@atproto/bsky 0.0.246 → 0.0.247

package/src/auth-verifier.ts

@@ -49,6 +49,7 @@ type NullOutput = {
 type StandardOutput = {
   credentials: {
     type: 'standard'
+    /** @note we don't validate this to be a {@link DidString} (we might want to in the future) */
     aud: string
     iss: DidString | `${DidString}#${string}`
   }
@@ -64,8 +65,8 @@ type RoleOutput = {
 type ModServiceOutput = {
   credentials: {
     type: 'mod_service'
-    aud: string
-    iss: string
+    aud: DidString
+    iss: DidString | `${DidString}#${string}`
   }
 }
 
@@ -76,17 +77,17 @@ const ALLOWED_AUTH_SCOPES = new Set([
 ])
 
 export type AuthVerifierOpts = {
-  ownDid: string
-  alternateAudienceDids: string[]
-  modServiceDid: string
+  ownDid: DidString
+  alternateAudienceDids: DidString[]
+  modServiceDid: DidString
   adminPasses: string[]
   entrywayJwtPublicKey?: KeyObject
 }
 
 export class AuthVerifier {
-  public ownDid: string
-  public standardAudienceDids: Set<string>
-  public modServiceDid: string
+  public ownDid: DidString
+  public standardAudienceDids: Set<DidString>
+  public modServiceDid: DidString
   private adminPasses: Set<string>
   private entrywayJwtPublicKey?: KeyObject
 
@@ -138,7 +139,10 @@ export class AuthVerifier {
           iss: null,
           aud: null,
         })
-        if (!opts.skipAudCheck && !this.standardAudienceDids.has(aud)) {
+        if (
+          !opts.skipAudCheck &&
+          !(this.standardAudienceDids as Set<string>).has(aud)
+        ) {
           throw new AuthRequiredError(
             'jwt audience does not match service did',
             'BadJwtAudience',
@@ -299,17 +303,13 @@ export class AuthVerifier {
     return { status: Invalid, admin: false }
   }
 
-  async verifyServiceJwt(
-    reqCtx: ReqCtx,
-    opts: {
+  async verifyServiceJwt<
+    TOptions extends {
       iss: string[] | null
       aud: string | null
       lxmCheck?: (method?: string) => boolean
     },
-  ): Promise<{
-    iss: DidString | `${DidString}#${string}`
-    aud: string
-  }> {
+  >(reqCtx: ReqCtx, opts: TOptions) {
     const getSigningKey = async (
       iss: string,
       _forceRefresh: boolean, // @TODO consider propagating to dataplane
@@ -318,6 +318,10 @@ export class AuthVerifier {
         throw new AuthRequiredError('Untrusted issuer', 'UntrustedIss')
       }
       const [did, serviceId] = iss.split('#')
+      if (!isDidString(did)) {
+        throw new AuthRequiredError('identity unknown')
+      }
+
       const keyId =
         serviceId === 'atproto_labeler' ? 'atproto_label' : 'atproto'
       let identity: GetIdentityByDidResponse
@@ -371,10 +375,16 @@ export class AuthVerifier {
       // we'll allow ozone self-hosters to upgrade before removing this condition.
       assertLxmCheck()
     }
-    return { iss: payload.iss, aud: payload.aud }
+
+    return {
+      iss: payload.iss as (DidString | `${DidString}#${string}`) &
+        (TOptions extends { iss: ReadonlyArray<infer I> } ? I : unknown),
+      aud: payload.aud as string &
+        (TOptions extends { aud: infer A extends string } ? A : unknown),
+    }
   }
 
-  isModService(iss: string): boolean {
+  isModService(iss: string): iss is DidString | `${DidString}#atproto_labeler` {
     return [
       this.modServiceDid,
       `${this.modServiceDid}#atproto_labeler`,

package/src/config.ts

@@ -39,8 +39,8 @@ export interface ServerConfigValues {
   debugMode?: boolean
   port?: number
   publicUrl?: string
-  serverDid: string
-  alternateAudienceDids: string[]
+  serverDid: DidString
+  alternateAudienceDids: DidString[]
   entrywayJwtPublicKeyHex?: string
   liveNowConfig?: LiveNowConfig
   // external services
@@ -76,9 +76,9 @@ export interface ServerConfigValues {
   didPlcUrl: string
   handleResolveNameservers?: string[]
   // moderation and administration
-  modServiceDid: string
+  modServiceDid: DidString
   adminPasswords: string[]
-  labelsFromIssuerDids?: string[]
+  labelsFromIssuerDids?: DidString[]
   indexedAtEpoch?: Date
   // misc/dev
   blobCacheLocation?: string
@@ -124,10 +124,12 @@ export class ServerConfig {
       process.env.NODE_ENV === 'development' || process.env.NODE_ENV === 'test'
     const publicUrl = process.env.BSKY_PUBLIC_URL || undefined
     const serverDid = process.env.BSKY_SERVER_DID || 'did:example:test'
+    assert(isDidString(serverDid))
     const envPort = parseInt(process.env.BSKY_PORT || '', 10)
     const port = isNaN(envPort) ? 2584 : envPort
     const didPlcUrl = process.env.BSKY_DID_PLC_URL || 'http://localhost:2582'
     const alternateAudienceDids = envList(process.env.BSKY_ALT_AUDIENCE_DIDS)
+    assert(alternateAudienceDids.every(isDidString))
     const entrywayJwtPublicKeyHex =
       process.env.BSKY_ENTRYWAY_JWT_PUBLIC_KEY_HEX || undefined
     let liveNowConfig: LiveNowConfig | undefined
@@ -184,6 +186,7 @@ export class ServerConfig {
     const labelsFromIssuerDids = envList(
       process.env.BSKY_LABELS_FROM_ISSUER_DIDS,
     )
+    assert(labelsFromIssuerDids.every(isDidString))
     const bsyncUrl = process.env.BSKY_BSYNC_URL || undefined
     assert(bsyncUrl)
     const bsyncApiKey = process.env.BSKY_BSYNC_API_KEY || undefined
@@ -215,7 +218,7 @@ export class ServerConfig {
       process.env.BSKY_ADMIN_PASSWORDS || process.env.BSKY_ADMIN_PASSWORD,
     )
     const modServiceDid = process.env.MOD_SERVICE_DID
-    assert(modServiceDid)
+    assert(modServiceDid != null && isDidString(modServiceDid))
 
     const eventProxyTrackingEndpoint =
       process.env.BSKY_EVENT_PROXY_TRACKING_ENDPOINT || undefined

package/tests/data-plane/subscription.test.ts

@@ -3,6 +3,7 @@ import { AtpAgent, ids } from '@atproto/api'
 import { cborDecode, cborEncode } from '@atproto/common'
 import { SeedClient, TestNetwork, basicSeed } from '@atproto/dev-env'
 import { sequencer } from '@atproto/pds'
+import type { DidString } from '@atproto/syntax'
 import { DatabaseSchemaType } from '../../src/data-plane/server/db/database-schema.js'
 import { forSnapshot } from '../_util.js'
 
@@ -98,7 +99,7 @@ describe('sync', () => {
 
   async function updateProfile(
     agent: AtpAgent,
-    did: string,
+    did: DidString,
     record: Record<string, unknown>,
   ) {
     return await agent.api.com.atproto.repo.putRecord(

package/tests/data-plane/thread-mutes.test.ts

@@ -1,14 +1,15 @@
 import { afterAll, beforeAll, describe, expect, it } from 'vitest'
 import { AtpAgent, ids } from '@atproto/api'
 import { RecordRef, SeedClient, TestNetwork, usersSeed } from '@atproto/dev-env'
+import type { DidString } from '@atproto/syntax'
 
 describe('thread mutes', () => {
   let network: TestNetwork
   let agent: AtpAgent
   let sc: SeedClient
 
-  let alice: string
-  let bob: string
+  let alice: DidString
+  let bob: DidString
 
   let rootPost: RecordRef
   let replyPost: RecordRef

package/tests/feed-generation.test.ts

@@ -18,6 +18,7 @@ import {
   basicSeed,
 } from '@atproto/dev-env'
 import { SkeletonHandler, app } from '@atproto/pds'
+import type { DidString } from '@atproto/syntax'
 import { AuthRequiredError } from '@atproto/xrpc-server'
 import { forSnapshot, paginateAll } from './_util.js'
 
@@ -28,7 +29,7 @@ describe('feed generation', () => {
   let sc: SeedClient
   let gen: TestFeedGen
 
-  let alice: string
+  let alice: DidString
   let feedUriAll: string
   let feedUriAllRef: RecordRef
   let feedUriEven: string

package/tests/label-hydration.test.ts

@@ -3,17 +3,18 @@ import { afterAll, beforeAll, beforeEach, describe, expect, it } from 'vitest'
 import { AtpAgent } from '@atproto/api'
 import { MINUTE } from '@atproto/common'
 import { SeedClient, TestNetwork, basicSeed } from '@atproto/dev-env'
+import type { DidString } from '@atproto/syntax'
 
 describe('label hydration', () => {
   let network: TestNetwork
   let pdsAgent: AtpAgent
   let sc: SeedClient
 
-  let alice: string
-  let bob: string
-  let carol: string
-  let labelerDid: string
-  let labeler2Did: string
+  let alice: DidString
+  let bob: DidString
+  let carol: DidString
+  let labelerDid: DidString
+  let labeler2Did: DidString
 
   beforeAll(async () => {
     network = await TestNetwork.create({

package/tests/query-labels.test.ts

@@ -1,16 +1,17 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, it } from 'vitest'
 import { AtpAgent } from '@atproto/api'
 import { SeedClient, TestNetwork, basicSeed } from '@atproto/dev-env'
+import type { DidString } from '@atproto/syntax'
 
 describe('label hydration', () => {
   let network: TestNetwork
   let pdsAgent: AtpAgent
   let sc: SeedClient
 
-  let alice: string
-  let bob: string
-  let carol: string
-  let labelerDid: string
+  let alice: DidString
+  let bob: DidString
+  let carol: DidString
+  let labelerDid: DidString
 
   beforeAll(async () => {
     network = await TestNetwork.create({

package/tests/seed/feed-hidden-replies.ts

@@ -1,10 +1,11 @@
 import { SeedClient, TestNetwork, TestNetworkNoAppView } from '@atproto/dev-env'
+import type { DidString, HandleString } from '@atproto/syntax'
 
 export type User = {
   id: string
-  did: string
+  did: DidString
   email: string
-  handle: string
+  handle: HandleString
   password: string
   displayName: string
   description: string

package/tests/seed/get-suggested-starter-packs.ts

@@ -1,10 +1,11 @@
 import { SeedClient, TestNetwork, TestNetworkNoAppView } from '@atproto/dev-env'
+import type { DidString, HandleString } from '@atproto/syntax'
 
 export type User = {
   id: string
-  did: string
+  did: DidString
   email: string
-  handle: string
+  handle: HandleString
   password: string
   displayName: string
   description: string

package/tests/seed/get-trends.ts

@@ -1,10 +1,11 @@
 import { SeedClient, TestNetwork, TestNetworkNoAppView } from '@atproto/dev-env'
+import type { DidString, HandleString } from '@atproto/syntax'
 
 export type User = {
   id: string
-  did: string
+  did: DidString
   email: string
-  handle: string
+  handle: HandleString
   password: string
   displayName: string
   description: string

package/tests/seed/known-followers.ts

@@ -1,8 +1,9 @@
 import { SeedClient, TestNetwork, TestNetworkNoAppView } from '@atproto/dev-env'
+import type { HandleString } from '@atproto/syntax'
 
 export type User = {
   email: string
-  handle: string
+  handle: HandleString
   password: string
   displayName: string
   description: string

package/tests/seed/postgates.ts

@@ -1,10 +1,11 @@
 import { SeedClient, TestNetwork, TestNetworkNoAppView } from '@atproto/dev-env'
+import type { DidString, HandleString } from '@atproto/syntax'
 
 export type User = {
   id: string
-  did: string
+  did: DidString
   email: string
-  handle: string
+  handle: HandleString
   password: string
   displayName: string
   description: string

package/tests/views/account-deactivation.test.ts

@@ -1,13 +1,14 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, it } from 'vitest'
 import { AtpAgent, ids } from '@atproto/api'
 import { SeedClient, TestNetwork, basicSeed } from '@atproto/dev-env'
+import type { DidString } from '@atproto/syntax'
 
 describe('bsky account deactivation', () => {
   let network: TestNetwork
   let agent: AtpAgent
   let sc: SeedClient
 
-  let alice: string
+  let alice: DidString
 
   beforeAll(async () => {
     network = await TestNetwork.create({

package/tests/views/actor-likes.test.ts

@@ -1,6 +1,7 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, it } from 'vitest'
 import { AtUri, AtpAgent, ids } from '@atproto/api'
 import { SeedClient, TestNetwork, basicSeed } from '@atproto/dev-env'
+import type { DidString } from '@atproto/syntax'
 
 describe('bsky actor likes feed views', () => {
   let network: TestNetwork
@@ -9,9 +10,9 @@ describe('bsky actor likes feed views', () => {
   let sc: SeedClient
 
   // account dids, for convenience
-  let alice: string
-  let bob: string
-  let carol: string
+  let alice: DidString
+  let bob: DidString
+  let carol: DidString
 
   beforeAll(async () => {
     network = await TestNetwork.create({

package/tests/views/author-feed.test.ts

@@ -14,6 +14,7 @@ import {
   ids,
 } from '@atproto/api'
 import { SeedClient, TestNetwork, authorFeedSeed } from '@atproto/dev-env'
+import type { DidString } from '@atproto/syntax'
 import { uriToDid } from '../../src/util/uris.js'
 import {
   forSnapshot,
@@ -32,11 +33,11 @@ describe('pds author feed views', () => {
   let sc: SeedClient
 
   // account dids, for convenience
-  let alice: string
-  let bob: string
-  let carol: string
-  let dan: string
-  let eve: string
+  let alice: DidString
+  let bob: DidString
+  let carol: DidString
+  let dan: DidString
+  let eve: DidString
 
   beforeAll(async () => {
     network = await TestNetwork.create({

package/tests/views/block-lists.test.ts

@@ -1,6 +1,7 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, it } from 'vitest'
 import { AtUri, AtpAgent, ids } from '@atproto/api'
 import { RecordRef, SeedClient, TestNetwork, basicSeed } from '@atproto/dev-env'
+import type { DidString } from '@atproto/syntax'
 import { forSnapshot } from '../_util.js'
 
 describe('pds views with blocking from block lists', () => {
@@ -10,10 +11,10 @@ describe('pds views with blocking from block lists', () => {
   let sc: SeedClient
   let aliceReplyToDan: { ref: RecordRef }
 
-  let alice: string
-  let bob: string
-  let carol: string
-  let dan: string
+  let alice: DidString
+  let bob: DidString
+  let carol: DidString
+  let dan: DidString
 
   beforeAll(async () => {
     network = await TestNetwork.create({
@@ -232,7 +233,7 @@ describe('pds views with blocking from block lists', () => {
     )
     expect(
       resDan.data.feed.some((post) =>
-        [bob, carol].includes(post.post.author.did),
+        [bob, carol].includes(post.post.author.did as DidString),
       ),
     ).toBeFalsy()
   })
@@ -616,7 +617,7 @@ describe('pds views with blocking from block lists', () => {
     )
     expect(
       resDan.data.feed.some((post) =>
-        [bob, carol].includes(post.post.author.did),
+        [bob, carol].includes(post.post.author.did as DidString),
       ),
     ).toBeTruthy()
   })
@@ -653,7 +654,7 @@ describe('pds views with blocking from block lists', () => {
     )
     expect(
       resDan.data.feed.some((post) =>
-        [bob, carol].includes(post.post.author.did),
+        [bob, carol].includes(post.post.author.did as DidString),
       ),
     ).toBeTruthy()
   })

package/tests/views/blocks.test.ts

@@ -8,6 +8,7 @@ import {
   ids,
 } from '@atproto/api'
 import { RecordRef, SeedClient, TestNetwork, basicSeed } from '@atproto/dev-env'
+import type { DidString } from '@atproto/syntax'
 import { assertIsThreadViewPost, forSnapshot } from '../_util.js'
 
 describe('pds views with blocking', () => {
@@ -19,10 +20,10 @@ describe('pds views with blocking', () => {
   let aliceReplyToDan: { ref: RecordRef }
   let carolReplyToDan: { ref: RecordRef }
 
-  let alice: string
-  let bob: string
-  let carol: string
-  let dan: string
+  let alice: DidString
+  let bob: DidString
+  let carol: DidString
+  let dan: DidString
   let danBlockUri: string
 
   beforeAll(async () => {

package/tests/views/bookmarks.test.ts

@@ -20,6 +20,7 @@ import {
   ids,
 } from '@atproto/api'
 import { RecordRef, SeedClient, TestNetwork, basicSeed } from '@atproto/dev-env'
+import type { DidString } from '@atproto/syntax'
 import { forSnapshot, paginateAll } from '../_util.js'
 
 type Database = TestNetwork['bsky']['db']
@@ -31,10 +32,10 @@ describe('appview bookmarks views', () => {
   let db: Database
 
   // account dids, for convenience
-  let alice: string
-  let bob: string
-  let carol: string
-  let dan: string
+  let alice: DidString
+  let bob: DidString
+  let carol: DidString
+  let dan: DidString
 
   beforeAll(async () => {
     network = await TestNetwork.create({

package/tests/views/feed-hidden-replies.test.ts

@@ -1,6 +1,7 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, it } from 'vitest'
 import { AtpAgent, ids } from '@atproto/api'
 import { SeedClient, TestNetwork } from '@atproto/dev-env'
+import type { DidString } from '@atproto/syntax'
 import { Users, feedHiddenRepliesSeed } from '../seed/feed-hidden-replies.js'
 
 describe('feed hidden replies', () => {
@@ -44,7 +45,7 @@ describe('feed hidden replies', () => {
           createdAt: new Date().toISOString(),
           hiddenReplies: [B.ref.uriStr],
         },
-        sc.getHeaders(A.ref.uri.host),
+        sc.getHeaders(A.ref.uri.host as DidString),
       )
 
       await network.processAll()
@@ -87,7 +88,7 @@ describe('feed hidden replies', () => {
           createdAt: new Date().toISOString(),
           hiddenReplies: [B.ref.uriStr],
         },
-        sc.getHeaders(A.ref.uri.host),
+        sc.getHeaders(A.ref.uri.host as DidString),
       )
 
       await network.processAll()
@@ -175,7 +176,7 @@ describe('feed hidden replies', () => {
           createdAt: new Date().toISOString(),
           hiddenReplies: [C.ref.uriStr],
         },
-        sc.getHeaders(A.ref.uri.host),
+        sc.getHeaders(A.ref.uri.host as DidString),
       )
       await network.processAll()
       const D = await sc.reply(users.viewer.did, A.ref, C.ref, `D`)
@@ -234,7 +235,7 @@ describe('feed hidden replies', () => {
           repo: A.ref.uri.host,
           rkey: A.ref.uri.rkey,
         },
-        sc.getHeaders(A.ref.uri.host),
+        sc.getHeaders(A.ref.uri.host as DidString),
       )
       await network.processAll()
     })

package/tests/views/feed-view-post.test.ts

@@ -2,6 +2,7 @@ import assert from 'node:assert'
 import { afterAll, beforeAll, beforeEach, describe, expect, it } from 'vitest'
 import { AppBskyFeedDefs, AtUri, AtpAgent, ids } from '@atproto/api'
 import { SeedClient, TestNetwork, basicSeed } from '@atproto/dev-env'
+import type { DidString } from '@atproto/syntax'
 
 /**
  * The frontend computes feed slices for display using at-most one
@@ -23,10 +24,10 @@ describe('pds thread views', () => {
   let sc: SeedClient
 
   // account dids, for convenience
-  let alice: string
-  let bob: string
-  let carol: string
-  let dan: string
+  let alice: DidString
+  let bob: DidString
+  let carol: DidString
+  let dan: DidString
 
   beforeAll(async () => {
     network = await TestNetwork.create({

package/tests/views/get-suggested-onboarding-users.test.ts

@@ -11,12 +11,13 @@ import {
   ids,
 } from '@atproto/api'
 import { SeedClient, TestNetwork } from '@atproto/dev-env'
+import type { DidString, HandleString } from '@atproto/syntax'
 
 type User = {
   id: string
-  did: string
+  did: DidString
   email: string
-  handle: string
+  handle: HandleString
   password: string
   displayName: string
   description: string

package/tests/views/internal-actor.test.ts

@@ -1,6 +1,7 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, it } from 'vitest'
 import { AppBskyActorDefs, AtpAgent } from '@atproto/api'
 import { SeedClient, TestNetwork } from '@atproto/dev-env'
+import type { DidString } from '@atproto/syntax'
 import { knownFollowersSeed } from '../seed/known-followers.js'
 
 describe('internal actor views', () => {
@@ -8,7 +9,7 @@ describe('internal actor views', () => {
   let pdsAgent: AtpAgent
   let seedClient: SeedClient
 
-  let dids: Record<string, string>
+  let dids: Record<string, DidString>
 
   beforeAll(async () => {
     network = await TestNetwork.create({

package/tests/views/known-followers.test.ts

@@ -1,6 +1,7 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, it } from 'vitest'
 import { AtpAgent, ids } from '@atproto/api'
 import { SeedClient, TestNetwork } from '@atproto/dev-env'
+import type { DidString } from '@atproto/syntax'
 import { knownFollowersSeed } from '../seed/known-followers.js'
 
 describe('known followers (social proof)', () => {
@@ -9,7 +10,7 @@ describe('known followers (social proof)', () => {
   let pdsAgent: AtpAgent
   let seedClient: SeedClient
 
-  let dids: Record<string, string>
+  let dids: Record<string, DidString>
 
   beforeAll(async () => {
     network = await TestNetwork.create({

package/tests/views/labeler-service.test.ts

@@ -8,6 +8,7 @@ import {
   ids,
 } from '@atproto/api'
 import { RecordRef, SeedClient, TestNetwork, basicSeed } from '@atproto/dev-env'
+import type { DidString } from '@atproto/syntax'
 import { forSnapshot, stripViewerFromLabeler } from '../_util.js'
 
 describe('labeler service views', () => {
@@ -17,9 +18,9 @@ describe('labeler service views', () => {
   let sc: SeedClient
 
   // account dids, for convenience
-  let alice: string
-  let bob: string
-  let carol: string
+  let alice: DidString
+  let bob: DidString
+  let carol: DidString
 
   let aliceService: RecordRef
 

package/tests/views/likes.test.ts

@@ -1,6 +1,7 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, it } from 'vitest'
 import { AppBskyFeedGetLikes, AtpAgent, ids } from '@atproto/api'
 import { SeedClient, TestNetwork, likesSeed } from '@atproto/dev-env'
+import type { DidString } from '@atproto/syntax'
 import {
   constantDate,
   forSnapshot,
@@ -14,10 +15,10 @@ describe('pds like views', () => {
   let sc: SeedClient
 
   // account dids, for convenience
-  let alice: string
-  let bob: string
-  let carol: string
-  let frankie: string
+  let alice: DidString
+  let bob: DidString
+  let carol: DidString
+  let frankie: DidString
 
   beforeAll(async () => {
     network = await TestNetwork.create({