* Ensure that the credentials used during a refresh correspond to those used to create the OAuth tokens.
* tidy
* Bind the OAuth session to the kid that was used to authenticate the client (private_key_jwt)
* Store the whole authentication method in the client session store rather than the kid only
* tidy
* Improve error reporting in case an invalid `token_endpoint_auth_method` is used in the client metadata document.
* tidy
* tidy
* Improve JAR checks
* tidy
* changeset
* tidy
* Remove schema's `.optional()` modifier when a `.default()` is defined
* tidy
* verify client auth during code exchange
* tidy
* Minor naming improvement
* tidy
* Update .changeset/quiet-pans-fix.md
Co-authored-by: devin ivy <devinivy@gmail.com>
* Update packages/oauth/oauth-client/src/oauth-client-auth.ts
* Use `private_key_jwt` instead of incorrect `client_secret_jwt` as authentication method for confidential clients
* style
* code split
* dead code removal
* Represent missing client auth with a `null` instead of "none" when storing request data.
* Allow storing `null` in authorization_request's `clientAuth` json column
* document
* tidy
* Remove non-standard behavior that allowed client to authenticate through JAR
* Improved error messages
* Parse JSON encoded Authorization Request Parameters
* Use `application/x-www-form-urlencoded` content instead of JSON for OAuth requests
Fixes: #3723
* tidy
* tidy
* tidy
* tidy
* code style
* remove un-necessary checks
* tidy
* Pre-process number too
* improved type checking
* add missing exports
* fix merge conflict
* tidy
* Remove invalid default for `code_challenge_method` authorization request parameter
* tidy
* Delete inaccurate changeset
* PR comment
* tidy
* Update OAuth client credentials factory to return headers and payload separately.
* tidy
* Renamed `clientAuthCheck` to `validateClientAuth`
* Validate presence of DPoP proofs sooner when processing token requests.
Fixes: #3859
* Protect against concurrent use of request code
* tidy
* tidy
* Update packages/oauth/oauth-provider/src/client/client.ts
Co-authored-by: devin ivy <devinivy@gmail.com>
* Review comments
* Add missing `exp` claim in client attestation JWT
* fixup! Review comments
* Review comments
* Refactor: explicit optionality of unsigned JAR issuer & audience
* Use client attestation's `exp` claim to determine the life time of JWT's `jti` nonce.
* Fix PDS: consumeRequestCode should delete request data
* tidy
* tidy
* Unused code removal
* Restore "Native clients must authenticate using "none" method" check
* tidy
* tidy
* cleanup
* comment
* Allow missing DPoP header during PAR request if `dpop_jkt` is provided
* tidy
---------
Co-authored-by: devin ivy <devinivy@gmail.com>
* Refactor route rate limiter builder
* Refactor RouteRateLimiter handle method to improve bypass logic and return type
* Use `redis` as rate limit db when available
* Properly validate JWK `htu` claim by enforcing URL without query or fragment
* type fix
* Return DPoP validation result from `authenticateRequest`
* Log clients using invalid "htu" claim in DPoP proof
* review comments
* fix lint
* tidy
* rename dpop result to dpop proof
* 🐛 Fetch record from pds if appview fails to find it for ozone
* ✨ Resolve and etch from pds without auth
* ♻️ Refactor and cleanup
* ✅ Fix tests
* ✅ Fix tests
* 🚨 Fix linter issue
* 🧹 Cleanup
* Allow proxying of dpop bound requests by using service auth instead, for the `getSession` endpoint.
* Show `getSession` data in example app
* Add scope
* strings
* cleanup
* tidy
* tidy
* Add transition:email scope to example app
* strings
* changeset
* pr comments
* Handle resolution improvements
On PDS, only perform resolution if appview is not configured.
On appview, never perform resolution, only rely on dataplane.
* changeset
* appview: add lookup_unidirectional to GetDidsByHandles
* appview: plumb lookup_unidirectional for handle lookup
* note
---------
Co-authored-by: Devin Ivy <devinivy@gmail.com>
* First vouch implementation
* Remove unneeded endpoints
* wip
* ✨ wip
* ✨ Process jetstream events through p-queue and add tests
* ✅ Add test for cursor update
* 🐛 Use utc time to update updatedAt
* 🧹 Cleanup
* 🔨 Fix pnpm versioning issues
* ✨ Replace jetstream lib with manual implementation
* ✨ Remove unnecessary 3p dep
* ✨ Add e2e test for jetstream
* 🚨 Fix import
* 🧹 Remove unnecessary property
* ✨ Fix dev-env and add profile to verification view in ozone
* ✅ Add profile type
* ✨ Add backpressure handling to jetstream listener
* ✨ Use WebSocketKeepAlive from xrpc-server and replace partysocket
* ✨ Add a new verifier role to ozone team meber roles
* 📝 Run codegen
* 🐛 Fix auth check
* 🐛 Fix test failure check
* 🚨 Fix json formatting
* 🐛 Fix team role check
* 🚧 Checking failing test
* ✅ Fix tests
* ✨ Address review comments
* ✨ Add xrpc-server to version
* 🚨 Fix linter issue
* 🚨 Fix linter issue
* ✨ Resolve race condition in cursor update
* ✅ Add verification check on profile
* 🐛 Fix missing cid in test and firehose cursor
* ✨ Fix test
* ✨ Add record validation for verification and separate xrpc-server version
* ✨ Return error object for failed revocations
* ✨ Add re-login on expired session case
* 📝 Fix typo
---------
Co-authored-by: rafael <rafael@blueskyweb.xyz>
* Allow `:` chars in url path parts
* Allow customizing contrast and hue colors
* Allow customizing contrast and hue colors
* Use white as primary contrast color
* Fix buttons alignment and labels in "My Devices" section
* Add a `<title>` tag to all pages
* Properly display the "lastSeenAt" date
* Improve display of clients & devices
* tidy
* code split
* Add definition for `ConventionalOAuthClientId`
* Remove hard coded `client_name` from loopback client metadata
* Code factorization
* Fix `<title>` of branding page
Matthieu Sieben
github-actions[bot]
Samuel Newman
Eric Bailey
rafael
Foysal Ahamed
bnewbold
hailey
devin ivy