Show ATProto handle and avatar in nav and presence

- Fix handle display in navbar: resolve handle from DID document
(alsoKnownAs field) instead of calling app.bsky.actor.getProfile
against the PDS, which doesn't serve AppView queries
- Fix avatar fetch: call public.api.bsky.app AppView instead of the
user's PDS for app.bsky.actor.getProfile
- Pass handle and avatar to collaboration presence: shown as tooltip
and avatar image on presence dots, falling back to colored circle
when no avatar is available

Co-Authored-By: Claude Sonnet 4.6 <[e-mail]>

internal/atproto/identity.go

···
 
 // DIDDocument is the minimal structure we need from a DID document.
 type DIDDocument struct {
-	Service []struct {
+	AlsoKnownAs []string `json:"alsoKnownAs"`
+	Service     []struct {
 		ID              string `json:"id"`
 		Type            string `json:"type"`
 		ServiceEndpoint string `json:"serviceEndpoint"`
 	} `json:"service"`
 }
 
-// ResolvePDS resolves a DID to the PDS (Personal Data Server) URL.
-func ResolvePDS(did string) (string, error) {
+// HandleFromDIDDoc extracts the AT Protocol handle from a DID document's alsoKnownAs field.
+// Returns empty string if no handle is found.
+func HandleFromDIDDoc(doc *DIDDocument) string {
+	for _, aka := range doc.AlsoKnownAs {
+		if strings.HasPrefix(aka, "at://") {
+			return strings.TrimPrefix(aka, "at://")
+		}
+	}
+	return ""
+}
+
+// ResolveDIDDoc fetches and parses the DID document for a given DID.
+func ResolveDIDDoc(did string) (*DIDDocument, error) {
 	var docURL string
 	switch {
 	case strings.HasPrefix(did, "did:plc:"):
···
 		host := strings.TrimPrefix(did, "did:web:")
 		docURL = "https://" + host + "/.well-known/did.json"
 	default:
-		return "", fmt.Errorf("unsupported DID method: %s", did)
+		return nil, fmt.Errorf("unsupported DID method: %s", did)
 	}
 
 	resp, err := httpClient.Get(docURL)
 	if err != nil {
-		return "", fmt.Errorf("fetch DID doc for %s: %w", did, err)
+		return nil, fmt.Errorf("fetch DID doc for %s: %w", did, err)
 	}
 	defer resp.Body.Close()
 	if resp.StatusCode != http.StatusOK {
-		return "", fmt.Errorf("fetch DID doc for %s: HTTP %d", did, resp.StatusCode)
+		return nil, fmt.Errorf("fetch DID doc for %s: HTTP %d", did, resp.StatusCode)
 	}
 
 	var doc DIDDocument
 	if err := json.NewDecoder(resp.Body).Decode(&doc); err != nil {
-		return "", fmt.Errorf("decode DID doc: %w", err)
+		return nil, fmt.Errorf("decode DID doc: %w", err)
+	}
+	return &doc, nil
+}
+
+// ResolvePDS resolves a DID to the PDS (Personal Data Server) URL.
+func ResolvePDS(did string) (string, error) {
+	doc, err := ResolveDIDDoc(did)
+	if err != nil {
+		return "", err
 	}
 
 	for _, svc := range doc.Service {
···
 		}
 	}
 	return "", fmt.Errorf("no #atproto_pds service in DID doc for %s", did)
+}
+
+// ResolveHandle resolves a DID to the AT Protocol handle via the DID document.
+func ResolveHandleFromDID(did string) (string, error) {
+	doc, err := ResolveDIDDoc(did)
+	if err != nil {
+		return "", err
+	}
+	handle := HandleFromDIDDoc(doc)
+	if handle == "" {
+		return "", fmt.Errorf("no handle found in DID doc for %s", did)
+	}
+	return handle, nil
 }
 
 // AuthServerMeta holds the OAuth authorization server metadata fields we need.

internal/atproto/profile.go

···
+package atproto
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+)
+
+// Profile holds resolved ATProto profile information fetched at runtime
+type Profile struct {
+	DID         string `json:"did"`
+	Handle      string `json:"handle"`
+	DisplayName string `json:"displayName"`
+	Avatar      string `json:"avatar"`
+	PDSURL      string `json:"pdsUrl"`
+}
+
+const bskyAppViewURL = "https://public.api.bsky.app"
+
+// ResolveProfile fetches a user's profile from the Bluesky public AppView.
+func ResolveProfile(did string) (*Profile, error) {
+	url := fmt.Sprintf("%s/xrpc/app.bsky.actor.getProfile?actor=%s", bskyAppViewURL, did)
+
+	resp, err := httpClient.Get(url)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("profile fetch failed: %d", resp.StatusCode)
+	}
+
+	var result struct {
+		DID         string `json:"did"`
+		Handle      string `json:"handle"`
+		DisplayName string `json:"displayName"`
+		Avatar      string `json:"avatar"`
+	}
+
+	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
+		return nil, err
+	}
+
+	return &Profile{
+		DID:         result.DID,
+		Handle:      result.Handle,
+		DisplayName: result.DisplayName,
+		Avatar:      result.Avatar,
+	}, nil
+}
+
+// GetDisplayName returns the best available name for a user
+func (p *Profile) GetDisplayName() string {
+	if p.DisplayName != "" {
+		return p.DisplayName
+	}
+	if p.Handle != "" && p.Handle != p.DID {
+		return p.Handle
+	}
+	return p.DID
+}

internal/collaboration/client.go

···
 	send    chan []byte
 	DID     string
 	Name    string
+	Handle  string
 	Color   string
+	Avatar  string
 	roomKey string
 }
 
···
 }
 
 type PresenceUser struct {
-	DID   string `json:"did"`
-	Name  string `json:"name"`
-	Color string `json:"color"`
+	DID    string `json:"did"`
+	Name   string `json:"name"`
+	Handle string `json:"handle,omitempty"`
+	Color  string `json:"color"`
+	Avatar string `json:"avatar,omitempty"`
 }
 
 type PresenceMessage struct {
···
 	Users []PresenceUser `json:"users"`
 }
 
-func NewClient(hub *Hub, conn *websocket.Conn, did, name, color, roomKey string) *Client {
+func NewClient(hub *Hub, conn *websocket.Conn, did, name, handle, color, avatar, roomKey string) *Client {
 	return &Client{
 		hub:     hub,
 		conn:    conn,
 		send:    make(chan []byte, 256),
 		DID:     did,
 		Name:    name,
+		Handle:  handle,
 		Color:   color,
+		Avatar:  avatar,
 		roomKey: roomKey,
 	}
 }

internal/collaboration/hub.go

···
 	users := make([]PresenceUser, 0, len(r.clients))
 	for client := range r.clients {
 		users = append(users, PresenceUser{
-			DID:   client.DID,
-			Name:  client.Name,
-			Color: client.Color,
+			DID:    client.DID,
+			Name:   client.Name,
+			Handle: client.Handle,
+			Color:  client.Color,
+			Avatar: client.Avatar,
 		})
 	}
 	return users

internal/handler/handler.go

···
 	"github.com/golang-jwt/jwt/v5"
 	"github.com/gorilla/websocket"
 
+	"github.com/limeleaf/diffdown/internal/atproto"
 	"github.com/limeleaf/diffdown/internal/atproto/xrpc"
 	"github.com/limeleaf/diffdown/internal/auth"
 	"github.com/limeleaf/diffdown/internal/collaboration"
···
 type PageData struct {
 	Title       string
 	User        *model.User
+	UserHandle  string
 	Content     interface{}
 	Error       string
 	Description string
···
 	OwnerDID string
 }
 
-func (h *Handler) currentUser(r *http.Request) *model.User {
+func (h *Handler) currentUser(r *http.Request) (*model.User, string) {
 	uid := auth.UserIDFromContext(r.Context())
 	if uid == "" {
-		return nil
+		return nil, ""
 	}
 	u, err := h.DB.GetUserByID(uid)
 	if err != nil {
-		return nil
+		return nil, ""
 	}
-	return u
+	session, err := h.DB.GetATProtoSession(uid)
+	if err == nil && session != nil && session.DID != "" {
+		handle, err := atproto.ResolveHandleFromDID(session.DID)
+		if err == nil && handle != "" {
+			return u, handle
+		}
+		return u, session.DID
+	}
+	return u, u.DID
 }
 
 func (h *Handler) render(w http.ResponseWriter, name string, data PageData) {
···
 
 // --- Auth handlers ---
 
-func (h *Handler) LoginPage(w http.ResponseWriter, r *http.Request) {
-	h.render(w, "login.html", PageData{Title: "Log In"})
-}
-
-func (h *Handler) LoginSubmit(w http.ResponseWriter, r *http.Request) {
-	email := strings.TrimSpace(r.FormValue("email"))
-	password := r.FormValue("password")
-
-	user, err := h.DB.GetUserByEmail(email)
-	if err != nil || user.PasswordHash == nil || !auth.CheckPassword(*user.PasswordHash, password) {
-		h.render(w, "login.html", PageData{Title: "Log In", Error: "Invalid email or password"})
-		return
-	}
-
-	auth.SetUserID(w, r, user.ID)
-	http.Redirect(w, r, "/", http.StatusSeeOther)
-}
-
-func (h *Handler) RegisterPage(w http.ResponseWriter, r *http.Request) {
-	h.render(w, "register.html", PageData{Title: "Sign Up"})
-}
-
-func (h *Handler) RegisterSubmit(w http.ResponseWriter, r *http.Request) {
-	name := strings.TrimSpace(r.FormValue("name"))
-	email := strings.TrimSpace(r.FormValue("email"))
-	password := r.FormValue("password")
-
-	if name == "" || email == "" || len(password) < 8 {
-		h.render(w, "register.html", PageData{Title: "Sign Up", Error: "Name, email required. Password min 8 chars."})
-		return
-	}
-
-	hash, err := auth.HashPassword(password)
-	if err != nil {
-		h.render(w, "register.html", PageData{Title: "Sign Up", Error: "Server error"})
-		return
-	}
-
-	user := &model.User{
-		Name:         name,
-		Email:        email,
-		PasswordHash: &hash,
-	}
-	if err := h.DB.CreateUser(user); err != nil {
-		h.render(w, "register.html", PageData{Title: "Sign Up", Error: "Email already registered"})
-		return
-	}
-
-	auth.SetUserID(w, r, user.ID)
-	http.Redirect(w, r, "/", http.StatusSeeOther)
-}
-
 func (h *Handler) Logout(w http.ResponseWriter, r *http.Request) {
 	auth.ClearSession(w, r)
 	http.Redirect(w, r, "/", http.StatusSeeOther)
···
 // --- Page handlers ---
 
 func (h *Handler) AboutPage(w http.ResponseWriter, r *http.Request) {
-	user := h.currentUser(r)
+	user, userHandle := h.currentUser(r)
 	h.render(w, "about.html", PageData{
-		Title: "About",
-		User:  user,
+		Title:      "About",
+		User:       user,
+		UserHandle: userHandle,
 	})
 }
 
 // --- Dashboard ---
 
 func (h *Handler) Dashboard(w http.ResponseWriter, r *http.Request) {
-	user := h.currentUser(r)
+	user, userHandle := h.currentUser(r)
 	if user == nil {
 		h.render(w, "landing.html", PageData{Title: "Diffdown"})
 		return
···
 	if err != nil {
 		log.Printf("Dashboard: xrpc client: %v", err)
 		h.render(w, "documents.html", PageData{
-			Title:   "Documents",
-			User:    user,
-			Content: []*model.Document{},
+			Title:      "Documents",
+			User:       user,
+			UserHandle: userHandle,
+			Content:    []*model.Document{},
 		})
 		return
 	}
···
 	if err != nil {
 		log.Printf("Dashboard: list records: %v", err)
 		h.render(w, "documents.html", PageData{
-			Title:   "Documents",
-			User:    user,
-			Content: []*model.Document{},
+			Title:      "Documents",
+			User:       user,
+			UserHandle: userHandle,
+			Content:    []*model.Document{},
 		})
 		return
 	}
···
 	}
 
 	h.render(w, "documents.html", PageData{
-		Title:   "Documents",
-		User:    user,
-		Content: docs,
+		Title:      "Documents",
+		User:       user,
+		UserHandle: userHandle,
+		Content:    docs,
 	})
 }
 
 // --- Document handlers ---
 
 func (h *Handler) NewDocumentPage(w http.ResponseWriter, r *http.Request) {
-	user := h.currentUser(r)
+	user, userHandle := h.currentUser(r)
 	if user == nil {
 		http.Redirect(w, r, "/auth/atproto", http.StatusSeeOther)
 		return
 	}
-	h.render(w, "new_document.html", PageData{Title: "New Document", User: user})
+	h.render(w, "new_document.html", PageData{
+		Title:      "New Document",
+		User:       user,
+		UserHandle: userHandle,
+	})
 }
 
 // stripMarkdown removes basic markdown syntax to produce plain text for textContent.
···
 }
 
 func (h *Handler) NewDocumentSubmit(w http.ResponseWriter, r *http.Request) {
-	user := h.currentUser(r)
+	user, _ := h.currentUser(r)
 	if user == nil {
 		http.Redirect(w, r, "/auth/atproto", http.StatusSeeOther)
 		return
···
 // documentView is the shared implementation for viewing a document given an ownerDID and rkey.
 // isOwner should be true when the current user owns the document; it suppresses the ownerDID
 // in the template so the edit button links to /docs/{rkey}/edit rather than the collaborator URL.
-func (h *Handler) documentView(w http.ResponseWriter, r *http.Request, ownerUserID, ownerDID, rkey string, isOwner bool) {
+func (h *Handler) documentView(w http.ResponseWriter, r *http.Request, ownerUserID, ownerDID, rkey string, isOwner bool, userHandle string) {
 	client, err := h.xrpcClient(ownerUserID)
 	if err != nil {
 		http.Error(w, "Could not connect to PDS", 500)
···
 		rendered, _ = render.Markdown([]byte(doc.Content.Text.RawMarkdown))
 	}
 
-	user := h.currentUser(r)
+	user, _ := h.currentUser(r)
 	type DocumentViewData struct {
 		Doc      *model.Document
 		Rendered template.HTML
···
 		templateOwnerDID = ""
 	}
 	h.render(w, "document_view.html", PageData{
-		Title:   doc.Title,
-		User:    user,
-		Content: DocumentViewData{Doc: doc, Rendered: template.HTML(rendered), OwnerDID: templateOwnerDID},
+		Title:      doc.Title,
+		User:       user,
+		UserHandle: userHandle,
+		Content:    DocumentViewData{Doc: doc, Rendered: template.HTML(rendered), OwnerDID: templateOwnerDID},
 	})
 }
 
 // DocumentView renders a document as HTML (owner viewing their own doc).
 func (h *Handler) DocumentView(w http.ResponseWriter, r *http.Request) {
-	user := h.currentUser(r)
+	user, userHandle := h.currentUser(r)
 	if user == nil {
 		http.Redirect(w, r, "/auth/atproto", http.StatusSeeOther)
 		return
···
 		http.Error(w, "Could not connect to PDS", 500)
 		return
 	}
-	h.documentView(w, r, user.ID, client.DID(), rkey, true)
+	h.documentView(w, r, user.ID, client.DID(), rkey, true, userHandle)
 }
 
 // CollaboratorDocumentView renders a document owned by another user (collaborator access).
 func (h *Handler) CollaboratorDocumentView(w http.ResponseWriter, r *http.Request) {
-	user := h.currentUser(r)
+	user, userHandle := h.currentUser(r)
 	if user == nil {
 		http.Redirect(w, r, "/auth/atproto", http.StatusSeeOther)
 		return
···
 		return
 	}
 
-	h.documentView(w, r, ownerUser.ID, ownerDID, rkey, false)
+	h.documentView(w, r, ownerUser.ID, ownerDID, rkey, false, userHandle)
 }
 
 // documentEdit is the shared implementation for the edit page.
 // ownerUserID/ownerDID identify whose PDS holds the document; isOwner is true for the creator.
-func (h *Handler) documentEdit(w http.ResponseWriter, r *http.Request, user *model.User, ownerUserID, ownerDID, rkey string, isOwner bool) {
+func (h *Handler) documentEdit(w http.ResponseWriter, r *http.Request, user *model.User, ownerUserID, ownerDID, rkey string, isOwner bool, userHandle string) {
 	ownerClient, err := h.xrpcClient(ownerUserID)
 	if err != nil {
 		http.Error(w, "Could not connect to PDS", 500)
···
 	}
 
 	h.render(w, "document_edit.html", PageData{
-		Title:   "Edit " + doc.Title,
-		User:    user,
-		Content: editData,
+		Title:      "Edit " + doc.Title,
+		User:       user,
+		UserHandle: userHandle,
+		Content:    editData,
 	})
 }
 
 // DocumentEdit renders the editor for a document (owner).
 func (h *Handler) DocumentEdit(w http.ResponseWriter, r *http.Request) {
-	user := h.currentUser(r)
+	user, userHandle := h.currentUser(r)
 	if user == nil {
 		http.Redirect(w, r, "/auth/atproto", http.StatusSeeOther)
 		return
···
 		return
 	}
 
-	h.documentEdit(w, r, user, user.ID, client.DID(), rkey, true)
+	h.documentEdit(w, r, user, user.ID, client.DID(), rkey, true, userHandle)
 }
 
 // CollaboratorDocumentEdit renders the editor for a document owned by another user.
 func (h *Handler) CollaboratorDocumentEdit(w http.ResponseWriter, r *http.Request) {
-	user := h.currentUser(r)
+	user, userHandle := h.currentUser(r)
 	if user == nil {
 		http.Redirect(w, r, "/auth/atproto", http.StatusSeeOther)
 		return
···
 		return
 	}
 
-	h.documentEdit(w, r, user, ownerUser.ID, ownerDID, rkey, false)
+	h.documentEdit(w, r, user, ownerUser.ID, ownerDID, rkey, false, userHandle)
 }
 
 // APIDocumentSave saves a document to the PDS.
 func (h *Handler) APIDocumentSave(w http.ResponseWriter, r *http.Request) {
-	user := h.currentUser(r)
+	user, _ := h.currentUser(r)
 	if user == nil {
 		http.Error(w, "Unauthorized", 401)
 		return
···
 
 // APIDocumentDelete deletes a document from the PDS.
 func (h *Handler) APIDocumentDelete(w http.ResponseWriter, r *http.Request) {
-	user := h.currentUser(r)
+	user, _ := h.currentUser(r)
 	if user == nil {
 		http.Error(w, "Unauthorized", 401)
 		return
···
 
 // DocumentInvite creates an invite link for a document.
 func (h *Handler) DocumentInvite(w http.ResponseWriter, r *http.Request) {
-	user := h.currentUser(r)
+	user, _ := h.currentUser(r)
 	if user == nil {
-		http.Redirect(w, r, "/auth/login", http.StatusSeeOther)
+		http.Redirect(w, r, "/auth/atproto", http.StatusSeeOther)
 		return
 	}
 
···
 
 // AcceptInvite handles an invite acceptance.
 func (h *Handler) AcceptInvite(w http.ResponseWriter, r *http.Request) {
-	user := h.currentUser(r)
+	user, _ := h.currentUser(r)
 	if user == nil {
 		// Preserve invite token through the login redirect.
-		http.Redirect(w, r, "/auth/login?next="+url.QueryEscape(r.URL.String()), http.StatusSeeOther)
+		http.Redirect(w, r, "/auth/atproto?next="+url.QueryEscape(r.URL.String()), http.StatusSeeOther)
 		return
 	}
 
···
 // --- API: Comments ---
 
 func (h *Handler) CommentCreate(w http.ResponseWriter, r *http.Request) {
-	user := h.currentUser(r)
+	user, _ := h.currentUser(r)
 	if user == nil {
 		http.Error(w, "Unauthorized", http.StatusUnauthorized)
 		return
···
 		return
 	}
 
-	user := h.currentUser(r)
+	user, _ := h.currentUser(r)
 	if user == nil {
 		http.Error(w, "Unauthorized", http.StatusUnauthorized)
 		return
···
 
 	color := colorFromDID(did)
 
+	// Fetch handle and avatar from ATProto profile; best-effort, empty on failure.
+	var avatar, handle string
+	if profile, err := atproto.ResolveProfile(did); err == nil && profile != nil {
+		avatar = profile.Avatar
+		handle = profile.Handle
+	}
+
 	conn, err := upgrader.Upgrade(w, r, nil)
 	if err != nil {
 		log.Printf("WebSocket upgrade failed: %v", err)
···
 	}
 
 	room := h.CollaborationHub.GetOrCreateRoom(rKey)
-	wsClient := collaboration.NewClient(h.CollaborationHub, conn, did, name, color, rKey)
+	wsClient := collaboration.NewClient(h.CollaborationHub, conn, did, name, handle, color, avatar, rKey)
 	room.RegisterClient(wsClient)
 
 	go wsClient.WritePump()
···
 // Response 200: {"version": N}
 // Response 409: {"version": N, "steps": ["...json..."]} — client must rebase
 func (h *Handler) SubmitSteps(w http.ResponseWriter, r *http.Request) {
-	user := h.currentUser(r)
+	user, _ := h.currentUser(r)
 	if user == nil {
 		http.Error(w, "Unauthorized", http.StatusUnauthorized)
 		return
···
 // GET /api/docs/{rkey}/steps?since={v}
 // Response 200: {"version": N, "steps": ["...json..."]}
 func (h *Handler) GetSteps(w http.ResponseWriter, r *http.Request) {
-	user := h.currentUser(r)
+	user, _ := h.currentUser(r)
 	if user == nil {
 		http.Error(w, "Unauthorized", http.StatusUnauthorized)
 		return

static/css/editor.css

···
     box-shadow: 0 0 0 1px var(--border);
     flex-shrink: 0;
     transition: transform 0.15s;
+    object-fit: cover;
 }
 
 .presence-avatar:hover {

templates/document_edit.html

···
     function updatePresence(users) {
         const list = document.getElementById('presence-list');
         if (!list) return;
-        list.innerHTML = users.map(u => `
-            <span class="presence-avatar" style="background:${u.color}" title="${escHtml(u.name || u.did)}"></span>
-        `).join('');
+        list.innerHTML = users.map(u => {
+            const label = escHtml(u.handle || u.name || u.did);
+            if (u.avatar) {
+                return `<img class="presence-avatar" src="${escHtml(u.avatar)}" title="${label}" alt="${label}">`;
+            }
+            return `<span class="presence-avatar" style="background:${u.color}" title="${label}"></span>`;
+        }).join('');
     }
 
     function escHtml(str) {