dpopProof

tcmts.atproto.dpopProof · #egft4z22 · term · runs on the server

uses node:crypto

A DPoP proof for a request: signed with the key, over its method and URL (and the access token, sent with it).

import { b64url } from "#codebase/tcmts/atproto";
import crypto from "node:crypto";

export function dpopProof(
  key: crypto.JsonWebKey,
  method: string,
  url: string,
  nonce?: string,
  accessToken?: string,
): string {
  const { kty, crv, x, y } = key;
  const u = new URL(url);
  u.search = "";
  u.hash = "";
  const header = { typ: "dpop+jwt", alg: "ES256", jwk: { kty, crv, x, y } };
  const payload = {
    jti: crypto.randomUUID(),
    htm: method,
    htu: u.href,
    iat: Math.floor(Date.now() / 1000),
    ...(nonce ? { nonce } : {}),
    ...(accessToken
      ? { ath: b64url(crypto.createHash("sha256").update(accessToken).digest()) }
      : {}),
  };
  const input = `${b64url(JSON.stringify(header))}.${b64url(JSON.stringify(payload))}`;
  const signature = crypto.sign("sha256", Buffer.from(input), {
    key: crypto.createPrivateKey({ key, format: "jwk" }),
    dsaEncoding: "ieee-p1363",
  });
  return `${input}.${b64url(signature)}`;
}

uses

used by