···49func (d *InvalidHandleDetector) Version() string { return "1.0.0" }
5051func (d *InvalidHandleDetector) Detect(ctx context.Context, op plc.PLCOperation) (*Match, error) {
52- if alsoKnownAs, ok := op.Operation["alsoKnownAs"].([]interface{}); ok {
000000000053 for _, aka := range alsoKnownAs {
54 if str, ok := aka.(string); ok {
55 // Check if it's an at:// handle
···203func (d *AlsoKnownAsSpamDetector) Version() string { return "1.0.0" }
204205func (d *AlsoKnownAsSpamDetector) Detect(ctx context.Context, op plc.PLCOperation) (*Match, error) {
206- if alsoKnownAs, ok := op.Operation["alsoKnownAs"].([]interface{}); ok {
00000000207 entryCount := len(alsoKnownAs)
208209 // Count different types of entries
···296func (d *SpamPDSDetector) Version() string { return "1.0.0" }
297298func (d *SpamPDSDetector) Detect(ctx context.Context, op plc.PLCOperation) (*Match, error) {
00000000299 // Check PDS endpoint
300- if services, ok := op.Operation["services"].(map[string]interface{}); ok {
301 if pds, ok := services["atproto_pds"].(map[string]interface{}); ok {
302 if endpoint, ok := pds["endpoint"].(string); ok {
303 host := extractHost(endpoint)
···320 }
321322 // Check for spam domain claims in alsoKnownAs
323- if alsoKnownAs, ok := op.Operation["alsoKnownAs"].([]interface{}); ok {
324 for _, aka := range alsoKnownAs {
325 if str, ok := aka.(string); ok {
326 if !strings.HasPrefix(str, "at://") {
···391func (d *ServiceAbuseDetector) Version() string { return "1.0.0" }
392393func (d *ServiceAbuseDetector) Detect(ctx context.Context, op plc.PLCOperation) (*Match, error) {
394- if services, ok := op.Operation["services"].(map[string]interface{}); ok {
00000000395 // Check for numeric service keys (spam uses "0", "1", "2" instead of proper names)
396 hasNumericKeys := false
397 numericKeyCount := 0
···457 }
458459 // Check for excessively long handles in alsoKnownAs
460- if alsoKnownAs, ok := op.Operation["alsoKnownAs"].([]interface{}); ok {
461 for _, aka := range alsoKnownAs {
462 if str, ok := aka.(string); ok {
463 if strings.HasPrefix(str, "at://") {
···480 }
481482 // Check for empty verificationMethods (common in this spam)
483- if vm, ok := op.Operation["verificationMethods"].(map[string]interface{}); ok {
484 if len(vm) == 0 {
485 // Empty verificationMethods alone isn't enough, but combined with other signals...
486 // Check if there are other suspicious signals
487- if services, ok := op.Operation["services"].(map[string]interface{}); ok {
488 if len(services) > 2 {
489 // Multiple services + empty verificationMethods = suspicious
490 return &Match{
···49func (d *InvalidHandleDetector) Version() string { return "1.0.0" }
5051func (d *InvalidHandleDetector) Detect(ctx context.Context, op plc.PLCOperation) (*Match, error) {
52+ // Parse Operation field on-demand
53+ operation, err := op.GetOperationMap()
54+ if err != nil {
55+ return nil, err
56+ }
57+ if operation == nil {
58+ return nil, nil
59+ }
60+61+ if alsoKnownAs, ok := operation["alsoKnownAs"].([]interface{}); ok {
62+63 for _, aka := range alsoKnownAs {
64 if str, ok := aka.(string); ok {
65 // Check if it's an at:// handle
···213func (d *AlsoKnownAsSpamDetector) Version() string { return "1.0.0" }
214215func (d *AlsoKnownAsSpamDetector) Detect(ctx context.Context, op plc.PLCOperation) (*Match, error) {
216+ // Parse Operation field on-demand
217+ operation, err := op.GetOperationMap()
218+ if err != nil {
219+ return nil, err
220+ }
221+ if operation == nil {
222+ return nil, nil
223+ }
224+ if alsoKnownAs, ok := operation["alsoKnownAs"].([]interface{}); ok {
225 entryCount := len(alsoKnownAs)
226227 // Count different types of entries
···314func (d *SpamPDSDetector) Version() string { return "1.0.0" }
315316func (d *SpamPDSDetector) Detect(ctx context.Context, op plc.PLCOperation) (*Match, error) {
317+ // Parse Operation field on-demand
318+ operation, err := op.GetOperationMap()
319+ if err != nil {
320+ return nil, err
321+ }
322+ if operation == nil {
323+ return nil, nil
324+ }
325 // Check PDS endpoint
326+ if services, ok := operation["services"].(map[string]interface{}); ok {
327 if pds, ok := services["atproto_pds"].(map[string]interface{}); ok {
328 if endpoint, ok := pds["endpoint"].(string); ok {
329 host := extractHost(endpoint)
···346 }
347348 // Check for spam domain claims in alsoKnownAs
349+ if alsoKnownAs, ok := operation["alsoKnownAs"].([]interface{}); ok {
350 for _, aka := range alsoKnownAs {
351 if str, ok := aka.(string); ok {
352 if !strings.HasPrefix(str, "at://") {
···417func (d *ServiceAbuseDetector) Version() string { return "1.0.0" }
418419func (d *ServiceAbuseDetector) Detect(ctx context.Context, op plc.PLCOperation) (*Match, error) {
420+ // Parse Operation field on-demand
421+ operation, err := op.GetOperationMap()
422+ if err != nil {
423+ return nil, err
424+ }
425+ if operation == nil {
426+ return nil, nil
427+ }
428+ if services, ok := operation["services"].(map[string]interface{}); ok {
429 // Check for numeric service keys (spam uses "0", "1", "2" instead of proper names)
430 hasNumericKeys := false
431 numericKeyCount := 0
···491 }
492493 // Check for excessively long handles in alsoKnownAs
494+ if alsoKnownAs, ok := operation["alsoKnownAs"].([]interface{}); ok {
495 for _, aka := range alsoKnownAs {
496 if str, ok := aka.(string); ok {
497 if strings.HasPrefix(str, "at://") {
···514 }
515516 // Check for empty verificationMethods (common in this spam)
517+ if vm, ok := operation["verificationMethods"].(map[string]interface{}); ok {
518 if len(vm) == 0 {
519 // Empty verificationMethods alone isn't enough, but combined with other signals...
520 // Check if there are other suspicious signals
521+ if services, ok := operation["services"].(map[string]interface{}); ok {
522 if len(services) > 2 {
523 // Multiple services + empty verificationMethods = suspicious
524 return &Match{
···10 // Return array of label strings
11 // Return empty array [] for no match
1213- if (op.did.match(/^did:plc:aa/)) {
14 labels.push('test')
15 }
16
···10 // Return array of label strings
11 // Return empty array [] for no match
1213+ if (op.did.match(/^did:plc:aaa/)) {
14 labels.push('test')
15 }
16