@atproto/ozone 0.1.36 → 0.1.38

package/src/api/proxied.ts

@@ -1,5 +1,6 @@
 import { Server } from '../lexicon'
 import AppContext from '../context'
+import { ids } from '../lexicon/lexicons'
 
 export default function (server: Server, ctx: AppContext) {
   server.app.bsky.actor.getProfile({
@@ -7,7 +8,7 @@ export default function (server: Server, ctx: AppContext) {
     handler: async (request) => {
       const res = await ctx.appviewAgent.api.app.bsky.actor.getProfile(
         request.params,
-        await ctx.appviewAuth(),
+        await ctx.appviewAuth(ids.AppBskyActorGetProfile),
       )
       return {
         encoding: 'application/json',
@@ -21,7 +22,7 @@ export default function (server: Server, ctx: AppContext) {
     handler: async (request) => {
       const res = await ctx.appviewAgent.api.app.bsky.actor.getProfiles(
         request.params,
-        await ctx.appviewAuth(),
+        await ctx.appviewAuth(ids.AppBskyActorGetProfiles),
       )
       return {
         encoding: 'application/json',
@@ -35,7 +36,7 @@ export default function (server: Server, ctx: AppContext) {
     handler: async (request) => {
       const res = await ctx.appviewAgent.api.app.bsky.feed.getAuthorFeed(
         request.params,
-        await ctx.appviewAuth(),
+        await ctx.appviewAuth(ids.AppBskyFeedGetAuthorFeed),
       )
       return {
         encoding: 'application/json',
@@ -49,7 +50,7 @@ export default function (server: Server, ctx: AppContext) {
     handler: async (request) => {
       const res = await ctx.appviewAgent.api.app.bsky.feed.searchPosts(
         request.params,
-        await ctx.appviewAuth(),
+        await ctx.appviewAuth(ids.AppBskyFeedSearchPosts),
       )
       return {
         encoding: 'application/json',
@@ -63,7 +64,7 @@ export default function (server: Server, ctx: AppContext) {
     handler: async (request) => {
       const res = await ctx.appviewAgent.api.app.bsky.feed.getPostThread(
         request.params,
-        await ctx.appviewAuth(),
+        await ctx.appviewAuth(ids.AppBskyFeedGetPostThread),
       )
       return {
         encoding: 'application/json',
@@ -77,7 +78,7 @@ export default function (server: Server, ctx: AppContext) {
     handler: async (request) => {
       const res = await ctx.appviewAgent.api.app.bsky.feed.getFeedGenerator(
         request.params,
-        await ctx.appviewAuth(),
+        await ctx.appviewAuth(ids.AppBskyFeedGetFeedGenerator),
       )
       return {
         encoding: 'application/json',
@@ -91,7 +92,7 @@ export default function (server: Server, ctx: AppContext) {
     handler: async (request) => {
       const res = await ctx.appviewAgent.api.app.bsky.graph.getFollows(
         request.params,
-        await ctx.appviewAuth(),
+        await ctx.appviewAuth(ids.AppBskyGraphGetFollows),
       )
       return {
         encoding: 'application/json',
@@ -105,7 +106,7 @@ export default function (server: Server, ctx: AppContext) {
     handler: async (request) => {
       const res = await ctx.appviewAgent.api.app.bsky.graph.getFollowers(
         request.params,
-        await ctx.appviewAuth(),
+        await ctx.appviewAuth(ids.AppBskyGraphGetFollowers),
       )
       return {
         encoding: 'application/json',
@@ -119,7 +120,7 @@ export default function (server: Server, ctx: AppContext) {
     handler: async (request) => {
       const res = await ctx.appviewAgent.api.app.bsky.graph.getList(
         request.params,
-        await ctx.appviewAuth(),
+        await ctx.appviewAuth(ids.AppBskyGraphGetList),
       )
       return {
         encoding: 'application/json',
@@ -133,7 +134,7 @@ export default function (server: Server, ctx: AppContext) {
     handler: async (request) => {
       const res = await ctx.appviewAgent.api.app.bsky.graph.getLists(
         request.params,
-        await ctx.appviewAuth(),
+        await ctx.appviewAuth(ids.AppBskyGraphGetLists),
       )
       return {
         encoding: 'application/json',
@@ -150,7 +151,7 @@ export default function (server: Server, ctx: AppContext) {
       }
       const res = await ctx.pdsAgent.api.com.atproto.admin.searchAccounts(
         request.params,
-        await ctx.pdsAuth(),
+        await ctx.pdsAuth(ids.ComAtprotoAdminSearchAccounts),
       )
       return {
         encoding: 'application/json',
@@ -164,7 +165,7 @@ export default function (server: Server, ctx: AppContext) {
     handler: async (request) => {
       const res = await ctx.appviewAgent.api.app.bsky.graph.getStarterPack(
         request.params,
-        await ctx.appviewAuth(),
+        await ctx.appviewAuth(ids.AppBskyGraphGetStarterPack),
       )
       return {
         encoding: 'application/json',
@@ -178,7 +179,7 @@ export default function (server: Server, ctx: AppContext) {
     handler: async (request) => {
       const res = await ctx.appviewAgent.api.app.bsky.graph.getStarterPacks(
         request.params,
-        await ctx.appviewAuth(),
+        await ctx.appviewAuth(ids.AppBskyGraphGetStarterPacks),
       )
       return {
         encoding: 'application/json',
@@ -193,7 +194,7 @@ export default function (server: Server, ctx: AppContext) {
       const res =
         await ctx.appviewAgent.api.app.bsky.graph.getActorStarterPacks(
           request.params,
-          await ctx.appviewAuth(),
+          await ctx.appviewAuth(ids.AppBskyGraphGetActorStarterPacks),
         )
       return {
         encoding: 'application/json',
@@ -207,7 +208,7 @@ export default function (server: Server, ctx: AppContext) {
     handler: async (request) => {
       const res = await ctx.appviewAgent.api.app.bsky.feed.getLikes(
         request.params,
-        await ctx.appviewAuth(),
+        await ctx.appviewAuth(ids.AppBskyFeedGetLikes),
       )
       return {
         encoding: 'application/json',
@@ -221,7 +222,7 @@ export default function (server: Server, ctx: AppContext) {
     handler: async (request) => {
       const res = await ctx.appviewAgent.api.app.bsky.feed.getRepostedBy(
         request.params,
-        await ctx.appviewAuth(),
+        await ctx.appviewAuth(ids.AppBskyFeedGetRepostedBy),
       )
       return {
         encoding: 'application/json',
@@ -236,7 +237,7 @@ export default function (server: Server, ctx: AppContext) {
       const res =
         await ctx.appviewAgent.api.app.bsky.actor.searchActorsTypeahead(
           request.params,
-          await ctx.appviewAuth(),
+          await ctx.appviewAuth(ids.AppBskyActorSearchActorsTypeahead),
         )
       return {
         encoding: 'application/json',

package/src/api/util.ts

@@ -26,6 +26,7 @@ import {
   ROLEMODERATOR,
   ROLETRIAGE,
 } from '../lexicon/types/tools/ozone/team/defs'
+import { ids } from '../lexicon/lexicons'
 
 export const getPdsAccountInfo = async (
   ctx: AppContext,
@@ -33,7 +34,7 @@ export const getPdsAccountInfo = async (
 ): Promise<AccountView | null> => {
   const agent = ctx.pdsAgent
   if (!agent) return null
-  const auth = await ctx.pdsAuth()
+  const auth = await ctx.pdsAuth(ids.ComAtprotoAdminGetAccountInfo)
   if (!auth) return null
   try {
     const res = await agent.api.com.atproto.admin.getAccountInfo({ did }, auth)

package/src/auth-verifier.ts

@@ -1,7 +1,11 @@
 import express from 'express'
 import * as ui8 from 'uint8arrays'
 import { IdResolver } from '@atproto/identity'
-import { AuthRequiredError, verifyJwt } from '@atproto/xrpc-server'
+import {
+  AuthRequiredError,
+  parseReqNsid,
+  verifyJwt,
+} from '@atproto/xrpc-server'
 import { TeamService } from './team'
 
 type ReqCtx = {
@@ -106,10 +110,11 @@ export class AuthVerifier {
     if (!jwtStr) {
       throw new AuthRequiredError('missing jwt', 'MissingJwt')
     }
+    const nsid = parseReqNsid(reqCtx.req)
     const payload = await verifyJwt(
       jwtStr,
       this.serviceDid,
-      null,
+      nsid,
       getSigningKey,
     )
     const iss = payload.iss

package/src/context.ts

@@ -84,11 +84,11 @@ export class AppContext {
       didCache,
     })
 
-    const createAuthHeaders = (aud: string) =>
+    const createAuthHeaders = (aud: string, lxm: string) =>
       createServiceAuthHeaders({
         iss: `${cfg.service.did}#atproto_labeler`,
         aud,
-        lxm: null,
+        lxm,
         keypair: signingKey,
       })
 
@@ -226,32 +226,32 @@ export class AppContext {
     return this.opts.authVerifier
   }
 
-  async serviceAuthHeaders(aud: string) {
+  async serviceAuthHeaders(aud: string, lxm: string) {
     const iss = `${this.cfg.service.did}#atproto_labeler`
     return createServiceAuthHeaders({
       iss,
       aud,
-      lxm: null,
+      lxm,
       keypair: this.signingKey,
     })
   }
 
-  async pdsAuth() {
+  async pdsAuth(lxm: string) {
     if (!this.cfg.pds) {
       return undefined
     }
-    return this.serviceAuthHeaders(this.cfg.pds.did)
+    return this.serviceAuthHeaders(this.cfg.pds.did, lxm)
   }
 
-  async appviewAuth() {
-    return this.serviceAuthHeaders(this.cfg.appview.did)
+  async appviewAuth(lxm: string) {
+    return this.serviceAuthHeaders(this.cfg.appview.did, lxm)
   }
 
-  async chatAuth() {
+  async chatAuth(lxm: string) {
     if (!this.cfg.chat) {
       throw new Error('No chat service configured')
     }
-    return this.serviceAuthHeaders(this.cfg.chat.did)
+    return this.serviceAuthHeaders(this.cfg.chat.did, lxm)
   }
 
   devOverride(overrides: Partial<AppContextOptions>) {

package/src/daemon/context.ts

@@ -39,11 +39,11 @@ export class DaemonContext {
     })
 
     const appviewAgent = new AtpAgent({ service: cfg.appview.url })
-    const createAuthHeaders = (aud: string) =>
+    const createAuthHeaders = (aud: string, lxm: string) =>
       createServiceAuthHeaders({
         iss: `${cfg.service.did}#atproto_labeler`,
         aud,
-        lxm: null,
+        lxm,
         keypair: signingKey,
       })
 

package/src/daemon/event-pusher.ts

@@ -8,6 +8,7 @@ import { dbLogger } from '../logger'
 import { InputSchema } from '../lexicon/types/com/atproto/admin/updateSubjectStatus'
 import { BlobPushEvent } from '../db/schema/blob_push_event'
 import { Insertable, Selectable } from 'kysely'
+import { ids } from '../lexicon/lexicons'
 
 type EventSubject = InputSchema['subject']
 
@@ -45,7 +46,10 @@ export class EventPusher {
 
   constructor(
     public db: Database,
-    public createAuthHeaders: (aud: string) => Promise<AuthHeaders>,
+    public createAuthHeaders: (
+      aud: string,
+      method: string,
+    ) => Promise<AuthHeaders>,
     services: {
       appview?: {
         url: string
@@ -162,7 +166,10 @@ export class EventPusher {
     subject: EventSubject,
     takedownRef: string | null,
   ): Promise<boolean> {
-    const auth = await this.createAuthHeaders(service.did)
+    const auth = await this.createAuthHeaders(
+      service.did,
+      ids.ComAtprotoAdminUpdateSubjectStatus,
+    )
     try {
       await retryHttp(() =>
         service.agent.com.atproto.admin.updateSubjectStatus(

package/src/db/migrations/20240814T003647759Z-event-created-at-index.ts

@@ -0,0 +1,13 @@
+import { Kysely } from 'kysely'
+
+export async function up(db: Kysely<unknown>): Promise<void> {
+  await db.schema
+    .createIndex('moderation_event_created_at_idx')
+    .on('moderation_event')
+    .column('createdAt')
+    .execute()
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+  await db.schema.dropIndex('moderation_event_created_at_idx').execute()
+}

package/src/db/migrations/index.ts

@@ -10,3 +10,4 @@ export * as _20240228T003647759Z from './20240228T003647759Z-add-label-sigs'
 export * as _20240408T192432676Z from './20240408T192432676Z-mute-reporting'
 export * as _20240506T225055595Z from './20240506T225055595Z-message-subject'
 export * as _20240430T211332580Z from './20240521T211332580Z-member'
+export * as _20240814T003647759Z from './20240814T003647759Z-event-created-at-index'

package/src/mod-service/index.ts

@@ -49,6 +49,7 @@ import { ImageInvalidator } from '../image-invalidator'
 import { httpLogger as log } from '../logger'
 import { OzoneConfig } from '../config'
 import { LABELER_HEADER_NAME, ParsedLabelers } from '../util'
+import { ids } from '../lexicon/lexicons'
 
 export type ModerationServiceCreator = (db: Database) => ModerationService
 
@@ -62,7 +63,10 @@ export class ModerationService {
     public idResolver: IdResolver,
     public eventPusher: EventPusher,
     public appviewAgent: AtpAgent,
-    private createAuthHeaders: (aud: string) => Promise<AuthHeaders>,
+    private createAuthHeaders: (
+      aud: string,
+      method: string,
+    ) => Promise<AuthHeaders>,
     public imgInvalidator?: ImageInvalidator,
   ) {}
 
@@ -74,7 +78,7 @@ export class ModerationService {
     idResolver: IdResolver,
     eventPusher: EventPusher,
     appviewAgent: AtpAgent,
-    createAuthHeaders: (aud: string) => Promise<AuthHeaders>,
+    createAuthHeaders: (aud: string, method: string) => Promise<AuthHeaders>,
     imgInvalidator?: ImageInvalidator,
   ) {
     return (db: Database) =>
@@ -97,8 +101,11 @@ export class ModerationService {
     this.signingKey,
     this.signingKeyId,
     this.appviewAgent,
-    async (labelers?: ParsedLabelers) => {
-      const authHeaders = await this.createAuthHeaders(this.cfg.appview.did)
+    async (method: string, labelers?: ParsedLabelers) => {
+      const authHeaders = await this.createAuthHeaders(
+        this.cfg.appview.did,
+        method,
+      )
       if (labelers?.dids?.length) {
         authHeaders.headers[LABELER_HEADER_NAME] = labelers.dids.join(', ')
       }
@@ -936,7 +943,10 @@ export class ModerationService {
       },
       {
         encoding: 'application/json',
-        ...(await this.createAuthHeaders(serverInfo.did)),
+        ...(await this.createAuthHeaders(
+          serverInfo.did,
+          ids.ComAtprotoAdminSendEmail,
+        )),
       },
     )
     if (!delivery.sent) {

package/src/mod-service/views.ts

@@ -29,6 +29,7 @@ import { LabelRow } from '../db/schema/label'
 import { dbLogger } from '../logger'
 import { httpLogger } from '../logger'
 import { ParsedLabelers } from '../util'
+import { ids } from '../lexicon/lexicons'
 
 export type AuthHeaders = {
   headers: {
@@ -43,12 +44,12 @@ export class ModerationViews {
     private signingKey: Keypair,
     private signingKeyId: number,
     private appviewAgent: AtpAgent,
-    private appviewAuth: () => Promise<AuthHeaders>,
+    private appviewAuth: (method: string) => Promise<AuthHeaders>,
   ) {}
 
   async getAccoutInfosByDid(dids: string[]): Promise<Map<string, AccountView>> {
     if (dids.length === 0) return new Map()
-    const auth = await this.appviewAuth()
+    const auth = await this.appviewAuth(ids.ComAtprotoAdminGetAccountInfos)
     if (!auth) return new Map()
     try {
       const res = await this.appviewAgent.api.com.atproto.admin.getAccountInfos(
@@ -236,7 +237,7 @@ export class ModerationViews {
   async fetchRecords(
     subjects: RecordSubject[],
   ): Promise<Map<string, RecordInfo>> {
-    const auth = await this.appviewAuth()
+    const auth = await this.appviewAuth(ids.ComAtprotoRepoGetRecord)
     if (!auth) return new Map()
     const fetched = await Promise.all(
       subjects.map(async (subject) => {
@@ -547,7 +548,7 @@ export class ModerationViews {
   async fetchAuthorFeed(
     actor: string,
   ): Promise<AppBskyFeedDefs.FeedViewPost[]> {
-    const auth = await this.appviewAuth()
+    const auth = await this.appviewAuth(ids.AppBskyFeedGetAuthorFeed)
     if (!auth) return []
     const {
       data: { feed },

package/src/team/index.ts

@@ -7,6 +7,7 @@ import { InvalidRequestError } from '@atproto/xrpc-server'
 import { chunkArray } from '@atproto/common'
 import AppContext from '../context'
 import { httpLogger } from '../logger'
+import { ids } from '../lexicon/lexicons'
 
 export type TeamServiceCreator = (db: Database) => TeamService
 
@@ -168,7 +169,7 @@ export class TeamService {
     const profiles = new Map<string, ProfileViewDetailed>()
 
     try {
-      const headers = await ctx.appviewAuth()
+      const headers = await ctx.appviewAuth(ids.AppBskyActorGetProfiles)
 
       for (const actors of chunkArray(dids, 25)) {
         const { data } = await ctx.appviewAgent.api.app.bsky.actor.getProfiles(

package/tests/3p-labeler.test.ts

@@ -9,6 +9,7 @@ import {
 import { AtpAgent } from '@atproto/api'
 import { Secp256k1Keypair } from '@atproto/crypto'
 import { LABELER_HEADER_NAME } from '../src/util'
+import { ids } from '../src/lexicon/lexicons'
 
 describe('labels from 3p labelers', () => {
   let network: TestNetwork
@@ -170,11 +171,17 @@ describe('labels from 3p labelers', () => {
       ] = await Promise.all([
         agent.api.tools.ozone.moderation.getRecord(
           { uri: sc.posts[sc.dids.alice][0].ref.uriStr },
-          { headers: await ozone.modHeaders() },
+          {
+            headers: await ozone.modHeaders(ids.ToolsOzoneModerationGetRecord),
+          },
         ),
         thirdPartyAgent.api.tools.ozone.moderation.getRecord(
           { uri: sc.posts[sc.dids.alice][0].ref.uriStr },
-          { headers: await thirdPartyLabeler.modHeaders() },
+          {
+            headers: await thirdPartyLabeler.modHeaders(
+              ids.ToolsOzoneModerationGetRecord,
+            ),
+          },
         ),
       ])
 
@@ -189,7 +196,9 @@ describe('labels from 3p labelers', () => {
     })
 
     it('includes labels from all authorities requested via header', async () => {
-      const authHeaders = await ozone.modHeaders()
+      const authHeaders = await ozone.modHeaders(
+        ids.ToolsOzoneModerationGetRecord,
+      )
       const { data: recordIncludingExternalLabels } =
         await agent.api.tools.ozone.moderation.getRecord(
           { uri: sc.posts[sc.dids.alice][0].ref.uriStr },
@@ -225,11 +234,17 @@ describe('labels from 3p labelers', () => {
         await Promise.all([
           agent.api.tools.ozone.moderation.getRepo(
             { did: sc.dids.alice },
-            { headers: await ozone.modHeaders() },
+            {
+              headers: await ozone.modHeaders(ids.ToolsOzoneModerationGetRepo),
+            },
           ),
           thirdPartyAgent.api.tools.ozone.moderation.getRepo(
             { did: sc.dids.alice },
-            { headers: await thirdPartyLabeler.modHeaders() },
+            {
+              headers: await thirdPartyLabeler.modHeaders(
+                ids.ToolsOzoneModerationGetRepo,
+              ),
+            },
           ),
         ])
 
@@ -244,7 +259,9 @@ describe('labels from 3p labelers', () => {
     })
 
     it('includes labels from all authorities requested via header', async () => {
-      const authHeaders = await ozone.modHeaders()
+      const authHeaders = await ozone.modHeaders(
+        ids.ToolsOzoneModerationGetRepo,
+      )
       const { data: recordIncludingExternalLabels } =
         await agent.api.tools.ozone.moderation.getRepo(
           { did: sc.dids.alice },

package/tests/communication-templates.test.ts

@@ -1,5 +1,6 @@
 import { TestNetwork, SeedClient, basicSeed } from '@atproto/dev-env'
 import { AtpAgent } from '@atproto/api'
+import { ids } from '../src/lexicon/lexicons'
 
 describe('communication-templates', () => {
   let network: TestNetwork
@@ -30,7 +31,10 @@ describe('communication-templates', () => {
     const { data } = await agent.api.tools.ozone.communication.listTemplates(
       {},
       {
-        headers: await network.ozone.modHeaders('moderator'),
+        headers: await network.ozone.modHeaders(
+          ids.ToolsOzoneCommunicationListTemplates,
+          'moderator',
+        ),
       },
     )
     return data.communicationTemplates
@@ -42,7 +46,10 @@ describe('communication-templates', () => {
         { ...templateOne, createdBy: sc.dids.bob },
         {
           encoding: 'application/json',
-          headers: await network.ozone.modHeaders('triage'),
+          headers: await network.ozone.modHeaders(
+            ids.ToolsOzoneCommunicationCreateTemplate,
+            'triage',
+          ),
         },
       )
       await expect(moderatorReq).rejects.toThrow(
@@ -52,7 +59,10 @@ describe('communication-templates', () => {
         { ...templateOne, createdBy: sc.dids.bob },
         {
           encoding: 'application/json',
-          headers: await network.ozone.modHeaders('admin'),
+          headers: await network.ozone.modHeaders(
+            ids.ToolsOzoneCommunicationCreateTemplate,
+            'admin',
+          ),
         },
       )
 
@@ -76,7 +86,10 @@ describe('communication-templates', () => {
         { ...templateTwo, createdBy: sc.dids.bob },
         {
           encoding: 'application/json',
-          headers: await network.ozone.modHeaders('admin'),
+          headers: await network.ozone.modHeaders(
+            ids.ToolsOzoneCommunicationCreateTemplate,
+            'admin',
+          ),
         },
       )
 
@@ -91,7 +104,10 @@ describe('communication-templates', () => {
         { id: '1', updatedBy: sc.dids.bob, name: '1 Test template' },
         {
           encoding: 'application/json',
-          headers: await network.ozone.modHeaders('admin'),
+          headers: await network.ozone.modHeaders(
+            ids.ToolsOzoneCommunicationUpdateTemplate,
+            'admin',
+          ),
         },
       )
 
@@ -105,7 +121,10 @@ describe('communication-templates', () => {
         { id: '1' },
         {
           encoding: 'application/json',
-          headers: await network.ozone.modHeaders('triage'),
+          headers: await network.ozone.modHeaders(
+            ids.ToolsOzoneCommunicationDeleteTemplate,
+            'triage',
+          ),
         },
       )
 
@@ -117,7 +136,10 @@ describe('communication-templates', () => {
         { id: '1' },
         {
           encoding: 'application/json',
-          headers: await network.ozone.modHeaders('moderator'),
+          headers: await network.ozone.modHeaders(
+            ids.ToolsOzoneCommunicationDeleteTemplate,
+            'moderator',
+          ),
         },
       )
       const list = await listTemplates()

package/tests/get-config.test.ts

@@ -1,6 +1,7 @@
 import { TestNetwork, SeedClient, basicSeed } from '@atproto/dev-env'
 import { AtpAgent } from '@atproto/api'
 import { TOOLS_OZONE_TEAM } from '../src/lexicon'
+import { ids } from '../src/lexicon/lexicons'
 
 describe('get-config', () => {
   let network: TestNetwork
@@ -25,7 +26,10 @@ describe('get-config', () => {
     const { data } = await agent.api.tools.ozone.server.getConfig(
       {},
       {
-        headers: await network.ozone.modHeaders(role),
+        headers: await network.ozone.modHeaders(
+          ids.ToolsOzoneServerGetConfig,
+          role,
+        ),
       },
     )
     return data

package/tests/get-lists.test.ts

@@ -8,6 +8,7 @@ import {
 } from '@atproto/dev-env'
 import { AtpAgent, BSKY_LABELER_DID } from '@atproto/api'
 import { TAKEDOWN_LABEL } from '../src/mod-service'
+import { ids } from '../src/lexicon/lexicons'
 
 describe('admin get lists', () => {
   let network: TestNetwork
@@ -42,7 +43,7 @@ describe('admin get lists', () => {
     const [{ data: fromOzone }, { data: fromAppview }] = await Promise.all([
       agent.api.app.bsky.graph.getLists(
         { actor: sc.dids.alice },
-        { headers: await ozone.modHeaders() },
+        { headers: await ozone.modHeaders(ids.AppBskyGraphGetLists) },
       ),
       appviewAgent.api.app.bsky.graph.getLists({ actor: sc.dids.alice }),
     ])

package/tests/get-record.test.ts

@@ -12,6 +12,7 @@ import {
   REASONSPAM,
 } from '../src/lexicon/types/com/atproto/moderation/defs'
 import { forSnapshot } from './_util'
+import { ids } from '../src/lexicon/lexicons'
 
 describe('admin get record view', () => {
   let network: TestNetwork
@@ -72,7 +73,7 @@ describe('admin get record view', () => {
   it('gets a record by uri, even when taken down.', async () => {
     const result = await agent.api.tools.ozone.moderation.getRecord(
       { uri: sc.posts[sc.dids.alice][0].ref.uriStr },
-      { headers: await ozone.modHeaders() },
+      { headers: await ozone.modHeaders(ids.ToolsOzoneModerationGetRecord) },
     )
     expect(forSnapshot(result.data)).toMatchSnapshot()
   })
@@ -83,7 +84,7 @@ describe('admin get record view', () => {
         uri: sc.posts[sc.dids.alice][0].ref.uriStr,
         cid: sc.posts[sc.dids.alice][0].ref.cidStr,
       },
-      { headers: await ozone.modHeaders() },
+      { headers: await ozone.modHeaders(ids.ToolsOzoneModerationGetRecord) },
     )
     expect(forSnapshot(result.data)).toMatchSnapshot()
   })
@@ -97,7 +98,7 @@ describe('admin get record view', () => {
           'badrkey',
         ).toString(),
       },
-      { headers: await ozone.modHeaders() },
+      { headers: await ozone.modHeaders(ids.ToolsOzoneModerationGetRecord) },
     )
     await expect(promise).rejects.toThrow('Record not found')
   })
@@ -108,7 +109,7 @@ describe('admin get record view', () => {
         uri: sc.posts[sc.dids.alice][0].ref.uriStr,
         cid: sc.posts[sc.dids.alice][1].ref.cidStr, // Mismatching cid
       },
-      { headers: await ozone.modHeaders() },
+      { headers: await ozone.modHeaders(ids.ToolsOzoneModerationGetRecord) },
     )
     await expect(promise).rejects.toThrow('Record not found')
   })