@atproto/pds 0.4.216 → 0.4.218

package/src/account-manager/helpers/account.ts

@@ -1,6 +1,14 @@
 import { DAY } from '@atproto/common'
+import {
+  AtIdentifierString,
+  DatetimeString,
+  DidString,
+  HandleString,
+  currentDatetimeString,
+  isDidIdentifier,
+} from '@atproto/lex'
 import { isErrUniqueViolation, notSoftDeletedClause } from '../../db'
-import { StatusAttr } from '../../lexicon/types/com/atproto/admin/defs'
+import { com } from '../../lexicons/index.js'
 import { AccountDb, ActorEntry } from '../db'
 
 export class UserAlreadyExistsError extends Error {}
@@ -49,12 +57,12 @@ export const selectAccountQB = (db: AccountDb, flags?: AvailabilityFlags) => {
 
 export const getAccount = async (
   db: AccountDb,
-  handleOrDid: string,
+  handleOrDid: AtIdentifierString,
   flags?: AvailabilityFlags,
 ): Promise<ActorAccount | null> => {
   const found = await selectAccountQB(db, flags)
     .where((qb) => {
-      if (handleOrDid.startsWith('did:')) {
+      if (isDidIdentifier(handleOrDid)) {
         return qb.where('actor.did', '=', handleOrDid)
       } else {
         return qb.where('actor.handle', '=', handleOrDid)
@@ -66,7 +74,7 @@ export const getAccount = async (
 
 export const getAccounts = async (
   db: AccountDb,
-  dids: string[],
+  dids: DidString[],
   flags?: AvailabilityFlags,
 ): Promise<Map<string, ActorAccount>> => {
   const results = new Map<string, ActorAccount>()
@@ -100,8 +108,8 @@ export const getAccountByEmail = async (
 export const registerActor = async (
   db: AccountDb,
   opts: {
-    did: string
-    handle: string
+    did: DidString
+    handle: HandleString
     deactivated?: boolean
   },
 ) => {
@@ -153,7 +161,7 @@ export const registerAccount = async (
 
 export const deleteAccount = async (
   db: AccountDb,
-  did: string,
+  did: DidString,
 ): Promise<void> => {
   // Not done in transaction because it would be too long, prone to contention.
   // Also, this can safely be run multiple times if it fails.
@@ -176,8 +184,8 @@ export const deleteAccount = async (
 
 export const updateHandle = async (
   db: AccountDb,
-  did: string,
-  handle: string,
+  did: DidString,
+  handle: HandleString,
 ) => {
   const [res] = await db.executeWithRetry(
     db.db
@@ -195,7 +203,7 @@ export const updateHandle = async (
 
 export const updateEmail = async (
   db: AccountDb,
-  did: string,
+  did: DidString,
   email: string,
 ) => {
   try {
@@ -218,8 +226,8 @@ export const updateEmail = async (
 
 export const setEmailConfirmedAt = async (
   db: AccountDb,
-  did: string,
-  emailConfirmedAt: string,
+  did: DidString,
+  emailConfirmedAt: DatetimeString,
 ) => {
   await db.executeWithRetry(
     db.db
@@ -231,8 +239,11 @@ export const setEmailConfirmedAt = async (
 
 export const getAccountAdminStatus = async (
   db: AccountDb,
-  did: string,
-): Promise<{ takedown: StatusAttr; deactivated: StatusAttr } | null> => {
+  did: DidString,
+): Promise<{
+  takedown: com.atproto.admin.defs.StatusAttr
+  deactivated: com.atproto.admin.defs.StatusAttr
+} | null> => {
   const res = await db.db
     .selectFrom('actor')
     .select(['takedownRef', 'deactivatedAt'])
@@ -248,11 +259,11 @@ export const getAccountAdminStatus = async (
 
 export const updateAccountTakedownStatus = async (
   db: AccountDb,
-  did: string,
-  takedown: StatusAttr,
+  did: DidString,
+  takedown: com.atproto.admin.defs.StatusAttr,
 ) => {
   const takedownRef = takedown.applied
-    ? takedown.ref ?? new Date().toISOString()
+    ? takedown.ref ?? currentDatetimeString()
     : null
   await db.executeWithRetry(
     db.db.updateTable('actor').set({ takedownRef }).where('did', '=', did),
@@ -261,21 +272,21 @@ export const updateAccountTakedownStatus = async (
 
 export const deactivateAccount = async (
   db: AccountDb,
-  did: string,
+  did: DidString,
   deleteAfter: string | null,
 ) => {
   await db.executeWithRetry(
     db.db
       .updateTable('actor')
       .set({
-        deactivatedAt: new Date().toISOString(),
+        deactivatedAt: currentDatetimeString(),
         deleteAfter,
       })
       .where('did', '=', did),
   )
 }
 
-export const activateAccount = async (db: AccountDb, did: string) => {
+export const activateAccount = async (db: AccountDb, did: DidString) => {
   await db.executeWithRetry(
     db.db
       .updateTable('actor')

package/src/account-manager/helpers/email-token.ts

@@ -1,15 +1,16 @@
 import { MINUTE, lessThanAgoMs } from '@atproto/common'
+import { DidString, currentDatetimeString } from '@atproto/lex'
 import { InvalidRequestError } from '@atproto/xrpc-server'
 import { getRandomToken } from '../../api/com/atproto/server/util'
 import { AccountDb, EmailTokenPurpose } from '../db'
 
 export const createEmailToken = async (
   db: AccountDb,
-  did: string,
+  did: DidString,
   purpose: EmailTokenPurpose,
 ): Promise<string> => {
   const token = getRandomToken().toUpperCase()
-  const now = new Date().toISOString()
+  const now = currentDatetimeString()
   await db.executeWithRetry(
     db.db
       .insertInto('email_token')
@@ -23,7 +24,7 @@ export const createEmailToken = async (
 
 export const deleteEmailToken = async (
   db: AccountDb,
-  did: string,
+  did: DidString,
   purpose: EmailTokenPurpose,
 ) => {
   await db.executeWithRetry(
@@ -34,7 +35,7 @@ export const deleteEmailToken = async (
   )
 }
 
-export const deleteAllEmailTokens = async (db: AccountDb, did: string) => {
+export const deleteAllEmailTokens = async (db: AccountDb, did: DidString) => {
   await db.executeWithRetry(
     db.db.deleteFrom('email_token').where('did', '=', did),
   )
@@ -42,7 +43,7 @@ export const deleteAllEmailTokens = async (db: AccountDb, did: string) => {
 
 export const assertValidToken = async (
   db: AccountDb,
-  did: string,
+  did: DidString,
   purpose: EmailTokenPurpose,
   token: string,
   expirationLen = 15 * MINUTE,
@@ -68,7 +69,7 @@ export const assertValidTokenAndFindDid = async (
   purpose: EmailTokenPurpose,
   token: string,
   expirationLen = 15 * MINUTE,
-): Promise<string> => {
+): Promise<DidString> => {
   const res = await db.db
     .selectFrom('email_token')
     .select(['did', 'requestedAt'])

package/src/account-manager/helpers/invite.ts

@@ -1,14 +1,19 @@
 import { chunkArray } from '@atproto/common'
+import { DatetimeString, DidString, currentDatetimeString } from '@atproto/lex'
 import { InvalidRequestError } from '@atproto/xrpc-server'
 import { countAll } from '../../db'
+import { com } from '../../lexicons/index.js'
 import { AccountDb, InviteCode } from '../db'
 
+export type CodeDetail = com.atproto.server.defs.InviteCode
+export type CodeUse = com.atproto.server.defs.InviteCodeUse
+
 export const createInviteCodes = async (
   db: AccountDb,
   toCreate: { account: string; codes: string[] }[],
   useCount: number,
 ) => {
-  const now = new Date().toISOString()
+  const now = currentDatetimeString()
   const rows = toCreate.flatMap((account) =>
     account.codes.map((code) => ({
       code: code,
@@ -33,18 +38,15 @@ export const createAccountInviteCodes = async (
   expectedTotal: number,
   disabled: 0 | 1,
 ): Promise<CodeDetail[]> => {
-  const now = new Date().toISOString()
-  const rows = codes.map(
-    (code) =>
-      ({
-        code,
-        availableUses: 1,
-        disabled,
-        forAccount,
-        createdBy: forAccount,
-        createdAt: now,
-      }) as InviteCode,
-  )
+  const now = currentDatetimeString()
+  const rows: InviteCode[] = codes.map((code) => ({
+    code,
+    availableUses: 1,
+    disabled,
+    forAccount,
+    createdBy: forAccount,
+    createdAt: now,
+  }))
   await db.executeWithRetry(db.db.insertInto('invite_code').values(rows))
 
   const finalRoutineInviteCodes = await db.db
@@ -71,9 +73,9 @@ export const createAccountInviteCodes = async (
 export const recordInviteUse = async (
   db: AccountDb,
   opts: {
-    did: string
+    did: DidString
     inviteCode: string | undefined
-    now: string
+    now: DatetimeString
   },
 ) => {
   if (!opts.inviteCode) return
@@ -159,7 +161,7 @@ export const getAccountsInviteCodes = async (
         ...row,
         uses: uses[row.code] ?? [],
         disabled: row.disabled === 1,
-      },
+      } satisfies com.atproto.server.defs.InviteCode,
     ])
   })
   return results
@@ -188,7 +190,7 @@ export const getInviteCodesUses = async (
 
 export const getInvitedByForAccounts = async (
   db: AccountDb,
-  dids: string[],
+  dids: DidString[],
 ): Promise<Record<string, CodeDetail>> => {
   if (dids.length < 1) return {}
   const codeDetailsRes = await selectInviteCodesQb(db)
@@ -204,20 +206,24 @@ export const getInvitedByForAccounts = async (
     db,
     codeDetailsRes.map((row) => row.code),
   )
-  const codeDetails = codeDetailsRes.map((row) => ({
-    ...row,
-    uses: uses[row.code] ?? [],
-    disabled: row.disabled === 1,
-  }))
-  return codeDetails.reduce(
-    (acc, cur) => {
-      for (const use of cur.uses) {
-        acc[use.usedBy] = cur
-      }
-      return acc
-    },
-    {} as Record<string, CodeDetail>,
+  const codeDetails = codeDetailsRes.map(
+    ({ uses: _, disabled, createdAt, ...row }): CodeDetail => ({
+      ...row,
+      createdAt,
+      uses: uses[row.code] ?? [],
+      disabled: disabled === 1,
+    }),
   )
+
+  const result: Record<string, CodeDetail> = {}
+
+  for (const cur of codeDetails) {
+    for (const use of cur.uses) {
+      result[use.usedBy] = cur
+    }
+  }
+
+  return result
 }
 
 export const disableInviteCodes = async (
@@ -245,7 +251,7 @@ export const disableInviteCodes = async (
 
 export const setAccountInvitesDisabled = async (
   db: AccountDb,
-  did: string,
+  did: DidString,
   disabled: boolean,
 ) => {
   await db.executeWithRetry(
@@ -255,18 +261,3 @@ export const setAccountInvitesDisabled = async (
       .set({ invitesDisabled: disabled ? 1 : 0 }),
   )
 }
-
-export type CodeDetail = {
-  code: string
-  available: number
-  disabled: boolean
-  forAccount: string
-  createdBy: string
-  createdAt: string
-  uses: CodeUse[]
-}
-
-type CodeUse = {
-  usedBy: string
-  usedAt: string
-}

package/src/account-manager/helpers/password.ts

@@ -1,6 +1,7 @@
 import { randomStr } from '@atproto/crypto'
+import { DatetimeString, currentDatetimeString } from '@atproto/lex'
 import { InvalidRequestError } from '@atproto/xrpc-server'
-import { AppPassword } from '../../lexicon/types/com/atproto/server/createAppPassword'
+import { com } from '../../lexicons/index.js'
 import { AccountDb } from '../db'
 import * as scrypt from './scrypt'
 
@@ -61,7 +62,7 @@ export const createAppPassword = async (
   did: string,
   name: string,
   privileged: boolean,
-): Promise<AppPassword> => {
+): Promise<com.atproto.server.createAppPassword.AppPassword> => {
   // create an app password with format:
   // 1234-abcd-5678-efgh
   const str = randomStr(16, 'base32').slice(0, 16)
@@ -80,7 +81,7 @@ export const createAppPassword = async (
         did,
         name,
         passwordScrypt,
-        createdAt: new Date().toISOString(),
+        createdAt: currentDatetimeString(),
         privileged: privileged ? 1 : 0,
       })
       .returningAll(),
@@ -99,7 +100,9 @@ export const createAppPassword = async (
 export const listAppPasswords = async (
   db: AccountDb,
   did: string,
-): Promise<{ name: string; createdAt: string; privileged: boolean }[]> => {
+): Promise<
+  { name: string; createdAt: DatetimeString; privileged: boolean }[]
+> => {
   const res = await db.db
     .selectFrom('app_password')
     .select(['name', 'createdAt', 'privileged'])

package/src/account-manager/helpers/repo.ts

@@ -1,10 +1,10 @@
-import { CID } from 'multiformats/cid'
+import { Cid, currentDatetimeString } from '@atproto/lex'
 import { AccountDb } from '../db'
 
 export const updateRoot = async (
   db: AccountDb,
   did: string,
-  cid: CID,
+  cid: Cid,
   rev: string,
 ) => {
   // @TODO balance risk of a race in the case of a long retry
@@ -15,7 +15,7 @@ export const updateRoot = async (
         did,
         cid: cid.toString(),
         rev,
-        indexedAt: new Date().toISOString(),
+        indexedAt: currentDatetimeString(),
       })
       .onConflict((oc) =>
         oc.column('did').doUpdateSet({ cid: cid.toString(), rev }),

package/src/account-manager/oauth-store.ts

@@ -2,6 +2,13 @@ import assert from 'node:assert'
 import { Client, createOp as createPlcOp } from '@did-plc/lib'
 import { Selectable } from 'kysely'
 import { Keypair, Secp256k1Keypair } from '@atproto/crypto'
+import {
+  HandleString,
+  asAtIdentifierString,
+  getBlobCidString,
+  isDidString,
+  isHandleString,
+} from '@atproto/lex'
 import {
   Account,
   AccountStore,
@@ -125,6 +132,8 @@ export class OAuthStore
     // @TODO Send an account creation confirmation email (+verification link) to the user (in their locale)
     // @NOTE Password strength & length already enforced by the OAuthProvider
 
+    assert(isHandleString(handle), 'Handle must be a valid HandleString')
+
     await Promise.all([
       this.verifyEmailAvailability(email),
       this.verifyHandleAvailability(handle),
@@ -148,6 +157,7 @@ export class OAuthStore
     })
 
     const { did, op } = plcCreate
+    assert(isDidString(did), 'Generated DID is not a valid DidString')
 
     try {
       await this.actorStore.create(did, signingKey)
@@ -245,9 +255,12 @@ export class OAuthStore
     account: Account
     authorizedClients: AuthorizedClients
   }> {
-    const accountRow = await accountHelper.getAccount(this.db, sub, {
-      includeDeactivated: true,
-    })
+    const accountRow = await accountHelper.getAccount(
+      this.db,
+      // @TODO @atproto/oauth-provider should strongly type `Sub` as `DidString`
+      asAtIdentifierString(sub),
+      { includeDeactivated: true },
+    )
 
     assert(accountRow, 'Account not found')
 
@@ -374,7 +387,7 @@ export class OAuthStore
     }
   }
 
-  async verifyHandleAvailability(handle: string): Promise<void> {
+  async verifyHandleAvailability(handle: HandleString): Promise<void> {
     // @NOTE Handle validity & normalization already enforced by the OAuthProvider
     try {
       const normalized =
@@ -621,7 +634,7 @@ export class OAuthStore
 
         account.name ||= displayName
         account.picture ||= avatar
-          ? this.imageUrlBuilder.build('avatar', did, avatar.ref.toString())
+          ? this.imageUrlBuilder.build('avatar', did, getBlobCidString(avatar))
           : undefined
       }
     }

package/src/account-manager/scope-reference-getter.ts

@@ -1,14 +1,14 @@
 import Redis from 'ioredis'
-import { Agent, ComAtprotoTempDereferenceScope } from '@atproto/api'
 import { DAY, backoffMs, retry } from '@atproto/common'
+import { Client, XrpcError } from '@atproto/lex'
 import { InvalidTokenError, OAuthScope } from '@atproto/oauth-provider'
 import { UpstreamFailureError } from '@atproto/xrpc-server'
 import { CachedGetter, GetterOptions } from '@atproto-labs/simple-store'
 import { SimpleStoreMemory } from '@atproto-labs/simple-store-memory'
 import { SimpleStoreRedis } from '@atproto-labs/simple-store-redis'
+import { com } from '../lexicons.js'
 import { oauthLogger } from '../logger.js'
 
-const { InvalidScopeReferenceError } = ComAtprotoTempDereferenceScope
 const PREFIX = 'ref:'
 
 type ScopeReference = `${typeof PREFIX}${string}`
@@ -22,7 +22,7 @@ export class ScopeReferenceGetter extends CachedGetter<
   OAuthScope
 > {
   constructor(
-    protected readonly entryway: Agent,
+    protected readonly entryway: Client,
     redis?: Redis,
   ) {
     super(
@@ -32,7 +32,8 @@ export class ScopeReferenceGetter extends CachedGetter<
           getWaitMs: (n) => backoffMs(n, 250, 2000),
           retryable: (err) =>
             !options?.signal?.aborted &&
-            !(err instanceof InvalidScopeReferenceError),
+            err instanceof XrpcError &&
+            err.shouldRetry(),
         })
       },
       redis
@@ -56,7 +57,8 @@ export class ScopeReferenceGetter extends CachedGetter<
     oauthLogger.info({ ref }, 'Fetching scope reference')
 
     try {
-      const response = await this.entryway.com.atproto.temp.dereferenceScope(
+      const { scope } = await this.entryway.call(
+        com.atproto.temp.dereferenceScope,
         { scope: ref },
         {
           signal: opts?.signal,
@@ -64,8 +66,6 @@ export class ScopeReferenceGetter extends CachedGetter<
         },
       )
 
-      const { scope } = response.data
-
       oauthLogger.info({ ref, scope }, 'Successfully fetched scope reference')
 
       // @NOTE the part after `PREFIX` (in the input scope) is the CID of the
@@ -90,7 +90,7 @@ export class ScopeReferenceGetter extends CachedGetter<
 }
 
 function handleDereferenceError(cause: unknown): never {
-  if (cause instanceof InvalidScopeReferenceError) {
+  if (cause instanceof XrpcError && cause.error === 'InvalidScopeReference') {
     // The scope reference cannot be found on the server.
     // Consider the session as invalid, allowing entryway to
     // re-build the scope as the user re-authenticates. This

package/src/actor-store/blob/reader.ts

@@ -1,9 +1,10 @@
 import stream from 'node:stream'
-import { CID } from 'multiformats/cid'
+import { Cid, parseCid } from '@atproto/lex-data'
 import { BlobNotFoundError, BlobStore } from '@atproto/repo'
+import { AtUriString } from '@atproto/syntax'
 import { InvalidRequestError } from '@atproto/xrpc-server'
 import { countAll, countDistinct, notSoftDeletedClause } from '../../db/util'
-import { StatusAttr } from '../../lexicon/types/com/atproto/admin/defs'
+import { com } from '../../lexicons/index.js'
 import { ActorDb } from '../db'
 
 export class BlobReader {
@@ -13,8 +14,8 @@ export class BlobReader {
   ) {}
 
   async getBlobMetadata(
-    cid: CID,
-  ): Promise<{ size: number; mimeType?: string }> {
+    cid: Cid,
+  ): Promise<{ size: number; mimeType?: `${string}/${string}` }> {
     const { ref } = this.db.db.dynamic
     const found = await this.db.db
       .selectFrom('blob')
@@ -27,27 +28,24 @@ export class BlobReader {
     }
     return {
       size: found.size,
-      mimeType: found.mimeType,
+      mimeType: found.mimeType as `${string}/${string}` | undefined,
     }
   }
 
-  async getBlob(
-    cid: CID,
-  ): Promise<{ size: number; mimeType?: string; stream: stream.Readable }> {
+  async getBlob(cid: Cid): Promise<{
+    size: number
+    mimeType?: `${string}/${string}`
+    stream: stream.Readable
+  }> {
     const metadata = await this.getBlobMetadata(cid)
-    let blobStream
-    try {
-      blobStream = await this.blobstore.getStream(cid)
-    } catch (err) {
+    const stream = await this.blobstore.getStream(cid).catch((err) => {
       if (err instanceof BlobNotFoundError) {
         throw new InvalidRequestError('Blob not found')
       }
       throw err
-    }
-    return {
-      ...metadata,
-      stream: blobStream,
-    }
+    })
+
+    return { ...metadata, stream }
   }
 
   async listBlobs(opts: {
@@ -74,7 +72,9 @@ export class BlobReader {
     return res.map((row) => row.blobCid)
   }
 
-  async getBlobTakedownStatus(cid: CID): Promise<StatusAttr | null> {
+  async getBlobTakedownStatus(
+    cid: Cid,
+  ): Promise<com.atproto.admin.defs.StatusAttr | null> {
     const res = await this.db.db
       .selectFrom('blob')
       .select('takedownRef')
@@ -86,13 +86,14 @@ export class BlobReader {
       : { applied: false }
   }
 
-  async getRecordsForBlob(cid: CID): Promise<string[]> {
+  async hasRecordsForBlob(cid: Cid): Promise<boolean> {
     const res = await this.db.db
       .selectFrom('record_blob')
       .where('blobCid', '=', cid.toString())
-      .selectAll()
-      .execute()
-    return res.map((row) => row.recordUri)
+      .select('blobCid')
+      .limit(1)
+      .executeTakeFirst()
+    return res != null
   }
 
   async getBlobsForRecord(recordUri: string): Promise<string[]> {
@@ -125,7 +126,7 @@ export class BlobReader {
   async listMissingBlobs(opts: {
     cursor?: string
     limit: number
-  }): Promise<{ cid: string; recordUri: string }[]> {
+  }): Promise<{ cid: string; recordUri: AtUriString }[]> {
     const { cursor, limit } = opts
     let builder = this.db.db
       .selectFrom('record_blob')
@@ -145,12 +146,12 @@ export class BlobReader {
     const res = await builder.execute()
     return res.map((row) => ({
       cid: row.blobCid,
-      recordUri: row.recordUri,
+      recordUri: row.recordUri as AtUriString,
     }))
   }
 
   async getBlobCids() {
     const blobRows = await this.db.db.selectFrom('blob').select('cid').execute()
-    return blobRows.map((row) => CID.parse(row.cid))
+    return blobRows.map((row) => parseCid(row.cid))
   }
 }