@atproto/bsky 0.0.251 → 0.0.253

package/src/api/age-assurance/kws/external-payload.test.ts

@@ -1,72 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import {
-  KWSExternalPayloadVersion,
-  parseKWSExternalPayloadV1WithV2Compat,
-  parseKWSExternalPayloadV2,
-  parseKWSExternalPayloadVersion,
-  serializeKWSExternalPayloadV1,
-  serializeKWSExternalPayloadV2,
-} from './external-payload.js'
-
-describe('parseKWSExternalPayloadVersion', () => {
-  it('should return V2 for "2"', () => {
-    const result = parseKWSExternalPayloadVersion('2')
-    expect(result).toBe('2')
-  })
-  it('should return V1 for unknown versions', () => {
-    const result = parseKWSExternalPayloadVersion('unknown')
-    expect(result).toBe('1')
-  })
-})
-
-describe('parseKWSExternalPayloadV1WithV2Compat', () => {
-  it('should parse V1 payload correctly', () => {
-    const payload = {
-      attemptId: '123',
-      actorDid: 'did:plc:123',
-    }
-    const serialized = serializeKWSExternalPayloadV1(payload)
-    const result = parseKWSExternalPayloadV1WithV2Compat(serialized)
-    expect(result).toEqual({
-      version: KWSExternalPayloadVersion.V1,
-      ...payload,
-    })
-  })
-  it('should parse V2 payload correctly', () => {
-    const payload = {
-      version: KWSExternalPayloadVersion.V2 as const,
-      attemptId: '123',
-      actorDid: 'did:plc:123',
-      countryCode: 'US',
-    }
-    const serialized = serializeKWSExternalPayloadV2(payload)
-    const result = parseKWSExternalPayloadV1WithV2Compat(serialized)
-    expect(result).toEqual(payload)
-  })
-})
-
-describe('serializeKWSExternalPayloadV2 & parseKWSExternalPayloadV2', () => {
-  const payload = {
-    version: KWSExternalPayloadVersion.V2 as const,
-    attemptId: '123',
-    actorDid: 'did:plc:123',
-    countryCode: 'US',
-    regionCode: 'CA',
-  }
-  it('compresses when serializing', () => {
-    const serialized = serializeKWSExternalPayloadV2(payload)
-    const comparison = JSON.stringify({
-      v: KWSExternalPayloadVersion.V2,
-      id: payload.attemptId,
-      did: payload.actorDid,
-      gc: payload.countryCode,
-      gr: payload.regionCode,
-    })
-    expect(serialized).toEqual(comparison)
-  })
-  it('decompresses when parsing', () => {
-    const serialized = serializeKWSExternalPayloadV2(payload)
-    const deserialized = parseKWSExternalPayloadV2(serialized)
-    expect(deserialized).toEqual(payload)
-  })
-})

package/src/api/age-assurance/kws/external-payload.ts

@@ -1,149 +0,0 @@
-import { z } from 'zod'
-
-export const KWS_EXTERNAL_PAYLOAD_CHAR_LIMIT = 250
-
-/**
- * Thrown when the provided external payload exceeds KWS's character limit.
- *
- * This is most commonly caused by DIDs that are too long, such as for
- * `did:web` DIDs. But it's very rare, and the client has special handling for
- * this case.
- */
-export class KWSExternalPayloadTooLargeError extends Error {}
-
-export enum KWSExternalPayloadVersion {
-  V1 = '1',
-  V2 = '2',
-}
-
-export function parseKWSExternalPayloadVersion(raw: string) {
-  switch (raw) {
-    case KWSExternalPayloadVersion.V2:
-      return KWSExternalPayloadVersion.V2
-    default:
-      return KWSExternalPayloadVersion.V1
-  }
-}
-
-export type KWSExternalPayloadV1 = {
-  actorDid: string
-  attemptId: string
-}
-
-export const KWSExternalPayloadV1Schema = z.object({
-  actorDid: z.string(),
-  attemptId: z.string(),
-})
-
-export function parseKWSExternalPayloadV1(raw: string): KWSExternalPayloadV1 {
-  try {
-    const value: unknown = JSON.parse(raw)
-    return KWSExternalPayloadV1Schema.parse(value)
-  } catch (err) {
-    throw new Error(`Failed to parse KWSExternalPayloadV1`, {
-      cause: err,
-    })
-  }
-}
-
-export function serializeKWSExternalPayloadV1(
-  payload: KWSExternalPayloadV1,
-): string {
-  try {
-    return JSON.stringify(KWSExternalPayloadV1Schema.parse(payload))
-  } catch (err) {
-    throw new Error('Failed to serialize KWSExternalPayloadV1', { cause: err })
-  }
-}
-
-/**
- * During our migration from v1 to v2 of the KWS external payload, we'll be
- * sending v2 payloads on the v1 flow (the `adult-verified` email flow). We use
- * this utility to parse either v1 or v2 payloads in that flow.
- *
- * Check for the `version` field on the output of this method to discriminate
- * between the two types and handle them differently.
- */
-export function parseKWSExternalPayloadV1WithV2Compat(
-  raw: string,
-):
-  | (KWSExternalPayloadV1 & { version: KWSExternalPayloadVersion.V1 })
-  | KWSExternalPayloadV2 {
-  const deserialized = JSON.parse(raw)
-  const v2 = deserialized.v === KWSExternalPayloadVersion.V2
-
-  if (v2) {
-    return parseKWSExternalPayloadV2(raw)
-  } else {
-    return {
-      ...parseKWSExternalPayloadV1(raw),
-      version: KWSExternalPayloadVersion.V1,
-    }
-  }
-}
-
-/***************************
- * KWS External Payload V2 *
- ***************************/
-
-export type KWSExternalPayloadV2 = {
-  version: KWSExternalPayloadVersion.V2
-  attemptId: string
-  actorDid: string
-  countryCode: string
-  regionCode?: string
-}
-
-export const KWSExternalPayloadV2Schema = z.object({
-  v: z.string(),
-  id: z.string(),
-  did: z.string(),
-  gc: z.string().length(2),
-  gr: z.string().optional(),
-})
-
-export function serializeKWSExternalPayloadV2(
-  payload: KWSExternalPayloadV2,
-): string {
-  let compressed: z.infer<typeof KWSExternalPayloadV2Schema>
-  try {
-    compressed = KWSExternalPayloadV2Schema.parse({
-      v: KWSExternalPayloadVersion.V2, // version
-      id: payload.attemptId,
-      did: payload.actorDid,
-      gc: payload.countryCode, // geolocation country
-      gr: payload.regionCode, // geolocation region
-    })
-  } catch (err) {
-    throw new Error('Failed to serialize KWSExternalPayloadV2', { cause: err })
-  }
-
-  const serialized = JSON.stringify(compressed)
-
-  if (serialized.length > KWS_EXTERNAL_PAYLOAD_CHAR_LIMIT) {
-    throw new KWSExternalPayloadTooLargeError(
-      `Serialized external payload size ${serialized.length} exceeds limit of ${KWS_EXTERNAL_PAYLOAD_CHAR_LIMIT}`,
-    )
-  }
-
-  return serialized
-}
-
-export function parseKWSExternalPayloadV2(raw: string): KWSExternalPayloadV2 {
-  try {
-    const deserialized = JSON.parse(raw)
-    const parsed = KWSExternalPayloadV2Schema.parse(deserialized)
-
-    return {
-      version: KWSExternalPayloadVersion.V2,
-      attemptId: parsed.id,
-      actorDid: parsed.did,
-      countryCode: parsed.gc,
-      regionCode: parsed.gr,
-    }
-  } catch (err) {
-    throw new Error(`Failed to parse KWSExternalPayloadV2`, {
-      cause: err,
-    })
-  }
-}

package/src/api/age-assurance/redirects/kws-age-verified.ts

@@ -1,107 +0,0 @@
-import express, { RequestHandler } from 'express'
-import { ageAssuranceLogger as logger } from '../../../logger.js'
-import { getClientUa, validateSignature } from '../../kws/util.js'
-import { AGE_ASSURANCE_CONFIG } from '../const.js'
-import { parseKWSAgeVerifiedStatus } from '../kws/age-verified.js'
-import {
-  type KWSExternalPayloadV2,
-  parseKWSExternalPayloadV2,
-} from '../kws/external-payload.js'
-import { createEvent } from '../stash.js'
-import { AppContextWithAA } from '../types.js'
-import { computeAgeAssuranceAccessOrThrow } from '../util.js'
-
-function parseQueryParams(
-  ctx: AppContextWithAA,
-  req: express.Request,
-): {
-  status: string
-  externalPayload: string
-} {
-  try {
-    const status = String(req.query.status)
-    const externalPayload = String(req.query.externalPayload)
-    const signature = String(req.query.signature)
-
-    validateSignature(
-      ctx.cfg.kws.ageVerifiedRedirectSecret,
-      `${status}:${externalPayload}`,
-      signature,
-    )
-
-    return {
-      status,
-      externalPayload,
-    }
-  } catch (err) {
-    throw new Error('Invalid KWS API request', { cause: err })
-  }
-}
-
-export const handler =
-  (ctx: AppContextWithAA): RequestHandler =>
-  async (req: express.Request, res: express.Response) => {
-    let externalPayload: KWSExternalPayloadV2 | undefined
-
-    try {
-      const query = parseQueryParams(ctx, req)
-      const { verified, verifiedMinimumAge } = parseKWSAgeVerifiedStatus(
-        query.status,
-      )
-      externalPayload = parseKWSExternalPayloadV2(query.externalPayload)
-      const { actorDid, attemptId, countryCode, regionCode } = externalPayload
-
-      /*
-       * KWS does not send unverified webhooks for age verification, so we
-       * expect all webhooks to be verified. This is just a sanity check.
-       */
-      if (!verified) {
-        const message =
-          'Expected KWS verification redirect to have verified status'
-        logger.error({}, message)
-        throw new Error(message)
-      }
-
-      const { access } = computeAgeAssuranceAccessOrThrow(
-        AGE_ASSURANCE_CONFIG,
-        {
-          countryCode,
-          regionCode,
-          verifiedMinimumAge,
-        },
-      )
-
-      await createEvent(ctx, actorDid, {
-        attemptId,
-        // Assumes `app.set('trust proxy', ...)` configured with `true` or specific values.
-        completeIp: req.ip,
-        completeUa: getClientUa(req),
-        countryCode,
-        regionCode,
-        status: 'assured',
-        access,
-      })
-
-      const q = new URLSearchParams({ actorDid, result: 'success' })
-
-      return res
-        .status(302)
-        .setHeader('Location', `${ctx.cfg.kws.redirectUrl}?${q}`)
-        .end()
-    } catch (err) {
-      logger.error(
-        { err, ...externalPayload },
-        'Failed to handle KWS verification redirect',
-      )
-
-      const q = new URLSearchParams({
-        ...(externalPayload ? { actorDid: externalPayload.actorDid } : {}),
-        result: 'unknown',
-      })
-
-      return res
-        .status(302)
-        .setHeader('Location', `${ctx.cfg.kws.redirectUrl}?${q}`)
-        .end()
-    }
-  }

package/src/api/age-assurance/stash.ts

@@ -1,23 +0,0 @@
-import { TID } from '@atproto/common'
-import { DatetimeString } from '@atproto/syntax'
-import { AppContext } from '../../context.js'
-import { app } from '../../lexicons/index.js'
-import { Namespaces } from '../../stash.js'
-
-export async function createEvent(
-  ctx: AppContext,
-  actorDid: string,
-  event: Omit<app.bsky.ageassurance.defs.Event, 'createdAt'>,
-) {
-  const payload: app.bsky.ageassurance.defs.Event = {
-    createdAt: new Date().toISOString() as DatetimeString,
-    ...event,
-  }
-  await ctx.stashClient.create({
-    actorDid: actorDid,
-    namespace: Namespaces.AppBskyAgeassuranceDefsEvent,
-    key: TID.nextStr(),
-    payload,
-  })
-  return payload
-}

package/src/api/age-assurance/types.ts

@@ -1,10 +0,0 @@
-import { KwsConfig, ServerConfig } from '../../config.js'
-import { AppContext } from '../../context.js'
-import { KwsClient } from '../../kws.js'
-
-export type AppContextWithAA = AppContext & {
-  kwsClient: KwsClient
-  cfg: ServerConfig & {
-    kws: KwsConfig
-  }
-}

package/src/api/age-assurance/util.ts

@@ -1,68 +0,0 @@
-import {
-  AgeAssuranceRuleID,
-  AppBskyAgeassuranceDefs,
-  computeAgeAssuranceRegionAccess,
-  getAgeAssuranceRegionConfig,
-} from '@atproto/api'
-import { app } from '../../lexicons/index.js'
-
-/**
- * Compute age assurance access based on verified minimum age. Thrown errors
- * are internal errors, so handle them accordingly.
- */
-export function computeAgeAssuranceAccessOrThrow(
-  config: app.bsky.ageassurance.defs.Config,
-  {
-    countryCode,
-    regionCode,
-    verifiedMinimumAge,
-  }: {
-    countryCode: string
-    regionCode?: string
-    verifiedMinimumAge: number
-  },
-): { access: AppBskyAgeassuranceDefs.Access; reason: AgeAssuranceRuleID } {
-  const region = getAgeAssuranceRegionConfig(config, {
-    countryCode,
-    regionCode,
-  })
-
-  if (region) {
-    const result = computeAgeAssuranceRegionAccess(region, {
-      assuredAge: verifiedMinimumAge,
-      /*
-       * We don't care about this here, this is a client-only rule. If we have
-       * verified data, we can use that, and the account creation date is
-       * irrelevant.
-       */
-      accountCreatedAt: undefined,
-    })
-
-    if (result) {
-      return result
-    } else {
-      /*
-       * If we don't get a result, it's because none of the rules matched,
-       * which is a configuration error: there should always be a default
-       * rule.
-       */
-      throw new Error('Cound not compute age assurance region access')
-    }
-  } else {
-    /**
-     * If we had geolocation data, but we don't have a region config for this
-     * geolocation, then it means a user outside of our configured regions
-     * has completed age verification. In this case, we can't determine their
-     * access level, so we throw an error.
-     *
-     * This case is also guarded in `app.bsky.ageassurance.begin`.
-     */
-    throw new Error('Could not get config for region')
-  }
-}
-
-export function createLocationString(countryCode: string, regionCode?: string) {
-  return regionCode
-    ? `${countryCode.toUpperCase()}-${regionCode.toUpperCase()}`
-    : countryCode.toUpperCase()
-}

package/src/api/age-assurance/webhooks/kws-age-verified.ts

@@ -1,75 +0,0 @@
-import express, { RequestHandler } from 'express'
-import { ageAssuranceLogger as logger } from '../../../logger.js'
-import { AGE_ASSURANCE_CONFIG } from '../const.js'
-import {
-  type KWSWebhookAgeVerified,
-  parseKWSAgeVerifiedWebhook,
-} from '../kws/age-verified.js'
-import { parseKWSExternalPayloadV2 } from '../kws/external-payload.js'
-import { createEvent } from '../stash.js'
-import { type AppContextWithAA } from '../types.js'
-import { computeAgeAssuranceAccessOrThrow } from '../util.js'
-
-export const handler =
-  (ctx: AppContextWithAA): RequestHandler =>
-  async (req: express.Request, res: express.Response) => {
-    let body: KWSWebhookAgeVerified
-    try {
-      body = parseKWSAgeVerifiedWebhook(req.body)
-    } catch (err) {
-      const message = 'Failed to parse KWS webhook body'
-      logger.error({ err }, message)
-      return res.status(400).json({ error: message })
-    }
-
-    const { status, externalPayload } = body.payload
-    const { verified, verifiedMinimumAge } = status
-    const { actorDid, countryCode, regionCode, attemptId } =
-      parseKWSExternalPayloadV2(externalPayload)
-
-    /*
-     * KWS does not send unverified webhooks for age verification, so we
-     * expect all webhooks to be verified. This is just a sanity check.
-     */
-    if (!verified) {
-      const message = 'Expected KWS webhook to have verified status'
-      logger.error({}, message)
-      return res.status(400).json({ error: message })
-    }
-
-    let result: ReturnType<typeof computeAgeAssuranceAccessOrThrow> | undefined
-    try {
-      result = computeAgeAssuranceAccessOrThrow(AGE_ASSURANCE_CONFIG, {
-        countryCode,
-        regionCode,
-        verifiedMinimumAge,
-      })
-    } catch (err) {
-      // internal errors
-      logger.error(
-        { err, attemptId, actorDid, countryCode, regionCode },
-        'Failed to compute age assurance access',
-      )
-    }
-
-    try {
-      if (result) {
-        await createEvent(ctx, actorDid, {
-          attemptId,
-          countryCode,
-          regionCode,
-          status: 'assured',
-          access: result.access,
-        })
-      }
-
-      return res.status(200).end()
-    } catch (err) {
-      const message = 'Failed to handle KWS webhook'
-      logger.error(
-        { err, attemptId, actorDid, countryCode, regionCode },
-        message,
-      )
-      return res.status(500).json({ error: message })
-    }
-  }

package/src/api/app/bsky/actor/getProfile.ts

@@ -1,106 +0,0 @@
-import { DidString } from '@atproto/syntax'
-import { InvalidRequestError, Server } from '@atproto/xrpc-server'
-import { AppContext } from '../../../../context.js'
-import {
-  HydrateCtx,
-  HydrationState,
-  Hydrator,
-} from '../../../../hydration/hydrator.js'
-import { app } from '../../../../lexicons/index.js'
-import { createPipeline, noRules } from '../../../../pipeline.js'
-import { Views } from '../../../../views/index.js'
-import { resHeaders } from '../../../util.js'
-
-export default function (server: Server, ctx: AppContext) {
-  const getProfile = createPipeline(skeleton, hydration, noRules, presentation)
-  server.add(app.bsky.actor.getProfile, {
-    auth: ctx.authVerifier.optionalStandardOrRole,
-    handler: async ({ auth, params, req }) => {
-      const { viewer, includeTakedowns, skipViewerBlocks } =
-        ctx.authVerifier.parseCreds(auth)
-      const labelers = ctx.reqLabelers(req)
-      const hydrateCtx = await ctx.hydrator.createContext({
-        labelers,
-        viewer,
-        includeTakedowns,
-        skipViewerBlocks,
-      })
-
-      const result = await getProfile({ ...params, hydrateCtx }, ctx)
-
-      const repoRev = await ctx.hydrator.actor.getRepoRevSafe(viewer)
-
-      return {
-        encoding: 'application/json',
-        body: result,
-        headers: resHeaders({
-          repoRev,
-          labelers: hydrateCtx.labelers,
-        }),
-      }
-    },
-  })
-}
-
-const skeleton = async (input: {
-  ctx: Context
-  params: Params
-}): Promise<SkeletonState> => {
-  const { ctx, params } = input
-  const [did] = await ctx.hydrator.actor.getDids([params.actor])
-  if (!did) {
-    throw new InvalidRequestError('Profile not found')
-  }
-  return { did }
-}
-
-const hydration = async (input: {
-  ctx: Context
-  params: Params
-  skeleton: SkeletonState
-}) => {
-  const { ctx, params, skeleton } = input
-  return ctx.hydrator.hydrateProfilesDetailed(
-    [skeleton.did],
-    params.hydrateCtx.copy({
-      overrideIncludeTakedownsForActor: true,
-    }),
-  )
-}
-
-const presentation = (input: {
-  ctx: Context
-  params: Params
-  skeleton: SkeletonState
-  hydration: HydrationState
-}) => {
-  const { ctx, params, skeleton, hydration } = input
-  const profile = ctx.views.profileDetailed(skeleton.did, hydration)
-  if (!profile) {
-    throw new InvalidRequestError('Profile not found')
-  } else if (!params.hydrateCtx.includeTakedowns) {
-    if (ctx.views.actorIsTakendown(skeleton.did, hydration)) {
-      throw new InvalidRequestError(
-        'Account has been suspended',
-        'AccountTakedown',
-      )
-    } else if (ctx.views.actorIsDeactivated(skeleton.did, hydration)) {
-      throw new InvalidRequestError(
-        'Account is deactivated',
-        'AccountDeactivated',
-      )
-    }
-  }
-  return profile
-}
-
-type Context = {
-  hydrator: Hydrator
-  views: Views
-}
-
-type Params = app.bsky.actor.getProfile.$Params & {
-  hydrateCtx: HydrateCtx
-}
-
-type SkeletonState = { did: DidString }