OAuth spec alignment (bluesky-social#2755)

* Improve reporting of metadata validation error
* Properly validate client metadata scope
* Allow loopback clients to define their scopes through client_id query parameters
* Require definition of "scope" in client metadata document
* Restrict the value used as code_challenge_methods_supported
* Remove `plain` from `code_challenge_methods_supported`
* Prevent use of empty string in unsupported oidc request parameters
* Centralize parsing of client metadata error
* Enfore code_challenge_method=S256 request parameter
* Improve error description in case of invalid loopback client_id
* Enfore single scope query param in loopback clients
* Disable request params scopes defaulting to client metadata scope
* Centralize loopback client validation logic
* add assertion utils for client ids
* Improve invalid client_id error messages from BrowserOAuthClient.from()
* Use scope from client metadata as default value
* Improve client side validation of client metadata
* Allow fetching of source maps files from browser debugger
* Use the clientId to configure the OAuth client
* Allow native clients to use https: redirect uris
* Explicitely forbid MTLS client auth method
* Improve error feedback in case of invalid client_id domain name
* Remove un-spec'ed restrictions on redirect_uris based on the client_uri
* Do not strip query string from URL after oauth redirect in fragment mode
* Add missing "expires_in" property to OAuthParResponse type definition
* Allow non canonical urls to be used as client ID
* Allow client metadata to contain other return type values than "code"
* Properly validate request_uri request parameter
* Improve parsing and validation of client_id's
* Return "invalid_client" on invalid client credentials
* improved error management & reporting
* performance improvement
* Allow loopback client ids to omit the (empty) path parameter

Co-authored-by: devin ivy <[email protected]>

.changeset/big-rules-decide.md

@@ -0,0 +1,5 @@
+---
+"@atproto/oauth-provider": patch
+---
+
+Disable request params scopes defaulting to client metadata scopes. Requires that client always provide a "scope" parameter when initiating an oauth flow.

.changeset/calm-planets-rescue.md

@@ -0,0 +1,5 @@
+---
+"@atproto/oauth-types": patch
+---
+
+Properly validate client metadata scope

.changeset/chatty-adults-sparkle.md

@@ -0,0 +1,5 @@
+---
+"@atproto/oauth-types": patch
+---
+
+Allow ClientID query params to end with a slash "/" char

.changeset/curly-maps-crash.md

@@ -0,0 +1,5 @@
+---
+"@atproto/oauth-provider": patch
+---
+
+Remove "plain" from code_challenge_methods_supported

.changeset/curly-tomatoes-listen.md

@@ -0,0 +1,5 @@
+---
+"@atproto/oauth-client-browser": patch
+---
+
+Improve invalid client_id error messages from BrowserOAuthClient.from()

.changeset/cyan-pandas-judge.md

@@ -0,0 +1,5 @@
+---
+"@atproto/oauth-provider": patch
+---
+
+Require definition of "scope" in client metadata document

.changeset/fair-hornets-raise.md

@@ -0,0 +1,5 @@
+---
+"@atproto/oauth-provider": patch
+---
+
+Improve reporting of metadata validation error

.changeset/famous-items-build.md

@@ -0,0 +1,5 @@
+---
+"@atproto/oauth-types": patch
+---
+
+Expose OAuthScope

.changeset/four-crews-wash.md

@@ -0,0 +1,5 @@
+---
+"@atproto/oauth-client": patch
+---
+
+Improve client side validation of client metadata

.changeset/friendly-suits-lay.md

@@ -0,0 +1,5 @@
+---
+"@atproto/oauth-client-browser": patch
+---
+
+Do not strip query string from URL after oauth redirect in fragment mode

.changeset/giant-ladybugs-deliver.md

@@ -0,0 +1,5 @@
+---
+"@atproto/oauth-types": patch
+---
+
+add assertion utils for client ids

.changeset/gold-taxis-fail.md

@@ -0,0 +1,5 @@
+---
+"@atproto/oauth-provider": patch
+---
+
+Properly validate request_uri request parameter

.changeset/gorgeous-hounds-rule.md

@@ -0,0 +1,5 @@
+---
+"@atproto/oauth-types": patch
+---
+
+Allow loopback client ids to omit the (empty) path parameter

.changeset/great-news-shout.md

@@ -0,0 +1,5 @@
+---
+"@atproto/oauth-types": patch
+---
+
+Enforce ClientID URL path to be normalized

.changeset/late-wolves-itch.md

@@ -0,0 +1,5 @@
+---
+"@atproto/oauth-provider": patch
+---
+
+Enforce code_challenge_method=S256 request parameter

.changeset/mighty-keys-grow.md

@@ -0,0 +1,5 @@
+---
+"@atproto/oauth-types": patch
+---
+
+Rename OAuthAuthenticationRequestParameters to OAuthAuthorizationRequestParameters

.changeset/odd-moons-collect.md

@@ -0,0 +1,5 @@
+---
+"@atproto/oauth-client": patch
+---
+
+Use scope from client metadata as default value

.changeset/purple-penguins-kiss.md

@@ -0,0 +1,5 @@
+---
+"@atproto/oauth-provider": patch
+---
+
+Explicitely forbid MTLS client auth method

.changeset/quick-eels-listen.md

@@ -0,0 +1,5 @@
+---
+"@atproto/oauth-types": patch
+---
+
+Restrict the value used as code_challenge_methods_supported

.changeset/quick-singers-pretend.md

@@ -0,0 +1,5 @@
+---
+"@atproto/oauth-provider": patch
+---
+
+Return "invalid_client" on invalid client credentials

.changeset/rude-apes-lay.md

@@ -0,0 +1,5 @@
+---
+"@atproto/oauth-provider": patch
+---
+
+Prevent use of empty string in unsupported oidc request parameters

.changeset/shy-balloons-watch.md

@@ -0,0 +1,5 @@
+---
+"@atproto/oauth-types": patch
+---
+
+Add missing "expires_in" property to OAuthParResponse type definition

.changeset/silly-sloths-mate.md

@@ -0,0 +1,5 @@
+---
+"@atproto/oauth-provider": patch
+---
+
+Allow fetching of source maps files from browser debugger

.changeset/smart-houses-battle.md

@@ -0,0 +1,5 @@
+---
+"@atproto/oauth-types": patch
+---
+
+Allow loopback clients to define their scopes through the "scope" client_id query parameter.

.changeset/sweet-dodos-talk.md

@@ -0,0 +1,5 @@
+---
+"@atproto/oauth-types": patch
+---
+
+Improve error description in case of invalid loopback client_id

.changeset/tasty-singers-matter.md

@@ -0,0 +1,5 @@
+---
+"@atproto/oauth-provider": patch
+---
+
+Allow native clients to use https: redirect uris

.changeset/three-elephants-call.md

@@ -0,0 +1,5 @@
+---
+"@atproto/oauth-provider": patch
+---
+
+Allow client metadata to contain other values than "code"

.changeset/yellow-ants-vanish.md

@@ -0,0 +1,5 @@
+---
+"@atproto/oauth-client-browser": patch
+---
+
+Relax type restriction on clientId option

packages/oauth/oauth-client-browser/example/src/app.tsx

@@ -3,7 +3,7 @@ import { useAuthContext } from './auth/auth-provider'
 import { OAuthSession } from '@atproto/oauth-client'
 
 function App() {
-  const { pdsAgent, signOut } = useAuthContext()
+  const { pdsAgent, signOut, refresh } = useAuthContext()
 
   const hasTokenInfo = pdsAgent.sessionManager instanceof OAuthSession
 
@@ -69,6 +69,8 @@ function App() {
         </pre>
       </code>
 
+      <button onClick={refresh}>Refresh tokens</button>
+      <br />
       <button onClick={signOut}>Sign-out</button>
     </div>
   )

packages/oauth/oauth-client-browser/example/src/auth/auth-provider.tsx

@@ -10,6 +10,7 @@ import { useOAuth, UseOAuthOptions } from './oauth/use-oauth'
 export type AuthContext = {
   pdsAgent: Agent
   signOut: () => void
+  refresh: () => void
 }
 
 const AuthContext = createContext<AuthContext | null>(null)
@@ -27,23 +28,42 @@ export const AuthProvider = ({
     agent: oauthAgent,
     signIn: oauthSignIn,
     signOut: oauthSignOut,
+    refresh: oauthRefresh,
   } = useOAuth(options)
 
   const {
     agent: credentialAgent,
     signIn: credentialSignIn,
     signOut: credentialSignOut,
+    refresh: credentialRefresh,
   } = useCredentialAuth()
 
-  const value = useMemo<AuthContext | null>(
-    () =>
-      oauthAgent
-        ? { pdsAgent: oauthAgent, signOut: oauthSignOut }
-        : credentialAgent
-          ? { pdsAgent: credentialAgent, signOut: credentialSignOut }
-          : null,
-    [oauthAgent, oauthSignOut, credentialAgent, credentialSignOut],
-  )
+  const value = useMemo<AuthContext | null>(() => {
+    if (oauthAgent) {
+      return {
+        pdsAgent: oauthAgent,
+        signOut: oauthSignOut,
+        refresh: oauthRefresh,
+      }
+    }
+
+    if (credentialAgent) {
+      return {
+        pdsAgent: credentialAgent,
+        signOut: credentialSignOut,
+        refresh: credentialRefresh,
+      }
+    }
+
+    return null
+  }, [
+    oauthAgent,
+    oauthSignOut,
+    credentialAgent,
+    credentialSignOut,
+    oauthRefresh,
+    credentialRefresh,
+  ])
 
   if (isLoginPopup) {
     return <div>This window can be closed</div>

packages/oauth/oauth-client-browser/example/src/auth/credential/use-credential-auth.ts

@@ -48,7 +48,12 @@ export function useCredentialAuth() {
   )
 
   return useMemo(
-    () => ({ agent, signIn, signOut: () => agent?.logout() }),
+    () => ({
+      agent,
+      signIn,
+      signOut: () => agent?.logout(),
+      refresh: () => agent?.sessionManager.refreshSession(),
+    }),
     [signIn, agent],
   )
 }