@atproto/ozone 0.1.107 → 0.1.109

package/src/lexicon/types/tools/ozone/team/defs.ts

@@ -27,6 +27,7 @@ export interface Member {
     | 'lex:tools.ozone.team.defs#roleAdmin'
     | 'lex:tools.ozone.team.defs#roleModerator'
     | 'lex:tools.ozone.team.defs#roleTriage'
+    | 'lex:tools.ozone.team.defs#roleVerifier'
     | (string & {})
 }
 
@@ -46,3 +47,5 @@ export const ROLEADMIN = `${id}#roleAdmin`
 export const ROLEMODERATOR = `${id}#roleModerator`
 /** Triage role. Mostly intended for monitoring and escalating issues. */
 export const ROLETRIAGE = `${id}#roleTriage`
+/** Verifier role. Only allowed to issue verifications. */
+export const ROLEVERIFIER = `${id}#roleVerifier`

package/src/lexicon/types/tools/ozone/team/updateMember.ts

@@ -25,6 +25,7 @@ export interface InputSchema {
   role?:
     | 'tools.ozone.team.defs#roleAdmin'
     | 'tools.ozone.team.defs#roleModerator'
+    | 'tools.ozone.team.defs#roleVerifier'
     | 'tools.ozone.team.defs#roleTriage'
     | (string & {})
 }

package/src/lexicon/types/tools/ozone/verification/defs.ts

@@ -0,0 +1,59 @@
+/**
+ * GENERATED CODE - DO NOT MODIFY
+ */
+import { type ValidationResult, BlobRef } from '@atproto/lexicon'
+import { CID } from 'multiformats/cid'
+import { validate as _validate } from '../../../../lexicons'
+import {
+  type $Typed,
+  is$typed as _is$typed,
+  type OmitKey,
+} from '../../../../util'
+import type * as ToolsOzoneModerationDefs from '../moderation/defs.js'
+
+const is$typed = _is$typed,
+  validate = _validate
+const id = 'tools.ozone.verification.defs'
+
+/** Verification data for the associated subject. */
+export interface VerificationView {
+  $type?: 'tools.ozone.verification.defs#verificationView'
+  /** The user who issued this verification. */
+  issuer: string
+  /** The AT-URI of the verification record. */
+  uri: string
+  /** The subject of the verification. */
+  subject: string
+  /** Handle of the subject the verification applies to at the moment of verifying, which might not be the same at the time of viewing. The verification is only valid if the current handle matches the one at the time of verifying. */
+  handle: string
+  /** Display name of the subject the verification applies to at the moment of verifying, which might not be the same at the time of viewing. The verification is only valid if the current displayName matches the one at the time of verifying. */
+  displayName: string
+  /** Timestamp when the verification was created. */
+  createdAt: string
+  /** Describes the reason for revocation, also indicating that the verification is no longer valid. */
+  revokeReason?: string
+  /** Timestamp when the verification was revoked. */
+  revokedAt?: string
+  /** The user who revoked this verification. */
+  revokedBy?: string
+  subjectProfile?: { $type: string }
+  issuerProfile?: { $type: string }
+  subjectRepo?:
+    | $Typed<ToolsOzoneModerationDefs.RepoViewDetail>
+    | $Typed<ToolsOzoneModerationDefs.RepoViewNotFound>
+    | { $type: string }
+  issuerRepo?:
+    | $Typed<ToolsOzoneModerationDefs.RepoViewDetail>
+    | $Typed<ToolsOzoneModerationDefs.RepoViewNotFound>
+    | { $type: string }
+}
+
+const hashVerificationView = 'verificationView'
+
+export function isVerificationView<V>(v: V) {
+  return is$typed(v, id, hashVerificationView)
+}
+
+export function validateVerificationView<V>(v: V) {
+  return validate<VerificationView & V>(v, id, hashVerificationView)
+}

package/src/lexicon/types/tools/ozone/verification/grantVerifications.ts

@@ -0,0 +1,100 @@
+/**
+ * GENERATED CODE - DO NOT MODIFY
+ */
+import express from 'express'
+import { type ValidationResult, BlobRef } from '@atproto/lexicon'
+import { CID } from 'multiformats/cid'
+import { validate as _validate } from '../../../../lexicons'
+import {
+  type $Typed,
+  is$typed as _is$typed,
+  type OmitKey,
+} from '../../../../util'
+import { HandlerAuth, HandlerPipeThrough } from '@atproto/xrpc-server'
+import type * as ToolsOzoneVerificationDefs from './defs.js'
+
+const is$typed = _is$typed,
+  validate = _validate
+const id = 'tools.ozone.verification.grantVerifications'
+
+export interface QueryParams {}
+
+export interface InputSchema {
+  /** Array of verification requests to process */
+  verifications: VerificationInput[]
+}
+
+export interface OutputSchema {
+  verifications: ToolsOzoneVerificationDefs.VerificationView[]
+  failedVerifications: GrantError[]
+}
+
+export interface HandlerInput {
+  encoding: 'application/json'
+  body: InputSchema
+}
+
+export interface HandlerSuccess {
+  encoding: 'application/json'
+  body: OutputSchema
+  headers?: { [key: string]: string }
+}
+
+export interface HandlerError {
+  status: number
+  message?: string
+}
+
+export type HandlerOutput = HandlerError | HandlerSuccess | HandlerPipeThrough
+export type HandlerReqCtx<HA extends HandlerAuth = never> = {
+  auth: HA
+  params: QueryParams
+  input: HandlerInput
+  req: express.Request
+  res: express.Response
+  resetRouteRateLimits: () => Promise<void>
+}
+export type Handler<HA extends HandlerAuth = never> = (
+  ctx: HandlerReqCtx<HA>,
+) => Promise<HandlerOutput> | HandlerOutput
+
+export interface VerificationInput {
+  $type?: 'tools.ozone.verification.grantVerifications#verificationInput'
+  /** The did of the subject being verified */
+  subject: string
+  /** Handle of the subject the verification applies to at the moment of verifying. */
+  handle: string
+  /** Display name of the subject the verification applies to at the moment of verifying. */
+  displayName: string
+  /** Timestamp for verification record. Defaults to current time when not specified. */
+  createdAt?: string
+}
+
+const hashVerificationInput = 'verificationInput'
+
+export function isVerificationInput<V>(v: V) {
+  return is$typed(v, id, hashVerificationInput)
+}
+
+export function validateVerificationInput<V>(v: V) {
+  return validate<VerificationInput & V>(v, id, hashVerificationInput)
+}
+
+/** Error object for failed verifications. */
+export interface GrantError {
+  $type?: 'tools.ozone.verification.grantVerifications#grantError'
+  /** Error message describing the reason for failure. */
+  error: string
+  /** The did of the subject being verified */
+  subject: string
+}
+
+const hashGrantError = 'grantError'
+
+export function isGrantError<V>(v: V) {
+  return is$typed(v, id, hashGrantError)
+}
+
+export function validateGrantError<V>(v: V) {
+  return validate<GrantError & V>(v, id, hashGrantError)
+}

package/src/lexicon/types/tools/ozone/verification/listVerifications.ts

@@ -0,0 +1,70 @@
+/**
+ * GENERATED CODE - DO NOT MODIFY
+ */
+import express from 'express'
+import { type ValidationResult, BlobRef } from '@atproto/lexicon'
+import { CID } from 'multiformats/cid'
+import { validate as _validate } from '../../../../lexicons'
+import {
+  type $Typed,
+  is$typed as _is$typed,
+  type OmitKey,
+} from '../../../../util'
+import { HandlerAuth, HandlerPipeThrough } from '@atproto/xrpc-server'
+import type * as ToolsOzoneVerificationDefs from './defs.js'
+
+const is$typed = _is$typed,
+  validate = _validate
+const id = 'tools.ozone.verification.listVerifications'
+
+export interface QueryParams {
+  /** Pagination cursor */
+  cursor?: string
+  /** Maximum number of results to return */
+  limit: number
+  /** Filter to verifications created after this timestamp */
+  createdAfter?: string
+  /** Filter to verifications created before this timestamp */
+  createdBefore?: string
+  /** Filter to verifications from specific issuers */
+  issuers?: string[]
+  /** Filter to specific verified DIDs */
+  subjects?: string[]
+  /** Sort direction for creation date */
+  sortDirection: 'asc' | 'desc'
+  /** Filter to verifications that are revoked or not. By default, includes both. */
+  isRevoked?: boolean
+}
+
+export type InputSchema = undefined
+
+export interface OutputSchema {
+  cursor?: string
+  verifications: ToolsOzoneVerificationDefs.VerificationView[]
+}
+
+export type HandlerInput = undefined
+
+export interface HandlerSuccess {
+  encoding: 'application/json'
+  body: OutputSchema
+  headers?: { [key: string]: string }
+}
+
+export interface HandlerError {
+  status: number
+  message?: string
+}
+
+export type HandlerOutput = HandlerError | HandlerSuccess | HandlerPipeThrough
+export type HandlerReqCtx<HA extends HandlerAuth = never> = {
+  auth: HA
+  params: QueryParams
+  input: HandlerInput
+  req: express.Request
+  res: express.Response
+  resetRouteRateLimits: () => Promise<void>
+}
+export type Handler<HA extends HandlerAuth = never> = (
+  ctx: HandlerReqCtx<HA>,
+) => Promise<HandlerOutput> | HandlerOutput

package/src/lexicon/types/tools/ozone/verification/revokeVerifications.ts

@@ -0,0 +1,81 @@
+/**
+ * GENERATED CODE - DO NOT MODIFY
+ */
+import express from 'express'
+import { type ValidationResult, BlobRef } from '@atproto/lexicon'
+import { CID } from 'multiformats/cid'
+import { validate as _validate } from '../../../../lexicons'
+import {
+  type $Typed,
+  is$typed as _is$typed,
+  type OmitKey,
+} from '../../../../util'
+import { HandlerAuth, HandlerPipeThrough } from '@atproto/xrpc-server'
+
+const is$typed = _is$typed,
+  validate = _validate
+const id = 'tools.ozone.verification.revokeVerifications'
+
+export interface QueryParams {}
+
+export interface InputSchema {
+  /** Array of verification record uris to revoke */
+  uris: string[]
+  /** Reason for revoking the verification. This is optional and can be omitted if not needed. */
+  revokeReason?: string
+}
+
+export interface OutputSchema {
+  /** List of verification uris successfully revoked */
+  revokedVerifications: string[]
+  /** List of verification uris that couldn't be revoked, including failure reasons */
+  failedRevocations: RevokeError[]
+}
+
+export interface HandlerInput {
+  encoding: 'application/json'
+  body: InputSchema
+}
+
+export interface HandlerSuccess {
+  encoding: 'application/json'
+  body: OutputSchema
+  headers?: { [key: string]: string }
+}
+
+export interface HandlerError {
+  status: number
+  message?: string
+}
+
+export type HandlerOutput = HandlerError | HandlerSuccess | HandlerPipeThrough
+export type HandlerReqCtx<HA extends HandlerAuth = never> = {
+  auth: HA
+  params: QueryParams
+  input: HandlerInput
+  req: express.Request
+  res: express.Response
+  resetRouteRateLimits: () => Promise<void>
+}
+export type Handler<HA extends HandlerAuth = never> = (
+  ctx: HandlerReqCtx<HA>,
+) => Promise<HandlerOutput> | HandlerOutput
+
+/** Error object for failed revocations */
+export interface RevokeError {
+  $type?: 'tools.ozone.verification.revokeVerifications#revokeError'
+  /** The AT-URI of the verification record that failed to revoke. */
+  uri: string
+  /** Description of the error that occurred during revocation. */
+  error: string
+}
+
+const hashRevokeError = 'revokeError'
+
+export function isRevokeError<V>(v: V) {
+  return is$typed(v, id, hashRevokeError)
+}
+
+export function validateRevokeError<V>(v: V) {
+  return validate<RevokeError & V>(v, id, hashRevokeError)
+}

package/src/logger.ts

@@ -10,6 +10,8 @@ export const httpLogger: ReturnType<typeof subsystemLogger> =
   subsystemLogger('ozone')
 export const langLogger: ReturnType<typeof subsystemLogger> =
   subsystemLogger('ozone:lang')
+export const verificationLogger: ReturnType<typeof subsystemLogger> =
+  subsystemLogger('ozone:verification')
 
 export const loggerMiddleware = pinoHttp({
   logger: httpLogger,

package/src/mod-service/index.ts

@@ -727,7 +727,7 @@ export class ModerationService {
               this.eventPusher
                 .attemptBlobEvent(evt.id)
                 .catch((err) =>
-                  log.error({ err, ...evt }, 'failed to push blob event'),
+                  log.error({ ...evt, err }, 'failed to push blob event'),
                 ),
             ),
           )

package/src/mod-service/views.ts

@@ -544,10 +544,14 @@ export class ModerationViews {
     subjects: string[],
     includeNeg?: boolean,
   ): Promise<Map<string, Label[]>> {
+    const now = new Date().toISOString()
     const labels = new Map<string, Label[]>()
     const res = await this.db.db
       .selectFrom('label')
       .where('label.uri', 'in', subjects)
+      .where((qb) =>
+        qb.where('label.exp', 'is', null).orWhere('label.exp', '>', now),
+      )
       .if(!includeNeg, (qb) => qb.where('neg', '=', false))
       .selectAll()
       .execute()

package/src/team/index.ts

@@ -54,6 +54,7 @@ export class TeamService {
         (r) =>
           r === 'tools.ozone.team.defs#roleAdmin' ||
           r === 'tools.ozone.team.defs#roleModerator' ||
+          r === 'tools.ozone.team.defs#roleVerifier' ||
           r === 'tools.ozone.team.defs#roleTriage',
       )
 
@@ -197,11 +198,14 @@ export class TeamService {
       isAdmin || member?.role === 'tools.ozone.team.defs#roleModerator'
     const isTriage =
       isModerator || member?.role === 'tools.ozone.team.defs#roleTriage'
+    const isVerifier =
+      isAdmin || member?.role === 'tools.ozone.team.defs#roleVerifier'
 
     return {
       isModerator,
       isAdmin,
       isTriage,
+      isVerifier,
     }
   }
 
@@ -225,11 +229,8 @@ export class TeamService {
           profiles.set(profile.did, profile)
         })
       }
-    } catch (error) {
-      httpLogger.error(
-        { error, dids },
-        'Failed to get profiles for team members',
-      )
+    } catch (err) {
+      httpLogger.error({ err, dids }, 'Failed to get profiles for team members')
     }
 
     return profiles

package/src/verification/issuer.ts

@@ -0,0 +1,135 @@
+import { Selectable } from 'kysely'
+import { Agent, AtUri, CredentialSession } from '@atproto/api'
+import { VerifierConfig } from '../config'
+import { Verification } from '../db/schema/verification'
+
+export type VerificationInput = {
+  displayName: string
+  handle: string
+  subject: string
+  createdAt?: string
+}
+
+export type VerificationIssuerCreator = (
+  verifierConfig: VerifierConfig,
+) => VerificationIssuer
+
+export class VerificationIssuer {
+  private session = new CredentialSession(new URL(this.verifierConfig.url))
+  private agent = new Agent(this.session)
+  constructor(private verifierConfig: VerifierConfig) {}
+
+  static creator() {
+    return (verifierConfig: VerifierConfig) =>
+      new VerificationIssuer(verifierConfig)
+  }
+
+  async getAgent() {
+    if (!this.session.hasSession) {
+      await this.session.login({
+        identifier: this.verifierConfig.did,
+        password: this.verifierConfig.password,
+      })
+    }
+
+    // Trigger a test request to check if the session is still valid, if not, we will login again
+    try {
+      await this.agent.com.atproto.server.getSession()
+    } catch (err) {
+      if ((err as any).status === 401) {
+        await this.session.login({
+          identifier: this.verifierConfig.did,
+          password: this.verifierConfig.password,
+        })
+      }
+    }
+
+    return this.agent
+  }
+
+  async verify(verifications: VerificationInput[]) {
+    const grantedVerifications: Selectable<Verification>[] = []
+    const failedVerifications: {
+      $type: 'tools.ozone.verification.grantVerifications#grantError'
+      subject: string
+      error: string
+    }[] = []
+    const now = new Date().toISOString()
+    const agent = await this.getAgent()
+    await Promise.allSettled(
+      verifications.map(async ({ displayName, handle, subject, createdAt }) => {
+        try {
+          const verificationRecord = {
+            createdAt: createdAt || now,
+            issuer: this.verifierConfig.did,
+            displayName,
+            handle,
+            subject,
+          }
+          const {
+            data: { uri, cid },
+          } = await agent.com.atproto.repo.createRecord({
+            repo: this.verifierConfig.did,
+            record: verificationRecord,
+            collection: 'app.bsky.graph.verification',
+          })
+          grantedVerifications.push({
+            ...verificationRecord,
+            uri,
+            cid,
+            revokedAt: null,
+            updatedAt: now,
+            revokedBy: null,
+            revokeReason: null,
+          })
+        } catch (err) {
+          failedVerifications.push({
+            $type: 'tools.ozone.verification.grantVerifications#grantError',
+            error: (err as Error).message,
+            subject,
+          })
+          return
+        }
+      }),
+    )
+
+    return { grantedVerifications, failedVerifications }
+  }
+
+  async revoke({ uris }: { uris: string[] }) {
+    const revokedVerifications: string[] = []
+    const failedRevocations: Array<{ uri: string; error: string }> = []
+
+    const agent = await this.getAgent()
+
+    await Promise.allSettled(
+      uris.map(async (uri) => {
+        try {
+          const atUri = new AtUri(uri)
+
+          if (atUri.collection !== 'app.bsky.graph.verification') {
+            throw new Error(`Only verification records can be revoked`)
+          }
+
+          if (atUri.host !== this.verifierConfig.did) {
+            throw new Error(
+              `Cannot revoke verification record ${uri} not issued by ${this.verifierConfig.did}`,
+            )
+          }
+
+          await agent.com.atproto.repo.deleteRecord({
+            collection: atUri.collection,
+            repo: this.verifierConfig.did,
+            rkey: atUri.rkey,
+          })
+          revokedVerifications.push(uri)
+        } catch (err) {
+          failedRevocations.push({ uri, error: (err as Error).message })
+          return
+        }
+      }),
+    )
+
+    return { revokedVerifications, failedRevocations }
+  }
+}