@atproto/ozone 0.1.150 → 0.1.151

package/tests/__snapshots__/account-strikes.test.ts.snap

@@ -0,0 +1,159 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`account-strikes tracks strikes and exposes them through queryStatuses and queryEvents 1`] = `
+Object {
+  "accountStats": Object {
+    "$type": "tools.ozone.moderation.defs#accountStats",
+  },
+  "accountStrike": Object {
+    "$type": "tools.ozone.moderation.defs#accountStrike",
+    "activeStrikeCount": 5,
+    "firstStrikeAt": "1970-01-01T00:00:00.000Z",
+    "lastStrikeAt": "1970-01-01T00:00:00.000Z",
+    "totalStrikeCount": 5,
+  },
+  "ageAssuranceState": "unknown",
+  "createdAt": "1970-01-01T00:00:00.000Z",
+  "hosting": Object {
+    "$type": "tools.ozone.moderation.defs#accountHosting",
+    "status": "unknown",
+  },
+  "id": 9,
+  "lastReviewedAt": "1970-01-01T00:00:00.000Z",
+  "lastReviewedBy": "user(0)",
+  "priorityScore": 0,
+  "recordsStats": Object {
+    "$type": "tools.ozone.moderation.defs#recordsStats",
+  },
+  "reviewState": "tools.ozone.moderation.defs#reviewClosed",
+  "subject": Object {
+    "$type": "com.atproto.admin.defs#repoRef",
+    "did": "user(1)",
+  },
+  "subjectBlobCids": Array [],
+  "subjectRepoHandle": "alice.test",
+  "tags": Array [
+    "lang:und",
+  ],
+  "takendown": true,
+  "updatedAt": "1970-01-01T00:00:00.000Z",
+}
+`;
+
+exports[`account-strikes tracks strikes and exposes them through queryStatuses and queryEvents 2`] = `
+Array [
+  Object {
+    "createdAt": "1970-01-01T00:00:00.000Z",
+    "createdBy": "user(0)",
+    "event": Object {
+      "$type": "tools.ozone.moderation.defs#modEventReverseTakedown",
+      "comment": "Appeal granted - reversing first takedown",
+      "severityLevel": "sev-2",
+      "strikeCount": -2,
+    },
+    "id": 11,
+    "subject": Object {
+      "$type": "com.atproto.repo.strongRef",
+      "cid": "cids(0)",
+      "uri": "record(0)",
+    },
+    "subjectBlobCids": Array [],
+    "subjectHandle": "alice.test",
+  },
+  Object {
+    "createdAt": "1970-01-01T00:00:00.000Z",
+    "createdBy": "user(0)",
+    "event": Object {
+      "$type": "tools.ozone.moderation.defs#modEventTakedown",
+      "comment": "Warning only",
+      "severityLevel": "sev-0",
+      "strikeCount": 0,
+    },
+    "id": 9,
+    "subject": Object {
+      "$type": "com.atproto.admin.defs#repoRef",
+      "did": "user(1)",
+    },
+    "subjectBlobCids": Array [],
+    "subjectHandle": "alice.test",
+  },
+  Object {
+    "createdAt": "1970-01-01T00:00:00.000Z",
+    "createdBy": "user(0)",
+    "event": Object {
+      "$type": "tools.ozone.moderation.defs#modEventTakedown",
+      "comment": "Second sev-1 violation",
+      "policies": Array [
+        "spam-policy",
+      ],
+      "severityLevel": "sev-1",
+      "strikeCount": 1,
+    },
+    "id": 7,
+    "subject": Object {
+      "$type": "com.atproto.repo.strongRef",
+      "cid": "cids(1)",
+      "uri": "record(1)",
+    },
+    "subjectBlobCids": Array [],
+    "subjectHandle": "alice.test",
+  },
+  Object {
+    "createdAt": "1970-01-01T00:00:00.000Z",
+    "createdBy": "user(0)",
+    "event": Object {
+      "$type": "tools.ozone.moderation.defs#modEventTakedown",
+      "comment": "First sev-1 violation",
+      "policies": Array [
+        "spam-policy",
+      ],
+      "severityLevel": "sev-1",
+      "strikeCount": 0,
+    },
+    "id": 5,
+    "subject": Object {
+      "$type": "com.atproto.repo.strongRef",
+      "cid": "cids(2)",
+      "uri": "record(2)",
+    },
+    "subjectBlobCids": Array [],
+    "subjectHandle": "alice.test",
+  },
+  Object {
+    "createdAt": "1970-01-01T00:00:00.000Z",
+    "createdBy": "user(0)",
+    "event": Object {
+      "$type": "tools.ozone.moderation.defs#modEventTakedown",
+      "comment": "Second violation",
+      "severityLevel": "sev-2",
+      "strikeCount": 2,
+    },
+    "id": 3,
+    "subject": Object {
+      "$type": "com.atproto.repo.strongRef",
+      "cid": "cids(3)",
+      "uri": "record(3)",
+    },
+    "subjectBlobCids": Array [],
+    "subjectHandle": "alice.test",
+  },
+  Object {
+    "createdAt": "1970-01-01T00:00:00.000Z",
+    "createdBy": "user(0)",
+    "event": Object {
+      "$type": "tools.ozone.moderation.defs#modEventTakedown",
+      "comment": "First violation",
+      "severityLevel": "sev-2",
+      "strikeCount": 2,
+    },
+    "id": 1,
+    "subject": Object {
+      "$type": "com.atproto.repo.strongRef",
+      "cid": "cids(0)",
+      "uri": "record(0)",
+    },
+    "subjectBlobCids": Array [],
+    "subjectHandle": "alice.test",
+  },
+]
+`;

package/tests/account-strikes.test.ts

@@ -0,0 +1,184 @@
+import AtpAgent from '@atproto/api'
+import {
+  ModeratorClient,
+  SeedClient,
+  TestNetwork,
+  basicSeed,
+} from '@atproto/dev-env'
+import { ids } from '../src/lexicon/lexicons'
+import { SeverityLevelSettingKey } from '../src/setting/constants'
+import { forSnapshot } from './_util'
+
+const strikeConfig = {
+  'sev-0': { strikeCount: 0 },
+  'sev-1': {
+    strikeCount: 1,
+    strikeOnOccurrence: 2,
+    expiresInDays: 365,
+  },
+  'sev-2': { strikeCount: 2, expiresInDays: 365 },
+  'sev-4': { strikeCount: 4, expiresInDays: 0 },
+  'sev-5': { needsTakedown: true },
+}
+
+describe('account-strikes', () => {
+  let network: TestNetwork
+  let agent: AtpAgent
+  let sc: SeedClient
+  let modClient: ModeratorClient
+
+  const repoSubject = (did: string) => ({
+    $type: 'com.atproto.admin.defs#repoRef',
+    did,
+  })
+
+  const configureSeverityLevels = async () => {
+    // Configure severity level settings
+    await agent.tools.ozone.setting.upsertOption(
+      {
+        scope: 'instance',
+        key: SeverityLevelSettingKey,
+        value: strikeConfig,
+        description: 'Severity level configuration for strike system',
+        managerRole: 'tools.ozone.team.defs#roleAdmin',
+      },
+      {
+        encoding: 'application/json',
+        headers: await network.ozone.modHeaders(
+          ids.ToolsOzoneSettingUpsertOption,
+          'admin',
+        ),
+      },
+    )
+  }
+
+  beforeAll(async () => {
+    network = await TestNetwork.create({
+      dbPostgresSchema: 'ozone_account_strikes',
+    })
+    agent = network.ozone.getClient()
+    sc = network.getSeedClient()
+    modClient = network.ozone.getModClient()
+    await basicSeed(sc)
+    await network.processAll()
+    await configureSeverityLevels()
+  })
+
+  afterAll(async () => {
+    await network.close()
+  })
+
+  it('tracks strikes and exposes them through queryStatuses and queryEvents', async () => {
+    const aliceSubject = repoSubject(sc.dids.alice)
+    const alicePost = {
+      $type: 'com.atproto.repo.strongRef',
+      uri: sc.posts[sc.dids.alice][0].ref.uriStr,
+      cid: sc.posts[sc.dids.alice][0].ref.cidStr,
+    }
+
+    await modClient.emitEvent({
+      event: {
+        $type: 'tools.ozone.moderation.defs#modEventTakedown',
+        severityLevel: 'sev-2',
+        strikeCount: strikeConfig['sev-2'].strikeCount,
+        comment: 'First violation',
+      },
+      subject: alicePost,
+    })
+
+    const alicePost2 = {
+      $type: 'com.atproto.repo.strongRef',
+      uri: sc.posts[sc.dids.alice][1].ref.uriStr,
+      cid: sc.posts[sc.dids.alice][1].ref.cidStr,
+    }
+    await modClient.emitEvent({
+      event: {
+        $type: 'tools.ozone.moderation.defs#modEventTakedown',
+        severityLevel: 'sev-2',
+        strikeCount: strikeConfig['sev-2'].strikeCount,
+        comment: 'Second violation',
+      },
+      subject: alicePost2,
+    })
+
+    const alicePost3 = {
+      $type: 'com.atproto.repo.strongRef',
+      uri: sc.posts[sc.dids.alice][2].ref.uriStr,
+      cid: sc.posts[sc.dids.alice][2].ref.cidStr,
+    }
+    await modClient.emitEvent({
+      event: {
+        $type: 'tools.ozone.moderation.defs#modEventTakedown',
+        severityLevel: 'sev-1',
+        strikeCount: 0, // First occurrence - warning
+        policies: ['spam-policy'],
+        comment: 'First sev-1 violation',
+      },
+      subject: alicePost3,
+    })
+
+    // Issue second sev-1 takedown with same policy on another post (second occurrence, should be 1 strike, total 5)
+    const aliceReply = {
+      $type: 'com.atproto.repo.strongRef',
+      uri: sc.replies[sc.dids.alice][0].ref.uriStr,
+      cid: sc.replies[sc.dids.alice][0].ref.cidStr,
+    }
+    await modClient.emitEvent({
+      event: {
+        $type: 'tools.ozone.moderation.defs#modEventTakedown',
+        severityLevel: 'sev-1',
+        strikeCount: strikeConfig['sev-1'].strikeCount, // Second occurrence - actual strike
+        policies: ['spam-policy'],
+        comment: 'Second sev-1 violation',
+      },
+      subject: aliceReply,
+    })
+
+    await modClient.emitEvent({
+      event: {
+        $type: 'tools.ozone.moderation.defs#modEventTakedown',
+        severityLevel: 'sev-0',
+        strikeCount: strikeConfig['sev-0'].strikeCount,
+        comment: 'Warning only',
+      },
+      subject: aliceSubject,
+    })
+
+    let statusResult = await modClient.queryStatuses({
+      subject: sc.dids.alice,
+    })
+
+    expect(statusResult.subjectStatuses.length).toBeGreaterThan(0)
+    expect(forSnapshot(statusResult.subjectStatuses[0])).toMatchSnapshot()
+    const strikeCountBefore =
+      statusResult.subjectStatuses[0].accountStrike?.activeStrikeCount
+
+    // Reverse one of the takedowns with negative strikeCount
+    await modClient.emitEvent({
+      event: {
+        $type: 'tools.ozone.moderation.defs#modEventReverseTakedown',
+        severityLevel: 'sev-2',
+        strikeCount: -2, // Negative to reverse strikes
+        comment: 'Appeal granted - reversing first takedown',
+      },
+      subject: alicePost,
+    })
+
+    // Verify strikes were reduced (if strikeCount tracking is implemented)
+    statusResult = await modClient.queryStatuses({
+      subject: sc.dids.alice,
+    })
+    const strikeCountAfter =
+      statusResult.subjectStatuses[0].accountStrike?.activeStrikeCount
+    expect(strikeCountAfter).toBe(3)
+    expect(strikeCountAfter).toBeLessThan(strikeCountBefore!)
+
+    const eventsWithStrikes = await modClient.queryEvents({
+      subject: sc.dids.alice,
+      includeAllUserRecords: true,
+      withStrike: true,
+    })
+
+    expect(forSnapshot(eventsWithStrikes.events)).toMatchSnapshot()
+  })
+})

package/tests/query-labels.test.ts

@@ -163,6 +163,7 @@ describe('ozone query labels', () => {
         modSrvc.eventPusher,
         modSrvc.appviewAgent,
         ctx.serviceAuthHeaders,
+        ctx.strikeService,
       ),
     })
 

package/tests/strike-expiry-processor.test.ts

@@ -0,0 +1,299 @@
+import AtpAgent from '@atproto/api'
+import { SECOND } from '@atproto/common'
+import {
+  ModeratorClient,
+  SeedClient,
+  TestNetwork,
+  basicSeed,
+} from '@atproto/dev-env'
+import { ids } from '../src/lexicon/lexicons'
+import { SeverityLevelSettingKey } from '../src/setting/constants'
+
+const strikeConfig = {
+  'sev-1': {
+    strikeCount: 1,
+    expiresInDays: 0, // Set to 0 so we can use future timestamps
+  },
+  'sev-2': {
+    strikeCount: 2,
+    expiresInDays: 0,
+  },
+}
+
+describe('strike expiry processor', () => {
+  let network: TestNetwork
+  let agent: AtpAgent
+  let sc: SeedClient
+  let modClient: ModeratorClient
+
+  const repoSubject = (did: string) => ({
+    $type: 'com.atproto.admin.defs#repoRef',
+    did,
+  })
+
+  const configureSeverityLevels = async () => {
+    await agent.tools.ozone.setting.upsertOption(
+      {
+        scope: 'instance',
+        key: SeverityLevelSettingKey,
+        value: strikeConfig,
+        description: 'Severity level configuration for strike system',
+        managerRole: 'tools.ozone.team.defs#roleAdmin',
+      },
+      {
+        encoding: 'application/json',
+        headers: await network.ozone.modHeaders(
+          ids.ToolsOzoneSettingUpsertOption,
+          'admin',
+        ),
+      },
+    )
+  }
+
+  const getAccountStatus = async (did: string) => {
+    const { subjectStatuses } = await modClient.queryStatuses({ subject: did })
+    return subjectStatuses[0]
+  }
+
+  beforeAll(async () => {
+    network = await TestNetwork.create({
+      dbPostgresSchema: 'ozone_strike_expiry_processor',
+    })
+    agent = network.ozone.getClient()
+    sc = network.getSeedClient()
+    modClient = network.ozone.getModClient()
+    await basicSeed(sc)
+    await network.processAll()
+    await configureSeverityLevels()
+  })
+
+  afterAll(async () => {
+    await network.close()
+  })
+
+  it('processes expired strikes and updates active strike count', async () => {
+    const bobDid = sc.dids.bob
+    const bobPost1 = {
+      $type: 'com.atproto.repo.strongRef',
+      uri: sc.posts[bobDid][0].ref.uriStr,
+      cid: sc.posts[bobDid][0].ref.cidStr,
+    }
+    const bobPost2 = {
+      $type: 'com.atproto.repo.strongRef',
+      uri: sc.posts[bobDid][1].ref.uriStr,
+      cid: sc.posts[bobDid][1].ref.cidStr,
+    }
+
+    // first strike on a post that expires in 2 seconds
+    const expiresAt1 = new Date(Date.now() + 2 * SECOND).toISOString()
+    await modClient.emitEvent({
+      event: {
+        $type: 'tools.ozone.moderation.defs#modEventTakedown',
+        severityLevel: 'sev-2',
+        strikeCount: 2,
+        strikeExpiresAt: expiresAt1,
+        comment: 'First violation - expires soon',
+      },
+      subject: bobPost1,
+    })
+
+    // second strike on another post that expires in 3 seconds
+    const expiresAt2 = new Date(Date.now() + 3 * SECOND).toISOString()
+    await modClient.emitEvent({
+      event: {
+        $type: 'tools.ozone.moderation.defs#modEventTakedown',
+        strikeCount: 1,
+        severityLevel: 'sev-1',
+        strikeExpiresAt: expiresAt2,
+        comment: 'Second violation - expires later',
+      },
+      subject: bobPost2,
+    })
+
+    // account-level event to ensure account status is created
+    await modClient.emitEvent({
+      event: {
+        $type: 'tools.ozone.moderation.defs#modEventComment',
+        comment: 'Account under review',
+      },
+      subject: repoSubject(bobDid),
+    })
+
+    // Verify initial state - both strikes are active
+    let status = await getAccountStatus(bobDid)
+    expect(status.accountStrike).toBeDefined()
+    expect(status.accountStrike!.activeStrikeCount).toBe(3) // 2 + 1
+    expect(status.accountStrike!.totalStrikeCount).toBe(3)
+
+    // Wait for first strike to expire
+    await new Promise((resolve) => setTimeout(resolve, 2.1 * SECOND))
+
+    // Run the processor
+    await network.ozone.daemon.ctx.strikeExpiryProcessor.processExpiredStrikes()
+
+    // Verify first strike expired - only second strike remains active
+    status = await getAccountStatus(bobDid)
+    expect(status.accountStrike).toBeDefined()
+    expect(status.accountStrike!.activeStrikeCount).toBe(1) // Only second strike
+    expect(status.accountStrike!.totalStrikeCount).toBe(3) // Total unchanged
+
+    // Wait for second strike to expire
+    await new Promise((resolve) => setTimeout(resolve, 1 * SECOND))
+
+    // Run the processor again
+    await network.ozone.daemon.ctx.strikeExpiryProcessor.processExpiredStrikes()
+
+    // Verify all strikes expired
+    status = await getAccountStatus(bobDid)
+    expect(status.accountStrike).toBeDefined()
+    expect(status.accountStrike!.activeStrikeCount).toBe(0)
+    expect(status.accountStrike!.totalStrikeCount).toBe(3) // Total unchanged
+  })
+
+  it('handles accounts with no expired strikes', async () => {
+    const aliceDid = sc.dids.alice
+
+    // strike that expires far in the future
+    const expiresAt = new Date(Date.now() + 1000 * SECOND).toISOString()
+    await modClient.emitEvent({
+      event: {
+        $type: 'tools.ozone.moderation.defs#modEventTakedown',
+        severityLevel: 'sev-2',
+        strikeCount: 2,
+        strikeExpiresAt: expiresAt,
+        comment: 'Future expiry',
+      },
+      subject: repoSubject(aliceDid),
+    })
+
+    // Get initial state
+    let status = await getAccountStatus(aliceDid)
+    expect(status.accountStrike).toBeDefined()
+    const initialActiveCount = status.accountStrike!.activeStrikeCount!
+    expect(initialActiveCount).toBe(2)
+
+    await network.ozone.daemon.ctx.strikeExpiryProcessor.processExpiredStrikes()
+
+    // Verify nothing changed
+    status = await getAccountStatus(aliceDid)
+    expect(status.accountStrike).toBeDefined()
+    expect(status.accountStrike!.activeStrikeCount).toBe(initialActiveCount)
+  })
+
+  it('handles strikes with no expiry date (permanent strikes)', async () => {
+    const carolDid = sc.dids.carol
+
+    // permanent strike (no expiry)
+    await modClient.emitEvent({
+      event: {
+        $type: 'tools.ozone.moderation.defs#modEventTakedown',
+        severityLevel: 'sev-2',
+        strikeCount: 2,
+        comment: 'Permanent strike - no expiry',
+      },
+      subject: repoSubject(carolDid),
+    })
+
+    // Get initial state
+    let status = await getAccountStatus(carolDid)
+    expect(status.accountStrike).toBeDefined()
+    expect(status.accountStrike!.activeStrikeCount).toBe(2)
+
+    await network.ozone.daemon.ctx.strikeExpiryProcessor.processExpiredStrikes()
+
+    // Verify permanent strikes remain active
+    status = await getAccountStatus(carolDid)
+    expect(status.accountStrike).toBeDefined()
+    expect(status.accountStrike!.activeStrikeCount).toBe(2)
+    expect(status.accountStrike!.totalStrikeCount).toBe(2)
+  })
+
+  it('processes multiple accounts with expired strikes in batch', async () => {
+    const danDid = 'did:plc:dan'
+    const eveDid = 'did:plc:eve'
+
+    const expiresAt = new Date(Date.now() + 1 * SECOND).toISOString()
+
+    // strikes to multiple accounts
+    await modClient.emitEvent({
+      event: {
+        $type: 'tools.ozone.moderation.defs#modEventTakedown',
+        severityLevel: 'sev-1',
+        strikeCount: 1,
+        strikeExpiresAt: expiresAt,
+        comment: 'Dan violation',
+      },
+      subject: repoSubject(danDid),
+    })
+
+    await modClient.emitEvent({
+      event: {
+        $type: 'tools.ozone.moderation.defs#modEventTakedown',
+        severityLevel: 'sev-2',
+        strikeCount: 2,
+        strikeExpiresAt: expiresAt,
+        comment: 'Eve violation',
+      },
+      subject: repoSubject(eveDid),
+    })
+
+    // Verify initial states
+    let danStatus = await getAccountStatus(danDid)
+    let eveStatus = await getAccountStatus(eveDid)
+    expect(danStatus.accountStrike?.activeStrikeCount).toBe(1)
+    expect(eveStatus.accountStrike?.activeStrikeCount).toBe(2)
+
+    // Wait for strikes to expire
+    await new Promise((resolve) => setTimeout(resolve, 1.1 * SECOND))
+
+    await network.ozone.daemon.ctx.strikeExpiryProcessor.processExpiredStrikes()
+
+    // Verify both accounts' strikes expired
+    danStatus = await getAccountStatus(danDid)
+    eveStatus = await getAccountStatus(eveDid)
+    expect(danStatus.accountStrike?.activeStrikeCount).toBe(0)
+    expect(eveStatus.accountStrike?.activeStrikeCount).toBe(0)
+  })
+
+  it('updates cursor to track last processed timestamp', async () => {
+    const frankDid = 'did:plc:frank'
+    const expiresAt = new Date(Date.now() + 1 * SECOND).toISOString()
+
+    await modClient.emitEvent({
+      event: {
+        $type: 'tools.ozone.moderation.defs#modEventTakedown',
+        severityLevel: 'sev-1',
+        strikeCount: 1,
+        strikeExpiresAt: expiresAt,
+        comment: 'Frank violation',
+      },
+      subject: repoSubject(frankDid),
+    })
+
+    // Wait for strike to expire
+    await new Promise((resolve) => setTimeout(resolve, 1.1 * SECOND))
+
+    // Get cursor before processing
+    const cursorBefore =
+      await network.ozone.daemon.ctx.strikeExpiryProcessor.getCursor()
+
+    await network.ozone.daemon.ctx.strikeExpiryProcessor.processExpiredStrikes()
+
+    // Get cursor after processing
+    const cursorAfter =
+      await network.ozone.daemon.ctx.strikeExpiryProcessor.getCursor()
+
+    expect(cursorAfter).not.toBe(cursorBefore)
+    expect(cursorAfter).toBeTruthy()
+
+    // Verify strike was processed
+    const status = await getAccountStatus(frankDid)
+    expect(status.accountStrike?.activeStrikeCount).toBe(0)
+
+    // running processor again should not reprocess the same strike
+    await network.ozone.daemon.ctx.strikeExpiryProcessor.processExpiredStrikes()
+    const cursorAfterSecond =
+      await network.ozone.daemon.ctx.strikeExpiryProcessor.getCursor()
+    expect(cursorAfterSecond).not.toBe(cursorAfter)
+  })
+})