@atproto/bsky 0.0.251 → 0.0.253

package/src/api/kws/api.ts

@@ -1,113 +0,0 @@
-import express, { RequestHandler } from 'express'
-import { httpLogger as log } from '../../logger.js'
-import { AGE_ASSURANCE_CONFIG } from '../age-assurance/const.js'
-import {
-  KWSExternalPayloadVersion,
-  parseKWSExternalPayloadV1WithV2Compat,
-} from '../age-assurance/kws/external-payload.js'
-import { createEvent } from '../age-assurance/stash.js'
-import { computeAgeAssuranceAccessOrThrow } from '../age-assurance/util.js'
-import { AppContextWithKwsClient } from './types.js'
-import {
-  createStashEvent,
-  getClientUa,
-  parseStatus,
-  validateSignature,
-} from './util.js'
-
-function parseQueryParams(
-  ctx: AppContextWithKwsClient,
-  req: express.Request,
-): {
-  status: string
-  externalPayload: string
-} {
-  try {
-    const status = String(req.query.status)
-    const externalPayload = String(req.query.externalPayload)
-    const signature = String(req.query.signature)
-
-    validateSignature(
-      ctx.cfg.kws.verificationSecret,
-      `${status}:${externalPayload}`,
-      signature,
-    )
-
-    return {
-      status,
-      externalPayload,
-    }
-  } catch (err) {
-    throw new Error('Invalid KWS API request', { cause: err })
-  }
-}
-
-export const verificationHandler =
-  (ctx: AppContextWithKwsClient): RequestHandler =>
-  async (req: express.Request, res: express.Response) => {
-    let actorDid: string | undefined
-    try {
-      const query = parseQueryParams(ctx, req)
-      const { verified } = parseStatus(query.status)
-      if (!verified) {
-        throw new Error(
-          'Unexpected KWS verification response call with unverified status',
-        )
-      }
-
-      // Assumes `app.set('trust proxy', ...)` configured with `true` or specific values.
-      const completeIp = req.ip
-      const completeUa = getClientUa(req)
-      const externalPayload = parseKWSExternalPayloadV1WithV2Compat(
-        query.externalPayload,
-      )
-      actorDid = externalPayload.actorDid
-
-      if (externalPayload.version === KWSExternalPayloadVersion.V2) {
-        const { countryCode, regionCode, attemptId } = externalPayload
-        const { access } = computeAgeAssuranceAccessOrThrow(
-          AGE_ASSURANCE_CONFIG,
-          {
-            countryCode: countryCode,
-            regionCode: regionCode,
-            verifiedMinimumAge: 18, // `adult-verified` is 18+ only
-          },
-        )
-        await createEvent(ctx, actorDid, {
-          attemptId,
-          status: 'assured',
-          access,
-          countryCode,
-          regionCode,
-          completeIp,
-          completeUa,
-        })
-      } else {
-        await createStashEvent(ctx, {
-          actorDid,
-          attemptId: externalPayload.attemptId,
-          status: 'assured',
-          completeIp,
-          completeUa,
-        })
-      }
-
-      return res
-        .status(302)
-        .setHeader(
-          'Location',
-          `${ctx.cfg.kws.redirectUrl}?${new URLSearchParams({ actorDid, result: 'success' })}`,
-        )
-        .end()
-    } catch (err) {
-      log.error({ err }, 'Failed to handle KWS verification response')
-
-      return res
-        .status(302)
-        .setHeader(
-          'Location',
-          `${ctx.cfg.kws.redirectUrl}?${new URLSearchParams({ ...(actorDid ? { actorDid } : {}), result: 'unknown' })}`,
-        )
-        .end()
-    }
-  }

package/src/api/kws/index.ts

@@ -1,29 +0,0 @@
-import { Router, raw } from 'express'
-import { AppContext } from '../../context.js'
-import { verificationHandler } from './api.js'
-import { AppContextWithKwsClient } from './types.js'
-import { webhookAuth, webhookHandler } from './webhook.js'
-
-export const createRouter = (ctx: AppContext): Router => {
-  assertAppContextWithAgeAssuranceClient(ctx)
-
-  const router = Router()
-  router.use(raw({ type: 'application/json' }))
-  router.post(
-    '/age-assurance-webhook',
-    webhookAuth({
-      secret: ctx.cfg.kws.webhookSecret,
-    }),
-    webhookHandler(ctx),
-  )
-  router.get('/age-assurance-verification', verificationHandler(ctx))
-  return router
-}
-
-const assertAppContextWithAgeAssuranceClient: (
-  ctx: AppContext,
-) => asserts ctx is AppContextWithKwsClient = (ctx: AppContext) => {
-  if (!ctx.kwsClient) {
-    throw new Error('Tried to set up KWS router without kwsClient configured.')
-  }
-}

package/src/api/kws/types.ts

@@ -1,78 +0,0 @@
-import { z } from 'zod'
-import { KwsConfig, ServerConfig } from '../../config.js'
-import { AppContext } from '../../context.js'
-import { KwsClient } from '../../kws.js'
-
-export type AppContextWithKwsClient = AppContext & {
-  kwsClient: KwsClient
-  cfg: ServerConfig & {
-    kws: KwsConfig
-  }
-}
-
-export type KwsExternalPayload = {
-  actorDid: string
-  attemptId: string
-}
-
-// `.strict()` because we control the payload structure.
-export const externalPayloadSchema = z
-  .object({
-    actorDid: z.string(),
-    attemptId: z.string(),
-  })
-  .strict()
-
-export type KwsStatus = {
-  verified: boolean
-  // A unique reference ID for the verification transaction.
-  transactionId?: string
-  // A code indicating the reason for failure, or null when verification
-  // succeeded.
-  errorCode?: string | null
-  // Epoch seconds indicating when KWS generated the payload. Optional so we
-  // remain compatible with payloads sent before this field was introduced.
-  timestamp?: number
-}
-
-export type KwsVerificationIntermediateQuery = {
-  externalPayload: string
-  status: string
-  signature: string
-}
-
-// Not `.strict()` to avoid breaking if KWS adds fields.
-export const verificationIntermediateQuerySchema = z.object({
-  externalPayload: z.string(),
-  signature: z.string(),
-  status: z.string(),
-})
-
-export type KwsVerificationQuery = {
-  externalPayload: KwsExternalPayload
-  signature: string
-  status: KwsStatus
-}
-
-export type KwsWebhookBody = {
-  payload: {
-    externalPayload: KwsExternalPayload
-    status: KwsStatus
-  }
-}
-
-// Not `.strict()` to avoid breaking if KWS adds fields.
-export const statusSchema = z.object({
-  verified: z.boolean(),
-  transactionId: z.string().optional(),
-  errorCode: z.string().nullable().optional(),
-  timestamp: z.number().optional(),
-})
-
-// Not `.strict()` to avoid breaking if KWS adds fields.
-export const webhookBodyIntermediateSchema = z.object({
-  payload: z.object({
-    externalPayload: z.string(),
-    status: statusSchema,
-  }),
-})

package/src/api/kws/util.test.ts

@@ -1,50 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { parseStatus } from './util.js'
-
-describe('parseStatus', () => {
-  it('parses a minimal status object', () => {
-    const raw = JSON.stringify({ verified: true })
-    expect(parseStatus(raw)).toEqual({ verified: true })
-  })
-
-  it('parses the optional transactionId, errorCode, and timestamp fields', () => {
-    const raw = JSON.stringify({
-      verified: true,
-      transactionId: 'txn-123',
-      errorCode: null,
-      timestamp: 1750680000,
-    })
-    expect(parseStatus(raw)).toEqual({
-      verified: true,
-      transactionId: 'txn-123',
-      errorCode: null,
-      timestamp: 1750680000,
-    })
-  })
-
-  it('parses a non-null errorCode', () => {
-    const raw = JSON.stringify({ verified: false, errorCode: 'some-failure' })
-    expect(parseStatus(raw)).toEqual({
-      verified: false,
-      errorCode: 'some-failure',
-    })
-  })
-
-  it('silently strips unknown fields KWS may add', () => {
-    const raw = JSON.stringify({
-      verified: true,
-      timestamp: 1750680000,
-      somethingNew: 'ignored',
-    })
-    expect(parseStatus(raw)).toEqual({ verified: true, timestamp: 1750680000 })
-  })
-
-  it('throws on malformed JSON', () => {
-    expect(() => parseStatus('not json')).toThrow(/Invalid status/)
-  })
-
-  it('throws when verified is missing', () => {
-    const raw = JSON.stringify({ timestamp: 1750680000 })
-    expect(() => parseStatus(raw)).toThrow(/Invalid status/)
-  })
-})

package/src/api/kws/util.ts

@@ -1,109 +0,0 @@
-import crypto from 'node:crypto'
-import express from 'express'
-import { TID } from '@atproto/common'
-import { DatetimeString } from '@atproto/syntax'
-import { AppContext } from '../../context.js'
-import { app } from '../../lexicons/index.js'
-import { Namespaces } from '../../stash.js'
-import {
-  KwsExternalPayload,
-  KwsStatus,
-  externalPayloadSchema,
-  statusSchema,
-} from './types.js'
-
-export const createStashEvent = async (
-  ctx: AppContext,
-  {
-    actorDid,
-    attemptId,
-    email,
-    initIp,
-    initUa,
-    completeIp,
-    completeUa,
-    status,
-  }: {
-    actorDid: string
-    attemptId: string
-    email?: string
-    initIp?: string
-    initUa?: string
-    completeIp?: string
-    completeUa?: string
-    status: app.bsky.unspecced.defs.AgeAssuranceState['status']
-  },
-) => {
-  const stashPayload: app.bsky.unspecced.defs.AgeAssuranceEvent = {
-    createdAt: new Date().toISOString() as DatetimeString,
-    email,
-    status,
-    attemptId,
-    initIp,
-    initUa,
-    completeIp,
-    completeUa,
-  }
-
-  await ctx.stashClient.create({
-    actorDid,
-    namespace: Namespaces.AppBskyUnspeccedDefsAgeAssuranceEvent,
-    key: TID.nextStr(),
-    payload: stashPayload,
-  })
-  return stashPayload
-}
-
-export const validateSignature = (
-  key: string,
-  data: string,
-  signature: string,
-) => {
-  const expectedSignature = crypto
-    .createHmac('sha256', key)
-    .update(data)
-    .digest('hex')
-
-  const expectedSignatureBuf = Buffer.from(expectedSignature, 'hex')
-  const actualSignatureBuf = Buffer.from(signature, 'hex')
-
-  if (expectedSignatureBuf.length !== actualSignatureBuf.length) {
-    throw new Error(`Signature mismatch`)
-  }
-
-  if (!crypto.timingSafeEqual(expectedSignatureBuf, actualSignatureBuf)) {
-    throw new Error(`Signature mismatch`)
-  }
-}
-
-export const serializeExternalPayload = (value: KwsExternalPayload): string => {
-  return JSON.stringify(value)
-}
-
-export const parseExternalPayload = (
-  serialized: string,
-): KwsExternalPayload => {
-  try {
-    const value: unknown = JSON.parse(serialized)
-    return externalPayloadSchema.parse(value)
-  } catch (err) {
-    throw new Error(`Invalid external payload: ${serialized}`, { cause: err })
-  }
-}
-
-export const parseStatus = (serialized: string): KwsStatus => {
-  try {
-    const value: unknown = JSON.parse(serialized)
-    return statusSchema.parse(value)
-  } catch (err) {
-    throw new Error(`Invalid status: ${serialized}`, { cause: err })
-  }
-}
-
-export const kwsWwwAuthenticate = (): Record<string, string> => ({
-  'www-authenticate': `Signature realm="kws"`,
-})
-
-export const getClientUa = (req: express.Request): string | undefined => {
-  return req.headers['user-agent']
-}

package/src/api/kws/webhook.ts

@@ -1,134 +0,0 @@
-import express, { RequestHandler } from 'express'
-import { httpLogger as log } from '../../logger.js'
-import { AGE_ASSURANCE_CONFIG } from '../age-assurance/const.js'
-import {
-  KWSExternalPayloadVersion,
-  parseKWSExternalPayloadV1WithV2Compat,
-} from '../age-assurance/kws/external-payload.js'
-import { createEvent } from '../age-assurance/stash.js'
-import { computeAgeAssuranceAccessOrThrow } from '../age-assurance/util.js'
-import {
-  AppContextWithKwsClient,
-  KwsWebhookBody,
-  webhookBodyIntermediateSchema,
-} from './types.js'
-import {
-  createStashEvent,
-  kwsWwwAuthenticate,
-  validateSignature,
-} from './util.js'
-
-export const webhookAuth =
-  ({ secret }: { secret: string }): RequestHandler =>
-  (req: express.Request, res: express.Response, next: express.NextFunction) => {
-    const body: Buffer = req.body
-    const sigHeader = req.headers['x-kws-signature']
-    if (!sigHeader || typeof sigHeader !== 'string') {
-      return res.status(401).header(kwsWwwAuthenticate()).json({
-        success: false,
-        error:
-          'Invalid authentication for KWS webhook: missing signature header',
-      })
-    }
-
-    try {
-      const parts = sigHeader.split(',')
-      const timestamp = parts.find((p) => p.startsWith('t='))?.split('=')[1]
-      const signature = parts.find((p) => p.startsWith('v1='))?.split('=')[1]
-      if (typeof timestamp !== 'string' || typeof signature !== 'string') {
-        throw new Error('Invalid webhook signature format')
-      }
-
-      const data = `${timestamp}.${body}`
-      validateSignature(secret, data, signature)
-      next()
-    } catch (err) {
-      log.error({ err }, 'Invalid KWS webhook signature')
-      return res.status(401).header(kwsWwwAuthenticate()).json({
-        success: false,
-        error: 'Invalid authentication for KWS webhook: signature mismatch',
-      })
-    }
-  }
-
-type AgeAssuranceWebhookIntermediateBody = {
-  payload: Omit<KwsWebhookBody['payload'], 'externalPayload'> & {
-    externalPayload: string
-  }
-}
-
-const parseBody = (serialized: string): AgeAssuranceWebhookIntermediateBody => {
-  try {
-    const value: unknown = JSON.parse(serialized)
-    return webhookBodyIntermediateSchema.parse(value)
-  } catch (err) {
-    throw new Error(`Invalid webhook body: ${serialized}`, { cause: err })
-  }
-}
-
-export const webhookHandler =
-  (ctx: AppContextWithKwsClient): RequestHandler =>
-  async (req: express.Request, res: express.Response) => {
-    let body: AgeAssuranceWebhookIntermediateBody
-    try {
-      body = parseBody(req.body)
-    } catch (err) {
-      log.error({ err }, 'Invalid KWS webhook body')
-      return res.status(400).json(err)
-    }
-
-    const { verified } = body.payload.status
-    if (!verified) {
-      throw new Error('Unexpected KWS webhook call with unverified status')
-    }
-
-    const externalPayload = parseKWSExternalPayloadV1WithV2Compat(
-      body.payload.externalPayload,
-    )
-    const isV2 = externalPayload.version === KWSExternalPayloadVersion.V2
-
-    let result: ReturnType<typeof computeAgeAssuranceAccessOrThrow> | undefined
-    if (isV2) {
-      const { attemptId, actorDid, countryCode, regionCode } = externalPayload
-      try {
-        result = computeAgeAssuranceAccessOrThrow(AGE_ASSURANCE_CONFIG, {
-          countryCode: countryCode,
-          regionCode: regionCode,
-          verifiedMinimumAge: 18, // `adult-verified` is 18+ only
-        })
-      } catch (err) {
-        // internal errors
-        log.error(
-          { err, attemptId, actorDid, countryCode, regionCode },
-          'Failed to compute age assurance access',
-        )
-      }
-    }
-
-    try {
-      if (isV2) {
-        if (result) {
-          const { attemptId, actorDid, countryCode, regionCode } =
-            externalPayload
-          await createEvent(ctx, actorDid, {
-            attemptId,
-            status: 'assured',
-            access: result.access,
-            countryCode,
-            regionCode,
-          })
-        } // else do nothing
-      } else {
-        const { attemptId, actorDid } = externalPayload
-        await createStashEvent(ctx, {
-          attemptId: attemptId,
-          actorDid: actorDid,
-          status: 'assured',
-        })
-      }
-      return res.status(200).end()
-    } catch (err) {
-      log.error({ err }, 'Failed to handle KWS webhook')
-      return res.status(500).json(err)
-    }
-  }

package/src/api/sitemap.ts

@@ -1,76 +0,0 @@
-import { Readable } from 'node:stream'
-import { Timestamp } from '@bufbuild/protobuf'
-import { Code, ConnectError } from '@connectrpc/connect'
-import express, { RequestHandler, Router } from 'express'
-import { AppContext } from '../context.js'
-import { httpLogger as log } from '../logger.js'
-import { SitemapPageType } from '../proto/bsky_pb.js'
-
-export const createRouter = (ctx: AppContext): Router => {
-  const router = Router()
-  router.get('/external/sitemap/users.xml.gz', userIndexHandler(ctx))
-  router.get(
-    '/external/sitemap/users/:date/:bucket.xml.gz',
-    userPageHandler(ctx),
-  )
-  return router
-}
-
-const userIndexHandler =
-  (ctx: AppContext): RequestHandler =>
-  async (_req: express.Request, res: express.Response) => {
-    try {
-      const result = await ctx.dataplane.getSitemapIndex({
-        type: SitemapPageType.USER,
-      })
-      res.set('Content-Type', 'application/gzip')
-      res.set('Content-Encoding', 'gzip')
-      Readable.from(Buffer.from(result.sitemap)).pipe(res)
-    } catch (err) {
-      log.error({ err }, 'failed to get sitemap index')
-      return res.status(500).send('Internal Server Error')
-    }
-  }
-
-const userPageHandler =
-  (ctx: AppContext): RequestHandler =>
-  async (req: express.Request, res: express.Response) => {
-    const { date, bucket } = req.params
-
-    // Parse date (YYYY-MM-DD format)
-    const dateParts = date.split('-')
-    if (dateParts.length !== 3) {
-      return res.status(400).send('Invalid date format. Expected YYYY-MM-DD')
-    }
-
-    const year = parseInt(dateParts[0], 10)
-    const month = parseInt(dateParts[1], 10)
-    const day = parseInt(dateParts[2], 10)
-
-    if (isNaN(year) || isNaN(month) || isNaN(day)) {
-      return res.status(400).send('Invalid date format. Expected YYYY-MM-DD')
-    }
-
-    // Parse bucket (1-indexed)
-    const bucketNum = parseInt(bucket, 10)
-    if (isNaN(bucketNum) || bucketNum < 1) {
-      return res.status(400).send('Invalid bucket number')
-    }
-
-    try {
-      const result = await ctx.dataplane.getSitemapPage({
-        type: SitemapPageType.USER,
-        date: Timestamp.fromDate(new Date(year, month - 1, day)),
-        bucket: bucketNum,
-      })
-      res.set('Content-Type', 'application/gzip')
-      res.set('Content-Encoding', 'gzip')
-      Readable.from(Buffer.from(result.sitemap)).pipe(res)
-    } catch (err) {
-      if (err instanceof ConnectError && err.code === Code.NotFound) {
-        return res.status(404).send('Sitemap page not found')
-      }
-      log.error({ err }, 'failed to get sitemap page')
-      return res.status(500).send('Internal Server Error')
-    }
-  }

package/src/api/util.ts

@@ -1,45 +0,0 @@
-import { IncomingHttpHeaders } from 'node:http'
-import { ServerConfig } from '../config.js'
-import { ParsedLabelers, formatLabelerHeader } from '../util.js'
-
-export const BSKY_USER_AGENT = 'BskyAppView'
-export const ATPROTO_CONTENT_LABELERS = 'Atproto-Content-Labelers'
-export const ATPROTO_REPO_REV = 'Atproto-Repo-Rev'
-
-type ResHeaderOpts = {
-  labelers: ParsedLabelers
-  repoRev: string | null
-}
-
-export const resHeaders = (
-  opts: Partial<ResHeaderOpts>,
-): Record<string, string> => {
-  const headers = {}
-  if (opts.labelers) {
-    headers[ATPROTO_CONTENT_LABELERS] = formatLabelerHeader(opts.labelers)
-  }
-  if (opts.repoRev) {
-    headers[ATPROTO_REPO_REV] = opts.repoRev
-  }
-  return headers
-}
-
-export const clearlyBadCursor = (cursor?: string) => {
-  // hallmark of v1 cursor, highly unlikely in v2 cursors based on time or rkeys
-  return !!cursor?.includes('::')
-}
-
-// @TEMPORARY backdoor to force search v2 via a request header, gated by the
-// BSKY_SEARCH_V2_OVERRIDE_HEADER env var. Remove once search v2 is fully rolled out.
-const SEARCH_V2_OVERRIDE_HEADER = 'x-bsky-search-v2-override'
-
-export const resolveSearchV2Override = (
-  req: { headers: IncomingHttpHeaders },
-  cfg: ServerConfig,
-): boolean => {
-  const expected = cfg.searchV2OverrideHeader
-  if (!expected) return false
-  const value = req.headers[SEARCH_V2_OVERRIDE_HEADER]
-  const header = Array.isArray(value) ? value.join(',') : value
-  return header === expected
-}

package/src/api/well-known.ts

@@ -1,44 +0,0 @@
-import { Router } from 'express'
-import { didWebToUrl, isDidWeb } from '@atproto/did'
-import { AppContext } from '../context.js'
-
-export const createRouter = (ctx: AppContext): Router => {
-  const router = Router()
-
-  const did = ctx.cfg.serverDid
-  if (isDidWeb(did)) {
-    const serviceEndpoint = didWebToUrl(did).origin
-
-    router.get('/.well-known/did.json', (_req, res) => {
-      res.json({
-        '@context': [
-          'https://www.w3.org/ns/did/v1',
-          'https://w3id.org/security/multikey/v1',
-        ],
-        id: did,
-        verificationMethod: [
-          {
-            id: `${did}#atproto`,
-            type: 'Multikey',
-            controller: did,
-            publicKeyMultibase: ctx.signingKey.did().replace('did:key:', ''),
-          },
-        ],
-        service: [
-          {
-            id: '#bsky_notif',
-            type: 'BskyNotificationService',
-            serviceEndpoint,
-          },
-          {
-            id: '#bsky_appview',
-            type: 'BskyAppView',
-            serviceEndpoint,
-          },
-        ],
-      })
-    })
-  }
-
-  return router
-}