···

       
1
       
-
       
import { DAY, HOUR, cborEncode, check } from '@atproto/common'

     

       
2
       
 
       
import * as plc from '@did-plc/lib'

     

       
3
       
 
       
import { ServerError } from './error'

     

       
4
       
 
       
import { parseDidKey } from '@atproto/crypto'

     
···

       
12
       
 
       
const MAX_SERVICE_ENDPOINT_LENGTH = 512

     

       
13
       
 
       
const MAX_ID_LENGTH = 32

     

       
14
       
 
       


     

       
15
       
-
       
export function assertValidIncomingOp(

     

       
16
       
-
       
  op: unknown,

     

       
17
       
-
       
): asserts op is plc.OpOrTombstone {

     

       
18
       
-
       
  const byteLength = cborEncode(op).byteLength

     

       
19
       
 
       
  if (byteLength > MAX_OP_BYTES) {

     

       
20
       
 
       
    throw new ServerError(

     

       
21
       
 
       
      400,

     

       
22
       
 
       
      `Operation too large (${MAX_OP_BYTES} bytes maximum in cbor encoding)`,

     

       
23
       
 
       
    )

     

       
24
       
 
       
  }

     

       
25
       
-
       
  if (!check.is(op, plc.def.opOrTombstone)) {

     

       
26
       
-
       
    throw new ServerError(400, `Not a valid operation: ${JSON.stringify(op)}`)

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
27
       
 
       
  }

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
28
       
 
       
  if (op.type === 'plc_tombstone') {

     

       
29
       
-
       
    return

     

       
30
       
 
       
  }

     

       
31
       
 
       
  if (op.alsoKnownAs.length > MAX_AKA_ENTRIES) {

     

       
32
       
 
       
    throw new ServerError(

     
···

       
34
       
 
       
      `To many alsoKnownAs entries (max ${MAX_AKA_ENTRIES})`,

     

       
35
       
 
       
    )

     

       
36
       
 
       
  }

     

       
37
       
-
       
  const akaDupe: Record<string, boolean> = {}

     

       
38
       
 
       
  for (const aka of op.alsoKnownAs) {

     

       
39
       
 
       
    if (aka.length > MAX_AKA_LENGTH) {

     

       
40
       
 
       
      throw new ServerError(

     
···

       
42
       
 
       
        `alsoKnownAs entry too long (max ${MAX_AKA_LENGTH}): ${aka}`,

     

       
43
       
 
       
      )

     

       
44
       
 
       
    }

     

       
45
       
-
       
    if (akaDupe[aka]) {

     

       
46
       
 
       
      throw new ServerError(400, `duplicate alsoKnownAs entry: ${aka}`)

     

       
47
       
 
       
    } else {

     

       
48
       
-
       
      akaDupe[aka] = true

     

       
49
       
 
       
    }

     

       
50
       
 
       
  }

     

       
51
       
 
       
  if (op.rotationKeys.length > MAX_ROTATION_ENTRIES) {

     
···

       
102
       
 
       
      throw new ServerError(400, `Invalid verificationMethod key: ${key}`)

     

       
103
       
 
       
    }

     

       
104
       
 
       
  }

     

       
0
       
 
       

     

       
0
       
 
       

     

       
105
       
 
       
}

     

       
106
       
 
       


     

       
107
       
 
       
const HOUR_LIMIT = 10

     

···

       
1
       
+
       
import { DAY, HOUR, cborEncode } from '@atproto/common'

     

       
2
       
 
       
import * as plc from '@did-plc/lib'

     

       
3
       
 
       
import { ServerError } from './error'

     

       
4
       
 
       
import { parseDidKey } from '@atproto/crypto'

     
···

       
12
       
 
       
const MAX_SERVICE_ENDPOINT_LENGTH = 512

     

       
13
       
 
       
const MAX_ID_LENGTH = 32

     

       
14
       
 
       


     

       
15
       
+
       
export function validateIncomingOp(input: unknown): plc.OpOrTombstone {

     

       
16
       
+
       
  const byteLength = cborEncode(input).byteLength

     

       
0
       
 
       

     

       
0
       
 
       

     

       
17
       
 
       
  if (byteLength > MAX_OP_BYTES) {

     

       
18
       
 
       
    throw new ServerError(

     

       
19
       
 
       
      400,

     

       
20
       
 
       
      `Operation too large (${MAX_OP_BYTES} bytes maximum in cbor encoding)`,

     

       
21
       
 
       
    )

     

       
22
       
 
       
  }

     

       
23
       
+
       


     

       
24
       
+
       
  // We *need* to parse, and use the result of the parsing, to ensure that any

     

       
25
       
+
       
  // unknown fields are removed from the input. "@atproto/common"'s check

     

       
26
       
+
       
  // function will not remove unknown fields.

     

       
27
       
+
       
  const result = plc.def.opOrTombstone.safeParse(input)

     

       
28
       
+
       


     

       
29
       
+
       
  if (!result.success) {

     

       
30
       
+
       
    const errors = result.error.errors.map(

     

       
31
       
+
       
      (e) => `${e.message} at /${e.path.join('/')}`,

     

       
32
       
+
       
    )

     

       
33
       
+
       
    throw new ServerError(

     

       
34
       
+
       
      400,

     

       
35
       
+
       
      errors.length

     

       
36
       
+
       
        ? errors.join('. ') + '.'

     

       
37
       
+
       
        : `Not a valid operation: ${JSON.stringify(input)}`,

     

       
38
       
+
       
    )

     

       
39
       
 
       
  }

     

       
40
       
+
       


     

       
41
       
+
       
  const op = result.data

     

       
42
       
+
       


     

       
43
       
 
       
  if (op.type === 'plc_tombstone') {

     

       
44
       
+
       
    return op

     

       
45
       
 
       
  }

     

       
46
       
 
       
  if (op.alsoKnownAs.length > MAX_AKA_ENTRIES) {

     

       
47
       
 
       
    throw new ServerError(

     
···

       
49
       
 
       
      `To many alsoKnownAs entries (max ${MAX_AKA_ENTRIES})`,

     

       
50
       
 
       
    )

     

       
51
       
 
       
  }

     

       
52
       
+
       
  const akaDupe = new Set<string>()

     

       
53
       
 
       
  for (const aka of op.alsoKnownAs) {

     

       
54
       
 
       
    if (aka.length > MAX_AKA_LENGTH) {

     

       
55
       
 
       
      throw new ServerError(

     
···

       
57
       
 
       
        `alsoKnownAs entry too long (max ${MAX_AKA_LENGTH}): ${aka}`,

     

       
58
       
 
       
      )

     

       
59
       
 
       
    }

     

       
60
       
+
       
    if (akaDupe.has(aka)) {

     

       
61
       
 
       
      throw new ServerError(400, `duplicate alsoKnownAs entry: ${aka}`)

     

       
62
       
 
       
    } else {

     

       
63
       
+
       
      akaDupe.add(aka)

     

       
64
       
 
       
    }

     

       
65
       
 
       
  }

     

       
66
       
 
       
  if (op.rotationKeys.length > MAX_ROTATION_ENTRIES) {

     
···

       
117
       
 
       
      throw new ServerError(400, `Invalid verificationMethod key: ${key}`)

     

       
118
       
 
       
    }

     

       
119
       
 
       
  }

     

       
120
       
+
       


     

       
121
       
+
       
  return op

     

       
122
       
 
       
}

     

       
123
       
 
       


     

       
124
       
 
       
const HOUR_LIMIT = 10

     

···

       
2
       
 
       
import * as plc from '@did-plc/lib'

     

       
3
       
 
       
import { ServerError } from './error'

     

       
4
       
 
       
import { AppContext } from './context'

     

       
5
       
-
       
import { assertValidIncomingOp } from './constraints'

     

       
6
       
 
       


     

       
7
       
 
       
export const createRouter = (ctx: AppContext): express.Router => {

     

       
8
       
 
       
  const router = express.Router()

     
···

       
113
       
 
       
  // Update or create a DID doc

     

       
114
       
 
       
  router.post('/:did', async function (req, res) {

     

       
115
       
 
       
    const { did } = req.params

     

       
116
       
-
       
    const op = req.body

     

       
117
       
-
       
    assertValidIncomingOp(op)

     

       
118
       
 
       
    await ctx.db.validateAndAddOp(did, op)

     

       
119
       
 
       
    res.sendStatus(200)

     

       
120
       
 
       
  })

     

···

       
2
       
 
       
import * as plc from '@did-plc/lib'

     

       
3
       
 
       
import { ServerError } from './error'

     

       
4
       
 
       
import { AppContext } from './context'

     

       
5
       
+
       
import { validateIncomingOp } from './constraints'

     

       
6
       
 
       


     

       
7
       
 
       
export const createRouter = (ctx: AppContext): express.Router => {

     

       
8
       
 
       
  const router = express.Router()

     
···

       
113
       
 
       
  // Update or create a DID doc

     

       
114
       
 
       
  router.post('/:did', async function (req, res) {

     

       
115
       
 
       
    const { did } = req.params

     

       
116
       
+
       
    const op = validateIncomingOp(req.body)

     

       
0
       
 
       

     

       
117
       
 
       
    await ctx.db.validateAndAddOp(did, op)

     

       
118
       
 
       
    res.sendStatus(200)

     

       
119
       
 
       
  })