{"id":16649927,"url":"https://github.com/datamine/glupper","last_synced_at":"2026-04-12T11:40:17.435Z","repository":{"id":281792116,"uuid":"946274431","full_name":"Datamine/Glupper","owner":"Datamine","description":"glupper.com source code","archived":false,"fork":false,"pushed_at":"2026-03-04T02:01:51.000Z","size":287,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2026-03-04T06:33:10.588Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Datamine.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":"AGENTS.md","dco":null,"cla":null}},"created_at":"2025-03-10T22:15:28.000Z","updated_at":"2026-03-04T02:01:54.000Z","dependencies_parsed_at":"2025-03-13T00:45:17.673Z","dependency_job_id":null,"html_url":"https://github.com/Datamine/Glupper","commit_stats":null,"previous_names":["datamine/glupper"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/Datamine/Glupper","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Datamine%2FGlupper","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Datamine%2FGlupper/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Datamine%2FGlupper/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Datamine%2FGlupper/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Datamine","download_url":"https://codeload.github.com/Datamine/Glupper/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Datamine%2FGlupper/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31713876,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-12T06:22:27.080Z","status":"ssl_error","status_checked_at":"2026-04-12T06:21:52.710Z","response_time":58,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-12T09:14:18.575Z","updated_at":"2026-04-12T11:40:17.430Z","avatar_url":"https://github.com/Datamine.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Glupper Backend\n\nGlupper is an invite-and-vouch trust graph for verifying that online accounts are controlled by real people.\n\n## Product Scope (Current)\n\n### Purpose\n\n- Establish social proof of real humans through in-person vouches.\n- Let users keep pseudonyms while still building public trust signals.\n- Show trust age (`trust_days`) publicly.\n\n### Trust Model\n\n- Bootstrap: platform admin creates initial trusted users.\n- Growth: active users create invite codes and sponsor new users.\n- Trust timer: starts at account creation or successful revouch and accumulates in days.\n- Public profile: exposes account status, sponsor relationship, trust timer, and verified linked social accounts.\n\n### Moderation Model\n\n- Reports are handled externally through GitHub issues (not handled by backend workflows).\n- Conviction is binary.\n- If an account is convicted as bot:\n  - Convicted account is permanently `banned`.\n  - Direct sponsor receives one demerit.\n  - All downstream descendants become `revouch_required` (not immediately permanently banned) and lose trust timer.\n  - Descendants cannot issue invites while in `revouch_required` state.\n\n### Recovery Model (Downstream of a Convicted Upstream)\n\nDownstream accounts can recover by revouching from a different active sponsor. To reduce fraud/ring recovery:\n\n- Recovery requires a different sponsor than the previous sponsor.\n- Recovery can be blocked by a cooldown (`RECOVERY_COOLDOWN_HOURS`, default 72h).\n- Recovery sponsor must meet minimum trust age (`RECOVERY_SPONSOR_MIN_TRUST_DAYS`, default 30).\n- Recovery sponsor must be low risk by demerits (`RECOVERY_SPONSOR_MAX_DEMERITS`, default 0).\n- Successful recovery resets trust timer and sets account back to `active`.\n\n### Sponsor Inactivity Model\n\n- Admin can run sponsor inactivity expiration.\n- Descendants of inactive sponsors become `revouch_required` and must get a fresh vouch.\n\n### Social Identity Verification\n\n- Linked social handles require OAuth proof of ownership.\n- MVP implementation currently supports GitHub linkage verification.\n- Google OAuth is supported for account sign-in/registration.\n\n## Explicit Decisions in Scope\n\n- Pseudonyms are allowed.\n- One-person-one-account enforcement is deferred (not in MVP).\n- No appeals process in MVP.\n- Historical moderation/event data is retained.\n- Redis maintains a banned-account dataset for fast lookups.\n\n## Out of Scope (Current)\n\n- Automated bot scoring/classification.\n- In-app reporting/review workflow (GitHub issues used instead).\n- Legal/privacy policy workflows.\n- Strong Sybil resistance beyond invite graph + recovery gates.\n\n## Architecture\n\n- FastAPI API server\n- PostgreSQL via asyncpg\n- Redis for ban cache\n- JWT auth\n\n## Key Data Concepts\n\n- `accounts`: identity, sponsor link, status, trust and recovery timestamps, demerits.\n- `invite_codes`: sponsor-issued vouch tokens.\n- `social_identities`: verified external handles.\n- `account_events`: immutable event log for moderation and lifecycle actions.\n\n## Main API Surface\n\n### Auth\n\n- `POST /api/v1/auth/register/password`\n- `POST /api/v1/auth/register/google`\n- `POST /api/v1/auth/login/password`\n- `GET /api/v1/auth/me`\n\n### Accounts\n\n- `GET /api/v1/accounts/{username}`\n- `GET /api/v1/accounts/me`\n- `POST /api/v1/accounts/me/revouch`\n- `POST /api/v1/accounts/me/heartbeat`\n\n### Invites\n\n- `POST /api/v1/invites`\n- `GET /api/v1/invites/mine`\n\n### Social Accounts\n\n- `POST /api/v1/social-accounts/link`\n- `GET /api/v1/social-accounts/mine`\n\n### Moderation/Admin\n\n- `POST /api/v1/moderation/bootstrap-user` (admin key)\n- `POST /api/v1/moderation/convict` (admin key)\n- `POST /api/v1/moderation/expire-inactive-sponsors` (admin key)\n- `GET /api/v1/moderation/banned/{account_id}` (admin key)\n\n## Configuration (Important)\n\nDefined in `src/config_secrets.py`:\n\n- `ADMIN_BOOTSTRAP_KEY`\n- `RECOVERY_COOLDOWN_HOURS`\n- `RECOVERY_SPONSOR_MIN_TRUST_DAYS`\n- `RECOVERY_SPONSOR_MAX_DEMERITS`\n- JWT, DB, and Redis settings\n\n## Local Run\n\n1. Install dependencies:\n\n```bash\nuv sync\n```\n\n2. Update config values in `src/config_secrets.py`.\n\n3. Start server:\n\n```bash\npython run.py --host 127.0.0.1 --port 8000\n```\n\n4. Open docs:\n\n- `http://127.0.0.1:8000/docs`\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdatamine%2Fglupper","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdatamine%2Fglupper","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdatamine%2Fglupper/lists"}