@atproto/ozone 0.1.24 → 0.1.26

package/src/api/team/deleteMember.ts

@@ -0,0 +1,29 @@
+import { AuthRequiredError, InvalidRequestError } from '@atproto/xrpc-server'
+import { Server } from '../../lexicon'
+import AppContext from '../../context'
+
+export default function (server: Server, ctx: AppContext) {
+  server.tools.ozone.team.deleteMember({
+    auth: ctx.authVerifier.modOrAdminToken,
+    handler: async ({ input, auth }) => {
+      const access = auth.credentials
+      const db = ctx.db
+      const { did } = input.body
+
+      if (!access.isAdmin) {
+        throw new AuthRequiredError('Must be an admin to delete a member')
+      }
+      if ('did' in auth.credentials && did === auth.credentials.did) {
+        throw new InvalidRequestError(
+          'You can not delete yourself from the team',
+          'CannotDeleteSelf',
+        )
+      }
+      await db.transaction(async (dbTxn) => {
+        const teamService = ctx.teamService(dbTxn)
+        await teamService.assertCanDelete(did)
+        await teamService.delete(did)
+      })
+    },
+  })
+}

package/src/api/team/listMembers.ts

@@ -0,0 +1,20 @@
+import { Server } from '../../lexicon'
+import AppContext from '../../context'
+
+export default function (server: Server, ctx: AppContext) {
+  server.tools.ozone.team.listMembers({
+    auth: ctx.authVerifier.modOrAdminToken,
+    handler: async ({ params }) => {
+      const teamService = ctx.teamService(ctx.db)
+      const { members, cursor } = await teamService.list(params)
+
+      return {
+        encoding: 'application/json',
+        body: {
+          cursor,
+          members: await teamService.view(members, ctx),
+        },
+      }
+    },
+  })
+}

package/src/api/team/updateMember.ts

@@ -0,0 +1,47 @@
+import { AuthRequiredError, InvalidRequestError } from '@atproto/xrpc-server'
+import { Server } from '../../lexicon'
+import AppContext from '../../context'
+import { getMemberRole } from '../util'
+
+export default function (server: Server, ctx: AppContext) {
+  server.tools.ozone.team.updateMember({
+    auth: ctx.authVerifier.modOrAdminToken,
+    handler: async ({ input, auth }) => {
+      const access = auth.credentials
+      const db = ctx.db
+      const { did, role, ...rest } = input.body
+
+      if (!access.isAdmin) {
+        throw new AuthRequiredError('Must be an admin to update a member')
+      }
+
+      if (did === ctx.cfg.service.did) {
+        throw new InvalidRequestError('Can not update service owner')
+      }
+
+      const updatedMember = await db.transaction(async (dbTxn) => {
+        const teamService = ctx.teamService(dbTxn)
+
+        const memberExists = await teamService.doesMemberExist(did)
+
+        if (!memberExists) {
+          throw new InvalidRequestError('member not found', 'MemberNotFound')
+        }
+
+        const updated = await teamService.update(did, {
+          ...rest,
+          ...(role ? { role: getMemberRole(role) } : {}),
+          lastUpdatedBy:
+            access.type === 'admin_token' ? 'admin_token' : access.iss,
+        })
+        const memberView = await teamService.view([updated], ctx)
+        return memberView[0]
+      })
+
+      return {
+        encoding: 'application/json',
+        body: updatedMember,
+      }
+    },
+  })
+}

package/src/api/util.ts

@@ -20,6 +20,12 @@ import {
 import { ModerationEvent } from '../db/schema/moderation_event'
 import { ModerationSubjectStatusRow } from '../mod-service/types'
 import AppContext from '../context'
+import { Member } from '../db/schema/member'
+import {
+  ROLEADMIN,
+  ROLEMODERATOR,
+  ROLETRIAGE,
+} from '../lexicon/types/tools/ozone/team/defs'
 
 export const getPdsAccountInfo = async (
   ctx: AppContext,
@@ -122,3 +128,12 @@ const eventTypes = new Set([
   'tools.ozone.moderation.defs#modEventTag',
   'tools.ozone.moderation.defs#modEventDivert',
 ])
+
+export const getMemberRole = (role: string) => {
+  if (memberRoles.has(role)) {
+    return role as Member['role']
+  }
+  throw new InvalidRequestError('Invalid member role')
+}
+
+const memberRoles = new Set([ROLEADMIN, ROLEMODERATOR, ROLETRIAGE])

package/src/auth-verifier.ts

@@ -2,6 +2,7 @@ import express from 'express'
 import * as ui8 from 'uint8arrays'
 import { IdResolver } from '@atproto/identity'
 import { AuthRequiredError, verifyJwt } from '@atproto/xrpc-server'
+import { TeamService } from './team'
 
 type ReqCtx = {
   req: express.Request
@@ -47,17 +48,13 @@ type NullOutput = {
 
 export type AuthVerifierOpts = {
   serviceDid: string
-  admins: string[]
-  moderators: string[]
-  triage: string[]
   adminPassword: string
+  teamService: TeamService
 }
 
 export class AuthVerifier {
   serviceDid: string
-  admins: string[]
-  moderators: string[]
-  triage: string[]
+  teamService: TeamService
   private adminPassword: string
 
   constructor(
@@ -65,10 +62,8 @@ export class AuthVerifier {
     opts: AuthVerifierOpts,
   ) {
     this.serviceDid = opts.serviceDid
-    this.admins = opts.admins
-    this.moderators = opts.moderators
-    this.triage = opts.triage
     this.adminPassword = opts.adminPassword
+    this.teamService = opts.teamService
   }
 
   modOrAdminToken = async (
@@ -113,9 +108,16 @@ export class AuthVerifier {
     }
     const payload = await verifyJwt(jwtStr, this.serviceDid, getSigningKey)
     const iss = payload.iss
-    const isAdmin = this.admins.includes(iss)
-    const isModerator = isAdmin || this.moderators.includes(iss)
-    const isTriage = isModerator || this.triage.includes(iss)
+
+    const member = await this.teamService.getMember(iss)
+
+    if (member?.disabled) {
+      throw new AuthRequiredError('member is disabled', 'MemberDisabled')
+    }
+
+    const { isAdmin, isModerator, isTriage } =
+      this.teamService.getMemberRole(member)
+
     return {
       credentials: {
         type: 'standard',

package/src/config/config.ts

@@ -6,8 +6,8 @@ import { OzoneEnvironment } from './env'
 
 export const envToCfg = (env: OzoneEnvironment): OzoneConfig => {
   const port = env.port ?? 3000
-  assert(env.publicUrl)
-  assert(env.serverDid)
+  assert(env.publicUrl, 'publicUrl is required')
+  assert(env.serverDid, 'serverDid is required')
   const serviceCfg: OzoneConfig['service'] = {
     port,
     publicUrl: env.publicUrl,
@@ -16,7 +16,7 @@ export const envToCfg = (env: OzoneEnvironment): OzoneConfig => {
     devMode: env.devMode,
   }
 
-  assert(env.dbPostgresUrl)
+  assert(env.dbPostgresUrl, 'dbPostgresUrl is required')
   const dbCfg: OzoneConfig['db'] = {
     postgresUrl: env.dbPostgresUrl,
     postgresSchema: env.dbPostgresSchema,
@@ -25,7 +25,8 @@ export const envToCfg = (env: OzoneEnvironment): OzoneConfig => {
     poolIdleTimeoutMs: env.dbPoolIdleTimeoutMs,
   }
 
-  assert(env.appviewUrl && env.appviewDid)
+  assert(env.appviewUrl, 'appviewUrl is required')
+  assert(env.appviewDid, 'appviewDid is required')
   const appviewCfg: OzoneConfig['appview'] = {
     url: env.appviewUrl,
     did: env.appviewDid,
@@ -34,7 +35,8 @@ export const envToCfg = (env: OzoneEnvironment): OzoneConfig => {
 
   let pdsCfg: OzoneConfig['pds'] = null
   if (env.pdsUrl || env.pdsDid) {
-    assert(env.pdsUrl && env.pdsDid)
+    assert(env.pdsUrl, 'pdsUrl is required')
+    assert(env.pdsDid, 'pdsDid is required')
     pdsCfg = {
       url: env.pdsUrl,
       did: env.pdsDid,
@@ -43,7 +45,8 @@ export const envToCfg = (env: OzoneEnvironment): OzoneConfig => {
 
   let chatCfg: OzoneConfig['chat'] = null
   if (env.chatUrl || env.chatDid) {
-    assert(env.chatUrl && env.chatDid)
+    assert(env.chatUrl, 'chatUrl is required when chatDid is provided')
+    assert(env.chatDid, 'chatDid is required when chatUrl is provided')
     chatCfg = {
       url: env.chatUrl,
       did: env.chatDid,
@@ -54,7 +57,7 @@ export const envToCfg = (env: OzoneEnvironment): OzoneConfig => {
     paths: env.cdnPaths,
   }
 
-  assert(env.didPlcUrl)
+  assert(env.didPlcUrl, 'didPlcUrl is required')
   const identityCfg: OzoneConfig['identity'] = {
     plcUrl: env.didPlcUrl,
   }

package/src/context.ts

@@ -18,6 +18,7 @@ import {
 import { BlobDiverter } from './daemon/blob-diverter'
 import { AuthVerifier } from './auth-verifier'
 import { ImageInvalidator } from './image-invalidator'
+import { TeamService, TeamServiceCreator } from './team'
 import {
   defaultLabelerHeader,
   getSigningKeyId,
@@ -31,6 +32,7 @@ export type AppContextOptions = {
   cfg: OzoneConfig
   modService: ModerationServiceCreator
   communicationTemplateService: CommunicationTemplateServiceCreator
+  teamService: TeamServiceCreator
   appviewAgent: AtpAgent
   pdsAgent: AtpAgent | undefined
   chatAgent: AtpAgent | undefined
@@ -107,15 +109,14 @@ export class AppContext {
     )
 
     const communicationTemplateService = CommunicationTemplateService.creator()
+    const teamService = TeamService.creator()
 
     const sequencer = new Sequencer(modService(db))
 
     const authVerifier = new AuthVerifier(idResolver, {
       serviceDid: cfg.service.did,
-      admins: cfg.access.admins,
-      moderators: cfg.access.moderators,
-      triage: cfg.access.triage,
       adminPassword: secrets.adminPassword,
+      teamService: teamService(db),
     })
 
     return new AppContext(
@@ -124,6 +125,7 @@ export class AppContext {
         cfg,
         modService,
         communicationTemplateService,
+        teamService,
         appviewAgent,
         pdsAgent,
         chatAgent,
@@ -168,6 +170,10 @@ export class AppContext {
     return this.opts.communicationTemplateService
   }
 
+  get teamService(): TeamServiceCreator {
+    return this.opts.teamService
+  }
+
   get appviewAgent(): AtpAgent {
     return this.opts.appviewAgent
   }

package/src/db/migrations/20240521T211332580Z-member.ts

@@ -0,0 +1,17 @@
+import { Kysely } from 'kysely'
+
+export async function up(db: Kysely<unknown>): Promise<void> {
+  await db.schema
+    .createTable('member')
+    .addColumn('did', 'varchar', (col) => col.primaryKey())
+    .addColumn('role', 'varchar', (col) => col.notNull())
+    .addColumn('disabled', 'boolean', (col) => col.defaultTo(false).notNull())
+    .addColumn('createdAt', 'timestamptz', (col) => col.notNull())
+    .addColumn('updatedAt', 'timestamptz', (col) => col.notNull())
+    .addColumn('lastUpdatedBy', 'varchar', (col) => col.notNull())
+    .execute()
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+  await db.schema.dropTable('member')
+}

package/src/db/migrations/index.ts

@@ -9,3 +9,4 @@ export * as _20240208T213404429Z from './20240208T213404429Z-add-tags-column-to-
 export * as _20240228T003647759Z from './20240228T003647759Z-add-label-sigs'
 export * as _20240408T192432676Z from './20240408T192432676Z-mute-reporting'
 export * as _20240506T225055595Z from './20240506T225055595Z-message-subject'
+export * as _20240430T211332580Z from './20240521T211332580Z-member'

package/src/db/schema/index.ts

@@ -7,6 +7,7 @@ import * as blobPushEvent from './blob_push_event'
 import * as label from './label'
 import * as signingKey from './signing_key'
 import * as communicationTemplate from './communication_template'
+import * as member from './member'
 
 export type DatabaseSchemaType = modEvent.PartialDB &
   modSubjectStatus.PartialDB &
@@ -15,7 +16,8 @@ export type DatabaseSchemaType = modEvent.PartialDB &
   repoPushEvent.PartialDB &
   recordPushEvent.PartialDB &
   blobPushEvent.PartialDB &
-  communicationTemplate.PartialDB
+  communicationTemplate.PartialDB &
+  member.PartialDB
 
 export type DatabaseSchema = Kysely<DatabaseSchemaType>
 

package/src/db/schema/member.ts

@@ -0,0 +1,19 @@
+import { Generated } from 'kysely'
+
+export const memberTableName = 'member'
+
+export interface Member {
+  did: string
+  role:
+    | 'tools.ozone.team.defs#roleAdmin'
+    | 'tools.ozone.team.defs#roleTriage'
+    | 'tools.ozone.team.defs#roleModerator'
+  disabled: Generated<boolean>
+  createdAt: Date
+  updatedAt: Date
+  lastUpdatedBy: string
+}
+
+export type PartialDB = {
+  [memberTableName]: Member
+}

package/src/index.ts

@@ -12,6 +12,7 @@ import { dbLogger, loggerMiddleware } from './logger'
 import { OzoneConfig, OzoneSecrets } from './config'
 import { createServer } from './lexicon'
 import AppContext, { AppContextOptions } from './context'
+import { Member } from './db/schema/member'
 
 export * from './config'
 export { type ImageInvalidator } from './image-invalidator'
@@ -64,10 +65,45 @@ export class OzoneService {
     return new OzoneService({ ctx, app })
   }
 
+  async seedInitialMembers() {
+    const members: Array<{ role: Member['role']; did: string }> = []
+    this.ctx.cfg.access.admins.forEach((did) =>
+      members.push({
+        role: 'tools.ozone.team.defs#roleAdmin',
+        did,
+      }),
+    )
+    this.ctx.cfg.access.triage.forEach((did) =>
+      members.push({
+        role: 'tools.ozone.team.defs#roleTriage',
+        did,
+      }),
+    )
+    this.ctx.cfg.access.moderators.forEach((did) =>
+      members.push({
+        role: 'tools.ozone.team.defs#roleModerator',
+        did,
+      }),
+    )
+
+    for (const member of members) {
+      const service = this.ctx.teamService(this.ctx.db)
+      await service.upsert({
+        ...member,
+        lastUpdatedBy: this.ctx.cfg.service.did,
+      })
+    }
+  }
+
   async start(): Promise<http.Server> {
     if (this.dbStatsInterval) {
       throw new Error(`${this.constructor.name} already started`)
     }
+
+    // Any moderator that are configured via env var may not exist in the database
+    // so we need to sync them from env var to the database
+    await this.seedInitialMembers()
+
     const { db, backgroundQueue } = this.ctx
     this.dbStatsInterval = setInterval(() => {
       dbLogger.info(

package/src/lexicon/index.ts

@@ -163,6 +163,10 @@ import * as ToolsOzoneModerationQueryEvents from './types/tools/ozone/moderation
 import * as ToolsOzoneModerationQueryStatuses from './types/tools/ozone/moderation/queryStatuses'
 import * as ToolsOzoneModerationSearchRepos from './types/tools/ozone/moderation/searchRepos'
 import * as ToolsOzoneServerGetConfig from './types/tools/ozone/server/getConfig'
+import * as ToolsOzoneTeamAddMember from './types/tools/ozone/team/addMember'
+import * as ToolsOzoneTeamDeleteMember from './types/tools/ozone/team/deleteMember'
+import * as ToolsOzoneTeamListMembers from './types/tools/ozone/team/listMembers'
+import * as ToolsOzoneTeamUpdateMember from './types/tools/ozone/team/updateMember'
 
 export const COM_ATPROTO_MODERATION = {
   DefsReasonSpam: 'com.atproto.moderation.defs#reasonSpam',
@@ -197,6 +201,11 @@ export const TOOLS_OZONE_MODERATION = {
   DefsReviewClosed: 'tools.ozone.moderation.defs#reviewClosed',
   DefsReviewNone: 'tools.ozone.moderation.defs#reviewNone',
 }
+export const TOOLS_OZONE_TEAM = {
+  DefsRoleAdmin: 'tools.ozone.team.defs#roleAdmin',
+  DefsRoleModerator: 'tools.ozone.team.defs#roleModerator',
+  DefsRoleTriage: 'tools.ozone.team.defs#roleTriage',
+}
 
 export function createServer(options?: XrpcOptions): Server {
   return new Server(options)
@@ -2043,12 +2052,14 @@ export class ToolsOzoneNS {
   communication: ToolsOzoneCommunicationNS
   moderation: ToolsOzoneModerationNS
   server: ToolsOzoneServerNS
+  team: ToolsOzoneTeamNS
 
   constructor(server: Server) {
     this._server = server
     this.communication = new ToolsOzoneCommunicationNS(server)
     this.moderation = new ToolsOzoneModerationNS(server)
     this.server = new ToolsOzoneServerNS(server)
+    this.team = new ToolsOzoneTeamNS(server)
   }
 }
 
@@ -2208,6 +2219,58 @@ export class ToolsOzoneServerNS {
   }
 }
 
+export class ToolsOzoneTeamNS {
+  _server: Server
+
+  constructor(server: Server) {
+    this._server = server
+  }
+
+  addMember<AV extends AuthVerifier>(
+    cfg: ConfigOf<
+      AV,
+      ToolsOzoneTeamAddMember.Handler<ExtractAuth<AV>>,
+      ToolsOzoneTeamAddMember.HandlerReqCtx<ExtractAuth<AV>>
+    >,
+  ) {
+    const nsid = 'tools.ozone.team.addMember' // @ts-ignore
+    return this._server.xrpc.method(nsid, cfg)
+  }
+
+  deleteMember<AV extends AuthVerifier>(
+    cfg: ConfigOf<
+      AV,
+      ToolsOzoneTeamDeleteMember.Handler<ExtractAuth<AV>>,
+      ToolsOzoneTeamDeleteMember.HandlerReqCtx<ExtractAuth<AV>>
+    >,
+  ) {
+    const nsid = 'tools.ozone.team.deleteMember' // @ts-ignore
+    return this._server.xrpc.method(nsid, cfg)
+  }
+
+  listMembers<AV extends AuthVerifier>(
+    cfg: ConfigOf<
+      AV,
+      ToolsOzoneTeamListMembers.Handler<ExtractAuth<AV>>,
+      ToolsOzoneTeamListMembers.HandlerReqCtx<ExtractAuth<AV>>
+    >,
+  ) {
+    const nsid = 'tools.ozone.team.listMembers' // @ts-ignore
+    return this._server.xrpc.method(nsid, cfg)
+  }
+
+  updateMember<AV extends AuthVerifier>(
+    cfg: ConfigOf<
+      AV,
+      ToolsOzoneTeamUpdateMember.Handler<ExtractAuth<AV>>,
+      ToolsOzoneTeamUpdateMember.HandlerReqCtx<ExtractAuth<AV>>
+    >,
+  ) {
+    const nsid = 'tools.ozone.team.updateMember' // @ts-ignore
+    return this._server.xrpc.method(nsid, cfg)
+  }
+}
+
 type SharedRateLimitOpts<T> = {
   name: string
   calcKey?: (ctx: T) => string