An easy-to-host PDS on the ATProtocol, MacOS. Grandma-approved.
feat(relay): OAuth authorization endpoint + neobrutal consent UI (MM-76)
Implements GET /oauth/authorize and POST /oauth/authorize for the
authorization code flow with PKCE enforcement and a server-rendered
consent screen.
GET validates client_id, redirect_uri, response_type=code, and
code_challenge_method=S256; renders a neobrutal HTML consent page
showing the client name and requested scopes. Errors that make
redirecting unsafe (unknown client, mismatched redirect_uri) return
an HTML error page instead of a redirect.
POST re-validates all parameters against the DB (hidden form fields
could be tampered with), generates a 43-char base64url authorization
code, stores it in oauth_authorization_codes with a 60-second TTL,
and redirects to redirect_uri?code=...&state=.... Denial redirects
with error=access_denied.
Also adds store_authorization_code and get_single_account_did to
db/oauth.rs; 21 new tests across the DB and route layers.
authored by
Tangled
97f4c54f
0169a85c
+980
-7
+5
crates/relay/src/app.rs
+5
crates/relay/src/app.rs
···
22
22
use crate::routes::describe_server::describe_server;
23
23
use crate::routes::get_relay_signing_key::get_relay_signing_key;
24
24
use crate::routes::health::health;
25
+
use crate::routes::oauth_authorize::{get_authorization, post_authorization};
25
26
use crate::routes::oauth_server_metadata::oauth_server_metadata;
26
27
use crate::routes::register_device::register_device;
27
28
use crate::routes::resolve_handle::resolve_handle_handler;
···
111
112
.route(
112
113
"/.well-known/oauth-authorization-server",
113
114
get(oauth_server_metadata),
115
+
)
116
+
.route(
117
+
"/oauth/authorize",
118
+
get(get_authorization).post(post_authorization),
114
119
)
115
120
.route("/xrpc/_health", get(health))
116
121
.route(
+121
-7
crates/relay/src/db/oauth.rs
+121
-7
crates/relay/src/db/oauth.rs
···
1
1
// pattern: Imperative Shell
2
2
//
3
-
// Storage adapter for OAuth server-side state in the `oauth_clients` table.
4
-
// Authorization code and token functions will be added when the full OAuth
5
-
// flow is implemented.
3
+
// Storage adapter for OAuth server-side state: client registry, authorization
4
+
// codes, and helpers for the authorization endpoint.
6
5
7
6
use sqlx::SqlitePool;
8
7
···
10
9
///
11
10
/// `client_metadata` is stored as a raw JSON string (RFC 7591 client metadata).
12
11
/// Callers are responsible for serializing/deserializing the JSON.
13
-
// Wired to handlers when the OAuth authorization flow is implemented.
14
-
#[allow(dead_code)]
15
12
pub struct OAuthClientRow {
13
+
// client_id and created_at are read by future handlers (dynamic client registration,
14
+
// admin listing); only client_metadata is needed by the authorization endpoint now.
15
+
#[allow(dead_code)]
16
16
pub client_id: String,
17
17
pub client_metadata: String,
18
+
#[allow(dead_code)]
18
19
pub created_at: String,
19
20
}
20
21
···
44
45
}
45
46
46
47
/// Look up a registered OAuth client by `client_id`. Returns `None` if not found.
47
-
// Wired to handlers when the OAuth authorization flow is implemented.
48
-
#[allow(dead_code)]
49
48
pub async fn get_oauth_client(
50
49
pool: &SqlitePool,
51
50
client_id: &str,
···
66
65
)
67
66
}
68
67
68
+
/// Store a newly generated authorization code.
69
+
///
70
+
/// The code expires 60 seconds after creation (single-use, short-lived per RFC 6749 §4.1.2).
71
+
/// The token endpoint is responsible for consuming and deleting the code on exchange.
72
+
pub async fn store_authorization_code(
73
+
pool: &SqlitePool,
74
+
code: &str,
75
+
client_id: &str,
76
+
did: &str,
77
+
code_challenge: &str,
78
+
code_challenge_method: &str,
79
+
redirect_uri: &str,
80
+
scope: &str,
81
+
) -> Result<(), sqlx::Error> {
82
+
sqlx::query(
83
+
"INSERT INTO oauth_authorization_codes \
84
+
(code, client_id, did, code_challenge, code_challenge_method, redirect_uri, scope, \
85
+
expires_at, created_at) \
86
+
VALUES (?, ?, ?, ?, ?, ?, ?, datetime('now', '+60 seconds'), datetime('now'))",
87
+
)
88
+
.bind(code)
89
+
.bind(client_id)
90
+
.bind(did)
91
+
.bind(code_challenge)
92
+
.bind(code_challenge_method)
93
+
.bind(redirect_uri)
94
+
.bind(scope)
95
+
.execute(pool)
96
+
.await?;
97
+
Ok(())
98
+
}
99
+
100
+
/// Return the DID of the single promoted account on this PDS.
101
+
///
102
+
/// For a single-user PDS there is exactly one account after DID promotion.
103
+
/// Returns `None` when no promoted account exists yet (server not yet set up).
104
+
pub async fn get_single_account_did(pool: &SqlitePool) -> Result<Option<String>, sqlx::Error> {
105
+
let row: Option<(String,)> = sqlx::query_as("SELECT did FROM accounts LIMIT 1")
106
+
.fetch_optional(pool)
107
+
.await?;
108
+
Ok(row.map(|(did,)| did))
109
+
}
110
+
69
111
#[cfg(test)]
70
112
mod tests {
71
113
use super::*;
···
124
166
is_unique_violation(&err),
125
167
"duplicate client_id should be a unique violation"
126
168
);
169
+
}
170
+
171
+
#[tokio::test]
172
+
async fn store_and_retrieve_authorization_code_exists_in_db() {
173
+
let pool = test_pool().await;
174
+
175
+
// Register client and account (FK constraints).
176
+
register_oauth_client(
177
+
&pool,
178
+
"https://app.example.com/client-metadata.json",
179
+
r#"{"redirect_uris":["https://app.example.com/callback"]}"#,
180
+
)
181
+
.await
182
+
.unwrap();
183
+
184
+
sqlx::query(
185
+
"INSERT INTO accounts (did, email, password_hash, created_at, updated_at) \
186
+
VALUES (?, ?, NULL, datetime('now'), datetime('now'))",
187
+
)
188
+
.bind("did:plc:testaccount000000000000")
189
+
.bind("test@example.com")
190
+
.execute(&pool)
191
+
.await
192
+
.unwrap();
193
+
194
+
store_authorization_code(
195
+
&pool,
196
+
"test-code-abc123",
197
+
"https://app.example.com/client-metadata.json",
198
+
"did:plc:testaccount000000000000",
199
+
"e3b0c44298fc1c149afbf4c8996fb924",
200
+
"S256",
201
+
"https://app.example.com/callback",
202
+
"atproto",
203
+
)
204
+
.await
205
+
.unwrap();
206
+
207
+
let row: Option<(String,)> =
208
+
sqlx::query_as("SELECT code FROM oauth_authorization_codes WHERE code = ?")
209
+
.bind("test-code-abc123")
210
+
.fetch_optional(&pool)
211
+
.await
212
+
.unwrap();
213
+
214
+
assert!(row.is_some(), "authorization code should be stored");
215
+
}
216
+
217
+
#[tokio::test]
218
+
async fn get_single_account_did_returns_none_when_no_accounts() {
219
+
let pool = test_pool().await;
220
+
let result = get_single_account_did(&pool).await.unwrap();
221
+
assert!(result.is_none());
222
+
}
223
+
224
+
#[tokio::test]
225
+
async fn get_single_account_did_returns_did_when_account_exists() {
226
+
let pool = test_pool().await;
227
+
let did = "did:plc:testaccount000000000000";
228
+
229
+
sqlx::query(
230
+
"INSERT INTO accounts (did, email, password_hash, created_at, updated_at) \
231
+
VALUES (?, ?, NULL, datetime('now'), datetime('now'))",
232
+
)
233
+
.bind(did)
234
+
.bind("test@example.com")
235
+
.execute(&pool)
236
+
.await
237
+
.unwrap();
238
+
239
+
let result = get_single_account_did(&pool).await.unwrap();
240
+
assert_eq!(result.as_deref(), Some(did));
127
241
}
128
242
}