@atproto/pds 0.4.28 → 0.4.30

package/src/api/com/atproto/server/createAccount.ts

@@ -11,7 +11,8 @@ import {
 import { Server } from '../../../../lexicon'
 import { InputSchema as CreateAccountInput } from '../../../../lexicon/types/com/atproto/server/createAccount'
 import AppContext from '../../../../context'
-import { didDocForSession } from './util'
+import { safeResolveDidDoc } from './util'
+import { AccountStatus } from '../../../../account-manager'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.server.createAccount({
@@ -56,6 +57,8 @@ export default function (server: Server, ctx: AppContext) {
           }
         }
 
+        didDoc = await safeResolveDidDoc(ctx, did, true)
+
         creds = await ctx.accountManager.createAccount({
           did,
           handle,
@@ -68,11 +71,11 @@ export default function (server: Server, ctx: AppContext) {
         })
 
         if (!deactivated) {
+          await ctx.sequencer.sequenceIdentityEvt(did, handle)
+          await ctx.sequencer.sequenceAccountEvt(did, AccountStatus.Active)
           await ctx.sequencer.sequenceCommit(did, commit, [])
-          await ctx.sequencer.sequenceIdentityEvt(did)
         }
         await ctx.accountManager.updateRepoRoot(did, commit.cid, commit.rev)
-        didDoc = await didDocForSession(ctx, did, true)
         await ctx.actorStore.clearReservedKeypair(signingKey.did(), did)
       } catch (err) {
         // this will only be reached if the actor store _did not_ exist before

package/src/api/com/atproto/server/createAppPassword.ts

@@ -4,7 +4,9 @@ import { authPassthru, resultPassthru } from '../../../proxy'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.server.createAppPassword({
-    auth: ctx.authVerifier.accessFull,
+    auth: ctx.authVerifier.accessFull({
+      checkTakedown: true,
+    }),
     handler: async ({ auth, input, req }) => {
       if (ctx.entrywayAgent) {
         return resultPassthru(

package/src/api/com/atproto/server/createSession.ts

@@ -86,6 +86,8 @@ export default function (server: Server, ctx: AppContext) {
           emailConfirmed: !!user.emailConfirmedAt,
           accessJwt,
           refreshJwt,
+          active: user.active,
+          status: user.status,
         },
       }
     },

package/src/api/com/atproto/server/deactivateAccount.ts

@@ -3,13 +3,15 @@ import AppContext from '../../../../context'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.server.deactivateAccount({
-    auth: ctx.authVerifier.accessFull,
+    auth: ctx.authVerifier.accessFull(),
     handler: async ({ auth, input }) => {
       const requester = auth.credentials.did
       await ctx.accountManager.deactivateAccount(
         requester,
         input.body.deleteAfter ?? null,
       )
+      const status = await ctx.accountManager.getAccountStatus(requester)
+      await ctx.sequencer.sequenceAccountEvt(requester, status)
     },
   })
 }

package/src/api/com/atproto/server/deleteAccount.ts

@@ -3,6 +3,7 @@ import { AuthRequiredError, InvalidRequestError } from '@atproto/xrpc-server'
 import { Server } from '../../../../lexicon'
 import AppContext from '../../../../context'
 import { authPassthru } from '../../../proxy'
+import { AccountStatus } from '../../../../account-manager'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.server.deleteAccount({
@@ -44,9 +45,12 @@ export default function (server: Server, ctx: AppContext) {
       )
       await ctx.actorStore.destroy(did)
       await ctx.accountManager.deleteAccount(did)
-      await ctx.sequencer.sequenceIdentityEvt(did)
-      await ctx.sequencer.sequenceTombstone(did)
-      await ctx.sequencer.deleteAllForUser(did)
+      const accountSeq = await ctx.sequencer.sequenceAccountEvt(
+        did,
+        AccountStatus.Deleted,
+      )
+      const tombstoneSeq = await ctx.sequencer.sequenceTombstone(did)
+      await ctx.sequencer.deleteAllForUser(did, [accountSeq, tombstoneSeq])
     },
   })
 }

package/src/api/com/atproto/server/getAccountInviteCodes.ts

@@ -7,7 +7,7 @@ import { authPassthru, resultPassthru } from '../../../proxy'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.server.getAccountInviteCodes({
-    auth: ctx.authVerifier.accessFull,
+    auth: ctx.authVerifier.accessFull({ checkTakedown: true }),
     handler: async ({ params, auth, req }) => {
       if (ctx.entrywayAgent) {
         return resultPassthru(

package/src/api/com/atproto/server/getServiceAuth.ts

@@ -4,7 +4,7 @@ import { Server } from '../../../../lexicon'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.server.getServiceAuth({
-    auth: ctx.authVerifier.accessAppPassPrivileged,
+    auth: ctx.authVerifier.accessPrivileged(),
     handler: async ({ params, auth }) => {
       const did = auth.credentials.did
       const keypair = await ctx.actorStore.keypair(did)

package/src/api/com/atproto/server/getSession.ts

@@ -4,10 +4,13 @@ import AppContext from '../../../../context'
 import { Server } from '../../../../lexicon'
 import { authPassthru, resultPassthru } from '../../../proxy'
 import { didDocForSession } from './util'
+import { AuthScope } from '../../../../auth-verifier'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.server.getSession({
-    auth: ctx.authVerifier.accessDeactived,
+    auth: ctx.authVerifier.accessStandard({
+      additional: [AuthScope.SignupQueued],
+    }),
     handler: async ({ auth, req }) => {
       if (ctx.entrywayAgent) {
         return resultPassthru(
@@ -20,7 +23,7 @@ export default function (server: Server, ctx: AppContext) {
 
       const did = auth.credentials.did
       const [user, didDoc] = await Promise.all([
-        ctx.accountManager.getAccount(did),
+        ctx.accountManager.getAccount(did, { includeDeactivated: true }),
         didDocForSession(ctx, did),
       ])
       if (!user) {
@@ -36,6 +39,8 @@ export default function (server: Server, ctx: AppContext) {
           email: user.email ?? undefined,
           didDoc,
           emailConfirmed: !!user.emailConfirmedAt,
+          active: user.active,
+          status: user.status,
         },
       }
     },

package/src/api/com/atproto/server/listAppPasswords.ts

@@ -4,7 +4,7 @@ import { authPassthru, resultPassthru } from '../../../proxy'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.server.listAppPasswords({
-    auth: ctx.authVerifier.access,
+    auth: ctx.authVerifier.accessStandard(),
     handler: async ({ auth, req }) => {
       if (ctx.entrywayAgent) {
         return resultPassthru(

package/src/api/com/atproto/server/refreshSession.ts

@@ -52,6 +52,8 @@ export default function (server: Server, ctx: AppContext) {
           handle: user.handle ?? INVALID_HANDLE,
           accessJwt: rotated.accessJwt,
           refreshJwt: rotated.refreshJwt,
+          active: user.active,
+          status: user.status,
         },
       }
     },

package/src/api/com/atproto/server/requestAccountDelete.ts

@@ -18,7 +18,7 @@ export default function (server: Server, ctx: AppContext) {
         calcKey: ({ auth }) => auth.credentials.did,
       },
     ],
-    auth: ctx.authVerifier.accessCheckTakedown,
+    auth: ctx.authVerifier.accessFull({ checkTakedown: true }),
     handler: async ({ auth, req }) => {
       const did = auth.credentials.did
       const account = await ctx.accountManager.getAccount(did, {

package/src/api/com/atproto/server/requestEmailConfirmation.ts

@@ -18,7 +18,7 @@ export default function (server: Server, ctx: AppContext) {
         calcKey: ({ auth }) => auth.credentials.did,
       },
     ],
-    auth: ctx.authVerifier.accessCheckTakedown,
+    auth: ctx.authVerifier.accessStandard({ checkTakedown: true }),
     handler: async ({ auth, req }) => {
       const did = auth.credentials.did
       const account = await ctx.accountManager.getAccount(did, {

package/src/api/com/atproto/server/requestEmailUpdate.ts

@@ -18,7 +18,7 @@ export default function (server: Server, ctx: AppContext) {
         calcKey: ({ auth }) => auth.credentials.did,
       },
     ],
-    auth: ctx.authVerifier.accessCheckTakedown,
+    auth: ctx.authVerifier.accessStandard({ checkTakedown: true }),
     handler: async ({ auth, req }) => {
       const did = auth.credentials.did
       const account = await ctx.accountManager.getAccount(did, {

package/src/api/com/atproto/server/revokeAppPassword.ts

@@ -4,7 +4,7 @@ import { authPassthru } from '../../../proxy'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.server.revokeAppPassword({
-    auth: ctx.authVerifier.access,
+    auth: ctx.authVerifier.accessStandard(),
     handler: async ({ auth, input, req }) => {
       if (ctx.entrywayAgent) {
         await ctx.entrywayAgent.com.atproto.server.revokeAppPassword(

package/src/api/com/atproto/server/updateEmail.ts

@@ -7,7 +7,7 @@ import { UserAlreadyExistsError } from '../../../../account-manager/helpers/acco
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.server.updateEmail({
-    auth: ctx.authVerifier.accessFull,
+    auth: ctx.authVerifier.accessFull({ checkTakedown: true }),
     handler: async ({ auth, input, req }) => {
       const did = auth.credentials.did
       const { token, email } = input.body

package/src/api/com/atproto/server/util.ts

@@ -2,7 +2,7 @@ import * as crypto from '@atproto/crypto'
 import { DidDocument } from '@atproto/identity'
 import { ServerConfig } from '../../../../config'
 import AppContext from '../../../../context'
-import { dbLogger } from '../../../../logger'
+import { httpLogger } from '../../../../logger'
 import { InvalidRequestError } from '@atproto/xrpc-server'
 import { getPdsEndpoint, getSigningDidKey } from '@atproto/common'
 
@@ -28,21 +28,28 @@ export const getRandomToken = () => {
   return token.slice(0, 5) + '-' + token.slice(5, 10)
 }
 
-// @TODO once supporting multiple pdses, validate pds in did doc based on allow-list.
-export const didDocForSession = async (
+export const safeResolveDidDoc = async (
   ctx: AppContext,
   did: string,
   forceRefresh?: boolean,
 ): Promise<DidDocument | undefined> => {
-  if (!ctx.cfg.identity.enableDidDocWithSession) return
   try {
     const didDoc = await ctx.idResolver.did.resolve(did, forceRefresh)
     return didDoc ?? undefined
   } catch (err) {
-    dbLogger.warn({ err, did }, 'failed to resolve did doc')
+    httpLogger.warn({ err, did }, 'failed to resolve did doc')
   }
 }
 
+export const didDocForSession = async (
+  ctx: AppContext,
+  did: string,
+  forceRefresh?: boolean,
+): Promise<DidDocument | undefined> => {
+  if (!ctx.cfg.identity.enableDidDocWithSession) return
+  return safeResolveDidDoc(ctx, did, forceRefresh)
+}
+
 export const isValidDidDocForService = async (
   ctx: AppContext,
   did: string,

package/src/api/com/atproto/sync/deprecated/getCheckout.ts

@@ -1,20 +1,18 @@
-import { InvalidRequestError } from '@atproto/xrpc-server'
 import { Server } from '../../../../../lexicon'
 import AppContext from '../../../../../context'
 import { getCarStream } from '../getRepo'
+import { assertRepoAvailability } from '../util'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.sync.getCheckout({
     auth: ctx.authVerifier.optionalAccessOrAdminToken,
     handler: async ({ params, auth }) => {
       const { did } = params
-      // takedown check for anyone other than an admin or the user
-      if (!ctx.authVerifier.isUserOrAdmin(auth, did)) {
-        const available = await ctx.accountManager.isRepoAvailable(did)
-        if (!available) {
-          throw new InvalidRequestError(`Could not find repo for DID: ${did}`)
-        }
-      }
+      await assertRepoAvailability(
+        ctx,
+        did,
+        ctx.authVerifier.isUserOrAdmin(auth, did),
+      )
 
       const carStream = await getCarStream(ctx, did)
 

package/src/api/com/atproto/sync/deprecated/getHead.ts

@@ -1,22 +1,19 @@
 import { InvalidRequestError } from '@atproto/xrpc-server'
 import { Server } from '../../../../../lexicon'
 import AppContext from '../../../../../context'
+import { assertRepoAvailability } from '../util'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.sync.getHead({
     auth: ctx.authVerifier.optionalAccessOrAdminToken,
     handler: async ({ params, auth }) => {
       const { did } = params
-      // takedown check for anyone other than an admin or the user
-      if (!ctx.authVerifier.isUserOrAdmin(auth, did)) {
-        const available = await ctx.accountManager.isRepoAvailable(did)
-        if (!available) {
-          throw new InvalidRequestError(
-            `Could not find root for DID: ${did}`,
-            'HeadNotFound',
-          )
-        }
-      }
+      await assertRepoAvailability(
+        ctx,
+        did,
+        ctx.authVerifier.isUserOrAdmin(auth, did),
+      )
+
       const root = await ctx.actorStore.read(did, (store) =>
         store.repo.storage.getRoot(),
       )

package/src/api/com/atproto/sync/getBlob.ts

@@ -3,17 +3,19 @@ import { Server } from '../../../../lexicon'
 import AppContext from '../../../../context'
 import { InvalidRequestError } from '@atproto/xrpc-server'
 import { BlobNotFoundError } from '@atproto/repo'
+import { assertRepoAvailability } from './util'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.sync.getBlob({
     auth: ctx.authVerifier.optionalAccessOrAdminToken,
     handler: async ({ params, res, auth }) => {
-      if (!ctx.authVerifier.isUserOrAdmin(auth, params.did)) {
-        const available = await ctx.accountManager.isRepoAvailable(params.did)
-        if (!available) {
-          throw new InvalidRequestError('Blob not found')
-        }
-      }
+      const { did } = params
+      await assertRepoAvailability(
+        ctx,
+        did,
+        ctx.authVerifier.isUserOrAdmin(auth, did),
+      )
+
       const cid = CID.parse(params.cid)
       const found = await ctx.actorStore.read(params.did, async (store) => {
         try {

package/src/api/com/atproto/sync/getBlocks.ts

@@ -4,19 +4,18 @@ import { byteIterableToStream } from '@atproto/common'
 import { blocksToCarStream } from '@atproto/repo'
 import { Server } from '../../../../lexicon'
 import AppContext from '../../../../context'
+import { assertRepoAvailability } from './util'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.sync.getBlocks({
     auth: ctx.authVerifier.optionalAccessOrAdminToken,
     handler: async ({ params, auth }) => {
       const { did } = params
-      // takedown check for anyone other than an admin or the user
-      if (!ctx.authVerifier.isUserOrAdmin(auth, did)) {
-        const available = await ctx.accountManager.isRepoAvailable(did)
-        if (!available) {
-          throw new InvalidRequestError(`Could not find repo for DID: ${did}`)
-        }
-      }
+      await assertRepoAvailability(
+        ctx,
+        did,
+        ctx.authVerifier.isUserOrAdmin(auth, did),
+      )
 
       const cids = params.cids.map((c) => CID.parse(c))
       const got = await ctx.actorStore.read(did, (store) =>

package/src/api/com/atproto/sync/getLatestCommit.ts

@@ -1,22 +1,19 @@
 import { InvalidRequestError } from '@atproto/xrpc-server'
 import { Server } from '../../../../lexicon'
 import AppContext from '../../../../context'
+import { assertRepoAvailability } from './util'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.sync.getLatestCommit({
     auth: ctx.authVerifier.optionalAccessOrAdminToken,
     handler: async ({ params, auth }) => {
       const { did } = params
-      // takedown check for anyone other than an admin or the user
-      if (!ctx.authVerifier.isUserOrAdmin(auth, did)) {
-        const available = await ctx.accountManager.isRepoAvailable(did)
-        if (!available) {
-          throw new InvalidRequestError(
-            `Could not find root for DID: ${did}`,
-            'RepoNotFound',
-          )
-        }
-      }
+      await assertRepoAvailability(
+        ctx,
+        did,
+        ctx.authVerifier.isUserOrAdmin(auth, did),
+      )
+
       const root = await ctx.actorStore.read(did, (store) =>
         store.repo.storage.getRootDetailed(),
       )

package/src/api/com/atproto/sync/getRecord.ts

@@ -6,19 +6,19 @@ import { Server } from '../../../../lexicon'
 import AppContext from '../../../../context'
 import { byteIterableToStream } from '@atproto/common'
 import { SqlRepoReader } from '../../../../actor-store/repo/sql-repo-reader'
+import { assertRepoAvailability } from './util'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.sync.getRecord({
     auth: ctx.authVerifier.optionalAccessOrAdminToken,
     handler: async ({ params, auth }) => {
       const { did, collection, rkey } = params
-      // takedown check for anyone other than an admin or the user
-      if (!ctx.authVerifier.isUserOrAdmin(auth, did)) {
-        const available = await ctx.accountManager.isRepoAvailable(did)
-        if (!available) {
-          throw new InvalidRequestError(`Could not find repo for DID: ${did}`)
-        }
-      }
+      await assertRepoAvailability(
+        ctx,
+        did,
+        ctx.authVerifier.isUserOrAdmin(auth, did),
+      )
+
       // must open up the db outside of store interface so that we can close the file handle after finished streaming
       const actorDb = await ctx.actorStore.openDb(did)
 

package/src/api/com/atproto/sync/getRepo.ts

@@ -6,19 +6,18 @@ import {
   RepoRootNotFoundError,
   SqlRepoReader,
 } from '../../../../actor-store/repo/sql-repo-reader'
+import { assertRepoAvailability } from './util'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.sync.getRepo({
     auth: ctx.authVerifier.optionalAccessOrAdminToken,
     handler: async ({ params, auth }) => {
       const { did, since } = params
-      // takedown check for anyone other than an admin or the user
-      if (!ctx.authVerifier.isUserOrAdmin(auth, did)) {
-        const available = await ctx.accountManager.isRepoAvailable(did)
-        if (!available) {
-          throw new InvalidRequestError(`Could not find repo for DID: ${did}`)
-        }
-      }
+      await assertRepoAvailability(
+        ctx,
+        did,
+        ctx.authVerifier.isUserOrAdmin(auth, did),
+      )
 
       const carStream = await getCarStream(ctx, did, since)
 

package/src/api/com/atproto/sync/getRepoStatus.ts

@@ -0,0 +1,31 @@
+import { Server } from '../../../../lexicon'
+import AppContext from '../../../../context'
+import { assertRepoAvailability } from './util'
+
+export default function (server: Server, ctx: AppContext) {
+  server.com.atproto.sync.getRepoStatus({
+    handler: async ({ params }) => {
+      const { did } = params
+      const account = await assertRepoAvailability(ctx, did, true)
+      const { active, status } = account
+
+      let rev: string | undefined = undefined
+      if (active) {
+        const root = await ctx.actorStore.read(did, (store) =>
+          store.repo.storage.getRootDetailed(),
+        )
+        rev = root.rev
+      }
+
+      return {
+        encoding: 'application/json',
+        body: {
+          did,
+          active,
+          status,
+          rev,
+        },
+      }
+    },
+  })
+}

package/src/api/com/atproto/sync/index.ts

@@ -3,6 +3,7 @@ import AppContext from '../../../../context'
 import getBlob from './getBlob'
 import getBlocks from './getBlocks'
 import getLatestCommit from './getLatestCommit'
+import getRepoStatus from './getRepoStatus'
 import getRecord from './getRecord'
 import getRepo from './getRepo'
 import subscribeRepos from './subscribeRepos'
@@ -15,6 +16,7 @@ export default function (server: Server, ctx: AppContext) {
   getBlob(server, ctx)
   getBlocks(server, ctx)
   getLatestCommit(server, ctx)
+  getRepoStatus(server, ctx)
   getRecord(server, ctx)
   getRepo(server, ctx)
   subscribeRepos(server, ctx)

package/src/api/com/atproto/sync/listBlobs.ts

@@ -1,19 +1,17 @@
-import { InvalidRequestError } from '@atproto/xrpc-server'
 import { Server } from '../../../../lexicon'
 import AppContext from '../../../../context'
+import { assertRepoAvailability } from './util'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.sync.listBlobs({
     auth: ctx.authVerifier.optionalAccessOrAdminToken,
     handler: async ({ params, auth }) => {
       const { did, since, limit, cursor } = params
-      // takedown check for anyone other than an admin or the user
-      if (!ctx.authVerifier.isUserOrAdmin(auth, did)) {
-        const available = await ctx.accountManager.isRepoAvailable(did)
-        if (!available) {
-          throw new InvalidRequestError(`Could not find root for DID: ${did}`)
-        }
-      }
+      await assertRepoAvailability(
+        ctx,
+        did,
+        ctx.authVerifier.isUserOrAdmin(auth, did),
+      )
 
       const blobCids = await ctx.actorStore.read(did, (store) =>
         store.repo.blob.listBlobs({ since, limit, cursor }),

package/src/api/com/atproto/sync/listRepos.ts

@@ -2,7 +2,7 @@ import { InvalidRequestError } from '@atproto/xrpc-server'
 import { Server } from '../../../../lexicon'
 import AppContext from '../../../../context'
 import { Cursor, GenericKeyset, paginate } from '../../../../db/pagination'
-import { notSoftDeletedClause } from '../../../../db/util'
+import { formatAccountStatus } from '../../../../account-manager/helpers/account'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.sync.listRepos(async ({ params }) => {
@@ -12,13 +12,13 @@ export default function (server: Server, ctx: AppContext) {
     let builder = db.db
       .selectFrom('actor')
       .innerJoin('repo_root', 'repo_root.did', 'actor.did')
-      .where(notSoftDeletedClause(ref('actor')))
-      .where('actor.deactivatedAt', 'is', null)
       .select([
         'actor.did as did',
         'repo_root.cid as head',
         'repo_root.rev as rev',
         'actor.createdAt as createdAt',
+        'actor.deactivatedAt as deactivatedAt',
+        'actor.takedownRef as takedownRef',
       ])
     const keyset = new TimeDidKeyset(ref('actor.createdAt'), ref('actor.did'))
     builder = paginate(builder, {
@@ -29,11 +29,16 @@ export default function (server: Server, ctx: AppContext) {
       tryIndex: true,
     })
     const res = await builder.execute()
-    const repos = res.map((row) => ({
-      did: row.did,
-      head: row.head,
-      rev: row.rev ?? '',
-    }))
+    const repos = res.map((row) => {
+      const { active, status } = formatAccountStatus(row)
+      return {
+        did: row.did,
+        head: row.head,
+        rev: row.rev ?? '',
+        active,
+        status,
+      }
+    })
     return {
       encoding: 'application/json',
       body: {

package/src/api/com/atproto/sync/subscribeRepos.ts

@@ -59,6 +59,13 @@ export default function (server: Server, ctx: AppContext) {
           time: evt.time,
           ...evt.evt,
         }
+      } else if (evt.type === 'account') {
+        yield {
+          $type: '#account',
+          seq: evt.seq,
+          time: evt.time,
+          ...evt.evt,
+        }
       } else if (evt.type === 'tombstone') {
         yield {
           $type: '#tombstone',

package/src/api/com/atproto/sync/util.ts

@@ -0,0 +1,36 @@
+import { InvalidRequestError } from '@atproto/xrpc-server'
+import { ActorAccount } from '../../../../account-manager/helpers/account'
+import AppContext from '../../../../context'
+
+export const assertRepoAvailability = async (
+  ctx: AppContext,
+  did: string,
+  isAdminOrSelf: boolean,
+): Promise<ActorAccount> => {
+  const account = await ctx.accountManager.getAccount(did, {
+    includeDeactivated: true,
+    includeTakenDown: true,
+  })
+  if (!account) {
+    throw new InvalidRequestError(
+      `Could not find repo for DID: ${did}`,
+      'RepoNotFound',
+    )
+  }
+  if (isAdminOrSelf) {
+    return account
+  }
+  if (account.takedownRef) {
+    throw new InvalidRequestError(
+      `Repo has been takendown: ${did}`,
+      'RepoTakendown',
+    )
+  }
+  if (account.deactivatedAt) {
+    throw new InvalidRequestError(
+      `Repo has been deactivated: ${did}`,
+      'RepoDeactivated',
+    )
+  }
+  return account
+}