testDpopProofsVerify

tcmts.atproto.test.testDpopProofsVerify · #get7kbfw · term

import { dpopProof } from "#codebase/tcmts/atproto";
import crypto from "node:crypto";

export const testDpopProofsVerify = () => {
  const pair = crypto.generateKeyPairSync("ec", { namedCurve: "P-256" });
  const key = pair.privateKey.export({ format: "jwk" });
  const jwt = dpopProof(key, "POST", "https://pds.example/xrpc/x?y=1#z", "n1", "tok");
  const [h, p, sig] = jwt.split(".") as [string, string, string];
  const header = JSON.parse(Buffer.from(h, "base64url").toString()) as {
    typ: string;
    alg: string;
    jwk: crypto.JsonWebKey;
  };
  const payload = JSON.parse(Buffer.from(p, "base64url").toString()) as Record<string, unknown>;
  if (header.typ !== "dpop+jwt" || header.alg !== "ES256" || "d" in header.jwk)
    throw new Error(JSON.stringify(header));
  if (
    payload.htm !== "POST" ||
    payload.htu !== "https://pds.example/xrpc/x" ||
    payload.nonce !== "n1"
  )
    throw new Error(JSON.stringify(payload));
  if (payload.ath !== crypto.createHash("sha256").update("tok").digest("base64url"))
    throw new Error("ath");
  const ok = crypto.verify(
    "sha256",
    Buffer.from(`${h}.${p}`),
    { key: crypto.createPublicKey({ key: header.jwk, format: "jwk" }), dsaEncoding: "ieee-p1363" },
    Buffer.from(sig, "base64url"),
  );
  if (!ok) throw new Error("the proof's signature doesn't verify with its key");
}

uses

• tcmts.atproto.dpopProof