@atproto/pds 0.5.11 → 0.5.14

package/src/account-manager/helpers/invite.ts

@@ -1,263 +0,0 @@
-import { chunkArray } from '@atproto/common'
-import { DatetimeString, DidString, currentDatetimeString } from '@atproto/lex'
-import { InvalidRequestError } from '@atproto/xrpc-server'
-import { countAll } from '../../db/index.js'
-import { com } from '../../lexicons/index.js'
-import { AccountDb, InviteCode } from '../db/index.js'
-
-export type CodeDetail = com.atproto.server.defs.InviteCode
-export type CodeUse = com.atproto.server.defs.InviteCodeUse
-
-export const createInviteCodes = async (
-  db: AccountDb,
-  toCreate: { account: string; codes: string[] }[],
-  useCount: number,
-) => {
-  const now = currentDatetimeString()
-  const rows = toCreate.flatMap((account) =>
-    account.codes.map((code) => ({
-      code: code,
-      availableUses: useCount,
-      disabled: 0 as const,
-      forAccount: account.account,
-      createdBy: 'admin',
-      createdAt: now,
-    })),
-  )
-  await Promise.all(
-    chunkArray(rows, 50).map((chunk) =>
-      db.executeWithRetry(db.db.insertInto('invite_code').values(chunk)),
-    ),
-  )
-}
-
-export const createAccountInviteCodes = async (
-  db: AccountDb,
-  forAccount: string,
-  codes: string[],
-  expectedTotal: number,
-  disabled: 0 | 1,
-): Promise<CodeDetail[]> => {
-  const now = currentDatetimeString()
-  const rows: InviteCode[] = codes.map((code) => ({
-    code,
-    availableUses: 1,
-    disabled,
-    forAccount,
-    createdBy: forAccount,
-    createdAt: now,
-  }))
-  await db.executeWithRetry(db.db.insertInto('invite_code').values(rows))
-
-  const finalRoutineInviteCodes = await db.db
-    .selectFrom('invite_code')
-    .where('forAccount', '=', forAccount)
-    .where('createdBy', '!=', 'admin') // dont count admin-gifted codes aginast the user
-    .selectAll()
-    .execute()
-  if (finalRoutineInviteCodes.length > expectedTotal) {
-    throw new InvalidRequestError(
-      'attempted to create additional codes in another request',
-      'DuplicateCreate',
-    )
-  }
-
-  return rows.map((row) => ({
-    ...row,
-    available: 1,
-    disabled: row.disabled === 1,
-    uses: [],
-  }))
-}
-
-export const recordInviteUse = async (
-  db: AccountDb,
-  opts: {
-    did: DidString
-    inviteCode: string | undefined
-    now: DatetimeString
-  },
-) => {
-  if (!opts.inviteCode) return
-  await db.executeWithRetry(
-    db.db.insertInto('invite_code_use').values({
-      code: opts.inviteCode,
-      usedBy: opts.did,
-      usedAt: opts.now,
-    }),
-  )
-}
-
-export const ensureInviteIsAvailable = async (
-  db: AccountDb,
-  inviteCode: string,
-): Promise<void> => {
-  const invite = await db.db
-    .selectFrom('invite_code')
-    .leftJoin('actor', 'actor.did', 'invite_code.forAccount')
-    .where('takedownRef', 'is', null)
-    .selectAll('invite_code')
-    .where('code', '=', inviteCode)
-    .executeTakeFirst()
-
-  if (!invite || invite.disabled) {
-    throw new InvalidRequestError(
-      'Provided invite code not available',
-      'InvalidInviteCode',
-    )
-  }
-
-  const uses = await db.db
-    .selectFrom('invite_code_use')
-    .select(countAll.as('count'))
-    .where('code', '=', inviteCode)
-    .executeTakeFirstOrThrow()
-
-  if (invite.availableUses <= uses.count) {
-    throw new InvalidRequestError(
-      'Provided invite code not available',
-      'InvalidInviteCode',
-    )
-  }
-}
-
-export const selectInviteCodesQb = (db: AccountDb) => {
-  const ref = db.db.dynamic.ref
-  const builder = db.db
-    .selectFrom('invite_code')
-    .select([
-      'invite_code.code as code',
-      'invite_code.availableUses as available',
-      'invite_code.disabled as disabled',
-      'invite_code.forAccount as forAccount',
-      'invite_code.createdBy as createdBy',
-      'invite_code.createdAt as createdAt',
-      db.db
-        .selectFrom('invite_code_use')
-        .select(countAll.as('count'))
-        .whereRef('invite_code_use.code', '=', ref('invite_code.code'))
-        .as('uses'),
-    ])
-  return db.db.selectFrom(builder.as('codes')).selectAll()
-}
-
-export const getAccountsInviteCodes = async (
-  db: AccountDb,
-  dids: string[],
-): Promise<Map<string, CodeDetail[]>> => {
-  const results = new Map<string, CodeDetail[]>()
-  // We don't want to pass an empty array to kysely and let's avoid running a query entirely if there is nothing to match for
-  if (!dids.length) return results
-  const res = await selectInviteCodesQb(db)
-    .where('forAccount', 'in', dids)
-    .execute()
-  const codes = res.map((row) => row.code)
-  const uses = await getInviteCodesUses(db, codes)
-  res.forEach((row) => {
-    const existing = results.get(row.forAccount) ?? []
-    results.set(row.forAccount, [
-      ...existing,
-      {
-        ...row,
-        uses: uses[row.code] ?? [],
-        disabled: row.disabled === 1,
-      } satisfies com.atproto.server.defs.InviteCode,
-    ])
-  })
-  return results
-}
-
-export const getInviteCodesUses = async (
-  db: AccountDb,
-  codes: string[],
-): Promise<Record<string, CodeUse[]>> => {
-  const uses: Record<string, CodeUse[]> = {}
-  if (codes.length > 0) {
-    const usesRes = await db.db
-      .selectFrom('invite_code_use')
-      .where('code', 'in', codes)
-      .orderBy('usedAt', 'desc')
-      .selectAll()
-      .execute()
-    for (const use of usesRes) {
-      const { code, usedBy, usedAt } = use
-      uses[code] ??= []
-      uses[code].push({ usedBy, usedAt })
-    }
-  }
-  return uses
-}
-
-export const getInvitedByForAccounts = async (
-  db: AccountDb,
-  dids: DidString[],
-): Promise<Record<string, CodeDetail>> => {
-  if (dids.length < 1) return {}
-  const codeDetailsRes = await selectInviteCodesQb(db)
-    .where('code', 'in', (qb) =>
-      qb
-        .selectFrom('invite_code_use')
-        .where('usedBy', 'in', dids)
-        .select('code')
-        .distinct(),
-    )
-    .execute()
-  const uses = await getInviteCodesUses(
-    db,
-    codeDetailsRes.map((row) => row.code),
-  )
-  const codeDetails = codeDetailsRes.map(
-    ({ uses: _, disabled, createdAt, ...row }): CodeDetail => ({
-      ...row,
-      createdAt,
-      uses: uses[row.code] ?? [],
-      disabled: disabled === 1,
-    }),
-  )
-
-  const result: Record<string, CodeDetail> = {}
-
-  for (const cur of codeDetails) {
-    for (const use of cur.uses) {
-      result[use.usedBy] = cur
-    }
-  }
-
-  return result
-}
-
-export const disableInviteCodes = async (
-  db: AccountDb,
-  opts: { codes: string[]; accounts: string[] },
-) => {
-  const { codes, accounts } = opts
-  if (codes.length > 0) {
-    await db.executeWithRetry(
-      db.db
-        .updateTable('invite_code')
-        .set({ disabled: 1 })
-        .where('code', 'in', codes),
-    )
-  }
-  if (accounts.length > 0) {
-    await db.executeWithRetry(
-      db.db
-        .updateTable('invite_code')
-        .set({ disabled: 1 })
-        .where('forAccount', 'in', accounts),
-    )
-  }
-}
-
-export const setAccountInvitesDisabled = async (
-  db: AccountDb,
-  did: DidString,
-  disabled: boolean,
-) => {
-  await db.executeWithRetry(
-    db.db
-      .updateTable('account')
-      .where('did', '=', did)
-      .set({ invitesDisabled: disabled ? 1 : 0 }),
-  )
-}

package/src/account-manager/helpers/lexicon.ts

@@ -1,67 +0,0 @@
-import { LEXICON_REFRESH_FREQUENCY, LexiconData } from '@atproto/oauth-provider'
-import { fromDateISO, fromJson, toDateISO, toJson } from '../../db/index.js'
-import { AccountDb } from '../db/index.js'
-
-export async function upsert(db: AccountDb, nsid: string, data: LexiconData) {
-  // @TODO not annotated as `Omit<Insertable<Lexicon>, 'nsid'>`. Insertable's
-  // nullable/non-nullable key partition evaluates `IsNullable<InsertType<…>>`
-  // per column, which for the recursive `JsonEncoded<LexiconDocument>` column
-  // overflows the tsgo (TS7) checker's instantiation depth (TS2589). The older
-  // tsc handled it; the `.values()`/`.doUpdateSet()` calls below still
-  // type-check this object against the insert type regardless.
-  const updates = {
-    ...data,
-    createdAt: toDateISO(data.createdAt),
-    updatedAt: toDateISO(data.updatedAt),
-    lastSucceededAt: data.lastSucceededAt
-      ? toDateISO(data.lastSucceededAt)
-      : null,
-    lexicon: data.lexicon ? toJson(data.lexicon) : null,
-  }
-
-  await db.executeWithRetry(
-    db.db
-      .insertInto('lexicon')
-      .values({ ...updates, nsid })
-      .onConflict((oc) => oc.column('nsid').doUpdateSet(updates)),
-  )
-
-  // Garbage collection: remove old, never resolved, lexicons.
-  // Uses "lexicon_failures_idx"
-  await db.executeWithRetry(
-    db.db
-      .deleteFrom('lexicon')
-      .where('lexicon', 'is', null)
-      .where(
-        'updatedAt',
-        '<',
-        toDateISO(new Date(Date.now() - LEXICON_REFRESH_FREQUENCY)),
-      ),
-  )
-}
-
-export async function find(
-  db: AccountDb,
-  nsid: string,
-): Promise<LexiconData | null> {
-  const row = await db.db
-    .selectFrom('lexicon')
-    .selectAll()
-    .where('nsid', '=', nsid)
-    .executeTakeFirst()
-  if (!row) return null
-
-  return {
-    ...row,
-    createdAt: fromDateISO(row.createdAt),
-    updatedAt: fromDateISO(row.updatedAt),
-    lastSucceededAt: row.lastSucceededAt
-      ? fromDateISO(row.lastSucceededAt)
-      : null,
-    lexicon: row.lexicon ? fromJson(row.lexicon) : null,
-  }
-}
-
-export async function remove(db: AccountDb, nsid: string) {
-  await db.db.deleteFrom('lexicon').where('nsid', '=', nsid).execute()
-}

package/src/account-manager/helpers/password.ts

@@ -1,136 +0,0 @@
-import { randomStr } from '@atproto/crypto'
-import { DatetimeString, currentDatetimeString } from '@atproto/lex'
-import { InvalidRequestError } from '@atproto/xrpc-server'
-import { com } from '../../lexicons/index.js'
-import { AccountDb } from '../db/index.js'
-import * as scrypt from './scrypt.js'
-
-export type AppPassDescript = {
-  name: string
-  privileged: boolean
-}
-
-export const verifyAccountPassword = async (
-  db: AccountDb,
-  did: string,
-  password: string,
-): Promise<boolean> => {
-  const found = await db.db
-    .selectFrom('account')
-    .selectAll()
-    .where('did', '=', did)
-    .executeTakeFirst()
-  return found ? await scrypt.verify(password, found.passwordScrypt) : false
-}
-
-export const verifyAppPassword = async (
-  db: AccountDb,
-  did: string,
-  password: string,
-): Promise<AppPassDescript | null> => {
-  const passwordScrypt = await scrypt.hashAppPassword(did, password)
-  const found = await db.db
-    .selectFrom('app_password')
-    .selectAll()
-    .where('did', '=', did)
-    .where('passwordScrypt', '=', passwordScrypt)
-    .executeTakeFirst()
-  if (!found) return null
-  return {
-    name: found.name,
-    privileged: found.privileged === 1 ? true : false,
-  }
-}
-
-export const updateUserPassword = async (
-  db: AccountDb,
-  opts: {
-    did: string
-    passwordScrypt: string
-  },
-) => {
-  await db.executeWithRetry(
-    db.db
-      .updateTable('account')
-      .set({ passwordScrypt: opts.passwordScrypt })
-      .where('did', '=', opts.did),
-  )
-}
-
-export const createAppPassword = async (
-  db: AccountDb,
-  did: string,
-  name: string,
-  privileged: boolean,
-): Promise<com.atproto.server.createAppPassword.AppPassword> => {
-  // create an app password with format:
-  // 1234-abcd-5678-efgh
-  const str = randomStr(16, 'base32').slice(0, 16)
-  const chunks = [
-    str.slice(0, 4),
-    str.slice(4, 8),
-    str.slice(8, 12),
-    str.slice(12, 16),
-  ]
-  const password = chunks.join('-')
-  const passwordScrypt = await scrypt.hashAppPassword(did, password)
-  const [got] = await db.executeWithRetry(
-    db.db
-      .insertInto('app_password')
-      .values({
-        did,
-        name,
-        passwordScrypt,
-        createdAt: currentDatetimeString(),
-        privileged: privileged ? 1 : 0,
-      })
-      .returningAll(),
-  )
-  if (!got) {
-    throw new InvalidRequestError('could not create app-specific password')
-  }
-  return {
-    name,
-    password,
-    createdAt: got.createdAt,
-    privileged,
-  }
-}
-
-export const listAppPasswords = async (
-  db: AccountDb,
-  did: string,
-): Promise<
-  { name: string; createdAt: DatetimeString; privileged: boolean }[]
-> => {
-  const res = await db.db
-    .selectFrom('app_password')
-    .select(['name', 'createdAt', 'privileged'])
-    .where('did', '=', did)
-    .orderBy('createdAt', 'desc')
-    .execute()
-  return res.map((row) => ({
-    name: row.name,
-    createdAt: row.createdAt,
-    privileged: row.privileged === 1 ? true : false,
-  }))
-}
-
-export const deleteAppPassword = async (
-  db: AccountDb,
-  did: string,
-  name: string,
-) => {
-  await db.executeWithRetry(
-    db.db
-      .deleteFrom('app_password')
-      .where('did', '=', did)
-      .where('name', '=', name),
-  )
-}
-
-export const deleteAllAppPasswords = async (db: AccountDb, did: string) => {
-  await db.executeWithRetry(
-    db.db.deleteFrom('app_password').where('did', '=', did),
-  )
-}

package/src/account-manager/helpers/repo.ts

@@ -1,24 +0,0 @@
-import { Cid, currentDatetimeString } from '@atproto/lex'
-import { AccountDb } from '../db/index.js'
-
-export const updateRoot = async (
-  db: AccountDb,
-  did: string,
-  cid: Cid,
-  rev: string,
-) => {
-  // @TODO balance risk of a race in the case of a long retry
-  await db.executeWithRetry(
-    db.db
-      .insertInto('repo_root')
-      .values({
-        did,
-        cid: cid.toString(),
-        rev,
-        indexedAt: currentDatetimeString(),
-      })
-      .onConflict((oc) =>
-        oc.column('did').doUpdateSet({ cid: cid.toString(), rev }),
-      ),
-  )
-}

package/src/account-manager/helpers/scrypt.ts

@@ -1,53 +0,0 @@
-import crypto from 'node:crypto'
-import * as ui8 from 'uint8arrays'
-import { sha256 } from '@atproto/crypto'
-
-export const OLD_PASSWORD_MAX_LENGTH = 512
-export const NEW_PASSWORD_MAX_LENGTH = 256
-
-export const genSaltAndHash = (password: string): Promise<string> => {
-  const salt = crypto.randomBytes(16).toString('hex')
-  return hashWithSalt(password, salt)
-}
-
-export const hashWithSalt = (
-  password: string,
-  salt: string,
-): Promise<string> => {
-  return new Promise((resolve, reject) => {
-    crypto.scrypt(password, salt, 64, (err, hash) => {
-      if (err) return reject(err)
-      resolve(salt + ':' + hash.toString('hex'))
-    })
-  })
-}
-
-export const verify = async (
-  password: string,
-  storedHash: string,
-): Promise<boolean> => {
-  const [salt, hash] = storedHash.split(':')
-  const derivedHash = await getDerivedHash(password, salt)
-  return hash === derivedHash
-}
-
-export const getDerivedHash = (
-  password: string,
-  salt: string,
-): Promise<string> => {
-  return new Promise((resolve, reject) => {
-    crypto.scrypt(password, salt, 64, (err, derivedHash) => {
-      if (err) return reject(err)
-      resolve(derivedHash.toString('hex'))
-    })
-  })
-}
-
-export const hashAppPassword = async (
-  did: string,
-  password: string,
-): Promise<string> => {
-  const sha = await sha256(did)
-  const salt = ui8.toString(sha.slice(0, 16), 'hex')
-  return hashWithSalt(password, salt)
-}

package/src/account-manager/helpers/token.ts

@@ -1,158 +0,0 @@
-import { Selectable } from 'kysely'
-import {
-  Code,
-  Did,
-  NewTokenData,
-  RefreshToken,
-  TokenData,
-  TokenId,
-} from '@atproto/oauth-provider'
-import { fromDateISO, fromJson, toDateISO, toJson } from '../../db/index.js'
-import { AccountDb, Token } from '../db/index.js'
-import { selectAccountQB } from './account.js'
-
-export function toTokenData(row: Selectable<Token>): TokenData {
-  return {
-    createdAt: fromDateISO(row.createdAt),
-    expiresAt: fromDateISO(row.expiresAt),
-    updatedAt: fromDateISO(row.updatedAt),
-    clientId: row.clientId,
-    clientAuth: fromJson(row.clientAuth),
-    deviceId: row.deviceId,
-    did: row.did,
-    parameters: fromJson(row.parameters),
-    code: row.code,
-    scope: row.scope,
-  }
-}
-
-const selectTokenInfoQB = (db: AccountDb) =>
-  selectAccountQB(db, { includeDeactivated: true })
-    // uses "token_did_idx" index (though unlikely in practice)
-    .innerJoin('token', 'token.did', 'actor.did')
-    .select([
-      'token.id',
-      'token.tokenId',
-      'token.createdAt',
-      'token.updatedAt',
-      'token.expiresAt',
-      'token.clientId',
-      'token.clientAuth',
-      'token.deviceId',
-      'token.did',
-      'token.parameters',
-      'token.details',
-      'token.code',
-      'token.currentRefreshToken',
-      'token.scope',
-    ])
-
-export const createQB = (
-  db: AccountDb,
-  tokenId: TokenId,
-  data: TokenData,
-  refreshToken?: RefreshToken,
-) => {
-  return db.db.insertInto('token').values({
-    tokenId,
-    createdAt: toDateISO(data.createdAt),
-    expiresAt: toDateISO(data.expiresAt),
-    updatedAt: toDateISO(data.updatedAt),
-    clientId: data.clientId,
-    clientAuth: toJson(data.clientAuth),
-    deviceId: data.deviceId,
-    did: data.did,
-    parameters: toJson(data.parameters),
-    details: data.details ? toJson(data.details) : null,
-    code: data.code,
-    currentRefreshToken: refreshToken || null,
-    scope: data.scope,
-  })
-}
-
-export const forRotateQB = (db: AccountDb, id: TokenId) =>
-  db.db
-    .selectFrom('token')
-    .where('tokenId', '=', id)
-    .where('currentRefreshToken', 'is not', null)
-    .select(['id', 'currentRefreshToken'])
-
-export const findByQB = (
-  db: AccountDb,
-  search: {
-    id?: number
-    did?: Did
-    code?: Code
-    tokenId?: TokenId
-    currentRefreshToken?: RefreshToken
-  },
-) => {
-  if (
-    search.id === undefined &&
-    search.did === undefined &&
-    search.code === undefined &&
-    search.tokenId === undefined &&
-    search.currentRefreshToken === undefined
-  ) {
-    // Prevent accidental scan
-    throw new TypeError('At least one search parameter is required')
-  }
-
-  return selectTokenInfoQB(db)
-    .$if(search.id !== undefined, (qb) =>
-      // uses primary key index
-      qb.where('token.id', '=', search.id!),
-    )
-    .$if(search.did !== undefined, (qb) =>
-      // uses "token_did_idx" index
-      qb.where('token.did', '=', search.did!),
-    )
-    .$if(search.code !== undefined, (qb) =>
-      // uses "token_code_idx" partial index (hence the null check)
-      qb
-        .where('token.code', '=', search.code!)
-        .where('token.code', 'is not', null),
-    )
-    .$if(search.tokenId !== undefined, (qb) =>
-      // uses "token_token_id_idx"
-      qb.where('token.tokenId', '=', search.tokenId!),
-    )
-    .$if(search.currentRefreshToken !== undefined, (qb) =>
-      // uses "token_refresh_token_unique_idx"
-      qb.where('token.currentRefreshToken', '=', search.currentRefreshToken!),
-    )
-}
-
-export const removeByDid = async (db: AccountDb, did: Did) => {
-  await db.executeWithRetry(
-    db.db
-      .deleteFrom('token')
-      // uses "token_did_idx" index
-      .where('did', '=', did),
-  )
-}
-
-export const rotateQB = (
-  db: AccountDb,
-  id: number,
-  newTokenId: TokenId,
-  newRefreshToken: RefreshToken,
-  newData: NewTokenData,
-) =>
-  db.db
-    .updateTable('token')
-    .set({
-      tokenId: newTokenId,
-      currentRefreshToken: newRefreshToken,
-
-      expiresAt: toDateISO(newData.expiresAt),
-      updatedAt: toDateISO(newData.updatedAt),
-      clientAuth: toJson(newData.clientAuth),
-      scope: newData.scope,
-    })
-    // uses primary key index
-    .where('id', '=', id)
-
-export const removeQB = (db: AccountDb, tokenId: TokenId) =>
-  // uses "used_refresh_token_fk" to cascade delete
-  db.db.deleteFrom('token').where('tokenId', '=', tokenId)