+33

Cargo.lock

reviewed

··· 139 139 checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c" 140 140 141 141 [[package]] 142 142 + name = "argon2" 143 143 + version = "0.5.3" 144 144 + source = "registry+https://github.com/rust-lang/crates.io-index" 145 145 + checksum = "3c3610892ee6e0cbce8ae2700349fcf8f98adb0dbfbee85aec3c9179d29cc072" 146 146 + dependencies = [ 147 147 + "base64ct", 148 148 + "blake2", 149 149 + "cpufeatures", 150 150 + "password-hash", 151 151 + ] 152 152 + 153 153 + [[package]] 142 154 name = "assert-json-diff" 143 155 version = "2.0.2" 144 156 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 348 360 checksum = "843867be96c8daad0d758b57df9392b6d8d271134fce549de6ce169ff98a92af" 349 361 dependencies = [ 350 362 "serde_core", 363 363 + ] 364 364 + 365 365 + [[package]] 366 366 + name = "blake2" 367 367 + version = "0.10.6" 368 368 + source = "registry+https://github.com/rust-lang/crates.io-index" 369 369 + checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe" 370 370 + dependencies = [ 371 371 + "digest", 351 372 ] 352 373 353 374 [[package]] ··· 3387 3408 ] 3388 3409 3389 3410 [[package]] 3411 3411 + name = "password-hash" 3412 3412 + version = "0.5.0" 3413 3413 + source = "registry+https://github.com/rust-lang/crates.io-index" 3414 3414 + checksum = "346f04948ba92c43e8469c1ee6736c7563d71012b17d40745260fe106aac2166" 3415 3415 + dependencies = [ 3416 3416 + "base64ct", 3417 3417 + "rand_core 0.6.4", 3418 3418 + "subtle", 3419 3419 + ] 3420 3420 + 3421 3421 + [[package]] 3390 3422 name = "pem" 3391 3423 version = "3.0.6" 3392 3424 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 4130 4162 version = "0.1.0" 4131 4163 dependencies = [ 4132 4164 "anyhow", 4165 4165 + "argon2", 4133 4166 "axum", 4134 4167 "base64 0.21.7", 4135 4168 "clap",

+3

Cargo.toml

reviewed

··· 73 73 # JWT (relay auth) 74 74 jsonwebtoken = "9" 75 75 76 76 + # Password hashing (relay createSession) 77 77 + argon2 = { version = "0.5", features = ["password-hash"] } 78 78 + 76 79 # ATProto handle resolution — DNS TXT fallback (relay) 77 80 hickory-resolver = { version = "0.25", features = ["tokio", "system-config"] } 78 81

+22

bruno/create_session.bru

reviewed

··· 1 1 + meta { 2 2 + name: Create Session (createSession) 3 3 + type: http 4 4 + seq: 17 5 5 + } 6 6 + 7 7 + post { 8 8 + url: {{baseUrl}}/xrpc/com.atproto.server.createSession 9 9 + body: json 10 10 + auth: none 11 11 + } 12 12 + 13 13 + body:json { 14 14 + { 15 15 + "identifier": "alice.example.com", 16 16 + "password": "hunter2" 17 17 + } 18 18 + } 19 19 + 20 20 + vars:pre-request { 21 21 + baseUrl: http://localhost:8080 22 22 + }

+1

crates/relay/Cargo.toml

reviewed

··· 39 39 hickory-resolver = { workspace = true } 40 40 jsonwebtoken = { workspace = true } 41 41 p256 = { workspace = true } 42 42 + argon2 = { workspace = true } 42 43 43 44 [dev-dependencies] 44 45 tower = { workspace = true }

+18 -2

crates/relay/src/app.rs

reviewed

··· 1 1 - use std::sync::Arc; 1 1 + use std::collections::{HashMap, VecDeque}; 2 2 + use std::sync::{Arc, Mutex}; 3 3 + use std::time::Instant; 2 4 3 5 use axum::{ 4 6 extract::Path, ··· 25 27 use crate::routes::health::health; 26 28 use crate::routes::oauth_authorize::{get_authorization, post_authorization}; 27 29 use crate::routes::oauth_server_metadata::oauth_server_metadata; 30 30 + use crate::routes::create_session::create_session; 28 31 use crate::routes::oauth_token::post_token; 29 32 use crate::routes::register_device::register_device; 30 33 use crate::routes::resolve_handle::resolve_handle_handler; 31 34 use crate::well_known::WellKnownResolver; 35 35 + 36 36 + /// In-memory store for failed login attempts per identifier (for createSession rate limiting). 37 37 + /// Maps identifier (DID or handle) → timestamps of recent failures. 38 38 + /// `std::sync::Mutex` is used because the critical section never awaits. 39 39 + pub type FailedLoginStore = Arc<Mutex<HashMap<String, VecDeque<Instant>>>>; 32 40 33 41 /// Wraps an `axum::http::HeaderMap` as an OTel text-map [`Extractor`] so that 34 42 /// the W3C `traceparent` and `tracestate` headers can be read by the global propagator. ··· 110 118 /// In-memory store for server-issued DPoP nonces. Shared across all token endpoint requests. 111 119 #[allow(dead_code)] 112 120 pub dpop_nonces: DpopNonceStore, 121 121 + /// In-memory sliding-window store for failed createSession attempts (rate limiting). 122 122 + /// Shared across all requests via Arc<Mutex<...>>. 123 123 + pub failed_login_attempts: FailedLoginStore, 113 124 } 114 125 115 126 /// Build the Axum router with middleware and routes. ··· 133 144 get(describe_server), 134 145 ) 135 146 .route( 147 147 + "/xrpc/com.atproto.server.createSession", 148 148 + post(create_session), 149 149 + ) 150 150 + .route( 136 151 "/xrpc/com.atproto.identity.resolveHandle", 137 152 get(resolve_handle_handler), 138 153 ) ··· 240 255 jwt_secret: [0x42u8; 32], 241 256 oauth_signing_keypair: test_signing_key, 242 257 dpop_nonces, 258 258 + failed_login_attempts: Arc::new(Mutex::new(HashMap::new())), 243 259 } 244 260 } 245 261 ··· 324 340 let response = app(test_state().await) 325 341 .oneshot( 326 342 Request::builder() 327 327 - .uri("/xrpc/com.atproto.server.createSession") 343 343 + .uri("/xrpc/com.atproto.server.getSession") 328 344 .body(Body::empty()) 329 345 .unwrap(), 330 346 )

+1

crates/relay/src/main.rs

reviewed

··· 150 150 jwt_secret, 151 151 oauth_signing_keypair, 152 152 dpop_nonces: auth::new_nonce_store(), 153 153 + failed_login_attempts: Arc::new(std::sync::Mutex::new(std::collections::HashMap::new())), 153 154 }; 154 155 155 156 let listener = tokio::net::TcpListener::bind(&addr)

+1

crates/relay/src/routes/auth.rs

reviewed

··· 209 209 jwt_secret: base.jwt_secret, 210 210 oauth_signing_keypair: base.oauth_signing_keypair, 211 211 dpop_nonces: base.dpop_nonces, 212 212 + failed_login_attempts: base.failed_login_attempts, 212 213 } 213 214 } 214 215

+715

crates/relay/src/routes/create_session.rs

reviewed

··· 1 1 + // pattern: Imperative Shell 2 2 + // 3 3 + // Gathers: JSON body {identifier, password}, DB pool, jwt_secret, config, rate-limit state 4 4 + // Processes: rate limit gate → identifier resolution → password verification → 5 5 + // JWT issuance → session + refresh_token DB insert 6 6 + // Returns: JSON {accessJwt, refreshJwt, handle, did, email} on success; ApiError on failure 7 7 + // 8 8 + // Implements: POST /xrpc/com.atproto.server.createSession 9 9 + 10 10 + use std::collections::{HashMap, VecDeque}; 11 11 + use std::time::{Instant, SystemTime, UNIX_EPOCH, Duration}; 12 12 + 13 13 + use argon2::{Argon2, PasswordHash, PasswordVerifier}; 14 14 + use axum::{extract::State, http::StatusCode, response::Json}; 15 15 + use jsonwebtoken::{encode, Algorithm, EncodingKey, Header}; 16 16 + use serde::{Deserialize, Serialize}; 17 17 + use uuid::Uuid; 18 18 + 19 19 + use common::{ApiError, ErrorCode}; 20 20 + 21 21 + use crate::app::AppState; 22 22 + 23 23 + const ACCESS_TOKEN_TTL_SECS: u64 = 2 * 60 * 60; // 2 hours 24 24 + const REFRESH_TOKEN_TTL_SECS: u64 = 90 * 24 * 60 * 60; // 90 days 25 25 + pub(crate) const RATE_LIMIT_WINDOW_SECS: u64 = 60; 26 26 + pub(crate) const RATE_LIMIT_MAX_FAILURES: usize = 5; 27 27 + 28 28 + // ── Request / Response types ───────────────────────────────────────────────── 29 29 + 30 30 + #[derive(Deserialize)] 31 31 + #[serde(rename_all = "camelCase")] 32 32 + pub struct CreateSessionRequest { 33 33 + identifier: String, 34 34 + password: String, 35 35 + } 36 36 + 37 37 + #[derive(Serialize)] 38 38 + #[serde(rename_all = "camelCase")] 39 39 + pub struct CreateSessionResponse { 40 40 + access_jwt: String, 41 41 + refresh_jwt: String, 42 42 + handle: String, 43 43 + did: String, 44 44 + email: String, 45 45 + } 46 46 + 47 47 + // ── JWT claim structs ──────────────────────────────────────────────────────── 48 48 + 49 49 + /// Claims for a legacy HS256 access token (scope: com.atproto.access). 50 50 + #[derive(Serialize)] 51 51 + struct LegacyAccessClaims { 52 52 + scope: &'static str, 53 53 + sub: String, 54 54 + /// Audience — server_did when configured, public_url otherwise. 55 55 + aud: String, 56 56 + iat: u64, 57 57 + exp: u64, 58 58 + } 59 59 + 60 60 + /// Claims for a legacy HS256 refresh token (scope: com.atproto.refresh). 61 61 + #[derive(Serialize)] 62 62 + struct LegacyRefreshClaims { 63 63 + scope: &'static str, 64 64 + sub: String, 65 65 + aud: String, 66 66 + /// Unique token ID stored in `refresh_tokens.jti` for refresh-token rotation. 67 67 + jti: String, 68 68 + iat: u64, 69 69 + exp: u64, 70 70 + } 71 71 + 72 72 + // ── Internal account record ────────────────────────────────────────────────── 73 73 + 74 74 + struct AccountRow { 75 75 + did: String, 76 76 + email: String, 77 77 + /// Argon2id PHC string. `None` for mobile accounts (password auth not allowed). 78 78 + password_hash: Option<String>, 79 79 + /// One associated handle (if any). Empty string returned in the response when absent. 80 80 + handle: Option<String>, 81 81 + } 82 82 + 83 83 + // ── Handler ────────────────────────────────────────────────────────────────── 84 84 + 85 85 + /// POST /xrpc/com.atproto.server.createSession 86 86 + /// 87 87 + /// Password-based authentication (ATProto legacy session flow). 88 88 + /// Issues a short-lived HS256 access JWT and a 90-day refresh JWT. 89 89 + pub async fn create_session( 90 90 + State(state): State<AppState>, 91 91 + Json(payload): Json<CreateSessionRequest>, 92 92 + ) -> Result<(StatusCode, Json<CreateSessionResponse>), ApiError> { 93 93 + // --- Rate limit gate --- 94 94 + // Check before any DB work to shed load on targeted accounts. 95 95 + { 96 96 + let mut attempts = state 97 97 + .failed_login_attempts 98 98 + .lock() 99 99 + .map_err(|_| ApiError::new(ErrorCode::InternalError, "internal error"))?; 100 100 + if is_rate_limited(&mut attempts, &payload.identifier) { 101 101 + return Err(ApiError::new( 102 102 + ErrorCode::RateLimited, 103 103 + "too many failed login attempts, please try again later", 104 104 + )); 105 105 + } 106 106 + } 107 107 + 108 108 + // --- Resolve identifier and verify password --- 109 109 + // Both "account not found" and "wrong password" surface as the same error to prevent 110 110 + // user enumeration via distinguishable error messages. 111 111 + let account_opt = resolve_identifier(&state.db, &payload.identifier).await?; 112 112 + 113 113 + let account = match account_opt { 114 114 + Some(row) => { 115 115 + let auth_ok = row 116 116 + .password_hash 117 117 + .as_deref() 118 118 + .map(|h| !h.is_empty() && verify_password(h, &payload.password)) 119 119 + .unwrap_or(false); // mobile accounts (NULL password_hash) cannot use createSession 120 120 + if !auth_ok { 121 121 + let mut attempts = state 122 122 + .failed_login_attempts 123 123 + .lock() 124 124 + .map_err(|_| ApiError::new(ErrorCode::InternalError, "internal error"))?; 125 125 + record_failure(&mut attempts, &payload.identifier); 126 126 + return Err(ApiError::new( 127 127 + ErrorCode::AuthenticationRequired, 128 128 + "invalid identifier or password", 129 129 + )); 130 130 + } 131 131 + row 132 132 + } 133 133 + None => { 134 134 + let mut attempts = state 135 135 + .failed_login_attempts 136 136 + .lock() 137 137 + .map_err(|_| ApiError::new(ErrorCode::InternalError, "internal error"))?; 138 138 + record_failure(&mut attempts, &payload.identifier); 139 139 + return Err(ApiError::new( 140 140 + ErrorCode::AuthenticationRequired, 141 141 + "invalid identifier or password", 142 142 + )); 143 143 + } 144 144 + }; 145 145 + 146 146 + // --- Clear failure history on successful authentication --- 147 147 + { 148 148 + let mut attempts = state 149 149 + .failed_login_attempts 150 150 + .lock() 151 151 + .map_err(|_| ApiError::new(ErrorCode::InternalError, "internal error"))?; 152 152 + clear_failures(&mut attempts, &payload.identifier); 153 153 + } 154 154 + 155 155 + // --- Issue legacy HS256 JWTs --- 156 156 + let now = SystemTime::now() 157 157 + .duration_since(UNIX_EPOCH) 158 158 + .unwrap_or_default() 159 159 + .as_secs(); 160 160 + 161 161 + // Prefer server_did as audience (what verify_hs256_access_token validates against 162 162 + // when configured); fall back to public_url. 163 163 + let aud = state 164 164 + .config 165 165 + .server_did 166 166 + .as_deref() 167 167 + .unwrap_or(&state.config.public_url) 168 168 + .to_string(); 169 169 + 170 170 + let access_jwt = issue_access_jwt(&state.jwt_secret, &account.did, &aud, now)?; 171 171 + 172 172 + let refresh_jti = Uuid::new_v4().to_string(); 173 173 + let refresh_jwt = 174 174 + issue_refresh_jwt(&state.jwt_secret, &account.did, &aud, &refresh_jti, now)?; 175 175 + 176 176 + // --- Persist session and refresh token atomically --- 177 177 + let session_id = Uuid::new_v4().to_string(); 178 178 + let mut tx = state.db.begin().await.map_err(|e| { 179 179 + tracing::error!(error = %e, "failed to begin transaction"); 180 180 + ApiError::new(ErrorCode::InternalError, "failed to create session") 181 181 + })?; 182 182 + 183 183 + sqlx::query( 184 184 + "INSERT INTO sessions (id, did, device_id, token_hash, created_at, expires_at) \ 185 185 + VALUES (?, ?, NULL, NULL, datetime('now'), datetime('now', '+90 days'))", 186 186 + ) 187 187 + .bind(&session_id) 188 188 + .bind(&account.did) 189 189 + .execute(&mut *tx) 190 190 + .await 191 191 + .map_err(|e| { 192 192 + tracing::error!(error = %e, "failed to insert session"); 193 193 + ApiError::new(ErrorCode::InternalError, "failed to create session") 194 194 + })?; 195 195 + 196 196 + sqlx::query( 197 197 + "INSERT INTO refresh_tokens (jti, did, session_id, expires_at, created_at) \ 198 198 + VALUES (?, ?, ?, datetime('now', '+90 days'), datetime('now'))", 199 199 + ) 200 200 + .bind(&refresh_jti) 201 201 + .bind(&account.did) 202 202 + .bind(&session_id) 203 203 + .execute(&mut *tx) 204 204 + .await 205 205 + .map_err(|e| { 206 206 + tracing::error!(error = %e, "failed to insert refresh token"); 207 207 + ApiError::new(ErrorCode::InternalError, "failed to create session") 208 208 + })?; 209 209 + 210 210 + tx.commit().await.map_err(|e| { 211 211 + tracing::error!(error = %e, "failed to commit session transaction"); 212 212 + ApiError::new(ErrorCode::InternalError, "failed to create session") 213 213 + })?; 214 214 + 215 215 + Ok(( 216 216 + StatusCode::OK, 217 217 + Json(CreateSessionResponse { 218 218 + access_jwt, 219 219 + refresh_jwt, 220 220 + handle: account.handle.unwrap_or_default(), 221 221 + did: account.did, 222 222 + email: account.email, 223 223 + }), 224 224 + )) 225 225 + } 226 226 + 227 227 + // ── Private helpers ────────────────────────────────────────────────────────── 228 228 + 229 229 + /// Resolve a handle or DID to an active (non-deactivated) account. 230 230 + /// 231 231 + /// Returns `None` when not found; `Err` only on DB errors. 232 232 + async fn resolve_identifier( 233 233 + db: &sqlx::SqlitePool, 234 234 + identifier: &str, 235 235 + ) -> Result<Option<AccountRow>, ApiError> { 236 236 + if identifier.starts_with("did:") { 237 237 + let row: Option<(String, Option<String>, Option<String>)> = sqlx::query_as( 238 238 + "SELECT a.email, a.password_hash, h.handle \ 239 239 + FROM accounts a \ 240 240 + LEFT JOIN handles h ON h.did = a.did \ 241 241 + WHERE a.did = ? AND a.deactivated_at IS NULL \ 242 242 + LIMIT 1", 243 243 + ) 244 244 + .bind(identifier) 245 245 + .fetch_optional(db) 246 246 + .await 247 247 + .map_err(|e| { 248 248 + tracing::error!(error = %e, "DB error resolving DID"); 249 249 + ApiError::new(ErrorCode::InternalError, "failed to resolve identifier") 250 250 + })?; 251 251 + 252 252 + Ok(row.map(|(email, password_hash, handle)| AccountRow { 253 253 + did: identifier.to_string(), 254 254 + email, 255 255 + password_hash, 256 256 + handle, 257 257 + })) 258 258 + } else { 259 259 + let row: Option<(String, String, Option<String>)> = sqlx::query_as( 260 260 + "SELECT a.did, a.email, a.password_hash \ 261 261 + FROM handles h \ 262 262 + JOIN accounts a ON a.did = h.did \ 263 263 + WHERE h.handle = ? AND a.deactivated_at IS NULL \ 264 264 + LIMIT 1", 265 265 + ) 266 266 + .bind(identifier) 267 267 + .fetch_optional(db) 268 268 + .await 269 269 + .map_err(|e| { 270 270 + tracing::error!(error = %e, "DB error resolving handle"); 271 271 + ApiError::new(ErrorCode::InternalError, "failed to resolve identifier") 272 272 + })?; 273 273 + 274 274 + Ok(row.map(|(did, email, password_hash)| AccountRow { 275 275 + did, 276 276 + email, 277 277 + password_hash, 278 278 + handle: Some(identifier.to_string()), 279 279 + })) 280 280 + } 281 281 + } 282 282 + 283 283 + /// Verify `password` against a stored argon2id PHC-format hash string. 284 284 + fn verify_password(stored_hash: &str, password: &str) -> bool { 285 285 + let Ok(hash) = PasswordHash::new(stored_hash) else { 286 286 + return false; 287 287 + }; 288 288 + Argon2::default() 289 289 + .verify_password(password.as_bytes(), &hash) 290 290 + .is_ok() 291 291 + } 292 292 + 293 293 + /// Sign an HS256 access JWT with a 2-hour lifetime. 294 294 + fn issue_access_jwt( 295 295 + secret: &[u8; 32], 296 296 + did: &str, 297 297 + aud: &str, 298 298 + now: u64, 299 299 + ) -> Result<String, ApiError> { 300 300 + encode( 301 301 + &Header::new(Algorithm::HS256), 302 302 + &LegacyAccessClaims { 303 303 + scope: "com.atproto.access", 304 304 + sub: did.to_string(), 305 305 + aud: aud.to_string(), 306 306 + iat: now, 307 307 + exp: now + ACCESS_TOKEN_TTL_SECS, 308 308 + }, 309 309 + &EncodingKey::from_secret(secret), 310 310 + ) 311 311 + .map_err(|e| { 312 312 + tracing::error!(error = %e, "failed to sign access JWT"); 313 313 + ApiError::new(ErrorCode::InternalError, "failed to issue token") 314 314 + }) 315 315 + } 316 316 + 317 317 + /// Sign an HS256 refresh JWT with a 90-day lifetime. 318 318 + fn issue_refresh_jwt( 319 319 + secret: &[u8; 32], 320 320 + did: &str, 321 321 + aud: &str, 322 322 + jti: &str, 323 323 + now: u64, 324 324 + ) -> Result<String, ApiError> { 325 325 + encode( 326 326 + &Header::new(Algorithm::HS256), 327 327 + &LegacyRefreshClaims { 328 328 + scope: "com.atproto.refresh", 329 329 + sub: did.to_string(), 330 330 + aud: aud.to_string(), 331 331 + jti: jti.to_string(), 332 332 + iat: now, 333 333 + exp: now + REFRESH_TOKEN_TTL_SECS, 334 334 + }, 335 335 + &EncodingKey::from_secret(secret), 336 336 + ) 337 337 + .map_err(|e| { 338 338 + tracing::error!(error = %e, "failed to sign refresh JWT"); 339 339 + ApiError::new(ErrorCode::InternalError, "failed to issue token") 340 340 + }) 341 341 + } 342 342 + 343 343 + // ── Rate limiting ──────────────────────────────────────────────────────────── 344 344 + 345 345 + /// Returns `true` if `identifier` has had ≥ `RATE_LIMIT_MAX_FAILURES` failed login 346 346 + /// attempts within the last `RATE_LIMIT_WINDOW_SECS` seconds (sliding window). 347 347 + /// 348 348 + /// Prunes expired entries from the front of the deque during the check, keeping 349 349 + /// memory bounded without a separate cleanup goroutine. 350 350 + /// 351 351 + /// # Your turn 352 352 + /// 353 353 + /// Implement this function. The approach: 354 354 + /// 1. Look up the `VecDeque` for `identifier`; return `false` if absent (no prior failures). 355 355 + /// 2. Drop entries from the **front** that are older than `RATE_LIMIT_WINDOW_SECS`. 356 356 + /// 3. Return `true` if the remaining count ≥ `RATE_LIMIT_MAX_FAILURES`. 357 357 + /// 358 358 + /// Trade-off to consider: a sliding window is accurate but allocates one `Instant` per 359 359 + /// failure. A fixed window (keyed by `now / window_secs`) uses O(1) memory but can allow 360 360 + /// 2× the limit at a window boundary. Either is valid for v0.1 — pick the approach that 361 361 + /// makes the rate-limit test below pass. 362 362 + fn is_rate_limited( 363 363 + attempts: &mut HashMap<String, VecDeque<Instant>>, 364 364 + identifier: &str, 365 365 + ) -> bool { 366 366 + let deque = attempts.get_mut(identifier); 367 367 + if let Some(deque) = deque { 368 368 + let now = Instant::now(); 369 369 + while let Some(&oldest) = deque.front() { 370 370 + if now - oldest > Duration::from_secs(RATE_LIMIT_WINDOW_SECS) { 371 371 + deque.pop_front(); 372 372 + } else { 373 373 + break; 374 374 + } 375 375 + } 376 376 + return deque.len() >= RATE_LIMIT_MAX_FAILURES; 377 377 + } 378 378 + false 379 379 + } 380 380 + 381 381 + /// Record a new failed attempt timestamp for `identifier`. 382 382 + fn record_failure(attempts: &mut HashMap<String, VecDeque<Instant>>, identifier: &str) { 383 383 + attempts 384 384 + .entry(identifier.to_string()) 385 385 + .or_default() 386 386 + .push_back(Instant::now()); 387 387 + } 388 388 + 389 389 + /// Clear the failure history for `identifier` on successful authentication. 390 390 + fn clear_failures(attempts: &mut HashMap<String, VecDeque<Instant>>, identifier: &str) { 391 391 + attempts.remove(identifier); 392 392 + } 393 393 + 394 394 + // ── Tests ──────────────────────────────────────────────────────────────────── 395 395 + 396 396 + #[cfg(test)] 397 397 + mod tests { 398 398 + use super::*; 399 399 + use argon2::{ 400 400 + password_hash::{rand_core::OsRng, SaltString}, 401 401 + Argon2, PasswordHasher, 402 402 + }; 403 403 + use axum::{ 404 404 + body::Body, 405 405 + http::{Request, StatusCode}, 406 406 + }; 407 407 + use tower::ServiceExt; 408 408 + 409 409 + use crate::app::{app, test_state}; 410 410 + 411 411 + // ── Helpers ─────────────────────────────────────────────────────────────── 412 412 + 413 413 + fn post_create_session(identifier: &str, password: &str) -> Request<Body> { 414 414 + Request::builder() 415 415 + .method("POST") 416 416 + .uri("/xrpc/com.atproto.server.createSession") 417 417 + .header("Content-Type", "application/json") 418 418 + .body(Body::from(format!( 419 419 + r#"{{"identifier":"{identifier}","password":"{password}"}}"# 420 420 + ))) 421 421 + .unwrap() 422 422 + } 423 423 + 424 424 + async fn insert_account_with_password( 425 425 + db: &sqlx::SqlitePool, 426 426 + did: &str, 427 427 + handle: &str, 428 428 + email: &str, 429 429 + password: &str, 430 430 + ) { 431 431 + let salt = SaltString::generate(&mut OsRng); 432 432 + let hash = Argon2::default() 433 433 + .hash_password(password.as_bytes(), &salt) 434 434 + .unwrap() 435 435 + .to_string(); 436 436 + 437 437 + sqlx::query( 438 438 + "INSERT INTO accounts (did, email, password_hash, created_at, updated_at) \ 439 439 + VALUES (?, ?, ?, datetime('now'), datetime('now'))", 440 440 + ) 441 441 + .bind(did) 442 442 + .bind(email) 443 443 + .bind(&hash) 444 444 + .execute(db) 445 445 + .await 446 446 + .unwrap(); 447 447 + 448 448 + sqlx::query( 449 449 + "INSERT INTO handles (handle, did, created_at) VALUES (?, ?, datetime('now'))", 450 450 + ) 451 451 + .bind(handle) 452 452 + .bind(did) 453 453 + .execute(db) 454 454 + .await 455 455 + .unwrap(); 456 456 + } 457 457 + 458 458 + async fn body_json(response: axum::response::Response) -> serde_json::Value { 459 459 + let bytes = axum::body::to_bytes(response.into_body(), usize::MAX) 460 460 + .await 461 461 + .unwrap(); 462 462 + serde_json::from_slice(&bytes).unwrap() 463 463 + } 464 464 + 465 465 + // ── Happy path ──────────────────────────────────────────────────────────── 466 466 + 467 467 + #[tokio::test] 468 468 + async fn valid_did_returns_200_with_jwts() { 469 469 + let state = test_state().await; 470 470 + insert_account_with_password( 471 471 + &state.db, 472 472 + "did:plc:alice", 473 473 + "alice.test.example.com", 474 474 + "alice@example.com", 475 475 + "hunter2", 476 476 + ) 477 477 + .await; 478 478 + 479 479 + let response = app(state) 480 480 + .oneshot(post_create_session("did:plc:alice", "hunter2")) 481 481 + .await 482 482 + .unwrap(); 483 483 + 484 484 + assert_eq!(response.status(), StatusCode::OK); 485 485 + let json = body_json(response).await; 486 486 + assert!(json["accessJwt"].as_str().is_some(), "accessJwt required"); 487 487 + assert!(json["refreshJwt"].as_str().is_some(), "refreshJwt required"); 488 488 + assert_eq!(json["did"], "did:plc:alice"); 489 489 + assert_eq!(json["email"], "alice@example.com"); 490 490 + } 491 491 + 492 492 + #[tokio::test] 493 493 + async fn valid_handle_returns_handle_in_response() { 494 494 + let state = test_state().await; 495 495 + insert_account_with_password( 496 496 + &state.db, 497 497 + "did:plc:bob", 498 498 + "bob.test.example.com", 499 499 + "bob@example.com", 500 500 + "p@ssw0rd", 501 501 + ) 502 502 + .await; 503 503 + 504 504 + let response = app(state) 505 505 + .oneshot(post_create_session("bob.test.example.com", "p@ssw0rd")) 506 506 + .await 507 507 + .unwrap(); 508 508 + 509 509 + assert_eq!(response.status(), StatusCode::OK); 510 510 + let json = body_json(response).await; 511 511 + assert_eq!(json["handle"], "bob.test.example.com"); 512 512 + assert_eq!(json["did"], "did:plc:bob"); 513 513 + } 514 514 + 515 515 + #[tokio::test] 516 516 + async fn session_and_refresh_token_persisted_in_db() { 517 517 + let state = test_state().await; 518 518 + insert_account_with_password( 519 519 + &state.db, 520 520 + "did:plc:persist", 521 521 + "persist.test.example.com", 522 522 + "persist@example.com", 523 523 + "testpass", 524 524 + ) 525 525 + .await; 526 526 + 527 527 + let db = state.db.clone(); 528 528 + let response = app(state) 529 529 + .oneshot(post_create_session("did:plc:persist", "testpass")) 530 530 + .await 531 531 + .unwrap(); 532 532 + 533 533 + assert_eq!(response.status(), StatusCode::OK); 534 534 + 535 535 + let session_count: i64 = 536 536 + sqlx::query_scalar("SELECT COUNT(*) FROM sessions WHERE did = 'did:plc:persist'") 537 537 + .fetch_one(&db) 538 538 + .await 539 539 + .unwrap(); 540 540 + assert_eq!(session_count, 1, "one session row expected"); 541 541 + 542 542 + let refresh_count: i64 = 543 543 + sqlx::query_scalar("SELECT COUNT(*) FROM refresh_tokens WHERE did = 'did:plc:persist'") 544 544 + .fetch_one(&db) 545 545 + .await 546 546 + .unwrap(); 547 547 + assert_eq!(refresh_count, 1, "one refresh token row expected"); 548 548 + } 549 549 + 550 550 + #[tokio::test] 551 551 + async fn access_jwt_has_correct_scope() { 552 552 + let state = test_state().await; 553 553 + insert_account_with_password( 554 554 + &state.db, 555 555 + "did:plc:jwtcheck", 556 556 + "jwt.test.example.com", 557 557 + "jwt@example.com", 558 558 + "jwtpass", 559 559 + ) 560 560 + .await; 561 561 + 562 562 + let secret = state.jwt_secret; 563 563 + let response = app(state) 564 564 + .oneshot(post_create_session("did:plc:jwtcheck", "jwtpass")) 565 565 + .await 566 566 + .unwrap(); 567 567 + 568 568 + let json = body_json(response).await; 569 569 + let access_jwt = json["accessJwt"].as_str().unwrap(); 570 570 + 571 571 + // Decode without audience validation (test state has no server_did). 572 572 + let mut validation = jsonwebtoken::Validation::new(jsonwebtoken::Algorithm::HS256); 573 573 + validation.validate_aud = false; 574 574 + validation.set_required_spec_claims(&["exp", "sub"]); 575 575 + let data = jsonwebtoken::decode::<serde_json::Value>( 576 576 + access_jwt, 577 577 + &jsonwebtoken::DecodingKey::from_secret(&secret), 578 578 + &validation, 579 579 + ) 580 580 + .expect("access JWT must be valid"); 581 581 + 582 582 + assert_eq!(data.claims["scope"], "com.atproto.access"); 583 583 + assert_eq!(data.claims["sub"], "did:plc:jwtcheck"); 584 584 + } 585 585 + 586 586 + #[tokio::test] 587 587 + async fn refresh_jwt_has_jti_stored_in_db() { 588 588 + let state = test_state().await; 589 589 + insert_account_with_password( 590 590 + &state.db, 591 591 + "did:plc:jticheck", 592 592 + "jti.test.example.com", 593 593 + "jti@example.com", 594 594 + "jtipass", 595 595 + ) 596 596 + .await; 597 597 + 598 598 + let secret = state.jwt_secret; 599 599 + let db = state.db.clone(); 600 600 + let response = app(state) 601 601 + .oneshot(post_create_session("did:plc:jticheck", "jtipass")) 602 602 + .await 603 603 + .unwrap(); 604 604 + 605 605 + let json = body_json(response).await; 606 606 + let refresh_jwt = json["refreshJwt"].as_str().unwrap(); 607 607 + 608 608 + let mut validation = jsonwebtoken::Validation::new(jsonwebtoken::Algorithm::HS256); 609 609 + validation.validate_aud = false; 610 610 + validation.set_required_spec_claims(&["exp", "sub"]); 611 611 + let data = jsonwebtoken::decode::<serde_json::Value>( 612 612 + refresh_jwt, 613 613 + &jsonwebtoken::DecodingKey::from_secret(&secret), 614 614 + &validation, 615 615 + ) 616 616 + .expect("refresh JWT must be valid"); 617 617 + 618 618 + assert_eq!(data.claims["scope"], "com.atproto.refresh"); 619 619 + let jti = data.claims["jti"].as_str().expect("jti must be present"); 620 620 + 621 621 + let stored: Option<String> = 622 622 + sqlx::query_scalar("SELECT jti FROM refresh_tokens WHERE jti = ?") 623 623 + .bind(jti) 624 624 + .fetch_optional(&db) 625 625 + .await 626 626 + .unwrap(); 627 627 + assert!(stored.is_some(), "refresh jti must be persisted in DB"); 628 628 + } 629 629 + 630 630 + // ── Auth failure ────────────────────────────────────────────────────────── 631 631 + 632 632 + #[tokio::test] 633 633 + async fn wrong_password_returns_401() { 634 634 + let state = test_state().await; 635 635 + insert_account_with_password( 636 636 + &state.db, 637 637 + "did:plc:charlie", 638 638 + "charlie.test.example.com", 639 639 + "charlie@example.com", 640 640 + "correcthorsebatterystaple", 641 641 + ) 642 642 + .await; 643 643 + 644 644 + let response = app(state) 645 645 + .oneshot(post_create_session("did:plc:charlie", "wrongpassword")) 646 646 + .await 647 647 + .unwrap(); 648 648 + 649 649 + assert_eq!(response.status(), StatusCode::UNAUTHORIZED); 650 650 + let json = body_json(response).await; 651 651 + assert_eq!(json["error"]["code"], "AUTHENTICATION_REQUIRED"); 652 652 + } 653 653 + 654 654 + #[tokio::test] 655 655 + async fn unknown_identifier_returns_401() { 656 656 + let response = app(test_state().await) 657 657 + .oneshot(post_create_session("did:plc:nobody", "password")) 658 658 + .await 659 659 + .unwrap(); 660 660 + 661 661 + assert_eq!(response.status(), StatusCode::UNAUTHORIZED); 662 662 + let json = body_json(response).await; 663 663 + assert_eq!(json["error"]["code"], "AUTHENTICATION_REQUIRED"); 664 664 + } 665 665 + 666 666 + #[tokio::test] 667 667 + async fn mobile_account_without_password_returns_401() { 668 668 + let state = test_state().await; 669 669 + sqlx::query( 670 670 + "INSERT INTO accounts (did, email, password_hash, created_at, updated_at) \ 671 671 + VALUES ('did:plc:mobile', 'mobile@example.com', NULL, datetime('now'), datetime('now'))", 672 672 + ) 673 673 + .execute(&state.db) 674 674 + .await 675 675 + .unwrap(); 676 676 + 677 677 + let response = app(state) 678 678 + .oneshot(post_create_session("did:plc:mobile", "anypassword")) 679 679 + .await 680 680 + .unwrap(); 681 681 + 682 682 + assert_eq!(response.status(), StatusCode::UNAUTHORIZED); 683 683 + } 684 684 + 685 685 + // ── Rate limiting (requires is_rate_limited implementation) ─────────────── 686 686 + // 687 687 + // This test will fail until you implement `is_rate_limited` above. 688 688 + // After 5 failures the 6th attempt should receive 429 Too Many Requests. 689 689 + 690 690 + #[tokio::test] 691 691 + async fn rate_limit_triggers_after_five_failures() { 692 692 + let state = test_state().await; 693 693 + 694 694 + // Five wrong-password attempts against a non-existent account. 695 695 + // Each should return 401, and each records a failure in the shared store. 696 696 + for i in 0..RATE_LIMIT_MAX_FAILURES { 697 697 + let response = app(state.clone()) 698 698 + .oneshot(post_create_session("did:plc:ratelimited", "wrongpassword")) 699 699 + .await 700 700 + .unwrap(); 701 701 + assert_eq!( 702 702 + response.status(), 703 703 + StatusCode::UNAUTHORIZED, 704 704 + "attempt {i} should be 401" 705 705 + ); 706 706 + } 707 707 + 708 708 + // The sixth attempt should now be rate-limited. 709 709 + let response = app(state) 710 710 + .oneshot(post_create_session("did:plc:ratelimited", "wrongpassword")) 711 711 + .await 712 712 + .unwrap(); 713 713 + assert_eq!(response.status(), StatusCode::TOO_MANY_REQUESTS); 714 714 + } 715 715 + }

+2

crates/relay/src/routes/create_signing_key.rs

reviewed

··· 131 131 jwt_secret: base.jwt_secret, 132 132 oauth_signing_keypair: base.oauth_signing_keypair, 133 133 dpop_nonces: base.dpop_nonces, 134 134 + failed_login_attempts: base.failed_login_attempts, 134 135 } 135 136 } 136 137 ··· 387 388 jwt_secret: base.jwt_secret, 388 389 oauth_signing_keypair: base.oauth_signing_keypair, 389 390 dpop_nonces: base.dpop_nonces, 391 391 + failed_login_attempts: base.failed_login_attempts, 390 392 }; 391 393 392 394 let response = app(state)

+1

crates/relay/src/routes/describe_server.rs

reviewed

··· 133 133 jwt_secret: base.jwt_secret, 134 134 oauth_signing_keypair: base.oauth_signing_keypair, 135 135 dpop_nonces: base.dpop_nonces, 136 136 + failed_login_attempts: base.failed_login_attempts, 136 137 }; 137 138 138 139 let response = app(state)

+1

crates/relay/src/routes/mod.rs

reviewed

··· 1 1 pub(crate) mod auth; 2 2 pub mod claim_codes; 3 3 + pub mod create_session; 3 4 pub mod create_account; 4 5 pub mod create_did; 5 6 pub mod create_handle;

+1

crates/relay/src/routes/test_utils.rs

reviewed

··· 21 21 jwt_secret: base.jwt_secret, 22 22 oauth_signing_keypair: base.oauth_signing_keypair, 23 23 dpop_nonces: base.dpop_nonces, 24 24 + failed_login_attempts: base.failed_login_attempts, 24 25 } 25 26 }