@atproto/ozone 0.1.106 → 0.1.108

package/src/mod-service/index.ts

@@ -1,5 +1,5 @@
 import net from 'node:net'
-import { Insertable, sql } from 'kysely'
+import { Insertable, RawBuilder, sql } from 'kysely'
 import { CID } from 'multiformats/cid'
 import { AtpAgent } from '@atproto/api'
 import { addHoursToDate, chunkArray } from '@atproto/common'
@@ -1275,17 +1275,35 @@ export class ModerationService {
     }
   }
 
-  buildModerationQuery(
+  async buildModerationQuery(
     subjectType: 'account' | 'record',
     createdByDids: string[],
     isActionQuery: boolean,
   ): Promise<(Partial<ReporterStatsResult> & { did: string })[]> {
-    const isAccount = subjectType === 'account'
+    if (!createdByDids.length) return []
+
     const actionTypes = [
       'tools.ozone.moderation.defs#modEventTakedown',
       'tools.ozone.moderation.defs#modEventLabel',
     ] as const
 
+    const countAll = () => {
+      return sql<number>`COUNT(*)`
+    }
+    const countAllDistinctBy = (ref: RawBuilder) => {
+      return sql<number>`COUNT(DISTINCT ${ref})`
+    }
+    const countTakedownsDistinctBy = (ref: RawBuilder) => {
+      return sql<number>`COUNT(DISTINCT ${ref}) FILTER (
+        WHERE actions."action" = 'tools.ozone.moderation.defs#modEventTakedown'
+      )`
+    }
+    const countLabelsDistinctBy = (ref: RawBuilder) => {
+      return sql<number>`COUNT(DISTINCT ${ref}) FILTER (
+        WHERE actions."action" = 'tools.ozone.moderation.defs#modEventLabel'
+      )`
+    }
+
     const query = this.db.db
       .selectFrom('moderation_event as reports')
       .where(
@@ -1293,48 +1311,83 @@ export class ModerationService {
         '=',
         'tools.ozone.moderation.defs#modEventReport',
       )
-      .where('reports.subjectUri', isAccount ? 'is' : 'is not', null)
+      .where(
+        'reports.subjectUri',
+        subjectType === 'account' ? 'is' : 'is not',
+        null,
+      )
       .where('reports.createdBy', 'in', createdByDids)
       .select(['reports.createdBy as did'])
 
-    if (isActionQuery) {
+    if (!isActionQuery) {
+      if (subjectType === 'account') {
+        return query
+          .select([
+            () => countAll().as('accountReportCount'),
+            (eb) =>
+              countAllDistinctBy(eb.ref('reports.subjectDid')).as(
+                'reportedAccountCount',
+              ),
+          ])
+          .groupBy('reports.createdBy')
+          .execute()
+      } else {
+        return query
+          .select([
+            () => countAll().as('recordReportCount'),
+            (eb) =>
+              countAllDistinctBy(eb.ref('reports.subjectUri')).as(
+                'reportedRecordCount',
+              ),
+          ])
+          .groupBy('reports.createdBy')
+          .execute()
+      }
+    }
+
+    if (subjectType === 'account') {
+      return query
+        .leftJoin('moderation_event as actions', (join) =>
+          join
+            .onRef('actions.subjectDid', '=', 'reports.subjectDid')
+            .on('actions.subjectUri', 'is', null)
+            .onRef('actions.createdAt', '>', 'reports.createdAt')
+            .on('actions.action', 'in', actionTypes),
+        )
+        .select([
+          (eb) =>
+            countTakedownsDistinctBy(eb.ref('actions.subjectDid')).as(
+              'takendownAccountCount',
+            ),
+          (eb) =>
+            countLabelsDistinctBy(eb.ref('actions.subjectDid')).as(
+              'labeledAccountCount',
+            ),
+        ])
+        .groupBy('reports.createdBy')
+        .execute()
+    } else {
       return query
         .leftJoin('moderation_event as actions', (join) =>
           join
             .onRef('actions.subjectDid', '=', 'reports.subjectDid')
-            .on('actions.subjectUri', isAccount ? 'is' : 'is not', null)
+            .onRef('actions.subjectUri', '=', 'reports.subjectUri')
             .onRef('actions.createdAt', '>', 'reports.createdAt')
             .on('actions.action', 'in', actionTypes),
         )
         .select([
-          () =>
-            sql<number>`COUNT(DISTINCT actions."subjectDid") FILTER (
-              WHERE actions."action" = 'tools.ozone.moderation.defs#modEventTakedown'
-            )`.as(`takendown${isAccount ? 'Account' : 'Record'}Count`),
-
-          () =>
-            sql<number>`COUNT(DISTINCT actions."subjectDid") FILTER (
-              WHERE actions."action" = 'tools.ozone.moderation.defs#modEventLabel'
-            )`.as(`labeled${isAccount ? 'Account' : 'Record'}Count`),
+          (eb) =>
+            countTakedownsDistinctBy(eb.ref('actions.subjectUri')).as(
+              'takendownRecordCount',
+            ),
+          (eb) =>
+            countLabelsDistinctBy(eb.ref('actions.subjectUri')).as(
+              'labeledRecordCount',
+            ),
         ])
         .groupBy('reports.createdBy')
         .execute()
     }
-
-    return query
-      .select([
-        (eb) =>
-          eb.fn.count<number>('reports.id').as(`${subjectType}ReportCount`),
-        (eb) =>
-          eb.fn
-            .count<number>(
-              isAccount ? 'reports.subjectDid' : 'reports.subjectUri',
-            )
-            .distinct()
-            .as(`reported${isAccount ? 'Account' : 'Record'}Count`),
-      ])
-      .groupBy('reports.createdBy')
-      .execute()
   }
 
   async getReporterStats(dids: string[]) {

package/src/team/index.ts

@@ -54,6 +54,7 @@ export class TeamService {
         (r) =>
           r === 'tools.ozone.team.defs#roleAdmin' ||
           r === 'tools.ozone.team.defs#roleModerator' ||
+          r === 'tools.ozone.team.defs#roleVerifier' ||
           r === 'tools.ozone.team.defs#roleTriage',
       )
 
@@ -197,11 +198,14 @@ export class TeamService {
       isAdmin || member?.role === 'tools.ozone.team.defs#roleModerator'
     const isTriage =
       isModerator || member?.role === 'tools.ozone.team.defs#roleTriage'
+    const isVerifier =
+      isAdmin || member?.role === 'tools.ozone.team.defs#roleVerifier'
 
     return {
       isModerator,
       isAdmin,
       isTriage,
+      isVerifier,
     }
   }
 

package/src/verification/issuer.ts

@@ -0,0 +1,135 @@
+import { Selectable } from 'kysely'
+import { Agent, AtUri, CredentialSession } from '@atproto/api'
+import { VerifierConfig } from '../config'
+import { Verification } from '../db/schema/verification'
+
+export type VerificationInput = {
+  displayName: string
+  handle: string
+  subject: string
+  createdAt?: string
+}
+
+export type VerificationIssuerCreator = (
+  verifierConfig: VerifierConfig,
+) => VerificationIssuer
+
+export class VerificationIssuer {
+  private session = new CredentialSession(new URL(this.verifierConfig.url))
+  private agent = new Agent(this.session)
+  constructor(private verifierConfig: VerifierConfig) {}
+
+  static creator() {
+    return (verifierConfig: VerifierConfig) =>
+      new VerificationIssuer(verifierConfig)
+  }
+
+  async getAgent() {
+    if (!this.session.hasSession) {
+      await this.session.login({
+        identifier: this.verifierConfig.did,
+        password: this.verifierConfig.password,
+      })
+    }
+
+    // Trigger a test request to check if the session is still valid, if not, we will login again
+    try {
+      await this.agent.com.atproto.server.getSession()
+    } catch (err) {
+      if ((err as any).status === 401) {
+        await this.session.login({
+          identifier: this.verifierConfig.did,
+          password: this.verifierConfig.password,
+        })
+      }
+    }
+
+    return this.agent
+  }
+
+  async verify(verifications: VerificationInput[]) {
+    const grantedVerifications: Selectable<Verification>[] = []
+    const failedVerifications: {
+      $type: 'tools.ozone.verification.grantVerifications#grantError'
+      subject: string
+      error: string
+    }[] = []
+    const now = new Date().toISOString()
+    const agent = await this.getAgent()
+    await Promise.allSettled(
+      verifications.map(async ({ displayName, handle, subject, createdAt }) => {
+        try {
+          const verificationRecord = {
+            createdAt: createdAt || now,
+            issuer: this.verifierConfig.did,
+            displayName,
+            handle,
+            subject,
+          }
+          const {
+            data: { uri, cid },
+          } = await agent.com.atproto.repo.createRecord({
+            repo: this.verifierConfig.did,
+            record: verificationRecord,
+            collection: 'app.bsky.graph.verification',
+          })
+          grantedVerifications.push({
+            ...verificationRecord,
+            uri,
+            cid,
+            revokedAt: null,
+            updatedAt: now,
+            revokedBy: null,
+            revokeReason: null,
+          })
+        } catch (err) {
+          failedVerifications.push({
+            $type: 'tools.ozone.verification.grantVerifications#grantError',
+            error: (err as Error).message,
+            subject,
+          })
+          return
+        }
+      }),
+    )
+
+    return { grantedVerifications, failedVerifications }
+  }
+
+  async revoke({ uris }: { uris: string[] }) {
+    const revokedVerifications: string[] = []
+    const failedRevocations: Array<{ uri: string; error: string }> = []
+
+    const agent = await this.getAgent()
+
+    await Promise.allSettled(
+      uris.map(async (uri) => {
+        try {
+          const atUri = new AtUri(uri)
+
+          if (atUri.collection !== 'app.bsky.graph.verification') {
+            throw new Error(`Only verification records can be revoked`)
+          }
+
+          if (atUri.host !== this.verifierConfig.did) {
+            throw new Error(
+              `Cannot revoke verification record ${uri} not issued by ${this.verifierConfig.did}`,
+            )
+          }
+
+          await agent.com.atproto.repo.deleteRecord({
+            collection: atUri.collection,
+            repo: this.verifierConfig.did,
+            rkey: atUri.rkey,
+          })
+          revokedVerifications.push(uri)
+        } catch (err) {
+          failedRevocations.push({ uri, error: (err as Error).message })
+          return
+        }
+      }),
+    )
+
+    return { revokedVerifications, failedRevocations }
+  }
+}

package/src/verification/service.ts

@@ -0,0 +1,208 @@
+import { Selectable } from 'kysely'
+import {
+  $Typed,
+  AppBskyActorDefs,
+  AtUri,
+  ToolsOzoneModerationDefs,
+  ToolsOzoneVerificationDefs,
+} from '@atproto/api'
+import { Database } from '../db'
+import { CreatedAtUriKeyset, paginate } from '../db/pagination'
+import { Verification } from '../db/schema/verification'
+
+export type VerificationServiceCreator = (db: Database) => VerificationService
+
+export class VerificationService {
+  constructor(public db: Database) {}
+
+  static creator() {
+    return (db: Database) => new VerificationService(db)
+  }
+
+  async create(
+    verifications: Pick<
+      Verification,
+      | 'uri'
+      | 'issuer'
+      | 'subject'
+      | 'handle'
+      | 'displayName'
+      | 'createdAt'
+      | 'cid'
+    >[],
+  ) {
+    return this.db.transaction(async (tx) => {
+      return tx.db
+        .insertInto('verification')
+        .values(verifications)
+        .onConflict((oc) => oc.doNothing())
+        .returningAll()
+        .execute()
+    })
+  }
+
+  async markRevoked({
+    uris,
+    revokedBy,
+    revokedAt,
+    revokeReason,
+  }: {
+    uris: string[]
+    revokedBy?: string
+    revokedAt?: string
+    revokeReason?: string
+  }) {
+    const now = new Date().toISOString()
+    return this.db.transaction(async (tx) => {
+      for (const uri of uris) {
+        return tx.db
+          .updateTable('verification')
+          .set({
+            revokeReason,
+            updatedAt: now,
+            revokedAt: revokedAt || now,
+            // Allow setting revokedBy to a moderator/verifier DID and if it isn't set, default to the author of the verification record
+            revokedBy: revokedBy || new AtUri(uri).host,
+          })
+          .where('uri', '=', uri)
+          .where('revokedAt', 'is', null)
+          .execute()
+      }
+    })
+  }
+
+  async list({
+    sortDirection,
+    cursor,
+    createdAfter,
+    createdBefore,
+    issuers = [],
+    subjects = [],
+    isRevoked,
+    limit = 100,
+  }: {
+    sortDirection?: 'asc' | 'desc'
+    cursor?: string
+    createdAfter?: string
+    createdBefore?: string
+    issuers?: string[]
+    subjects?: string[]
+    isRevoked?: boolean
+    limit?: number
+  }) {
+    const { ref } = this.db.db.dynamic
+
+    let qb = this.db.db.selectFrom('verification').selectAll()
+
+    if (issuers.length) {
+      qb = qb.where('issuer', 'in', issuers)
+    }
+
+    if (isRevoked !== undefined) {
+      qb = qb.where('revokedAt', isRevoked ? 'is not' : 'is', null)
+    }
+
+    if (subjects.length) {
+      qb = qb.where('subject', 'in', subjects)
+    }
+
+    if (createdAfter) {
+      qb = qb.where('createdAt', '>=', createdAfter)
+    }
+
+    if (createdBefore) {
+      qb = qb.where('createdAt', '<=', createdBefore)
+    }
+
+    const keyset = new CreatedAtUriKeyset(ref(`createdAt`), ref('uri'))
+    const paginatedBuilder = paginate(qb, {
+      limit,
+      cursor,
+      keyset,
+      tryIndex: true,
+      direction: sortDirection === 'desc' ? 'desc' : 'asc',
+    })
+
+    const result = await paginatedBuilder.execute()
+    return { verifications: result, cursor: keyset.packFromResult(result) }
+  }
+
+  view(
+    verifications: Selectable<Verification>[],
+    repos: Map<
+      string,
+      | $Typed<ToolsOzoneModerationDefs.RepoViewDetail>
+      | $Typed<ToolsOzoneModerationDefs.RepoViewNotFound>
+    >,
+    profiles: Map<string, AppBskyActorDefs.ProfileViewDetailed>,
+  ): $Typed<ToolsOzoneVerificationDefs.VerificationView>[] {
+    return verifications.map((verification) => {
+      const issuerRepo = repos.get(verification.issuer)
+      const subjectRepo = repos.get(verification.subject)
+      const subjectProfile = profiles.get(verification.subject)
+      const issuerProfile = profiles.get(verification.issuer)
+      return {
+        $type: 'tools.ozone.verification.defs#verificationView',
+        uri: verification.uri,
+        issuer: verification.issuer,
+        subject: verification.subject,
+        createdAt: verification.createdAt,
+        displayName: verification.displayName,
+        handle: verification.handle,
+        updatedAt: verification.updatedAt || undefined,
+        revokedAt: verification.revokedAt || undefined,
+        revokedBy: verification.revokedBy || undefined,
+        revokeReason: verification.revokeReason || undefined,
+        issuerRepo,
+        subjectRepo,
+        subjectProfile: subjectProfile
+          ? {
+              $type: 'app.bsky.actor.defs#profileViewDetailed',
+              ...subjectProfile,
+            }
+          : undefined,
+        issuerProfile: issuerProfile
+          ? {
+              $type: 'app.bsky.actor.defs#profileViewDetailed',
+              ...issuerProfile,
+            }
+          : undefined,
+      }
+    })
+  }
+
+  async getFirehoseCursor() {
+    const entry = await this.db.db
+      .selectFrom('firehose_cursor')
+      .select('cursor')
+      .where('service', '=', 'verification')
+      .executeTakeFirst()
+
+    return entry?.cursor || null
+  }
+
+  createFirehoseCursor() {
+    return this.db.db
+      .insertInto('firehose_cursor')
+      .values({
+        service: 'verification',
+        cursor: null,
+      })
+      .onConflict((oc) => oc.doNothing())
+      .execute()
+  }
+
+  async updateFirehoseCursor(cursor: number) {
+    const updated = await this.db.db
+      .updateTable('firehose_cursor')
+      .set({ cursor })
+      .where('service', '=', 'verification')
+      .where((qb) =>
+        qb.where('cursor', '<', cursor).orWhere('cursor', 'is', null),
+      )
+      .returningAll()
+      .executeTakeFirst()
+
+    return updated?.cursor
+  }
+}

package/src/verification/util.ts

@@ -0,0 +1,50 @@
+import { $Typed, ToolsOzoneModerationDefs } from '@atproto/api'
+import { addAccountInfoToRepoViewDetail, getPdsAccountInfos } from '../api/util'
+import { AppContext } from '../context'
+import { ModerationService } from '../mod-service'
+import { ParsedLabelers } from '../util'
+
+export const getReposForVerifications = async (
+  ctx: AppContext,
+  labelers: ParsedLabelers,
+  modService: ModerationService,
+  dids: string[],
+  isModerator: boolean,
+) => {
+  const [partialRepos, accountInfo] = await Promise.all([
+    modService.views.repoDetails(dids, labelers),
+    getPdsAccountInfos(ctx, dids),
+  ])
+
+  const repos = new Map<
+    string,
+    | $Typed<ToolsOzoneModerationDefs.RepoViewDetail>
+    | $Typed<ToolsOzoneModerationDefs.RepoViewNotFound>
+  >(
+    dids.map((did) => {
+      const partialRepo = partialRepos.get(did)
+      if (!partialRepo) {
+        return [
+          did,
+          {
+            did,
+            $type: 'tools.ozone.moderation.defs#repoViewNotFound',
+          },
+        ]
+      }
+      return [
+        did,
+        {
+          ...addAccountInfoToRepoViewDetail(
+            partialRepo,
+            accountInfo.get(did) || null,
+            isModerator,
+          ),
+          $type: 'tools.ozone.moderation.defs#repoViewDetail',
+        },
+      ]
+    }),
+  )
+
+  return repos
+}