@atproto/pds 0.5.11 → 0.5.14

package/src/api/com/atproto/repo/putRecord.ts

@@ -1,211 +0,0 @@
-import { atUri } from '@atproto/lex'
-import {
-  LegacyBlobRef,
-  LexMap,
-  TypedBlobRef,
-  isLegacyBlobRef,
-  parseCid,
-} from '@atproto/lex-data'
-import {
-  AuthRequiredError,
-  InvalidRequestError,
-  Server,
-} from '@atproto/xrpc-server'
-import { ActorStoreTransactor } from '../../../../actor-store/actor-store-transactor.js'
-import { AppContext } from '../../../../context.js'
-import { app, com } from '../../../../lexicons/index.js'
-import { dbLogger } from '../../../../logger.js'
-import {
-  BadCommitSwapError,
-  BadRecordSwapError,
-  InvalidRecordError,
-  PreparedCreate,
-  PreparedUpdate,
-  prepareCreate,
-  prepareUpdate,
-} from '../../../../repo/index.js'
-
-export default function (server: Server, ctx: AppContext) {
-  server.add(com.atproto.repo.putRecord, {
-    auth: ctx.authVerifier.authorization({
-      // @NOTE the "checkTakedown" and "checkDeactivated" checks are typically
-      // performed during auth. However, since this method's "repo" parameter
-      // can be a handle, we will need to fetch the account again to ensure that
-      // the handle matches the DID from the request's credentials. In order to
-      // avoid fetching the account twice (during auth, and then again in the
-      // controller), the checks are disabled here:
-
-      // checkTakedown: true,
-      // checkDeactivated: true,
-      authorize: () => {
-        // Performed in the handler as it requires the request body
-      },
-    }),
-    rateLimit: [
-      {
-        name: 'repo-write-hour',
-        calcKey: ({ auth }) => auth.credentials.did,
-        calcPoints: () => 2,
-      },
-      {
-        name: 'repo-write-day',
-        calcKey: ({ auth }) => auth.credentials.did,
-        calcPoints: () => 2,
-      },
-    ],
-    opts: {
-      jsonLimit: 1_000_000,
-    },
-    handler: async ({ auth, input }) => {
-      const {
-        repo,
-        collection,
-        rkey,
-        record,
-        validate,
-        swapCommit,
-        swapRecord,
-      } = input.body
-
-      const account = await ctx.authVerifier.findAccount(repo, {
-        checkDeactivated: true,
-        checkTakedown: true,
-      })
-
-      const did = account.did
-      if (did !== auth.credentials.did) {
-        throw new AuthRequiredError()
-      }
-
-      // We can't compute permissions based on the request payload ("input") in
-      // the 'auth' phase, so we do it here.
-      if (auth.credentials.type === 'oauth') {
-        auth.credentials.permissions.assertRepo({
-          action: 'create',
-          collection,
-        })
-        auth.credentials.permissions.assertRepo({
-          action: 'update',
-          collection,
-        })
-      }
-
-      const uri = atUri(did, collection, rkey)
-      const swapCommitCid = swapCommit ? parseCid(swapCommit) : undefined
-      const swapRecordCid =
-        typeof swapRecord === 'string' ? parseCid(swapRecord) : swapRecord
-
-      const { commit, write } = await ctx.actorStore.transact(
-        did,
-        async (actorTxn) => {
-          const current = await actorTxn.record.getRecord(uri, null, true)
-          const isUpdate = current !== null
-
-          // @TODO temporaray hack for legacy blob refs in profiles - remove after migrating legacy blobs
-          if (isUpdate && collection === app.bsky.actor.profile.$type) {
-            await updateProfileLegacyBlobRef(actorTxn, record)
-          }
-
-          const writeInfo = {
-            did,
-            collection,
-            rkey,
-            record,
-            swapCid: swapRecordCid,
-            validate,
-          }
-
-          let write: PreparedCreate | PreparedUpdate
-          try {
-            write = isUpdate
-              ? await prepareUpdate(writeInfo)
-              : await prepareCreate(writeInfo)
-          } catch (err) {
-            if (err instanceof InvalidRecordError) {
-              throw new InvalidRequestError(err.message)
-            }
-            throw err
-          }
-
-          // no-op
-          if (current && current.cid === write.cid.toString()) {
-            return {
-              commit: null,
-              write,
-            }
-          }
-
-          const commit = await actorTxn.repo
-            .processWrites([write], swapCommitCid)
-            .catch((err) => {
-              if (
-                err instanceof BadCommitSwapError ||
-                err instanceof BadRecordSwapError
-              ) {
-                throw new InvalidRequestError(err.message, 'InvalidSwap')
-              } else {
-                throw err
-              }
-            })
-
-          await ctx.sequencer.sequenceCommit(did, commit)
-
-          return { commit, write }
-        },
-      )
-
-      if (commit !== null) {
-        await ctx.accountManager
-          .updateRepoRoot(did, commit.cid, commit.rev)
-          .catch((err) => {
-            dbLogger.error(
-              { err, did, cid: commit.cid, rev: commit.rev },
-              'failed to update account root',
-            )
-          })
-      }
-
-      return {
-        encoding: 'application/json',
-        body: {
-          uri: write.uri.toString(),
-          cid: write.cid.toString(),
-          commit: commit
-            ? {
-                cid: commit.cid.toString(),
-                rev: commit.rev,
-              }
-            : undefined,
-          validationStatus: write.validationStatus,
-        },
-      }
-    },
-  })
-}
-
-// WARNING: mutates object
-async function updateProfileLegacyBlobRef(
-  actorStore: ActorStoreTransactor,
-  record: LexMap,
-): Promise<void> {
-  if (isLegacyBlobRef(record.avatar)) {
-    record.avatar = await upgradeLegacyBlob(actorStore, record.avatar)
-  }
-  if (isLegacyBlobRef(record.banner)) {
-    record.banner = await upgradeLegacyBlob(actorStore, record.banner)
-  }
-}
-
-async function upgradeLegacyBlob(
-  actorStore: ActorStoreTransactor,
-  legacyBlob: LegacyBlobRef,
-): Promise<TypedBlobRef> {
-  const ref = parseCid(legacyBlob.cid)
-  const blob = await actorStore.repo.blob.getBlobMetadata(ref)
-  return {
-    $type: 'blob',
-    mimeType: legacyBlob.mimeType,
-    ref,
-    size: blob.size,
-  }
-}

package/src/api/com/atproto/repo/uploadBlob.ts

@@ -1,60 +0,0 @@
-import { DAY } from '@atproto/common'
-import {
-  Server,
-  UpstreamTimeoutError,
-  parseReqEncoding,
-} from '@atproto/xrpc-server'
-import { AppContext } from '../../../../context.js'
-import { com } from '../../../../lexicons/index.js'
-
-export default function (server: Server, ctx: AppContext) {
-  server.add(com.atproto.repo.uploadBlob, {
-    auth: ctx.authVerifier.authorizationOrUserServiceAuth({
-      checkTakedown: true,
-      authorize: (permissions, { req }) => {
-        const encoding = parseReqEncoding(req)
-        permissions.assertBlob({ mime: encoding })
-      },
-    }),
-    rateLimit: {
-      durationMs: DAY,
-      points: 1000,
-    },
-    handler: async ({ auth, input }) => {
-      const requester = auth.credentials.did
-
-      const blob = await ctx.actorStore.writeNoTransaction(
-        requester,
-        async (store) => {
-          const metadata = await store.repo.blob
-            .uploadBlobAndGetMetadata(input.encoding, input.body)
-            .catch(throwAbortAsUpstreamError)
-
-          return store.transact(async (actorTxn) => {
-            const blobRef =
-              await actorTxn.repo.blob.trackUntetheredBlob(metadata)
-
-            // make the blob permanent if an associated record is already indexed
-            if (await actorTxn.repo.blob.hasRecordsForBlob(blobRef.ref)) {
-              await actorTxn.repo.blob.verifyBlobAndMakePermanent(blobRef)
-            }
-
-            return blobRef
-          })
-        },
-      )
-
-      return {
-        encoding: 'application/json' as const,
-        body: { blob },
-      }
-    },
-  })
-}
-
-function throwAbortAsUpstreamError(err: unknown): never {
-  if (err?.['name'] === 'AbortError') {
-    throw new UpstreamTimeoutError('Operation timed out, please try again.')
-  }
-  throw err
-}

package/src/api/com/atproto/server/activateAccount.ts

@@ -1,37 +0,0 @@
-import { ForbiddenError, Server } from '@atproto/xrpc-server'
-import { ACCESS_FULL } from '../../../../auth-scope.js'
-import { AppContext } from '../../../../context.js'
-import { com } from '../../../../lexicons/index.js'
-
-export default function (server: Server, ctx: AppContext) {
-  const { entrywayClient } = ctx
-
-  const auth = ctx.authVerifier.authorization({
-    scopes: ACCESS_FULL,
-    authorize: () => {
-      throw new ForbiddenError(
-        'OAuth credentials are not supported for this endpoint',
-      )
-    },
-  })
-
-  if (entrywayClient) {
-    // in the case of entryway, the full flow is activateAccount (PDS) -> activateAccount (Entryway) -> updateSubjectStatus(PDS)
-    server.add(com.atproto.server.activateAccount, {
-      auth,
-      handler: async ({ req }) => {
-        const { headers } = ctx.entrywayPassthruHeaders(req)
-        await entrywayClient.xrpc(com.atproto.server.activateAccount, {
-          headers,
-        })
-      },
-    })
-  } else {
-    server.add(com.atproto.server.activateAccount, {
-      auth,
-      handler: async ({ auth }) => {
-        await ctx.accountManager.activateAccount(auth.credentials.did)
-      },
-    })
-  }
-}

package/src/api/com/atproto/server/checkAccountStatus.ts

@@ -1,51 +0,0 @@
-import { Server } from '@atproto/xrpc-server'
-import { AppContext } from '../../../../context.js'
-import { com } from '../../../../lexicons/index.js'
-import { isValidDidDocForService } from './util.js'
-
-export default function (server: Server, ctx: AppContext) {
-  server.add(com.atproto.server.checkAccountStatus, {
-    auth: ctx.authVerifier.authorization({
-      authorize: () => {
-        // always allow
-      },
-    }),
-    handler: async ({ auth }) => {
-      const requester = auth.credentials.did
-      const [
-        repoRoot,
-        repoBlocks,
-        indexedRecords,
-        importedBlobs,
-        expectedBlobs,
-      ] = await ctx.actorStore.read(requester, async (store) => {
-        return await Promise.all([
-          store.repo.storage.getRootDetailed(),
-          store.repo.storage.countBlocks(),
-          store.record.recordCount(),
-          store.repo.blob.blobCount(),
-          store.repo.blob.recordBlobCount(),
-        ])
-      })
-      const [activated, validDid] = await Promise.all([
-        ctx.accountManager.isAccountActivated(requester),
-        isValidDidDocForService(ctx, requester),
-      ])
-
-      return {
-        encoding: 'application/json' as const,
-        body: {
-          activated,
-          validDid,
-          repoCommit: repoRoot.cid.toString(),
-          repoRev: repoRoot.rev,
-          repoBlocks,
-          indexedRecords,
-          privateStateValues: 0,
-          expectedBlobs,
-          importedBlobs,
-        },
-      }
-    },
-  })
-}

package/src/api/com/atproto/server/confirmEmail.ts

@@ -1,39 +0,0 @@
-import { Server } from '@atproto/xrpc-server'
-import { AppContext } from '../../../../context.js'
-import { com } from '../../../../lexicons/index.js'
-import { requestEmailConfirmationAuth } from './requestEmailConfirmation.js'
-
-export default function (server: Server, ctx: AppContext) {
-  const { entrywayClient } = ctx
-
-  // @NOTE Ensure that both endpoints use the same authentication logic
-  const auth = requestEmailConfirmationAuth(ctx)
-
-  if (entrywayClient) {
-    server.add(com.atproto.server.confirmEmail, {
-      auth,
-      handler: async ({ auth, input: { body }, req }) => {
-        const { headers } = await ctx.entrywayAuthHeaders(
-          req,
-          auth.credentials.did,
-          com.atproto.server.confirmEmail.$lxm,
-        )
-        await entrywayClient.xrpc(com.atproto.server.confirmEmail, {
-          headers,
-          body,
-        })
-      },
-    })
-  } else {
-    server.add(com.atproto.server.confirmEmail, {
-      auth,
-      handler: async ({ auth, input: { body } }) => {
-        await ctx.accountManager.confirmEmail(
-          auth.credentials.did,
-          body.email,
-          body.token,
-        )
-      },
-    })
-  }
-}