General linting, document react-native-streamplace-oauth-problem

KNOWN_ISSUES.md

···
+# Known Issues
+
+## stream.place iOS app OAuth flow fails
+
+OAuth flow with stream.place's iOS app (using expo-web-browser's ASWebAuthenticationSession) does not complete. After user approves consent, the redirect from our PDS to stream.place's callback URL is not followed by ASWebAuthenticationSession.
+
+What does work with stream.place: everything else :P
+- Desktop browsers
+- ios safari (regular browser)
+- ASWebAuthenticationSession using the reference pds
+
+What fails:
+- ASWebAuthenticationSession with this pds
+
+Attempted fixes (all failed):
+- HTTP 302/303/307 redirects
+- JavaScript navigation
+- Meta refresh
+- Form auto-submit
+- Removing CORS headers
+- HTTP/1.1 instead of HTTP/2
+- Minimal response headers
+

frontend/src/components/migration/ChooseHandleStep.svelte

···
   </div>
 
   <div class="field">
-    <label>{$_('migration.inbound.chooseHandle.authMethod')}</label>
+    <span class="field-label">{$_('migration.inbound.chooseHandle.authMethod')}</span>
     <div class="auth-method-options">
       <label class="auth-option" class:selected={authMethod === 'password'}>
         <input

frontend/src/routes/Admin.svelte

···
     padding: var(--space-7);
   }
 
-  .message {
-    padding: var(--space-3);
-    border-radius: var(--radius-md);
-    margin-bottom: var(--space-4);
-  }
-
-  .message.error {
-    background: var(--error-bg);
-    border: 1px solid var(--error-border);
-    color: var(--error-text);
-  }
-
-  .message.success {
-    background: var(--success-bg);
-    border: 1px solid var(--success-border);
-    color: var(--success-text);
-  }
-
   .config-form {
     max-width: 500px;
   }

frontend/src/routes/AppPasswords.svelte

···
     margin-bottom: var(--space-7);
   }
 
-  .error {
-    padding: var(--space-3);
-    background: var(--error-bg);
-    border: 1px solid var(--error-border);
-    border-radius: var(--radius-md);
-    color: var(--error-text);
-    margin-bottom: var(--space-4);
-  }
-
   .created-password {
     display: flex;
     flex-direction: column;

frontend/src/routes/Comms.svelte

···
     margin: var(--space-2) 0 0 0;
   }
 
-  .loading {
-    text-align: center;
-    color: var(--text-secondary);
-    padding: var(--space-7);
-  }
-
   .split-layout {
     display: grid;
     grid-template-columns: 1fr;

frontend/src/routes/Controllers.svelte

···
     margin: var(--space-2) 0 0 0;
   }
 
-  .loading,
   .empty {
     text-align: center;
     color: var(--text-secondary);
     padding: var(--space-4);
-  }
-
-  .message {
-    padding: var(--space-3);
-    border-radius: var(--radius-md);
-    margin-bottom: var(--space-4);
-  }
-
-  .message.error {
-    background: var(--error-bg);
-    border: 1px solid var(--error-border);
-    color: var(--error-text);
-  }
-
-  .message.success {
-    background: var(--success-bg);
-    border: 1px solid var(--success-border);
-    color: var(--success-text);
   }
 
   .constraint-notice {

frontend/src/routes/DelegationAudit.svelte

···
     margin: var(--space-2) 0 0 0;
   }
 
-  .loading,
   .empty {
     text-align: center;
     color: var(--text-secondary);
     padding: var(--space-7);
-  }
-
-  .message.error {
-    padding: var(--space-3);
-    background: var(--error-bg);
-    border: 1px solid var(--error-border);
-    border-radius: var(--radius-md);
-    color: var(--error-text);
-    margin-bottom: var(--space-4);
   }
 
   .audit-list {

frontend/src/routes/DidDocumentEditor.svelte

···
     margin-top: var(--space-6);
   }
 
-  .loading {
-    text-align: center;
-    padding: var(--space-9);
-    color: var(--text-secondary);
-  }
-
   @media (max-width: 600px) {
     .field-row {
       flex-direction: column;

frontend/src/routes/InviteCodes.svelte

···
     margin-bottom: var(--space-7);
   }
 
-  .error {
-    padding: var(--space-3);
-    background: var(--error-bg);
-    border: 1px solid var(--error-border);
-    border-radius: var(--radius-md);
-    color: var(--error-text);
-    margin-bottom: var(--space-4);
-  }
-
   .created-code {
     padding: var(--space-6);
     background: var(--success-bg);

frontend/src/routes/Migration.svelte

···
 
   if (!hasOAuthCallback) {
     if (hasPendingMigration()) {
-      resumeInfo = getResumeInfo()
-      if (resumeInfo) {
-        if (resumeInfo.step === 'success') {
+      const info = getResumeInfo()
+      if (info) {
+        if (info.step === 'success') {
           clearMigrationState()
-          resumeInfo = null
         } else {
+          resumeInfo = info
           const stored = loadMigrationState()
           if (stored && stored.direction === 'inbound') {
             direction = 'inbound'
-            inboundFlow = createInboundMigrationFlow()
-            inboundFlow.resumeFromState(stored)
+            const flow = createInboundMigrationFlow()
+            flow.resumeFromState(stored)
+            inboundFlow = flow
           }
         }
       }
···
         clearOfflineState()
       } else {
         direction = 'offline-inbound'
-        offlineFlow = createOfflineInboundMigrationFlow()
-        offlineFlow.tryResume()
+        const flow = createOfflineInboundMigrationFlow()
+        flow.tryResume()
+        offlineFlow = flow
       }
     }
   }

frontend/src/routes/OAuthConsent.svelte

···
         body: JSON.stringify({
           request_uri: consentData.request_uri,
           approved_scopes: approvedScopes,
-          remember: rememberChoice
-        })
+          remember: rememberChoice,
+        }),
       })
 
       if (!response.ok) {

frontend/src/routes/Register.svelte

···
     color: var(--error-text);
   }
 
-  .section-hint {
-    font-size: var(--text-sm);
-    color: var(--text-secondary);
-    margin: 0 0 var(--space-5) 0;
-  }
-
   .radio-group {
     display: flex;
     flex-direction: column;

frontend/src/routes/RepoExplorer.svelte

···
     color: var(--success-text);
   }
 
-  .loading-text {
-    text-align: center;
-    color: var(--text-secondary);
-    padding: var(--space-7);
-  }
-
   .toolbar {
     display: flex;
     gap: var(--space-2);

frontend/src/routes/Security.svelte

···
     margin: var(--space-2) 0 0 0;
   }
 
-  .loading {
-    text-align: center;
-    color: var(--text-secondary);
-    padding: var(--space-7);
-  }
-
   section {
     padding: var(--space-6);
     background: var(--bg-secondary);

frontend/src/routes/Settings.svelte

···
     font-size: var(--text-xs);
   }
 
-  .empty,
-  .loading {
+  .empty {
     color: var(--text-secondary);
     font-size: var(--text-sm);
     margin-bottom: var(--space-4);

frontend/src/routes/TrustedDevices.svelte

···
     font-size: var(--text-sm);
   }
 
-  .loading {
-    text-align: center;
-    padding: var(--space-7);
-    color: var(--text-secondary);
-  }
-
   .empty-state {
     text-align: center;
     padding: var(--space-8) var(--space-4);

frontend/src/styles/migration.css

···
   margin: 0 auto;
 }
 
+.field-label {
+  display: block;
+  font-size: var(--text-sm);
+  font-weight: var(--font-medium);
+  color: var(--text-primary);
+  margin-bottom: var(--space-2);
+}
+
 .step-indicator {
   display: flex;
   align-items: center;

src/lib.rs

···
         .route("/authorize/deny", post(oauth::endpoints::authorize_deny))
         .route("/authorize/consent", get(oauth::endpoints::consent_get))
         .route("/authorize/consent", post(oauth::endpoints::consent_post))
+        .route(
+            "/authorize/redirect",
+            get(oauth::endpoints::authorize_redirect),
+        )
         .route("/delegation/auth", post(oauth::endpoints::delegation_auth))
         .route(
             "/delegation/totp",

src/oauth/endpoints/authorize.rs

···
 const DEVICE_COOKIE_NAME: &str = "oauth_device_id";
 
 fn redirect_see_other(uri: &str) -> Response {
-    (StatusCode::SEE_OTHER, [(LOCATION, uri.to_string())]).into_response()
+    (
+        StatusCode::SEE_OTHER,
+        [
+            (LOCATION, uri.to_string()),
+            (axum::http::header::CACHE_CONTROL, "no-store".to_string()),
+            (
+                SET_COOKIE,
+                "bfCacheBypass=foo; max-age=1; SameSite=Lax".to_string(),
+            ),
+        ],
+    )
+        .into_response()
 }
 
 fn redirect_to_frontend_error(error: &str, description: &str) -> Response {
···
     {
         return show_login_error("An error occurred. Please try again.", json_response);
     }
-    let redirect_url = build_success_redirect(
-        &request_data.parameters.redirect_uri,
-        &code.0,
-        request_data.parameters.state.as_deref(),
-        request_data.parameters.response_mode.as_deref(),
-    );
     if json_response {
+        let redirect_url = build_intermediate_redirect_url(
+            &request_data.parameters.redirect_uri,
+            &code.0,
+            request_data.parameters.state.as_deref(),
+            request_data.parameters.response_mode.as_deref(),
+        );
         if let Some(cookie) = new_cookie {
             (
                 StatusCode::OK,
···
         } else {
             Json(serde_json::json!({"redirect_uri": redirect_url})).into_response()
         }
-    } else if let Some(cookie) = new_cookie {
-        (
-            StatusCode::SEE_OTHER,
-            [(SET_COOKIE, cookie), (LOCATION, redirect_url)],
-        )
-            .into_response()
     } else {
-        redirect_see_other(&redirect_url)
+        let redirect_url = build_success_redirect(
+            &request_data.parameters.redirect_uri,
+            &code.0,
+            request_data.parameters.state.as_deref(),
+            request_data.parameters.response_mode.as_deref(),
+        );
+        if let Some(cookie) = new_cookie {
+            (
+                StatusCode::SEE_OTHER,
+                [(SET_COOKIE, cookie), (LOCATION, redirect_url)],
+            )
+                .into_response()
+        } else {
+            redirect_see_other(&redirect_url)
+        }
     }
 }
 
···
             "An error occurred. Please try again.",
         );
     }
-    let redirect_url = build_success_redirect(
+    let redirect_url = build_intermediate_redirect_url(
         &request_data.parameters.redirect_uri,
         &code.0,
         request_data.parameters.state.as_deref(),
···
         '?'
     };
     redirect_url.push(separator);
-    redirect_url.push_str(&format!("code={}", url_encode(code)));
-    if let Some(req_state) = state {
-        redirect_url.push_str(&format!("&state={}", url_encode(req_state)));
-    }
     let pds_hostname = std::env::var("PDS_HOSTNAME").unwrap_or_else(|_| "localhost".to_string());
     redirect_url.push_str(&format!(
-        "&iss={}",
+        "iss={}",
         url_encode(&format!("https://{}", pds_hostname))
     ));
+    if let Some(req_state) = state {
+        redirect_url.push_str(&format!("&state={}", url_encode(req_state)));
+    }
+    redirect_url.push_str(&format!("&code={}", url_encode(code)));
     redirect_url
 }
 
+fn build_intermediate_redirect_url(
+    redirect_uri: &str,
+    code: &str,
+    state: Option<&str>,
+    response_mode: Option<&str>,
+) -> String {
+    let pds_hostname = std::env::var("PDS_HOSTNAME").unwrap_or_else(|_| "localhost".to_string());
+    let mut url = format!(
+        "https://{}/oauth/authorize/redirect?redirect_uri={}&code={}",
+        pds_hostname,
+        url_encode(redirect_uri),
+        url_encode(code)
+    );
+    if let Some(s) = state {
+        url.push_str(&format!("&state={}", url_encode(s)));
+    }
+    if let Some(rm) = response_mode {
+        url.push_str(&format!("&response_mode={}", url_encode(rm)));
+    }
+    url
+}
+
+#[derive(Debug, Deserialize)]
+pub struct AuthorizeRedirectParams {
+    redirect_uri: String,
+    code: String,
+    state: Option<String>,
+    response_mode: Option<String>,
+}
+
+pub async fn authorize_redirect(Query(params): Query<AuthorizeRedirectParams>) -> Response {
+    let final_url = build_success_redirect(
+        &params.redirect_uri,
+        &params.code,
+        params.state.as_deref(),
+        params.response_mode.as_deref(),
+    );
+    tracing::info!(
+        final_url = %final_url,
+        client_redirect = %params.redirect_uri,
+        "authorize_redirect performing 303 redirect"
+    );
+    (
+        StatusCode::SEE_OTHER,
+        [
+            (axum::http::header::LOCATION, final_url),
+            (axum::http::header::CACHE_CONTROL, "no-store".to_string()),
+        ],
+    )
+        .into_response()
+}
+
 #[derive(Debug, Serialize)]
 pub struct AuthorizeDenyResponse {
     pub error: String,
···
             }
         };
 
-    if let Some(err_response) = validate_auth_flow_state(&flow_state, true) {
-        if flow_state.is_expired() {
-            let _ = db::delete_authorization_request(&state.db, &form.request_uri).await;
-        }
-        return err_response;
+    if flow_state.is_expired() {
+        let _ = db::delete_authorization_request(&state.db, &form.request_uri).await;
+        return json_error(
+            StatusCode::BAD_REQUEST,
+            "invalid_request",
+            "Authorization request has expired",
+        );
+    }
+    if flow_state.is_pending() {
+        return json_error(StatusCode::FORBIDDEN, "access_denied", "Not authenticated");
     }
 
     let did = flow_state.did().unwrap().to_string();
···
         && !has_granular_scopes
         && !form.approved_scopes.contains(&"atproto".to_string())
     {
-        return (
+        return json_error(
             StatusCode::BAD_REQUEST,
-            Json(serde_json::json!({
-                "error": "invalid_request",
-                "error_description": "The atproto scope was requested and must be approved"
-            })),
-        )
-            .into_response();
+            "invalid_request",
+            "The atproto scope was requested and must be approved",
+        );
     }
     let final_approved: Vec<String> = if user_denied_some_granular {
         form.approved_scopes
···
         form.approved_scopes.clone()
     };
     if final_approved.is_empty() {
-        return (
+        return json_error(
             StatusCode::BAD_REQUEST,
-            Json(serde_json::json!({
-                "error": "invalid_request",
-                "error_description": "At least one scope must be approved"
-            })),
-        )
-            .into_response();
+            "invalid_request",
+            "At least one scope must be approved",
+        );
     }
     let approved_scope_str = final_approved.join(" ");
     let has_valid_scope = final_approved.iter().all(|s| {
···
             || s.starts_with("include:")
     });
     if !has_valid_scope {
-        return (
+        return json_error(
             StatusCode::BAD_REQUEST,
-            Json(serde_json::json!({
-                "error": "invalid_request",
-                "error_description": "Invalid scope format"
-            })),
-        )
-            .into_response();
+            "invalid_request",
+            "Invalid scope format",
+        );
     }
     if form.remember {
         let preferences: Vec<db::ScopePreference> = requested_scopes
···
     .await
     .is_err()
     {
-        return (
+        return json_error(
             StatusCode::INTERNAL_SERVER_ERROR,
-            Json(serde_json::json!({
-                "error": "server_error",
-                "error_description": "Failed to complete authorization"
-            })),
-        )
-            .into_response();
+            "server_error",
+            "Failed to complete authorization",
+        );
     }
-    let redirect_url = build_success_redirect(
-        &request_data.parameters.redirect_uri,
+    let redirect_uri = &request_data.parameters.redirect_uri;
+    let intermediate_url = build_intermediate_redirect_url(
+        redirect_uri,
         &code.0,
         request_data.parameters.state.as_deref(),
         request_data.parameters.response_mode.as_deref(),
     );
-    Json(serde_json::json!({
-        "redirect_uri": redirect_url
-    }))
-    .into_response()
+    tracing::info!(
+        intermediate_url = %intermediate_url,
+        client_redirect = %redirect_uri,
+        "consent_post returning JSON with intermediate URL (for 303 redirect)"
+    );
+    Json(serde_json::json!({ "redirect_uri": intermediate_url })).into_response()
 }
 
 pub async fn authorize_2fa_post(
···
                 "An error occurred. Please try again.",
             );
         }
-        let redirect_url = build_success_redirect(
+        let redirect_url = build_intermediate_redirect_url(
             &request_data.parameters.redirect_uri,
             &code.0,
             request_data.parameters.state.as_deref(),
···
             "An error occurred. Please try again.",
         );
     }
-    let redirect_url = build_success_redirect(
+    let redirect_url = build_intermediate_redirect_url(
         &request_data.parameters.redirect_uri,
         &code.0,
         request_data.parameters.state.as_deref(),
···
             .into_response();
     }
 
-    let redirect_url = build_success_redirect(
+    let redirect_url = build_intermediate_redirect_url(
         &request_data.parameters.redirect_uri,
         &code.0,
         request_data.parameters.state.as_deref(),

src/util.rs

···
 }
 
 pub fn build_full_url(path: &str) -> String {
-    format!("{}{}", pds_public_url(), path)
+    let normalized_path = if !path.starts_with("/xrpc/")
+        && (path.starts_with("/com.atproto.")
+            || path.starts_with("/app.bsky.")
+            || path.starts_with("/_"))
+    {
+        format!("/xrpc{}", path)
+    } else {
+        path.to_string()
+    };
+    format!("{}{}", pds_public_url(), normalized_path)
 }
 
 pub fn json_to_ipld(value: &JsonValue) -> Ipld {
···
             return;
         }
         panic!("Failed to find CID link in parsed CBOR");
+    }
+
+    #[test]
+    fn test_build_full_url_adds_xrpc_prefix_for_atproto_paths() {
+        unsafe { std::env::set_var("PDS_HOSTNAME", "example.com") };
+        assert_eq!(
+            build_full_url("/com.atproto.server.getSession"),
+            "https://example.com/xrpc/com.atproto.server.getSession"
+        );
+        assert_eq!(
+            build_full_url("/app.bsky.feed.getTimeline"),
+            "https://example.com/xrpc/app.bsky.feed.getTimeline"
+        );
+        assert_eq!(
+            build_full_url("/_health"),
+            "https://example.com/xrpc/_health"
+        );
+        assert_eq!(
+            build_full_url("/xrpc/com.atproto.server.getSession"),
+            "https://example.com/xrpc/com.atproto.server.getSession"
+        );
+        assert_eq!(
+            build_full_url("/oauth/token"),
+            "https://example.com/oauth/token"
+        );
     }
 }