appview: update state, ingester, middleware, and resolver for repo DID

Signed-off-by: Lewis <[e-mail]>

appview/ingester.go

···
 
 import (
 	"context"
+	"database/sql"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"log/slog"
 	"maps"
···
 			return err
 		}
 
-		subjectUri, err = syntax.ParseATURI(record.Subject)
-		if err != nil {
-			l.Error("invalid record", "err", err)
-			return err
+		star := &models.Star{
+			Did:  did,
+			Rkey: e.Commit.RKey,
+		}
+
+		switch {
+		case record.SubjectDid != nil:
+			star.SubjectDid = *record.SubjectDid
+			repo, repoErr := db.GetRepo(i.Db, orm.FilterEq("repo_did", *record.SubjectDid))
+			if repoErr == nil {
+				subjectUri = repo.RepoAt()
+				star.RepoAt = subjectUri
+			}
+		case record.Subject != nil:
+			subjectUri, err = syntax.ParseATURI(*record.Subject)
+			if err != nil {
+				l.Error("invalid record", "err", err)
+				return err
+			}
+			star.RepoAt = subjectUri
+			repo, repoErr := db.GetRepoByAtUri(i.Db, subjectUri.String())
+			if repoErr == nil && repo.RepoDid != "" {
+				star.SubjectDid = repo.RepoDid
+				if enqErr := db.EnqueuePdsRewrite(i.Db, did, repo.RepoDid, tangled.FeedStarNSID, e.Commit.RKey, *record.Subject); enqErr != nil {
+					l.Warn("failed to enqueue PDS rewrite for star", "err", enqErr, "did", did, "repoDid", repo.RepoDid)
+				}
+			}
+		default:
+			l.Error("star record has neither subject nor subjectDid")
+			return fmt.Errorf("star record has neither subject nor subjectDid")
 		}
-		err = db.AddStar(i.Db, &models.Star{
-			Did:    did,
-			RepoAt: subjectUri,
-			Rkey:   e.Commit.RKey,
-		})
+		err = db.AddStar(i.Db, star)
 	case jmodels.CommitOperationDelete:
 		err = db.DeleteStarByRkey(i.Db, did, e.Commit.RKey)
 	}
···
 			return err
 		}
 
-		repoAt, err := syntax.ParseATURI(record.Repo)
-		if err != nil {
-			return err
+		var repo *models.Repo
+		if record.RepoDid != nil && *record.RepoDid != "" {
+			repo, err = db.GetRepoByDid(i.Db, *record.RepoDid)
+			if err != nil && !errors.Is(err, sql.ErrNoRows) {
+				return fmt.Errorf("failed to look up repo by DID %s: %w", *record.RepoDid, err)
+			}
 		}
-
-		repo, err := db.GetRepoByAtUri(i.Db, repoAt.String())
-		if err != nil {
-			return err
+		if repo == nil && record.Repo != nil {
+			repoAt, parseErr := syntax.ParseATURI(*record.Repo)
+			if parseErr != nil {
+				return parseErr
+			}
+			repo, err = db.GetRepoByAtUri(i.Db, repoAt.String())
+			if err != nil {
+				return err
+			}
+		}
+		if repo == nil {
+			return fmt.Errorf("artifact record has neither valid repoDid nor repo field")
 		}
 
-		ok, err := i.Enforcer.E.Enforce(did, repo.Knot, repo.DidSlashRepo(), "repo:push")
+		ok, err := i.Enforcer.E.Enforce(did, repo.Knot, repo.RepoIdentifier(), "repo:push")
 		if err != nil || !ok {
 			return err
 		}
 
+		repoDid := repo.RepoDid
+		if repoDid == "" && record.RepoDid != nil {
+			repoDid = *record.RepoDid
+		}
+		if repoDid != "" && (record.RepoDid == nil || *record.RepoDid == "") && record.Repo != nil {
+			if enqErr := db.EnqueuePdsRewrite(i.Db, did, repoDid, tangled.RepoArtifactNSID, e.Commit.RKey, *record.Repo); enqErr != nil {
+				l.Warn("failed to enqueue PDS rewrite for artifact", "err", enqErr, "did", did, "repoDid", repoDid)
+			}
+		}
+
 		createdAt, err := time.Parse(time.RFC3339, record.CreatedAt)
 		if err != nil {
 			createdAt = time.Now()
···
 		artifact := models.Artifact{
 			Did:       did,
 			Rkey:      e.Commit.RKey,
-			RepoAt:    repoAt,
+			RepoAt:    repo.RepoAt(),
+			RepoDid:   repoDid,
 			Tag:       plumbing.Hash(record.Tag),
 			CreatedAt: createdAt,
 			BlobCid:   cid.Cid(record.Artifact.Ref),
···
 
 		issue := models.IssueFromRecord(did, rkey, record)
 
+		if issue.RepoDid == "" && issue.RepoAt == "" {
+			return fmt.Errorf("issue record has neither repo nor repoDid")
+		}
+
 		if err := i.Validator.ValidateIssue(&issue); err != nil {
 			return fmt.Errorf("failed to validate issue: %w", err)
+		}
+
+		if issue.RepoDid == "" && record.Repo != nil {
+			repo, repoErr := db.GetRepoByAtUri(i.Db, *record.Repo)
+			if repoErr == nil && repo.RepoDid != "" {
+				issue.RepoDid = repo.RepoDid
+				if enqErr := db.EnqueuePdsRewrite(i.Db, did, repo.RepoDid, tangled.RepoIssueNSID, rkey, *record.Repo); enqErr != nil {
+					l.Warn("failed to enqueue PDS rewrite for issue", "err", enqErr, "did", did, "repoDid", repo.RepoDid)
+				}
+			}
 		}
 
 		tx, err := ddb.BeginTx(ctx, nil)

appview/middleware/middleware.go

···
 	"tangled.org/core/appview/pages"
 	"tangled.org/core/appview/pagination"
 	"tangled.org/core/appview/reporesolver"
+	"tangled.org/core/appview/state/userutil"
 	"tangled.org/core/idresolver"
 	"tangled.org/core/orm"
 	"tangled.org/core/rbac"
···
 				return
 			}
 
-			ok, err := mw.enforcer.E.Enforce(actor.Active.Did, f.Knot, f.DidSlashRepo(), requiredPerm)
+			ok, err := mw.enforcer.E.Enforce(actor.Active.Did, f.Knot, f.RepoIdentifier(), requiredPerm)
 			if err != nil || !ok {
-				log.Printf("%s does not have perms of a %s in repo %s", actor.Active.Did, requiredPerm, f.DidSlashRepo())
+				log.Printf("%s does not have perms of a %s in repo %s", actor.Active.Did, requiredPerm, f.RepoIdentifier())
 				http.Error(w, "Forbiden", http.StatusUnauthorized)
 				return
 			}
···
 
 			id, err := mw.idResolver.ResolveIdent(req.Context(), didOrHandle)
 			if err != nil {
-				// invalid did or handle
 				log.Printf("failed to resolve did/handle '%s': %s\n", didOrHandle, err)
 				mw.pages.Error404(w)
 				return
···
 
 			if r.Header.Get("User-Agent") == "Go-http-client/1.1" {
 				if r.URL.Query().Get("go-get") == "1" {
+					modulePath := userutil.FlattenDid(fullName)
+					if strings.Contains(modulePath, ":") {
+						modulePath = userutil.FlattenDid(f.Did) + "/" + f.Name
+					}
 					html := fmt.Sprintf(
 						`<meta name="go-import" content="tangled.sh/%s git https://tangled.sh/%s"/>
 <meta name="go-import" content="tangled.org/%s git https://tangled.org/%s"/>`,
-						fullName, fullName,
-						fullName, fullName,
+						modulePath, fullName,
+						modulePath, fullName,
 					)
 					w.Header().Set("Content-Type", "text/html")
 					w.Write([]byte(html))

appview/reporesolver/resolver.go

···
 
 // NOTE: this... should not even be here. the entire package will be removed in future refactor
 func GetBaseRepoPath(r *http.Request, repo *models.Repo) string {
+	if repo.RepoDid != "" {
+		return repo.RepoDid
+	}
 	var (
 		user = chi.URLParam(r, "user")
 		name = chi.URLParam(r, "repo")
 	)
 	if user == "" || name == "" {
-		return repo.DidSlashRepo()
+		return repo.RepoIdentifier()
 	}
 	return path.Join(user, name)
 }
···
 	roles := repoinfo.RolesInRepo{}
 	if user != nil && user.Active != nil {
 		isStarred = db.GetStarStatus(rr.execer, user.Active.Did, repoAt)
-		roles.Roles = rr.enforcer.GetPermissionsInRepo(user.Active.Did, repo.Knot, repo.DidSlashRepo())
+		roles.Roles = rr.enforcer.GetPermissionsInRepo(user.Active.Did, repo.Knot, repo.RepoIdentifier())
 	}
 
 	stats := repo.RepoStats
 	if stats == nil {
-		starCount, err := db.GetStarCount(rr.execer, repoAt)
-		if err != nil {
+		starCount, starErr := db.GetStarCount(rr.execer, repo.RepoDid, repoAt)
+		if starErr != nil {
 			log.Println("failed to get star count for ", repoAt)
 		}
 		issueCount, err := db.GetIssueCount(rr.execer, repoAt)
···
 	var sourceRepo *models.Repo
 	var err error
 	if repo.Source != "" {
-		sourceRepo, err = db.GetRepoByAtUri(rr.execer, repo.Source)
+		if strings.HasPrefix(repo.Source, "did:") {
+			sourceRepo, err = db.GetRepoByDid(rr.execer, repo.Source)
+		} else {
+			sourceRepo, err = db.GetRepoByAtUri(rr.execer, repo.Source)
+		}
 		if err != nil {
-			log.Println("failed to get repo by at uri", err)
+			log.Println("failed to get source repo", err)
 		}
 	}
 
···
 		// this is basically a models.Repo
 		OwnerDid:    ownerId.DID.String(),
 		OwnerHandle: ownerId.Handle.String(),
+		RepoDid:     repo.RepoDid,
 		Name:        repo.Name,
 		Rkey:        repo.Rkey,
 		Description: repo.Description,

appview/state/git_http.go

···
 )
 
 func (s *State) InfoRefs(w http.ResponseWriter, r *http.Request) {
-	user := r.Context().Value("resolvedId").(identity.Identity)
 	repo := r.Context().Value("repo").(*models.Repo)
 
 	scheme := "https"
···
 		scheme = "http"
 	}
 
-	targetURL := fmt.Sprintf("%s://%s/%s/%s/info/refs?%s", scheme, repo.Knot, user.DID, repo.Name, r.URL.RawQuery)
+	targetURL := fmt.Sprintf("%s://%s/%s/info/refs?%s", scheme, repo.Knot, repo.RepoIdentifier(), r.URL.RawQuery)
 	s.proxyRequest(w, r, targetURL)
 
 }
 
 func (s *State) UploadArchive(w http.ResponseWriter, r *http.Request) {
-	user, ok := r.Context().Value("resolvedId").(identity.Identity)
-	if !ok {
-		http.Error(w, "failed to resolve user", http.StatusInternalServerError)
-		return
-	}
 	repo := r.Context().Value("repo").(*models.Repo)
 
 	scheme := "https"
···
 		scheme = "http"
 	}
 
-	targetURL := fmt.Sprintf("%s://%s/%s/%s/git-upload-archive?%s", scheme, repo.Knot, user.DID, repo.Name, r.URL.RawQuery)
+	targetURL := fmt.Sprintf("%s://%s/%s/git-upload-archive?%s", scheme, repo.Knot, repo.RepoIdentifier(), r.URL.RawQuery)
 	s.proxyRequest(w, r, targetURL)
 }
 
 func (s *State) UploadPack(w http.ResponseWriter, r *http.Request) {
-	user, ok := r.Context().Value("resolvedId").(identity.Identity)
-	if !ok {
-		http.Error(w, "failed to resolve user", http.StatusInternalServerError)
-		return
-	}
 	repo := r.Context().Value("repo").(*models.Repo)
 
 	scheme := "https"
···
 		scheme = "http"
 	}
 
-	targetURL := fmt.Sprintf("%s://%s/%s/%s/git-upload-pack?%s", scheme, repo.Knot, user.DID, repo.Name, r.URL.RawQuery)
+	targetURL := fmt.Sprintf("%s://%s/%s/git-upload-pack?%s", scheme, repo.Knot, repo.RepoIdentifier(), r.URL.RawQuery)
 	s.proxyRequest(w, r, targetURL)
 }
 
 func (s *State) ReceivePack(w http.ResponseWriter, r *http.Request) {
-	user, ok := r.Context().Value("resolvedId").(identity.Identity)
-	if !ok {
-		http.Error(w, "failed to resolve user", http.StatusInternalServerError)
-		return
-	}
 	repo := r.Context().Value("repo").(*models.Repo)
 
 	scheme := "https"
···
 		scheme = "http"
 	}
 
-	targetURL := fmt.Sprintf("%s://%s/%s/%s/git-receive-pack?%s", scheme, repo.Knot, user.DID, repo.Name, r.URL.RawQuery)
+	targetURL := fmt.Sprintf("%s://%s/%s/git-receive-pack?%s", scheme, repo.Knot, repo.RepoIdentifier(), r.URL.RawQuery)
 	s.proxyRequest(w, r, targetURL)
 }
 
···
 	proxyReq.Header = r.Header
 
 	repoOwnerHandle := chi.URLParam(r, "user")
+	if id, ok := r.Context().Value("resolvedId").(identity.Identity); ok && !id.Handle.IsInvalidHandle() {
+		repoOwnerHandle = id.Handle.String()
+	}
 	proxyReq.Header.Add("x-tangled-repo-owner-handle", repoOwnerHandle)
 
 	// Execute request

appview/state/knotstream.go

···
 
 import (
 	"context"
+	"database/sql"
 	"encoding/json"
 	"errors"
 	"fmt"
···
 		return err
 	}
 
+	if record.RepoDid == nil || *record.RepoDid == "" {
+		logger.Error("gitRefUpdate missing repoDid, skipping", "repo_name", record.RepoName)
+		return fmt.Errorf("gitRefUpdate missing repoDid")
+	}
+
 	knownKnots, err := enforcer.GetKnotsForUser(record.CommitterDid)
 	if err != nil {
 		return err
···
 	}
 
 	logger.Info("processing gitRefUpdate event",
-		"repo_did", record.RepoDid,
-		"repo_name", record.RepoName,
+		"repo_did", *record.RepoDid,
 		"ref", record.Ref,
 		"old_sha", record.OldSha,
 		"new_sha", record.NewSha)
 
-	// trigger webhook notifications first (before other ops that might fail)
 	var errWebhook error
-	repos, err := db.GetRepos(
-		d,
-		0,
-		orm.FilterEq("did", record.RepoDid),
-		orm.FilterEq("name", record.RepoName),
-	)
-	if err != nil {
-		errWebhook = fmt.Errorf("failed to lookup repo for webhooks: %w", err)
-	} else if len(repos) == 1 {
+
+	repo, lookupErr := db.GetRepoByDid(d, *record.RepoDid)
+	if lookupErr != nil && !errors.Is(lookupErr, sql.ErrNoRows) {
+		return fmt.Errorf("failed to look up repo by DID %s: %w", *record.RepoDid, lookupErr)
+	}
+
+	var repos []models.Repo
+	if lookupErr == nil {
+		repos = []models.Repo{*repo}
+	}
+
+	if errWebhook == nil && len(repos) == 1 {
 		notifier.Push(ctx, &repos[0], record.Ref, record.OldSha, record.NewSha, record.CommitterDid)
 	}
 
···
 	}
 	pushedBranch := ref.Short()
 
-	repos, err := db.GetRepos(
-		d,
-		0,
-		orm.FilterEq("did", record.RepoDid),
-		orm.FilterEq("name", record.RepoName),
-	)
-	if err != nil || len(repos) != 1 {
+	if record.RepoDid == nil || *record.RepoDid == "" {
+		return
+	}
+
+	repo, err := db.GetRepoByDid(d, *record.RepoDid)
+	if err != nil {
 		return
 	}
-	repo := repos[0]
 
 	siteConfig, err := db.GetRepoSiteConfig(d, repo.RepoAt().String())
 	if err != nil || siteConfig == nil {
···
 		Trigger:   models.SiteDeployTriggerPush,
 	}
 
-	deployErr := sites.Deploy(ctx, cfClient, knotHost, record.RepoDid, record.RepoName, siteConfig.Branch, siteConfig.Dir)
+	deployErr := sites.Deploy(ctx, cfClient, knotHost, *record.RepoDid, record.RepoName, siteConfig.Branch, siteConfig.Dir)
 	if deployErr != nil {
-		logger.Error("sites: R2 sync failed on push", "repo", record.RepoDid+"/"+record.RepoName, "err", deployErr)
+		logger.Error("sites: R2 sync failed on push", "repo", repo.RepoIdentifier(), "err", deployErr)
 		deploy.Status = models.SiteDeployStatusFailure
 		deploy.Error = deployErr.Error()
 	} else {
···
 	}
 
 	if err := db.AddSiteDeploy(d, deploy); err != nil {
-		logger.Error("sites: failed to record deploy", "repo", record.RepoDid+"/"+record.RepoName, "err", err)
+		logger.Error("sites: failed to record deploy", "repo", repo.RepoIdentifier(), "err", err)
 	}
 
 	if deployErr == nil {
-		logger.Info("site deployed to r2", "repo", record.RepoDid+"/"+record.RepoName)
+		logger.Info("site deployed to r2", "repo", repo.RepoIdentifier())
 	}
 }
 
···
 
 func updateRepoLanguages(d *db.DB, record tangled.GitRefUpdate) error {
 	if record.Meta == nil || record.Meta.LangBreakdown == nil || record.Meta.LangBreakdown.Inputs == nil {
-		return fmt.Errorf("empty language data for repo: %s/%s", record.RepoDid, record.RepoName)
+		return fmt.Errorf("empty language data for repo: %v/%s", record.OwnerDid, record.RepoName)
 	}
 
-	repos, err := db.GetRepos(
-		d,
-		0,
-		orm.FilterEq("did", record.RepoDid),
-		orm.FilterEq("name", record.RepoName),
-	)
-	if err != nil {
-		return fmt.Errorf("failed to look for repo in DB (%s/%s): %w", record.RepoDid, record.RepoName, err)
+	if record.RepoDid == nil || *record.RepoDid == "" {
+		return fmt.Errorf("gitRefUpdate missing repoDid for language update")
 	}
-	if len(repos) != 1 {
-		return fmt.Errorf("incorrect number of repos returned: %d (expected 1)", len(repos))
+
+	r, lookupErr := db.GetRepoByDid(d, *record.RepoDid)
+	if lookupErr != nil {
+		return fmt.Errorf("failed to look up repo by DID %s: %w", *record.RepoDid, lookupErr)
 	}
-	repo := repos[0]
+	repo := *r
 
 	ref := plumbing.ReferenceName(record.Ref)
 	if !ref.IsBranch() {
···
 
 		langs = append(langs, models.RepoLanguage{
 			RepoAt:       repo.RepoAt(),
+			RepoDid:      repo.RepoDid,
 			Ref:          ref.Short(),
 			IsDefaultRef: record.Meta.IsDefaultRef,
 			Language:     l.Lang,
···
 		return fmt.Errorf("empty repo: nsid %s, rkey %s", msg.Nsid, msg.Rkey)
 	}
 
-	// does this repo have a spindle configured?
-	repos, err := db.GetRepos(
-		d,
-		0,
-		orm.FilterEq("did", record.TriggerMetadata.Repo.Did),
-		orm.FilterEq("name", record.TriggerMetadata.Repo.Repo),
-	)
-	if err != nil {
-		return fmt.Errorf("failed to look for repo in DB: nsid %s, rkey %s, %w", msg.Nsid, msg.Rkey, err)
+	if record.TriggerMetadata.Repo.RepoDid == nil || *record.TriggerMetadata.Repo.RepoDid == "" {
+		return fmt.Errorf("pipeline missing repoDid: nsid %s, rkey %s", msg.Nsid, msg.Rkey)
 	}
-	if len(repos) != 1 {
-		return fmt.Errorf("incorrect number of repos returned: %d (expected 1)", len(repos))
+
+	repo, lookupErr := db.GetRepoByDid(d, *record.TriggerMetadata.Repo.RepoDid)
+	if lookupErr != nil {
+		return fmt.Errorf("failed to look up repo by DID %s: %w", *record.TriggerMetadata.Repo.RepoDid, lookupErr)
 	}
+	repos := []models.Repo{*repo}
 	if repos[0].Spindle == "" {
 		return fmt.Errorf("repo does not have a spindle configured yet: nsid %s, rkey %s", msg.Nsid, msg.Rkey)
 	}
···
 		return fmt.Errorf("failed to add trigger entry: %w", err)
 	}
 
+	repoName := ""
+	if record.TriggerMetadata.Repo.Repo != nil {
+		repoName = *record.TriggerMetadata.Repo.Repo
+	}
+
 	pipeline := models.Pipeline{
 		Rkey:      msg.Rkey,
 		Knot:      source.Key(),
 		RepoOwner: syntax.DID(record.TriggerMetadata.Repo.Did),
-		RepoName:  record.TriggerMetadata.Repo.Repo,
+		RepoName:  repoName,
+		RepoDid:   repos[0].RepoDid,
 		TriggerId: int(triggerId),
 		Sha:       sha,
 	}

appview/state/router.go

···
 package state
 
 import (
+	"context"
+	"database/sql"
+	"errors"
 	"net/http"
 	"strings"
 
 	"github.com/go-chi/chi/v5"
+	"tangled.org/core/appview/db"
 	"tangled.org/core/appview/issues"
 	"tangled.org/core/appview/knots"
 	"tangled.org/core/appview/labels"
···
 		if len(pathParts) > 0 {
 			firstPart := pathParts[0]
 
-			// if using a DID or handle, just continue as per usual
-			if userutil.IsDid(firstPart) || userutil.IsHandle(firstPart) {
+			if userutil.IsDid(firstPart) {
+				repo, err := db.GetRepoByDid(s.db, firstPart)
+				switch {
+				case err == nil:
+					remaining := ""
+					if len(pathParts) > 1 {
+						remaining = "/" + pathParts[1]
+					}
+					rewritten := "/" + repo.Did + "/" + repo.Name + remaining
+					r2 := r.Clone(r.Context())
+					r2.URL.Path = rewritten
+					r2.URL.RawPath = rewritten
+					ctx := context.WithValue(r2.Context(), "repoDidCanonical", true)
+					userRouter.ServeHTTP(w, r2.WithContext(ctx))
+				case errors.Is(err, sql.ErrNoRows):
+					userRouter.ServeHTTP(w, r)
+				default:
+					s.logger.Error("db error looking up repo DID", "repoDid", firstPart, "err", err)
+					http.Error(w, "internal server error", http.StatusInternalServerError)
+				}
+				return
+			}
+
+			if userutil.IsHandle(firstPart) {
 				userRouter.ServeHTTP(w, r)
 				return
 			}

appview/state/star.go

···
 	"tangled.org/core/appview/db"
 	"tangled.org/core/appview/models"
 	"tangled.org/core/appview/pages"
+	"tangled.org/core/orm"
 	"tangled.org/core/tid"
 )
 
···
 	case http.MethodPost:
 		createdAt := time.Now().Format(time.RFC3339)
 		rkey := tid.TID()
+
+		starRecord := &tangled.FeedStar{
+			CreatedAt: createdAt,
+		}
+		repo, err := db.GetRepo(s.db, orm.FilterEq("at_uri", subjectUri.String()))
+		repoHasDid := err == nil && repo.RepoDid != ""
+		if repoHasDid {
+			starRecord.SubjectDid = &repo.RepoDid
+		} else {
+			s := subjectUri.String()
+			starRecord.Subject = &s
+		}
+
 		resp, err := comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{
 			Collection: tangled.FeedStarNSID,
 			Repo:       currentUser.Active.Did,
 			Rkey:       rkey,
-			Record: &lexutil.LexiconTypeDecoder{
-				Val: &tangled.FeedStar{
-					Subject:   subjectUri.String(),
-					CreatedAt: createdAt,
-				}},
+			Record:     &lexutil.LexiconTypeDecoder{Val: starRecord},
 		})
 		if err != nil {
 			log.Println("failed to create atproto record", err)
···
 			RepoAt: subjectUri,
 			Rkey:   rkey,
 		}
+		if repoHasDid {
+			star.SubjectDid = repo.RepoDid
+		}
 
 		err = db.AddStar(s.db, star)
 		if err != nil {
···
 			return
 		}
 
-		starCount, err := db.GetStarCount(s.db, subjectUri)
+		starCount, err := db.GetStarCount(s.db, "", subjectUri)
 		if err != nil {
 			log.Println("failed to get star count for ", subjectUri)
 		}
···
 			// this is not an issue, the firehose event might have already done this
 		}
 
-		starCount, err := db.GetStarCount(s.db, subjectUri)
+		starCount, err := db.GetStarCount(s.db, "", subjectUri)
 		if err != nil {
 			log.Println("failed to get star count for ", subjectUri)
 			return

appview/state/state.go

···
 	"github.com/bluesky-social/indigo/atproto/syntax"
 	lexutil "github.com/bluesky-social/indigo/lex/util"
 	"github.com/bluesky-social/indigo/xrpc"
-	securejoin "github.com/cyphar/filepath-securejoin"
+
 	"github.com/go-chi/chi/v5"
 	"github.com/posthog/posthog-go"
 )
···
 			return
 		}
 
-		// create atproto record for this repo
 		rkey := tid.TID()
+
+		client, err := s.oauth.ServiceClient(
+			r,
+			oauth.WithService(domain),
+			oauth.WithLxm(tangled.RepoCreateNSID),
+			oauth.WithDev(s.config.Core.Dev),
+		)
+		if err != nil {
+			l.Error("service auth failed", "err", err)
+			s.pages.Notice(w, "repo", "Failed to reach knot server.")
+			return
+		}
+
+		input := &tangled.RepoCreate_Input{
+			Rkey:          rkey,
+			Name:          repoName,
+			DefaultBranch: &defaultBranch,
+		}
+		if rd := strings.TrimSpace(r.FormValue("repo_did")); rd != "" {
+			input.RepoDid = &rd
+		}
+
+		createResp, xe := tangled.RepoCreate(
+			r.Context(),
+			client,
+			input,
+		)
+		if err := xrpcclient.HandleXrpcErr(xe); err != nil {
+			l.Error("xrpc error", "xe", xe)
+			s.pages.Notice(w, "repo", err.Error())
+			return
+		}
+
+		var repoDid string
+		if createResp != nil && createResp.RepoDid != nil {
+			repoDid = *createResp.RepoDid
+		}
+		if repoDid == "" {
+			l.Error("knot returned empty repo DID")
+			s.pages.Notice(w, "repo", "Knot failed to mint a repo DID. The knot may need to be upgraded.")
+			return
+		}
+
 		repo := &models.Repo{
 			Did:         user.Active.Did,
 			Name:        repoName,
···
 			Description: description,
 			Created:     time.Now(),
 			Labels:      s.config.Label.DefaultLabelDefs,
+			RepoDid:     repoDid,
 		}
 		record := repo.AsRecord()
 
+		cleanupKnot := func() {
+			go func() {
+				delays := []time.Duration{0, 2 * time.Second, 5 * time.Second}
+				for attempt, delay := range delays {
+					time.Sleep(delay)
+					deleteClient, dErr := s.oauth.ServiceClient(
+						r,
+						oauth.WithService(domain),
+						oauth.WithLxm(tangled.RepoDeleteNSID),
+						oauth.WithDev(s.config.Core.Dev),
+					)
+					if dErr != nil {
+						l.Error("failed to create delete client for knot cleanup", "attempt", attempt+1, "err", dErr)
+						continue
+					}
+					ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+					if dErr := tangled.RepoDelete(ctx, deleteClient, &tangled.RepoDelete_Input{
+						Did:  user.Active.Did,
+						Name: repoName,
+						Rkey: rkey,
+					}); dErr != nil {
+						cancel()
+						l.Error("failed to clean up repo on knot after rollback", "attempt", attempt+1, "err", dErr)
+						continue
+					}
+					cancel()
+					l.Info("successfully cleaned up repo on knot after rollback", "attempt", attempt+1)
+					return
+				}
+				l.Error("exhausted retries for knot cleanup, repo may be orphaned",
+					"did", user.Active.Did, "repo", repoName, "knot", domain)
+			}()
+		}
+
 		atpClient, err := s.oauth.AuthorizedClient(r)
 		if err != nil {
 			l.Info("PDS write failed", "err", err)
+			cleanupKnot()
 			s.pages.Notice(w, "repo", "Failed to write record to PDS.")
 			return
 		}
···
 		})
 		if err != nil {
 			l.Info("PDS write failed", "err", err)
+			cleanupKnot()
 			s.pages.Notice(w, "repo", "Failed to announce repository creation.")
 			return
 		}
···
 			return
 		}
 
-		// The rollback function reverts a few things on failure:
-		// - the pending txn
-		// - the ACLs
-		// - the atproto record created
 		rollback := func() {
 			err1 := tx.Rollback()
 			err2 := s.enforcer.E.LoadPolicy()
 			err3 := rollbackRecord(context.Background(), aturi, atpClient)
 
-			// ignore txn complete errors, this is okay
 			if errors.Is(err1, sql.ErrTxDone) {
 				err1 = nil
 			}
 
 			if errs := errors.Join(err1, err2, err3); errs != nil {
 				l.Error("failed to rollback changes", "errs", errs)
-				return
 			}
-		}
-		defer rollback()
 
-		client, err := s.oauth.ServiceClient(
-			r,
-			oauth.WithService(domain),
-			oauth.WithLxm(tangled.RepoCreateNSID),
-			oauth.WithDev(s.config.Core.Dev),
-		)
-		if err != nil {
-			l.Error("service auth failed", "err", err)
-			s.pages.Notice(w, "repo", "Failed to reach PDS.")
-			return
-		}
-
-		xe := tangled.RepoCreate(
-			r.Context(),
-			client,
-			&tangled.RepoCreate_Input{
-				Rkey: rkey,
-			},
-		)
-		if err := xrpcclient.HandleXrpcErr(xe); err != nil {
-			l.Error("xrpc error", "xe", xe)
-			s.pages.Notice(w, "repo", err.Error())
-			return
+			if aturi != "" {
+				cleanupKnot()
+			}
 		}
+		defer rollback()
 
 		err = db.AddRepo(tx, repo)
 		if err != nil {
···
 			return
 		}
 
-		// acls
-		p, _ := securejoin.SecureJoin(user.Active.Did, repoName)
-		err = s.enforcer.AddRepo(user.Active.Did, domain, p)
+		rbacPath := repo.RepoIdentifier()
+		err = s.enforcer.AddRepo(user.Active.Did, domain, rbacPath)
 		if err != nil {
 			l.Error("acl setup failed", "err", err)
 			s.pages.Notice(w, "repo", "Failed to set up repository permissions.")
···
 			return
 		}
 
-		// reset the ATURI because the transaction completed successfully
 		aturi = ""
 
 		s.notifier.NewRepo(r.Context(), repo)
-		s.pages.HxLocation(w, fmt.Sprintf("/%s/%s", user.Active.Did, repoName))
+		if repoDid != "" {
+			s.pages.HxLocation(w, fmt.Sprintf("/%s", repoDid))
+		} else {
+			s.pages.HxLocation(w, fmt.Sprintf("/%s/%s", user.Active.Did, repoName))
+		}
 	}
 }
 

appview/validator/label.go

···
 	// validate permissions: only collaborators can apply labels currently
 	//
 	// TODO: introduce a repo:triage permission
-	ok, err := v.enforcer.IsPushAllowed(labelOp.Did, repo.Knot, repo.DidSlashRepo())
+	ok, err := v.enforcer.IsPushAllowed(labelOp.Did, repo.Knot, repo.RepoIdentifier())
 	if err != nil {
 		return fmt.Errorf("failed to enforce permissions: %w", err)
 	}