@atproto/pds 0.5.5 → 0.5.6

package/tests/account-status.test.ts

@@ -0,0 +1,206 @@
+import { jest } from '@jest/globals'
+import { TestNetworkNoAppView } from '@atproto/dev-env'
+import { Client } from '@atproto/lex'
+import { com } from '../src/lexicons/index.js'
+
+describe('account-status', () => {
+  let network: TestNetworkNoAppView
+  let client: Client
+
+  beforeAll(async () => {
+    network = await TestNetworkNoAppView.create({
+      dbPostgresSchema: 'account_status',
+    })
+    client = network.pds.getClient()
+  })
+
+  afterEach(async () => {
+    await network.processAll()
+  })
+
+  afterAll(async () => {
+    await network.close()
+  })
+
+  it('takedown + activation triggers an error', async () => {
+    const { did } = await client.call(com.atproto.server.createAccount, {
+      handle: 'iris.test',
+      email: 'iris@test.com',
+      password: 'password',
+    })
+
+    await expect(
+      client.call(
+        com.atproto.admin.updateSubjectStatus,
+        {
+          subject: com.atproto.admin.defs.repoRef.$build({ did }),
+          takedown: { applied: true },
+          deactivated: { applied: false },
+        },
+        { headers: { authorization: network.pds.adminAuth() } },
+      ),
+    ).rejects.toMatchObject({
+      error: 'InvalidRequest',
+      message: 'Cannot activate and takedown an account at the same time',
+    })
+  })
+
+  it('activating a taken down account causes an error', async () => {
+    const { did } = await client.call(com.atproto.server.createAccount, {
+      handle: 'iris2.test',
+      email: 'iris2@test.com',
+      password: 'password',
+    })
+
+    const mock = jest.spyOn(network.pds.ctx.sequencer, 'sequenceEvts')
+
+    // First deactivate
+    await client.call(
+      com.atproto.admin.updateSubjectStatus,
+      {
+        subject: com.atproto.admin.defs.repoRef.$build({ did }),
+        deactivated: { applied: true },
+      },
+      { headers: { authorization: network.pds.adminAuth() } },
+    )
+
+    expect(mock).toHaveBeenCalledTimes(1)
+
+    // Then takedown
+    await client.call(
+      com.atproto.admin.updateSubjectStatus,
+      {
+        subject: com.atproto.admin.defs.repoRef.$build({ did }),
+        takedown: { applied: true },
+      },
+      { headers: { authorization: network.pds.adminAuth() } },
+    )
+
+    expect(mock).toHaveBeenCalledTimes(2)
+
+    // Then remove the takedown
+    await client.call(
+      com.atproto.admin.updateSubjectStatus,
+      {
+        subject: com.atproto.admin.defs.repoRef.$build({ did }),
+        takedown: { applied: false },
+      },
+      { headers: { authorization: network.pds.adminAuth() } },
+    )
+
+    expect(mock).toHaveBeenCalledTimes(3)
+
+    // Then try to activate again (should work now)
+    await client.call(
+      com.atproto.admin.updateSubjectStatus,
+      {
+        subject: com.atproto.admin.defs.repoRef.$build({ did }),
+        deactivated: { applied: false },
+      },
+      { headers: { authorization: network.pds.adminAuth() } },
+    )
+
+    expect(mock).toHaveBeenCalledTimes(4)
+
+    // Attempt login to ensure account is active
+    await client.call(com.atproto.server.createSession, {
+      identifier: 'iris2.test',
+      password: 'password',
+    })
+
+    // @TODO use "using" (requires updating jest)
+    mock.mockRestore()
+  })
+
+  it('sequences an account status event when calling updateSubjectStatus without changing the status', async () => {
+    const { did } = await client.call(com.atproto.server.createAccount, {
+      handle: 'iris3.test',
+      email: 'iris3@test.com',
+      password: 'password',
+    })
+
+    const mock = jest.spyOn(network.pds.ctx.sequencer, 'sequenceEvts')
+
+    // Update the account status without changing the status (should still sequence an event)
+    await client.call(
+      com.atproto.admin.updateSubjectStatus,
+      {
+        subject: com.atproto.admin.defs.repoRef.$build({ did }),
+      },
+      { headers: { authorization: network.pds.adminAuth() } },
+    )
+
+    expect(mock).toHaveBeenCalledTimes(1)
+
+    // @TODO use "using" (requires updating jest)
+    mock.mockRestore()
+  })
+
+  it('allows to takedown, then deactivate, an account', async () => {
+    const { did } = await client.call(com.atproto.server.createAccount, {
+      handle: 'iris4.test',
+      email: 'iris4@test.com',
+      password: 'password',
+    })
+
+    await client.call(
+      com.atproto.admin.updateSubjectStatus,
+      {
+        subject: com.atproto.admin.defs.repoRef.$build({ did }),
+        takedown: { applied: true },
+      },
+      { headers: { authorization: network.pds.adminAuth() } },
+    )
+
+    await client.call(
+      com.atproto.admin.updateSubjectStatus,
+      {
+        subject: com.atproto.admin.defs.repoRef.$build({ did }),
+        deactivated: { applied: true },
+      },
+      { headers: { authorization: network.pds.adminAuth() } },
+    )
+
+    const status = await client.call(
+      com.atproto.admin.getSubjectStatus,
+      { did },
+      { headers: { authorization: network.pds.adminAuth() } },
+    )
+
+    expect(status).toEqual({
+      subject: com.atproto.admin.defs.repoRef.$build({ did }),
+      takedown: { applied: true, ref: expect.any(String) },
+      deactivated: { applied: true },
+    })
+  })
+
+  it('throws when trying to activate a takedown account', async () => {
+    const { did } = await client.call(com.atproto.server.createAccount, {
+      handle: 'iris5.test',
+      email: 'iris5@test.com',
+      password: 'password',
+    })
+
+    await client.call(
+      com.atproto.admin.updateSubjectStatus,
+      {
+        subject: com.atproto.admin.defs.repoRef.$build({ did }),
+        takedown: { applied: true },
+      },
+      { headers: { authorization: network.pds.adminAuth() } },
+    )
+
+    await expect(
+      client.call(
+        com.atproto.admin.updateSubjectStatus,
+        {
+          subject: com.atproto.admin.defs.repoRef.$build({ did }),
+          deactivated: { applied: false },
+        },
+        { headers: { authorization: network.pds.adminAuth() } },
+      ),
+    ).rejects.toMatchObject({
+      error: 'AccountNotFound',
+    })
+  })
+})

package/tests/db.test.ts

@@ -21,8 +21,8 @@ describe('db', () => {
     const result = await db.transaction(async (dbTxn) => {
       return await dbTxn.db
         .insertInto('repo_root')
+        // @ts-expect-error invalid date is intentional for testing purposes
         .values({
-          // @ts-expect-error invalid date is intentional for testing purposes
           did: 'x',
           cid: 'x',
           rev: 'x',
@@ -56,8 +56,8 @@ describe('db', () => {
     const promise = db.transaction(async (dbTxn) => {
       await dbTxn.db
         .insertInto('repo_root')
+        // @ts-expect-error invalid date is intentional for testing purposes
         .values({
-          // @ts-expect-error invalid date is intentional for testing purposes
           did: 'y',
           cid: 'y',
           rev: 'y',
@@ -139,8 +139,8 @@ describe('db', () => {
           const name = `user${i}`
           const query = dbTxn.db
             .insertInto('repo_root')
+            // @ts-expect-error invalid date is intentional for testing purposes
             .values({
-              // @ts-expect-error invalid date is intentional for testing purposes
               cid: name,
               did: name,
               rev: name,

package/tests/oauth.test.ts

@@ -160,6 +160,7 @@ describe('oauth', () => {
     const [params] = sendTemplateMock.mock.lastCall!
     expect(params).toEqual({
       handle: 'alice.test',
+      locale: 'fr',
       token: expect.any(String),
     })
 
@@ -240,4 +241,94 @@ describe('oauth', () => {
 
     await page.waitForNetworkIdle()
   })
+
+  it('revokes OAuth sessions on deactivation & requires re-activation on sign-in', async () => {
+    await using page = await PageHelper.from(browser, { languages })
+
+    // Sign into the client (the device session is remembered, so the flow
+    // jumps straight to the consent screen).
+    await page.goto(appUrl)
+
+    await page.assertTitle('OAuth Client Example')
+
+    await page.navigationAction(async () => {
+      const input = await page.typeInInput('identifier', 'alice.test')
+      await input.press('Enter')
+    })
+
+    await page.assertTitle('Autoriser')
+
+    await page.navigationClick('Autoriser')
+
+    await page.assertTitle('OAuth Client Example')
+
+    await page.ensureTextVisibility('Token info', 'h2')
+
+    // While the client page is still open, deactivate the account through
+    // the account manager in another page.
+    {
+      await using accountPage = await PageHelper.from(browser, { languages })
+
+      await accountPage.goto(new URL('/account', network.pds.url))
+
+      await accountPage.assertTitle('Mon compte Atmosphère')
+
+      await accountPage.clickOnText('Compte utilisateur', 'a')
+
+      await accountPage.clickOnText('Désactiver le compte')
+
+      await accountPage.clickOnText('Oui, désactiver')
+
+      await accountPage.waitForNetworkIdle()
+
+      await accountPage.ensureTextVisibility('Réactiver le compte', 'span')
+
+      await network.processAll()
+    }
+
+    // Back in the client: deactivation revoked every OAuth session, so
+    // refreshing the credentials logs the user out.
+    await page.clickOnText('refresh').catch((_err) => {
+      // The OAuth app may have refreshed the session on it's own, causing the
+      // page to reset before the click is processed, which throws an error.
+    })
+
+    await page.waitForNetworkIdle()
+
+    await page.ensureTextVisibility('Login with the Atmosphere', 'h2')
+
+    // Signing back in with the deactivated account asks the user to
+    // re-activate it before the flow can proceed.
+    // @NOTE The PDS is used directly as issuer (rather than resolving the
+    // handle) because handle resolution does not work for deactivated
+    // accounts.
+
+    await page.navigationClick(`Login with ${new URL(network.pds.url).host}`)
+
+    await page.ensureTextVisibility('Se connecter en tant que...')
+
+    await page.clickOnText('alice.test', 'span')
+
+    await page.assertTitle('Heureux de vous revoir!')
+
+    await page.ensureTextVisibility('Vous avez précédemment désactivé')
+
+    await page.clickOnText('Oui, réactiver mon compte')
+
+    // Deactivation also cleared the authorized clients, so consent is
+    // required again.
+    await page.assertTitle('Autoriser')
+
+    await page.navigationClick('Autoriser')
+
+    await page.assertTitle('OAuth Client Example')
+
+    await page.ensureTextVisibility('Token info', 'h2')
+
+    await page.clickOnAriaLabel('User menu')
+
+    await page.clickOnText('Sign out')
+
+    await page.waitForNetworkIdle()
+  })
 })