everything works now

packages/client/app/components/PostFeed.tsx

···
+import {
+  parseCanonicalResourceUri,
+  type Did,
+  type ResourceUri
+} from '@atcute/lexicons'
 import type { FeedItem } from '@www/lib/post.server'
+import { useRootData } from '@www/lib/useRootData'
 import { Form } from 'react-router'
 
 const postVisibilityLabels: Record<string, string> = {
···
   mentioned: 'Mentioned only'
 }
 
+function atUriToDid(uri: ResourceUri) {
+  const parsedUri = parseCanonicalResourceUri(uri)
+  if (!parsedUri.ok) {
+    throw new Error(`invalid AT uri: ${parsedUri.error}`)
+  }
+  const did = parsedUri.value.repo
+  return did as Did
+}
+
 export default function PostFeed({ feed }: { feed: FeedItem[] }) {
+  const { user } = useRootData()
+  const me = user?.identity.did
+  const isMe = (uri: ResourceUri) => atUriToDid(uri) === me
+
   return (
     <ul className="divide-accent-content">
       {feed.length === 0 ? (
···
           key={post.uri}
           className="relative px-4 py-3 mb-6 border border-neutral rounded-box"
         >
-          <div className="top-1 right-1 absolute">
-            <Form method="POST" className="tooltip" data-tip="Delete">
-              <input type="hidden" name="uri" value={post.uri} />
-              <button
-                name="action"
-                value="delete"
-                className="btn btn-sm btn-square btn-ghost"
-              >
-                <svg
-                  xmlns="http://www.w3.org/2000/svg"
-                  className="h-4 w-4"
-                  fill="none"
-                  viewBox="0 0 24 24"
-                  stroke="currentColor"
+          {isMe(post.uri) ? (
+            <div className="top-1 right-1 absolute">
+              <Form method="POST" className="tooltip" data-tip="Delete">
+                <input type="hidden" name="uri" value={post.uri} />
+                <button
+                  name="action"
+                  value="delete"
+                  className="btn btn-sm btn-square btn-ghost"
                 >
-                  <path
-                    strokeLinecap="round"
-                    strokeLinejoin="round"
-                    strokeWidth={2}
-                    d="M6 18L18 6M6 6l12 12"
-                  />
-                </svg>
-              </button>
-            </Form>
-          </div>
+                  <svg
+                    xmlns="http://www.w3.org/2000/svg"
+                    className="h-4 w-4"
+                    fill="none"
+                    viewBox="0 0 24 24"
+                    stroke="currentColor"
+                  >
+                    <path
+                      strokeLinecap="round"
+                      strokeLinejoin="round"
+                      strokeWidth={2}
+                      d="M6 18L18 6M6 6l12 12"
+                    />
+                  </svg>
+                </button>
+              </Form>
+            </div>
+          ) : null}
           <p className="text-sm mb-2 text-base-content/90">@{post.handle}</p>
           <p className="mb-3 text-base">
             {post.content.contentWarning

packages/client/app/components/UserMenu.tsx

···
         >
           {avatar ? (
             <div className="w-10 rounded-full">
-              <img src={avatar} alt={handle} className="w-10" />
+              <img src={avatar} alt={handle ?? ''} className="w-10" />
             </div>
           ) : (
             <div className="bg-accent text-base-content w-10 rounded-full">
···
           className="menu menu-sm dropdown-content bg-base-100 rounded-box z-10 mt-1 w-52 p-2 shadow"
         >
           <li>
-            <a>Profile</a>
+            <Link to={`/profile/${handle}`}>Your profile</Link>
           </li>
           <li>
-            <Link to="/settings/delegation">Delegation Settings</Link>
+            <Link to="/settings/delegation">Private posts setup</Link>
           </li>
           <li>
             <button onClick={logout}>Logout</button>

packages/client/app/lib/post.server.ts

···
 import type { OAuthSession } from '@atproto/oauth-client-node'
 import type { AtprotoDid as Did, ResourceUri } from '@atcute/lexicons/syntax'
 import { atUriToDid, didToHandle, handleToDid } from './idResolver.server'
+import asyncWrap from './asyncWrap'
 
 type PostPayload = {
   visibility: AppWafrnContentDefs.PrivatePostView['visibility']
···
         visibility: 'public'
       })
     } else if (is(AppWafrnContentDefs.privatePostViewSchema, record)) {
-      try {
-        const plainText = await keyClient.decrypt(
+      const [plainText, error] = await asyncWrap(() =>
+        keyClient.decrypt(
           record.uri,
           `${did}#${record.visibility}`,
           record.encryptedContent,
           record.keyVersion
         )
-        const postContent = JSON.parse(
-          plainText
-        ) as AppWafrnContentDefs.PostContent
+      )
+      let content = {} as AppWafrnContentDefs.PostContent
+      if (error) {
+        console.error(error)
+        const isMe = session.did === did
+        // only show "could not decrypt this post" if it's the user's post
+        if (isMe) {
+          content = {
+            contentMarkdown: 'Could not decrypt this post',
+            contentHTML: 'Could not decrypt this post'
+          }
+        }
+      } else {
+        content = JSON.parse(plainText) as AppWafrnContentDefs.PostContent
+      }
+      if (content.contentMarkdown || content.contentHTML) {
         posts.push({
           $type: 'app.wafrn.content.defs#publicPostView',
           handle,
           uri: record.uri,
-          content: postContent,
-          createdAt: record.createdAt,
-          updatedAt: record.updatedAt,
-          visibility: record.visibility
-        })
-      } catch (error) {
-        console.error('Error decrypting private post:', error)
-        posts.push({
-          $type: 'app.wafrn.content.defs#publicPostView',
-          handle,
-          uri: record.uri,
-          content: {
-            contentMarkdown: 'Could not decrypt this post',
-            contentHTML: 'Could not decrypt this post'
-          },
+          content,
           createdAt: record.createdAt,
           updatedAt: record.updatedAt,
           visibility: record.visibility

packages/client/app/routes/settings.delegation.tsx

···
         delegate_did: env.API_SERVICE_DID,
         permissions: ['add_member', 'remove_member']
       })
-      return data({ success: true, message: 'Server authorized successfully!' })
+      return data({
+        success: true,
+        message:
+          'Private posts enabled! You can now create posts that only your followers can read.'
+      })
     } else if (action === 'revoke') {
       await keyClient.revokeDelegate({
         group_id: groupId,
         delegate_did: env.API_SERVICE_DID
       })
-      return data({ success: true, message: 'Server authorization revoked!' })
+      return data({
+        success: true,
+        message:
+          'Private posts disabled. The server can no longer manage your follower encryption group.'
+      })
     }
   } catch (error) {
     return data(
···
 
   return (
     <div className="px-4 py-6 max-w-3xl mx-auto">
-      <h1 className="text-2xl font-bold mb-3">Delegation Settings</h1>
+      <h1 className="text-2xl font-bold mb-3">Private Post Setup</h1>
 
       <div className="card bg-base-200 shadow-xl mb-4">
         <div className="card-body">
-          <h2 className="card-title">Server Authorization</h2>
+          <h2 className="card-title">
+            Let the server manage your follower encryption
+          </h2>
           <p className="text-sm opacity-70 mb-4">
-            Authorize the application server to manage your follower group on
-            the keyserver. This allows the server to automatically add followers
-            to your encryption group when they follow you.
+            Want to create private posts that only your followers can read?
+            You'll need to authorize the server to manage your follower
+            encryption group. When someone follows you, the server will
+            automatically add them to the group so they can decrypt your private
+            posts. Without this, private posts won't work unless you enable
+            manual follow approval (not implemented yet).
           </p>
 
           <div className="grid grid-cols-2 gap-2 text-sm mb-4">
···
             <div className="font-semibold">Server DID:</div>
             <div className="font-mono text-xs break-all">{apiServiceDid}</div>
 
-            <div className="font-semibold">Status:</div>
+            <div className="font-semibold">Private Posts:</div>
             <div>
               {isAuthorized ? (
-                <span className="badge badge-success">Authorized</span>
+                <span className="badge badge-success">Enabled</span>
               ) : (
-                <span className="badge badge-warning">Not Authorized</span>
+                <span className="badge badge-warning">Disabled</span>
               )}
             </div>
           </div>
 
           {actionData?.message ? (
             <div
-              className={`alert ${actionData.success ? 'alert-success' : 'alert-error'} mb-4`}
+              className={`alert alert-soft ${actionData.success ? 'alert-success' : 'alert-error'} mb-4`}
             >
               {actionData.message}
             </div>
           ) : null}
 
           {error ? (
-            <div className="alert alert-error mb-4">{error.message}</div>
+            <div className="alert alert-soft alert-error mb-4">
+              {error.message}
+            </div>
           ) : null}
 
           <Form method="POST" className="card-actions">
···
                 className="btn btn-warning"
                 type="submit"
               >
-                Revoke Authorization
+                Turn Off (Disable Private Posts)
               </button>
             ) : (
               <button
···
                 className="btn btn-primary"
                 type="submit"
               >
-                Authorize Server
+                Enable Private Posts
               </button>
             )}
           </Form>