@atproto/pds 0.5.12 → 0.5.14

package/src/account-manager/db/index.ts

@@ -1,21 +0,0 @@
-import { Database, Migrator } from '../../db/index.js'
-import migrations from './migrations/index.js'
-import { DatabaseSchema } from './schema/index.js'
-
-export * from './schema/index.js'
-
-export type AccountDb = Database<DatabaseSchema>
-
-export const getDb = (
-  location: string,
-  disableWalAutoCheckpoint = false,
-): AccountDb => {
-  const pragmas: Record<string, string> = disableWalAutoCheckpoint
-    ? { wal_autocheckpoint: '0' }
-    : {}
-  return Database.sqlite(location, { pragmas })
-}
-
-export const getMigrator = (db: AccountDb) => {
-  return new Migrator(db.db, migrations)
-}

package/src/account-manager/db/migrations/001-init.ts

@@ -1,115 +0,0 @@
-import { Kysely, sql } from 'kysely'
-
-export async function up(db: Kysely<unknown>): Promise<void> {
-  await db.schema
-    .createTable('app_password')
-    .addColumn('did', 'varchar', (col) => col.notNull())
-    .addColumn('name', 'varchar', (col) => col.notNull())
-    .addColumn('passwordScrypt', 'varchar', (col) => col.notNull())
-    .addColumn('createdAt', 'varchar', (col) => col.notNull())
-    .addPrimaryKeyConstraint('app_password_pkey', ['did', 'name'])
-    .execute()
-
-  await db.schema
-    .createTable('invite_code')
-    .addColumn('code', 'varchar', (col) => col.primaryKey())
-    .addColumn('availableUses', 'integer', (col) => col.notNull())
-    .addColumn('disabled', 'int2', (col) => col.defaultTo(0))
-    .addColumn('forAccount', 'varchar', (col) => col.notNull())
-    .addColumn('createdBy', 'varchar', (col) => col.notNull())
-    .addColumn('createdAt', 'varchar', (col) => col.notNull())
-    .execute()
-  await db.schema
-    .createIndex('invite_code_for_account_idx')
-    .on('invite_code')
-    .column('forAccount')
-    .execute()
-
-  await db.schema
-    .createTable('invite_code_use')
-    .addColumn('code', 'varchar', (col) => col.notNull())
-    .addColumn('usedBy', 'varchar', (col) => col.notNull())
-    .addColumn('usedAt', 'varchar', (col) => col.notNull())
-    .addPrimaryKeyConstraint(`invite_code_use_pkey`, ['code', 'usedBy'])
-    .execute()
-
-  await db.schema
-    .createTable('refresh_token')
-    .addColumn('id', 'varchar', (col) => col.primaryKey())
-    .addColumn('did', 'varchar', (col) => col.notNull())
-    .addColumn('expiresAt', 'varchar', (col) => col.notNull())
-    .addColumn('nextId', 'varchar')
-    .addColumn('appPasswordName', 'varchar')
-    .execute()
-  await db.schema // Aids in refresh token cleanup
-    .createIndex('refresh_token_did_idx')
-    .on('refresh_token')
-    .column('did')
-    .execute()
-
-  await db.schema
-    .createTable('repo_root')
-    .addColumn('did', 'varchar', (col) => col.primaryKey())
-    .addColumn('cid', 'varchar', (col) => col.notNull())
-    .addColumn('rev', 'varchar', (col) => col.notNull())
-    .addColumn('indexedAt', 'varchar', (col) => col.notNull())
-    .execute()
-
-  await db.schema
-    .createTable('actor')
-    .addColumn('did', 'varchar', (col) => col.primaryKey())
-    .addColumn('handle', 'varchar')
-    .addColumn('createdAt', 'varchar', (col) => col.notNull())
-    .addColumn('takedownRef', 'varchar')
-    .execute()
-  await db.schema
-    .createIndex(`actor_handle_lower_idx`)
-    .unique()
-    .on('actor')
-    .expression(sql`lower("handle")`)
-    .execute()
-  await db.schema
-    .createIndex('actor_cursor_idx')
-    .on('actor')
-    .columns(['createdAt', 'did'])
-    .execute()
-
-  await db.schema
-    .createTable('account')
-    .addColumn('did', 'varchar', (col) => col.primaryKey())
-    .addColumn('email', 'varchar', (col) => col.notNull())
-    .addColumn('passwordScrypt', 'varchar', (col) => col.notNull())
-    .addColumn('emailConfirmedAt', 'varchar')
-    .addColumn('invitesDisabled', 'int2', (col) => col.notNull().defaultTo(0))
-    .execute()
-  await db.schema
-    .createIndex(`account_email_lower_idx`)
-    .unique()
-    .on('account')
-    .expression(sql`lower("email")`)
-    .execute()
-
-  await db.schema
-    .createTable('email_token')
-    .addColumn('purpose', 'varchar', (col) => col.notNull())
-    .addColumn('did', 'varchar', (col) => col.notNull())
-    .addColumn('token', 'varchar', (col) => col.notNull())
-    .addColumn('requestedAt', 'varchar', (col) => col.notNull())
-    .addPrimaryKeyConstraint('email_token_pkey', ['purpose', 'did'])
-    .addUniqueConstraint('email_token_purpose_token_unique', [
-      'purpose',
-      'token',
-    ])
-    .execute()
-}
-
-export async function down(db: Kysely<unknown>): Promise<void> {
-  await db.schema.dropTable('email_token').execute()
-  await db.schema.dropTable('account').execute()
-  await db.schema.dropTable('actor').execute()
-  await db.schema.dropTable('repo_root').execute()
-  await db.schema.dropTable('refresh_token').execute()
-  await db.schema.dropTable('invite_code_use').execute()
-  await db.schema.dropTable('invite_code').execute()
-  await db.schema.dropTable('app_password').execute()
-}

package/src/account-manager/db/migrations/002-account-deactivation.ts

@@ -1,17 +0,0 @@
-import { Kysely } from 'kysely'
-
-export async function up(db: Kysely<unknown>): Promise<void> {
-  await db.schema
-    .alterTable('actor')
-    .addColumn('deactivatedAt', 'varchar')
-    .execute()
-  await db.schema
-    .alterTable('actor')
-    .addColumn('deleteAfter', 'varchar')
-    .execute()
-}
-
-export async function down(db: Kysely<unknown>): Promise<void> {
-  await db.schema.alterTable('actor').dropColumn('deactivatedAt').execute()
-  await db.schema.alterTable('actor').dropColumn('deleteAfter').execute()
-}

package/src/account-manager/db/migrations/003-privileged-app-passwords.ts

@@ -1,12 +0,0 @@
-import { Kysely } from 'kysely'
-
-export async function up(db: Kysely<unknown>): Promise<void> {
-  await db.schema
-    .alterTable('app_password')
-    .addColumn('privileged', 'integer', (col) => col.notNull().defaultTo(0))
-    .execute()
-}
-
-export async function down(db: Kysely<unknown>): Promise<void> {
-  await db.schema.alterTable('app_password').dropColumn('privileged').execute()
-}

package/src/account-manager/db/migrations/004-oauth.ts

@@ -1,122 +0,0 @@
-import { Kysely, sql } from 'kysely'
-
-export async function up(db: Kysely<unknown>): Promise<void> {
-  await db.schema
-    .createTable('authorization_request')
-    .addColumn('id', 'varchar', (col) => col.primaryKey())
-    .addColumn('did', 'varchar')
-    .addColumn('deviceId', 'varchar')
-    .addColumn('clientId', 'varchar', (col) => col.notNull())
-    .addColumn('clientAuth', 'varchar', (col) => col.notNull())
-    .addColumn('parameters', 'varchar', (col) => col.notNull())
-    .addColumn('expiresAt', 'varchar', (col) => col.notNull())
-    .addColumn('code', 'varchar')
-    .execute()
-
-  await db.schema
-    .createIndex('authorization_request_code_idx')
-    .unique()
-    .on('authorization_request')
-    // https://github.com/kysely-org/kysely/issues/302
-    .expression(sql`code DESC) WHERE (code IS NOT NULL`)
-    .execute()
-
-  await db.schema
-    .createIndex('authorization_request_expires_at_idx')
-    .on('authorization_request')
-    .column('expiresAt')
-    .execute()
-
-  await db.schema
-    .createTable('device')
-    .addColumn('id', 'varchar', (col) => col.primaryKey())
-    .addColumn('sessionId', 'varchar', (col) => col.notNull())
-    .addColumn('userAgent', 'varchar')
-    .addColumn('ipAddress', 'varchar', (col) => col.notNull())
-    .addColumn('lastSeenAt', 'varchar', (col) => col.notNull())
-    .addUniqueConstraint('device_session_id_idx', ['sessionId'])
-    .execute()
-
-  await db.schema
-    .createTable('device_account')
-    .addColumn('did', 'varchar', (col) => col.notNull())
-    .addColumn('deviceId', 'varchar', (col) => col.notNull())
-    .addColumn('authenticatedAt', 'varchar', (col) => col.notNull())
-    .addColumn('remember', 'boolean', (col) => col.notNull())
-    .addColumn('authorizedClients', 'varchar', (col) => col.notNull())
-    .addPrimaryKeyConstraint('device_account_pk', [
-      'deviceId', // first because this table will be joined from the "device" table
-      'did',
-    ])
-    .addForeignKeyConstraint(
-      'device_account_device_id_fk',
-      ['deviceId'],
-      'device',
-      ['id'],
-      (qb) => qb.onDelete('cascade').onUpdate('cascade'),
-    )
-    .execute()
-
-  await db.schema
-    .createTable('token')
-    .addColumn('id', 'integer', (col) => col.primaryKey().autoIncrement())
-    .addColumn('did', 'varchar', (col) => col.notNull())
-    .addColumn('tokenId', 'varchar', (col) => col.notNull())
-    .addColumn('createdAt', 'varchar', (col) => col.notNull())
-    .addColumn('updatedAt', 'varchar', (col) => col.notNull())
-    .addColumn('expiresAt', 'varchar', (col) => col.notNull())
-    .addColumn('clientId', 'varchar', (col) => col.notNull())
-    .addColumn('clientAuth', 'varchar', (col) => col.notNull())
-    .addColumn('deviceId', 'varchar')
-    .addColumn('parameters', 'varchar', (col) => col.notNull())
-    .addColumn('details', 'varchar')
-    .addColumn('code', 'varchar')
-    .addColumn('currentRefreshToken', 'varchar')
-    .addUniqueConstraint('token_current_refresh_token_unique_idx', [
-      'currentRefreshToken',
-    ])
-    .addUniqueConstraint('token_id_unique_idx', ['tokenId'])
-    .execute()
-
-  await db.schema
-    .createIndex('token_did_idx')
-    .on('token')
-    .column('did')
-    .execute()
-
-  await db.schema
-    .createIndex('token_code_idx')
-    .unique()
-    .on('token')
-    // https://github.com/kysely-org/kysely/issues/302
-    .expression(sql`code DESC) WHERE (code IS NOT NULL`)
-    .execute()
-
-  await db.schema
-    .createTable('used_refresh_token')
-    .addColumn('refreshToken', 'varchar', (col) => col.primaryKey())
-    .addColumn('tokenId', 'integer', (col) => col.notNull())
-    .addForeignKeyConstraint(
-      'used_refresh_token_fk',
-      ['tokenId'],
-      'token',
-      ['id'],
-      // uses "used_refresh_token_id_idx" index (when cascading)
-      (qb) => qb.onDelete('cascade').onUpdate('cascade'),
-    )
-    .execute()
-
-  await db.schema
-    .createIndex('used_refresh_token_id_idx')
-    .on('used_refresh_token')
-    .column('tokenId')
-    .execute()
-}
-
-export async function down(db: Kysely<unknown>): Promise<void> {
-  await db.schema.dropTable('used_refresh_token').execute()
-  await db.schema.dropTable('token').execute()
-  await db.schema.dropTable('device_account').execute()
-  await db.schema.dropTable('device').execute()
-  await db.schema.dropTable('authorization_request').execute()
-}

package/src/account-manager/db/migrations/005-oauth-account-management.ts

@@ -1,136 +0,0 @@
-import { Kysely } from 'kysely'
-import { HOUR } from '@atproto/common'
-import { ClientId, DeviceId } from '@atproto/oauth-provider'
-import { DateISO, JsonEncoded, toDateISO } from '../../../db/index.js'
-
-// @NOTE this migration has been updated to be idempotent through
-// the insertInto('account_device') step. this allows users to roll
-// forward if the migration partially succeeded on first run, failing
-// on a fk constraint during the insertInto('account_device') step.
-// this previously occurred under the following conditions:
-//  a. a user was deleted
-//  b. this user used oauth functionality with "remember me" selected.
-
-export async function up(
-  db: Kysely<{
-    account: {
-      did: string
-    }
-    device_account: {
-      did: string
-      deviceId: DeviceId
-
-      remember: 0 | 1
-      authenticatedAt: string
-      authorizedClients: JsonEncoded<ClientId[]>
-    }
-    account_device: {
-      did: string
-      deviceId: DeviceId
-
-      createdAt: DateISO
-      updatedAt: DateISO
-    }
-  }>,
-): Promise<void> {
-  // Security: Delete any leftover device accounts that are not remembered
-  // @NOTE idempotent, see note at top of migration.
-  await db
-    .deleteFrom('device_account')
-    .where('remember', '=', 0)
-    .where('authenticatedAt', '<', toDateISO(new Date(Date.now() - HOUR)))
-    .execute()
-
-  // replaces "device_account"
-  // @NOTE idempotent from ifNotExists(), see note at top of migration.
-  await db.schema
-    .createTable('account_device')
-    .ifNotExists()
-    .addColumn('did', 'varchar', (col) => col.notNull())
-    .addColumn('deviceId', 'varchar', (col) => col.notNull())
-    .addColumn('createdAt', 'varchar', (col) => col.notNull())
-    .addColumn('updatedAt', 'varchar', (col) => col.notNull())
-    .addPrimaryKeyConstraint('account_device_pk', [
-      'deviceId', // first because this table will be joined from the "device" table
-      'did',
-    ])
-    .addForeignKeyConstraint(
-      'account_device_did_fk',
-      ['did'],
-      'account',
-      ['did'],
-      // cascade on delete, future-proofing on update (fk can't be altered)
-      (qb) => qb.onDelete('cascade').onUpdate('cascade'),
-    )
-    .addForeignKeyConstraint(
-      'account_device_device_id_fk',
-      ['deviceId'],
-      'device',
-      ['id'],
-      // cascade on delete, future-proofing on update (fk can't be altered)
-      (qb) => qb.onDelete('cascade').onUpdate('cascade'),
-    )
-    .execute()
-
-  // Migrate "device_account" to "account_device"
-  // @NOTE idempotent from onConflict(): see note at top of migration.
-  await db
-    .insertInto('account_device')
-    .columns(['did', 'deviceId', 'createdAt', 'updatedAt'])
-    .expression(
-      db
-        .selectFrom('device_account')
-        .select('did')
-        .select('deviceId')
-        .select('authenticatedAt as createdAt') // Best we can do
-        .select('authenticatedAt as updatedAt')
-        .where('remember', '=', 1)
-        .where(({ exists, selectFrom }) =>
-          // device_account does not have fkey on account.did,
-          // so we satisfy account_device_did_fk with this condition.
-          exists(
-            selectFrom('account')
-              .selectAll()
-              .whereRef('account.did', '=', 'device_account.did'),
-          ),
-        ),
-    )
-    .onConflict((oc) => oc.doNothing())
-    .execute()
-
-  // @NOTE No need to create an index on "deviceId" for "account_device" because
-  // it is the first column in the primary key constraint
-
-  await db.schema
-    .createIndex('account_device_did_idx')
-    .on('account_device')
-    .column('did')
-    .execute()
-
-  await db.schema
-    .createTable('authorized_client')
-    .addColumn('did', 'varchar', (col) => col.notNull())
-    .addColumn('clientId', 'varchar', (col) => col.notNull())
-    .addColumn('createdAt', 'varchar', (col) => col.notNull())
-    .addColumn('updatedAt', 'varchar', (col) => col.notNull())
-    .addColumn('data', 'varchar', (col) => col.notNull())
-    .addPrimaryKeyConstraint('authorized_client_pk', ['did', 'clientId'])
-    .addForeignKeyConstraint(
-      'authorized_client_did_fk',
-      ['did'],
-      'account',
-      ['did'],
-      // cascade on delete, future-proofing on update (fk can't be altered)
-      (qb) => qb.onDelete('cascade').onUpdate('cascade'),
-    )
-    .execute()
-
-  // We don't migrate the "device_account" authorized clients. Users will need
-  // to reauthorize the client during the next oauth flow (minor inconvenience
-  // for authenticated clients users).
-}
-
-export async function down(db: Kysely<unknown>): Promise<void> {
-  await db.schema.dropTable('authorized_client').execute()
-  await db.schema.dropTable('account_device').execute()
-}

package/src/account-manager/db/migrations/006-oauth-permission-sets.ts

@@ -1,20 +0,0 @@
-import { Kysely } from 'kysely'
-
-export async function up(db: Kysely<unknown>): Promise<void> {
-  await db.schema.alterTable('token').addColumn('scope', 'varchar').execute()
-
-  await db.schema
-    .createTable('lexicon')
-    .addColumn('nsid', 'varchar', (col) => col.primaryKey())
-    .addColumn('createdAt', 'varchar', (col) => col.notNull())
-    .addColumn('updatedAt', 'varchar', (col) => col.notNull())
-    .addColumn('lastSucceededAt', 'varchar')
-    .addColumn('uri', 'varchar')
-    .addColumn('lexicon', 'varchar')
-    .execute()
-}
-
-export async function down(db: Kysely<unknown>): Promise<void> {
-  await db.schema.dropTable('lexicon').execute()
-  await db.schema.alterTable('token').dropColumn('scope').execute()
-}

package/src/account-manager/db/migrations/007-lexicon-failures-index.ts

@@ -1,14 +0,0 @@
-import { Kysely, sql } from 'kysely'
-
-export async function up(db: Kysely<unknown>): Promise<void> {
-  await db.schema
-    .createIndex('lexicon_failures_idx')
-    .on('lexicon')
-    // https://github.com/kysely-org/kysely/issues/302
-    .expression(sql`"updatedAt" DESC) WHERE ("lexicon" is NULL`)
-    .execute()
-}
-
-export async function down(db: Kysely<unknown>): Promise<void> {
-  await db.schema.dropIndex('lexicon_failures_idx').execute()
-}

package/src/account-manager/db/migrations/index.ts

@@ -1,17 +0,0 @@
-import * as mig001 from './001-init.js'
-import * as mig002 from './002-account-deactivation.js'
-import * as mig003 from './003-privileged-app-passwords.js'
-import * as mig004 from './004-oauth.js'
-import * as mig005 from './005-oauth-account-management.js'
-import * as mig006 from './006-oauth-permission-sets.js'
-import * as mig007 from './007-lexicon-failures-index.js'
-
-export default {
-  '001': mig001,
-  '002': mig002,
-  '003': mig003,
-  '004': mig004,
-  '005': mig005,
-  '006': mig006,
-  '007': mig007,
-}

package/src/account-manager/db/schema/account-device.ts

@@ -1,14 +0,0 @@
-import { DeviceId } from '@atproto/oauth-provider'
-import { DateISO } from '../../../db/index.js'
-
-export interface AccountDevice {
-  did: string
-  deviceId: DeviceId
-
-  createdAt: DateISO
-  updatedAt: DateISO
-}
-
-export const tableName = 'account_device'
-
-export type PartialDB = { [tableName]: AccountDevice }

package/src/account-manager/db/schema/account.ts

@@ -1,16 +0,0 @@
-import { Generated, Selectable } from 'kysely'
-import { DatetimeString } from '@atproto/lex'
-
-export interface Account {
-  did: string
-  email: string
-  passwordScrypt: string
-  emailConfirmedAt: DatetimeString | null
-  invitesDisabled: Generated<0 | 1>
-}
-
-export type AccountEntry = Selectable<Account>
-
-export const tableName = 'account'
-
-export type PartialDB = { [tableName]: Account }

package/src/account-manager/db/schema/actor.ts

@@ -1,17 +0,0 @@
-import { Selectable } from 'kysely'
-import { DidString, HandleString } from '@atproto/syntax'
-
-export interface Actor {
-  did: DidString
-  handle: HandleString | null
-  createdAt: string
-  takedownRef: string | null
-  deactivatedAt: string | null
-  deleteAfter: string | null
-}
-
-export type ActorEntry = Selectable<Actor>
-
-export const tableName = 'actor'
-
-export type PartialDB = { [tableName]: Actor }

package/src/account-manager/db/schema/app-password.ts

@@ -1,13 +0,0 @@
-import { DatetimeString } from '@atproto/lex'
-
-export interface AppPassword {
-  did: string
-  name: string
-  passwordScrypt: string
-  createdAt: DatetimeString
-  privileged: 0 | 1
-}
-
-export const tableName = 'app_password'
-
-export type PartialDB = { [tableName]: AppPassword }

package/src/account-manager/db/schema/authorization-request.ts

@@ -1,30 +0,0 @@
-import { Selectable } from 'kysely'
-import {
-  ClientAuth,
-  ClientAuthLegacy,
-  Code,
-  DeviceId,
-  Did,
-  OAuthAuthorizationRequestParameters,
-  OAuthClientId,
-  RequestId,
-} from '@atproto/oauth-provider'
-import { DateISO, JsonEncoded } from '../../../db/index.js'
-
-export interface AuthorizationRequest {
-  id: RequestId
-  did: Did | null
-  deviceId: DeviceId | null
-
-  clientId: OAuthClientId
-  clientAuth: JsonEncoded<null | ClientAuth | ClientAuthLegacy>
-  parameters: JsonEncoded<OAuthAuthorizationRequestParameters>
-  expiresAt: DateISO
-  code: Code | null
-}
-
-export type AuthorizationRequestEntry = Selectable<AuthorizationRequest>
-
-export const tableName = 'authorization_request'
-
-export type PartialDB = { [tableName]: AuthorizationRequest }

package/src/account-manager/db/schema/authorized-client.ts

@@ -1,23 +0,0 @@
-import { Selectable } from 'kysely'
-import {
-  AuthorizedClientData,
-  Did,
-  OAuthClientId,
-} from '@atproto/oauth-provider'
-import { DateISO, JsonEncoded } from '../../../db/index.js'
-
-export interface AuthorizedClient {
-  did: Did
-  clientId: OAuthClientId
-
-  createdAt: DateISO
-  updatedAt: DateISO
-
-  data: JsonEncoded<AuthorizedClientData>
-}
-
-export type AuthorizedClientEntry = Selectable<AuthorizedClient>
-
-export const tableName = 'authorized_client'
-
-export type PartialDB = { [tableName]: AuthorizedClient }

package/src/account-manager/db/schema/device.ts

@@ -1,18 +0,0 @@
-import { Selectable } from 'kysely'
-import { DeviceId, SessionId } from '@atproto/oauth-provider'
-import { DateISO } from '../../../db/index.js'
-
-export interface Device {
-  id: DeviceId
-  sessionId: SessionId
-
-  userAgent: string | null
-  ipAddress: string
-  lastSeenAt: DateISO
-}
-
-export type DeviceEntry = Selectable<Device>
-
-export const tableName = 'device'
-
-export type PartialDB = { [tableName]: Device }

package/src/account-manager/db/schema/email-token.ts

@@ -1,19 +0,0 @@
-import { DidString } from '@atproto/syntax'
-
-export type EmailTokenPurpose =
-  | 'confirm_email'
-  | 'update_email'
-  | 'reset_password'
-  | 'delete_account'
-  | 'plc_operation'
-
-export interface EmailToken {
-  purpose: EmailTokenPurpose
-  did: DidString
-  token: string
-  requestedAt: string
-}
-
-export const tableName = 'email_token'
-
-export type PartialDB = { [tableName]: EmailToken }