astro-atmosphere-comments 0.4.2 → 0.6.0

package/lib/client/composer.ts

@@ -2,6 +2,7 @@
 // posting (as a reply, or a quote post), and the quote preview. Used by
 // AtmosphereComments (its main box and every reply box) and by the reply and
 // quote overlay of AtmosphereReactions. The markup is Composer.astro.
+import { send } from "./account";
 
 export const MAX = 300; // Bluesky's limit for a post, in characters as people count them
 const graphemes = new Intl.Segmenter();
@@ -9,7 +10,7 @@ export const count = (text: string) => [...graphemes.segment(text.trim())].lengt
 
 export type Suggestion = { handle: string; displayName?: string; avatar?: string };
 export type Person = { did: string; handle: string; displayName?: string; avatar?: string };
-/** What the comment route answers with once something is posted. */
+/** What posting a comment (lib/client/account.ts) answers with. */
 export type Posted = {
   uri: string;
   url: string;
@@ -31,11 +32,12 @@ export type ComposerContext = {
 export type ComposerBehaviour = {
   /** The post being replied to or quoted (the announcement, or another post by the site's accounts). */
   root: () => string;
-  /** More for the comment route: { parent } for a reply to a comment, { quote: true } for a quote post. */
+  /** More for posting: { parent } for a reply to a comment, { quote: true } for a quote post. */
   extra: () => Record<string, unknown>;
   tell: (message: string) => void;
   onPosted: (data: Posted) => void;
-  onError: (code: string, tell: (message: string) => void) => void;
+  /** `permission`, with "needs-permission": the one the reader hasn't given yet. */
+  onError: (code: string, tell: (message: string) => void, permission?: string) => void;
   onInput?: () => void;
 };
 
@@ -158,14 +160,9 @@ export function setUpComposer(form: HTMLFormElement, ctx: ComposerContext, behav
     submit.disabled = true;
     behaviour.tell(ctx.t("composer.posting"));
     try {
-      const response = await fetch(`${ctx.base}/comment`, {
-        method: "POST",
-        credentials: "same-origin",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({ text, root: behaviour.root(), ...behaviour.extra() }),
-      });
+      const response = await send("comment", { text, root: behaviour.root(), ...behaviour.extra() });
       const data = await response.json();
-      if (!response.ok) return behaviour.onError(data.error, behaviour.tell);
+      if (!response.ok) return behaviour.onError(data.error, behaviour.tell, data.permission);
       textarea.value = "";
       updateCount();
       behaviour.onPosted(data);
@@ -179,6 +176,20 @@ export function setUpComposer(form: HTMLFormElement, ctx: ComposerContext, behav
   return { textarea, updateCount };
 }
 
+/** A post's age as Bluesky shows it: 10m, 4h, 6d, then the date. */
+function postAge(when: string): string {
+  const date = new Date(when);
+  const lang = document.documentElement.lang || undefined;
+  const minutes = Math.floor((Date.now() - date.getTime()) / 60000);
+  const unit = (value: number, name: string) => new Intl.NumberFormat(lang, { style: "unit", unit: name, unitDisplay: "narrow" }).format(value);
+  if (minutes < 1) return unit(1, "minute");
+  if (minutes < 60) return unit(minutes, "minute");
+  if (minutes < 1440) return unit(Math.floor(minutes / 60), "hour");
+  if (minutes < 43200) return unit(Math.floor(minutes / 1440), "day");
+  const thisYear = date.getFullYear() === new Date().getFullYear();
+  return date.toLocaleDateString(lang, { month: "short", day: "numeric", ...(!thisYear && { year: "numeric" }) });
+}
+
 /**
  * The quote preview inside a box: the reader's words as they type, with the
  * post being quoted beneath, as Bluesky will show it. Call update() as they
@@ -202,6 +213,7 @@ export function quotePreview(form: HTMLFormElement, textarea: HTMLTextAreaElemen
       const quoted = (await response.json()) as {
         author: { handle: string; displayName?: string; avatar?: string };
         text: string;
+        indexedAt?: string;
         external?: { uri: string; title: string; description: string; thumb?: string };
       };
       loaded = uri;
@@ -209,6 +221,7 @@ export function quotePreview(form: HTMLFormElement, textarea: HTMLTextAreaElemen
       $<HTMLElement>("[data-quoted-name]").textContent = quotedName;
       ctx.setAvatar($<HTMLElement>("[data-quoted-avatar]"), quotedName, quoted.author.avatar);
       $<HTMLElement>("[data-quoted-handle]").textContent = `@${quoted.author.handle}`;
+      $<HTMLElement>("[data-quoted-age]").textContent = quoted.indexedAt ? `· ${postAge(quoted.indexedAt)}` : "";
       $<HTMLElement>("[data-quoted-text]").textContent = quoted.text;
       const card = $<HTMLElement>("[data-card]");
       card.hidden = !quoted.external;

package/lib/client/subscribe.ts

@@ -0,0 +1,106 @@
+// Subscribe / Subscribed buttons (marked data-atmosphere-subscribe): the panel
+// under a post and any others a site places. Each component looks after its
+// own buttons and how it offers signing in; what the reader's subscription is
+// lives here, so every button on the page agrees.
+//
+// Signing in asks for this along with everything else, so there's never a
+// second trip to the reader's account host for it.
+import { canSubscribe, send, subscribed } from "./account";
+
+type Translate = (key: string, vars?: Record<string, string | number>) => string;
+/** Offers the sign-in form, coming back to #atmo-subscribe; `problem` says why it's needed again. */
+type AskToSignIn = (problem?: string) => void;
+
+const SIGN_IN_PROBLEMS: Record<string, string> = {
+  "sign-in-failed": "messages.signInFailed",
+  "account-not-found": "messages.accountNotFound",
+  "invalid-handle": "messages.invalidHandle",
+};
+
+const buttons = new Map<HTMLButtonElement, Translate>();
+let isSubscribed = false;
+let loaded: Promise<boolean | null> | undefined;
+
+const render = () => {
+  for (const [button, t] of buttons) {
+    button.title = t(isSubscribed ? "subscribe.subscribedLabel" : "subscribe.subscribeLabel");
+    // A label to fill in; without one, the button keeps what the site put in
+    // it (and shows the state with [aria-pressed]), so it needs its full name.
+    const label = button.querySelector("[data-atmosphere-subscribe-label]");
+    if (label) label.textContent = t(isSubscribed ? "subscribe.subscribed" : "subscribe.subscribe");
+    else button.setAttribute("aria-label", button.title);
+    button.setAttribute("aria-pressed", String(isSubscribed));
+    button.hidden = false;
+  }
+};
+
+/** Whether the reader subscribes, asked once a page; null if they aren't signed in. */
+export function loadSubscribed(): Promise<boolean | null> {
+  loaded ??= subscribed().then((found) => {
+    isSubscribed = !!found;
+    render();
+    return found;
+  });
+  return loaded;
+}
+
+/** After signing out here. */
+export function forgetSubscribed() {
+  loaded = undefined;
+  isSubscribed = false;
+  render();
+}
+
+async function press(button: HTMLButtonElement, t: Translate, ask: AskToSignIn) {
+  for (const each of buttons.keys()) each.disabled = true;
+  let problem = "";
+  try {
+    const response = await send("subscribe", { on: !isSubscribed });
+    const data = (await response.json().catch(() => ({}))) as { subscribed?: boolean; error?: string };
+    if (response.ok) isSubscribed = !!data.subscribed;
+    else if (data.error === "signed-out") ask();
+    else problem = t("messages.error");
+  } catch {
+    problem = t("messages.error");
+  }
+  for (const each of buttons.keys()) each.disabled = false;
+  render();
+  // Said beside the button, as the page may be showing nothing else.
+  document.querySelectorAll(".atmo-subscribe-problem").forEach((part) => part.remove());
+  if (problem) {
+    const note = Object.assign(document.createElement("span"), { className: "atmo-subscribe-problem", textContent: problem });
+    note.setAttribute("role", "status");
+    button.after(note);
+  }
+}
+
+/** Shows these buttons, if the site has a publication to subscribe to. */
+export function addSubscribeButtons(list: HTMLButtonElement[], t: Translate, ask: AskToSignIn) {
+  if (!canSubscribe()) return;
+  for (const button of list) {
+    buttons.set(button, t);
+    button.addEventListener("click", () => void press(button, t, ask));
+  }
+  render();
+}
+
+let finished = false;
+
+/** Back from signing in after pressing Subscribe: subscribes, as they asked. */
+export async function finishPendingSubscribe(t: Translate, ask: AskToSignIn) {
+  if (finished || location.hash !== "#atmo-subscribe") return;
+  finished = true;
+  const url = new URL(location.href);
+  const code = url.searchParams.get("atmosphere") ?? "";
+  if (!document.querySelector("atmosphere-comments")) url.searchParams.delete("atmosphere");
+  history.replaceState(history.state, "", `${url.pathname}${url.search}`);
+  const known = await loadSubscribed();
+  if (known === null) {
+    if (SIGN_IN_PROBLEMS[code]) ask(t(SIGN_IN_PROBLEMS[code]));
+    return;
+  }
+  const [first] = buttons.keys();
+  if (!first) return;
+  first.scrollIntoView({ block: "center" });
+  if (!known) await press(first, t, ask);
+}

package/lib/http.ts

@@ -24,3 +24,31 @@ export const json = (body: unknown, status = 200) =>
 export function fromThisSite(request: Request, url: URL): boolean {
   return request.headers.get("origin") === url.origin;
 }
+
+/** A simple limit per key: at most `perMinute` a minute and `perHour` an hour. True when over it. */
+export function rateLimit(perMinute: number, perHour: number) {
+  const recent = new Map<string, number[]>();
+  return (key: string): boolean => {
+    const now = Date.now();
+    const times = (recent.get(key) ?? []).filter((time) => now - time < 60 * 60 * 1000);
+    if (times.length) recent.set(key, times);
+    else recent.delete(key);
+    if (times.length >= perHour || times.filter((time) => now - time < 60 * 1000).length >= perMinute) return true;
+    times.push(now);
+    recent.set(key, times);
+    return false;
+  };
+}
+
+/**
+ * The visitor's address, for rate limits only (never stored or logged).
+ * Behind a proxy every visitor may share one, so routes add an overall cap.
+ */
+export function addressOf(context: { clientAddress: string }): string {
+  try {
+    return context.clientAddress;
+  } catch {
+    // Some adapters can't tell; the overall cap still applies.
+    return "unknown";
+  }
+}

package/lib/permissions.ts

@@ -0,0 +1,132 @@
+// What a reader's account host is asked to allow, and the site's OAuth
+// client metadata. Shared by the server (routes/client-metadata.json.ts) and
+// the browser (lib/client/account.ts), so both always agree.
+//
+// The site is a browser ("public") client: a reader's sign-in is kept only in
+// their own browser, and the site's server never sees it. Signing out cancels
+// it at the reader's account host.
+
+// What every signed-in reader grants: their identity, and reading posts as
+// they see them (to know whether they've already liked or reposted),
+// through Bluesky's AppView. Nothing here can change their account.
+export const BASE_SCOPE = "atproto rpc:app.bsky.feed.getPosts?aud=did:web:api.bsky.app%23bsky_appview";
+
+// Everything else comes in groups. Signing in asks for all that a reader can
+// do here at once (DEFAULT_PERMISSIONS), so there's one approval rather than
+// a trip to their account host for each new thing: as the sign-in stays in
+// their browser, the server can't use any of it, and the page's own code has
+// the same reach either way. (A permission can only name a kind of record,
+// not particular posts, so lib/client/account.ts limits each one to the
+// site's own threads.)
+export const PERMISSIONS = {
+  // Comments, replies and quote posts.
+  post: "repo:app.bsky.feed.post?action=create",
+  // Likes and reposts, and taking them back.
+  react: "repo:app.bsky.feed.like?action=create&action=delete repo:app.bsky.feed.repost?action=create&action=delete",
+  // Deleting the reader's own comments.
+  delete: "repo:app.bsky.feed.post?action=delete",
+  // Following (and unfollowing) the site's own accounts.
+  follow: "repo:app.bsky.graph.follow?action=create&action=delete",
+  // For the site's own accounts: hiding comments under their announcements.
+  moderate: "repo:app.bsky.feed.threadgate?action=create&action=update",
+  // With the `standardSite` option: subscribing to the site's publication and
+  // recommending its posts (Standard.site's own permission set, which account
+  // hosts show as one line).
+  social: "include:site.standard.authSocial",
+} as const;
+
+export type Permission = keyof typeof PERMISSIONS;
+
+export const isPermission = (value: unknown): value is Permission =>
+  typeof value === "string" && Object.hasOwn(PERMISSIONS, value);
+
+// What signing in asks for: everything readers can do here. "moderate" is
+// added only for the site's own accounts (allowedAuthors), the only ones
+// that can use it, and "social" only for sites with the `standardSite` option.
+// Sign-ins from before a group was added are asked for it when it's first
+// needed; those from before "social" sign in again instead (account.ts).
+export const DEFAULT_PERMISSIONS: Permission[] = ["post", "react", "delete", "follow"];
+
+/** The scope to ask for: the base, plus the groups named. */
+export const scopeFor = (permissions: Iterable<Permission>) =>
+  [BASE_SCOPE, ...new Set([...permissions].map((name) => PERMISSIONS[name]))].join(" ");
+
+// Everything the site may ask for, which its client metadata has to list.
+export const allScopes = (settings: { standardSite?: unknown }) =>
+  scopeFor((Object.keys(PERMISSIONS) as Permission[]).filter((name) => name !== "social" || !!settings.standardSite));
+
+// What Standard.site's permission set covers (its lexicon lists both).
+const SOCIAL_COLLECTIONS = ["site.standard.graph.subscription", "site.standard.graph.recommend"];
+
+/**
+ * Whether `scopes` (a grant) allow `action` on records of `collection`: a
+ * repo permission for that collection (or all of them) listing the action,
+ * or listing no actions, which means all of them. A host may keep the
+ * permission set's name in the grant, or write it out as repo permissions.
+ */
+export function scopesAllow(scopes: string[], collection: string, action: string): boolean {
+  return scopes.some((scope) => {
+    const [name, query = ""] = scope.split("?");
+    if (name === PERMISSIONS.social) return SOCIAL_COLLECTIONS.includes(collection);
+    const params = new URLSearchParams(query);
+    const listed = name === "repo" && params.getAll("collection").some((item) => item === collection || item === "*");
+    if (name !== `repo:${collection}` && name !== "repo:*" && !listed) return false;
+    const actions = params.getAll("action");
+    return !actions.length || actions.includes(action);
+  });
+}
+
+/** The permission groups a grant covers in full. */
+export function grantedPermissions(scopes: string[]): Permission[] {
+  return (Object.keys(PERMISSIONS) as Permission[]).filter((name) =>
+    PERMISSIONS[name].split(" ").every((part) => {
+      if (part === PERMISSIONS.social) {
+        return SOCIAL_COLLECTIONS.every((collection) => ["create", "delete"].every((action) => scopesAllow(scopes, collection, action)));
+      }
+      const [scope, query = ""] = part.split("?");
+      const collection = scope.replace(/^repo:/, "");
+      return new URLSearchParams(query).getAll("action").every((action) => scopesAllow(scopes, collection, action));
+    }),
+  );
+}
+
+/** Whether a grant has BASE_SCOPE (compared by name, as hosts may write the rest differently). */
+export function hasBase(scopes: string[]): boolean {
+  const names = scopes.map((part) => part.split("?")[0]);
+  return BASE_SCOPE.split(" ").every((part) => names.includes(part.split("?")[0]));
+}
+
+type MetadataSettings = {
+  site: string;
+  base: string;
+  clientName: string;
+  logoUri?: string;
+  policyUri?: string;
+  tosUri?: string;
+  standardSite?: { publication: string; feed?: string };
+};
+
+export const callbackPath = (base: string) => `${base}/callback`;
+
+/** The client metadata, served at /oauth-client-metadata.json (the site's client ID). */
+export function clientMetadata(settings: MetadataSettings) {
+  return {
+    // At the site's root, the address account hosts treat as the convention:
+    // Bluesky's approval page then shows just the site's address.
+    client_id: `${settings.site}/oauth-client-metadata.json`,
+    client_name: settings.clientName,
+    client_uri: settings.site,
+    ...(settings.logoUri && { logo_uri: settings.logoUri }),
+    ...(settings.policyUri && { policy_uri: settings.policyUri }),
+    ...(settings.tosUri && { tos_uri: settings.tosUri }),
+    redirect_uris: [`${settings.site}${callbackPath(settings.base)}`] as [`https://${string}`],
+    scope: allScopes(settings),
+    grant_types: ["authorization_code", "refresh_token"] as ["authorization_code", "refresh_token"],
+    response_types: ["code"] as ["code"],
+    application_type: "web" as const,
+    // A browser client: it has no secret to prove who it is, and its
+    // tokens only work together with a key kept in the reader's browser.
+    token_endpoint_auth_method: "none" as const,
+    dpop_bound_access_tokens: true,
+  };
+}

package/lib/public-settings.ts

@@ -0,0 +1,20 @@
+// The integration's settings that are safe for readers' browsers: the
+// site's address, the routes' base, its name and links, and its accounts.
+// (The rest, such as `hidden`, stays on the server: lib/settings.ts.)
+import settings from "virtual:atmosphere-comments/public-settings";
+
+export type PublicSettings = {
+  clientName: string;
+  allowedAuthors: string[];
+  /** Where the routes live, e.g. "/atmosphere" (no trailing slash). */
+  base: string;
+  /** The site's address, e.g. "https://saltedlolly.com" (no trailing slash). */
+  site: string;
+  logoUri?: string;
+  policyUri?: string;
+  tosUri?: string;
+  /** The site's Standard.site publication: turns on Subscribe, and recommending with Like. */
+  standardSite?: { publication: string; feed?: string };
+};
+
+export default settings as PublicSettings;

package/lib/quoted.ts

@@ -5,6 +5,8 @@ import { profileFor, type Profile } from "./profile";
 export type Quoted = {
   author: Profile;
   text: string;
+  /** When Bluesky received the post (for a backdated announcement, not its stated date). */
+  indexedAt?: string;
   external?: { uri: string; title: string; description: string; thumbSource?: string };
 };
 
@@ -22,6 +24,7 @@ export async function quotedPost(uri: string): Promise<Quoted | null> {
   const [post] = ((await response.json()) as {
     posts?: {
       author: { did: string };
+      indexedAt?: string;
       record: { text?: string };
       embed?: { external?: { uri: string; title: string; description: string; thumb?: string } };
     }[];
@@ -31,6 +34,7 @@ export async function quotedPost(uri: string): Promise<Quoted | null> {
   const quoted: Quoted = {
     author: await profileFor(post.author.did),
     text: post.record.text ?? "",
+    indexedAt: post.indexedAt,
     ...(external && {
       external: {
         uri: external.uri,

package/lib/settings.ts

@@ -12,6 +12,8 @@ export type AtmosphereSettings = {
   logoUri?: string;
   policyUri?: string;
   tosUri?: string;
+  /** The site's Standard.site publication: turns on Subscribe, and recommending with Like. */
+  standardSite?: { publication: string; feed?: string };
   hidden?: string[];
   locale?: string;
   messages?: Record<string, string>;

package/lib/thread.ts

@@ -1,9 +1,17 @@
 // The Bluesky thread under an announcement, read from Bluesky's public API:
 // who liked and reposted it, and the replies (the comments), nested.
 //
-// Left out: replies the announcement's author hid (Bluesky's threadgate),
-// deleted or blocked posts, posts or accounts carrying hiding labels from
-// Bluesky's moderation (spam, porn…), and anything in the `hidden` option.
+// Left out, with the replies under them: replies the announcement's author
+// hid (Bluesky's threadgate), deleted or blocked posts, posts or accounts
+// carrying hiding labels from Bluesky's moderation (spam, porn…), and
+// anything in the `hidden` option.
+//
+// Accounts that ask apps not to show them to logged-out people (Bluesky's
+// "Discourage apps from showing my account to logged-out users", the
+// !no-unauthenticated label) are respected too, as the page is public:
+// their comments become a bare placeholder (no name, picture, address or
+// words), keeping the replies under them, which are other people's, and
+// they're left out of the faces of who liked and reposted.
 // Cached for two minutes per announcement; if Bluesky can't be reached the
 // last good copy is kept.
 import { rememberAvatar } from "./avatars";
@@ -17,6 +25,7 @@ const MAX_CACHED = 200;
 const MAX_DEPTH = 6;
 const MAX_FACES = 48;
 const HIDING_LABELS = new Set(["!hide", "!takedown", "!suspend", "spam", "porn", "sexual", "nudity", "graphic-media", "gore"]);
+const LOGGED_IN_ONLY = "!no-unauthenticated";
 
 export type Person = { did: string; handle: string; displayName?: string; avatar?: string; url: string };
 
@@ -32,6 +41,11 @@ export type Reply = {
   depth: number;
   likeCount: number;
   repostCount: number;
+  /**
+   * Its author asks not to be shown to logged-out people: everything else
+   * is left empty, and the page shows a placeholder in its place.
+   */
+  withheld?: true;
 };
 
 export type Thread = {
@@ -80,6 +94,9 @@ function person(author: Author): Person | null {
   };
 }
 
+/** Whether an account asks apps not to show it to people who aren't signed in. */
+const loggedInOnly = (author?: Author) => !!author?.labels?.some((label) => label.val === LOGGED_IN_ONLY);
+
 function isHidden(post: ThreadPost, author: Person, url: string): boolean {
   const labels = [...(post.labels ?? []), ...(post.author?.labels ?? [])];
   if (labels.some((label) => label.val && HIDING_LABELS.has(label.val))) return true;
@@ -97,7 +114,20 @@ function collect(nodes: ThreadNode[] = [], depth: number, hiddenByAuthor: Set<st
     if (!author || !post.uri || !key || hiddenByAuthor.has(post.uri)) continue;
     const url = `${author.url}/post/${key}`;
     if (isHidden(post, author, url)) continue;
-    out.push({
+    if (loggedInOnly(post.author)) {
+      out.push({
+        uri: "",
+        url: "",
+        author: { did: "", handle: "", url: "" },
+        byAuthor: false,
+        createdAt: "",
+        text: [],
+        depth,
+        likeCount: 0,
+        repostCount: 0,
+        withheld: true,
+      });
+    } else out.push({
       uri: post.uri,
       url,
       author,
@@ -131,8 +161,8 @@ async function fetchThread(uri: string): Promise<Thread> {
     url: rootAuthor ? `${rootAuthor.url}/post/${uri.split("/").pop()}` : "",
     likeCount: root.likeCount ?? likes.length,
     repostCount: root.repostCount ?? repostedBy.length,
-    likes: likes.flatMap(({ actor }) => (actor ? [person(actor)].filter((p): p is Person => !!p) : [])),
-    reposts: repostedBy.map(person).filter((p): p is Person => !!p),
+    likes: likes.flatMap(({ actor }) => (actor && !loggedInOnly(actor) ? [person(actor)].filter((p): p is Person => !!p) : [])),
+    reposts: repostedBy.filter((actor) => !loggedInOnly(actor)).map(person).filter((p): p is Person => !!p),
     replies,
   };
 }

package/lib/uris.ts

@@ -0,0 +1,39 @@
+// Telling the site's own posts and threads apart from everything else, for
+// the routes and the browser alike. Nothing outside these can be replied to,
+// liked, reposted or quoted through the site.
+import settings from "./public-settings";
+
+const POST_URI = /^at:\/\/(did:[a-z0-9]+:[a-zA-Z0-9._:%-]+)\/app\.bsky\.feed\.post\/([a-zA-Z0-9._~-]+)$/;
+
+export const isPostUri = (uri: unknown): uri is string => typeof uri === "string" && POST_URI.test(uri);
+
+/** The DID that wrote a post, from its AT URI. */
+export const authorOf = (uri: string) => POST_URI.exec(uri)?.[1] ?? "";
+
+/** The post's record key, the last part of its AT URI. */
+export const rkeyOf = (uri: string) => POST_URI.exec(uri)?.[2] ?? "";
+
+/** True for a post by one of the site's own accounts (an announcement). */
+export function isSitePost(uri: unknown): uri is string {
+  return isPostUri(uri) && settings.allowedAuthors.includes(authorOf(uri));
+}
+
+const DOCUMENT_URI = /^at:\/\/(did:[a-z0-9]+:[a-zA-Z0-9._:%-]+)\/site\.standard\.document\/[a-zA-Z0-9._~-]+$/;
+
+/** True for a Standard.site document in the same account as the site's publication. */
+export function isSiteDocument(uri: unknown): uri is string {
+  const publisher = settings.standardSite?.publication.split("/")[2];
+  return typeof uri === "string" && !!publisher && DOCUMENT_URI.exec(uri)?.[1] === publisher;
+}
+
+export type PostView = {
+  uri: string;
+  cid: string;
+  author?: { did: string };
+  record?: { reply?: { root?: { uri?: string } } };
+  viewer?: { like?: string; repost?: string };
+};
+
+/** True for one of the site's announcements, or a comment somewhere under one. */
+export const inSiteThread = (view: PostView): boolean =>
+  isSitePost(view.uri) || isSitePost(view.record?.reply?.root?.uri);

package/locales/de.json

@@ -49,7 +49,7 @@
   "comment.deleteConfirm": "Diesen Kommentar von Bluesky löschen?",
   "comment.deleting": "Wird gelöscht…",
   "comment.deleted": "Dein Kommentar wurde gelöscht.",
-  "comment.deletePermission": "Um hier Kommentare zu löschen, braucht diese Seite eine weitere Erlaubnis von deinem Konto. Du kannst ihn auch in jeder Bluesky-App löschen.",
+  "comment.deletePermission": "Um hier Kommentare zu löschen, braucht diese Seite eine weitere Erlaubnis von deinem Atmosphere-Konto. Du kannst ihn aber auch {{link}} löschen.",
   "comment.continue": "Weiter zur Bestätigung",
   "comment.cancel": "Abbrechen",
   "signInFirst.reply": "Melde dich an, um zu antworten.",
@@ -65,9 +65,8 @@
   "messages.accountNotFound": "Dieses Konto wurde nicht gefunden. Prüfe den Handle und versuche es noch einmal.",
   "messages.invalidHandle": "Das sieht nicht wie ein Handle aus. Meist ist es etwas wie alice.bsky.social.",
   "messages.signedOut": "Du wurdest abgemeldet. Bitte melde dich erneut an.",
-  "messages.needsPermission": "Um hier Kommentare zu löschen, braucht diese Seite eine weitere Erlaubnis von deinem Konto.",
+  "messages.needsPermission": "Dafür braucht es eine weitere Erlaubnis von deinem Konto.",
   "messages.notAllowed": "Das ist hier nicht möglich.",
-  "messages.newPermissions": "Diese Seite kann jetzt auch für dich liken und reposten und braucht deshalb erneut deine Erlaubnis. Bitte melde dich erneut an.",
   "messages.tooLong": "Beiträge können bis zu {{max}} Zeichen lang sein.",
   "messages.tooMany": "Du bist ziemlich schnell. Bitte warte eine Minute und versuche es noch einmal.",
   "messages.error": "Das hat nicht geklappt. Bitte versuche es noch einmal.",
@@ -91,5 +90,22 @@
   "follow.following": "Folge ich",
   "follow.followAs": "{{handle}} als {{me}} folgen",
   "follow.followingLabel": "Du folgst {{handle}}",
-  "credit": "Bereitgestellt von {{link}}"
+  "credit": "Bereitgestellt von {{link}}",
+  "callback.signingIn": "Anmeldung läuft …",
+  "signIn.access": "Deine Anmeldung bleibt in diesem Browser: Der Server dieser Seite sieht sie nie und kann nicht für dich posten, und beim Abmelden wird sie aufgehoben.",
+  "signIn.policy": "Wie diese Seite mit deinen Daten umgeht",
+  "composer.needsPermission": "Um hier als {{handle}} zu kommentieren, braucht diese Seite eine weitere Erlaubnis von deinem Atmosphere-Konto.",
+  "comment.hide": "Ausblenden",
+  "comment.hideLabel": "Diesen Kommentar ausblenden",
+  "comment.hideConfirm": "Diesen Kommentar hier und auf Bluesky ausblenden? In der Bluesky-App kannst du ihn wieder einblenden.",
+  "comment.hiding": "Wird ausgeblendet …",
+  "comment.hidden": "Kommentar ausgeblendet.",
+  "comment.hidePermission": "Um hier Kommentare auszublenden, braucht diese Seite eine weitere Erlaubnis von deinem Konto. Du kannst sie auch in der Bluesky-App ausblenden.",
+  "comment.deleteElsewhere": "auf der Bluesky-Website",
+  "permission.heading": "Eine weitere Erlaubnis",
+  "permission.follow": "Um {{handle}} von dieser Seite aus zu folgen, braucht sie eine weitere Erlaubnis von deinem Atmosphere-Konto: Konten folgen und entfolgen.",
+  "permission.post": "Um von dieser Seite aus zu antworten und zu zitieren, braucht sie eine weitere Erlaubnis von deinem Atmosphere-Konto: Beiträge erstellen.",
+  "permission.react": "Um von dieser Seite aus zu liken und zu reposten, braucht sie eine weitere Erlaubnis von deinem Atmosphere-Konto: liken und reposten und das zurücknehmen.",
+  "permission.approve": "Die Seite deines Kontos (für die meisten die von Bluesky) bittet dich, das zu bestätigen, und vielleicht vorher, dich dort anzumelden. Danach kommst du direkt hierher zurück.",
+  "comment.withheld": "Hier nicht angezeigt: Die Person bittet Apps, ihre Beiträge nicht Leuten zu zeigen, die nicht angemeldet sind."
 }