@atproto/ozone 0.1.149 → 0.1.151

package/src/mod-service/index.ts

@@ -36,6 +36,7 @@ import {
   isModEventMute,
   isModEventPriorityScore,
   isModEventReport,
+  isModEventReverseTakedown,
   isModEventTag,
   isModEventTakedown,
   isRecordEvent,
@@ -49,6 +50,7 @@ import {
   getStatusIdentifierFromSubject,
   moderationSubjectStatusQueryBuilder,
 } from './status'
+import { StrikeService, StrikeServiceCreator } from './strike'
 import {
   ModSubject,
   RecordSubject,
@@ -89,6 +91,7 @@ export class ModerationService {
       aud: string,
       method: string,
     ) => Promise<AuthHeaders>,
+    public strikeService: StrikeService,
     public imgInvalidator?: ImageInvalidator,
   ) {}
 
@@ -101,10 +104,12 @@ export class ModerationService {
     eventPusher: EventPusher,
     appviewAgent: AtpAgent,
     createAuthHeaders: (aud: string, method: string) => Promise<AuthHeaders>,
+    strikeServiceCreator: StrikeServiceCreator,
     imgInvalidator?: ImageInvalidator,
   ) {
-    return (db: Database) =>
-      new ModerationService(
+    return (db: Database) => {
+      const strikeService = strikeServiceCreator(db)
+      return new ModerationService(
         db,
         signingKey,
         signingKeyId,
@@ -114,8 +119,10 @@ export class ModerationService {
         eventPusher,
         appviewAgent,
         createAuthHeaders,
+        strikeService,
         imgInvalidator,
       )
+    }
   }
 
   views = new ModerationViews(
@@ -190,6 +197,7 @@ export class ModerationService {
     modTool?: string[]
     ageAssuranceState?: string
     batchId?: string
+    withStrike?: boolean
   }): Promise<{ cursor?: string; events: ModerationEventRow[] }> {
     const {
       subject,
@@ -214,6 +222,7 @@ export class ModerationService {
       modTool,
       ageAssuranceState,
       batchId,
+      withStrike,
     } = opts
     const { ref } = this.db.db.dynamic
     let builder = this.db.db.selectFrom('moderation_event').selectAll()
@@ -333,6 +342,10 @@ export class ModerationService {
         .where(sql`meta->>'status'`, '=', ageAssuranceState)
     }
 
+    if (withStrike !== undefined) {
+      builder = builder.where('strikeCount', 'is not', null)
+    }
+
     const keyset = new TimeIdKeyset(
       ref(`moderation_event.createdAt`),
       ref('moderation_event.id'),
@@ -484,6 +497,9 @@ export class ModerationService {
       if (event.content) {
         meta.content = event.content
       }
+      if (event.policies?.length) {
+        meta.policies = event.policies.join(',')
+      }
     }
 
     if (isAccountEvent(event)) {
@@ -566,6 +582,32 @@ export class ModerationService {
 
     const subjectInfo = subject.info()
 
+    // Store severityLevel, strikeCount, and strikeExpiresAt if provided
+    // These values should be calculated by the client based on configuration
+    // processNewEvent will update the account_strike table with the new strike count
+    let severityLevel: string | null = null
+    let strikeCount: number | null = null
+    let strikeExpiresAt: string | null = null
+
+    if (
+      isModEventTakedown(event) ||
+      isModEventEmail(event) ||
+      isModEventReverseTakedown(event)
+    ) {
+      // Store severityLevel if provided (for display/tracking)
+      if (event.severityLevel) {
+        severityLevel = event.severityLevel
+      }
+      // Store explicit strikeCount if provided
+      if (event.strikeCount !== undefined) {
+        strikeCount = event.strikeCount
+      }
+      // Store strikeExpiresAt if provided by client
+      if ('strikeExpiresAt' in event && event.strikeExpiresAt) {
+        strikeExpiresAt = event.strikeExpiresAt
+      }
+    }
+
     const modEvent = await this.db.db
       .insertInto('moderation_event')
       .values({
@@ -599,6 +641,9 @@ export class ModerationService {
         subjectMessageId: subjectInfo.subjectMessageId,
         modTool: modTool ? jsonb(modTool) : null,
         externalId: externalId ?? null,
+        severityLevel,
+        strikeCount,
+        strikeExpiresAt,
       })
       .returningAll()
       .executeTakeFirstOrThrow()
@@ -609,6 +654,19 @@ export class ModerationService {
       subject.blobCids,
     )
 
+    // Updates are only needed if strikeCount is numeric (in some cases even 0)
+    if (modEvent.strikeCount !== null) {
+      try {
+        await this.strikeService.updateSubjectStrikeCount(modEvent.subjectDid)
+      } catch (error) {
+        // Log error but don't fail the entire operation to ensure that events are logged even if updating strike count fails
+        log.error(
+          { err: error, modEventId: modEvent.id },
+          'Error processing strikes for moderation event',
+        )
+      }
+    }
+
     return { event: modEvent, subjectStatus }
   }
 
@@ -959,6 +1017,7 @@ export class ModerationService {
     minReportedRecordsCount,
     minTakendownRecordsCount,
     minPriorityScore,
+    minStrikeCount,
     ageAssuranceState,
   }: QueryStatusParams): Promise<{
     statuses: ModerationSubjectStatusRowWithHandle[]
@@ -1224,6 +1283,14 @@ export class ModerationService {
       )
     }
 
+    if (minStrikeCount != null && minStrikeCount >= 0) {
+      builder = builder.where(
+        'account_strike.activeStrikeCount',
+        '>=',
+        minStrikeCount,
+      )
+    }
+
     if (ageAssuranceState) {
       builder = builder.where(
         'moderation_subject_status.ageAssuranceState',

package/src/mod-service/status.ts

@@ -258,6 +258,15 @@ export const moderationSubjectStatusQueryBuilder = (db: DatabaseSchema) => {
       'account_record_status_stats.processedCount',
       'account_record_status_stats.takendownCount',
     ])
+    .leftJoin('account_strike', (join) =>
+      join.onRef('moderation_subject_status.did', '=', 'account_strike.did'),
+    )
+    .select([
+      'account_strike.activeStrikeCount as strikeCount',
+      'account_strike.totalStrikeCount',
+      'account_strike.firstStrikeAt',
+      'account_strike.lastStrikeAt',
+    ])
 }
 
 // Based on a given moderation action event, this function will update the moderation status of the subject

package/src/mod-service/strike.ts

@@ -0,0 +1,96 @@
+import { Database } from '../db'
+
+export type StrikeServiceCreator = (db: Database) => StrikeService
+
+export class StrikeService {
+  constructor(private db: Database) {}
+
+  static creator() {
+    return (db: Database) => {
+      return new StrikeService(db)
+    }
+  }
+
+  /**
+   * Update the strike count in account_strike table
+   */
+  async updateSubjectStrikeCount(subjectDid: string): Promise<void> {
+    const now = new Date().toISOString()
+
+    // This should not incur too many rows since we tend to do permanent takedown on relatively low strike count
+    // and we have a very specific index to support this query
+    const events = await this.db.db
+      .selectFrom('moderation_event')
+      .where('subjectDid', '=', subjectDid)
+      .where('strikeCount', '<>', 0)
+      .select(['strikeCount', 'strikeExpiresAt', 'createdAt'])
+      .orderBy('createdAt', 'asc')
+      .execute()
+
+    if (!events.length) {
+      return
+    }
+
+    let activeStrikeCount = 0
+    let totalStrikeCount = 0
+
+    const firstStrikeAt = events[0].createdAt
+    const lastStrikeAt = events[events.length - 1].createdAt
+
+    for (const event of events) {
+      const strikeCount = event.strikeCount || 0
+      totalStrikeCount += strikeCount
+
+      // Count as active if not expired
+      const isActive =
+        event.strikeExpiresAt === null || event.strikeExpiresAt > now
+      if (isActive) {
+        activeStrikeCount += strikeCount
+      }
+    }
+
+    await this.db.db
+      .insertInto('account_strike')
+      .values({
+        did: subjectDid,
+        activeStrikeCount,
+        totalStrikeCount,
+        firstStrikeAt,
+        lastStrikeAt,
+      })
+      .onConflict((oc) =>
+        oc.column('did').doUpdateSet({
+          activeStrikeCount,
+          totalStrikeCount,
+          firstStrikeAt,
+          lastStrikeAt,
+        }),
+      )
+      .execute()
+  }
+
+  /**
+   * Get distinct subjects with expired strikes since a given timestamp
+   * Used by the strike expiry processor to find accounts that need strike count updates
+   */
+  async getExpiredStrikeSubjects(
+    afterTimestamp?: string,
+  ): Promise<Array<{ subjectDid: string }>> {
+    const now = new Date().toISOString()
+
+    let query = this.db.db
+      .selectFrom('moderation_event')
+      .where('strikeExpiresAt', 'is not', null)
+      .where('strikeExpiresAt', '<=', now)
+      .where('strikeCount', '<>', 0)
+      .select('subjectDid')
+      .distinct()
+
+    // Only process strikes that expired since the last run
+    if (afterTimestamp) {
+      query = query.where('strikeExpiresAt', '>=', afterTimestamp)
+    }
+
+    return await query.execute()
+  }
+}

package/src/mod-service/types.ts

@@ -37,6 +37,12 @@ export type ModerationSubjectStatusRowWithStats = ModerationSubjectStatusRow & {
   pendingCount: number | null
   processedCount: number | null
   takendownCount: number | null
+
+  // account_strike
+  strikeCount: number | null
+  totalStrikeCount: number | null
+  firstStrikeAt: string | null
+  lastStrikeAt: string | null
 }
 
 export type ModerationSubjectStatusRowWithHandle =

package/src/mod-service/views.ts

@@ -41,6 +41,7 @@ import {
   isModEventMuteReporter,
   isModEventPriorityScore,
   isModEventReport,
+  isModEventReverseTakedown,
   isModEventTag,
   isModEventTakedown,
   isRecordEvent,
@@ -178,11 +179,20 @@ export class ModerationViews {
     }
 
     if (
-      isModEventTakedown(event) &&
-      typeof meta.policies === 'string' &&
-      meta.policies.length > 0
+      isModEventTakedown(event) ||
+      isModEventEmail(event) ||
+      isModEventReverseTakedown(event)
     ) {
-      event.policies = meta.policies.split(',')
+      if (typeof meta.policies === 'string' && meta.policies.length > 0) {
+        event.policies = meta.policies.split(',')
+      }
+
+      event.strikeCount = ifNumber(row.strikeCount)
+      event.severityLevel = ifString(row.severityLevel)
+
+      if (isModEventTakedown(event) || isModEventEmail(event)) {
+        event.strikeExpiresAt = ifString(row.strikeExpiresAt)
+      }
     }
 
     if (isModEventLabel(event)) {
@@ -745,6 +755,17 @@ export class ModerationViews {
         processedCount: status.processedCount ?? undefined,
         takendownCount: status.takendownCount ?? undefined,
       },
+
+      accountStrike:
+        status.strikeCount !== null || status.totalStrikeCount !== null
+          ? {
+              $type: 'tools.ozone.moderation.defs#accountStrike',
+              activeStrikeCount: status.strikeCount ?? undefined,
+              totalStrikeCount: status.totalStrikeCount ?? undefined,
+              firstStrikeAt: status.firstStrikeAt ?? undefined,
+              lastStrikeAt: status.lastStrikeAt ?? undefined,
+            }
+          : undefined,
     }
 
     if (status.recordPath !== '') {

package/src/setting/constants.ts

@@ -1,2 +1,3 @@
 export const ProtectedTagSettingKey = 'tools.ozone.setting.protectedTags'
 export const PolicyListSettingKey = 'tools.ozone.setting.policyList'
+export const SeverityLevelSettingKey = 'tools.ozone.setting.severityLevels'

package/src/setting/validators.ts

@@ -1,7 +1,11 @@
 import { Selectable } from 'kysely'
 import { InvalidRequestError } from '@atproto/xrpc-server'
 import { Setting } from '../db/schema/setting'
-import { PolicyListSettingKey, ProtectedTagSettingKey } from './constants'
+import {
+  PolicyListSettingKey,
+  ProtectedTagSettingKey,
+  SeverityLevelSettingKey,
+} from './constants'
 
 export const settingValidators = new Map<
   string,
@@ -9,6 +13,21 @@ export const settingValidators = new Map<
 >([
   [
     ProtectedTagSettingKey,
+    /*
+     * Example configuration:
+     * {
+     *   "sensitive-tag": {
+     *     "roles": ["tools.ozone.team.defs#roleAdmin", "tools.ozone.team.defs#roleModerator"],
+     *     "moderators": ["did:plc:example1", "did:plc:example2"]
+     *   },
+     *   "high-risk-tag": {
+     *     "roles": ["tools.ozone.team.defs#roleAdmin"]
+     *   },
+     *   "admin-only-tag": {
+     *     "moderators": ["did:plc:admin1"]
+     *   }
+     * }
+     */
     async (setting: Partial<Selectable<Setting>>) => {
       if (setting.managerRole !== 'tools.ozone.team.defs#roleAdmin') {
         throw new InvalidRequestError(
@@ -60,6 +79,61 @@ export const settingValidators = new Map<
   ],
   [
     PolicyListSettingKey,
+    /*
+     * Example configuration:
+     * {
+     *   "harassment": {
+     *     "name": "Anti-Harassment",
+     *     "description": "Content that harasses, intimidates, or bullies users",
+     *     "severityLevels": {
+     *       "sev-1": {
+     *         "description": "Minor harassment",
+     *         "isDefault": true
+     *       },
+     *       "sev-2": {
+     *         "description": "Moderate harassment",
+     *         "isDefault": false
+     *       },
+     *       "sev-4": {
+     *         "description": "Severe harassment",
+     *         "isDefault": false
+     *       }
+     *     }
+     *   },
+     *   "death-threats": {
+     *     "name": "Death Threats",
+     *     "description": "Threats of violence or death against individuals",
+     *     "severityLevels": {
+     *       "death-threat": {
+     *         "description": "Death threat violation",
+     *         "isDefault": true
+     *       }
+     *     }
+     *   },
+     *   "spam": {
+     *     "name": "Spam",
+     *     "description": "Unsolicited or repetitive content",
+     *     "severityLevels": {
+     *       "sev-0": {
+     *         "description": "Minor spam",
+     *         "isDefault": false
+     *       },
+     *       "sev-1": {
+     *         "description": "Moderate spam",
+     *         "isDefault": true
+     *       },
+     *       "sev-2": {
+     *         "description": "Severe spam",
+     *         "isDefault": false
+     *       }
+     *     }
+     *   },
+     *   "minimal-policy": {
+     *     "name": "Basic Policy",
+     *     "description": "Simple policy without severity levels"
+     *   }
+     * }
+     */
     async (setting: Partial<Selectable<Setting>>) => {
       if (setting.managerRole !== 'tools.ozone.team.defs#roleAdmin') {
         throw new InvalidRequestError(
@@ -82,6 +156,162 @@ export const settingValidators = new Map<
             `Must define a name and description for policy ${key}`,
           )
         }
+
+        if (val['severityLevels'] !== undefined) {
+          if (typeof val['severityLevels'] !== 'object') {
+            throw new InvalidRequestError(
+              `Severity levels must be an object for policy ${key}`,
+            )
+          }
+
+          let hasDefault = false
+          for (const [severityKey, severityVal] of Object.entries(
+            val['severityLevels'],
+          )) {
+            if (!severityVal || typeof severityVal !== 'object') {
+              throw new InvalidRequestError(
+                `Invalid configuration for severity level ${severityKey} in policy ${key}`,
+              )
+            }
+
+            if (
+              severityVal['description'] !== undefined &&
+              typeof severityVal['description'] !== 'string'
+            ) {
+              throw new InvalidRequestError(
+                `Description must be a string for severity level ${severityKey} in policy ${key}`,
+              )
+            }
+
+            if (severityVal['isDefault'] !== undefined) {
+              if (typeof severityVal['isDefault'] !== 'boolean') {
+                throw new InvalidRequestError(
+                  `isDefault must be a boolean for severity level ${severityKey} in policy ${key}`,
+                )
+              }
+              if (severityVal['isDefault']) {
+                if (hasDefault) {
+                  throw new InvalidRequestError(
+                    `Only one severity level can be the default for policy ${key}`,
+                  )
+                }
+                hasDefault = true
+              }
+            }
+          }
+        }
+      }
+    },
+  ],
+  [
+    SeverityLevelSettingKey,
+    /*
+     * Example configuration:
+     * {
+     *   "sev-0": {
+     *     "strikeCount": 0
+     *   },
+     *   "sev-1": {
+     *     "strikeCount": 1,
+     *     "strikeOnOccurrence": 2
+     *   },
+     *   "sev-2": {
+     *     "strikeCount": 2
+     *   },
+     *   "sev-4": {
+     *     "strikeCount": 4,
+     *     "expiresInDays": 365
+     *   },
+     *   "sev-5": {
+     *     "needsTakedown": true
+     *   },
+     *   "death-threat": {
+     *     "strikeCount": 4,
+     *     "firstOccurrenceStrikeCount": 4,
+     *   },
+     *   "custom-severity": {
+     *     "strikeCount": 3,
+     *     "strikeOnOccurrence": 1,
+     *   },
+     *   "escalating-severity": {
+     *     "firstOccurrenceStrikeCount": 2,
+     *     "repeatOccurrenceStrikeCount": 5
+     *   }
+     * }
+     */
+    async (setting: Partial<Selectable<Setting>>) => {
+      if (setting.managerRole !== 'tools.ozone.team.defs#roleAdmin') {
+        throw new InvalidRequestError(
+          'Only admins should be able to manage severity levels',
+        )
+      }
+
+      if (typeof setting.value !== 'object') {
+        throw new InvalidRequestError('Invalid value')
+      }
+
+      for (const [key, val] of Object.entries(setting.value)) {
+        if (!val || typeof val !== 'object') {
+          throw new InvalidRequestError(
+            `Invalid configuration for severity level ${key}`,
+          )
+        }
+
+        if (val['strikeCount'] !== undefined) {
+          if (
+            typeof val['strikeCount'] !== 'number' ||
+            !Number.isInteger(val['strikeCount']) ||
+            val['strikeCount'] < 0
+          ) {
+            throw new InvalidRequestError(
+              `Strike count must be a non-negative integer for severity level ${key}`,
+            )
+          }
+        }
+
+        if (val['strikeOnOccurrence'] !== undefined) {
+          if (
+            typeof val['strikeOnOccurrence'] !== 'number' ||
+            !Number.isInteger(val['strikeOnOccurrence']) ||
+            val['strikeOnOccurrence'] < 1
+          ) {
+            throw new InvalidRequestError(
+              `Strike on occurrence must be a positive integer for severity level ${key}`,
+            )
+          }
+        }
+
+        if (val['needsTakedown'] !== undefined) {
+          if (typeof val['needsTakedown'] !== 'boolean') {
+            throw new InvalidRequestError(
+              `Needs takedown must be a boolean for severity level ${key}`,
+            )
+          }
+        }
+
+        if (val['expiresInDays'] !== undefined) {
+          if (
+            typeof val['expiresInDays'] !== 'number' ||
+            !Number.isInteger(val['expiresInDays']) ||
+            val['expiresInDays'] < 0
+          ) {
+            throw new InvalidRequestError(
+              `Expires in days must be a non-negative integer for severity level ${key}`,
+            )
+          }
+        }
+
+        if (val['firstOccurrenceStrikeCount'] !== undefined) {
+          if (
+            typeof val['firstOccurrenceStrikeCount'] !== 'number' ||
+            !Number.isInteger(val['firstOccurrenceStrikeCount']) ||
+            val['firstOccurrenceStrikeCount'] < 0
+          ) {
+            throw new InvalidRequestError(
+              `First occurrence strike count must be a non-negative integer for severity level ${key}`,
+            )
+          }
+        }
       }
     },
   ],