@atproto/ozone 0.0.16 → 0.0.17-next.0

package/src/api/admin/getModerationEvent.ts

@@ -3,7 +3,7 @@ import AppContext from '../../context'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.admin.getModerationEvent({
-    auth: ctx.authVerifier.modOrRole,
+    auth: ctx.authVerifier.modOrAdminToken,
     handler: async ({ params }) => {
       const { id } = params
       const db = ctx.db

package/src/api/admin/getRecord.ts

@@ -6,7 +6,7 @@ import { AtUri } from '@atproto/syntax'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.admin.getRecord({
-    auth: ctx.authVerifier.modOrRole,
+    auth: ctx.authVerifier.modOrAdminToken,
     handler: async ({ params, auth }) => {
       const db = ctx.db
 

package/src/api/admin/getRepo.ts

@@ -5,7 +5,7 @@ import { addAccountInfoToRepoViewDetail, getPdsAccountInfo } from './util'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.admin.getRepo({
-    auth: ctx.authVerifier.modOrRole,
+    auth: ctx.authVerifier.modOrAdminToken,
     handler: async ({ params, auth }) => {
       const { did } = params
       const db = ctx.db

package/src/api/admin/listCommunicationTemplates.ts

@@ -4,7 +4,7 @@ import AppContext from '../../context'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.admin.listCommunicationTemplates({
-    auth: ctx.authVerifier.modOrRole,
+    auth: ctx.authVerifier.modOrAdminToken,
     handler: async ({ auth }) => {
       const access = auth.credentials
       const db = ctx.db

package/src/api/admin/queryModerationEvents.ts

@@ -4,7 +4,7 @@ import { getEventType } from '../moderation/util'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.admin.queryModerationEvents({
-    auth: ctx.authVerifier.modOrRole,
+    auth: ctx.authVerifier.modOrAdminToken,
     handler: async ({ params }) => {
       const {
         subject,

package/src/api/admin/queryModerationStatuses.ts

@@ -4,7 +4,7 @@ import { getReviewState } from '../moderation/util'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.admin.queryModerationStatuses({
-    auth: ctx.authVerifier.modOrRole,
+    auth: ctx.authVerifier.modOrAdminToken,
     handler: async ({ params }) => {
       const {
         subject,

package/src/api/admin/searchRepos.ts

@@ -4,7 +4,7 @@ import { mapDefined } from '@atproto/common'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.admin.searchRepos({
-    auth: ctx.authVerifier.modOrRole,
+    auth: ctx.authVerifier.modOrAdminToken,
     handler: async ({ params }) => {
       const modService = ctx.modService(ctx.db)
 

package/src/api/admin/updateCommunicationTemplate.ts

@@ -4,7 +4,7 @@ import AppContext from '../../context'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.admin.updateCommunicationTemplate({
-    auth: ctx.authVerifier.modOrRole,
+    auth: ctx.authVerifier.modOrAdminToken,
     handler: async ({ input, auth }) => {
       const access = auth.credentials
       const db = ctx.db

package/src/api/admin/util.ts

@@ -16,7 +16,7 @@ export const getPdsAccountInfo = async (
   try {
     const res = await agent.api.com.atproto.admin.getAccountInfo({ did }, auth)
     return res.data
-  } catch (err) {
+  } catch {
     return null
   }
 }

package/src/api/moderation/createReport.ts

@@ -8,8 +8,7 @@ import { ModerationLangService } from '../../mod-service/lang'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.moderation.createReport({
-    // @TODO anonymous reports w/ optional auth are a temporary measure
-    auth: ctx.authVerifier.standardOptionalOrRole,
+    auth: ctx.authVerifier.standard,
     handler: async ({ input, auth }) => {
       const requester =
         'iss' in auth.credentials ? auth.credentials.iss : ctx.cfg.service.did

package/src/api/proxied.ts

@@ -3,7 +3,7 @@ import AppContext from '../context'
 
 export default function (server: Server, ctx: AppContext) {
   server.app.bsky.actor.getProfile({
-    auth: ctx.authVerifier.modOrRole,
+    auth: ctx.authVerifier.moderator,
     handler: async (request) => {
       const res = await ctx.appviewAgent.api.app.bsky.actor.getProfile(
         request.params,
@@ -17,7 +17,7 @@ export default function (server: Server, ctx: AppContext) {
   })
 
   server.app.bsky.actor.getProfiles({
-    auth: ctx.authVerifier.modOrRole,
+    auth: ctx.authVerifier.moderator,
     handler: async (request) => {
       const res = await ctx.appviewAgent.api.app.bsky.actor.getProfiles(
         request.params,
@@ -31,7 +31,7 @@ export default function (server: Server, ctx: AppContext) {
   })
 
   server.app.bsky.feed.getAuthorFeed({
-    auth: ctx.authVerifier.modOrRole,
+    auth: ctx.authVerifier.moderator,
     handler: async (request) => {
       const res = await ctx.appviewAgent.api.app.bsky.feed.getAuthorFeed(
         request.params,
@@ -45,7 +45,7 @@ export default function (server: Server, ctx: AppContext) {
   })
 
   server.app.bsky.feed.getPostThread({
-    auth: ctx.authVerifier.modOrRole,
+    auth: ctx.authVerifier.moderator,
     handler: async (request) => {
       const res = await ctx.appviewAgent.api.app.bsky.feed.getPostThread(
         request.params,
@@ -59,7 +59,7 @@ export default function (server: Server, ctx: AppContext) {
   })
 
   server.app.bsky.feed.getFeedGenerator({
-    auth: ctx.authVerifier.modOrRole,
+    auth: ctx.authVerifier.moderator,
     handler: async (request) => {
       const res = await ctx.appviewAgent.api.app.bsky.feed.getFeedGenerator(
         request.params,
@@ -73,7 +73,7 @@ export default function (server: Server, ctx: AppContext) {
   })
 
   server.app.bsky.graph.getFollows({
-    auth: ctx.authVerifier.modOrRole,
+    auth: ctx.authVerifier.moderator,
     handler: async (request) => {
       const res = await ctx.appviewAgent.api.app.bsky.graph.getFollows(
         request.params,
@@ -87,7 +87,7 @@ export default function (server: Server, ctx: AppContext) {
   })
 
   server.app.bsky.graph.getFollowers({
-    auth: ctx.authVerifier.modOrRole,
+    auth: ctx.authVerifier.moderator,
     handler: async (request) => {
       const res = await ctx.appviewAgent.api.app.bsky.graph.getFollowers(
         request.params,
@@ -101,7 +101,7 @@ export default function (server: Server, ctx: AppContext) {
   })
 
   server.app.bsky.graph.getList({
-    auth: ctx.authVerifier.modOrRole,
+    auth: ctx.authVerifier.moderator,
     handler: async (request) => {
       const res = await ctx.appviewAgent.api.app.bsky.graph.getList(
         request.params,

package/src/api/temp/fetchLabels.ts

@@ -8,7 +8,7 @@ import {
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.temp.fetchLabels({
-    auth: ctx.authVerifier.standardOptionalOrRole,
+    auth: ctx.authVerifier.standardOptionalOrAdminToken,
     handler: async ({ auth, params }) => {
       const { limit } = params
       const since =

package/src/auth-verifier.ts

@@ -7,11 +7,11 @@ type ReqCtx = {
   req: express.Request
 }
 
-type RoleOutput = {
+type AdminTokenOutput = {
   credentials: {
-    type: 'role'
-    isAdmin: boolean
-    isModerator: boolean
+    type: 'admin_token'
+    isAdmin: true
+    isModerator: true
     isTriage: true
   }
 }
@@ -51,8 +51,6 @@ export type AuthVerifierOpts = {
   moderators: string[]
   triage: string[]
   adminPassword: string
-  moderatorPassword: string
-  triagePassword: string
 }
 
 export class AuthVerifier {
@@ -61,8 +59,6 @@ export class AuthVerifier {
   moderators: string[]
   triage: string[]
   private adminPassword: string
-  private moderatorPassword: string
-  private triagePassword: string
 
   constructor(public idResolver: IdResolver, opts: AuthVerifierOpts) {
     this.serviceDid = opts.serviceDid
@@ -70,15 +66,15 @@ export class AuthVerifier {
     this.moderators = opts.moderators
     this.triage = opts.triage
     this.adminPassword = opts.adminPassword
-    this.moderatorPassword = opts.moderatorPassword
-    this.triagePassword = opts.triagePassword
   }
 
-  modOrRole = async (reqCtx: ReqCtx): Promise<ModeratorOutput | RoleOutput> => {
-    if (isBearerToken(reqCtx.req)) {
-      return this.moderator(reqCtx)
+  modOrAdminToken = async (
+    reqCtx: ReqCtx,
+  ): Promise<ModeratorOutput | AdminTokenOutput> => {
+    if (isBasicToken(reqCtx.req)) {
+      return this.adminToken(reqCtx)
     } else {
-      return this.role(reqCtx)
+      return this.moderator(reqCtx)
     }
   }
 
@@ -138,36 +134,30 @@ export class AuthVerifier {
     return this.nullCreds()
   }
 
-  standardOptionalOrRole = async (
+  standardOptionalOrAdminToken = async (
     reqCtx: ReqCtx,
-  ): Promise<StandardOutput | RoleOutput | NullOutput> => {
+  ): Promise<StandardOutput | AdminTokenOutput | NullOutput> => {
     if (isBearerToken(reqCtx.req)) {
       return this.standard(reqCtx)
     } else if (isBasicToken(reqCtx.req)) {
-      return this.role(reqCtx)
+      return this.adminToken(reqCtx)
     } else {
       return this.nullCreds()
     }
   }
 
-  role = async (reqCtx: ReqCtx): Promise<RoleOutput> => {
+  adminToken = async (reqCtx: ReqCtx): Promise<AdminTokenOutput> => {
     const parsed = parseBasicAuth(reqCtx.req.headers.authorization ?? '')
     const { username, password } = parsed ?? {}
-    if (username !== 'admin') {
-      throw new AuthRequiredError()
-    }
-    const isAdmin = password === this.adminPassword
-    const isModerator = isAdmin || password === this.moderatorPassword
-    const isTriage = isModerator || password === this.triagePassword
-    if (!isTriage) {
+    if (username !== 'admin' || password !== this.adminPassword) {
       throw new AuthRequiredError()
     }
     return {
       credentials: {
-        type: 'role',
-        isAdmin,
-        isModerator,
-        isTriage,
+        type: 'admin_token',
+        isAdmin: true,
+        isModerator: true,
+        isTriage: true,
       },
     }
   }

package/src/config/config.ts

@@ -25,18 +25,20 @@ export const envToCfg = (env: OzoneEnvironment): OzoneConfig => {
     poolIdleTimeoutMs: env.dbPoolIdleTimeoutMs,
   }
 
-  assert(env.appviewUrl)
-  assert(env.appviewDid)
+  assert(env.appviewUrl && env.appviewDid)
   const appviewCfg: OzoneConfig['appview'] = {
     url: env.appviewUrl,
     did: env.appviewDid,
+    pushEvents: !!env.appviewPushEvents,
   }
 
-  assert(env.pdsUrl)
-  assert(env.pdsDid)
-  const pdsCfg: OzoneConfig['pds'] = {
-    url: env.pdsUrl,
-    did: env.pdsDid,
+  let pdsCfg: OzoneConfig['pds'] = null
+  if (env.pdsUrl || env.pdsDid) {
+    assert(env.pdsUrl && env.pdsDid)
+    pdsCfg = {
+      url: env.pdsUrl,
+      did: env.pdsDid,
+    }
   }
 
   const cdnCfg: OzoneConfig['cdn'] = {
@@ -94,6 +96,7 @@ export type DatabaseConfig = {
 export type AppviewConfig = {
   url: string
   did: string
+  pushEvents: boolean
 }
 
 export type PdsConfig = {

package/src/config/env.ts

@@ -10,6 +10,7 @@ export const readEnv = (): OzoneEnvironment => {
     serverDid: envStr('OZONE_SERVER_DID'),
     appviewUrl: envStr('OZONE_APPVIEW_URL'),
     appviewDid: envStr('OZONE_APPVIEW_DID'),
+    appviewPushEvents: envBool('OZONE_APPVIEW_PUSH_EVENTS'),
     pdsUrl: envStr('OZONE_PDS_URL'),
     pdsDid: envStr('OZONE_PDS_DID'),
     dbPostgresUrl: envStr('OZONE_DB_POSTGRES_URL'),
@@ -23,8 +24,6 @@ export const readEnv = (): OzoneEnvironment => {
     moderatorDids: envList('OZONE_MODERATOR_DIDS'),
     triageDids: envList('OZONE_TRIAGE_DIDS'),
     adminPassword: envStr('OZONE_ADMIN_PASSWORD'),
-    moderatorPassword: envStr('OZONE_MODERATOR_PASSWORD'),
-    triagePassword: envStr('OZONE_TRIAGE_PASSWORD'),
     signingKeyHex: envStr('OZONE_SIGNING_KEY_HEX'),
   }
 }
@@ -38,6 +37,7 @@ export type OzoneEnvironment = {
   serverDid?: string
   appviewUrl?: string
   appviewDid?: string
+  appviewPushEvents?: boolean
   pdsUrl?: string
   pdsDid?: string
   dbPostgresUrl?: string
@@ -51,7 +51,5 @@ export type OzoneEnvironment = {
   moderatorDids: string[]
   triageDids: string[]
   adminPassword?: string
-  moderatorPassword?: string
-  triagePassword?: string
   signingKeyHex?: string
 }

package/src/config/secrets.ts

@@ -3,21 +3,15 @@ import { OzoneEnvironment } from './env'
 
 export const envToSecrets = (env: OzoneEnvironment): OzoneSecrets => {
   assert(env.adminPassword)
-  assert(env.moderatorPassword)
-  assert(env.triagePassword)
   assert(env.signingKeyHex)
 
   return {
     adminPassword: env.adminPassword,
-    moderatorPassword: env.moderatorPassword,
-    triagePassword: env.triagePassword,
     signingKeyHex: env.signingKeyHex,
   }
 }
 
 export type OzoneSecrets = {
   adminPassword: string
-  moderatorPassword: string
-  triagePassword: string
   signingKeyHex: string
 }

package/src/context.ts

@@ -62,7 +62,7 @@ export class AppContext {
 
     const backgroundQueue = new BackgroundQueue(db)
     const eventPusher = new EventPusher(db, createAuthHeaders, {
-      appview: cfg.appview,
+      appview: cfg.appview.pushEvents ? cfg.appview : undefined,
       pds: cfg.pds ?? undefined,
     })
 
@@ -92,8 +92,6 @@ export class AppContext {
       moderators: cfg.access.moderators,
       triage: cfg.access.triage,
       adminPassword: secrets.adminPassword,
-      moderatorPassword: secrets.moderatorPassword,
-      triagePassword: secrets.triagePassword,
     })
 
     return new AppContext(

package/src/daemon/context.ts

@@ -35,13 +35,13 @@ export class DaemonContext {
     const appviewAgent = new AtpAgent({ service: cfg.appview.url })
     const createAuthHeaders = (aud: string) =>
       createServiceAuthHeaders({
-        iss: cfg.service.did,
+        iss: `${cfg.service.did}#atproto_labeler`,
         aud,
         keypair: signingKey,
       })
 
     const eventPusher = new EventPusher(db, createAuthHeaders, {
-      appview: cfg.appview,
+      appview: cfg.appview.pushEvents ? cfg.appview : undefined,
       pds: cfg.pds ?? undefined,
     })
 

package/src/daemon/event-pusher.ts

@@ -1,10 +1,11 @@
+import assert from 'node:assert'
 import AtpAgent from '@atproto/api'
 import { SECOND } from '@atproto/common'
 import Database from '../db'
+import { RepoPushEventType } from '../db/schema/repo_push_event'
 import { retryHttp } from '../util'
 import { dbLogger } from '../logger'
 import { InputSchema } from '../lexicon/types/com/atproto/admin/updateSubjectStatus'
-import assert from 'assert'
 
 type EventSubject = InputSchema['subject']
 
@@ -74,6 +75,13 @@ export class EventPusher {
     this.poll(this.blobPollState, () => this.pushBlobEvents())
   }
 
+  get takedowns(): RepoPushEventType[] {
+    const takedowns: RepoPushEventType[] = []
+    if (this.pds) takedowns.push('pds_takedown')
+    if (this.appview) takedowns.push('appview_takedown')
+    return takedowns
+  }
+
   poll(state: PollState, fn: () => Promise<void>) {
     if (this.destroyed) return
     state.promise = fn()

package/src/db/schema/moderation_subject_status.ts

@@ -3,6 +3,7 @@ import {
   REVIEWCLOSED,
   REVIEWOPEN,
   REVIEWESCALATED,
+  REVIEWNONE,
 } from '../../lexicon/types/com/atproto/admin/defs'
 
 export const subjectStatusTableName = 'moderation_subject_status'
@@ -13,7 +14,11 @@ export interface ModerationSubjectStatus {
   recordPath: string
   recordCid: string | null
   blobCids: string[] | null
-  reviewState: typeof REVIEWCLOSED | typeof REVIEWOPEN | typeof REVIEWESCALATED
+  reviewState:
+    | typeof REVIEWCLOSED
+    | typeof REVIEWOPEN
+    | typeof REVIEWESCALATED
+    | typeof REVIEWNONE
   createdAt: string
   updatedAt: string
   lastReviewedBy: string | null

package/src/lexicon/index.ts

@@ -129,6 +129,7 @@ import * as AppBskyGraphMuteActor from './types/app/bsky/graph/muteActor'
 import * as AppBskyGraphMuteActorList from './types/app/bsky/graph/muteActorList'
 import * as AppBskyGraphUnmuteActor from './types/app/bsky/graph/unmuteActor'
 import * as AppBskyGraphUnmuteActorList from './types/app/bsky/graph/unmuteActorList'
+import * as AppBskyLabelerGetServices from './types/app/bsky/labeler/getServices'
 import * as AppBskyNotificationGetUnreadCount from './types/app/bsky/notification/getUnreadCount'
 import * as AppBskyNotificationListNotifications from './types/app/bsky/notification/listNotifications'
 import * as AppBskyNotificationRegisterPush from './types/app/bsky/notification/registerPush'
@@ -142,6 +143,7 @@ export const COM_ATPROTO_ADMIN = {
   DefsReviewOpen: 'com.atproto.admin.defs#reviewOpen',
   DefsReviewEscalated: 'com.atproto.admin.defs#reviewEscalated',
   DefsReviewClosed: 'com.atproto.admin.defs#reviewClosed',
+  DefsReviewNone: 'com.atproto.admin.defs#reviewNone',
 }
 export const COM_ATPROTO_MODERATION = {
   DefsReasonSpam: 'com.atproto.moderation.defs#reasonSpam',
@@ -1204,6 +1206,7 @@ export class AppBskyNS {
   embed: AppBskyEmbedNS
   feed: AppBskyFeedNS
   graph: AppBskyGraphNS
+  labeler: AppBskyLabelerNS
   notification: AppBskyNotificationNS
   richtext: AppBskyRichtextNS
   unspecced: AppBskyUnspeccedNS
@@ -1214,6 +1217,7 @@ export class AppBskyNS {
     this.embed = new AppBskyEmbedNS(server)
     this.feed = new AppBskyFeedNS(server)
     this.graph = new AppBskyGraphNS(server)
+    this.labeler = new AppBskyLabelerNS(server)
     this.notification = new AppBskyNotificationNS(server)
     this.richtext = new AppBskyRichtextNS(server)
     this.unspecced = new AppBskyUnspeccedNS(server)
@@ -1659,6 +1663,25 @@ export class AppBskyGraphNS {
   }
 }
 
+export class AppBskyLabelerNS {
+  _server: Server
+
+  constructor(server: Server) {
+    this._server = server
+  }
+
+  getServices<AV extends AuthVerifier>(
+    cfg: ConfigOf<
+      AV,
+      AppBskyLabelerGetServices.Handler<ExtractAuth<AV>>,
+      AppBskyLabelerGetServices.HandlerReqCtx<ExtractAuth<AV>>
+    >,
+  ) {
+    const nsid = 'app.bsky.labeler.getServices' // @ts-ignore
+    return this._server.xrpc.method(nsid, cfg)
+  }
+}
+
 export class AppBskyNotificationNS {
   _server: Server