@atproto/pds 0.4.29 → 0.4.31

package/src/api/chat/index.ts

@@ -4,85 +4,85 @@ import { pipethrough, pipethroughProcedure } from '../../pipethrough'
 
 export default function (server: Server, ctx: AppContext) {
   server.chat.bsky.actor.deleteAccount({
-    auth: ctx.authVerifier.accessAppPassPrivileged,
+    auth: ctx.authVerifier.accessPrivileged(),
     handler: async ({ req, auth }) => {
       return pipethroughProcedure(ctx, req, auth.credentials.did)
     },
   })
   server.chat.bsky.actor.exportAccountData({
-    auth: ctx.authVerifier.accessAppPassPrivileged,
+    auth: ctx.authVerifier.accessPrivileged(),
     handler: ({ req, auth }) => {
       return pipethrough(ctx, req, auth.credentials.did)
     },
   })
   server.chat.bsky.convo.deleteMessageForSelf({
-    auth: ctx.authVerifier.accessAppPassPrivileged,
+    auth: ctx.authVerifier.accessPrivileged(),
     handler: ({ req, auth, input }) => {
       return pipethroughProcedure(ctx, req, auth.credentials.did, input.body)
     },
   })
   server.chat.bsky.convo.getConvo({
-    auth: ctx.authVerifier.accessAppPassPrivileged,
+    auth: ctx.authVerifier.accessPrivileged(),
     handler: ({ req, auth }) => {
       return pipethrough(ctx, req, auth.credentials.did)
     },
   })
   server.chat.bsky.convo.getConvoForMembers({
-    auth: ctx.authVerifier.accessAppPassPrivileged,
+    auth: ctx.authVerifier.accessPrivileged(),
     handler: ({ req, auth }) => {
       return pipethrough(ctx, req, auth.credentials.did)
     },
   })
   server.chat.bsky.convo.getLog({
-    auth: ctx.authVerifier.accessAppPassPrivileged,
+    auth: ctx.authVerifier.accessPrivileged(),
     handler: ({ req, auth }) => {
       return pipethrough(ctx, req, auth.credentials.did)
     },
   })
   server.chat.bsky.convo.getMessages({
-    auth: ctx.authVerifier.accessAppPassPrivileged,
+    auth: ctx.authVerifier.accessPrivileged(),
     handler: ({ req, auth }) => {
       return pipethrough(ctx, req, auth.credentials.did)
     },
   })
   server.chat.bsky.convo.leaveConvo({
-    auth: ctx.authVerifier.accessAppPassPrivileged,
+    auth: ctx.authVerifier.accessPrivileged(),
     handler: ({ req, auth, input }) => {
       return pipethroughProcedure(ctx, req, auth.credentials.did, input.body)
     },
   })
   server.chat.bsky.convo.listConvos({
-    auth: ctx.authVerifier.accessAppPassPrivileged,
+    auth: ctx.authVerifier.accessPrivileged(),
     handler: ({ req, auth }) => {
       return pipethrough(ctx, req, auth.credentials.did)
     },
   })
   server.chat.bsky.convo.muteConvo({
-    auth: ctx.authVerifier.accessAppPassPrivileged,
+    auth: ctx.authVerifier.accessPrivileged(),
     handler: ({ req, auth, input }) => {
       return pipethroughProcedure(ctx, req, auth.credentials.did, input.body)
     },
   })
   server.chat.bsky.convo.sendMessage({
-    auth: ctx.authVerifier.accessAppPassPrivileged,
+    auth: ctx.authVerifier.accessPrivileged(),
     handler: ({ req, auth, input }) => {
       return pipethroughProcedure(ctx, req, auth.credentials.did, input.body)
     },
   })
   server.chat.bsky.convo.sendMessageBatch({
-    auth: ctx.authVerifier.accessAppPassPrivileged,
+    auth: ctx.authVerifier.accessPrivileged(),
     handler: ({ req, auth, input }) => {
       return pipethroughProcedure(ctx, req, auth.credentials.did, input.body)
     },
   })
   server.chat.bsky.convo.unmuteConvo({
-    auth: ctx.authVerifier.accessAppPassPrivileged,
+    auth: ctx.authVerifier.accessPrivileged(),
     handler: ({ req, auth, input }) => {
       return pipethroughProcedure(ctx, req, auth.credentials.did, input.body)
     },
   })
   server.chat.bsky.convo.updateRead({
-    auth: ctx.authVerifier.accessAppPassPrivileged,
+    auth: ctx.authVerifier.accessPrivileged(),
     handler: ({ req, auth, input }) => {
       return pipethroughProcedure(ctx, req, auth.credentials.did, input.body)
     },

package/src/api/com/atproto/admin/getAccountInfo.ts

@@ -32,6 +32,7 @@ export default function (server: Server, ctx: AppContext) {
           invitesDisabled: managesOwnInvites
             ? account.invitesDisabled === 1
             : undefined,
+          deactivatedAt: account.deactivatedAt ?? undefined,
         },
       }
     },

package/src/api/com/atproto/admin/getSubjectStatus.ts

@@ -51,14 +51,15 @@ export default function (server: Server, ctx: AppContext) {
           }
         }
       } else if (did) {
-        const takedown = await ctx.accountManager.getAccountTakedownStatus(did)
-        if (takedown) {
+        const status = await ctx.accountManager.getAccountAdminStatus(did)
+        if (status) {
           body = {
             subject: {
               $type: 'com.atproto.admin.defs#repoRef',
               did: did,
             },
-            takedown,
+            takedown: status.takedown,
+            deactivated: status.deactivated,
           }
         }
       } else {

package/src/api/com/atproto/admin/updateSubjectStatus.ts

@@ -13,7 +13,7 @@ export default function (server: Server, ctx: AppContext) {
   server.com.atproto.admin.updateSubjectStatus({
     auth: ctx.authVerifier.moderator,
     handler: async ({ input }) => {
-      const { subject, takedown } = input.body
+      const { subject, takedown, deactivated } = input.body
       if (takedown) {
         if (isRepoRef(subject)) {
           await ctx.accountManager.takedownAccount(subject.did, takedown)
@@ -36,6 +36,16 @@ export default function (server: Server, ctx: AppContext) {
         }
       }
 
+      if (deactivated) {
+        if (isRepoRef(subject)) {
+          if (deactivated.applied) {
+            await ctx.accountManager.deactivateAccount(subject.did, null)
+          } else {
+            await ctx.accountManager.activateAccount(subject.did)
+          }
+        }
+      }
+
       return {
         encoding: 'application/json',
         body: {

package/src/api/com/atproto/identity/getRecommendedDidCredentials.ts

@@ -3,7 +3,7 @@ import AppContext from '../../../../context'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.identity.getRecommendedDidCredentials({
-    auth: ctx.authVerifier.access,
+    auth: ctx.authVerifier.accessStandard(),
     handler: async ({ auth }) => {
       const requester = auth.credentials.did
       const signingKey = await ctx.actorStore.keypair(requester)

package/src/api/com/atproto/identity/requestPlcOperationSignature.ts

@@ -5,7 +5,7 @@ import { authPassthru } from '../../../proxy'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.identity.requestPlcOperationSignature({
-    auth: ctx.authVerifier.accessFull,
+    auth: ctx.authVerifier.accessFull(),
     handler: async ({ auth, req }) => {
       if (ctx.entrywayAgent) {
         await ctx.entrywayAgent.com.atproto.identity.requestPlcOperationSignature(

package/src/api/com/atproto/identity/signPlcOperation.ts

@@ -7,7 +7,7 @@ import { authPassthru, resultPassthru } from '../../../proxy'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.identity.signPlcOperation({
-    auth: ctx.authVerifier.accessFull,
+    auth: ctx.authVerifier.accessFull(),
     handler: async ({ auth, input, req }) => {
       if (ctx.entrywayAgent) {
         return resultPassthru(

package/src/api/com/atproto/identity/submitPlcOperation.ts

@@ -7,7 +7,7 @@ import { httpLogger as log } from '../../../../logger'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.identity.submitPlcOperation({
-    auth: ctx.authVerifier.access,
+    auth: ctx.authVerifier.accessStandard(),
     handler: async ({ auth, input }) => {
       const requester = auth.credentials.did
       const op = input.body.operation

package/src/api/com/atproto/identity/updateHandle.ts

@@ -8,7 +8,7 @@ import { authPassthru } from '../../../proxy'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.identity.updateHandle({
-    auth: ctx.authVerifier.accessCheckTakedown,
+    auth: ctx.authVerifier.accessStandard({ checkTakedown: true }),
     rateLimit: [
       {
         durationMs: 5 * MINUTE,

package/src/api/com/atproto/repo/applyWrites.ts

@@ -31,7 +31,10 @@ const ratelimitPoints = ({ input }: { input: HandlerInput }) => {
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.repo.applyWrites({
-    auth: ctx.authVerifier.accessCheckTakedown,
+    auth: ctx.authVerifier.accessStandard({
+      checkTakedown: true,
+      checkDeactivated: true,
+    }),
     rateLimit: [
       {
         name: 'repo-write-hour',

package/src/api/com/atproto/repo/createRecord.ts

@@ -12,7 +12,10 @@ import AppContext from '../../../../context'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.repo.createRecord({
-    auth: ctx.authVerifier.accessCheckTakedown,
+    auth: ctx.authVerifier.accessStandard({
+      checkTakedown: true,
+      checkDeactivated: true,
+    }),
     rateLimit: [
       {
         name: 'repo-write-hour',

package/src/api/com/atproto/repo/deleteRecord.ts

@@ -7,7 +7,10 @@ import { CID } from 'multiformats/cid'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.repo.deleteRecord({
-    auth: ctx.authVerifier.accessCheckTakedown,
+    auth: ctx.authVerifier.accessStandard({
+      checkTakedown: true,
+      checkDeactivated: true,
+    }),
     rateLimit: [
       {
         name: 'repo-write-hour',

package/src/api/com/atproto/repo/importRepo.ts

@@ -17,7 +17,9 @@ import { BlobRef, LexValue, RepoRecord } from '@atproto/lexicon'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.repo.importRepo({
-    auth: ctx.authVerifier.accessFull,
+    auth: ctx.authVerifier.accessFull({
+      checkTakedown: true,
+    }),
     handler: async ({ input, auth }) => {
       const did = auth.credentials.did
       if (!ctx.cfg.service.acceptingImports) {

package/src/api/com/atproto/repo/listMissingBlobs.ts

@@ -3,7 +3,7 @@ import AppContext from '../../../../context'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.repo.listMissingBlobs({
-    auth: ctx.authVerifier.access,
+    auth: ctx.authVerifier.accessStandard(),
     handler: async ({ auth, params }) => {
       const did = auth.credentials.did
       const { limit, cursor } = params

package/src/api/com/atproto/repo/putRecord.ts

@@ -19,7 +19,10 @@ import { ActorStoreTransactor } from '../../../../actor-store'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.repo.putRecord({
-    auth: ctx.authVerifier.accessCheckTakedown,
+    auth: ctx.authVerifier.accessStandard({
+      checkTakedown: true,
+      checkDeactivated: true,
+    }),
     rateLimit: [
       {
         name: 'repo-write-hour',

package/src/api/com/atproto/repo/uploadBlob.ts

@@ -6,7 +6,9 @@ import { BlobMetadata } from '../../../../actor-store/blob/transactor'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.repo.uploadBlob({
-    auth: ctx.authVerifier.accessCheckTakedown,
+    auth: ctx.authVerifier.accessStandard({
+      checkTakedown: true,
+    }),
     rateLimit: {
       durationMs: DAY,
       points: 1000,

package/src/api/com/atproto/server/activateAccount.ts

@@ -7,7 +7,7 @@ import { assertValidDidDocumentForService } from './util'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.server.activateAccount({
-    auth: ctx.authVerifier.accessFull,
+    auth: ctx.authVerifier.accessFull(),
     handler: async ({ auth }) => {
       const requester = auth.credentials.did
 

package/src/api/com/atproto/server/checkAccountStatus.ts

@@ -4,7 +4,7 @@ import { isValidDidDocForService } from './util'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.server.checkAccountStatus({
-    auth: ctx.authVerifier.access,
+    auth: ctx.authVerifier.accessStandard(),
     handler: async ({ auth }) => {
       const requester = auth.credentials.did
       const [

package/src/api/com/atproto/server/confirmEmail.ts

@@ -5,7 +5,7 @@ import { authPassthru } from '../../../proxy'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.server.confirmEmail({
-    auth: ctx.authVerifier.accessCheckTakedown,
+    auth: ctx.authVerifier.accessStandard({ checkTakedown: true }),
     handler: async ({ auth, input, req }) => {
       const did = auth.credentials.did
 

package/src/api/com/atproto/server/createAppPassword.ts

@@ -4,7 +4,9 @@ import { authPassthru, resultPassthru } from '../../../proxy'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.server.createAppPassword({
-    auth: ctx.authVerifier.accessFull,
+    auth: ctx.authVerifier.accessFull({
+      checkTakedown: true,
+    }),
     handler: async ({ auth, input, req }) => {
       if (ctx.entrywayAgent) {
         return resultPassthru(

package/src/api/com/atproto/server/createSession.ts

@@ -86,6 +86,8 @@ export default function (server: Server, ctx: AppContext) {
           emailConfirmed: !!user.emailConfirmedAt,
           accessJwt,
           refreshJwt,
+          active: user.active,
+          status: user.status,
         },
       }
     },

package/src/api/com/atproto/server/deactivateAccount.ts

@@ -3,7 +3,7 @@ import AppContext from '../../../../context'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.server.deactivateAccount({
-    auth: ctx.authVerifier.accessFull,
+    auth: ctx.authVerifier.accessFull(),
     handler: async ({ auth, input }) => {
       const requester = auth.credentials.did
       await ctx.accountManager.deactivateAccount(

package/src/api/com/atproto/server/getAccountInviteCodes.ts

@@ -7,7 +7,7 @@ import { authPassthru, resultPassthru } from '../../../proxy'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.server.getAccountInviteCodes({
-    auth: ctx.authVerifier.accessFull,
+    auth: ctx.authVerifier.accessFull({ checkTakedown: true }),
     handler: async ({ params, auth, req }) => {
       if (ctx.entrywayAgent) {
         return resultPassthru(

package/src/api/com/atproto/server/getServiceAuth.ts

@@ -4,7 +4,7 @@ import { Server } from '../../../../lexicon'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.server.getServiceAuth({
-    auth: ctx.authVerifier.accessAppPassPrivileged,
+    auth: ctx.authVerifier.accessPrivileged(),
     handler: async ({ params, auth }) => {
       const did = auth.credentials.did
       const keypair = await ctx.actorStore.keypair(did)

package/src/api/com/atproto/server/getSession.ts

@@ -4,10 +4,13 @@ import AppContext from '../../../../context'
 import { Server } from '../../../../lexicon'
 import { authPassthru, resultPassthru } from '../../../proxy'
 import { didDocForSession } from './util'
+import { AuthScope } from '../../../../auth-verifier'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.server.getSession({
-    auth: ctx.authVerifier.accessDeactived,
+    auth: ctx.authVerifier.accessStandard({
+      additional: [AuthScope.SignupQueued],
+    }),
     handler: async ({ auth, req }) => {
       if (ctx.entrywayAgent) {
         return resultPassthru(
@@ -20,7 +23,7 @@ export default function (server: Server, ctx: AppContext) {
 
       const did = auth.credentials.did
       const [user, didDoc] = await Promise.all([
-        ctx.accountManager.getAccount(did),
+        ctx.accountManager.getAccount(did, { includeDeactivated: true }),
         didDocForSession(ctx, did),
       ])
       if (!user) {
@@ -36,6 +39,8 @@ export default function (server: Server, ctx: AppContext) {
           email: user.email ?? undefined,
           didDoc,
           emailConfirmed: !!user.emailConfirmedAt,
+          active: user.active,
+          status: user.status,
         },
       }
     },

package/src/api/com/atproto/server/listAppPasswords.ts

@@ -4,7 +4,7 @@ import { authPassthru, resultPassthru } from '../../../proxy'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.server.listAppPasswords({
-    auth: ctx.authVerifier.access,
+    auth: ctx.authVerifier.accessStandard(),
     handler: async ({ auth, req }) => {
       if (ctx.entrywayAgent) {
         return resultPassthru(

package/src/api/com/atproto/server/refreshSession.ts

@@ -52,6 +52,8 @@ export default function (server: Server, ctx: AppContext) {
           handle: user.handle ?? INVALID_HANDLE,
           accessJwt: rotated.accessJwt,
           refreshJwt: rotated.refreshJwt,
+          active: user.active,
+          status: user.status,
         },
       }
     },

package/src/api/com/atproto/server/requestAccountDelete.ts

@@ -18,7 +18,7 @@ export default function (server: Server, ctx: AppContext) {
         calcKey: ({ auth }) => auth.credentials.did,
       },
     ],
-    auth: ctx.authVerifier.accessCheckTakedown,
+    auth: ctx.authVerifier.accessFull({ checkTakedown: true }),
     handler: async ({ auth, req }) => {
       const did = auth.credentials.did
       const account = await ctx.accountManager.getAccount(did, {

package/src/api/com/atproto/server/requestEmailConfirmation.ts

@@ -18,7 +18,7 @@ export default function (server: Server, ctx: AppContext) {
         calcKey: ({ auth }) => auth.credentials.did,
       },
     ],
-    auth: ctx.authVerifier.accessCheckTakedown,
+    auth: ctx.authVerifier.accessStandard({ checkTakedown: true }),
     handler: async ({ auth, req }) => {
       const did = auth.credentials.did
       const account = await ctx.accountManager.getAccount(did, {

package/src/api/com/atproto/server/requestEmailUpdate.ts

@@ -18,7 +18,7 @@ export default function (server: Server, ctx: AppContext) {
         calcKey: ({ auth }) => auth.credentials.did,
       },
     ],
-    auth: ctx.authVerifier.accessCheckTakedown,
+    auth: ctx.authVerifier.accessStandard({ checkTakedown: true }),
     handler: async ({ auth, req }) => {
       const did = auth.credentials.did
       const account = await ctx.accountManager.getAccount(did, {

package/src/api/com/atproto/server/revokeAppPassword.ts

@@ -4,7 +4,7 @@ import { authPassthru } from '../../../proxy'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.server.revokeAppPassword({
-    auth: ctx.authVerifier.access,
+    auth: ctx.authVerifier.accessStandard(),
     handler: async ({ auth, input, req }) => {
       if (ctx.entrywayAgent) {
         await ctx.entrywayAgent.com.atproto.server.revokeAppPassword(

package/src/api/com/atproto/server/updateEmail.ts

@@ -7,7 +7,7 @@ import { UserAlreadyExistsError } from '../../../../account-manager/helpers/acco
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.server.updateEmail({
-    auth: ctx.authVerifier.accessFull,
+    auth: ctx.authVerifier.accessFull({ checkTakedown: true }),
     handler: async ({ auth, input, req }) => {
       const did = auth.credentials.did
       const { token, email } = input.body

package/src/api/com/atproto/sync/getRepoStatus.ts

@@ -1,13 +1,13 @@
 import { Server } from '../../../../lexicon'
 import AppContext from '../../../../context'
-import { assertRepoAvailability, formatAccountStatus } from './util'
+import { assertRepoAvailability } from './util'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.sync.getRepoStatus({
     handler: async ({ params }) => {
       const { did } = params
       const account = await assertRepoAvailability(ctx, did, true)
-      const { active, status } = formatAccountStatus(account)
+      const { active, status } = account
 
       let rev: string | undefined = undefined
       if (active) {

package/src/api/com/atproto/sync/listRepos.ts

@@ -2,7 +2,7 @@ import { InvalidRequestError } from '@atproto/xrpc-server'
 import { Server } from '../../../../lexicon'
 import AppContext from '../../../../context'
 import { Cursor, GenericKeyset, paginate } from '../../../../db/pagination'
-import { formatAccountStatus } from './util'
+import { formatAccountStatus } from '../../../../account-manager/helpers/account'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.sync.listRepos(async ({ params }) => {

package/src/api/com/atproto/sync/util.ts

@@ -1,8 +1,5 @@
 import { InvalidRequestError } from '@atproto/xrpc-server'
-import {
-  AccountStatus,
-  ActorAccount,
-} from '../../../../account-manager/helpers/account'
+import { ActorAccount } from '../../../../account-manager/helpers/account'
 import AppContext from '../../../../context'
 
 export const assertRepoAvailability = async (
@@ -37,23 +34,3 @@ export const assertRepoAvailability = async (
   }
   return account
 }
-
-export const formatAccountStatus = (account: {
-  takedownRef: string | null
-  deactivatedAt: string | null
-}): {
-  active: boolean
-  status?: AccountStatus
-} => {
-  let status: AccountStatus | undefined = undefined
-  if (account.takedownRef) {
-    status = AccountStatus.Takendown
-  } else if (account.deactivatedAt) {
-    status = AccountStatus.Deactivated
-  }
-  const active = !status
-  return {
-    active,
-    status,
-  }
-}

package/src/api/com/atproto/temp/checkSignupQueue.ts

@@ -1,11 +1,14 @@
 import { Server } from '../../../../lexicon'
 import AppContext from '../../../../context'
 import { authPassthru, resultPassthru } from '../../../proxy'
+import { AuthScope } from '../../../../auth-verifier'
 
 // THIS IS A TEMPORARY UNSPECCED ROUTE
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.temp.checkSignupQueue({
-    auth: ctx.authVerifier.accessDeactived,
+    auth: ctx.authVerifier.accessStandard({
+      additional: [AuthScope.SignupQueued],
+    }),
     handler: async ({ req }) => {
       if (!ctx.entrywayAgent) {
         return {