allow 3p labelers to query appview account infos

bluesky-social · Mar 12, 2024 · 6af2e94 · 6af2e94
1 parent 2802880
commit 6af2e94
Showing 1 changed file with 10 additions and 3 deletions.
diff --git a/packages/bsky/src/api/com/atproto/admin/getAccountInfos.ts b/packages/bsky/src/api/com/atproto/admin/getAccountInfos.ts
@@ -5,18 +5,25 @@ import { INVALID_HANDLE } from '@atproto/syntax'
 
 export default function (server: Server, ctx: AppContext) {
   server.com.atproto.admin.getAccountInfos({
-    auth: ctx.authVerifier.roleOrModService,
-    handler: async ({ params }) => {
+    auth: ctx.authVerifier.optionalStandardOrRole,
+    handler: async ({ params, auth }) => {
       const { dids } = params
+      const { canViewTakedowns } = ctx.authVerifier.parseCreds(auth)
+
       const actors = await ctx.hydrator.actor.getActors(dids, true)
 
       const infos = mapDefined(dids, (did) => {
         const info = actors.get(did)
         if (!info) return
+        if (info.takedownRef && !canViewTakedowns) return
+        const profileRecord =
+          !info.profileTakedownRef || canViewTakedowns
+            ? info.profile
+            : undefined
         return {
           did,
           handle: info.handle ?? INVALID_HANDLE,
-          relatedRecords: info.profile ? [info.profile] : undefined,
+          relatedRecords: profileRecord ? [profileRecord] : undefined,
           indexedAt: (info.sortedAt ?? new Date(0)).toISOString(),
         }
       })