ponderants/app
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: Complete OAuth DPoP implementation with working stores

Browse Source 
Fixed multiple issues with the @atproto/oauth-client-node integration:

1. OAuth State Store:
   - Changed from SQL WHERE queries to SurrealDB record IDs
   - Use `oauth_state:⟨${key}⟩` pattern for direct lookups
   - Fixes "Parse error: Unexpected token" issues

2. OAuth Session Store:
   - Changed from SQL WHERE queries to SurrealDB record IDs
   - Use `oauth_session:⟨${did}⟩` pattern for direct lookups
   - Implement proper upsert logic with select + merge/create

3. OAuth Client Configuration:
   - Use loopback pattern with metadata in client_id query params
   - Format: `http://localhost/?redirect_uri=...&scope=atproto`
   - Complies with ATproto OAuth localhost development mode

4. Auth Callback:
   - Remove getProfile API call that requires additional scopes
   - Use DID directly from session for user identification
   - Simplify user creation in SurrealDB with record IDs

5. Login Page:
   - Change from GET redirect to POST with JSON body
   - Properly handle errors and display to user

The OAuth flow now works end-to-end:
- User enters handle → redirects to Bluesky OAuth
- User authorizes → callback exchanges code for tokens
- Session stored in SurrealDB → user redirected to /chat

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
Albert
2025-11-09 01:53:12 +00:00
parent d7f3bcd338
commit 0ec5adb246
5 changed files with 102 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
app/api/auth/callback/route.ts
View File

@@ -51,19 +51,14 @@ export async function GET(request: NextRequest) {
console.log('[OAuth Callback] ✓ Successfully authenticated user:', session.did);
// Create ATproto agent with session
const agent = new Agent(session);
const did = session.did;
// Fetch user profile
const profileResponse = await agent.getProfile({ actor: session.did });
// For now, we'll use the DID as the handle placeholder
// The actual handle will be fetched later when the user accesses protected routes
// This avoids needing additional OAuth scopes during the callback
const handle = did;
if (!profileResponse.success) {
throw new Error('Failed to fetch user profile');
}
const { did, handle } = profileResponse.data;
console.log('[OAuth Callback] User profile:', { did, handle });
console.log('[OAuth Callback] User DID:', did);
// Upsert user in SurrealDB
const db = new Surreal();
@@ -77,12 +72,18 @@ export async function GET(request: NextRequest) {
database: process.env.SURREALDB_DB!,
});
await db.query(
`INSERT INTO user (did, handle)
VALUES ($did, $handle)
ON DUPLICATE KEY UPDATE handle = $handle`,
{ did, handle }
);
// Use UPSERT with record ID for better performance
await db.create(`user:⟨${did}⟩`, {
did,
handle,
created_at: new Date().toISOString(),
}).catch(async () => {
// If record exists, update it
await db.merge(`user:⟨${did}⟩`, {
handle,
updated_at: new Date().toISOString(),
});
});
await db.close();

30
app/login/page.tsx
View File

@@ -27,11 +27,31 @@ export default function LoginPage() {
const handleSubmit = async (values: { handle: string }) => {
setIsLoading(true);
// We redirect to our *own* API route, which will then
// perform discovery and redirect to the correct Bluesky PDS.
// This keeps all complex logic and secrets on the server.
// Using window.location.href for full navigation that follows server redirects
window.location.href = `/api/auth/login?handle=${encodeURIComponent(values.handle)}`;
try {
// Call our API route to initiate OAuth flow
const response = await fetch('/api/auth/login', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ handle: values.handle }),
});
if (!response.ok) {
const error = await response.json();
throw new Error(error.error || 'Login failed');
}
const { url } = await response.json();
// Redirect to the OAuth authorization URL
window.location.href = url;
} catch (error) {
console.error('Login error:', error);
setIsLoading(false);
// Show error to user
window.location.href = `/login?error=${encodeURIComponent(
error instanceof Error ? error.message : 'An error occurred'
)}`;
}
};
return (

24
lib/auth/oauth-client.ts
View File

@@ -36,19 +36,27 @@ export async function getOAuthClient(): Promise<NodeOAuthClient> {
}
if (isDev) {
// Development: Use localhost exception
// Per ATproto spec, client_id must be exactly "http://localhost"
// (no port number) with metadata in query parameters
const clientId = `http://localhost?${new URLSearchParams({
// Development: Use localhost loopback client
// Per ATproto spec, we encode metadata in the client_id query params
const clientId = `http://localhost/?${new URLSearchParams({
redirect_uri: callbackUrl,
scope: 'atproto',
})}`;
}).toString()}`;
console.log('[OAuth] Initializing development client with localhost exception');
console.log('[OAuth] Initializing development client with loopback exception');
console.log('[OAuth] client_id:', clientId);
clientInstance = await NodeOAuthClient.fromClientId({
clientId,
clientInstance = new NodeOAuthClient({
clientMetadata: {
client_id: clientId,
redirect_uris: [callbackUrl],
scope: 'atproto',
grant_types: ['authorization_code', 'refresh_token'],
response_types: ['code'],
application_type: 'native',
token_endpoint_auth_method: 'none',
dpop_bound_access_tokens: true,
},
stateStore: createStateStore(),
sessionStore: createSessionStore(),
});

45
lib/auth/oauth-session-store.ts
View File

@@ -41,13 +41,28 @@ export function createSessionStore(): NodeSavedSessionStore {
const db = await getDB();
try {
// Upsert: create if doesn't exist, update if it does
await db.query(
`INSERT INTO oauth_session (did, session_data)
VALUES ($did, $session_data)
ON DUPLICATE KEY UPDATE session_data = $session_data, updated_at = time::now()`,
{ did, session_data: sessionData }
);
// Use DID as the record ID for direct lookup
// Escape special characters in the DID for SurrealDB record ID
const recordId = `oauth_session:⟨${did}⟩`;
// Upsert: update if exists, create if doesn't
const existing = await db.select<{ session_data: NodeSavedSession }>(recordId);
if (Array.isArray(existing) && existing.length > 0) {
// Update existing record
await db.merge(recordId, {
session_data: sessionData,
updated_at: new Date().toISOString(),
});
} else {
// Create new record
await db.create(recordId, {
did,
session_data: sessionData,
created_at: new Date().toISOString(),
updated_at: new Date().toISOString(),
});
}
} finally {
await db.close();
}
@@ -57,12 +72,12 @@ export function createSessionStore(): NodeSavedSessionStore {
const db = await getDB();
try {
const [result] = await db.query<[{ session_data: NodeSavedSession }[]]>(
'SELECT session_data FROM oauth_session WHERE did = $did',
{ did }
);
// Select directly by record ID
const result = await db.select<{ session_data: NodeSavedSession }>(`oauth_session:⟨${did}⟩`);
return result?.[0]?.session_data;
// db.select() returns an array when selecting a specific record ID
const record = Array.isArray(result) ? result[0] : result;
return record?.session_data;
} finally {
await db.close();
}
@@ -72,10 +87,8 @@ export function createSessionStore(): NodeSavedSessionStore {
const db = await getDB();
try {
await db.query(
'DELETE oauth_session WHERE did = $did',
{ did }
);
// Delete directly by record ID
await db.delete(`oauth_session:⟨${did}⟩`);
} finally {
await db.close();
}

27
lib/auth/oauth-state-store.ts
View File

@@ -41,10 +41,13 @@ export function createStateStore(): NodeSavedStateStore {
const db = await getDB();
try {
await db.query(
'CREATE oauth_state SET key = $key, value = $value',
{ key, value }
);
// Use the key as the record ID for direct lookup
// Escape special characters in the key for SurrealDB record ID
await db.create(`oauth_state:⟨${key}⟩`, {
key,
value,
created_at: new Date().toISOString(),
});
} finally {
await db.close();
}
@@ -54,12 +57,12 @@ export function createStateStore(): NodeSavedStateStore {
const db = await getDB();
try {
const [result] = await db.query<[{ value: NodeSavedState }[]]>(
'SELECT value FROM oauth_state WHERE key = $key',
{ key }
);
// Select directly by record ID
const result = await db.select<{ value: NodeSavedState }>(`oauth_state:⟨${key}⟩`);
return result?.[0]?.value;
// db.select() returns an array when selecting a specific record ID
const record = Array.isArray(result) ? result[0] : result;
return record?.value;
} finally {
await db.close();
}
@@ -69,10 +72,8 @@ export function createStateStore(): NodeSavedStateStore {
const db = await getDB();
try {
await db.query(
'DELETE oauth_state WHERE key = $key',
{ key }
);
// Delete directly by record ID
await db.delete(`oauth_state:⟨${key}⟩`);
} finally {
await db.close();
}