@atproto/pds 0.5.4 → 0.5.6

package/src/api/com/atproto/server/activateAccount.ts

@@ -1,59 +1,37 @@
-import { INVALID_HANDLE } from '@atproto/syntax'
-import {
-  ForbiddenError,
-  InvalidRequestError,
-  Server,
-} from '@atproto/xrpc-server'
+import { ForbiddenError, Server } from '@atproto/xrpc-server'
 import { ACCESS_FULL } from '../../../../auth-scope.js'
 import { AppContext } from '../../../../context.js'
 import { com } from '../../../../lexicons/index.js'
-import { assertValidDidDocumentForService } from './util.js'
 
 export default function (server: Server, ctx: AppContext) {
-  server.add(com.atproto.server.activateAccount, {
-    auth: ctx.authVerifier.authorization({
-      scopes: ACCESS_FULL,
-      authorize: () => {
-        throw new ForbiddenError(
-          'OAuth credentials are not supported for this endpoint',
-        )
-      },
-    }),
-    handler: async ({ req, auth }) => {
-      // in the case of entryway, the full flow is activateAccount (PDS) -> activateAccount (Entryway) -> updateSubjectStatus(PDS)
-      if (ctx.entrywayClient) {
-        const { headers } = ctx.entrywayPassthruHeaders(req)
-        await ctx.entrywayClient.xrpc(com.atproto.server.activateAccount, {
-          headers,
-        })
-        return
-      }
-
-      const requester = auth.credentials.did
-
-      await assertValidDidDocumentForService(ctx, requester)
-
-      const account = await ctx.accountManager.getAccount(requester, {
-        includeDeactivated: true,
-      })
-      if (!account) {
-        throw new InvalidRequestError('user not found', 'AccountNotFound')
-      }
-
-      await ctx.accountManager.activateAccount(requester)
+  const { entrywayClient } = ctx
 
-      const syncData = await ctx.actorStore.read(requester, (store) =>
-        store.repo.getSyncEventData(),
-      )
-
-      // @NOTE: we're over-emitting for now for backwards compatibility, can reduce this in the future
-      const status = await ctx.accountManager.getAccountStatus(requester)
-      await ctx.sequencer.sequenceAccountActivation(
-        requester,
-        account.handle ?? INVALID_HANDLE,
-        status,
-        syncData,
+  const auth = ctx.authVerifier.authorization({
+    scopes: ACCESS_FULL,
+    authorize: () => {
+      throw new ForbiddenError(
+        'OAuth credentials are not supported for this endpoint',
       )
     },
   })
+
+  if (entrywayClient) {
+    // in the case of entryway, the full flow is activateAccount (PDS) -> activateAccount (Entryway) -> updateSubjectStatus(PDS)
+    server.add(com.atproto.server.activateAccount, {
+      auth,
+      handler: async ({ req }) => {
+        const { headers } = ctx.entrywayPassthruHeaders(req)
+        await entrywayClient.xrpc(com.atproto.server.activateAccount, {
+          headers,
+        })
+      },
+    })
+  } else {
+    server.add(com.atproto.server.activateAccount, {
+      auth,
+      handler: async ({ auth }) => {
+        await ctx.accountManager.activateAccount(auth.credentials.did)
+      },
+    })
+  }
 }

package/src/api/com/atproto/server/deactivateAccount.ts

@@ -32,13 +32,9 @@ export default function (server: Server, ctx: AppContext) {
     server.add(com.atproto.server.deactivateAccount, {
       auth,
       handler: async ({ input: { body }, auth }) => {
-        const requester = auth.credentials.did
-        await ctx.accountManager.deactivateAccount(
-          requester,
-          body.deleteAfter ?? null,
-        )
-        const status = await ctx.accountManager.getAccountStatus(requester)
-        await ctx.sequencer.sequenceAccount(requester, status)
+        await ctx.accountManager.deactivateAccount(auth.credentials.did, {
+          deleteAfter: body.deleteAfter ?? null,
+        })
       },
     })
   }

package/src/api/com/atproto/server/deleteAccount.ts

@@ -2,6 +2,7 @@ import { MINUTE } from '@atproto/common'
 import {
   AuthRequiredError,
   InvalidRequestError,
+  MethodRateLimit,
   Server,
 } from '@atproto/xrpc-server'
 import { OLD_PASSWORD_MAX_LENGTH } from '../../../../account-manager/helpers/scrypt.js'
@@ -11,58 +12,74 @@ import { com } from '../../../../lexicons/index.js'
 export default function (server: Server, ctx: AppContext) {
   const { entrywayClient } = ctx
 
-  server.add(com.atproto.server.deleteAccount, {
-    rateLimit: {
-      durationMs: 5 * MINUTE,
-      points: 50,
-    },
-    handler: async ({ input: { body }, req }) => {
-      const { did, password, token } = body
+  const rateLimit: MethodRateLimit = {
+    durationMs: 5 * MINUTE,
+    points: 50,
+  }
 
-      const account = await ctx.accountManager.getAccount(did, {
-        includeDeactivated: true,
-        includeTakenDown: true,
-      })
-      if (!account) {
-        throw new InvalidRequestError('account not found')
-      }
+  if (entrywayClient) {
+    server.add(com.atproto.server.deleteAccount, {
+      rateLimit,
+      handler: async ({ input: { body }, req }) => {
+        const account = await ctx.accountManager.getAccount(body.did, {
+          includeDeactivated: true,
+          includeTakenDown: true,
+        })
+        if (!account) {
+          throw new InvalidRequestError('account not found')
+        }
 
-      if (entrywayClient) {
         const { headers } = ctx.entrywayPassthruHeaders(req)
         await entrywayClient.xrpc(com.atproto.server.deleteAccount, {
           body,
           headers,
         })
-        return
-      }
+      },
+    })
+  } else {
+    server.add(com.atproto.server.deleteAccount, {
+      rateLimit,
+      handler: async ({ input: { body } }) => {
+        const { did, password, token } = body
+
+        if (password.length > OLD_PASSWORD_MAX_LENGTH) {
+          throw new AuthRequiredError(
+            'Password too long. Consider resetting your password.',
+          )
+        }
 
-      if (password.length > OLD_PASSWORD_MAX_LENGTH) {
-        throw new InvalidRequestError('Invalid password length.')
-      }
+        const account = await ctx.accountManager.getAccount(did, {
+          includeDeactivated: true,
+          includeTakenDown: true,
+        })
+        if (!account) {
+          throw new InvalidRequestError('account not found')
+        }
 
-      const validPass = await ctx.accountManager.verifyAccountPassword(
-        did,
-        password,
-      )
-      if (!validPass) {
-        throw new AuthRequiredError('Invalid did or password')
-      }
+        const validPass = await ctx.accountManager.verifyAccountPassword(
+          did,
+          password,
+        )
+        if (!validPass) {
+          throw new AuthRequiredError('Invalid did or password')
+        }
 
-      await ctx.accountManager.assertValidEmailToken(
-        did,
-        'delete_account',
-        token,
-      )
+        await ctx.accountManager.assertValidEmailToken(
+          did,
+          'delete_account',
+          token,
+        )
 
-      // @NOTE Order matters here: first "unlink" the account by removing it
-      // from the account manager database ("source of truth"), then notify the
-      // sequencer, and finally cleanup files from the file system.
-      await ctx.accountManager.deleteAccount(did)
-      try {
-        await ctx.sequencer.sequenceAccountDeletion(did)
-      } finally {
-        await ctx.actorStore.destroy(did)
-      }
-    },
-  })
+        // @NOTE Order matters here: first "unlink" the account by removing it
+        // from the account manager database ("source of truth"), then notify the
+        // sequencer, and finally cleanup files from the file system.
+        await ctx.accountManager.deleteAccount(did)
+        try {
+          await ctx.sequencer.sequenceAccountDeletion(did)
+        } finally {
+          await ctx.actorStore.destroy(did)
+        }
+      },
+    })
+  }
 }

package/src/api/com/atproto/server/util.ts

@@ -1,9 +1,10 @@
+import * as plc from '@did-plc/lib'
 import { getPdsEndpoint, getSigningDidKey } from '@atproto/common'
 import * as crypto from '@atproto/crypto'
-import { DidDocument } from '@atproto/identity'
+import { DidDocument, IdResolver } from '@atproto/identity'
 import { InvalidRequestError } from '@atproto/xrpc-server'
+import { ActorStore } from '../../../../actor-store/actor-store.js'
 import { ServerConfig } from '../../../../config/index.js'
-import { AppContext } from '../../../../context.js'
 import { httpLogger } from '../../../../logger.js'
 
 // generate an invite code preceded by the hostname
@@ -29,7 +30,7 @@ export const getRandomToken = () => {
 }
 
 export const safeResolveDidDoc = async (
-  ctx: AppContext,
+  ctx: { idResolver: IdResolver },
   did: string,
   forceRefresh?: boolean,
 ): Promise<DidDocument | undefined> => {
@@ -42,7 +43,7 @@ export const safeResolveDidDoc = async (
 }
 
 export const didDocForSession = async (
-  ctx: AppContext,
+  ctx: { idResolver: IdResolver; cfg: ServerConfig },
   did: string,
   forceRefresh?: boolean,
 ): Promise<DidDocument | undefined> => {
@@ -51,7 +52,13 @@ export const didDocForSession = async (
 }
 
 export const isValidDidDocForService = async (
-  ctx: AppContext,
+  ctx: {
+    plcClient: plc.Client
+    idResolver: IdResolver
+    cfg: ServerConfig
+    plcRotationKey: crypto.Keypair
+    actorStore: ActorStore
+  },
   did: string,
 ): Promise<boolean> => {
   try {
@@ -63,7 +70,13 @@ export const isValidDidDocForService = async (
 }
 
 export const assertValidDidDocumentForService = async (
-  ctx: AppContext,
+  ctx: {
+    plcClient: plc.Client
+    idResolver: IdResolver
+    cfg: ServerConfig
+    plcRotationKey: crypto.Keypair
+    actorStore: ActorStore
+  },
   did: string,
 ) => {
   if (did.startsWith('did:plc')) {
@@ -86,7 +99,11 @@ export const assertValidDidDocumentForService = async (
 }
 
 const assertValidDocContents = async (
-  ctx: AppContext,
+  ctx: {
+    cfg: ServerConfig
+    plcRotationKey: crypto.Keypair
+    actorStore: ActorStore
+  },
   did: string,
   contents: {
     signingKey?: string

package/src/config/config.ts

@@ -5,7 +5,7 @@ import {
   BrandingInput as BrandingConfig,
   HcaptchaConfig,
 } from '@atproto/oauth-provider'
-import { ensureValidDid } from '@atproto/syntax'
+import { DidString, ensureValidDid, isValidDid } from '@atproto/syntax'
 import { ServerEnvironment } from './env.js'
 
 export type { BrandingConfig }
@@ -21,6 +21,11 @@ export const envToCfg = (env: ServerEnvironment): ServerConfig => {
       ? `http://localhost:${port}`
       : `https://${hostname}`
   const did = env.serviceDid ?? `did:web:${hostname}`
+
+  if (!isValidDid(did)) {
+    throw new Error(`Invalid service DID: ${did}`)
+  }
+
   const serviceCfg: ServerConfig['service'] = {
     port,
     hostname,
@@ -400,7 +405,7 @@ export type ServiceConfig = {
   port: number
   hostname: string
   publicUrl: string
-  did: string
+  did: DidString
   version?: string
   privacyPolicyUrl?: string
   termsOfServiceUrl?: string

package/src/context.ts

@@ -277,15 +277,14 @@ export class AppContext {
           )
 
     const accountManager = new AccountManager(
+      cfg,
+      actorStore,
       idResolver,
       jwtSecretKey,
       mailer,
       sequencer,
       plcClient,
       plcRotationKey,
-      cfg.service.did,
-      cfg.identity.serviceHandleDomains,
-      cfg.db,
     )
     await accountManager.migrateOrThrow()
 

package/src/db/migrator.ts

@@ -1,4 +1,5 @@
-import { Kysely, Migration, Migrator as KyselyMigrator } from 'kysely'
+import { Kysely } from 'kysely'
+import { Migration, Migrator as KyselyMigrator } from 'kysely/migration'
 
 export class Migrator<T> extends KyselyMigrator {
   constructor(

package/src/db/pagination.ts

@@ -1,4 +1,4 @@
-import { sql } from 'kysely'
+import { SqlBool, sql } from 'kysely'
 import { InvalidRequestError } from '@atproto/xrpc-server'
 import { AnyQb, DbRef } from './util.js'
 
@@ -66,16 +66,16 @@ export abstract class GenericKeyset<R, LR extends LabeledResult> {
     if (tryIndex) {
       // The tryIndex param will likely disappear and become the default implementation: here for now for gradual rollout query-by-query.
       if (direction === 'asc') {
-        return sql`((${this.primary}, ${this.secondary}) > (${labeled.primary}, ${labeled.secondary}))`
+        return sql<SqlBool>`((${this.primary}, ${this.secondary}) > (${labeled.primary}, ${labeled.secondary}))`
       } else {
-        return sql`((${this.primary}, ${this.secondary}) < (${labeled.primary}, ${labeled.secondary}))`
+        return sql<SqlBool>`((${this.primary}, ${this.secondary}) < (${labeled.primary}, ${labeled.secondary}))`
       }
     } else {
       // @NOTE this implementation can struggle to use an index on (primary, secondary) for pagination due to the "or" usage.
       if (direction === 'asc') {
-        return sql`((${this.primary} > ${labeled.primary}) or (${this.primary} = ${labeled.primary} and ${this.secondary} > ${labeled.secondary}))`
+        return sql<SqlBool>`((${this.primary} > ${labeled.primary}) or (${this.primary} = ${labeled.primary} and ${this.secondary} > ${labeled.secondary}))`
       } else {
-        return sql`((${this.primary} < ${labeled.primary}) or (${this.primary} = ${labeled.primary} and ${this.secondary} < ${labeled.secondary}))`
+        return sql<SqlBool>`((${this.primary} < ${labeled.primary}) or (${this.primary} = ${labeled.primary} and ${this.secondary} < ${labeled.secondary}))`
       }
     }
   }
@@ -125,8 +125,8 @@ export const paginate = <
   const { limit, cursor, keyset, direction = 'desc', tryIndex } = opts
   const keysetSql = keyset.getSql(keyset.unpack(cursor), direction, tryIndex)
   return qb
-    .if(!!limit, (q) => q.limit(limit as number))
+    .$if(!!limit, (q) => q.limit(limit as number))
     .orderBy(keyset.primary, direction)
     .orderBy(keyset.secondary, direction)
-    .if(!!keysetSql, (qb) => (keysetSql ? qb.where(keysetSql) : qb)) as QB
+    .$if(!!keysetSql, (qb) => (keysetSql ? qb.where(keysetSql) : qb)) as QB
 }

package/src/db/util.ts

@@ -5,6 +5,7 @@ import {
   RawBuilder,
   ReferenceExpression,
   SelectQueryBuilder,
+  SqlBool,
   SqliteAdapter,
   SqliteIntrospector,
   SqliteQueryCompiler,
@@ -14,7 +15,7 @@ import { retry } from '@atproto/common'
 
 // Applies to repo_root or record table
 export const notSoftDeletedClause = (alias: DbRef) => {
-  return sql`${alias}."takedownRef" is null`
+  return sql<SqlBool>`${alias}."takedownRef" is null`
 }
 
 export const softDeleted = (repoOrRecord: { takedownRef: string | null }) => {
@@ -92,7 +93,9 @@ const RETRY_ERRORS = new Set([
 
 export type Ref = ReferenceExpression<any, any>
 
-export type DbRef = RawBuilder | ReturnType<DynamicModule['ref']>
+export type DbRef =
+  | RawBuilder<unknown>
+  | ReturnType<DynamicModule<unknown>['ref']>
 
 export type AnyQb = SelectQueryBuilder<any, any, any>
 

package/src/mailer/index.ts

@@ -36,9 +36,10 @@ export class ServerMailer {
   }
 
   async sendResetPassword(
-    params: { handle: string; token: string },
+    params: { handle: string; token: string; locale?: string },
     mailOpts: SendMailOptions,
   ) {
+    // @TODO (later) handle locale in the template
     await this.sendTemplate('resetPassword', params, {
       subject: 'Password Reset Requested',
       ...mailOpts,
@@ -46,9 +47,10 @@ export class ServerMailer {
   }
 
   async sendAccountDelete(
-    params: { token: string },
+    params: { token: string; locale?: string },
     mailOpts: SendMailOptions,
   ) {
+    // @TODO (later) handle locale in the template
     await this.sendTemplate('deleteAccount', params, {
       subject: 'Account Deletion Requested',
       ...mailOpts,

package/src/scripts/sequencer-recovery/recovery-db.ts

@@ -35,7 +35,7 @@ export const getAndMigrateRecoveryDb = async (
   const pragmas: Record<string, string> = disableWalAutoCheckpoint
     ? { wal_autocheckpoint: '0' }
     : {}
-  const db = Database.sqlite(location, pragmas)
+  const db = Database.sqlite<RecoveryDbSchema>(location, pragmas)
   const migrator = new Migrator(db.db, migrations)
   await migrator.migrateToLatestOrThrow()
   return db

package/src/sequencer/events.ts

@@ -83,12 +83,10 @@ export const formatSeqIdentityEvt = async (
   did: DidString,
   handle?: HandleString,
 ): Promise<RepoSeqInsert> => {
-  const evt: IdentityEvt = {
-    did,
-  }
-  if (handle) {
-    evt.handle = handle
-  }
+  const evt: IdentityEvt = handle //
+    ? { did, handle }
+    : { did }
+
   return {
     did,
     eventType: 'identity',
@@ -101,13 +99,10 @@ export const formatSeqAccountEvt = async (
   did: DidString,
   status: AccountStatus,
 ): Promise<RepoSeqInsert> => {
-  const evt: AccountEvt = {
-    did,
-    active: status === 'active',
-  }
-  if (status !== AccountStatus.Active) {
-    evt.status = status
-  }
+  const evt: AccountEvt =
+    status === AccountStatus.Active
+      ? { did, active: true }
+      : { did, active: false, status }
 
   return {
     did,

package/src/sequencer/sequencer.ts

@@ -162,9 +162,7 @@ export class Sequencer extends (EventEmitter as new () => SequencerEmitter) {
     await wait(waitTime)
   }
 
-  protected async sequenceEvts(
-    events: readonly RepoSeqInsert[],
-  ): Promise<number[]> {
+  async sequenceEvts(events: readonly RepoSeqInsert[]): Promise<number[]> {
     if (!events.length) return []
     const rows = await this.db.executeWithRetry(
       this.db.db.insertInto('repo_seq').values(events).returning('seq'),

package/tests/account-manager.test.ts

@@ -134,6 +134,7 @@ describe('account manager', () => {
     const [params] = sendResetPasswordMock.mock.lastCall!
     expect(params).toEqual({
       handle: 'bob.test',
+      locale: 'fr',
       token: expect.any(String),
     })
 
@@ -380,4 +381,82 @@ describe('account manager', () => {
     await page.clickOnText('Retour')
     await page.ensureTextVisibility('bob-renamed.test', 'span')
   })
+
+  it('allows deactivating & reactivating the account', async () => {
+    await using page = await PageHelper.from(browser, { languages })
+
+    await page.goto(new URL('/account', network.pds.url))
+
+    await page.assertTitle('Mon compte Atmosphère')
+
+    await page.clickOnText('Compte utilisateur', 'a')
+
+    await page.clickOnText('Désactiver le compte')
+
+    await page.ensureTextVisibility(
+      'limite de temps pour la désactivation du compte',
+    )
+
+    await page.clickOnText('Oui, désactiver')
+
+    await page.waitForNetworkIdle()
+
+    // The row should now offer re-activation
+    await page.ensureTextVisibility('Réactiver le compte', 'span')
+
+    await page.clickOnText('Réactiver le compte')
+
+    // @NOTE The dialog's submit label ("Réactiver") is a substring of the
+    // trigger row ("Réactiver le compte"), which comes first in DOM order, so
+    // we target the dialog's submit button instead of using its text.
+    await page.clickOn('[role="dialog"] button[type="submit"]')
+
+    await page.waitForNetworkIdle()
+
+    await page.ensureTextVisibility('Désactiver le compte', 'span')
+  })
+
+  it('allows deleting the account', async () => {
+    await using page = await PageHelper.from(browser, { languages })
+
+    await page.goto(new URL('/account', network.pds.url))
+
+    await page.assertTitle('Mon compte Atmosphère')
+
+    await page.clickOnText('Compte utilisateur', 'a')
+
+    await page.clickOnText('Supprimer le compte')
+
+    using sendAccountDeleteMock = jest
+      .spyOn(network.pds.ctx.mailer, 'sendAccountDelete')
+      .mockImplementation(async () => {
+        // noop
+      })
+
+    await page.clickOnText("Envoyer l'email")
+
+    await page.waitForNetworkIdle()
+
+    expect(sendAccountDeleteMock).toHaveBeenCalledTimes(1)
+
+    const [params] = sendAccountDeleteMock.mock.lastCall!
+    expect(params).toEqual({
+      locale: 'fr',
+      token: expect.any(String),
+    })
+
+    await page.typeInInput('code', params.token)
+    await page.typeInInput('password', 'bob-new-pass')
+
+    await page.clickOnText('Supprimer mon compte')
+
+    // A final confirmation step is displayed
+    await page.ensureTextVisibility('Êtes-vous vraiment, vraiment sûr ?', 'h2')
+
+    await page.clickOnText('Oui, supprimer mon compte')
+
+    // Once the account is deleted, the session is gone and the user is
+    // brought back to the sign-in page.
+    await page.assertTitle('Se connecter')
+  })
 })