@atproto/ozone 0.1.15 → 0.1.16

package/dist/util.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.retryableHttp = exports.retryHttp = exports.getSigningKeyId = void 0;
+exports.formatLabelerHeader = exports.defaultLabelerHeader = exports.parseLabelerHeader = exports.LABELER_HEADER_NAME = exports.retryableHttp = exports.retryHttp = exports.getSigningKeyId = void 0;
 const axios_1 = require("axios");
+const structured_headers_1 = require("structured-headers");
 const xrpc_1 = require("@atproto/xrpc");
 const common_1 = require("@atproto/common");
 const getSigningKeyId = async (db, signingKey) => {
@@ -42,4 +43,43 @@ exports.retryableHttp = retryableHttp;
 const retryableHttpStatusCodes = new Set([
     408, 425, 429, 500, 502, 503, 504, 522, 524,
 ]);
+exports.LABELER_HEADER_NAME = 'atproto-accept-labelers';
+const parseLabelerHeader = (header, ignoreDid) => {
+    if (!header)
+        return null;
+    const labelerDids = new Set();
+    const redactDids = new Set();
+    const parsed = (0, structured_headers_1.parseList)(header);
+    for (const item of parsed) {
+        const did = item[0].toString();
+        if (!did) {
+            return null;
+        }
+        if (did === ignoreDid) {
+            continue;
+        }
+        labelerDids.add(did);
+        const redact = item[1].get('redact')?.valueOf();
+        if (redact === true) {
+            redactDids.add(did);
+        }
+    }
+    return {
+        dids: [...labelerDids],
+        redact: redactDids,
+    };
+};
+exports.parseLabelerHeader = parseLabelerHeader;
+const defaultLabelerHeader = (dids) => {
+    return {
+        dids,
+        redact: new Set(dids),
+    };
+};
+exports.defaultLabelerHeader = defaultLabelerHeader;
+const formatLabelerHeader = (parsed) => {
+    const parts = parsed.dids.map((did) => parsed.redact.has(did) ? `${did};redact` : did);
+    return parts.join(',');
+};
+exports.formatLabelerHeader = formatLabelerHeader;
 //# sourceMappingURL=util.js.map

package/dist/util.js.map

@@ -1 +1 @@
-{"version":3,"file":"util.js","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":";;;AAAA,iCAAkC;AAClC,wCAAuD;AACvD,4CAAqD;AAG9C,MAAM,eAAe,GAAG,KAAK,EAClC,EAAY,EACZ,UAAkB,EACD,EAAE;IACnB,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,EAAE;SAC1B,UAAU,CAAC,aAAa,CAAC;SACzB,SAAS,EAAE;SACX,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,CAAC;SAC7B,gBAAgB,EAAE,CAAA;IACrB,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,SAAS,CAAC,EAAE,CAAA;IACrB,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,EAAE;SAC1B,UAAU,CAAC,aAAa,CAAC;SACzB,MAAM,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;SAC3B,YAAY,EAAE;SACd,uBAAuB,EAAE,CAAA;IAC5B,OAAO,SAAS,CAAC,EAAE,CAAA;AACrB,CAAC,CAAA;AAlBY,QAAA,eAAe,mBAkB3B;AAEM,KAAK,UAAU,SAAS,CAC7B,EAAoB,EACpB,OAAqB,EAAE;IAEvB,OAAO,IAAA,cAAK,EAAC,EAAE,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,IAAI,EAAE,CAAC,CAAA;AACzD,CAAC;AALD,8BAKC;AAED,SAAgB,aAAa,CAAC,GAAY;IACxC,IAAI,GAAG,YAAY,gBAAS,EAAE,CAAC;QAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,mBAAY,CAAC,OAAO;YAAE,OAAO,IAAI,CAAA;QACpD,OAAO,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACjD,CAAC;IACD,IAAI,GAAG,YAAY,kBAAU,EAAE,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAA;QAC9B,OAAO,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC1D,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAVD,sCAUC;AAED,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;CAC5C,CAAC,CAAA"}
+{"version":3,"file":"util.js","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":";;;AAAA,iCAAkC;AAClC,2DAA8C;AAC9C,wCAAuD;AACvD,4CAAqD;AAG9C,MAAM,eAAe,GAAG,KAAK,EAClC,EAAY,EACZ,UAAkB,EACD,EAAE;IACnB,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,EAAE;SAC1B,UAAU,CAAC,aAAa,CAAC;SACzB,SAAS,EAAE;SACX,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,CAAC;SAC7B,gBAAgB,EAAE,CAAA;IACrB,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,SAAS,CAAC,EAAE,CAAA;IACrB,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,EAAE;SAC1B,UAAU,CAAC,aAAa,CAAC;SACzB,MAAM,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;SAC3B,YAAY,EAAE;SACd,uBAAuB,EAAE,CAAA;IAC5B,OAAO,SAAS,CAAC,EAAE,CAAA;AACrB,CAAC,CAAA;AAlBY,QAAA,eAAe,mBAkB3B;AAEM,KAAK,UAAU,SAAS,CAC7B,EAAoB,EACpB,OAAqB,EAAE;IAEvB,OAAO,IAAA,cAAK,EAAC,EAAE,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,IAAI,EAAE,CAAC,CAAA;AACzD,CAAC;AALD,8BAKC;AAED,SAAgB,aAAa,CAAC,GAAY;IACxC,IAAI,GAAG,YAAY,gBAAS,EAAE,CAAC;QAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,mBAAY,CAAC,OAAO;YAAE,OAAO,IAAI,CAAA;QACpD,OAAO,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACjD,CAAC;IACD,IAAI,GAAG,YAAY,kBAAU,EAAE,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAA;QAC9B,OAAO,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC1D,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAVD,sCAUC;AAED,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;CAC5C,CAAC,CAAA;AAOW,QAAA,mBAAmB,GAAG,yBAAyB,CAAA;AAErD,MAAM,kBAAkB,GAAG,CAChC,MAA0B,EAC1B,SAAkB,EACK,EAAE;IACzB,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAA;IACrC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAA;IACpC,MAAM,MAAM,GAAG,IAAA,8BAAS,EAAC,MAAM,CAAC,CAAA;IAChC,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;QAC9B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,SAAQ;QACV,CAAC;QACD,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAA;QAC/C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACrB,CAAC;IACH,CAAC;IACD,OAAO;QACL,IAAI,EAAE,CAAC,GAAG,WAAW,CAAC;QACtB,MAAM,EAAE,UAAU;KACnB,CAAA;AACH,CAAC,CAAA;AA1BY,QAAA,kBAAkB,sBA0B9B;AAEM,MAAM,oBAAoB,GAAG,CAAC,IAAc,EAAkB,EAAE;IACrE,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC;KACtB,CAAA;AACH,CAAC,CAAA;AALY,QAAA,oBAAoB,wBAKhC;AAEM,MAAM,mBAAmB,GAAG,CAAC,MAAsB,EAAU,EAAE;IACpE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CACpC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,CAC/C,CAAA;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACxB,CAAC,CAAA;AALY,QAAA,mBAAmB,uBAK/B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atproto/ozone",
-  "version": "0.1.15",
+  "version": "0.1.16",
   "license": "MIT",
   "description": "Backend service for moderating the Bluesky network.",
   "keywords": [
@@ -29,9 +29,10 @@
     "p-queue": "^6.6.2",
     "pg": "^8.10.0",
     "pino-http": "^8.2.1",
+    "structured-headers": "^1.0.1",
     "typed-emitter": "^2.1.0",
     "uint8arrays": "3.0.0",
-    "@atproto/api": "^0.12.11",
+    "@atproto/api": "^0.12.12",
     "@atproto/common": "^0.4.0",
     "@atproto/crypto": "^0.4.0",
     "@atproto/identity": "^0.4.0",
@@ -51,7 +52,7 @@
     "jest": "^28.1.2",
     "ts-node": "^10.8.2",
     "@atproto/lex-cli": "^0.4.0",
-    "@atproto/pds": "^0.4.23"
+    "@atproto/pds": "^0.4.24"
   },
   "scripts": {
     "codegen": "lex gen-server ./src/lexicon ../../lexicons/com/atproto/*/* ../../lexicons/app/bsky/*/* ../../lexicons/chat/bsky/*/* ../../lexicons/tools/ozone/*/*",

package/src/api/moderation/getRecord.ts

@@ -7,11 +7,12 @@ import { AtUri } from '@atproto/syntax'
 export default function (server: Server, ctx: AppContext) {
   server.tools.ozone.moderation.getRecord({
     auth: ctx.authVerifier.modOrAdminToken,
-    handler: async ({ params, auth }) => {
+    handler: async ({ params, auth, req }) => {
       const db = ctx.db
+      const labelers = ctx.reqLabelers(req)
 
       const [record, accountInfo] = await Promise.all([
-        ctx.modService(db).views.recordDetail(params),
+        ctx.modService(db).views.recordDetail(params, labelers),
         getPdsAccountInfo(ctx, new AtUri(params.uri).hostname),
       ])
 

package/src/api/moderation/getRepo.ts

@@ -6,11 +6,12 @@ import { addAccountInfoToRepoViewDetail, getPdsAccountInfo } from '../util'
 export default function (server: Server, ctx: AppContext) {
   server.tools.ozone.moderation.getRepo({
     auth: ctx.authVerifier.modOrAdminToken,
-    handler: async ({ params, auth }) => {
+    handler: async ({ params, auth, req }) => {
       const { did } = params
       const db = ctx.db
+      const labelers = ctx.reqLabelers(req)
       const [partialRepo, accountInfo] = await Promise.all([
-        ctx.modService(db).views.repoDetail(did),
+        ctx.modService(db).views.repoDetail(did, labelers),
         getPdsAccountInfo(ctx, did),
       ])
       if (!partialRepo) {

package/src/api/proxied.ts

@@ -127,4 +127,18 @@ export default function (server: Server, ctx: AppContext) {
       }
     },
   })
+
+  server.app.bsky.graph.getLists({
+    auth: ctx.authVerifier.moderator,
+    handler: async (request) => {
+      const res = await ctx.appviewAgent.api.app.bsky.graph.getLists(
+        request.params,
+        await ctx.appviewAuth(),
+      )
+      return {
+        encoding: 'application/json',
+        body: res.data,
+      }
+    },
+  })
 }

package/src/context.ts

@@ -1,3 +1,4 @@
+import express from 'express'
 import * as plc from '@did-plc/lib'
 import { IdResolver } from '@atproto/identity'
 import { AtpAgent } from '@atproto/api'
@@ -17,7 +18,13 @@ import {
 import { BlobDiverter } from './daemon/blob-diverter'
 import { AuthVerifier } from './auth-verifier'
 import { ImageInvalidator } from './image-invalidator'
-import { getSigningKeyId } from './util'
+import {
+  defaultLabelerHeader,
+  getSigningKeyId,
+  LABELER_HEADER_NAME,
+  ParsedLabelers,
+  parseLabelerHeader,
+} from './util'
 
 export type AppContextOptions = {
   db: Database
@@ -234,5 +241,17 @@ export class AppContext {
       ...overrides,
     }
   }
+
+  reqLabelers(req: express.Request): ParsedLabelers {
+    const val = req.header(LABELER_HEADER_NAME)
+    let parsed: ParsedLabelers | null
+    try {
+      parsed = parseLabelerHeader(val, this.cfg.service.did)
+    } catch (err) {
+      parsed = null
+    }
+    if (!parsed) return defaultLabelerHeader([])
+    return parsed
+  }
 }
 export default AppContext

package/src/mod-service/index.ts

@@ -48,6 +48,7 @@ import { formatLabel, formatLabelRow, signLabel } from './util'
 import { ImageInvalidator } from '../image-invalidator'
 import { httpLogger as log } from '../logger'
 import { OzoneConfig } from '../config'
+import { LABELER_HEADER_NAME, ParsedLabelers } from '../util'
 
 export type ModerationServiceCreator = (db: Database) => ModerationService
 
@@ -96,7 +97,13 @@ export class ModerationService {
     this.signingKey,
     this.signingKeyId,
     this.appviewAgent,
-    () => this.createAuthHeaders(this.cfg.appview.did),
+    async (labelers?: ParsedLabelers) => {
+      const authHeaders = await this.createAuthHeaders(this.cfg.appview.did)
+      if (labelers?.dids?.length) {
+        authHeaders.headers[LABELER_HEADER_NAME] = labelers.dids.join(', ')
+      }
+      return authHeaders
+    },
   )
 
   async getEvent(id: number): Promise<ModerationEventRow | undefined> {

package/src/mod-service/views.ts

@@ -28,10 +28,12 @@ import { formatLabel, signLabel } from './util'
 import { LabelRow } from '../db/schema/label'
 import { dbLogger } from '../logger'
 import { httpLogger } from '../logger'
+import { ParsedLabelers } from '../util'
 
 export type AuthHeaders = {
   headers: {
     authorization: string
+    'atproto-accept-labelers'?: string
   }
 }
 
@@ -210,10 +212,14 @@ export class ModerationViews {
     }
   }
 
-  async repoDetail(did: string): Promise<RepoViewDetail | undefined> {
-    const [repos, labels] = await Promise.all([
+  async repoDetail(
+    did: string,
+    labelers?: ParsedLabelers,
+  ): Promise<RepoViewDetail | undefined> {
+    const [repos, localLabels, externalLabels] = await Promise.all([
       this.repos([did]),
       this.labels(did),
+      this.getExternalLabels([did], labelers),
     ])
     const repo = repos.get(did)
     if (!repo) return
@@ -223,7 +229,7 @@ export class ModerationViews {
       moderation: {
         ...repo.moderation,
       },
-      labels,
+      labels: [...localLabels, ...externalLabels],
     }
   }
 
@@ -293,6 +299,7 @@ export class ModerationViews {
 
   async recordDetail(
     subject: RecordSubject,
+    labelers?: ParsedLabelers,
   ): Promise<RecordViewDetail | undefined> {
     const [records, subjectStatusesResult] = await Promise.all([
       this.records([subject]),
@@ -303,9 +310,10 @@ export class ModerationViews {
 
     const status = subjectStatusesResult.get(subject.uri)
 
-    const [blobs, labels, subjectStatus] = await Promise.all([
+    const [blobs, labels, externalLabels, subjectStatus] = await Promise.all([
       this.blob(findBlobRefs(record.value)),
       this.labels(record.uri),
+      this.getExternalLabels([record.uri], labelers),
       status ? this.formatSubjectStatus(status) : Promise.resolve(undefined),
     ])
     const selfLabels = getSelfLabels({
@@ -313,6 +321,7 @@ export class ModerationViews {
       cid: record.cid,
       record: record.value,
     })
+
     return {
       ...record,
       blobs,
@@ -320,10 +329,26 @@ export class ModerationViews {
         ...record.moderation,
         subjectStatus,
       },
-      labels: [...labels, ...selfLabels],
+      labels: [...labels, ...selfLabels, ...externalLabels],
     }
   }
 
+  async getExternalLabels(
+    subjects: string[],
+    labelers?: ParsedLabelers,
+  ): Promise<Label[]> {
+    if (!labelers?.dids.length && !labelers?.redact.size) return []
+
+    const {
+      data: { labels },
+    } = await this.appviewAgent.api.com.atproto.label.queryLabels({
+      uriPatterns: subjects,
+      sources: labelers.dids,
+    })
+
+    return labels
+  }
+
   formatReport(report: ModerationEventRowWithHandle): ReportOutput {
     return {
       id: report.id,

package/src/util.ts

@@ -1,4 +1,5 @@
 import { AxiosError } from 'axios'
+import { parseList } from 'structured-headers'
 import { XRPCError, ResponseType } from '@atproto/xrpc'
 import { RetryOptions, retry } from '@atproto/common'
 import Database from './db'
@@ -45,3 +46,52 @@ export function retryableHttp(err: unknown) {
 const retryableHttpStatusCodes = new Set([
   408, 425, 429, 500, 502, 503, 504, 522, 524,
 ])
+
+export type ParsedLabelers = {
+  dids: string[]
+  redact: Set<string>
+}
+
+export const LABELER_HEADER_NAME = 'atproto-accept-labelers'
+
+export const parseLabelerHeader = (
+  header: string | undefined,
+  ignoreDid?: string,
+): ParsedLabelers | null => {
+  if (!header) return null
+  const labelerDids = new Set<string>()
+  const redactDids = new Set<string>()
+  const parsed = parseList(header)
+  for (const item of parsed) {
+    const did = item[0].toString()
+    if (!did) {
+      return null
+    }
+    if (did === ignoreDid) {
+      continue
+    }
+    labelerDids.add(did)
+    const redact = item[1].get('redact')?.valueOf()
+    if (redact === true) {
+      redactDids.add(did)
+    }
+  }
+  return {
+    dids: [...labelerDids],
+    redact: redactDids,
+  }
+}
+
+export const defaultLabelerHeader = (dids: string[]): ParsedLabelers => {
+  return {
+    dids,
+    redact: new Set(dids),
+  }
+}
+
+export const formatLabelerHeader = (parsed: ParsedLabelers): string => {
+  const parts = parsed.dids.map((did) =>
+    parsed.redact.has(did) ? `${did};redact` : did,
+  )
+  return parts.join(',')
+}

package/tests/3p-labeler.test.ts

@@ -0,0 +1,271 @@
+import {
+  SeedClient,
+  TestNetwork,
+  basicSeed,
+  TestOzone,
+  ModeratorClient,
+  createOzoneDid,
+} from '@atproto/dev-env'
+import AtpAgent from '@atproto/api'
+import { Secp256k1Keypair } from '@atproto/crypto'
+import { LABELER_HEADER_NAME } from '../src/util'
+
+describe('labels from 3p labelers', () => {
+  let network: TestNetwork
+  let ozone: TestOzone
+  let thirdPartyLabeler: TestOzone
+  let agent: AtpAgent
+  let thirdPartyAgent: AtpAgent
+  let sc: SeedClient
+  let modClient: ModeratorClient
+  let thirdPartyModClient: ModeratorClient
+
+  beforeAll(async () => {
+    network = await TestNetwork.create({
+      dbPostgresSchema: 'ozone_admin_third_party_labeler',
+    })
+    ozone = network.ozone
+
+    const ozoneKey = await Secp256k1Keypair.create({ exportable: true })
+    const ozoneDid = await createOzoneDid(network.plc.url, ozoneKey)
+    thirdPartyLabeler = await TestOzone.create({
+      port: ozone.port + 10,
+      plcUrl: network.plc.url,
+      signingKey: ozoneKey,
+      serverDid: ozoneDid,
+      dbPostgresSchema: `ozone_admin_third_party_labeler`,
+      dbPostgresUrl: ozone.ctx.cfg.db.postgresUrl,
+      appviewUrl: network.bsky.url,
+      appviewDid: network.bsky.ctx.cfg.serverDid,
+      appviewPushEvents: true,
+      pdsUrl: network.pds.url,
+      pdsDid: network.pds.ctx.cfg.service.did,
+    })
+
+    thirdPartyAgent = thirdPartyLabeler.getClient()
+    agent = ozone.getClient()
+    sc = network.getSeedClient()
+    modClient = ozone.getModClient()
+    thirdPartyModClient = thirdPartyLabeler.getModClient()
+    await basicSeed(sc)
+    await network.processAll()
+  })
+
+  afterAll(async () => {
+    await network.close()
+    await thirdPartyLabeler.close()
+  })
+
+  const getPostSubject = () => ({
+    $type: 'com.atproto.repo.strongRef',
+    uri: sc.posts[sc.dids.alice][0].ref.uriStr,
+    cid: sc.posts[sc.dids.alice][0].ref.cidStr,
+  })
+
+  const adjustLabels = async ({
+    uri,
+    cid,
+    src,
+    createLabelVals = [],
+    negateLabelVals = [],
+  }: {
+    uri: string
+    src: string
+    cid?: string
+    createLabelVals?: string[]
+    negateLabelVals?: string[]
+  }) => {
+    const labelEntries = createLabelVals.map((val) => ({
+      uri,
+      cid: cid || '',
+      val,
+      cts: new Date().toISOString(),
+      neg: false,
+      src,
+    }))
+
+    negateLabelVals.forEach((val) => {
+      labelEntries.push({
+        uri,
+        cid: cid || '',
+        val,
+        cts: new Date().toISOString(),
+        neg: true,
+        src,
+      })
+    })
+    await network.bsky.db.db.insertInto('label').values(labelEntries).execute()
+  }
+
+  const labelAccount = async (
+    client: ModeratorClient,
+    {
+      createLabelVals = [],
+      negateLabelVals = [],
+    }: { createLabelVals?: string[]; negateLabelVals?: string[] },
+  ) => {
+    const subject = {
+      $type: 'com.atproto.admin.defs#repoRef',
+      did: sc.dids.alice,
+    }
+    await client.emitEvent(
+      {
+        subject,
+        event: {
+          $type: 'tools.ozone.moderation.defs#modEventLabel',
+          createLabelVals,
+          negateLabelVals,
+        },
+        createdBy: sc.dids.carol,
+      },
+      'moderator',
+    )
+    await adjustLabels({
+      createLabelVals,
+      negateLabelVals,
+      uri: sc.dids.alice,
+      src: client.ozone.ctx.cfg.service.did,
+    })
+  }
+
+  const labelPost = async (
+    client: ModeratorClient,
+    {
+      createLabelVals = [],
+      negateLabelVals = [],
+    }: { createLabelVals?: string[]; negateLabelVals?: string[] },
+  ) => {
+    const subject = getPostSubject()
+    await client.emitEvent(
+      {
+        subject,
+        event: {
+          $type: 'tools.ozone.moderation.defs#modEventLabel',
+          createLabelVals,
+          negateLabelVals,
+        },
+        createdBy: sc.dids.carol,
+      },
+      'moderator',
+    )
+    await adjustLabels({
+      createLabelVals,
+      negateLabelVals,
+      uri: subject.uri,
+      cid: subject.cid,
+      src: client.ozone.ctx.cfg.service.did,
+    })
+  }
+
+  describe('record labels', () => {
+    it('includes only labels from current authority by default', async () => {
+      await Promise.all([
+        labelPost(modClient, { createLabelVals: ['spam'] }),
+        labelPost(thirdPartyModClient, { createLabelVals: ['weird'] }),
+      ])
+
+      const [
+        { data: recordFromCurrentAuthority },
+        { data: recordFromThirdParty },
+      ] = await Promise.all([
+        agent.api.tools.ozone.moderation.getRecord(
+          { uri: sc.posts[sc.dids.alice][0].ref.uriStr },
+          { headers: await ozone.modHeaders() },
+        ),
+        thirdPartyAgent.api.tools.ozone.moderation.getRecord(
+          { uri: sc.posts[sc.dids.alice][0].ref.uriStr },
+          { headers: await thirdPartyLabeler.modHeaders() },
+        ),
+      ])
+
+      const currentAuthorityLabels = recordFromCurrentAuthority.labels?.map(
+        (l) => l.val,
+      )
+      const thirdPartyLabels = recordFromThirdParty.labels?.map((l) => l.val)
+      expect(currentAuthorityLabels).toContain('spam')
+      expect(currentAuthorityLabels).not.toContain('weird')
+      expect(thirdPartyLabels).toContain('weird')
+      expect(thirdPartyLabels).not.toContain('spam')
+    })
+
+    it('includes labels from all authorities requested via header', async () => {
+      const authHeaders = await ozone.modHeaders()
+      const { data: recordIncludingExternalLabels } =
+        await agent.api.tools.ozone.moderation.getRecord(
+          { uri: sc.posts[sc.dids.alice][0].ref.uriStr },
+          {
+            headers: {
+              ...authHeaders,
+              [LABELER_HEADER_NAME]: [
+                thirdPartyLabeler.ctx.cfg.service.did,
+                ozone.ctx.cfg.service.did,
+              ].join(','),
+            },
+          },
+        )
+      const labelVals = recordIncludingExternalLabels.labels?.map((l) => l.val)
+      const labelSources = recordIncludingExternalLabels.labels?.map(
+        (l) => l.src,
+      )
+      expect(labelVals).toContain('weird')
+      expect(labelVals).toContain('spam')
+      expect(labelSources).toContain(thirdPartyLabeler.ctx.cfg.service.did)
+      expect(labelSources).toContain(ozone.ctx.cfg.service.did)
+    })
+  })
+
+  describe('repo labels', () => {
+    it('includes only labels from current authority by default', async () => {
+      await Promise.all([
+        labelAccount(modClient, { createLabelVals: ['spam'] }),
+        labelAccount(thirdPartyModClient, { createLabelVals: ['weird'] }),
+      ])
+
+      const [{ data: repoFromCurrentAuthority }, { data: repoFromThirdParty }] =
+        await Promise.all([
+          agent.api.tools.ozone.moderation.getRepo(
+            { did: sc.dids.alice },
+            { headers: await ozone.modHeaders() },
+          ),
+          thirdPartyAgent.api.tools.ozone.moderation.getRepo(
+            { did: sc.dids.alice },
+            { headers: await thirdPartyLabeler.modHeaders() },
+          ),
+        ])
+
+      const currentAuthorityLabels = repoFromCurrentAuthority.labels?.map(
+        (l) => l.val,
+      )
+      const thirdPartyLabels = repoFromThirdParty.labels?.map((l) => l.val)
+      expect(currentAuthorityLabels).toContain('spam')
+      expect(currentAuthorityLabels).not.toContain('weird')
+      expect(thirdPartyLabels).toContain('weird')
+      expect(thirdPartyLabels).not.toContain('spam')
+    })
+
+    it('includes labels from all authorities requested via header', async () => {
+      const authHeaders = await ozone.modHeaders()
+      const { data: recordIncludingExternalLabels } =
+        await agent.api.tools.ozone.moderation.getRepo(
+          { did: sc.dids.alice },
+          {
+            headers: {
+              ...authHeaders,
+              [LABELER_HEADER_NAME]: [
+                thirdPartyLabeler.ctx.cfg.service.did,
+                ozone.ctx.cfg.service.did,
+              ].join(','),
+            },
+          },
+        )
+      const labelVals = recordIncludingExternalLabels.labels?.map((l) => l.val)
+      const labelSources = recordIncludingExternalLabels.labels?.map(
+        (l) => l.src,
+      )
+      expect(labelVals).toContain('weird')
+      expect(labelVals).toContain('spam')
+      expect(labelSources).toContain(thirdPartyLabeler.ctx.cfg.service.did)
+      expect(labelSources).toContain(ozone.ctx.cfg.service.did)
+    })
+  })
+})