@atproto/ozone 0.0.15 → 0.0.16

package/src/mod-service/views.ts

@@ -25,36 +25,39 @@ import {
 import { REASONOTHER } from '../lexicon/types/com/atproto/moderation/defs'
 import { subjectFromEventRow, subjectFromStatusRow } from './subject'
 import { formatLabel } from './util'
+import { httpLogger as log } from '../logger'
 
-export type AppviewAuth = () => Promise<
-  | {
-      headers: {
-        authorization: string
-      }
-    }
-  | undefined
->
+export type AuthHeaders = {
+  headers: {
+    authorization: string
+  }
+}
 
 export class ModerationViews {
   constructor(
     private db: Database,
     private appviewAgent: AtpAgent,
-    private appviewAuth: AppviewAuth,
+    private appviewAuth: () => Promise<AuthHeaders>,
   ) {}
 
   async getAccoutInfosByDid(dids: string[]): Promise<Map<string, AccountView>> {
     if (dids.length === 0) return new Map()
     const auth = await this.appviewAuth()
     if (!auth) return new Map()
-    const res = await this.appviewAgent.api.com.atproto.admin.getAccountInfos(
-      {
-        dids: dedupeStrs(dids),
-      },
-      auth,
-    )
-    return res.data.infos.reduce((acc, cur) => {
-      return acc.set(cur.did, cur)
-    }, new Map<string, AccountView>())
+    try {
+      const res = await this.appviewAgent.api.com.atproto.admin.getAccountInfos(
+        {
+          dids: dedupeStrs(dids),
+        },
+        auth,
+      )
+      return res.data.infos.reduce((acc, cur) => {
+        return acc.set(cur.did, cur)
+      }, new Map<string, AccountView>())
+    } catch (err) {
+      log.error({ err, dids }, 'failed to resolve account infos from appview')
+      return new Map()
+    }
   }
 
   async repos(dids: string[]): Promise<Map<string, RepoView>> {
@@ -154,6 +157,7 @@ export class ModerationViews {
       eventView.event = {
         ...eventView.event,
         subjectLine: event.meta?.subjectLine ?? '',
+        content: event.meta?.content,
       }
     }
 

package/tests/moderation-events.test.ts

@@ -1,4 +1,6 @@
 import assert from 'node:assert'
+import EventEmitter, { once } from 'node:events'
+import Mail from 'nodemailer/lib/mailer'
 import { TestNetwork, SeedClient, basicSeed } from '@atproto/dev-env'
 import AtpAgent, {
   ComAtprotoAdminDefs,
@@ -422,4 +424,51 @@ describe('moderation-events', () => {
       })
     })
   })
+
+  describe('email event', () => {
+    let sendMailOriginal
+    const mailCatcher = new EventEmitter()
+    const getMailFrom = async (promise): Promise<Mail.Options> => {
+      const result = await Promise.all([once(mailCatcher, 'mail'), promise])
+      return result[0][0]
+    }
+
+    beforeAll(() => {
+      const mailer = network.pds.ctx.moderationMailer
+      // Catch emails for use in tests
+      sendMailOriginal = mailer.transporter.sendMail
+      mailer.transporter.sendMail = async (opts) => {
+        const result = await sendMailOriginal.call(mailer.transporter, opts)
+        mailCatcher.emit('mail', opts)
+        return result
+      }
+    })
+
+    afterAll(() => {
+      network.pds.ctx.moderationMailer.transporter.sendMail = sendMailOriginal
+    })
+
+    it('sends email via pds.', async () => {
+      const mail = await getMailFrom(
+        emitModerationEvent({
+          event: {
+            $type: 'com.atproto.admin.defs#modEventEmail',
+            comment: 'Reaching out to Alice',
+            subjectLine: 'Hello',
+            content: 'Hey Alice, how are you?',
+          },
+          subject: {
+            $type: 'com.atproto.admin.defs#repoRef',
+            did: sc.dids.alice,
+          },
+          createdBy: sc.dids.bob,
+        }),
+      )
+      expect(mail).toEqual({
+        to: 'alice@test.com',
+        subject: 'Hello',
+        html: 'Hey Alice, how are you?',
+      })
+    })
+  })
 })

package/dist/auth.d.ts

@@ -1,81 +0,0 @@
-import express from 'express';
-import { IdResolver } from '@atproto/identity';
-import { OzoneSecrets } from './config';
-export declare const authVerifier: (idResolver: IdResolver, opts: {
-    aud: string | null;
-}) => (reqCtx: {
-    req: express.Request;
-    res: express.Response;
-}) => Promise<{
-    credentials: {
-        did: string;
-    };
-    artifacts: {
-        aud: string | null;
-    };
-}>;
-export declare const authOptionalVerifier: (idResolver: IdResolver, opts: {
-    aud: string | null;
-}) => (reqCtx: {
-    req: express.Request;
-    res: express.Response;
-}) => Promise<{
-    credentials: {
-        did: string;
-    };
-    artifacts: {
-        aud: string | null;
-    };
-} | {
-    credentials: {
-        did: null;
-    };
-}>;
-export declare const authOptionalAccessOrRoleVerifier: (idResolver: IdResolver, secrets: OzoneSecrets, serverDid: string) => (ctx: {
-    req: express.Request;
-    res: express.Response;
-}) => Promise<{
-    credentials: {
-        did: null;
-        type: "unauthed";
-    };
-} | {
-    credentials: {
-        valid: boolean;
-        admin: boolean;
-        moderator: boolean;
-        triage: boolean;
-        type: "role";
-    };
-} | {
-    credentials: {
-        did: string;
-        type: "access";
-    };
-    artifacts: {
-        aud: string | null;
-    };
-}>;
-export declare const roleVerifier: (secrets: OzoneSecrets) => (reqCtx: {
-    req: express.Request;
-    res: express.Response;
-}) => Promise<{
-    credentials: {
-        valid: boolean;
-        admin: boolean;
-        moderator: boolean;
-        triage: boolean;
-    };
-}>;
-export declare const getRoleCredentials: (secrets: OzoneSecrets, req: express.Request) => {
-    valid: boolean;
-    admin: boolean;
-    moderator: boolean;
-    triage: boolean;
-};
-export declare const parseBasicAuth: (token: string) => {
-    username: string;
-    password: string;
-} | null;
-export declare const buildBasicAuth: (username: string, password: string) => string;
-export declare const getJwtStrFromReq: (req: express.Request) => string | null;

package/src/auth.ts

@@ -1,147 +0,0 @@
-import express from 'express'
-import * as uint8arrays from 'uint8arrays'
-import { AuthRequiredError, verifyJwt } from '@atproto/xrpc-server'
-import { IdResolver } from '@atproto/identity'
-import { OzoneSecrets } from './config'
-
-const BASIC = 'Basic '
-const BEARER = 'Bearer '
-
-export const authVerifier = (
-  idResolver: IdResolver,
-  opts: { aud: string | null },
-) => {
-  const getSigningKey = async (
-    did: string,
-    forceRefresh: boolean,
-  ): Promise<string> => {
-    const atprotoData = await idResolver.did.resolveAtprotoData(
-      did,
-      forceRefresh,
-    )
-    return atprotoData.signingKey
-  }
-
-  return async (reqCtx: { req: express.Request; res: express.Response }) => {
-    const jwtStr = getJwtStrFromReq(reqCtx.req)
-    if (!jwtStr) {
-      throw new AuthRequiredError('missing jwt', 'MissingJwt')
-    }
-    const payload = await verifyJwt(jwtStr, opts.aud, getSigningKey)
-    return { credentials: { did: payload.iss }, artifacts: { aud: opts.aud } }
-  }
-}
-
-export const authOptionalVerifier = (
-  idResolver: IdResolver,
-  opts: { aud: string | null },
-) => {
-  const verifyAccess = authVerifier(idResolver, opts)
-  return async (reqCtx: { req: express.Request; res: express.Response }) => {
-    if (!reqCtx.req.headers.authorization) {
-      return { credentials: { did: null } }
-    }
-    return verifyAccess(reqCtx)
-  }
-}
-
-export const authOptionalAccessOrRoleVerifier = (
-  idResolver: IdResolver,
-  secrets: OzoneSecrets,
-  serverDid: string,
-) => {
-  const verifyAccess = authVerifier(idResolver, { aud: serverDid })
-  const verifyRole = roleVerifier(secrets)
-  return async (ctx: { req: express.Request; res: express.Response }) => {
-    const defaultUnAuthorizedCredentials = {
-      credentials: { did: null, type: 'unauthed' as const },
-    }
-    if (!ctx.req.headers.authorization) {
-      return defaultUnAuthorizedCredentials
-    }
-    // For non-admin tokens, we don't want to consider alternative verifiers and let it fail if it fails
-    const isRoleAuthToken = ctx.req.headers.authorization?.startsWith(BASIC)
-    if (isRoleAuthToken) {
-      const result = await verifyRole(ctx)
-      return {
-        ...result,
-        credentials: {
-          type: 'role' as const,
-          ...result.credentials,
-        },
-      }
-    }
-    const result = await verifyAccess(ctx)
-    return {
-      ...result,
-      credentials: {
-        type: 'access' as const,
-        ...result.credentials,
-      },
-    }
-  }
-}
-
-export const roleVerifier =
-  (secrets: OzoneSecrets) =>
-  async (reqCtx: { req: express.Request; res: express.Response }) => {
-    const credentials = getRoleCredentials(secrets, reqCtx.req)
-    if (!credentials.valid) {
-      throw new AuthRequiredError()
-    }
-    return { credentials }
-  }
-
-export const getRoleCredentials = (
-  secrets: OzoneSecrets,
-  req: express.Request,
-) => {
-  const parsed = parseBasicAuth(req.headers.authorization || '')
-  const { username, password } = parsed ?? {}
-  if (username === 'admin' && password === secrets.triagePassword) {
-    return { valid: true, admin: false, moderator: false, triage: true }
-  }
-  if (username === 'admin' && password === secrets.moderatorPassword) {
-    return { valid: true, admin: false, moderator: true, triage: true }
-  }
-  if (username === 'admin' && password === secrets.adminPassword) {
-    return { valid: true, admin: true, moderator: true, triage: true }
-  }
-  return { valid: false, admin: false, moderator: false, triage: false }
-}
-
-export const parseBasicAuth = (
-  token: string,
-): { username: string; password: string } | null => {
-  if (!token.startsWith(BASIC)) return null
-  const b64 = token.slice(BASIC.length)
-  let parsed: string[]
-  try {
-    parsed = uint8arrays
-      .toString(uint8arrays.fromString(b64, 'base64pad'), 'utf8')
-      .split(':')
-  } catch (err) {
-    return null
-  }
-  const [username, password] = parsed
-  if (!username || !password) return null
-  return { username, password }
-}
-
-export const buildBasicAuth = (username: string, password: string): string => {
-  return (
-    BASIC +
-    uint8arrays.toString(
-      uint8arrays.fromString(`${username}:${password}`, 'utf8'),
-      'base64pad',
-    )
-  )
-}
-
-export const getJwtStrFromReq = (req: express.Request): string | null => {
-  const { authorization } = req.headers
-  if (!authorization?.startsWith(BEARER)) {
-    return null
-  }
-  return authorization.slice(BEARER.length).trim()
-}