@atproto/pds 0.5.4 → 0.5.6

package/src/account-manager/helpers/authorized-client.ts

@@ -2,14 +2,14 @@ import {
   AuthorizedClientData,
   AuthorizedClients,
   ClientId,
-  Sub,
+  Did,
 } from '@atproto/oauth-provider'
 import { fromJson, toDateISO, toJson } from '../../db/index.js'
 import { AccountDb } from '../db/index.js'
 
 export async function upsert(
   db: AccountDb,
-  did: string,
+  did: Did,
   clientId: ClientId,
   data: AuthorizedClientData,
 ) {
@@ -36,17 +36,23 @@ export async function upsert(
 
 export async function getAuthorizedClients(
   db: AccountDb,
-  did: string,
+  did: Did,
 ): Promise<AuthorizedClients> {
   return (await getAuthorizedClientsMulti(db, [did])).get(did)!
 }
 
+export async function deleteAllAuthorizedClients(db: AccountDb, did: Did) {
+  await db.executeWithRetry(
+    db.db.deleteFrom('authorized_client').where('did', '=', did),
+  )
+}
+
 export async function getAuthorizedClientsMulti(
   db: AccountDb,
-  dids: Iterable<string>,
-): Promise<Map<Sub, AuthorizedClients>> {
+  dids: Iterable<Did>,
+): Promise<Map<Did, AuthorizedClients>> {
   // Using a Map will ensure unicity of dids (through unicity of keys)
-  const map = new Map<Sub, AuthorizedClients>(
+  const map = new Map<Did, AuthorizedClients>(
     Array.from(dids, (did) => [did, new Map()]),
   )
 

package/src/account-manager/helpers/device.ts

@@ -35,10 +35,10 @@ export const updateQB = (
 ) =>
   db.db
     .updateTable('device')
-    .if(sessionId != null, (qb) => qb.set({ sessionId }))
-    .if(userAgent != null, (qb) => qb.set({ userAgent }))
-    .if(ipAddress != null, (qb) => qb.set({ ipAddress }))
-    .if(lastSeenAt != null, (qb) =>
+    .$if(sessionId != null, (qb) => qb.set({ sessionId }))
+    .$if(userAgent != null, (qb) => qb.set({ userAgent }))
+    .$if(ipAddress != null, (qb) => qb.set({ ipAddress }))
+    .$if(lastSeenAt != null, (qb) =>
       qb.set({ lastSeenAt: toDateISO(lastSeenAt!) }),
     )
     .where('id', '=', deviceId)

package/src/account-manager/helpers/lexicon.ts

@@ -1,10 +1,15 @@
-import { Insertable } from 'kysely'
 import { LEXICON_REFRESH_FREQUENCY, LexiconData } from '@atproto/oauth-provider'
 import { fromDateISO, fromJson, toDateISO, toJson } from '../../db/index.js'
-import { AccountDb, Lexicon } from '../db/index.js'
+import { AccountDb } from '../db/index.js'
 
 export async function upsert(db: AccountDb, nsid: string, data: LexiconData) {
-  const updates: Omit<Insertable<Lexicon>, 'nsid'> = {
+  // @TODO not annotated as `Omit<Insertable<Lexicon>, 'nsid'>`. Insertable's
+  // nullable/non-nullable key partition evaluates `IsNullable<InsertType<…>>`
+  // per column, which for the recursive `JsonEncoded<LexiconDocument>` column
+  // overflows the tsgo (TS7) checker's instantiation depth (TS2589). The older
+  // tsc handled it; the `.values()`/`.doUpdateSet()` calls below still
+  // type-check this object against the insert type regardless.
+  const updates = {
     ...data,
     createdAt: toDateISO(data.createdAt),
     updatedAt: toDateISO(data.updatedAt),

package/src/account-manager/helpers/password.ts

@@ -128,3 +128,9 @@ export const deleteAppPassword = async (
       .where('name', '=', name),
   )
 }
+
+export const deleteAllAppPasswords = async (db: AccountDb, did: string) => {
+  await db.executeWithRetry(
+    db.db.deleteFrom('app_password').where('did', '=', did),
+  )
+}

package/src/account-manager/helpers/token.ts

@@ -1,6 +1,7 @@
 import { Selectable } from 'kysely'
 import {
   Code,
+  Did,
   NewTokenData,
   RefreshToken,
   TokenData,
@@ -18,7 +19,7 @@ export function toTokenData(row: Selectable<Token>): TokenData {
     clientId: row.clientId,
     clientAuth: fromJson(row.clientAuth),
     deviceId: row.deviceId,
-    sub: row.did,
+    did: row.did,
     parameters: fromJson(row.parameters),
     code: row.code,
     scope: row.scope,
@@ -60,7 +61,7 @@ export const createQB = (
     clientId: data.clientId,
     clientAuth: toJson(data.clientAuth),
     deviceId: data.deviceId,
-    did: data.sub,
+    did: data.did,
     parameters: toJson(data.parameters),
     details: data.details ? toJson(data.details) : null,
     code: data.code,
@@ -80,7 +81,7 @@ export const findByQB = (
   db: AccountDb,
   search: {
     id?: number
-    did?: string
+    did?: Did
     code?: Code
     tokenId?: TokenId
     currentRefreshToken?: RefreshToken
@@ -98,33 +99,38 @@ export const findByQB = (
   }
 
   return selectTokenInfoQB(db)
-    .if(search.id !== undefined, (qb) =>
+    .$if(search.id !== undefined, (qb) =>
       // uses primary key index
       qb.where('token.id', '=', search.id!),
     )
-    .if(search.did !== undefined, (qb) =>
+    .$if(search.did !== undefined, (qb) =>
       // uses "token_did_idx" index
       qb.where('token.did', '=', search.did!),
     )
-    .if(search.code !== undefined, (qb) =>
+    .$if(search.code !== undefined, (qb) =>
       // uses "token_code_idx" partial index (hence the null check)
       qb
         .where('token.code', '=', search.code!)
         .where('token.code', 'is not', null),
     )
-    .if(search.tokenId !== undefined, (qb) =>
+    .$if(search.tokenId !== undefined, (qb) =>
       // uses "token_token_id_idx"
       qb.where('token.tokenId', '=', search.tokenId!),
     )
-    .if(search.currentRefreshToken !== undefined, (qb) =>
+    .$if(search.currentRefreshToken !== undefined, (qb) =>
       // uses "token_refresh_token_unique_idx"
       qb.where('token.currentRefreshToken', '=', search.currentRefreshToken!),
     )
 }
 
-export const removeByDidQB = (db: AccountDb, did: string) =>
-  // uses "token_did_idx" index
-  db.db.deleteFrom('token').where('did', '=', did)
+export const removeByDid = async (db: AccountDb, did: Did) => {
+  await db.executeWithRetry(
+    db.db
+      .deleteFrom('token')
+      // uses "token_did_idx" index
+      .where('did', '=', did),
+  )
+}
 
 export const rotateQB = (
   db: AccountDb,

package/src/account-manager/oauth-store.ts

@@ -2,14 +2,7 @@ import assert from 'node:assert'
 import { Client, createOp as createPlcOp } from '@did-plc/lib'
 import { Selectable } from 'kysely'
 import { Keypair, Secp256k1Keypair } from '@atproto/crypto'
-import {
-  DidString,
-  HandleString,
-  asAtIdentifierString,
-  getBlobCidString,
-  isDidString,
-  isHandleString,
-} from '@atproto/lex'
+import { DidString, HandleString, getBlobCidString } from '@atproto/lex'
 import {
   Account,
   AccountStore,
@@ -18,10 +11,14 @@ import {
   AuthorizedClients,
   ClientId,
   Code,
+  DeactivateAccountData,
+  DeleteAccountConfirmInput,
+  DeleteAccountRequestInput,
   DeviceAccount,
   DeviceData,
   DeviceId,
   DeviceStore,
+  Did,
   FoundRequestResult,
   HandleUnavailableError,
   HandleUnavailableReason,
@@ -31,6 +28,7 @@ import {
   LexiconData,
   LexiconStore,
   NewTokenData,
+  ReactivateAccountData,
   RefreshToken,
   RequestData,
   RequestId,
@@ -38,7 +36,6 @@ import {
   ResetPasswordConfirmInput,
   ResetPasswordRequestInput,
   SignUpData,
-  Sub,
   TokenData,
   TokenId,
   TokenInfo,
@@ -140,8 +137,6 @@ export class OAuthStore
     // @TODO Send an account creation confirmation email (+verification link) to the user (in their locale)
     // @NOTE Password strength & length already enforced by the OAuthProvider
 
-    assert(isHandleString(handle), 'Handle must be a valid HandleString')
-
     await Promise.all([
       this.verifyEmailAvailability(email),
       this.verifyHandleAvailability(handle),
@@ -281,32 +276,28 @@ export class OAuthStore
   }
 
   async setAuthorizedClient(
-    sub: Sub,
+    did: Did,
     clientId: ClientId,
     data: AuthorizedClientData,
   ): Promise<void> {
-    await authorizedClientHelper.upsert(this.db, sub, clientId, data)
+    await authorizedClientHelper.upsert(this.db, did, clientId, data)
   }
 
-  async getAccount(sub: Sub): Promise<{
+  async getAccount(did: Did): Promise<{
     account: Account
     authorizedClients: AuthorizedClients
   }> {
-    const accountRow = await this.accountManager.getAccount(
-      // @TODO @atproto/oauth-provider should strongly type `Sub` as `DidString`
-      asAtIdentifierString(sub),
-      {
-        includeDeactivated: true,
-        includeTakenDown: false,
-      },
-    )
+    const accountRow = await this.accountManager.getAccount(did, {
+      includeDeactivated: true,
+      includeTakenDown: false,
+    })
 
     assert(accountRow, 'Account not found')
 
     const account = await this.buildAccount(accountRow)
     const authorizedClients = await authorizedClientHelper.getAuthorizedClients(
       this.db,
-      sub,
+      did,
     )
 
     return { account, authorizedClients }
@@ -320,10 +311,10 @@ export class OAuthStore
 
   async getDeviceAccount(
     deviceId: DeviceId,
-    sub: string,
+    did: Did,
   ): Promise<DeviceAccount | null> {
     const row = await accountDeviceHelper
-      .selectQB(this.db, { deviceId, sub })
+      .selectQB(this.db, { deviceId, did })
       .executeTakeFirst()
 
     if (!row) return null
@@ -334,30 +325,30 @@ export class OAuthStore
       account: await this.buildAccount(row),
       authorizedClients: await authorizedClientHelper.getAuthorizedClients(
         this.db,
-        sub,
+        did,
       ),
       createdAt: fromDateISO(row.adCreatedAt),
       updatedAt: fromDateISO(row.adUpdatedAt),
     }
   }
 
-  async removeDeviceAccount(deviceId: DeviceId, sub: Sub): Promise<void> {
+  async removeDeviceAccount(deviceId: DeviceId, did: Did): Promise<void> {
     await this.db.executeWithRetry(
-      accountDeviceHelper.removeQB(this.db, deviceId, sub),
+      accountDeviceHelper.removeQB(this.db, deviceId, did),
     )
   }
 
   async listDeviceAccounts(
-    filter: { sub: Sub } | { deviceId: DeviceId },
+    filter: { did: Did } | { deviceId: DeviceId },
   ): Promise<DeviceAccount[]> {
     const rows = await accountDeviceHelper.selectQB(this.db, filter).execute()
 
-    const uniqueDids: string[] = [...new Set(rows.map((row) => row.did))]
+    const uniqueDids = [...new Set(rows.map((row) => row.did))]
 
     // Enrich all distinct account with their profile data
     const accounts = new Map(
       await Promise.all(
-        Array.from(uniqueDids, async (did): Promise<[Sub, Account]> => {
+        Array.from(uniqueDids, async (did): Promise<[Did, Account]> => {
           const row = rows.find((r) => r.did === did)!
           return [did, await this.buildAccount(row)]
         }),
@@ -381,8 +372,8 @@ export class OAuthStore
   }
 
   async resetPasswordRequest({
-    locale: _locale,
     email,
+    locale,
   }: ResetPasswordRequestInput): Promise<Account | null> {
     const account = await this.accountManager.getAccountByEmail(email, {
       includeDeactivated: true,
@@ -397,9 +388,8 @@ export class OAuthStore
       'reset_password',
     )
 
-    // @TODO Use the locale to send the email in the right language
     await this.mailer.sendResetPassword(
-      { handle, token },
+      { handle, token, locale },
       { to: account.email },
     )
 
@@ -557,8 +547,8 @@ export class OAuthStore
     })
   }
 
-  async listAccountTokens(sub: Sub): Promise<TokenInfo[]> {
-    const rows = await tokenHelper.findByQB(this.db, { did: sub }).execute()
+  async listAccountTokens(did: Did): Promise<TokenInfo[]> {
+    const rows = await tokenHelper.findByQB(this.db, { did }).execute()
     return Promise.all(rows.map((row) => this.toTokenInfo(row)))
   }
 
@@ -629,12 +619,9 @@ export class OAuthStore
   }
 
   async verifyEmailRequest({
-    sub: did,
+    did,
     locale,
   }: VerifyEmailRequestInput): Promise<void> {
-    // @TODO @atproto/oauth-provider should strongly type `Sub` as `DidString`
-    assert(isDidString(did), 'sub must be a valid DID string')
-
     try {
       await this.accountManager.requestEmailConfirmation(did, { locale })
     } catch (err) {
@@ -647,13 +634,10 @@ export class OAuthStore
   }
 
   async verifyEmailConfirm({
-    sub: did,
+    did,
     email,
     token,
   }: VerifyEmailConfirmInput): Promise<Account | null> {
-    // @TODO @atproto/oauth-provider should strongly type `Sub` as `DidString`
-    assert(isDidString(did), 'sub must be a valid DID string')
-
     try {
       const account = await this.accountManager.confirmEmail(did, email, token)
 
@@ -668,24 +652,18 @@ export class OAuthStore
   }
 
   async updateEmailRequest({
-    sub: did,
+    did,
     locale,
   }: UpdateEmailRequestInput): Promise<UpdateEmailRequestOutput> {
-    // @TODO @atproto/oauth-provider should strongly type `Sub` as `DidString`
-    assert(isDidString(did), 'sub must be a valid DID string')
-
     return this.accountManager.requestEmailUpdate(did, { locale })
   }
 
   async updateEmailConfirm({
-    sub: did,
+    did,
     token,
     email,
     locale,
   }: UpdateEmailConfirmInput): Promise<Account | null> {
-    // @TODO @atproto/oauth-provider should strongly type `Sub` as `DidString`
-    assert(isDidString(did), 'sub must be a valid DID string')
-
     try {
       const account = await this.accountManager.updateEmail(did, email, token, {
         sendConfirmationEmail: true,
@@ -702,10 +680,7 @@ export class OAuthStore
     }
   }
 
-  async updateHandle({ sub: did, handle }: UpdateHandleData): Promise<Account> {
-    // @TODO @atproto/oauth-provider should strongly type `Sub` as `DidString`
-    assert(isDidString(did), 'sub must be a valid DID string')
-
+  async updateHandle({ did, handle }: UpdateHandleData): Promise<Account> {
     try {
       const account = await this.accountManager.updateHandle(did, handle)
 
@@ -715,6 +690,98 @@ export class OAuthStore
     }
   }
 
+  async deactivateAccount({ did }: DeactivateAccountData): Promise<Account> {
+    const { account } = await this.accountManager.deactivateAccount(did, {
+      deleteCredentials: true,
+    })
+
+    return this.buildAccount(account)
+  }
+
+  async reactivateAccount({ did }: ReactivateAccountData): Promise<Account> {
+    try {
+      const { account } = await this.accountManager.activateAccount(did)
+
+      return this.buildAccount(account)
+    } catch (err) {
+      if (err instanceof XrpcInvalidRequestError) {
+        throw new InvalidRequestError(err.message, err)
+      }
+
+      throw err
+    }
+  }
+
+  async deleteAccountRequest({
+    did,
+    locale,
+  }: DeleteAccountRequestInput): Promise<void> {
+    // Mirror the XRPC `com.atproto.server.requestAccountDelete` flow
+    // (no-entryway path): generate an email confirmation token and dispatch
+    // it to the account's email address.
+    const account = await this.accountManager.getAccount(did, {
+      includeDeactivated: true,
+      includeTakenDown: true,
+    })
+    if (!account) {
+      throw new InvalidRequestError('Account not found')
+    }
+    if (!account.email) {
+      throw new InvalidRequestError('Account does not have an email address')
+    }
+
+    const token = await this.accountManager.createEmailToken(
+      did,
+      'delete_account',
+    )
+    await this.mailer.sendAccountDelete(
+      { token, locale },
+      { to: account.email },
+    )
+  }
+
+  async deleteAccountConfirm({
+    did,
+    token,
+    password,
+  }: DeleteAccountConfirmInput): Promise<void> {
+    // Mirror the XRPC `com.atproto.server.deleteAccount` flow (no-entryway
+    // path): verify the password, validate the email confirmation token,
+    // destroy the actor store, delete the account row, and emit the
+    // tombstone account event.
+    const account = await this.accountManager.getAccount(did, {
+      includeDeactivated: true,
+      includeTakenDown: true,
+    })
+    if (!account) {
+      throw new InvalidRequestError('Account not found')
+    }
+
+    const validPass = await this.accountManager.verifyAccountPassword(
+      did,
+      password,
+    )
+    if (!validPass) {
+      throw new InvalidCredentialsError('Invalid did or password', did)
+    }
+
+    await this.accountManager.assertValidEmailToken(
+      did,
+      'delete_account',
+      token,
+    )
+
+    // @NOTE Order matters here: first "unlink" the account by removing it
+    // from the account manager database ("source of truth"), then notify the
+    // sequencer, and finally cleanup files from the file system.
+    await this.accountManager.deleteAccount(did)
+    try {
+      await this.sequencer.sequenceAccountDeletion(did)
+    } finally {
+      await this.actorStore.destroy(did)
+    }
+  }
+
   private async toTokenInfo(
     row: ActorAccount & Selectable<schemas.Token>,
   ): Promise<TokenInfo> {
@@ -728,15 +795,16 @@ export class OAuthStore
 
   private async buildAccount(row: ActorAccount): Promise<Account> {
     const account: Account = {
-      sub: row.did,
-      aud: this.serviceDid,
+      did: row.did,
+      pds: this.serviceDid,
       email: row.email || undefined,
-      email_verified: row.email ? row.emailConfirmedAt != null : undefined,
-      preferred_username: row.handle || undefined,
+      emailVerified: row.email ? row.emailConfirmedAt != null : undefined,
+      handle: row.handle || undefined,
+      deactivated: row.deactivatedAt != null,
     }
 
     if (!account.name || !account.picture) {
-      const did = account.sub
+      const { did } = account
 
       const profile = await this.actorStore
         .read(did, async (store) => {

package/src/actor-store/blob/reader.ts

@@ -130,11 +130,14 @@ export class BlobReader {
     const { cursor, limit } = opts
     let builder = this.db.db
       .selectFrom('record_blob')
-      .whereNotExists((qb) =>
-        qb
-          .selectFrom('blob')
-          .selectAll()
-          .whereRef('blob.cid', '=', 'record_blob.blobCid'),
+      .where(({ not, exists, selectFrom }) =>
+        not(
+          exists(
+            selectFrom('blob')
+              .selectAll()
+              .whereRef('blob.cid', '=', 'record_blob.blobCid'),
+          ),
+        ),
       )
       .selectAll()
       .orderBy('blobCid', 'asc')

package/src/actor-store/record/reader.ts

@@ -88,7 +88,7 @@ export class RecordReader {
       .selectFrom('record')
       .innerJoin('repo_block', 'repo_block.cid', 'record.cid')
       .where('record.collection', '=', collection)
-      .if(!includeSoftDeleted, (qb) =>
+      .$if(!includeSoftDeleted, (qb) =>
         qb.where(notSoftDeletedClause(ref('record'))),
       )
       .orderBy('record.rkey', reverse ? 'asc' : 'desc')
@@ -135,7 +135,7 @@ export class RecordReader {
       .innerJoin('repo_block', 'repo_block.cid', 'record.cid')
       .where('record.uri', '=', uri.toString())
       .selectAll()
-      .if(!includeSoftDeleted, (qb) =>
+      .$if(!includeSoftDeleted, (qb) =>
         qb.where(notSoftDeletedClause(ref('record'))),
       )
     if (cid) {
@@ -162,7 +162,7 @@ export class RecordReader {
       .selectFrom('record')
       .select('uri')
       .where('record.uri', '=', uri.toString())
-      .if(!includeSoftDeleted, (qb) =>
+      .$if(!includeSoftDeleted, (qb) =>
         qb.where(notSoftDeletedClause(ref('record'))),
       )
     if (cid) {

package/src/actor-store/repo/sql-repo-reader.ts

@@ -118,7 +118,7 @@ export class SqlRepoReader extends ReadableBlockstore {
     if (cursor) {
       // use this syntax to ensure we hit the index
       builder = builder.where(
-        sql`((${ref('repoRev')}, ${ref('cid')}) < (${
+        sql<boolean>`((${ref('repoRev')}, ${ref('cid')}) < (${
           cursor.rev
         }, ${cursor.cid.toString()}))`,
       )

package/src/api/com/atproto/admin/updateSubjectStatus.ts

@@ -9,6 +9,13 @@ export default function (server: Server, ctx: AppContext) {
     auth: ctx.authVerifier.moderator,
     handler: async ({ input }) => {
       const { subject, takedown, deactivated } = input.body
+
+      if (takedown?.applied && deactivated != null && !deactivated.applied) {
+        throw new InvalidRequestError(
+          `Cannot activate and takedown an account at the same time`,
+        )
+      }
+
       if (takedown) {
         if (com.atproto.admin.defs.repoRef.$isTypeOf(subject)) {
           await ctx.accountManager.takedownAccount(subject.did, takedown)
@@ -32,16 +39,21 @@ export default function (server: Server, ctx: AppContext) {
       if (deactivated) {
         if (com.atproto.admin.defs.repoRef.$isTypeOf(subject)) {
           if (deactivated.applied) {
-            await ctx.accountManager.deactivateAccount(subject.did, null)
+            await ctx.accountManager.deactivateAccount(subject.did)
           } else {
             await ctx.accountManager.activateAccount(subject.did)
           }
         }
       }
 
-      if (com.atproto.admin.defs.repoRef.$isTypeOf(subject)) {
-        const status = await ctx.accountManager.getAccountStatus(subject.did)
-        await ctx.sequencer.sequenceAccount(subject.did, status)
+      // @NOTE accountManager will sequence an account status when updating the
+      // status, so we don't *need* to sequence the account status here.
+      // However, this endpoint historically has always sequenced the account
+      // status.
+      if (!takedown && !deactivated) {
+        if (com.atproto.admin.defs.repoRef.$isTypeOf(subject)) {
+          await ctx.accountManager.sequenceAccountStatus(subject.did)
+        }
       }
 
       return {