@atproto/pds 0.4.28 → 0.4.30

package/src/api/com/atproto/temp/checkSignupQueue.ts

@@ -1,11 +1,14 @@
 import { Server } from '../../../../lexicon'
 import AppContext from '../../../../context'
 import { authPassthru, resultPassthru } from '../../../proxy'
+import { AuthScope } from '../../../../auth-verifier'
 
 // THIS IS A TEMPORARY UNSPECCED ROUTE
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.temp.checkSignupQueue({
-    auth: ctx.authVerifier.accessDeactived,
+    auth: ctx.authVerifier.accessStandard({
+      additional: [AuthScope.SignupQueued],
+    }),
     handler: async ({ req }) => {
       if (!ctx.entrywayAgent) {
         return {

package/src/auth-verifier.ts

@@ -24,7 +24,13 @@ export enum AuthScope {
   Refresh = 'com.atproto.refresh',
   AppPass = 'com.atproto.appPass',
   AppPassPrivileged = 'com.atproto.appPassPrivileged',
-  Deactivated = 'com.atproto.deactivated',
+  SignupQueued = 'com.atproto.signupQueued',
+}
+
+export type AccessOpts = {
+  additional: AuthScope[]
+  checkTakedown: boolean
+  checkDeactivated: boolean
 }
 
 export enum RoleStatus {
@@ -115,55 +121,40 @@ export class AuthVerifier {
 
   // verifiers (arrow fns to preserve scope)
 
-  access = (ctx: ReqCtx): Promise<AccessOutput> => {
-    return this.validateAccessToken(ctx.req, [
-      AuthScope.Access,
-      AuthScope.AppPassPrivileged,
-      AuthScope.AppPass,
-    ])
-  }
-
-  accessCheckTakedown = async (ctx: ReqCtx): Promise<AccessOutput> => {
-    const result = await this.validateAccessToken(ctx.req, [
-      AuthScope.Access,
-      AuthScope.AppPassPrivileged,
-      AuthScope.AppPass,
-    ])
-    const found = await this.accountManager.getAccount(result.credentials.did, {
-      includeDeactivated: true,
-    })
-    if (!found) {
-      // will be turned into ExpiredToken for the client if proxied by entryway
-      throw new ForbiddenError('Account not found', 'AccountNotFound')
-    }
-    if (softDeleted(found)) {
-      throw new AuthRequiredError(
-        'Account has been taken down',
-        'AccountTakedown',
+  accessStandard =
+    (opts: Partial<AccessOpts> = {}) =>
+    (ctx: ReqCtx): Promise<AccessOutput> => {
+      return this.validateAccessToken(
+        ctx.req,
+        [
+          AuthScope.Access,
+          AuthScope.AppPassPrivileged,
+          AuthScope.AppPass,
+          ...(opts.additional ?? []),
+        ],
+        opts,
       )
     }
-    return result
-  }
-
-  accessFull = (ctx: ReqCtx): Promise<AccessOutput> => {
-    return this.validateAccessToken(ctx.req, [AuthScope.Access])
-  }
 
-  accessAppPassPrivileged = (ctx: ReqCtx): Promise<AccessOutput> => {
-    return this.validateAccessToken(ctx.req, [
-      AuthScope.Access,
-      AuthScope.AppPassPrivileged,
-    ])
-  }
+  accessFull =
+    (opts: Partial<AccessOpts> = {}) =>
+    (ctx: ReqCtx): Promise<AccessOutput> => {
+      return this.validateAccessToken(
+        ctx.req,
+        [AuthScope.Access, ...(opts.additional ?? [])],
+        opts,
+      )
+    }
 
-  accessDeactived = (ctx: ReqCtx): Promise<AccessOutput> => {
-    return this.validateAccessToken(ctx.req, [
-      AuthScope.Access,
-      AuthScope.AppPass,
-      AuthScope.AppPassPrivileged,
-      AuthScope.Deactivated,
-    ])
-  }
+  accessPrivileged =
+    (opts: Partial<AccessOpts> = {}) =>
+    (ctx: ReqCtx): Promise<AccessOutput> => {
+      return this.validateAccessToken(ctx.req, [
+        AuthScope.Access,
+        AuthScope.AppPassPrivileged,
+        ...(opts.additional ?? []),
+      ])
+    }
 
   refresh = async (ctx: ReqCtx): Promise<RefreshOutput> => {
     const { did, scope, token, audience, payload } =
@@ -205,7 +196,7 @@ export class AuthVerifier {
     ctx: ReqCtx,
   ): Promise<AccessOutput | AdminTokenOutput | NullOutput> => {
     if (isBearerToken(ctx.req)) {
-      return await this.access(ctx)
+      return await this.accessStandard()(ctx)
     } else if (isBasicToken(ctx.req)) {
       return await this.adminToken(ctx)
     } else {
@@ -308,12 +299,36 @@ export class AuthVerifier {
   async validateAccessToken(
     req: express.Request,
     scopes: AuthScope[],
+    opts?: { checkTakedown?: boolean; checkDeactivated?: boolean },
   ): Promise<AccessOutput> {
     const { did, scope, token, audience } = await this.validateBearerToken(
       req,
       scopes,
       { audience: this.dids.pds },
     )
+    const { checkTakedown = false, checkDeactivated = false } = opts ?? {}
+    if (checkTakedown || checkDeactivated) {
+      const found = await this.accountManager.getAccount(did, {
+        includeDeactivated: true,
+        includeTakenDown: true,
+      })
+      if (!found) {
+        // will be turned into ExpiredToken for the client if proxied by entryway
+        throw new ForbiddenError('Account not found', 'AccountNotFound')
+      }
+      if (checkTakedown && softDeleted(found)) {
+        throw new AuthRequiredError(
+          'Account has been taken down',
+          'AccountTakedown',
+        )
+      }
+      if (checkDeactivated && found.deactivatedAt) {
+        throw new AuthRequiredError(
+          'Account is deactivated',
+          'AccountDeactivated',
+        )
+      }
+    }
     return {
       credentials: {
         type: 'access',

package/src/index.ts

@@ -33,6 +33,7 @@ export { createServer as createLexiconServer } from './lexicon'
 export * as sequencer from './sequencer'
 export { type PreparedWrite } from './repo'
 export * as repoPrepare from './repo/prepare'
+export { scripts } from './scripts'
 
 export class PDS {
   public ctx: AppContext

package/src/lexicon/index.ts

@@ -73,6 +73,7 @@ import * as ComAtprotoSyncGetHead from './types/com/atproto/sync/getHead'
 import * as ComAtprotoSyncGetLatestCommit from './types/com/atproto/sync/getLatestCommit'
 import * as ComAtprotoSyncGetRecord from './types/com/atproto/sync/getRecord'
 import * as ComAtprotoSyncGetRepo from './types/com/atproto/sync/getRepo'
+import * as ComAtprotoSyncGetRepoStatus from './types/com/atproto/sync/getRepoStatus'
 import * as ComAtprotoSyncListBlobs from './types/com/atproto/sync/listBlobs'
 import * as ComAtprotoSyncListRepos from './types/com/atproto/sync/listRepos'
 import * as ComAtprotoSyncNotifyOfUpdate from './types/com/atproto/sync/notifyOfUpdate'
@@ -1009,6 +1010,17 @@ export class ComAtprotoSyncNS {
     return this._server.xrpc.method(nsid, cfg)
   }
 
+  getRepoStatus<AV extends AuthVerifier>(
+    cfg: ConfigOf<
+      AV,
+      ComAtprotoSyncGetRepoStatus.Handler<ExtractAuth<AV>>,
+      ComAtprotoSyncGetRepoStatus.HandlerReqCtx<ExtractAuth<AV>>
+    >,
+  ) {
+    const nsid = 'com.atproto.sync.getRepoStatus' // @ts-ignore
+    return this._server.xrpc.method(nsid, cfg)
+  }
+
   listBlobs<AV extends AuthVerifier>(
     cfg: ConfigOf<
       AV,

package/src/lexicon/lexicons.ts

@@ -66,6 +66,10 @@ export const schemaDict = {
           inviteNote: {
             type: 'string',
           },
+          deactivatedAt: {
+            type: 'string',
+            format: 'datetime',
+          },
         },
       },
       repoRef: {
@@ -364,6 +368,10 @@ export const schemaDict = {
                 type: 'ref',
                 ref: 'lex:com.atproto.admin.defs#statusAttr',
               },
+              deactivated: {
+                type: 'ref',
+                ref: 'lex:com.atproto.admin.defs#statusAttr',
+              },
             },
           },
         },
@@ -2255,6 +2263,15 @@ export const schemaDict = {
               emailAuthFactor: {
                 type: 'boolean',
               },
+              active: {
+                type: 'boolean',
+              },
+              status: {
+                type: 'string',
+                description:
+                  'If active=false, this optional field indicates a possible reason for why the account is not active. If active=false and no status is supplied, then the host makes no claim for why the repository is no longer being hosted.',
+                knownValues: ['takendown', 'suspended', 'deactivated'],
+              },
             },
           },
         },
@@ -2591,6 +2608,15 @@ export const schemaDict = {
               didDoc: {
                 type: 'unknown',
               },
+              active: {
+                type: 'boolean',
+              },
+              status: {
+                type: 'string',
+                description:
+                  'If active=false, this optional field indicates a possible reason for why the account is not active. If active=false and no status is supplied, then the host makes no claim for why the repository is no longer being hosted.',
+                knownValues: ['takendown', 'suspended', 'deactivated'],
+              },
             },
           },
         },
@@ -2675,6 +2701,15 @@ export const schemaDict = {
               didDoc: {
                 type: 'unknown',
               },
+              active: {
+                type: 'boolean',
+              },
+              status: {
+                type: 'string',
+                description:
+                  "Hosting status of the account. If not specified, then assume 'active'.",
+                knownValues: ['takendown', 'suspended', 'deactivated'],
+              },
             },
           },
         },
@@ -2912,6 +2947,23 @@ export const schemaDict = {
         output: {
           encoding: '*/*',
         },
+        errors: [
+          {
+            name: 'BlobNotFound',
+          },
+          {
+            name: 'RepoNotFound',
+          },
+          {
+            name: 'RepoTakendown',
+          },
+          {
+            name: 'RepoSuspended',
+          },
+          {
+            name: 'RepoDeactivated',
+          },
+        ],
       },
     },
   },
@@ -2944,6 +2996,23 @@ export const schemaDict = {
         output: {
           encoding: 'application/vnd.ipld.car',
         },
+        errors: [
+          {
+            name: 'BlockNotFound',
+          },
+          {
+            name: 'RepoNotFound',
+          },
+          {
+            name: 'RepoTakendown',
+          },
+          {
+            name: 'RepoSuspended',
+          },
+          {
+            name: 'RepoDeactivated',
+          },
+        ],
       },
     },
   },
@@ -3050,6 +3119,15 @@ export const schemaDict = {
           {
             name: 'RepoNotFound',
           },
+          {
+            name: 'RepoTakendown',
+          },
+          {
+            name: 'RepoSuspended',
+          },
+          {
+            name: 'RepoDeactivated',
+          },
         ],
       },
     },
@@ -3090,6 +3168,23 @@ export const schemaDict = {
         output: {
           encoding: 'application/vnd.ipld.car',
         },
+        errors: [
+          {
+            name: 'RecordNotFound',
+          },
+          {
+            name: 'RepoNotFound',
+          },
+          {
+            name: 'RepoTakendown',
+          },
+          {
+            name: 'RepoSuspended',
+          },
+          {
+            name: 'RepoDeactivated',
+          },
+        ],
       },
     },
   },
@@ -3120,6 +3215,74 @@ export const schemaDict = {
         output: {
           encoding: 'application/vnd.ipld.car',
         },
+        errors: [
+          {
+            name: 'RepoNotFound',
+          },
+          {
+            name: 'RepoTakendown',
+          },
+          {
+            name: 'RepoSuspended',
+          },
+          {
+            name: 'RepoDeactivated',
+          },
+        ],
+      },
+    },
+  },
+  ComAtprotoSyncGetRepoStatus: {
+    lexicon: 1,
+    id: 'com.atproto.sync.getRepoStatus',
+    defs: {
+      main: {
+        type: 'query',
+        description:
+          'Get the hosting status for a repository, on this server. Expected to be implemented by PDS and Relay.',
+        parameters: {
+          type: 'params',
+          required: ['did'],
+          properties: {
+            did: {
+              type: 'string',
+              format: 'did',
+              description: 'The DID of the repo.',
+            },
+          },
+        },
+        output: {
+          encoding: 'application/json',
+          schema: {
+            type: 'object',
+            required: ['did', 'active'],
+            properties: {
+              did: {
+                type: 'string',
+                format: 'did',
+              },
+              active: {
+                type: 'boolean',
+              },
+              status: {
+                type: 'string',
+                description:
+                  'If active=false, this optional field indicates a possible reason for why the account is not active. If active=false and no status is supplied, then the host makes no claim for why the repository is no longer being hosted.',
+                knownValues: ['takendown', 'suspended', 'deactivated'],
+              },
+              rev: {
+                type: 'string',
+                description:
+                  'Optional field, the current rev of the repo, if active=true',
+              },
+            },
+          },
+        },
+        errors: [
+          {
+            name: 'RepoNotFound',
+          },
+        ],
       },
     },
   },
@@ -3174,6 +3337,20 @@ export const schemaDict = {
             },
           },
         },
+        errors: [
+          {
+            name: 'RepoNotFound',
+          },
+          {
+            name: 'RepoTakendown',
+          },
+          {
+            name: 'RepoSuspended',
+          },
+          {
+            name: 'RepoDeactivated',
+          },
+        ],
       },
     },
   },
@@ -3235,6 +3412,15 @@ export const schemaDict = {
           rev: {
             type: 'string',
           },
+          active: {
+            type: 'boolean',
+          },
+          status: {
+            type: 'string',
+            description:
+              'If active=false, this optional field indicates a possible reason for why the account is not active. If active=false and no status is supplied, then the host makes no claim for why the repository is no longer being hosted.',
+            knownValues: ['takendown', 'suspended', 'deactivated'],
+          },
         },
       },
     },
@@ -3312,6 +3498,7 @@ export const schemaDict = {
             refs: [
               'lex:com.atproto.sync.subscribeRepos#commit',
               'lex:com.atproto.sync.subscribeRepos#identity',
+              'lex:com.atproto.sync.subscribeRepos#account',
               'lex:com.atproto.sync.subscribeRepos#handle',
               'lex:com.atproto.sync.subscribeRepos#migrate',
               'lex:com.atproto.sync.subscribeRepos#tombstone',
@@ -3435,12 +3622,47 @@ export const schemaDict = {
             type: 'string',
             format: 'datetime',
           },
+          handle: {
+            type: 'string',
+            format: 'handle',
+            description:
+              "The current handle for the account, or 'handle.invalid' if validation fails. This field is optional, might have been validated or passed-through from an upstream source. Semantics and behaviors for PDS vs Relay may evolve in the future; see atproto specs for more details.",
+          },
         },
       },
-      handle: {
+      account: {
         type: 'object',
         description:
-          "Represents an update of the account's handle, or transition to/from invalid state. NOTE: Will be deprecated in favor of #identity.",
+          "Represents a change to an account's status on a host (eg, PDS or Relay). The semantics of this event are that the status is at the host which emitted the event, not necessarily that at the currently active PDS. Eg, a Relay takedown would emit a takedown with active=false, even if the PDS is still active.",
+        required: ['seq', 'did', 'time', 'active'],
+        properties: {
+          seq: {
+            type: 'integer',
+          },
+          did: {
+            type: 'string',
+            format: 'did',
+          },
+          time: {
+            type: 'string',
+            format: 'datetime',
+          },
+          active: {
+            type: 'boolean',
+            description:
+              'Indicates that the account has a repository which can be fetched from the host that emitted this event.',
+          },
+          status: {
+            type: 'string',
+            description:
+              'If active=false, this optional field indicates a reason for why the account is not active.',
+            knownValues: ['takendown', 'suspended', 'deleted', 'deactivated'],
+          },
+        },
+      },
+      handle: {
+        type: 'object',
+        description: 'DEPRECATED -- Use #identity event instead',
         required: ['seq', 'did', 'handle', 'time'],
         properties: {
           seq: {
@@ -3462,8 +3684,7 @@ export const schemaDict = {
       },
       migrate: {
         type: 'object',
-        description:
-          'Represents an account moving from one PDS instance to another. NOTE: not implemented; account migration uses #identity instead',
+        description: 'DEPRECATED -- Use #account event instead',
         required: ['seq', 'did', 'migrateTo', 'time'],
         nullable: ['migrateTo'],
         properties: {
@@ -3485,8 +3706,7 @@ export const schemaDict = {
       },
       tombstone: {
         type: 'object',
-        description:
-          'Indicates that an account has been deleted. NOTE: may be deprecated in favor of #identity or a future #account event',
+        description: 'DEPRECATED -- Use #account event instead',
         required: ['seq', 'did', 'time'],
         properties: {
           seq: {
@@ -8379,7 +8599,7 @@ export const schemaDict = {
           },
           embed: {
             type: 'union',
-            refs: ['lex:app.bsky.embed.record'],
+            refs: ['lex:app.bsky.embed.record#view'],
           },
           sender: {
             type: 'ref',
@@ -9814,6 +10034,10 @@ export const schemaDict = {
           inviteNote: {
             type: 'string',
           },
+          deactivatedAt: {
+            type: 'string',
+            format: 'datetime',
+          },
         },
       },
       repoViewDetail: {
@@ -9879,6 +10103,10 @@ export const schemaDict = {
             type: 'string',
             format: 'datetime',
           },
+          deactivatedAt: {
+            type: 'string',
+            format: 'datetime',
+          },
         },
       },
       repoViewNotFound: {
@@ -10624,6 +10852,7 @@ export const ids = {
   ComAtprotoSyncGetLatestCommit: 'com.atproto.sync.getLatestCommit',
   ComAtprotoSyncGetRecord: 'com.atproto.sync.getRecord',
   ComAtprotoSyncGetRepo: 'com.atproto.sync.getRepo',
+  ComAtprotoSyncGetRepoStatus: 'com.atproto.sync.getRepoStatus',
   ComAtprotoSyncListBlobs: 'com.atproto.sync.listBlobs',
   ComAtprotoSyncListRepos: 'com.atproto.sync.listRepos',
   ComAtprotoSyncNotifyOfUpdate: 'com.atproto.sync.notifyOfUpdate',

package/src/lexicon/types/chat/bsky/convo/defs.ts

@@ -54,7 +54,7 @@ export interface MessageView {
   text: string
   /** Annotations of text (mentions, URLs, hashtags, etc) */
   facets?: AppBskyRichtextFacet.Main[]
-  embed?: AppBskyEmbedRecord.Main | { $type: string; [k: string]: unknown }
+  embed?: AppBskyEmbedRecord.View | { $type: string; [k: string]: unknown }
   sender: MessageViewSender
   sentAt: string
   [k: string]: unknown

package/src/lexicon/types/com/atproto/admin/defs.ts

@@ -36,6 +36,7 @@ export interface AccountView {
   invitesDisabled?: boolean
   emailConfirmedAt?: string
   inviteNote?: string
+  deactivatedAt?: string
   [k: string]: unknown
 }
 

package/src/lexicon/types/com/atproto/admin/getSubjectStatus.ts

@@ -25,6 +25,7 @@ export interface OutputSchema {
     | ComAtprotoAdminDefs.RepoBlobRef
     | { $type: string; [k: string]: unknown }
   takedown?: ComAtprotoAdminDefs.StatusAttr
+  deactivated?: ComAtprotoAdminDefs.StatusAttr
   [k: string]: unknown
 }
 

package/src/lexicon/types/com/atproto/server/createSession.ts

@@ -27,6 +27,9 @@ export interface OutputSchema {
   email?: string
   emailConfirmed?: boolean
   emailAuthFactor?: boolean
+  active?: boolean
+  /** If active=false, this optional field indicates a possible reason for why the account is not active. If active=false and no status is supplied, then the host makes no claim for why the repository is no longer being hosted. */
+  status?: 'takendown' | 'suspended' | 'deactivated' | (string & {})
   [k: string]: unknown
 }
 

package/src/lexicon/types/com/atproto/server/getSession.ts

@@ -19,6 +19,9 @@ export interface OutputSchema {
   emailConfirmed?: boolean
   emailAuthFactor?: boolean
   didDoc?: {}
+  active?: boolean
+  /** If active=false, this optional field indicates a possible reason for why the account is not active. If active=false and no status is supplied, then the host makes no claim for why the repository is no longer being hosted. */
+  status?: 'takendown' | 'suspended' | 'deactivated' | (string & {})
   [k: string]: unknown
 }
 

package/src/lexicon/types/com/atproto/server/refreshSession.ts

@@ -18,6 +18,9 @@ export interface OutputSchema {
   handle: string
   did: string
   didDoc?: {}
+  active?: boolean
+  /** Hosting status of the account. If not specified, then assume 'active'. */
+  status?: 'takendown' | 'suspended' | 'deactivated' | (string & {})
   [k: string]: unknown
 }
 

package/src/lexicon/types/com/atproto/sync/getBlob.ts

@@ -28,6 +28,12 @@ export interface HandlerSuccess {
 export interface HandlerError {
   status: number
   message?: string
+  error?:
+    | 'BlobNotFound'
+    | 'RepoNotFound'
+    | 'RepoTakendown'
+    | 'RepoSuspended'
+    | 'RepoDeactivated'
 }
 
 export type HandlerOutput = HandlerError | HandlerSuccess | HandlerPipeThrough

package/src/lexicon/types/com/atproto/sync/getBlocks.ts

@@ -27,6 +27,12 @@ export interface HandlerSuccess {
 export interface HandlerError {
   status: number
   message?: string
+  error?:
+    | 'BlockNotFound'
+    | 'RepoNotFound'
+    | 'RepoTakendown'
+    | 'RepoSuspended'
+    | 'RepoDeactivated'
 }
 
 export type HandlerOutput = HandlerError | HandlerSuccess | HandlerPipeThrough

package/src/lexicon/types/com/atproto/sync/getLatestCommit.ts

@@ -32,7 +32,7 @@ export interface HandlerSuccess {
 export interface HandlerError {
   status: number
   message?: string
-  error?: 'RepoNotFound'
+  error?: 'RepoNotFound' | 'RepoTakendown' | 'RepoSuspended' | 'RepoDeactivated'
 }
 
 export type HandlerOutput = HandlerError | HandlerSuccess | HandlerPipeThrough