knotserver/xrpc: use repo DID resolution in all handlers

Signed-off-by: Lewis <[e-mail]>

knotserver/xrpc/create_repo.go

···
 package xrpc
 
 import (
+	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"net/http"
-	"path/filepath"
+	"os"
 	"strings"
+	"time"
 
-	comatproto "github.com/bluesky-social/indigo/api/atproto"
 	"github.com/bluesky-social/indigo/atproto/syntax"
-	"github.com/bluesky-social/indigo/xrpc"
 	securejoin "github.com/cyphar/filepath-securejoin"
 	gogit "github.com/go-git/go-git/v5"
 	"tangled.org/core/api/tangled"
 	"tangled.org/core/hook"
 	"tangled.org/core/knotserver/git"
+	"tangled.org/core/knotserver/repodid"
 	"tangled.org/core/rbac"
 	xrpcerr "tangled.org/core/xrpc/errors"
 )
···
 		return
 	}
 
-	rkey := data.Rkey
+	repoName := data.Name
 
-	ident, err := h.Resolver.ResolveIdent(r.Context(), actorDid.String())
-	if err != nil || ident.Handle.IsInvalidHandle() {
-		fail(xrpcerr.GenericError(err))
+	if repoName == "" {
+		fail(xrpcerr.GenericError(fmt.Errorf("repository name is required")))
 		return
 	}
 
-	xrpcc := xrpc.Client{
-		Host: ident.PDSEndpoint(),
+	defaultBranch := h.Config.Repo.MainBranch
+	if data.DefaultBranch != nil && *data.DefaultBranch != "" {
+		defaultBranch = *data.DefaultBranch
 	}
 
-	resp, err := comatproto.RepoGetRecord(r.Context(), &xrpcc, "", tangled.RepoNSID, actorDid.String(), rkey)
-	if err != nil {
+	if err := validateRepoName(repoName); err != nil {
+		l.Error("creating repo", "error", err.Error())
 		fail(xrpcerr.GenericError(err))
 		return
 	}
 
-	repo := resp.Value.Val.(*tangled.Repo)
+	var repoDid string
+	var prepared *repodid.PreparedDID
 
-	defaultBranch := h.Config.Repo.MainBranch
-	if data.DefaultBranch != nil && *data.DefaultBranch != "" {
-		defaultBranch = *data.DefaultBranch
+	knotServiceUrl := "https://" + h.Config.Server.Hostname
+	if h.Config.Server.Dev {
+		knotServiceUrl = "http://" + h.Config.Server.Hostname
 	}
 
-	if err := validateRepoName(repo.Name); err != nil {
-		l.Error("creating repo", "error", err.Error())
-		fail(xrpcerr.GenericError(err))
+	switch {
+	case data.RepoDid != nil && strings.HasPrefix(*data.RepoDid, "did:web:"):
+		if err := repodid.VerifyRepoDIDWeb(r.Context(), h.Resolver, *data.RepoDid, knotServiceUrl); err != nil {
+			l.Error("verifying did:web", "error", err.Error())
+			writeError(w, xrpcerr.GenericError(err), http.StatusBadRequest)
+			return
+		}
+
+		exists, err := h.Db.RepoDidExists(*data.RepoDid)
+		if err != nil {
+			l.Error("checking did:web uniqueness", "error", err.Error())
+			writeError(w, xrpcerr.GenericError(err), http.StatusInternalServerError)
+			return
+		}
+		if exists {
+			writeError(w, xrpcerr.GenericError(fmt.Errorf("did:web %s is already in use on this knot", *data.RepoDid)), http.StatusConflict)
+			return
+		}
+
+		repoDid = *data.RepoDid
+
+	case data.RepoDid != nil && *data.RepoDid != "":
+		writeError(w, xrpcerr.GenericError(fmt.Errorf("only did:web is accepted as a user-provided repo DID; did:plc is auto-generated")), http.StatusBadRequest)
 		return
+
+	default:
+		existingDid, dbErr := h.Db.GetRepoDid(actorDid.String(), repoName)
+		if dbErr == nil && existingDid != "" {
+			didRepoPath, _ := securejoin.SecureJoin(h.Config.Repo.ScanPath, existingDid)
+			if _, statErr := os.Stat(didRepoPath); statErr == nil {
+				l.Info("repo already exists from previous attempt", "repoDid", existingDid)
+				output := tangled.RepoCreate_Output{RepoDid: &existingDid}
+				writeJson(w, &output)
+				return
+			}
+			l.Warn("stale repo key found without directory, cleaning up", "repoDid", existingDid)
+			if delErr := h.Db.DeleteRepoKey(existingDid); delErr != nil {
+				l.Error("failed to clean up stale repo key", "repoDid", existingDid, "error", delErr.Error())
+				writeError(w, xrpcerr.GenericError(fmt.Errorf("failed to clean up stale state, retry later")), http.StatusInternalServerError)
+				return
+			}
+		}
+
+		var prepErr error
+		prepared, prepErr = repodid.PrepareRepoDID(h.Config.Server.PlcUrl, knotServiceUrl)
+		if prepErr != nil {
+			l.Error("preparing repo DID", "error", prepErr.Error())
+			writeError(w, xrpcerr.GenericError(prepErr), http.StatusInternalServerError)
+			return
+		}
+		repoDid = prepared.RepoDid
+
+		if err := h.Db.StoreRepoKey(repoDid, prepared.SigningKeyRaw, actorDid.String(), repoName); err != nil {
+			if strings.Contains(err.Error(), "UNIQUE constraint failed") {
+				writeError(w, xrpcerr.GenericError(fmt.Errorf("repository %s already being created", repoName)), http.StatusConflict)
+				return
+			}
+			l.Error("claiming repo key slot", "error", err.Error())
+			writeError(w, xrpcerr.GenericError(err), http.StatusInternalServerError)
+			return
+		}
 	}
 
-	relativeRepoPath := filepath.Join(actorDid.String(), repo.Name)
-	repoPath, _ := securejoin.SecureJoin(h.Config.Repo.ScanPath, relativeRepoPath)
+	l = l.With("repoDid", repoDid)
+
+	repoPath, _ := securejoin.SecureJoin(h.Config.Repo.ScanPath, repoDid)
+	rbacPath := repoDid
+
+	cleanup := func() {
+		if rmErr := os.RemoveAll(repoPath); rmErr != nil {
+			l.Error("failed to clean up repo directory", "path", repoPath, "error", rmErr.Error())
+		}
+	}
+
+	cleanupAll := func() {
+		cleanup()
+		if delErr := h.Db.DeleteRepoKey(repoDid); delErr != nil {
+			l.Error("failed to clean up repo key", "error", delErr.Error())
+		}
+	}
 
 	if data.Source != nil && *data.Source != "" {
 		err = git.Fork(repoPath, *data.Source, h.Config)
 		if err != nil {
 			l.Error("forking repo", "error", err.Error())
+			cleanupAll()
 			writeError(w, xrpcerr.GenericError(err), http.StatusInternalServerError)
 			return
 		}
···
 		err = git.InitBare(repoPath, defaultBranch)
 		if err != nil {
 			l.Error("initializing bare repo", "error", err.Error())
+			cleanupAll()
 			if errors.Is(err, gogit.ErrRepositoryAlreadyExists) {
 				fail(xrpcerr.RepoExistsError("repository already exists"))
 				return
-			} else {
-				writeError(w, xrpcerr.GenericError(err), http.StatusInternalServerError)
+			}
+			writeError(w, xrpcerr.GenericError(err), http.StatusInternalServerError)
+			return
+		}
+	}
+
+	if data.RepoDid != nil && strings.HasPrefix(*data.RepoDid, "did:web:") {
+		if err := h.Db.StoreRepoDidWeb(repoDid, actorDid.String(), repoName); err != nil {
+			cleanupAll()
+			if strings.Contains(err.Error(), "UNIQUE constraint failed") {
+				writeError(w, xrpcerr.GenericError(fmt.Errorf("did:web %s is already in use", repoDid)), http.StatusConflict)
 				return
 			}
+			l.Error("storing did:web repo entry", "error", err.Error())
+			writeError(w, xrpcerr.GenericError(err), http.StatusInternalServerError)
+			return
+		}
+	}
+
+	if prepared != nil {
+		plcCtx, plcCancel := context.WithTimeout(context.Background(), 30*time.Second)
+		defer plcCancel()
+		if err := prepared.Submit(plcCtx); err != nil {
+			l.Error("submitting to PLC directory", "error", err.Error())
+			cleanupAll()
+			writeError(w, xrpcerr.GenericError(fmt.Errorf("PLC directory submission failed: %w", err)), http.StatusInternalServerError)
+			return
 		}
 	}
 
 	// add perms for this user to access the repo
-	err = h.Enforcer.AddRepo(actorDid.String(), rbac.ThisServer, relativeRepoPath)
+	err = h.Enforcer.AddRepo(actorDid.String(), rbac.ThisServer, rbacPath)
 	if err != nil {
 		l.Error("adding repo permissions", "error", err.Error())
+		cleanupAll()
 		writeError(w, xrpcerr.GenericError(err), http.StatusInternalServerError)
 		return
 	}
···
 		repoPath,
 	)
 
-	w.WriteHeader(http.StatusOK)
+	writeJson(w, &tangled.RepoCreate_Output{RepoDid: &repoDid})
 }
 
 func validateRepoName(name string) error {

knotserver/xrpc/delete_branch.go

···
 	comatproto "github.com/bluesky-social/indigo/api/atproto"
 	"github.com/bluesky-social/indigo/atproto/syntax"
 	"github.com/bluesky-social/indigo/xrpc"
-	securejoin "github.com/cyphar/filepath-securejoin"
 	"tangled.org/core/api/tangled"
 	"tangled.org/core/knotserver/git"
 	"tangled.org/core/rbac"
···
 	}
 
 	repo := resp.Value.Val.(*tangled.Repo)
-	didPath, err := securejoin.SecureJoin(ident.DID.String(), repo.Name)
+	repoDid, err := x.Db.GetRepoDid(ident.DID.String(), repo.Name)
 	if err != nil {
-		fail(xrpcerr.GenericError(err))
+		fail(xrpcerr.RepoNotFoundError)
+		return
+	}
+	repoPath, _, _, err := x.Db.ResolveRepoDIDOnDisk(x.Config.Repo.ScanPath, repoDid)
+	if err != nil {
+		fail(xrpcerr.RepoNotFoundError)
 		return
 	}
 
-	if ok, err := x.Enforcer.IsPushAllowed(actorDid.String(), rbac.ThisServer, didPath); !ok || err != nil {
-		l.Error("insufficent permissions", "did", actorDid.String(), "repo", didPath)
+	if ok, err := x.Enforcer.IsPushAllowed(actorDid.String(), rbac.ThisServer, repoDid); !ok || err != nil {
+		l.Error("insufficent permissions", "did", actorDid.String(), "repo", repoDid)
 		writeError(w, xrpcerr.AccessControlError(actorDid.String()), http.StatusUnauthorized)
 		return
 	}
 
-	path, _ := securejoin.SecureJoin(x.Config.Repo.ScanPath, didPath)
-	gr, err := git.PlainOpen(path)
+	gr, err := git.PlainOpen(repoPath)
 	if err != nil {
 		fail(xrpcerr.GenericError(err))
 		return

knotserver/xrpc/delete_repo.go

···
 	"fmt"
 	"net/http"
 	"os"
-	"path/filepath"
 
 	comatproto "github.com/bluesky-social/indigo/api/atproto"
 	"github.com/bluesky-social/indigo/atproto/syntax"
 	"github.com/bluesky-social/indigo/xrpc"
-	securejoin "github.com/cyphar/filepath-securejoin"
 	"tangled.org/core/api/tangled"
 	"tangled.org/core/rbac"
 	xrpcerr "tangled.org/core/xrpc/errors"
···
 		return
 	}
 
-	relativeRepoPath := filepath.Join(did, name)
-	isDeleteAllowed, err := x.Enforcer.IsRepoDeleteAllowed(actorDid.String(), rbac.ThisServer, relativeRepoPath)
+	repoDid, err := x.Db.GetRepoDid(did, name)
 	if err != nil {
-		fail(xrpcerr.GenericError(err))
+		fail(xrpcerr.RepoNotFoundError)
 		return
 	}
-	if !isDeleteAllowed {
-		fail(xrpcerr.AccessControlError(actorDid.String()))
+	repoPath, _, _, err := x.Db.ResolveRepoDIDOnDisk(x.Config.Repo.ScanPath, repoDid)
+	if err != nil {
+		fail(xrpcerr.RepoNotFoundError)
 		return
 	}
 
-	repoPath, err := securejoin.SecureJoin(x.Config.Repo.ScanPath, relativeRepoPath)
+	isDeleteAllowed, err := x.Enforcer.IsRepoDeleteAllowed(actorDid.String(), rbac.ThisServer, repoDid)
 	if err != nil {
 		fail(xrpcerr.GenericError(err))
+		return
+	}
+	if !isDeleteAllowed {
+		fail(xrpcerr.AccessControlError(actorDid.String()))
 		return
 	}
 
···
 		return
 	}
 
-	err = x.Enforcer.RemoveRepo(did, rbac.ThisServer, relativeRepoPath)
+	err = x.Enforcer.RemoveRepo(did, rbac.ThisServer, repoDid)
 	if err != nil {
 		l.Error("failed to delete repo from enforcer", "error", err.Error())
 		writeError(w, xrpcerr.GenericError(err), http.StatusInternalServerError)
 		return
+	}
+
+	if err := x.Db.DeleteRepoKey(repoDid); err != nil {
+		l.Error("failed to delete repo key", "error", err.Error())
 	}
 
 	w.WriteHeader(http.StatusOK)

knotserver/xrpc/fork_status.go

···
 	"path/filepath"
 
 	"github.com/bluesky-social/indigo/atproto/syntax"
-	securejoin "github.com/cyphar/filepath-securejoin"
 	"tangled.org/core/api/tangled"
 	"tangled.org/core/knotserver/git"
 	"tangled.org/core/rbac"
···
 		name = filepath.Base(source)
 	}
 
-	relativeRepoPath := filepath.Join(did, name)
-
-	if ok, err := x.Enforcer.IsPushAllowed(actorDid.String(), rbac.ThisServer, relativeRepoPath); !ok || err != nil {
-		l.Error("insufficient permissions", "did", actorDid.String(), "repo", relativeRepoPath)
-		writeError(w, xrpcerr.AccessControlError(actorDid.String()), http.StatusUnauthorized)
+	repoDid, err := x.Db.GetRepoDid(did, name)
+	if err != nil {
+		fail(xrpcerr.RepoNotFoundError)
+		return
+	}
+	repoPath, _, _, err := x.Db.ResolveRepoDIDOnDisk(x.Config.Repo.ScanPath, repoDid)
+	if err != nil {
+		fail(xrpcerr.RepoNotFoundError)
 		return
 	}
 
-	repoPath, err := securejoin.SecureJoin(x.Config.Repo.ScanPath, relativeRepoPath)
-	if err != nil {
-		fail(xrpcerr.GenericError(err))
+	if ok, err := x.Enforcer.IsPushAllowed(actorDid.String(), rbac.ThisServer, repoDid); !ok || err != nil {
+		l.Error("insufficient permissions", "did", actorDid.String(), "repo", repoDid)
+		writeError(w, xrpcerr.AccessControlError(actorDid.String()), http.StatusUnauthorized)
 		return
 	}
 

knotserver/xrpc/fork_sync.go

···
 	"encoding/json"
 	"fmt"
 	"net/http"
-	"path/filepath"
 
 	"github.com/bluesky-social/indigo/atproto/syntax"
-	securejoin "github.com/cyphar/filepath-securejoin"
 	"tangled.org/core/api/tangled"
 	"tangled.org/core/knotserver/git"
 	"tangled.org/core/rbac"
···
 		return
 	}
 
-	relativeRepoPath := filepath.Join(did, name)
-
-	if ok, err := x.Enforcer.IsPushAllowed(actorDid.String(), rbac.ThisServer, relativeRepoPath); !ok || err != nil {
-		l.Error("insufficient permissions", "did", actorDid.String(), "repo", relativeRepoPath)
-		writeError(w, xrpcerr.AccessControlError(actorDid.String()), http.StatusUnauthorized)
+	repoDid, err := x.Db.GetRepoDid(did, name)
+	if err != nil {
+		fail(xrpcerr.RepoNotFoundError)
+		return
+	}
+	repoPath, _, _, err := x.Db.ResolveRepoDIDOnDisk(x.Config.Repo.ScanPath, repoDid)
+	if err != nil {
+		fail(xrpcerr.RepoNotFoundError)
 		return
 	}
 
-	repoPath, err := securejoin.SecureJoin(x.Config.Repo.ScanPath, relativeRepoPath)
-	if err != nil {
-		fail(xrpcerr.GenericError(err))
+	if ok, err := x.Enforcer.IsPushAllowed(actorDid.String(), rbac.ThisServer, repoDid); !ok || err != nil {
+		l.Error("insufficient permissions", "did", actorDid.String(), "repo", repoDid)
+		writeError(w, xrpcerr.AccessControlError(actorDid.String()), http.StatusUnauthorized)
 		return
 	}
 

knotserver/xrpc/hidden_ref.go

···
 	comatproto "github.com/bluesky-social/indigo/api/atproto"
 	"github.com/bluesky-social/indigo/atproto/syntax"
 	"github.com/bluesky-social/indigo/xrpc"
-	securejoin "github.com/cyphar/filepath-securejoin"
 	"tangled.org/core/api/tangled"
 	"tangled.org/core/knotserver/git"
 	"tangled.org/core/rbac"
···
 	}
 
 	repo := resp.Value.Val.(*tangled.Repo)
-	didPath, err := securejoin.SecureJoin(actorDid.String(), repo.Name)
+	repoDid, err := x.Db.GetRepoDid(actorDid.String(), repo.Name)
 	if err != nil {
-		fail(xrpcerr.GenericError(err))
+		fail(xrpcerr.RepoNotFoundError)
 		return
 	}
-
-	if ok, err := x.Enforcer.IsPushAllowed(actorDid.String(), rbac.ThisServer, didPath); !ok || err != nil {
-		l.Error("insufficient permissions", "did", actorDid.String(), "repo", didPath)
-		writeError(w, xrpcerr.AccessControlError(actorDid.String()), http.StatusUnauthorized)
+	repoPath, _, _, err := x.Db.ResolveRepoDIDOnDisk(x.Config.Repo.ScanPath, repoDid)
+	if err != nil {
+		fail(xrpcerr.RepoNotFoundError)
 		return
 	}
 
-	repoPath, err := securejoin.SecureJoin(x.Config.Repo.ScanPath, didPath)
-	if err != nil {
-		fail(xrpcerr.GenericError(err))
+	if ok, err := x.Enforcer.IsPushAllowed(actorDid.String(), rbac.ThisServer, repoDid); !ok || err != nil {
+		l.Error("insufficient permissions", "did", actorDid.String(), "repo", repoDid)
+		writeError(w, xrpcerr.AccessControlError(actorDid.String()), http.StatusUnauthorized)
 		return
 	}
 

knotserver/xrpc/merge.go

···
 	"net/http"
 
 	"github.com/bluesky-social/indigo/atproto/syntax"
-	securejoin "github.com/cyphar/filepath-securejoin"
 	"tangled.org/core/api/tangled"
 	"tangled.org/core/knotserver/git"
 	"tangled.org/core/patchutil"
···
 		return
 	}
 
-	relativeRepoPath, err := securejoin.SecureJoin(did, name)
+	repoDid, err := x.Db.GetRepoDid(did, name)
 	if err != nil {
-		fail(xrpcerr.GenericError(err))
+		fail(xrpcerr.RepoNotFoundError)
 		return
 	}
-
-	if ok, err := x.Enforcer.IsPushAllowed(actorDid.String(), rbac.ThisServer, relativeRepoPath); !ok || err != nil {
-		l.Error("insufficient permissions", "did", actorDid.String(), "repo", relativeRepoPath)
-		writeError(w, xrpcerr.AccessControlError(actorDid.String()), http.StatusUnauthorized)
+	repoPath, _, _, err := x.Db.ResolveRepoDIDOnDisk(x.Config.Repo.ScanPath, repoDid)
+	if err != nil {
+		fail(xrpcerr.RepoNotFoundError)
 		return
 	}
 
-	repoPath, err := securejoin.SecureJoin(x.Config.Repo.ScanPath, relativeRepoPath)
-	if err != nil {
-		fail(xrpcerr.GenericError(err))
+	if ok, err := x.Enforcer.IsPushAllowed(actorDid.String(), rbac.ThisServer, repoDid); !ok || err != nil {
+		l.Error("insufficient permissions", "did", actorDid.String(), "repo", repoDid)
+		writeError(w, xrpcerr.AccessControlError(actorDid.String()), http.StatusUnauthorized)
 		return
 	}
 

knotserver/xrpc/merge_check.go

···
 	"fmt"
 	"net/http"
 
-	securejoin "github.com/cyphar/filepath-securejoin"
 	"tangled.org/core/api/tangled"
 	"tangled.org/core/knotserver/git"
 	"tangled.org/core/patchutil"
···
 		return
 	}
 
-	relativeRepoPath, err := securejoin.SecureJoin(did, name)
+	repoDid, err := x.Db.GetRepoDid(did, name)
 	if err != nil {
-		fail(xrpcerr.GenericError(err))
+		fail(xrpcerr.RepoNotFoundError)
 		return
 	}
-
-	repoPath, err := securejoin.SecureJoin(x.Config.Repo.ScanPath, relativeRepoPath)
+	repoPath, _, _, err := x.Db.ResolveRepoDIDOnDisk(x.Config.Repo.ScanPath, repoDid)
 	if err != nil {
-		fail(xrpcerr.GenericError(err))
+		fail(xrpcerr.RepoNotFoundError)
 		return
 	}
 

knotserver/xrpc/set_default_branch.go

···
 	comatproto "github.com/bluesky-social/indigo/api/atproto"
 	"github.com/bluesky-social/indigo/atproto/syntax"
 	"github.com/bluesky-social/indigo/xrpc"
-	securejoin "github.com/cyphar/filepath-securejoin"
 	"tangled.org/core/api/tangled"
 	"tangled.org/core/knotserver/git"
 	"tangled.org/core/rbac"
···
 	}
 
 	repo := resp.Value.Val.(*tangled.Repo)
-	didPath, err := securejoin.SecureJoin(actorDid.String(), repo.Name)
+	repoDid, err := x.Db.GetRepoDid(actorDid.String(), repo.Name)
 	if err != nil {
-		fail(xrpcerr.GenericError(err))
+		fail(xrpcerr.RepoNotFoundError)
+		return
+	}
+	repoPath, _, _, err := x.Db.ResolveRepoDIDOnDisk(x.Config.Repo.ScanPath, repoDid)
+	if err != nil {
+		fail(xrpcerr.RepoNotFoundError)
 		return
 	}
 
-	if ok, err := x.Enforcer.IsPushAllowed(actorDid.String(), rbac.ThisServer, didPath); !ok || err != nil {
+	if ok, err := x.Enforcer.IsPushAllowed(actorDid.String(), rbac.ThisServer, repoDid); !ok || err != nil {
 		l.Error("insufficent permissions", "did", actorDid.String())
 		writeError(w, xrpcerr.AccessControlError(actorDid.String()), http.StatusUnauthorized)
 		return
 	}
 
-	path, _ := securejoin.SecureJoin(x.Config.Repo.ScanPath, didPath)
-	gr, err := git.PlainOpen(path)
+	gr, err := git.PlainOpen(repoPath)
 	if err != nil {
 		fail(xrpcerr.GenericError(err))
 		return

knotserver/xrpc/xrpc.go

···
 	"net/http"
 	"strings"
 
-	securejoin "github.com/cyphar/filepath-securejoin"
 	"tangled.org/core/api/tangled"
 	"tangled.org/core/idresolver"
 	"tangled.org/core/jetstream"
···
 	return r
 }
 
-// parseRepoParam parses a repo parameter in 'did/repoName' format and returns
-// the full repository path on disk
 func (x *Xrpc) parseRepoParam(repo string) (string, error) {
-	if repo == "" {
+	if repo == "" || !strings.HasPrefix(repo, "did:") {
 		return "", xrpcerr.NewXrpcError(
 			xrpcerr.WithTag("InvalidRequest"),
-			xrpcerr.WithMessage("missing repo parameter"),
+			xrpcerr.WithMessage("missing or invalid repo parameter, expected a repo DID"),
 		)
 	}
 
-	// Parse repo string (did/repoName format)
-	parts := strings.SplitN(repo, "/", 2)
-	if len(parts) != 2 {
-		return "", xrpcerr.NewXrpcError(
-			xrpcerr.WithTag("InvalidRequest"),
-			xrpcerr.WithMessage("invalid repo format, expected 'did/repoName'"),
-		)
-	}
-
-	did := parts[0]
-	repoName := parts[1]
-
-	// Construct repository path using the same logic as didPath
-	didRepoPath, err := securejoin.SecureJoin(did, repoName)
+	repoPath, _, _, err := x.Db.ResolveRepoDIDOnDisk(x.Config.Repo.ScanPath, repo)
 	if err != nil {
 		return "", xrpcerr.RepoNotFoundError
 	}
-
-	repoPath, err := securejoin.SecureJoin(x.Config.Repo.ScanPath, didRepoPath)
-	if err != nil {
-		return "", xrpcerr.RepoNotFoundError
-	}
-
 	return repoPath, nil
 }