Something went wrong. Try again.
A CLI for publishing standard.site documents to ATProto sequoia.pub
standard site lexicon cli publishing
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156import { Hono } from "hono";import type { Database } from "bun:sqlite";import { createOAuthClient, OAUTH_SCOPE } from "../lib/oauth-client";import { kvGet, kvSet, kvDel } from "../lib/db";import { getSessionDid, setSessionCookie, clearSessionCookie, getReturnToCookie, clearReturnToCookie,} from "../lib/session";import type { Env } from "../env";
type Variables = { env: Env; db: Database };
const auth = new Hono<{ Variables: Variables }>();
// OAuth client metadata endpointauth.get("/client-metadata.json", (c) => { const env = c.get("env"); const clientId = `${env.CLIENT_URL}/oauth/client-metadata.json`; const redirectUri = `${env.CLIENT_URL}/oauth/callback`;
return c.json({ client_id: clientId, client_name: env.CLIENT_NAME, client_uri: env.CLIENT_URL, redirect_uris: [redirectUri], grant_types: ["authorization_code", "refresh_token"], response_types: ["code"], scope: OAUTH_SCOPE, token_endpoint_auth_method: "none", application_type: "web", dpop_bound_access_tokens: true, });});
// Start OAuth login flowauth.get("/login", async (c) => { const env = c.get("env"); const db = c.get("db");
try { const handle = c.req.query("handle"); if (!handle) { return c.redirect(`${env.CLIENT_URL}/?error=missing_handle`); }
const client = createOAuthClient(db, env.CLIENT_URL, env.CLIENT_NAME); const authUrl = await client.authorize(handle, { scope: OAUTH_SCOPE, });
return c.redirect(authUrl.toString()); } catch (error) { console.error("Login error:", error); return c.redirect(`${env.CLIENT_URL}/?error=login_failed`); }});
// OAuth callback handlerauth.get("/callback", async (c) => { const env = c.get("env"); const db = c.get("db");
try { const params = new URLSearchParams(c.req.url.split("?")[1] || "");
if (params.get("error")) { const error = params.get("error"); console.error("OAuth error:", error, params.get("error_description")); return c.redirect( `${env.CLIENT_URL}/?error=${encodeURIComponent(error!)}`, ); }
const client = createOAuthClient(db, env.CLIENT_URL, env.CLIENT_NAME); const { session } = await client.callback(params);
// Resolve handle from DID let handle: string | undefined; try { const identity = await client.identityResolver.resolve(session.did); handle = identity.handle; } catch { // Handle resolution is best-effort }
// Store handle alongside the session for quick lookup if (handle) { kvSet(db, `oauth_handle:${session.did}`, handle, 60 * 60 * 24 * 14); }
setSessionCookie(c, session.did, env.CLIENT_URL);
// If a subscribe flow set a return URL before initiating OAuth, honor it const returnTo = getReturnToCookie(c); clearReturnToCookie(c, env.CLIENT_URL);
return c.redirect(returnTo ?? `${env.CLIENT_URL}/`); } catch (error) { console.error("Callback error:", error); return c.redirect(`${env.CLIENT_URL}/?error=callback_failed`); }});
// Logout endpointauth.post("/logout", async (c) => { const env = c.get("env"); const db = c.get("db"); const did = getSessionDid(c);
if (did) { try { const client = createOAuthClient(db, env.CLIENT_URL, env.CLIENT_NAME); await client.revoke(did); } catch (error) { console.error("Revoke error:", error); } kvDel(db, `oauth_handle:${did}`); }
clearSessionCookie(c, env.CLIENT_URL); return c.json({ success: true });});
// Check auth statusauth.get("/status", async (c) => { const env = c.get("env"); const db = c.get("db"); const did = getSessionDid(c);
if (!did) { return c.json({ authenticated: false }); }
try { const client = createOAuthClient(db, env.CLIENT_URL, env.CLIENT_NAME); const session = await client.restore(did);
const handle = kvGet(db, `oauth_handle:${session.did}`);
return c.json({ authenticated: true, did: session.did, handle: handle || undefined, }); } catch (error) { console.error("Session restore failed:", error); clearSessionCookie(c, env.CLIENT_URL); return c.json({ authenticated: false }); }});
export default auth;