feat: add ATProto identity resolution (handle→DID→PDS→auth meta)

internal/atproto/identity.go

···
+package atproto
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"strings"
+	"time"
+)
+
+var httpClient = &http.Client{Timeout: 10 * time.Second}
+
+// ResolveHandle resolves a Bluesky handle (e.g. "alice.bsky.social") to a DID.
+// It tries DNS TXT first, then HTTP well-known fallback.
+func ResolveHandle(handle string) (string, error) {
+	handle = strings.TrimPrefix(handle, "@")
+
+	// Try DNS TXT: _atproto.<handle> → "did=<did>"
+	txts, err := net.LookupTXT("_atproto." + handle)
+	if err == nil {
+		for _, txt := range txts {
+			if strings.HasPrefix(txt, "did=") {
+				return strings.TrimPrefix(txt, "did="), nil
+			}
+		}
+	}
+
+	// Fallback: HTTPS GET https://<handle>/.well-known/atproto-did
+	resp, err := httpClient.Get("https://" + handle + "/.well-known/atproto-did")
+	if err != nil {
+		return "", fmt.Errorf("resolve handle %s: %w", handle, err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return "", fmt.Errorf("resolve handle %s: HTTP %d", handle, resp.StatusCode)
+	}
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return "", err
+	}
+	did := strings.TrimSpace(string(body))
+	if !strings.HasPrefix(did, "did:") {
+		return "", fmt.Errorf("resolve handle %s: invalid DID response: %q", handle, did)
+	}
+	return did, nil
+}
+
+// DIDDocument is the minimal structure we need from a DID document.
+type DIDDocument struct {
+	Service []struct {
+		ID              string `json:"id"`
+		Type            string `json:"type"`
+		ServiceEndpoint string `json:"serviceEndpoint"`
+	} `json:"service"`
+}
+
+// ResolvePDS resolves a DID to the PDS (Personal Data Server) URL.
+func ResolvePDS(did string) (string, error) {
+	var docURL string
+	switch {
+	case strings.HasPrefix(did, "did:plc:"):
+		docURL = "https://plc.directory/" + did
+	case strings.HasPrefix(did, "did:web:"):
+		host := strings.TrimPrefix(did, "did:web:")
+		docURL = "https://" + host + "/.well-known/did.json"
+	default:
+		return "", fmt.Errorf("unsupported DID method: %s", did)
+	}
+
+	resp, err := httpClient.Get(docURL)
+	if err != nil {
+		return "", fmt.Errorf("fetch DID doc for %s: %w", did, err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return "", fmt.Errorf("fetch DID doc for %s: HTTP %d", did, resp.StatusCode)
+	}
+
+	var doc DIDDocument
+	if err := json.NewDecoder(resp.Body).Decode(&doc); err != nil {
+		return "", fmt.Errorf("decode DID doc: %w", err)
+	}
+
+	for _, svc := range doc.Service {
+		if svc.ID == "#atproto_pds" {
+			return svc.ServiceEndpoint, nil
+		}
+	}
+	return "", fmt.Errorf("no #atproto_pds service in DID doc for %s", did)
+}
+
+// AuthServerMeta holds the OAuth authorization server metadata fields we need.
+type AuthServerMeta struct {
+	Issuer                             string `json:"issuer"`
+	AuthorizationEndpoint              string `json:"authorization_endpoint"`
+	TokenEndpoint                      string `json:"token_endpoint"`
+	PushedAuthorizationRequestEndpoint string `json:"pushed_authorization_request_endpoint"`
+}
+
+// FetchAuthServerMeta fetches OAuth authorization server metadata from a PDS.
+func FetchAuthServerMeta(pdsURL string) (*AuthServerMeta, error) {
+	url := strings.TrimRight(pdsURL, "/") + "/.well-known/oauth-authorization-server"
+	resp, err := httpClient.Get(url)
+	if err != nil {
+		return nil, fmt.Errorf("fetch auth server meta from %s: %w", pdsURL, err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("fetch auth server meta from %s: HTTP %d", pdsURL, resp.StatusCode)
+	}
+
+	var meta AuthServerMeta
+	if err := json.NewDecoder(resp.Body).Decode(&meta); err != nil {
+		return nil, fmt.Errorf("decode auth server meta: %w", err)
+	}
+	if meta.PushedAuthorizationRequestEndpoint == "" {
+		return nil, fmt.Errorf("auth server at %s does not support PAR", pdsURL)
+	}
+	return &meta, nil
+}