@atproto/ozone 0.0.15 → 0.0.16

package/src/auth-verifier.ts

@@ -0,0 +1,218 @@
+import express from 'express'
+import * as ui8 from 'uint8arrays'
+import { IdResolver } from '@atproto/identity'
+import { AuthRequiredError, verifyJwt } from '@atproto/xrpc-server'
+
+type ReqCtx = {
+  req: express.Request
+}
+
+type RoleOutput = {
+  credentials: {
+    type: 'role'
+    isAdmin: boolean
+    isModerator: boolean
+    isTriage: true
+  }
+}
+
+type ModeratorOutput = {
+  credentials: {
+    type: 'moderator'
+    aud: string
+    iss: string
+    isAdmin: boolean
+    isModerator: boolean
+    isTriage: true
+  }
+}
+
+type StandardOutput = {
+  credentials: {
+    type: 'standard'
+    aud: string
+    iss: string
+    isAdmin: boolean
+    isModerator: boolean
+    isTriage: boolean
+  }
+}
+
+type NullOutput = {
+  credentials: {
+    type: 'none'
+    iss: null
+  }
+}
+
+export type AuthVerifierOpts = {
+  serviceDid: string
+  admins: string[]
+  moderators: string[]
+  triage: string[]
+  adminPassword: string
+  moderatorPassword: string
+  triagePassword: string
+}
+
+export class AuthVerifier {
+  serviceDid: string
+  admins: string[]
+  moderators: string[]
+  triage: string[]
+  private adminPassword: string
+  private moderatorPassword: string
+  private triagePassword: string
+
+  constructor(public idResolver: IdResolver, opts: AuthVerifierOpts) {
+    this.serviceDid = opts.serviceDid
+    this.admins = opts.admins
+    this.moderators = opts.moderators
+    this.triage = opts.triage
+    this.adminPassword = opts.adminPassword
+    this.moderatorPassword = opts.moderatorPassword
+    this.triagePassword = opts.triagePassword
+  }
+
+  modOrRole = async (reqCtx: ReqCtx): Promise<ModeratorOutput | RoleOutput> => {
+    if (isBearerToken(reqCtx.req)) {
+      return this.moderator(reqCtx)
+    } else {
+      return this.role(reqCtx)
+    }
+  }
+
+  moderator = async (reqCtx: ReqCtx): Promise<ModeratorOutput> => {
+    const creds = await this.standard(reqCtx)
+    if (!creds.credentials.isTriage) {
+      throw new AuthRequiredError('not a moderator account')
+    }
+    return {
+      credentials: {
+        ...creds.credentials,
+        type: 'moderator',
+        isTriage: true,
+      },
+    }
+  }
+
+  standard = async (reqCtx: ReqCtx): Promise<StandardOutput> => {
+    const getSigningKey = async (
+      did: string,
+      forceRefresh: boolean,
+    ): Promise<string> => {
+      const atprotoData = await this.idResolver.did.resolveAtprotoData(
+        did,
+        forceRefresh,
+      )
+      return atprotoData.signingKey
+    }
+
+    const jwtStr = getJwtStrFromReq(reqCtx.req)
+    if (!jwtStr) {
+      throw new AuthRequiredError('missing jwt', 'MissingJwt')
+    }
+    const payload = await verifyJwt(jwtStr, this.serviceDid, getSigningKey)
+    const iss = payload.iss
+    const isAdmin = this.admins.includes(iss)
+    const isModerator = isAdmin || this.moderators.includes(iss)
+    const isTriage = isModerator || this.triage.includes(iss)
+    return {
+      credentials: {
+        type: 'standard',
+        iss,
+        aud: payload.aud,
+        isAdmin,
+        isModerator,
+        isTriage,
+      },
+    }
+  }
+
+  standardOptional = async (
+    reqCtx: ReqCtx,
+  ): Promise<StandardOutput | NullOutput> => {
+    if (isBearerToken(reqCtx.req)) {
+      return this.standard(reqCtx)
+    }
+    return this.nullCreds()
+  }
+
+  standardOptionalOrRole = async (
+    reqCtx: ReqCtx,
+  ): Promise<StandardOutput | RoleOutput | NullOutput> => {
+    if (isBearerToken(reqCtx.req)) {
+      return this.standard(reqCtx)
+    } else if (isBasicToken(reqCtx.req)) {
+      return this.role(reqCtx)
+    } else {
+      return this.nullCreds()
+    }
+  }
+
+  role = async (reqCtx: ReqCtx): Promise<RoleOutput> => {
+    const parsed = parseBasicAuth(reqCtx.req.headers.authorization ?? '')
+    const { username, password } = parsed ?? {}
+    if (username !== 'admin') {
+      throw new AuthRequiredError()
+    }
+    const isAdmin = password === this.adminPassword
+    const isModerator = isAdmin || password === this.moderatorPassword
+    const isTriage = isModerator || password === this.triagePassword
+    if (!isTriage) {
+      throw new AuthRequiredError()
+    }
+    return {
+      credentials: {
+        type: 'role',
+        isAdmin,
+        isModerator,
+        isTriage,
+      },
+    }
+  }
+
+  nullCreds(): NullOutput {
+    return {
+      credentials: {
+        type: 'none',
+        iss: null,
+      },
+    }
+  }
+}
+
+const BEARER = 'Bearer '
+const BASIC = 'Basic '
+
+const isBearerToken = (req: express.Request): boolean => {
+  return req.headers.authorization?.startsWith(BEARER) ?? false
+}
+
+const isBasicToken = (req: express.Request): boolean => {
+  return req.headers.authorization?.startsWith(BASIC) ?? false
+}
+
+export const getJwtStrFromReq = (req: express.Request): string | null => {
+  const { authorization } = req.headers
+  if (!authorization?.startsWith(BEARER)) {
+    return null
+  }
+  return authorization.slice(BEARER.length).trim()
+}
+
+export const parseBasicAuth = (
+  token: string,
+): { username: string; password: string } | null => {
+  if (!token.startsWith(BASIC)) return null
+  const b64 = token.slice(BASIC.length)
+  let parsed: string[]
+  try {
+    parsed = ui8.toString(ui8.fromString(b64, 'base64pad'), 'utf8').split(':')
+  } catch (err) {
+    return null
+  }
+  const [username, password] = parsed
+  if (!username || !password) return null
+  return { username, password }
+}

package/src/config/config.ts

@@ -13,6 +13,7 @@ export const envToCfg = (env: OzoneEnvironment): OzoneConfig => {
     publicUrl: env.publicUrl,
     did: env.serverDid,
     version: env.version,
+    devMode: env.devMode,
   }
 
   assert(env.dbPostgresUrl)
@@ -47,6 +48,12 @@ export const envToCfg = (env: OzoneEnvironment): OzoneConfig => {
     plcUrl: env.didPlcUrl,
   }
 
+  const accessCfg: OzoneConfig['access'] = {
+    admins: env.adminDids,
+    moderators: env.moderatorDids,
+    triage: env.triageDids,
+  }
+
   return {
     service: serviceCfg,
     db: dbCfg,
@@ -54,6 +61,7 @@ export const envToCfg = (env: OzoneEnvironment): OzoneConfig => {
     pds: pdsCfg,
     cdn: cdnCfg,
     identity: identityCfg,
+    access: accessCfg,
   }
 }
 
@@ -64,6 +72,7 @@ export type OzoneConfig = {
   pds: PdsConfig | null
   cdn: CdnConfig
   identity: IdentityConfig
+  access: AccessConfig
 }
 
 export type ServiceConfig = {
@@ -71,6 +80,7 @@ export type ServiceConfig = {
   publicUrl: string
   did: string
   version?: string
+  devMode?: boolean
 }
 
 export type DatabaseConfig = {
@@ -91,10 +101,16 @@ export type PdsConfig = {
   did: string
 }
 
+export type CdnConfig = {
+  paths?: string[]
+}
+
 export type IdentityConfig = {
   plcUrl: string
 }
 
-export type CdnConfig = {
-  paths?: string[]
+export type AccessConfig = {
+  admins: string[]
+  moderators: string[]
+  triage: string[]
 }

package/src/config/env.ts

@@ -1,8 +1,9 @@
-import { envInt, envList, envStr } from '@atproto/common'
+import { envBool, envInt, envList, envStr } from '@atproto/common'
 
 export const readEnv = (): OzoneEnvironment => {
   return {
     nodeEnv: envStr('NODE_ENV'),
+    devMode: envBool('OZONE_DEV_MODE'),
     version: envStr('OZONE_VERSION'),
     port: envInt('OZONE_PORT'),
     publicUrl: envStr('OZONE_PUBLIC_URL'),
@@ -18,6 +19,9 @@ export const readEnv = (): OzoneEnvironment => {
     dbPoolIdleTimeoutMs: envInt('OZONE_DB_POOL_IDLE_TIMEOUT_MS'),
     didPlcUrl: envStr('OZONE_DID_PLC_URL'),
     cdnPaths: envList('OZONE_CDN_PATHS'),
+    adminDids: envList('OZONE_ADMIN_DIDS'),
+    moderatorDids: envList('OZONE_MODERATOR_DIDS'),
+    triageDids: envList('OZONE_TRIAGE_DIDS'),
     adminPassword: envStr('OZONE_ADMIN_PASSWORD'),
     moderatorPassword: envStr('OZONE_MODERATOR_PASSWORD'),
     triagePassword: envStr('OZONE_TRIAGE_PASSWORD'),
@@ -27,6 +31,7 @@ export const readEnv = (): OzoneEnvironment => {
 
 export type OzoneEnvironment = {
   nodeEnv?: string
+  devMode?: boolean
   version?: string
   port?: number
   publicUrl?: string
@@ -42,6 +47,9 @@ export type OzoneEnvironment = {
   dbPoolIdleTimeoutMs?: number
   didPlcUrl?: string
   cdnPaths?: string[]
+  adminDids: string[]
+  moderatorDids: string[]
+  triageDids: string[]
   adminPassword?: string
   moderatorPassword?: string
   triagePassword?: string

package/src/context.ts

@@ -6,7 +6,6 @@ import { createServiceAuthHeaders } from '@atproto/xrpc-server'
 import { Database } from './db'
 import { OzoneConfig, OzoneSecrets } from './config'
 import { ModerationService, ModerationServiceCreator } from './mod-service'
-import * as auth from './auth'
 import { BackgroundQueue } from './background'
 import assert from 'assert'
 import { EventPusher } from './daemon'
@@ -15,6 +14,7 @@ import {
   CommunicationTemplateService,
   CommunicationTemplateServiceCreator,
 } from './communication-service/template'
+import { AuthVerifier } from './auth-verifier'
 import { ImageInvalidator } from './image-invalidator'
 
 export type AppContextOptions = {
@@ -29,6 +29,7 @@ export type AppContextOptions = {
   imgInvalidator?: ImageInvalidator
   backgroundQueue: BackgroundQueue
   sequencer: Sequencer
+  authVerifier: AuthVerifier
 }
 
 export class AppContext {
@@ -54,12 +55,10 @@ export class AppContext {
 
     const createAuthHeaders = (aud: string) =>
       createServiceAuthHeaders({
-        iss: cfg.service.did,
+        iss: `${cfg.service.did}#atproto_labeler`,
         aud,
         keypair: signingKey,
       })
-    const appviewAuth = async () =>
-      cfg.appview.did ? createAuthHeaders(cfg.appview.did) : undefined
 
     const backgroundQueue = new BackgroundQueue(db)
     const eventPusher = new EventPusher(db, createAuthHeaders, {
@@ -67,11 +66,17 @@ export class AppContext {
       pds: cfg.pds ?? undefined,
     })
 
+    const idResolver = new IdResolver({
+      plcUrl: cfg.identity.plcUrl,
+    })
+
     const modService = ModerationService.creator(
+      cfg,
       backgroundQueue,
+      idResolver,
       eventPusher,
       appviewAgent,
-      appviewAuth,
+      createAuthHeaders,
       cfg.service.did,
       overrides?.imgInvalidator,
       cfg.cdn.paths,
@@ -79,12 +84,18 @@ export class AppContext {
 
     const communicationTemplateService = CommunicationTemplateService.creator()
 
-    const idResolver = new IdResolver({
-      plcUrl: cfg.identity.plcUrl,
-    })
-
     const sequencer = new Sequencer(db)
 
+    const authVerifier = new AuthVerifier(idResolver, {
+      serviceDid: cfg.service.did,
+      admins: cfg.access.admins,
+      moderators: cfg.access.moderators,
+      triage: cfg.access.triage,
+      adminPassword: secrets.adminPassword,
+      moderatorPassword: secrets.moderatorPassword,
+      triagePassword: secrets.triagePassword,
+    })
+
     return new AppContext(
       {
         db,
@@ -97,6 +108,7 @@ export class AppContext {
         idResolver,
         backgroundQueue,
         sequencer,
+        authVerifier,
         ...(overrides ?? {}),
       },
       secrets,
@@ -155,38 +167,12 @@ export class AppContext {
     return this.opts.sequencer
   }
 
-  get authVerifier() {
-    return auth.authVerifier(this.idResolver, { aud: this.cfg.service.did })
-  }
-
-  get authVerifierAnyAudience() {
-    return auth.authVerifier(this.idResolver, { aud: null })
-  }
-
-  get authOptionalVerifierAnyAudience() {
-    return auth.authOptionalVerifier(this.idResolver, { aud: null })
-  }
-
-  get authOptionalVerifier() {
-    return auth.authOptionalVerifier(this.idResolver, {
-      aud: this.cfg.service.did,
-    })
-  }
-
-  get authOptionalAccessOrRoleVerifier() {
-    return auth.authOptionalAccessOrRoleVerifier(
-      this.idResolver,
-      this.secrets,
-      this.cfg.service.did,
-    )
-  }
-
-  get roleVerifier() {
-    return auth.roleVerifier(this.secrets)
+  get authVerifier(): AuthVerifier {
+    return this.opts.authVerifier
   }
 
   async serviceAuthHeaders(aud: string) {
-    const iss = this.cfg.service.did
+    const iss = `${this.cfg.service.did}#atproto_labeler`
     return createServiceAuthHeaders({
       iss,
       aud,

package/src/daemon/context.ts

@@ -7,6 +7,7 @@ import { EventPusher } from './event-pusher'
 import { EventReverser } from './event-reverser'
 import { ModerationService, ModerationServiceCreator } from '../mod-service'
 import { BackgroundQueue } from '../background'
+import { IdResolver } from '@atproto/identity'
 
 export type DaemonContextOptions = {
   db: Database
@@ -39,21 +40,26 @@ export class DaemonContext {
         keypair: signingKey,
       })
 
-    const appviewAuth = async () =>
-      cfg.appview.did ? createAuthHeaders(cfg.appview.did) : undefined
-
     const eventPusher = new EventPusher(db, createAuthHeaders, {
       appview: cfg.appview,
       pds: cfg.pds ?? undefined,
     })
+
     const backgroundQueue = new BackgroundQueue(db)
+    const idResolver = new IdResolver({
+      plcUrl: cfg.identity.plcUrl,
+    })
+
     const modService = ModerationService.creator(
+      cfg,
       backgroundQueue,
+      idResolver,
       eventPusher,
       appviewAgent,
-      appviewAuth,
+      createAuthHeaders,
       cfg.service.did,
     )
+
     const eventReverser = new EventReverser(db, modService)
 
     return new DaemonContext({

package/src/daemon/event-pusher.ts

@@ -205,7 +205,7 @@ export class EventPusher {
             ? { confirmedAt: new Date() }
             : {
                 lastAttempted: new Date(),
-                attempts: evt.attempts ?? 0 + 1,
+                attempts: (evt.attempts ?? 0) + 1,
               },
         )
         .where('subjectDid', '=', evt.subjectDid)
@@ -244,7 +244,7 @@ export class EventPusher {
             ? { confirmedAt: new Date() }
             : {
                 lastAttempted: new Date(),
-                attempts: evt.attempts ?? 0 + 1,
+                attempts: (evt.attempts ?? 0) + 1,
               },
         )
         .where('subjectUri', '=', evt.subjectUri)
@@ -284,7 +284,7 @@ export class EventPusher {
             ? { confirmedAt: new Date() }
             : {
                 lastAttempted: new Date(),
-                attempts: evt.attempts ?? 0 + 1,
+                attempts: (evt.attempts ?? 0) + 1,
               },
         )
         .where('subjectDid', '=', evt.subjectDid)

package/src/lexicon/lexicons.ts

@@ -897,6 +897,10 @@ export const schemaDict = {
             type: 'string',
             description: 'The subject line of the email sent to the user.',
           },
+          content: {
+            type: 'string',
+            description: 'The content of the email sent to the user.',
+          },
           comment: {
             type: 'string',
             description: 'Additional comment about the outgoing comm.',
@@ -5180,6 +5184,7 @@ export const schemaDict = {
             type: 'boolean',
             description:
               'Hide replies in the feed if they are not by followed users.',
+            default: true,
           },
           hideRepliesByLikeCount: {
             type: 'integer',

package/src/lexicon/types/app/bsky/actor/defs.ts

@@ -197,7 +197,7 @@ export interface FeedViewPref {
   /** Hide replies in the feed. */
   hideReplies?: boolean
   /** Hide replies in the feed if they are not by followed users. */
-  hideRepliesByUnfollowed?: boolean
+  hideRepliesByUnfollowed: boolean
   /** Hide replies in the feed if they do not have this number of likes. */
   hideRepliesByLikeCount?: number
   /** Hide reposts in the feed. */

package/src/lexicon/types/com/atproto/admin/defs.ts

@@ -704,6 +704,8 @@ export function validateModEventUnmute(v: unknown): ValidationResult {
 export interface ModEventEmail {
   /** The subject line of the email sent to the user. */
   subjectLine: string
+  /** The content of the email sent to the user. */
+  content?: string
   /** Additional comment about the outgoing comm. */
   comment?: string
   [k: string]: unknown

package/src/mod-service/index.ts

@@ -1,9 +1,13 @@
+import net from 'node:net'
+import { Insertable, sql } from 'kysely'
 import { CID } from 'multiformats/cid'
 import { AtUri, INVALID_HANDLE } from '@atproto/syntax'
 import { InvalidRequestError } from '@atproto/xrpc-server'
 import { addHoursToDate } from '@atproto/common'
+import { IdResolver } from '@atproto/identity'
+import AtpAgent from '@atproto/api'
 import { Database } from '../db'
-import { AppviewAuth, ModerationViews } from './views'
+import { AuthHeaders, ModerationViews } from './views'
 import { Main as StrongRef } from '../lexicon/types/com/atproto/repo/strongRef'
 import {
   isModEventComment,
@@ -30,9 +34,7 @@ import {
 } from './types'
 import { ModerationEvent } from '../db/schema/moderation_event'
 import { StatusKeyset, TimeIdKeyset, paginate } from '../db/pagination'
-import AtpAgent from '@atproto/api'
 import { Label } from '../lexicon/types/com/atproto/label/defs'
-import { Insertable, sql } from 'kysely'
 import {
   ModSubject,
   RecordSubject,
@@ -46,26 +48,31 @@ import { BackgroundQueue } from '../background'
 import { EventPusher } from '../daemon'
 import { ImageInvalidator } from '../image-invalidator'
 import { httpLogger as log } from '../logger'
+import { OzoneConfig } from '../config'
 
 export type ModerationServiceCreator = (db: Database) => ModerationService
 
 export class ModerationService {
   constructor(
     public db: Database,
+    public cfg: OzoneConfig,
     public backgroundQueue: BackgroundQueue,
+    public idResolver: IdResolver,
     public eventPusher: EventPusher,
     public appviewAgent: AtpAgent,
-    private appviewAuth: AppviewAuth,
+    private createAuthHeaders: (aud: string) => Promise<AuthHeaders>,
     public serverDid: string,
     public imgInvalidator?: ImageInvalidator,
     public cdnPaths?: string[],
   ) {}
 
   static creator(
+    cfg: OzoneConfig,
     backgroundQueue: BackgroundQueue,
+    idResolver: IdResolver,
     eventPusher: EventPusher,
     appviewAgent: AtpAgent,
-    appviewAuth: AppviewAuth,
+    createAuthHeaders: (aud: string) => Promise<AuthHeaders>,
     serverDid: string,
     imgInvalidator?: ImageInvalidator,
     cdnPaths?: string[],
@@ -73,17 +80,21 @@ export class ModerationService {
     return (db: Database) =>
       new ModerationService(
         db,
+        cfg,
         backgroundQueue,
+        idResolver,
         eventPusher,
         appviewAgent,
-        appviewAuth,
+        createAuthHeaders,
         serverDid,
         imgInvalidator,
         cdnPaths,
       )
   }
 
-  views = new ModerationViews(this.db, this.appviewAgent, this.appviewAuth)
+  views = new ModerationViews(this.db, this.appviewAgent, () =>
+    this.createAuthHeaders(this.cfg.appview.did),
+  )
 
   async getEvent(id: number): Promise<ModerationEventRow | undefined> {
     return await this.db.db
@@ -291,6 +302,9 @@ export class ModerationService {
 
     if (isModEventEmail(event)) {
       meta.subjectLine = event.subjectLine
+      if (event.content) {
+        meta.content = event.content
+      }
     }
 
     const subjectInfo = subject.info()
@@ -903,6 +917,49 @@ export class ModerationService {
       )
       .execute()
   }
+
+  async sendEmail(opts: {
+    content: string
+    recipientDid: string
+    subject: string
+  }) {
+    const { subject, content, recipientDid } = opts
+    const { pds } = await this.idResolver.did.resolveAtprotoData(recipientDid)
+    const url = new URL(pds)
+    if (!this.cfg.service.devMode && !isSafeUrl(url)) {
+      throw new InvalidRequestError('Invalid pds service in DID doc')
+    }
+    const agent = new AtpAgent({ service: url })
+    const { data: serverInfo } =
+      await agent.api.com.atproto.server.describeServer()
+    if (serverInfo.did !== `did:web:${url.hostname}`) {
+      // @TODO do bidirectional check once implemented. in the meantime,
+      // matching did to hostname we're talking to is pretty good.
+      throw new InvalidRequestError('Invalid pds service in DID doc')
+    }
+    const { data: delivery } = await agent.api.com.atproto.admin.sendEmail(
+      {
+        subject,
+        content,
+        recipientDid,
+        senderDid: this.cfg.service.did,
+      },
+      {
+        encoding: 'application/json',
+        ...(await this.createAuthHeaders(serverInfo.did)),
+      },
+    )
+    if (!delivery.sent) {
+      throw new InvalidRequestError('Email was accepted but not sent')
+    }
+  }
+}
+
+const isSafeUrl = (url: URL) => {
+  if (url.protocol !== 'https:') return false
+  if (!url.hostname || url.hostname === 'localhost') return false
+  if (net.isIP(url.hostname) !== 0) return false
+  return true
 }
 
 const TAKEDOWNS = ['pds_takedown' as const, 'appview_takedown' as const]