Added functionality to detect accounts created specifically to harrass, spam, or astroturf

.env.example

···
 PORT=4000
 METRICS_PORT=4001
 FIREHOSE_URL=
+PLC_URL=plc.wtf
 CURSOR_UPDATE_INTERVAL=10000
 LABEL_LIMIT=2900 * 1000
 LABEL_LIMIT_WAIT=300 * 1000

src/account/age.ts

···
+import { agent, isLoggedIn } from "../agent.js";
+import { logger } from "../logger.js";
+import { createAccountLabel } from "../moderation.js";
+import { ACCOUNT_AGE_CHECKS } from "./ageConstants.js";
+import { PLC_URL } from "../config.js";
+
+interface ReplyContext {
+  replyToDid: string;
+  replyingDid: string;
+  atURI: string;
+  time: number;
+}
+
+/**
+ * Gets the account creation date from a DID
+ * Uses the plc directory to get DID document creation timestamp
+ */
+export const getAccountCreationDate = async (
+  did: string,
+): Promise<Date | null> => {
+  try {
+    await isLoggedIn;
+
+    // For plc DIDs, try to extract creation from the DID document
+    if (did.startsWith("did:plc:")) {
+      try {
+        const response = await fetch(`https://${PLC_URL}/${did}`);
+        if (response.ok) {
+          const didDoc = await response.json();
+
+          // The plc directory returns an array of operations, first one is creation
+          if (Array.isArray(didDoc) && didDoc.length > 0) {
+            const createdAt = didDoc[0].createdAt;
+            if (createdAt) {
+              return new Date(createdAt);
+            }
+          }
+        } else {
+          logger.debug(
+            { process: "ACCOUNT_AGE", did },
+            "Failed to fetch DID document, trying profile fallback",
+          );
+        }
+      } catch (plcError) {
+        logger.debug(
+          { process: "ACCOUNT_AGE", did },
+          "Error fetching from plc directory, trying profile fallback",
+        );
+      }
+    }
+
+    // Fallback: try getting profile for any DID type
+    try {
+      const profile = await agent.getProfile({ actor: did });
+      if (profile.data.indexedAt) {
+        return new Date(profile.data.indexedAt);
+      }
+    } catch (profileError) {
+      logger.debug(
+        { process: "ACCOUNT_AGE", did },
+        "Failed to get profile",
+      );
+    }
+
+    logger.warn(
+      { process: "ACCOUNT_AGE", did },
+      "Could not determine account creation date",
+    );
+    return null;
+  } catch (error) {
+    logger.error(
+      { process: "ACCOUNT_AGE", did, error },
+      "Error fetching account creation date",
+    );
+    return null;
+  }
+};
+
+/**
+ * Calculates the age of an account in days at a specific reference date
+ */
+export const calculateAccountAge = (
+  creationDate: Date,
+  referenceDate: Date,
+): number => {
+  const diffMs = referenceDate.getTime() - creationDate.getTime();
+  return Math.floor(diffMs / (1000 * 60 * 60 * 24));
+};
+
+/**
+ * Checks if a reply meets age criteria and applies labels accordingly
+ */
+export const checkAccountAge = async (
+  context: ReplyContext,
+): Promise<void> => {
+  // Skip if no checks configured
+  if (ACCOUNT_AGE_CHECKS.length === 0) {
+    return;
+  }
+
+  // Check each configuration
+  for (const check of ACCOUNT_AGE_CHECKS) {
+    // Check if this reply is to a monitored DID
+    if (!check.monitoredDIDs.includes(context.replyToDid)) {
+      continue;
+    }
+
+    logger.debug(
+      {
+        process: "ACCOUNT_AGE",
+        replyingDid: context.replyingDid,
+        replyToDid: context.replyToDid,
+      },
+      "Checking account age for reply to monitored DID",
+    );
+
+    // Get account creation date
+    const creationDate = await getAccountCreationDate(context.replyingDid);
+    if (!creationDate) {
+      logger.warn(
+        {
+          process: "ACCOUNT_AGE",
+          replyingDid: context.replyingDid,
+        },
+        "Could not determine creation date, skipping",
+      );
+      continue;
+    }
+
+    // Calculate age at anchor date
+    const anchorDate = new Date(check.anchorDate);
+    const accountAge = calculateAccountAge(creationDate, anchorDate);
+
+    logger.debug(
+      {
+        process: "ACCOUNT_AGE",
+        replyingDid: context.replyingDid,
+        creationDate: creationDate.toISOString(),
+        anchorDate: check.anchorDate,
+        accountAge,
+        threshold: check.maxAgeDays,
+      },
+      "Account age calculated",
+    );
+
+    // Check if account is too new
+    if (accountAge < check.maxAgeDays) {
+      logger.info(
+        {
+          process: "ACCOUNT_AGE",
+          replyingDid: context.replyingDid,
+          replyToDid: context.replyToDid,
+          accountAge,
+          threshold: check.maxAgeDays,
+          atURI: context.atURI,
+        },
+        "Labeling new account replying to monitored DID",
+      );
+
+      await createAccountLabel(
+        context.replyingDid,
+        check.label,
+        `${context.time}: ${check.comment} - Account age: ${accountAge} days (threshold: ${check.maxAgeDays} days) - Reply: ${context.atURI}`,
+      );
+
+      // Only apply one label per reply
+      return;
+    }
+  }
+};

src/account/ageConstants.ts

···
+import { AccountAgeCheck } from "../types.js";
+
+/**
+ * Account age monitoring configurations
+ *
+ * Each configuration monitors replies to specified DIDs and labels accounts
+ * that are newer than the threshold relative to the anchor date.
+ *
+ * Example use case:
+ * - Monitor replies to high-profile accounts during harassment campaigns
+ * - Flag sock puppet accounts created to participate in coordinated harassment
+ */
+export const ACCOUNT_AGE_CHECKS: AccountAgeCheck[] = [
+  // Example configuration (disabled by default)
+  // {
+  //   monitoredDIDs: [
+  //     "did:plc:example123", // High-profile account 1
+  //     "did:plc:example456", // High-profile account 2
+  //   ],
+  //   anchorDate: "2025-01-15", // Date when harassment campaign started
+  //   maxAgeDays: 7, // Flag accounts less than 7 days old
+  //   label: "new-account-reply",
+  //   comment: "New account replying to monitored user during campaign",
+  // },
+];

src/account/tests/age.test.ts

···
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import {
+  calculateAccountAge,
+  checkAccountAge,
+  getAccountCreationDate,
+} from "../age.js";
+import { ACCOUNT_AGE_CHECKS } from "../ageConstants.js";
+
+// Mock dependencies
+vi.mock("../../agent.js", () => ({
+  agent: {
+    getProfile: vi.fn(),
+  },
+  isLoggedIn: Promise.resolve(true),
+}));
+
+vi.mock("../../logger.js", () => ({
+  logger: {
+    info: vi.fn(),
+    debug: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+  },
+}));
+
+vi.mock("../../moderation.js", () => ({
+  createAccountLabel: vi.fn(),
+}));
+
+// Mock fetch for DID document lookups
+global.fetch = vi.fn();
+
+import { agent } from "../../agent.js";
+import { logger } from "../../logger.js";
+import { createAccountLabel } from "../../moderation.js";
+
+describe("Account Age Module", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  describe("calculateAccountAge", () => {
+    it("should calculate age in days correctly", () => {
+      const creationDate = new Date("2025-01-01");
+      const referenceDate = new Date("2025-01-08");
+
+      const age = calculateAccountAge(creationDate, referenceDate);
+
+      expect(age).toBe(7);
+    });
+
+    it("should return 0 for same day", () => {
+      const date = new Date("2025-01-15");
+
+      const age = calculateAccountAge(date, date);
+
+      expect(age).toBe(0);
+    });
+
+    it("should handle accounts created before reference date", () => {
+      const creationDate = new Date("2024-01-01");
+      const referenceDate = new Date("2025-01-01");
+
+      const age = calculateAccountAge(creationDate, referenceDate);
+
+      expect(age).toBe(366); // 2024 is leap year
+    });
+
+    it("should return negative for accounts created after reference date", () => {
+      const creationDate = new Date("2025-01-15");
+      const referenceDate = new Date("2025-01-01");
+
+      const age = calculateAccountAge(creationDate, referenceDate);
+
+      expect(age).toBe(-14);
+    });
+  });
+
+  describe("getAccountCreationDate", () => {
+    it("should fetch creation date from plc directory for plc DIDs", async () => {
+      const mockDidDoc = [
+        {
+          createdAt: "2025-01-10T12:00:00.000Z",
+        },
+      ];
+
+      (global.fetch as any).mockResolvedValueOnce({
+        ok: true,
+        json: async () => mockDidDoc,
+      });
+
+      const result = await getAccountCreationDate("did:plc:test123");
+
+      expect(global.fetch).toHaveBeenCalledWith(
+        "https://plc.wtf/did:plc:test123",
+      );
+      expect(result).toEqual(new Date("2025-01-10T12:00:00.000Z"));
+    });
+
+    it("should fall back to profile.indexedAt if plc lookup fails", async () => {
+      (global.fetch as any).mockResolvedValueOnce({
+        ok: false,
+      });
+
+      (agent.getProfile as any).mockResolvedValueOnce({
+        data: {
+          indexedAt: "2025-01-12T10:00:00.000Z",
+        },
+      });
+
+      const result = await getAccountCreationDate("did:plc:test456");
+
+      expect(result).toEqual(new Date("2025-01-12T10:00:00.000Z"));
+    });
+
+    it("should return null if both plc and profile fail", async () => {
+      (global.fetch as any).mockResolvedValueOnce({
+        ok: false,
+      });
+
+      (agent.getProfile as any).mockResolvedValueOnce({
+        data: {},
+      });
+
+      const result = await getAccountCreationDate("did:plc:unknown");
+
+      expect(result).toBeNull();
+      expect(logger.warn).toHaveBeenCalled();
+    });
+
+    it("should handle errors gracefully", async () => {
+      (global.fetch as any).mockRejectedValueOnce(new Error("Network error"));
+
+      (agent.getProfile as any).mockResolvedValueOnce({
+        data: {},
+      });
+
+      const result = await getAccountCreationDate("did:plc:error");
+
+      expect(result).toBeNull();
+      // Should log debug/warn when handling expected errors, not error
+      expect(logger.debug).toHaveBeenCalled();
+    });
+  });
+
+  describe("checkAccountAge", () => {
+    const TEST_TIME = Date.now() * 1000;
+    const TEST_REPLY_URI = "at://did:plc:replier123/app.bsky.feed.post/xyz";
+
+    beforeEach(() => {
+      // Clear the ACCOUNT_AGE_CHECKS array and add test config
+      ACCOUNT_AGE_CHECKS.length = 0;
+    });
+
+    it("should skip if no checks configured", async () => {
+      await checkAccountAge({
+        replyToDid: "did:plc:monitored",
+        replyingDid: "did:plc:replier",
+        atURI: TEST_REPLY_URI,
+        time: TEST_TIME,
+      });
+
+      expect(createAccountLabel).not.toHaveBeenCalled();
+    });
+
+    it("should skip if reply is not to monitored DID", async () => {
+      ACCOUNT_AGE_CHECKS.push({
+        monitoredDIDs: ["did:plc:monitored1"],
+        anchorDate: "2025-01-15",
+        maxAgeDays: 7,
+        label: "new-account-reply",
+        comment: "New account reply",
+      });
+
+      await checkAccountAge({
+        replyToDid: "did:plc:other",
+        replyingDid: "did:plc:replier",
+        atURI: TEST_REPLY_URI,
+        time: TEST_TIME,
+      });
+
+      expect(createAccountLabel).not.toHaveBeenCalled();
+    });
+
+    it("should label account if too new", async () => {
+      ACCOUNT_AGE_CHECKS.push({
+        monitoredDIDs: ["did:plc:monitored"],
+        anchorDate: "2025-01-15",
+        maxAgeDays: 7,
+        label: "new-account-reply",
+        comment: "New account replying during campaign",
+      });
+
+      // Mock account created on Jan 12 noon (2.5 days before anchor at midnight = 2 days floored)
+      const mockDidDoc = [
+        {
+          createdAt: "2025-01-12T12:00:00.000Z",
+        },
+      ];
+
+      (global.fetch as any).mockResolvedValueOnce({
+        ok: true,
+        json: async () => mockDidDoc,
+      });
+
+      await checkAccountAge({
+        replyToDid: "did:plc:monitored",
+        replyingDid: "did:plc:newaccount",
+        atURI: TEST_REPLY_URI,
+        time: TEST_TIME,
+      });
+
+      expect(createAccountLabel).toHaveBeenCalledWith(
+        "did:plc:newaccount",
+        "new-account-reply",
+        expect.stringContaining("Account age: 2 days"),
+      );
+    });
+
+    it("should not label account if old enough", async () => {
+      ACCOUNT_AGE_CHECKS.push({
+        monitoredDIDs: ["did:plc:monitored"],
+        anchorDate: "2025-01-15",
+        maxAgeDays: 7,
+        label: "new-account-reply",
+        comment: "New account reply",
+      });
+
+      // Mock account created on Jan 5 (10 days before anchor)
+      const mockDidDoc = [
+        {
+          createdAt: "2025-01-05T12:00:00.000Z",
+        },
+      ];
+
+      (global.fetch as any).mockResolvedValueOnce({
+        ok: true,
+        json: async () => mockDidDoc,
+      });
+
+      await checkAccountAge({
+        replyToDid: "did:plc:monitored",
+        replyingDid: "did:plc:oldaccount",
+        atURI: TEST_REPLY_URI,
+        time: TEST_TIME,
+      });
+
+      expect(createAccountLabel).not.toHaveBeenCalled();
+    });
+
+    it("should handle multiple monitored DIDs", async () => {
+      ACCOUNT_AGE_CHECKS.push({
+        monitoredDIDs: ["did:plc:monitored1", "did:plc:monitored2"],
+        anchorDate: "2025-01-15",
+        maxAgeDays: 7,
+        label: "new-account-reply",
+        comment: "New account reply",
+      });
+
+      const mockDidDoc = [
+        {
+          createdAt: "2025-01-14T12:00:00.000Z",
+        },
+      ];
+
+      (global.fetch as any).mockResolvedValueOnce({
+        ok: true,
+        json: async () => mockDidDoc,
+      });
+
+      await checkAccountAge({
+        replyToDid: "did:plc:monitored2",
+        replyingDid: "did:plc:newaccount",
+        atURI: TEST_REPLY_URI,
+        time: TEST_TIME,
+      });
+
+      expect(createAccountLabel).toHaveBeenCalledOnce();
+    });
+
+    it("should handle multiple check configurations", async () => {
+      ACCOUNT_AGE_CHECKS.push(
+        {
+          monitoredDIDs: ["did:plc:monitored1"],
+          anchorDate: "2025-01-15",
+          maxAgeDays: 7,
+          label: "new-account-campaign1",
+          comment: "Campaign 1",
+        },
+        {
+          monitoredDIDs: ["did:plc:monitored2"],
+          anchorDate: "2025-02-01",
+          maxAgeDays: 14,
+          label: "new-account-campaign2",
+          comment: "Campaign 2",
+        },
+      );
+
+      const mockDidDoc = [
+        {
+          createdAt: "2025-01-20T12:00:00.000Z",
+        },
+      ];
+
+      (global.fetch as any).mockResolvedValueOnce({
+        ok: true,
+        json: async () => mockDidDoc,
+      });
+
+      // Reply to monitored2 - account created Jan 20 noon, checked against Feb 1 midnight (11.5 days = 11 floored)
+      await checkAccountAge({
+        replyToDid: "did:plc:monitored2",
+        replyingDid: "did:plc:newaccount",
+        atURI: TEST_REPLY_URI,
+        time: TEST_TIME,
+      });
+
+      expect(createAccountLabel).toHaveBeenCalledWith(
+        "did:plc:newaccount",
+        "new-account-campaign2",
+        expect.stringContaining("Account age: 11 days"),
+      );
+    });
+
+    it("should skip if creation date cannot be determined", async () => {
+      ACCOUNT_AGE_CHECKS.push({
+        monitoredDIDs: ["did:plc:monitored"],
+        anchorDate: "2025-01-15",
+        maxAgeDays: 7,
+        label: "new-account-reply",
+        comment: "New account reply",
+      });
+
+      (global.fetch as any).mockResolvedValueOnce({
+        ok: false,
+      });
+
+      (agent.getProfile as any).mockResolvedValueOnce({
+        data: {},
+      });
+
+      await checkAccountAge({
+        replyToDid: "did:plc:monitored",
+        replyingDid: "did:plc:unknown",
+        atURI: TEST_REPLY_URI,
+        time: TEST_TIME,
+      });
+
+      expect(createAccountLabel).not.toHaveBeenCalled();
+      expect(logger.warn).toHaveBeenCalled();
+    });
+
+    it("should only apply one label per reply", async () => {
+      // Add overlapping configurations
+      ACCOUNT_AGE_CHECKS.push(
+        {
+          monitoredDIDs: ["did:plc:monitored"],
+          anchorDate: "2025-01-15",
+          maxAgeDays: 7,
+          label: "label1",
+          comment: "First check",
+        },
+        {
+          monitoredDIDs: ["did:plc:monitored"],
+          anchorDate: "2025-01-15",
+          maxAgeDays: 14,
+          label: "label2",
+          comment: "Second check",
+        },
+      );
+
+      const mockDidDoc = [
+        {
+          createdAt: "2025-01-14T12:00:00.000Z",
+        },
+      ];
+
+      (global.fetch as any).mockResolvedValueOnce({
+        ok: true,
+        json: async () => mockDidDoc,
+      });
+
+      await checkAccountAge({
+        replyToDid: "did:plc:monitored",
+        replyingDid: "did:plc:newaccount",
+        atURI: TEST_REPLY_URI,
+        time: TEST_TIME,
+      });
+
+      // Should only call once (first matching check)
+      expect(createAccountLabel).toHaveBeenCalledOnce();
+      expect(createAccountLabel).toHaveBeenCalledWith(
+        "did:plc:newaccount",
+        "label1",
+        expect.any(String),
+      );
+    });
+  });
+});

src/config.ts

···
   : 4101; // Left this intact from the code I adapted this from
 export const FIREHOSE_URL =
   process.env.FIREHOSE_URL ?? "wss://jetstream.atproto.tools/subscribe";
+export const PLC_URL = process.env.PLC_URL ?? "plc.wtf";
 export const WANTED_COLLECTION = [
   "app.bsky.feed.post",
   "app.bsky.actor.defs",

src/main.ts

···
 import { checkHandle } from "./checkHandles.js";
 import { checkDescription, checkDisplayName } from "./checkProfiles.js";
 import { checkFacetSpam } from "./rules/facets/facets.js";
+import { checkAccountAge } from "./account/age.js";
 
 let cursor = 0;
 let cursorUpdateInterval: NodeJS.Timeout;
···
     const hasText = event.commit.record.hasOwnProperty("text");
 
     const tasks: Promise<void>[] = [];
+
+    // Check account age for replies to monitored DIDs
+    if (event.commit.record.reply) {
+      const parentUri = event.commit.record.reply.parent.uri;
+      const replyToDid = parentUri.split("/")[2]; // Extract DID from at://did/...
+
+      tasks.push(
+        checkAccountAge({
+          replyToDid,
+          replyingDid: event.did,
+          atURI,
+          time: event.time_us,
+        }),
+      );
+    }
 
     // Check if the record has facets
     if (hasFacets) {

src/rules/facets/tests/facets.test.ts

···
       expect(createAccountLabel).not.toHaveBeenCalled();
       expect(logger.info).not.toHaveBeenCalled();
     });
+
+    it("should not label when DID is on allowlist", async () => {
+      // Add test DID to allowlist temporarily
+      FACET_SPAM_ALLOWLIST.push(TEST_DID);
+
+      const facets: Facet[] = [
+        {
+          index: { byteStart: 0, byteEnd: 1 },
+          features: [{ $type: "app.bsky.richtext.facet#mention", did: "did:plc:user1" }],
+        },
+        {
+          index: { byteStart: 0, byteEnd: 1 },
+          features: [{ $type: "app.bsky.richtext.facet#mention", did: "did:plc:user2" }],
+        },
+      ];
+
+      await checkFacetSpam(TEST_DID, TEST_TIME, TEST_URI, facets);
+
+      // Should not trigger - allowlisted
+      expect(createAccountLabel).not.toHaveBeenCalled();
+      expect(logger.debug).toHaveBeenCalledWith(
+        { process: "FACET_SPAM", did: TEST_DID, atURI: TEST_URI },
+        "Allowlisted DID"
+      );
+
+      // Clean up
+      FACET_SPAM_ALLOWLIST.pop();
+    });
   });
 
   describe("when spam is detected", () => {

src/types.ts

···
   index: FacetIndex;
   features: Array<{ $type: string; [key: string]: any }>;
 }
+
+export interface AccountAgeCheck {
+  monitoredDIDs: string[]; // DIDs to monitor for replies
+  anchorDate: string; // ISO 8601 date string (e.g., "2025-01-15")
+  maxAgeDays: number; // Maximum account age in days
+  label: string; // Label to apply if account is too new
+  comment: string; // Comment for the label
+}
+