@atproto/pds 0.5.5 → 0.5.7

package/src/account-manager/account-manager.ts

@@ -1,3 +1,4 @@
+import assert from 'node:assert'
 import { KeyObject } from 'node:crypto'
 import { Client as PlcClient } from '@did-plc/lib'
 import { isEmailValid } from '@hapi/address'
@@ -12,9 +13,16 @@ import {
   isAtIdentifierString,
 } from '@atproto/lex'
 import { Cid } from '@atproto/lex-data'
-import { currentDatetimeString, isValidTld } from '@atproto/syntax'
+import {
+  INVALID_HANDLE,
+  currentDatetimeString,
+  isValidTld,
+} from '@atproto/syntax'
 import { AuthRequiredError, InvalidRequestError } from '@atproto/xrpc-server'
+import { ActorStore } from '../actor-store/actor-store.js'
+import { assertValidDidDocumentForService } from '../api/com/atproto/server/util.js'
 import { AuthScope } from '../auth-scope.js'
+import { ServerConfig } from '../config/config.js'
 import { softDeleted } from '../db/index.js'
 import { hasExplicitSlur } from '../handle/explicit-slurs.js'
 import {
@@ -27,9 +35,10 @@ import { httpLogger } from '../logger.js'
 import { ServerMailer } from '../mailer/index.js'
 import { Sequencer } from '../sequencer/index.js'
 import { AccountDb, EmailTokenPurpose, getDb, getMigrator } from './db/index.js'
-import * as account from './helpers/account.js'
+import * as accountHelpers from './helpers/account.js'
 import { AccountStatus, ActorAccount } from './helpers/account.js'
 import * as auth from './helpers/auth.js'
+import * as authorizedClientHelper from './helpers/authorized-client.js'
 import * as emailToken from './helpers/email-token.js'
 import * as invite from './helpers/invite.js'
 import * as password from './helpers/password.js'
@@ -53,7 +62,7 @@ export { AccountStatus, formatAccountStatus } from './helpers/account.js'
  */
 export class InvalidPasswordError extends AuthRequiredError {
   constructor(
-    public readonly did: string,
+    public readonly did: DidString,
     errorMessage = 'Invalid identifier or password',
   ) {
     super(errorMessage)
@@ -69,17 +78,24 @@ export class AccountManager {
   readonly db: AccountDb
 
   constructor(
+    readonly cfg: ServerConfig,
+    readonly actorStore: ActorStore,
     readonly idResolver: IdResolver,
     readonly jwtKey: KeyObject,
     readonly mailer: ServerMailer,
     readonly sequencer: Sequencer,
     readonly plcClient: PlcClient,
     readonly plcRotationKey: Keypair,
-    readonly serviceDid: string,
-    readonly serviceHandleDomains: string[],
-    db: AccountManagerDbConfig,
   ) {
-    this.db = getDb(db.accountDbLoc, db.disableWalAutoCheckpoint)
+    this.db = getDb(cfg.db.accountDbLoc, cfg.db.disableWalAutoCheckpoint)
+  }
+
+  get serviceDid(): DidString {
+    return this.cfg.service.did
+  }
+
+  get serviceHandleDomains(): string[] {
+    return this.cfg.identity.serviceHandleDomains
   }
 
   async migrateOrThrow() {
@@ -96,23 +112,23 @@ export class AccountManager {
 
   async getAccount(
     handleOrDid: AtIdentifierString,
-    flags?: account.AvailabilityFlags,
+    flags?: accountHelpers.AvailabilityFlags,
   ): Promise<ActorAccount | null> {
-    return account.getAccount(this.db, handleOrDid, flags)
+    return accountHelpers.getAccount(this.db, handleOrDid, flags)
   }
 
   async getAccounts(
     dids: DidString[],
-    flags?: account.AvailabilityFlags,
+    flags?: accountHelpers.AvailabilityFlags,
   ): Promise<Map<string, ActorAccount>> {
-    return account.getAccounts(this.db, dids, flags)
+    return accountHelpers.getAccounts(this.db, dids, flags)
   }
 
   async getAccountByEmail(
     email: string,
-    flags?: account.AvailabilityFlags,
+    flags?: accountHelpers.AvailabilityFlags,
   ): Promise<ActorAccount | null> {
-    return account.getAccountByEmail(this.db, email, flags)
+    return accountHelpers.getAccountByEmail(this.db, email, flags)
   }
 
   async isAccountActivated(did: DidString): Promise<boolean> {
@@ -123,22 +139,26 @@ export class AccountManager {
 
   async getDidForActor(
     handleOrDid: AtIdentifierString,
-    flags?: account.AvailabilityFlags,
+    flags?: accountHelpers.AvailabilityFlags,
   ): Promise<DidString | null> {
     const got = await this.getAccount(handleOrDid, flags)
     return got?.did ?? null
   }
 
-  async getAccountStatus(
-    handleOrDid: AtIdentifierString,
-  ): Promise<AccountStatus> {
+  async getAccountStatus(handleOrDid: AtIdentifierString) {
     const got = await this.getAccount(handleOrDid, {
       includeDeactivated: true,
       includeTakenDown: true,
     })
 
-    const res = account.formatAccountStatus(got)
-    return res.active ? AccountStatus.Active : res.status
+    const { active, status = active ? AccountStatus.Active : undefined } =
+      accountHelpers.formatAccountStatus(got)
+    assert(status != null)
+    return { status, account: got } as
+      | { status: AccountStatus.Deleted; account: null }
+      | { status: AccountStatus.Takendown; account: ActorAccount }
+      | { status: AccountStatus.Deactivated; account: ActorAccount }
+      | { status: AccountStatus.Active; account: ActorAccount }
   }
 
   async normalizeAndValidateHandle(
@@ -230,10 +250,14 @@ export class AccountManager {
         await invite.ensureInviteIsAvailable(dbTxn, inviteCode)
       }
 
-      await account.registerActor(dbTxn, { did, handle, deactivated })
+      await accountHelpers.registerActor(dbTxn, { did, handle, deactivated })
 
       if (email && passwordScrypt) {
-        await account.registerAccount(dbTxn, { did, email, passwordScrypt })
+        await accountHelpers.registerAccount(dbTxn, {
+          did,
+          email,
+          passwordScrypt,
+        })
       }
 
       await invite.recordInviteUse(dbTxn, {
@@ -359,7 +383,7 @@ export class AccountManager {
     did: DidString,
     handle: HandleString,
   ): Promise<void> {
-    await account.updateHandle(this.db, did, handle)
+    await accountHelpers.updateHandle(this.db, did, handle)
 
     try {
       await this.sequencer.sequenceIdentity(did, handle)
@@ -369,36 +393,105 @@ export class AccountManager {
   }
 
   async deleteAccount(did: DidString) {
-    return account.deleteAccount(this.db, did)
+    return accountHelpers.deleteAccount(this.db, did)
   }
 
   async takedownAccount(
     did: DidString,
     takedown: com.atproto.admin.defs.StatusAttr,
   ) {
-    await this.db.transaction(async (dbTxn) =>
-      Promise.all([
-        account.updateAccountTakedownStatus(dbTxn, did, takedown),
-        auth.revokeRefreshTokensByDid(dbTxn, did),
-        token.removeByDidQB(dbTxn, did).execute(),
-      ]),
-    )
+    await this.db.transaction(async (dbTxn) => {
+      await accountHelpers.updateAccountTakedownStatus(dbTxn, did, takedown)
+      await auth.revokeRefreshTokensByDid(dbTxn, did)
+      await token.removeByDid(dbTxn, did)
+    })
+
+    await this.sequenceAccountStatus(did)
   }
 
   async getAccountAdminStatus(did: DidString) {
-    return account.getAccountAdminStatus(this.db, did)
+    return accountHelpers.getAccountAdminStatus(this.db, did)
   }
 
   async updateRepoRoot(did: DidString, cid: Cid, rev: string) {
     return repo.updateRoot(this.db, did, cid, rev)
   }
 
-  async deactivateAccount(did: DidString, deleteAfter: string | null) {
-    return account.deactivateAccount(this.db, did, deleteAfter)
+  async deactivateAccount(
+    did: DidString,
+    options?: {
+      deleteCredentials?: boolean
+      deleteAfter?: string | null
+    },
+  ) {
+    const wasUpdated = await this.db.transaction(async (dbTxn) => {
+      if (options?.deleteCredentials) {
+        await token.removeByDid(dbTxn, did)
+        await authorizedClientHelper.deleteAllAuthorizedClients(dbTxn, did)
+        await password.deleteAllAppPasswords(dbTxn, did)
+      }
+
+      return accountHelpers.deactivateAccount(
+        dbTxn,
+        did,
+        options?.deleteAfter ?? null,
+      )
+    })
+
+    if (!wasUpdated) {
+      throw new InvalidRequestError('Account not found')
+    }
+
+    const accountStatus = await this.getAccountStatus(did)
+
+    // Account is likely soft-deleted (takendown)
+    if (accountStatus.status === AccountStatus.Deleted) {
+      throw new InvalidRequestError('Account not found')
+    }
+
+    await this.sequencer.sequenceAccount(did, accountStatus.status)
+
+    return accountStatus
   }
 
   async activateAccount(did: DidString) {
-    return account.activateAccount(this.db, did)
+    await assertValidDidDocumentForService(this, did)
+
+    const found = await accountHelpers.activateAccount(this.db, did, {
+      // We cannot activate a takendown account
+      includeTakenDown: false,
+      includeDeactivated: true,
+    })
+    if (!found) {
+      throw new InvalidRequestError('user not found', 'AccountNotFound')
+    }
+
+    const accountStatus = await this.getAccountStatus(did)
+
+    const { account, status } = accountStatus
+
+    if (status === AccountStatus.Deleted) {
+      // A concurrent operation deleted the account
+      throw new InvalidRequestError('user not found', 'AccountNotFound')
+    }
+
+    const syncData = await this.actorStore.read(did, (store) => {
+      return store.repo.getSyncEventData()
+    })
+
+    await this.sequencer.sequenceAccountActivation(
+      did,
+      account.handle ?? INVALID_HANDLE,
+      status,
+      syncData,
+    )
+
+    return accountStatus
+  }
+
+  async sequenceAccountStatus(did: DidString) {
+    const { status } = await this.getAccountStatus(did)
+    await this.sequencer.sequenceAccount(did, status)
   }
 
   // Auth
@@ -556,6 +649,12 @@ export class AccountManager {
     did: DidString,
     passwordStr: string,
   ): Promise<boolean> {
+    if (passwordStr.length > scrypt.OLD_PASSWORD_MAX_LENGTH) {
+      // @NOTE Avoid throwing from here to avoid leaking account email validity
+      // through error messages.
+      return false
+    }
+
     return password.verifyAccountPassword(this.db, did, passwordStr)
   }
 
@@ -691,7 +790,7 @@ export class AccountManager {
     const now = currentDatetimeString()
     await this.db.transaction(async (dbTxn) => {
       await emailToken.deleteEmailToken(dbTxn, did, 'confirm_email')
-      await account.setEmailConfirmedAt(dbTxn, did, now)
+      await accountHelpers.setEmailConfirmedAt(dbTxn, did, now)
     })
 
     user.emailConfirmedAt = now
@@ -787,7 +886,7 @@ export class AccountManager {
   async updateAccountEmail(opts: { did: DidString; email: string }) {
     const { did, email } = opts
     await this.db.transaction(async (dbTxn) => {
-      await account.updateEmail(dbTxn, did, email)
+      await accountHelpers.updateEmail(dbTxn, did, email)
       await emailToken.deleteAllEmailTokens(dbTxn, did)
     })
   }

package/src/account-manager/db/migrations/005-oauth-account-management.ts

@@ -85,13 +85,14 @@ export async function up(
         .select('authenticatedAt as createdAt') // Best we can do
         .select('authenticatedAt as updatedAt')
         .where('remember', '=', 1)
-        .whereExists((qb) =>
+        .where(({ exists, selectFrom }) =>
           // device_account does not have fkey on account.did,
           // so we satisfy account_device_did_fk with this condition.
-          qb
-            .selectFrom('account')
-            .selectAll()
-            .whereRef('account.did', '=', 'device_account.did'),
+          exists(
+            selectFrom('account')
+              .selectAll()
+              .whereRef('account.did', '=', 'device_account.did'),
+          ),
         ),
     )
     .onConflict((oc) => oc.doNothing())

package/src/account-manager/db/schema/authorization-request.ts

@@ -4,6 +4,7 @@ import {
   ClientAuthLegacy,
   Code,
   DeviceId,
+  Did,
   OAuthAuthorizationRequestParameters,
   OAuthClientId,
   RequestId,
@@ -12,7 +13,7 @@ import { DateISO, JsonEncoded } from '../../../db/index.js'
 
 export interface AuthorizationRequest {
   id: RequestId
-  did: string | null
+  did: Did | null
   deviceId: DeviceId | null
 
   clientId: OAuthClientId

package/src/account-manager/db/schema/authorized-client.ts

@@ -1,9 +1,13 @@
 import { Selectable } from 'kysely'
-import { AuthorizedClientData, OAuthClientId } from '@atproto/oauth-provider'
+import {
+  AuthorizedClientData,
+  Did,
+  OAuthClientId,
+} from '@atproto/oauth-provider'
 import { DateISO, JsonEncoded } from '../../../db/index.js'
 
 export interface AuthorizedClient {
-  did: string
+  did: Did
   clientId: OAuthClientId
 
   createdAt: DateISO

package/src/account-manager/db/schema/token.ts

@@ -4,18 +4,18 @@ import {
   ClientAuthLegacy,
   Code,
   DeviceId,
+  Did,
   OAuthAuthorizationDetails,
   OAuthAuthorizationRequestParameters,
   OAuthClientId,
   RefreshToken,
-  Sub,
   TokenId,
 } from '@atproto/oauth-provider'
 import { DateISO, JsonEncoded } from '../../../db/cast.js'
 
 export interface Token {
   id: Generated<number>
-  did: Sub
+  did: Did
 
   tokenId: TokenId
   createdAt: DateISO

package/src/account-manager/helpers/account-device.ts

@@ -1,6 +1,5 @@
 import assert from 'node:assert'
-import { DeviceId } from '@atproto/oauth-provider'
-import { DidString } from '@atproto/syntax'
+import { DeviceId, Did } from '@atproto/oauth-provider'
 import { toDateISO } from '../../db/index.js'
 import { AccountDb } from '../db/index.js'
 import { selectAccountQB } from './account.js'
@@ -26,13 +25,10 @@ export function upsertQB(db: AccountDb, deviceId: DeviceId, did: string) {
 
 export function selectQB(
   db: AccountDb,
-  filter: {
-    sub?: string
-    deviceId?: DeviceId
-  },
+  filter: { did?: Did; deviceId?: DeviceId },
 ) {
   assert(
-    filter.sub != null || filter.deviceId != null,
+    filter.did != null || filter.deviceId != null,
     'Either sub or deviceId must be provided',
   )
 
@@ -52,10 +48,8 @@ export function selectQB(
         'device.ipAddress',
         'device.lastSeenAt',
       ])
-      .if(filter.sub != null, (qb) =>
-        qb.where('actor.did', '=', filter.sub! as DidString),
-      )
-      .if(filter.deviceId != null, (qb) =>
+      .$if(filter.did != null, (qb) => qb.where('actor.did', '=', filter.did!))
+      .$if(filter.deviceId != null, (qb) =>
         qb.where('account_device.deviceId', '=', filter.deviceId!),
       )
   )

package/src/account-manager/helpers/account.ts

@@ -46,8 +46,10 @@ export const selectAccountQB = (db: AccountDb, flags?: AvailabilityFlags) => {
   return db.db
     .selectFrom('actor')
     .leftJoin('account', 'actor.did', 'account.did')
-    .if(!includeTakenDown, (qb) => qb.where(notSoftDeletedClause(ref('actor'))))
-    .if(!includeDeactivated, (qb) =>
+    .$if(!includeTakenDown, (qb) =>
+      qb.where(notSoftDeletedClause(ref('actor'))),
+    )
+    .$if(!includeDeactivated, (qb) =>
       qb.where('actor.deactivatedAt', 'is', null),
     )
     .select([
@@ -69,11 +71,11 @@ export const getAccount = async (
   flags?: AvailabilityFlags,
 ): Promise<ActorAccount | null> => {
   const found = await selectAccountQB(db, flags)
-    .where((qb) => {
+    .where((eb) => {
       if (isDidIdentifier(handleOrDid)) {
-        return qb.where('actor.did', '=', handleOrDid)
+        return eb('actor.did', '=', handleOrDid)
       } else {
-        return qb.where('actor.handle', '=', handleOrDid)
+        return eb('actor.handle', '=', handleOrDid)
       }
     })
     .executeTakeFirst()
@@ -202,12 +204,16 @@ export const updateHandle = async (
       .updateTable('actor')
       .set({ handle })
       .where('did', '=', did)
-      .whereNotExists(
-        db.db
-          .selectFrom('actor')
-          .where('handle', '=', handle)
-          .where('did', '!=', did)
-          .selectAll(),
+      .where(({ not, exists }) =>
+        not(
+          exists(
+            db.db
+              .selectFrom('actor')
+              .where('handle', '=', handle)
+              .where('did', '!=', did)
+              .selectAll(),
+          ),
+        ),
       ),
   )
   if (res.numUpdatedRows < 1) {
@@ -290,8 +296,8 @@ export const deactivateAccount = async (
   db: AccountDb,
   did: DidString,
   deleteAfter: string | null,
-) => {
-  await db.executeWithRetry(
+): Promise<boolean> => {
+  const [res] = await db.executeWithRetry(
     db.db
       .updateTable('actor')
       .set({
@@ -300,18 +306,35 @@ export const deactivateAccount = async (
       })
       .where('did', '=', did),
   )
+
+  return res.numUpdatedRows > 0
 }
 
-export const activateAccount = async (db: AccountDb, did: DidString) => {
-  await db.executeWithRetry(
+export const activateAccount = async (
+  db: AccountDb,
+  did: DidString,
+  flags?: AvailabilityFlags,
+): Promise<boolean> => {
+  const { includeTakenDown = false, includeDeactivated = true } = flags ?? {}
+  const { ref } = db.db.dynamic
+
+  const [res] = await db.executeWithRetry(
     db.db
       .updateTable('actor')
       .set({
         deactivatedAt: null,
         deleteAfter: null,
       })
-      .where('did', '=', did),
+      .where('did', '=', did)
+      .$if(!includeTakenDown, (q) =>
+        q.where(notSoftDeletedClause(ref('actor'))),
+      )
+      .$if(!includeDeactivated, (q) =>
+        q.where('actor.deactivatedAt', 'is not', null),
+      ),
   )
+
+  return res.numUpdatedRows > 0
 }
 
 export const formatAccountStatus = (

package/src/account-manager/helpers/auth.ts

@@ -164,8 +164,8 @@ export const addRefreshGracePeriod = async (
     db.db
       .updateTable('refresh_token')
       .where('id', '=', id)
-      .where((inner) =>
-        inner.where('nextId', 'is', null).orWhere('nextId', '=', nextId),
+      .where((eb) =>
+        eb.or([eb('nextId', 'is', null), eb('nextId', '=', nextId)]),
       )
       .set({ expiresAt, nextId })
       .returningAll(),

package/src/account-manager/helpers/authorization-request.ts

@@ -18,7 +18,7 @@ export const rowToRequestData = (
   parameters: fromJson(row.parameters),
   expiresAt: fromDateISO(row.expiresAt),
   deviceId: row.deviceId,
-  sub: row.did,
+  did: row.did,
   code: row.code,
 })
 
@@ -34,7 +34,7 @@ const requestDataToRow = (
   data: RequestData,
 ): Insertable<AuthorizationRequest> => ({
   id,
-  did: data.sub,
+  did: data.did,
   deviceId: data.deviceId,
 
   clientId: data.clientId,
@@ -53,16 +53,20 @@ export const readQB = (db: AccountDb, id: RequestId) =>
 export const updateQB = (
   db: AccountDb,
   id: RequestId,
-  { code, sub, deviceId, expiresAt, parameters, ...rest }: UpdateRequestData,
+  { code, did, deviceId, expiresAt, parameters, ...rest }: UpdateRequestData,
 ) => {
   assert(!Object.keys(rest).length, 'Unexpected fields in UpdateRequestData')
   return db.db
     .updateTable('authorization_request')
-    .if(code !== undefined, (qb) => qb.set({ code }))
-    .if(sub !== undefined, (qb) => qb.set({ did: sub }))
-    .if(deviceId !== undefined, (qb) => qb.set({ deviceId }))
-    .if(expiresAt != null, (qb) => qb.set({ expiresAt: toDateISO(expiresAt!) }))
-    .if(parameters != null, (qb) => qb.set({ parameters: toJson(parameters!) }))
+    .$if(code !== undefined, (qb) => qb.set({ code }))
+    .$if(did !== undefined, (qb) => qb.set({ did }))
+    .$if(deviceId !== undefined, (qb) => qb.set({ deviceId }))
+    .$if(expiresAt != null, (qb) =>
+      qb.set({ expiresAt: toDateISO(expiresAt!) }),
+    )
+    .$if(parameters != null, (qb) =>
+      qb.set({ parameters: toJson(parameters!) }),
+    )
     .where('id', '=', id)
 }
 

package/src/account-manager/helpers/authorized-client.ts

@@ -2,14 +2,14 @@ import {
   AuthorizedClientData,
   AuthorizedClients,
   ClientId,
-  Sub,
+  Did,
 } from '@atproto/oauth-provider'
 import { fromJson, toDateISO, toJson } from '../../db/index.js'
 import { AccountDb } from '../db/index.js'
 
 export async function upsert(
   db: AccountDb,
-  did: string,
+  did: Did,
   clientId: ClientId,
   data: AuthorizedClientData,
 ) {
@@ -36,17 +36,23 @@ export async function upsert(
 
 export async function getAuthorizedClients(
   db: AccountDb,
-  did: string,
+  did: Did,
 ): Promise<AuthorizedClients> {
   return (await getAuthorizedClientsMulti(db, [did])).get(did)!
 }
 
+export async function deleteAllAuthorizedClients(db: AccountDb, did: Did) {
+  await db.executeWithRetry(
+    db.db.deleteFrom('authorized_client').where('did', '=', did),
+  )
+}
+
 export async function getAuthorizedClientsMulti(
   db: AccountDb,
-  dids: Iterable<string>,
-): Promise<Map<Sub, AuthorizedClients>> {
+  dids: Iterable<Did>,
+): Promise<Map<Did, AuthorizedClients>> {
   // Using a Map will ensure unicity of dids (through unicity of keys)
-  const map = new Map<Sub, AuthorizedClients>(
+  const map = new Map<Did, AuthorizedClients>(
     Array.from(dids, (did) => [did, new Map()]),
   )
 

package/src/account-manager/helpers/device.ts

@@ -35,10 +35,10 @@ export const updateQB = (
 ) =>
   db.db
     .updateTable('device')
-    .if(sessionId != null, (qb) => qb.set({ sessionId }))
-    .if(userAgent != null, (qb) => qb.set({ userAgent }))
-    .if(ipAddress != null, (qb) => qb.set({ ipAddress }))
-    .if(lastSeenAt != null, (qb) =>
+    .$if(sessionId != null, (qb) => qb.set({ sessionId }))
+    .$if(userAgent != null, (qb) => qb.set({ userAgent }))
+    .$if(ipAddress != null, (qb) => qb.set({ ipAddress }))
+    .$if(lastSeenAt != null, (qb) =>
       qb.set({ lastSeenAt: toDateISO(lastSeenAt!) }),
     )
     .where('id', '=', deviceId)

package/src/account-manager/helpers/lexicon.ts

@@ -1,10 +1,15 @@
-import { Insertable } from 'kysely'
 import { LEXICON_REFRESH_FREQUENCY, LexiconData } from '@atproto/oauth-provider'
 import { fromDateISO, fromJson, toDateISO, toJson } from '../../db/index.js'
-import { AccountDb, Lexicon } from '../db/index.js'
+import { AccountDb } from '../db/index.js'
 
 export async function upsert(db: AccountDb, nsid: string, data: LexiconData) {
-  const updates: Omit<Insertable<Lexicon>, 'nsid'> = {
+  // @TODO not annotated as `Omit<Insertable<Lexicon>, 'nsid'>`. Insertable's
+  // nullable/non-nullable key partition evaluates `IsNullable<InsertType<…>>`
+  // per column, which for the recursive `JsonEncoded<LexiconDocument>` column
+  // overflows the tsgo (TS7) checker's instantiation depth (TS2589). The older
+  // tsc handled it; the `.values()`/`.doUpdateSet()` calls below still
+  // type-check this object against the insert type regardless.
+  const updates = {
     ...data,
     createdAt: toDateISO(data.createdAt),
     updatedAt: toDateISO(data.updatedAt),

package/src/account-manager/helpers/password.ts

@@ -128,3 +128,9 @@ export const deleteAppPassword = async (
       .where('name', '=', name),
   )
 }
+
+export const deleteAllAppPasswords = async (db: AccountDb, did: string) => {
+  await db.executeWithRetry(
+    db.db.deleteFrom('app_password').where('did', '=', did),
+  )
+}