oauth working woohoo

apps/web/client.ts

···
 
 const metadata: OAuthClientMetadataInput = PUBLIC_URL
   ? {
-      client_name: "Teal.fm Discord Bot",
+      client_name: "Disco Stu - Teal.fm Discord Bot",
       client_id: `${PUBLIC_URL}/oauth-client-metadata.json`,
       jwks_uri: `${PUBLIC_URL}/.well-known/jwks.json`,
       redirect_uris: [`${PUBLIC_URL}/oauth/callback`],
-      scope: "atproto transition:generic",
+      scope: "atproto",
       grant_types: ["authorization_code", "refresh_token"],
       response_types: ["code"],
       application_type: "web",
···
   : atprotoLoopbackClientMetadata(
       `http://localhost?${new URLSearchParams([
         ["redirect_uri", "http://127.0.0.1:8002/oauth/callback"],
-        ["scope", "atproto transition:generic"],
+        ["scope", "atproto"],
       ])}`,
     );
 

apps/web/index.ts

···
-import { isValidHandle } from "@atproto/syntax";
 import { serve, type HttpBindings } from "@hono/node-server";
 import { COOKIE_SECRET } from "@tealfmbot/common/constants.js";
 import { logger } from "@tealfmbot/common/logger.js";
 import { Hono } from "hono";
 import { getSignedCookie } from "hono/cookie";
+import { html } from "hono/html";
 import { validator } from "hono/validator";
 import pinoHttpLogger from "pino-http";
 
 import { client } from "./client";
-import { createSession, MAX_AGE } from "./utils";
+import { createSession, MAX_AGE, validateIdentifier } from "./utils";
 
 type Variables = {
   logger: typeof logger;
···
   return c.redirect("/");
 });
 
+app.get("/login", (c) => {
+  return c.html(
+    html`
+        <form action="/login" method="post">
+            <label for="identifier">Identifier</label>
+            <input id="identifier" name="identifier" type="text" placeholder="handle.bsky.social" required />
+            <button type="submit">Log in</button>
+        </form>
+    `,
+  );
+});
+
 app.post(
   "/login",
   validator("form", (value, c) => {
     const identifier = value["identifier"];
-    if (!identifier || typeof identifier !== "string" || !isValidHandle(identifier)) {
+    if (typeof identifier !== "string" || !validateIdentifier(identifier)) {
       return c.json({ message: "Invalid handle, did or PDS URL" }, 400);
     }
 
···
       identifier,
     };
   }),
-  (c) => {
+  async (c) => {
     c.header("Cache-Control", "no-store");
     const { identifier } = c.req.valid("form");
+    const ac = new AbortController();
     try {
-      return c.text(identifier);
+      // if (identifier.startsWith("did:web")) {
+      //   const id = identifier.split(":")[2]
+      //   const url = await client.authorize(identifier, {
+      //     signal: ac.signal
+      //   })
+      // }
+      const url = await client.authorize(identifier, {
+        signal: ac.signal,
+      });
+      return c.redirect(url.href);
     } catch (error) {
       logger.error({ error }, "oauth authorize failed");
       return c.json({ message: "oauth authorize failed" }, 500);

apps/web/package.json

···
   },
   "dependencies": {
     "@atproto/api": "^0.18.8",
+    "@atproto/did": "^0.2.3",
     "@atproto/oauth-client-node": "^0.3.13",
     "@atproto/syntax": "^0.4.2",
     "@hono/node-server": "^1.19.7",

apps/web/storage.ts

···
       .where("key", "=", key)
       .executeTakeFirst();
     if (!result) return;
-    return JSON.parse(result.state) as NodeSavedState;
+    return JSON.parse(result.state);
   }
   async set(key: string, val: NodeSavedState) {
     const state = JSON.stringify(val);
     await this.db
       .insertInto("auth_state")
       .values({ key, state })
-      .onConflict((oc) => oc.doUpdateSet({ state }))
+      .onConflict((oc) => oc.column("key").doUpdateSet({ state }))
       .execute();
   }
   async del(key: string) {
···
       .where("key", "=", key)
       .executeTakeFirst();
     if (!result) return;
-    return JSON.parse(result.session) as NodeSavedSession;
+    return JSON.parse(result.session);
   }
-  async set(key: string, value: NodeSavedSession) {
-    const session = JSON.stringify(value);
+  async set(key: string, val: NodeSavedSession) {
+    const session = JSON.stringify(val);
     await this.db
       .insertInto("auth_session")
       .values({ key, session })
-      .onConflict((oc) => oc.doUpdateSet({ session }))
+      .onConflict((oc) => oc.column("key").doUpdateSet({ session }))
       .execute();
   }
   async del(key: string) {

apps/web/tsconfig.json

···
     "target": "ESNext",
     "module": "ESNext",
     "moduleResolution": "bundler",
-    "lib": ["ESNext"]
+    "lib": ["ESNext"],
   },
   "exclude": ["node_modules"]
 }

apps/web/utils.ts

···
 import type { Context } from "hono";
 
 import { Agent } from "@atproto/api";
+import { isAtprotoDid, isAtprotoDidWeb } from "@atproto/did";
+import { isValidHandle } from "@atproto/syntax";
 import { COOKIE_SECRET } from "@tealfmbot/common/constants.ts";
 import { logger } from "@tealfmbot/common/logger.js";
 import { deleteCookie, generateSignedCookie, getSignedCookie } from "hono/cookie";
···
     secure: process.env.NODE_ENV === "development" ? false : true,
     httpOnly: true,
     sameSite: "lax",
+    maxAge: 60 * 60 * 24 * 7,
   });
 
   return cookie;
···
   try {
     const oauthSession = await client.restore(session);
     return oauthSession ? new Agent(oauthSession) : null;
-  } catch {
-    logger.warn("oauth restore failed");
+  } catch (error) {
+    logger.warn({ error }, "oauth restore failed");
     deleteCookie(c, "__teal_fm_bot_session");
     return null;
   }
 }
+
+export function isValidUrl(url: string) {
+  if (URL.canParse(url)) {
+    const pdsUrl = new URL(url);
+    return pdsUrl.protocol === "http:" || pdsUrl.protocol === "https:";
+  }
+  return false;
+}
+
+// https://github.com/bluesky-social/social-app/blob/main/src/lib/strings/handles.ts#L51
+export function validateIdentifier(input: string) {
+  if (typeof input !== "string") return false;
+  const results = {
+    validHandle: isValidHandle(input),
+    nonEmptyIdentifier: !input.trim(),
+    validDid: isAtprotoDid(input),
+    validUrl: isValidUrl(input),
+    validDidWeb: isAtprotoDidWeb(input),
+  };
+
+  return Object.values(results).includes(true);
+}

packages/database/migrations/1766974106212_oauth.ts

···
 export async function up(db: Kysely<any>): Promise<void> {
   await db.schema
     .createTable("auth_session")
-    .addColumn("key", "varchar", (col) => col.primaryKey())
+    .addColumn("key", "varchar", (col) => col.primaryKey().unique())
     .addColumn("session", "varchar", (col) => col.notNull())
     .execute();
   await db.schema
     .createTable("auth_state")
-    .addColumn("key", "varchar", (col) => col.primaryKey())
+    .addColumn("key", "varchar", (col) => col.primaryKey().unique())
     .addColumn("state", "varchar", (col) => col.notNull())
     .execute();
 }

pnpm-lock.yaml

···
       '@atproto/api':
         specifier: ^0.18.8
         version: 0.18.8
+      '@atproto/did':
+        specifier: ^0.2.3
+        version: 0.2.3
       '@atproto/oauth-client-node':
         specifier: ^0.3.13
         version: 0.3.13