@atproto/pds 0.5.11 → 0.5.14

package/src/api/com/atproto/server/requestEmailConfirmation.ts

@@ -1,68 +0,0 @@
-import { DAY, HOUR } from '@atproto/common'
-import {
-  MethodAuthVerifier,
-  MethodRateLimit,
-  Server,
-} from '@atproto/xrpc-server'
-import { AccessOutput, OAuthOutput } from '../../../../auth-output.js'
-import { AppContext } from '../../../../context.js'
-import { com } from '../../../../lexicons/index.js'
-
-// Exposed as a utility to ensure auth in confirmEmail and requestEmailConfirmation
-export function requestEmailConfirmationAuth(
-  ctx: AppContext,
-): MethodAuthVerifier<AccessOutput | OAuthOutput> {
-  return ctx.authVerifier.authorization({
-    checkTakedown: true,
-    authorize: (permissions) => {
-      permissions.assertAccount({ attr: 'email', action: 'manage' })
-    },
-  })
-}
-
-const rateLimit: MethodRateLimit<AccessOutput | OAuthOutput> = [
-  {
-    durationMs: DAY,
-    points: 15,
-    calcKey: ({ auth }) => auth.credentials.did,
-  },
-  {
-    durationMs: HOUR,
-    points: 5,
-    calcKey: ({ auth }) => auth.credentials.did,
-  },
-]
-
-export default function (server: Server, ctx: AppContext) {
-  const { entrywayClient } = ctx
-
-  const auth = requestEmailConfirmationAuth(ctx)
-
-  if (entrywayClient) {
-    server.add(com.atproto.server.requestEmailConfirmation, {
-      auth,
-      rateLimit,
-      handler: async ({ auth, req }) => {
-        const { headers } = await ctx.entrywayAuthHeaders(
-          req,
-          auth.credentials.did,
-          com.atproto.server.requestEmailConfirmation.$lxm,
-        )
-
-        await entrywayClient.xrpc(com.atproto.server.requestEmailConfirmation, {
-          headers,
-        })
-      },
-    })
-  } else {
-    server.add(com.atproto.server.requestEmailConfirmation, {
-      auth,
-      rateLimit,
-      handler: async ({ auth }) => {
-        const did = auth.credentials.did
-        const locale = undefined // @TODO get the locale somehow
-        await ctx.accountManager.requestEmailConfirmation(did, { locale })
-      },
-    })
-  }
-}

package/src/api/com/atproto/server/requestEmailUpdate.ts

@@ -1,86 +0,0 @@
-import { DAY, HOUR } from '@atproto/common'
-import {
-  ForbiddenError,
-  MethodAuthVerifier,
-  MethodRateLimit,
-  Server,
-} from '@atproto/xrpc-server'
-import { AccessOutput, OAuthOutput } from '../../../../auth-output.js'
-import { ACCESS_FULL } from '../../../../auth-scope.js'
-import { AppContext } from '../../../../context.js'
-import { com } from '../../../../lexicons/index.js'
-
-// Exposed as a utility to ensure auth in updateEmail and requestEmailUpdate
-// stay consistent.
-export function requestEmailUpdateAuth(
-  ctx: AppContext,
-): MethodAuthVerifier<AccessOutput | OAuthOutput> {
-  return ctx.authVerifier.authorization({
-    checkTakedown: true,
-    scopes: ACCESS_FULL,
-    authorize: () => {
-      throw new ForbiddenError(
-        'Use the account manager interface to update email address associated with an account',
-      )
-    },
-  })
-}
-
-const rateLimit: MethodRateLimit<AccessOutput | OAuthOutput> = [
-  {
-    durationMs: DAY,
-    points: 15,
-    calcKey: ({ auth }) => auth.credentials.did,
-  },
-  {
-    durationMs: HOUR,
-    points: 5,
-    calcKey: ({ auth }) => auth.credentials.did,
-  },
-]
-
-export default function (server: Server, ctx: AppContext) {
-  const { entrywayClient } = ctx
-
-  const auth = requestEmailUpdateAuth(ctx)
-
-  if (entrywayClient) {
-    server.add(com.atproto.server.requestEmailUpdate, {
-      rateLimit,
-      auth,
-      handler: async ({ auth, req }) => {
-        const { headers } = await ctx.entrywayAuthHeaders(
-          req,
-          auth.credentials.did,
-          com.atproto.server.requestEmailUpdate.$lxm,
-        )
-
-        return entrywayClient.xrpc(com.atproto.server.requestEmailUpdate, {
-          headers,
-        })
-      },
-    })
-  } else {
-    server.add(com.atproto.server.requestEmailUpdate, {
-      rateLimit,
-      auth,
-      handler: async ({ auth }) => {
-        const did = auth.credentials.did
-
-        // @TODO get the locale somehow (either by adding a field in the request
-        // body, or by using the `Accept-Language` header).
-        const locale = undefined
-
-        const { tokenRequired } = await ctx.accountManager.requestEmailUpdate(
-          did,
-          { locale },
-        )
-
-        return {
-          encoding: 'application/json' as const,
-          body: { tokenRequired },
-        }
-      },
-    })
-  }
-}

package/src/api/com/atproto/server/requestPasswordReset.ts

@@ -1,52 +0,0 @@
-import { DAY, HOUR } from '@atproto/common'
-import { InvalidRequestError, Server } from '@atproto/xrpc-server'
-import { AppContext } from '../../../../context.js'
-import { com } from '../../../../lexicons/index.js'
-
-export default function (server: Server, ctx: AppContext) {
-  const { entrywayClient } = ctx
-
-  server.add(com.atproto.server.requestPasswordReset, {
-    rateLimit: [
-      {
-        durationMs: DAY,
-        points: 50,
-      },
-      {
-        durationMs: HOUR,
-        points: 15,
-      },
-    ],
-    handler: async ({ input: { body }, req }) => {
-      const email = body.email.toLowerCase()
-
-      const account = await ctx.accountManager.getAccountByEmail(email, {
-        includeDeactivated: true,
-        includeTakenDown: true,
-      })
-
-      if (account?.email) {
-        const token = await ctx.accountManager.createEmailToken(
-          account.did,
-          'reset_password',
-        )
-        await ctx.mailer.sendResetPassword(
-          { handle: account.handle ?? account.email, token },
-          { to: account.email },
-        )
-        return
-      }
-
-      if (entrywayClient) {
-        const { headers } = ctx.entrywayPassthruHeaders(req)
-        await entrywayClient.xrpc(com.atproto.server.requestPasswordReset, {
-          headers,
-          body,
-        })
-        return
-      }
-
-      throw new InvalidRequestError('account does not have an email address')
-    },
-  })
-}

package/src/api/com/atproto/server/reserveSigningKey.ts

@@ -1,15 +0,0 @@
-import { Server } from '@atproto/xrpc-server'
-import { AppContext } from '../../../../context.js'
-import { com } from '../../../../lexicons/index.js'
-
-export default function (server: Server, ctx: AppContext) {
-  server.add(com.atproto.server.reserveSigningKey, {
-    handler: async ({ input }) => {
-      const signingKey = await ctx.actorStore.reserveKeypair(input.body.did)
-      return {
-        encoding: 'application/json' as const,
-        body: { signingKey },
-      }
-    },
-  })
-}

package/src/api/com/atproto/server/resetPassword.ts

@@ -1,50 +0,0 @@
-import { MINUTE } from '@atproto/common'
-import {
-  InvalidRequestError,
-  MethodRateLimit,
-  Server,
-} from '@atproto/xrpc-server'
-import { NEW_PASSWORD_MAX_LENGTH } from '../../../../account-manager/helpers/scrypt.js'
-import { AppContext } from '../../../../context.js'
-import { com } from '../../../../lexicons/index.js'
-
-export default function (server: Server, ctx: AppContext) {
-  const { entrywayClient } = ctx
-
-  const rateLimit: MethodRateLimit<
-    void,
-    com.atproto.server.resetPassword.$Params,
-    com.atproto.server.resetPassword.$Input
-  > = [
-    {
-      durationMs: 5 * MINUTE,
-      points: 50,
-    },
-  ]
-
-  if (entrywayClient) {
-    server.add(com.atproto.server.resetPassword, {
-      rateLimit,
-      handler: async ({ input: { body }, req }) => {
-        const { headers } = ctx.entrywayPassthruHeaders(req)
-        await entrywayClient.xrpc(com.atproto.server.resetPassword, {
-          headers,
-          body,
-        })
-      },
-    })
-  } else {
-    server.add(com.atproto.server.resetPassword, {
-      rateLimit,
-      handler: async ({ input: { body } }) => {
-        const { token, password } = body
-
-        if (password.length > NEW_PASSWORD_MAX_LENGTH) {
-          throw new InvalidRequestError('Invalid password length.')
-        }
-
-        await ctx.accountManager.resetPassword({ token, password })
-      },
-    })
-  }
-}

package/src/api/com/atproto/server/revokeAppPassword.ts

@@ -1,42 +0,0 @@
-import { ForbiddenError, Server } from '@atproto/xrpc-server'
-import { AppContext } from '../../../../context.js'
-import { com } from '../../../../lexicons/index.js'
-
-export default function (server: Server, ctx: AppContext) {
-  const { entrywayClient } = ctx
-
-  const auth = ctx.authVerifier.authorization({
-    authorize: () => {
-      throw new ForbiddenError(
-        'OAuth credentials are not supported for this endpoint',
-      )
-    },
-  })
-
-  if (entrywayClient) {
-    server.add(com.atproto.server.revokeAppPassword, {
-      auth,
-      handler: async ({ auth, input: { body }, req }) => {
-        const { headers } = await ctx.entrywayAuthHeaders(
-          req,
-          auth.credentials.did,
-          com.atproto.server.revokeAppPassword.$lxm,
-        )
-
-        await entrywayClient.xrpc(com.atproto.server.revokeAppPassword, {
-          headers,
-          body,
-        })
-      },
-    })
-  } else {
-    server.add(com.atproto.server.revokeAppPassword, {
-      auth,
-      handler: async ({ auth, input: { body } }) => {
-        const requester = auth.credentials.did
-
-        await ctx.accountManager.revokeAppPassword(requester, body.name)
-      },
-    })
-  }
-}

package/src/api/com/atproto/server/updateEmail.ts

@@ -1,52 +0,0 @@
-import { InvalidRequestError, Server } from '@atproto/xrpc-server'
-import { UserAlreadyExistsError } from '../../../../account-manager/helpers/account.js'
-import { AppContext } from '../../../../context.js'
-import { com } from '../../../../lexicons/index.js'
-import { requestEmailUpdateAuth } from './requestEmailUpdate.js'
-
-export default function (server: Server, ctx: AppContext) {
-  const { entrywayClient } = ctx
-
-  // @NOTE Ensure that both endpoints use the same authentication logic
-  const auth = requestEmailUpdateAuth(ctx)
-
-  if (entrywayClient) {
-    server.add(com.atproto.server.updateEmail, {
-      auth,
-      handler: async ({ auth, input: { body }, req }) => {
-        const { headers } = await ctx.entrywayAuthHeaders(
-          req,
-          auth.credentials.did,
-          com.atproto.server.updateEmail.$lxm,
-        )
-
-        await entrywayClient.xrpc(com.atproto.server.updateEmail, {
-          headers,
-          body,
-        })
-      },
-    })
-  } else {
-    server.add(com.atproto.server.updateEmail, {
-      auth,
-      handler: async ({ auth, input: { body } }) => {
-        const did = auth.credentials.did
-        const { token, email } = body
-
-        // @TODO get the locale somehow (either by adding a field in the request
-        // body, or by using the `Accept-Language` header).
-        const locale = undefined
-
-        try {
-          await ctx.accountManager.updateEmail(did, email, token, { locale })
-        } catch (cause) {
-          if (cause instanceof UserAlreadyExistsError) {
-            throw new InvalidRequestError(cause.message, undefined, { cause })
-          }
-
-          throw cause
-        }
-      },
-    })
-  }
-}

package/src/api/com/atproto/server/util.ts

@@ -1,136 +0,0 @@
-import * as plc from '@did-plc/lib'
-import { getPdsEndpoint, getSigningDidKey } from '@atproto/common'
-import * as crypto from '@atproto/crypto'
-import { DidDocument, IdResolver } from '@atproto/identity'
-import { InvalidRequestError } from '@atproto/xrpc-server'
-import { ActorStore } from '../../../../actor-store/actor-store.js'
-import { ServerConfig } from '../../../../config/index.js'
-import { httpLogger } from '../../../../logger.js'
-
-// generate an invite code preceded by the hostname
-// with '.'s replaced by '-'s so it is not mistakable for a link
-// ex: bsky-app-abc23-567xy
-// regex: bsky-app-[a-z2-7]{5}-[a-z2-7]{5}
-export const genInvCode = (cfg: ServerConfig): string => {
-  return cfg.service.hostname.replaceAll('.', '-') + '-' + getRandomToken()
-}
-
-export const genInvCodes = (cfg: ServerConfig, count: number): string[] => {
-  const codes: string[] = []
-  for (let i = 0; i < count; i++) {
-    codes.push(genInvCode(cfg))
-  }
-  return codes
-}
-
-// Formatted xxxxx-xxxxx where digits are in base32
-export const getRandomToken = () => {
-  const token = crypto.randomStr(8, 'base32').slice(0, 10)
-  return token.slice(0, 5) + '-' + token.slice(5, 10)
-}
-
-export const safeResolveDidDoc = async (
-  ctx: { idResolver: IdResolver },
-  did: string,
-  forceRefresh?: boolean,
-): Promise<DidDocument | undefined> => {
-  try {
-    const didDoc = await ctx.idResolver.did.resolve(did, forceRefresh)
-    return didDoc ?? undefined
-  } catch (err) {
-    httpLogger.warn({ err, did }, 'failed to resolve did doc')
-  }
-}
-
-export const didDocForSession = async (
-  ctx: { idResolver: IdResolver; cfg: ServerConfig },
-  did: string,
-  forceRefresh?: boolean,
-): Promise<DidDocument | undefined> => {
-  if (!ctx.cfg.identity.enableDidDocWithSession) return
-  return safeResolveDidDoc(ctx, did, forceRefresh)
-}
-
-export const isValidDidDocForService = async (
-  ctx: {
-    plcClient: plc.Client
-    idResolver: IdResolver
-    cfg: ServerConfig
-    plcRotationKey: crypto.Keypair
-    actorStore: ActorStore
-  },
-  did: string,
-): Promise<boolean> => {
-  try {
-    await assertValidDidDocumentForService(ctx, did)
-    return true
-  } catch {
-    return false
-  }
-}
-
-export const assertValidDidDocumentForService = async (
-  ctx: {
-    plcClient: plc.Client
-    idResolver: IdResolver
-    cfg: ServerConfig
-    plcRotationKey: crypto.Keypair
-    actorStore: ActorStore
-  },
-  did: string,
-) => {
-  if (did.startsWith('did:plc')) {
-    const resolved = await ctx.plcClient.getDocumentData(did)
-    await assertValidDocContents(ctx, did, {
-      pdsEndpoint: resolved.services['atproto_pds']?.endpoint,
-      signingKey: resolved.verificationMethods['atproto'],
-      rotationKeys: resolved.rotationKeys,
-    })
-  } else {
-    const resolved = await ctx.idResolver.did.resolve(did, true)
-    if (!resolved) {
-      throw new InvalidRequestError('Could not resolve DID')
-    }
-    await assertValidDocContents(ctx, did, {
-      pdsEndpoint: getPdsEndpoint(resolved),
-      signingKey: getSigningDidKey(resolved),
-    })
-  }
-}
-
-const assertValidDocContents = async (
-  ctx: {
-    cfg: ServerConfig
-    plcRotationKey: crypto.Keypair
-    actorStore: ActorStore
-  },
-  did: string,
-  contents: {
-    signingKey?: string
-    pdsEndpoint?: string
-    rotationKeys?: string[]
-  },
-) => {
-  const { signingKey, pdsEndpoint, rotationKeys } = contents
-
-  const plcRotationKey =
-    ctx.cfg.entryway?.plcRotationKey ?? ctx.plcRotationKey.did()
-  if (rotationKeys !== undefined && !rotationKeys.includes(plcRotationKey)) {
-    throw new InvalidRequestError(
-      'Server rotation key not included in PLC DID data',
-    )
-  }
-
-  if (!pdsEndpoint || pdsEndpoint !== ctx.cfg.service.publicUrl) {
-    throw new InvalidRequestError(
-      'DID document atproto_pds service endpoint does not match PDS public url',
-    )
-  }
-
-  const keypair = await ctx.actorStore.keypair(did)
-  if (!signingKey || signingKey !== keypair.did()) {
-    throw new InvalidRequestError(
-      'DID document verification method does not match expected signing key',
-    )
-  }
-}

package/src/api/com/atproto/sync/deprecated/getCheckout.ts

@@ -1,27 +0,0 @@
-import { Server } from '@atproto/xrpc-server'
-import { isUserOrAdmin } from '../../../../../auth-verifier.js'
-import { AppContext } from '../../../../../context.js'
-import { com } from '../../../../../lexicons/index.js'
-import { getCarStream } from '../getRepo.js'
-import { assertRepoAvailability } from '../util.js'
-
-export default function (server: Server, ctx: AppContext) {
-  server.add(com.atproto.sync.getCheckout, {
-    auth: ctx.authVerifier.authorizationOrAdminTokenOptional({
-      authorize: () => {
-        // always allow
-      },
-    }),
-    handler: async ({ params, auth }) => {
-      const { did } = params
-      await assertRepoAvailability(ctx, did, isUserOrAdmin(auth, did))
-
-      const carStream = await getCarStream(ctx, did)
-
-      return {
-        encoding: 'application/vnd.ipld.car' as const,
-        body: carStream,
-      }
-    },
-  })
-}

package/src/api/com/atproto/sync/deprecated/getHead.ts

@@ -1,33 +0,0 @@
-import { InvalidRequestError, Server } from '@atproto/xrpc-server'
-import { isUserOrAdmin } from '../../../../../auth-verifier.js'
-import { AppContext } from '../../../../../context.js'
-import { com } from '../../../../../lexicons/index.js'
-import { assertRepoAvailability } from '../util.js'
-
-export default function (server: Server, ctx: AppContext) {
-  server.add(com.atproto.sync.getHead, {
-    auth: ctx.authVerifier.authorizationOrAdminTokenOptional({
-      authorize: () => {
-        // always allow
-      },
-    }),
-    handler: async ({ params, auth }) => {
-      const { did } = params
-      await assertRepoAvailability(ctx, did, isUserOrAdmin(auth, did))
-
-      const root = await ctx.actorStore.read(did, (store) =>
-        store.repo.storage.getRoot(),
-      )
-      if (root === null) {
-        throw new InvalidRequestError(
-          `Could not find root for DID: ${did}`,
-          'HeadNotFound',
-        )
-      }
-      return {
-        encoding: 'application/json' as const,
-        body: { root: root.toString() },
-      }
-    },
-  })
-}

package/src/api/com/atproto/sync/getBlob.ts

@@ -1,61 +0,0 @@
-import { parseCid } from '@atproto/lex-data'
-import { BlobNotFoundError } from '@atproto/repo'
-import { InvalidRequestError, Server } from '@atproto/xrpc-server'
-import { AuthScope } from '../../../../auth-scope.js'
-import { isUserOrAdmin } from '../../../../auth-verifier.js'
-import { AppContext } from '../../../../context.js'
-import { com } from '../../../../lexicons/index.js'
-import { assertRepoAvailability } from './util.js'
-
-export default function (server: Server, ctx: AppContext) {
-  server.add(com.atproto.sync.getBlob, {
-    auth: ctx.authVerifier.authorizationOrAdminTokenOptional({
-      additional: [AuthScope.Takendown],
-      authorize: () => {
-        // always allow
-      },
-    }),
-    handler: async ({ params, res, auth }) => {
-      const { did } = params
-      await assertRepoAvailability(ctx, did, isUserOrAdmin(auth, did))
-
-      const cid = parseCid(params.cid)
-      const found = await ctx.actorStore.read(params.did, async (store) => {
-        try {
-          return await store.repo.blob.getBlob(cid)
-        } catch (err) {
-          if (err instanceof BlobNotFoundError) {
-            throw new InvalidRequestError('Blob not found')
-          } else {
-            throw err
-          }
-        }
-      })
-      if (!found) {
-        throw new InvalidRequestError('Blob not found')
-      }
-      res.setHeader('content-length', found.size)
-
-      // Important Security headers
-
-      // This prevents the browser from trying to guess the content type
-      // and potentially loading the blob as executable code, or rendering it
-      // in some other unsafe way.
-      res.setHeader('x-content-type-options', 'nosniff')
-
-      // This forces the browser to download the blob instead of trying to
-      // render it when visiting the URL. This is important to prevent XSS
-      // attacks if the blob happens to be HTML. Even if JS is disabled via the
-      // CSP header below, a blob could still contain malicious HTML links.
-      res.setHeader('content-disposition', `attachment; filename="${cid}"`)
-
-      // This should prevent the browser from executing the blob in any way
-      res.setHeader('content-security-policy', `default-src 'none'; sandbox`)
-
-      return {
-        encoding: found.mimeType || ('application/octet-stream' as const),
-        body: found.stream,
-      }
-    },
-  })
-}

package/src/api/com/atproto/sync/getBlocks.ts

@@ -1,37 +0,0 @@
-import { byteIterableToStream } from '@atproto/common'
-import { parseCid } from '@atproto/lex-data'
-import { blocksToCarStream } from '@atproto/repo'
-import { InvalidRequestError, Server } from '@atproto/xrpc-server'
-import { isUserOrAdmin } from '../../../../auth-verifier.js'
-import { AppContext } from '../../../../context.js'
-import { com } from '../../../../lexicons/index.js'
-import { assertRepoAvailability } from './util.js'
-
-export default function (server: Server, ctx: AppContext) {
-  server.add(com.atproto.sync.getBlocks, {
-    auth: ctx.authVerifier.authorizationOrAdminTokenOptional({
-      authorize: () => {
-        // always allow
-      },
-    }),
-    handler: async ({ params, auth }) => {
-      const { did } = params
-      await assertRepoAvailability(ctx, did, isUserOrAdmin(auth, did))
-
-      const cids = params.cids.map(parseCid)
-      const got = await ctx.actorStore.read(did, (store) =>
-        store.repo.storage.getBlocks(cids),
-      )
-      if (got.missing.length > 0) {
-        const missingStr = got.missing.map((c) => c.toString())
-        throw new InvalidRequestError(`Could not find cids: ${missingStr}`)
-      }
-      const car = blocksToCarStream(null, got.blocks)
-
-      return {
-        encoding: 'application/vnd.ipld.car' as const,
-        body: byteIterableToStream(car),
-      }
-    },
-  })
-}