2251 Commits

Author SHA1 Message Date
dholms
3783889c49 bump @atproto/did-resolver 2023-05-10 23:24:33 -05:00
dholms
2f43fb7454 bump api package version 2023-05-10 20:50:56 -05:00
bnewbold
7368020068
pds: place-holder robots.txt, and a text base-level route (/) ()
* pds: place-holder robots.txt and / (as txt)

robots.txt: want to be explicit about allowing crawling (generically)

/: a bit of dev-experience polish. in prod we already redirect this
route, but may be helpful for self-hosting folks and people just
exploring

* pds: move basic routes (health, robots.txt, /) to separate file
2023-05-10 17:08:52 -07:00
Patryk
0e35bc3899
Make BskyAgent instantiation 4 times faster ()
Improve BskyAgent performance

By using z.discriminatedUnion instead of z.union
we can hint to zod at which field it should look when
validating/parsing schemas

This improves BskyAgent instantiation time around 4 times,
when creating 10 agents using stuff from ,
the time went down from ~1200ms to 330ms
2023-05-10 12:22:58 -04:00
Daniel Holmgren
89b783eec9
Update how sequencer invalidation works ()
* invalidatedBy -> invalidated

* fix test

* dont remake fkey constraint sqlite

* sqlite migration

* appeasing sqlite

* sqlite finally happy?

* Fix sqlite migration, run proxy tests thru postgres when configured

* Fix pg schemas in proxy tests

---------

Co-authored-by: Devin Ivy <devinivy@gmail.com>
2023-05-10 11:01:56 -04:00
bnewbold
a449d793a6
disallow new registration of .arpa, .local, etc handles ()
* handles: test 'dotless' disallowed; move .arpa/.local proto-level test

* handles: disallow infra/reserved handles
2023-05-09 16:35:06 -07:00
devin ivy
977202fa2b
Fix indexed record datetimes ()
* Normalize record datetimes used for sort to simplified iso

* Update tests and snapshots for alternate valid datetime formats

* Fix notifications race during record update
2023-05-09 12:53:33 -04:00
devin ivy
c3c75322bf
Sync-up account deletion indexes migration () 2023-05-09 12:52:56 -04:00
Daniel Holmgren
d30b0f93e1
Disable account invites ()
* enable disabling account invites

* xtra test

* couple fixes

* allow re-enabling user accoutn invites

* add in getter route for if invites are disabled or not

* fix admin search test

* gneerated type on user account
2023-05-09 09:24:12 -05:00
Daniel Holmgren
51503384b6
No cache invalidation on blob deletion ()
no invalidate on blob deletion
2023-05-09 08:57:45 -05:00
Daniel Holmgren
b20a5045a2
Rebase route ()
* tidy rebase query

* add rebase route

* bring tests up to speed

* add tx check
2023-05-09 05:54:48 -05:00
Daniel Holmgren
c8e6adbbf5
Clean up what's hot ()
* changes to clean up whats hot

* fix test

* add quote posts back in & use underwear label instead of no-promote

* tidy
2023-05-08 18:26:11 -05:00
devin ivy
41793b7ff9
Add indexes to support account deletion ()
* Add indexes to support account deletion

* Temporarily skip index creation in migration
2023-05-08 18:47:25 -04:00
devin ivy
facd310fde
Add april to contributors for sec disclosure () 2023-05-08 17:24:22 -05:00
Jaga Santagostino
652eb50da6
Update README.md example ()
Update README.md
2023-05-08 17:24:01 -05:00
Gabe
4a91ae1f50
fix: macos install ()
fix: add updated node-gyp dep

This fixes better-sqlite3 from using an old version of node-gyp to build from source.
2023-05-08 17:23:34 -05:00
Wes Todd
b01e47b617
fix: updated repository field for packages () 2023-05-08 11:38:42 -04:00
Daniel Holmgren
aabbf43a7f
Blessed hell thread ()
give notifs in blessed hell thread
2023-05-05 20:51:57 -05:00
Daniel Holmgren
8e5f2bd2dc
Do not give deeply nested notifs ()
do not give deeply nested notifs
2023-05-05 19:00:02 -05:00
Daniel Holmgren
bfe59e2bd3
Do not filter on negative labels on getPopular ()
do not filter on negative labels on whats hot
2023-05-05 18:59:49 -05:00
bnewbold
8c19ce991a
moderation action 'escalate' type ()
* lex: 'escalate' mod action type

* api: codegen for escalate mod action type

* pds: codegen+impl esclate mod action type

* bsky: codegen+impl esclate mod action type

* pds: prettier:fix

* Tidy

---------

Co-authored-by: Devin Ivy <devinivy@gmail.com>
2023-05-04 12:32:27 -07:00
Daniel Holmgren
b75436b9cb
Delete user state on account delete ()
* Delete user state on account delete

* blocks too
2023-05-03 22:39:57 -05:00
devin ivy
6976fb3e7d
Add lily to contributors for sec disclosure () 2023-05-03 21:29:33 -04:00
Daniel Holmgren
015fe1226c
Delete dereferenced blobs ()
* delete dereferenced blobs

* invalidate cache for delete blobs

* start testing

* test & cleanup

* rm blob cleanup logic on rebases

* make disk blob deletes idempotent

* move blob deletion to background queue
2023-05-03 18:34:55 -05:00
Daniel Holmgren
fc15c1b0ea
Security policy ()
* drafted security policy

* update email

* update wording

* more words
2023-05-02 17:07:32 -05:00
Daniel Holmgren
b182344fef
Avoid sequencer retry loop ()
* avoid seq loop

* tidy

* comments
2023-05-02 17:07:18 -05:00
devin ivy
a1666776b3
Log requests to subscribeRepos () 2023-05-02 17:37:23 -04:00
Daniel Holmgren
4555596212
Filter server-side labels ()
filter server side labels
2023-05-02 16:00:41 -05:00
devin ivy
b1493650f4
Perform account deletion async ()
* Perform takedown then background hard-deletion process for deleteAccount

* Remove transactions from account deletion process, perform steps sequentially
2023-05-02 14:24:59 -04:00
devin ivy
142c77cadd
Disallow writes of bad records ()
* Disallow writes of bad records

* Increase obj depth to hit stack issue on more systems
2023-05-02 13:44:07 -04:00
Mustafa Yafes Akbaş
dc51cafa3d
Fix SSRF vulnerability on blob ()
* Add hostname and protocol validation for pds in getBlob()

Hostname and protocol validation for the pds' url in the getBlob() to prevent potential SSRF (Server-Side Request Forgery) attacks by ensuring that only valid protocols and hostnames are used in the URL. Function also will now throw a 400 error if detects any invalid.

* Migrate changes

* delete the line with console.log...
2023-05-02 11:51:25 -05:00
Daniel Holmgren
86fae264d3
Sequencer race condition ()
* wip

* split out seq invalidations

* wip

* fix

* comments

* 2 db hits

* cleanup

* re-add comment
2023-05-02 11:39:25 -05:00
Roj
fa95f5b20f
Return InternalServerError instead of XRPCNotSupported when a falsy value is thrown ()
* Return `XRPCError` instead of 404 if a handler errors

Currently, if there is an uncaught error inside a handler, a 404 response is returned instead of the error itself. This fixes that.

* Catch it in the higher-level catch block

* Add test

* merge

* Improve test
2023-05-02 11:39:07 -05:00
Ryan Winchester
5333258771
Fix NSID name length error message typo ()
The name length limit is 128 not 127.
2023-05-02 11:24:30 -05:00
Max Graey
7329c28564
Some improvements for tid.ts ()
* Some improvements for tid.ts

* refactor dedash helper

* tripple equal

* run prettify
2023-05-02 10:53:19 -05:00
bnewbold
5fd71c099b
appview: tweak repo error log line to not clobber 'service' ()
Somehow the output of this log line has been ending up in datadog under
the wrong 'service' (with the 'service' being an "wss://"-prefixed URL,
not "pds" or "bav" or whatever expected).

Tweaks the 'service' key, and some others that might have conflict.
2023-05-01 20:53:38 -05:00
Wes Bos
958c9ef6b3
add repository field to package.json () 2023-05-01 20:43:32 -05:00
Roj
3370eac6ca
Improve readability in instanceof assertions ()
* Improve readability in `instanceof` assertions

* Remove unused import
2023-05-01 20:43:09 -05:00
Daniel Holmgren
12c6d886eb
Deterministic DNS handle resolution ()
* enforce constraint for one handle per domain

* tweak + tests
2023-05-01 20:27:12 -05:00
Daniel Holmgren
1e24d3e820
Include nsfw flag for getPopular ()
add includeNsfw flag for whats hot
2023-05-01 15:50:21 -05:00
Daniel Holmgren
bff96544d1
Tweak whats hot ()
* tweak whats hot

* couple fixes & test
2023-05-01 14:10:48 -05:00
bnewbold
0b70f50eb4
pds: iterated Hive label parsing ()
Tune "porn", "sexual", and "nudity" label categorization, including
re-structuring of code paths.

This comes out of some image testing as well as review of Hive API docs.
2023-05-01 11:20:50 -07:00
devin ivy
9366734f6d
More aggressive backpressure on websocket writer ()
* Implement more aggressive backpressure on websocket writer, may be temporary

* Add heap snapshot signal to pds
2023-05-01 08:48:45 -04:00
Devin Ivy
6a4258c973 Merge remote-tracking branch 'origin/blob-csp' 2023-04-29 17:24:51 -04:00
devin ivy
37df00d1e2
Add @ianklatzco to contributors file ()
Update CONTRIBUTORS.md

@devinivy

Co-authored-by: Ian Klatzco <iklatzco@gmail.com>
2023-04-29 12:33:41 -04:00
Devin Ivy
3d1b3b3675 Add csp and nosniff when serving user uploads 2023-04-29 11:47:50 -04:00
Paul Frazee
01b5971907
api@0.2.11, pds@0.1.5 ()
* @atproto/api@0.2.11

* @atproto/pds@0.1.5
2023-04-28 19:41:01 -05:00
dholms
87cc1267fd Remove temporary CI on blocks branch 2023-04-28 19:37:01 -05:00
Daniel Holmgren
db1042cf0d
Blocks ()
* block lexicons

* table schema

* block processing

* Actor-block migration

* Add blocked post lexicon to getPostThread

* getBlocks routes

* Add missing lexicons to bsky

* Add block state to actor views

* throw on blocked accounts in getAuthorFeed

* blcok state in profile views

* Update getPostThread to support block views, update existing test

* strip out blocks out oof timeline & popular

* more routes

* Test blocked posts in threads

* Support blocks on record embeds

* notifs

* Update pds test snapshots w/ block state

* fix search

* Update pds actor search snapshots w/ blocks

* test

* tests

* update lex

* fix up from returning blocking as record

* ci for branch

* fix build issue in bsky

* more blocks tests

* fix actor search test

* hook getBlocks up to router

* bugfix & actually test lol

---------

Co-authored-by: Devin Ivy <devinivy@gmail.com>
2023-04-28 19:36:02 -05:00
Daniel Holmgren
63bef856cc
Return on subscription abort ()
return on subscription abort
2023-04-27 23:34:03 -05:00