Skip to content

draft: check redirect url #1021

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
alexdln wants to merge 4 commits into from
Closed

draft: check redirect url #1021

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
5c11dbc
draft: check redirect url
alexdln Feb 5, 2026
b2e167e
draft: check api route
alexdln Feb 5, 2026
62e4056
draft: check auth state
alexdln Feb 5, 2026
98df155
draft: check client metadata
alexdln Feb 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
74 changes: 1 addition & 73 deletions server/api/auth/atproto.get.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,12 @@
import { Agent } from '@atproto/api'

Check failure on line 1 in server/api/auth/atproto.get.ts

View workflow job for this annotation

GitHub Actions / 💪 Type check 

'Agent' is declared but its value is never read.
import { NodeOAuthClient } from '@atproto/oauth-client-node'

Check failure on line 2 in server/api/auth/atproto.get.ts

View workflow job for this annotation

GitHub Actions / 💪 Type check 

'NodeOAuthClient' is declared but its value is never read.
import { createError, getQuery, sendRedirect } from 'h3'

Check failure on line 3 in server/api/auth/atproto.get.ts

View workflow job for this annotation

GitHub Actions / 💪 Type check 

'sendRedirect' is declared but its value is never read.
import { getOAuthLock } from '#server/utils/atproto/lock'

Check failure on line 4 in server/api/auth/atproto.get.ts

View workflow job for this annotation

GitHub Actions / 💪 Type check 

'getOAuthLock' is declared but its value is never read.
import { useOAuthStorage } from '#server/utils/atproto/storage'

Check failure on line 5 in server/api/auth/atproto.get.ts

View workflow job for this annotation

GitHub Actions / 💪 Type check 

'useOAuthStorage' is declared but its value is never read.
import { SLINGSHOT_HOST } from '#shared/utils/constants'

Check failure on line 6 in server/api/auth/atproto.get.ts

View workflow job for this annotation

GitHub Actions / 💪 Type check 

'SLINGSHOT_HOST' is declared but its value is never read.
import { useServerSession } from '#server/utils/server-session'

Check failure on line 7 in server/api/auth/atproto.get.ts

View workflow job for this annotation

GitHub Actions / 💪 Type check 

'useServerSession' is declared but its value is never read.
import type { PublicUserSession } from '#shared/schemas/publicUserSession'

Check failure on line 8 in server/api/auth/atproto.get.ts

View workflow job for this annotation

GitHub Actions / 💪 Type check 

'PublicUserSession' is declared but its value is never read.
import { handleResolver } from '#server/utils/atproto/oauth'

Check failure on line 9 in server/api/auth/atproto.get.ts

View workflow job for this annotation

GitHub Actions / 💪 Type check 

'handleResolver' is declared but its value is never read.
import { Client } from '@atproto/lex'
import * as app from '#shared/types/lexicons/app'
import { ensureValidAtIdentifier } from '@atproto/syntax'
Expand All @@ -17,7 +17,7 @@
* @param pds
* @returns
*/
async function getAvatar(did: string, pds: string) {

Check failure on line 20 in server/api/auth/atproto.get.ts

View workflow job for this annotation

GitHub Actions / 💪 Type check 

'getAvatar' is declared but its value is never read.
let avatar: string | undefined
try {
const pdsUrl = new URL(pds)
Expand Down Expand Up @@ -54,77 +54,5 @@

const query = getQuery(event)
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot Feb 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Remove the unused query variable to fix the lint warning.

Line 55 declares query but never uses it; this is already flagged by ESLint.

Suggested fix 
-  const query = getQuery(event)
+  // const query = getQuery(event) // remove if not needed
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
const query = getQuery(event)
// const query = getQuery(event) // remove if not needed
Suggested change
const query = getQuery(event)
🧰 Tools
🪛 GitHub Actions: autofix.ci

[warning] 55-55: ESLint: 'query' is declared but never used. (no-unused-vars) - Consider renaming to _query or using it.

const clientMetadata = getOauthClientMetadata()
const session = await useServerSession(event)
const { stateStore, sessionStore } = useOAuthStorage(session)

const atclient = new NodeOAuthClient({
stateStore,
sessionStore,
clientMetadata,
requestLock: getOAuthLock(),
handleResolver,
})

if (!query.code) {
try {
const handle = query.handle?.toString()
const create = query.create?.toString()

if (!handle) {
throw createError({
statusCode: 401,
message: 'Handle not provided in query',
})
}

const redirectUrl = await atclient.authorize(handle, {
scope,
prompt: create ? 'create' : undefined,
})
return sendRedirect(event, redirectUrl.toString())
} catch (error) {
const message = error instanceof Error ? error.message : 'Authentication failed.'

return handleApiError(error, {
statusCode: 401,
message: `${message}. Please login and try again.`,
})
}
}

const { session: authSession } = await atclient.callback(
new URLSearchParams(query as Record<string, string>),
)
const agent = new Agent(authSession)
event.context.agent = agent

const response = await fetch(
`https://${SLINGSHOT_HOST}/xrpc/com.bad-example.identity.resolveMiniDoc?identifier=${agent.did}`,
{ headers: { 'User-Agent': 'npmx' } },
)
if (response.ok) {
const miniDoc: PublicUserSession = await response.json()

let avatar: string | undefined = await getAvatar(authSession.did, miniDoc.pds)

await session.update({
public: {
...miniDoc,
avatar,
},
})
} else {
//If slingshot fails we still want to set some key info we need.
const pdsBase = (await authSession.getTokenInfo()).aud
let avatar: string | undefined = await getAvatar(authSession.did, pdsBase)
await session.update({
public: {
did: authSession.did,
handle: 'Not available',
pds: pdsBase,
avatar,
},
})
}
return sendRedirect(event, '/')
return clientMetadata
})
Loading