@atproto/ozone 0.1.150 → 0.1.152

package/src/setting/validators.ts

@@ -1,7 +1,11 @@
 import { Selectable } from 'kysely'
 import { InvalidRequestError } from '@atproto/xrpc-server'
 import { Setting } from '../db/schema/setting'
-import { PolicyListSettingKey, ProtectedTagSettingKey } from './constants'
+import {
+  PolicyListSettingKey,
+  ProtectedTagSettingKey,
+  SeverityLevelSettingKey,
+} from './constants'
 
 export const settingValidators = new Map<
   string,
@@ -9,6 +13,21 @@ export const settingValidators = new Map<
 >([
   [
     ProtectedTagSettingKey,
+    /*
+     * Example configuration:
+     * {
+     *   "sensitive-tag": {
+     *     "roles": ["tools.ozone.team.defs#roleAdmin", "tools.ozone.team.defs#roleModerator"],
+     *     "moderators": ["did:plc:example1", "did:plc:example2"]
+     *   },
+     *   "high-risk-tag": {
+     *     "roles": ["tools.ozone.team.defs#roleAdmin"]
+     *   },
+     *   "admin-only-tag": {
+     *     "moderators": ["did:plc:admin1"]
+     *   }
+     * }
+     */
     async (setting: Partial<Selectable<Setting>>) => {
       if (setting.managerRole !== 'tools.ozone.team.defs#roleAdmin') {
         throw new InvalidRequestError(
@@ -60,6 +79,61 @@ export const settingValidators = new Map<
   ],
   [
     PolicyListSettingKey,
+    /*
+     * Example configuration:
+     * {
+     *   "harassment": {
+     *     "name": "Anti-Harassment",
+     *     "description": "Content that harasses, intimidates, or bullies users",
+     *     "severityLevels": {
+     *       "sev-1": {
+     *         "description": "Minor harassment",
+     *         "isDefault": true
+     *       },
+     *       "sev-2": {
+     *         "description": "Moderate harassment",
+     *         "isDefault": false
+     *       },
+     *       "sev-4": {
+     *         "description": "Severe harassment",
+     *         "isDefault": false
+     *       }
+     *     }
+     *   },
+     *   "death-threats": {
+     *     "name": "Death Threats",
+     *     "description": "Threats of violence or death against individuals",
+     *     "severityLevels": {
+     *       "death-threat": {
+     *         "description": "Death threat violation",
+     *         "isDefault": true
+     *       }
+     *     }
+     *   },
+     *   "spam": {
+     *     "name": "Spam",
+     *     "description": "Unsolicited or repetitive content",
+     *     "severityLevels": {
+     *       "sev-0": {
+     *         "description": "Minor spam",
+     *         "isDefault": false
+     *       },
+     *       "sev-1": {
+     *         "description": "Moderate spam",
+     *         "isDefault": true
+     *       },
+     *       "sev-2": {
+     *         "description": "Severe spam",
+     *         "isDefault": false
+     *       }
+     *     }
+     *   },
+     *   "minimal-policy": {
+     *     "name": "Basic Policy",
+     *     "description": "Simple policy without severity levels"
+     *   }
+     * }
+     */
     async (setting: Partial<Selectable<Setting>>) => {
       if (setting.managerRole !== 'tools.ozone.team.defs#roleAdmin') {
         throw new InvalidRequestError(
@@ -82,6 +156,162 @@ export const settingValidators = new Map<
             `Must define a name and description for policy ${key}`,
           )
         }
+
+        if (val['severityLevels'] !== undefined) {
+          if (typeof val['severityLevels'] !== 'object') {
+            throw new InvalidRequestError(
+              `Severity levels must be an object for policy ${key}`,
+            )
+          }
+
+          let hasDefault = false
+          for (const [severityKey, severityVal] of Object.entries(
+            val['severityLevels'],
+          )) {
+            if (!severityVal || typeof severityVal !== 'object') {
+              throw new InvalidRequestError(
+                `Invalid configuration for severity level ${severityKey} in policy ${key}`,
+              )
+            }
+
+            if (
+              severityVal['description'] !== undefined &&
+              typeof severityVal['description'] !== 'string'
+            ) {
+              throw new InvalidRequestError(
+                `Description must be a string for severity level ${severityKey} in policy ${key}`,
+              )
+            }
+
+            if (severityVal['isDefault'] !== undefined) {
+              if (typeof severityVal['isDefault'] !== 'boolean') {
+                throw new InvalidRequestError(
+                  `isDefault must be a boolean for severity level ${severityKey} in policy ${key}`,
+                )
+              }
+              if (severityVal['isDefault']) {
+                if (hasDefault) {
+                  throw new InvalidRequestError(
+                    `Only one severity level can be the default for policy ${key}`,
+                  )
+                }
+                hasDefault = true
+              }
+            }
+          }
+        }
+      }
+    },
+  ],
+  [
+    SeverityLevelSettingKey,
+    /*
+     * Example configuration:
+     * {
+     *   "sev-0": {
+     *     "strikeCount": 0
+     *   },
+     *   "sev-1": {
+     *     "strikeCount": 1,
+     *     "strikeOnOccurrence": 2
+     *   },
+     *   "sev-2": {
+     *     "strikeCount": 2
+     *   },
+     *   "sev-4": {
+     *     "strikeCount": 4,
+     *     "expiresInDays": 365
+     *   },
+     *   "sev-5": {
+     *     "needsTakedown": true
+     *   },
+     *   "death-threat": {
+     *     "strikeCount": 4,
+     *     "firstOccurrenceStrikeCount": 4,
+     *   },
+     *   "custom-severity": {
+     *     "strikeCount": 3,
+     *     "strikeOnOccurrence": 1,
+     *   },
+     *   "escalating-severity": {
+     *     "firstOccurrenceStrikeCount": 2,
+     *     "repeatOccurrenceStrikeCount": 5
+     *   }
+     * }
+     */
+    async (setting: Partial<Selectable<Setting>>) => {
+      if (setting.managerRole !== 'tools.ozone.team.defs#roleAdmin') {
+        throw new InvalidRequestError(
+          'Only admins should be able to manage severity levels',
+        )
+      }
+
+      if (typeof setting.value !== 'object') {
+        throw new InvalidRequestError('Invalid value')
+      }
+
+      for (const [key, val] of Object.entries(setting.value)) {
+        if (!val || typeof val !== 'object') {
+          throw new InvalidRequestError(
+            `Invalid configuration for severity level ${key}`,
+          )
+        }
+
+        if (val['strikeCount'] !== undefined) {
+          if (
+            typeof val['strikeCount'] !== 'number' ||
+            !Number.isInteger(val['strikeCount']) ||
+            val['strikeCount'] < 0
+          ) {
+            throw new InvalidRequestError(
+              `Strike count must be a non-negative integer for severity level ${key}`,
+            )
+          }
+        }
+
+        if (val['strikeOnOccurrence'] !== undefined) {
+          if (
+            typeof val['strikeOnOccurrence'] !== 'number' ||
+            !Number.isInteger(val['strikeOnOccurrence']) ||
+            val['strikeOnOccurrence'] < 1
+          ) {
+            throw new InvalidRequestError(
+              `Strike on occurrence must be a positive integer for severity level ${key}`,
+            )
+          }
+        }
+
+        if (val['needsTakedown'] !== undefined) {
+          if (typeof val['needsTakedown'] !== 'boolean') {
+            throw new InvalidRequestError(
+              `Needs takedown must be a boolean for severity level ${key}`,
+            )
+          }
+        }
+
+        if (val['expiresInDays'] !== undefined) {
+          if (
+            typeof val['expiresInDays'] !== 'number' ||
+            !Number.isInteger(val['expiresInDays']) ||
+            val['expiresInDays'] < 0
+          ) {
+            throw new InvalidRequestError(
+              `Expires in days must be a non-negative integer for severity level ${key}`,
+            )
+          }
+        }
+
+        if (val['firstOccurrenceStrikeCount'] !== undefined) {
+          if (
+            typeof val['firstOccurrenceStrikeCount'] !== 'number' ||
+            !Number.isInteger(val['firstOccurrenceStrikeCount']) ||
+            val['firstOccurrenceStrikeCount'] < 0
+          ) {
+            throw new InvalidRequestError(
+              `First occurrence strike count must be a non-negative integer for severity level ${key}`,
+            )
+          }
+        }
       }
     },
   ],

package/tests/__snapshots__/account-strikes.test.ts.snap

@@ -0,0 +1,159 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`account-strikes tracks strikes and exposes them through queryStatuses and queryEvents 1`] = `
+Object {
+  "accountStats": Object {
+    "$type": "tools.ozone.moderation.defs#accountStats",
+  },
+  "accountStrike": Object {
+    "$type": "tools.ozone.moderation.defs#accountStrike",
+    "activeStrikeCount": 5,
+    "firstStrikeAt": "1970-01-01T00:00:00.000Z",
+    "lastStrikeAt": "1970-01-01T00:00:00.000Z",
+    "totalStrikeCount": 5,
+  },
+  "ageAssuranceState": "unknown",
+  "createdAt": "1970-01-01T00:00:00.000Z",
+  "hosting": Object {
+    "$type": "tools.ozone.moderation.defs#accountHosting",
+    "status": "unknown",
+  },
+  "id": 9,
+  "lastReviewedAt": "1970-01-01T00:00:00.000Z",
+  "lastReviewedBy": "user(0)",
+  "priorityScore": 0,
+  "recordsStats": Object {
+    "$type": "tools.ozone.moderation.defs#recordsStats",
+  },
+  "reviewState": "tools.ozone.moderation.defs#reviewClosed",
+  "subject": Object {
+    "$type": "com.atproto.admin.defs#repoRef",
+    "did": "user(1)",
+  },
+  "subjectBlobCids": Array [],
+  "subjectRepoHandle": "alice.test",
+  "tags": Array [
+    "lang:und",
+  ],
+  "takendown": true,
+  "updatedAt": "1970-01-01T00:00:00.000Z",
+}
+`;
+
+exports[`account-strikes tracks strikes and exposes them through queryStatuses and queryEvents 2`] = `
+Array [
+  Object {
+    "createdAt": "1970-01-01T00:00:00.000Z",
+    "createdBy": "user(0)",
+    "event": Object {
+      "$type": "tools.ozone.moderation.defs#modEventReverseTakedown",
+      "comment": "Appeal granted - reversing first takedown",
+      "severityLevel": "sev-2",
+      "strikeCount": -2,
+    },
+    "id": 11,
+    "subject": Object {
+      "$type": "com.atproto.repo.strongRef",
+      "cid": "cids(0)",
+      "uri": "record(0)",
+    },
+    "subjectBlobCids": Array [],
+    "subjectHandle": "alice.test",
+  },
+  Object {
+    "createdAt": "1970-01-01T00:00:00.000Z",
+    "createdBy": "user(0)",
+    "event": Object {
+      "$type": "tools.ozone.moderation.defs#modEventTakedown",
+      "comment": "Warning only",
+      "severityLevel": "sev-0",
+      "strikeCount": 0,
+    },
+    "id": 9,
+    "subject": Object {
+      "$type": "com.atproto.admin.defs#repoRef",
+      "did": "user(1)",
+    },
+    "subjectBlobCids": Array [],
+    "subjectHandle": "alice.test",
+  },
+  Object {
+    "createdAt": "1970-01-01T00:00:00.000Z",
+    "createdBy": "user(0)",
+    "event": Object {
+      "$type": "tools.ozone.moderation.defs#modEventTakedown",
+      "comment": "Second sev-1 violation",
+      "policies": Array [
+        "spam-policy",
+      ],
+      "severityLevel": "sev-1",
+      "strikeCount": 1,
+    },
+    "id": 7,
+    "subject": Object {
+      "$type": "com.atproto.repo.strongRef",
+      "cid": "cids(1)",
+      "uri": "record(1)",
+    },
+    "subjectBlobCids": Array [],
+    "subjectHandle": "alice.test",
+  },
+  Object {
+    "createdAt": "1970-01-01T00:00:00.000Z",
+    "createdBy": "user(0)",
+    "event": Object {
+      "$type": "tools.ozone.moderation.defs#modEventTakedown",
+      "comment": "First sev-1 violation",
+      "policies": Array [
+        "spam-policy",
+      ],
+      "severityLevel": "sev-1",
+      "strikeCount": 0,
+    },
+    "id": 5,
+    "subject": Object {
+      "$type": "com.atproto.repo.strongRef",
+      "cid": "cids(2)",
+      "uri": "record(2)",
+    },
+    "subjectBlobCids": Array [],
+    "subjectHandle": "alice.test",
+  },
+  Object {
+    "createdAt": "1970-01-01T00:00:00.000Z",
+    "createdBy": "user(0)",
+    "event": Object {
+      "$type": "tools.ozone.moderation.defs#modEventTakedown",
+      "comment": "Second violation",
+      "severityLevel": "sev-2",
+      "strikeCount": 2,
+    },
+    "id": 3,
+    "subject": Object {
+      "$type": "com.atproto.repo.strongRef",
+      "cid": "cids(3)",
+      "uri": "record(3)",
+    },
+    "subjectBlobCids": Array [],
+    "subjectHandle": "alice.test",
+  },
+  Object {
+    "createdAt": "1970-01-01T00:00:00.000Z",
+    "createdBy": "user(0)",
+    "event": Object {
+      "$type": "tools.ozone.moderation.defs#modEventTakedown",
+      "comment": "First violation",
+      "severityLevel": "sev-2",
+      "strikeCount": 2,
+    },
+    "id": 1,
+    "subject": Object {
+      "$type": "com.atproto.repo.strongRef",
+      "cid": "cids(0)",
+      "uri": "record(0)",
+    },
+    "subjectBlobCids": Array [],
+    "subjectHandle": "alice.test",
+  },
+]
+`;

package/tests/account-strikes.test.ts

@@ -0,0 +1,184 @@
+import AtpAgent from '@atproto/api'
+import {
+  ModeratorClient,
+  SeedClient,
+  TestNetwork,
+  basicSeed,
+} from '@atproto/dev-env'
+import { ids } from '../src/lexicon/lexicons'
+import { SeverityLevelSettingKey } from '../src/setting/constants'
+import { forSnapshot } from './_util'
+
+const strikeConfig = {
+  'sev-0': { strikeCount: 0 },
+  'sev-1': {
+    strikeCount: 1,
+    strikeOnOccurrence: 2,
+    expiresInDays: 365,
+  },
+  'sev-2': { strikeCount: 2, expiresInDays: 365 },
+  'sev-4': { strikeCount: 4, expiresInDays: 0 },
+  'sev-5': { needsTakedown: true },
+}
+
+describe('account-strikes', () => {
+  let network: TestNetwork
+  let agent: AtpAgent
+  let sc: SeedClient
+  let modClient: ModeratorClient
+
+  const repoSubject = (did: string) => ({
+    $type: 'com.atproto.admin.defs#repoRef',
+    did,
+  })
+
+  const configureSeverityLevels = async () => {
+    // Configure severity level settings
+    await agent.tools.ozone.setting.upsertOption(
+      {
+        scope: 'instance',
+        key: SeverityLevelSettingKey,
+        value: strikeConfig,
+        description: 'Severity level configuration for strike system',
+        managerRole: 'tools.ozone.team.defs#roleAdmin',
+      },
+      {
+        encoding: 'application/json',
+        headers: await network.ozone.modHeaders(
+          ids.ToolsOzoneSettingUpsertOption,
+          'admin',
+        ),
+      },
+    )
+  }
+
+  beforeAll(async () => {
+    network = await TestNetwork.create({
+      dbPostgresSchema: 'ozone_account_strikes',
+    })
+    agent = network.ozone.getClient()
+    sc = network.getSeedClient()
+    modClient = network.ozone.getModClient()
+    await basicSeed(sc)
+    await network.processAll()
+    await configureSeverityLevels()
+  })
+
+  afterAll(async () => {
+    await network.close()
+  })
+
+  it('tracks strikes and exposes them through queryStatuses and queryEvents', async () => {
+    const aliceSubject = repoSubject(sc.dids.alice)
+    const alicePost = {
+      $type: 'com.atproto.repo.strongRef',
+      uri: sc.posts[sc.dids.alice][0].ref.uriStr,
+      cid: sc.posts[sc.dids.alice][0].ref.cidStr,
+    }
+
+    await modClient.emitEvent({
+      event: {
+        $type: 'tools.ozone.moderation.defs#modEventTakedown',
+        severityLevel: 'sev-2',
+        strikeCount: strikeConfig['sev-2'].strikeCount,
+        comment: 'First violation',
+      },
+      subject: alicePost,
+    })
+
+    const alicePost2 = {
+      $type: 'com.atproto.repo.strongRef',
+      uri: sc.posts[sc.dids.alice][1].ref.uriStr,
+      cid: sc.posts[sc.dids.alice][1].ref.cidStr,
+    }
+    await modClient.emitEvent({
+      event: {
+        $type: 'tools.ozone.moderation.defs#modEventTakedown',
+        severityLevel: 'sev-2',
+        strikeCount: strikeConfig['sev-2'].strikeCount,
+        comment: 'Second violation',
+      },
+      subject: alicePost2,
+    })
+
+    const alicePost3 = {
+      $type: 'com.atproto.repo.strongRef',
+      uri: sc.posts[sc.dids.alice][2].ref.uriStr,
+      cid: sc.posts[sc.dids.alice][2].ref.cidStr,
+    }
+    await modClient.emitEvent({
+      event: {
+        $type: 'tools.ozone.moderation.defs#modEventTakedown',
+        severityLevel: 'sev-1',
+        strikeCount: 0, // First occurrence - warning
+        policies: ['spam-policy'],
+        comment: 'First sev-1 violation',
+      },
+      subject: alicePost3,
+    })
+
+    // Issue second sev-1 takedown with same policy on another post (second occurrence, should be 1 strike, total 5)
+    const aliceReply = {
+      $type: 'com.atproto.repo.strongRef',
+      uri: sc.replies[sc.dids.alice][0].ref.uriStr,
+      cid: sc.replies[sc.dids.alice][0].ref.cidStr,
+    }
+    await modClient.emitEvent({
+      event: {
+        $type: 'tools.ozone.moderation.defs#modEventTakedown',
+        severityLevel: 'sev-1',
+        strikeCount: strikeConfig['sev-1'].strikeCount, // Second occurrence - actual strike
+        policies: ['spam-policy'],
+        comment: 'Second sev-1 violation',
+      },
+      subject: aliceReply,
+    })
+
+    await modClient.emitEvent({
+      event: {
+        $type: 'tools.ozone.moderation.defs#modEventTakedown',
+        severityLevel: 'sev-0',
+        strikeCount: strikeConfig['sev-0'].strikeCount,
+        comment: 'Warning only',
+      },
+      subject: aliceSubject,
+    })
+
+    let statusResult = await modClient.queryStatuses({
+      subject: sc.dids.alice,
+    })
+
+    expect(statusResult.subjectStatuses.length).toBeGreaterThan(0)
+    expect(forSnapshot(statusResult.subjectStatuses[0])).toMatchSnapshot()
+    const strikeCountBefore =
+      statusResult.subjectStatuses[0].accountStrike?.activeStrikeCount
+
+    // Reverse one of the takedowns with negative strikeCount
+    await modClient.emitEvent({
+      event: {
+        $type: 'tools.ozone.moderation.defs#modEventReverseTakedown',
+        severityLevel: 'sev-2',
+        strikeCount: -2, // Negative to reverse strikes
+        comment: 'Appeal granted - reversing first takedown',
+      },
+      subject: alicePost,
+    })
+
+    // Verify strikes were reduced (if strikeCount tracking is implemented)
+    statusResult = await modClient.queryStatuses({
+      subject: sc.dids.alice,
+    })
+    const strikeCountAfter =
+      statusResult.subjectStatuses[0].accountStrike?.activeStrikeCount
+    expect(strikeCountAfter).toBe(3)
+    expect(strikeCountAfter).toBeLessThan(strikeCountBefore!)
+
+    const eventsWithStrikes = await modClient.queryEvents({
+      subject: sc.dids.alice,
+      includeAllUserRecords: true,
+      withStrike: true,
+    })
+
+    expect(forSnapshot(eventsWithStrikes.events)).toMatchSnapshot()
+  })
+})

package/tests/query-labels.test.ts

@@ -163,6 +163,7 @@ describe('ozone query labels', () => {
         modSrvc.eventPusher,
         modSrvc.appviewAgent,
         ctx.serviceAuthHeaders,
+        ctx.strikeService,
       ),
     })