@atproto/ozone 0.1.25 → 0.1.26

package/src/api/team/updateMember.ts

@@ -0,0 +1,47 @@
+import { AuthRequiredError, InvalidRequestError } from '@atproto/xrpc-server'
+import { Server } from '../../lexicon'
+import AppContext from '../../context'
+import { getMemberRole } from '../util'
+
+export default function (server: Server, ctx: AppContext) {
+  server.tools.ozone.team.updateMember({
+    auth: ctx.authVerifier.modOrAdminToken,
+    handler: async ({ input, auth }) => {
+      const access = auth.credentials
+      const db = ctx.db
+      const { did, role, ...rest } = input.body
+
+      if (!access.isAdmin) {
+        throw new AuthRequiredError('Must be an admin to update a member')
+      }
+
+      if (did === ctx.cfg.service.did) {
+        throw new InvalidRequestError('Can not update service owner')
+      }
+
+      const updatedMember = await db.transaction(async (dbTxn) => {
+        const teamService = ctx.teamService(dbTxn)
+
+        const memberExists = await teamService.doesMemberExist(did)
+
+        if (!memberExists) {
+          throw new InvalidRequestError('member not found', 'MemberNotFound')
+        }
+
+        const updated = await teamService.update(did, {
+          ...rest,
+          ...(role ? { role: getMemberRole(role) } : {}),
+          lastUpdatedBy:
+            access.type === 'admin_token' ? 'admin_token' : access.iss,
+        })
+        const memberView = await teamService.view([updated], ctx)
+        return memberView[0]
+      })
+
+      return {
+        encoding: 'application/json',
+        body: updatedMember,
+      }
+    },
+  })
+}

package/src/api/util.ts

@@ -20,6 +20,12 @@ import {
 import { ModerationEvent } from '../db/schema/moderation_event'
 import { ModerationSubjectStatusRow } from '../mod-service/types'
 import AppContext from '../context'
+import { Member } from '../db/schema/member'
+import {
+  ROLEADMIN,
+  ROLEMODERATOR,
+  ROLETRIAGE,
+} from '../lexicon/types/tools/ozone/team/defs'
 
 export const getPdsAccountInfo = async (
   ctx: AppContext,
@@ -122,3 +128,12 @@ const eventTypes = new Set([
   'tools.ozone.moderation.defs#modEventTag',
   'tools.ozone.moderation.defs#modEventDivert',
 ])
+
+export const getMemberRole = (role: string) => {
+  if (memberRoles.has(role)) {
+    return role as Member['role']
+  }
+  throw new InvalidRequestError('Invalid member role')
+}
+
+const memberRoles = new Set([ROLEADMIN, ROLEMODERATOR, ROLETRIAGE])

package/src/auth-verifier.ts

@@ -2,6 +2,7 @@ import express from 'express'
 import * as ui8 from 'uint8arrays'
 import { IdResolver } from '@atproto/identity'
 import { AuthRequiredError, verifyJwt } from '@atproto/xrpc-server'
+import { TeamService } from './team'
 
 type ReqCtx = {
   req: express.Request
@@ -47,17 +48,13 @@ type NullOutput = {
 
 export type AuthVerifierOpts = {
   serviceDid: string
-  admins: string[]
-  moderators: string[]
-  triage: string[]
   adminPassword: string
+  teamService: TeamService
 }
 
 export class AuthVerifier {
   serviceDid: string
-  admins: string[]
-  moderators: string[]
-  triage: string[]
+  teamService: TeamService
   private adminPassword: string
 
   constructor(
@@ -65,10 +62,8 @@ export class AuthVerifier {
     opts: AuthVerifierOpts,
   ) {
     this.serviceDid = opts.serviceDid
-    this.admins = opts.admins
-    this.moderators = opts.moderators
-    this.triage = opts.triage
     this.adminPassword = opts.adminPassword
+    this.teamService = opts.teamService
   }
 
   modOrAdminToken = async (
@@ -113,9 +108,16 @@ export class AuthVerifier {
     }
     const payload = await verifyJwt(jwtStr, this.serviceDid, getSigningKey)
     const iss = payload.iss
-    const isAdmin = this.admins.includes(iss)
-    const isModerator = isAdmin || this.moderators.includes(iss)
-    const isTriage = isModerator || this.triage.includes(iss)
+
+    const member = await this.teamService.getMember(iss)
+
+    if (member?.disabled) {
+      throw new AuthRequiredError('member is disabled', 'MemberDisabled')
+    }
+
+    const { isAdmin, isModerator, isTriage } =
+      this.teamService.getMemberRole(member)
+
     return {
       credentials: {
         type: 'standard',

package/src/context.ts

@@ -18,6 +18,7 @@ import {
 import { BlobDiverter } from './daemon/blob-diverter'
 import { AuthVerifier } from './auth-verifier'
 import { ImageInvalidator } from './image-invalidator'
+import { TeamService, TeamServiceCreator } from './team'
 import {
   defaultLabelerHeader,
   getSigningKeyId,
@@ -31,6 +32,7 @@ export type AppContextOptions = {
   cfg: OzoneConfig
   modService: ModerationServiceCreator
   communicationTemplateService: CommunicationTemplateServiceCreator
+  teamService: TeamServiceCreator
   appviewAgent: AtpAgent
   pdsAgent: AtpAgent | undefined
   chatAgent: AtpAgent | undefined
@@ -107,15 +109,14 @@ export class AppContext {
     )
 
     const communicationTemplateService = CommunicationTemplateService.creator()
+    const teamService = TeamService.creator()
 
     const sequencer = new Sequencer(modService(db))
 
     const authVerifier = new AuthVerifier(idResolver, {
       serviceDid: cfg.service.did,
-      admins: cfg.access.admins,
-      moderators: cfg.access.moderators,
-      triage: cfg.access.triage,
       adminPassword: secrets.adminPassword,
+      teamService: teamService(db),
     })
 
     return new AppContext(
@@ -124,6 +125,7 @@ export class AppContext {
         cfg,
         modService,
         communicationTemplateService,
+        teamService,
         appviewAgent,
         pdsAgent,
         chatAgent,
@@ -168,6 +170,10 @@ export class AppContext {
     return this.opts.communicationTemplateService
   }
 
+  get teamService(): TeamServiceCreator {
+    return this.opts.teamService
+  }
+
   get appviewAgent(): AtpAgent {
     return this.opts.appviewAgent
   }

package/src/db/migrations/20240521T211332580Z-member.ts

@@ -0,0 +1,17 @@
+import { Kysely } from 'kysely'
+
+export async function up(db: Kysely<unknown>): Promise<void> {
+  await db.schema
+    .createTable('member')
+    .addColumn('did', 'varchar', (col) => col.primaryKey())
+    .addColumn('role', 'varchar', (col) => col.notNull())
+    .addColumn('disabled', 'boolean', (col) => col.defaultTo(false).notNull())
+    .addColumn('createdAt', 'timestamptz', (col) => col.notNull())
+    .addColumn('updatedAt', 'timestamptz', (col) => col.notNull())
+    .addColumn('lastUpdatedBy', 'varchar', (col) => col.notNull())
+    .execute()
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+  await db.schema.dropTable('member')
+}

package/src/db/migrations/index.ts

@@ -9,3 +9,4 @@ export * as _20240208T213404429Z from './20240208T213404429Z-add-tags-column-to-
 export * as _20240228T003647759Z from './20240228T003647759Z-add-label-sigs'
 export * as _20240408T192432676Z from './20240408T192432676Z-mute-reporting'
 export * as _20240506T225055595Z from './20240506T225055595Z-message-subject'
+export * as _20240430T211332580Z from './20240521T211332580Z-member'

package/src/db/schema/index.ts

@@ -7,6 +7,7 @@ import * as blobPushEvent from './blob_push_event'
 import * as label from './label'
 import * as signingKey from './signing_key'
 import * as communicationTemplate from './communication_template'
+import * as member from './member'
 
 export type DatabaseSchemaType = modEvent.PartialDB &
   modSubjectStatus.PartialDB &
@@ -15,7 +16,8 @@ export type DatabaseSchemaType = modEvent.PartialDB &
   repoPushEvent.PartialDB &
   recordPushEvent.PartialDB &
   blobPushEvent.PartialDB &
-  communicationTemplate.PartialDB
+  communicationTemplate.PartialDB &
+  member.PartialDB
 
 export type DatabaseSchema = Kysely<DatabaseSchemaType>
 

package/src/db/schema/member.ts

@@ -0,0 +1,19 @@
+import { Generated } from 'kysely'
+
+export const memberTableName = 'member'
+
+export interface Member {
+  did: string
+  role:
+    | 'tools.ozone.team.defs#roleAdmin'
+    | 'tools.ozone.team.defs#roleTriage'
+    | 'tools.ozone.team.defs#roleModerator'
+  disabled: Generated<boolean>
+  createdAt: Date
+  updatedAt: Date
+  lastUpdatedBy: string
+}
+
+export type PartialDB = {
+  [memberTableName]: Member
+}

package/src/index.ts

@@ -12,6 +12,7 @@ import { dbLogger, loggerMiddleware } from './logger'
 import { OzoneConfig, OzoneSecrets } from './config'
 import { createServer } from './lexicon'
 import AppContext, { AppContextOptions } from './context'
+import { Member } from './db/schema/member'
 
 export * from './config'
 export { type ImageInvalidator } from './image-invalidator'
@@ -64,10 +65,45 @@ export class OzoneService {
     return new OzoneService({ ctx, app })
   }
 
+  async seedInitialMembers() {
+    const members: Array<{ role: Member['role']; did: string }> = []
+    this.ctx.cfg.access.admins.forEach((did) =>
+      members.push({
+        role: 'tools.ozone.team.defs#roleAdmin',
+        did,
+      }),
+    )
+    this.ctx.cfg.access.triage.forEach((did) =>
+      members.push({
+        role: 'tools.ozone.team.defs#roleTriage',
+        did,
+      }),
+    )
+    this.ctx.cfg.access.moderators.forEach((did) =>
+      members.push({
+        role: 'tools.ozone.team.defs#roleModerator',
+        did,
+      }),
+    )
+
+    for (const member of members) {
+      const service = this.ctx.teamService(this.ctx.db)
+      await service.upsert({
+        ...member,
+        lastUpdatedBy: this.ctx.cfg.service.did,
+      })
+    }
+  }
+
   async start(): Promise<http.Server> {
     if (this.dbStatsInterval) {
       throw new Error(`${this.constructor.name} already started`)
     }
+
+    // Any moderator that are configured via env var may not exist in the database
+    // so we need to sync them from env var to the database
+    await this.seedInitialMembers()
+
     const { db, backgroundQueue } = this.ctx
     this.dbStatsInterval = setInterval(() => {
       dbLogger.info(

package/src/lexicon/index.ts

@@ -163,6 +163,10 @@ import * as ToolsOzoneModerationQueryEvents from './types/tools/ozone/moderation
 import * as ToolsOzoneModerationQueryStatuses from './types/tools/ozone/moderation/queryStatuses'
 import * as ToolsOzoneModerationSearchRepos from './types/tools/ozone/moderation/searchRepos'
 import * as ToolsOzoneServerGetConfig from './types/tools/ozone/server/getConfig'
+import * as ToolsOzoneTeamAddMember from './types/tools/ozone/team/addMember'
+import * as ToolsOzoneTeamDeleteMember from './types/tools/ozone/team/deleteMember'
+import * as ToolsOzoneTeamListMembers from './types/tools/ozone/team/listMembers'
+import * as ToolsOzoneTeamUpdateMember from './types/tools/ozone/team/updateMember'
 
 export const COM_ATPROTO_MODERATION = {
   DefsReasonSpam: 'com.atproto.moderation.defs#reasonSpam',
@@ -197,6 +201,11 @@ export const TOOLS_OZONE_MODERATION = {
   DefsReviewClosed: 'tools.ozone.moderation.defs#reviewClosed',
   DefsReviewNone: 'tools.ozone.moderation.defs#reviewNone',
 }
+export const TOOLS_OZONE_TEAM = {
+  DefsRoleAdmin: 'tools.ozone.team.defs#roleAdmin',
+  DefsRoleModerator: 'tools.ozone.team.defs#roleModerator',
+  DefsRoleTriage: 'tools.ozone.team.defs#roleTriage',
+}
 
 export function createServer(options?: XrpcOptions): Server {
   return new Server(options)
@@ -2043,12 +2052,14 @@ export class ToolsOzoneNS {
   communication: ToolsOzoneCommunicationNS
   moderation: ToolsOzoneModerationNS
   server: ToolsOzoneServerNS
+  team: ToolsOzoneTeamNS
 
   constructor(server: Server) {
     this._server = server
     this.communication = new ToolsOzoneCommunicationNS(server)
     this.moderation = new ToolsOzoneModerationNS(server)
     this.server = new ToolsOzoneServerNS(server)
+    this.team = new ToolsOzoneTeamNS(server)
   }
 }
 
@@ -2208,6 +2219,58 @@ export class ToolsOzoneServerNS {
   }
 }
 
+export class ToolsOzoneTeamNS {
+  _server: Server
+
+  constructor(server: Server) {
+    this._server = server
+  }
+
+  addMember<AV extends AuthVerifier>(
+    cfg: ConfigOf<
+      AV,
+      ToolsOzoneTeamAddMember.Handler<ExtractAuth<AV>>,
+      ToolsOzoneTeamAddMember.HandlerReqCtx<ExtractAuth<AV>>
+    >,
+  ) {
+    const nsid = 'tools.ozone.team.addMember' // @ts-ignore
+    return this._server.xrpc.method(nsid, cfg)
+  }
+
+  deleteMember<AV extends AuthVerifier>(
+    cfg: ConfigOf<
+      AV,
+      ToolsOzoneTeamDeleteMember.Handler<ExtractAuth<AV>>,
+      ToolsOzoneTeamDeleteMember.HandlerReqCtx<ExtractAuth<AV>>
+    >,
+  ) {
+    const nsid = 'tools.ozone.team.deleteMember' // @ts-ignore
+    return this._server.xrpc.method(nsid, cfg)
+  }
+
+  listMembers<AV extends AuthVerifier>(
+    cfg: ConfigOf<
+      AV,
+      ToolsOzoneTeamListMembers.Handler<ExtractAuth<AV>>,
+      ToolsOzoneTeamListMembers.HandlerReqCtx<ExtractAuth<AV>>
+    >,
+  ) {
+    const nsid = 'tools.ozone.team.listMembers' // @ts-ignore
+    return this._server.xrpc.method(nsid, cfg)
+  }
+
+  updateMember<AV extends AuthVerifier>(
+    cfg: ConfigOf<
+      AV,
+      ToolsOzoneTeamUpdateMember.Handler<ExtractAuth<AV>>,
+      ToolsOzoneTeamUpdateMember.HandlerReqCtx<ExtractAuth<AV>>
+    >,
+  ) {
+    const nsid = 'tools.ozone.team.updateMember' // @ts-ignore
+    return this._server.xrpc.method(nsid, cfg)
+  }
+}
+
 type SharedRateLimitOpts<T> = {
   name: string
   calcKey?: (ctx: T) => string

package/src/lexicon/lexicons.ts

@@ -11006,6 +11006,226 @@ export const schemaDict = {
       },
     },
   },
+  ToolsOzoneTeamAddMember: {
+    lexicon: 1,
+    id: 'tools.ozone.team.addMember',
+    defs: {
+      main: {
+        type: 'procedure',
+        description: 'Add a member to the ozone team. Requires admin role.',
+        input: {
+          encoding: 'application/json',
+          schema: {
+            type: 'object',
+            required: ['did', 'role'],
+            properties: {
+              did: {
+                type: 'string',
+                format: 'did',
+              },
+              role: {
+                type: 'string',
+                knownValues: [
+                  'tools.ozone.team.defs#roleAdmin',
+                  'tools.ozone.team.defs#roleModerator',
+                  'tools.ozone.team.defs#roleTriage',
+                ],
+              },
+            },
+          },
+        },
+        output: {
+          encoding: 'application/json',
+          schema: {
+            type: 'ref',
+            ref: 'lex:tools.ozone.team.defs#member',
+          },
+        },
+        errors: [
+          {
+            name: 'MemberAlreadyExists',
+            description: 'Member already exists in the team.',
+          },
+        ],
+      },
+    },
+  },
+  ToolsOzoneTeamDefs: {
+    lexicon: 1,
+    id: 'tools.ozone.team.defs',
+    defs: {
+      member: {
+        type: 'object',
+        required: ['did', 'role'],
+        properties: {
+          did: {
+            type: 'string',
+            format: 'did',
+          },
+          disabled: {
+            type: 'boolean',
+          },
+          profile: {
+            type: 'ref',
+            ref: 'lex:app.bsky.actor.defs#profileViewDetailed',
+          },
+          createdAt: {
+            type: 'string',
+            format: 'datetime',
+          },
+          updatedAt: {
+            type: 'string',
+            format: 'datetime',
+          },
+          lastUpdatedBy: {
+            type: 'string',
+          },
+          role: {
+            type: 'string',
+            knownValues: [
+              'lex:tools.ozone.team.defs#roleAdmin',
+              'lex:tools.ozone.team.defs#roleModerator',
+              'lex:tools.ozone.team.defs#roleTriage',
+            ],
+          },
+        },
+      },
+      roleAdmin: {
+        type: 'token',
+        description:
+          'Admin role. Highest level of access, can perform all actions.',
+      },
+      roleModerator: {
+        type: 'token',
+        description: 'Moderator role. Can perform most actions.',
+      },
+      roleTriage: {
+        type: 'token',
+        description:
+          'Triage role. Mostly intended for monitoring and escalating issues.',
+      },
+    },
+  },
+  ToolsOzoneTeamDeleteMember: {
+    lexicon: 1,
+    id: 'tools.ozone.team.deleteMember',
+    defs: {
+      main: {
+        type: 'procedure',
+        description: 'Delete a member from ozone team. Requires admin role.',
+        input: {
+          encoding: 'application/json',
+          schema: {
+            type: 'object',
+            required: ['did'],
+            properties: {
+              did: {
+                type: 'string',
+                format: 'did',
+              },
+            },
+          },
+        },
+        errors: [
+          {
+            name: 'MemberNotFound',
+            description: 'The member being deleted does not exist',
+          },
+        ],
+      },
+    },
+  },
+  ToolsOzoneTeamListMembers: {
+    lexicon: 1,
+    id: 'tools.ozone.team.listMembers',
+    defs: {
+      main: {
+        type: 'query',
+        description: 'List all members with access to the ozone service.',
+        parameters: {
+          type: 'params',
+          properties: {
+            limit: {
+              type: 'integer',
+              minimum: 1,
+              maximum: 100,
+              default: 50,
+            },
+            cursor: {
+              type: 'string',
+            },
+          },
+        },
+        output: {
+          encoding: 'application/json',
+          schema: {
+            type: 'object',
+            required: ['members'],
+            properties: {
+              cursor: {
+                type: 'string',
+              },
+              members: {
+                type: 'array',
+                items: {
+                  type: 'ref',
+                  ref: 'lex:tools.ozone.team.defs#member',
+                },
+              },
+            },
+          },
+        },
+      },
+    },
+  },
+  ToolsOzoneTeamUpdateMember: {
+    lexicon: 1,
+    id: 'tools.ozone.team.updateMember',
+    defs: {
+      main: {
+        type: 'procedure',
+        description:
+          'Update a member in the ozone service. Requires admin role.',
+        input: {
+          encoding: 'application/json',
+          schema: {
+            type: 'object',
+            required: ['did'],
+            properties: {
+              did: {
+                type: 'string',
+                format: 'did',
+              },
+              disabled: {
+                type: 'boolean',
+              },
+              role: {
+                type: 'string',
+                knownValues: [
+                  'tools.ozone.team.defs#roleAdmin',
+                  'tools.ozone.team.defs#roleModerator',
+                  'tools.ozone.team.defs#roleTriage',
+                ],
+              },
+            },
+          },
+        },
+        output: {
+          encoding: 'application/json',
+          schema: {
+            type: 'ref',
+            ref: 'lex:tools.ozone.team.defs#member',
+          },
+        },
+        errors: [
+          {
+            name: 'MemberNotFound',
+            description: 'The member being updated does not exist in the team',
+          },
+        ],
+      },
+    },
+  },
 }
 export const schemas: LexiconDoc[] = Object.values(schemaDict) as LexiconDoc[]
 export const lexicons: Lexicons = new Lexicons(schemas)
@@ -11216,4 +11436,9 @@ export const ids = {
   ToolsOzoneModerationQueryStatuses: 'tools.ozone.moderation.queryStatuses',
   ToolsOzoneModerationSearchRepos: 'tools.ozone.moderation.searchRepos',
   ToolsOzoneServerGetConfig: 'tools.ozone.server.getConfig',
+  ToolsOzoneTeamAddMember: 'tools.ozone.team.addMember',
+  ToolsOzoneTeamDefs: 'tools.ozone.team.defs',
+  ToolsOzoneTeamDeleteMember: 'tools.ozone.team.deleteMember',
+  ToolsOzoneTeamListMembers: 'tools.ozone.team.listMembers',
+  ToolsOzoneTeamUpdateMember: 'tools.ozone.team.updateMember',
 }

package/src/lexicon/types/tools/ozone/team/addMember.ts

@@ -0,0 +1,53 @@
+/**
+ * GENERATED CODE - DO NOT MODIFY
+ */
+import express from 'express'
+import { ValidationResult, BlobRef } from '@atproto/lexicon'
+import { lexicons } from '../../../../lexicons'
+import { isObj, hasProp } from '../../../../util'
+import { CID } from 'multiformats/cid'
+import { HandlerAuth, HandlerPipeThrough } from '@atproto/xrpc-server'
+import * as ToolsOzoneTeamDefs from './defs'
+
+export interface QueryParams {}
+
+export interface InputSchema {
+  did: string
+  role:
+    | 'tools.ozone.team.defs#roleAdmin'
+    | 'tools.ozone.team.defs#roleModerator'
+    | 'tools.ozone.team.defs#roleTriage'
+    | (string & {})
+  [k: string]: unknown
+}
+
+export type OutputSchema = ToolsOzoneTeamDefs.Member
+
+export interface HandlerInput {
+  encoding: 'application/json'
+  body: InputSchema
+}
+
+export interface HandlerSuccess {
+  encoding: 'application/json'
+  body: OutputSchema
+  headers?: { [key: string]: string }
+}
+
+export interface HandlerError {
+  status: number
+  message?: string
+  error?: 'MemberAlreadyExists'
+}
+
+export type HandlerOutput = HandlerError | HandlerSuccess | HandlerPipeThrough
+export type HandlerReqCtx<HA extends HandlerAuth = never> = {
+  auth: HA
+  params: QueryParams
+  input: HandlerInput
+  req: express.Request
+  res: express.Response
+}
+export type Handler<HA extends HandlerAuth = never> = (
+  ctx: HandlerReqCtx<HA>,
+) => Promise<HandlerOutput> | HandlerOutput