@atproto/bsky 0.0.251 → 0.0.253

package/src/util/standard-site.test.ts

@@ -1,423 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { validateStandardSiteForUrl } from './standard-site.js'
-
-const docDid = 'did:plc:doc'
-const pubDid = 'did:plc:pub'
-const docUri = `at://${docDid}/site.standard.document/abc`
-const pubUri = `at://${pubDid}/site.standard.publication/self`
-
-const makeDoc = (record: { site: string; path?: string }) => ({
-  ref: { uri: docUri },
-  info: { record },
-})
-
-const makePub = (record: { url: string }) => ({
-  ref: { uri: pubUri },
-  info: { record },
-})
-
-describe(validateStandardSiteForUrl, () => {
-  describe('document + publication', () => {
-    it('accepts when site resolves to publication and url+path matches', () => {
-      const doc = makeDoc({ site: pubUri, path: '/posts/hello' })
-      const pub = makePub({ url: 'https://example.com' })
-      expect(
-        validateStandardSiteForUrl(doc, pub, 'https://example.com/posts/hello'),
-      ).toBe(true)
-    })
-
-    it('rejects when joined url+path does not match assumedUrl', () => {
-      const doc = makeDoc({ site: pubUri, path: '/posts/hello' })
-      const pub = makePub({ url: 'https://example.com' })
-      expect(
-        validateStandardSiteForUrl(
-          doc,
-          pub,
-          'https://example.com/posts/different',
-        ),
-      ).toBe(false)
-    })
-
-    it('accepts when document has no path and assumedUrl is the bare publication url', () => {
-      const doc = makeDoc({ site: pubUri })
-      const pub = makePub({ url: 'https://example.com' })
-      expect(validateStandardSiteForUrl(doc, pub, 'https://example.com')).toBe(
-        true,
-      )
-    })
-  })
-
-  describe('document only (loose doc)', () => {
-    it('accepts when site is HTTP and matches assumedUrl', () => {
-      const doc = makeDoc({ site: 'https://example.com', path: '/posts/hi' })
-      expect(
-        validateStandardSiteForUrl(
-          doc,
-          undefined,
-          'https://example.com/posts/hi',
-        ),
-      ).toBe(true)
-    })
-
-    // The lookups reject this pairing upstream, but validate as a fallback:
-    // an at-uri base canonicalizes to null and fails the URL match.
-    it('rejects when site is an at-uri (non-HTTP base canonicalizes to null)', () => {
-      const doc = makeDoc({ site: pubUri, path: '/posts/hi' })
-      expect(
-        validateStandardSiteForUrl(
-          doc,
-          undefined,
-          'https://example.com/posts/hi',
-        ),
-      ).toBe(false)
-    })
-
-    it('rejects when assumedUrl is on a different host', () => {
-      const doc = makeDoc({ site: 'https://example.com', path: '/posts/hi' })
-      expect(
-        validateStandardSiteForUrl(doc, undefined, 'https://evil.com/posts/hi'),
-      ).toBe(false)
-    })
-
-    it('accepts when site has no path field and assumedUrl is the bare site', () => {
-      const doc = makeDoc({ site: 'https://example.com' })
-      expect(
-        validateStandardSiteForUrl(doc, undefined, 'https://example.com'),
-      ).toBe(true)
-    })
-  })
-
-  describe('publication only', () => {
-    it('accepts when publication.url matches assumedUrl', () => {
-      const pub = makePub({ url: 'https://example.com' })
-      expect(
-        validateStandardSiteForUrl(undefined, pub, 'https://example.com'),
-      ).toBe(true)
-    })
-
-    it('rejects when publication.url and assumedUrl differ', () => {
-      const pub = makePub({ url: 'https://example.com' })
-      expect(
-        validateStandardSiteForUrl(undefined, pub, 'https://other.com'),
-      ).toBe(false)
-    })
-
-    it('accepts when assumedUrl has a trailing slash and publication.url does not', () => {
-      const pub = makePub({ url: 'https://atproto.com/blog' })
-      expect(
-        validateStandardSiteForUrl(undefined, pub, 'https://atproto.com/blog/'),
-      ).toBe(true)
-    })
-  })
-
-  describe('neither', () => {
-    it('returns true (caller handles the no-records short-circuit)', () => {
-      expect(
-        validateStandardSiteForUrl(undefined, undefined, 'https://example.com'),
-      ).toBe(true)
-    })
-  })
-
-  describe('assumedUrl variants', () => {
-    const doc = makeDoc({ site: pubUri, path: '/posts/hello' })
-    const pub = makePub({ url: 'https://example.com' })
-
-    for (const { note, assumedUrl, expected } of [
-      {
-        note: 'trailing slash on assumed URL',
-        assumedUrl: 'https://example.com/posts/hello/',
-        expected: true,
-      },
-      {
-        note: 'query string ignored',
-        assumedUrl: 'https://example.com/posts/hello?utm_source=twitter',
-        expected: true,
-      },
-      {
-        note: 'fragment ignored',
-        assumedUrl: 'https://example.com/posts/hello#section',
-        expected: true,
-      },
-      {
-        note: 'mixed-case host',
-        assumedUrl: 'https://Example.COM/posts/hello',
-        expected: true,
-      },
-      {
-        note: 'http vs https mismatch is rejected',
-        assumedUrl: 'http://example.com/posts/hello',
-        expected: false,
-      },
-      {
-        note: 'unparseable assumed URL is rejected',
-        assumedUrl: 'not a url',
-        expected: false,
-      },
-      {
-        note: 'non-http scheme is rejected',
-        assumedUrl: 'ftp://example.com/posts/hello',
-        expected: false,
-      },
-    ]) {
-      it(note, () => {
-        expect(validateStandardSiteForUrl(doc, pub, assumedUrl)).toBe(expected)
-      })
-    }
-  })
-
-  describe('path joining (root domain × subpath × slash placement)', () => {
-    // Real-world example that originally broke:
-    //   pub.url:  'https://atproto.com/blog'
-    //   doc.path: '/indexing-standard-site'
-    //   expected: 'https://atproto.com/blog/indexing-standard-site'
-    // `new URL('/indexing-standard-site', 'https://atproto.com/blog')` would
-    // resolve to 'https://atproto.com/indexing-standard-site' (the leading
-    // slash on path swallows the base's pathname under WHATWG semantics) —
-    // we want path-append, not relative resolution.
-    for (const { note, baseUrl, path, assumedUrl, expected } of [
-      // Root-domain base, all four slash combinations.
-      {
-        note: 'root base, base/, path/',
-        baseUrl: 'https://example.com/',
-        path: '/posts/hello',
-        assumedUrl: 'https://example.com/posts/hello',
-        expected: true,
-      },
-      {
-        note: 'root base, base/, path-no-slash',
-        baseUrl: 'https://example.com/',
-        path: 'posts/hello',
-        assumedUrl: 'https://example.com/posts/hello',
-        expected: true,
-      },
-      {
-        note: 'root base, base-no-slash, path/',
-        baseUrl: 'https://example.com',
-        path: '/posts/hello',
-        assumedUrl: 'https://example.com/posts/hello',
-        expected: true,
-      },
-      {
-        note: 'root base, base-no-slash, path-no-slash',
-        baseUrl: 'https://example.com',
-        path: 'posts/hello',
-        assumedUrl: 'https://example.com/posts/hello',
-        expected: true,
-      },
-      // Subpath base, all four slash combinations (the regression case).
-      {
-        note: 'subpath base, base/, path/',
-        baseUrl: 'https://atproto.com/blog/',
-        path: '/indexing-standard-site',
-        assumedUrl: 'https://atproto.com/blog/indexing-standard-site',
-        expected: true,
-      },
-      {
-        note: 'subpath base, base/, path-no-slash',
-        baseUrl: 'https://atproto.com/blog/',
-        path: 'indexing-standard-site',
-        assumedUrl: 'https://atproto.com/blog/indexing-standard-site',
-        expected: true,
-      },
-      {
-        note: 'subpath base, base-no-slash, path/ (regression)',
-        baseUrl: 'https://atproto.com/blog',
-        path: '/indexing-standard-site',
-        assumedUrl: 'https://atproto.com/blog/indexing-standard-site',
-        expected: true,
-      },
-      {
-        note: 'subpath base, base-no-slash, path-no-slash',
-        baseUrl: 'https://atproto.com/blog',
-        path: 'indexing-standard-site',
-        assumedUrl: 'https://atproto.com/blog/indexing-standard-site',
-        expected: true,
-      },
-      // Empty path: assumedUrl should equal the base.
-      {
-        note: 'empty path, root base, no trailing slash',
-        baseUrl: 'https://example.com',
-        path: undefined,
-        assumedUrl: 'https://example.com',
-        expected: true,
-      },
-      {
-        note: 'empty path, subpath base, with trailing slash',
-        baseUrl: 'https://atproto.com/blog/',
-        path: undefined,
-        assumedUrl: 'https://atproto.com/blog',
-        expected: true,
-      },
-      // Negative: subpath base with assumedUrl that lost the subpath
-      // (what `new URL`'s relative resolution would have produced).
-      {
-        note: 'rejects when assumed URL drops the subpath',
-        baseUrl: 'https://atproto.com/blog',
-        path: '/indexing-standard-site',
-        assumedUrl: 'https://atproto.com/indexing-standard-site',
-        expected: false,
-      },
-    ]) {
-      it(`doc + pub: ${note}`, () => {
-        const doc = makeDoc(
-          path === undefined ? { site: pubUri } : { site: pubUri, path },
-        )
-        const pub = makePub({ url: baseUrl })
-        expect(validateStandardSiteForUrl(doc, pub, assumedUrl)).toBe(expected)
-      })
-      it(`loose doc: ${note}`, () => {
-        const doc = makeDoc(
-          path === undefined ? { site: baseUrl } : { site: baseUrl, path },
-        )
-        expect(validateStandardSiteForUrl(doc, undefined, assumedUrl)).toBe(
-          expected,
-        )
-      })
-    }
-  })
-
-  describe('subpath-friendly hosts', () => {
-    // Allowlist of hosts where each record's author owns the full subpath
-    // space under their canonical record URL. These platforms typically
-    // serve dynamic per-record subpaths (page numbers, revision ids,
-    // comment threads, etc.) under the same slug, so an `assumedUrl` with
-    // extra path segments past the record URL is still authentic content.
-    for (const { note, baseUrl, path, assumedUrl, expected } of [
-      // Allowlisted apex domain (subdomain) — extra path segments accepted.
-      {
-        note: 'pckt.blog subdomain accepts extra path segments past the record URL',
-        baseUrl: 'https://waow-tech.pckt.blog',
-        path: '/typeahead-more-like-typebehind-amirite-tzgmqge',
-        assumedUrl:
-          'https://waow-tech.pckt.blog/typeahead-more-like-typebehind-amirite-tzgmqge/589/621',
-        expected: true,
-      },
-      {
-        note: 'leaflet.pub subdomain with one extra segment',
-        baseUrl: 'https://author.leaflet.pub',
-        path: '/post-slug',
-        assumedUrl: 'https://author.leaflet.pub/post-slug/v2',
-        expected: true,
-      },
-      {
-        note: 'offprint.app at apex with multi-segment extension',
-        baseUrl: 'https://offprint.app',
-        path: '/story/abc',
-        assumedUrl: 'https://offprint.app/story/abc/chapter/3',
-        expected: true,
-      },
-      // Allowlisted host but the assumed URL diverges from the path —
-      // still rejected; subpath is "extends with extra segments after a
-      // path-segment boundary," not "any URL on the same host."
-      {
-        note: 'pckt.blog rejects assumed URLs that diverge before the boundary',
-        baseUrl: 'https://blog.pckt.blog',
-        path: '/post-slug',
-        assumedUrl: 'https://blog.pckt.blog/different-post',
-        expected: false,
-      },
-      {
-        note: 'pckt.blog rejects partial-segment matches (no slash boundary)',
-        baseUrl: 'https://blog.pckt.blog',
-        path: '/foo',
-        assumedUrl: 'https://blog.pckt.blog/foobar',
-        expected: false,
-      },
-      // Non-allowlisted hosts — exact match still required.
-      {
-        note: 'arbitrary host rejects extra path segments',
-        baseUrl: 'https://example.com',
-        path: '/article',
-        assumedUrl: 'https://example.com/article/extra',
-        expected: false,
-      },
-      {
-        note: 'lookalike host (pckt.blog.evil.com) is NOT allowlisted',
-        baseUrl: 'https://pckt.blog.evil.com',
-        path: '/post',
-        assumedUrl: 'https://pckt.blog.evil.com/post/extra',
-        expected: false,
-      },
-      {
-        note: 'evilpckt.blog is NOT allowlisted (no subdomain dot before pckt.blog)',
-        baseUrl: 'https://evilpckt.blog',
-        path: '/post',
-        assumedUrl: 'https://evilpckt.blog/post/extra',
-        expected: false,
-      },
-      // Allowlist host with exact match still works (no regression).
-      {
-        note: 'pckt.blog still accepts exact match without subpath',
-        baseUrl: 'https://author.pckt.blog',
-        path: '/post-slug',
-        assumedUrl: 'https://author.pckt.blog/post-slug',
-        expected: true,
-      },
-      // Allowlist host with cross-host mismatch — still rejected.
-      {
-        note: 'allowlisted record host vs different host on assumed URL is rejected',
-        baseUrl: 'https://author.pckt.blog',
-        path: '/post',
-        assumedUrl: 'https://example.com/author.pckt.blog/post/extra',
-        expected: false,
-      },
-    ]) {
-      it(`doc + pub: ${note}`, () => {
-        const doc = makeDoc(
-          path === undefined ? { site: pubUri } : { site: pubUri, path },
-        )
-        const pub = makePub({ url: baseUrl })
-        expect(validateStandardSiteForUrl(doc, pub, assumedUrl)).toBe(expected)
-      })
-      it(`loose doc: ${note}`, () => {
-        const doc = makeDoc(
-          path === undefined ? { site: baseUrl } : { site: baseUrl, path },
-        )
-        expect(validateStandardSiteForUrl(doc, undefined, assumedUrl)).toBe(
-          expected,
-        )
-      })
-    }
-
-    // Publication-only validation never accepts subpaths — `assumedUrl`
-    // for a publication is the home-page URL, not an article underneath
-    // it. Subpath relaxation belongs to documents.
-    it('publication-only: allowlisted host still requires exact match', () => {
-      const pub = makePub({ url: 'https://author.pckt.blog' })
-      expect(
-        validateStandardSiteForUrl(
-          undefined,
-          pub,
-          'https://author.pckt.blog/some/sub/path',
-        ),
-      ).toBe(false)
-    })
-
-    it('publication-only: non-allowlisted host rejects subpath', () => {
-      const pub = makePub({ url: 'https://example.com' })
-      expect(
-        validateStandardSiteForUrl(
-          undefined,
-          pub,
-          'https://example.com/some/sub/path',
-        ),
-      ).toBe(false)
-    })
-
-    // Case-insensitivity on the host.
-    it('host comparison is case-insensitive', () => {
-      const doc = makeDoc({
-        site: pubUri,
-        path: '/post',
-      })
-      const pub = makePub({ url: 'https://Author.PCKT.blog' })
-      expect(
-        validateStandardSiteForUrl(
-          doc,
-          pub,
-          'https://author.pckt.BLOG/post/extra',
-        ),
-      ).toBe(true)
-    })
-  })
-})

package/src/util/standard-site.ts

@@ -1,196 +0,0 @@
-import { AtUriString } from '@atproto/syntax'
-
-export const SITE_STANDARD_NSID_PREFIX = 'site.standard.'
-
-/**
- * Composes a stable map key from an `(uri, cid)` pair. A single hydration
- * batch can pull more than one version of the same SS record URI (different
- * posts pinning different cids), so the composite is needed for O(1)
- * version-exact lookups.
- */
-export const siteStandardRecordKey = (uri: string, cid: string) =>
-  `${uri}@${cid}`
-
-export const parseSiteStandardRecordKey = (
-  key: string,
-): { uri: AtUriString; cid: string } => {
-  const at = key.lastIndexOf('@')
-  return {
-    uri: key.slice(0, at) as AtUriString,
-    cid: key.slice(at + 1),
-  }
-}
-
-/**
- * Parse `url` as HTTP(S) and reduce it to a canonical
- * `protocol://host/path` string for equality comparison: lowercases host,
- * strips a trailing slash from the path, and drops query/fragment. Returns
- * `null` when the input isn't a valid HTTP(S) URL.
- */
-const canonicalizeHttpUrl = (url: string): string | null => {
-  let parsed: URL
-  try {
-    parsed = new URL(url)
-  } catch {
-    return null
-  }
-  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') return null
-  const path = parsed.pathname === '/' ? '' : parsed.pathname.replace(/\/$/, '')
-  return `${parsed.protocol}//${parsed.host}${path}`
-}
-
-/**
- * Append `path` to `base` with exactly one slash between, or return `base`
- * unchanged when `path` is empty. Unlike `new URL(path, base)`, a leading
- * slash on `path` does NOT swallow `base`'s pathname — so
- * `joinPath('https://x.com/blog', '/foo')` is `https://x.com/blog/foo`,
- * not `https://x.com/foo`.
- */
-const joinPath = (base: string, path: string): string => {
-  if (!path) return base
-  const baseTrimmed = base.endsWith('/') ? base.slice(0, -1) : base
-  const pathTrimmed = path.startsWith('/') ? path.slice(1) : path
-  return `${baseTrimmed}/${pathTrimmed}`
-}
-
-/**
- * Apex domains whose authors own the full subpath space under their
- * record-claimed URL. Each entry matches itself and any subdomain; e.g.
- * `pckt.blog` matches `pckt.blog` and `waow-tech.pckt.blog`.
- *
- * On these domains, an `assumedUrl` whose pathname extends the canonical
- * record URL with extra segments is treated as valid. Adding to this list
- * is a trust call — only platforms where each record's URL space is
- * authoritatively owned by its author belong here.
- */
-const SUBPATH_FRIENDLY_DOMAINS = ['pckt.blog', 'leaflet.pub', 'offprint.app']
-
-const isSubpathFriendlyHost = (host: string): boolean => {
-  const lower = host.toLowerCase()
-  return SUBPATH_FRIENDLY_DOMAINS.some(
-    (domain) => lower === domain || lower.endsWith(`.${domain}`),
-  )
-}
-
-/**
- * Return whether `recordUrl` and `assumedUrl` should validate as the same
- * canonical content. Strictly equal canonical forms always match. On
- * subpath-friendly hosts (see `SUBPATH_FRIENDLY_DOMAINS`), an `assumedUrl`
- * whose path extends `recordUrl`'s with extra segments is also accepted.
- *
- * Both inputs are pre-canonicalized strings (`canonicalizeHttpUrl` output)
- * with no trailing slash and no query/fragment.
- */
-const canonicalUrlMatchesAssumed = (
-  canonicalRecordUrl: string,
-  canonicalAssumedUrl: string,
-): boolean => {
-  if (canonicalRecordUrl === canonicalAssumedUrl) return true
-  // Subpath fallback. Both strings are canonicalized, so a real
-  // path-segment boundary at `recordUrl + '/'` (e.g. `/foo` vs `/foo-bar`
-  // never matches; `/foo` vs `/foo/bar` does).
-  if (!canonicalAssumedUrl.startsWith(`${canonicalRecordUrl}/`)) return false
-  let host: string
-  try {
-    host = new URL(canonicalAssumedUrl).host
-  } catch {
-    return false
-  }
-  return isSubpathFriendlyHost(host)
-}
-
-/**
- * Confirm that the supplied SS records actually back `assumedUrl`. The
- * record-side URL is built by concatenating the publication URL (or the
- * loose-doc site) with the document's `path` field, then both sides are
- * canonicalized for equality: lowercase host, query/fragment dropped,
- * trailing slash stripped.
- *
- * Path concatenation is `base + '/' + path` semantics — a leading `/` on
- * `path` does NOT swallow the base's pathname (the way
- * `new URL(path, base)` would). So
- * `'https://atproto.com/blog' + '/indexing-standard-site'` resolves to
- * `https://atproto.com/blog/indexing-standard-site` regardless of which
- * side carries the slash.
- *
- * Structural validation of the doc/pub pair (matching `site` ↔ pub URI,
- * no orphan docs that claim a missing publication) happens upstream in
- * `getSiteStandardRecordsFromHydrationMapsByRefs` /
- * `…ByDocumentUri` (see `hydration/external.ts`); by the time this
- * function runs the pair is already known to be structurally consistent,
- * so we only check whether the records back the URL.
- *
- * For document validation, `SUBPATH_FRIENDLY_DOMAINS` (and their
- * subdomains) accept an assumed URL whose path extends the canonical
- * record URL with additional segments — these are platforms where each
- * record's author owns the full subpath space under their claimed URL.
- * Publication-only validation always requires exact match: there's no
- * coherent "subpath" of a publication's home page.
- *
- * Cases:
- * - Document + publication: `publication.url + document.path` must
- *   canonicalize to `assumedUrl` (or be a subpath-friendly prefix of it).
- * - Loose document (web-URL `site`): `document.site + document.path`
- *   must canonicalize to `assumedUrl` (or be a subpath-friendly prefix).
- *   (Doc with at-uri `site` but no publication can't reach this function
- *   — the lookups reject it.)
- * - Publication only: `publication.url` must canonicalize exactly to
- *   `assumedUrl`.
- * - Neither: vacuously valid; the caller short-circuits before we get
- *   here.
- */
-export const validateStandardSiteForUrl = (
-  document:
-    | {
-        ref: { uri: string }
-        info: { record: { site: string; path?: string } }
-      }
-    | undefined,
-  publication:
-    | { ref: { uri: string }; info: { record: { url: string } } }
-    | undefined,
-  assumedUrl: string,
-): boolean => {
-  const canonicalAssumed = canonicalizeHttpUrl(assumedUrl)
-  if (canonicalAssumed === null) return false
-
-  if (document && publication) {
-    const joined = canonicalizeHttpUrl(
-      joinPath(publication.info.record.url, document.info.record.path ?? ''),
-    )
-    return (
-      joined !== null && canonicalUrlMatchesAssumed(joined, canonicalAssumed)
-    )
-  }
-  if (document) {
-    const joined = canonicalizeHttpUrl(
-      joinPath(document.info.record.site, document.info.record.path ?? ''),
-    )
-    return (
-      joined !== null && canonicalUrlMatchesAssumed(joined, canonicalAssumed)
-    )
-  }
-  if (publication) {
-    // Publication-only matches are exact: `assumedUrl` represents the
-    // publication's home page, not an article underneath it. Subpath
-    // extensions belong to document validation.
-    return canonicalizeHttpUrl(publication.info.record.url) === canonicalAssumed
-  }
-  return true
-}
-
-const WORDS_PER_MINUTE = 200
-
-/**
- * Estimate reading time in minutes from a plaintext document body. Returns
- * `undefined` when the input has no countable words. Uses a coarse
- * `WORDS_PER_MINUTE` heuristic; swap in a more accurate library here if
- * needed (e.g. `reading-time`).
- */
-export const estimateReadingTimeMinutes = (
-  text: string,
-): number | undefined => {
-  const words = text.trim().split(/\s+/).filter(Boolean).length
-  if (!words) return undefined
-  return Math.max(1, Math.ceil(words / WORDS_PER_MINUTE))
-}

package/src/util/uris.ts

@@ -1,38 +0,0 @@
-import { AtUri, DidString } from '@atproto/syntax'
-import { app } from '../lexicons/index.js'
-import { StrongRef, validateStrongRef } from '../views/types.js'
-
-/**
- * Convert a post URI to a threadgate URI. If the URI is not a valid
- * post URI, return URI unchanged. Threadgate lookups will then fail.
- */
-export function postUriToThreadgateUri(postUri: string) {
-  const urip = new AtUri(postUri)
-  if (urip.collection === app.bsky.feed.post.$type) {
-    urip.collection = app.bsky.feed.threadgate.$type
-  }
-  return urip.toString()
-}
-
-/**
- * Convert a post URI to a postgate URI. If the URI is not a valid
- * post URI, return URI unchanged. Postgate lookups will then fail.
- */
-export function postUriToPostgateUri(postUri: string) {
-  const urip = new AtUri(postUri)
-  if (urip.collection === app.bsky.feed.post.$type) {
-    urip.collection = app.bsky.feed.postgate.$type
-  }
-  return urip.toString()
-}
-
-export function uriToDid(uri: string): DidString {
-  // @NOTE URIs returned from the dataplane are always in DID form.
-  return new AtUri(uri).hostname as DidString
-}
-
-// @TODO temp fix for proliferation of invalid pinned post values
-export function safePinnedPost(value: unknown): StrongRef | undefined {
-  const validated = validateStrongRef(value)
-  return validated.success ? validated.value : undefined
-}