@atproto/ozone 0.1.25 → 0.1.27

package/src/api/util.ts

@@ -20,6 +20,12 @@ import {
 import { ModerationEvent } from '../db/schema/moderation_event'
 import { ModerationSubjectStatusRow } from '../mod-service/types'
 import AppContext from '../context'
+import { Member } from '../db/schema/member'
+import {
+  ROLEADMIN,
+  ROLEMODERATOR,
+  ROLETRIAGE,
+} from '../lexicon/types/tools/ozone/team/defs'
 
 export const getPdsAccountInfo = async (
   ctx: AppContext,
@@ -122,3 +128,12 @@ const eventTypes = new Set([
   'tools.ozone.moderation.defs#modEventTag',
   'tools.ozone.moderation.defs#modEventDivert',
 ])
+
+export const getMemberRole = (role: string) => {
+  if (memberRoles.has(role)) {
+    return role as Member['role']
+  }
+  throw new InvalidRequestError('Invalid member role')
+}
+
+const memberRoles = new Set([ROLEADMIN, ROLEMODERATOR, ROLETRIAGE])

package/src/auth-verifier.ts

@@ -2,6 +2,7 @@ import express from 'express'
 import * as ui8 from 'uint8arrays'
 import { IdResolver } from '@atproto/identity'
 import { AuthRequiredError, verifyJwt } from '@atproto/xrpc-server'
+import { TeamService } from './team'
 
 type ReqCtx = {
   req: express.Request
@@ -47,17 +48,13 @@ type NullOutput = {
 
 export type AuthVerifierOpts = {
   serviceDid: string
-  admins: string[]
-  moderators: string[]
-  triage: string[]
   adminPassword: string
+  teamService: TeamService
 }
 
 export class AuthVerifier {
   serviceDid: string
-  admins: string[]
-  moderators: string[]
-  triage: string[]
+  teamService: TeamService
   private adminPassword: string
 
   constructor(
@@ -65,10 +62,8 @@ export class AuthVerifier {
     opts: AuthVerifierOpts,
   ) {
     this.serviceDid = opts.serviceDid
-    this.admins = opts.admins
-    this.moderators = opts.moderators
-    this.triage = opts.triage
     this.adminPassword = opts.adminPassword
+    this.teamService = opts.teamService
   }
 
   modOrAdminToken = async (
@@ -113,9 +108,16 @@ export class AuthVerifier {
     }
     const payload = await verifyJwt(jwtStr, this.serviceDid, getSigningKey)
     const iss = payload.iss
-    const isAdmin = this.admins.includes(iss)
-    const isModerator = isAdmin || this.moderators.includes(iss)
-    const isTriage = isModerator || this.triage.includes(iss)
+
+    const member = await this.teamService.getMember(iss)
+
+    if (member?.disabled) {
+      throw new AuthRequiredError('member is disabled', 'MemberDisabled')
+    }
+
+    const { isAdmin, isModerator, isTriage } =
+      this.teamService.getMemberRole(member)
+
     return {
       credentials: {
         type: 'standard',

package/src/context.ts

@@ -18,6 +18,7 @@ import {
 import { BlobDiverter } from './daemon/blob-diverter'
 import { AuthVerifier } from './auth-verifier'
 import { ImageInvalidator } from './image-invalidator'
+import { TeamService, TeamServiceCreator } from './team'
 import {
   defaultLabelerHeader,
   getSigningKeyId,
@@ -31,6 +32,7 @@ export type AppContextOptions = {
   cfg: OzoneConfig
   modService: ModerationServiceCreator
   communicationTemplateService: CommunicationTemplateServiceCreator
+  teamService: TeamServiceCreator
   appviewAgent: AtpAgent
   pdsAgent: AtpAgent | undefined
   chatAgent: AtpAgent | undefined
@@ -107,15 +109,14 @@ export class AppContext {
     )
 
     const communicationTemplateService = CommunicationTemplateService.creator()
+    const teamService = TeamService.creator()
 
     const sequencer = new Sequencer(modService(db))
 
     const authVerifier = new AuthVerifier(idResolver, {
       serviceDid: cfg.service.did,
-      admins: cfg.access.admins,
-      moderators: cfg.access.moderators,
-      triage: cfg.access.triage,
       adminPassword: secrets.adminPassword,
+      teamService: teamService(db),
     })
 
     return new AppContext(
@@ -124,6 +125,7 @@ export class AppContext {
         cfg,
         modService,
         communicationTemplateService,
+        teamService,
         appviewAgent,
         pdsAgent,
         chatAgent,
@@ -168,6 +170,10 @@ export class AppContext {
     return this.opts.communicationTemplateService
   }
 
+  get teamService(): TeamServiceCreator {
+    return this.opts.teamService
+  }
+
   get appviewAgent(): AtpAgent {
     return this.opts.appviewAgent
   }

package/src/db/migrations/20240521T211332580Z-member.ts

@@ -0,0 +1,17 @@
+import { Kysely } from 'kysely'
+
+export async function up(db: Kysely<unknown>): Promise<void> {
+  await db.schema
+    .createTable('member')
+    .addColumn('did', 'varchar', (col) => col.primaryKey())
+    .addColumn('role', 'varchar', (col) => col.notNull())
+    .addColumn('disabled', 'boolean', (col) => col.defaultTo(false).notNull())
+    .addColumn('createdAt', 'timestamptz', (col) => col.notNull())
+    .addColumn('updatedAt', 'timestamptz', (col) => col.notNull())
+    .addColumn('lastUpdatedBy', 'varchar', (col) => col.notNull())
+    .execute()
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+  await db.schema.dropTable('member')
+}

package/src/db/migrations/index.ts

@@ -9,3 +9,4 @@ export * as _20240208T213404429Z from './20240208T213404429Z-add-tags-column-to-
 export * as _20240228T003647759Z from './20240228T003647759Z-add-label-sigs'
 export * as _20240408T192432676Z from './20240408T192432676Z-mute-reporting'
 export * as _20240506T225055595Z from './20240506T225055595Z-message-subject'
+export * as _20240430T211332580Z from './20240521T211332580Z-member'

package/src/db/schema/index.ts

@@ -7,6 +7,7 @@ import * as blobPushEvent from './blob_push_event'
 import * as label from './label'
 import * as signingKey from './signing_key'
 import * as communicationTemplate from './communication_template'
+import * as member from './member'
 
 export type DatabaseSchemaType = modEvent.PartialDB &
   modSubjectStatus.PartialDB &
@@ -15,7 +16,8 @@ export type DatabaseSchemaType = modEvent.PartialDB &
   repoPushEvent.PartialDB &
   recordPushEvent.PartialDB &
   blobPushEvent.PartialDB &
-  communicationTemplate.PartialDB
+  communicationTemplate.PartialDB &
+  member.PartialDB
 
 export type DatabaseSchema = Kysely<DatabaseSchemaType>
 

package/src/db/schema/member.ts

@@ -0,0 +1,19 @@
+import { Generated } from 'kysely'
+
+export const memberTableName = 'member'
+
+export interface Member {
+  did: string
+  role:
+    | 'tools.ozone.team.defs#roleAdmin'
+    | 'tools.ozone.team.defs#roleTriage'
+    | 'tools.ozone.team.defs#roleModerator'
+  disabled: Generated<boolean>
+  createdAt: Date
+  updatedAt: Date
+  lastUpdatedBy: string
+}
+
+export type PartialDB = {
+  [memberTableName]: Member
+}

package/src/index.ts

@@ -12,6 +12,7 @@ import { dbLogger, loggerMiddleware } from './logger'
 import { OzoneConfig, OzoneSecrets } from './config'
 import { createServer } from './lexicon'
 import AppContext, { AppContextOptions } from './context'
+import { Member } from './db/schema/member'
 
 export * from './config'
 export { type ImageInvalidator } from './image-invalidator'
@@ -64,10 +65,45 @@ export class OzoneService {
     return new OzoneService({ ctx, app })
   }
 
+  async seedInitialMembers() {
+    const members: Array<{ role: Member['role']; did: string }> = []
+    this.ctx.cfg.access.admins.forEach((did) =>
+      members.push({
+        role: 'tools.ozone.team.defs#roleAdmin',
+        did,
+      }),
+    )
+    this.ctx.cfg.access.triage.forEach((did) =>
+      members.push({
+        role: 'tools.ozone.team.defs#roleTriage',
+        did,
+      }),
+    )
+    this.ctx.cfg.access.moderators.forEach((did) =>
+      members.push({
+        role: 'tools.ozone.team.defs#roleModerator',
+        did,
+      }),
+    )
+
+    for (const member of members) {
+      const service = this.ctx.teamService(this.ctx.db)
+      await service.upsert({
+        ...member,
+        lastUpdatedBy: this.ctx.cfg.service.did,
+      })
+    }
+  }
+
   async start(): Promise<http.Server> {
     if (this.dbStatsInterval) {
       throw new Error(`${this.constructor.name} already started`)
     }
+
+    // Any moderator that are configured via env var may not exist in the database
+    // so we need to sync them from env var to the database
+    await this.seedInitialMembers()
+
     const { db, backgroundQueue } = this.ctx
     this.dbStatsInterval = setInterval(() => {
       dbLogger.info(

package/src/lexicon/index.ts

@@ -107,6 +107,7 @@ import * as AppBskyFeedGetSuggestedFeeds from './types/app/bsky/feed/getSuggeste
 import * as AppBskyFeedGetTimeline from './types/app/bsky/feed/getTimeline'
 import * as AppBskyFeedSearchPosts from './types/app/bsky/feed/searchPosts'
 import * as AppBskyFeedSendInteractions from './types/app/bsky/feed/sendInteractions'
+import * as AppBskyGraphGetActorStarterPacks from './types/app/bsky/graph/getActorStarterPacks'
 import * as AppBskyGraphGetBlocks from './types/app/bsky/graph/getBlocks'
 import * as AppBskyGraphGetFollowers from './types/app/bsky/graph/getFollowers'
 import * as AppBskyGraphGetFollows from './types/app/bsky/graph/getFollows'
@@ -117,6 +118,8 @@ import * as AppBskyGraphGetListMutes from './types/app/bsky/graph/getListMutes'
 import * as AppBskyGraphGetLists from './types/app/bsky/graph/getLists'
 import * as AppBskyGraphGetMutes from './types/app/bsky/graph/getMutes'
 import * as AppBskyGraphGetRelationships from './types/app/bsky/graph/getRelationships'
+import * as AppBskyGraphGetStarterPack from './types/app/bsky/graph/getStarterPack'
+import * as AppBskyGraphGetStarterPacks from './types/app/bsky/graph/getStarterPacks'
 import * as AppBskyGraphGetSuggestedFollowsByActor from './types/app/bsky/graph/getSuggestedFollowsByActor'
 import * as AppBskyGraphMuteActor from './types/app/bsky/graph/muteActor'
 import * as AppBskyGraphMuteActorList from './types/app/bsky/graph/muteActorList'
@@ -163,6 +166,10 @@ import * as ToolsOzoneModerationQueryEvents from './types/tools/ozone/moderation
 import * as ToolsOzoneModerationQueryStatuses from './types/tools/ozone/moderation/queryStatuses'
 import * as ToolsOzoneModerationSearchRepos from './types/tools/ozone/moderation/searchRepos'
 import * as ToolsOzoneServerGetConfig from './types/tools/ozone/server/getConfig'
+import * as ToolsOzoneTeamAddMember from './types/tools/ozone/team/addMember'
+import * as ToolsOzoneTeamDeleteMember from './types/tools/ozone/team/deleteMember'
+import * as ToolsOzoneTeamListMembers from './types/tools/ozone/team/listMembers'
+import * as ToolsOzoneTeamUpdateMember from './types/tools/ozone/team/updateMember'
 
 export const COM_ATPROTO_MODERATION = {
   DefsReasonSpam: 'com.atproto.moderation.defs#reasonSpam',
@@ -190,6 +197,7 @@ export const APP_BSKY_FEED = {
 export const APP_BSKY_GRAPH = {
   DefsModlist: 'app.bsky.graph.defs#modlist',
   DefsCuratelist: 'app.bsky.graph.defs#curatelist',
+  DefsReferencelist: 'app.bsky.graph.defs#referencelist',
 }
 export const TOOLS_OZONE_MODERATION = {
   DefsReviewOpen: 'tools.ozone.moderation.defs#reviewOpen',
@@ -197,6 +205,11 @@ export const TOOLS_OZONE_MODERATION = {
   DefsReviewClosed: 'tools.ozone.moderation.defs#reviewClosed',
   DefsReviewNone: 'tools.ozone.moderation.defs#reviewNone',
 }
+export const TOOLS_OZONE_TEAM = {
+  DefsRoleAdmin: 'tools.ozone.team.defs#roleAdmin',
+  DefsRoleModerator: 'tools.ozone.team.defs#roleModerator',
+  DefsRoleTriage: 'tools.ozone.team.defs#roleTriage',
+}
 
 export function createServer(options?: XrpcOptions): Server {
   return new Server(options)
@@ -1463,6 +1476,17 @@ export class AppBskyGraphNS {
     this._server = server
   }
 
+  getActorStarterPacks<AV extends AuthVerifier>(
+    cfg: ConfigOf<
+      AV,
+      AppBskyGraphGetActorStarterPacks.Handler<ExtractAuth<AV>>,
+      AppBskyGraphGetActorStarterPacks.HandlerReqCtx<ExtractAuth<AV>>
+    >,
+  ) {
+    const nsid = 'app.bsky.graph.getActorStarterPacks' // @ts-ignore
+    return this._server.xrpc.method(nsid, cfg)
+  }
+
   getBlocks<AV extends AuthVerifier>(
     cfg: ConfigOf<
       AV,
@@ -1573,6 +1597,28 @@ export class AppBskyGraphNS {
     return this._server.xrpc.method(nsid, cfg)
   }
 
+  getStarterPack<AV extends AuthVerifier>(
+    cfg: ConfigOf<
+      AV,
+      AppBskyGraphGetStarterPack.Handler<ExtractAuth<AV>>,
+      AppBskyGraphGetStarterPack.HandlerReqCtx<ExtractAuth<AV>>
+    >,
+  ) {
+    const nsid = 'app.bsky.graph.getStarterPack' // @ts-ignore
+    return this._server.xrpc.method(nsid, cfg)
+  }
+
+  getStarterPacks<AV extends AuthVerifier>(
+    cfg: ConfigOf<
+      AV,
+      AppBskyGraphGetStarterPacks.Handler<ExtractAuth<AV>>,
+      AppBskyGraphGetStarterPacks.HandlerReqCtx<ExtractAuth<AV>>
+    >,
+  ) {
+    const nsid = 'app.bsky.graph.getStarterPacks' // @ts-ignore
+    return this._server.xrpc.method(nsid, cfg)
+  }
+
   getSuggestedFollowsByActor<AV extends AuthVerifier>(
     cfg: ConfigOf<
       AV,
@@ -2043,12 +2089,14 @@ export class ToolsOzoneNS {
   communication: ToolsOzoneCommunicationNS
   moderation: ToolsOzoneModerationNS
   server: ToolsOzoneServerNS
+  team: ToolsOzoneTeamNS
 
   constructor(server: Server) {
     this._server = server
     this.communication = new ToolsOzoneCommunicationNS(server)
     this.moderation = new ToolsOzoneModerationNS(server)
     this.server = new ToolsOzoneServerNS(server)
+    this.team = new ToolsOzoneTeamNS(server)
   }
 }
 
@@ -2208,6 +2256,58 @@ export class ToolsOzoneServerNS {
   }
 }
 
+export class ToolsOzoneTeamNS {
+  _server: Server
+
+  constructor(server: Server) {
+    this._server = server
+  }
+
+  addMember<AV extends AuthVerifier>(
+    cfg: ConfigOf<
+      AV,
+      ToolsOzoneTeamAddMember.Handler<ExtractAuth<AV>>,
+      ToolsOzoneTeamAddMember.HandlerReqCtx<ExtractAuth<AV>>
+    >,
+  ) {
+    const nsid = 'tools.ozone.team.addMember' // @ts-ignore
+    return this._server.xrpc.method(nsid, cfg)
+  }
+
+  deleteMember<AV extends AuthVerifier>(
+    cfg: ConfigOf<
+      AV,
+      ToolsOzoneTeamDeleteMember.Handler<ExtractAuth<AV>>,
+      ToolsOzoneTeamDeleteMember.HandlerReqCtx<ExtractAuth<AV>>
+    >,
+  ) {
+    const nsid = 'tools.ozone.team.deleteMember' // @ts-ignore
+    return this._server.xrpc.method(nsid, cfg)
+  }
+
+  listMembers<AV extends AuthVerifier>(
+    cfg: ConfigOf<
+      AV,
+      ToolsOzoneTeamListMembers.Handler<ExtractAuth<AV>>,
+      ToolsOzoneTeamListMembers.HandlerReqCtx<ExtractAuth<AV>>
+    >,
+  ) {
+    const nsid = 'tools.ozone.team.listMembers' // @ts-ignore
+    return this._server.xrpc.method(nsid, cfg)
+  }
+
+  updateMember<AV extends AuthVerifier>(
+    cfg: ConfigOf<
+      AV,
+      ToolsOzoneTeamUpdateMember.Handler<ExtractAuth<AV>>,
+      ToolsOzoneTeamUpdateMember.HandlerReqCtx<ExtractAuth<AV>>
+    >,
+  ) {
+    const nsid = 'tools.ozone.team.updateMember' // @ts-ignore
+    return this._server.xrpc.method(nsid, cfg)
+  }
+}
+
 type SharedRateLimitOpts<T> = {
   name: string
   calcKey?: (ctx: T) => string