@atproto/ozone 0.2.9 → 0.2.11

package/src/api/moderation/scheduleAction.ts

@@ -1,129 +0,0 @@
-import { ToolsOzoneModerationScheduleAction } from '@atproto/api'
-import { AuthRequiredError, InvalidRequestError } from '@atproto/xrpc-server'
-import { AppContext } from '../../context.js'
-import { Server } from '../../lexicon/index.js'
-import { subjectFromInput } from '../../mod-service/subject.js'
-import { ExecutionSchedule } from '../../scheduled-action/types.js'
-import { getScheduledActionType } from '../util.js'
-import { ScheduledTakedownTag } from './util.js'
-
-export default function (server: Server, ctx: AppContext) {
-  server.tools.ozone.moderation.scheduleAction({
-    auth: ctx.authVerifier.modOrAdminToken,
-    handler: async ({ input, auth }) => {
-      const access = auth.credentials
-      const db = ctx.db
-      const { action, subjects, createdBy, scheduling, modTool } = input.body
-
-      if (!access.isModerator) {
-        throw new AuthRequiredError('Must be a moderator to schedule actions')
-      }
-
-      if (access.type === 'admin_token' && !createdBy) {
-        throw new AuthRequiredError(
-          'Must specify createdBy when using admin auth',
-        )
-      }
-
-      const actionType = getScheduledActionType(
-        action.$type?.split('#')[1] || '',
-      )
-
-      const succeeded: string[] = []
-      const failed: ToolsOzoneModerationScheduleAction.FailedScheduling[] = []
-
-      // Defining alternatively required fields is not supported by lexicons so we need to manually validate here
-      if (!scheduling.executeAt && !scheduling.executeAfter) {
-        throw new InvalidRequestError('Must specify an execution schedule')
-      }
-
-      const executionSchedule: ExecutionSchedule = scheduling.executeAt
-        ? { executeAt: new Date(scheduling.executeAt) }
-        : {
-            executeAfter: new Date(scheduling.executeAfter!),
-            executeUntil: scheduling.executeUntil
-              ? new Date(scheduling.executeUntil)
-              : undefined,
-          }
-
-      const eventData = { ...action, modTool }
-      const actualCreatedBy =
-        access.type === 'admin_token' ? createdBy : access.iss
-
-      const now = new Date()
-      for (const subject of subjects) {
-        try {
-          await db.transaction(async (tx) => {
-            const modService = ctx.modService(tx)
-            const scheduledActionService = ctx.scheduledActionService(tx)
-            // register the action in database
-            await scheduledActionService.scheduleAction({
-              action: actionType,
-              eventData,
-              did: subject,
-              createdBy: actualCreatedBy,
-              ...executionSchedule,
-            })
-            // log an event in the mod event stream
-            if (ToolsOzoneModerationScheduleAction.isTakedown(action)) {
-              await modService.logEvent({
-                event: {
-                  $type: 'tools.ozone.moderation.defs#scheduleTakedownEvent',
-                  executeAfter: scheduling.executeAfter,
-                  executeUntil: scheduling.executeUntil,
-                  executeAt: scheduling.executeAt,
-                  comment: action.comment,
-                },
-                subject: subjectFromInput({
-                  did: subject,
-                  $type: 'com.atproto.admin.defs#repoRef',
-                }),
-                createdBy: actualCreatedBy,
-                createdAt: now,
-                modTool,
-              })
-              await modService.logEvent({
-                event: {
-                  $type: 'tools.ozone.moderation.defs#modEventTag',
-                  add: [ScheduledTakedownTag],
-                  remove: [],
-                },
-                subject: subjectFromInput({
-                  did: subject,
-                  $type: 'com.atproto.admin.defs#repoRef',
-                }),
-                createdBy,
-                createdAt: now,
-              })
-            }
-            succeeded.push(subject)
-          })
-        } catch (error) {
-          let errorMessage = 'Unknown error'
-          let errorCode: string | undefined
-
-          if (error instanceof InvalidRequestError) {
-            errorMessage = error.message
-            errorCode = 'InvalidRequest'
-          } else if (error instanceof Error) {
-            errorMessage = error.message
-          }
-
-          failed.push({
-            subject,
-            error: errorMessage,
-            errorCode,
-          })
-        }
-      }
-
-      return {
-        encoding: 'application/json',
-        body: {
-          succeeded,
-          failed,
-        },
-      }
-    },
-  })
-}

package/src/api/moderation/searchRepos.ts

@@ -1,46 +0,0 @@
-import { mapDefined } from '@atproto/common'
-import { AppContext } from '../../context.js'
-import { Server } from '../../lexicon/index.js'
-import { ids } from '../../lexicon/lexicons.js'
-
-export default function (server: Server, ctx: AppContext) {
-  server.tools.ozone.moderation.searchRepos({
-    auth: ctx.authVerifier.modOrAdminToken,
-    handler: async ({ params }) => {
-      const modService = ctx.modService(ctx.db)
-
-      // prefer new 'q' query param over deprecated 'term'
-      const query = params.q ?? params.term
-
-      // special case for did searches - do exact match
-      if (query?.startsWith('did:')) {
-        const repos = await modService.views.repos([query])
-        const found = repos.get(query)
-        return {
-          encoding: 'application/json',
-          body: {
-            repos: found ? [found] : [],
-          },
-        }
-      }
-
-      const res = await ctx.appviewAgent.api.app.bsky.actor.searchActors(
-        params,
-        await ctx.appviewAuth(ids.AppBskyActorSearchActors),
-      )
-      const repoMap = await modService.views.repos(
-        res.data.actors.map((a) => a.did),
-      )
-      const repos = mapDefined(res.data.actors, (actor) =>
-        repoMap.get(actor.did),
-      )
-      return {
-        encoding: 'application/json',
-        body: {
-          cursor: res.data.cursor,
-          repos,
-        },
-      }
-    },
-  })
-}

package/src/api/moderation/util.ts

@@ -1,96 +0,0 @@
-import { InvalidRequestError } from '@atproto/xrpc-server'
-import { ProtectedTagSettingKey } from '../../setting/constants.js'
-import { SettingService } from '../../setting/service.js'
-import { ProtectedTagSetting } from '../../setting/types.js'
-
-export const getProtectedTags = async (
-  settingService: SettingService,
-  serviceDid: string,
-) => {
-  const protectedTagSetting = await settingService.query({
-    keys: [ProtectedTagSettingKey],
-    scope: 'instance',
-    did: serviceDid,
-    limit: 1,
-  })
-
-  // if no protected tags are configured, then no need to do further check
-  if (!protectedTagSetting.options.length) {
-    return
-  }
-
-  return protectedTagSetting.options[0].value as ProtectedTagSetting
-}
-
-export const assertProtectedTagAction = ({
-  protectedTags,
-  subjectTags,
-  actionAuthor,
-  isModerator,
-  isAdmin,
-  isTriage,
-}: {
-  protectedTags: ProtectedTagSetting
-  subjectTags: string[]
-  actionAuthor: string
-  isModerator: boolean
-  isAdmin: boolean
-  isTriage: boolean
-}) => {
-  subjectTags.forEach((tag) => {
-    if (!Object.hasOwn(protectedTags, tag)) return
-    if (
-      protectedTags[tag]['moderators'] &&
-      !protectedTags[tag]['moderators'].includes(actionAuthor)
-    ) {
-      throw new InvalidRequestError(
-        `Not allowed to action on protected tag: ${tag}`,
-      )
-    }
-
-    if (protectedTags[tag]['roles']) {
-      if (isAdmin) {
-        if (
-          protectedTags[tag]['roles'].includes(
-            'tools.ozone.team.defs#roleAdmin',
-          )
-        ) {
-          return
-        }
-        throw new InvalidRequestError(
-          `Not allowed to action on protected tag: ${tag}`,
-        )
-      }
-
-      if (isModerator) {
-        if (
-          protectedTags[tag]['roles'].includes(
-            'tools.ozone.team.defs#roleModerator',
-          )
-        ) {
-          return
-        }
-
-        throw new InvalidRequestError(
-          `Not allowed to action on protected tag: ${tag}`,
-        )
-      }
-
-      if (isTriage) {
-        if (
-          protectedTags[tag]['roles'].includes(
-            'tools.ozone.team.defs#roleTriage',
-          )
-        ) {
-          return
-        }
-
-        throw new InvalidRequestError(
-          `Not allowed to action on protected tag: ${tag}`,
-        )
-      }
-    }
-  })
-}
-
-export const ScheduledTakedownTag = 'scheduled-takedown'

package/src/api/proxied.ts

@@ -1,327 +0,0 @@
-import { AppContext } from '../context.js'
-import { Server } from '../lexicon/index.js'
-import { ids } from '../lexicon/lexicons.js'
-
-export default function (server: Server, ctx: AppContext) {
-  server.app.bsky.actor.getProfile({
-    auth: ctx.authVerifier.moderator,
-    handler: async (request) => {
-      const res = await ctx.appviewAgent.app.bsky.actor.getProfile(
-        request.params,
-        await ctx.appviewAuth(ids.AppBskyActorGetProfile),
-      )
-      return {
-        encoding: 'application/json',
-        body: res.data,
-      }
-    },
-  })
-
-  server.app.bsky.actor.getProfiles({
-    auth: ctx.authVerifier.modOrAdminToken,
-    handler: async (request) => {
-      const res = await ctx.appviewAgent.app.bsky.actor.getProfiles(
-        request.params,
-        await ctx.appviewAuth(ids.AppBskyActorGetProfiles),
-      )
-      return {
-        encoding: 'application/json',
-        body: res.data,
-      }
-    },
-  })
-
-  server.app.bsky.feed.getAuthorFeed({
-    auth: ctx.authVerifier.modOrAdminToken,
-    handler: async (request) => {
-      const res = await ctx.appviewAgent.app.bsky.feed.getAuthorFeed(
-        request.params,
-        await ctx.appviewAuth(ids.AppBskyFeedGetAuthorFeed),
-      )
-      return {
-        encoding: 'application/json',
-        body: res.data,
-      }
-    },
-  })
-
-  server.app.bsky.feed.searchPosts({
-    auth: ctx.authVerifier.moderator,
-    handler: async (request) => {
-      const res = await ctx.appviewAgent.app.bsky.feed.searchPosts(
-        request.params,
-        await ctx.appviewAuth(ids.AppBskyFeedSearchPosts),
-      )
-      return {
-        encoding: 'application/json',
-        body: res.data,
-      }
-    },
-  })
-
-  server.app.bsky.feed.getPostThread({
-    auth: ctx.authVerifier.modOrAdminToken,
-    handler: async (request) => {
-      const res = await ctx.appviewAgent.app.bsky.feed.getPostThread(
-        request.params,
-        await ctx.appviewAuth(ids.AppBskyFeedGetPostThread),
-      )
-      return {
-        encoding: 'application/json',
-        body: res.data,
-      }
-    },
-  })
-
-  server.app.bsky.feed.getFeedGenerator({
-    auth: ctx.authVerifier.moderator,
-    handler: async (request) => {
-      const res = await ctx.appviewAgent.app.bsky.feed.getFeedGenerator(
-        request.params,
-        await ctx.appviewAuth(ids.AppBskyFeedGetFeedGenerator),
-      )
-      return {
-        encoding: 'application/json',
-        body: res.data,
-      }
-    },
-  })
-
-  server.app.bsky.graph.getFollows({
-    auth: ctx.authVerifier.modOrAdminToken,
-    handler: async (request) => {
-      const res = await ctx.appviewAgent.app.bsky.graph.getFollows(
-        request.params,
-        await ctx.appviewAuth(ids.AppBskyGraphGetFollows),
-      )
-      return {
-        encoding: 'application/json',
-        body: res.data,
-      }
-    },
-  })
-
-  server.app.bsky.graph.getFollowers({
-    auth: ctx.authVerifier.modOrAdminToken,
-    handler: async (request) => {
-      const res = await ctx.appviewAgent.app.bsky.graph.getFollowers(
-        request.params,
-        await ctx.appviewAuth(ids.AppBskyGraphGetFollowers),
-      )
-      return {
-        encoding: 'application/json',
-        body: res.data,
-      }
-    },
-  })
-
-  server.app.bsky.graph.getList({
-    auth: ctx.authVerifier.modOrAdminToken,
-    handler: async (request) => {
-      const res = await ctx.appviewAgent.app.bsky.graph.getList(
-        request.params,
-        await ctx.appviewAuth(ids.AppBskyGraphGetList),
-      )
-      return {
-        encoding: 'application/json',
-        body: res.data,
-      }
-    },
-  })
-
-  server.app.bsky.graph.getLists({
-    auth: ctx.authVerifier.modOrAdminToken,
-    handler: async (request) => {
-      const res = await ctx.appviewAgent.app.bsky.graph.getLists(
-        request.params,
-        await ctx.appviewAuth(ids.AppBskyGraphGetLists),
-      )
-      return {
-        encoding: 'application/json',
-        body: res.data,
-      }
-    },
-  })
-
-  server.com.atproto.admin.searchAccounts({
-    auth: ctx.authVerifier.moderator,
-    handler: async (request) => {
-      if (!ctx.pdsAgent) {
-        throw new Error('PDS not configured')
-      }
-      const res = await ctx.pdsAgent.com.atproto.admin.searchAccounts(
-        request.params,
-        await ctx.pdsAuth(ids.ComAtprotoAdminSearchAccounts),
-      )
-      return {
-        encoding: 'application/json',
-        body: res.data,
-      }
-    },
-  })
-
-  server.com.atproto.temp.revokeAccountCredentials({
-    auth: ctx.authVerifier.moderator,
-    handler: async (request) => {
-      if (!ctx.pdsAgent) {
-        throw new Error('PDS not configured')
-      }
-      await ctx.pdsAgent.com.atproto.temp.revokeAccountCredentials(
-        request.input.body,
-        await ctx.pdsAuth(ids.ComAtprotoTempRevokeAccountCredentials),
-      )
-    },
-  })
-
-  server.tools.ozone.hosting.getAccountHistory({
-    auth: ctx.authVerifier.moderator,
-    handler: async (request) => {
-      if (!ctx.pdsAgent) {
-        throw new Error('PDS not configured')
-      }
-      const res = await ctx.pdsAgent.tools.ozone.hosting.getAccountHistory(
-        request.params,
-        await ctx.pdsAuth(ids.ToolsOzoneHostingGetAccountHistory),
-      )
-      return {
-        encoding: 'application/json',
-        body: res.data,
-      }
-    },
-  })
-
-  server.tools.ozone.signature.findRelatedAccounts({
-    auth: ctx.authVerifier.moderator,
-    handler: async (request) => {
-      if (!ctx.pdsAgent) {
-        throw new Error('PDS not configured')
-      }
-      const res = await ctx.pdsAgent.tools.ozone.signature.findRelatedAccounts(
-        request.params,
-        await ctx.pdsAuth(ids.ToolsOzoneSignatureFindRelatedAccounts),
-      )
-      return {
-        encoding: 'application/json',
-        body: res.data,
-      }
-    },
-  })
-
-  server.tools.ozone.signature.searchAccounts({
-    auth: ctx.authVerifier.moderator,
-    handler: async (request) => {
-      if (!ctx.pdsAgent) {
-        throw new Error('PDS not configured')
-      }
-      const res = await ctx.pdsAgent.tools.ozone.signature.searchAccounts(
-        request.params,
-        await ctx.pdsAuth(ids.ToolsOzoneSignatureSearchAccounts),
-      )
-      return {
-        encoding: 'application/json',
-        body: res.data,
-      }
-    },
-  })
-
-  server.tools.ozone.signature.findCorrelation({
-    auth: ctx.authVerifier.moderator,
-    handler: async (request) => {
-      if (!ctx.pdsAgent) {
-        throw new Error('PDS not configured')
-      }
-      const res = await ctx.pdsAgent.tools.ozone.signature.findCorrelation(
-        request.params,
-        await ctx.pdsAuth(ids.ToolsOzoneSignatureFindCorrelation),
-      )
-      return {
-        encoding: 'application/json',
-        body: res.data,
-      }
-    },
-  })
-
-  server.app.bsky.graph.getStarterPack({
-    auth: ctx.authVerifier.modOrAdminToken,
-    handler: async (request) => {
-      const res = await ctx.appviewAgent.api.app.bsky.graph.getStarterPack(
-        request.params,
-        await ctx.appviewAuth(ids.AppBskyGraphGetStarterPack),
-      )
-      return {
-        encoding: 'application/json',
-        body: res.data,
-      }
-    },
-  })
-
-  server.app.bsky.graph.getStarterPacks({
-    auth: ctx.authVerifier.modOrAdminToken,
-    handler: async (request) => {
-      const res = await ctx.appviewAgent.app.bsky.graph.getStarterPacks(
-        request.params,
-        await ctx.appviewAuth(ids.AppBskyGraphGetStarterPacks),
-      )
-      return {
-        encoding: 'application/json',
-        body: res.data,
-      }
-    },
-  })
-
-  server.app.bsky.graph.getActorStarterPacks({
-    auth: ctx.authVerifier.modOrAdminToken,
-    handler: async (request) => {
-      const res = await ctx.appviewAgent.app.bsky.graph.getActorStarterPacks(
-        request.params,
-        await ctx.appviewAuth(ids.AppBskyGraphGetActorStarterPacks),
-      )
-      return {
-        encoding: 'application/json',
-        body: res.data,
-      }
-    },
-  })
-
-  server.app.bsky.feed.getLikes({
-    auth: ctx.authVerifier.modOrAdminToken,
-    handler: async (request) => {
-      const res = await ctx.appviewAgent.app.bsky.feed.getLikes(
-        request.params,
-        await ctx.appviewAuth(ids.AppBskyFeedGetLikes),
-      )
-      return {
-        encoding: 'application/json',
-        body: res.data,
-      }
-    },
-  })
-
-  server.app.bsky.feed.getRepostedBy({
-    auth: ctx.authVerifier.moderator,
-    handler: async (request) => {
-      const res = await ctx.appviewAgent.app.bsky.feed.getRepostedBy(
-        request.params,
-        await ctx.appviewAuth(ids.AppBskyFeedGetRepostedBy),
-      )
-      return {
-        encoding: 'application/json',
-        body: res.data,
-      }
-    },
-  })
-
-  server.app.bsky.actor.searchActorsTypeahead({
-    auth: ctx.authVerifier.moderator,
-    handler: async (request) => {
-      const res = await ctx.appviewAgent.app.bsky.actor.searchActorsTypeahead(
-        request.params,
-        await ctx.appviewAuth(ids.AppBskyActorSearchActorsTypeahead),
-      )
-      return {
-        encoding: 'application/json',
-        body: res.data,
-      }
-    },
-  })
-}

package/src/api/queue/assignModerator.ts

@@ -1,31 +0,0 @@
-import { ForbiddenError } from '@atproto/xrpc-server'
-import { AppContext } from '../../context.js'
-import { Server } from '../../lexicon/index.js'
-import { getAuthDid } from '../util.js'
-
-export default function (server: Server, ctx: AppContext) {
-  server.tools.ozone.queue.assignModerator({
-    auth: ctx.authVerifier.modOrAdminToken,
-    handler: async ({ input, auth }) => {
-      const { queueId, did } = input.body
-      const authDid = getAuthDid(auth, ctx.cfg.service.did)
-
-      // RBAC
-      if (!auth.credentials.isModerator) {
-        throw new ForbiddenError('Unauthorized')
-      }
-
-      // RuBAC
-      if (did !== authDid && !auth.credentials.isAdmin) {
-        throw new ForbiddenError('Unauthorized')
-      }
-
-      const result = await ctx.assignmentService.assignQueue({ did, queueId })
-
-      return {
-        encoding: 'application/json',
-        body: result,
-      }
-    },
-  })
-}

package/src/api/queue/createQueue.ts

@@ -1,62 +0,0 @@
-import { AuthRequiredError, InvalidRequestError } from '@atproto/xrpc-server'
-import { AppContext } from '../../context.js'
-import { Server } from '../../lexicon/index.js'
-
-const VALID_SUBJECT_TYPES = ['account', 'record', 'message']
-
-export default function (server: Server, ctx: AppContext) {
-  server.tools.ozone.queue.createQueue({
-    auth: ctx.authVerifier.modOrAdminToken,
-    handler: async ({ input, auth }) => {
-      const access = auth.credentials
-
-      if (!access.isModerator) {
-        throw new AuthRequiredError('Must be a moderator to create a queue')
-      }
-
-      const { name, subjectTypes, collection, reportTypes, description } =
-        input.body
-      const createdBy =
-        access.type === 'admin_token' ? 'admin_token' : access.iss
-
-      const invalidTypes = subjectTypes.filter(
-        (t) => !VALID_SUBJECT_TYPES.includes(t),
-      )
-      if (invalidTypes.length > 0) {
-        throw new InvalidRequestError(
-          `Invalid subject types: ${invalidTypes.join(', ')}. Allowed values: ${VALID_SUBJECT_TYPES.join(', ')}`,
-          'InvalidSubjectType',
-        )
-      }
-
-      if (collection && !subjectTypes.includes('record')) {
-        throw new InvalidRequestError(
-          'collection can only be specified when subjectTypes includes "record"',
-          'InvalidCollection',
-        )
-      }
-
-      const queueService = ctx.queueService(ctx.db)
-
-      await queueService.checkConflict({
-        subjectTypes,
-        collection,
-        reportTypes,
-      })
-
-      const queue = await queueService.create({
-        name,
-        subjectTypes,
-        collection,
-        reportTypes,
-        description,
-        createdBy,
-      })
-
-      return {
-        encoding: 'application/json',
-        body: { queue: queueService.view(queue) },
-      }
-    },
-  })
-}