@atproto/dev-env 0.0.0-spaces-alpha-20260818163953

package/src/service-profile-ozone.ts

@@ -0,0 +1,375 @@
+import type { AtpAgent } from '@atproto/api'
+import { Secp256k1Keypair } from '@atproto/crypto'
+import type { TestPds } from './pds.js'
+import {
+  type ServiceMigrationOptions,
+  ServiceProfile,
+  type ServiceUserDetails,
+} from './service-profile.js'
+
+export class OzoneServiceProfile extends ServiceProfile {
+  static async create(
+    pds: TestPds,
+    ozoneUrl: string,
+    userDetails = {
+      email: 'mod-authority@test.com',
+      handle: 'mod-authority.test',
+      password: 'hunter2',
+    },
+  ) {
+    const agent = pds.getAgent()
+    await agent.createAccount(userDetails)
+
+    const key = await Secp256k1Keypair.create({ exportable: true })
+
+    return new OzoneServiceProfile(pds, agent, userDetails, ozoneUrl, key)
+  }
+
+  protected constructor(
+    pds: TestPds,
+    agent: AtpAgent,
+    userDetails: ServiceUserDetails,
+    readonly ozoneUrl: string,
+    readonly key: Secp256k1Keypair,
+  ) {
+    super(pds, agent, userDetails)
+  }
+
+  async createAppPasswordForVerification() {
+    const { data } = await this.agent.com.atproto.server.createAppPassword({
+      name: 'ozone-verifier',
+    })
+    return data.password
+  }
+
+  async migrateTo(pds: TestPds, options: ServiceMigrationOptions = {}) {
+    await super.migrateTo(pds, {
+      ...options,
+      services: {
+        ...options.services,
+        atproto_labeler: {
+          type: 'AtprotoLabeler',
+          endpoint: this.ozoneUrl,
+        },
+      },
+      verificationMethods: {
+        ...options.verificationMethods,
+        atproto_label: this.key.did(),
+      },
+    })
+  }
+
+  async createRecords() {
+    await this.agent.app.bsky.actor.profile.create(
+      { repo: this.did },
+      {
+        displayName: 'Dev-env Moderation',
+        description: `The pretend version of mod.bsky.app`,
+      },
+    )
+
+    await this.agent.app.bsky.labeler.service.create(
+      { repo: this.did, rkey: 'self' },
+      {
+        policies: {
+          labelValues: [
+            '!hide',
+            '!warn',
+            'porn',
+            'sexual',
+            'nudity',
+            'sexual-figurative',
+            'graphic-media',
+            'self-harm',
+            'sensitive',
+            'extremist',
+            'intolerant',
+            'threat',
+            'rude',
+            'illicit',
+            'security',
+            'unsafe-link',
+            'impersonation',
+            'misinformation',
+            'scam',
+            'engagement-farming',
+            'spam',
+            'rumor',
+            'misleading',
+            'inauthentic',
+          ],
+          labelValueDefinitions: [
+            {
+              identifier: 'spam',
+              blurs: 'content',
+              severity: 'inform',
+              defaultSetting: 'hide',
+              adultOnly: false,
+              locales: [
+                {
+                  lang: 'en',
+                  name: 'Spam',
+                  description:
+                    'Unwanted, repeated, or unrelated actions that bother users.',
+                },
+              ],
+            },
+            {
+              identifier: 'impersonation',
+              blurs: 'none',
+              severity: 'inform',
+              defaultSetting: 'hide',
+              adultOnly: false,
+              locales: [
+                {
+                  lang: 'en',
+                  name: 'Impersonation',
+                  description:
+                    'Pretending to be someone else without permission.',
+                },
+              ],
+            },
+            {
+              identifier: 'scam',
+              blurs: 'content',
+              severity: 'alert',
+              defaultSetting: 'hide',
+              adultOnly: false,
+              locales: [
+                {
+                  lang: 'en',
+                  name: 'Scam',
+                  description: 'Scams, phishing & fraud.',
+                },
+              ],
+            },
+            {
+              identifier: 'intolerant',
+              blurs: 'content',
+              severity: 'alert',
+              defaultSetting: 'warn',
+              adultOnly: false,
+              locales: [
+                {
+                  lang: 'en',
+                  name: 'Intolerance',
+                  description: 'Discrimination against protected groups.',
+                },
+              ],
+            },
+            {
+              identifier: 'self-harm',
+              blurs: 'content',
+              severity: 'alert',
+              defaultSetting: 'warn',
+              adultOnly: false,
+              locales: [
+                {
+                  lang: 'en',
+                  name: 'Self-Harm',
+                  description:
+                    'Promotes self-harm, including graphic images, glorifying discussions, or triggering stories.',
+                },
+              ],
+            },
+            {
+              identifier: 'security',
+              blurs: 'content',
+              severity: 'alert',
+              defaultSetting: 'hide',
+              adultOnly: false,
+              locales: [
+                {
+                  lang: 'en',
+                  name: 'Security Concerns',
+                  description:
+                    'May be unsafe and could harm your device, steal your info, or get your account hacked.',
+                },
+              ],
+            },
+            {
+              identifier: 'misleading',
+              blurs: 'content',
+              severity: 'alert',
+              defaultSetting: 'warn',
+              adultOnly: false,
+              locales: [
+                {
+                  lang: 'en',
+                  name: 'Misleading',
+                  description:
+                    'Altered images/videos, deceptive links, or false statements.',
+                },
+              ],
+            },
+            {
+              identifier: 'threat',
+              blurs: 'content',
+              severity: 'inform',
+              defaultSetting: 'hide',
+              adultOnly: false,
+              locales: [
+                {
+                  lang: 'en',
+                  name: 'Threats',
+                  description:
+                    'Promotes violence or harm towards others, including threats, incitement, or advocacy of harm.',
+                },
+              ],
+            },
+            {
+              identifier: 'unsafe-link',
+              blurs: 'content',
+              severity: 'alert',
+              defaultSetting: 'hide',
+              adultOnly: false,
+              locales: [
+                {
+                  lang: 'en',
+                  name: 'Unsafe link',
+                  description:
+                    'Links to harmful sites with malware, phishing, or violating content that risk security and privacy.',
+                },
+              ],
+            },
+            {
+              identifier: 'illicit',
+              blurs: 'content',
+              severity: 'alert',
+              defaultSetting: 'hide',
+              adultOnly: false,
+              locales: [
+                {
+                  lang: 'en',
+                  name: 'Illicit',
+                  description:
+                    'Promoting or selling potentially illicit goods, services, or activities.',
+                },
+              ],
+            },
+            {
+              identifier: 'misinformation',
+              blurs: 'content',
+              severity: 'inform',
+              defaultSetting: 'warn',
+              adultOnly: false,
+              locales: [
+                {
+                  lang: 'en',
+                  name: 'Misinformation',
+                  description:
+                    'Spreading false or misleading info, including unverified claims and harmful conspiracy theories.',
+                },
+              ],
+            },
+            {
+              identifier: 'rumor',
+              blurs: 'content',
+              severity: 'inform',
+              defaultSetting: 'warn',
+              adultOnly: false,
+              locales: [
+                {
+                  lang: 'en',
+                  name: 'Rumor',
+                  description:
+                    'Approach with caution, as these claims lack evidence from credible sources.',
+                },
+              ],
+            },
+            {
+              identifier: 'rude',
+              blurs: 'content',
+              severity: 'inform',
+              defaultSetting: 'hide',
+              adultOnly: false,
+              locales: [
+                {
+                  lang: 'en',
+                  name: 'Rude',
+                  description:
+                    'Rude or impolite, including crude language and disrespectful comments, without constructive purpose.',
+                },
+              ],
+            },
+            {
+              identifier: 'extremist',
+              blurs: 'content',
+              severity: 'alert',
+              defaultSetting: 'hide',
+              adultOnly: false,
+              locales: [
+                {
+                  lang: 'en',
+                  name: 'Extremist',
+                  description:
+                    'Radical views advocating violence, hate, or discrimination against individuals or groups.',
+                },
+              ],
+            },
+            {
+              identifier: 'sensitive',
+              blurs: 'content',
+              severity: 'alert',
+              defaultSetting: 'warn',
+              adultOnly: false,
+              locales: [
+                {
+                  lang: 'en',
+                  name: 'Sensitive',
+                  description:
+                    'May be upsetting, covering topics like substance abuse or mental health issues, cautioning sensitive viewers.',
+                },
+              ],
+            },
+            {
+              identifier: 'engagement-farming',
+              blurs: 'content',
+              severity: 'alert',
+              defaultSetting: 'hide',
+              adultOnly: false,
+              locales: [
+                {
+                  lang: 'en',
+                  name: 'Engagement Farming',
+                  description:
+                    'Insincere content or bulk actions aimed at gaining followers, including frequent follows, posts, and likes.',
+                },
+              ],
+            },
+            {
+              identifier: 'inauthentic',
+              blurs: 'content',
+              severity: 'alert',
+              defaultSetting: 'hide',
+              adultOnly: false,
+              locales: [
+                {
+                  lang: 'en',
+                  name: 'Inauthentic Account',
+                  description: 'Bot or a person pretending to be someone else.',
+                },
+              ],
+            },
+            {
+              identifier: 'sexual-figurative',
+              blurs: 'media',
+              severity: 'none',
+              defaultSetting: 'show',
+              adultOnly: true,
+              locales: [
+                {
+                  lang: 'en',
+                  name: 'Sexually Suggestive (Cartoon)',
+                  description:
+                    'Art with explicit or suggestive sexual themes, including provocative imagery or partial nudity.',
+                },
+              ],
+            },
+          ],
+        },
+        createdAt: new Date().toISOString(),
+      },
+    )
+  }
+}

package/src/service-profile.ts

@@ -0,0 +1,95 @@
+import type { AtpAgent } from '@atproto/api'
+import type { DidString } from '@atproto/lex'
+import type { TestPds } from './pds.js'
+
+export type ServiceUserDetails = {
+  email: string
+  handle: string
+  password: string
+}
+
+export type ServiceMigrationOptions = {
+  services?: Record<string, unknown>
+  verificationMethods?: Record<string, unknown>
+}
+
+export class ServiceProfile {
+  protected constructor(
+    protected pds: TestPds,
+    /** @note assumes the session is already authenticated */
+    protected agent: AtpAgent,
+    protected userDetails: ServiceUserDetails,
+  ) {}
+
+  get did(): DidString {
+    return this.agent.assertDid
+  }
+
+  async migrateTo(newPds: TestPds, options: ServiceMigrationOptions = {}) {
+    const newAgent = newPds.getAgent()
+
+    const newPdsDesc = await newAgent.com.atproto.server.describeServer()
+    const serviceAuth = await this.agent.com.atproto.server.getServiceAuth({
+      aud: newPdsDesc.data.did,
+      lxm: 'com.atproto.server.createAccount',
+    })
+
+    const inviteCode = newPds.ctx.cfg.invites.required
+      ? await newAgent.com.atproto.server
+          .createInviteCode(
+            { useCount: 1 },
+            {
+              encoding: 'application/json',
+              headers: newPds.adminAuthHeaders(),
+            },
+          )
+          .then((res) => res.data.code)
+      : undefined
+
+    await newAgent.createAccount(
+      {
+        ...this.userDetails,
+        inviteCode,
+        did: this.did,
+      },
+      {
+        encoding: 'application/json',
+        headers: { authorization: `Bearer ${serviceAuth.data.token}` },
+      },
+    )
+
+    // The session manager will use the "didDoc" in the result of
+    // "createAccount" in order to setup the pdsUrl. However, since are in the
+    // process of migrating, that didDoc references the old PDS. In order to
+    // avoid calling the old PDS, let's clear the pdsUrl, which will result in
+    // the (new) serviceUrl being used.
+    newAgent.sessionManager.pdsUrl = undefined
+
+    const newDidCredentialsRes =
+      await newAgent.com.atproto.identity.getRecommendedDidCredentials()
+
+    await this.agent.com.atproto.identity.requestPlcOperationSignature()
+    const { token } = await this.pds.ctx.accountManager.db.db
+      .selectFrom('email_token')
+      .select('token')
+      .where('did', '=', this.did)
+      .where('purpose', '=', 'plc_operation')
+      .executeTakeFirstOrThrow()
+
+    const op = { ...newDidCredentialsRes.data, token }
+    Object.assign((op.services ??= {}), options.services)
+    Object.assign((op.verificationMethods ??= {}), options.verificationMethods)
+
+    const signedPlcOperation =
+      await this.agent.com.atproto.identity.signPlcOperation(op)
+
+    await newAgent.com.atproto.identity.submitPlcOperation({
+      operation: signedPlcOperation.data.operation,
+    })
+
+    await newAgent.com.atproto.server.activateAccount()
+
+    this.pds = newPds
+    this.agent = newAgent
+  }
+}

package/src/types.ts

@@ -0,0 +1,68 @@
+import type * as bsky from '@atproto/bsky'
+import type * as bsync from '@atproto/bsync'
+import type { ExportableKeypair, Keypair } from '@atproto/crypto'
+import type * as ozone from '@atproto/ozone'
+import type * as pds from '@atproto/pds'
+
+export type IntrospectConfig = {
+  port?: number
+}
+
+export type PlcConfig = {
+  port?: number
+  version?: string
+}
+
+export type PdsConfig = Partial<pds.ServerEnvironment> & {
+  didPlcUrl: string
+  migration?: string
+}
+
+export type BskyConfig = Partial<bsky.ServerConfig> & {
+  bsyncUrl: string
+  plcUrl: string
+  repoProvider: string
+  dbPostgresUrl: string
+  dbPostgresSchema: string
+  redisHost: string
+  pdsPort: number
+  migration?: string
+  privateKey?: string
+}
+
+export type BsyncConfig = Partial<bsync.ServerEnvironment> & {
+  dbUrl: string
+}
+
+export type OzoneConfig = Partial<ozone.OzoneEnvironment> & {
+  plcUrl: string
+  appviewUrl: string
+  appviewDid: string
+  dbPostgresUrl: string
+  migration?: string
+  signingKey?: ExportableKeypair
+  imgInvalidator?: ozone.ImageInvalidator
+}
+
+export type TestServerParams = {
+  dbPostgresUrl: string
+  dbPostgresSchema: string
+  pds: Partial<PdsConfig>
+  plc: Partial<PlcConfig>
+  bsky: Partial<BskyConfig>
+  ozone: Partial<OzoneConfig>
+  introspect: Partial<IntrospectConfig>
+  extraPdses: number
+  /**
+   * Create a lexicon-authority account and point every PDS at it, so lexicon
+   * documents (permission sets, `space` declarations) resolve. Opt-in: it costs
+   * an account creation plus a record write per document, which most tests don't
+   * need. `TestNetwork` always does this.
+   */
+  lexiconAuthority: boolean
+}
+
+export type DidAndKey = {
+  did: string
+  key: Keypair
+}

package/src/util.ts

@@ -0,0 +1,118 @@
+import * as plc from '@did-plc/lib'
+import { request } from 'undici'
+import { Secp256k1Keypair } from '@atproto/crypto'
+import type { IdResolver } from '@atproto/identity'
+import type { TestBsky } from './bsky.js'
+import type { TestPds } from './pds.js'
+import type { DidAndKey } from './types.js'
+
+export const mockNetworkUtilities = (
+  pds: TestPds | TestPds[],
+  bsky?: TestBsky,
+) => {
+  const pdses = Array.isArray(pds) ? pds : [pds]
+  for (const p of pdses) {
+    mockResolvers(p.ctx.idResolver, pdses)
+  }
+  if (bsky) {
+    mockResolvers(bsky.ctx.idResolver, pdses)
+    mockResolvers(bsky.dataplane.idResolver, pdses)
+  }
+}
+
+export const mockResolvers = (
+  idResolver: IdResolver,
+  pds: TestPds | TestPds[],
+  // handles resolve against the matching pds by default, but may point
+  // elsewhere e.g. an entryway
+  handleResolveUrl?: string,
+) => {
+  const pdses = Array.isArray(pds) ? pds : [pds]
+
+  // Map pds public url to its local url when resolving from plc
+  const origResolveDid = idResolver.did.resolveNoCache
+  idResolver.did.resolveNoCache = async (did: string) => {
+    const result = await (origResolveDid.call(
+      idResolver.did,
+      did,
+    ) as ReturnType<typeof origResolveDid>)
+    const service = result?.service?.find((svc) => svc.id === '#atproto_pds')
+    if (typeof service?.serviceEndpoint === 'string') {
+      for (const p of pdses) {
+        service.serviceEndpoint = service.serviceEndpoint.replace(
+          p.ctx.cfg.service.publicUrl,
+          `http://localhost:${p.port}`,
+        )
+      }
+    }
+    return result
+  }
+
+  const origResolveHandleDns = idResolver.handle.resolveDns
+  idResolver.handle.resolve = async (handle: string) => {
+    // Handle domains across PDSes are disjoint suffixes (.test, .test2, ...);
+    // first match wins.
+    const match = pdses.find((p) =>
+      p.ctx.cfg.identity.serviceHandleDomains.some((d) => handle.endsWith(d)),
+    )
+    if (!match) {
+      return origResolveHandleDns.call(idResolver.handle, handle)
+    }
+
+    const url = new URL(
+      `/.well-known/atproto-did`,
+      handleResolveUrl ?? match.url,
+    )
+    try {
+      const res = await request(url, { headers: { host: handle } })
+      if (res.statusCode !== 200) {
+        await res.body.dump()
+        return undefined
+      }
+
+      return res.body.text()
+    } catch (err) {
+      return undefined
+    }
+  }
+}
+
+export const mockMailer = (pds: TestPds) => {
+  const mailer = pds.ctx.mailer
+  const _origSendMail = mailer.transporter.sendMail
+  mailer.transporter.sendMail = async (opts) => {
+    const result = await _origSendMail.call(mailer.transporter, opts)
+    console.log(`✉️ Email: ${JSON.stringify(result, null, 2)}`)
+    return result
+  }
+}
+
+const usedLockIds = new Set()
+export const uniqueLockId = () => {
+  let lockId: number
+  do {
+    lockId = 1000 + Math.ceil(1000 * Math.random())
+  } while (usedLockIds.has(lockId))
+  usedLockIds.add(lockId)
+  return lockId
+}
+
+export const createDidAndKey = async (opts: {
+  plcUrl: string
+  handle: string
+  pds: string
+}): Promise<DidAndKey> => {
+  const { plcUrl, handle, pds } = opts
+  const key = await Secp256k1Keypair.create({ exportable: true })
+  const did = await new plc.Client(plcUrl).createDid({
+    signingKey: key.did(),
+    rotationKeys: [key.did()],
+    handle,
+    pds,
+    signer: key,
+  })
+  return {
+    key,
+    did,
+  }
+}

package/tsconfig.build.json

@@ -0,0 +1,25 @@
+{
+  "extends": ["../../tsconfig/node.tsconfig.json"],
+  "include": ["./src"],
+  "references": [
+    { "path": "../api/tsconfig.build.json" },
+    { "path": "../bsky/tsconfig.build.json" },
+    { "path": "../bsync/tsconfig.build.json" },
+    { "path": "../common-web/tsconfig.build.json" },
+    { "path": "../crypto/tsconfig.build.json" },
+    { "path": "../identity/tsconfig.build.json" },
+    { "path": "../lex/lex/tsconfig.build.json" },
+    { "path": "../lexicon/tsconfig.build.json" },
+    { "path": "../ozone/tsconfig.build.json" },
+    { "path": "../pds/tsconfig.build.json" },
+    { "path": "../sync/tsconfig.build.json" },
+    { "path": "../syntax/tsconfig.build.json" },
+    { "path": "../xrpc-server/tsconfig.build.json" },
+  ],
+  "compilerOptions": {
+    "rootDir": "./src",
+    "outDir": "./dist",
+    // @TODO Change to true and fix implicit any errors
+    "noImplicitAny": false,
+  },
+}

package/tsconfig.json

@@ -0,0 +1,4 @@
+{
+  "include": [],
+  "references": [{ "path": "./tsconfig.build.json" }],
+}