").unwrap();

     

       472
       472
       +
               let store = FileAuthStore::new(&path);

     

       473
       473
       +
               let session = AtpSession {

     

       474
       474
       +
                   access_jwt: "a".into(),

     

       475
       475
       +
                   refresh_jwt: "r".into(),

     

       476
       476
       +
                   did: Did::new_static("did:plc:alice").unwrap(),

     

       477
       477
       +
                   handle: Handle::new_static("alice.bsky.social").unwrap(),

     

       478
       478
       +
               };

     

       479
       479
       +
               let key: SessionKey = (session.did.clone(), "session".into());

     

       480
       480
       +
               jacquard_common::session::SessionStore::set(&store, key.clone(), session.clone())

     

       481
       481
       +
                   .await

     

       482
       482
       +
                   .unwrap();

     

       483
       483
       +
               let restored = jacquard_common::session::SessionStore::get(&store, &key)

     

       484
       484
       +
                   .await

     

       485
       485
       +
                   .unwrap();

     

       486
       486
       +
               assert_eq!(restored.access_jwt.as_ref(), "a");

     

       487
       487
       +
               // clean up

     

       488
       488
       +
               let _ = fs::remove_file(&path);

     

       489
       489
       +
           }

     

       490
       490
       +
       }

+4 -4

crates/jacquard/src/lib.rs

···

       27
       27
        
       //! use jacquard::client::credential_session::{CredentialSession, SessionKey};

     

       28
       28
        
       //! use jacquard::client::{AtpSession, FileAuthStore, MemorySessionStore};

     

       29
       29
        
       //! use jacquard::identity::PublicResolver as JacquardResolver;

     

       30
       30
       +
       //! use jacquard::types::xrpc::XrpcClient;

     

       30
       31
        
       //! # use miette::IntoDiagnostic;

     

       31
       32
        
       //!

     

       32
       33
        
       //! # #[derive(Parser, Debug)]

     
···

       57
       58
        
       //!         .into_diagnostic()?;

     

       58
       59
        
       //!     // Fetch timeline

     

       59
       60
        
       //!     let timeline = session

     

       60
       60
       -
       //!         .clone()

     

       61
       61
       -
       //!         .send(GetTimeline::new().limit(5).build())

     

       61
       61
       +
       //!         .send(&GetTimeline::new().limit(5).build())

     

       62
       62
        
       //!         .await

     

       63
       63
        
       //!         .into_diagnostic()?

     

       64
       64
        
       //!         .into_output()

     
···

       90
       90
        
       //!       let resp = http

     

       91
       91
        
       //!           .xrpc(base)

     

       92
       92
        
       //!           .send(

     

       93
       93
       -
       //!               GetAuthorFeed::new()

     

       93
       93
       +
       //!               &GetAuthorFeed::new()

     

       94
       94
        
       //!                   .actor(AtIdentifier::new_static("pattern.atproto.systems").unwrap())

     

       95
       95
        
       //!                   .limit(5)

     

       96
       96
        
       //!                   .build(),

     
···

       124
       124
        
       //!         .accept_labelers(vec![CowStr::from("did:plc:labelerid")])

     

       125
       125
        
       //!         .header(http::header::USER_AGENT, http::HeaderValue::from_static("jacquard-example"))

     

       126
       126
        
       //!         .send(

     

       127
       127
       -
       //!             GetAuthorFeed::new()

     

       127
       127
       +
       //!             &GetAuthorFeed::new()

     

       128
       128
        
       //!                 .actor(AtIdentifier::new_static("pattern.atproto.systems").unwrap())

     

       129
       129
        
       //!                 .limit(5)

     

       130
       130
        
       //!                 .build(),

+147

crates/jacquard/tests/agent.rs

···

       1
       1
       +
       use std::collections::VecDeque;

     

       2
       2
       +
       use std::sync::Arc;

     

       3
       3
       +
       

     

       4
       4
       +
       use http::{HeaderValue, Response as HttpResponse, StatusCode};

     

       5
       5
       +
       use jacquard::client::credential_session::{CredentialSession, SessionKey};

     

       6
       6
       +
       use jacquard::client::{Agent, AtpSession};

     

       7
       7
       +
       use jacquard::identity::resolver::{DidDocResponse, IdentityResolver, ResolverOptions};

     

       8
       8
       +
       use jacquard::types::did::Did;

     

       9
       9
       +
       use jacquard::types::string::Handle;

     

       10
       10
       +
       use jacquard_common::http_client::HttpClient;

     

       11
       11
       +
       use jacquard_common::session::MemorySessionStore;

     

       12
       12
       +
       use tokio::sync::Mutex;

     

       13
       13
       +
       

     

       14
       14
       +
       #[derive(Clone, Default)]

     

       15
       15
       +
       struct MockClient {

     

       16
       16
       +
           queue: Arc<Mutex<VecDeque<http::Response<Vec<u8>>>>>,

     

       17
       17
       +
           log: Arc<Mutex<Vec<http::Request<Vec<u8>>>>>,

     

       18
       18
       +
       }

     

       19
       19
       +
       

     

       20
       20
       +
       impl MockClient {

     

       21
       21
       +
           async fn push(&self, resp: http::Response<Vec<u8>>) {

     

       22
       22
       +
               self.queue.lock().await.push_back(resp);

     

       23
       23
       +
           }

     

       24
       24
       +
       }

     

       25
       25
       +
       

     

       26
       26
       +
       impl HttpClient for MockClient {

     

       27
       27
       +
           type Error = std::convert::Infallible;

     

       28
       28
       +
           fn send_http(

     

       29
       29
       +
               &self,

     

       30
       30
       +
               request: http::Request<Vec<u8>>,

     

       31
       31
       +
           ) -> impl core::future::Future<

     

       32
       32
       +
               Output = core::result::Result<http::Response<Vec<u8>>, Self::Error>,

     

       33
       33
       +
           > + Send {

     

       34
       34
       +
               let log = self.log.clone();

     

       35
       35
       +
               let queue = self.queue.clone();

     

       36
       36
       +
               async move {

     

       37
       37
       +
                   log.lock().await.push(request);

     

       38
       38
       +
                   Ok(queue.lock().await.pop_front().expect("no queued response"))

     

       39
       39
       +
               }

     

       40
       40
       +
           }

     

       41
       41
       +
       }

     

       42
       42
       +
       

     

       43
       43
       +
       #[async_trait::async_trait]

     

       44
       44
       +
       impl IdentityResolver for MockClient {

     

       45
       45
       +
           fn options(&self) -> &ResolverOptions {

     

       46
       46
       +
               use std::sync::LazyLock;

     

       47
       47
       +
               static OPTS: LazyLock<ResolverOptions> = LazyLock::new(ResolverOptions::default);

     

       48
       48
       +
               &OPTS

     

       49
       49
       +
           }

     

       50
       50
       +
           async fn resolve_handle(

     

       51
       51
       +
               &self,

     

       52
       52
       +
               _handle: &Handle<'_>,

     

       53
       53
       +
           ) -> std::result::Result<Did<'static>, jacquard::identity::resolver::IdentityError> {

     

       54
       54
       +
               Ok(Did::new_static("did:plc:alice").unwrap())

     

       55
       55
       +
           }

     

       56
       56
       +
           async fn resolve_did_doc(

     

       57
       57
       +
               &self,

     

       58
       58
       +
               _did: &Did<'_>,

     

       59
       59
       +
           ) -> std::result::Result<DidDocResponse, jacquard::identity::resolver::IdentityError> {

     

       60
       60
       +
               let doc = serde_json::json!({

     

       61
       61
       +
                   "id": "did:plc:alice",

     

       62
       62
       +
                   "service": [{

     

       63
       63
       +
                       "id": "#pds",

     

       64
       64
       +
                       "type": "AtprotoPersonalDataServer",

     

       65
       65
       +
                       "serviceEndpoint": "https://pds"

     

       66
       66
       +
                   }]

     

       67
       67
       +
               });

     

       68
       68
       +
               Ok(DidDocResponse {

     

       69
       69
       +
                   buffer: bytes::Bytes::from(serde_json::to_vec(&doc).unwrap()),

     

       70
       70
       +
                   status: StatusCode::OK,

     

       71
       71
       +
                   requested: None,

     

       72
       72
       +
               })

     

       73
       73
       +
           }

     

       74
       74
       +
       }

     

       75
       75
       +
       

     

       76
       76
       +
       // XrpcExt blanket impl applies via HttpClient

     

       77
       77
       +
       

     

       78
       78
       +
       fn refresh_session_body(access: &str, refresh: &str) -> Vec<u8> {

     

       79
       79
       +
           serde_json::to_vec(&serde_json::json!({

     

       80
       80
       +
               "accessJwt": access,

     

       81
       81
       +
               "refreshJwt": refresh,

     

       82
       82
       +
               "did": "did:plc:alice",

     

       83
       83
       +
               "handle": "alice.bsky.social"

     

       84
       84
       +
           }))

     

       85
       85
       +
           .unwrap()

     

       86
       86
       +
       }

     

       87
       87
       +
       

     

       88
       88
       +
       #[tokio::test]

     

       89
       89
       +
       async fn agent_delegates_to_session_and_refreshes() {

     

       90
       90
       +
           let client = Arc::new(MockClient::default());

     

       91
       91
       +
           let store: Arc<MemorySessionStore<SessionKey, AtpSession>> = Arc::new(Default::default());

     

       92
       92
       +
           let session = CredentialSession::new(store.clone(), client.clone());

     

       93
       93
       +
       

     

       94
       94
       +
           // Seed a session in the store and activate it via restore (sets endpoint to PDS)

     

       95
       95
       +
           let atp = AtpSession {

     

       96
       96
       +
               access_jwt: "acc1".into(),

     

       97
       97
       +
               refresh_jwt: "ref1".into(),

     

       98
       98
       +
               did: Did::new_static("did:plc:alice").unwrap(),

     

       99
       99
       +
               handle: Handle::new_static("alice.bsky.social").unwrap(),

     

       100
       100
       +
           };

     

       101
       101
       +
           let key: SessionKey = (atp.did.clone(), "session".into());

     

       102
       102
       +
           jacquard_common::session::SessionStore::set(store.as_ref(), key.clone(), atp)

     

       103
       103
       +
               .await

     

       104
       104
       +
               .unwrap();

     

       105
       105
       +
           session

     

       106
       106
       +
               .restore(Did::new_static("did:plc:alice").unwrap(), "session".into())

     

       107
       107
       +
               .await

     

       108
       108
       +
               .unwrap();

     

       109
       109
       +
       

     

       110
       110
       +
           let agent: Agent<_> = Agent::from(session);

     

       111
       111
       +
           assert_eq!(agent.kind(), jacquard::client::AgentKind::AppPassword);

     

       112
       112
       +
           let info = agent.info().await.expect("session info");

     

       113
       113
       +
           assert_eq!(info.0.as_str(), "did:plc:alice");

     

       114
       114
       +
           assert_eq!(info.1.as_ref().unwrap().as_str(), "session");

     

       115
       115
       +
           assert_eq!(agent.endpoint().await.as_str(), "https://pds/");

     

       116
       116
       +
       

     

       117
       117
       +
           // Queue a refresh response and call agent.refresh(); Authorization header must use refresh token

     

       118
       118
       +
           client

     

       119
       119
       +
               .push(

     

       120
       120
       +
                   HttpResponse::builder()

     

       121
       121
       +
                       .status(StatusCode::OK)

     

       122
       122
       +
                       .header(http::header::CONTENT_TYPE, "application/json")

     

       123
       123
       +
                       .body(refresh_session_body("acc2", "ref2"))

     

       124
       124
       +
                       .unwrap(),

     

       125
       125
       +
               )

     

       126
       126
       +
               .await;

     

       127
       127
       +
       

     

       128
       128
       +
           let token = agent.refresh().await.expect("refresh ok");

     

       129
       129
       +
           match token {

     

       130
       130
       +
               jacquard::AuthorizationToken::Bearer(s) => assert_eq!(s.as_ref(), "acc2"),

     

       131
       131
       +
               _ => panic!("expected Bearer token"),

     

       132
       132
       +
           }

     

       133
       133
       +
       

     

       134
       134
       +
           // Validate the refreshSession call used the refresh token header

     

       135
       135
       +
           let log = client.log.lock().await;

     

       136
       136
       +
           assert_eq!(log.len(), 1);

     

       137
       137
       +
           assert!(

     

       138
       138
       +
               log[0]

     

       139
       139
       +
                   .uri()

     

       140
       140
       +
                   .to_string()

     

       141
       141
       +
                   .ends_with("/xrpc/com.atproto.server.refreshSession")

     

       142
       142
       +
           );

     

       143
       143
       +
           assert_eq!(

     

       144
       144
       +
               log[0].headers().get(http::header::AUTHORIZATION),

     

       145
       145
       +
               Some(&HeaderValue::from_static("Bearer ref1"))

     

       146
       146
       +
           );

     

       147
       147
       +
       }

+261

crates/jacquard/tests/credential_session.rs

···

       1
       1
       +
       use std::collections::VecDeque;

     

       2
       2
       +
       use std::sync::Arc;

     

       3
       3
       +
       

     

       4
       4
       +
       use bytes::Bytes;

     

       5
       5
       +
       use http::{HeaderValue, Method, Response as HttpResponse, StatusCode};

     

       6
       6
       +
       use jacquard::client::AtpSession;

     

       7
       7
       +
       use jacquard::client::credential_session::{CredentialSession, SessionKey};

     

       8
       8
       +
       use jacquard::identity::resolver::{DidDocResponse, IdentityResolver, ResolverOptions};

     

       9
       9
       +
       use jacquard::types::did::Did;

     

       10
       10
       +
       use jacquard::types::string::Handle;

     

       11
       11
       +
       use jacquard::types::xrpc::XrpcClient;

     

       12
       12
       +
       use jacquard_common::http_client::HttpClient;

     

       13
       13
       +
       use jacquard_common::session::{MemorySessionStore, SessionStore};

     

       14
       14
       +
       use tokio::sync::{Mutex, RwLock};

     

       15
       15
       +
       

     

       16
       16
       +
       #[derive(Clone, Default)]

     

       17
       17
       +
       struct MockClient {

     

       18
       18
       +
           // Queue of HTTP responses to pop for each send_http call

     

       19
       19
       +
           queue: Arc<Mutex<VecDeque<HttpResponse<Vec<u8>>>>>,

     

       20
       20
       +
           // Capture requests for assertions

     

       21
       21
       +
           log: Arc<Mutex<Vec<http::Request<Vec<u8>>>>>,

     

       22
       22
       +
           // Count calls to identity resolver helpers

     

       23
       23
       +
           did_doc_calls: Arc<RwLock<usize>>,

     

       24
       24
       +
       }

     

       25
       25
       +
       

     

       26
       26
       +
       impl MockClient {

     

       27
       27
       +
           async fn push(&self, resp: HttpResponse<Vec<u8>>) {

     

       28
       28
       +
               self.queue.lock().await.push_back(resp);

     

       29
       29
       +
           }

     

       30
       30
       +
           async fn take_log(&self) -> Vec<http::Request<Vec<u8>>> {

     

       31
       31
       +
               let mut log = self.log.lock().await;

     

       32
       32
       +
               let out = log.clone();

     

       33
       33
       +
               log.clear();

     

       34
       34
       +
               out

     

       35
       35
       +
           }

     

       36
       36
       +
       }

     

       37
       37
       +
       

     

       38
       38
       +
       impl HttpClient for MockClient {

     

       39
       39
       +
           type Error = std::convert::Infallible;

     

       40
       40
       +
       

     

       41
       41
       +
           fn send_http(

     

       42
       42
       +
               &self,

     

       43
       43
       +
               request: http::Request<Vec<u8>>,

     

       44
       44
       +
           ) -> impl core::future::Future<

     

       45
       45
       +
               Output = core::result::Result<http::Response<Vec<u8>>, Self::Error>,

     

       46
       46
       +
           > + Send {

     

       47
       47
       +
               let log = self.log.clone();

     

       48
       48
       +
               let queue = self.queue.clone();

     

       49
       49
       +
               async move {

     

       50
       50
       +
                   log.lock().await.push(request);

     

       51
       51
       +
                   Ok(queue.lock().await.pop_front().expect("no queued response"))

     

       52
       52
       +
               }

     

       53
       53
       +
           }

     

       54
       54
       +
       }

     

       55
       55
       +
       

     

       56
       56
       +
       #[async_trait::async_trait]

     

       57
       57
       +
       impl IdentityResolver for MockClient {

     

       58
       58
       +
           fn options(&self) -> &ResolverOptions {

     

       59
       59
       +
               use std::sync::LazyLock;

     

       60
       60
       +
               static OPTS: LazyLock<ResolverOptions> = LazyLock::new(ResolverOptions::default);

     

       61
       61
       +
               &OPTS

     

       62
       62
       +
           }

     

       63
       63
       +
       

     

       64
       64
       +
           async fn resolve_handle(

     

       65
       65
       +
               &self,

     

       66
       66
       +
               handle: &Handle<'_>,

     

       67
       67
       +
           ) -> std::result::Result<Did<'static>, jacquard::identity::resolver::IdentityError> {

     

       68
       68
       +
               // Return a fixed DID for any handle

     

       69
       69
       +
               assert!(handle.as_str().contains('.'));

     

       70
       70
       +
               Ok(Did::new_static("did:plc:alice").unwrap())

     

       71
       71
       +
           }

     

       72
       72
       +
       

     

       73
       73
       +
           async fn resolve_did_doc(

     

       74
       74
       +
               &self,

     

       75
       75
       +
               did: &Did<'_>,

     

       76
       76
       +
           ) -> std::result::Result<DidDocResponse, jacquard::identity::resolver::IdentityError> {

     

       77
       77
       +
               // Track calls and return a minimal DID doc with a PDS endpoint

     

       78
       78
       +
               *self.did_doc_calls.write().await += 1;

     

       79
       79
       +
               assert_eq!(did.as_str(), "did:plc:alice");

     

       80
       80
       +
               let doc = serde_json::json!({

     

       81
       81
       +
                   "id": "did:plc:alice",

     

       82
       82
       +
                   "service": [{

     

       83
       83
       +
                       "id": "#pds",

     

       84
       84
       +
                       "type": "AtprotoPersonalDataServer",

     

       85
       85
       +
                       "serviceEndpoint": "https://pds"

     

       86
       86
       +
                   }]

     

       87
       87
       +
               });

     

       88
       88
       +
               Ok(DidDocResponse {

     

       89
       89
       +
                   buffer: Bytes::from(serde_json::to_vec(&doc).unwrap()),

     

       90
       90
       +
                   status: StatusCode::OK,

     

       91
       91
       +
                   requested: None,

     

       92
       92
       +
               })

     

       93
       93
       +
           }

     

       94
       94
       +
       }

     

       95
       95
       +
       

     

       96
       96
       +
       // XrpcExt blanket impl applies via HttpClient

     

       97
       97
       +
       

     

       98
       98
       +
       fn create_session_body() -> Vec<u8> {

     

       99
       99
       +
           serde_json::to_vec(&serde_json::json!({

     

       100
       100
       +
               "accessJwt": "acc1",

     

       101
       101
       +
               "refreshJwt": "ref1",

     

       102
       102
       +
               "did": "did:plc:alice",

     

       103
       103
       +
               "handle": "alice.bsky.social"

     

       104
       104
       +
           }))

     

       105
       105
       +
           .unwrap()

     

       106
       106
       +
       }

     

       107
       107
       +
       

     

       108
       108
       +
       fn refresh_session_body(access: &str, refresh: &str) -> Vec<u8> {

     

       109
       109
       +
           serde_json::to_vec(&serde_json::json!({

     

       110
       110
       +
               "accessJwt": access,

     

       111
       111
       +
               "refreshJwt": refresh,

     

       112
       112
       +
               "did": "did:plc:alice",

     

       113
       113
       +
               "handle": "alice.bsky.social"

     

       114
       114
       +
           }))

     

       115
       115
       +
           .unwrap()

     

       116
       116
       +
       }

     

       117
       117
       +
       

     

       118
       118
       +
       fn get_session_ok_body() -> Vec<u8> {

     

       119
       119
       +
           serde_json::to_vec(&serde_json::json!({

     

       120
       120
       +
               "did": "did:plc:alice",

     

       121
       121
       +
               "handle": "alice.bsky.social",

     

       122
       122
       +
               "active": true

     

       123
       123
       +
           }))

     

       124
       124
       +
           .unwrap()

     

       125
       125
       +
       }

     

       126
       126
       +
       

     

       127
       127
       +
       #[tokio::test(flavor = "multi_thread")]

     

       128
       128
       +
       async fn credential_login_and_auto_refresh() {

     

       129
       129
       +
           let client = Arc::new(MockClient::default());

     

       130
       130
       +
       

     

       131
       131
       +
           // Queue responses in order: createSession 200 → getSession 401 → refreshSession 200 → getSession 200

     

       132
       132
       +
           client

     

       133
       133
       +
               .push(

     

       134
       134
       +
                   HttpResponse::builder()

     

       135
       135
       +
                       .status(StatusCode::OK)

     

       136
       136
       +
                       .header(http::header::CONTENT_TYPE, "application/json")

     

       137
       137
       +
                       .body(create_session_body())

     

       138
       138
       +
                       .unwrap(),

     

       139
       139
       +
               )

     

       140
       140
       +
               .await;

     

       141
       141
       +
           client

     

       142
       142
       +
               .push(

     

       143
       143
       +
                   HttpResponse::builder()

     

       144
       144
       +
                       .status(StatusCode::UNAUTHORIZED)

     

       145
       145
       +
                       .header(http::header::CONTENT_TYPE, "application/json")

     

       146
       146
       +
                       .body(serde_json::to_vec(&serde_json::json!({"error":"ExpiredToken"})).unwrap())

     

       147
       147
       +
                       .unwrap(),

     

       148
       148
       +
               )

     

       149
       149
       +
               .await;

     

       150
       150
       +
           client

     

       151
       151
       +
               .push(

     

       152
       152
       +
                   HttpResponse::builder()

     

       153
       153
       +
                       .status(StatusCode::OK)

     

       154
       154
       +
                       .header(http::header::CONTENT_TYPE, "application/json")

     

       155
       155
       +
                       .body(refresh_session_body("acc2", "ref2"))

     

       156
       156
       +
                       .unwrap(),

     

       157
       157
       +
               )

     

       158
       158
       +
               .await;

     

       159
       159
       +
           client

     

       160
       160
       +
               .push(

     

       161
       161
       +
                   HttpResponse::builder()

     

       162
       162
       +
                       .status(StatusCode::OK)

     

       163
       163
       +
                       .header(http::header::CONTENT_TYPE, "application/json")

     

       164
       164
       +
                       .body(get_session_ok_body())

     

       165
       165
       +
                       .unwrap(),

     

       166
       166
       +
               )

     

       167
       167
       +
               .await;

     

       168
       168
       +
       

     

       169
       169
       +
           let store: Arc<MemorySessionStore<SessionKey, AtpSession>> = Arc::new(Default::default());

     

       170
       170
       +
           let session = CredentialSession::new(store.clone(), client.clone());

     

       171
       171
       +
       

     

       172
       172
       +
           // Before login, default endpoint should be public appview

     

       173
       173
       +
           assert_eq!(

     

       174
       174
       +
               session.endpoint().await.as_str(),

     

       175
       175
       +
               "https://public.bsky.app/"

     

       176
       176
       +
           );

     

       177
       177
       +
       

     

       178
       178
       +
           // Login using handle; resolves to PDS and persists session

     

       179
       179
       +
           session

     

       180
       180
       +
               .login(

     

       181
       181
       +
                   jacquard::CowStr::from("alice.bsky.social"),

     

       182
       182
       +
                   jacquard::CowStr::from("apppass"),

     

       183
       183
       +
                   Some(jacquard::CowStr::from("session")),

     

       184
       184
       +
                   None,

     

       185
       185
       +
                   None,

     

       186
       186
       +
               )

     

       187
       187
       +
               .await

     

       188
       188
       +
               .expect("login ok");

     

       189
       189
       +
       

     

       190
       190
       +
           // Endpoint switches to PDS

     

       191
       191
       +
           assert_eq!(session.endpoint().await.as_str(), "https://pds/");

     

       192
       192
       +
       

     

       193
       193
       +
           // Send a request that will first 401 (ExpiredToken), then refresh, then succeed

     

       194
       194
       +
           let resp = session

     

       195
       195
       +
               .send(&jacquard::api::com_atproto::server::get_session::GetSession)

     

       196
       196
       +
               .await

     

       197
       197
       +
               .expect("xrpc send ok");

     

       198
       198
       +
           assert_eq!(resp.status(), StatusCode::OK);

     

       199
       199
       +
           let out = resp

     

       200
       200
       +
               .parse()

     

       201
       201
       +
               .expect("parse ok after refresh (GetSession output)");

     

       202
       202
       +
           assert_eq!(out.handle.as_str(), "alice.bsky.social");

     

       203
       203
       +
       

     

       204
       204
       +
           // Verify request sequence and Authorization headers used

     

       205
       205
       +
           let log = client.take_log().await;

     

       206
       206
       +
           assert_eq!(log.len(), 4, "expected four HTTP calls");

     

       207
       207
       +
           // 0: createSession (no auth)

     

       208
       208
       +
           assert_eq!(log[0].method(), Method::POST);

     

       209
       209
       +
           assert!(

     

       210
       210
       +
               log[0]

     

       211
       211
       +
                   .uri()

     

       212
       212
       +
                   .to_string()

     

       213
       213
       +
                   .ends_with("/xrpc/com.atproto.server.createSession")

     

       214
       214
       +
           );

     

       215
       215
       +
           assert!(log[0].headers().get(http::header::AUTHORIZATION).is_none());

     

       216
       216
       +
           // 1: getSession (uses access token acc1)

     

       217
       217
       +
           assert_eq!(log[1].method(), Method::GET);

     

       218
       218
       +
           assert!(

     

       219
       219
       +
               log[1]

     

       220
       220
       +
                   .uri()

     

       221
       221
       +
                   .to_string()

     

       222
       222
       +
                   .ends_with("/xrpc/com.atproto.server.getSession")

     

       223
       223
       +
           );

     

       224
       224
       +
           assert_eq!(

     

       225
       225
       +
               log[1].headers().get(http::header::AUTHORIZATION),

     

       226
       226
       +
               Some(&HeaderValue::from_static("Bearer acc1"))

     

       227
       227
       +
           );

     

       228
       228
       +
           // 2: refreshSession (uses refresh token ref1)

     

       229
       229
       +
           assert_eq!(log[2].method(), Method::POST);

     

       230
       230
       +
           assert!(

     

       231
       231
       +
               log[2]

     

       232
       232
       +
                   .uri()

     

       233
       233
       +
                   .to_string()

     

       234
       234
       +
                   .ends_with("/xrpc/com.atproto.server.refreshSession")

     

       235
       235
       +
           );

     

       236
       236
       +
           assert_eq!(

     

       237
       237
       +
               log[2].headers().get(http::header::AUTHORIZATION),

     

       238
       238
       +
               Some(&HeaderValue::from_static("Bearer ref1"))

     

       239
       239
       +
           );

     

       240
       240
       +
           // 3: getSession (re-sent with new access token acc2)

     

       241
       241
       +
           assert_eq!(log[3].method(), Method::GET);

     

       242
       242
       +
           assert!(

     

       243
       243
       +
               log[3]

     

       244
       244
       +
                   .uri()

     

       245
       245
       +
                   .to_string()

     

       246
       246
       +
                   .ends_with("/xrpc/com.atproto.server.getSession")

     

       247
       247
       +
           );

     

       248
       248
       +
           assert_eq!(

     

       249
       249
       +
               log[3].headers().get(http::header::AUTHORIZATION),

     

       250
       250
       +
               Some(&HeaderValue::from_static("Bearer acc2"))

     

       251
       251
       +
           );

     

       252
       252
       +
       

     

       253
       253
       +
           // Verify store updated with refreshed tokens

     

       254
       254
       +
           let key: SessionKey = (

     

       255
       255
       +
               Did::new_static("did:plc:alice").unwrap(),

     

       256
       256
       +
               jacquard::CowStr::from("session"),

     

       257
       257
       +
           );

     

       258
       258
       +
           let updated = store.get(&key).await.expect("session present");

     

       259
       259
       +
           assert_eq!(updated.access_jwt.as_ref(), "acc2");

     

       260
       260
       +
           assert_eq!(updated.refresh_jwt.as_ref(), "ref2");

     

       261
       261
       +
       }

+374

crates/jacquard/tests/oauth_auto_refresh.rs

···

       1
       1
       +
       use std::collections::VecDeque;

     

       2
       2
       +
       use std::sync::Arc;

     

       3
       3
       +
       

     

       4
       4
       +
       use bytes::Bytes;

     

       5
       5
       +
       use http::{HeaderValue, Method, Response as HttpResponse, StatusCode};

     

       6
       6
       +
       use jacquard::client::Agent;

     

       7
       7
       +
       use jacquard::IntoStatic;

     

       8
       8
       +
       use jacquard::types::did::Did;

     

       9
       9
       +
       use jacquard::types::xrpc::XrpcClient;

     

       10
       10
       +
       use jacquard_common::http_client::HttpClient;

     

       11
       11
       +
       use jacquard_oauth::atproto::AtprotoClientMetadata;

     

       12
       12
       +
       use jacquard_oauth::client::OAuthSession;

     

       13
       13
       +
       use jacquard_oauth::session::SessionRegistry;

     

       14
       14
       +
       use jacquard_oauth::resolver::OAuthResolver;

     

       15
       15
       +
       use jacquard_oauth::scopes::Scope;

     

       16
       16
       +
       use jacquard_oauth::session::{ClientData, ClientSessionData, DpopClientData};

     

       17
       17
       +
       use jacquard_oauth::types::{OAuthAuthorizationServerMetadata, OAuthTokenType, TokenSet};

     

       18
       18
       +
       use tokio::sync::Mutex;

     

       19
       19
       +
       

     

       20
       20
       +
       #[derive(Clone, Default)]

     

       21
       21
       +
       struct MockClient {

     

       22
       22
       +
           queue: Arc<Mutex<VecDeque<http::Response<Vec<u8>>>>>,

     

       23
       23
       +
           log: Arc<Mutex<Vec<http::Request<Vec<u8>>>>>,

     

       24
       24
       +
       }

     

       25
       25
       +
       

     

       26
       26
       +
       impl MockClient {

     

       27
       27
       +
           async fn push(&self, resp: http::Response<Vec<u8>>) {

     

       28
       28
       +
               self.queue.lock().await.push_back(resp);

     

       29
       29
       +
           }

     

       30
       30
       +
       }

     

       31
       31
       +
       

     

       32
       32
       +
       impl HttpClient for MockClient {

     

       33
       33
       +
           type Error = std::convert::Infallible;

     

       34
       34
       +
           fn send_http(

     

       35
       35
       +
               &self,

     

       36
       36
       +
               request: http::Request<Vec<u8>>,

     

       37
       37
       +
           ) -> impl core::future::Future<

     

       38
       38
       +
               Output = core::result::Result<http::Response<Vec<u8>>, Self::Error>,

     

       39
       39
       +
           > + Send {

     

       40
       40
       +
               let log = self.log.clone();

     

       41
       41
       +
               let queue = self.queue.clone();

     

       42
       42
       +
               async move {

     

       43
       43
       +
                   log.lock().await.push(request);

     

       44
       44
       +
                   Ok(queue

     

       45
       45
       +
                       .lock()

     

       46
       46
       +
                       .await

     

       47
       47
       +
                       .pop_front()

     

       48
       48
       +
                       .expect("no queued response"))

     

       49
       49
       +
               }

     

       50
       50
       +
           }

     

       51
       51
       +
       }

     

       52
       52
       +
       

     

       53
       53
       +
       #[async_trait::async_trait]

     

       54
       54
       +
       impl jacquard::identity::resolver::IdentityResolver for MockClient {

     

       55
       55
       +
           fn options(&self) -> &jacquard::identity::resolver::ResolverOptions {

     

       56
       56
       +
               use std::sync::LazyLock;

     

       57
       57
       +
               static OPTS: LazyLock<jacquard::identity::resolver::ResolverOptions> =

     

       58
       58
       +
                   LazyLock::new(jacquard::identity::resolver::ResolverOptions::default);

     

       59
       59
       +
               &OPTS

     

       60
       60
       +
           }

     

       61
       61
       +
           async fn resolve_handle(

     

       62
       62
       +
               &self,

     

       63
       63
       +
               _handle: &jacquard::types::string::Handle<'_>,

     

       64
       64
       +
           ) -> std::result::Result<Did<'static>, jacquard::identity::resolver::IdentityError> {

     

       65
       65
       +
               Ok(Did::new_static("did:plc:alice").unwrap())

     

       66
       66
       +
           }

     

       67
       67
       +
           async fn resolve_did_doc(

     

       68
       68
       +
               &self,

     

       69
       69
       +
               _did: &Did<'_>,

     

       70
       70
       +
           ) -> std::result::Result<jacquard::identity::resolver::DidDocResponse, jacquard::identity::resolver::IdentityError> {

     

       71
       71
       +
               let doc = serde_json::json!({

     

       72
       72
       +
                   "id": "did:plc:alice",

     

       73
       73
       +
                   "service": [{

     

       74
       74
       +
                       "id": "#pds",

     

       75
       75
       +
                       "type": "AtprotoPersonalDataServer",

     

       76
       76
       +
                       "serviceEndpoint": "https://pds"

     

       77
       77
       +
                   }]

     

       78
       78
       +
               });

     

       79
       79
       +
               Ok(jacquard::identity::resolver::DidDocResponse {

     

       80
       80
       +
                   buffer: Bytes::from(serde_json::to_vec(&doc).unwrap()),

     

       81
       81
       +
                   status: StatusCode::OK,

     

       82
       82
       +
                   requested: None,

     

       83
       83
       +
               })

     

       84
       84
       +
           }

     

       85
       85
       +
       }

     

       86
       86
       +
       

     

       87
       87
       +
       #[async_trait::async_trait]

     

       88
       88
       +
       impl OAuthResolver for MockClient {

     

       89
       89
       +
           async fn get_authorization_server_metadata(

     

       90
       90
       +
               &self,

     

       91
       91
       +
               issuer: &url::Url,

     

       92
       92
       +
           ) -> Result<OAuthAuthorizationServerMetadata<'static>, jacquard_oauth::resolver::ResolverError> {

     

       93
       93
       +
               // Return minimal metadata with supported auth method "none" and DPoP support

     

       94
       94
       +
               let mut md = OAuthAuthorizationServerMetadata::default();

     

       95
       95
       +
               md.issuer = jacquard::CowStr::from(issuer.as_str());

     

       96
       96
       +
               md.token_endpoint = jacquard::CowStr::from(format!("{}/token", issuer));

     

       97
       97
       +
               md.authorization_endpoint = jacquard::CowStr::from(format!("{}/authorize", issuer));

     

       98
       98
       +
               md.require_pushed_authorization_requests = Some(true);

     

       99
       99
       +
               md.pushed_authorization_request_endpoint =

     

       100
       100
       +
                   Some(jacquard::CowStr::from(format!("{}/par", issuer)));

     

       101
       101
       +
               md.token_endpoint_auth_methods_supported = Some(vec![jacquard::CowStr::from("none")]);

     

       102
       102
       +
               md.dpop_signing_alg_values_supported = Some(vec![jacquard::CowStr::from("ES256")]);

     

       103
       103
       +
               use jacquard::IntoStatic;

     

       104
       104
       +
               Ok(md.into_static())

     

       105
       105
       +
           }

     

       106
       106
       +
       

     

       107
       107
       +
           async fn get_resource_server_metadata(

     

       108
       108
       +
               &self,

     

       109
       109
       +
               _pds: &url::Url,

     

       110
       110
       +
           ) -> Result<OAuthAuthorizationServerMetadata<'static>, jacquard_oauth::resolver::ResolverError> {

     

       111
       111
       +
               // Return metadata pointing to the same issuer as above

     

       112
       112
       +
               let mut md = OAuthAuthorizationServerMetadata::default();

     

       113
       113
       +
               md.issuer = jacquard::CowStr::from("https://issuer");

     

       114
       114
       +
               md.token_endpoint = jacquard::CowStr::from("https://issuer/token");

     

       115
       115
       +
               md.authorization_endpoint = jacquard::CowStr::from("https://issuer/authorize");

     

       116
       116
       +
               md.require_pushed_authorization_requests = Some(true);

     

       117
       117
       +
               md.pushed_authorization_request_endpoint = Some(jacquard::CowStr::from("https://issuer/par"));

     

       118
       118
       +
               md.token_endpoint_auth_methods_supported = Some(vec![jacquard::CowStr::from("none")]);

     

       119
       119
       +
               md.dpop_signing_alg_values_supported = Some(vec![jacquard::CowStr::from("ES256")]);

     

       120
       120
       +
               Ok(md.into_static())

     

       121
       121
       +
           }

     

       122
       122
       +
       

     

       123
       123
       +
           async fn verify_issuer(

     

       124
       124
       +
               &self,

     

       125
       125
       +
               _server_metadata: &OAuthAuthorizationServerMetadata<'_>,

     

       126
       126
       +
               _sub: &Did<'_>,

     

       127
       127
       +
           ) -> Result<url::Url, jacquard_oauth::resolver::ResolverError> {

     

       128
       128
       +
               Ok(url::Url::parse("https://pds").unwrap())

     

       129
       129
       +
           }

     

       130
       130
       +
       }

     

       131
       131
       +
       

     

       132
       132
       +
       fn get_session_unauthorized() -> http::Response<Vec<u8>> {

     

       133
       133
       +
           HttpResponse::builder()

     

       134
       134
       +
               .status(StatusCode::UNAUTHORIZED)

     

       135
       135
       +
               .header(

     

       136
       136
       +
                   http::header::WWW_AUTHENTICATE,

     

       137
       137
       +
                   HeaderValue::from_static("DPoP realm=\"pds\", error=\"invalid_token\""),

     

       138
       138
       +
               )

     

       139
       139
       +
               .body(Vec::new())

     

       140
       140
       +
               .unwrap()

     

       141
       141
       +
       }

     

       142
       142
       +
       

     

       143
       143
       +
       fn get_session_unauthorized_body() -> http::Response<Vec<u8>> {

     

       144
       144
       +
           HttpResponse::builder()

     

       145
       145
       +
               .status(StatusCode::UNAUTHORIZED)

     

       146
       146
       +
               .header(http::header::CONTENT_TYPE, "application/json")

     

       147
       147
       +
               .body(

     

       148
       148
       +
                   serde_json::to_vec(&serde_json::json!({

     

       149
       149
       +
                       "error":"InvalidToken"

     

       150
       150
       +
                   }))

     

       151
       151
       +
                   .unwrap(),

     

       152
       152
       +
               )

     

       153
       153
       +
               .unwrap()

     

       154
       154
       +
       }

     

       155
       155
       +
       

     

       156
       156
       +
       fn token_use_dpop_nonce() -> http::Response<Vec<u8>> {

     

       157
       157
       +
           HttpResponse::builder()

     

       158
       158
       +
               .status(StatusCode::BAD_REQUEST)

     

       159
       159
       +
               .header(http::header::CONTENT_TYPE, "application/json")

     

       160
       160
       +
               .header("DPoP-Nonce", HeaderValue::from_static("n1"))

     

       161
       161
       +
               .body(serde_json::to_vec(&serde_json::json!({"error":"use_dpop_nonce"})).unwrap())

     

       162
       162
       +
               .unwrap()

     

       163
       163
       +
       }

     

       164
       164
       +
       

     

       165
       165
       +
       fn token_refresh_ok() -> http::Response<Vec<u8>> {

     

       166
       166
       +
           HttpResponse::builder()

     

       167
       167
       +
               .status(StatusCode::OK)

     

       168
       168
       +
               .header(http::header::CONTENT_TYPE, "application/json")

     

       169
       169
       +
               .body(

     

       170
       170
       +
                   serde_json::to_vec(&serde_json::json!({

     

       171
       171
       +
                       "access_token":"newacc",

     

       172
       172
       +
                       "token_type":"DPoP",

     

       173
       173
       +
                       "refresh_token":"newref",

     

       174
       174
       +
                       "expires_in": 3600

     

       175
       175
       +
                   }))

     

       176
       176
       +
                   .unwrap(),

     

       177
       177
       +
               )

     

       178
       178
       +
               .unwrap()

     

       179
       179
       +
       }

     

       180
       180
       +
       

     

       181
       181
       +
       fn get_session_ok() -> http::Response<Vec<u8>> {

     

       182
       182
       +
           HttpResponse::builder()

     

       183
       183
       +
               .status(StatusCode::OK)

     

       184
       184
       +
               .header(http::header::CONTENT_TYPE, "application/json")

     

       185
       185
       +
               .body(

     

       186
       186
       +
                   serde_json::to_vec(&serde_json::json!({

     

       187
       187
       +
                       "did":"did:plc:alice",

     

       188
       188
       +
                       "handle":"alice.bsky.social",

     

       189
       189
       +
                       "active":true

     

       190
       190
       +
                   }))

     

       191
       191
       +
                   .unwrap(),

     

       192
       192
       +
               )

     

       193
       193
       +
               .unwrap()

     

       194
       194
       +
       }

     

       195
       195
       +
       

     

       196
       196
       +
       impl jacquard_oauth::dpop::DpopExt for MockClient {}

     

       197
       197
       +
       

     

       198
       198
       +
       #[tokio::test(flavor = "multi_thread")]

     

       199
       199
       +
       async fn oauth_xrpc_invalid_token_triggers_refresh_and_retries() {

     

       200
       200
       +
           // (reopen test body since we inserted a trait impl)

     

       201
       201
       +
           let client = Arc::new(MockClient::default());

     

       202
       202
       +
       

     

       203
       203
       +
           client.push(get_session_unauthorized()).await;

     

       204
       204
       +
           client.push(token_use_dpop_nonce()).await;

     

       205
       205
       +
           client.push(token_refresh_ok()).await;

     

       206
       206
       +
           client.push(get_session_ok()).await;

     

       207
       207
       +
       

     

       208
       208
       +
           let mut path = std::env::temp_dir();

     

       209
       209
       +
           path.push(format!("jacquard-oauth-test-{}.json", std::process::id()));

     

       210
       210
       +
           std::fs::write(&path, "{}").unwrap();

     

       211
       211
       +
           let store = jacquard::client::FileAuthStore::new(&path);

     

       212
       212
       +
       

     

       213
       213
       +
           let client_data = ClientData {

     

       214
       214
       +
               keyset: None,

     

       215
       215
       +
               config: AtprotoClientMetadata::new_localhost(None, Some(vec![Scope::Atproto])),

     

       216
       216
       +
           };

     

       217
       217
       +
           use jacquard::IntoStatic;

     

       218
       218
       +
           let session_data = ClientSessionData {

     

       219
       219
       +
               account_did: Did::new_static("did:plc:alice").unwrap(),

     

       220
       220
       +
               session_id: jacquard::CowStr::from("state"),

     

       221
       221
       +
               host_url: url::Url::parse("https://pds").unwrap(),

     

       222
       222
       +
               authserver_url: url::Url::parse("https://issuer").unwrap(),

     

       223
       223
       +
               authserver_token_endpoint: jacquard::CowStr::from("https://issuer/token"),

     

       224
       224
       +
               authserver_revocation_endpoint: None,

     

       225
       225
       +
               scopes: vec![Scope::Atproto],

     

       226
       226
       +
               dpop_data: DpopClientData {

     

       227
       227
       +
                   dpop_key: jacquard_oauth::utils::generate_key(&[jacquard::CowStr::from("ES256")])

     

       228
       228
       +
                       .unwrap(),

     

       229
       229
       +
                   dpop_authserver_nonce: jacquard::CowStr::from(""),

     

       230
       230
       +
                   dpop_host_nonce: jacquard::CowStr::from(""),

     

       231
       231
       +
               },

     

       232
       232
       +
               token_set: TokenSet {

     

       233
       233
       +
                   iss: jacquard::CowStr::from("https://issuer"),

     

       234
       234
       +
                   sub: Did::new_static("did:plc:alice").unwrap(),

     

       235
       235
       +
                   aud: jacquard::CowStr::from("https://pds"),

     

       236
       236
       +
                   scope: None,

     

       237
       237
       +
                   refresh_token: Some(jacquard::CowStr::from("rt1")),

     

       238
       238
       +
                   access_token: jacquard::CowStr::from("atk1"),

     

       239
       239
       +
                   token_type: OAuthTokenType::DPoP,

     

       240
       240
       +
                   expires_at: None,

     

       241
       241
       +
               },

     

       242
       242
       +
           }

     

       243
       243
       +
           .into_static();

     

       244
       244
       +
           let client_arc = client.clone();

     

       245
       245
       +
           let registry = Arc::new(SessionRegistry::new(store, client_arc.clone(), client_data));

     

       246
       246
       +
           // Seed the store so refresh can load the session

     

       247
       247
       +
           let data_store = ClientSessionData {

     

       248
       248
       +
               account_did: Did::new_static("did:plc:alice").unwrap(),

     

       249
       249
       +
               session_id: jacquard::CowStr::from("state"),

     

       250
       250
       +
               host_url: url::Url::parse("https://pds").unwrap(),

     

       251
       251
       +
               authserver_url: url::Url::parse("https://issuer").unwrap(),

     

       252
       252
       +
               authserver_token_endpoint: jacquard::CowStr::from("https://issuer/token"),

     

       253
       253
       +
               authserver_revocation_endpoint: None,

     

       254
       254
       +
               scopes: vec![Scope::Atproto],

     

       255
       255
       +
               dpop_data: DpopClientData {

     

       256
       256
       +
                   dpop_key: jacquard_oauth::utils::generate_key(&[jacquard::CowStr::from("ES256")])

     

       257
       257
       +
                       .unwrap(),

     

       258
       258
       +
                   dpop_authserver_nonce: jacquard::CowStr::from(""),

     

       259
       259
       +
                   dpop_host_nonce: jacquard::CowStr::from(""),

     

       260
       260
       +
               },

     

       261
       261
       +
               token_set: TokenSet {

     

       262
       262
       +
                   iss: jacquard::CowStr::from("https://issuer"),

     

       263
       263
       +
                   sub: Did::new_static("did:plc:alice").unwrap(),

     

       264
       264
       +
                   aud: jacquard::CowStr::from("https://pds"),

     

       265
       265
       +
                   scope: None,

     

       266
       266
       +
                   refresh_token: Some(jacquard::CowStr::from("rt1")),

     

       267
       267
       +
                   access_token: jacquard::CowStr::from("atk1"),

     

       268
       268
       +
                   token_type: OAuthTokenType::DPoP,

     

       269
       269
       +
                   expires_at: None,

     

       270
       270
       +
               },

     

       271
       271
       +
           }

     

       272
       272
       +
           .into_static();

     

       273
       273
       +
           registry.set(data_store).await.unwrap();

     

       274
       274
       +
           let session = OAuthSession::new(registry, client_arc, session_data);

     

       275
       275
       +
       

     

       276
       276
       +
           let agent: Agent<_> = Agent::from(session);

     

       277
       277
       +
           let resp = agent

     

       278
       278
       +
               .send(&jacquard::api::com_atproto::server::get_session::GetSession)

     

       279
       279
       +
               .await

     

       280
       280
       +
               .expect("xrpc send ok after auto-refresh");

     

       281
       281
       +
           assert_eq!(resp.status(), StatusCode::OK);

     

       282
       282
       +
       

     

       283
       283
       +
           // Inspect the request log

     

       284
       284
       +
           let log = client.log.lock().await;

     

       285
       285
       +
           assert_eq!(log.len(), 4, "expected 4 HTTP calls");

     

       286
       286
       +
           // 0: getSession with old token

     

       287
       287
       +
           assert_eq!(log[0].method(), Method::GET);

     

       288
       288
       +
           assert!(log[0].headers().get(http::header::AUTHORIZATION).unwrap().to_str().unwrap().starts_with("DPoP "));

     

       289
       289
       +
           assert!(log[0]

     

       290
       290
       +
               .uri()

     

       291
       291
       +
               .to_string()

     

       292
       292
       +
               .ends_with("/xrpc/com.atproto.server.getSession"));

     

       293
       293
       +
           // 1 and 2: token refresh attempts

     

       294
       294
       +
           assert_eq!(log[1].method(), Method::POST);

     

       295
       295
       +
           assert!(log[1].uri().to_string().ends_with("/token"));

     

       296
       296
       +
           assert!(log[1].headers().contains_key("DPoP"));

     

       297
       297
       +
           assert_eq!(log[2].method(), Method::POST);

     

       298
       298
       +
           assert!(log[2].uri().to_string().ends_with("/token"));

     

       299
       299
       +
           assert!(log[2].headers().contains_key("DPoP"));

     

       300
       300
       +
           // 3: retried getSession with new access token

     

       301
       301
       +
           assert_eq!(log[3].method(), Method::GET);

     

       302
       302
       +
           assert!(log[3]

     

       303
       303
       +
               .headers()

     

       304
       304
       +
               .get(http::header::AUTHORIZATION)

     

       305
       305
       +
               .unwrap()

     

       306
       306
       +
               .to_str()

     

       307
       307
       +
               .unwrap()

     

       308
       308
       +
               .starts_with("DPoP newacc"));

     

       309
       309
       +
       

     

       310
       310
       +
           // Cleanup temp file

     

       311
       311
       +
           let _ = std::fs::remove_file(&path);

     

       312
       312
       +
       }

     

       313
       313
       +
       

     

       314
       314
       +
       #[tokio::test(flavor = "multi_thread")]

     

       315
       315
       +
       async fn oauth_xrpc_invalid_token_body_triggers_refresh_and_retries() {

     

       316
       316
       +
           let client = Arc::new(MockClient::default());

     

       317
       317
       +
       

     

       318
       318
       +
           // Queue responses: initial 401 with JSON body; token refresh 400(use_dpop_nonce); token refresh 200; retry getSession 200

     

       319
       319
       +
           client.push(get_session_unauthorized_body()).await;

     

       320
       320
       +
           client.push(token_use_dpop_nonce()).await;

     

       321
       321
       +
           client.push(token_refresh_ok()).await;

     

       322
       322
       +
           client.push(get_session_ok()).await;

     

       323
       323
       +
       

     

       324
       324
       +
           let mut path = std::env::temp_dir();

     

       325
       325
       +
           path.push(format!("jacquard-oauth-test-body-{}.json", std::process::id()));

     

       326
       326
       +
           std::fs::write(&path, "{}").unwrap();

     

       327
       327
       +
           let store = jacquard::client::FileAuthStore::new(&path);

     

       328
       328
       +
       

     

       329
       329
       +
           let client_data = ClientData {

     

       330
       330
       +
               keyset: None,

     

       331
       331
       +
               config: AtprotoClientMetadata::new_localhost(None, Some(vec![Scope::Atproto])),

     

       332
       332
       +
           };

     

       333
       333
       +
           use jacquard::IntoStatic;

     

       334
       334
       +
           let session_data = ClientSessionData {

     

       335
       335
       +
               account_did: Did::new_static("did:plc:alice").unwrap(),

     

       336
       336
       +
               session_id: jacquard::CowStr::from("state"),

     

       337
       337
       +
               host_url: url::Url::parse("https://pds").unwrap(),

     

       338
       338
       +
               authserver_url: url::Url::parse("https://issuer").unwrap(),

     

       339
       339
       +
               authserver_token_endpoint: jacquard::CowStr::from("https://issuer/token"),

     

       340
       340
       +
               authserver_revocation_endpoint: None,

     

       341
       341
       +
               scopes: vec![Scope::Atproto],

     

       342
       342
       +
               dpop_data: DpopClientData {

     

       343
       343
       +
                   dpop_key: jacquard_oauth::utils::generate_key(&[jacquard::CowStr::from("ES256")])

     

       344
       344
       +
                       .unwrap(),

     

       345
       345
       +
                   dpop_authserver_nonce: jacquard::CowStr::from(""),

     

       346
       346
       +
                   dpop_host_nonce: jacquard::CowStr::from(""),

     

       347
       347
       +
               },

     

       348
       348
       +
               token_set: TokenSet {

     

       349
       349
       +
                   iss: jacquard::CowStr::from("https://issuer"),

     

       350
       350
       +
                   sub: Did::new_static("did:plc:alice").unwrap(),

     

       351
       351
       +
                   aud: jacquard::CowStr::from("https://pds"),

     

       352
       352
       +
                   scope: None,

     

       353
       353
       +
                   refresh_token: Some(jacquard::CowStr::from("rt1")),

     

       354
       354
       +
                   access_token: jacquard::CowStr::from("atk1"),

     

       355
       355
       +
                   token_type: OAuthTokenType::DPoP,

     

       356
       356
       +
                   expires_at: None,

     

       357
       357
       +
               },

     

       358
       358
       +
           }

     

       359
       359
       +
           .into_static();

     

       360
       360
       +
           let client_arc = client.clone();

     

       361
       361
       +
           let registry = Arc::new(SessionRegistry::new(store, client_arc.clone(), client_data));

     

       362
       362
       +
           registry.set(session_data.clone()).await.unwrap();

     

       363
       363
       +
           let session = OAuthSession::new(registry, client_arc, session_data);

     

       364
       364
       +
       

     

       365
       365
       +
           let agent: Agent<_> = Agent::from(session);

     

       366
       366
       +
           let resp = agent

     

       367
       367
       +
               .send(&jacquard::api::com_atproto::server::get_session::GetSession)

     

       368
       368
       +
               .await

     

       369
       369
       +
               .expect("xrpc send ok after auto-refresh");

     

       370
       370
       +
           assert_eq!(resp.status(), StatusCode::OK);

     

       371
       371
       +
       

     

       372
       372
       +
           // Cleanup temp file

     

       373
       373
       +
           let _ = std::fs::remove_file(&path);

     

       374
       374
       +
       }

+293

crates/jacquard/tests/oauth_flow.rs

···

       1
       1
       +
       use std::collections::VecDeque;

     

       2
       2
       +
       use std::sync::Arc;

     

       3
       3
       +
       

     

       4
       4
       +
       use bytes::Bytes;

     

       5
       5
       +
       use http::{Response as HttpResponse, StatusCode};

     

       6
       6
       +
       use jacquard::IntoStatic;

     

       7
       7
       +
       use jacquard::client::Agent;

     

       8
       8
       +
       use jacquard::types::xrpc::XrpcClient;

     

       9
       9
       +
       use jacquard_common::http_client::HttpClient;

     

       10
       10
       +
       use jacquard_oauth::atproto::AtprotoClientMetadata;

     

       11
       11
       +
       use jacquard_oauth::authstore::ClientAuthStore;

     

       12
       12
       +
       use jacquard_oauth::client::OAuthClient;

     

       13
       13
       +
       use jacquard_oauth::resolver::OAuthResolver;

     

       14
       14
       +
       use jacquard_oauth::scopes::Scope;

     

       15
       15
       +
       use jacquard_oauth::session::ClientData;

     

       16
       16
       +
       

     

       17
       17
       +
       #[derive(Clone, Default)]

     

       18
       18
       +
       struct MockClient {

     

       19
       19
       +
           queue: Arc<tokio::sync::Mutex<VecDeque<http::Response<Vec<u8>>>>>,

     

       20
       20
       +
       }

     

       21
       21
       +
       

     

       22
       22
       +
       impl MockClient {

     

       23
       23
       +
           async fn push(&self, resp: http::Response<Vec<u8>>) {

     

       24
       24
       +
               self.queue.lock().await.push_back(resp);

     

       25
       25
       +
           }

     

       26
       26
       +
       }

     

       27
       27
       +
       

     

       28
       28
       +
       impl HttpClient for MockClient {

     

       29
       29
       +
           type Error = std::convert::Infallible;

     

       30
       30
       +
           fn send_http(

     

       31
       31
       +
               &self,

     

       32
       32
       +
               _request: http::Request<Vec<u8>>,

     

       33
       33
       +
           ) -> impl core::future::Future<

     

       34
       34
       +
               Output = core::result::Result<http::Response<Vec<u8>>, Self::Error>,

     

       35
       35
       +
           > + Send {

     

       36
       36
       +
               let queue = self.queue.clone();

     

       37
       37
       +
               async move { Ok(queue.lock().await.pop_front().expect("no queued response")) }

     

       38
       38
       +
           }

     

       39
       39
       +
       }

     

       40
       40
       +
       

     

       41
       41
       +
       #[async_trait::async_trait]

     

       42
       42
       +
       impl jacquard::identity::resolver::IdentityResolver for MockClient {

     

       43
       43
       +
           fn options(&self) -> &jacquard::identity::resolver::ResolverOptions {

     

       44
       44
       +
               use std::sync::LazyLock;

     

       45
       45
       +
               static OPTS: LazyLock<jacquard::identity::resolver::ResolverOptions> =

     

       46
       46
       +
                   LazyLock::new(jacquard::identity::resolver::ResolverOptions::default);

     

       47
       47
       +
               &OPTS

     

       48
       48
       +
           }

     

       49
       49
       +
           async fn resolve_handle(

     

       50
       50
       +
               &self,

     

       51
       51
       +
               _handle: &jacquard::types::string::Handle<'_>,

     

       52
       52
       +
           ) -> std::result::Result<

     

       53
       53
       +
               jacquard::types::did::Did<'static>,

     

       54
       54
       +
               jacquard::identity::resolver::IdentityError,

     

       55
       55
       +
           > {

     

       56
       56
       +
               Ok(jacquard::types::did::Did::new_static("did:plc:alice").unwrap())

     

       57
       57
       +
           }

     

       58
       58
       +
           async fn resolve_did_doc(

     

       59
       59
       +
               &self,

     

       60
       60
       +
               _did: &jacquard::types::did::Did<'_>,

     

       61
       61
       +
           ) -> std::result::Result<

     

       62
       62
       +
               jacquard::identity::resolver::DidDocResponse,

     

       63
       63
       +
               jacquard::identity::resolver::IdentityError,

     

       64
       64
       +
           > {

     

       65
       65
       +
               let doc = serde_json::json!({

     

       66
       66
       +
                   "id": "did:plc:alice",

     

       67
       67
       +
                   "service": [{

     

       68
       68
       +
                       "id": "#pds",

     

       69
       69
       +
                       "type": "AtprotoPersonalDataServer",

     

       70
       70
       +
                       "serviceEndpoint": "https://pds"

     

       71
       71
       +
                   }]

     

       72
       72
       +
               });

     

       73
       73
       +
               Ok(jacquard::identity::resolver::DidDocResponse {

     

       74
       74
       +
                   buffer: Bytes::from(serde_json::to_vec(&doc).unwrap()),

     

       75
       75
       +
                   status: StatusCode::OK,

     

       76
       76
       +
                   requested: None,

     

       77
       77
       +
               })

     

       78
       78
       +
           }

     

       79
       79
       +
       }

     

       80
       80
       +
       

     

       81
       81
       +
       #[async_trait::async_trait]

     

       82
       82
       +
       impl OAuthResolver for MockClient {

     

       83
       83
       +
           async fn resolve_oauth(

     

       84
       84
       +
               &self,

     

       85
       85
       +
               _input: &str,

     

       86
       86
       +
           ) -> Result<

     

       87
       87
       +
               (

     

       88
       88
       +
                   jacquard_oauth::types::OAuthAuthorizationServerMetadata<'static>,

     

       89
       89
       +
                   Option<jacquard_common::types::did_doc::DidDocument<'static>>,

     

       90
       90
       +
               ),

     

       91
       91
       +
               jacquard_oauth::resolver::ResolverError,

     

       92
       92
       +
           > {

     

       93
       93
       +
               let mut md = jacquard_oauth::types::OAuthAuthorizationServerMetadata::default();

     

       94
       94
       +
               md.issuer = jacquard::CowStr::from("https://issuer");

     

       95
       95
       +
               md.authorization_endpoint = jacquard::CowStr::from("https://issuer/authorize");

     

       96
       96
       +
               md.token_endpoint = jacquard::CowStr::from("https://issuer/token");

     

       97
       97
       +
               md.require_pushed_authorization_requests = Some(true);

     

       98
       98
       +
               md.pushed_authorization_request_endpoint =

     

       99
       99
       +
                   Some(jacquard::CowStr::from("https://issuer/par"));

     

       100
       100
       +
               md.token_endpoint_auth_methods_supported = Some(vec![jacquard::CowStr::from("none")]);

     

       101
       101
       +
               md.dpop_signing_alg_values_supported = Some(vec![jacquard::CowStr::from("ES256")]);

     

       102
       102
       +
       

     

       103
       103
       +
               // Simple DID doc pointing to https://pds

     

       104
       104
       +
               let doc = serde_json::json!({

     

       105
       105
       +
                   "id": "did:plc:alice",

     

       106
       106
       +
                   "service": [{

     

       107
       107
       +
                       "id": "#pds",

     

       108
       108
       +
                       "type": "AtprotoPersonalDataServer",

     

       109
       109
       +
                       "serviceEndpoint": "https://pds"

     

       110
       110
       +
                   }]

     

       111
       111
       +
               });

     

       112
       112
       +
               let buf = Bytes::from(serde_json::to_vec(&doc).unwrap());

     

       113
       113
       +
               let did_doc_b: jacquard_common::types::did_doc::DidDocument<'_> =

     

       114
       114
       +
                   serde_json::from_slice(&buf).unwrap();

     

       115
       115
       +
               let did_doc = did_doc_b.into_static();

     

       116
       116
       +
               Ok((md.into_static(), Some(did_doc)))

     

       117
       117
       +
           }

     

       118
       118
       +
           async fn get_authorization_server_metadata(

     

       119
       119
       +
               &self,

     

       120
       120
       +
               issuer: &url::Url,

     

       121
       121
       +
           ) -> Result<

     

       122
       122
       +
               jacquard_oauth::types::OAuthAuthorizationServerMetadata<'static>,

     

       123
       123
       +
               jacquard_oauth::resolver::ResolverError,

     

       124
       124
       +
           > {

     

       125
       125
       +
               let mut md = jacquard_oauth::types::OAuthAuthorizationServerMetadata::default();

     

       126
       126
       +
               md.issuer = jacquard::CowStr::from(issuer.as_str());

     

       127
       127
       +
               md.authorization_endpoint = jacquard::CowStr::from(format!("{}/authorize", issuer));

     

       128
       128
       +
               md.token_endpoint = jacquard::CowStr::from(format!("{}/token", issuer));

     

       129
       129
       +
               md.require_pushed_authorization_requests = Some(true);

     

       130
       130
       +
               md.pushed_authorization_request_endpoint =

     

       131
       131
       +
                   Some(jacquard::CowStr::from(format!("{}/par", issuer)));

     

       132
       132
       +
               md.token_endpoint_auth_methods_supported = Some(vec![jacquard::CowStr::from("none")]);

     

       133
       133
       +
               md.dpop_signing_alg_values_supported = Some(vec![jacquard::CowStr::from("ES256")]);

     

       134
       134
       +
               Ok(md.into_static())

     

       135
       135
       +
           }

     

       136
       136
       +
       

     

       137
       137
       +
           async fn get_resource_server_metadata(

     

       138
       138
       +
               &self,

     

       139
       139
       +
               _pds: &url::Url,

     

       140
       140
       +
           ) -> Result<

     

       141
       141
       +
               jacquard_oauth::types::OAuthAuthorizationServerMetadata<'static>,

     

       142
       142
       +
               jacquard_oauth::resolver::ResolverError,

     

       143
       143
       +
           > {

     

       144
       144
       +
               let mut md = jacquard_oauth::types::OAuthAuthorizationServerMetadata::default();

     

       145
       145
       +
               md.issuer = jacquard::CowStr::from("https://issuer/");

     

       146
       146
       +
               md.authorization_endpoint = jacquard::CowStr::from("https://issuer/authorize");

     

       147
       147
       +
               md.token_endpoint = jacquard::CowStr::from("https://issuer/token");

     

       148
       148
       +
               md.require_pushed_authorization_requests = Some(true);

     

       149
       149
       +
               md.pushed_authorization_request_endpoint =

     

       150
       150
       +
                   Some(jacquard::CowStr::from("https://issuer/par"));

     

       151
       151
       +
               md.token_endpoint_auth_methods_supported = Some(vec![jacquard::CowStr::from("none")]);

     

       152
       152
       +
               md.dpop_signing_alg_values_supported = Some(vec![jacquard::CowStr::from("ES256")]);

     

       153
       153
       +
               Ok(md.into_static())

     

       154
       154
       +
           }

     

       155
       155
       +
       }

     

       156
       156
       +
       

     

       157
       157
       +
       impl jacquard_oauth::dpop::DpopExt for MockClient {}

     

       158
       158
       +
       

     

       159
       159
       +
       #[tokio::test(flavor = "multi_thread")]

     

       160
       160
       +
       async fn oauth_end_to_end_mock_flow() {

     

       161
       161
       +
           let client = Arc::new(MockClient::default());

     

       162
       162
       +
           // Queue responses: PAR 201, token 200, XRPC getSession 200

     

       163
       163
       +
           client

     

       164
       164
       +
               .push(

     

       165
       165
       +
                   HttpResponse::builder()

     

       166
       166
       +
                       .status(StatusCode::CREATED)

     

       167
       167
       +
                       .header(http::header::CONTENT_TYPE, "application/json")

     

       168
       168
       +
                       .body(

     

       169
       169
       +
                           serde_json::to_vec(&serde_json::json!({

     

       170
       170
       +
                               "request_uri": "urn:par:abc",

     

       171
       171
       +
                               "expires_in": 60

     

       172
       172
       +
                           }))

     

       173
       173
       +
                           .unwrap(),

     

       174
       174
       +
                       )

     

       175
       175
       +
                       .unwrap(),

     

       176
       176
       +
               )

     

       177
       177
       +
               .await;

     

       178
       178
       +
           client

     

       179
       179
       +
               .push(

     

       180
       180
       +
                   HttpResponse::builder()

     

       181
       181
       +
                       .status(StatusCode::OK)

     

       182
       182
       +
                       .header(http::header::CONTENT_TYPE, "application/json")

     

       183
       183
       +
                       .header("DPoP-Nonce", http::HeaderValue::from_static("n1"))

     

       184
       184
       +
                       .body(

     

       185
       185
       +
                           serde_json::to_vec(&serde_json::json!({

     

       186
       186
       +
                               "access_token": "atk1",

     

       187
       187
       +
                               "token_type": "DPoP",

     

       188
       188
       +
                               "refresh_token": "rt1",

     

       189
       189
       +
                               "sub": "did:plc:alice",

     

       190
       190
       +
                               "iss": "https://issuer",

     

       191
       191
       +
                               "aud": "https://pds",

     

       192
       192
       +
                               "expires_in": 3600

     

       193
       193
       +
                           }))

     

       194
       194
       +
                           .unwrap(),

     

       195
       195
       +
                       )

     

       196
       196
       +
                       .unwrap(),

     

       197
       197
       +
               )

     

       198
       198
       +
               .await;

     

       199
       199
       +
           client

     

       200
       200
       +
               .push(

     

       201
       201
       +
                   HttpResponse::builder()

     

       202
       202
       +
                       .status(StatusCode::OK)

     

       203
       203
       +
                       .header(http::header::CONTENT_TYPE, "application/json")

     

       204
       204
       +
                       .body(

     

       205
       205
       +
                           serde_json::to_vec(&serde_json::json!({

     

       206
       206
       +
                               "did": "did:plc:alice",

     

       207
       207
       +
                               "handle": "alice.bsky.social",

     

       208
       208
       +
                               "active": true

     

       209
       209
       +
                           }))

     

       210
       210
       +
                           .unwrap(),

     

       211
       211
       +
                       )

     

       212
       212
       +
                       .unwrap(),

     

       213
       213
       +
               )

     

       214
       214
       +
               .await;

     

       215
       215
       +
       

     

       216
       216
       +
           // File-backed store for auth state/session

     

       217
       217
       +
           let mut path = std::env::temp_dir();

     

       218
       218
       +
           path.push(format!("jacquard-oauth-flow-{}.json", std::process::id()));

     

       219
       219
       +
           std::fs::write(&path, "{}").unwrap();

     

       220
       220
       +
           let store = jacquard::client::FileAuthStore::new(&path);

     

       221
       221
       +
       

     

       222
       222
       +
           let client_data: ClientData<'static> = ClientData {

     

       223
       223
       +
               keyset: None,

     

       224
       224
       +
               config: AtprotoClientMetadata::new_localhost(None, Some(vec![Scope::Atproto])),

     

       225
       225
       +
           };

     

       226
       226
       +
           let client_arc = client.clone();

     

       227
       227
       +
           let oauth = OAuthClient::new_from_resolver(store, (*client_arc).clone(), client_data);

     

       228
       228
       +
       

     

       229
       229
       +
           // Build metadata and call PAR to get an AuthRequestData, then save in store

     

       230
       230
       +
           let (server_metadata, identity) = client.resolve_oauth("alice.bsky.social").await.unwrap();

     

       231
       231
       +
           let metadata = jacquard_oauth::request::OAuthMetadata {

     

       232
       232
       +
               server_metadata,

     

       233
       233
       +
               client_metadata: jacquard_oauth::atproto::atproto_client_metadata(

     

       234
       234
       +
                   AtprotoClientMetadata::new_localhost(None, Some(vec![Scope::Atproto])),

     

       235
       235
       +
                   &None,

     

       236
       236
       +
               )

     

       237
       237
       +
               .unwrap()

     

       238
       238
       +
               .into_static(),

     

       239
       239
       +
               keyset: None,

     

       240
       240
       +
           };

     

       241
       241
       +
           let login_hint = identity.map(|_| jacquard::CowStr::from("alice.bsky.social"));

     

       242
       242
       +
           let mut auth_req = jacquard_oauth::request::par(client.as_ref(), login_hint, None, &metadata)

     

       243
       243
       +
               .await

     

       244
       244
       +
               .unwrap();

     

       245
       245
       +
           // Construct authorization URL as OAuthClient::start_auth would do

     

       246
       246
       +
           #[derive(serde::Serialize)]

     

       247
       247
       +
           struct Parameters<'s> {

     

       248
       248
       +
               client_id: url::Url,

     

       249
       249
       +
               request_uri: jacquard::CowStr<'s>,

     

       250
       250
       +
           }

     

       251
       251
       +
           let auth_url = format!(

     

       252
       252
       +
               "{}?{}",

     

       253
       253
       +
               metadata.server_metadata.authorization_endpoint,

     

       254
       254
       +
               serde_html_form::to_string(Parameters {

     

       255
       255
       +
                   client_id: metadata.client_metadata.client_id.clone(),

     

       256
       256
       +
                   request_uri: auth_req.request_uri.clone(),

     

       257
       257
       +
               })

     

       258
       258
       +
               .unwrap()

     

       259
       259
       +
           );

     

       260
       260
       +
           assert!(auth_url.contains("/authorize?"));

     

       261
       261
       +
           assert!(auth_url.contains("request_uri"));

     

       262
       262
       +
           // keep state for the callback

     

       263
       263
       +
           let state = auth_req.state.clone();

     

       264
       264
       +
           oauth

     

       265
       265
       +
               .registry

     

       266
       266
       +
               .store

     

       267
       267
       +
               .save_auth_req_info(&auth_req)

     

       268
       268
       +
               .await

     

       269
       269
       +
               .unwrap();

     

       270
       270
       +
       

     

       271
       271
       +
           // callback: exchange code, create session

     

       272
       272
       +
           use jacquard_oauth::types::CallbackParams;

     

       273
       273
       +
           let session = oauth

     

       274
       274
       +
               .callback(CallbackParams {

     

       275
       275
       +
                   code: jacquard::CowStr::from("code123"),

     

       276
       276
       +
                   state: Some(state.clone()),

     

       277
       277
       +
                   // Callback compares exact string with metadata.issuer (which is a URL string

     

       278
       278
       +
                   // including trailing slash). Use normalized form to match.

     

       279
       279
       +
                   iss: Some(jacquard::CowStr::from("https://issuer/")),

     

       280
       280
       +
               })

     

       281
       281
       +
               .await

     

       282
       282
       +
               .unwrap();

     

       283
       283
       +
       

     

       284
       284
       +
           // Wrap in Agent and send a resource XRPC call to verify Authorization works

     

       285
       285
       +
           let agent: Agent<_> = Agent::from(session);

     

       286
       286
       +
           let resp = agent

     

       287
       287
       +
               .send(&jacquard::api::com_atproto::server::get_session::GetSession)

     

       288
       288
       +
               .await

     

       289
       289
       +
               .unwrap();

     

       290
       290
       +
           assert_eq!(resp.status(), StatusCode::OK);

     

       291
       291
       +
       

     

       292
       292
       +
           let _ = std::fs::remove_file(&path);

     

       293
       293
       +
       }

+125

crates/jacquard/tests/restore_pds_cache.rs

···

       1
       1
       +
       use std::sync::Arc;

     

       2
       2
       +
       

     

       3
       3
       +
       use bytes::Bytes;

     

       4
       4
       +
       use http::{Response as HttpResponse, StatusCode};

     

       5
       5
       +
       use jacquard::client::credential_session::{CredentialSession, SessionKey};

     

       6
       6
       +
       use jacquard::client::{AtpSession, FileAuthStore};

     

       7
       7
       +
       use jacquard::identity::resolver::{DidDocResponse, IdentityResolver, ResolverOptions};

     

       8
       8
       +
       use jacquard::types::did::Did;

     

       9
       9
       +
       use jacquard::types::string::Handle;

     

       10
       10
       +
       use jacquard_common::http_client::HttpClient;

     

       11
       11
       +
       use jacquard_common::session::SessionStore;

     

       12
       12
       +
       use std::fs;

     

       13
       13
       +
       use std::path::PathBuf;

     

       14
       14
       +
       use tokio::sync::RwLock;

     

       15
       15
       +
       use url::Url;

     

       16
       16
       +
       

     

       17
       17
       +
       #[derive(Clone, Default)]

     

       18
       18
       +
       struct MockResolver {

     

       19
       19
       +
           // Count calls to DID doc resolution

     

       20
       20
       +
           did_doc_calls: Arc<RwLock<usize>>,

     

       21
       21
       +
       }

     

       22
       22
       +
       

     

       23
       23
       +
       impl HttpClient for MockResolver {

     

       24
       24
       +
           type Error = std::convert::Infallible;

     

       25
       25
       +
           fn send_http(

     

       26
       26
       +
               &self,

     

       27
       27
       +
               _request: http::Request<Vec<u8>>,

     

       28
       28
       +
           ) -> impl core::future::Future<

     

       29
       29
       +
               Output = core::result::Result<http::Response<Vec<u8>>, Self::Error>,

     

       30
       30
       +
           > + Send {

     

       31
       31
       +
               async {

     

       32
       32
       +
                   // Not used in this test

     

       33
       33
       +
                   Ok(HttpResponse::builder()

     

       34
       34
       +
                       .status(StatusCode::OK)

     

       35
       35
       +
                       .body(Vec::new())

     

       36
       36
       +
                       .unwrap())

     

       37
       37
       +
               }

     

       38
       38
       +
           }

     

       39
       39
       +
       }

     

       40
       40
       +
       

     

       41
       41
       +
       #[async_trait::async_trait]

     

       42
       42
       +
       impl IdentityResolver for MockResolver {

     

       43
       43
       +
           fn options(&self) -> &ResolverOptions {

     

       44
       44
       +
               use std::sync::LazyLock;

     

       45
       45
       +
               static OPTS: LazyLock<ResolverOptions> = LazyLock::new(ResolverOptions::default);

     

       46
       46
       +
               &OPTS

     

       47
       47
       +
           }

     

       48
       48
       +
           async fn resolve_handle(

     

       49
       49
       +
               &self,

     

       50
       50
       +
               _handle: &Handle<'_>,

     

       51
       51
       +
           ) -> std::result::Result<Did<'static>, jacquard::identity::resolver::IdentityError> {

     

       52
       52
       +
               Ok(Did::new_static("did:plc:alice").unwrap())

     

       53
       53
       +
           }

     

       54
       54
       +
           async fn resolve_did_doc(

     

       55
       55
       +
               &self,

     

       56
       56
       +
               _did: &Did<'_>,

     

       57
       57
       +
           ) -> std::result::Result<DidDocResponse, jacquard::identity::resolver::IdentityError> {

     

       58
       58
       +
               *self.did_doc_calls.write().await += 1;

     

       59
       59
       +
               let doc = serde_json::json!({

     

       60
       60
       +
                   "id": "did:plc:alice",

     

       61
       61
       +
                   "service": [{

     

       62
       62
       +
                       "id": "#pds",

     

       63
       63
       +
                       "type": "AtprotoPersonalDataServer",

     

       64
       64
       +
                       "serviceEndpoint": "https://pds-resolved"

     

       65
       65
       +
                   }]

     

       66
       66
       +
               });

     

       67
       67
       +
               Ok(DidDocResponse {

     

       68
       68
       +
                   buffer: Bytes::from(serde_json::to_vec(&doc).unwrap()),

     

       69
       69
       +
                   status: StatusCode::OK,

     

       70
       70
       +
                   requested: None,

     

       71
       71
       +
               })

     

       72
       72
       +
           }

     

       73
       73
       +
       }

     

       74
       74
       +
       

     

       75
       75
       +
       fn temp_file() -> PathBuf {

     

       76
       76
       +
           let mut p = std::env::temp_dir();

     

       77
       77
       +
           p.push(format!("jacquard-test-restore-{}.json", std::process::id()));

     

       78
       78
       +
           p

     

       79
       79
       +
       }

     

       80
       80
       +
       

     

       81
       81
       +
       #[tokio::test]

     

       82
       82
       +
       async fn restore_uses_cached_pds_when_present() {

     

       83
       83
       +
           let path = temp_file();

     

       84
       84
       +
           fs::write(&path, "{}").unwrap();

     

       85
       85
       +
           let store = Arc::new(FileAuthStore::new(&path));

     

       86
       86
       +
           let resolver = Arc::new(MockResolver::default());

     

       87
       87
       +
       

     

       88
       88
       +
           // Seed an app-password session in the file store

     

       89
       89
       +
           let session = AtpSession {

     

       90
       90
       +
               access_jwt: "acc".into(),

     

       91
       91
       +
               refresh_jwt: "ref".into(),

     

       92
       92
       +
               did: Did::new_static("did:plc:alice").unwrap(),

     

       93
       93
       +
               handle: Handle::new_static("alice.bsky.social").unwrap(),

     

       94
       94
       +
           };

     

       95
       95
       +
           let key: SessionKey = (session.did.clone(), "session".into());

     

       96
       96
       +
           jacquard_common::session::SessionStore::set(store.as_ref(), key.clone(), session)

     

       97
       97
       +
               .await

     

       98
       98
       +
               .unwrap();

     

       99
       99
       +
           // Verify it is persisted

     

       100
       100
       +
           assert!(SessionStore::get(store.as_ref(), &key).await.is_some());

     

       101
       101
       +
           // Persist PDS endpoint cache to avoid DID resolution on restore

     

       102
       102
       +
           store

     

       103
       103
       +
               .set_atp_pds(&key, &Url::parse("https://pds-cached").unwrap())

     

       104
       104
       +
               .unwrap();

     

       105
       105
       +
           assert_eq!(

     

       106
       106
       +
               store

     

       107
       107
       +
                   .get_atp_pds(&key)

     

       108
       108
       +
                   .ok()

     

       109
       109
       +
                   .flatten()

     

       110
       110
       +
                   .expect("pds cached")

     

       111
       111
       +
                   .as_str(),

     

       112
       112
       +
               "https://pds-cached/"

     

       113
       113
       +
           );

     

       114
       114
       +
       

     

       115
       115
       +
           let session = CredentialSession::new(store.clone(), resolver.clone());

     

       116
       116
       +
           // Restore should pick cached PDS and NOT call resolve_did_doc

     

       117
       117
       +
           session

     

       118
       118
       +
               .restore(Did::new_static("did:plc:alice").unwrap(), "session".into())

     

       119
       119
       +
               .await

     

       120
       120
       +
               .expect("restore ok");

     

       121
       121
       +
           assert_eq!(session.endpoint().await.as_str(), "https://pds-cached/");

     

       122
       122
       +
       

     

       123
       123
       +
           // Cleanup

     

       124
       124
       +
           let _ = fs::remove_file(&path);

     

       125
       125
       +
       }