@atproto/ozone 0.1.107 → 0.1.108

package/src/lexicon/types/tools/ozone/verification/listVerifications.ts

@@ -0,0 +1,70 @@
+/**
+ * GENERATED CODE - DO NOT MODIFY
+ */
+import express from 'express'
+import { type ValidationResult, BlobRef } from '@atproto/lexicon'
+import { CID } from 'multiformats/cid'
+import { validate as _validate } from '../../../../lexicons'
+import {
+  type $Typed,
+  is$typed as _is$typed,
+  type OmitKey,
+} from '../../../../util'
+import { HandlerAuth, HandlerPipeThrough } from '@atproto/xrpc-server'
+import type * as ToolsOzoneVerificationDefs from './defs.js'
+
+const is$typed = _is$typed,
+  validate = _validate
+const id = 'tools.ozone.verification.listVerifications'
+
+export interface QueryParams {
+  /** Pagination cursor */
+  cursor?: string
+  /** Maximum number of results to return */
+  limit: number
+  /** Filter to verifications created after this timestamp */
+  createdAfter?: string
+  /** Filter to verifications created before this timestamp */
+  createdBefore?: string
+  /** Filter to verifications from specific issuers */
+  issuers?: string[]
+  /** Filter to specific verified DIDs */
+  subjects?: string[]
+  /** Sort direction for creation date */
+  sortDirection: 'asc' | 'desc'
+  /** Filter to verifications that are revoked or not. By default, includes both. */
+  isRevoked?: boolean
+}
+
+export type InputSchema = undefined
+
+export interface OutputSchema {
+  cursor?: string
+  verifications: ToolsOzoneVerificationDefs.VerificationView[]
+}
+
+export type HandlerInput = undefined
+
+export interface HandlerSuccess {
+  encoding: 'application/json'
+  body: OutputSchema
+  headers?: { [key: string]: string }
+}
+
+export interface HandlerError {
+  status: number
+  message?: string
+}
+
+export type HandlerOutput = HandlerError | HandlerSuccess | HandlerPipeThrough
+export type HandlerReqCtx<HA extends HandlerAuth = never> = {
+  auth: HA
+  params: QueryParams
+  input: HandlerInput
+  req: express.Request
+  res: express.Response
+  resetRouteRateLimits: () => Promise<void>
+}
+export type Handler<HA extends HandlerAuth = never> = (
+  ctx: HandlerReqCtx<HA>,
+) => Promise<HandlerOutput> | HandlerOutput

package/src/lexicon/types/tools/ozone/verification/revokeVerifications.ts

@@ -0,0 +1,81 @@
+/**
+ * GENERATED CODE - DO NOT MODIFY
+ */
+import express from 'express'
+import { type ValidationResult, BlobRef } from '@atproto/lexicon'
+import { CID } from 'multiformats/cid'
+import { validate as _validate } from '../../../../lexicons'
+import {
+  type $Typed,
+  is$typed as _is$typed,
+  type OmitKey,
+} from '../../../../util'
+import { HandlerAuth, HandlerPipeThrough } from '@atproto/xrpc-server'
+
+const is$typed = _is$typed,
+  validate = _validate
+const id = 'tools.ozone.verification.revokeVerifications'
+
+export interface QueryParams {}
+
+export interface InputSchema {
+  /** Array of verification record uris to revoke */
+  uris: string[]
+  /** Reason for revoking the verification. This is optional and can be omitted if not needed. */
+  revokeReason?: string
+}
+
+export interface OutputSchema {
+  /** List of verification uris successfully revoked */
+  revokedVerifications: string[]
+  /** List of verification uris that couldn't be revoked, including failure reasons */
+  failedRevocations: RevokeError[]
+}
+
+export interface HandlerInput {
+  encoding: 'application/json'
+  body: InputSchema
+}
+
+export interface HandlerSuccess {
+  encoding: 'application/json'
+  body: OutputSchema
+  headers?: { [key: string]: string }
+}
+
+export interface HandlerError {
+  status: number
+  message?: string
+}
+
+export type HandlerOutput = HandlerError | HandlerSuccess | HandlerPipeThrough
+export type HandlerReqCtx<HA extends HandlerAuth = never> = {
+  auth: HA
+  params: QueryParams
+  input: HandlerInput
+  req: express.Request
+  res: express.Response
+  resetRouteRateLimits: () => Promise<void>
+}
+export type Handler<HA extends HandlerAuth = never> = (
+  ctx: HandlerReqCtx<HA>,
+) => Promise<HandlerOutput> | HandlerOutput
+
+/** Error object for failed revocations */
+export interface RevokeError {
+  $type?: 'tools.ozone.verification.revokeVerifications#revokeError'
+  /** The AT-URI of the verification record that failed to revoke. */
+  uri: string
+  /** Description of the error that occurred during revocation. */
+  error: string
+}
+
+const hashRevokeError = 'revokeError'
+
+export function isRevokeError<V>(v: V) {
+  return is$typed(v, id, hashRevokeError)
+}
+
+export function validateRevokeError<V>(v: V) {
+  return validate<RevokeError & V>(v, id, hashRevokeError)
+}

package/src/logger.ts

@@ -10,6 +10,8 @@ export const httpLogger: ReturnType<typeof subsystemLogger> =
   subsystemLogger('ozone')
 export const langLogger: ReturnType<typeof subsystemLogger> =
   subsystemLogger('ozone:lang')
+export const verificationLogger: ReturnType<typeof subsystemLogger> =
+  subsystemLogger('ozone:verification')
 
 export const loggerMiddleware = pinoHttp({
   logger: httpLogger,

package/src/team/index.ts

@@ -54,6 +54,7 @@ export class TeamService {
         (r) =>
           r === 'tools.ozone.team.defs#roleAdmin' ||
           r === 'tools.ozone.team.defs#roleModerator' ||
+          r === 'tools.ozone.team.defs#roleVerifier' ||
           r === 'tools.ozone.team.defs#roleTriage',
       )
 
@@ -197,11 +198,14 @@ export class TeamService {
       isAdmin || member?.role === 'tools.ozone.team.defs#roleModerator'
     const isTriage =
       isModerator || member?.role === 'tools.ozone.team.defs#roleTriage'
+    const isVerifier =
+      isAdmin || member?.role === 'tools.ozone.team.defs#roleVerifier'
 
     return {
       isModerator,
       isAdmin,
       isTriage,
+      isVerifier,
     }
   }
 

package/src/verification/issuer.ts

@@ -0,0 +1,135 @@
+import { Selectable } from 'kysely'
+import { Agent, AtUri, CredentialSession } from '@atproto/api'
+import { VerifierConfig } from '../config'
+import { Verification } from '../db/schema/verification'
+
+export type VerificationInput = {
+  displayName: string
+  handle: string
+  subject: string
+  createdAt?: string
+}
+
+export type VerificationIssuerCreator = (
+  verifierConfig: VerifierConfig,
+) => VerificationIssuer
+
+export class VerificationIssuer {
+  private session = new CredentialSession(new URL(this.verifierConfig.url))
+  private agent = new Agent(this.session)
+  constructor(private verifierConfig: VerifierConfig) {}
+
+  static creator() {
+    return (verifierConfig: VerifierConfig) =>
+      new VerificationIssuer(verifierConfig)
+  }
+
+  async getAgent() {
+    if (!this.session.hasSession) {
+      await this.session.login({
+        identifier: this.verifierConfig.did,
+        password: this.verifierConfig.password,
+      })
+    }
+
+    // Trigger a test request to check if the session is still valid, if not, we will login again
+    try {
+      await this.agent.com.atproto.server.getSession()
+    } catch (err) {
+      if ((err as any).status === 401) {
+        await this.session.login({
+          identifier: this.verifierConfig.did,
+          password: this.verifierConfig.password,
+        })
+      }
+    }
+
+    return this.agent
+  }
+
+  async verify(verifications: VerificationInput[]) {
+    const grantedVerifications: Selectable<Verification>[] = []
+    const failedVerifications: {
+      $type: 'tools.ozone.verification.grantVerifications#grantError'
+      subject: string
+      error: string
+    }[] = []
+    const now = new Date().toISOString()
+    const agent = await this.getAgent()
+    await Promise.allSettled(
+      verifications.map(async ({ displayName, handle, subject, createdAt }) => {
+        try {
+          const verificationRecord = {
+            createdAt: createdAt || now,
+            issuer: this.verifierConfig.did,
+            displayName,
+            handle,
+            subject,
+          }
+          const {
+            data: { uri, cid },
+          } = await agent.com.atproto.repo.createRecord({
+            repo: this.verifierConfig.did,
+            record: verificationRecord,
+            collection: 'app.bsky.graph.verification',
+          })
+          grantedVerifications.push({
+            ...verificationRecord,
+            uri,
+            cid,
+            revokedAt: null,
+            updatedAt: now,
+            revokedBy: null,
+            revokeReason: null,
+          })
+        } catch (err) {
+          failedVerifications.push({
+            $type: 'tools.ozone.verification.grantVerifications#grantError',
+            error: (err as Error).message,
+            subject,
+          })
+          return
+        }
+      }),
+    )
+
+    return { grantedVerifications, failedVerifications }
+  }
+
+  async revoke({ uris }: { uris: string[] }) {
+    const revokedVerifications: string[] = []
+    const failedRevocations: Array<{ uri: string; error: string }> = []
+
+    const agent = await this.getAgent()
+
+    await Promise.allSettled(
+      uris.map(async (uri) => {
+        try {
+          const atUri = new AtUri(uri)
+
+          if (atUri.collection !== 'app.bsky.graph.verification') {
+            throw new Error(`Only verification records can be revoked`)
+          }
+
+          if (atUri.host !== this.verifierConfig.did) {
+            throw new Error(
+              `Cannot revoke verification record ${uri} not issued by ${this.verifierConfig.did}`,
+            )
+          }
+
+          await agent.com.atproto.repo.deleteRecord({
+            collection: atUri.collection,
+            repo: this.verifierConfig.did,
+            rkey: atUri.rkey,
+          })
+          revokedVerifications.push(uri)
+        } catch (err) {
+          failedRevocations.push({ uri, error: (err as Error).message })
+          return
+        }
+      }),
+    )
+
+    return { revokedVerifications, failedRevocations }
+  }
+}

package/src/verification/service.ts

@@ -0,0 +1,208 @@
+import { Selectable } from 'kysely'
+import {
+  $Typed,
+  AppBskyActorDefs,
+  AtUri,
+  ToolsOzoneModerationDefs,
+  ToolsOzoneVerificationDefs,
+} from '@atproto/api'
+import { Database } from '../db'
+import { CreatedAtUriKeyset, paginate } from '../db/pagination'
+import { Verification } from '../db/schema/verification'
+
+export type VerificationServiceCreator = (db: Database) => VerificationService
+
+export class VerificationService {
+  constructor(public db: Database) {}
+
+  static creator() {
+    return (db: Database) => new VerificationService(db)
+  }
+
+  async create(
+    verifications: Pick<
+      Verification,
+      | 'uri'
+      | 'issuer'
+      | 'subject'
+      | 'handle'
+      | 'displayName'
+      | 'createdAt'
+      | 'cid'
+    >[],
+  ) {
+    return this.db.transaction(async (tx) => {
+      return tx.db
+        .insertInto('verification')
+        .values(verifications)
+        .onConflict((oc) => oc.doNothing())
+        .returningAll()
+        .execute()
+    })
+  }
+
+  async markRevoked({
+    uris,
+    revokedBy,
+    revokedAt,
+    revokeReason,
+  }: {
+    uris: string[]
+    revokedBy?: string
+    revokedAt?: string
+    revokeReason?: string
+  }) {
+    const now = new Date().toISOString()
+    return this.db.transaction(async (tx) => {
+      for (const uri of uris) {
+        return tx.db
+          .updateTable('verification')
+          .set({
+            revokeReason,
+            updatedAt: now,
+            revokedAt: revokedAt || now,
+            // Allow setting revokedBy to a moderator/verifier DID and if it isn't set, default to the author of the verification record
+            revokedBy: revokedBy || new AtUri(uri).host,
+          })
+          .where('uri', '=', uri)
+          .where('revokedAt', 'is', null)
+          .execute()
+      }
+    })
+  }
+
+  async list({
+    sortDirection,
+    cursor,
+    createdAfter,
+    createdBefore,
+    issuers = [],
+    subjects = [],
+    isRevoked,
+    limit = 100,
+  }: {
+    sortDirection?: 'asc' | 'desc'
+    cursor?: string
+    createdAfter?: string
+    createdBefore?: string
+    issuers?: string[]
+    subjects?: string[]
+    isRevoked?: boolean
+    limit?: number
+  }) {
+    const { ref } = this.db.db.dynamic
+
+    let qb = this.db.db.selectFrom('verification').selectAll()
+
+    if (issuers.length) {
+      qb = qb.where('issuer', 'in', issuers)
+    }
+
+    if (isRevoked !== undefined) {
+      qb = qb.where('revokedAt', isRevoked ? 'is not' : 'is', null)
+    }
+
+    if (subjects.length) {
+      qb = qb.where('subject', 'in', subjects)
+    }
+
+    if (createdAfter) {
+      qb = qb.where('createdAt', '>=', createdAfter)
+    }
+
+    if (createdBefore) {
+      qb = qb.where('createdAt', '<=', createdBefore)
+    }
+
+    const keyset = new CreatedAtUriKeyset(ref(`createdAt`), ref('uri'))
+    const paginatedBuilder = paginate(qb, {
+      limit,
+      cursor,
+      keyset,
+      tryIndex: true,
+      direction: sortDirection === 'desc' ? 'desc' : 'asc',
+    })
+
+    const result = await paginatedBuilder.execute()
+    return { verifications: result, cursor: keyset.packFromResult(result) }
+  }
+
+  view(
+    verifications: Selectable<Verification>[],
+    repos: Map<
+      string,
+      | $Typed<ToolsOzoneModerationDefs.RepoViewDetail>
+      | $Typed<ToolsOzoneModerationDefs.RepoViewNotFound>
+    >,
+    profiles: Map<string, AppBskyActorDefs.ProfileViewDetailed>,
+  ): $Typed<ToolsOzoneVerificationDefs.VerificationView>[] {
+    return verifications.map((verification) => {
+      const issuerRepo = repos.get(verification.issuer)
+      const subjectRepo = repos.get(verification.subject)
+      const subjectProfile = profiles.get(verification.subject)
+      const issuerProfile = profiles.get(verification.issuer)
+      return {
+        $type: 'tools.ozone.verification.defs#verificationView',
+        uri: verification.uri,
+        issuer: verification.issuer,
+        subject: verification.subject,
+        createdAt: verification.createdAt,
+        displayName: verification.displayName,
+        handle: verification.handle,
+        updatedAt: verification.updatedAt || undefined,
+        revokedAt: verification.revokedAt || undefined,
+        revokedBy: verification.revokedBy || undefined,
+        revokeReason: verification.revokeReason || undefined,
+        issuerRepo,
+        subjectRepo,
+        subjectProfile: subjectProfile
+          ? {
+              $type: 'app.bsky.actor.defs#profileViewDetailed',
+              ...subjectProfile,
+            }
+          : undefined,
+        issuerProfile: issuerProfile
+          ? {
+              $type: 'app.bsky.actor.defs#profileViewDetailed',
+              ...issuerProfile,
+            }
+          : undefined,
+      }
+    })
+  }
+
+  async getFirehoseCursor() {
+    const entry = await this.db.db
+      .selectFrom('firehose_cursor')
+      .select('cursor')
+      .where('service', '=', 'verification')
+      .executeTakeFirst()
+
+    return entry?.cursor || null
+  }
+
+  createFirehoseCursor() {
+    return this.db.db
+      .insertInto('firehose_cursor')
+      .values({
+        service: 'verification',
+        cursor: null,
+      })
+      .onConflict((oc) => oc.doNothing())
+      .execute()
+  }
+
+  async updateFirehoseCursor(cursor: number) {
+    const updated = await this.db.db
+      .updateTable('firehose_cursor')
+      .set({ cursor })
+      .where('service', '=', 'verification')
+      .where((qb) =>
+        qb.where('cursor', '<', cursor).orWhere('cursor', 'is', null),
+      )
+      .returningAll()
+      .executeTakeFirst()
+
+    return updated?.cursor
+  }
+}

package/src/verification/util.ts

@@ -0,0 +1,50 @@
+import { $Typed, ToolsOzoneModerationDefs } from '@atproto/api'
+import { addAccountInfoToRepoViewDetail, getPdsAccountInfos } from '../api/util'
+import { AppContext } from '../context'
+import { ModerationService } from '../mod-service'
+import { ParsedLabelers } from '../util'
+
+export const getReposForVerifications = async (
+  ctx: AppContext,
+  labelers: ParsedLabelers,
+  modService: ModerationService,
+  dids: string[],
+  isModerator: boolean,
+) => {
+  const [partialRepos, accountInfo] = await Promise.all([
+    modService.views.repoDetails(dids, labelers),
+    getPdsAccountInfos(ctx, dids),
+  ])
+
+  const repos = new Map<
+    string,
+    | $Typed<ToolsOzoneModerationDefs.RepoViewDetail>
+    | $Typed<ToolsOzoneModerationDefs.RepoViewNotFound>
+  >(
+    dids.map((did) => {
+      const partialRepo = partialRepos.get(did)
+      if (!partialRepo) {
+        return [
+          did,
+          {
+            did,
+            $type: 'tools.ozone.moderation.defs#repoViewNotFound',
+          },
+        ]
+      }
+      return [
+        did,
+        {
+          ...addAccountInfoToRepoViewDetail(
+            partialRepo,
+            accountInfo.get(did) || null,
+            isModerator,
+          ),
+          $type: 'tools.ozone.moderation.defs#repoViewDetail',
+        },
+      ]
+    }),
+  )
+
+  return repos
+}