Automerge backed Markdown editor for the Atmosphere
Something went wrong. Try again.
1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980import { createPrivateKey, createPublicKey } from 'node:crypto'import { readFileSync } from 'node:fs'
const route = '/oauth-client-metadata.json'const scopeToken = /^[A-Za-z0-9:.*_/-]+$/const maxPreviousKeys = 8
export function createOAuthClientMetadata(env = process.env) { const names = ['OAUTH_CLIENT_ID', 'OAUTH_REDIRECT_URI', 'OAUTH_SCOPE', 'OAUTH_SIGNING_KEY', 'OAUTH_KID'] const configured = names.map(name => Boolean(env[name])) if (configured.every(value => !value)) return null if (configured.some(value => !value)) throw new Error(`OAuth metadata requires all of: ${names.join(', ')}.`)
const clientId = absoluteHttpsUrl(env.OAUTH_CLIENT_ID, 'OAUTH_CLIENT_ID') const expectedId = new URL(route, clientId).href if (clientId !== expectedId) throw new Error(`OAUTH_CLIENT_ID must be the absolute HTTPS URL ending in ${route}.`) const redirectUri = absoluteHttpsUrl(env.OAUTH_REDIRECT_URI, 'OAUTH_REDIRECT_URI') if (new URL(redirectUri).origin !== new URL(clientId).origin) { throw new Error('OAUTH_REDIRECT_URI must use the same HTTPS origin as OAUTH_CLIENT_ID.') } if (!/^[A-Za-z0-9._-]{1,128}$/.test(env.OAUTH_KID)) throw new Error('OAUTH_KID must be a non-empty key identifier.')
const scopes = env.OAUTH_SCOPE.trim().split(/\s+/) if (!scopes.length || scopes.some(scope => !scopeToken.test(scope))) throw new Error('OAUTH_SCOPE must contain valid space-separated scope tokens.')
const signingKeys = [{ kid: env.OAUTH_KID, keyPath: env.OAUTH_SIGNING_KEY }, ...parsePreviousKeys(env.OAUTH_PREVIOUS_KEYS, env.OAUTH_KID)] const keys = signingKeys.map(({ kid, keyPath }) => { const privateKey = readP256Key(keyPath, kid === env.OAUTH_KID ? 'OAUTH_SIGNING_KEY' : `previous key ${kid}`) const { x, y } = createPublicKey(privateKey).export({ format: 'jwk' }) return { kty: 'EC', crv: 'P-256', x, y, kid, alg: 'ES256', use: 'sig' } }) return Object.freeze({ route, clientId, metadata: Object.freeze({ client_id: clientId, client_name: 'Reams', client_uri: new URL('/', clientId).href, logo_uri: new URL('/icon-192.png', clientId).href, redirect_uris: [redirectUri], response_types: ['code'], grant_types: ['authorization_code', 'refresh_token'], scope: scopes.join(' '), token_endpoint_auth_method: 'private_key_jwt', token_endpoint_auth_signing_alg: 'ES256', jwks: { keys }, dpop_bound_access_tokens: true, }), })}
function parsePreviousKeys(raw, currentKid) { if (raw === undefined || raw === '') return [] let values try { values = JSON.parse(raw) } catch { throw new Error('OAUTH_PREVIOUS_KEYS must be a JSON array of {kid,keyPath} objects.') } if (!Array.isArray(values) || values.length > maxPreviousKeys) throw new Error(`OAUTH_PREVIOUS_KEYS must contain at most ${maxPreviousKeys} keys.`) const kids = new Set([currentKid]) return values.map(value => { if (!value || typeof value !== 'object' || Array.isArray(value) || typeof value.kid !== 'string' || !/^[A-Za-z0-9._-]{1,128}$/.test(value.kid) || typeof value.keyPath !== 'string' || !value.keyPath.trim()) throw new Error('Each OAUTH_PREVIOUS_KEYS entry must have a valid kid and keyPath.') if (kids.has(value.kid)) throw new Error(`OAuth key identifier ${value.kid} is configured more than once.`) kids.add(value.kid) return { kid: value.kid, keyPath: value.keyPath } })}
function readP256Key(path, name) { const privateKey = createPrivateKey(readFileSync(path)) if (privateKey.asymmetricKeyType !== 'ec' || privateKey.asymmetricKeyDetails?.namedCurve !== 'prime256v1') throw new Error(`${name} must be a PEM-encoded P-256 EC private key.`) return privateKey}
function absoluteHttpsUrl(value, name) { let parsed try { parsed = new URL(value) } catch { throw new Error(`${name} must be an absolute HTTPS URL.`) } if (parsed.protocol !== 'https:' || parsed.username || parsed.password || parsed.hash) { throw new Error(`${name} must be an absolute HTTPS URL without credentials or a fragment.`) } return parsed.href}