@atproto/ozone 0.2.9 → 0.2.11

package/src/auth-verifier.ts

@@ -1,227 +0,0 @@
-import express from 'express'
-import * as ui8 from 'uint8arrays'
-import { IdResolver } from '@atproto/identity'
-import {
-  AuthRequiredError,
-  parseReqNsid,
-  verifyJwt,
-} from '@atproto/xrpc-server'
-import { TeamService } from './team/index.js'
-
-type ReqCtx = {
-  req: express.Request
-}
-
-export type AdminTokenOutput = {
-  credentials: {
-    type: 'admin_token'
-    isAdmin: true
-    isModerator: true
-    isTriage: true
-    isVerifier: true
-  }
-}
-
-export type ModeratorOutput = {
-  credentials: {
-    type: 'moderator'
-    aud: string
-    iss: string
-    isAdmin: boolean
-    isModerator: boolean
-    isTriage: boolean
-    isVerifier: boolean
-  }
-}
-
-type StandardOutput = {
-  credentials: {
-    type: 'standard'
-    aud: string
-    iss: string
-    isAdmin: boolean
-    isModerator: boolean
-    isTriage: boolean
-    isVerifier: boolean
-  }
-}
-
-type NullOutput = {
-  credentials: {
-    type: 'none'
-    iss: null
-  }
-}
-
-export type AuthVerifierOpts = {
-  serviceDid: string
-  adminPassword: string
-  teamService: TeamService
-}
-
-export class AuthVerifier {
-  serviceDid: string
-  teamService: TeamService
-  private adminPassword: string
-
-  constructor(
-    public idResolver: IdResolver,
-    opts: AuthVerifierOpts,
-  ) {
-    this.serviceDid = opts.serviceDid
-    this.adminPassword = opts.adminPassword
-    this.teamService = opts.teamService
-  }
-
-  modOrAdminToken = async (
-    reqCtx: ReqCtx,
-  ): Promise<ModeratorOutput | AdminTokenOutput> => {
-    if (isBasicToken(reqCtx.req)) {
-      return this.adminToken(reqCtx)
-    } else {
-      return this.moderator(reqCtx)
-    }
-  }
-
-  moderator = async (reqCtx: ReqCtx): Promise<ModeratorOutput> => {
-    const creds = await this.standard(reqCtx)
-    if (!creds.credentials.isTriage && !creds.credentials.isVerifier) {
-      throw new AuthRequiredError('not a moderator account')
-    }
-    return {
-      credentials: {
-        ...creds.credentials,
-        type: 'moderator',
-      },
-    }
-  }
-
-  standard = async (reqCtx: ReqCtx): Promise<StandardOutput> => {
-    const getSigningKey = async (
-      did: string,
-      forceRefresh: boolean,
-    ): Promise<string> => {
-      const atprotoData = await this.idResolver.did.resolveAtprotoData(
-        did,
-        forceRefresh,
-      )
-      return atprotoData.signingKey
-    }
-
-    const jwtStr = getJwtStrFromReq(reqCtx.req)
-    if (!jwtStr) {
-      throw new AuthRequiredError('missing jwt', 'MissingJwt')
-    }
-    const nsid = parseReqNsid(reqCtx.req)
-    const payload = await verifyJwt(
-      jwtStr,
-      this.serviceDid,
-      nsid,
-      getSigningKey,
-    )
-    const iss = payload.iss
-
-    const member = await this.teamService.getMember(iss)
-
-    if (member?.disabled) {
-      throw new AuthRequiredError('member is disabled', 'MemberDisabled')
-    }
-
-    const { isAdmin, isModerator, isTriage, isVerifier } =
-      this.teamService.getMemberRole(member)
-
-    return {
-      credentials: {
-        type: 'standard',
-        iss,
-        aud: payload.aud,
-        isAdmin,
-        isModerator,
-        isTriage,
-        isVerifier,
-      },
-    }
-  }
-
-  standardOptional = async (
-    reqCtx: ReqCtx,
-  ): Promise<StandardOutput | NullOutput> => {
-    if (isBearerToken(reqCtx.req)) {
-      return this.standard(reqCtx)
-    }
-    return this.nullCreds()
-  }
-
-  standardOptionalOrAdminToken = async (
-    reqCtx: ReqCtx,
-  ): Promise<StandardOutput | AdminTokenOutput | NullOutput> => {
-    if (isBearerToken(reqCtx.req)) {
-      return this.standard(reqCtx)
-    } else if (isBasicToken(reqCtx.req)) {
-      return this.adminToken(reqCtx)
-    } else {
-      return this.nullCreds()
-    }
-  }
-
-  adminToken = async (reqCtx: ReqCtx): Promise<AdminTokenOutput> => {
-    const parsed = parseBasicAuth(reqCtx.req.headers.authorization ?? '')
-    const { username, password } = parsed ?? {}
-    if (username !== 'admin' || password !== this.adminPassword) {
-      throw new AuthRequiredError()
-    }
-    return {
-      credentials: {
-        type: 'admin_token',
-        isAdmin: true,
-        isModerator: true,
-        isTriage: true,
-        isVerifier: true,
-      },
-    }
-  }
-
-  nullCreds(): NullOutput {
-    return {
-      credentials: {
-        type: 'none',
-        iss: null,
-      },
-    }
-  }
-}
-
-const BEARER = 'Bearer '
-const BASIC = 'Basic '
-
-const isBearerToken = (req: express.Request): boolean => {
-  return req.headers.authorization?.startsWith(BEARER) ?? false
-}
-
-const isBasicToken = (req: express.Request): boolean => {
-  return req.headers.authorization?.startsWith(BASIC) ?? false
-}
-
-export const getJwtStrFromReq = (req: express.Request): string | null => {
-  const { authorization } = req.headers
-  if (!authorization?.startsWith(BEARER)) {
-    return null
-  }
-  return authorization.slice(BEARER.length).trim()
-}
-
-export const parseBasicAuth = (
-  token: string,
-): { username: string; password: string } | null => {
-  if (!token.startsWith(BASIC)) return null
-  const b64 = token.slice(BASIC.length)
-  let parsed: string[]
-  try {
-    parsed = ui8.toString(ui8.fromString(b64, 'base64pad'), 'utf8').split(':')
-  } catch (err) {
-    return null
-  }
-  const [username, password] = parsed
-  if (!username || !password) return null
-  return { username, password }
-}

package/src/background.ts

@@ -1,183 +0,0 @@
-import PQueue from 'p-queue'
-import { Database } from './db/index.js'
-import { dbLogger } from './logger.js'
-import {
-  boundAbortController,
-  isCausedBySignal,
-  startInterval,
-} from './util.js'
-
-type Task = (db: Database, signal: AbortSignal) => Promise<void>
-
-export type BackgroundQueueOptions = NonNullable<
-  ConstructorParameters<typeof PQueue>[0]
-> & {
-  concurrency: number
-}
-
-/**
- * A simple queue for in-process, out-of-band/backgrounded work
- */
-// @NOTE Keep this in sync with the BackgroundQueue in
-// - packages/bsky/src/data-plane/server/background.ts
-// - packages/ozone/src/background.ts
-// - packages/pds/src/background.ts
-export class BackgroundQueue {
-  private abortController = new AbortController()
-  private queue: PQueue
-
-  public get signal(): AbortSignal {
-    return this.abortController.signal
-  }
-
-  public get destroyed() {
-    return this.signal.aborted
-  }
-
-  constructor(
-    protected db: Database,
-    options: BackgroundQueueOptions,
-  ) {
-    this.queue = new PQueue(options)
-  }
-
-  getStats() {
-    return {
-      runningCount: this.queue.pending,
-      waitingCount: this.queue.size,
-    }
-  }
-
-  /**
-   * Add a task that will be executed at some point in the future.
-   *
-   * The task will be executed even if the backgroundQueue is destroyed, unless
-   * the provided `signal` is aborted.
-   *
-   * The `signal` provided to the task will be aborted whenever either the
-   * backgroundQueue is destroyed or the provided `signal` is aborted.
-   */
-  async add(task: Task, signal?: AbortSignal): Promise<void> {
-    if (this.destroyed) {
-      return
-    }
-
-    const abortController = boundAbortController(this.signal, signal)
-
-    return this.queue.add<void>(async () => {
-      try {
-        // Do not run the task if the signal provided to the task has become
-        // aborted. Do not use `abortController.signal` here since we do not
-        // want to abort the task if the backgroundQueue is being destroyed.
-        if (signal?.aborted) return
-
-        // The task will receive a "combined signal" allowing it to abort if
-        // either the backgroundQueue is destroyed or the provided signal is
-        // aborted.
-        await task(this.db, abortController.signal)
-      } catch (err) {
-        if (!isCausedBySignal(err, abortController.signal)) {
-          dbLogger.error({ err }, 'background queue task failed')
-        }
-      } finally {
-        abortController.abort()
-      }
-    })
-  }
-
-  async processAll() {
-    const { queue } = this
-    while (queue.size || queue.pending) await queue.onIdle()
-  }
-
-  /**
-   * On destroy we stop accepting new tasks, but complete all
-   * pending/in-progress tasks. Tasks can decide to abort their current
-   * operation based on the signal they received. The application calls this
-   * only once http connections have drained (tasks no longer being added).
-   */
-  async destroy() {
-    if (this.destroyed) {
-      dbLogger.warn('BackgroundQueue.destroy() called multiple times')
-    }
-
-    this.abortController.abort()
-    return this.processAll()
-  }
-}
-
-/**
- * A simple periodic background task runner. This class will schedule a task to
- * run through a provided {@link BackgroundQueue} at a fixed interval. The task
- * will never run more than once concurrently, and will wait at least `interval`
- * milliseconds between the end of one run and the start of the next.
- */
-export class PeriodicBackgroundTask {
-  private abortController: AbortController
-
-  private intervalPromise?: Promise<void>
-  private runningPromise?: Promise<void>
-
-  public get signal(): AbortSignal {
-    return this.abortController.signal
-  }
-
-  public get destroyed() {
-    return this.signal.aborted
-  }
-
-  constructor(
-    protected backgroundQueue: BackgroundQueue,
-    protected interval: number,
-    protected task: Task,
-  ) {
-    if (!Number.isFinite(interval) || interval <= 0) {
-      throw new TypeError('interval must be a positive number')
-    }
-
-    // Bind this class's signal to the backgroundQueue's signal (destroying this
-    // instance if the backgroundQueue is destroyed)
-    this.abortController = boundAbortController(backgroundQueue.signal)
-  }
-
-  public run(signal?: AbortSignal): Promise<void> {
-    // `startInterval` already ensures that only one run is in progress at a
-    // time. However, we want to be able to expose a `run()` method that can be
-    // used to force a run, which could cause concurrent executions. We prevent
-    // this using the `runningPromise` property.
-
-    if (this.runningPromise) return this.runningPromise
-
-    // Combine the `this.signal` with the provided `signal`, if any.
-    const abortController = boundAbortController(this.signal, signal)
-
-    const promise = this.backgroundQueue.add(this.task, abortController.signal)
-
-    return (this.runningPromise = promise).finally(() => {
-      if (this.runningPromise === promise) this.runningPromise = undefined
-
-      // Cleanup the listeners added by `boundAbortController`
-      abortController.abort()
-    })
-  }
-
-  public start() {
-    // Noop if already started. Throws if this.signal is aborted (instance is
-    // destroyed).
-    this.intervalPromise ||= startInterval(
-      async (signal) => this.run(signal),
-      this.interval,
-      this.signal,
-    )
-  }
-
-  public async destroy() {
-    // @NOTE This instance does not "own" the backgroundQueue, so we do not
-    // destroy it here.
-
-    this.abortController.abort()
-
-    await this.intervalPromise
-    this.intervalPromise = undefined
-  }
-}

package/src/communication-service/template.ts

@@ -1,110 +0,0 @@
-import { Selectable } from 'kysely'
-import { Database } from '../db/index.js'
-import { CommunicationTemplate } from '../db/schema/communication_template.js'
-import { TemplateView } from '../lexicon/types/tools/ozone/communication/defs.js'
-
-export type CommunicationTemplateServiceCreator = (
-  db: Database,
-) => CommunicationTemplateService
-
-export class CommunicationTemplateService {
-  constructor(public db: Database) {}
-
-  static creator() {
-    return (db: Database) => new CommunicationTemplateService(db)
-  }
-
-  async list(): Promise<Selectable<CommunicationTemplate>[]> {
-    const list = await this.db.db
-      .selectFrom('communication_template')
-      .selectAll()
-      .execute()
-
-    return list
-  }
-
-  async create({
-    name,
-    contentMarkdown,
-    subject,
-    lang,
-    disabled,
-    updatedAt,
-    createdAt,
-    lastUpdatedBy,
-  }: Omit<
-    Selectable<CommunicationTemplate>,
-    'id' | 'createdAt' | 'updatedAt'
-  > & {
-    createdAt?: Date
-    updatedAt?: Date
-  }): Promise<Selectable<CommunicationTemplate>> {
-    const newTemplate = await this.db.db
-      .insertInto('communication_template')
-      .values({
-        name,
-        contentMarkdown,
-        subject,
-        lang,
-        disabled,
-        lastUpdatedBy,
-        updatedAt: updatedAt || new Date(),
-        createdAt: createdAt || new Date(),
-      })
-      .returningAll()
-      .executeTakeFirstOrThrow()
-
-    return newTemplate
-  }
-
-  async update(
-    id: number,
-    {
-      name,
-      contentMarkdown,
-      subject,
-      disabled,
-      lang,
-      updatedAt,
-      lastUpdatedBy,
-    }: Partial<Omit<Selectable<CommunicationTemplate>, 'id' | 'createdAt'>>,
-  ): Promise<Selectable<CommunicationTemplate>> {
-    const updatedTemplate = await this.db.db
-      .updateTable('communication_template')
-      .where('id', '=', id)
-      .set({
-        name,
-        contentMarkdown,
-        subject,
-        lang,
-        disabled,
-        lastUpdatedBy,
-        updatedAt: updatedAt || new Date(),
-      })
-      .returningAll()
-      .executeTakeFirstOrThrow()
-
-    return updatedTemplate
-  }
-
-  async delete(id: number): Promise<void> {
-    await this.db.db
-      .deleteFrom('communication_template')
-      .where('id', '=', id)
-      .execute()
-  }
-
-  view(template: Selectable<CommunicationTemplate>): TemplateView {
-    return {
-      id: `${template.id}`,
-      name: template.name,
-      contentMarkdown: template.contentMarkdown,
-      disabled: template.disabled,
-      lang: template.lang || undefined,
-      subject: template.subject || undefined,
-      createdAt: template.createdAt.toISOString(),
-      updatedAt: template.updatedAt.toISOString(),
-      lastUpdatedBy: template.lastUpdatedBy,
-    }
-  }
-}

package/src/communication-service/util.ts

@@ -1,8 +0,0 @@
-// Postgresql will throw a specific error code with the constraint when trying to create a template with duplicate name
-// see https://www.postgresql.org/docs/current/errcodes-appendix.html
-export const isDuplicateTemplateNameError = (err: any) => {
-  return (
-    err?.['code'] === '23505' &&
-    err?.['constraint'] === 'communication_template_unique_name'
-  )
-}