@atproto/ozone 0.1.56 → 0.1.58

package/src/setting/validators.ts

@@ -0,0 +1,61 @@
+import { Selectable } from 'kysely'
+import { Setting } from '../db/schema/setting'
+import { ProtectedTagSettingKey } from './constants'
+import { InvalidRequestError } from '@atproto/xrpc-server'
+
+export const settingValidators = new Map<
+  string,
+  (setting: Partial<Selectable<Setting>>) => Promise<void>
+>([
+  [
+    ProtectedTagSettingKey,
+    async (setting: Partial<Selectable<Setting>>) => {
+      if (setting.managerRole !== 'tools.ozone.team.defs#roleAdmin') {
+        throw new InvalidRequestError(
+          'Only admins should be able to configure protected tags',
+        )
+      }
+
+      if (typeof setting.value !== 'object') {
+        throw new InvalidRequestError('Invalid value')
+      }
+      for (const [key, val] of Object.entries(setting.value)) {
+        if (!val || typeof val !== 'object') {
+          throw new InvalidRequestError(`Invalid configuration for tag ${key}`)
+        }
+
+        if (!val['roles'] && !val['moderators']) {
+          throw new InvalidRequestError(
+            `Must define who a list of moderators or a role who can action subjects with ${key} tag`,
+          )
+        }
+
+        if (val['roles']) {
+          if (!Array.isArray(val['roles'])) {
+            throw new InvalidRequestError(
+              `Roles must be an array of moderator roles for tag ${key}`,
+            )
+          }
+          if (!val['roles']?.length) {
+            throw new InvalidRequestError(
+              `Must define at least one role for tag ${key}`,
+            )
+          }
+        }
+
+        if (val['moderators']) {
+          if (!Array.isArray(val['moderators'])) {
+            throw new InvalidRequestError(
+              `Moderators must be an array of moderator DIDs for tag ${key}`,
+            )
+          }
+          if (!val['moderators']?.length) {
+            throw new InvalidRequestError(
+              `Must define at least one moderator DID for tag ${key}`,
+            )
+          }
+        }
+      }
+    },
+  ],
+])

package/tests/__snapshots__/moderation-events.test.ts.snap

@@ -197,3 +197,126 @@ Array [
   },
 ]
 `;
+
+exports[`moderation-events query events returns events matching multiple keywords in comment 1`] = `
+Array [
+  Object {
+    "createdAt": "1970-01-01T00:00:00.000Z",
+    "createdBy": "user(1)",
+    "creatorHandle": "bob.test",
+    "event": Object {
+      "$type": "tools.ozone.moderation.defs#modEventReport",
+      "comment": "rainy days feel lazy",
+      "isReporterMuted": false,
+      "reportType": "com.atproto.moderation.defs#reasonSpam",
+    },
+    "id": 16,
+    "subject": Object {
+      "$type": "com.atproto.admin.defs#repoRef",
+      "did": "user(0)",
+    },
+    "subjectBlobCids": Array [],
+    "subjectHandle": "alice.test",
+  },
+  Object {
+    "createdAt": "1970-01-01T00:00:00.000Z",
+    "createdBy": "user(1)",
+    "creatorHandle": "bob.test",
+    "event": Object {
+      "$type": "tools.ozone.moderation.defs#modEventReport",
+      "comment": "november rain",
+      "isReporterMuted": false,
+      "reportType": "com.atproto.moderation.defs#reasonSpam",
+    },
+    "id": 15,
+    "subject": Object {
+      "$type": "com.atproto.admin.defs#repoRef",
+      "did": "user(0)",
+    },
+    "subjectBlobCids": Array [],
+    "subjectHandle": "alice.test",
+  },
+]
+`;
+
+exports[`moderation-events query events returns events matching multiple keywords in comment 2`] = `
+Array [
+  Object {
+    "createdAt": "1970-01-01T00:00:00.000Z",
+    "createdBy": "user(1)",
+    "creatorHandle": "bob.test",
+    "event": Object {
+      "$type": "tools.ozone.moderation.defs#modEventReport",
+      "comment": "rainy days feel lazy",
+      "isReporterMuted": false,
+      "reportType": "com.atproto.moderation.defs#reasonSpam",
+    },
+    "id": 16,
+    "subject": Object {
+      "$type": "com.atproto.admin.defs#repoRef",
+      "did": "user(0)",
+    },
+    "subjectBlobCids": Array [],
+    "subjectHandle": "alice.test",
+  },
+  Object {
+    "createdAt": "1970-01-01T00:00:00.000Z",
+    "createdBy": "user(1)",
+    "creatorHandle": "bob.test",
+    "event": Object {
+      "$type": "tools.ozone.moderation.defs#modEventReport",
+      "comment": "november rain",
+      "isReporterMuted": false,
+      "reportType": "com.atproto.moderation.defs#reasonSpam",
+    },
+    "id": 15,
+    "subject": Object {
+      "$type": "com.atproto.admin.defs#repoRef",
+      "did": "user(0)",
+    },
+    "subjectBlobCids": Array [],
+    "subjectHandle": "alice.test",
+  },
+]
+`;
+
+exports[`moderation-events query events returns events matching multiple keywords in comment 3`] = `
+Array [
+  Object {
+    "createdAt": "1970-01-01T00:00:00.000Z",
+    "createdBy": "user(1)",
+    "creatorHandle": "bob.test",
+    "event": Object {
+      "$type": "tools.ozone.moderation.defs#modEventReport",
+      "comment": "rainy days feel lazy",
+      "isReporterMuted": false,
+      "reportType": "com.atproto.moderation.defs#reasonSpam",
+    },
+    "id": 16,
+    "subject": Object {
+      "$type": "com.atproto.admin.defs#repoRef",
+      "did": "user(0)",
+    },
+    "subjectBlobCids": Array [],
+    "subjectHandle": "alice.test",
+  },
+  Object {
+    "createdAt": "1970-01-01T00:00:00.000Z",
+    "createdBy": "user(1)",
+    "creatorHandle": "bob.test",
+    "event": Object {
+      "$type": "tools.ozone.moderation.defs#modEventReport",
+      "comment": "november rain",
+      "isReporterMuted": false,
+      "reportType": "com.atproto.moderation.defs#reasonSpam",
+    },
+    "id": 15,
+    "subject": Object {
+      "$type": "com.atproto.admin.defs#repoRef",
+      "did": "user(0)",
+    },
+    "subjectBlobCids": Array [],
+    "subjectHandle": "alice.test",
+  },
+]
+`;

package/tests/ack-all-subjects-of-account.test.ts

@@ -35,28 +35,28 @@ describe('moderation', () => {
     cid: ref.cidStr,
   })
 
-  beforeAll(async () => {
-    network = await TestNetwork.create({
-      dbPostgresSchema: 'ozone_ack_all_subjects_of_account',
+  const getReviewStateBySubject = (subjects: SubjectStatusView[]) => {
+    const states = new Map<string, SubjectStatusView>()
+
+    subjects.forEach((item) => {
+      if (ComAtprotoRepoStrongRef.isMain(item.subject)) {
+        states.set(item.subject.uri, item)
+      } else if (isRepoRef(item.subject)) {
+        states.set(item.subject.did, item)
+      }
     })
-    sc = network.getSeedClient()
-    modClient = network.ozone.getModClient()
-    await basicSeed(sc)
-    await network.processAll()
-  })
 
-  afterAll(async () => {
-    await network.close()
-  })
+    return states
+  }
 
-  it('acknowledges all open/escalated review subjects.', async () => {
-    const postOne = sc.posts[sc.dids.bob][0].ref
-    const postTwo = sc.posts[sc.dids.bob][1].ref
+  const reportUserAndPost = async (did: string) => {
+    const postOne = sc.posts[did][0].ref
+    const postTwo = sc.posts[did][1].ref
     await Promise.all([
       sc.createReport({
         reasonType: REASONSPAM,
-        subject: repoSubject(sc.dids.bob),
-        reportedBy: sc.dids.alice,
+        subject: repoSubject(did),
+        reportedBy: sc.dids.carol,
       }),
       sc.createReport({
         reasonType: REASONOTHER,
@@ -71,7 +71,6 @@ describe('moderation', () => {
         reportedBy: sc.dids.carol,
       }),
     ])
-
     await modClient.emitEvent({
       event: {
         $type: 'tools.ozone.moderation.defs#modEventReport',
@@ -80,6 +79,26 @@ describe('moderation', () => {
       subject: recordSubject(postTwo),
     })
 
+    return { postOne, postTwo }
+  }
+
+  beforeAll(async () => {
+    network = await TestNetwork.create({
+      dbPostgresSchema: 'ozone_ack_all_subjects_of_account',
+    })
+    sc = network.getSeedClient()
+    modClient = network.ozone.getModClient()
+    await basicSeed(sc)
+    await network.processAll()
+  })
+
+  afterAll(async () => {
+    await network.close()
+  })
+
+  it('acknowledges all open/escalated review subjects with takedown.', async () => {
+    const { postOne, postTwo } = await reportUserAndPost(sc.dids.bob)
+
     const { subjectStatuses: statusesBefore } = await modClient.queryStatuses({
       subject: sc.dids.bob,
       includeAllUserRecords: true,
@@ -95,19 +114,46 @@ describe('moderation', () => {
       includeAllUserRecords: true,
     })
 
-    const getReviewStateBySubject = (subjects: SubjectStatusView[]) => {
-      const states = new Map<string, SubjectStatusView>()
+    const reviewStatesBefore = getReviewStateBySubject(statusesBefore)
+    const reviewStatesAfter = getReviewStateBySubject(statusesAfter)
+
+    // Check that review states before were different for different subjects
+    expect(reviewStatesBefore.get(postOne.uriStr)?.reviewState).toBe(REVIEWOPEN)
+    expect(reviewStatesBefore.get(postTwo.uriStr)?.reviewState).toBe(
+      REVIEWESCALATED,
+    )
+    expect(reviewStatesBefore.get(sc.dids.bob)?.reviewState).toBe(REVIEWOPEN)
 
-      subjects.forEach((item) => {
-        if (ComAtprotoRepoStrongRef.isMain(item.subject)) {
-          states.set(item.subject.uri, item)
-        } else if (isRepoRef(item.subject)) {
-          states.set(item.subject.did, item)
-        }
-      })
+    // Check that review states after are all closed
+    expect(reviewStatesAfter.get(postOne.uriStr)?.reviewState).toBe(
+      REVIEWCLOSED,
+    )
+    expect(reviewStatesAfter.get(postTwo.uriStr)?.reviewState).toBe(
+      REVIEWCLOSED,
+    )
+    expect(reviewStatesAfter.get(sc.dids.bob)?.reviewState).toBe(REVIEWCLOSED)
+  })
 
-      return states
-    }
+  it('acknowledges all open/escalated review subjects with acknowledge.', async () => {
+    const { postOne, postTwo } = await reportUserAndPost(sc.dids.alice)
+
+    const { subjectStatuses: statusesBefore } = await modClient.queryStatuses({
+      subject: sc.dids.alice,
+      includeAllUserRecords: true,
+    })
+
+    await modClient.emitEvent({
+      subject: repoSubject(sc.dids.alice),
+      event: {
+        $type: 'tools.ozone.moderation.defs#modEventAcknowledge',
+        acknowledgeAccountSubjects: true,
+      },
+    })
+
+    const { subjectStatuses: statusesAfter } = await modClient.queryStatuses({
+      subject: sc.dids.alice,
+      includeAllUserRecords: true,
+    })
 
     const reviewStatesBefore = getReviewStateBySubject(statusesBefore)
     const reviewStatesAfter = getReviewStateBySubject(statusesAfter)
@@ -117,7 +163,7 @@ describe('moderation', () => {
     expect(reviewStatesBefore.get(postTwo.uriStr)?.reviewState).toBe(
       REVIEWESCALATED,
     )
-    expect(reviewStatesBefore.get(sc.dids.bob)?.reviewState).toBe(REVIEWOPEN)
+    expect(reviewStatesBefore.get(sc.dids.alice)?.reviewState).toBe(REVIEWOPEN)
 
     // Check that review states after are all closed
     expect(reviewStatesAfter.get(postOne.uriStr)?.reviewState).toBe(
@@ -126,6 +172,6 @@ describe('moderation', () => {
     expect(reviewStatesAfter.get(postTwo.uriStr)?.reviewState).toBe(
       REVIEWCLOSED,
     )
-    expect(reviewStatesAfter.get(sc.dids.bob)?.reviewState).toBe(REVIEWCLOSED)
+    expect(reviewStatesAfter.get(sc.dids.alice)?.reviewState).toBe(REVIEWCLOSED)
   })
 })

package/tests/moderation-events.test.ts

@@ -224,6 +224,46 @@ describe('moderation-events', () => {
       expect(eventsWithComment.events.length).toEqual(10)
     })
 
+    it('returns events matching multiple keywords in comment', async () => {
+      await sc.createReport({
+        reasonType: REASONSPAM,
+        reason: 'november rain',
+        subject: {
+          $type: 'com.atproto.admin.defs#repoRef',
+          did: sc.dids.alice,
+        },
+        reportedBy: sc.dids.bob,
+      })
+      await sc.createReport({
+        reasonType: REASONSPAM,
+        reason: 'rainy days feel lazy',
+        subject: {
+          $type: 'com.atproto.admin.defs#repoRef',
+          did: sc.dids.alice,
+        },
+        reportedBy: sc.dids.bob,
+      })
+      const [eventsMatchingBothKeywords, unusedTrailingSeparator, extraSpaces] =
+        await Promise.all([
+          modClient.queryEvents({
+            hasComment: true,
+            comment: 'november||lazy',
+          }),
+          modClient.queryEvents({
+            hasComment: true,
+            comment: 'november||lazy||',
+          }),
+          modClient.queryEvents({
+            hasComment: true,
+            comment: '||november||lazy||  ',
+          }),
+        ])
+
+      expect(forSnapshot(eventsMatchingBothKeywords.events)).toMatchSnapshot()
+      expect(forSnapshot(unusedTrailingSeparator.events)).toMatchSnapshot()
+      expect(forSnapshot(extraSpaces.events)).toMatchSnapshot()
+    })
+
     it('returns events matching filter params for labels', async () => {
       const [negatedLabelEvent, createdLabelEvent] = await Promise.all([
         modClient.emitEvent({

package/tests/protected-tags.test.ts

@@ -0,0 +1,201 @@
+import {
+  TestNetwork,
+  SeedClient,
+  basicSeed,
+  ModeratorClient,
+} from '@atproto/dev-env'
+import { ProtectedTagSettingKey } from '../src/setting/constants'
+import {
+  ROLEADMIN,
+  ROLEMODERATOR,
+} from '../dist/lexicon/types/tools/ozone/team/defs'
+
+describe('protected-tags', () => {
+  let network: TestNetwork
+  let sc: SeedClient
+  let modClient: ModeratorClient
+  const basicSetting = {
+    key: ProtectedTagSettingKey,
+    scope: 'instance',
+  }
+
+  beforeAll(async () => {
+    network = await TestNetwork.create({
+      dbPostgresSchema: 'ozone_protected_tags',
+    })
+    sc = network.getSeedClient()
+    modClient = network.ozone.getModClient()
+    await basicSeed(sc)
+    await network.processAll()
+  })
+
+  afterAll(async () => {
+    await network.close()
+  })
+
+  describe('Settings management', () => {
+    it('validates settings', async () => {
+      await expect(
+        modClient.upsertSettingOption({
+          ...basicSetting,
+          managerRole: ROLEMODERATOR,
+          value: {
+            vip: {},
+          },
+        }),
+      ).rejects.toThrow(
+        'Only admins should be able to configure protected tags',
+      )
+      await expect(
+        modClient.upsertSettingOption({
+          ...basicSetting,
+          managerRole: ROLEADMIN,
+          value: ['test'],
+        }),
+      ).rejects.toThrow('Invalid configuration')
+      await expect(
+        modClient.upsertSettingOption({
+          ...basicSetting,
+          managerRole: ROLEADMIN,
+          value: { vip: 'test' },
+        }),
+      ).rejects.toThrow('Invalid configuration')
+      await expect(
+        modClient.upsertSettingOption({
+          ...basicSetting,
+          managerRole: ROLEADMIN,
+          value: { vip: { weirdValue: 1 } },
+        }),
+      ).rejects.toThrow(/Must define who a list of moderators or a role/gi)
+      await expect(
+        modClient.upsertSettingOption({
+          ...basicSetting,
+          managerRole: ROLEADMIN,
+          value: { vip: { roles: 'test' } },
+        }),
+      ).rejects.toThrow(/Roles must be an array of moderator/gi)
+      await expect(
+        modClient.upsertSettingOption({
+          ...basicSetting,
+          managerRole: ROLEADMIN,
+          value: { vip: { roles: 'test' } },
+        }),
+      ).rejects.toThrow(/Roles must be an array of moderator/gi)
+      await expect(
+        modClient.upsertSettingOption({
+          ...basicSetting,
+          managerRole: ROLEADMIN,
+          value: { vip: { moderators: 1 } },
+        }),
+      ).rejects.toThrow(/Moderators must be an array of moderator/gi)
+    })
+  })
+  describe('Protected subject via tags', () => {
+    afterEach(async () => {
+      await modClient.removeSettingOptions({
+        keys: [ProtectedTagSettingKey],
+        scope: 'instance',
+      })
+    })
+    it('only allows configured roles to add/remove protected tags', async () => {
+      await modClient.upsertSettingOption({
+        ...basicSetting,
+        managerRole: ROLEADMIN,
+        value: { vip: { roles: ['tools.ozone.team.defs#roleAdmin'] } },
+      })
+
+      await expect(
+        modClient.emitEvent({
+          subject: {
+            $type: 'com.atproto.admin.defs#repoRef',
+            did: sc.dids.bob,
+          },
+          event: {
+            $type: 'tools.ozone.moderation.defs#modEventTag',
+            add: ['vip'],
+            remove: [],
+          },
+        }),
+      ).rejects.toThrow(/Can not manage tag vip/gi)
+
+      await modClient.emitEvent(
+        {
+          subject: {
+            $type: 'com.atproto.admin.defs#repoRef',
+            did: sc.dids.bob,
+          },
+          event: {
+            $type: 'tools.ozone.moderation.defs#modEventTag',
+            add: ['vip'],
+            remove: [],
+          },
+        },
+        'admin',
+      )
+      await expect(
+        modClient.emitEvent({
+          subject: {
+            $type: 'com.atproto.admin.defs#repoRef',
+            did: sc.dids.bob,
+          },
+          event: {
+            $type: 'tools.ozone.moderation.defs#modEventTag',
+            add: [],
+            remove: ['vip'],
+          },
+        }),
+      ).rejects.toThrow(/Can not manage tag vip/gi)
+    })
+    it('only allows configured moderators to add/remove protected tags', async () => {
+      await modClient.upsertSettingOption({
+        ...basicSetting,
+        managerRole: ROLEADMIN,
+        value: { vip: { moderators: [network.ozone.adminAccnt.did] } },
+      })
+
+      // By default, this query is made with moderator account's did
+      await expect(
+        modClient.emitEvent({
+          subject: {
+            $type: 'com.atproto.admin.defs#repoRef',
+            did: sc.dids.bob,
+          },
+          event: {
+            $type: 'tools.ozone.moderation.defs#modEventTag',
+            add: ['vip'],
+            remove: [],
+          },
+        }),
+      ).rejects.toThrow(/Not allowed to manage tag: vip/gi)
+
+      await modClient.emitEvent(
+        {
+          subject: {
+            $type: 'com.atproto.admin.defs#repoRef',
+            did: sc.dids.bob,
+          },
+          event: {
+            $type: 'tools.ozone.moderation.defs#modEventTag',
+            add: ['vip'],
+            remove: [],
+          },
+        },
+        'admin',
+      )
+
+      await expect(
+        modClient.emitEvent({
+          subject: {
+            $type: 'com.atproto.admin.defs#repoRef',
+            did: sc.dids.bob,
+          },
+          event: {
+            $type: 'tools.ozone.moderation.defs#modEventTag',
+            add: [],
+            remove: ['vip'],
+          },
+        }),
+      ).rejects.toThrow(/Not allowed to manage tag: vip/gi)
+    })
+  })
+})