Fixed bsky.social OAuth issues, removed old SQL cruft

fly-production.toml

···
   auto_start_machines = true
   min_machines_running = 0
 
+  [http_service.http_options]
+    h2_backend = false
+
 [mounts]
   source = "data"
   destination = "/data"

fly-staging.toml

···
   auto_start_machines = true
   min_machines_running = 1
 
+  [http_service.http_options]
+    h2_backend = false
+
 [mounts]
   source = "data"
   destination = "/data"

internal/atproto/identity.go

···
 }
 
 // FetchAuthServerMeta fetches OAuth authorization server metadata from a PDS.
+// Per the ATProto OAuth spec, the PDS may delegate to a separate authorization server.
+// We discover it via the protected resource metadata if the PDS doesn't host its own.
 func FetchAuthServerMeta(pdsURL string) (*AuthServerMeta, error) {
-	url := strings.TrimRight(pdsURL, "/") + "/.well-known/oauth-authorization-server"
-	resp, err := httpClient.Get(url)
+	base := strings.TrimRight(pdsURL, "/")
+
+	// First try the PDS directly (works for self-hosted PDSes).
+	directURL := base + "/.well-known/oauth-authorization-server"
+	resp, err := httpClient.Get(directURL)
 	if err != nil {
 		return nil, fmt.Errorf("fetch auth server meta from %s: %w", pdsURL, err)
 	}
 	defer resp.Body.Close()
-	if resp.StatusCode != http.StatusOK {
-		return nil, fmt.Errorf("fetch auth server meta from %s: HTTP %d", pdsURL, resp.StatusCode)
+
+	if resp.StatusCode == http.StatusOK {
+		var meta AuthServerMeta
+		if err := json.NewDecoder(resp.Body).Decode(&meta); err != nil {
+			return nil, fmt.Errorf("decode auth server meta: %w", err)
+		}
+		if meta.PushedAuthorizationRequestEndpoint == "" {
+			return nil, fmt.Errorf("auth server at %s does not support PAR", pdsURL)
+		}
+		return &meta, nil
+	}
+	resp.Body.Close()
+
+	// PDS doesn't host its own auth server — discover it via protected resource metadata.
+	prURL := base + "/.well-known/oauth-protected-resource"
+	prResp, err := httpClient.Get(prURL)
+	if err != nil {
+		return nil, fmt.Errorf("fetch protected resource meta from %s: %w", pdsURL, err)
+	}
+	defer prResp.Body.Close()
+	if prResp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("fetch protected resource meta from %s: HTTP %d", pdsURL, prResp.StatusCode)
+	}
+
+	var prMeta struct {
+		AuthorizationServers []string `json:"authorization_servers"`
+	}
+	if err := json.NewDecoder(prResp.Body).Decode(&prMeta); err != nil {
+		return nil, fmt.Errorf("decode protected resource meta: %w", err)
+	}
+	if len(prMeta.AuthorizationServers) == 0 {
+		return nil, fmt.Errorf("no authorization_servers in protected resource meta for %s", pdsURL)
+	}
+
+	authServerURL := strings.TrimRight(prMeta.AuthorizationServers[0], "/")
+	metaURL := authServerURL + "/.well-known/oauth-authorization-server"
+	metaResp, err := httpClient.Get(metaURL)
+	if err != nil {
+		return nil, fmt.Errorf("fetch auth server meta from %s: %w", authServerURL, err)
+	}
+	defer metaResp.Body.Close()
+	if metaResp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("fetch auth server meta from %s: HTTP %d", authServerURL, metaResp.StatusCode)
 	}
 
 	var meta AuthServerMeta
-	if err := json.NewDecoder(resp.Body).Decode(&meta); err != nil {
+	if err := json.NewDecoder(metaResp.Body).Decode(&meta); err != nil {
 		return nil, fmt.Errorf("decode auth server meta: %w", err)
 	}
 	if meta.PushedAuthorizationRequestEndpoint == "" {
-		return nil, fmt.Errorf("auth server at %s does not support PAR", pdsURL)
+		return nil, fmt.Errorf("auth server at %s does not support PAR", authServerURL)
 	}
 	return &meta, nil
 }

internal/atproto/xrpc/client.go

···
 		c.db.UpdateATProtoTokens(c.userID, c.session.AccessToken, c.session.RefreshToken, newNonce, c.session.ExpiresAt)
 	}
 
-	// On 401, refresh token and retry once
+	// On 401, retry once — nonce error just needs the updated nonce, token errors need a refresh.
 	if resp.StatusCode == http.StatusUnauthorized {
+		respBody, _ := io.ReadAll(resp.Body)
 		resp.Body.Close()
-		if err := atproto.RefreshAccessToken(c.db, c.session); err != nil {
-			return nil, fmt.Errorf("refresh after 401: %w", err)
+
+		var errPayload struct {
+			Error string `json:"error"`
+		}
+		json.Unmarshal(respBody, &errPayload)
+
+		if errPayload.Error != "use_dpop_nonce" {
+			// Expired/invalid token — refresh and retry.
+			if err := atproto.RefreshAccessToken(c.db, c.session); err != nil {
+				return nil, fmt.Errorf("refresh after 401: %w", err)
+			}
 		}
+		// For use_dpop_nonce the nonce was already updated above; just retry.
 
-		// Re-read the body if it was provided — caller must handle this
-		// For our use case, body is always a bytes.Reader or nil
 		if body != nil {
 			if seeker, ok := body.(io.Seeker); ok {
 				seeker.Seek(0, io.SeekStart)

internal/handler/handler.go

···
 
 import (
 	"crypto/rand"
+	"encoding/base64"
 	"encoding/hex"
 	"encoding/json"
 	"fmt"
···
 	"strings"
 	"time"
 
-	"github.com/golang-jwt/jwt/v5"
 	"github.com/gorilla/websocket"
 
 	"github.com/limeleaf/diffdown/internal/atproto"
···
 
 	did, name, err := h.validateWSToken(accessToken, dpopProof)
 	if err != nil {
+		log.Printf("CollaboratorWebSocket: token validation failed for rkey %s: %v", rKey, err)
 		http.Error(w, "Invalid tokens", http.StatusUnauthorized)
 		return
 	}
 
 	user, err := h.DB.GetUserByDID(did)
 	if err != nil {
+		log.Printf("CollaboratorWebSocket: user not found for DID %s: %v", did, err)
 		http.Error(w, "No user found", http.StatusUnauthorized)
 		return
 	}
 
 	session, err := h.DB.GetATProtoSession(user.ID)
 	if err != nil || session == nil {
+		log.Printf("CollaboratorWebSocket: no ATProto session for user %s: %v", user.ID, err)
 		http.Error(w, "No ATProto session", http.StatusUnauthorized)
 		return
 	}
···
 		}
 		docClient, err = h.xrpcClient(ownerUser.ID)
 		if err != nil {
+			log.Printf("CollaboratorWebSocket: xrpc client for owner %s: %v", ownerDID, err)
 			http.Error(w, "Failed to connect to owner PDS", http.StatusInternalServerError)
 			return
 		}
···
 	} else {
 		docClient, err = h.xrpcClient(session.UserID)
 		if err != nil {
+			log.Printf("CollaboratorWebSocket: xrpc client for user %s: %v", session.UserID, err)
 			http.Error(w, "Failed to connect to ATProto", http.StatusInternalServerError)
 			return
 		}
···
 
 	value, _, err := docClient.GetRecord(docRepoDID, collectionDocument, rKey)
 	if err != nil {
+		log.Printf("CollaboratorWebSocket: GetRecord %s/%s: %v", docRepoDID, rKey, err)
 		http.Error(w, "Document not found", http.StatusNotFound)
 		return
 	}
 	doc := &model.Document{}
 	if err := json.Unmarshal(value, doc); err != nil {
+		log.Printf("CollaboratorWebSocket: unmarshal doc %s: %v", rKey, err)
 		http.Error(w, "Invalid document", http.StatusInternalServerError)
 		return
 	}
···
 		}
 	}
 	if !isCollaborator {
+		log.Printf("CollaboratorWebSocket: DID %s not a collaborator on %s/%s", did, docRepoDID, rKey)
 		http.Error(w, "Not a collaborator", http.StatusForbidden)
 		return
 	}
···
 	wsClient.ReadPump()
 }
 
-func (h *Handler) validateWSToken(accessToken, dpopProof string) (string, string, error) {
-	claims := &jwt.MapClaims{}
-	parser := jwt.Parser{}
-	_, _, err := parser.ParseUnverified(accessToken, claims)
+func (h *Handler) validateWSToken(accessToken, _ string) (string, string, error) {
+	// ATProto JWTs use ES256K which golang-jwt doesn't register by default.
+	// We only need the sub claim, so decode the payload directly.
+	parts := strings.SplitN(accessToken, ".", 3)
+	if len(parts) != 3 {
+		return "", "", fmt.Errorf("malformed token")
+	}
+	payload, err := base64.RawURLEncoding.DecodeString(parts[1])
 	if err != nil {
-		return "", "", fmt.Errorf("parse token: %w", err)
+		return "", "", fmt.Errorf("decode token payload: %w", err)
+	}
+	var claims map[string]interface{}
+	if err := json.Unmarshal(payload, &claims); err != nil {
+		return "", "", fmt.Errorf("parse token claims: %w", err)
 	}
 
-	did, ok := (*claims)["sub"].(string)
-	if !ok {
+	did, ok := claims["sub"].(string)
+	if !ok || did == "" {
 		return "", "", fmt.Errorf("no sub in token")
 	}
 
···
 		return "", "", fmt.Errorf("session expired")
 	}
 
-	name, _ := (*claims)["name"].(string)
+	name, _ := claims["name"].(string)
 	return did, name, nil
 }
 

migrations/001_baseline.sql

···
+-- 001_baseline.sql
+-- Consolidated baseline schema replacing migrations 001–008.
+
+CREATE TABLE users (
+    id  TEXT PRIMARY KEY,
+    did TEXT UNIQUE NOT NULL
+);
+
+CREATE TABLE atproto_sessions (
+    user_id        TEXT PRIMARY KEY REFERENCES users(id) ON DELETE CASCADE,
+    did            TEXT NOT NULL,
+    pds_url        TEXT NOT NULL,
+    access_token   TEXT NOT NULL,
+    refresh_token  TEXT NOT NULL,
+    dpop_key_jwk   TEXT NOT NULL,
+    dpop_nonce     TEXT DEFAULT '',
+    token_endpoint TEXT NOT NULL,
+    expires_at     DATETIME NOT NULL,
+    updated_at     DATETIME DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE TABLE invites (
+    id             TEXT PRIMARY KEY,
+    document_rkey  TEXT NOT NULL,
+    token          TEXT NOT NULL UNIQUE,
+    created_by_did TEXT NOT NULL,
+    created_at     DATETIME DEFAULT CURRENT_TIMESTAMP,
+    expires_at     DATETIME NOT NULL
+);
+
+CREATE INDEX idx_invites_document ON invites(document_rkey);
+CREATE INDEX idx_invites_token    ON invites(token);
+
+CREATE TABLE doc_steps (
+    id         INTEGER PRIMARY KEY AUTOINCREMENT,
+    doc_rkey   TEXT    NOT NULL,
+    version    INTEGER NOT NULL,
+    step_json  TEXT    NOT NULL,
+    client_id  TEXT    NOT NULL,
+    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+    UNIQUE(doc_rkey, version)
+);
+
+CREATE INDEX idx_doc_steps_rkey_version ON doc_steps(doc_rkey, version);
+
+CREATE TABLE collaborations (
+    collaborator_did TEXT NOT NULL,
+    owner_did        TEXT NOT NULL,
+    document_rkey    TEXT NOT NULL,
+    added_at         DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    PRIMARY KEY (collaborator_did, owner_did, document_rkey)
+);
+
+CREATE INDEX idx_collaborations_did_added ON collaborations(collaborator_did, added_at DESC);

migrations/001_initial.sql

···
--- 001_initial.sql
-
-CREATE TABLE IF NOT EXISTS users (
-    id TEXT PRIMARY KEY,
-    name TEXT NOT NULL,
-    email TEXT UNIQUE NOT NULL,
-    password_hash TEXT,
-    avatar_url TEXT DEFAULT '',
-    oauth_provider TEXT,
-    oauth_id TEXT,
-    created_at DATETIME DEFAULT CURRENT_TIMESTAMP
-);
-
-CREATE UNIQUE INDEX IF NOT EXISTS idx_users_oauth ON users(oauth_provider, oauth_id)
-    WHERE oauth_provider IS NOT NULL;
-
-CREATE TABLE IF NOT EXISTS repos (
-    id TEXT PRIMARY KEY,
-    name TEXT NOT NULL,
-    slug TEXT NOT NULL,
-    description TEXT DEFAULT '',
-    owner_id TEXT NOT NULL REFERENCES users(id),
-    visibility TEXT DEFAULT 'private' CHECK(visibility IN ('private','public','unlisted')),
-    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
-    updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
-);
-
-CREATE UNIQUE INDEX IF NOT EXISTS idx_repos_owner_slug ON repos(owner_id, slug);
-
-CREATE TABLE IF NOT EXISTS repo_collaborators (
-    repo_id TEXT NOT NULL REFERENCES repos(id) ON DELETE CASCADE,
-    user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
-    role TEXT NOT NULL DEFAULT 'viewer' CHECK(role IN ('owner','editor','commenter','viewer')),
-    PRIMARY KEY (repo_id, user_id)
-);
-
-CREATE TABLE IF NOT EXISTS files (
-    id TEXT PRIMARY KEY,
-    repo_id TEXT NOT NULL REFERENCES repos(id) ON DELETE CASCADE,
-    path TEXT NOT NULL,
-    content TEXT DEFAULT '',
-    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
-    updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
-);
-
-CREATE UNIQUE INDEX IF NOT EXISTS idx_files_repo_path ON files(repo_id, path);
-
-CREATE TABLE IF NOT EXISTS versions (
-    id TEXT PRIMARY KEY,
-    file_id TEXT NOT NULL REFERENCES files(id) ON DELETE CASCADE,
-    content TEXT NOT NULL,
-    author_id TEXT NOT NULL REFERENCES users(id),
-    message TEXT DEFAULT '',
-    created_at DATETIME DEFAULT CURRENT_TIMESTAMP
-);
-
-CREATE INDEX IF NOT EXISTS idx_versions_file ON versions(file_id, created_at DESC);
-
-CREATE TABLE IF NOT EXISTS comments (
-    id TEXT PRIMARY KEY,
-    file_id TEXT NOT NULL REFERENCES files(id) ON DELETE CASCADE,
-    version_id TEXT REFERENCES versions(id),
-    line_start INTEGER NOT NULL,
-    line_end INTEGER NOT NULL,
-    content_hash TEXT DEFAULT '',
-    body TEXT NOT NULL,
-    author_id TEXT NOT NULL REFERENCES users(id),
-    parent_id TEXT REFERENCES comments(id),
-    resolved INTEGER DEFAULT 0,
-    created_at DATETIME DEFAULT CURRENT_TIMESTAMP
-);
-
-CREATE INDEX IF NOT EXISTS idx_comments_file ON comments(file_id);

migrations/002_add_did.sql

···
--- 002_add_did.sql
-ALTER TABLE users ADD COLUMN did TEXT;
-CREATE UNIQUE INDEX IF NOT EXISTS idx_users_did ON users(did) WHERE did IS NOT NULL;

migrations/003_atproto_sessions.sql

···
-CREATE TABLE IF NOT EXISTS atproto_sessions (
-    user_id TEXT PRIMARY KEY REFERENCES users(id) ON DELETE CASCADE,
-    did TEXT NOT NULL,
-    pds_url TEXT NOT NULL,
-    access_token TEXT NOT NULL,
-    refresh_token TEXT NOT NULL,
-    dpop_key_jwk TEXT NOT NULL,
-    dpop_nonce TEXT DEFAULT '',
-    token_endpoint TEXT NOT NULL,
-    expires_at DATETIME NOT NULL,
-    updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
-);
-
-ALTER TABLE users ADD COLUMN pds_url TEXT DEFAULT '';

migrations/004_drop_content_tables.sql

···
-DROP TABLE IF EXISTS comments;
-DROP TABLE IF EXISTS versions;
-DROP TABLE IF EXISTS files;
-DROP TABLE IF EXISTS repo_collaborators;
-DROP TABLE IF EXISTS repos;

migrations/005_create_invites.sql

···
--- 005_create_invites.sql
-
-CREATE TABLE IF NOT EXISTS invites (
-    id TEXT PRIMARY KEY,
-    document_rkey TEXT NOT NULL,
-    token TEXT NOT NULL UNIQUE,
-    created_by_did TEXT NOT NULL,
-    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
-    expires_at DATETIME NOT NULL
-);
-
-CREATE INDEX IF NOT EXISTS idx_invites_document ON invites(document_rkey);
-CREATE INDEX IF NOT EXISTS idx_invites_token ON invites(token);

migrations/006_doc_steps.sql

···
--- migrations/006_doc_steps.sql
-CREATE TABLE IF NOT EXISTS doc_steps (
-    id        INTEGER PRIMARY KEY AUTOINCREMENT,
-    doc_rkey  TEXT    NOT NULL,
-    version   INTEGER NOT NULL,
-    step_json TEXT    NOT NULL,
-    client_id TEXT    NOT NULL,
-    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
-    UNIQUE(doc_rkey, version)
-);
-
-CREATE INDEX IF NOT EXISTS idx_doc_steps_rkey_version ON doc_steps(doc_rkey, version);

migrations/007_stateless_users.sql

···
--- 007_stateless_users.sql
--- Remove cached profile data, make auth stateless
-
--- Recreate users table with minimal data (DID only)
--- We need to preserve existing data, so we'll create new table and migrate
-
-CREATE TABLE users_new (
-    id  TEXT PRIMARY KEY,
-    did TEXT UNIQUE NOT NULL
-);
-
--- Migrate existing users - copy only id and did
-INSERT INTO users_new (id, did)
-SELECT id, COALESCE(did, email) as did
-FROM users
-WHERE did IS NOT NULL OR email LIKE 'did:%';
-
--- Drop old users table
-DROP TABLE users;
-
--- Rename new table
-ALTER TABLE users_new RENAME TO users;
-
--- Note: We keep atproto_sessions as-is since it stores the OAuth tokens
--- needed to authenticate with the user's PDS at runtime

migrations/008_collaborations.sql

···
-CREATE TABLE IF NOT EXISTS collaborations (
-    collaborator_did TEXT NOT NULL,
-    owner_did        TEXT NOT NULL,
-    document_rkey    TEXT NOT NULL,
-    added_at         DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    PRIMARY KEY (collaborator_did, owner_did, document_rkey)
-);
-
-CREATE INDEX IF NOT EXISTS idx_collaborations_did_added
-    ON collaborations (collaborator_did, added_at DESC);

templates/about.html

···
         </div>
         <div class="about-col">
             <h2>Status</h2>
-            <p>As I said, I am not an engineer. My goal was to create something simple that worked, and I achieved that. But 95% of Diffdown was written by <a href="https://en.wikipedia.org/wiki/Large_language_model">LLMs</a>. I am not qualified to assess the security or robustness of the code and don't claim that it is production quality. I would <em>like</em> it to be, so <a href="https://tangled.org/diffdown.com/diffdown-app/">contributors are welcome</a>!</p>
+            <p>As I said, I am not an engineer. My goal was to create something simple that worked, and I achieved that. But 95% of Diffdown was written by <a href="https://en.wikipedia.org/wiki/Large_language_model">LLMs</a>. I am not qualified to assess the security or robustness of the code and don't claim that it is production quality. I would <em>like</em> it to be, so <a href="https://tangled.org/diffdown.com/diffdown-app/">contributions from real engineers are welcome</a>!</p>
             <p>Functionally, the app is alpha quality, at best. Expect bugs, flakiness, breaking changes, and limited features.</p>
             <p>The good news is that any documents you create will be stored on your AT Proto PDS, so even if Diffdown goes away, you will still have your documents and comments.</p>
             <p><strong class="warning">Important:</strong> Because AT Proto does not support private records (<a href="https://atproto.wiki/en/working-groups/private-data">yet</a>), any documents you create will be visible to the world (not on diffdown.com, but with a PDS record viewer, <a href="https://atproto.at/viewer?uri=did:plc:za4vlvbizdstoym7lpymc5q5/com.diffdown.document/3mhg62vlznz24">see this example</a>).</p>