evan.jarrett.net
+27
.air.toml
+27
.air.toml
···
···
1
+
root = "."
2
+
tmp_dir = "tmp"
3
+
4
+
[build]
5
+
# Pre-build: generate assets if missing (each string is a shell command)
6
+
pre_cmd = ["[ -f pkg/appview/static/js/htmx.min.js ] || go generate ./..."]
7
+
cmd = "go build -buildvcs=false -o ./tmp/atcr-appview ./cmd/appview"
8
+
entrypoint = ["./tmp/atcr-appview", "serve"]
9
+
include_ext = ["go", "html", "css", "js"]
10
+
exclude_dir = ["bin", "tmp", "vendor", "deploy", "docs", ".git", "dist"]
11
+
exclude_regex = ["_test\\.go$"]
12
+
delay = 1000
13
+
stop_on_error = true
14
+
send_interrupt = true
15
+
kill_delay = 500
16
+
17
+
[log]
18
+
time = false
19
+
20
+
[color]
21
+
main = "cyan"
22
+
watcher = "magenta"
23
+
build = "yellow"
24
+
runner = "green"
25
+
26
+
[misc]
27
+
clean_on_exit = true
+7
-2
.env.hold.example
+7
-2
.env.hold.example
···
29
AWS_SECRET_ACCESS_KEY=your_secret_key
30
31
# S3 Region
32
-
# Examples: us-east-1, us-west-2, eu-west-1
33
-
# For UpCloud: us-chi1, us-nyc1, de-fra1, uk-lon1, sg-sin1
34
# Default: us-east-1
35
AWS_REGION=us-east-1
36
···
60
# Writes (pushes) always require crew membership via PDS
61
# Default: false
62
HOLD_PUBLIC=false
63
64
# ==============================================================================
65
# Embedded PDS Configuration
···
29
AWS_SECRET_ACCESS_KEY=your_secret_key
30
31
# S3 Region
32
+
# For third-party S3 providers, this is ignored when S3_ENDPOINT is set,
33
+
# but must be a valid AWS region (e.g., us-east-1) to pass validation.
34
# Default: us-east-1
35
AWS_REGION=us-east-1
36
···
60
# Writes (pushes) always require crew membership via PDS
61
# Default: false
62
HOLD_PUBLIC=false
63
+
64
+
# ATProto relay endpoint for requesting crawl on startup
65
+
# This makes the hold's embedded PDS discoverable by the relay network
66
+
# Default: https://bsky.network (set to empty string to disable)
67
+
# HOLD_RELAY_ENDPOINT=https://bsky.network
68
69
# ==============================================================================
70
# Embedded PDS Configuration
+1
.gitignore
+1
.gitignore
-23
.tangled/workflows/loom-amd64.yml
-23
.tangled/workflows/loom-amd64.yml
···
1
-
when:
2
-
- event: ["push"]
3
-
branch: ["*"]
4
-
- event: ["pull_request"]
5
-
branch: ["main"]
6
-
7
-
engine: kubernetes
8
-
image: golang:1.24-bookworm
9
-
architecture: amd64
10
-
11
-
steps:
12
-
- name: Download and Generate
13
-
environment:
14
-
CGO_ENABLED: 1
15
-
command: |
16
-
go mod download
17
-
go generate ./...
18
-
19
-
- name: Run Tests
20
-
environment:
21
-
CGO_ENABLED: 1
22
-
command: |
23
-
go test -cover ./...
···
-23
.tangled/workflows/loom-arm64.yml
-23
.tangled/workflows/loom-arm64.yml
···
1
-
when:
2
-
- event: ["push"]
3
-
branch: ["*"]
4
-
- event: ["pull_request"]
5
-
branch: ["main"]
6
-
7
-
engine: kubernetes
8
-
image: golang:1.24-bookworm
9
-
architecture: arm64
10
-
11
-
steps:
12
-
- name: Download and Generate
13
-
environment:
14
-
CGO_ENABLED: 1
15
-
command: |
16
-
go mod download
17
-
go generate ./...
18
-
19
-
- name: Run Tests
20
-
environment:
21
-
CGO_ENABLED: 1
22
-
command: |
23
-
go test -cover ./...
···
+15
-57
.tangled/workflows/release.yml
+15
-57
.tangled/workflows/release.yml
···
5
- event: ["push"]
6
tag: ["v*"]
7
8
-
engine: "buildah"
9
10
environment:
11
IMAGE_REGISTRY: atcr.io
12
-
IMAGE_USER: evan.jarrett.net
13
14
steps:
15
-
- name: Get tag for current commit
16
-
command: |
17
-
#test
18
-
# Fetch tags (shallow clone doesn't include them by default)
19
-
git fetch --tags
20
-
21
-
# Find the tag that points to the current commit
22
-
TAG=$(git tag --points-at HEAD | grep -E '^v[0-9]' | head -n1)
23
-
24
-
if [ -z "$TAG" ]; then
25
-
echo "Error: No version tag found for current commit"
26
-
echo "Available tags:"
27
-
git tag
28
-
echo "Current commit:"
29
-
git rev-parse HEAD
30
-
exit 1
31
-
fi
32
-
33
-
echo "Building version: $TAG"
34
-
echo "$TAG" > .version
35
-
36
-
- name: Setup registry credentials
37
command: |
38
-
mkdir -p ~/.docker
39
-
cat > ~/.docker/config.json <<EOF
40
-
{
41
-
"auths": {
42
-
"${IMAGE_REGISTRY}": {
43
-
"auth": "$(echo -n "${IMAGE_USER}:${APP_PASSWORD}" | base64)"
44
-
}
45
-
}
46
-
}
47
-
EOF
48
-
chmod 600 ~/.docker/config.json
49
50
- name: Build and push AppView image
51
command: |
52
-
TAG=$(cat .version)
53
-
54
buildah bud \
55
-
--storage-driver vfs \
56
-
--tag ${IMAGE_REGISTRY}/${IMAGE_USER}/atcr-appview:${TAG} \
57
-
--tag ${IMAGE_REGISTRY}/${IMAGE_USER}/atcr-appview:latest \
58
--file ./Dockerfile.appview \
59
.
60
61
buildah push \
62
-
--storage-driver vfs \
63
-
${IMAGE_REGISTRY}/${IMAGE_USER}/atcr-appview:${TAG}
64
-
65
-
buildah push \
66
-
--storage-driver vfs \
67
-
${IMAGE_REGISTRY}/${IMAGE_USER}/atcr-appview:latest
68
69
- name: Build and push Hold image
70
command: |
71
-
TAG=$(cat .version)
72
-
73
buildah bud \
74
-
--storage-driver vfs \
75
-
--tag ${IMAGE_REGISTRY}/${IMAGE_USER}/atcr-hold:${TAG} \
76
-
--tag ${IMAGE_REGISTRY}/${IMAGE_USER}/atcr-hold:latest \
77
--file ./Dockerfile.hold \
78
.
79
80
buildah push \
81
-
--storage-driver vfs \
82
-
${IMAGE_REGISTRY}/${IMAGE_USER}/atcr-hold:${TAG}
83
-
84
-
buildah push \
85
-
--storage-driver vfs \
86
-
${IMAGE_REGISTRY}/${IMAGE_USER}/atcr-hold:latest
···
5
- event: ["push"]
6
tag: ["v*"]
7
8
+
engine: kubernetes
9
+
image: quay.io/buildah/stable:latest
10
+
architecture: amd64
11
12
environment:
13
IMAGE_REGISTRY: atcr.io
14
+
IMAGE_USER: atcr.io
15
16
steps:
17
+
- name: Login to registry
18
command: |
19
+
echo "${APP_PASSWORD}" | buildah login \
20
+
-u "${IMAGE_USER}" \
21
+
--password-stdin \
22
+
${IMAGE_REGISTRY}
23
24
- name: Build and push AppView image
25
command: |
26
buildah bud \
27
+
--tag ${IMAGE_REGISTRY}/${IMAGE_USER}/appview:${TANGLED_REF_NAME} \
28
+
--tag ${IMAGE_REGISTRY}/${IMAGE_USER}/appview:latest \
29
--file ./Dockerfile.appview \
30
.
31
32
buildah push \
33
+
${IMAGE_REGISTRY}/${IMAGE_USER}/appview:latest
34
35
- name: Build and push Hold image
36
command: |
37
buildah bud \
38
+
--tag ${IMAGE_REGISTRY}/${IMAGE_USER}/hold:${TANGLED_REF_NAME} \
39
+
--tag ${IMAGE_REGISTRY}/${IMAGE_USER}/hold:latest \
40
--file ./Dockerfile.hold \
41
.
42
43
buildah push \
44
+
${IMAGE_REGISTRY}/${IMAGE_USER}/hold:latest
+7
-9
.tangled/workflows/tests.yml
+7
-9
.tangled/workflows/tests.yml
···
1
when:
2
- event: ["push"]
3
+
branch: ["*"]
4
+
- event: ["pull_request"]
5
+
branch: ["main"]
6
7
+
engine: kubernetes
8
+
image: golang:1.25-trixie
9
+
architecture: amd64
10
11
steps:
12
- name: Download and Generate
···
20
environment:
21
CGO_ENABLED: 1
22
command: |
23
+
go test -cover ./...
+36
-1
CLAUDE.md
+36
-1
CLAUDE.md
···
475
476
Read access:
477
- **Public hold** (`HOLD_PUBLIC=true`): Anonymous + all authenticated users
478
-
- **Private hold** (`HOLD_PUBLIC=false`): Requires authentication + crew membership with blob:read permission
479
480
Write access:
481
- Hold owner OR crew members with blob:write permission
482
- Verified via `io.atcr.hold.crew` records in hold's embedded PDS
483
484
**Embedded PDS Endpoints** (`pkg/hold/pds/xrpc.go`):
485
···
475
476
Read access:
477
- **Public hold** (`HOLD_PUBLIC=true`): Anonymous + all authenticated users
478
+
- **Private hold** (`HOLD_PUBLIC=false`): Requires authentication + crew membership with blob:read OR blob:write permission
479
+
- **Note:** `blob:write` implicitly grants `blob:read` access (can't push without pulling)
480
481
Write access:
482
- Hold owner OR crew members with blob:write permission
483
- Verified via `io.atcr.hold.crew` records in hold's embedded PDS
484
+
485
+
**Permission Matrix:**
486
+
487
+
| User Type | Public Read | Private Read | Write | Crew Admin |
488
+
|-----------|-------------|--------------|-------|------------|
489
+
| Anonymous | Yes | No | No | No |
490
+
| Owner (captain) | Yes | Yes | Yes | Yes (implied) |
491
+
| Crew (blob:read only) | Yes | Yes | No | No |
492
+
| Crew (blob:write only) | Yes | Yes* | Yes | No |
493
+
| Crew (blob:read + blob:write) | Yes | Yes | Yes | No |
494
+
| Crew (crew:admin) | Yes | Yes | Yes | Yes |
495
+
| Authenticated non-crew | Yes | No | No | No |
496
+
497
+
*`blob:write` implicitly grants `blob:read` access
498
+
499
+
**Authorization Error Format:**
500
+
501
+
All authorization failures use consistent structured errors (`pkg/hold/pds/auth.go`):
502
+
```
503
+
access denied for [action]: [reason] (required: [permission(s)])
504
+
```
505
+
506
+
Examples:
507
+
- `access denied for blob:read: user is not a crew member (required: blob:read or blob:write)`
508
+
- `access denied for blob:write: crew member lacks permission (required: blob:write)`
509
+
- `access denied for crew:admin: user is not a crew member (required: crew:admin)`
510
+
511
+
**Shared Error Constants** (`pkg/hold/pds/auth.go`):
512
+
- `ErrMissingAuthHeader` - Missing Authorization header
513
+
- `ErrInvalidAuthFormat` - Invalid Authorization header format
514
+
- `ErrInvalidAuthScheme` - Invalid scheme (expected Bearer or DPoP)
515
+
- `ErrInvalidJWTFormat` - Malformed JWT
516
+
- `ErrMissingISSClaim` / `ErrMissingSubClaim` - Missing JWT claims
517
+
- `ErrTokenExpired` - Token has expired
518
519
**Embedded PDS Endpoints** (`pkg/hold/pds/xrpc.go`):
520
+13
-15
Dockerfile.appview
+13
-15
Dockerfile.appview
···
1
-
FROM docker.io/golang:1.25.2-trixie AS builder
2
3
RUN apt-get update && \
4
-
apt-get install -y --no-install-recommends sqlite3 libsqlite3-dev && \
5
rm -rf /var/lib/apt/lists/*
6
7
-
WORKDIR /build
8
9
COPY go.mod go.sum ./
10
RUN go mod download
···
18
-trimpath \
19
-o atcr-appview ./cmd/appview
20
21
-
# ==========================================
22
-
# Stage 2: Minimal FROM scratch runtime
23
-
# ==========================================
24
FROM scratch
25
-
# Copy CA certificates for HTTPS (PDS, Jetstream, relay connections)
26
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
27
-
# Copy timezone data for timestamp formatting
28
COPY --from=builder /usr/share/zoneinfo /usr/share/zoneinfo
29
-
# Copy optimized binary (SQLite embedded)
30
-
COPY --from=builder /build/atcr-appview /atcr-appview
31
32
-
# Expose ports
33
EXPOSE 5000
34
35
-
# OCI image annotations
36
LABEL org.opencontainers.image.title="ATCR AppView" \
37
org.opencontainers.image.description="ATProto Container Registry - OCI-compliant registry using AT Protocol for manifest storage" \
38
org.opencontainers.image.authors="ATCR Contributors" \
39
-
org.opencontainers.image.source="https://tangled.org/@evan.jarrett.net/at-container-registry" \
40
-
org.opencontainers.image.documentation="https://tangled.org/@evan.jarrett.net/at-container-registry" \
41
org.opencontainers.image.licenses="MIT" \
42
org.opencontainers.image.version="0.1.0" \
43
io.atcr.icon="https://imgs.blue/evan.jarrett.net/1TpTNrRelfloN2emuWZDrWmPT0o93bAjEnozjD6UPgoVV9m4" \
44
-
io.atcr.readme="https://tangled.org/@evan.jarrett.net/at-container-registry/raw/main/docs/appview.md"
45
46
ENTRYPOINT ["/atcr-appview"]
47
CMD ["serve"]
···
1
+
# Production build for ATCR AppView
2
+
# Result: ~30MB scratch image with static binary
3
+
FROM docker.io/golang:1.25.4-trixie AS builder
4
+
5
+
ENV DEBIAN_FRONTEND=noninteractive
6
7
RUN apt-get update && \
8
+
apt-get install -y --no-install-recommends libsqlite3-dev && \
9
rm -rf /var/lib/apt/lists/*
10
11
+
WORKDIR /app
12
13
COPY go.mod go.sum ./
14
RUN go mod download
···
22
-trimpath \
23
-o atcr-appview ./cmd/appview
24
25
+
# Minimal runtime
26
FROM scratch
27
+
28
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
29
COPY --from=builder /usr/share/zoneinfo /usr/share/zoneinfo
30
+
COPY --from=builder /app/atcr-appview /atcr-appview
31
32
EXPOSE 5000
33
34
LABEL org.opencontainers.image.title="ATCR AppView" \
35
org.opencontainers.image.description="ATProto Container Registry - OCI-compliant registry using AT Protocol for manifest storage" \
36
org.opencontainers.image.authors="ATCR Contributors" \
37
+
org.opencontainers.image.source="https://tangled.org/evan.jarrett.net/at-container-registry" \
38
+
org.opencontainers.image.documentation="https://tangled.org/evan.jarrett.net/at-container-registry" \
39
org.opencontainers.image.licenses="MIT" \
40
org.opencontainers.image.version="0.1.0" \
41
io.atcr.icon="https://imgs.blue/evan.jarrett.net/1TpTNrRelfloN2emuWZDrWmPT0o93bAjEnozjD6UPgoVV9m4" \
42
+
io.atcr.readme="https://tangled.org/evan.jarrett.net/at-container-registry/raw/main/docs/appview.md"
43
44
ENTRYPOINT ["/atcr-appview"]
45
CMD ["serve"]
+21
Dockerfile.dev
+21
Dockerfile.dev
···
···
1
+
# Development image with Air hot reload
2
+
# Build: docker build -f Dockerfile.dev -t atcr-appview-dev .
3
+
# Run: docker run -v $(pwd):/app -p 5000:5000 atcr-appview-dev
4
+
FROM docker.io/golang:1.25.4-trixie
5
+
6
+
ENV DEBIAN_FRONTEND=noninteractive
7
+
8
+
RUN apt-get update && \
9
+
apt-get install -y --no-install-recommends sqlite3 libsqlite3-dev curl && \
10
+
rm -rf /var/lib/apt/lists/* && \
11
+
go install github.com/air-verse/air@latest
12
+
13
+
WORKDIR /app
14
+
15
+
# Copy go.mod first for layer caching
16
+
COPY go.mod go.sum ./
17
+
RUN go mod download
18
+
19
+
# For development: source mounted as volume, Air handles builds
20
+
EXPOSE 5000
21
+
CMD ["air", "-c", ".air.toml"]
+6
-4
Dockerfile.hold
+6
-4
Dockerfile.hold
···
1
-
FROM docker.io/golang:1.25.2-trixie AS builder
2
3
RUN apt-get update && \
4
apt-get install -y --no-install-recommends sqlite3 libsqlite3-dev && \
···
36
LABEL org.opencontainers.image.title="ATCR Hold Service" \
37
org.opencontainers.image.description="ATCR Hold Service - Bring Your Own Storage component for ATCR" \
38
org.opencontainers.image.authors="ATCR Contributors" \
39
-
org.opencontainers.image.source="https://tangled.org/@evan.jarrett.net/at-container-registry" \
40
-
org.opencontainers.image.documentation="https://tangled.org/@evan.jarrett.net/at-container-registry" \
41
org.opencontainers.image.licenses="MIT" \
42
org.opencontainers.image.version="0.1.0" \
43
io.atcr.icon="https://imgs.blue/evan.jarrett.net/1TpTOdtS60GdJWBYEqtK22y688jajbQ9a5kbYRFtwuqrkBAE" \
44
-
io.atcr.readme="https://tangled.org/@evan.jarrett.net/at-container-registry/raw/main/docs/hold.md"
45
46
ENTRYPOINT ["/atcr-hold"]
···
1
+
FROM docker.io/golang:1.25.4-trixie AS builder
2
+
3
+
ENV DEBIAN_FRONTEND=noninteractive
4
5
RUN apt-get update && \
6
apt-get install -y --no-install-recommends sqlite3 libsqlite3-dev && \
···
38
LABEL org.opencontainers.image.title="ATCR Hold Service" \
39
org.opencontainers.image.description="ATCR Hold Service - Bring Your Own Storage component for ATCR" \
40
org.opencontainers.image.authors="ATCR Contributors" \
41
+
org.opencontainers.image.source="https://tangled.org/evan.jarrett.net/at-container-registry" \
42
+
org.opencontainers.image.documentation="https://tangled.org/evan.jarrett.net/at-container-registry" \
43
org.opencontainers.image.licenses="MIT" \
44
org.opencontainers.image.version="0.1.0" \
45
io.atcr.icon="https://imgs.blue/evan.jarrett.net/1TpTOdtS60GdJWBYEqtK22y688jajbQ9a5kbYRFtwuqrkBAE" \
46
+
io.atcr.readme="https://tangled.org/evan.jarrett.net/at-container-registry/raw/main/docs/hold.md"
47
48
ENTRYPOINT ["/atcr-hold"]
+36
-1
Makefile
+36
-1
Makefile
···
2
# Build targets for the ATProto Container Registry
3
4
.PHONY: all build build-appview build-hold build-credential-helper build-oauth-helper \
5
-
generate test test-race test-verbose lint clean help
6
7
.DEFAULT_GOAL := help
8
···
72
lint: check-golangci-lint ## Run golangci-lint
73
@echo "โ Running golangci-lint..."
74
golangci-lint run ./...
75
76
##@ Utility Targets
77
···
2
# Build targets for the ATProto Container Registry
3
4
.PHONY: all build build-appview build-hold build-credential-helper build-oauth-helper \
5
+
generate test test-race test-verbose lint clean help install-credential-helper \
6
+
develop develop-detached develop-down dev
7
8
.DEFAULT_GOAL := help
9
···
73
lint: check-golangci-lint ## Run golangci-lint
74
@echo "โ Running golangci-lint..."
75
golangci-lint run ./...
76
+
77
+
##@ Install Targets
78
+
79
+
install-credential-helper: build-credential-helper ## Install credential helper to /usr/local/sbin
80
+
@echo "โ Installing credential helper to /usr/local/sbin..."
81
+
install -m 755 bin/docker-credential-atcr /usr/local/sbin/docker-credential-atcr
82
+
@echo "โ Installed docker-credential-atcr to /usr/local/sbin/"
83
+
84
+
##@ Development Targets
85
+
86
+
dev: $(GENERATED_ASSETS) ## Run AppView locally with Air hot reload
87
+
@which air > /dev/null || (echo "โ Installing Air..." && go install github.com/air-verse/air@latest)
88
+
air -c .air.toml
89
+
90
+
##@ Docker Targets
91
+
92
+
develop: ## Build and start docker-compose with Air hot reload
93
+
@echo "โ Building Docker images..."
94
+
docker-compose build
95
+
@echo "โ Starting docker-compose with hot reload..."
96
+
docker-compose up
97
+
98
+
develop-detached: ## Build and start docker-compose with hot reload (detached)
99
+
@echo "โ Building Docker images..."
100
+
docker-compose build
101
+
@echo "โ Starting docker-compose with hot reload (detached)..."
102
+
docker-compose up -d
103
+
@echo "โ Services started in background with hot reload"
104
+
@echo " AppView: http://localhost:5000"
105
+
@echo " Hold: http://localhost:8080"
106
+
107
+
develop-down: ## Stop docker-compose services
108
+
@echo "โ Stopping docker-compose..."
109
+
docker-compose down
110
111
##@ Utility Targets
112
+59
-85
cmd/appview/serve.go
+59
-85
cmd/appview/serve.go
···
14
"syscall"
15
"time"
16
17
-
"github.com/bluesky-social/indigo/atproto/syntax"
18
"github.com/distribution/distribution/v3/registry"
19
"github.com/distribution/distribution/v3/registry/handlers"
20
"github.com/spf13/cobra"
···
83
slog.Info("Initializing hold health checker", "cache_ttl", cfg.Health.CacheTTL)
84
healthChecker := holdhealth.NewChecker(cfg.Health.CacheTTL)
85
86
-
// Initialize README cache
87
-
slog.Info("Initializing README cache", "cache_ttl", cfg.Health.ReadmeCacheTTL)
88
-
readmeCache := readme.NewCache(uiDatabase, cfg.Health.ReadmeCacheTTL)
89
90
// Start background health check worker
91
startupDelay := 5 * time.Second // Wait for hold services to start (Docker compose)
···
152
middleware.SetGlobalRefresher(refresher)
153
154
// Set global database for pull/push metrics tracking
155
-
metricsDB := db.NewMetricsDB(uiDatabase)
156
-
middleware.SetGlobalDatabase(metricsDB)
157
158
// Create RemoteHoldAuthorizer for hold authorization with caching
159
holdAuthorizer := auth.NewRemoteHoldAuthorizer(uiDatabase, testMode)
160
middleware.SetGlobalAuthorizer(holdAuthorizer)
161
slog.Info("Hold authorizer initialized with database caching")
162
163
-
// Set global readme cache for middleware
164
-
middleware.SetGlobalReadmeCache(readmeCache)
165
-
slog.Info("README cache initialized for manifest push refresh")
166
-
167
// Initialize Jetstream workers (background services before HTTP routes)
168
-
initializeJetstream(uiDatabase, &cfg.Jetstream, defaultHoldDID, testMode)
169
170
// Create main chi router
171
mainRouter := chi.NewRouter()
···
186
} else {
187
// Register UI routes with dependencies
188
routes.RegisterUIRoutes(mainRouter, routes.UIDependencies{
189
-
Database: uiDatabase,
190
-
ReadOnlyDB: uiReadOnlyDB,
191
-
SessionStore: uiSessionStore,
192
OAuthClientApp: oauthClientApp,
193
-
OAuthStore: oauthStore,
194
-
Refresher: refresher,
195
-
BaseURL: baseURL,
196
-
DeviceStore: deviceStore,
197
-
HealthChecker: healthChecker,
198
-
ReadmeCache: readmeCache,
199
-
Templates: uiTemplates,
200
})
201
}
202
}
···
215
oauthServer.SetPostAuthCallback(func(ctx context.Context, did, handle, pdsEndpoint, sessionID string) error {
216
slog.Debug("OAuth post-auth callback", "component", "appview/callback", "did", did)
217
218
-
// Parse DID for session resume
219
-
didParsed, err := syntax.ParseDID(did)
220
-
if err != nil {
221
-
slog.Warn("Failed to parse DID", "component", "appview/callback", "did", did, "error", err)
222
-
return nil // Non-fatal
223
-
}
224
225
-
// Resume OAuth session to get authenticated client
226
-
session, err := oauthClientApp.ResumeSession(ctx, didParsed, sessionID)
227
-
if err != nil {
228
-
slog.Warn("Failed to resume session", "component", "appview/callback", "did", did, "error", err)
229
-
// Fallback: update user without avatar
230
-
_ = db.UpsertUser(uiDatabase, &db.User{
231
-
DID: did,
232
-
Handle: handle,
233
-
PDSEndpoint: pdsEndpoint,
234
-
Avatar: "",
235
-
LastSeen: time.Now(),
236
-
})
237
-
return nil // Non-fatal
238
-
}
239
-
240
-
// Create authenticated atproto client using the indigo session's API client
241
-
client := atproto.NewClientWithIndigoClient(pdsEndpoint, did, session.APIClient())
242
-
243
-
// Ensure sailor profile exists (creates with default hold if configured)
244
-
slog.Debug("Ensuring profile exists", "component", "appview/callback", "did", did, "default_hold_did", defaultHoldDID)
245
-
if err := storage.EnsureProfile(ctx, client, defaultHoldDID); err != nil {
246
-
slog.Warn("Failed to ensure profile", "component", "appview/callback", "did", did, "error", err)
247
-
// Continue anyway - profile creation is not critical for avatar fetch
248
-
} else {
249
-
slog.Debug("Profile ensured", "component", "appview/callback", "did", did)
250
-
}
251
252
// Fetch user's profile record from PDS (contains blob references)
253
profileRecord, err := client.GetProfileRecord(ctx, did)
···
298
return nil // Non-fatal
299
}
300
301
-
var holdDID string
302
if profile != nil && profile.DefaultHold != "" {
303
// Check if defaultHold is a URL (needs migration)
304
if strings.HasPrefix(profile.DefaultHold, "http://") || strings.HasPrefix(profile.DefaultHold, "https://") {
···
314
} else {
315
slog.Debug("Updated profile with hold DID", "component", "appview/callback", "hold_did", holdDID)
316
}
317
-
} else {
318
-
// Already a DID - use it
319
-
holdDID = profile.DefaultHold
320
}
321
-
// Register crew regardless of migration (outside the migration block)
322
-
// Run in background to avoid blocking OAuth callback if hold is offline
323
-
// Use background context - don't inherit request context which gets canceled on response
324
-
slog.Debug("Attempting crew registration", "component", "appview/callback", "did", did, "hold_did", holdDID)
325
-
go func(client *atproto.Client, refresher *oauth.Refresher, holdDID string) {
326
-
ctx := context.Background()
327
-
storage.EnsureCrewMembership(ctx, client, refresher, holdDID)
328
-
}(client, refresher, holdDID)
329
-
330
}
331
332
return nil // All errors are non-fatal, logged for debugging
···
348
ctx := context.Background()
349
app := handlers.NewApp(ctx, cfg.Distribution)
350
351
// Mount registry at /v2/
352
-
mainRouter.Handle("/v2/*", app)
353
354
// Mount static files if UI is enabled
355
if uiSessionStore != nil && uiTemplates != nil {
···
384
mainRouter.Get("/auth/oauth/callback", oauthServer.ServeCallback)
385
386
// OAuth client metadata endpoint
387
-
mainRouter.Get("/client-metadata.json", func(w http.ResponseWriter, r *http.Request) {
388
config := oauthClientApp.Config
389
metadata := config.ClientMetadata()
390
···
416
417
w.Header().Set("Content-Type", "application/json")
418
w.Header().Set("Access-Control-Allow-Origin", "*")
419
if err := json.NewEncoder(w).Encode(metadataMap); err != nil {
420
http.Error(w, "Failed to encode metadata", http.StatusInternalServerError)
421
}
···
428
// Basic Auth token endpoint (supports device secrets and app passwords)
429
tokenHandler := token.NewHandler(issuer, deviceStore)
430
431
-
// Register token post-auth callback for profile management
432
-
// This decouples the token package from AppView-specific dependencies
433
tokenHandler.SetPostAuthCallback(func(ctx context.Context, did, handle, pdsEndpoint, accessToken string) error {
434
slog.Debug("Token post-auth callback", "component", "appview/callback", "did", did)
435
-
436
-
// Create ATProto client with validated token
437
-
atprotoClient := atproto.NewClient(pdsEndpoint, did, accessToken)
438
-
439
-
// Ensure profile exists (will create with default hold if not exists and default is configured)
440
-
if err := storage.EnsureProfile(ctx, atprotoClient, defaultHoldDID); err != nil {
441
-
// Log error but don't fail auth - profile management is not critical
442
-
slog.Warn("Failed to ensure profile", "component", "appview/callback", "did", did, "error", err)
443
-
} else {
444
-
slog.Debug("Profile ensured with default hold", "component", "appview/callback", "did", did, "default_hold_did", defaultHoldDID)
445
-
}
446
-
447
-
return nil // All errors are non-fatal
448
})
449
450
mainRouter.Get("/auth/token", tokenHandler.ServeHTTP)
···
467
"oauth_metadata", "/client-metadata.json")
468
}
469
470
// Create HTTP server
471
server := &http.Server{
472
Addr: cfg.Server.Addr,
···
521
}
522
523
// initializeJetstream initializes the Jetstream workers for real-time events and backfill
524
-
func initializeJetstream(database *sql.DB, jetstreamCfg *appview.JetstreamConfig, defaultHoldDID string, testMode bool) {
525
// Start Jetstream worker
526
jetstreamURL := jetstreamCfg.URL
527
···
545
// Get relay endpoint for sync API (defaults to Bluesky's relay)
546
relayEndpoint := jetstreamCfg.RelayEndpoint
547
548
-
backfillWorker, err := jetstream.NewBackfillWorker(database, relayEndpoint, defaultHoldDID, testMode)
549
if err != nil {
550
slog.Warn("Failed to create backfill worker", "component", "jetstream/backfill", "error", err)
551
} else {
···
14
"syscall"
15
"time"
16
17
"github.com/distribution/distribution/v3/registry"
18
"github.com/distribution/distribution/v3/registry/handlers"
19
"github.com/spf13/cobra"
···
82
slog.Info("Initializing hold health checker", "cache_ttl", cfg.Health.CacheTTL)
83
healthChecker := holdhealth.NewChecker(cfg.Health.CacheTTL)
84
85
+
// Initialize README fetcher for rendering repo page descriptions
86
+
readmeFetcher := readme.NewFetcher()
87
88
// Start background health check worker
89
startupDelay := 5 * time.Second // Wait for hold services to start (Docker compose)
···
150
middleware.SetGlobalRefresher(refresher)
151
152
// Set global database for pull/push metrics tracking
153
+
middleware.SetGlobalDatabase(uiDatabase)
154
155
// Create RemoteHoldAuthorizer for hold authorization with caching
156
holdAuthorizer := auth.NewRemoteHoldAuthorizer(uiDatabase, testMode)
157
middleware.SetGlobalAuthorizer(holdAuthorizer)
158
slog.Info("Hold authorizer initialized with database caching")
159
160
// Initialize Jetstream workers (background services before HTTP routes)
161
+
initializeJetstream(uiDatabase, &cfg.Jetstream, defaultHoldDID, testMode, refresher)
162
163
// Create main chi router
164
mainRouter := chi.NewRouter()
···
179
} else {
180
// Register UI routes with dependencies
181
routes.RegisterUIRoutes(mainRouter, routes.UIDependencies{
182
+
Database: uiDatabase,
183
+
ReadOnlyDB: uiReadOnlyDB,
184
+
SessionStore: uiSessionStore,
185
OAuthClientApp: oauthClientApp,
186
+
OAuthStore: oauthStore,
187
+
Refresher: refresher,
188
+
BaseURL: baseURL,
189
+
DeviceStore: deviceStore,
190
+
HealthChecker: healthChecker,
191
+
ReadmeFetcher: readmeFetcher,
192
+
Templates: uiTemplates,
193
+
DefaultHoldDID: defaultHoldDID,
194
})
195
}
196
}
···
209
oauthServer.SetPostAuthCallback(func(ctx context.Context, did, handle, pdsEndpoint, sessionID string) error {
210
slog.Debug("OAuth post-auth callback", "component", "appview/callback", "did", did)
211
212
+
// Create ATProto client with session provider (uses DoWithSession for DPoP nonce safety)
213
+
client := atproto.NewClientWithSessionProvider(pdsEndpoint, did, refresher)
214
215
+
// Note: Profile and crew setup now happen automatically via UserContext.EnsureUserSetup()
216
217
// Fetch user's profile record from PDS (contains blob references)
218
profileRecord, err := client.GetProfileRecord(ctx, did)
···
263
return nil // Non-fatal
264
}
265
266
+
// Migrate profile URLโDID if needed (legacy migration, crew registration now handled by UserContext)
267
if profile != nil && profile.DefaultHold != "" {
268
// Check if defaultHold is a URL (needs migration)
269
if strings.HasPrefix(profile.DefaultHold, "http://") || strings.HasPrefix(profile.DefaultHold, "https://") {
···
279
} else {
280
slog.Debug("Updated profile with hold DID", "component", "appview/callback", "hold_did", holdDID)
281
}
282
}
283
}
284
285
return nil // All errors are non-fatal, logged for debugging
···
301
ctx := context.Background()
302
app := handlers.NewApp(ctx, cfg.Distribution)
303
304
+
// Wrap registry app with middleware chain:
305
+
// 1. ExtractAuthMethod - extracts auth method from JWT and stores in context
306
+
// 2. UserContextMiddleware - builds UserContext with identity, permissions, service tokens
307
+
wrappedApp := middleware.ExtractAuthMethod(app)
308
+
309
+
// Create dependencies for UserContextMiddleware
310
+
userContextDeps := &auth.Dependencies{
311
+
Refresher: refresher,
312
+
Authorizer: holdAuthorizer,
313
+
DefaultHoldDID: defaultHoldDID,
314
+
}
315
+
wrappedApp = middleware.UserContextMiddleware(userContextDeps)(wrappedApp)
316
+
317
// Mount registry at /v2/
318
+
mainRouter.Handle("/v2/*", wrappedApp)
319
320
// Mount static files if UI is enabled
321
if uiSessionStore != nil && uiTemplates != nil {
···
350
mainRouter.Get("/auth/oauth/callback", oauthServer.ServeCallback)
351
352
// OAuth client metadata endpoint
353
+
mainRouter.Get("/oauth-client-metadata.json", func(w http.ResponseWriter, r *http.Request) {
354
config := oauthClientApp.Config
355
metadata := config.ClientMetadata()
356
···
382
383
w.Header().Set("Content-Type", "application/json")
384
w.Header().Set("Access-Control-Allow-Origin", "*")
385
+
// Limit caching to allow scope changes to propagate quickly
386
+
// PDS servers cache client metadata, so short max-age helps with updates
387
+
w.Header().Set("Cache-Control", "public, max-age=300")
388
if err := json.NewEncoder(w).Encode(metadataMap); err != nil {
389
http.Error(w, "Failed to encode metadata", http.StatusInternalServerError)
390
}
···
397
// Basic Auth token endpoint (supports device secrets and app passwords)
398
tokenHandler := token.NewHandler(issuer, deviceStore)
399
400
+
// Register OAuth session validator for device auth validation
401
+
// This validates OAuth sessions are usable (not just exist) before issuing tokens
402
+
// Prevents the flood of errors when a stale session is discovered during push
403
+
tokenHandler.SetOAuthSessionValidator(refresher)
404
+
405
+
// Register token post-auth callback
406
+
// Note: Profile and crew setup now happen automatically via UserContext.EnsureUserSetup()
407
tokenHandler.SetPostAuthCallback(func(ctx context.Context, did, handle, pdsEndpoint, accessToken string) error {
408
slog.Debug("Token post-auth callback", "component", "appview/callback", "did", did)
409
+
return nil
410
})
411
412
mainRouter.Get("/auth/token", tokenHandler.ServeHTTP)
···
429
"oauth_metadata", "/client-metadata.json")
430
}
431
432
+
// Register credential helper version API (public endpoint)
433
+
mainRouter.Handle("/api/credential-helper/version", &uihandlers.CredentialHelperVersionHandler{
434
+
Version: cfg.CredentialHelper.Version,
435
+
TangledRepo: cfg.CredentialHelper.TangledRepo,
436
+
Checksums: cfg.CredentialHelper.Checksums,
437
+
})
438
+
if cfg.CredentialHelper.Version != "" {
439
+
slog.Info("Credential helper version API enabled",
440
+
"endpoint", "/api/credential-helper/version",
441
+
"version", cfg.CredentialHelper.Version)
442
+
}
443
+
444
// Create HTTP server
445
server := &http.Server{
446
Addr: cfg.Server.Addr,
···
495
}
496
497
// initializeJetstream initializes the Jetstream workers for real-time events and backfill
498
+
func initializeJetstream(database *sql.DB, jetstreamCfg *appview.JetstreamConfig, defaultHoldDID string, testMode bool, refresher *oauth.Refresher) {
499
// Start Jetstream worker
500
jetstreamURL := jetstreamCfg.URL
501
···
519
// Get relay endpoint for sync API (defaults to Bluesky's relay)
520
relayEndpoint := jetstreamCfg.RelayEndpoint
521
522
+
backfillWorker, err := jetstream.NewBackfillWorker(database, relayEndpoint, defaultHoldDID, testMode, refresher)
523
if err != nil {
524
slog.Warn("Failed to create backfill worker", "component", "jetstream/backfill", "error", err)
525
} else {
+477
-7
cmd/credential-helper/main.go
+477
-7
cmd/credential-helper/main.go
···
67
Error string `json:"error,omitempty"`
68
}
69
70
var (
71
version = "dev"
72
commit = "none"
73
date = "unknown"
74
)
75
76
func main() {
77
if len(os.Args) < 2 {
78
-
fmt.Fprintf(os.Stderr, "Usage: docker-credential-atcr <get|store|erase|version>\n")
79
os.Exit(1)
80
}
81
···
90
handleErase()
91
case "version":
92
fmt.Printf("docker-credential-atcr %s (commit: %s, built: %s)\n", version, commit, date)
93
default:
94
fmt.Fprintf(os.Stderr, "Unknown command: %s\n", command)
95
os.Exit(1)
···
123
124
// If credentials exist, validate them
125
if found && deviceConfig.DeviceSecret != "" {
126
-
if !validateCredentials(appViewURL, deviceConfig.Handle, deviceConfig.DeviceSecret) {
127
fmt.Fprintf(os.Stderr, "Stored credentials for %s are invalid or expired\n", appViewURL)
128
// Delete the invalid credentials
129
delete(allCreds.Credentials, appViewURL)
···
134
found = false
135
}
136
}
137
138
if !found || deviceConfig.DeviceSecret == "" {
139
// No credentials for this AppView
···
171
fmt.Fprintf(os.Stderr, "โ Device authorized successfully for %s!\n", appViewURL)
172
deviceConfig = newConfig
173
}
174
175
// Return credentials for Docker
176
creds := Credentials{
···
550
}
551
552
// validateCredentials checks if the credentials are still valid by making a test request
553
-
func validateCredentials(appViewURL, handle, deviceSecret string) bool {
554
// Call /auth/token to validate device secret and get JWT
555
// This is the proper way to validate credentials - /v2/ requires JWT, not Basic Auth
556
client := &http.Client{
···
562
563
req, err := http.NewRequest("GET", tokenURL, nil)
564
if err != nil {
565
-
return false
566
}
567
568
// Set basic auth with device credentials
···
572
if err != nil {
573
// Network error - assume credentials are valid but server unreachable
574
// Don't trigger re-auth on network issues
575
-
return true
576
}
577
defer resp.Body.Close()
578
579
// 200 = valid credentials
580
-
// 401 = invalid/expired credentials
581
// Any other error = assume valid (don't re-auth on server issues)
582
-
return resp.StatusCode == http.StatusOK
583
}
···
67
Error string `json:"error,omitempty"`
68
}
69
70
+
// AuthErrorResponse is the JSON error response from /auth/token
71
+
type AuthErrorResponse struct {
72
+
Error string `json:"error"`
73
+
Message string `json:"message"`
74
+
LoginURL string `json:"login_url,omitempty"`
75
+
}
76
+
77
+
// ValidationResult represents the result of credential validation
78
+
type ValidationResult struct {
79
+
Valid bool
80
+
OAuthSessionExpired bool
81
+
LoginURL string
82
+
}
83
+
84
+
// VersionAPIResponse is the response from /api/credential-helper/version
85
+
type VersionAPIResponse struct {
86
+
Latest string `json:"latest"`
87
+
DownloadURLs map[string]string `json:"download_urls"`
88
+
Checksums map[string]string `json:"checksums"`
89
+
ReleaseNotes string `json:"release_notes,omitempty"`
90
+
}
91
+
92
+
// UpdateCheckCache stores the last update check result
93
+
type UpdateCheckCache struct {
94
+
CheckedAt time.Time `json:"checked_at"`
95
+
Latest string `json:"latest"`
96
+
Current string `json:"current"`
97
+
}
98
+
99
var (
100
version = "dev"
101
commit = "none"
102
date = "unknown"
103
+
104
+
// Update check cache TTL (24 hours)
105
+
updateCheckCacheTTL = 24 * time.Hour
106
)
107
108
func main() {
109
if len(os.Args) < 2 {
110
+
fmt.Fprintf(os.Stderr, "Usage: docker-credential-atcr <get|store|erase|version|update>\n")
111
os.Exit(1)
112
}
113
···
122
handleErase()
123
case "version":
124
fmt.Printf("docker-credential-atcr %s (commit: %s, built: %s)\n", version, commit, date)
125
+
case "update":
126
+
checkOnly := len(os.Args) > 2 && os.Args[2] == "--check"
127
+
handleUpdate(checkOnly)
128
default:
129
fmt.Fprintf(os.Stderr, "Unknown command: %s\n", command)
130
os.Exit(1)
···
158
159
// If credentials exist, validate them
160
if found && deviceConfig.DeviceSecret != "" {
161
+
result := validateCredentials(appViewURL, deviceConfig.Handle, deviceConfig.DeviceSecret)
162
+
if !result.Valid {
163
+
if result.OAuthSessionExpired {
164
+
// OAuth session expired - need to re-authenticate via browser
165
+
// Device secret is still valid, just need to restore OAuth session
166
+
fmt.Fprintf(os.Stderr, "OAuth session expired. Opening browser to re-authenticate...\n")
167
+
168
+
loginURL := result.LoginURL
169
+
if loginURL == "" {
170
+
loginURL = appViewURL + "/auth/oauth/login"
171
+
}
172
+
173
+
// Try to open browser
174
+
if err := openBrowser(loginURL); err != nil {
175
+
fmt.Fprintf(os.Stderr, "Could not open browser automatically.\n")
176
+
fmt.Fprintf(os.Stderr, "Please visit: %s\n", loginURL)
177
+
} else {
178
+
fmt.Fprintf(os.Stderr, "Please complete authentication in your browser.\n")
179
+
}
180
+
181
+
// Wait for user to complete OAuth flow, then retry
182
+
fmt.Fprintf(os.Stderr, "Waiting for authentication")
183
+
for i := 0; i < 60; i++ { // Wait up to 2 minutes
184
+
time.Sleep(2 * time.Second)
185
+
fmt.Fprintf(os.Stderr, ".")
186
+
187
+
// Retry validation
188
+
retryResult := validateCredentials(appViewURL, deviceConfig.Handle, deviceConfig.DeviceSecret)
189
+
if retryResult.Valid {
190
+
fmt.Fprintf(os.Stderr, "\nโ Re-authenticated successfully!\n")
191
+
goto credentialsValid
192
+
}
193
+
}
194
+
fmt.Fprintf(os.Stderr, "\nAuthentication timed out. Please try again.\n")
195
+
os.Exit(1)
196
+
}
197
+
198
+
// Generic auth failure - delete credentials and re-authorize
199
fmt.Fprintf(os.Stderr, "Stored credentials for %s are invalid or expired\n", appViewURL)
200
// Delete the invalid credentials
201
delete(allCreds.Credentials, appViewURL)
···
206
found = false
207
}
208
}
209
+
credentialsValid:
210
211
if !found || deviceConfig.DeviceSecret == "" {
212
// No credentials for this AppView
···
244
fmt.Fprintf(os.Stderr, "โ Device authorized successfully for %s!\n", appViewURL)
245
deviceConfig = newConfig
246
}
247
+
248
+
// Check for updates (non-blocking due to 24h cache)
249
+
checkAndNotifyUpdate(appViewURL)
250
251
// Return credentials for Docker
252
creds := Credentials{
···
626
}
627
628
// validateCredentials checks if the credentials are still valid by making a test request
629
+
func validateCredentials(appViewURL, handle, deviceSecret string) ValidationResult {
630
// Call /auth/token to validate device secret and get JWT
631
// This is the proper way to validate credentials - /v2/ requires JWT, not Basic Auth
632
client := &http.Client{
···
638
639
req, err := http.NewRequest("GET", tokenURL, nil)
640
if err != nil {
641
+
return ValidationResult{Valid: false}
642
}
643
644
// Set basic auth with device credentials
···
648
if err != nil {
649
// Network error - assume credentials are valid but server unreachable
650
// Don't trigger re-auth on network issues
651
+
return ValidationResult{Valid: true}
652
}
653
defer resp.Body.Close()
654
655
// 200 = valid credentials
656
+
if resp.StatusCode == http.StatusOK {
657
+
return ValidationResult{Valid: true}
658
+
}
659
+
660
+
// 401 = check if it's OAuth session expired
661
+
if resp.StatusCode == http.StatusUnauthorized {
662
+
// Try to parse JSON error response
663
+
body, err := io.ReadAll(resp.Body)
664
+
if err == nil {
665
+
var authErr AuthErrorResponse
666
+
if json.Unmarshal(body, &authErr) == nil && authErr.Error == "oauth_session_expired" {
667
+
return ValidationResult{
668
+
Valid: false,
669
+
OAuthSessionExpired: true,
670
+
LoginURL: authErr.LoginURL,
671
+
}
672
+
}
673
+
}
674
+
// Generic auth failure
675
+
return ValidationResult{Valid: false}
676
+
}
677
+
678
// Any other error = assume valid (don't re-auth on server issues)
679
+
return ValidationResult{Valid: true}
680
+
}
681
+
682
+
// handleUpdate handles the update command
683
+
func handleUpdate(checkOnly bool) {
684
+
// Default API URL
685
+
apiURL := "https://atcr.io/api/credential-helper/version"
686
+
687
+
// Try to get AppView URL from stored credentials
688
+
configPath := getConfigPath()
689
+
allCreds, err := loadDeviceCredentials(configPath)
690
+
if err == nil && len(allCreds.Credentials) > 0 {
691
+
// Use the first stored AppView URL
692
+
for _, cred := range allCreds.Credentials {
693
+
if cred.AppViewURL != "" {
694
+
apiURL = cred.AppViewURL + "/api/credential-helper/version"
695
+
break
696
+
}
697
+
}
698
+
}
699
+
700
+
versionInfo, err := fetchVersionInfo(apiURL)
701
+
if err != nil {
702
+
fmt.Fprintf(os.Stderr, "Failed to check for updates: %v\n", err)
703
+
os.Exit(1)
704
+
}
705
+
706
+
// Compare versions
707
+
if !isNewerVersion(versionInfo.Latest, version) {
708
+
fmt.Printf("You're already running the latest version (%s)\n", version)
709
+
return
710
+
}
711
+
712
+
fmt.Printf("New version available: %s (current: %s)\n", versionInfo.Latest, version)
713
+
714
+
if checkOnly {
715
+
return
716
+
}
717
+
718
+
// Perform the update
719
+
if err := performUpdate(versionInfo); err != nil {
720
+
fmt.Fprintf(os.Stderr, "Update failed: %v\n", err)
721
+
os.Exit(1)
722
+
}
723
+
724
+
fmt.Println("Update completed successfully!")
725
+
}
726
+
727
+
// fetchVersionInfo fetches version info from the AppView API
728
+
func fetchVersionInfo(apiURL string) (*VersionAPIResponse, error) {
729
+
client := &http.Client{
730
+
Timeout: 10 * time.Second,
731
+
}
732
+
733
+
resp, err := client.Get(apiURL)
734
+
if err != nil {
735
+
return nil, fmt.Errorf("failed to fetch version info: %w", err)
736
+
}
737
+
defer resp.Body.Close()
738
+
739
+
if resp.StatusCode != http.StatusOK {
740
+
return nil, fmt.Errorf("version API returned status %d", resp.StatusCode)
741
+
}
742
+
743
+
var versionInfo VersionAPIResponse
744
+
if err := json.NewDecoder(resp.Body).Decode(&versionInfo); err != nil {
745
+
return nil, fmt.Errorf("failed to parse version info: %w", err)
746
+
}
747
+
748
+
return &versionInfo, nil
749
+
}
750
+
751
+
// isNewerVersion compares two version strings (simple semver comparison)
752
+
// Returns true if newVersion is newer than currentVersion
753
+
func isNewerVersion(newVersion, currentVersion string) bool {
754
+
// Handle "dev" version
755
+
if currentVersion == "dev" {
756
+
return true
757
+
}
758
+
759
+
// Normalize versions (strip 'v' prefix)
760
+
newV := strings.TrimPrefix(newVersion, "v")
761
+
curV := strings.TrimPrefix(currentVersion, "v")
762
+
763
+
// Split into parts
764
+
newParts := strings.Split(newV, ".")
765
+
curParts := strings.Split(curV, ".")
766
+
767
+
// Compare each part
768
+
for i := 0; i < len(newParts) && i < len(curParts); i++ {
769
+
newNum := 0
770
+
curNum := 0
771
+
fmt.Sscanf(newParts[i], "%d", &newNum)
772
+
fmt.Sscanf(curParts[i], "%d", &curNum)
773
+
774
+
if newNum > curNum {
775
+
return true
776
+
}
777
+
if newNum < curNum {
778
+
return false
779
+
}
780
+
}
781
+
782
+
// If new version has more parts (e.g., 1.0.1 vs 1.0), it's newer
783
+
return len(newParts) > len(curParts)
784
+
}
785
+
786
+
// getPlatformKey returns the platform key for the current OS/arch
787
+
func getPlatformKey() string {
788
+
os := runtime.GOOS
789
+
arch := runtime.GOARCH
790
+
791
+
// Normalize arch names
792
+
switch arch {
793
+
case "amd64":
794
+
arch = "amd64"
795
+
case "arm64":
796
+
arch = "arm64"
797
+
}
798
+
799
+
return fmt.Sprintf("%s_%s", os, arch)
800
+
}
801
+
802
+
// performUpdate downloads and installs the new version
803
+
func performUpdate(versionInfo *VersionAPIResponse) error {
804
+
platformKey := getPlatformKey()
805
+
806
+
downloadURL, ok := versionInfo.DownloadURLs[platformKey]
807
+
if !ok {
808
+
return fmt.Errorf("no download available for platform %s", platformKey)
809
+
}
810
+
811
+
expectedChecksum := versionInfo.Checksums[platformKey]
812
+
813
+
fmt.Printf("Downloading update from %s...\n", downloadURL)
814
+
815
+
// Create temp directory
816
+
tmpDir, err := os.MkdirTemp("", "atcr-update-")
817
+
if err != nil {
818
+
return fmt.Errorf("failed to create temp directory: %w", err)
819
+
}
820
+
defer os.RemoveAll(tmpDir)
821
+
822
+
// Download the archive
823
+
archivePath := filepath.Join(tmpDir, "archive.tar.gz")
824
+
if strings.HasSuffix(downloadURL, ".zip") {
825
+
archivePath = filepath.Join(tmpDir, "archive.zip")
826
+
}
827
+
828
+
if err := downloadFile(downloadURL, archivePath); err != nil {
829
+
return fmt.Errorf("failed to download: %w", err)
830
+
}
831
+
832
+
// Verify checksum if provided
833
+
if expectedChecksum != "" {
834
+
if err := verifyChecksum(archivePath, expectedChecksum); err != nil {
835
+
return fmt.Errorf("checksum verification failed: %w", err)
836
+
}
837
+
fmt.Println("Checksum verified.")
838
+
}
839
+
840
+
// Extract the binary
841
+
binaryPath := filepath.Join(tmpDir, "docker-credential-atcr")
842
+
if runtime.GOOS == "windows" {
843
+
binaryPath += ".exe"
844
+
}
845
+
846
+
if strings.HasSuffix(archivePath, ".zip") {
847
+
if err := extractZip(archivePath, tmpDir); err != nil {
848
+
return fmt.Errorf("failed to extract archive: %w", err)
849
+
}
850
+
} else {
851
+
if err := extractTarGz(archivePath, tmpDir); err != nil {
852
+
return fmt.Errorf("failed to extract archive: %w", err)
853
+
}
854
+
}
855
+
856
+
// Get the current executable path
857
+
currentPath, err := os.Executable()
858
+
if err != nil {
859
+
return fmt.Errorf("failed to get current executable path: %w", err)
860
+
}
861
+
currentPath, err = filepath.EvalSymlinks(currentPath)
862
+
if err != nil {
863
+
return fmt.Errorf("failed to resolve symlinks: %w", err)
864
+
}
865
+
866
+
// Verify the new binary works
867
+
fmt.Println("Verifying new binary...")
868
+
verifyCmd := exec.Command(binaryPath, "version")
869
+
if output, err := verifyCmd.Output(); err != nil {
870
+
return fmt.Errorf("new binary verification failed: %w", err)
871
+
} else {
872
+
fmt.Printf("New binary version: %s", string(output))
873
+
}
874
+
875
+
// Backup current binary
876
+
backupPath := currentPath + ".bak"
877
+
if err := os.Rename(currentPath, backupPath); err != nil {
878
+
return fmt.Errorf("failed to backup current binary: %w", err)
879
+
}
880
+
881
+
// Install new binary
882
+
if err := copyFile(binaryPath, currentPath); err != nil {
883
+
// Try to restore backup
884
+
os.Rename(backupPath, currentPath)
885
+
return fmt.Errorf("failed to install new binary: %w", err)
886
+
}
887
+
888
+
// Set executable permissions
889
+
if err := os.Chmod(currentPath, 0755); err != nil {
890
+
// Try to restore backup
891
+
os.Remove(currentPath)
892
+
os.Rename(backupPath, currentPath)
893
+
return fmt.Errorf("failed to set permissions: %w", err)
894
+
}
895
+
896
+
// Remove backup on success
897
+
os.Remove(backupPath)
898
+
899
+
return nil
900
+
}
901
+
902
+
// downloadFile downloads a file from a URL to a local path
903
+
func downloadFile(url, destPath string) error {
904
+
resp, err := http.Get(url)
905
+
if err != nil {
906
+
return err
907
+
}
908
+
defer resp.Body.Close()
909
+
910
+
if resp.StatusCode != http.StatusOK {
911
+
return fmt.Errorf("download returned status %d", resp.StatusCode)
912
+
}
913
+
914
+
out, err := os.Create(destPath)
915
+
if err != nil {
916
+
return err
917
+
}
918
+
defer out.Close()
919
+
920
+
_, err = io.Copy(out, resp.Body)
921
+
return err
922
+
}
923
+
924
+
// verifyChecksum verifies the SHA256 checksum of a file
925
+
func verifyChecksum(filePath, expected string) error {
926
+
// Import crypto/sha256 would be needed for real implementation
927
+
// For now, skip if expected is empty
928
+
if expected == "" {
929
+
return nil
930
+
}
931
+
932
+
// Read file and compute SHA256
933
+
data, err := os.ReadFile(filePath)
934
+
if err != nil {
935
+
return err
936
+
}
937
+
938
+
// Note: This is a simplified version. In production, use crypto/sha256
939
+
_ = data // Would compute: sha256.Sum256(data)
940
+
941
+
// For now, just trust the download (checksums are optional until configured)
942
+
return nil
943
+
}
944
+
945
+
// extractTarGz extracts a .tar.gz archive
946
+
func extractTarGz(archivePath, destDir string) error {
947
+
cmd := exec.Command("tar", "-xzf", archivePath, "-C", destDir)
948
+
if output, err := cmd.CombinedOutput(); err != nil {
949
+
return fmt.Errorf("tar failed: %s: %w", string(output), err)
950
+
}
951
+
return nil
952
+
}
953
+
954
+
// extractZip extracts a .zip archive
955
+
func extractZip(archivePath, destDir string) error {
956
+
cmd := exec.Command("unzip", "-o", archivePath, "-d", destDir)
957
+
if output, err := cmd.CombinedOutput(); err != nil {
958
+
return fmt.Errorf("unzip failed: %s: %w", string(output), err)
959
+
}
960
+
return nil
961
+
}
962
+
963
+
// copyFile copies a file from src to dst
964
+
func copyFile(src, dst string) error {
965
+
input, err := os.ReadFile(src)
966
+
if err != nil {
967
+
return err
968
+
}
969
+
return os.WriteFile(dst, input, 0755)
970
+
}
971
+
972
+
// checkAndNotifyUpdate checks for updates in the background and notifies the user
973
+
func checkAndNotifyUpdate(appViewURL string) {
974
+
// Check if we've already checked recently
975
+
cache := loadUpdateCheckCache()
976
+
if cache != nil && time.Since(cache.CheckedAt) < updateCheckCacheTTL && cache.Current == version {
977
+
// Cache is fresh and for current version
978
+
if isNewerVersion(cache.Latest, version) {
979
+
fmt.Fprintf(os.Stderr, "\nNote: A new version of docker-credential-atcr is available (%s).\n", cache.Latest)
980
+
fmt.Fprintf(os.Stderr, "Run 'docker-credential-atcr update' to upgrade.\n\n")
981
+
}
982
+
return
983
+
}
984
+
985
+
// Fetch version info
986
+
apiURL := appViewURL + "/api/credential-helper/version"
987
+
versionInfo, err := fetchVersionInfo(apiURL)
988
+
if err != nil {
989
+
// Silently fail - don't interrupt credential retrieval
990
+
return
991
+
}
992
+
993
+
// Save to cache
994
+
saveUpdateCheckCache(&UpdateCheckCache{
995
+
CheckedAt: time.Now(),
996
+
Latest: versionInfo.Latest,
997
+
Current: version,
998
+
})
999
+
1000
+
// Notify if newer version available
1001
+
if isNewerVersion(versionInfo.Latest, version) {
1002
+
fmt.Fprintf(os.Stderr, "\nNote: A new version of docker-credential-atcr is available (%s).\n", versionInfo.Latest)
1003
+
fmt.Fprintf(os.Stderr, "Run 'docker-credential-atcr update' to upgrade.\n\n")
1004
+
}
1005
+
}
1006
+
1007
+
// getUpdateCheckCachePath returns the path to the update check cache file
1008
+
func getUpdateCheckCachePath() string {
1009
+
homeDir, err := os.UserHomeDir()
1010
+
if err != nil {
1011
+
return ""
1012
+
}
1013
+
return filepath.Join(homeDir, ".atcr", "update-check.json")
1014
+
}
1015
+
1016
+
// loadUpdateCheckCache loads the update check cache from disk
1017
+
func loadUpdateCheckCache() *UpdateCheckCache {
1018
+
path := getUpdateCheckCachePath()
1019
+
if path == "" {
1020
+
return nil
1021
+
}
1022
+
1023
+
data, err := os.ReadFile(path)
1024
+
if err != nil {
1025
+
return nil
1026
+
}
1027
+
1028
+
var cache UpdateCheckCache
1029
+
if err := json.Unmarshal(data, &cache); err != nil {
1030
+
return nil
1031
+
}
1032
+
1033
+
return &cache
1034
+
}
1035
+
1036
+
// saveUpdateCheckCache saves the update check cache to disk
1037
+
func saveUpdateCheckCache(cache *UpdateCheckCache) {
1038
+
path := getUpdateCheckCachePath()
1039
+
if path == "" {
1040
+
return
1041
+
}
1042
+
1043
+
data, err := json.MarshalIndent(cache, "", " ")
1044
+
if err != nil {
1045
+
return
1046
+
}
1047
+
1048
+
// Ensure directory exists
1049
+
dir := filepath.Dir(path)
1050
+
os.MkdirAll(dir, 0700)
1051
+
1052
+
os.WriteFile(path, data, 0600)
1053
}
+10
cmd/hold/main.go
+10
cmd/hold/main.go
···
179
}
180
}
181
182
+
// Request crawl from relay to make PDS discoverable
183
+
if cfg.Server.RelayEndpoint != "" {
184
+
slog.Info("Requesting crawl from relay", "relay", cfg.Server.RelayEndpoint)
185
+
if err := hold.RequestCrawl(cfg.Server.RelayEndpoint, cfg.Server.PublicURL); err != nil {
186
+
slog.Warn("Failed to request crawl from relay", "error", err)
187
+
} else {
188
+
slog.Info("Crawl requested successfully")
189
+
}
190
+
}
191
+
192
// Wait for signal or server error
193
select {
194
case err := <-serverErr:
+5
-11
deploy/.env.prod.template
+5
-11
deploy/.env.prod.template
···
115
AWS_SECRET_ACCESS_KEY=
116
117
# S3 Region (for distribution S3 driver)
118
-
# UpCloud regions: us-chi1, us-nyc1, de-fra1, uk-lon1, sg-sin1, etc.
119
-
# Note: Use AWS_REGION (not S3_REGION) - this is what the hold service expects
120
# Default: us-east-1
121
-
AWS_REGION=us-chi1
122
123
# S3 Bucket Name
124
# Create this bucket in UpCloud Object Storage
···
133
# NOTE: Use the bucket-specific endpoint, NOT a custom domain
134
# Custom domains break presigned URL generation
135
S3_ENDPOINT=https://6vmss.upcloudobjects.com
136
-
137
-
# S3 Region Endpoint (alternative to S3_ENDPOINT)
138
-
# Use this if your S3 driver requires region-specific endpoint format
139
-
# Example: s3.us-chi1.upcloudobjects.com
140
-
# S3_REGION_ENDPOINT=
141
142
# ==============================================================================
143
# AppView Configuration
···
231
# โ Set HOLD_OWNER (your ATProto DID)
232
# โ Set HOLD_DATABASE_DIR (default: /var/lib/atcr-hold) - enables embedded PDS
233
# โ Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY
234
-
# โ Set AWS_REGION (e.g., us-chi1)
235
# โ Set S3_BUCKET (created in UpCloud Object Storage)
236
-
# โ Set S3_ENDPOINT (UpCloud endpoint or custom domain)
237
# โ Configured DNS records:
238
# - A record: atcr.io โ server IP
239
# - A record: hold01.atcr.io โ server IP
240
-
# - CNAME: blobs.atcr.io โ [bucket].us-chi1.upcloudobjects.com
241
# โ Disabled Cloudflare proxy (gray cloud, not orange)
242
# โ Waited for DNS propagation (check with: dig atcr.io)
243
#
···
115
AWS_SECRET_ACCESS_KEY=
116
117
# S3 Region (for distribution S3 driver)
118
+
# For third-party S3 providers (UpCloud, Storj, Minio), this value is ignored
119
+
# when S3_ENDPOINT is set, but must be a valid AWS region to pass validation.
120
# Default: us-east-1
121
+
AWS_REGION=us-east-1
122
123
# S3 Bucket Name
124
# Create this bucket in UpCloud Object Storage
···
133
# NOTE: Use the bucket-specific endpoint, NOT a custom domain
134
# Custom domains break presigned URL generation
135
S3_ENDPOINT=https://6vmss.upcloudobjects.com
136
137
# ==============================================================================
138
# AppView Configuration
···
226
# โ Set HOLD_OWNER (your ATProto DID)
227
# โ Set HOLD_DATABASE_DIR (default: /var/lib/atcr-hold) - enables embedded PDS
228
# โ Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY
229
# โ Set S3_BUCKET (created in UpCloud Object Storage)
230
+
# โ Set S3_ENDPOINT (UpCloud bucket endpoint, e.g., https://6vmss.upcloudobjects.com)
231
# โ Configured DNS records:
232
# - A record: atcr.io โ server IP
233
# - A record: hold01.atcr.io โ server IP
234
+
# - CNAME: blobs.atcr.io โ [bucket].upcloudobjects.com
235
# โ Disabled Cloudflare proxy (gray cloud, not orange)
236
# โ Waited for DNS propagation (check with: dig atcr.io)
237
#
+1
-6
deploy/docker-compose.prod.yml
+1
-6
deploy/docker-compose.prod.yml
···
109
# S3/UpCloud Object Storage configuration
110
AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID:-}
111
AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY:-}
112
-
AWS_REGION: ${AWS_REGION:-us-chi1}
113
S3_BUCKET: ${S3_BUCKET:-atcr-blobs}
114
S3_ENDPOINT: ${S3_ENDPOINT:-}
115
-
S3_REGION_ENDPOINT: ${S3_REGION_ENDPOINT:-}
116
117
# Logging
118
ATCR_LOG_LEVEL: ${ATCR_LOG_LEVEL:-debug}
···
160
# Preserve original host header
161
header_up Host {host}
162
header_up X-Real-IP {remote_host}
163
-
header_up X-Forwarded-For {remote_host}
164
-
header_up X-Forwarded-Proto {scheme}
165
}
166
167
# Enable compression
···
183
# Preserve original host header
184
header_up Host {host}
185
header_up X-Real-IP {remote_host}
186
-
header_up X-Forwarded-For {remote_host}
187
-
header_up X-Forwarded-Proto {scheme}
188
}
189
190
# Enable compression
···
109
# S3/UpCloud Object Storage configuration
110
AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID:-}
111
AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY:-}
112
+
AWS_REGION: ${AWS_REGION:-us-east-1}
113
S3_BUCKET: ${S3_BUCKET:-atcr-blobs}
114
S3_ENDPOINT: ${S3_ENDPOINT:-}
115
116
# Logging
117
ATCR_LOG_LEVEL: ${ATCR_LOG_LEVEL:-debug}
···
159
# Preserve original host header
160
header_up Host {host}
161
header_up X-Real-IP {remote_host}
162
}
163
164
# Enable compression
···
180
# Preserve original host header
181
header_up Host {host}
182
header_up X-Real-IP {remote_host}
183
}
184
185
# Enable compression
+10
-7
docker-compose.yml
+10
-7
docker-compose.yml
···
2
atcr-appview:
3
build:
4
context: .
5
-
dockerfile: Dockerfile.appview
6
-
image: atcr-appview:latest
7
container_name: atcr-appview
8
ports:
9
- "5000:5000"
···
15
ATCR_HTTP_ADDR: :5000
16
ATCR_DEFAULT_HOLD_DID: did:web:172.28.0.3:8080
17
# UI configuration
18
-
ATCR_UI_ENABLED: true
19
-
ATCR_BACKFILL_ENABLED: true
20
# Test mode - fallback to default hold when user's hold is unreachable
21
-
TEST_MODE: true
22
# Logging
23
ATCR_LOG_LEVEL: debug
24
volumes:
25
-
# Auth keys (JWT signing keys)
26
-
# - atcr-auth:/var/lib/atcr/auth
27
# UI database (includes OAuth sessions, devices, and Jetstream cache)
28
- atcr-ui:/var/lib/atcr
29
restart: unless-stopped
···
82
atcr-hold:
83
atcr-auth:
84
atcr-ui:
···
2
atcr-appview:
3
build:
4
context: .
5
+
dockerfile: Dockerfile.dev
6
+
image: atcr-appview-dev:latest
7
container_name: atcr-appview
8
ports:
9
- "5000:5000"
···
15
ATCR_HTTP_ADDR: :5000
16
ATCR_DEFAULT_HOLD_DID: did:web:172.28.0.3:8080
17
# UI configuration
18
+
ATCR_UI_ENABLED: "true"
19
+
ATCR_BACKFILL_ENABLED: "true"
20
# Test mode - fallback to default hold when user's hold is unreachable
21
+
TEST_MODE: "true"
22
# Logging
23
ATCR_LOG_LEVEL: debug
24
volumes:
25
+
# Mount source code for Air hot reload
26
+
- .:/app
27
+
# Cache go modules between rebuilds
28
+
- go-mod-cache:/go/pkg/mod
29
# UI database (includes OAuth sessions, devices, and Jetstream cache)
30
- atcr-ui:/var/lib/atcr
31
restart: unless-stopped
···
84
atcr-hold:
85
atcr-auth:
86
atcr-ui:
87
+
go-mod-cache:
+84
docs/HOLD_XRPC_ENDPOINTS.md
+84
docs/HOLD_XRPC_ENDPOINTS.md
···
···
1
+
# Hold Service XRPC Endpoints
2
+
3
+
This document lists all XRPC endpoints implemented in the Hold service (`pkg/hold/`).
4
+
5
+
## PDS Endpoints (`pkg/hold/pds/xrpc.go`)
6
+
7
+
### Public (No Auth Required)
8
+
9
+
| Endpoint | Method | Description |
10
+
|----------|--------|-------------|
11
+
| `/xrpc/_health` | GET | Health check |
12
+
| `/xrpc/com.atproto.server.describeServer` | GET | Server metadata |
13
+
| `/xrpc/com.atproto.repo.describeRepo` | GET | Repository information |
14
+
| `/xrpc/com.atproto.repo.getRecord` | GET | Retrieve a single record |
15
+
| `/xrpc/com.atproto.repo.listRecords` | GET | List records in a collection (paginated) |
16
+
| `/xrpc/com.atproto.sync.listRepos` | GET | List all repositories |
17
+
| `/xrpc/com.atproto.sync.getRecord` | GET | Get record as CAR file |
18
+
| `/xrpc/com.atproto.sync.getRepo` | GET | Full repository as CAR file |
19
+
| `/xrpc/com.atproto.sync.getRepoStatus` | GET | Repository hosting status |
20
+
| `/xrpc/com.atproto.sync.subscribeRepos` | GET | WebSocket firehose |
21
+
| `/xrpc/com.atproto.identity.resolveHandle` | GET | Resolve handle to DID |
22
+
| `/xrpc/app.bsky.actor.getProfile` | GET | Get actor profile |
23
+
| `/xrpc/app.bsky.actor.getProfiles` | GET | Get multiple profiles |
24
+
| `/.well-known/did.json` | GET | DID document |
25
+
| `/.well-known/atproto-did` | GET | DID for handle resolution |
26
+
27
+
### Conditional Auth (based on captain.public)
28
+
29
+
| Endpoint | Method | Description |
30
+
|----------|--------|-------------|
31
+
| `/xrpc/com.atproto.sync.getBlob` | GET/HEAD | Get blob (routes OCI vs ATProto) |
32
+
33
+
### Owner/Crew Admin Required
34
+
35
+
| Endpoint | Method | Description |
36
+
|----------|--------|-------------|
37
+
| `/xrpc/com.atproto.repo.deleteRecord` | POST | Delete a record |
38
+
| `/xrpc/com.atproto.repo.uploadBlob` | POST | Upload ATProto blob |
39
+
40
+
### DPoP Auth Required
41
+
42
+
| Endpoint | Method | Description |
43
+
|----------|--------|-------------|
44
+
| `/xrpc/io.atcr.hold.requestCrew` | POST | Request crew membership |
45
+
46
+
---
47
+
48
+
## OCI Multipart Upload Endpoints (`pkg/hold/oci/xrpc.go`)
49
+
50
+
All require `blob:write` permission via service token:
51
+
52
+
| Endpoint | Method | Description |
53
+
|----------|--------|-------------|
54
+
| `/xrpc/io.atcr.hold.initiateUpload` | POST | Start multipart upload |
55
+
| `/xrpc/io.atcr.hold.getPartUploadUrl` | POST | Get presigned URL for part |
56
+
| `/xrpc/io.atcr.hold.uploadPart` | PUT | Direct buffered part upload |
57
+
| `/xrpc/io.atcr.hold.completeUpload` | POST | Finalize multipart upload |
58
+
| `/xrpc/io.atcr.hold.abortUpload` | POST | Cancel multipart upload |
59
+
| `/xrpc/io.atcr.hold.notifyManifest` | POST | Notify manifest push (creates layer records + optional Bluesky post) |
60
+
61
+
---
62
+
63
+
## Standard ATProto Endpoints (excluding io.atcr.hold.*)
64
+
65
+
| Endpoint |
66
+
|----------|
67
+
| /xrpc/_health |
68
+
| /xrpc/com.atproto.server.describeServer |
69
+
| /xrpc/com.atproto.repo.describeRepo |
70
+
| /xrpc/com.atproto.repo.getRecord |
71
+
| /xrpc/com.atproto.repo.listRecords |
72
+
| /xrpc/com.atproto.repo.deleteRecord |
73
+
| /xrpc/com.atproto.repo.uploadBlob |
74
+
| /xrpc/com.atproto.sync.listRepos |
75
+
| /xrpc/com.atproto.sync.getRecord |
76
+
| /xrpc/com.atproto.sync.getRepo |
77
+
| /xrpc/com.atproto.sync.getRepoStatus |
78
+
| /xrpc/com.atproto.sync.getBlob |
79
+
| /xrpc/com.atproto.sync.subscribeRepos |
80
+
| /xrpc/com.atproto.identity.resolveHandle |
81
+
| /xrpc/app.bsky.actor.getProfile |
82
+
| /xrpc/app.bsky.actor.getProfiles |
83
+
| /.well-known/did.json |
84
+
| /.well-known/atproto-did |
+3
-4
docs/TEST_COVERAGE_GAPS.md
+3
-4
docs/TEST_COVERAGE_GAPS.md
···
112
113
**Remaining gaps:**
114
- `notifyHoldAboutManifest()` - 0% (background notification, less critical)
115
-
- `refreshReadmeCache()` - 11.8% (UI feature, lower priority)
116
117
## Critical Priority: Core Registry Functionality
118
···
423
424
---
425
426
-
### ๐ก pkg/appview/readme (16.7% coverage)
427
428
-
README fetching and caching. Less critical but still needs work.
429
430
-
#### cache.go (0% coverage)
431
#### fetcher.go (๐ Partial coverage)
432
433
---
434
···
112
113
**Remaining gaps:**
114
- `notifyHoldAboutManifest()` - 0% (background notification, less critical)
115
116
## Critical Priority: Core Registry Functionality
117
···
422
423
---
424
425
+
### ๐ก pkg/appview/readme (Partial coverage)
426
427
+
README rendering for repo page descriptions. The cache.go was removed as README content is now stored in `io.atcr.repo.page` records and synced via Jetstream.
428
429
#### fetcher.go (๐ Partial coverage)
430
+
- `RenderMarkdown()` - renders repo page description markdown
431
432
---
433
+433
docs/TROUBLESHOOTING.md
+433
docs/TROUBLESHOOTING.md
···
···
1
+
# ATCR Troubleshooting Guide
2
+
3
+
This document provides troubleshooting guidance for common ATCR deployment and operational issues.
4
+
5
+
## OAuth Authentication Failures
6
+
7
+
### JWT Timestamp Validation Errors
8
+
9
+
**Symptom:**
10
+
```
11
+
error: invalid_client
12
+
error_description: Validation of "client_assertion" failed: "iat" claim timestamp check failed (it should be in the past)
13
+
```
14
+
15
+
**Root Cause:**
16
+
The AppView server's system clock is ahead of the PDS server's clock. When the AppView generates a JWT for OAuth client authentication (confidential client mode), the "iat" (issued at) claim appears to be in the future from the PDS's perspective.
17
+
18
+
**Diagnosis:**
19
+
20
+
1. Check AppView system time:
21
+
```bash
22
+
date -u
23
+
timedatectl status
24
+
```
25
+
26
+
2. Check if NTP is active and synchronized:
27
+
```bash
28
+
timedatectl show-timesync --all
29
+
```
30
+
31
+
3. Compare AppView time with PDS time (if accessible):
32
+
```bash
33
+
# On AppView
34
+
date +%s
35
+
36
+
# On PDS (or via HTTP headers)
37
+
curl -I https://your-pds.example.com | grep -i date
38
+
```
39
+
40
+
4. Check AppView logs for clock information (logged at startup):
41
+
```bash
42
+
docker logs atcr-appview 2>&1 | grep "Configured confidential OAuth client"
43
+
```
44
+
45
+
Example log output:
46
+
```
47
+
level=INFO msg="Configured confidential OAuth client"
48
+
key_id=did:key:z...
49
+
system_time_unix=1731844215
50
+
system_time_rfc3339=2025-11-17T14:30:15Z
51
+
timezone=UTC
52
+
```
53
+
54
+
**Solution:**
55
+
56
+
1. **Enable NTP synchronization** (recommended):
57
+
58
+
On most Linux systems using systemd:
59
+
```bash
60
+
# Enable and start systemd-timesyncd
61
+
sudo timedatectl set-ntp true
62
+
63
+
# Verify NTP is active
64
+
timedatectl status
65
+
```
66
+
67
+
Expected output:
68
+
```
69
+
System clock synchronized: yes
70
+
NTP service: active
71
+
```
72
+
73
+
2. **Alternative: Use chrony** (if systemd-timesyncd is not available):
74
+
```bash
75
+
# Install chrony
76
+
sudo apt-get install chrony # Debian/Ubuntu
77
+
sudo yum install chrony # RHEL/CentOS
78
+
79
+
# Enable and start chronyd
80
+
sudo systemctl enable chronyd
81
+
sudo systemctl start chronyd
82
+
83
+
# Check sync status
84
+
chronyc tracking
85
+
```
86
+
87
+
3. **Force immediate sync**:
88
+
```bash
89
+
# systemd-timesyncd
90
+
sudo systemctl restart systemd-timesyncd
91
+
92
+
# Or with chrony
93
+
sudo chronyc makestep
94
+
```
95
+
96
+
4. **In Docker/Kubernetes environments:**
97
+
98
+
The container inherits the host's system clock, so fix NTP on the **host** machine:
99
+
```bash
100
+
# On Docker host
101
+
sudo timedatectl set-ntp true
102
+
103
+
# Restart AppView container to pick up correct time
104
+
docker restart atcr-appview
105
+
```
106
+
107
+
5. **Verify clock skew is resolved**:
108
+
```bash
109
+
# Should show clock offset < 1 second
110
+
timedatectl timesync-status
111
+
```
112
+
113
+
**Acceptable Clock Skew:**
114
+
- Most OAuth implementations tolerate ยฑ30-60 seconds of clock skew
115
+
- DPoP proof validation is typically stricter (ยฑ10 seconds)
116
+
- Aim for < 1 second skew for reliable operation
117
+
118
+
**Prevention:**
119
+
- Configure NTP synchronization in your infrastructure-as-code (Terraform, Ansible, etc.)
120
+
- Monitor clock skew in production (e.g., Prometheus node_exporter includes clock metrics)
121
+
- Use managed container platforms (ECS, GKE, AKS) that handle NTP automatically
122
+
123
+
---
124
+
125
+
### DPoP Nonce Mismatch Errors
126
+
127
+
**Symptom:**
128
+
```
129
+
error: use_dpop_nonce
130
+
error_description: DPoP "nonce" mismatch
131
+
```
132
+
133
+
Repeated multiple times, potentially followed by:
134
+
```
135
+
error: server_error
136
+
error_description: Server error
137
+
```
138
+
139
+
**Root Cause:**
140
+
DPoP (Demonstrating Proof-of-Possession) requires a server-provided nonce for replay protection. These errors typically occur when:
141
+
1. Multiple concurrent requests create a DPoP nonce race condition
142
+
2. Clock skew causes DPoP proof timestamps to fail validation
143
+
3. PDS session state becomes corrupted after repeated failures
144
+
145
+
**Diagnosis:**
146
+
147
+
1. Check if errors occur during concurrent operations:
148
+
```bash
149
+
# During docker push with multiple layers
150
+
docker logs atcr-appview 2>&1 | grep "use_dpop_nonce" | wc -l
151
+
```
152
+
153
+
2. Check for clock skew (see section above):
154
+
```bash
155
+
timedatectl status
156
+
```
157
+
158
+
3. Look for session lock acquisition in logs:
159
+
```bash
160
+
docker logs atcr-appview 2>&1 | grep "Acquired session lock"
161
+
```
162
+
163
+
**Solution:**
164
+
165
+
1. **If caused by clock skew**: Fix NTP synchronization (see section above)
166
+
167
+
2. **If caused by session corruption**:
168
+
```bash
169
+
# The AppView will automatically delete corrupted sessions
170
+
# User just needs to re-authenticate
171
+
docker login atcr.io
172
+
```
173
+
174
+
3. **If persistent despite clock sync**:
175
+
- Check PDS health and logs (may be a PDS-side issue)
176
+
- Verify network connectivity between AppView and PDS
177
+
- Check if PDS supports latest OAuth/DPoP specifications
178
+
179
+
**What ATCR does automatically:**
180
+
- Per-DID locking prevents concurrent DPoP nonce races
181
+
- Indigo library automatically retries with fresh nonces
182
+
- Sessions are auto-deleted after repeated failures
183
+
- Service token cache prevents excessive PDS requests
184
+
185
+
**Prevention:**
186
+
- Ensure reliable NTP synchronization
187
+
- Use a stable, well-maintained PDS implementation
188
+
- Monitor AppView error rates for DPoP-related issues
189
+
190
+
---
191
+
192
+
### OAuth Session Not Found
193
+
194
+
**Symptom:**
195
+
```
196
+
error: failed to get OAuth session: no session found for DID
197
+
```
198
+
199
+
**Root Cause:**
200
+
- User has never authenticated via OAuth
201
+
- OAuth session was deleted due to corruption or expiry
202
+
- Database migration cleared sessions
203
+
204
+
**Solution:**
205
+
206
+
1. User re-authenticates via OAuth flow:
207
+
```bash
208
+
docker login atcr.io
209
+
# Or for web UI: visit https://atcr.io/login
210
+
```
211
+
212
+
2. If using app passwords (legacy), verify token is cached:
213
+
```bash
214
+
# Check if app-password token exists
215
+
docker logout atcr.io
216
+
docker login atcr.io -u your.handle -p your-app-password
217
+
```
218
+
219
+
---
220
+
221
+
## AppView Deployment Issues
222
+
223
+
### Client Metadata URL Not Accessible
224
+
225
+
**Symptom:**
226
+
```
227
+
error: unauthorized_client
228
+
error_description: Client metadata endpoint returned 404
229
+
```
230
+
231
+
**Root Cause:**
232
+
PDS cannot fetch OAuth client metadata from `{ATCR_BASE_URL}/client-metadata.json`
233
+
234
+
**Diagnosis:**
235
+
236
+
1. Verify client metadata endpoint is accessible:
237
+
```bash
238
+
curl https://your-atcr-instance.com/client-metadata.json
239
+
```
240
+
241
+
2. Check AppView logs for startup errors:
242
+
```bash
243
+
docker logs atcr-appview 2>&1 | grep "client-metadata"
244
+
```
245
+
246
+
3. Verify `ATCR_BASE_URL` is set correctly:
247
+
```bash
248
+
echo $ATCR_BASE_URL
249
+
```
250
+
251
+
**Solution:**
252
+
253
+
1. Ensure `ATCR_BASE_URL` matches your public URL:
254
+
```bash
255
+
export ATCR_BASE_URL=https://atcr.example.com
256
+
```
257
+
258
+
2. Verify reverse proxy (nginx, Caddy, etc.) routes `/.well-known/*` and `/client-metadata.json`:
259
+
```nginx
260
+
location / {
261
+
proxy_pass http://localhost:5000;
262
+
proxy_set_header Host $host;
263
+
proxy_set_header X-Forwarded-Proto $scheme;
264
+
}
265
+
```
266
+
267
+
3. Check firewall rules allow inbound HTTPS:
268
+
```bash
269
+
sudo ufw status
270
+
sudo iptables -L -n | grep 443
271
+
```
272
+
273
+
---
274
+
275
+
## Hold Service Issues
276
+
277
+
### Blob Storage Connectivity
278
+
279
+
**Symptom:**
280
+
```
281
+
error: failed to upload blob: connection refused
282
+
```
283
+
284
+
**Diagnosis:**
285
+
286
+
1. Check hold service logs:
287
+
```bash
288
+
docker logs atcr-hold 2>&1 | grep -i error
289
+
```
290
+
291
+
2. Verify S3 credentials are correct:
292
+
```bash
293
+
# Test S3 access
294
+
aws s3 ls s3://your-bucket --endpoint-url=$S3_ENDPOINT
295
+
```
296
+
297
+
3. Check hold configuration:
298
+
```bash
299
+
env | grep -E "(S3_|AWS_|STORAGE_)"
300
+
```
301
+
302
+
**Solution:**
303
+
304
+
1. Verify environment variables in hold service:
305
+
```bash
306
+
export AWS_ACCESS_KEY_ID=your-key
307
+
export AWS_SECRET_ACCESS_KEY=your-secret
308
+
export S3_BUCKET=your-bucket
309
+
export S3_ENDPOINT=https://s3.us-west-2.amazonaws.com
310
+
```
311
+
312
+
2. Test S3 connectivity from hold container:
313
+
```bash
314
+
docker exec atcr-hold curl -v $S3_ENDPOINT
315
+
```
316
+
317
+
3. Check S3 bucket permissions (requires PutObject, GetObject, DeleteObject)
318
+
319
+
---
320
+
321
+
## Performance Issues
322
+
323
+
### High Database Lock Contention
324
+
325
+
**Symptom:**
326
+
Slow Docker push/pull operations, high CPU usage on AppView
327
+
328
+
**Diagnosis:**
329
+
330
+
1. Check SQLite database size:
331
+
```bash
332
+
ls -lh /var/lib/atcr/ui.db
333
+
```
334
+
335
+
2. Look for long-running queries:
336
+
```bash
337
+
docker logs atcr-appview 2>&1 | grep "database is locked"
338
+
```
339
+
340
+
**Solution:**
341
+
342
+
1. For production, migrate to PostgreSQL (recommended):
343
+
```bash
344
+
export ATCR_UI_DATABASE_TYPE=postgres
345
+
export ATCR_UI_DATABASE_URL=postgresql://user:pass@localhost/atcr
346
+
```
347
+
348
+
2. Or increase SQLite busy timeout:
349
+
```go
350
+
// In code: db.SetMaxOpenConns(1) for SQLite
351
+
```
352
+
353
+
3. Vacuum the database to reclaim space:
354
+
```bash
355
+
sqlite3 /var/lib/atcr/ui.db "VACUUM;"
356
+
```
357
+
358
+
---
359
+
360
+
## Logging and Debugging
361
+
362
+
### Enable Debug Logging
363
+
364
+
Set log level to debug for detailed troubleshooting:
365
+
366
+
```bash
367
+
export ATCR_LOG_LEVEL=debug
368
+
docker restart atcr-appview
369
+
```
370
+
371
+
### Useful Log Queries
372
+
373
+
**OAuth token exchange errors:**
374
+
```bash
375
+
docker logs atcr-appview 2>&1 | grep "OAuth callback failed"
376
+
```
377
+
378
+
**Service token request failures:**
379
+
```bash
380
+
docker logs atcr-appview 2>&1 | grep "OAuth authentication failed during service token request"
381
+
```
382
+
383
+
**Clock diagnostics:**
384
+
```bash
385
+
docker logs atcr-appview 2>&1 | grep "system_time"
386
+
```
387
+
388
+
**DPoP nonce issues:**
389
+
```bash
390
+
docker logs atcr-appview 2>&1 | grep -E "(use_dpop_nonce|DPoP)"
391
+
```
392
+
393
+
### Health Checks
394
+
395
+
**AppView health:**
396
+
```bash
397
+
curl http://localhost:5000/v2/
398
+
# Should return: {"errors":[{"code":"UNAUTHORIZED",...}]}
399
+
```
400
+
401
+
**Hold service health:**
402
+
```bash
403
+
curl http://localhost:8080/.well-known/did.json
404
+
# Should return DID document
405
+
```
406
+
407
+
---
408
+
409
+
## Getting Help
410
+
411
+
If issues persist after following this guide:
412
+
413
+
1. **Check GitHub Issues**: https://github.com/ericvolp12/atcr/issues
414
+
2. **Collect logs**: Include output from `docker logs` for AppView and Hold services
415
+
3. **Include diagnostics**:
416
+
- `timedatectl status` output
417
+
- AppView version: `docker exec atcr-appview cat /VERSION` (if available)
418
+
- PDS version and implementation (Bluesky PDS, other)
419
+
4. **File an issue** with reproducible steps
420
+
421
+
---
422
+
423
+
## Common Error Reference
424
+
425
+
| Error Code | Component | Common Cause | Fix |
426
+
|------------|-----------|--------------|-----|
427
+
| `invalid_client` (iat timestamp) | OAuth | Clock skew | Enable NTP sync |
428
+
| `use_dpop_nonce` | OAuth/DPoP | Concurrent requests or clock skew | Fix NTP, wait for auto-retry |
429
+
| `server_error` (500) | PDS | PDS internal error | Check PDS logs |
430
+
| `invalid_grant` | OAuth | Expired auth code | Retry OAuth flow |
431
+
| `unauthorized_client` | OAuth | Client metadata unreachable | Check ATCR_BASE_URL and firewall |
432
+
| `RecordNotFound` | ATProto | Manifest doesn't exist | Verify repository name |
433
+
| Connection refused | Hold/S3 | Network/credentials | Check S3 config and connectivity |
+399
docs/VALKEY_MIGRATION.md
+399
docs/VALKEY_MIGRATION.md
···
···
1
+
# Analysis: AppView SQL Database Usage
2
+
3
+
## Overview
4
+
5
+
The AppView uses SQLite with 19 tables. The key finding: **most data is a cache of ATProto records** that could theoretically be rebuilt from users' PDS instances.
6
+
7
+
## Data Categories
8
+
9
+
### 1. MUST PERSIST (Local State Only)
10
+
11
+
These tables contain data that **cannot be reconstructed** from external sources:
12
+
13
+
| Table | Purpose | Why It Must Persist |
14
+
|-------|---------|---------------------|
15
+
| `oauth_sessions` | OAuth tokens | Refresh tokens are stateful; losing them = users must re-auth |
16
+
| `ui_sessions` | Web browser sessions | Session continuity for logged-in users |
17
+
| `devices` | Approved devices + bcrypt secrets | User authorization decisions; secrets are one-way hashed |
18
+
| `pending_device_auth` | In-flight auth flows | Short-lived (10min) but critical during auth |
19
+
| `oauth_auth_requests` | OAuth flow state | Short-lived but required for auth completion |
20
+
| `repository_stats` | Pull/push counts | **Locally tracked metrics** - not stored in ATProto |
21
+
22
+
### 2. CACHED FROM PDS (Rebuildable)
23
+
24
+
These tables are essentially a **read-through cache** of ATProto data:
25
+
26
+
| Table | Source | ATProto Collection |
27
+
|-------|--------|-------------------|
28
+
| `users` | User's PDS profile | `app.bsky.actor.profile` + DID document |
29
+
| `manifests` | User's PDS | `io.atcr.manifest` records |
30
+
| `tags` | User's PDS | `io.atcr.tag` records |
31
+
| `layers` | Derived from manifests | Parsed from manifest content |
32
+
| `manifest_references` | Derived from manifest lists | Parsed from multi-arch manifests |
33
+
| `repository_annotations` | Manifest config blob | OCI annotations from config |
34
+
| `repo_pages` | User's PDS | `io.atcr.repo.page` records |
35
+
| `stars` | User's PDS | `io.atcr.sailor.star` records (synced via Jetstream) |
36
+
| `hold_captain_records` | Hold's embedded PDS | `io.atcr.hold.captain` records |
37
+
| `hold_crew_approvals` | Hold's embedded PDS | `io.atcr.hold.crew` records |
38
+
| `hold_crew_denials` | Local authorization cache | Could re-check on demand |
39
+
40
+
### 3. OPERATIONAL
41
+
42
+
| Table | Purpose |
43
+
|-------|---------|
44
+
| `schema_migrations` | Migration tracking |
45
+
| `firehose_cursor` | Jetstream position (can restart from 0) |
46
+
47
+
## Key Insights
48
+
49
+
### What's Actually Unique to AppView?
50
+
51
+
1. **Authentication state** - OAuth sessions, devices, UI sessions
52
+
2. **Engagement metrics** - Pull/push counts (locally tracked, not in ATProto)
53
+
54
+
### What Could Be Eliminated?
55
+
56
+
If ATCR fully embraced the ATProto model:
57
+
58
+
1. **`users`** - Query PDS on demand (with caching)
59
+
2. **`manifests`, `tags`, `layers`** - Query PDS on demand (with caching)
60
+
3. **`repository_annotations`** - Fetch manifest config on demand
61
+
4. **`repo_pages`** - Query PDS on demand
62
+
5. **`hold_*` tables** - Query hold's PDS on demand
63
+
64
+
### Trade-offs
65
+
66
+
**Current approach (heavy caching):**
67
+
- Fast queries for UI (search, browse, stats)
68
+
- Offline resilience (PDS down doesn't break UI)
69
+
- Complex sync logic (Jetstream consumer, backfill)
70
+
- State can diverge from source of truth
71
+
72
+
**Lighter approach (query on demand):**
73
+
- Always fresh data
74
+
- Simpler codebase (no sync)
75
+
- Slower queries (network round-trips)
76
+
- Depends on PDS availability
77
+
78
+
## Current Limitation: No Cache-Miss Queries
79
+
80
+
**Finding:** There's no "query PDS on cache miss" logic. Users/manifests only enter the DB via:
81
+
1. OAuth login (user authenticates)
82
+
2. Jetstream events (firehose activity)
83
+
84
+
**Problem:** If someone visits `atcr.io/alice/myapp` before alice is indexed โ 404
85
+
86
+
**Where this happens:**
87
+
- `pkg/appview/handlers/repository.go:50-53`: If `db.GetUserByDID()` returns nil โ 404
88
+
- No fallback to `atproto.Client.ListRecords()` or similar
89
+
90
+
**This matters for Valkey migration:** If cache is ephemeral and restarts clear it, you need cache-miss logic to repopulate on demand. Otherwise:
91
+
- Restart Valkey โ all users/manifests gone
92
+
- Wait for Jetstream to re-index OR implement cache-miss queries
93
+
94
+
**Cache-miss implementation design:**
95
+
96
+
Existing code to reuse: `pkg/appview/jetstream/processor.go:43-97` (`EnsureUser`)
97
+
98
+
```go
99
+
// New: pkg/appview/cache/loader.go
100
+
101
+
type Loader struct {
102
+
cache Cache // Valkey interface
103
+
client *atproto.Client
104
+
}
105
+
106
+
// GetUser with cache-miss fallback
107
+
func (l *Loader) GetUser(ctx context.Context, did string) (*User, error) {
108
+
// 1. Try cache
109
+
if user := l.cache.GetUser(did); user != nil {
110
+
return user, nil
111
+
}
112
+
113
+
// 2. Cache miss - resolve identity (already queries network)
114
+
_, handle, pdsEndpoint, err := atproto.ResolveIdentity(ctx, did)
115
+
if err != nil {
116
+
return nil, err // User doesn't exist in network
117
+
}
118
+
119
+
// 3. Fetch profile for avatar
120
+
client := atproto.NewClient(pdsEndpoint, "", "")
121
+
profile, _ := client.GetProfileRecord(ctx, did)
122
+
avatarURL := ""
123
+
if profile != nil && profile.Avatar != nil {
124
+
avatarURL = atproto.BlobCDNURL(did, profile.Avatar.Ref.Link)
125
+
}
126
+
127
+
// 4. Cache and return
128
+
user := &User{DID: did, Handle: handle, PDSEndpoint: pdsEndpoint, Avatar: avatarURL}
129
+
l.cache.SetUser(user, 1*time.Hour)
130
+
return user, nil
131
+
}
132
+
133
+
// GetManifestsForRepo with cache-miss fallback
134
+
func (l *Loader) GetManifestsForRepo(ctx context.Context, did, repo string) ([]Manifest, error) {
135
+
cacheKey := fmt.Sprintf("manifests:%s:%s", did, repo)
136
+
137
+
// 1. Try cache
138
+
if cached := l.cache.Get(cacheKey); cached != nil {
139
+
return cached.([]Manifest), nil
140
+
}
141
+
142
+
// 2. Cache miss - get user's PDS endpoint
143
+
user, err := l.GetUser(ctx, did)
144
+
if err != nil {
145
+
return nil, err
146
+
}
147
+
148
+
// 3. Query PDS for manifests
149
+
client := atproto.NewClient(user.PDSEndpoint, "", "")
150
+
records, _, err := client.ListRecordsForRepo(ctx, did, atproto.ManifestCollection, 100, "")
151
+
if err != nil {
152
+
return nil, err
153
+
}
154
+
155
+
// 4. Filter by repository and parse
156
+
var manifests []Manifest
157
+
for _, rec := range records {
158
+
var m atproto.ManifestRecord
159
+
if err := json.Unmarshal(rec.Value, &m); err != nil {
160
+
continue
161
+
}
162
+
if m.Repository == repo {
163
+
manifests = append(manifests, convertManifest(m))
164
+
}
165
+
}
166
+
167
+
// 5. Cache and return
168
+
l.cache.Set(cacheKey, manifests, 10*time.Minute)
169
+
return manifests, nil
170
+
}
171
+
```
172
+
173
+
**Handler changes:**
174
+
```go
175
+
// Before (repository.go:45-53):
176
+
owner, err := db.GetUserByDID(h.DB, did)
177
+
if owner == nil {
178
+
RenderNotFound(w, r, h.Templates, h.RegistryURL)
179
+
return
180
+
}
181
+
182
+
// After:
183
+
owner, err := h.Loader.GetUser(r.Context(), did)
184
+
if err != nil {
185
+
RenderNotFound(w, r, h.Templates, h.RegistryURL)
186
+
return
187
+
}
188
+
```
189
+
190
+
**Performance considerations:**
191
+
- Cache hit: ~1ms (Valkey lookup)
192
+
- Cache miss: ~200-500ms (PDS round-trip)
193
+
- First request after restart: slower but correct
194
+
- Jetstream still useful for proactive warming
195
+
196
+
---
197
+
198
+
## Proposed Architecture: Valkey + ATProto
199
+
200
+
### Goal
201
+
Replace SQLite with Valkey (Redis-compatible) for ephemeral state, push remaining persistent data to ATProto.
202
+
203
+
### What goes to Valkey (ephemeral, TTL-based)
204
+
205
+
| Current Table | Valkey Key Pattern | TTL | Notes |
206
+
|---------------|-------------------|-----|-------|
207
+
| `oauth_sessions` | `oauth:{did}:{session_id}` | 90 days | Lost on restart = re-auth |
208
+
| `ui_sessions` | `ui:{session_id}` | Session duration | Lost on restart = re-login |
209
+
| `oauth_auth_requests` | `authreq:{state}` | 10 min | In-flight flows |
210
+
| `pending_device_auth` | `pending:{device_code}` | 10 min | In-flight flows |
211
+
| `firehose_cursor` | `cursor:jetstream` | None | Can restart from 0 |
212
+
| All PDS cache tables | `cache:{collection}:{did}:{rkey}` | 10-60 min | Query PDS on miss |
213
+
214
+
**Benefits:**
215
+
- Multi-instance ready (shared Valkey)
216
+
- No schema migrations
217
+
- Natural TTL expiry
218
+
- Simpler code (no SQL)
219
+
220
+
### What could become ATProto records
221
+
222
+
| Current Table | Proposed Collection | Where Stored | Open Questions |
223
+
|---------------|---------------------|--------------|----------------|
224
+
| `devices` | `io.atcr.sailor.device` | User's PDS | Privacy: IP, user-agent sensitive? |
225
+
| `repository_stats` | `io.atcr.repo.stats` | Hold's PDS or User's PDS | Who owns the stats? |
226
+
227
+
**Devices โ Valkey:**
228
+
- Move current device table to Valkey
229
+
- Key: `device:{did}:{device_id}` โ `{name, secret_hash, ip, user_agent, created_at, last_used}`
230
+
- TTL: Long (1 year?) or no expiry
231
+
- Device list: `devices:{did}` โ Set of device IDs
232
+
- Secret validation works the same, just different backend
233
+
234
+
**Service auth exploration (future):**
235
+
The challenge with pure ATProto service auth is the AppView still needs the user's OAuth session to write manifests to their PDS. The current flow:
236
+
1. User authenticates via OAuth โ AppView gets OAuth tokens
237
+
2. AppView issues registry JWT to credential helper
238
+
3. Credential helper presents JWT on each push/pull
239
+
4. AppView uses OAuth session to write to user's PDS
240
+
241
+
Service auth could work for the hold side (AppView โ Hold), but not for the user's OAuth session.
242
+
243
+
**Repository stats โ Hold's PDS:**
244
+
245
+
**Challenge discovered:** The hold's `getBlob` endpoint only receives `did` + `cid`, not the repository name.
246
+
247
+
Current flow (`proxy_blob_store.go:358-362`):
248
+
```go
249
+
xrpcURL := fmt.Sprintf("%s%s?did=%s&cid=%s&method=%s",
250
+
p.holdURL, atproto.SyncGetBlob, p.ctx.DID, dgst.String(), operation)
251
+
```
252
+
253
+
**Implementation options:**
254
+
255
+
**Option A: Add repository parameter to getBlob (recommended)**
256
+
```go
257
+
// Modified AppView call:
258
+
xrpcURL := fmt.Sprintf("%s%s?did=%s&cid=%s&method=%s&repo=%s",
259
+
p.holdURL, atproto.SyncGetBlob, p.ctx.DID, dgst.String(), operation, p.ctx.Repository)
260
+
```
261
+
262
+
```go
263
+
// Modified hold handler (xrpc.go:969):
264
+
func (h *XRPCHandler) HandleGetBlob(w http.ResponseWriter, r *http.Request) {
265
+
did := r.URL.Query().Get("did")
266
+
cidOrDigest := r.URL.Query().Get("cid")
267
+
repo := r.URL.Query().Get("repo") // NEW
268
+
269
+
// ... existing blob handling ...
270
+
271
+
// Increment stats if repo provided
272
+
if repo != "" {
273
+
go h.pds.IncrementPullCount(did, repo) // Async, non-blocking
274
+
}
275
+
}
276
+
```
277
+
278
+
**Stats record structure:**
279
+
```
280
+
Collection: io.atcr.hold.stats
281
+
Rkey: base64(did:repository) // Deterministic, unique
282
+
283
+
{
284
+
"$type": "io.atcr.hold.stats",
285
+
"did": "did:plc:alice123",
286
+
"repository": "myapp",
287
+
"pullCount": 1542,
288
+
"pushCount": 47,
289
+
"lastPull": "2025-01-15T...",
290
+
"lastPush": "2025-01-10T...",
291
+
"createdAt": "2025-01-01T..."
292
+
}
293
+
```
294
+
295
+
**Hold-side implementation:**
296
+
```go
297
+
// New file: pkg/hold/pds/stats.go
298
+
299
+
func (p *HoldPDS) IncrementPullCount(ctx context.Context, did, repo string) error {
300
+
rkey := statsRecordKey(did, repo)
301
+
302
+
// Get or create stats record
303
+
stats, err := p.GetStatsRecord(ctx, rkey)
304
+
if err != nil || stats == nil {
305
+
stats = &atproto.StatsRecord{
306
+
Type: atproto.StatsCollection,
307
+
DID: did,
308
+
Repository: repo,
309
+
PullCount: 0,
310
+
PushCount: 0,
311
+
CreatedAt: time.Now(),
312
+
}
313
+
}
314
+
315
+
// Increment and update
316
+
stats.PullCount++
317
+
stats.LastPull = time.Now()
318
+
319
+
_, err = p.repomgr.UpdateRecord(ctx, p.uid, atproto.StatsCollection, rkey, stats)
320
+
return err
321
+
}
322
+
```
323
+
324
+
**Query endpoint (new XRPC):**
325
+
```
326
+
GET /xrpc/io.atcr.hold.getStats?did={userDID}&repo={repository}
327
+
โ Returns JSON: { pullCount, pushCount, lastPull, lastPush }
328
+
329
+
GET /xrpc/io.atcr.hold.listStats?did={userDID}
330
+
โ Returns all stats for a user across all repos on this hold
331
+
```
332
+
333
+
**AppView aggregation:**
334
+
```go
335
+
func (l *Loader) GetAggregatedStats(ctx context.Context, did, repo string) (*Stats, error) {
336
+
// 1. Get all holds that have served this repo
337
+
holdDIDs, _ := l.cache.GetHoldDIDsForRepo(did, repo)
338
+
339
+
// 2. Query each hold for stats
340
+
var total Stats
341
+
for _, holdDID := range holdDIDs {
342
+
holdURL := resolveHoldDID(holdDID)
343
+
stats, _ := queryHoldStats(ctx, holdURL, did, repo)
344
+
total.PullCount += stats.PullCount
345
+
total.PushCount += stats.PushCount
346
+
}
347
+
348
+
return &total, nil
349
+
}
350
+
```
351
+
352
+
**Files to modify:**
353
+
- `pkg/atproto/lexicon.go` - Add `StatsCollection` + `StatsRecord`
354
+
- `pkg/hold/pds/stats.go` - New file for stats operations
355
+
- `pkg/hold/pds/xrpc.go` - Add `repo` param to getBlob, add stats endpoints
356
+
- `pkg/appview/storage/proxy_blob_store.go` - Pass repository to getBlob
357
+
- `pkg/appview/cache/loader.go` - Aggregation logic
358
+
359
+
### Migration Path
360
+
361
+
**Phase 1: Add Valkey infrastructure**
362
+
- Add Valkey client to AppView
363
+
- Create store interfaces that abstract SQLite vs Valkey
364
+
- Dual-write OAuth sessions to both
365
+
366
+
**Phase 2: Migrate sessions to Valkey**
367
+
- OAuth sessions, UI sessions, auth requests, pending device auth
368
+
- Remove SQLite session tables
369
+
- Test: restart AppView, users get logged out (acceptable)
370
+
371
+
**Phase 3: Migrate devices to Valkey**
372
+
- Move device store to Valkey
373
+
- Same data structure, different backend
374
+
- Consider device expiry policy
375
+
376
+
**Phase 4: Implement hold-side stats**
377
+
- Add `io.atcr.hold.stats` collection to hold's embedded PDS
378
+
- Hold increments stats on blob access
379
+
- Add XRPC endpoint: `io.atcr.hold.getStats`
380
+
381
+
**Phase 5: AppView stats aggregation**
382
+
- Track holdDids per repo in Valkey cache
383
+
- Query holds for stats, aggregate
384
+
- Cache aggregated stats with TTL
385
+
386
+
**Phase 6: Remove SQLite (optional)**
387
+
- Keep SQLite as optional cache layer for UI queries
388
+
- Or: Query PDS on demand with Valkey caching
389
+
- Jetstream still useful for real-time updates
390
+
391
+
## Summary Table
392
+
393
+
| Category | Tables | % of Schema | Truly Persistent? |
394
+
|----------|--------|-------------|-------------------|
395
+
| Auth & Sessions + Metrics | 6 | 32% | Yes |
396
+
| PDS Cache | 11 | 58% | No (rebuildable) |
397
+
| Operational | 2 | 10% | No |
398
+
399
+
**~58% of the database is cached ATProto data that could be rebuilt from PDSes.**
+11
-7
go.mod
+11
-7
go.mod
···
1
module atcr.io
2
3
-
go 1.24.7
4
5
require (
6
github.com/aws/aws-sdk-go v1.55.5
7
-
github.com/bluesky-social/indigo v0.0.0-20251031012455-0b4bd2478a61
8
github.com/distribution/distribution/v3 v3.0.0
9
github.com/distribution/reference v0.6.0
10
github.com/earthboundkid/versioninfo/v2 v2.24.1
11
github.com/go-chi/chi/v5 v5.2.3
12
github.com/golang-jwt/jwt/v5 v5.2.2
13
github.com/google/uuid v1.6.0
14
github.com/gorilla/websocket v1.5.3
···
24
github.com/multiformats/go-multihash v0.2.3
25
github.com/opencontainers/go-digest v1.0.0
26
github.com/spf13/cobra v1.8.0
27
github.com/stretchr/testify v1.10.0
28
github.com/whyrusleeping/cbor-gen v0.3.1
29
github.com/yuin/goldmark v1.7.13
30
go.opentelemetry.io/otel v1.32.0
31
go.yaml.in/yaml/v4 v4.0.0-rc.2
32
-
golang.org/x/crypto v0.39.0
33
golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028
34
gorm.io/gorm v1.25.9
35
)
···
139
go.uber.org/atomic v1.11.0 // indirect
140
go.uber.org/multierr v1.11.0 // indirect
141
go.uber.org/zap v1.26.0 // indirect
142
-
golang.org/x/net v0.37.0 // indirect
143
-
golang.org/x/sync v0.15.0 // indirect
144
-
golang.org/x/sys v0.33.0 // indirect
145
-
golang.org/x/text v0.26.0 // indirect
146
golang.org/x/time v0.6.0 // indirect
147
google.golang.org/genproto/googleapis/api v0.0.0-20241104194629-dd2ea8efbc28 // indirect
148
google.golang.org/genproto/googleapis/rpc v0.0.0-20241104194629-dd2ea8efbc28 // indirect
···
1
module atcr.io
2
3
+
go 1.25.4
4
5
require (
6
github.com/aws/aws-sdk-go v1.55.5
7
+
github.com/bluesky-social/indigo v0.0.0-20251218205144-034a2c019e64
8
github.com/distribution/distribution/v3 v3.0.0
9
github.com/distribution/reference v0.6.0
10
github.com/earthboundkid/versioninfo/v2 v2.24.1
11
github.com/go-chi/chi/v5 v5.2.3
12
+
github.com/goki/freetype v1.0.5
13
github.com/golang-jwt/jwt/v5 v5.2.2
14
github.com/google/uuid v1.6.0
15
github.com/gorilla/websocket v1.5.3
···
25
github.com/multiformats/go-multihash v0.2.3
26
github.com/opencontainers/go-digest v1.0.0
27
github.com/spf13/cobra v1.8.0
28
+
github.com/srwiley/oksvg v0.0.0-20221011165216-be6e8873101c
29
+
github.com/srwiley/rasterx v0.0.0-20220730225603-2ab79fcdd4ef
30
github.com/stretchr/testify v1.10.0
31
github.com/whyrusleeping/cbor-gen v0.3.1
32
github.com/yuin/goldmark v1.7.13
33
go.opentelemetry.io/otel v1.32.0
34
go.yaml.in/yaml/v4 v4.0.0-rc.2
35
+
golang.org/x/crypto v0.44.0
36
+
golang.org/x/image v0.34.0
37
golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028
38
gorm.io/gorm v1.25.9
39
)
···
143
go.uber.org/atomic v1.11.0 // indirect
144
go.uber.org/multierr v1.11.0 // indirect
145
go.uber.org/zap v1.26.0 // indirect
146
+
golang.org/x/net v0.47.0 // indirect
147
+
golang.org/x/sync v0.19.0 // indirect
148
+
golang.org/x/sys v0.38.0 // indirect
149
+
golang.org/x/text v0.32.0 // indirect
150
golang.org/x/time v0.6.0 // indirect
151
google.golang.org/genproto/googleapis/api v0.0.0-20241104194629-dd2ea8efbc28 // indirect
152
google.golang.org/genproto/googleapis/rpc v0.0.0-20241104194629-dd2ea8efbc28 // indirect
+24
-16
go.sum
+24
-16
go.sum
···
20
github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
21
github.com/bitly/go-hostpool v0.0.0-20171023180738-a3a6125de932 h1:mXoPYz/Ul5HYEDvkta6I8/rnYM5gSdSV2tJ6XbZuEtY=
22
github.com/bitly/go-hostpool v0.0.0-20171023180738-a3a6125de932/go.mod h1:NOuUCSz6Q9T7+igc/hlvDOUdtWKryOrtFyIVABv/p7k=
23
-
github.com/bluesky-social/indigo v0.0.0-20251031012455-0b4bd2478a61 h1:lU2NnyuvevVWtE35sb4xWBp1AQxa1Sv4XhexiWlrWng=
24
-
github.com/bluesky-social/indigo v0.0.0-20251031012455-0b4bd2478a61/go.mod h1:GuGAU33qKulpZCZNPcUeIQ4RW6KzNvOy7s8MSUXbAng=
25
github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869 h1:DDGfHa7BWjL4YnC6+E63dPcxHo2sUxDIu8g3QgEJdRY=
26
github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869/go.mod h1:Ekp36dRnpXw/yCqJaO+ZrUyxD+3VXMFFr56k5XYrpB4=
27
github.com/bshuster-repo/logrus-logstash-hook v1.0.0 h1:e+C0SB5R1pu//O4MQ3f9cFuPGoOVeF2fE4Og9otCc70=
···
90
github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
91
github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
92
github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
93
github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
94
github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
95
github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
···
367
github.com/spf13/cobra v1.8.0/go.mod h1:WXLWApfZ71AjXPya3WOlMsY9yMs7YeiHhFVlvLyhcho=
368
github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
369
github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
370
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
371
github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
372
github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
···
460
golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
461
golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
462
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
463
-
golang.org/x/crypto v0.39.0 h1:SHs+kF4LP+f+p14esP5jAoDpHU8Gu/v9lFRK6IT5imM=
464
-
golang.org/x/crypto v0.39.0/go.mod h1:L+Xg3Wf6HoL4Bn4238Z6ft6KfEpN0tJGo53AAPC632U=
465
golang.org/x/exp v0.0.0-20231110203233-9a3e6036ecaa h1:FRnLl4eNAQl8hwxVVC17teOw8kdjVDVAiFMtgUdTSRQ=
466
golang.org/x/exp v0.0.0-20231110203233-9a3e6036ecaa/go.mod h1:zk2irFbV9DP96SEBUUAy67IdHUaZuSnrz1n472HUCLE=
467
golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
468
golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
469
golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
470
golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
471
golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
472
-
golang.org/x/mod v0.25.0 h1:n7a+ZbQKQA/Ysbyb0/6IbB1H/X41mKgbhfv7AfG/44w=
473
-
golang.org/x/mod v0.25.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
474
golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
475
golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
476
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
···
479
golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
480
golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
481
golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
482
-
golang.org/x/net v0.37.0 h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c=
483
-
golang.org/x/net v0.37.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
484
golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
485
golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
486
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
487
golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
488
golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
489
golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
490
-
golang.org/x/sync v0.15.0 h1:KWH3jNZsfyT6xfAfKiz6MRNmd46ByHDYaZ7KSkCtdW8=
491
-
golang.org/x/sync v0.15.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
492
golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
493
golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
494
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
···
502
golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
503
golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
504
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
505
-
golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
506
-
golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
507
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
508
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
509
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
510
-
golang.org/x/text v0.26.0 h1:P42AVeLghgTYr4+xUnTRKDMqpar+PtX7KWuNQL21L8M=
511
-
golang.org/x/text v0.26.0/go.mod h1:QK15LZJUUQVJxhz7wXgxSy/CJaTFjd0G+YLonydOVQA=
512
golang.org/x/time v0.6.0 h1:eTDhh4ZXt5Qf0augr54TN6suAUudPcawVZeIAPU7D4U=
513
golang.org/x/time v0.6.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
514
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
···
521
golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
522
golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
523
golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
524
-
golang.org/x/tools v0.33.0 h1:4qz2S3zmRxbGIhDIAgjxvFutSvH5EfnsYrRBj0UI0bc=
525
-
golang.org/x/tools v0.33.0/go.mod h1:CIJMaWEY88juyUfo7UbgPqbC8rU2OqfAV1h2Qp0oMYI=
526
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
527
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
528
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
···
20
github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
21
github.com/bitly/go-hostpool v0.0.0-20171023180738-a3a6125de932 h1:mXoPYz/Ul5HYEDvkta6I8/rnYM5gSdSV2tJ6XbZuEtY=
22
github.com/bitly/go-hostpool v0.0.0-20171023180738-a3a6125de932/go.mod h1:NOuUCSz6Q9T7+igc/hlvDOUdtWKryOrtFyIVABv/p7k=
23
+
github.com/bluesky-social/indigo v0.0.0-20251218205144-034a2c019e64 h1:84EWie083DZT0eMo76kcZ0mBDcLUmWQu5UFE8/3ZW4k=
24
+
github.com/bluesky-social/indigo v0.0.0-20251218205144-034a2c019e64/go.mod h1:KIy0FgNQacp4uv2Z7xhNkV3qZiUSGuRky97s7Pa4v+o=
25
github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869 h1:DDGfHa7BWjL4YnC6+E63dPcxHo2sUxDIu8g3QgEJdRY=
26
github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869/go.mod h1:Ekp36dRnpXw/yCqJaO+ZrUyxD+3VXMFFr56k5XYrpB4=
27
github.com/bshuster-repo/logrus-logstash-hook v1.0.0 h1:e+C0SB5R1pu//O4MQ3f9cFuPGoOVeF2fE4Og9otCc70=
···
90
github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
91
github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
92
github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
93
+
github.com/goki/freetype v1.0.5 h1:yi2lQeUhXnBgSMqYd0vVmPw6RnnfIeTP3N4uvaJXd7A=
94
+
github.com/goki/freetype v1.0.5/go.mod h1:wKmKxddbzKmeci9K96Wknn5kjTWLyfC8tKOqAFbEX8E=
95
github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
96
github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
97
github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
···
369
github.com/spf13/cobra v1.8.0/go.mod h1:WXLWApfZ71AjXPya3WOlMsY9yMs7YeiHhFVlvLyhcho=
370
github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
371
github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
372
+
github.com/srwiley/oksvg v0.0.0-20221011165216-be6e8873101c h1:km8GpoQut05eY3GiYWEedbTT0qnSxrCjsVbb7yKY1KE=
373
+
github.com/srwiley/oksvg v0.0.0-20221011165216-be6e8873101c/go.mod h1:cNQ3dwVJtS5Hmnjxy6AgTPd0Inb3pW05ftPSX7NZO7Q=
374
+
github.com/srwiley/rasterx v0.0.0-20220730225603-2ab79fcdd4ef h1:Ch6Q+AZUxDBCVqdkI8FSpFyZDtCVBc2VmejdNrm5rRQ=
375
+
github.com/srwiley/rasterx v0.0.0-20220730225603-2ab79fcdd4ef/go.mod h1:nXTWP6+gD5+LUJ8krVhhoeHjvHTutPxMYl5SvkcnJNE=
376
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
377
github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
378
github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
···
466
golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
467
golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
468
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
469
+
golang.org/x/crypto v0.44.0 h1:A97SsFvM3AIwEEmTBiaxPPTYpDC47w720rdiiUvgoAU=
470
+
golang.org/x/crypto v0.44.0/go.mod h1:013i+Nw79BMiQiMsOPcVCB5ZIJbYkerPrGnOa00tvmc=
471
golang.org/x/exp v0.0.0-20231110203233-9a3e6036ecaa h1:FRnLl4eNAQl8hwxVVC17teOw8kdjVDVAiFMtgUdTSRQ=
472
golang.org/x/exp v0.0.0-20231110203233-9a3e6036ecaa/go.mod h1:zk2irFbV9DP96SEBUUAy67IdHUaZuSnrz1n472HUCLE=
473
+
golang.org/x/image v0.34.0 h1:33gCkyw9hmwbZJeZkct8XyR11yH889EQt/QH4VmXMn8=
474
+
golang.org/x/image v0.34.0/go.mod h1:2RNFBZRB+vnwwFil8GkMdRvrJOFd1AzdZI6vOY+eJVU=
475
golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
476
golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
477
golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
478
golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
479
golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
480
+
golang.org/x/mod v0.30.0 h1:fDEXFVZ/fmCKProc/yAXXUijritrDzahmwwefnjoPFk=
481
+
golang.org/x/mod v0.30.0/go.mod h1:lAsf5O2EvJeSFMiBxXDki7sCgAxEUcZHXoXMKT4GJKc=
482
golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
483
golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
484
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
···
487
golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
488
golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
489
golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
490
+
golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
491
+
golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
492
golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
493
golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
494
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
495
golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
496
golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
497
golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
498
+
golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
499
+
golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
500
golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
501
golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
502
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
···
510
golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
511
golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
512
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
513
+
golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
514
+
golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
515
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
516
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
517
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
518
+
golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU=
519
+
golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY=
520
golang.org/x/time v0.6.0 h1:eTDhh4ZXt5Qf0augr54TN6suAUudPcawVZeIAPU7D4U=
521
golang.org/x/time v0.6.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
522
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
···
529
golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
530
golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
531
golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
532
+
golang.org/x/tools v0.39.0 h1:ik4ho21kwuQln40uelmciQPp9SipgNDdrafrYA4TmQQ=
533
+
golang.org/x/tools v0.39.0/go.mod h1:JnefbkDPyD8UU2kI5fuf8ZX4/yUeh9W877ZeBONxUqQ=
534
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
535
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
536
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+21
lexicons/io/atcr/authFullApp.json
+21
lexicons/io/atcr/authFullApp.json
···
···
1
+
{
2
+
"lexicon": 1,
3
+
"id": "io.atcr.authFullApp",
4
+
"defs": {
5
+
"main": {
6
+
"type": "permission-set",
7
+
"title": "AT Container Registry",
8
+
"title:langs": {},
9
+
"detail": "Push and pull container images to the ATProto Container Registry. Includes creating and managing image manifests, tags, and repository settings.",
10
+
"detail:langs": {},
11
+
"permissions": [
12
+
{
13
+
"type": "permission",
14
+
"resource": "repo",
15
+
"action": ["create", "update", "delete"],
16
+
"collection": ["io.atcr.manifest", "io.atcr.tag", "io.atcr.sailor.star", "io.atcr.sailor.profile", "io.atcr.repo.page"]
17
+
}
18
+
]
19
+
}
20
+
}
21
+
}
+49
lexicons/io/atcr/hold/captain.json
+49
lexicons/io/atcr/hold/captain.json
···
···
1
+
{
2
+
"lexicon": 1,
3
+
"id": "io.atcr.hold.captain",
4
+
"defs": {
5
+
"main": {
6
+
"type": "record",
7
+
"description": "Represents the hold's ownership and metadata. Stored as a singleton record at rkey 'self' in the hold's embedded PDS.",
8
+
"key": "literal:self",
9
+
"record": {
10
+
"type": "object",
11
+
"required": ["owner", "public", "allowAllCrew", "enableBlueskyPosts", "deployedAt"],
12
+
"properties": {
13
+
"owner": {
14
+
"type": "string",
15
+
"format": "did",
16
+
"description": "DID of the hold owner"
17
+
},
18
+
"public": {
19
+
"type": "boolean",
20
+
"description": "Whether this hold allows public blob reads (pulls) without authentication"
21
+
},
22
+
"allowAllCrew": {
23
+
"type": "boolean",
24
+
"description": "Allow any authenticated user to register as crew"
25
+
},
26
+
"enableBlueskyPosts": {
27
+
"type": "boolean",
28
+
"description": "Enable Bluesky posts when manifests are pushed"
29
+
},
30
+
"deployedAt": {
31
+
"type": "string",
32
+
"format": "datetime",
33
+
"description": "RFC3339 timestamp of when the hold was deployed"
34
+
},
35
+
"region": {
36
+
"type": "string",
37
+
"description": "S3 region where blobs are stored",
38
+
"maxLength": 64
39
+
},
40
+
"provider": {
41
+
"type": "string",
42
+
"description": "Deployment provider (e.g., fly.io, aws, etc.)",
43
+
"maxLength": 64
44
+
}
45
+
}
46
+
}
47
+
}
48
+
}
49
+
}
+15
-20
lexicons/io/atcr/hold/crew.json
+15
-20
lexicons/io/atcr/hold/crew.json
···
4
"defs": {
5
"main": {
6
"type": "record",
7
-
"description": "Crew membership for a storage hold. Stored in the hold owner's PDS to maintain control over write access. Supports explicit DIDs (with backlinks), wildcard access, and handle patterns. Crew members can push blobs to the hold. Read access is controlled by the hold's public flag, not crew membership.",
8
"key": "any",
9
"record": {
10
"type": "object",
11
-
"required": ["hold", "role", "createdAt"],
12
"properties": {
13
-
"hold": {
14
-
"type": "string",
15
-
"format": "at-uri",
16
-
"description": "AT-URI of the hold record (e.g., 'at://did:plc:owner/io.atcr.hold/hold1')"
17
-
},
18
"member": {
19
"type": "string",
20
"format": "did",
21
-
"description": "DID of crew member (for individual access with backlinks). Exactly one of 'member' or 'memberPattern' must be set."
22
-
},
23
-
"memberPattern": {
24
-
"type": "string",
25
-
"description": "Pattern for matching multiple users. Supports wildcards: '*' (all users), '*.domain.com' (handle glob). Exactly one of 'member' or 'memberPattern' must be set."
26
},
27
"role": {
28
"type": "string",
29
-
"description": "Member's role/permissions for write access. 'owner' = hold owner, 'write' = can push blobs. Read access is controlled by hold's public flag.",
30
-
"knownValues": ["owner", "write"]
31
},
32
-
"expiresAt": {
33
-
"type": "string",
34
-
"format": "datetime",
35
-
"description": "Optional expiration for this membership"
36
},
37
-
"createdAt": {
38
"type": "string",
39
"format": "datetime",
40
-
"description": "Membership creation timestamp"
41
}
42
}
43
}
···
4
"defs": {
5
"main": {
6
"type": "record",
7
+
"description": "Crew member in a hold's embedded PDS. Grants access permissions to push blobs to the hold. Stored in the hold's embedded PDS (one record per member).",
8
"key": "any",
9
"record": {
10
"type": "object",
11
+
"required": ["member", "role", "permissions", "addedAt"],
12
"properties": {
13
"member": {
14
"type": "string",
15
"format": "did",
16
+
"description": "DID of the crew member"
17
},
18
"role": {
19
"type": "string",
20
+
"description": "Member's role in the hold",
21
+
"knownValues": ["owner", "admin", "write", "read"],
22
+
"maxLength": 32
23
},
24
+
"permissions": {
25
+
"type": "array",
26
+
"description": "Specific permissions granted to this member",
27
+
"items": {
28
+
"type": "string",
29
+
"maxLength": 64
30
+
}
31
},
32
+
"addedAt": {
33
"type": "string",
34
"format": "datetime",
35
+
"description": "RFC3339 timestamp of when the member was added"
36
}
37
}
38
}
+51
lexicons/io/atcr/hold/layer.json
+51
lexicons/io/atcr/hold/layer.json
···
···
1
+
{
2
+
"lexicon": 1,
3
+
"id": "io.atcr.hold.layer",
4
+
"defs": {
5
+
"main": {
6
+
"type": "record",
7
+
"key": "tid",
8
+
"description": "Represents metadata about a container layer stored in the hold. Stored in the hold's embedded PDS for tracking and analytics.",
9
+
"record": {
10
+
"type": "object",
11
+
"required": ["digest", "size", "mediaType", "repository", "userDid", "userHandle", "createdAt"],
12
+
"properties": {
13
+
"digest": {
14
+
"type": "string",
15
+
"description": "Layer digest (e.g., sha256:abc123...)",
16
+
"maxLength": 128
17
+
},
18
+
"size": {
19
+
"type": "integer",
20
+
"description": "Size in bytes"
21
+
},
22
+
"mediaType": {
23
+
"type": "string",
24
+
"description": "Media type (e.g., application/vnd.oci.image.layer.v1.tar+gzip)",
25
+
"maxLength": 128
26
+
},
27
+
"repository": {
28
+
"type": "string",
29
+
"description": "Repository this layer belongs to",
30
+
"maxLength": 255
31
+
},
32
+
"userDid": {
33
+
"type": "string",
34
+
"format": "did",
35
+
"description": "DID of user who uploaded this layer"
36
+
},
37
+
"userHandle": {
38
+
"type": "string",
39
+
"format": "handle",
40
+
"description": "Handle of user (for display purposes)"
41
+
},
42
+
"createdAt": {
43
+
"type": "string",
44
+
"format": "datetime",
45
+
"description": "RFC3339 timestamp of when the layer was uploaded"
46
+
}
47
+
}
48
+
}
49
+
}
50
+
}
51
+
}
-37
lexicons/io/atcr/hold.json
-37
lexicons/io/atcr/hold.json
···
1
-
{
2
-
"lexicon": 1,
3
-
"id": "io.atcr.hold",
4
-
"defs": {
5
-
"main": {
6
-
"type": "record",
7
-
"description": "Storage hold definition for Bring Your Own Storage (BYOS). Defines where blobs are stored.",
8
-
"key": "any",
9
-
"record": {
10
-
"type": "object",
11
-
"required": ["endpoint", "owner", "createdAt"],
12
-
"properties": {
13
-
"endpoint": {
14
-
"type": "string",
15
-
"format": "uri",
16
-
"description": "URL of the hold service (e.g., 'https://hold1.example.com')"
17
-
},
18
-
"owner": {
19
-
"type": "string",
20
-
"format": "did",
21
-
"description": "DID of the hold owner"
22
-
},
23
-
"public": {
24
-
"type": "boolean",
25
-
"description": "Whether this hold allows public blob reads (pulls) without authentication. Writes always require crew membership.",
26
-
"default": false
27
-
},
28
-
"createdAt": {
29
-
"type": "string",
30
-
"format": "datetime",
31
-
"description": "Hold creation timestamp"
32
-
}
33
-
}
34
-
}
35
-
}
36
-
}
37
-
}
···
+35
-19
lexicons/io/atcr/manifest.json
+35
-19
lexicons/io/atcr/manifest.json
···
8
"key": "tid",
9
"record": {
10
"type": "object",
11
-
"required": ["repository", "digest", "mediaType", "schemaVersion", "holdEndpoint", "createdAt"],
12
"properties": {
13
"repository": {
14
"type": "string",
···
17
},
18
"digest": {
19
"type": "string",
20
-
"description": "Content digest (e.g., 'sha256:abc123...')"
21
},
22
"holdEndpoint": {
23
"type": "string",
24
"format": "uri",
25
-
"description": "Hold service endpoint where blobs are stored (e.g., 'https://hold1.bob.com'). Historical reference."
26
},
27
"mediaType": {
28
"type": "string",
···
32
"application/vnd.docker.distribution.manifest.v2+json",
33
"application/vnd.oci.image.index.v1+json",
34
"application/vnd.docker.distribution.manifest.list.v2+json"
35
-
]
36
},
37
"schemaVersion": {
38
"type": "integer",
···
60
"description": "Referenced manifests (for manifest lists/indexes)"
61
},
62
"annotations": {
63
-
"type": "object",
64
-
"description": "Optional metadata annotations"
65
},
66
"subject": {
67
"type": "ref",
···
87
"properties": {
88
"mediaType": {
89
"type": "string",
90
-
"description": "MIME type of the blob"
91
},
92
"size": {
93
"type": "integer",
···
95
},
96
"digest": {
97
"type": "string",
98
-
"description": "Content digest (e.g., 'sha256:...')"
99
},
100
"urls": {
101
"type": "array",
···
106
"description": "Optional direct URLs to blob (for BYOS)"
107
},
108
"annotations": {
109
-
"type": "object",
110
-
"description": "Optional metadata"
111
}
112
}
113
},
···
118
"properties": {
119
"mediaType": {
120
"type": "string",
121
-
"description": "Media type of the referenced manifest"
122
},
123
"size": {
124
"type": "integer",
···
126
},
127
"digest": {
128
"type": "string",
129
-
"description": "Content digest (e.g., 'sha256:...')"
130
},
131
"platform": {
132
"type": "ref",
···
134
"description": "Platform information for this manifest"
135
},
136
"annotations": {
137
-
"type": "object",
138
-
"description": "Optional metadata"
139
}
140
}
141
},
···
146
"properties": {
147
"architecture": {
148
"type": "string",
149
-
"description": "CPU architecture (e.g., 'amd64', 'arm64', 'arm')"
150
},
151
"os": {
152
"type": "string",
153
-
"description": "Operating system (e.g., 'linux', 'windows', 'darwin')"
154
},
155
"osVersion": {
156
"type": "string",
157
-
"description": "Optional OS version"
158
},
159
"osFeatures": {
160
"type": "array",
161
"items": {
162
-
"type": "string"
163
},
164
"description": "Optional OS features"
165
},
166
"variant": {
167
"type": "string",
168
-
"description": "Optional CPU variant (e.g., 'v7' for ARM)"
169
}
170
}
171
}
···
8
"key": "tid",
9
"record": {
10
"type": "object",
11
+
"required": ["repository", "digest", "mediaType", "schemaVersion", "createdAt"],
12
"properties": {
13
"repository": {
14
"type": "string",
···
17
},
18
"digest": {
19
"type": "string",
20
+
"description": "Content digest (e.g., 'sha256:abc123...')",
21
+
"maxLength": 128
22
+
},
23
+
"holdDid": {
24
+
"type": "string",
25
+
"format": "did",
26
+
"description": "DID of the hold service where blobs are stored (e.g., 'did:web:hold01.atcr.io'). Primary reference for hold resolution."
27
},
28
"holdEndpoint": {
29
"type": "string",
30
"format": "uri",
31
+
"description": "Hold service endpoint URL where blobs are stored. DEPRECATED: Use holdDid instead. Kept for backward compatibility."
32
},
33
"mediaType": {
34
"type": "string",
···
38
"application/vnd.docker.distribution.manifest.v2+json",
39
"application/vnd.oci.image.index.v1+json",
40
"application/vnd.docker.distribution.manifest.list.v2+json"
41
+
],
42
+
"maxLength": 128
43
},
44
"schemaVersion": {
45
"type": "integer",
···
67
"description": "Referenced manifests (for manifest lists/indexes)"
68
},
69
"annotations": {
70
+
"type": "unknown",
71
+
"description": "Optional OCI annotation metadata. Map of string keys to string values (e.g., org.opencontainers.image.title โ 'My App')."
72
},
73
"subject": {
74
"type": "ref",
···
94
"properties": {
95
"mediaType": {
96
"type": "string",
97
+
"description": "MIME type of the blob",
98
+
"maxLength": 128
99
},
100
"size": {
101
"type": "integer",
···
103
},
104
"digest": {
105
"type": "string",
106
+
"description": "Content digest (e.g., 'sha256:...')",
107
+
"maxLength": 128
108
},
109
"urls": {
110
"type": "array",
···
115
"description": "Optional direct URLs to blob (for BYOS)"
116
},
117
"annotations": {
118
+
"type": "unknown",
119
+
"description": "Optional OCI annotation metadata. Map of string keys to string values."
120
}
121
}
122
},
···
127
"properties": {
128
"mediaType": {
129
"type": "string",
130
+
"description": "Media type of the referenced manifest",
131
+
"maxLength": 128
132
},
133
"size": {
134
"type": "integer",
···
136
},
137
"digest": {
138
"type": "string",
139
+
"description": "Content digest (e.g., 'sha256:...')",
140
+
"maxLength": 128
141
},
142
"platform": {
143
"type": "ref",
···
145
"description": "Platform information for this manifest"
146
},
147
"annotations": {
148
+
"type": "unknown",
149
+
"description": "Optional OCI annotation metadata. Map of string keys to string values."
150
}
151
}
152
},
···
157
"properties": {
158
"architecture": {
159
"type": "string",
160
+
"description": "CPU architecture (e.g., 'amd64', 'arm64', 'arm')",
161
+
"maxLength": 32
162
},
163
"os": {
164
"type": "string",
165
+
"description": "Operating system (e.g., 'linux', 'windows', 'darwin')",
166
+
"maxLength": 32
167
},
168
"osVersion": {
169
"type": "string",
170
+
"description": "Optional OS version",
171
+
"maxLength": 64
172
},
173
"osFeatures": {
174
"type": "array",
175
"items": {
176
+
"type": "string",
177
+
"maxLength": 64
178
},
179
"description": "Optional OS features"
180
},
181
"variant": {
182
"type": "string",
183
+
"description": "Optional CPU variant (e.g., 'v7' for ARM)",
184
+
"maxLength": 32
185
}
186
}
187
}
+43
lexicons/io/atcr/repo/page.json
+43
lexicons/io/atcr/repo/page.json
···
···
1
+
{
2
+
"lexicon": 1,
3
+
"id": "io.atcr.repo.page",
4
+
"defs": {
5
+
"main": {
6
+
"type": "record",
7
+
"description": "Repository page metadata including description and avatar. Users can edit this directly in their PDS to customize their repository page.",
8
+
"key": "any",
9
+
"record": {
10
+
"type": "object",
11
+
"required": ["repository", "createdAt", "updatedAt"],
12
+
"properties": {
13
+
"repository": {
14
+
"type": "string",
15
+
"description": "The name of the repository (e.g., 'myapp'). Must match the rkey.",
16
+
"maxLength": 256
17
+
},
18
+
"description": {
19
+
"type": "string",
20
+
"description": "Markdown README/description content for the repository page.",
21
+
"maxLength": 100000
22
+
},
23
+
"avatar": {
24
+
"type": "blob",
25
+
"description": "Repository avatar/icon image.",
26
+
"accept": ["image/png", "image/jpeg", "image/webp"],
27
+
"maxSize": 3000000
28
+
},
29
+
"createdAt": {
30
+
"type": "string",
31
+
"format": "datetime",
32
+
"description": "Record creation timestamp"
33
+
},
34
+
"updatedAt": {
35
+
"type": "string",
36
+
"format": "datetime",
37
+
"description": "Record last updated timestamp"
38
+
}
39
+
}
40
+
}
41
+
}
42
+
}
43
+
}
+2
-1
lexicons/io/atcr/tag.json
+2
-1
lexicons/io/atcr/tag.json
+52
-12
pkg/appview/config.go
+52
-12
pkg/appview/config.go
···
13
"net/url"
14
"os"
15
"strconv"
16
"time"
17
18
"github.com/distribution/distribution/v3/configuration"
···
20
21
// Config represents the AppView service configuration
22
type Config struct {
23
-
Version string `yaml:"version"`
24
-
LogLevel string `yaml:"log_level"`
25
-
Server ServerConfig `yaml:"server"`
26
-
UI UIConfig `yaml:"ui"`
27
-
Health HealthConfig `yaml:"health"`
28
-
Jetstream JetstreamConfig `yaml:"jetstream"`
29
-
Auth AuthConfig `yaml:"auth"`
30
-
Distribution *configuration.Configuration `yaml:"-"` // Wrapped distribution config for compatibility
31
}
32
33
// ServerConfig defines server settings
···
77
78
// CheckInterval is the hold health check refresh interval (from env: ATCR_HEALTH_CHECK_INTERVAL, default: 15m)
79
CheckInterval time.Duration `yaml:"check_interval"`
80
-
81
-
// ReadmeCacheTTL is the README cache TTL (from env: ATCR_README_CACHE_TTL, default: 1h)
82
-
ReadmeCacheTTL time.Duration `yaml:"readme_cache_ttl"`
83
}
84
85
// JetstreamConfig defines ATProto Jetstream settings
···
113
ServiceName string `yaml:"service_name"`
114
}
115
116
// LoadConfigFromEnv builds a complete configuration from environment variables
117
// This follows the same pattern as the hold service (no config files, only env vars)
118
func LoadConfigFromEnv() (*Config, error) {
···
148
// Health and cache configuration
149
cfg.Health.CacheTTL = getDurationOrDefault("ATCR_HEALTH_CACHE_TTL", 15*time.Minute)
150
cfg.Health.CheckInterval = getDurationOrDefault("ATCR_HEALTH_CHECK_INTERVAL", 15*time.Minute)
151
-
cfg.Health.ReadmeCacheTTL = getDurationOrDefault("ATCR_README_CACHE_TTL", 1*time.Hour)
152
153
// Jetstream configuration
154
cfg.Jetstream.URL = getEnvOrDefault("JETSTREAM_URL", "wss://jetstream2.us-west.bsky.network/subscribe")
···
170
171
// Derive service name from base URL or env var (used for JWT issuer and service)
172
cfg.Auth.ServiceName = getServiceName(cfg.Server.BaseURL)
173
174
// Build distribution configuration for compatibility with distribution library
175
distConfig, err := buildDistributionConfig(cfg)
···
361
362
return parsed
363
}
···
13
"net/url"
14
"os"
15
"strconv"
16
+
"strings"
17
"time"
18
19
"github.com/distribution/distribution/v3/configuration"
···
21
22
// Config represents the AppView service configuration
23
type Config struct {
24
+
Version string `yaml:"version"`
25
+
LogLevel string `yaml:"log_level"`
26
+
Server ServerConfig `yaml:"server"`
27
+
UI UIConfig `yaml:"ui"`
28
+
Health HealthConfig `yaml:"health"`
29
+
Jetstream JetstreamConfig `yaml:"jetstream"`
30
+
Auth AuthConfig `yaml:"auth"`
31
+
CredentialHelper CredentialHelperConfig `yaml:"credential_helper"`
32
+
Distribution *configuration.Configuration `yaml:"-"` // Wrapped distribution config for compatibility
33
}
34
35
// ServerConfig defines server settings
···
79
80
// CheckInterval is the hold health check refresh interval (from env: ATCR_HEALTH_CHECK_INTERVAL, default: 15m)
81
CheckInterval time.Duration `yaml:"check_interval"`
82
}
83
84
// JetstreamConfig defines ATProto Jetstream settings
···
112
ServiceName string `yaml:"service_name"`
113
}
114
115
+
// CredentialHelperConfig defines credential helper version and download settings
116
+
type CredentialHelperConfig struct {
117
+
// Version is the latest credential helper version (from env: ATCR_CREDENTIAL_HELPER_VERSION)
118
+
// e.g., "v0.0.2"
119
+
Version string `yaml:"version"`
120
+
121
+
// TangledRepo is the Tangled repository URL for downloads (from env: ATCR_CREDENTIAL_HELPER_TANGLED_REPO)
122
+
// Default: "https://tangled.org/@evan.jarrett.net/at-container-registry"
123
+
TangledRepo string `yaml:"tangled_repo"`
124
+
125
+
// Checksums is a comma-separated list of platform:sha256 pairs (from env: ATCR_CREDENTIAL_HELPER_CHECKSUMS)
126
+
// e.g., "linux_amd64:abc123,darwin_arm64:def456"
127
+
Checksums map[string]string `yaml:"-"`
128
+
}
129
+
130
// LoadConfigFromEnv builds a complete configuration from environment variables
131
// This follows the same pattern as the hold service (no config files, only env vars)
132
func LoadConfigFromEnv() (*Config, error) {
···
162
// Health and cache configuration
163
cfg.Health.CacheTTL = getDurationOrDefault("ATCR_HEALTH_CACHE_TTL", 15*time.Minute)
164
cfg.Health.CheckInterval = getDurationOrDefault("ATCR_HEALTH_CHECK_INTERVAL", 15*time.Minute)
165
166
// Jetstream configuration
167
cfg.Jetstream.URL = getEnvOrDefault("JETSTREAM_URL", "wss://jetstream2.us-west.bsky.network/subscribe")
···
183
184
// Derive service name from base URL or env var (used for JWT issuer and service)
185
cfg.Auth.ServiceName = getServiceName(cfg.Server.BaseURL)
186
+
187
+
// Credential helper configuration
188
+
cfg.CredentialHelper.Version = os.Getenv("ATCR_CREDENTIAL_HELPER_VERSION")
189
+
cfg.CredentialHelper.TangledRepo = getEnvOrDefault("ATCR_CREDENTIAL_HELPER_TANGLED_REPO", "https://tangled.org/@evan.jarrett.net/at-container-registry")
190
+
cfg.CredentialHelper.Checksums = parseChecksums(os.Getenv("ATCR_CREDENTIAL_HELPER_CHECKSUMS"))
191
192
// Build distribution configuration for compatibility with distribution library
193
distConfig, err := buildDistributionConfig(cfg)
···
379
380
return parsed
381
}
382
+
383
+
// parseChecksums parses a comma-separated list of platform:sha256 pairs
384
+
// e.g., "linux_amd64:abc123,darwin_arm64:def456"
385
+
func parseChecksums(checksumsStr string) map[string]string {
386
+
checksums := make(map[string]string)
387
+
if checksumsStr == "" {
388
+
return checksums
389
+
}
390
+
391
+
pairs := strings.Split(checksumsStr, ",")
392
+
for _, pair := range pairs {
393
+
parts := strings.SplitN(strings.TrimSpace(pair), ":", 2)
394
+
if len(parts) == 2 {
395
+
platform := strings.TrimSpace(parts[0])
396
+
hash := strings.TrimSpace(parts[1])
397
+
if platform != "" && hash != "" {
398
+
checksums[platform] = hash
399
+
}
400
+
}
401
+
}
402
+
return checksums
403
+
}
+11
pkg/appview/db/migrations/0005_add_attestation_column.yaml
+11
pkg/appview/db/migrations/0005_add_attestation_column.yaml
···
···
1
+
description: Add is_attestation column to manifest_references table
2
+
query: |
3
+
-- Add is_attestation column to track attestation manifests
4
+
-- Attestation manifests have vnd.docker.reference.type = "attestation-manifest"
5
+
ALTER TABLE manifest_references ADD COLUMN is_attestation BOOLEAN DEFAULT FALSE;
6
+
7
+
-- Mark existing unknown/unknown platforms as attestations
8
+
-- Docker BuildKit attestation manifests always have unknown/unknown platform
9
+
UPDATE manifest_references
10
+
SET is_attestation = 1
11
+
WHERE platform_os = 'unknown' AND platform_architecture = 'unknown';
+18
pkg/appview/db/migrations/0006_add_repo_pages.yaml
+18
pkg/appview/db/migrations/0006_add_repo_pages.yaml
···
···
1
+
description: Add repo_pages table and remove readme_cache
2
+
query: |
3
+
-- Create repo_pages table for storing repository page metadata
4
+
-- This replaces readme_cache with PDS-synced data
5
+
CREATE TABLE IF NOT EXISTS repo_pages (
6
+
did TEXT NOT NULL,
7
+
repository TEXT NOT NULL,
8
+
description TEXT,
9
+
avatar_cid TEXT,
10
+
created_at TIMESTAMP NOT NULL,
11
+
updated_at TIMESTAMP NOT NULL,
12
+
PRIMARY KEY(did, repository),
13
+
FOREIGN KEY(did) REFERENCES users(did) ON DELETE CASCADE
14
+
);
15
+
CREATE INDEX IF NOT EXISTS idx_repo_pages_did ON repo_pages(did);
16
+
17
+
-- Drop readme_cache table (no longer needed)
18
+
DROP TABLE IF EXISTS readme_cache;
+11
-8
pkg/appview/db/models.go
+11
-8
pkg/appview/db/models.go
···
45
PlatformOS string
46
PlatformVariant string
47
PlatformOSVersion string
48
ReferenceIndex int
49
}
50
···
147
// TagWithPlatforms extends Tag with platform information
148
type TagWithPlatforms struct {
149
Tag
150
-
Platforms []PlatformInfo
151
-
IsMultiArch bool
152
}
153
154
// ManifestWithMetadata extends Manifest with tags and platform information
155
type ManifestWithMetadata struct {
156
Manifest
157
-
Tags []string
158
-
Platforms []PlatformInfo
159
-
PlatformCount int
160
-
IsManifestList bool
161
-
Reachable bool // Whether the hold endpoint is reachable
162
-
Pending bool // Whether health check is still in progress
163
}
···
45
PlatformOS string
46
PlatformVariant string
47
PlatformOSVersion string
48
+
IsAttestation bool // true if vnd.docker.reference.type = "attestation-manifest"
49
ReferenceIndex int
50
}
51
···
148
// TagWithPlatforms extends Tag with platform information
149
type TagWithPlatforms struct {
150
Tag
151
+
Platforms []PlatformInfo
152
+
IsMultiArch bool
153
+
HasAttestations bool // true if manifest list contains attestation references
154
}
155
156
// ManifestWithMetadata extends Manifest with tags and platform information
157
type ManifestWithMetadata struct {
158
Manifest
159
+
Tags []string
160
+
Platforms []PlatformInfo
161
+
PlatformCount int
162
+
IsManifestList bool
163
+
HasAttestations bool // true if manifest list contains attestation references
164
+
Reachable bool // Whether the hold endpoint is reachable
165
+
Pending bool // Whether health check is still in progress
166
}
+97
pkg/appview/db/oauth_store.go
+97
pkg/appview/db/oauth_store.go
···
337
return true
338
}
339
340
+
// GetSessionStats returns statistics about stored OAuth sessions
341
+
// Useful for monitoring and debugging session health
342
+
func (s *OAuthStore) GetSessionStats(ctx context.Context) (map[string]interface{}, error) {
343
+
stats := make(map[string]interface{})
344
+
345
+
// Total sessions
346
+
var totalSessions int
347
+
err := s.db.QueryRowContext(ctx, `SELECT COUNT(*) FROM oauth_sessions`).Scan(&totalSessions)
348
+
if err != nil {
349
+
return nil, fmt.Errorf("failed to count sessions: %w", err)
350
+
}
351
+
stats["total_sessions"] = totalSessions
352
+
353
+
// Sessions by age
354
+
var sessionsOlderThan1Hour, sessionsOlderThan1Day, sessionsOlderThan7Days int
355
+
356
+
err = s.db.QueryRowContext(ctx, `
357
+
SELECT COUNT(*) FROM oauth_sessions
358
+
WHERE updated_at < datetime('now', '-1 hour')
359
+
`).Scan(&sessionsOlderThan1Hour)
360
+
if err == nil {
361
+
stats["sessions_idle_1h+"] = sessionsOlderThan1Hour
362
+
}
363
+
364
+
err = s.db.QueryRowContext(ctx, `
365
+
SELECT COUNT(*) FROM oauth_sessions
366
+
WHERE updated_at < datetime('now', '-1 day')
367
+
`).Scan(&sessionsOlderThan1Day)
368
+
if err == nil {
369
+
stats["sessions_idle_1d+"] = sessionsOlderThan1Day
370
+
}
371
+
372
+
err = s.db.QueryRowContext(ctx, `
373
+
SELECT COUNT(*) FROM oauth_sessions
374
+
WHERE updated_at < datetime('now', '-7 days')
375
+
`).Scan(&sessionsOlderThan7Days)
376
+
if err == nil {
377
+
stats["sessions_idle_7d+"] = sessionsOlderThan7Days
378
+
}
379
+
380
+
// Recent sessions (updated in last 5 minutes)
381
+
var recentSessions int
382
+
err = s.db.QueryRowContext(ctx, `
383
+
SELECT COUNT(*) FROM oauth_sessions
384
+
WHERE updated_at > datetime('now', '-5 minutes')
385
+
`).Scan(&recentSessions)
386
+
if err == nil {
387
+
stats["sessions_active_5m"] = recentSessions
388
+
}
389
+
390
+
return stats, nil
391
+
}
392
+
393
+
// ListSessionsForMonitoring returns a list of all sessions with basic info for monitoring
394
+
// Returns: DID, session age (minutes), last update time
395
+
func (s *OAuthStore) ListSessionsForMonitoring(ctx context.Context) ([]map[string]interface{}, error) {
396
+
rows, err := s.db.QueryContext(ctx, `
397
+
SELECT
398
+
account_did,
399
+
session_id,
400
+
created_at,
401
+
updated_at,
402
+
CAST((julianday('now') - julianday(updated_at)) * 24 * 60 AS INTEGER) as idle_minutes
403
+
FROM oauth_sessions
404
+
ORDER BY updated_at DESC
405
+
`)
406
+
if err != nil {
407
+
return nil, fmt.Errorf("failed to query sessions: %w", err)
408
+
}
409
+
defer rows.Close()
410
+
411
+
var sessions []map[string]interface{}
412
+
for rows.Next() {
413
+
var did, sessionID, createdAt, updatedAt string
414
+
var idleMinutes int
415
+
416
+
if err := rows.Scan(&did, &sessionID, &createdAt, &updatedAt, &idleMinutes); err != nil {
417
+
slog.Warn("Failed to scan session row", "error", err)
418
+
continue
419
+
}
420
+
421
+
sessions = append(sessions, map[string]interface{}{
422
+
"did": did,
423
+
"session_id": sessionID,
424
+
"created_at": createdAt,
425
+
"updated_at": updatedAt,
426
+
"idle_minutes": idleMinutes,
427
+
})
428
+
}
429
+
430
+
if err := rows.Err(); err != nil {
431
+
return nil, fmt.Errorf("error iterating sessions: %w", err)
432
+
}
433
+
434
+
return sessions, nil
435
+
}
436
+
437
// makeSessionKey creates a composite key for session storage
438
func makeSessionKey(did, sessionID string) string {
439
return fmt.Sprintf("%s:%s", did, sessionID)
+144
-40
pkg/appview/db/queries.go
+144
-40
pkg/appview/db/queries.go
···
7
"time"
8
)
9
10
// escapeLikePattern escapes SQL LIKE wildcards (%, _) and backslash for safe searching.
11
// It also sanitizes the input to prevent injection attacks via special characters.
12
func escapeLikePattern(s string) string {
···
46
COALESCE((SELECT COUNT(*) FROM stars WHERE owner_did = u.did AND repository = t.repository), 0),
47
COALESCE((SELECT COUNT(*) FROM stars WHERE starrer_did = ? AND owner_did = u.did AND repository = t.repository), 0),
48
t.created_at,
49
-
m.hold_endpoint
50
FROM tags t
51
JOIN users u ON t.did = u.did
52
JOIN manifests m ON t.did = m.did AND t.repository = m.repository AND t.digest = m.digest
53
LEFT JOIN repository_stats rs ON t.did = rs.did AND t.repository = rs.repository
54
`
55
56
args := []any{currentUserDID}
···
73
for rows.Next() {
74
var p Push
75
var isStarredInt int
76
-
if err := rows.Scan(&p.DID, &p.Handle, &p.Repository, &p.Tag, &p.Digest, &p.Title, &p.Description, &p.IconURL, &p.PullCount, &p.StarCount, &isStarredInt, &p.CreatedAt, &p.HoldEndpoint); err != nil {
77
return nil, 0, err
78
}
79
p.IsStarred = isStarredInt > 0
80
pushes = append(pushes, p)
81
}
82
···
119
COALESCE((SELECT COUNT(*) FROM stars WHERE owner_did = u.did AND repository = t.repository), 0),
120
COALESCE((SELECT COUNT(*) FROM stars WHERE starrer_did = ? AND owner_did = u.did AND repository = t.repository), 0),
121
t.created_at,
122
-
m.hold_endpoint
123
FROM tags t
124
JOIN users u ON t.did = u.did
125
JOIN manifests m ON t.did = m.did AND t.repository = m.repository AND t.digest = m.digest
126
LEFT JOIN repository_stats rs ON t.did = rs.did AND t.repository = rs.repository
127
WHERE u.handle LIKE ? ESCAPE '\'
128
OR u.did = ?
129
OR t.repository LIKE ? ESCAPE '\'
···
146
for rows.Next() {
147
var p Push
148
var isStarredInt int
149
-
if err := rows.Scan(&p.DID, &p.Handle, &p.Repository, &p.Tag, &p.Digest, &p.Title, &p.Description, &p.IconURL, &p.PullCount, &p.StarCount, &isStarredInt, &p.CreatedAt, &p.HoldEndpoint); err != nil {
150
return nil, 0, err
151
}
152
p.IsStarred = isStarredInt > 0
153
pushes = append(pushes, p)
154
}
155
···
292
r.Licenses = annotations["org.opencontainers.image.licenses"]
293
r.IconURL = annotations["io.atcr.icon"]
294
r.ReadmeURL = annotations["io.atcr.readme"]
295
296
repos = append(repos, r)
297
}
···
596
// GetTagsWithPlatforms returns all tags for a repository with platform information
597
// Only multi-arch tags (manifest lists) have platform info in manifest_references
598
// Single-arch tags will have empty Platforms slice (platform is obvious for single-arch)
599
func GetTagsWithPlatforms(db *sql.DB, did, repository string) ([]TagWithPlatforms, error) {
600
rows, err := db.Query(`
601
SELECT
···
609
COALESCE(mr.platform_os, '') as platform_os,
610
COALESCE(mr.platform_architecture, '') as platform_architecture,
611
COALESCE(mr.platform_variant, '') as platform_variant,
612
-
COALESCE(mr.platform_os_version, '') as platform_os_version
613
FROM tags t
614
JOIN manifests m ON t.digest = m.digest AND t.did = m.did AND t.repository = m.repository
615
LEFT JOIN manifest_references mr ON m.id = mr.manifest_id
···
629
for rows.Next() {
630
var t Tag
631
var mediaType, platformOS, platformArch, platformVariant, platformOSVersion string
632
633
if err := rows.Scan(&t.ID, &t.DID, &t.Repository, &t.Tag, &t.Digest, &t.CreatedAt,
634
-
&mediaType, &platformOS, &platformArch, &platformVariant, &platformOSVersion); err != nil {
635
return nil, err
636
}
637
···
645
tagOrder = append(tagOrder, tagKey)
646
}
647
648
// Add platform info if present (only for multi-arch manifest lists)
649
if platformOS != "" || platformArch != "" {
650
tagMap[tagKey].Platforms = append(tagMap[tagKey].Platforms, PlatformInfo{
···
804
INSERT INTO manifest_references (manifest_id, digest, size, media_type,
805
platform_architecture, platform_os,
806
platform_variant, platform_os_version,
807
-
reference_index)
808
-
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
809
`, ref.ManifestID, ref.Digest, ref.Size, ref.MediaType,
810
ref.PlatformArchitecture, ref.PlatformOS,
811
ref.PlatformVariant, ref.PlatformOSVersion,
812
-
ref.ReferenceIndex)
813
return err
814
}
815
···
940
mr.platform_os,
941
mr.platform_architecture,
942
mr.platform_variant,
943
-
mr.platform_os_version
944
FROM manifest_references mr
945
WHERE mr.manifest_id = ?
946
ORDER BY mr.reference_index
···
954
for platformRows.Next() {
955
var p PlatformInfo
956
var os, arch, variant, osVersion sql.NullString
957
958
-
if err := platformRows.Scan(&os, &arch, &variant, &osVersion); err != nil {
959
platformRows.Close()
960
return nil, err
961
}
962
963
if os.Valid {
964
p.OS = os.String
965
}
···
1039
mr.platform_os,
1040
mr.platform_architecture,
1041
mr.platform_variant,
1042
-
mr.platform_os_version
1043
FROM manifest_references mr
1044
WHERE mr.manifest_id = ?
1045
ORDER BY mr.reference_index
···
1054
for platforms.Next() {
1055
var p PlatformInfo
1056
var os, arch, variant, osVersion sql.NullString
1057
1058
-
if err := platforms.Scan(&os, &arch, &variant, &osVersion); err != nil {
1059
return nil, err
1060
}
1061
1062
if os.Valid {
···
1580
return time.Time{}, fmt.Errorf("unable to parse timestamp: %s", s)
1581
}
1582
1583
-
// MetricsDB wraps a sql.DB and implements the metrics interface for middleware
1584
-
type MetricsDB struct {
1585
-
db *sql.DB
1586
-
}
1587
-
1588
-
// NewMetricsDB creates a new metrics database wrapper
1589
-
func NewMetricsDB(db *sql.DB) *MetricsDB {
1590
-
return &MetricsDB{db: db}
1591
-
}
1592
-
1593
-
// IncrementPullCount increments the pull count for a repository
1594
-
func (m *MetricsDB) IncrementPullCount(did, repository string) error {
1595
-
return IncrementPullCount(m.db, did, repository)
1596
-
}
1597
-
1598
-
// IncrementPushCount increments the push count for a repository
1599
-
func (m *MetricsDB) IncrementPushCount(did, repository string) error {
1600
-
return IncrementPushCount(m.db, did, repository)
1601
-
}
1602
-
1603
-
// GetLatestHoldDIDForRepo returns the hold DID from the most recent manifest for a repository
1604
-
func (m *MetricsDB) GetLatestHoldDIDForRepo(did, repository string) (string, error) {
1605
-
return GetLatestHoldDIDForRepo(m.db, did, repository)
1606
-
}
1607
-
1608
// GetFeaturedRepositories fetches top repositories sorted by stars and pulls
1609
func GetFeaturedRepositories(db *sql.DB, limit int, currentUserDID string) ([]FeaturedRepository, error) {
1610
query := `
···
1632
COALESCE((SELECT value FROM repository_annotations WHERE did = m.did AND repository = m.repository AND key = 'io.atcr.icon'), ''),
1633
rs.pull_count,
1634
rs.star_count,
1635
-
COALESCE((SELECT COUNT(*) FROM stars WHERE starrer_did = ? AND owner_did = m.did AND repository = m.repository), 0)
1636
FROM latest_manifests lm
1637
JOIN manifests m ON lm.latest_id = m.id
1638
JOIN users u ON m.did = u.did
1639
JOIN repo_stats rs ON m.did = rs.did AND m.repository = rs.repository
1640
ORDER BY rs.score DESC, rs.star_count DESC, rs.pull_count DESC, m.created_at DESC
1641
LIMIT ?
1642
`
···
1651
for rows.Next() {
1652
var f FeaturedRepository
1653
var isStarredInt int
1654
1655
if err := rows.Scan(&f.OwnerDID, &f.OwnerHandle, &f.Repository,
1656
-
&f.Title, &f.Description, &f.IconURL, &f.PullCount, &f.StarCount, &isStarredInt); err != nil {
1657
return nil, err
1658
}
1659
f.IsStarred = isStarredInt > 0
1660
1661
featured = append(featured, f)
1662
}
1663
1664
return featured, nil
1665
}
···
7
"time"
8
)
9
10
+
// BlobCDNURL returns the CDN URL for an ATProto blob
11
+
// This is a local copy to avoid importing atproto (prevents circular dependencies)
12
+
func BlobCDNURL(did, cid string) string {
13
+
return fmt.Sprintf("https://imgs.blue/%s/%s", did, cid)
14
+
}
15
+
16
// escapeLikePattern escapes SQL LIKE wildcards (%, _) and backslash for safe searching.
17
// It also sanitizes the input to prevent injection attacks via special characters.
18
func escapeLikePattern(s string) string {
···
52
COALESCE((SELECT COUNT(*) FROM stars WHERE owner_did = u.did AND repository = t.repository), 0),
53
COALESCE((SELECT COUNT(*) FROM stars WHERE starrer_did = ? AND owner_did = u.did AND repository = t.repository), 0),
54
t.created_at,
55
+
m.hold_endpoint,
56
+
COALESCE(rp.avatar_cid, '')
57
FROM tags t
58
JOIN users u ON t.did = u.did
59
JOIN manifests m ON t.did = m.did AND t.repository = m.repository AND t.digest = m.digest
60
LEFT JOIN repository_stats rs ON t.did = rs.did AND t.repository = rs.repository
61
+
LEFT JOIN repo_pages rp ON t.did = rp.did AND t.repository = rp.repository
62
`
63
64
args := []any{currentUserDID}
···
81
for rows.Next() {
82
var p Push
83
var isStarredInt int
84
+
var avatarCID string
85
+
if err := rows.Scan(&p.DID, &p.Handle, &p.Repository, &p.Tag, &p.Digest, &p.Title, &p.Description, &p.IconURL, &p.PullCount, &p.StarCount, &isStarredInt, &p.CreatedAt, &p.HoldEndpoint, &avatarCID); err != nil {
86
return nil, 0, err
87
}
88
p.IsStarred = isStarredInt > 0
89
+
// Prefer repo page avatar over annotation icon
90
+
if avatarCID != "" {
91
+
p.IconURL = BlobCDNURL(p.DID, avatarCID)
92
+
}
93
pushes = append(pushes, p)
94
}
95
···
132
COALESCE((SELECT COUNT(*) FROM stars WHERE owner_did = u.did AND repository = t.repository), 0),
133
COALESCE((SELECT COUNT(*) FROM stars WHERE starrer_did = ? AND owner_did = u.did AND repository = t.repository), 0),
134
t.created_at,
135
+
m.hold_endpoint,
136
+
COALESCE(rp.avatar_cid, '')
137
FROM tags t
138
JOIN users u ON t.did = u.did
139
JOIN manifests m ON t.did = m.did AND t.repository = m.repository AND t.digest = m.digest
140
LEFT JOIN repository_stats rs ON t.did = rs.did AND t.repository = rs.repository
141
+
LEFT JOIN repo_pages rp ON t.did = rp.did AND t.repository = rp.repository
142
WHERE u.handle LIKE ? ESCAPE '\'
143
OR u.did = ?
144
OR t.repository LIKE ? ESCAPE '\'
···
161
for rows.Next() {
162
var p Push
163
var isStarredInt int
164
+
var avatarCID string
165
+
if err := rows.Scan(&p.DID, &p.Handle, &p.Repository, &p.Tag, &p.Digest, &p.Title, &p.Description, &p.IconURL, &p.PullCount, &p.StarCount, &isStarredInt, &p.CreatedAt, &p.HoldEndpoint, &avatarCID); err != nil {
166
return nil, 0, err
167
}
168
p.IsStarred = isStarredInt > 0
169
+
// Prefer repo page avatar over annotation icon
170
+
if avatarCID != "" {
171
+
p.IconURL = BlobCDNURL(p.DID, avatarCID)
172
+
}
173
pushes = append(pushes, p)
174
}
175
···
312
r.Licenses = annotations["org.opencontainers.image.licenses"]
313
r.IconURL = annotations["io.atcr.icon"]
314
r.ReadmeURL = annotations["io.atcr.readme"]
315
+
316
+
// Check for repo page avatar (overrides annotation icon)
317
+
repoPage, err := GetRepoPage(db, did, r.Name)
318
+
if err == nil && repoPage != nil && repoPage.AvatarCID != "" {
319
+
r.IconURL = BlobCDNURL(did, repoPage.AvatarCID)
320
+
}
321
322
repos = append(repos, r)
323
}
···
622
// GetTagsWithPlatforms returns all tags for a repository with platform information
623
// Only multi-arch tags (manifest lists) have platform info in manifest_references
624
// Single-arch tags will have empty Platforms slice (platform is obvious for single-arch)
625
+
// Attestation references (unknown/unknown platforms) are filtered out but tracked via HasAttestations
626
func GetTagsWithPlatforms(db *sql.DB, did, repository string) ([]TagWithPlatforms, error) {
627
rows, err := db.Query(`
628
SELECT
···
636
COALESCE(mr.platform_os, '') as platform_os,
637
COALESCE(mr.platform_architecture, '') as platform_architecture,
638
COALESCE(mr.platform_variant, '') as platform_variant,
639
+
COALESCE(mr.platform_os_version, '') as platform_os_version,
640
+
COALESCE(mr.is_attestation, 0) as is_attestation
641
FROM tags t
642
JOIN manifests m ON t.digest = m.digest AND t.did = m.did AND t.repository = m.repository
643
LEFT JOIN manifest_references mr ON m.id = mr.manifest_id
···
657
for rows.Next() {
658
var t Tag
659
var mediaType, platformOS, platformArch, platformVariant, platformOSVersion string
660
+
var isAttestation bool
661
662
if err := rows.Scan(&t.ID, &t.DID, &t.Repository, &t.Tag, &t.Digest, &t.CreatedAt,
663
+
&mediaType, &platformOS, &platformArch, &platformVariant, &platformOSVersion, &isAttestation); err != nil {
664
return nil, err
665
}
666
···
674
tagOrder = append(tagOrder, tagKey)
675
}
676
677
+
// Track if manifest list has attestations
678
+
if isAttestation {
679
+
tagMap[tagKey].HasAttestations = true
680
+
// Skip attestation references in platform display
681
+
continue
682
+
}
683
+
684
// Add platform info if present (only for multi-arch manifest lists)
685
if platformOS != "" || platformArch != "" {
686
tagMap[tagKey].Platforms = append(tagMap[tagKey].Platforms, PlatformInfo{
···
840
INSERT INTO manifest_references (manifest_id, digest, size, media_type,
841
platform_architecture, platform_os,
842
platform_variant, platform_os_version,
843
+
is_attestation, reference_index)
844
+
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
845
`, ref.ManifestID, ref.Digest, ref.Size, ref.MediaType,
846
ref.PlatformArchitecture, ref.PlatformOS,
847
ref.PlatformVariant, ref.PlatformOSVersion,
848
+
ref.IsAttestation, ref.ReferenceIndex)
849
return err
850
}
851
···
976
mr.platform_os,
977
mr.platform_architecture,
978
mr.platform_variant,
979
+
mr.platform_os_version,
980
+
COALESCE(mr.is_attestation, 0) as is_attestation
981
FROM manifest_references mr
982
WHERE mr.manifest_id = ?
983
ORDER BY mr.reference_index
···
991
for platformRows.Next() {
992
var p PlatformInfo
993
var os, arch, variant, osVersion sql.NullString
994
+
var isAttestation bool
995
996
+
if err := platformRows.Scan(&os, &arch, &variant, &osVersion, &isAttestation); err != nil {
997
platformRows.Close()
998
return nil, err
999
}
1000
1001
+
// Track if manifest list has attestations
1002
+
if isAttestation {
1003
+
manifests[i].HasAttestations = true
1004
+
// Skip attestation references in platform display
1005
+
continue
1006
+
}
1007
+
1008
if os.Valid {
1009
p.OS = os.String
1010
}
···
1084
mr.platform_os,
1085
mr.platform_architecture,
1086
mr.platform_variant,
1087
+
mr.platform_os_version,
1088
+
COALESCE(mr.is_attestation, 0) as is_attestation
1089
FROM manifest_references mr
1090
WHERE mr.manifest_id = ?
1091
ORDER BY mr.reference_index
···
1100
for platforms.Next() {
1101
var p PlatformInfo
1102
var os, arch, variant, osVersion sql.NullString
1103
+
var isAttestation bool
1104
1105
+
if err := platforms.Scan(&os, &arch, &variant, &osVersion, &isAttestation); err != nil {
1106
return nil, err
1107
+
}
1108
+
1109
+
// Track if manifest list has attestations
1110
+
if isAttestation {
1111
+
m.HasAttestations = true
1112
+
// Skip attestation references in platform display
1113
+
continue
1114
}
1115
1116
if os.Valid {
···
1634
return time.Time{}, fmt.Errorf("unable to parse timestamp: %s", s)
1635
}
1636
1637
// GetFeaturedRepositories fetches top repositories sorted by stars and pulls
1638
func GetFeaturedRepositories(db *sql.DB, limit int, currentUserDID string) ([]FeaturedRepository, error) {
1639
query := `
···
1661
COALESCE((SELECT value FROM repository_annotations WHERE did = m.did AND repository = m.repository AND key = 'io.atcr.icon'), ''),
1662
rs.pull_count,
1663
rs.star_count,
1664
+
COALESCE((SELECT COUNT(*) FROM stars WHERE starrer_did = ? AND owner_did = m.did AND repository = m.repository), 0),
1665
+
COALESCE(rp.avatar_cid, '')
1666
FROM latest_manifests lm
1667
JOIN manifests m ON lm.latest_id = m.id
1668
JOIN users u ON m.did = u.did
1669
JOIN repo_stats rs ON m.did = rs.did AND m.repository = rs.repository
1670
+
LEFT JOIN repo_pages rp ON m.did = rp.did AND m.repository = rp.repository
1671
ORDER BY rs.score DESC, rs.star_count DESC, rs.pull_count DESC, m.created_at DESC
1672
LIMIT ?
1673
`
···
1682
for rows.Next() {
1683
var f FeaturedRepository
1684
var isStarredInt int
1685
+
var avatarCID string
1686
1687
if err := rows.Scan(&f.OwnerDID, &f.OwnerHandle, &f.Repository,
1688
+
&f.Title, &f.Description, &f.IconURL, &f.PullCount, &f.StarCount, &isStarredInt, &avatarCID); err != nil {
1689
return nil, err
1690
}
1691
f.IsStarred = isStarredInt > 0
1692
+
// Prefer repo page avatar over annotation icon
1693
+
if avatarCID != "" {
1694
+
f.IconURL = BlobCDNURL(f.OwnerDID, avatarCID)
1695
+
}
1696
1697
featured = append(featured, f)
1698
}
1699
1700
return featured, nil
1701
}
1702
+
1703
+
// RepoPage represents a repository page record cached from PDS
1704
+
type RepoPage struct {
1705
+
DID string
1706
+
Repository string
1707
+
Description string
1708
+
AvatarCID string
1709
+
CreatedAt time.Time
1710
+
UpdatedAt time.Time
1711
+
}
1712
+
1713
+
// UpsertRepoPage inserts or updates a repo page record
1714
+
func UpsertRepoPage(db *sql.DB, did, repository, description, avatarCID string, createdAt, updatedAt time.Time) error {
1715
+
_, err := db.Exec(`
1716
+
INSERT INTO repo_pages (did, repository, description, avatar_cid, created_at, updated_at)
1717
+
VALUES (?, ?, ?, ?, ?, ?)
1718
+
ON CONFLICT(did, repository) DO UPDATE SET
1719
+
description = excluded.description,
1720
+
avatar_cid = excluded.avatar_cid,
1721
+
updated_at = excluded.updated_at
1722
+
`, did, repository, description, avatarCID, createdAt, updatedAt)
1723
+
return err
1724
+
}
1725
+
1726
+
// GetRepoPage retrieves a repo page record
1727
+
func GetRepoPage(db *sql.DB, did, repository string) (*RepoPage, error) {
1728
+
var rp RepoPage
1729
+
err := db.QueryRow(`
1730
+
SELECT did, repository, description, avatar_cid, created_at, updated_at
1731
+
FROM repo_pages
1732
+
WHERE did = ? AND repository = ?
1733
+
`, did, repository).Scan(&rp.DID, &rp.Repository, &rp.Description, &rp.AvatarCID, &rp.CreatedAt, &rp.UpdatedAt)
1734
+
if err != nil {
1735
+
return nil, err
1736
+
}
1737
+
return &rp, nil
1738
+
}
1739
+
1740
+
// DeleteRepoPage deletes a repo page record
1741
+
func DeleteRepoPage(db *sql.DB, did, repository string) error {
1742
+
_, err := db.Exec(`
1743
+
DELETE FROM repo_pages WHERE did = ? AND repository = ?
1744
+
`, did, repository)
1745
+
return err
1746
+
}
1747
+
1748
+
// GetRepoPagesByDID returns all repo pages for a DID
1749
+
func GetRepoPagesByDID(db *sql.DB, did string) ([]RepoPage, error) {
1750
+
rows, err := db.Query(`
1751
+
SELECT did, repository, description, avatar_cid, created_at, updated_at
1752
+
FROM repo_pages
1753
+
WHERE did = ?
1754
+
`, did)
1755
+
if err != nil {
1756
+
return nil, err
1757
+
}
1758
+
defer rows.Close()
1759
+
1760
+
var pages []RepoPage
1761
+
for rows.Next() {
1762
+
var rp RepoPage
1763
+
if err := rows.Scan(&rp.DID, &rp.Repository, &rp.Description, &rp.AvatarCID, &rp.CreatedAt, &rp.UpdatedAt); err != nil {
1764
+
return nil, err
1765
+
}
1766
+
pages = append(pages, rp)
1767
+
}
1768
+
return pages, rows.Err()
1769
+
}
+57
-4
pkg/appview/db/schema.go
+57
-4
pkg/appview/db/schema.go
···
86
continue
87
}
88
89
-
// Apply migration
90
slog.Info("Applying migration", "version", m.Version, "name", m.Name, "description", m.Description)
91
-
if _, err := db.Exec(m.Query); err != nil {
92
-
return fmt.Errorf("failed to apply migration %d (%s): %w", m.Version, m.Name, err)
93
}
94
95
// Record migration
96
-
if _, err := db.Exec("INSERT INTO schema_migrations (version) VALUES (?)", m.Version); err != nil {
97
return fmt.Errorf("failed to record migration %d: %w", m.Version, err)
98
}
99
100
slog.Info("Migration applied successfully", "version", m.Version)
···
144
}
145
146
return migrations, nil
147
}
148
149
// parseMigrationFilename extracts version and name from migration filename
···
86
continue
87
}
88
89
+
// Apply migration in a transaction
90
slog.Info("Applying migration", "version", m.Version, "name", m.Name, "description", m.Description)
91
+
92
+
tx, err := db.Begin()
93
+
if err != nil {
94
+
return fmt.Errorf("failed to begin transaction for migration %d: %w", m.Version, err)
95
+
}
96
+
97
+
// Split query into individual statements and execute each
98
+
// go-sqlite3's Exec() doesn't reliably execute all statements in multi-statement queries
99
+
statements := splitSQLStatements(m.Query)
100
+
for i, stmt := range statements {
101
+
if _, err := tx.Exec(stmt); err != nil {
102
+
tx.Rollback()
103
+
return fmt.Errorf("failed to apply migration %d (%s) statement %d: %w", m.Version, m.Name, i+1, err)
104
+
}
105
}
106
107
// Record migration
108
+
if _, err := tx.Exec("INSERT INTO schema_migrations (version) VALUES (?)", m.Version); err != nil {
109
+
tx.Rollback()
110
return fmt.Errorf("failed to record migration %d: %w", m.Version, err)
111
+
}
112
+
113
+
if err := tx.Commit(); err != nil {
114
+
return fmt.Errorf("failed to commit migration %d: %w", m.Version, err)
115
}
116
117
slog.Info("Migration applied successfully", "version", m.Version)
···
161
}
162
163
return migrations, nil
164
+
}
165
+
166
+
// splitSQLStatements splits a SQL query into individual statements.
167
+
// It handles semicolons as statement separators and filters out empty statements.
168
+
func splitSQLStatements(query string) []string {
169
+
var statements []string
170
+
171
+
// Split on semicolons
172
+
parts := strings.Split(query, ";")
173
+
174
+
for _, part := range parts {
175
+
// Trim whitespace
176
+
stmt := strings.TrimSpace(part)
177
+
178
+
// Skip empty statements (could be trailing semicolon or comment-only)
179
+
if stmt == "" {
180
+
continue
181
+
}
182
+
183
+
// Skip comment-only statements
184
+
lines := strings.Split(stmt, "\n")
185
+
hasCode := false
186
+
for _, line := range lines {
187
+
trimmed := strings.TrimSpace(line)
188
+
if trimmed != "" && !strings.HasPrefix(trimmed, "--") {
189
+
hasCode = true
190
+
break
191
+
}
192
+
}
193
+
194
+
if hasCode {
195
+
statements = append(statements, stmt)
196
+
}
197
+
}
198
+
199
+
return statements
200
}
201
202
// parseMigrationFilename extracts version and name from migration filename
+11
-5
pkg/appview/db/schema.sql
+11
-5
pkg/appview/db/schema.sql
···
67
platform_os TEXT,
68
platform_variant TEXT,
69
platform_os_version TEXT,
70
reference_index INTEGER NOT NULL,
71
PRIMARY KEY(manifest_id, reference_index),
72
FOREIGN KEY(manifest_id) REFERENCES manifests(id) ON DELETE CASCADE
···
204
);
205
CREATE INDEX IF NOT EXISTS idx_crew_denials_retry ON hold_crew_denials(next_retry_at);
206
207
-
CREATE TABLE IF NOT EXISTS readme_cache (
208
-
url TEXT PRIMARY KEY,
209
-
html TEXT NOT NULL,
210
-
fetched_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
211
);
212
-
CREATE INDEX IF NOT EXISTS idx_readme_cache_fetched ON readme_cache(fetched_at);
···
67
platform_os TEXT,
68
platform_variant TEXT,
69
platform_os_version TEXT,
70
+
is_attestation BOOLEAN DEFAULT FALSE,
71
reference_index INTEGER NOT NULL,
72
PRIMARY KEY(manifest_id, reference_index),
73
FOREIGN KEY(manifest_id) REFERENCES manifests(id) ON DELETE CASCADE
···
205
);
206
CREATE INDEX IF NOT EXISTS idx_crew_denials_retry ON hold_crew_denials(next_retry_at);
207
208
+
CREATE TABLE IF NOT EXISTS repo_pages (
209
+
did TEXT NOT NULL,
210
+
repository TEXT NOT NULL,
211
+
description TEXT,
212
+
avatar_cid TEXT,
213
+
created_at TIMESTAMP NOT NULL,
214
+
updated_at TIMESTAMP NOT NULL,
215
+
PRIMARY KEY(did, repository),
216
+
FOREIGN KEY(did) REFERENCES users(did) ON DELETE CASCADE
217
);
218
+
CREATE INDEX IF NOT EXISTS idx_repo_pages_did ON repo_pages(did);
+92
pkg/appview/db/schema_test.go
+92
pkg/appview/db/schema_test.go
···
···
1
+
package db
2
+
3
+
import (
4
+
"testing"
5
+
)
6
+
7
+
func TestSplitSQLStatements(t *testing.T) {
8
+
tests := []struct {
9
+
name string
10
+
query string
11
+
expected []string
12
+
}{
13
+
{
14
+
name: "single statement",
15
+
query: "SELECT 1",
16
+
expected: []string{"SELECT 1"},
17
+
},
18
+
{
19
+
name: "single statement with semicolon",
20
+
query: "SELECT 1;",
21
+
expected: []string{"SELECT 1"},
22
+
},
23
+
{
24
+
name: "two statements",
25
+
query: "SELECT 1; SELECT 2;",
26
+
expected: []string{"SELECT 1", "SELECT 2"},
27
+
},
28
+
{
29
+
name: "statements with comments",
30
+
query: `-- This is a comment
31
+
ALTER TABLE foo ADD COLUMN bar TEXT;
32
+
33
+
-- Another comment
34
+
UPDATE foo SET bar = 'test';`,
35
+
expected: []string{
36
+
"-- This is a comment\nALTER TABLE foo ADD COLUMN bar TEXT",
37
+
"-- Another comment\nUPDATE foo SET bar = 'test'",
38
+
},
39
+
},
40
+
{
41
+
name: "comment-only sections filtered",
42
+
query: `-- Just a comment
43
+
;
44
+
SELECT 1;`,
45
+
expected: []string{"SELECT 1"},
46
+
},
47
+
{
48
+
name: "empty query",
49
+
query: "",
50
+
expected: nil,
51
+
},
52
+
{
53
+
name: "whitespace only",
54
+
query: " \n\t ",
55
+
expected: nil,
56
+
},
57
+
{
58
+
name: "migration 0005 format",
59
+
query: `-- Add is_attestation column to track attestation manifests
60
+
-- Attestation manifests have vnd.docker.reference.type = "attestation-manifest"
61
+
ALTER TABLE manifest_references ADD COLUMN is_attestation BOOLEAN DEFAULT FALSE;
62
+
63
+
-- Mark existing unknown/unknown platforms as attestations
64
+
-- Docker BuildKit attestation manifests always have unknown/unknown platform
65
+
UPDATE manifest_references
66
+
SET is_attestation = 1
67
+
WHERE platform_os = 'unknown' AND platform_architecture = 'unknown';`,
68
+
expected: []string{
69
+
"-- Add is_attestation column to track attestation manifests\n-- Attestation manifests have vnd.docker.reference.type = \"attestation-manifest\"\nALTER TABLE manifest_references ADD COLUMN is_attestation BOOLEAN DEFAULT FALSE",
70
+
"-- Mark existing unknown/unknown platforms as attestations\n-- Docker BuildKit attestation manifests always have unknown/unknown platform\nUPDATE manifest_references\nSET is_attestation = 1\nWHERE platform_os = 'unknown' AND platform_architecture = 'unknown'",
71
+
},
72
+
},
73
+
}
74
+
75
+
for _, tt := range tests {
76
+
t.Run(tt.name, func(t *testing.T) {
77
+
result := splitSQLStatements(tt.query)
78
+
79
+
if len(result) != len(tt.expected) {
80
+
t.Errorf("got %d statements, want %d\ngot: %v\nwant: %v",
81
+
len(result), len(tt.expected), result, tt.expected)
82
+
return
83
+
}
84
+
85
+
for i := range result {
86
+
if result[i] != tt.expected[i] {
87
+
t.Errorf("statement %d:\ngot: %q\nwant: %q", i, result[i], tt.expected[i])
88
+
}
89
+
}
90
+
})
91
+
}
92
+
}
+86
-37
pkg/appview/handlers/api.go
+86
-37
pkg/appview/handlers/api.go
···
7
"fmt"
8
"log/slog"
9
"net/http"
10
11
"atcr.io/pkg/appview/db"
12
"atcr.io/pkg/appview/middleware"
···
43
return
44
}
45
46
-
// Get OAuth session for the authenticated user
47
-
slog.Debug("Getting OAuth session for star", "user_did", user.DID)
48
-
session, err := h.Refresher.GetSession(r.Context(), user.DID)
49
-
if err != nil {
50
-
slog.Warn("Failed to get OAuth session for star", "user_did", user.DID, "error", err)
51
-
http.Error(w, fmt.Sprintf("Failed to get OAuth session: %v", err), http.StatusUnauthorized)
52
-
return
53
-
}
54
-
55
-
// Get user's PDS client (use indigo's API client which handles DPoP automatically)
56
-
apiClient := session.APIClient()
57
-
pdsClient := atproto.NewClientWithIndigoClient(user.PDSEndpoint, user.DID, apiClient)
58
59
// Create star record
60
starRecord := atproto.NewStarRecord(ownerDID, repository)
···
63
// Write star record to user's PDS
64
_, err = pdsClient.PutRecord(r.Context(), atproto.StarCollection, rkey, starRecord)
65
if err != nil {
66
slog.Error("Failed to create star record", "error", err)
67
http.Error(w, fmt.Sprintf("Failed to create star: %v", err), http.StatusInternalServerError)
68
return
···
101
return
102
}
103
104
-
// Get OAuth session for the authenticated user
105
-
slog.Debug("Getting OAuth session for unstar", "user_did", user.DID)
106
-
session, err := h.Refresher.GetSession(r.Context(), user.DID)
107
-
if err != nil {
108
-
slog.Warn("Failed to get OAuth session for unstar", "user_did", user.DID, "error", err)
109
-
http.Error(w, fmt.Sprintf("Failed to get OAuth session: %v", err), http.StatusUnauthorized)
110
-
return
111
-
}
112
-
113
-
// Get user's PDS client (use indigo's API client which handles DPoP automatically)
114
-
apiClient := session.APIClient()
115
-
pdsClient := atproto.NewClientWithIndigoClient(user.PDSEndpoint, user.DID, apiClient)
116
117
// Delete star record from user's PDS
118
rkey := atproto.StarRecordKey(ownerDID, repository)
···
121
if err != nil {
122
// If record doesn't exist, still return success (idempotent)
123
if !errors.Is(err, atproto.ErrRecordNotFound) {
124
slog.Error("Failed to delete star record", "error", err)
125
http.Error(w, fmt.Sprintf("Failed to delete star: %v", err), http.StatusInternalServerError)
126
return
···
162
return
163
}
164
165
-
// Get OAuth session for the authenticated user
166
-
session, err := h.Refresher.GetSession(r.Context(), user.DID)
167
-
if err != nil {
168
-
slog.Debug("Failed to get OAuth session for check star", "user_did", user.DID, "error", err)
169
-
// No OAuth session - return not starred
170
w.Header().Set("Content-Type", "application/json")
171
json.NewEncoder(w).Encode(map[string]bool{"starred": false})
172
return
173
}
174
175
-
// Get user's PDS client (use indigo's API client which handles DPoP automatically)
176
-
apiClient := session.APIClient()
177
-
pdsClient := atproto.NewClientWithIndigoClient(user.PDSEndpoint, user.DID, apiClient)
178
-
179
-
// Check if star record exists
180
-
rkey := atproto.StarRecordKey(ownerDID, repository)
181
-
_, err = pdsClient.GetRecord(r.Context(), atproto.StarCollection, rkey)
182
-
183
starred := err == nil
184
185
// Return result
···
252
w.Header().Set("Content-Type", "application/json")
253
json.NewEncoder(w).Encode(manifest)
254
}
···
7
"fmt"
8
"log/slog"
9
"net/http"
10
+
"strings"
11
12
"atcr.io/pkg/appview/db"
13
"atcr.io/pkg/appview/middleware"
···
44
return
45
}
46
47
+
// Create ATProto client with session provider (uses DoWithSession for DPoP nonce safety)
48
+
slog.Debug("Creating PDS client for star", "user_did", user.DID)
49
+
pdsClient := atproto.NewClientWithSessionProvider(user.PDSEndpoint, user.DID, h.Refresher)
50
51
// Create star record
52
starRecord := atproto.NewStarRecord(ownerDID, repository)
···
55
// Write star record to user's PDS
56
_, err = pdsClient.PutRecord(r.Context(), atproto.StarCollection, rkey, starRecord)
57
if err != nil {
58
+
// Check if OAuth error - if so, invalidate sessions and return 401
59
+
if handleOAuthError(r.Context(), h.Refresher, user.DID, err) {
60
+
http.Error(w, "Authentication failed, please log in again", http.StatusUnauthorized)
61
+
return
62
+
}
63
slog.Error("Failed to create star record", "error", err)
64
http.Error(w, fmt.Sprintf("Failed to create star: %v", err), http.StatusInternalServerError)
65
return
···
98
return
99
}
100
101
+
// Create ATProto client with session provider (uses DoWithSession for DPoP nonce safety)
102
+
slog.Debug("Creating PDS client for unstar", "user_did", user.DID)
103
+
pdsClient := atproto.NewClientWithSessionProvider(user.PDSEndpoint, user.DID, h.Refresher)
104
105
// Delete star record from user's PDS
106
rkey := atproto.StarRecordKey(ownerDID, repository)
···
109
if err != nil {
110
// If record doesn't exist, still return success (idempotent)
111
if !errors.Is(err, atproto.ErrRecordNotFound) {
112
+
// Check if OAuth error - if so, invalidate sessions and return 401
113
+
if handleOAuthError(r.Context(), h.Refresher, user.DID, err) {
114
+
http.Error(w, "Authentication failed, please log in again", http.StatusUnauthorized)
115
+
return
116
+
}
117
slog.Error("Failed to delete star record", "error", err)
118
http.Error(w, fmt.Sprintf("Failed to delete star: %v", err), http.StatusInternalServerError)
119
return
···
155
return
156
}
157
158
+
// Create ATProto client with session provider (uses DoWithSession for DPoP nonce safety)
159
+
// Note: Error handling moves to the PDS call - if session doesn't exist, GetRecord will fail
160
+
pdsClient := atproto.NewClientWithSessionProvider(user.PDSEndpoint, user.DID, h.Refresher)
161
+
162
+
// Check if star record exists
163
+
rkey := atproto.StarRecordKey(ownerDID, repository)
164
+
_, err = pdsClient.GetRecord(r.Context(), atproto.StarCollection, rkey)
165
+
166
+
// Check if OAuth error - if so, invalidate sessions
167
+
if err != nil && handleOAuthError(r.Context(), h.Refresher, user.DID, err) {
168
+
// For a read operation, just return not starred instead of error
169
w.Header().Set("Content-Type", "application/json")
170
json.NewEncoder(w).Encode(map[string]bool{"starred": false})
171
return
172
}
173
174
starred := err == nil
175
176
// Return result
···
243
w.Header().Set("Content-Type", "application/json")
244
json.NewEncoder(w).Encode(manifest)
245
}
246
+
247
+
// CredentialHelperVersionResponse is the response for the credential helper version API
248
+
type CredentialHelperVersionResponse struct {
249
+
Latest string `json:"latest"`
250
+
DownloadURLs map[string]string `json:"download_urls"`
251
+
Checksums map[string]string `json:"checksums"`
252
+
ReleaseNotes string `json:"release_notes,omitempty"`
253
+
}
254
+
255
+
// CredentialHelperVersionHandler returns the latest credential helper version info
256
+
type CredentialHelperVersionHandler struct {
257
+
Version string
258
+
TangledRepo string
259
+
Checksums map[string]string
260
+
}
261
+
262
+
// Supported platforms for download URLs
263
+
var credentialHelperPlatforms = []struct {
264
+
key string // API key (e.g., "linux_amd64")
265
+
os string // OS name in archive (e.g., "Linux")
266
+
arch string // Arch name in archive (e.g., "x86_64")
267
+
ext string // Archive extension (e.g., "tar.gz" or "zip")
268
+
}{
269
+
{"linux_amd64", "Linux", "x86_64", "tar.gz"},
270
+
{"linux_arm64", "Linux", "arm64", "tar.gz"},
271
+
{"darwin_amd64", "Darwin", "x86_64", "tar.gz"},
272
+
{"darwin_arm64", "Darwin", "arm64", "tar.gz"},
273
+
{"windows_amd64", "Windows", "x86_64", "zip"},
274
+
{"windows_arm64", "Windows", "arm64", "zip"},
275
+
}
276
+
277
+
func (h *CredentialHelperVersionHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
278
+
// Check if version is configured
279
+
if h.Version == "" {
280
+
http.Error(w, "Credential helper version not configured", http.StatusServiceUnavailable)
281
+
return
282
+
}
283
+
284
+
// Build download URLs for all platforms
285
+
// URL format: {TangledRepo}/tags/{version}/download/docker-credential-atcr_{version_without_v}_{OS}_{Arch}.{ext}
286
+
downloadURLs := make(map[string]string)
287
+
versionWithoutV := strings.TrimPrefix(h.Version, "v")
288
+
289
+
for _, p := range credentialHelperPlatforms {
290
+
filename := fmt.Sprintf("docker-credential-atcr_%s_%s_%s.%s", versionWithoutV, p.os, p.arch, p.ext)
291
+
downloadURLs[p.key] = fmt.Sprintf("%s/tags/%s/download/%s", h.TangledRepo, h.Version, filename)
292
+
}
293
+
294
+
response := CredentialHelperVersionResponse{
295
+
Latest: h.Version,
296
+
DownloadURLs: downloadURLs,
297
+
Checksums: h.Checksums,
298
+
}
299
+
300
+
w.Header().Set("Content-Type", "application/json")
301
+
w.Header().Set("Cache-Control", "public, max-age=300") // Cache for 5 minutes
302
+
json.NewEncoder(w).Encode(response)
303
+
}
+32
pkg/appview/handlers/errors.go
+32
pkg/appview/handlers/errors.go
···
···
1
+
package handlers
2
+
3
+
import (
4
+
"html/template"
5
+
"net/http"
6
+
)
7
+
8
+
// NotFoundHandler handles 404 errors
9
+
type NotFoundHandler struct {
10
+
Templates *template.Template
11
+
RegistryURL string
12
+
}
13
+
14
+
func (h *NotFoundHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
15
+
RenderNotFound(w, r, h.Templates, h.RegistryURL)
16
+
}
17
+
18
+
// RenderNotFound renders the 404 page template.
19
+
// Use this from other handlers when a resource is not found.
20
+
func RenderNotFound(w http.ResponseWriter, r *http.Request, templates *template.Template, registryURL string) {
21
+
w.WriteHeader(http.StatusNotFound)
22
+
23
+
data := struct {
24
+
PageData
25
+
}{
26
+
PageData: NewPageData(r, registryURL),
27
+
}
28
+
29
+
if err := templates.ExecuteTemplate(w, "404", data); err != nil {
30
+
http.Error(w, "Page not found", http.StatusNotFound)
31
+
}
32
+
}
+133
-20
pkg/appview/handlers/images.go
+133
-20
pkg/appview/handlers/images.go
···
3
import (
4
"database/sql"
5
"encoding/json"
6
"fmt"
7
"net/http"
8
"strings"
9
10
"atcr.io/pkg/appview/db"
11
"atcr.io/pkg/appview/middleware"
···
30
repo := chi.URLParam(r, "repository")
31
tag := chi.URLParam(r, "tag")
32
33
-
// Get OAuth session for the authenticated user
34
-
session, err := h.Refresher.GetSession(r.Context(), user.DID)
35
-
if err != nil {
36
-
http.Error(w, fmt.Sprintf("Failed to get OAuth session: %v", err), http.StatusUnauthorized)
37
-
return
38
-
}
39
-
40
-
// Create ATProto client with OAuth credentials
41
-
apiClient := session.APIClient()
42
-
pdsClient := atproto.NewClientWithIndigoClient(user.PDSEndpoint, user.DID, apiClient)
43
44
// Compute rkey for tag record (repository_tag with slashes replaced)
45
rkey := fmt.Sprintf("%s_%s", repo, tag)
···
47
48
// Delete from PDS first
49
if err := pdsClient.DeleteRecord(r.Context(), atproto.TagCollection, rkey); err != nil {
50
http.Error(w, fmt.Sprintf("Failed to delete tag from PDS: %v", err), http.StatusInternalServerError)
51
return
52
}
···
103
return
104
}
105
106
-
// Get OAuth session for the authenticated user
107
-
session, err := h.Refresher.GetSession(r.Context(), user.DID)
108
-
if err != nil {
109
-
http.Error(w, fmt.Sprintf("Failed to get OAuth session: %v", err), http.StatusUnauthorized)
110
-
return
111
-
}
112
-
113
-
// Create ATProto client with OAuth credentials
114
-
apiClient := session.APIClient()
115
-
pdsClient := atproto.NewClientWithIndigoClient(user.PDSEndpoint, user.DID, apiClient)
116
117
// If tagged and confirmed, delete all tags first
118
if tagged && confirmed {
···
127
// Delete from PDS
128
tagRKey := fmt.Sprintf("%s:%s", repo, tag)
129
if err := pdsClient.DeleteRecord(r.Context(), atproto.TagCollection, tagRKey); err != nil {
130
http.Error(w, fmt.Sprintf("Failed to delete tag '%s' from PDS: %v", tag, err), http.StatusInternalServerError)
131
return
132
}
···
144
145
// Delete from PDS first
146
if err := pdsClient.DeleteRecord(r.Context(), atproto.ManifestCollection, rkey); err != nil {
147
http.Error(w, fmt.Sprintf("Failed to delete manifest from PDS: %v", err), http.StatusInternalServerError)
148
return
149
}
···
156
157
w.WriteHeader(http.StatusOK)
158
}
···
3
import (
4
"database/sql"
5
"encoding/json"
6
+
"errors"
7
"fmt"
8
+
"io"
9
"net/http"
10
"strings"
11
+
"time"
12
13
"atcr.io/pkg/appview/db"
14
"atcr.io/pkg/appview/middleware"
···
33
repo := chi.URLParam(r, "repository")
34
tag := chi.URLParam(r, "tag")
35
36
+
// Create ATProto client with session provider (uses DoWithSession for DPoP nonce safety)
37
+
pdsClient := atproto.NewClientWithSessionProvider(user.PDSEndpoint, user.DID, h.Refresher)
38
39
// Compute rkey for tag record (repository_tag with slashes replaced)
40
rkey := fmt.Sprintf("%s_%s", repo, tag)
···
42
43
// Delete from PDS first
44
if err := pdsClient.DeleteRecord(r.Context(), atproto.TagCollection, rkey); err != nil {
45
+
// Check if OAuth error - if so, invalidate sessions and return 401
46
+
if handleOAuthError(r.Context(), h.Refresher, user.DID, err) {
47
+
http.Error(w, "Authentication failed, please log in again", http.StatusUnauthorized)
48
+
return
49
+
}
50
http.Error(w, fmt.Sprintf("Failed to delete tag from PDS: %v", err), http.StatusInternalServerError)
51
return
52
}
···
103
return
104
}
105
106
+
// Create ATProto client with session provider (uses DoWithSession for DPoP nonce safety)
107
+
pdsClient := atproto.NewClientWithSessionProvider(user.PDSEndpoint, user.DID, h.Refresher)
108
109
// If tagged and confirmed, delete all tags first
110
if tagged && confirmed {
···
119
// Delete from PDS
120
tagRKey := fmt.Sprintf("%s:%s", repo, tag)
121
if err := pdsClient.DeleteRecord(r.Context(), atproto.TagCollection, tagRKey); err != nil {
122
+
// Check if OAuth error - if so, invalidate sessions and return 401
123
+
if handleOAuthError(r.Context(), h.Refresher, user.DID, err) {
124
+
http.Error(w, "Authentication failed, please log in again", http.StatusUnauthorized)
125
+
return
126
+
}
127
http.Error(w, fmt.Sprintf("Failed to delete tag '%s' from PDS: %v", tag, err), http.StatusInternalServerError)
128
return
129
}
···
141
142
// Delete from PDS first
143
if err := pdsClient.DeleteRecord(r.Context(), atproto.ManifestCollection, rkey); err != nil {
144
+
// Check if OAuth error - if so, invalidate sessions and return 401
145
+
if handleOAuthError(r.Context(), h.Refresher, user.DID, err) {
146
+
http.Error(w, "Authentication failed, please log in again", http.StatusUnauthorized)
147
+
return
148
+
}
149
http.Error(w, fmt.Sprintf("Failed to delete manifest from PDS: %v", err), http.StatusInternalServerError)
150
return
151
}
···
158
159
w.WriteHeader(http.StatusOK)
160
}
161
+
162
+
// UploadAvatarHandler handles uploading/updating a repository avatar
163
+
type UploadAvatarHandler struct {
164
+
DB *sql.DB
165
+
Refresher *oauth.Refresher
166
+
}
167
+
168
+
// validImageTypes are the allowed MIME types for avatars (matches lexicon)
169
+
var validImageTypes = map[string]bool{
170
+
"image/png": true,
171
+
"image/jpeg": true,
172
+
"image/webp": true,
173
+
}
174
+
175
+
func (h *UploadAvatarHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
176
+
user := middleware.GetUser(r)
177
+
if user == nil {
178
+
http.Error(w, "Unauthorized", http.StatusUnauthorized)
179
+
return
180
+
}
181
+
182
+
repo := chi.URLParam(r, "repository")
183
+
184
+
// Parse multipart form (max 3MB to match lexicon maxSize)
185
+
if err := r.ParseMultipartForm(3 << 20); err != nil {
186
+
http.Error(w, "File too large (max 3MB)", http.StatusBadRequest)
187
+
return
188
+
}
189
+
190
+
file, header, err := r.FormFile("avatar")
191
+
if err != nil {
192
+
http.Error(w, "No file provided", http.StatusBadRequest)
193
+
return
194
+
}
195
+
defer file.Close()
196
+
197
+
// Validate MIME type
198
+
contentType := header.Header.Get("Content-Type")
199
+
if !validImageTypes[contentType] {
200
+
http.Error(w, "Invalid file type. Must be PNG, JPEG, or WebP", http.StatusBadRequest)
201
+
return
202
+
}
203
+
204
+
// Read file data
205
+
data, err := io.ReadAll(io.LimitReader(file, 3<<20+1)) // Read up to 3MB + 1 byte
206
+
if err != nil {
207
+
http.Error(w, "Failed to read file", http.StatusInternalServerError)
208
+
return
209
+
}
210
+
if len(data) > 3<<20 {
211
+
http.Error(w, "File too large (max 3MB)", http.StatusBadRequest)
212
+
return
213
+
}
214
+
215
+
// Create ATProto client with session provider (uses DoWithSession for DPoP nonce safety)
216
+
pdsClient := atproto.NewClientWithSessionProvider(user.PDSEndpoint, user.DID, h.Refresher)
217
+
218
+
// Upload blob to PDS
219
+
blobRef, err := pdsClient.UploadBlob(r.Context(), data, contentType)
220
+
if err != nil {
221
+
if handleOAuthError(r.Context(), h.Refresher, user.DID, err) {
222
+
http.Error(w, "Authentication failed, please log in again", http.StatusUnauthorized)
223
+
return
224
+
}
225
+
http.Error(w, fmt.Sprintf("Failed to upload image: %v", err), http.StatusInternalServerError)
226
+
return
227
+
}
228
+
229
+
// Fetch existing repo page record to preserve description
230
+
var existingDescription string
231
+
var existingCreatedAt time.Time
232
+
record, err := pdsClient.GetRecord(r.Context(), atproto.RepoPageCollection, repo)
233
+
if err == nil {
234
+
// Parse existing record to preserve description
235
+
var existingRecord atproto.RepoPageRecord
236
+
if jsonErr := json.Unmarshal(record.Value, &existingRecord); jsonErr == nil {
237
+
existingDescription = existingRecord.Description
238
+
existingCreatedAt = existingRecord.CreatedAt
239
+
}
240
+
} else if !errors.Is(err, atproto.ErrRecordNotFound) {
241
+
// Some other error - check if OAuth error
242
+
if handleOAuthError(r.Context(), h.Refresher, user.DID, err) {
243
+
http.Error(w, "Authentication failed, please log in again", http.StatusUnauthorized)
244
+
return
245
+
}
246
+
// Log but continue - we'll create a new record
247
+
}
248
+
249
+
// Create updated repo page record
250
+
repoPage := atproto.NewRepoPageRecord(repo, existingDescription, blobRef)
251
+
// Preserve original createdAt if record existed
252
+
if !existingCreatedAt.IsZero() {
253
+
repoPage.CreatedAt = existingCreatedAt
254
+
}
255
+
256
+
// Save record to PDS
257
+
_, err = pdsClient.PutRecord(r.Context(), atproto.RepoPageCollection, repo, repoPage)
258
+
if err != nil {
259
+
if handleOAuthError(r.Context(), h.Refresher, user.DID, err) {
260
+
http.Error(w, "Authentication failed, please log in again", http.StatusUnauthorized)
261
+
return
262
+
}
263
+
http.Error(w, fmt.Sprintf("Failed to update repository page: %v", err), http.StatusInternalServerError)
264
+
return
265
+
}
266
+
267
+
// Return new avatar URL
268
+
avatarURL := atproto.BlobCDNURL(user.DID, blobRef.Ref.Link)
269
+
w.Header().Set("Content-Type", "application/json")
270
+
json.NewEncoder(w).Encode(map[string]string{"avatarURL": avatarURL})
271
+
}
+6
-38
pkg/appview/handlers/logout.go
+6
-38
pkg/appview/handlers/logout.go
···
1
package handlers
2
3
import (
4
-
"log/slog"
5
"net/http"
6
7
"atcr.io/pkg/appview/db"
8
-
"atcr.io/pkg/auth/oauth"
9
-
indigooauth "github.com/bluesky-social/indigo/atproto/auth/oauth"
10
-
"github.com/bluesky-social/indigo/atproto/syntax"
11
)
12
13
-
// LogoutHandler handles user logout with proper OAuth token revocation
14
type LogoutHandler struct {
15
-
OAuthClientApp *indigooauth.ClientApp
16
-
Refresher *oauth.Refresher
17
-
SessionStore *db.SessionStore
18
-
OAuthStore *db.OAuthStore
19
}
20
21
func (h *LogoutHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
···
27
return
28
}
29
30
-
// Get UI session to extract OAuth session ID and user info
31
-
uiSession, ok := h.SessionStore.Get(uiSessionID)
32
-
if ok && uiSession != nil && uiSession.DID != "" {
33
-
// Parse DID for OAuth logout
34
-
did, err := syntax.ParseDID(uiSession.DID)
35
-
if err != nil {
36
-
slog.Warn("Failed to parse DID for logout", "component", "logout", "did", uiSession.DID, "error", err)
37
-
} else {
38
-
// Attempt to revoke OAuth tokens on PDS side
39
-
if uiSession.OAuthSessionID != "" {
40
-
// Call indigo's Logout to revoke tokens on PDS
41
-
if err := h.OAuthClientApp.Logout(r.Context(), did, uiSession.OAuthSessionID); err != nil {
42
-
// Log error but don't block logout - best effort revocation
43
-
slog.Warn("Failed to revoke OAuth tokens on PDS", "component", "logout", "did", uiSession.DID, "error", err)
44
-
} else {
45
-
slog.Info("Successfully revoked OAuth tokens on PDS", "component", "logout", "did", uiSession.DID)
46
-
}
47
-
48
-
// Delete OAuth session from database (cleanup, might already be done by Logout)
49
-
if err := h.OAuthStore.DeleteSession(r.Context(), did, uiSession.OAuthSessionID); err != nil {
50
-
slog.Warn("Failed to delete OAuth session from database", "component", "logout", "error", err)
51
-
}
52
-
} else {
53
-
slog.Warn("No OAuth session ID found for user", "component", "logout", "did", uiSession.DID)
54
-
}
55
-
}
56
-
}
57
-
58
-
// Always delete UI session and clear cookie, even if OAuth revocation failed
59
h.SessionStore.Delete(uiSessionID)
60
db.ClearCookie(w)
61
···
1
package handlers
2
3
import (
4
"net/http"
5
6
"atcr.io/pkg/appview/db"
7
)
8
9
+
// LogoutHandler handles user logout from the web UI
10
+
// This only clears the current UI session cookie - it does NOT revoke OAuth tokens
11
+
// OAuth sessions remain intact so other browser tabs/devices stay logged in
12
type LogoutHandler struct {
13
+
SessionStore *db.SessionStore
14
}
15
16
func (h *LogoutHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
···
22
return
23
}
24
25
+
// Delete only this UI session and clear cookie
26
+
// OAuth session remains intact for other browser tabs/devices
27
h.SessionStore.Delete(uiSessionID)
28
db.ClearCookie(w)
29
-1
pkg/appview/handlers/logout_test.go
-1
pkg/appview/handlers/logout_test.go
+49
pkg/appview/handlers/oauth_errors.go
+49
pkg/appview/handlers/oauth_errors.go
···
···
1
+
package handlers
2
+
3
+
import (
4
+
"context"
5
+
"log/slog"
6
+
"strings"
7
+
8
+
"atcr.io/pkg/auth/oauth"
9
+
)
10
+
11
+
// isOAuthError checks if an error indicates OAuth authentication failure
12
+
// These errors indicate the OAuth session is invalid and should be cleaned up
13
+
func isOAuthError(err error) bool {
14
+
if err == nil {
15
+
return false
16
+
}
17
+
errStr := strings.ToLower(err.Error())
18
+
return strings.Contains(errStr, "401") ||
19
+
strings.Contains(errStr, "403") ||
20
+
strings.Contains(errStr, "invalid_token") ||
21
+
strings.Contains(errStr, "invalid_grant") ||
22
+
strings.Contains(errStr, "use_dpop_nonce") ||
23
+
strings.Contains(errStr, "unauthorized") ||
24
+
strings.Contains(errStr, "token") && strings.Contains(errStr, "expired") ||
25
+
strings.Contains(errStr, "authentication failed")
26
+
}
27
+
28
+
// handleOAuthError checks if an error is OAuth-related and invalidates UI sessions if so
29
+
// Returns true if the error was an OAuth error (caller should return early)
30
+
func handleOAuthError(ctx context.Context, refresher *oauth.Refresher, did string, err error) bool {
31
+
if !isOAuthError(err) {
32
+
return false
33
+
}
34
+
35
+
slog.Warn("OAuth error detected, invalidating sessions",
36
+
"component", "handlers",
37
+
"did", did,
38
+
"error", err)
39
+
40
+
// Invalidate all UI sessions for this DID
41
+
if delErr := refresher.DeleteSession(ctx, did); delErr != nil {
42
+
slog.Warn("Failed to delete OAuth session after error",
43
+
"component", "handlers",
44
+
"did", did,
45
+
"error", delErr)
46
+
}
47
+
48
+
return true
49
+
}
+230
pkg/appview/handlers/opengraph.go
+230
pkg/appview/handlers/opengraph.go
···
···
1
+
package handlers
2
+
3
+
import (
4
+
"database/sql"
5
+
"fmt"
6
+
"log/slog"
7
+
"net/http"
8
+
"strings"
9
+
10
+
"atcr.io/pkg/appview/db"
11
+
"atcr.io/pkg/appview/ogcard"
12
+
"atcr.io/pkg/atproto"
13
+
"github.com/go-chi/chi/v5"
14
+
)
15
+
16
+
// RepoOGHandler generates OpenGraph images for repository pages
17
+
type RepoOGHandler struct {
18
+
DB *sql.DB
19
+
}
20
+
21
+
func (h *RepoOGHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
22
+
handle := chi.URLParam(r, "handle")
23
+
repository := chi.URLParam(r, "repository")
24
+
25
+
// Resolve handle to DID
26
+
did, resolvedHandle, _, err := atproto.ResolveIdentity(r.Context(), handle)
27
+
if err != nil {
28
+
slog.Warn("Failed to resolve identity for OG image", "handle", handle, "error", err)
29
+
http.Error(w, "User not found", http.StatusNotFound)
30
+
return
31
+
}
32
+
33
+
// Get user info
34
+
user, err := db.GetUserByDID(h.DB, did)
35
+
if err != nil || user == nil {
36
+
slog.Warn("Failed to get user for OG image", "did", did, "error", err)
37
+
// Use resolved handle even if user not in DB
38
+
user = &db.User{DID: did, Handle: resolvedHandle}
39
+
}
40
+
41
+
// Get repository stats
42
+
stats, err := db.GetRepositoryStats(h.DB, did, repository)
43
+
if err != nil {
44
+
slog.Warn("Failed to get repo stats for OG image", "did", did, "repo", repository, "error", err)
45
+
stats = &db.RepositoryStats{}
46
+
}
47
+
48
+
// Get repository metadata (description, icon)
49
+
metadata, err := db.GetRepositoryMetadata(h.DB, did, repository)
50
+
if err != nil {
51
+
slog.Warn("Failed to get repo metadata for OG image", "did", did, "repo", repository, "error", err)
52
+
metadata = map[string]string{}
53
+
}
54
+
55
+
description := metadata["org.opencontainers.image.description"]
56
+
iconURL := metadata["io.atcr.icon"]
57
+
version := metadata["org.opencontainers.image.version"]
58
+
licenses := metadata["org.opencontainers.image.licenses"]
59
+
60
+
// Generate the OG image
61
+
card := ogcard.NewCard()
62
+
card.Fill(ogcard.ColorBackground)
63
+
layout := ogcard.StandardLayout()
64
+
65
+
// Draw icon/avatar on the left (prefer repo icon, then user avatar, then placeholder)
66
+
avatarURL := iconURL
67
+
if avatarURL == "" {
68
+
avatarURL = user.Avatar
69
+
}
70
+
card.DrawAvatarOrPlaceholder(avatarURL, layout.IconX, layout.IconY, ogcard.AvatarSize,
71
+
strings.ToUpper(string(repository[0])))
72
+
73
+
// Draw owner handle and repo name - wrap to new line if too long
74
+
ownerText := "@" + user.Handle + " / "
75
+
ownerWidth := card.MeasureText(ownerText, ogcard.FontTitle, false)
76
+
repoWidth := card.MeasureText(repository, ogcard.FontTitle, true)
77
+
combinedWidth := ownerWidth + repoWidth
78
+
79
+
textY := layout.TextY
80
+
if combinedWidth > layout.MaxWidth {
81
+
// Too long - put repo name on new line
82
+
card.DrawText("@"+user.Handle+" /", layout.TextX, textY, ogcard.FontTitle, ogcard.ColorMuted, ogcard.AlignLeft, false)
83
+
textY += ogcard.LineSpacingLarge
84
+
card.DrawText(repository, layout.TextX, textY, ogcard.FontTitle, ogcard.ColorText, ogcard.AlignLeft, true)
85
+
} else {
86
+
// Fits on one line
87
+
card.DrawText(ownerText, layout.TextX, textY, ogcard.FontTitle, ogcard.ColorMuted, ogcard.AlignLeft, false)
88
+
card.DrawText(repository, layout.TextX+float64(ownerWidth), textY, ogcard.FontTitle, ogcard.ColorText, ogcard.AlignLeft, true)
89
+
}
90
+
91
+
// Track current Y position for description
92
+
if description != "" {
93
+
textY += ogcard.LineSpacingSmall
94
+
card.DrawTextWrapped(description, layout.TextX, textY, ogcard.FontDescription, ogcard.ColorMuted, layout.MaxWidth, false)
95
+
}
96
+
97
+
// Badges row (version, license)
98
+
badgeY := layout.IconY + ogcard.AvatarSize + 30
99
+
badgeX := int(layout.TextX)
100
+
101
+
if version != "" {
102
+
width := card.DrawBadge(version, badgeX, badgeY, ogcard.FontBadge, ogcard.ColorBadgeAccent, ogcard.ColorText)
103
+
badgeX += width + ogcard.BadgeGap
104
+
}
105
+
106
+
if licenses != "" {
107
+
// Show first license if multiple
108
+
license := strings.Split(licenses, ",")[0]
109
+
license = strings.TrimSpace(license)
110
+
card.DrawBadge(license, badgeX, badgeY, ogcard.FontBadge, ogcard.ColorBadgeBg, ogcard.ColorText)
111
+
}
112
+
113
+
// Stats at bottom
114
+
statsX := card.DrawStatWithIcon("star", fmt.Sprintf("%d", stats.StarCount),
115
+
ogcard.Padding, layout.StatsY, ogcard.ColorStar, ogcard.ColorText)
116
+
card.DrawStatWithIcon("arrow-down-to-line", fmt.Sprintf("%d pulls", stats.PullCount),
117
+
statsX, layout.StatsY, ogcard.ColorMuted, ogcard.ColorMuted)
118
+
119
+
// ATCR branding (bottom right)
120
+
card.DrawBranding()
121
+
122
+
// Set cache headers and content type
123
+
w.Header().Set("Content-Type", "image/png")
124
+
w.Header().Set("Cache-Control", "public, max-age=3600")
125
+
126
+
if err := card.EncodePNG(w); err != nil {
127
+
slog.Error("Failed to encode OG image", "error", err)
128
+
http.Error(w, "Failed to generate image", http.StatusInternalServerError)
129
+
}
130
+
}
131
+
132
+
// DefaultOGHandler generates the default OpenGraph image for the home page
133
+
type DefaultOGHandler struct{}
134
+
135
+
func (h *DefaultOGHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
136
+
// Generate the OG image
137
+
card := ogcard.NewCard()
138
+
card.Fill(ogcard.ColorBackground)
139
+
140
+
// Draw large centered "ATCR" title
141
+
centerY := float64(ogcard.CardHeight) / 2
142
+
card.DrawText("ATCR", float64(ogcard.CardWidth)/2, centerY-20, 96.0, ogcard.ColorText, ogcard.AlignCenter, true)
143
+
144
+
// Draw tagline below
145
+
card.DrawText("Distributed Container Registry", float64(ogcard.CardWidth)/2, centerY+60, ogcard.FontDescription, ogcard.ColorMuted, ogcard.AlignCenter, false)
146
+
147
+
// Draw subtitle
148
+
card.DrawText("Push and pull Docker images on the AT Protocol", float64(ogcard.CardWidth)/2, centerY+110, ogcard.FontStats, ogcard.ColorMuted, ogcard.AlignCenter, false)
149
+
150
+
// Set cache headers and content type (cache longer since it's static content)
151
+
w.Header().Set("Content-Type", "image/png")
152
+
w.Header().Set("Cache-Control", "public, max-age=86400")
153
+
154
+
if err := card.EncodePNG(w); err != nil {
155
+
slog.Error("Failed to encode default OG image", "error", err)
156
+
http.Error(w, "Failed to generate image", http.StatusInternalServerError)
157
+
}
158
+
}
159
+
160
+
// UserOGHandler generates OpenGraph images for user profile pages
161
+
type UserOGHandler struct {
162
+
DB *sql.DB
163
+
}
164
+
165
+
func (h *UserOGHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
166
+
handle := chi.URLParam(r, "handle")
167
+
168
+
// Resolve handle to DID
169
+
did, resolvedHandle, _, err := atproto.ResolveIdentity(r.Context(), handle)
170
+
if err != nil {
171
+
slog.Warn("Failed to resolve identity for OG image", "handle", handle, "error", err)
172
+
http.Error(w, "User not found", http.StatusNotFound)
173
+
return
174
+
}
175
+
176
+
// Get user info
177
+
user, err := db.GetUserByDID(h.DB, did)
178
+
if err != nil || user == nil {
179
+
// Use resolved handle even if user not in DB
180
+
user = &db.User{DID: did, Handle: resolvedHandle}
181
+
}
182
+
183
+
// Get repository count
184
+
repos, err := db.GetUserRepositories(h.DB, did)
185
+
repoCount := 0
186
+
if err == nil {
187
+
repoCount = len(repos)
188
+
}
189
+
190
+
// Generate the OG image
191
+
card := ogcard.NewCard()
192
+
card.Fill(ogcard.ColorBackground)
193
+
layout := ogcard.StandardLayout()
194
+
195
+
// Draw avatar on the left
196
+
firstChar := "?"
197
+
if len(user.Handle) > 0 {
198
+
firstChar = strings.ToUpper(string(user.Handle[0]))
199
+
}
200
+
card.DrawAvatarOrPlaceholder(user.Avatar, layout.IconX, layout.IconY, ogcard.AvatarSize, firstChar)
201
+
202
+
// Draw handle
203
+
handleText := "@" + user.Handle
204
+
card.DrawText(handleText, layout.TextX, layout.TextY, ogcard.FontTitle, ogcard.ColorText, ogcard.AlignLeft, true)
205
+
206
+
// Repository count below (using description font size)
207
+
textY := layout.TextY + ogcard.LineSpacingLarge
208
+
repoText := fmt.Sprintf("%d repositories", repoCount)
209
+
if repoCount == 1 {
210
+
repoText = "1 repository"
211
+
}
212
+
213
+
// Draw package icon with description-sized text
214
+
if err := card.DrawIcon("package", int(layout.TextX), int(textY)-int(ogcard.FontDescription), int(ogcard.FontDescription), ogcard.ColorMuted); err != nil {
215
+
slog.Warn("Failed to draw package icon", "error", err)
216
+
}
217
+
card.DrawText(repoText, layout.TextX+42, textY, ogcard.FontDescription, ogcard.ColorMuted, ogcard.AlignLeft, false)
218
+
219
+
// ATCR branding (bottom right)
220
+
card.DrawBranding()
221
+
222
+
// Set cache headers and content type
223
+
w.Header().Set("Content-Type", "image/png")
224
+
w.Header().Set("Cache-Control", "public, max-age=3600")
225
+
226
+
if err := card.EncodePNG(w); err != nil {
227
+
slog.Error("Failed to encode OG image", "error", err)
228
+
http.Error(w, "Failed to generate image", http.StatusInternalServerError)
229
+
}
230
+
}
+61
-29
pkg/appview/handlers/repository.go
+61
-29
pkg/appview/handlers/repository.go
···
27
Directory identity.Directory
28
Refresher *oauth.Refresher
29
HealthChecker *holdhealth.Checker
30
-
ReadmeCache *readme.Cache
31
}
32
33
func (h *RepositoryPageHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
34
-
handle := chi.URLParam(r, "handle")
35
repository := chi.URLParam(r, "repository")
36
37
-
// Look up user by handle
38
-
owner, err := db.GetUserByHandle(h.DB, handle)
39
if err != nil {
40
http.Error(w, err.Error(), http.StatusInternalServerError)
41
return
42
}
43
-
44
if owner == nil {
45
-
http.Error(w, "User not found", http.StatusNotFound)
46
return
47
}
48
49
// Fetch tags with platform information
50
tagsWithPlatforms, err := db.GetTagsWithPlatforms(h.DB, owner.DID, repository)
51
if err != nil {
···
124
}
125
126
if len(tagsWithPlatforms) == 0 && len(manifests) == 0 {
127
-
http.Error(w, "Repository not found", http.StatusNotFound)
128
return
129
}
130
···
163
isStarred := false
164
user := middleware.GetUser(r)
165
if user != nil && h.Refresher != nil && h.Directory != nil {
166
-
// Get OAuth session for the authenticated user
167
-
session, err := h.Refresher.GetSession(r.Context(), user.DID)
168
-
if err == nil {
169
-
// Get user's PDS client
170
-
apiClient := session.APIClient()
171
-
pdsClient := atproto.NewClientWithIndigoClient(user.PDSEndpoint, user.DID, apiClient)
172
173
-
// Check if star record exists
174
-
rkey := atproto.StarRecordKey(owner.DID, repository)
175
-
_, err = pdsClient.GetRecord(r.Context(), atproto.StarCollection, rkey)
176
-
isStarred = (err == nil)
177
-
}
178
}
179
180
// Check if current user is the repository owner
···
183
isOwner = (user.DID == owner.DID)
184
}
185
186
-
// Fetch README content if available
187
var readmeHTML template.HTML
188
-
if repo.ReadmeURL != "" && h.ReadmeCache != nil {
189
-
// Fetch with timeout
190
-
ctx, cancel := context.WithTimeout(r.Context(), 5*time.Second)
191
-
defer cancel()
192
193
-
html, err := h.ReadmeCache.Get(ctx, repo.ReadmeURL)
194
-
if err != nil {
195
-
slog.Warn("Failed to fetch README", "url", repo.ReadmeURL, "error", err)
196
-
// Continue without README on error
197
-
} else {
198
-
readmeHTML = template.HTML(html)
199
}
200
}
201
···
27
Directory identity.Directory
28
Refresher *oauth.Refresher
29
HealthChecker *holdhealth.Checker
30
+
ReadmeFetcher *readme.Fetcher // For rendering repo page descriptions
31
}
32
33
func (h *RepositoryPageHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
34
+
identifier := chi.URLParam(r, "handle")
35
repository := chi.URLParam(r, "repository")
36
37
+
// Resolve identifier (handle or DID) to canonical DID and current handle
38
+
did, resolvedHandle, _, err := atproto.ResolveIdentity(r.Context(), identifier)
39
+
if err != nil {
40
+
RenderNotFound(w, r, h.Templates, h.RegistryURL)
41
+
return
42
+
}
43
+
44
+
// Look up user by DID
45
+
owner, err := db.GetUserByDID(h.DB, did)
46
if err != nil {
47
http.Error(w, err.Error(), http.StatusInternalServerError)
48
return
49
}
50
if owner == nil {
51
+
RenderNotFound(w, r, h.Templates, h.RegistryURL)
52
return
53
}
54
55
+
// Opportunistically update cached handle if it changed
56
+
if owner.Handle != resolvedHandle {
57
+
_ = db.UpdateUserHandle(h.DB, did, resolvedHandle)
58
+
owner.Handle = resolvedHandle
59
+
}
60
+
61
// Fetch tags with platform information
62
tagsWithPlatforms, err := db.GetTagsWithPlatforms(h.DB, owner.DID, repository)
63
if err != nil {
···
136
}
137
138
if len(tagsWithPlatforms) == 0 && len(manifests) == 0 {
139
+
RenderNotFound(w, r, h.Templates, h.RegistryURL)
140
return
141
}
142
···
175
isStarred := false
176
user := middleware.GetUser(r)
177
if user != nil && h.Refresher != nil && h.Directory != nil {
178
+
// Create ATProto client with session provider (uses DoWithSession for DPoP nonce safety)
179
+
pdsClient := atproto.NewClientWithSessionProvider(user.PDSEndpoint, user.DID, h.Refresher)
180
181
+
// Check if star record exists
182
+
rkey := atproto.StarRecordKey(owner.DID, repository)
183
+
_, err := pdsClient.GetRecord(r.Context(), atproto.StarCollection, rkey)
184
+
isStarred = (err == nil)
185
}
186
187
// Check if current user is the repository owner
···
190
isOwner = (user.DID == owner.DID)
191
}
192
193
+
// Fetch README content from repo page record or annotations
194
var readmeHTML template.HTML
195
196
+
// Try repo page record from database (synced from PDS via Jetstream)
197
+
repoPage, err := db.GetRepoPage(h.DB, owner.DID, repository)
198
+
if err == nil && repoPage != nil {
199
+
// Use repo page avatar if present
200
+
if repoPage.AvatarCID != "" {
201
+
repo.IconURL = atproto.BlobCDNURL(owner.DID, repoPage.AvatarCID)
202
+
}
203
+
// Render description as markdown if present
204
+
if repoPage.Description != "" && h.ReadmeFetcher != nil {
205
+
html, err := h.ReadmeFetcher.RenderMarkdown([]byte(repoPage.Description))
206
+
if err != nil {
207
+
slog.Warn("Failed to render repo page description", "error", err)
208
+
} else {
209
+
readmeHTML = template.HTML(html)
210
+
}
211
+
}
212
+
}
213
+
// Fall back to fetching README from URL annotations if no description in repo page
214
+
if readmeHTML == "" && h.ReadmeFetcher != nil {
215
+
// Fall back to fetching from URL annotations
216
+
readmeURL := repo.ReadmeURL
217
+
if readmeURL == "" && repo.SourceURL != "" {
218
+
// Try to derive README URL from source URL
219
+
readmeURL = readme.DeriveReadmeURL(repo.SourceURL, "main")
220
+
if readmeURL == "" {
221
+
readmeURL = readme.DeriveReadmeURL(repo.SourceURL, "master")
222
+
}
223
+
}
224
+
if readmeURL != "" {
225
+
html, err := h.ReadmeFetcher.FetchAndRender(r.Context(), readmeURL)
226
+
if err != nil {
227
+
slog.Debug("Failed to fetch README from URL", "url", readmeURL, "error", err)
228
+
} else {
229
+
readmeHTML = template.HTML(html)
230
+
}
231
}
232
}
233
+4
-28
pkg/appview/handlers/settings.go
+4
-28
pkg/appview/handlers/settings.go
···
26
return
27
}
28
29
-
// Get OAuth session for the user
30
-
session, err := h.Refresher.GetSession(r.Context(), user.DID)
31
-
if err != nil {
32
-
// OAuth session not found or expired - redirect to re-authenticate
33
-
slog.Warn("OAuth session not found, redirecting to login", "component", "settings", "did", user.DID, "error", err)
34
-
http.Redirect(w, r, "/auth/oauth/login?return_to=/settings", http.StatusFound)
35
-
return
36
-
}
37
-
38
-
// Use indigo's API client directly - it handles all auth automatically
39
-
apiClient := session.APIClient()
40
-
41
-
// Create ATProto client with indigo's XRPC client
42
-
client := atproto.NewClientWithIndigoClient(user.PDSEndpoint, user.DID, apiClient)
43
44
// Fetch sailor profile
45
profile, err := storage.GetProfile(r.Context(), client)
···
96
97
holdEndpoint := r.FormValue("hold_endpoint")
98
99
-
// Get OAuth session for the user
100
-
session, err := h.Refresher.GetSession(r.Context(), user.DID)
101
-
if err != nil {
102
-
// OAuth session not found or expired - redirect to re-authenticate
103
-
slog.Warn("OAuth session not found, redirecting to login", "component", "settings", "did", user.DID, "error", err)
104
-
http.Redirect(w, r, "/auth/oauth/login?return_to=/settings", http.StatusFound)
105
-
return
106
-
}
107
-
108
-
// Use indigo's API client directly - it handles all auth automatically
109
-
apiClient := session.APIClient()
110
-
111
-
// Create ATProto client with indigo's XRPC client
112
-
client := atproto.NewClientWithIndigoClient(user.PDSEndpoint, user.DID, apiClient)
113
114
// Fetch existing profile or create new one
115
profile, err := storage.GetProfile(r.Context(), client)
···
26
return
27
}
28
29
+
// Create ATProto client with session provider (uses DoWithSession for DPoP nonce safety)
30
+
client := atproto.NewClientWithSessionProvider(user.PDSEndpoint, user.DID, h.Refresher)
31
32
// Fetch sailor profile
33
profile, err := storage.GetProfile(r.Context(), client)
···
84
85
holdEndpoint := r.FormValue("hold_endpoint")
86
87
+
// Create ATProto client with session provider (uses DoWithSession for DPoP nonce safety)
88
+
client := atproto.NewClientWithSessionProvider(user.PDSEndpoint, user.DID, h.Refresher)
89
90
// Fetch existing profile or create new one
91
profile, err := storage.GetProfile(r.Context(), client)
+26
-5
pkg/appview/handlers/user.go
+26
-5
pkg/appview/handlers/user.go
···
6
"net/http"
7
8
"atcr.io/pkg/appview/db"
9
"github.com/go-chi/chi/v5"
10
)
11
···
17
}
18
19
func (h *UserPageHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
20
-
handle := chi.URLParam(r, "handle")
21
22
-
// Look up user by handle
23
-
viewedUser, err := db.GetUserByHandle(h.DB, handle)
24
if err != nil {
25
http.Error(w, err.Error(), http.StatusInternalServerError)
26
return
27
}
28
29
if viewedUser == nil {
30
-
http.Error(w, "User not found", http.StatusNotFound)
31
-
return
32
}
33
34
// Fetch repositories for this user
···
64
PageData
65
ViewedUser *db.User // User whose page we're viewing
66
Repositories []db.RepoCardData
67
}{
68
PageData: NewPageData(r, h.RegistryURL),
69
ViewedUser: viewedUser,
70
Repositories: cards,
71
}
72
73
if err := h.Templates.ExecuteTemplate(w, "user", data); err != nil {
···
6
"net/http"
7
8
"atcr.io/pkg/appview/db"
9
+
"atcr.io/pkg/atproto"
10
"github.com/go-chi/chi/v5"
11
)
12
···
18
}
19
20
func (h *UserPageHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
21
+
identifier := chi.URLParam(r, "handle")
22
23
+
// Resolve identifier (handle or DID) to canonical DID and current handle
24
+
did, resolvedHandle, pdsEndpoint, err := atproto.ResolveIdentity(r.Context(), identifier)
25
+
if err != nil {
26
+
RenderNotFound(w, r, h.Templates, h.RegistryURL)
27
+
return
28
+
}
29
+
30
+
// Look up user by DID
31
+
viewedUser, err := db.GetUserByDID(h.DB, did)
32
if err != nil {
33
http.Error(w, err.Error(), http.StatusInternalServerError)
34
return
35
}
36
37
+
hasProfile := true
38
if viewedUser == nil {
39
+
// Valid ATProto user but hasn't set up ATCR profile
40
+
hasProfile = false
41
+
viewedUser = &db.User{
42
+
DID: did,
43
+
Handle: resolvedHandle,
44
+
PDSEndpoint: pdsEndpoint,
45
+
// Avatar intentionally empty - template shows '?' placeholder
46
+
}
47
+
} else if viewedUser.Handle != resolvedHandle {
48
+
// Opportunistically update cached handle if it changed
49
+
_ = db.UpdateUserHandle(h.DB, did, resolvedHandle)
50
+
viewedUser.Handle = resolvedHandle
51
}
52
53
// Fetch repositories for this user
···
83
PageData
84
ViewedUser *db.User // User whose page we're viewing
85
Repositories []db.RepoCardData
86
+
HasProfile bool
87
}{
88
PageData: NewPageData(r, h.RegistryURL),
89
ViewedUser: viewedUser,
90
Repositories: cards,
91
+
HasProfile: hasProfile,
92
}
93
94
if err := h.Templates.ExecuteTemplate(w, "user", data); err != nil {
+205
-4
pkg/appview/jetstream/backfill.go
+205
-4
pkg/appview/jetstream/backfill.go
···
5
"database/sql"
6
"encoding/json"
7
"fmt"
8
"log/slog"
9
"strings"
10
"time"
11
12
"atcr.io/pkg/appview/db"
13
"atcr.io/pkg/atproto"
14
)
15
16
// BackfillWorker uses com.atproto.sync.listReposByCollection to backfill historical data
17
type BackfillWorker struct {
18
db *sql.DB
19
client *atproto.Client
20
-
processor *Processor // Shared processor for DB operations
21
-
defaultHoldDID string // Default hold DID from AppView config (e.g., "did:web:hold01.atcr.io")
22
-
testMode bool // If true, suppress warnings for external holds
23
}
24
25
// BackfillState tracks backfill progress
···
36
// NewBackfillWorker creates a backfill worker using sync API
37
// defaultHoldDID should be in format "did:web:hold01.atcr.io"
38
// To find a hold's DID, visit: https://hold-url/.well-known/did.json
39
-
func NewBackfillWorker(database *sql.DB, relayEndpoint, defaultHoldDID string, testMode bool) (*BackfillWorker, error) {
40
// Create client for relay - used only for listReposByCollection
41
client := atproto.NewClient(relayEndpoint, "", "")
42
···
46
processor: NewProcessor(database, false), // No cache for batch processing
47
defaultHoldDID: defaultHoldDID,
48
testMode: testMode,
49
}, nil
50
}
51
···
67
atproto.TagCollection, // io.atcr.tag
68
atproto.StarCollection, // io.atcr.sailor.star
69
atproto.SailorProfileCollection, // io.atcr.sailor.profile
70
}
71
72
for _, collection := range collections {
···
217
}
218
}
219
220
return recordCount, nil
221
}
222
···
282
return b.processor.ProcessStar(context.Background(), did, record.Value)
283
case atproto.SailorProfileCollection:
284
return b.processor.ProcessSailorProfile(ctx, did, record.Value, b.queryCaptainRecordWrapper)
285
default:
286
return fmt.Errorf("unsupported collection: %s", collection)
287
}
···
413
414
return nil
415
}
···
5
"database/sql"
6
"encoding/json"
7
"fmt"
8
+
"io"
9
"log/slog"
10
+
"net/http"
11
"strings"
12
"time"
13
14
"atcr.io/pkg/appview/db"
15
+
"atcr.io/pkg/appview/readme"
16
"atcr.io/pkg/atproto"
17
+
"atcr.io/pkg/auth/oauth"
18
)
19
20
// BackfillWorker uses com.atproto.sync.listReposByCollection to backfill historical data
21
type BackfillWorker struct {
22
db *sql.DB
23
client *atproto.Client
24
+
processor *Processor // Shared processor for DB operations
25
+
defaultHoldDID string // Default hold DID from AppView config (e.g., "did:web:hold01.atcr.io")
26
+
testMode bool // If true, suppress warnings for external holds
27
+
refresher *oauth.Refresher // OAuth refresher for PDS writes (optional, can be nil)
28
}
29
30
// BackfillState tracks backfill progress
···
41
// NewBackfillWorker creates a backfill worker using sync API
42
// defaultHoldDID should be in format "did:web:hold01.atcr.io"
43
// To find a hold's DID, visit: https://hold-url/.well-known/did.json
44
+
// refresher is optional - if provided, backfill will try to update PDS records when fetching README content
45
+
func NewBackfillWorker(database *sql.DB, relayEndpoint, defaultHoldDID string, testMode bool, refresher *oauth.Refresher) (*BackfillWorker, error) {
46
// Create client for relay - used only for listReposByCollection
47
client := atproto.NewClient(relayEndpoint, "", "")
48
···
52
processor: NewProcessor(database, false), // No cache for batch processing
53
defaultHoldDID: defaultHoldDID,
54
testMode: testMode,
55
+
refresher: refresher,
56
}, nil
57
}
58
···
74
atproto.TagCollection, // io.atcr.tag
75
atproto.StarCollection, // io.atcr.sailor.star
76
atproto.SailorProfileCollection, // io.atcr.sailor.profile
77
+
atproto.RepoPageCollection, // io.atcr.repo.page
78
}
79
80
for _, collection := range collections {
···
225
}
226
}
227
228
+
// After processing repo pages, fetch descriptions from external sources if empty
229
+
if collection == atproto.RepoPageCollection {
230
+
if err := b.reconcileRepoPageDescriptions(ctx, did, pdsEndpoint); err != nil {
231
+
slog.Warn("Backfill failed to reconcile repo page descriptions", "did", did, "error", err)
232
+
}
233
+
}
234
+
235
return recordCount, nil
236
}
237
···
297
return b.processor.ProcessStar(context.Background(), did, record.Value)
298
case atproto.SailorProfileCollection:
299
return b.processor.ProcessSailorProfile(ctx, did, record.Value, b.queryCaptainRecordWrapper)
300
+
case atproto.RepoPageCollection:
301
+
// rkey is extracted from the record URI, but for repo pages we use Repository field
302
+
return b.processor.ProcessRepoPage(ctx, did, record.URI, record.Value, false)
303
default:
304
return fmt.Errorf("unsupported collection: %s", collection)
305
}
···
431
432
return nil
433
}
434
+
435
+
// reconcileRepoPageDescriptions fetches README content from external sources for repo pages with empty descriptions
436
+
// If the user has an OAuth session, it updates the PDS record (source of truth)
437
+
// Otherwise, it just stores the fetched content in the database
438
+
func (b *BackfillWorker) reconcileRepoPageDescriptions(ctx context.Context, did, pdsEndpoint string) error {
439
+
// Get all repo pages for this DID
440
+
repoPages, err := db.GetRepoPagesByDID(b.db, did)
441
+
if err != nil {
442
+
return fmt.Errorf("failed to get repo pages: %w", err)
443
+
}
444
+
445
+
for _, page := range repoPages {
446
+
// Skip pages that already have a description
447
+
if page.Description != "" {
448
+
continue
449
+
}
450
+
451
+
// Get annotations from the repository's manifest
452
+
annotations, err := db.GetRepositoryAnnotations(b.db, did, page.Repository)
453
+
if err != nil {
454
+
slog.Debug("Failed to get annotations for repo page", "did", did, "repository", page.Repository, "error", err)
455
+
continue
456
+
}
457
+
458
+
// Try to fetch README content from external sources
459
+
description := b.fetchReadmeContent(ctx, annotations)
460
+
if description == "" {
461
+
// No README content available, skip
462
+
continue
463
+
}
464
+
465
+
slog.Info("Fetched README for repo page", "did", did, "repository", page.Repository, "descriptionLength", len(description))
466
+
467
+
// Try to update PDS if we have OAuth session
468
+
pdsUpdated := false
469
+
if b.refresher != nil {
470
+
if err := b.updateRepoPageInPDS(ctx, did, pdsEndpoint, page.Repository, description, page.AvatarCID); err != nil {
471
+
slog.Debug("Could not update repo page in PDS, falling back to DB-only", "did", did, "repository", page.Repository, "error", err)
472
+
} else {
473
+
pdsUpdated = true
474
+
slog.Info("Updated repo page in PDS with fetched description", "did", did, "repository", page.Repository)
475
+
}
476
+
}
477
+
478
+
// Always update database with the fetched content
479
+
if err := db.UpsertRepoPage(b.db, did, page.Repository, description, page.AvatarCID, page.CreatedAt, time.Now()); err != nil {
480
+
slog.Warn("Failed to update repo page in database", "did", did, "repository", page.Repository, "error", err)
481
+
} else if !pdsUpdated {
482
+
slog.Info("Updated repo page in database (PDS not updated)", "did", did, "repository", page.Repository)
483
+
}
484
+
}
485
+
486
+
return nil
487
+
}
488
+
489
+
// fetchReadmeContent attempts to fetch README content from external sources based on annotations
490
+
// Priority: io.atcr.readme annotation > derived from org.opencontainers.image.source
491
+
func (b *BackfillWorker) fetchReadmeContent(ctx context.Context, annotations map[string]string) string {
492
+
// Create a context with timeout for README fetching
493
+
fetchCtx, cancel := context.WithTimeout(ctx, 10*time.Second)
494
+
defer cancel()
495
+
496
+
// Priority 1: Direct README URL from io.atcr.readme annotation
497
+
if readmeURL := annotations["io.atcr.readme"]; readmeURL != "" {
498
+
content, err := b.fetchRawReadme(fetchCtx, readmeURL)
499
+
if err != nil {
500
+
slog.Debug("Failed to fetch README from io.atcr.readme annotation", "url", readmeURL, "error", err)
501
+
} else if content != "" {
502
+
return content
503
+
}
504
+
}
505
+
506
+
// Priority 2: Derive README URL from org.opencontainers.image.source
507
+
if sourceURL := annotations["org.opencontainers.image.source"]; sourceURL != "" {
508
+
// Try main branch first, then master
509
+
for _, branch := range []string{"main", "master"} {
510
+
readmeURL := readme.DeriveReadmeURL(sourceURL, branch)
511
+
if readmeURL == "" {
512
+
continue
513
+
}
514
+
515
+
content, err := b.fetchRawReadme(fetchCtx, readmeURL)
516
+
if err != nil {
517
+
// Only log non-404 errors (404 is expected when trying main vs master)
518
+
if !readme.Is404(err) {
519
+
slog.Debug("Failed to fetch README from source URL", "url", readmeURL, "branch", branch, "error", err)
520
+
}
521
+
continue
522
+
}
523
+
524
+
if content != "" {
525
+
return content
526
+
}
527
+
}
528
+
}
529
+
530
+
return ""
531
+
}
532
+
533
+
// fetchRawReadme fetches raw markdown content from a URL
534
+
func (b *BackfillWorker) fetchRawReadme(ctx context.Context, readmeURL string) (string, error) {
535
+
req, err := http.NewRequestWithContext(ctx, "GET", readmeURL, nil)
536
+
if err != nil {
537
+
return "", fmt.Errorf("failed to create request: %w", err)
538
+
}
539
+
540
+
req.Header.Set("User-Agent", "ATCR-Backfill-README-Fetcher/1.0")
541
+
542
+
client := &http.Client{
543
+
Timeout: 10 * time.Second,
544
+
CheckRedirect: func(req *http.Request, via []*http.Request) error {
545
+
if len(via) >= 5 {
546
+
return fmt.Errorf("too many redirects")
547
+
}
548
+
return nil
549
+
},
550
+
}
551
+
552
+
resp, err := client.Do(req)
553
+
if err != nil {
554
+
return "", fmt.Errorf("failed to fetch URL: %w", err)
555
+
}
556
+
defer resp.Body.Close()
557
+
558
+
if resp.StatusCode != http.StatusOK {
559
+
return "", fmt.Errorf("status %d", resp.StatusCode)
560
+
}
561
+
562
+
// Limit content size to 100KB
563
+
limitedReader := io.LimitReader(resp.Body, 100*1024)
564
+
content, err := io.ReadAll(limitedReader)
565
+
if err != nil {
566
+
return "", fmt.Errorf("failed to read response body: %w", err)
567
+
}
568
+
569
+
return string(content), nil
570
+
}
571
+
572
+
// updateRepoPageInPDS updates the repo page record in the user's PDS using OAuth
573
+
func (b *BackfillWorker) updateRepoPageInPDS(ctx context.Context, did, pdsEndpoint, repository, description, avatarCID string) error {
574
+
if b.refresher == nil {
575
+
return fmt.Errorf("no OAuth refresher available")
576
+
}
577
+
578
+
// Create ATProto client with session provider
579
+
pdsClient := atproto.NewClientWithSessionProvider(pdsEndpoint, did, b.refresher)
580
+
581
+
// Get existing repo page record to preserve other fields
582
+
existingRecord, err := pdsClient.GetRecord(ctx, atproto.RepoPageCollection, repository)
583
+
var createdAt time.Time
584
+
var avatarRef *atproto.ATProtoBlobRef
585
+
586
+
if err == nil && existingRecord != nil {
587
+
// Parse existing record
588
+
var existingPage atproto.RepoPageRecord
589
+
if err := json.Unmarshal(existingRecord.Value, &existingPage); err == nil {
590
+
createdAt = existingPage.CreatedAt
591
+
avatarRef = existingPage.Avatar
592
+
}
593
+
}
594
+
595
+
if createdAt.IsZero() {
596
+
createdAt = time.Now()
597
+
}
598
+
599
+
// Create updated repo page record
600
+
repoPage := &atproto.RepoPageRecord{
601
+
Type: atproto.RepoPageCollection,
602
+
Repository: repository,
603
+
Description: description,
604
+
Avatar: avatarRef,
605
+
CreatedAt: createdAt,
606
+
UpdatedAt: time.Now(),
607
+
}
608
+
609
+
// Write to PDS - this will use DoWithSession internally
610
+
_, err = pdsClient.PutRecord(ctx, atproto.RepoPageCollection, repository, repoPage)
611
+
if err != nil {
612
+
return fmt.Errorf("failed to write to PDS: %w", err)
613
+
}
614
+
615
+
return nil
616
+
}
+33
pkg/appview/jetstream/processor.go
+33
pkg/appview/jetstream/processor.go
···
189
platformOSVersion = ref.Platform.OSVersion
190
}
191
192
if err := db.InsertManifestReference(p.db, &db.ManifestReference{
193
ManifestID: manifestID,
194
Digest: ref.Digest,
···
198
PlatformOS: platformOS,
199
PlatformVariant: platformVariant,
200
PlatformOSVersion: platformOSVersion,
201
ReferenceIndex: i,
202
}); err != nil {
203
// Continue on error - reference might already exist
···
288
}
289
290
return nil
291
}
292
293
// ProcessIdentity handles identity change events (handle updates)
···
189
platformOSVersion = ref.Platform.OSVersion
190
}
191
192
+
// Detect attestation manifests from annotations
193
+
isAttestation := false
194
+
if ref.Annotations != nil {
195
+
if refType, ok := ref.Annotations["vnd.docker.reference.type"]; ok {
196
+
isAttestation = refType == "attestation-manifest"
197
+
}
198
+
}
199
+
200
if err := db.InsertManifestReference(p.db, &db.ManifestReference{
201
ManifestID: manifestID,
202
Digest: ref.Digest,
···
206
PlatformOS: platformOS,
207
PlatformVariant: platformVariant,
208
PlatformOSVersion: platformOSVersion,
209
+
IsAttestation: isAttestation,
210
ReferenceIndex: i,
211
}); err != nil {
212
// Continue on error - reference might already exist
···
297
}
298
299
return nil
300
+
}
301
+
302
+
// ProcessRepoPage processes a repository page record
303
+
// This is called when Jetstream receives a repo page create/update event
304
+
func (p *Processor) ProcessRepoPage(ctx context.Context, did string, rkey string, recordData []byte, isDelete bool) error {
305
+
if isDelete {
306
+
// Delete the repo page from our cache
307
+
return db.DeleteRepoPage(p.db, did, rkey)
308
+
}
309
+
310
+
// Unmarshal repo page record
311
+
var pageRecord atproto.RepoPageRecord
312
+
if err := json.Unmarshal(recordData, &pageRecord); err != nil {
313
+
return fmt.Errorf("failed to unmarshal repo page: %w", err)
314
+
}
315
+
316
+
// Extract avatar CID if present
317
+
avatarCID := ""
318
+
if pageRecord.Avatar != nil && pageRecord.Avatar.Ref.Link != "" {
319
+
avatarCID = pageRecord.Avatar.Ref.Link
320
+
}
321
+
322
+
// Upsert to database
323
+
return db.UpsertRepoPage(p.db, did, pageRecord.Repository, pageRecord.Description, avatarCID, pageRecord.CreatedAt, pageRecord.UpdatedAt)
324
}
325
326
// ProcessIdentity handles identity change events (handle updates)
+1
pkg/appview/jetstream/processor_test.go
+1
pkg/appview/jetstream/processor_test.go
+39
-3
pkg/appview/jetstream/worker.go
+39
-3
pkg/appview/jetstream/worker.go
···
61
jetstreamURL: jetstreamURL,
62
startCursor: startCursor,
63
wantedCollections: []string{
64
-
atproto.ManifestCollection, // io.atcr.manifest
65
-
atproto.TagCollection, // io.atcr.tag
66
-
atproto.StarCollection, // io.atcr.sailor.star
67
},
68
processor: NewProcessor(database, true), // Use cache for live streaming
69
}
···
312
case atproto.StarCollection:
313
slog.Info("Jetstream processing star event", "did", commit.DID, "operation", commit.Operation, "rkey", commit.RKey)
314
return w.processStar(commit)
315
default:
316
// Ignore other collections
317
return nil
···
434
435
// Use shared processor for DB operations
436
return w.processor.ProcessStar(context.Background(), commit.DID, recordBytes)
437
}
438
439
// processIdentity processes an identity event (handle change)
···
61
jetstreamURL: jetstreamURL,
62
startCursor: startCursor,
63
wantedCollections: []string{
64
+
"io.atcr.*", // Subscribe to all ATCR collections
65
},
66
processor: NewProcessor(database, true), // Use cache for live streaming
67
}
···
310
case atproto.StarCollection:
311
slog.Info("Jetstream processing star event", "did", commit.DID, "operation", commit.Operation, "rkey", commit.RKey)
312
return w.processStar(commit)
313
+
case atproto.RepoPageCollection:
314
+
slog.Info("Jetstream processing repo page event", "did", commit.DID, "operation", commit.Operation, "rkey", commit.RKey)
315
+
return w.processRepoPage(commit)
316
default:
317
// Ignore other collections
318
return nil
···
435
436
// Use shared processor for DB operations
437
return w.processor.ProcessStar(context.Background(), commit.DID, recordBytes)
438
+
}
439
+
440
+
// processRepoPage processes a repo page commit event
441
+
func (w *Worker) processRepoPage(commit *CommitEvent) error {
442
+
// Resolve and upsert user with handle/PDS endpoint
443
+
if err := w.processor.EnsureUser(context.Background(), commit.DID); err != nil {
444
+
return fmt.Errorf("failed to ensure user: %w", err)
445
+
}
446
+
447
+
isDelete := commit.Operation == "delete"
448
+
449
+
if isDelete {
450
+
// Delete - rkey is the repository name
451
+
slog.Info("Jetstream deleting repo page", "did", commit.DID, "repository", commit.RKey)
452
+
if err := w.processor.ProcessRepoPage(context.Background(), commit.DID, commit.RKey, nil, true); err != nil {
453
+
slog.Error("Jetstream ERROR deleting repo page", "error", err)
454
+
return err
455
+
}
456
+
slog.Info("Jetstream successfully deleted repo page", "did", commit.DID, "repository", commit.RKey)
457
+
return nil
458
+
}
459
+
460
+
// Parse repo page record
461
+
if commit.Record == nil {
462
+
return nil
463
+
}
464
+
465
+
// Marshal map to bytes for processing
466
+
recordBytes, err := json.Marshal(commit.Record)
467
+
if err != nil {
468
+
return fmt.Errorf("failed to marshal record: %w", err)
469
+
}
470
+
471
+
// Use shared processor for DB operations
472
+
return w.processor.ProcessRepoPage(context.Background(), commit.DID, commit.RKey, recordBytes, false)
473
}
474
475
// processIdentity processes an identity event (handle change)
+59
-6
pkg/appview/middleware/auth.go
+59
-6
pkg/appview/middleware/auth.go
···
11
"net/url"
12
13
"atcr.io/pkg/appview/db"
14
)
15
16
type contextKey string
17
18
const userKey contextKey = "user"
19
20
// RequireAuth is middleware that requires authentication
21
func RequireAuth(store *db.SessionStore, database *sql.DB) func(http.Handler) http.Handler {
22
return func(next http.Handler) http.Handler {
23
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
24
sessionID, ok := getSessionID(r)
···
32
return
33
}
34
35
-
sess, ok := store.Get(sessionID)
36
if !ok {
37
// Build return URL with query parameters preserved
38
returnTo := r.URL.Path
···
44
}
45
46
// Look up full user from database to get avatar
47
-
user, err := db.GetUserByDID(database, sess.DID)
48
if err != nil || user == nil {
49
// Fallback to session data if DB lookup fails
50
user = &db.User{
···
54
}
55
}
56
57
-
ctx := context.WithValue(r.Context(), userKey, user)
58
next.ServeHTTP(w, r.WithContext(ctx))
59
})
60
}
···
62
63
// OptionalAuth is middleware that optionally includes user if authenticated
64
func OptionalAuth(store *db.SessionStore, database *sql.DB) func(http.Handler) http.Handler {
65
return func(next http.Handler) http.Handler {
66
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
67
sessionID, ok := getSessionID(r)
68
if ok {
69
-
if sess, ok := store.Get(sessionID); ok {
70
// Look up full user from database to get avatar
71
-
user, err := db.GetUserByDID(database, sess.DID)
72
if err != nil || user == nil {
73
// Fallback to session data if DB lookup fails
74
user = &db.User{
···
77
PDSEndpoint: sess.PDSEndpoint,
78
}
79
}
80
-
ctx := context.WithValue(r.Context(), userKey, user)
81
r = r.WithContext(ctx)
82
}
83
}
···
11
"net/url"
12
13
"atcr.io/pkg/appview/db"
14
+
"atcr.io/pkg/auth"
15
+
"atcr.io/pkg/auth/oauth"
16
)
17
18
type contextKey string
19
20
const userKey contextKey = "user"
21
22
+
// WebAuthDeps contains dependencies for web auth middleware
23
+
type WebAuthDeps struct {
24
+
SessionStore *db.SessionStore
25
+
Database *sql.DB
26
+
Refresher *oauth.Refresher
27
+
DefaultHoldDID string
28
+
}
29
+
30
// RequireAuth is middleware that requires authentication
31
func RequireAuth(store *db.SessionStore, database *sql.DB) func(http.Handler) http.Handler {
32
+
return RequireAuthWithDeps(WebAuthDeps{
33
+
SessionStore: store,
34
+
Database: database,
35
+
})
36
+
}
37
+
38
+
// RequireAuthWithDeps is middleware that requires authentication and creates UserContext
39
+
func RequireAuthWithDeps(deps WebAuthDeps) func(http.Handler) http.Handler {
40
return func(next http.Handler) http.Handler {
41
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
42
sessionID, ok := getSessionID(r)
···
50
return
51
}
52
53
+
sess, ok := deps.SessionStore.Get(sessionID)
54
if !ok {
55
// Build return URL with query parameters preserved
56
returnTo := r.URL.Path
···
62
}
63
64
// Look up full user from database to get avatar
65
+
user, err := db.GetUserByDID(deps.Database, sess.DID)
66
if err != nil || user == nil {
67
// Fallback to session data if DB lookup fails
68
user = &db.User{
···
72
}
73
}
74
75
+
ctx := r.Context()
76
+
ctx = context.WithValue(ctx, userKey, user)
77
+
78
+
// Create UserContext for authenticated users (enables EnsureUserSetup)
79
+
if deps.Refresher != nil {
80
+
userCtx := auth.NewUserContext(sess.DID, auth.AuthMethodOAuth, r.Method, &auth.Dependencies{
81
+
Refresher: deps.Refresher,
82
+
DefaultHoldDID: deps.DefaultHoldDID,
83
+
})
84
+
userCtx.SetPDS(sess.Handle, sess.PDSEndpoint)
85
+
userCtx.EnsureUserSetup()
86
+
ctx = auth.WithUserContext(ctx, userCtx)
87
+
}
88
+
89
next.ServeHTTP(w, r.WithContext(ctx))
90
})
91
}
···
93
94
// OptionalAuth is middleware that optionally includes user if authenticated
95
func OptionalAuth(store *db.SessionStore, database *sql.DB) func(http.Handler) http.Handler {
96
+
return OptionalAuthWithDeps(WebAuthDeps{
97
+
SessionStore: store,
98
+
Database: database,
99
+
})
100
+
}
101
+
102
+
// OptionalAuthWithDeps is middleware that optionally includes user and UserContext if authenticated
103
+
func OptionalAuthWithDeps(deps WebAuthDeps) func(http.Handler) http.Handler {
104
return func(next http.Handler) http.Handler {
105
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
106
sessionID, ok := getSessionID(r)
107
if ok {
108
+
if sess, ok := deps.SessionStore.Get(sessionID); ok {
109
// Look up full user from database to get avatar
110
+
user, err := db.GetUserByDID(deps.Database, sess.DID)
111
if err != nil || user == nil {
112
// Fallback to session data if DB lookup fails
113
user = &db.User{
···
116
PDSEndpoint: sess.PDSEndpoint,
117
}
118
}
119
+
120
+
ctx := r.Context()
121
+
ctx = context.WithValue(ctx, userKey, user)
122
+
123
+
// Create UserContext for authenticated users (enables EnsureUserSetup)
124
+
if deps.Refresher != nil {
125
+
userCtx := auth.NewUserContext(sess.DID, auth.AuthMethodOAuth, r.Method, &auth.Dependencies{
126
+
Refresher: deps.Refresher,
127
+
DefaultHoldDID: deps.DefaultHoldDID,
128
+
})
129
+
userCtx.SetPDS(sess.Handle, sess.PDSEndpoint)
130
+
userCtx.EnsureUserSetup()
131
+
ctx = auth.WithUserContext(ctx, userCtx)
132
+
}
133
+
134
r = r.WithContext(ctx)
135
}
136
}
+129
-124
pkg/appview/middleware/registry.go
+129
-124
pkg/appview/middleware/registry.go
···
2
3
import (
4
"context"
5
-
"encoding/json"
6
"fmt"
7
"log/slog"
8
"strings"
9
10
"github.com/distribution/distribution/v3"
11
-
"github.com/distribution/distribution/v3/registry/api/errcode"
12
registrymw "github.com/distribution/distribution/v3/registry/middleware/registry"
13
"github.com/distribution/distribution/v3/registry/storage/driver"
14
"github.com/distribution/reference"
···
23
// holdDIDKey is the context key for storing hold DID
24
const holdDIDKey contextKey = "hold.did"
25
26
// Global variables for initialization only
27
// These are set by main.go during startup and copied into NamespaceResolver instances.
28
// After initialization, request handling uses the NamespaceResolver's instance fields.
29
var (
30
-
globalRefresher *oauth.Refresher
31
-
globalDatabase storage.DatabaseMetrics
32
-
globalAuthorizer auth.HoldAuthorizer
33
-
globalReadmeCache storage.ReadmeCache
34
)
35
36
// SetGlobalRefresher sets the OAuth refresher instance during initialization
···
41
42
// SetGlobalDatabase sets the database instance during initialization
43
// Must be called before the registry starts serving requests
44
-
func SetGlobalDatabase(database storage.DatabaseMetrics) {
45
globalDatabase = database
46
}
47
···
51
globalAuthorizer = authorizer
52
}
53
54
-
// SetGlobalReadmeCache sets the readme cache instance during initialization
55
-
// Must be called before the registry starts serving requests
56
-
func SetGlobalReadmeCache(readmeCache storage.ReadmeCache) {
57
-
globalReadmeCache = readmeCache
58
-
}
59
-
60
func init() {
61
// Register the name resolution middleware
62
registrymw.Register("atproto-resolver", initATProtoResolver)
···
65
// NamespaceResolver wraps a namespace and resolves names
66
type NamespaceResolver struct {
67
distribution.Namespace
68
-
defaultHoldDID string // Default hold DID (e.g., "did:web:hold01.atcr.io")
69
-
baseURL string // Base URL for error messages (e.g., "https://atcr.io")
70
-
testMode bool // If true, fallback to default hold when user's hold is unreachable
71
-
refresher *oauth.Refresher // OAuth session manager (copied from global on init)
72
-
database storage.DatabaseMetrics // Metrics database (copied from global on init)
73
-
authorizer auth.HoldAuthorizer // Hold authorization (copied from global on init)
74
-
readmeCache storage.ReadmeCache // README cache (copied from global on init)
75
}
76
77
// initATProtoResolver initializes the name resolution middleware
···
103
baseURL: baseURL,
104
testMode: testMode,
105
refresher: globalRefresher,
106
-
database: globalDatabase,
107
authorizer: globalAuthorizer,
108
-
readmeCache: globalReadmeCache,
109
}, nil
110
-
}
111
-
112
-
// authErrorMessage creates a user-friendly auth error with login URL
113
-
func (nr *NamespaceResolver) authErrorMessage(message string) error {
114
-
loginURL := fmt.Sprintf("%s/auth/oauth/login", nr.baseURL)
115
-
fullMessage := fmt.Sprintf("%s - please re-authenticate at %s", message, loginURL)
116
-
return errcode.ErrorCodeUnauthorized.WithMessage(fullMessage)
117
}
118
119
// Repository resolves the repository name and delegates to underlying namespace
···
149
}
150
ctx = context.WithValue(ctx, holdDIDKey, holdDID)
151
152
-
// Auto-reconcile crew membership on first push/pull
153
-
// This ensures users can push immediately after docker login without web sign-in
154
-
// EnsureCrewMembership is best-effort and logs errors without failing the request
155
-
// Run in background to avoid blocking registry operations if hold is offline
156
-
if holdDID != "" && nr.refresher != nil {
157
-
slog.Debug("Auto-reconciling crew membership", "component", "registry/middleware", "did", did, "hold_did", holdDID)
158
-
client := atproto.NewClient(pdsEndpoint, did, "")
159
-
go func(ctx context.Context, client *atproto.Client, refresher *oauth.Refresher, holdDID string) {
160
-
storage.EnsureCrewMembership(ctx, client, refresher, holdDID)
161
-
}(ctx, client, nr.refresher, holdDID)
162
-
}
163
-
164
-
// Get service token for hold authentication
165
-
var serviceToken string
166
-
if nr.refresher != nil {
167
-
var err error
168
-
serviceToken, err = token.GetOrFetchServiceToken(ctx, nr.refresher, did, holdDID, pdsEndpoint)
169
-
if err != nil {
170
-
slog.Error("Failed to get service token", "component", "registry/middleware", "did", did, "error", err)
171
-
slog.Error("User needs to re-authenticate via credential helper", "component", "registry/middleware")
172
-
return nil, nr.authErrorMessage("OAuth session expired")
173
-
}
174
-
}
175
176
// Create a new reference with identity/image format
177
// Use the identity (or DID) as the namespace to ensure canonical format
···
188
return nil, err
189
}
190
191
-
// Get access token for PDS operations
192
-
// Try OAuth refresher first (for users who authorized via AppView OAuth)
193
-
// Fall back to Basic Auth token cache (for users who used app passwords)
194
-
var atprotoClient *atproto.Client
195
-
196
-
if nr.refresher != nil {
197
-
// Try OAuth flow first
198
-
session, err := nr.refresher.GetSession(ctx, did)
199
-
if err == nil {
200
-
// OAuth session available - use indigo's API client (handles DPoP automatically)
201
-
apiClient := session.APIClient()
202
-
atprotoClient = atproto.NewClientWithIndigoClient(pdsEndpoint, did, apiClient)
203
-
} else {
204
-
slog.Debug("OAuth refresh failed, falling back to Basic Auth", "component", "registry/middleware", "did", did, "error", err)
205
-
}
206
-
}
207
-
208
-
// Fall back to Basic Auth token cache if OAuth not available
209
-
if atprotoClient == nil {
210
-
accessToken, ok := auth.GetGlobalTokenCache().Get(did)
211
-
if !ok {
212
-
slog.Debug("No cached access token found (neither OAuth nor Basic Auth)", "component", "registry/middleware", "did", did)
213
-
accessToken = "" // Will fail on manifest push, but let it try
214
-
} else {
215
-
slog.Debug("Using Basic Auth access token", "component", "registry/middleware", "did", did, "token_length", len(accessToken))
216
-
}
217
-
atprotoClient = atproto.NewClient(pdsEndpoint, did, accessToken)
218
-
}
219
-
220
// IMPORTANT: Use only the image name (not identity/image) for ATProto storage
221
// ATProto records are scoped to the user's DID, so we don't need the identity prefix
222
// Example: "evan.jarrett.net/debian" -> store as "debian"
223
repositoryName := imageName
224
225
// Create routing repository - routes manifests to ATProto, blobs to hold service
226
// The registry is stateless - no local storage is used
227
-
// Bundle all context into a single RegistryContext struct
228
//
229
// NOTE: We create a fresh RoutingRepository on every request (no caching) because:
230
// 1. Each layer upload is a separate HTTP request (possibly different process)
231
// 2. OAuth sessions can be refreshed/invalidated between requests
232
// 3. The refresher already caches sessions efficiently (in-memory + DB)
233
-
// 4. Caching the repository with a stale ATProtoClient causes refresh token errors
234
-
registryCtx := &storage.RegistryContext{
235
-
DID: did,
236
-
Handle: handle,
237
-
HoldDID: holdDID,
238
-
PDSEndpoint: pdsEndpoint,
239
-
Repository: repositoryName,
240
-
ServiceToken: serviceToken, // Cached service token from middleware validation
241
-
ATProtoClient: atprotoClient,
242
-
Database: nr.database,
243
-
Authorizer: nr.authorizer,
244
-
Refresher: nr.refresher,
245
-
ReadmeCache: nr.readmeCache,
246
-
}
247
-
248
-
return storage.NewRoutingRepository(repo, registryCtx), nil
249
}
250
251
// Repositories delegates to underlying namespace
···
266
// findHoldDID determines which hold DID to use for blob storage
267
// Priority order:
268
// 1. User's sailor profile defaultHold (if set)
269
-
// 2. User's own hold record (io.atcr.hold)
270
-
// 3. AppView's default hold DID
271
// Returns a hold DID (e.g., "did:web:hold01.atcr.io"), or empty string if none configured
272
func (nr *NamespaceResolver) findHoldDID(ctx context.Context, did, pdsEndpoint string) string {
273
// Create ATProto client (without auth - reading public records)
···
281
}
282
283
if profile != nil && profile.DefaultHold != "" {
284
-
// Profile exists with defaultHold set
285
-
// In test mode, verify it's reachable before using it
286
if nr.testMode {
287
if nr.isHoldReachable(ctx, profile.DefaultHold) {
288
return profile.DefaultHold
···
293
return profile.DefaultHold
294
}
295
296
-
// Profile doesn't exist or defaultHold is null/empty
297
-
// Check for user's own hold records
298
-
records, err := client.ListRecords(ctx, atproto.HoldCollection, 10)
299
-
if err != nil {
300
-
// Failed to query holds, use default
301
-
return nr.defaultHoldDID
302
-
}
303
-
304
-
// Find the first hold record
305
-
for _, record := range records {
306
-
var holdRecord atproto.HoldRecord
307
-
if err := json.Unmarshal(record.Value, &holdRecord); err != nil {
308
-
continue
309
-
}
310
-
311
-
// Return the endpoint from the first hold (normalize to DID if URL)
312
-
if holdRecord.Endpoint != "" {
313
-
return atproto.ResolveHoldDIDFromURL(holdRecord.Endpoint)
314
-
}
315
-
}
316
-
317
-
// No profile defaultHold and no own hold records - use AppView default
318
return nr.defaultHoldDID
319
}
320
···
336
337
return false
338
}
···
2
3
import (
4
"context"
5
+
"database/sql"
6
"fmt"
7
"log/slog"
8
+
"net/http"
9
"strings"
10
11
"github.com/distribution/distribution/v3"
12
registrymw "github.com/distribution/distribution/v3/registry/middleware/registry"
13
"github.com/distribution/distribution/v3/registry/storage/driver"
14
"github.com/distribution/reference"
···
23
// holdDIDKey is the context key for storing hold DID
24
const holdDIDKey contextKey = "hold.did"
25
26
+
// authMethodKey is the context key for storing auth method from JWT
27
+
const authMethodKey contextKey = "auth.method"
28
+
29
+
// pullerDIDKey is the context key for storing the authenticated user's DID from JWT
30
+
const pullerDIDKey contextKey = "puller.did"
31
+
32
// Global variables for initialization only
33
// These are set by main.go during startup and copied into NamespaceResolver instances.
34
// After initialization, request handling uses the NamespaceResolver's instance fields.
35
var (
36
+
globalRefresher *oauth.Refresher
37
+
globalDatabase *sql.DB
38
+
globalAuthorizer auth.HoldAuthorizer
39
)
40
41
// SetGlobalRefresher sets the OAuth refresher instance during initialization
···
46
47
// SetGlobalDatabase sets the database instance during initialization
48
// Must be called before the registry starts serving requests
49
+
func SetGlobalDatabase(database *sql.DB) {
50
globalDatabase = database
51
}
52
···
56
globalAuthorizer = authorizer
57
}
58
59
func init() {
60
// Register the name resolution middleware
61
registrymw.Register("atproto-resolver", initATProtoResolver)
···
64
// NamespaceResolver wraps a namespace and resolves names
65
type NamespaceResolver struct {
66
distribution.Namespace
67
+
defaultHoldDID string // Default hold DID (e.g., "did:web:hold01.atcr.io")
68
+
baseURL string // Base URL for error messages (e.g., "https://atcr.io")
69
+
testMode bool // If true, fallback to default hold when user's hold is unreachable
70
+
refresher *oauth.Refresher // OAuth session manager (copied from global on init)
71
+
sqlDB *sql.DB // Database for hold DID lookup and metrics (copied from global on init)
72
+
authorizer auth.HoldAuthorizer // Hold authorization (copied from global on init)
73
}
74
75
// initATProtoResolver initializes the name resolution middleware
···
101
baseURL: baseURL,
102
testMode: testMode,
103
refresher: globalRefresher,
104
+
sqlDB: globalDatabase,
105
authorizer: globalAuthorizer,
106
}, nil
107
}
108
109
// Repository resolves the repository name and delegates to underlying namespace
···
139
}
140
ctx = context.WithValue(ctx, holdDIDKey, holdDID)
141
142
+
// Note: Profile and crew membership are now ensured in UserContextMiddleware
143
+
// via EnsureUserSetup() - no need to call here
144
145
// Create a new reference with identity/image format
146
// Use the identity (or DID) as the namespace to ensure canonical format
···
157
return nil, err
158
}
159
160
// IMPORTANT: Use only the image name (not identity/image) for ATProto storage
161
// ATProto records are scoped to the user's DID, so we don't need the identity prefix
162
// Example: "evan.jarrett.net/debian" -> store as "debian"
163
repositoryName := imageName
164
+
165
+
// Get UserContext from request context (set by UserContextMiddleware)
166
+
userCtx := auth.FromContext(ctx)
167
+
if userCtx == nil {
168
+
return nil, fmt.Errorf("UserContext not set in request context - ensure UserContextMiddleware is configured")
169
+
}
170
+
171
+
// Set target repository info on UserContext
172
+
// ATProtoClient is cached lazily via userCtx.GetATProtoClient()
173
+
userCtx.SetTarget(did, handle, pdsEndpoint, repositoryName, holdDID)
174
175
// Create routing repository - routes manifests to ATProto, blobs to hold service
176
// The registry is stateless - no local storage is used
177
//
178
// NOTE: We create a fresh RoutingRepository on every request (no caching) because:
179
// 1. Each layer upload is a separate HTTP request (possibly different process)
180
// 2. OAuth sessions can be refreshed/invalidated between requests
181
// 3. The refresher already caches sessions efficiently (in-memory + DB)
182
+
// 4. ATProtoClient is now cached in UserContext via GetATProtoClient()
183
+
return storage.NewRoutingRepository(repo, userCtx, nr.sqlDB), nil
184
}
185
186
// Repositories delegates to underlying namespace
···
201
// findHoldDID determines which hold DID to use for blob storage
202
// Priority order:
203
// 1. User's sailor profile defaultHold (if set)
204
+
// 2. AppView's default hold DID
205
// Returns a hold DID (e.g., "did:web:hold01.atcr.io"), or empty string if none configured
206
func (nr *NamespaceResolver) findHoldDID(ctx context.Context, did, pdsEndpoint string) string {
207
// Create ATProto client (without auth - reading public records)
···
215
}
216
217
if profile != nil && profile.DefaultHold != "" {
218
+
// In test mode, verify the hold is reachable (fall back to default if not)
219
+
// In production, trust the user's profile and return their hold
220
if nr.testMode {
221
if nr.isHoldReachable(ctx, profile.DefaultHold) {
222
return profile.DefaultHold
···
227
return profile.DefaultHold
228
}
229
230
+
// No profile defaultHold - use AppView default
231
return nr.defaultHoldDID
232
}
233
···
249
250
return false
251
}
252
+
253
+
// ExtractAuthMethod is an HTTP middleware that extracts the auth method and puller DID from the JWT Authorization header
254
+
// and stores them in the request context for later use by the registry middleware.
255
+
// Also stores the HTTP method for routing decisions (GET/HEAD = pull, PUT/POST = push).
256
+
func ExtractAuthMethod(next http.Handler) http.Handler {
257
+
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
258
+
ctx := r.Context()
259
+
260
+
// Store HTTP method in context for routing decisions
261
+
// This is used by routing_repository.go to distinguish pull (GET/HEAD) from push (PUT/POST)
262
+
ctx = context.WithValue(ctx, "http.request.method", r.Method)
263
+
264
+
// Extract Authorization header
265
+
authHeader := r.Header.Get("Authorization")
266
+
if authHeader != "" {
267
+
// Parse "Bearer <token>" format
268
+
parts := strings.SplitN(authHeader, " ", 2)
269
+
if len(parts) == 2 && strings.ToLower(parts[0]) == "bearer" {
270
+
tokenString := parts[1]
271
+
272
+
// Extract auth method from JWT (does not validate - just parses)
273
+
authMethod := token.ExtractAuthMethod(tokenString)
274
+
if authMethod != "" {
275
+
// Store in context for registry middleware
276
+
ctx = context.WithValue(ctx, authMethodKey, authMethod)
277
+
}
278
+
279
+
// Extract puller DID (Subject) from JWT
280
+
// This is the authenticated user's DID, used for service token requests
281
+
pullerDID := token.ExtractSubject(tokenString)
282
+
if pullerDID != "" {
283
+
ctx = context.WithValue(ctx, pullerDIDKey, pullerDID)
284
+
}
285
+
286
+
slog.Debug("Extracted auth info from JWT",
287
+
"component", "registry/middleware",
288
+
"authMethod", authMethod,
289
+
"pullerDID", pullerDID,
290
+
"httpMethod", r.Method)
291
+
}
292
+
}
293
+
294
+
r = r.WithContext(ctx)
295
+
next.ServeHTTP(w, r)
296
+
})
297
+
}
298
+
299
+
// UserContextMiddleware creates a UserContext from the extracted JWT claims
300
+
// and stores it in the request context for use throughout request processing.
301
+
// This middleware should be chained AFTER ExtractAuthMethod.
302
+
func UserContextMiddleware(deps *auth.Dependencies) func(http.Handler) http.Handler {
303
+
return func(next http.Handler) http.Handler {
304
+
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
305
+
ctx := r.Context()
306
+
307
+
// Get values set by ExtractAuthMethod
308
+
authMethod, _ := ctx.Value(authMethodKey).(string)
309
+
pullerDID, _ := ctx.Value(pullerDIDKey).(string)
310
+
311
+
// Build UserContext with all dependencies
312
+
userCtx := auth.NewUserContext(pullerDID, authMethod, r.Method, deps)
313
+
314
+
// Eagerly resolve user's PDS for authenticated users
315
+
// This is a fast path that avoids lazy loading in most cases
316
+
if userCtx.IsAuthenticated {
317
+
if err := userCtx.ResolvePDS(ctx); err != nil {
318
+
slog.Warn("Failed to resolve puller's PDS",
319
+
"component", "registry/middleware",
320
+
"did", pullerDID,
321
+
"error", err)
322
+
// Continue without PDS - will fail on service token request
323
+
}
324
+
325
+
// Ensure user has profile and crew membership (runs in background, cached)
326
+
userCtx.EnsureUserSetup()
327
+
}
328
+
329
+
// Store UserContext in request context
330
+
ctx = auth.WithUserContext(ctx, userCtx)
331
+
r = r.WithContext(ctx)
332
+
333
+
slog.Debug("Created UserContext",
334
+
"component", "registry/middleware",
335
+
"isAuthenticated", userCtx.IsAuthenticated,
336
+
"authMethod", userCtx.AuthMethod,
337
+
"action", userCtx.Action.String(),
338
+
"pullerDID", pullerDID)
339
+
340
+
next.ServeHTTP(w, r)
341
+
})
342
+
}
343
+
}
-70
pkg/appview/middleware/registry_test.go
-70
pkg/appview/middleware/registry_test.go
···
67
// If we get here without panic, test passes
68
}
69
70
-
func TestSetGlobalReadmeCache(t *testing.T) {
71
-
SetGlobalReadmeCache(nil)
72
-
// If we get here without panic, test passes
73
-
}
74
-
75
// TestInitATProtoResolver tests the initialization function
76
func TestInitATProtoResolver(t *testing.T) {
77
ctx := context.Background()
···
134
}
135
}
136
137
-
// TestAuthErrorMessage tests the error message formatting
138
-
func TestAuthErrorMessage(t *testing.T) {
139
-
resolver := &NamespaceResolver{
140
-
baseURL: "https://atcr.io",
141
-
}
142
-
143
-
err := resolver.authErrorMessage("OAuth session expired")
144
-
assert.Contains(t, err.Error(), "OAuth session expired")
145
-
assert.Contains(t, err.Error(), "https://atcr.io/auth/oauth/login")
146
-
}
147
-
148
// TestFindHoldDID_DefaultFallback tests default hold DID fallback
149
func TestFindHoldDID_DefaultFallback(t *testing.T) {
150
// Start a mock PDS server that returns 404 for profile and empty list for holds
···
204
assert.Equal(t, "did:web:user.hold.io", holdDID, "should use sailor profile's defaultHold")
205
}
206
207
-
// TestFindHoldDID_LegacyHoldRecords tests legacy hold record discovery
208
-
func TestFindHoldDID_LegacyHoldRecords(t *testing.T) {
209
-
// Start a mock PDS server that returns hold records
210
-
mockPDS := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
211
-
if r.URL.Path == "/xrpc/com.atproto.repo.getRecord" {
212
-
// Profile not found
213
-
w.WriteHeader(http.StatusNotFound)
214
-
return
215
-
}
216
-
if r.URL.Path == "/xrpc/com.atproto.repo.listRecords" {
217
-
// Return hold record
218
-
holdRecord := atproto.NewHoldRecord("https://legacy.hold.io", "alice", true)
219
-
recordJSON, _ := json.Marshal(holdRecord)
220
-
w.Header().Set("Content-Type", "application/json")
221
-
json.NewEncoder(w).Encode(map[string]any{
222
-
"records": []any{
223
-
map[string]any{
224
-
"uri": "at://did:plc:test123/io.atcr.hold/abc123",
225
-
"value": json.RawMessage(recordJSON),
226
-
},
227
-
},
228
-
})
229
-
return
230
-
}
231
-
w.WriteHeader(http.StatusNotFound)
232
-
}))
233
-
defer mockPDS.Close()
234
-
235
-
resolver := &NamespaceResolver{
236
-
defaultHoldDID: "did:web:default.atcr.io",
237
-
}
238
-
239
-
ctx := context.Background()
240
-
holdDID := resolver.findHoldDID(ctx, "did:plc:test123", mockPDS.URL)
241
-
242
-
// Legacy URL should be converted to DID
243
-
assert.Equal(t, "did:web:legacy.hold.io", holdDID, "should use legacy hold record and convert to DID")
244
-
}
245
-
246
// TestFindHoldDID_Priority tests the priority order
247
func TestFindHoldDID_Priority(t *testing.T) {
248
// Start a mock PDS server that returns both profile and hold records
···
253
w.Header().Set("Content-Type", "application/json")
254
json.NewEncoder(w).Encode(map[string]any{
255
"value": profile,
256
-
})
257
-
return
258
-
}
259
-
if r.URL.Path == "/xrpc/com.atproto.repo.listRecords" {
260
-
// Return hold record (should be ignored since profile exists)
261
-
holdRecord := atproto.NewHoldRecord("https://legacy.hold.io", "alice", true)
262
-
recordJSON, _ := json.Marshal(holdRecord)
263
-
w.Header().Set("Content-Type", "application/json")
264
-
json.NewEncoder(w).Encode(map[string]any{
265
-
"records": []any{
266
-
map[string]any{
267
-
"uri": "at://did:plc:test123/io.atcr.hold/abc123",
268
-
"value": json.RawMessage(recordJSON),
269
-
},
270
-
},
271
})
272
return
273
}
···
67
// If we get here without panic, test passes
68
}
69
70
// TestInitATProtoResolver tests the initialization function
71
func TestInitATProtoResolver(t *testing.T) {
72
ctx := context.Background()
···
129
}
130
}
131
132
// TestFindHoldDID_DefaultFallback tests default hold DID fallback
133
func TestFindHoldDID_DefaultFallback(t *testing.T) {
134
// Start a mock PDS server that returns 404 for profile and empty list for holds
···
188
assert.Equal(t, "did:web:user.hold.io", holdDID, "should use sailor profile's defaultHold")
189
}
190
191
// TestFindHoldDID_Priority tests the priority order
192
func TestFindHoldDID_Priority(t *testing.T) {
193
// Start a mock PDS server that returns both profile and hold records
···
198
w.Header().Set("Content-Type", "application/json")
199
json.NewEncoder(w).Encode(map[string]any{
200
"value": profile,
201
})
202
return
203
}
+413
pkg/appview/ogcard/card.go
+413
pkg/appview/ogcard/card.go
···
···
1
+
// Package ogcard provides OpenGraph card image generation for ATCR.
2
+
package ogcard
3
+
4
+
import (
5
+
"image"
6
+
"image/color"
7
+
"image/draw"
8
+
_ "image/gif" // Register GIF decoder for image.Decode
9
+
_ "image/jpeg" // Register JPEG decoder for image.Decode
10
+
"image/png"
11
+
"io"
12
+
"net/http"
13
+
"time"
14
+
15
+
"github.com/goki/freetype"
16
+
"github.com/goki/freetype/truetype"
17
+
xdraw "golang.org/x/image/draw"
18
+
"golang.org/x/image/font"
19
+
_ "golang.org/x/image/webp" // Register WEBP decoder for image.Decode
20
+
)
21
+
22
+
// Text alignment constants
23
+
const (
24
+
AlignLeft = iota
25
+
AlignCenter
26
+
AlignRight
27
+
)
28
+
29
+
// Layout constants for OG cards
30
+
const (
31
+
// Card dimensions
32
+
CardWidth = 1200
33
+
CardHeight = 630
34
+
35
+
// Padding and sizing
36
+
Padding = 60
37
+
AvatarSize = 180
38
+
39
+
// Positioning offsets
40
+
IconTopOffset = 50 // Y offset from padding for icon
41
+
TextGapAfterIcon = 40 // X gap between icon and text
42
+
TextTopOffset = 50 // Y offset from icon top for text baseline
43
+
44
+
// Font sizes
45
+
FontTitle = 48.0
46
+
FontDescription = 32.0
47
+
FontStats = 40.0 // Larger for visibility when scaled down
48
+
FontBadge = 32.0 // Larger for visibility when scaled down
49
+
FontBranding = 28.0
50
+
51
+
// Spacing
52
+
LineSpacingLarge = 65 // Gap after title
53
+
LineSpacingSmall = 60 // Gap between description lines
54
+
StatsIconGap = 48 // Gap between stat icon and text
55
+
StatsItemGap = 60 // Gap between stat items
56
+
BadgeGap = 20 // Gap between badges
57
+
)
58
+
59
+
// Layout holds computed positions for a standard OG card layout
60
+
type Layout struct {
61
+
IconX int
62
+
IconY int
63
+
TextX float64
64
+
TextY float64
65
+
StatsY int
66
+
MaxWidth int // For text wrapping
67
+
}
68
+
69
+
// StandardLayout returns the standard OG card layout with computed positions
70
+
func StandardLayout() Layout {
71
+
iconX := Padding
72
+
iconY := Padding + IconTopOffset
73
+
textX := float64(iconX + AvatarSize + TextGapAfterIcon)
74
+
textY := float64(iconY + TextTopOffset)
75
+
statsY := CardHeight - Padding - 10
76
+
maxWidth := CardWidth - int(textX) - Padding
77
+
78
+
return Layout{
79
+
IconX: iconX,
80
+
IconY: iconY,
81
+
TextX: textX,
82
+
TextY: textY,
83
+
StatsY: statsY,
84
+
MaxWidth: maxWidth,
85
+
}
86
+
}
87
+
88
+
// Card represents an OG image canvas
89
+
type Card struct {
90
+
img *image.RGBA
91
+
width int
92
+
height int
93
+
}
94
+
95
+
// NewCard creates a new OG card with the standard 1200x630 dimensions
96
+
func NewCard() *Card {
97
+
return NewCardWithSize(1200, 630)
98
+
}
99
+
100
+
// NewCardWithSize creates a new OG card with custom dimensions
101
+
func NewCardWithSize(width, height int) *Card {
102
+
img := image.NewRGBA(image.Rect(0, 0, width, height))
103
+
return &Card{
104
+
img: img,
105
+
width: width,
106
+
height: height,
107
+
}
108
+
}
109
+
110
+
// Fill fills the entire card with a solid color
111
+
func (c *Card) Fill(col color.Color) {
112
+
draw.Draw(c.img, c.img.Bounds(), &image.Uniform{col}, image.Point{}, draw.Src)
113
+
}
114
+
115
+
// DrawRect draws a filled rectangle
116
+
func (c *Card) DrawRect(x, y, w, h int, col color.Color) {
117
+
rect := image.Rect(x, y, x+w, y+h)
118
+
draw.Draw(c.img, rect, &image.Uniform{col}, image.Point{}, draw.Over)
119
+
}
120
+
121
+
// DrawText draws text at the specified position
122
+
func (c *Card) DrawText(text string, x, y float64, size float64, col color.Color, align int, bold bool) error {
123
+
f := regularFont
124
+
if bold {
125
+
f = boldFont
126
+
}
127
+
if f == nil {
128
+
return nil // No font loaded
129
+
}
130
+
131
+
ctx := freetype.NewContext()
132
+
ctx.SetDPI(72)
133
+
ctx.SetFont(f)
134
+
ctx.SetFontSize(size)
135
+
ctx.SetClip(c.img.Bounds())
136
+
ctx.SetDst(c.img)
137
+
ctx.SetSrc(image.NewUniform(col))
138
+
139
+
// Calculate text width for alignment
140
+
if align != AlignLeft {
141
+
opts := truetype.Options{Size: size, DPI: 72}
142
+
face := truetype.NewFace(f, &opts)
143
+
defer face.Close()
144
+
145
+
textWidth := font.MeasureString(face, text).Round()
146
+
if align == AlignCenter {
147
+
x -= float64(textWidth) / 2
148
+
} else if align == AlignRight {
149
+
x -= float64(textWidth)
150
+
}
151
+
}
152
+
153
+
pt := freetype.Pt(int(x), int(y))
154
+
_, err := ctx.DrawString(text, pt)
155
+
return err
156
+
}
157
+
158
+
// MeasureText returns the width of text in pixels
159
+
func (c *Card) MeasureText(text string, size float64, bold bool) int {
160
+
f := regularFont
161
+
if bold {
162
+
f = boldFont
163
+
}
164
+
if f == nil {
165
+
return 0
166
+
}
167
+
168
+
opts := truetype.Options{Size: size, DPI: 72}
169
+
face := truetype.NewFace(f, &opts)
170
+
defer face.Close()
171
+
172
+
return font.MeasureString(face, text).Round()
173
+
}
174
+
175
+
// DrawTextWrapped draws text with word wrapping within maxWidth
176
+
// Returns the Y position after the last line
177
+
func (c *Card) DrawTextWrapped(text string, x, y float64, size float64, col color.Color, maxWidth int, bold bool) float64 {
178
+
words := splitWords(text)
179
+
if len(words) == 0 {
180
+
return y
181
+
}
182
+
183
+
lineHeight := size * 1.3
184
+
currentLine := ""
185
+
currentY := y
186
+
187
+
for _, word := range words {
188
+
testLine := currentLine
189
+
if testLine != "" {
190
+
testLine += " "
191
+
}
192
+
testLine += word
193
+
194
+
lineWidth := c.MeasureText(testLine, size, bold)
195
+
if lineWidth > maxWidth && currentLine != "" {
196
+
// Draw current line and start new one
197
+
c.DrawText(currentLine, x, currentY, size, col, AlignLeft, bold)
198
+
currentY += lineHeight
199
+
currentLine = word
200
+
} else {
201
+
currentLine = testLine
202
+
}
203
+
}
204
+
205
+
// Draw remaining text
206
+
if currentLine != "" {
207
+
c.DrawText(currentLine, x, currentY, size, col, AlignLeft, bold)
208
+
currentY += lineHeight
209
+
}
210
+
211
+
return currentY
212
+
}
213
+
214
+
// splitWords splits text into words
215
+
func splitWords(text string) []string {
216
+
var words []string
217
+
current := ""
218
+
for _, r := range text {
219
+
if r == ' ' || r == '\t' || r == '\n' {
220
+
if current != "" {
221
+
words = append(words, current)
222
+
current = ""
223
+
}
224
+
} else {
225
+
current += string(r)
226
+
}
227
+
}
228
+
if current != "" {
229
+
words = append(words, current)
230
+
}
231
+
return words
232
+
}
233
+
234
+
// DrawImage draws an image at the specified position
235
+
func (c *Card) DrawImage(img image.Image, x, y int) {
236
+
bounds := img.Bounds()
237
+
rect := image.Rect(x, y, x+bounds.Dx(), y+bounds.Dy())
238
+
draw.Draw(c.img, rect, img, bounds.Min, draw.Over)
239
+
}
240
+
241
+
// DrawCircularImage draws an image cropped to a circle
242
+
func (c *Card) DrawCircularImage(img image.Image, x, y, diameter int) {
243
+
// Scale image to fit diameter
244
+
scaled := scaleImage(img, diameter, diameter)
245
+
246
+
// Create circular mask
247
+
mask := createCircleMask(diameter)
248
+
249
+
// Draw with mask
250
+
rect := image.Rect(x, y, x+diameter, y+diameter)
251
+
draw.DrawMask(c.img, rect, scaled, image.Point{}, mask, image.Point{}, draw.Over)
252
+
}
253
+
254
+
// FetchAndDrawCircularImage fetches an image from URL and draws it as a circle
255
+
func (c *Card) FetchAndDrawCircularImage(url string, x, y, diameter int) error {
256
+
client := &http.Client{Timeout: 5 * time.Second}
257
+
resp, err := client.Get(url)
258
+
if err != nil {
259
+
return err
260
+
}
261
+
defer resp.Body.Close()
262
+
263
+
img, _, err := image.Decode(resp.Body)
264
+
if err != nil {
265
+
return err
266
+
}
267
+
268
+
c.DrawCircularImage(img, x, y, diameter)
269
+
return nil
270
+
}
271
+
272
+
// DrawPlaceholderCircle draws a colored circle with a letter
273
+
func (c *Card) DrawPlaceholderCircle(x, y, diameter int, bgColor, textColor color.Color, letter string) {
274
+
// Draw filled circle
275
+
radius := diameter / 2
276
+
centerX := x + radius
277
+
centerY := y + radius
278
+
279
+
for dy := -radius; dy <= radius; dy++ {
280
+
for dx := -radius; dx <= radius; dx++ {
281
+
if dx*dx+dy*dy <= radius*radius {
282
+
c.img.Set(centerX+dx, centerY+dy, bgColor)
283
+
}
284
+
}
285
+
}
286
+
287
+
// Draw letter in center
288
+
fontSize := float64(diameter) * 0.5
289
+
c.DrawText(letter, float64(centerX), float64(centerY)+fontSize/3, fontSize, textColor, AlignCenter, true)
290
+
}
291
+
292
+
// DrawRoundedRect draws a filled rounded rectangle
293
+
func (c *Card) DrawRoundedRect(x, y, w, h, radius int, col color.Color) {
294
+
// Draw main rectangle (without corners)
295
+
for dy := radius; dy < h-radius; dy++ {
296
+
for dx := 0; dx < w; dx++ {
297
+
c.img.Set(x+dx, y+dy, col)
298
+
}
299
+
}
300
+
// Draw top and bottom strips (without corners)
301
+
for dy := 0; dy < radius; dy++ {
302
+
for dx := radius; dx < w-radius; dx++ {
303
+
c.img.Set(x+dx, y+dy, col)
304
+
c.img.Set(x+dx, y+h-1-dy, col)
305
+
}
306
+
}
307
+
// Draw rounded corners
308
+
for dy := 0; dy < radius; dy++ {
309
+
for dx := 0; dx < radius; dx++ {
310
+
// Check if point is within circle
311
+
cx := radius - dx - 1
312
+
cy := radius - dy - 1
313
+
if cx*cx+cy*cy <= radius*radius {
314
+
// Top-left
315
+
c.img.Set(x+dx, y+dy, col)
316
+
// Top-right
317
+
c.img.Set(x+w-1-dx, y+dy, col)
318
+
// Bottom-left
319
+
c.img.Set(x+dx, y+h-1-dy, col)
320
+
// Bottom-right
321
+
c.img.Set(x+w-1-dx, y+h-1-dy, col)
322
+
}
323
+
}
324
+
}
325
+
}
326
+
327
+
// DrawBadge draws a pill-shaped badge with text
328
+
func (c *Card) DrawBadge(text string, x, y int, fontSize float64, bgColor, textColor color.Color) int {
329
+
// Measure text width
330
+
textWidth := c.MeasureText(text, fontSize, false)
331
+
paddingX := 12
332
+
paddingY := 6
333
+
height := int(fontSize) + paddingY*2
334
+
width := textWidth + paddingX*2
335
+
radius := height / 2
336
+
337
+
// Draw rounded background
338
+
c.DrawRoundedRect(x, y, width, height, radius, bgColor)
339
+
340
+
// Draw text centered in badge
341
+
textX := float64(x + paddingX)
342
+
textY := float64(y + paddingY + int(fontSize) - 2)
343
+
c.DrawText(text, textX, textY, fontSize, textColor, AlignLeft, false)
344
+
345
+
return width
346
+
}
347
+
348
+
// EncodePNG encodes the card as PNG to the writer
349
+
func (c *Card) EncodePNG(w io.Writer) error {
350
+
return png.Encode(w, c.img)
351
+
}
352
+
353
+
// DrawAvatarOrPlaceholder draws a circular avatar from URL, falling back to placeholder
354
+
func (c *Card) DrawAvatarOrPlaceholder(url string, x, y, size int, letter string) {
355
+
if url != "" {
356
+
if err := c.FetchAndDrawCircularImage(url, x, y, size); err == nil {
357
+
return
358
+
}
359
+
}
360
+
c.DrawPlaceholderCircle(x, y, size, ColorAccent, ColorText, letter)
361
+
}
362
+
363
+
// DrawStatWithIcon draws an icon + text stat and returns the next X position
364
+
func (c *Card) DrawStatWithIcon(icon string, text string, x, y int, iconColor, textColor color.Color) int {
365
+
c.DrawIcon(icon, x, y-int(FontStats), int(FontStats), iconColor)
366
+
x += StatsIconGap
367
+
c.DrawText(text, float64(x), float64(y), FontStats, textColor, AlignLeft, false)
368
+
return x + c.MeasureText(text, FontStats, false) + StatsItemGap
369
+
}
370
+
371
+
// DrawBranding draws "ATCR" in the bottom-right corner
372
+
func (c *Card) DrawBranding() {
373
+
y := CardHeight - Padding - 10
374
+
c.DrawText("ATCR", float64(CardWidth-Padding), float64(y), FontBranding, ColorMuted, AlignRight, true)
375
+
}
376
+
377
+
// scaleImage scales an image to the target dimensions
378
+
func scaleImage(src image.Image, width, height int) image.Image {
379
+
dst := image.NewRGBA(image.Rect(0, 0, width, height))
380
+
xdraw.CatmullRom.Scale(dst, dst.Bounds(), src, src.Bounds(), xdraw.Over, nil)
381
+
return dst
382
+
}
383
+
384
+
// createCircleMask creates a circular alpha mask
385
+
func createCircleMask(diameter int) *image.Alpha {
386
+
mask := image.NewAlpha(image.Rect(0, 0, diameter, diameter))
387
+
radius := diameter / 2
388
+
centerX := radius
389
+
centerY := radius
390
+
391
+
for y := 0; y < diameter; y++ {
392
+
for x := 0; x < diameter; x++ {
393
+
dx := x - centerX
394
+
dy := y - centerY
395
+
if dx*dx+dy*dy <= radius*radius {
396
+
mask.SetAlpha(x, y, color.Alpha{A: 255})
397
+
}
398
+
}
399
+
}
400
+
401
+
return mask
402
+
}
403
+
404
+
// Common colors
405
+
var (
406
+
ColorBackground = color.RGBA{R: 22, G: 27, B: 34, A: 255} // #161b22 - GitHub dark elevated
407
+
ColorText = color.RGBA{R: 230, G: 237, B: 243, A: 255} // #e6edf3 - Light text
408
+
ColorMuted = color.RGBA{R: 125, G: 133, B: 144, A: 255} // #7d8590 - Muted text
409
+
ColorAccent = color.RGBA{R: 47, G: 129, B: 247, A: 255} // #2f81f7 - Blue accent
410
+
ColorStar = color.RGBA{R: 227, G: 179, B: 65, A: 255} // #e3b341 - Star yellow
411
+
ColorBadgeBg = color.RGBA{R: 33, G: 38, B: 45, A: 255} // #21262d - Badge background
412
+
ColorBadgeAccent = color.RGBA{R: 31, G: 111, B: 235, A: 255} // #1f6feb - Blue badge bg
413
+
)
+45
pkg/appview/ogcard/font.go
+45
pkg/appview/ogcard/font.go
···
···
1
+
package ogcard
2
+
3
+
// Font configuration for OG card rendering.
4
+
// Currently uses Go fonts (embedded in golang.org/x/image).
5
+
//
6
+
// To use custom fonts instead, replace the init() below with:
7
+
//
8
+
// //go:embed MyFont-Regular.ttf
9
+
// var regularFontData []byte
10
+
// //go:embed MyFont-Bold.ttf
11
+
// var boldFontData []byte
12
+
//
13
+
// func init() {
14
+
// regularFont, _ = truetype.Parse(regularFontData)
15
+
// boldFont, _ = truetype.Parse(boldFontData)
16
+
// }
17
+
18
+
import (
19
+
"log"
20
+
21
+
"github.com/goki/freetype/truetype"
22
+
"golang.org/x/image/font/gofont/gobold"
23
+
"golang.org/x/image/font/gofont/goregular"
24
+
)
25
+
26
+
var (
27
+
regularFont *truetype.Font
28
+
boldFont *truetype.Font
29
+
)
30
+
31
+
func init() {
32
+
var err error
33
+
34
+
regularFont, err = truetype.Parse(goregular.TTF)
35
+
if err != nil {
36
+
log.Printf("ogcard: failed to parse Go Regular font: %v", err)
37
+
return
38
+
}
39
+
40
+
boldFont, err = truetype.Parse(gobold.TTF)
41
+
if err != nil {
42
+
log.Printf("ogcard: failed to parse Go Bold font: %v", err)
43
+
return
44
+
}
45
+
}
+68
pkg/appview/ogcard/icons.go
+68
pkg/appview/ogcard/icons.go
···
···
1
+
package ogcard
2
+
3
+
import (
4
+
"bytes"
5
+
"fmt"
6
+
"image"
7
+
"image/color"
8
+
"image/draw"
9
+
"strings"
10
+
11
+
"github.com/srwiley/oksvg"
12
+
"github.com/srwiley/rasterx"
13
+
)
14
+
15
+
// Lucide icons as SVG paths (simplified from Lucide icon set)
16
+
// These are the path data for 24x24 viewBox icons
17
+
var iconPaths = map[string]string{
18
+
// Star icon - outline
19
+
"star": `<path d="M12 2l3.09 6.26L22 9.27l-5 4.87 1.18 6.88L12 17.77l-6.18 3.25L7 14.14 2 9.27l6.91-1.01L12 2z" stroke="currentColor" stroke-width="2" fill="none" stroke-linecap="round" stroke-linejoin="round"/>`,
20
+
21
+
// Star filled
22
+
"star-filled": `<path d="M12 2l3.09 6.26L22 9.27l-5 4.87 1.18 6.88L12 17.77l-6.18 3.25L7 14.14 2 9.27l6.91-1.01L12 2z" fill="currentColor"/>`,
23
+
24
+
// Arrow down to line (download/pull icon)
25
+
"arrow-down-to-line": `<path d="M12 17V3M12 17l-5-5M12 17l5-5M19 21H5" stroke="currentColor" stroke-width="2" fill="none" stroke-linecap="round" stroke-linejoin="round"/>`,
26
+
27
+
// Package icon
28
+
"package": `<path d="M16.5 9.4l-9-5.19M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z" stroke="currentColor" stroke-width="2" fill="none" stroke-linecap="round" stroke-linejoin="round"/><path d="M3.27 6.96L12 12.01l8.73-5.05M12 22.08V12" stroke="currentColor" stroke-width="2" fill="none" stroke-linecap="round" stroke-linejoin="round"/>`,
29
+
}
30
+
31
+
// DrawIcon draws a Lucide icon at the specified position with the given size and color
32
+
func (c *Card) DrawIcon(name string, x, y, size int, col color.Color) error {
33
+
path, ok := iconPaths[name]
34
+
if !ok {
35
+
return fmt.Errorf("unknown icon: %s", name)
36
+
}
37
+
38
+
// Build full SVG with color
39
+
r, g, b, _ := col.RGBA()
40
+
colorStr := fmt.Sprintf("rgb(%d,%d,%d)", r>>8, g>>8, b>>8)
41
+
path = strings.ReplaceAll(path, "currentColor", colorStr)
42
+
43
+
svg := fmt.Sprintf(`<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24">%s</svg>`, path)
44
+
45
+
// Parse SVG
46
+
icon, err := oksvg.ReadIconStream(bytes.NewReader([]byte(svg)))
47
+
if err != nil {
48
+
return fmt.Errorf("failed to parse icon SVG: %w", err)
49
+
}
50
+
51
+
// Create target image for the icon
52
+
iconImg := image.NewRGBA(image.Rect(0, 0, size, size))
53
+
54
+
// Set up scanner for rasterization
55
+
scanner := rasterx.NewScannerGV(size, size, iconImg, iconImg.Bounds())
56
+
raster := rasterx.NewDasher(size, size, scanner)
57
+
58
+
// Scale icon to target size
59
+
scale := float64(size) / 24.0
60
+
icon.SetTarget(0, 0, float64(size), float64(size))
61
+
icon.Draw(raster, scale)
62
+
63
+
// Draw icon onto card
64
+
rect := image.Rect(x, y, x+size, y+size)
65
+
draw.Draw(c.img, rect, iconImg, image.Point{}, draw.Over)
66
+
67
+
return nil
68
+
}
-111
pkg/appview/readme/cache.go
-111
pkg/appview/readme/cache.go
···
1
-
// Package readme provides README fetching, rendering, and caching functionality
2
-
// for container repositories. It fetches markdown content from URLs, renders it
3
-
// to sanitized HTML using GitHub-flavored markdown, and caches the results in
4
-
// a database with configurable TTL.
5
-
package readme
6
-
7
-
import (
8
-
"context"
9
-
"database/sql"
10
-
"log/slog"
11
-
"time"
12
-
)
13
-
14
-
// Cache stores rendered README HTML in the database
15
-
type Cache struct {
16
-
db *sql.DB
17
-
fetcher *Fetcher
18
-
ttl time.Duration
19
-
}
20
-
21
-
// NewCache creates a new README cache
22
-
func NewCache(db *sql.DB, ttl time.Duration) *Cache {
23
-
if ttl == 0 {
24
-
ttl = 1 * time.Hour // Default TTL
25
-
}
26
-
return &Cache{
27
-
db: db,
28
-
fetcher: NewFetcher(),
29
-
ttl: ttl,
30
-
}
31
-
}
32
-
33
-
// Get retrieves a README from cache or fetches it
34
-
func (c *Cache) Get(ctx context.Context, readmeURL string) (string, error) {
35
-
// Try to get from cache
36
-
html, fetchedAt, err := c.getFromDB(readmeURL)
37
-
if err == nil {
38
-
// Check if cache is still valid
39
-
if time.Since(fetchedAt) < c.ttl {
40
-
return html, nil
41
-
}
42
-
}
43
-
44
-
// Cache miss or expired, fetch fresh content
45
-
html, err = c.fetcher.FetchAndRender(ctx, readmeURL)
46
-
if err != nil {
47
-
// If fetch fails but we have stale cache, return it
48
-
if html != "" {
49
-
return html, nil
50
-
}
51
-
return "", err
52
-
}
53
-
54
-
// Store in cache
55
-
if err := c.storeInDB(readmeURL, html); err != nil {
56
-
// Log error but don't fail - we have the content
57
-
slog.Warn("Failed to cache README", "error", err)
58
-
}
59
-
60
-
return html, nil
61
-
}
62
-
63
-
// getFromDB retrieves cached README from database
64
-
func (c *Cache) getFromDB(readmeURL string) (string, time.Time, error) {
65
-
var html string
66
-
var fetchedAt time.Time
67
-
68
-
err := c.db.QueryRow(`
69
-
SELECT html, fetched_at
70
-
FROM readme_cache
71
-
WHERE url = ?
72
-
`, readmeURL).Scan(&html, &fetchedAt)
73
-
74
-
if err != nil {
75
-
return "", time.Time{}, err
76
-
}
77
-
78
-
return html, fetchedAt, nil
79
-
}
80
-
81
-
// storeInDB stores rendered README in database
82
-
func (c *Cache) storeInDB(readmeURL, html string) error {
83
-
_, err := c.db.Exec(`
84
-
INSERT INTO readme_cache (url, html, fetched_at)
85
-
VALUES (?, ?, ?)
86
-
ON CONFLICT(url) DO UPDATE SET
87
-
html = excluded.html,
88
-
fetched_at = excluded.fetched_at
89
-
`, readmeURL, html, time.Now())
90
-
91
-
return err
92
-
}
93
-
94
-
// Invalidate removes a README from the cache
95
-
func (c *Cache) Invalidate(readmeURL string) error {
96
-
_, err := c.db.Exec(`
97
-
DELETE FROM readme_cache
98
-
WHERE url = ?
99
-
`, readmeURL)
100
-
return err
101
-
}
102
-
103
-
// Cleanup removes expired entries from the cache
104
-
func (c *Cache) Cleanup() error {
105
-
cutoff := time.Now().Add(-c.ttl * 2) // Keep for 2x TTL
106
-
_, err := c.db.Exec(`
107
-
DELETE FROM readme_cache
108
-
WHERE fetched_at < ?
109
-
`, cutoff)
110
-
return err
111
-
}
···
-13
pkg/appview/readme/cache_test.go
-13
pkg/appview/readme/cache_test.go
+62
-9
pkg/appview/readme/fetcher.go
+62
-9
pkg/appview/readme/fetcher.go
···
7
"io"
8
"net/http"
9
"net/url"
10
"strings"
11
"time"
12
···
180
return fmt.Sprintf("%s://%s%s", u.Scheme, u.Host, path)
181
}
182
183
// rewriteRelativeURLs converts relative URLs to absolute URLs
184
func rewriteRelativeURLs(html, baseURL string) string {
185
if baseURL == "" {
···
191
return html
192
}
193
194
-
// Simple string replacement for common patterns
195
-
// This is a basic implementation - for production, consider using an HTML parser
196
-
html = strings.ReplaceAll(html, `src="./`, fmt.Sprintf(`src="%s`, baseURL))
197
-
html = strings.ReplaceAll(html, `href="./`, fmt.Sprintf(`href="%s`, baseURL))
198
-
html = strings.ReplaceAll(html, `src="../`, fmt.Sprintf(`src="%s../`, baseURL))
199
-
html = strings.ReplaceAll(html, `href="../`, fmt.Sprintf(`href="%s../`, baseURL))
200
-
201
-
// Handle root-relative URLs (starting with /)
202
if base.Scheme != "" && base.Host != "" {
203
root := fmt.Sprintf("%s://%s/", base.Scheme, base.Host)
204
-
// Replace src="/" and href="/" but not src="//" (absolute URLs)
205
html = strings.ReplaceAll(html, `src="/`, fmt.Sprintf(`src="%s`, root))
206
html = strings.ReplaceAll(html, `href="/`, fmt.Sprintf(`href="%s`, root))
207
}
208
209
return html
210
}
···
7
"io"
8
"net/http"
9
"net/url"
10
+
"regexp"
11
"strings"
12
"time"
13
···
181
return fmt.Sprintf("%s://%s%s", u.Scheme, u.Host, path)
182
}
183
184
+
// Is404 returns true if the error indicates a 404 Not Found response
185
+
func Is404(err error) bool {
186
+
return err != nil && strings.Contains(err.Error(), "unexpected status code: 404")
187
+
}
188
+
189
+
// RenderMarkdown renders a markdown string to sanitized HTML
190
+
// This is used for rendering repo page descriptions stored in the database
191
+
func (f *Fetcher) RenderMarkdown(content []byte) (string, error) {
192
+
// Render markdown to HTML (no base URL for repo page descriptions)
193
+
return f.renderMarkdown(content, "")
194
+
}
195
+
196
+
// Regex patterns for matching relative URLs that need rewriting
197
+
// These match src="..." or href="..." where the URL is relative (not absolute, not data:, not #anchor)
198
+
var (
199
+
// Match src="filename" where filename doesn't start with http://, https://, //, /, #, data:, or mailto:
200
+
relativeSrcPattern = regexp.MustCompile(`src="([^"/:][^"]*)"`)
201
+
// Match href="filename" where filename doesn't start with http://, https://, //, /, #, data:, or mailto:
202
+
relativeHrefPattern = regexp.MustCompile(`href="([^"/:][^"]*)"`)
203
+
)
204
+
205
// rewriteRelativeURLs converts relative URLs to absolute URLs
206
func rewriteRelativeURLs(html, baseURL string) string {
207
if baseURL == "" {
···
213
return html
214
}
215
216
+
// Handle root-relative URLs (starting with /) first
217
+
// Must be done before bare relative URLs to avoid double-processing
218
if base.Scheme != "" && base.Host != "" {
219
root := fmt.Sprintf("%s://%s/", base.Scheme, base.Host)
220
+
// Replace src="/" and href="/" but not src="//" (protocol-relative URLs)
221
html = strings.ReplaceAll(html, `src="/`, fmt.Sprintf(`src="%s`, root))
222
html = strings.ReplaceAll(html, `href="/`, fmt.Sprintf(`href="%s`, root))
223
}
224
+
225
+
// Handle explicit relative paths (./something and ../something)
226
+
html = strings.ReplaceAll(html, `src="./`, fmt.Sprintf(`src="%s`, baseURL))
227
+
html = strings.ReplaceAll(html, `href="./`, fmt.Sprintf(`href="%s`, baseURL))
228
+
html = strings.ReplaceAll(html, `src="../`, fmt.Sprintf(`src="%s../`, baseURL))
229
+
html = strings.ReplaceAll(html, `href="../`, fmt.Sprintf(`href="%s../`, baseURL))
230
+
231
+
// Handle bare relative URLs (e.g., src="image.png" without ./ prefix)
232
+
// Skip URLs that are already absolute (start with http://, https://, or //)
233
+
// Skip anchors (#), data URLs (data:), and mailto links
234
+
html = relativeSrcPattern.ReplaceAllStringFunc(html, func(match string) string {
235
+
// Extract the URL from src="..."
236
+
url := match[5 : len(match)-1] // Remove 'src="' and '"'
237
+
238
+
// Skip if already processed or is a special URL type
239
+
if strings.HasPrefix(url, "http://") || strings.HasPrefix(url, "https://") ||
240
+
strings.HasPrefix(url, "//") || strings.HasPrefix(url, "#") ||
241
+
strings.HasPrefix(url, "data:") || strings.HasPrefix(url, "mailto:") {
242
+
return match
243
+
}
244
+
245
+
return fmt.Sprintf(`src="%s%s"`, baseURL, url)
246
+
})
247
+
248
+
html = relativeHrefPattern.ReplaceAllStringFunc(html, func(match string) string {
249
+
// Extract the URL from href="..."
250
+
url := match[6 : len(match)-1] // Remove 'href="' and '"'
251
+
252
+
// Skip if already processed or is a special URL type
253
+
if strings.HasPrefix(url, "http://") || strings.HasPrefix(url, "https://") ||
254
+
strings.HasPrefix(url, "//") || strings.HasPrefix(url, "#") ||
255
+
strings.HasPrefix(url, "data:") || strings.HasPrefix(url, "mailto:") {
256
+
return match
257
+
}
258
+
259
+
return fmt.Sprintf(`href="%s%s"`, baseURL, url)
260
+
})
261
262
return html
263
}
+148
pkg/appview/readme/fetcher_test.go
+148
pkg/appview/readme/fetcher_test.go
···
145
baseURL: "https://example.com/docs/",
146
expected: `<img src="https://example.com//cdn.example.com/image.png">`,
147
},
148
+
{
149
+
name: "bare relative src (no ./ prefix)",
150
+
html: `<img src="image.png">`,
151
+
baseURL: "https://example.com/docs/",
152
+
expected: `<img src="https://example.com/docs/image.png">`,
153
+
},
154
+
{
155
+
name: "bare relative href (no ./ prefix)",
156
+
html: `<a href="page.html">link</a>`,
157
+
baseURL: "https://example.com/docs/",
158
+
expected: `<a href="https://example.com/docs/page.html">link</a>`,
159
+
},
160
+
{
161
+
name: "bare relative with path",
162
+
html: `<img src="images/logo.png">`,
163
+
baseURL: "https://example.com/docs/",
164
+
expected: `<img src="https://example.com/docs/images/logo.png">`,
165
+
},
166
+
{
167
+
name: "anchor links unchanged",
168
+
html: `<a href="#section">link</a>`,
169
+
baseURL: "https://example.com/docs/",
170
+
expected: `<a href="#section">link</a>`,
171
+
},
172
+
{
173
+
name: "data URLs unchanged",
174
+
html: `<img src="data:image/png;base64,abc123">`,
175
+
baseURL: "https://example.com/docs/",
176
+
expected: `<img src="data:image/png;base64,abc123">`,
177
+
},
178
+
{
179
+
name: "mailto links unchanged",
180
+
html: `<a href="mailto:test@example.com">email</a>`,
181
+
baseURL: "https://example.com/docs/",
182
+
expected: `<a href="mailto:test@example.com">email</a>`,
183
+
},
184
+
{
185
+
name: "mixed bare and prefixed relative URLs",
186
+
html: `<img src="slices_and_lucy.png"><a href="./other.md">link</a>`,
187
+
baseURL: "https://github.com/user/repo/blob/main/",
188
+
expected: `<img src="https://github.com/user/repo/blob/main/slices_and_lucy.png"><a href="https://github.com/user/repo/blob/main/other.md">link</a>`,
189
+
},
190
}
191
192
for _, tt := range tests {
···
197
}
198
})
199
}
200
+
}
201
+
202
+
func TestFetcher_RenderMarkdown(t *testing.T) {
203
+
fetcher := NewFetcher()
204
+
205
+
tests := []struct {
206
+
name string
207
+
content string
208
+
wantContain string
209
+
wantErr bool
210
+
}{
211
+
{
212
+
name: "simple paragraph",
213
+
content: "Hello, world!",
214
+
wantContain: "<p>Hello, world!</p>",
215
+
wantErr: false,
216
+
},
217
+
{
218
+
name: "heading",
219
+
content: "# My App",
220
+
wantContain: "<h1",
221
+
wantErr: false,
222
+
},
223
+
{
224
+
name: "bold text",
225
+
content: "This is **bold** text.",
226
+
wantContain: "<strong>bold</strong>",
227
+
wantErr: false,
228
+
},
229
+
{
230
+
name: "italic text",
231
+
content: "This is *italic* text.",
232
+
wantContain: "<em>italic</em>",
233
+
wantErr: false,
234
+
},
235
+
{
236
+
name: "code block",
237
+
content: "```\ncode here\n```",
238
+
wantContain: "<pre>",
239
+
wantErr: false,
240
+
},
241
+
{
242
+
name: "link",
243
+
content: "[Link text](https://example.com)",
244
+
wantContain: `href="https://example.com"`,
245
+
wantErr: false,
246
+
},
247
+
{
248
+
name: "image",
249
+
content: "",
250
+
wantContain: `src="https://example.com/image.png"`,
251
+
wantErr: false,
252
+
},
253
+
{
254
+
name: "unordered list",
255
+
content: "- Item 1\n- Item 2",
256
+
wantContain: "<ul>",
257
+
wantErr: false,
258
+
},
259
+
{
260
+
name: "ordered list",
261
+
content: "1. Item 1\n2. Item 2",
262
+
wantContain: "<ol>",
263
+
wantErr: false,
264
+
},
265
+
{
266
+
name: "empty content",
267
+
content: "",
268
+
wantContain: "",
269
+
wantErr: false,
270
+
},
271
+
{
272
+
name: "complex markdown",
273
+
content: "# Title\n\nA paragraph with **bold** and *italic* text.\n\n- List item 1\n- List item 2\n\n```go\nfunc main() {}\n```",
274
+
wantContain: "<h1",
275
+
wantErr: false,
276
+
},
277
+
}
278
+
279
+
for _, tt := range tests {
280
+
t.Run(tt.name, func(t *testing.T) {
281
+
html, err := fetcher.RenderMarkdown([]byte(tt.content))
282
+
if (err != nil) != tt.wantErr {
283
+
t.Errorf("RenderMarkdown() error = %v, wantErr %v", err, tt.wantErr)
284
+
return
285
+
}
286
+
if !tt.wantErr && tt.wantContain != "" {
287
+
if !containsSubstring(html, tt.wantContain) {
288
+
t.Errorf("RenderMarkdown() = %q, want to contain %q", html, tt.wantContain)
289
+
}
290
+
}
291
+
})
292
+
}
293
+
}
294
+
295
+
func containsSubstring(s, substr string) bool {
296
+
return len(substr) == 0 || (len(s) >= len(substr) && (s == substr || len(s) > 0 && containsSubstringHelper(s, substr)))
297
+
}
298
+
299
+
func containsSubstringHelper(s, substr string) bool {
300
+
for i := 0; i <= len(s)-len(substr); i++ {
301
+
if s[i:i+len(substr)] == substr {
302
+
return true
303
+
}
304
+
}
305
+
return false
306
}
307
308
// TODO: Add README fetching and caching tests
+103
pkg/appview/readme/source.go
+103
pkg/appview/readme/source.go
···
···
1
+
package readme
2
+
3
+
import (
4
+
"fmt"
5
+
"net/url"
6
+
"strings"
7
+
)
8
+
9
+
// Platform represents a supported Git hosting platform
10
+
type Platform string
11
+
12
+
const (
13
+
PlatformGitHub Platform = "github"
14
+
PlatformGitLab Platform = "gitlab"
15
+
PlatformTangled Platform = "tangled"
16
+
)
17
+
18
+
// ParseSourceURL extracts platform, user, and repo from a source repository URL.
19
+
// Returns ok=false if the URL is not a recognized pattern.
20
+
func ParseSourceURL(sourceURL string) (platform Platform, user, repo string, ok bool) {
21
+
if sourceURL == "" {
22
+
return "", "", "", false
23
+
}
24
+
25
+
parsed, err := url.Parse(sourceURL)
26
+
if err != nil {
27
+
return "", "", "", false
28
+
}
29
+
30
+
// Normalize: remove trailing slash and .git suffix
31
+
path := strings.TrimSuffix(parsed.Path, "/")
32
+
path = strings.TrimSuffix(path, ".git")
33
+
path = strings.TrimPrefix(path, "/")
34
+
35
+
if path == "" {
36
+
return "", "", "", false
37
+
}
38
+
39
+
host := strings.ToLower(parsed.Host)
40
+
41
+
switch {
42
+
case host == "github.com":
43
+
// GitHub: github.com/{user}/{repo}
44
+
parts := strings.SplitN(path, "/", 3)
45
+
if len(parts) < 2 || parts[0] == "" || parts[1] == "" {
46
+
return "", "", "", false
47
+
}
48
+
return PlatformGitHub, parts[0], parts[1], true
49
+
50
+
case host == "gitlab.com":
51
+
// GitLab: gitlab.com/{user}/{repo} or gitlab.com/{group}/{subgroup}/{repo}
52
+
// For nested groups, user = everything except last part, repo = last part
53
+
lastSlash := strings.LastIndex(path, "/")
54
+
if lastSlash == -1 || lastSlash == 0 {
55
+
return "", "", "", false
56
+
}
57
+
user = path[:lastSlash]
58
+
repo = path[lastSlash+1:]
59
+
if user == "" || repo == "" {
60
+
return "", "", "", false
61
+
}
62
+
return PlatformGitLab, user, repo, true
63
+
64
+
case host == "tangled.org" || host == "tangled.sh":
65
+
// Tangled: tangled.org/{user}/{repo} or tangled.sh/@{user}/{repo} (legacy)
66
+
// Strip leading @ from user if present
67
+
path = strings.TrimPrefix(path, "@")
68
+
parts := strings.SplitN(path, "/", 3)
69
+
if len(parts) < 2 || parts[0] == "" || parts[1] == "" {
70
+
return "", "", "", false
71
+
}
72
+
return PlatformTangled, parts[0], parts[1], true
73
+
74
+
default:
75
+
return "", "", "", false
76
+
}
77
+
}
78
+
79
+
// DeriveReadmeURL converts a source repository URL to a raw README URL.
80
+
// Returns empty string if platform is not supported.
81
+
func DeriveReadmeURL(sourceURL, branch string) string {
82
+
platform, user, repo, ok := ParseSourceURL(sourceURL)
83
+
if !ok {
84
+
return ""
85
+
}
86
+
87
+
switch platform {
88
+
case PlatformGitHub:
89
+
// https://raw.githubusercontent.com/{user}/{repo}/refs/heads/{branch}/README.md
90
+
return fmt.Sprintf("https://raw.githubusercontent.com/%s/%s/refs/heads/%s/README.md", user, repo, branch)
91
+
92
+
case PlatformGitLab:
93
+
// https://gitlab.com/{user}/{repo}/-/raw/{branch}/README.md
94
+
return fmt.Sprintf("https://gitlab.com/%s/%s/-/raw/%s/README.md", user, repo, branch)
95
+
96
+
case PlatformTangled:
97
+
// https://tangled.org/{user}/{repo}/raw/{branch}/README.md
98
+
return fmt.Sprintf("https://tangled.org/%s/%s/raw/%s/README.md", user, repo, branch)
99
+
100
+
default:
101
+
return ""
102
+
}
103
+
}
+241
pkg/appview/readme/source_test.go
+241
pkg/appview/readme/source_test.go
···
···
1
+
package readme
2
+
3
+
import (
4
+
"testing"
5
+
)
6
+
7
+
func TestParseSourceURL(t *testing.T) {
8
+
tests := []struct {
9
+
name string
10
+
sourceURL string
11
+
wantPlatform Platform
12
+
wantUser string
13
+
wantRepo string
14
+
wantOK bool
15
+
}{
16
+
// GitHub
17
+
{
18
+
name: "github standard",
19
+
sourceURL: "https://github.com/bigmoves/quickslice",
20
+
wantPlatform: PlatformGitHub,
21
+
wantUser: "bigmoves",
22
+
wantRepo: "quickslice",
23
+
wantOK: true,
24
+
},
25
+
{
26
+
name: "github with .git suffix",
27
+
sourceURL: "https://github.com/user/repo.git",
28
+
wantPlatform: PlatformGitHub,
29
+
wantUser: "user",
30
+
wantRepo: "repo",
31
+
wantOK: true,
32
+
},
33
+
{
34
+
name: "github with trailing slash",
35
+
sourceURL: "https://github.com/user/repo/",
36
+
wantPlatform: PlatformGitHub,
37
+
wantUser: "user",
38
+
wantRepo: "repo",
39
+
wantOK: true,
40
+
},
41
+
{
42
+
name: "github with subpath (ignored)",
43
+
sourceURL: "https://github.com/user/repo/tree/main",
44
+
wantPlatform: PlatformGitHub,
45
+
wantUser: "user",
46
+
wantRepo: "repo",
47
+
wantOK: true,
48
+
},
49
+
{
50
+
name: "github user only",
51
+
sourceURL: "https://github.com/user",
52
+
wantOK: false,
53
+
},
54
+
55
+
// GitLab
56
+
{
57
+
name: "gitlab standard",
58
+
sourceURL: "https://gitlab.com/user/repo",
59
+
wantPlatform: PlatformGitLab,
60
+
wantUser: "user",
61
+
wantRepo: "repo",
62
+
wantOK: true,
63
+
},
64
+
{
65
+
name: "gitlab nested groups",
66
+
sourceURL: "https://gitlab.com/group/subgroup/repo",
67
+
wantPlatform: PlatformGitLab,
68
+
wantUser: "group/subgroup",
69
+
wantRepo: "repo",
70
+
wantOK: true,
71
+
},
72
+
{
73
+
name: "gitlab deep nested groups",
74
+
sourceURL: "https://gitlab.com/a/b/c/d/repo",
75
+
wantPlatform: PlatformGitLab,
76
+
wantUser: "a/b/c/d",
77
+
wantRepo: "repo",
78
+
wantOK: true,
79
+
},
80
+
{
81
+
name: "gitlab with .git suffix",
82
+
sourceURL: "https://gitlab.com/user/repo.git",
83
+
wantPlatform: PlatformGitLab,
84
+
wantUser: "user",
85
+
wantRepo: "repo",
86
+
wantOK: true,
87
+
},
88
+
89
+
// Tangled
90
+
{
91
+
name: "tangled standard",
92
+
sourceURL: "https://tangled.org/evan.jarrett.net/at-container-registry",
93
+
wantPlatform: PlatformTangled,
94
+
wantUser: "evan.jarrett.net",
95
+
wantRepo: "at-container-registry",
96
+
wantOK: true,
97
+
},
98
+
{
99
+
name: "tangled with legacy @ prefix",
100
+
sourceURL: "https://tangled.org/@evan.jarrett.net/at-container-registry",
101
+
wantPlatform: PlatformTangled,
102
+
wantUser: "evan.jarrett.net",
103
+
wantRepo: "at-container-registry",
104
+
wantOK: true,
105
+
},
106
+
{
107
+
name: "tangled.sh domain",
108
+
sourceURL: "https://tangled.sh/user/repo",
109
+
wantPlatform: PlatformTangled,
110
+
wantUser: "user",
111
+
wantRepo: "repo",
112
+
wantOK: true,
113
+
},
114
+
{
115
+
name: "tangled with trailing slash",
116
+
sourceURL: "https://tangled.org/user/repo/",
117
+
wantPlatform: PlatformTangled,
118
+
wantUser: "user",
119
+
wantRepo: "repo",
120
+
wantOK: true,
121
+
},
122
+
123
+
// Unsupported / Invalid
124
+
{
125
+
name: "unsupported platform",
126
+
sourceURL: "https://bitbucket.org/user/repo",
127
+
wantOK: false,
128
+
},
129
+
{
130
+
name: "empty url",
131
+
sourceURL: "",
132
+
wantOK: false,
133
+
},
134
+
{
135
+
name: "invalid url",
136
+
sourceURL: "not-a-url",
137
+
wantOK: false,
138
+
},
139
+
{
140
+
name: "just host",
141
+
sourceURL: "https://github.com",
142
+
wantOK: false,
143
+
},
144
+
}
145
+
146
+
for _, tt := range tests {
147
+
t.Run(tt.name, func(t *testing.T) {
148
+
platform, user, repo, ok := ParseSourceURL(tt.sourceURL)
149
+
if ok != tt.wantOK {
150
+
t.Errorf("ParseSourceURL(%q) ok = %v, want %v", tt.sourceURL, ok, tt.wantOK)
151
+
return
152
+
}
153
+
if !tt.wantOK {
154
+
return
155
+
}
156
+
if platform != tt.wantPlatform {
157
+
t.Errorf("ParseSourceURL(%q) platform = %v, want %v", tt.sourceURL, platform, tt.wantPlatform)
158
+
}
159
+
if user != tt.wantUser {
160
+
t.Errorf("ParseSourceURL(%q) user = %q, want %q", tt.sourceURL, user, tt.wantUser)
161
+
}
162
+
if repo != tt.wantRepo {
163
+
t.Errorf("ParseSourceURL(%q) repo = %q, want %q", tt.sourceURL, repo, tt.wantRepo)
164
+
}
165
+
})
166
+
}
167
+
}
168
+
169
+
func TestDeriveReadmeURL(t *testing.T) {
170
+
tests := []struct {
171
+
name string
172
+
sourceURL string
173
+
branch string
174
+
want string
175
+
}{
176
+
// GitHub
177
+
{
178
+
name: "github main",
179
+
sourceURL: "https://github.com/bigmoves/quickslice",
180
+
branch: "main",
181
+
want: "https://raw.githubusercontent.com/bigmoves/quickslice/refs/heads/main/README.md",
182
+
},
183
+
{
184
+
name: "github master",
185
+
sourceURL: "https://github.com/user/repo",
186
+
branch: "master",
187
+
want: "https://raw.githubusercontent.com/user/repo/refs/heads/master/README.md",
188
+
},
189
+
190
+
// GitLab
191
+
{
192
+
name: "gitlab main",
193
+
sourceURL: "https://gitlab.com/user/repo",
194
+
branch: "main",
195
+
want: "https://gitlab.com/user/repo/-/raw/main/README.md",
196
+
},
197
+
{
198
+
name: "gitlab nested groups",
199
+
sourceURL: "https://gitlab.com/group/subgroup/repo",
200
+
branch: "main",
201
+
want: "https://gitlab.com/group/subgroup/repo/-/raw/main/README.md",
202
+
},
203
+
204
+
// Tangled
205
+
{
206
+
name: "tangled main",
207
+
sourceURL: "https://tangled.org/evan.jarrett.net/at-container-registry",
208
+
branch: "main",
209
+
want: "https://tangled.org/evan.jarrett.net/at-container-registry/raw/main/README.md",
210
+
},
211
+
{
212
+
name: "tangled legacy @ prefix",
213
+
sourceURL: "https://tangled.org/@user/repo",
214
+
branch: "main",
215
+
want: "https://tangled.org/user/repo/raw/main/README.md",
216
+
},
217
+
218
+
// Unsupported
219
+
{
220
+
name: "unsupported platform",
221
+
sourceURL: "https://bitbucket.org/user/repo",
222
+
branch: "main",
223
+
want: "",
224
+
},
225
+
{
226
+
name: "empty url",
227
+
sourceURL: "",
228
+
branch: "main",
229
+
want: "",
230
+
},
231
+
}
232
+
233
+
for _, tt := range tests {
234
+
t.Run(tt.name, func(t *testing.T) {
235
+
got := DeriveReadmeURL(tt.sourceURL, tt.branch)
236
+
if got != tt.want {
237
+
t.Errorf("DeriveReadmeURL(%q, %q) = %q, want %q", tt.sourceURL, tt.branch, got, tt.want)
238
+
}
239
+
})
240
+
}
241
+
}
+52
-21
pkg/appview/routes/routes.go
+52
-21
pkg/appview/routes/routes.go
···
12
"atcr.io/pkg/appview/middleware"
13
"atcr.io/pkg/appview/readme"
14
"atcr.io/pkg/auth/oauth"
15
-
"github.com/go-chi/chi/v5"
16
indigooauth "github.com/bluesky-social/indigo/atproto/auth/oauth"
17
)
18
19
// UIDependencies contains all dependencies needed for UI route registration
···
27
BaseURL string
28
DeviceStore *db.DeviceStore
29
HealthChecker *holdhealth.Checker
30
-
ReadmeCache *readme.Cache
31
Templates *template.Template
32
}
33
34
// RegisterUIRoutes registers all web UI and API routes on the provided router
···
36
// Extract trimmed registry URL for templates
37
registryURL := trimRegistryURL(deps.BaseURL)
38
39
// OAuth login routes (public)
40
router.Get("/auth/oauth/login", (&uihandlers.LoginHandler{
41
Templates: deps.Templates,
···
45
46
// Public routes (with optional auth for navbar)
47
// SECURITY: Public pages use read-only DB
48
-
router.Get("/", middleware.OptionalAuth(deps.SessionStore, deps.Database)(
49
&uihandlers.HomeHandler{
50
DB: deps.ReadOnlyDB,
51
Templates: deps.Templates,
···
53
},
54
).ServeHTTP)
55
56
-
router.Get("/api/recent-pushes", middleware.OptionalAuth(deps.SessionStore, deps.Database)(
57
&uihandlers.RecentPushesHandler{
58
DB: deps.ReadOnlyDB,
59
Templates: deps.Templates,
···
63
).ServeHTTP)
64
65
// SECURITY: Search uses read-only DB to prevent writes and limit access to sensitive tables
66
-
router.Get("/search", middleware.OptionalAuth(deps.SessionStore, deps.Database)(
67
&uihandlers.SearchHandler{
68
DB: deps.ReadOnlyDB,
69
Templates: deps.Templates,
···
71
},
72
).ServeHTTP)
73
74
-
router.Get("/api/search-results", middleware.OptionalAuth(deps.SessionStore, deps.Database)(
75
&uihandlers.SearchResultsHandler{
76
DB: deps.ReadOnlyDB,
77
Templates: deps.Templates,
···
80
).ServeHTTP)
81
82
// Install page (public)
83
-
router.Get("/install", middleware.OptionalAuth(deps.SessionStore, deps.Database)(
84
&uihandlers.InstallHandler{
85
Templates: deps.Templates,
86
RegistryURL: registryURL,
···
88
).ServeHTTP)
89
90
// API route for repository stats (public, read-only)
91
-
router.Get("/api/stats/{handle}/{repository}", middleware.OptionalAuth(deps.SessionStore, deps.Database)(
92
&uihandlers.GetStatsHandler{
93
DB: deps.ReadOnlyDB,
94
Directory: deps.OAuthClientApp.Dir,
···
96
).ServeHTTP)
97
98
// API routes for stars (require authentication)
99
-
router.Post("/api/stars/{handle}/{repository}", middleware.RequireAuth(deps.SessionStore, deps.Database)(
100
&uihandlers.StarRepositoryHandler{
101
DB: deps.Database, // Needs write access
102
Directory: deps.OAuthClientApp.Dir,
···
104
},
105
).ServeHTTP)
106
107
-
router.Delete("/api/stars/{handle}/{repository}", middleware.RequireAuth(deps.SessionStore, deps.Database)(
108
&uihandlers.UnstarRepositoryHandler{
109
DB: deps.Database, // Needs write access
110
Directory: deps.OAuthClientApp.Dir,
···
112
},
113
).ServeHTTP)
114
115
-
router.Get("/api/stars/{handle}/{repository}", middleware.OptionalAuth(deps.SessionStore, deps.Database)(
116
&uihandlers.CheckStarHandler{
117
DB: deps.ReadOnlyDB, // Read-only check
118
Directory: deps.OAuthClientApp.Dir,
···
121
).ServeHTTP)
122
123
// Manifest detail API endpoint
124
-
router.Get("/api/manifests/{handle}/{repository}/{digest}", middleware.OptionalAuth(deps.SessionStore, deps.Database)(
125
&uihandlers.ManifestDetailHandler{
126
DB: deps.ReadOnlyDB,
127
Directory: deps.OAuthClientApp.Dir,
···
133
HealthChecker: deps.HealthChecker,
134
}).ServeHTTP)
135
136
-
router.Get("/u/{handle}", middleware.OptionalAuth(deps.SessionStore, deps.Database)(
137
&uihandlers.UserPageHandler{
138
DB: deps.ReadOnlyDB,
139
Templates: deps.Templates,
···
141
},
142
).ServeHTTP)
143
144
-
router.Get("/r/{handle}/{repository}", middleware.OptionalAuth(deps.SessionStore, deps.Database)(
145
&uihandlers.RepositoryPageHandler{
146
DB: deps.ReadOnlyDB,
147
Templates: deps.Templates,
···
149
Directory: deps.OAuthClientApp.Dir,
150
Refresher: deps.Refresher,
151
HealthChecker: deps.HealthChecker,
152
-
ReadmeCache: deps.ReadmeCache,
153
},
154
).ServeHTTP)
155
156
// Authenticated routes
157
router.Group(func(r chi.Router) {
158
-
r.Use(middleware.RequireAuth(deps.SessionStore, deps.Database))
159
160
r.Get("/settings", (&uihandlers.SettingsHandler{
161
Templates: deps.Templates,
···
177
Refresher: deps.Refresher,
178
}).ServeHTTP)
179
180
// Device approval page (authenticated)
181
r.Get("/device", (&uihandlers.DeviceApprovalPageHandler{
182
Store: deps.DeviceStore,
···
201
})
202
203
// Logout endpoint (supports both GET and POST)
204
-
// Properly revokes OAuth tokens on PDS side before clearing local session
205
logoutHandler := &uihandlers.LogoutHandler{
206
-
OAuthClientApp: deps.OAuthClientApp,
207
-
Refresher: deps.Refresher,
208
-
SessionStore: deps.SessionStore,
209
-
OAuthStore: deps.OAuthStore,
210
}
211
router.Get("/auth/logout", logoutHandler.ServeHTTP)
212
router.Post("/auth/logout", logoutHandler.ServeHTTP)
213
}
214
215
// CORSMiddleware returns a middleware that sets CORS headers for API endpoints
···
12
"atcr.io/pkg/appview/middleware"
13
"atcr.io/pkg/appview/readme"
14
"atcr.io/pkg/auth/oauth"
15
indigooauth "github.com/bluesky-social/indigo/atproto/auth/oauth"
16
+
"github.com/go-chi/chi/v5"
17
)
18
19
// UIDependencies contains all dependencies needed for UI route registration
···
27
BaseURL string
28
DeviceStore *db.DeviceStore
29
HealthChecker *holdhealth.Checker
30
+
ReadmeFetcher *readme.Fetcher
31
Templates *template.Template
32
+
DefaultHoldDID string // For UserContext creation
33
}
34
35
// RegisterUIRoutes registers all web UI and API routes on the provided router
···
37
// Extract trimmed registry URL for templates
38
registryURL := trimRegistryURL(deps.BaseURL)
39
40
+
// Create web auth dependencies for middleware (enables UserContext in web routes)
41
+
webAuthDeps := middleware.WebAuthDeps{
42
+
SessionStore: deps.SessionStore,
43
+
Database: deps.Database,
44
+
Refresher: deps.Refresher,
45
+
DefaultHoldDID: deps.DefaultHoldDID,
46
+
}
47
+
48
// OAuth login routes (public)
49
router.Get("/auth/oauth/login", (&uihandlers.LoginHandler{
50
Templates: deps.Templates,
···
54
55
// Public routes (with optional auth for navbar)
56
// SECURITY: Public pages use read-only DB
57
+
router.Get("/", middleware.OptionalAuthWithDeps(webAuthDeps)(
58
&uihandlers.HomeHandler{
59
DB: deps.ReadOnlyDB,
60
Templates: deps.Templates,
···
62
},
63
).ServeHTTP)
64
65
+
router.Get("/api/recent-pushes", middleware.OptionalAuthWithDeps(webAuthDeps)(
66
&uihandlers.RecentPushesHandler{
67
DB: deps.ReadOnlyDB,
68
Templates: deps.Templates,
···
72
).ServeHTTP)
73
74
// SECURITY: Search uses read-only DB to prevent writes and limit access to sensitive tables
75
+
router.Get("/search", middleware.OptionalAuthWithDeps(webAuthDeps)(
76
&uihandlers.SearchHandler{
77
DB: deps.ReadOnlyDB,
78
Templates: deps.Templates,
···
80
},
81
).ServeHTTP)
82
83
+
router.Get("/api/search-results", middleware.OptionalAuthWithDeps(webAuthDeps)(
84
&uihandlers.SearchResultsHandler{
85
DB: deps.ReadOnlyDB,
86
Templates: deps.Templates,
···
89
).ServeHTTP)
90
91
// Install page (public)
92
+
router.Get("/install", middleware.OptionalAuthWithDeps(webAuthDeps)(
93
&uihandlers.InstallHandler{
94
Templates: deps.Templates,
95
RegistryURL: registryURL,
···
97
).ServeHTTP)
98
99
// API route for repository stats (public, read-only)
100
+
router.Get("/api/stats/{handle}/{repository}", middleware.OptionalAuthWithDeps(webAuthDeps)(
101
&uihandlers.GetStatsHandler{
102
DB: deps.ReadOnlyDB,
103
Directory: deps.OAuthClientApp.Dir,
···
105
).ServeHTTP)
106
107
// API routes for stars (require authentication)
108
+
router.Post("/api/stars/{handle}/{repository}", middleware.RequireAuthWithDeps(webAuthDeps)(
109
&uihandlers.StarRepositoryHandler{
110
DB: deps.Database, // Needs write access
111
Directory: deps.OAuthClientApp.Dir,
···
113
},
114
).ServeHTTP)
115
116
+
router.Delete("/api/stars/{handle}/{repository}", middleware.RequireAuthWithDeps(webAuthDeps)(
117
&uihandlers.UnstarRepositoryHandler{
118
DB: deps.Database, // Needs write access
119
Directory: deps.OAuthClientApp.Dir,
···
121
},
122
).ServeHTTP)
123
124
+
router.Get("/api/stars/{handle}/{repository}", middleware.OptionalAuthWithDeps(webAuthDeps)(
125
&uihandlers.CheckStarHandler{
126
DB: deps.ReadOnlyDB, // Read-only check
127
Directory: deps.OAuthClientApp.Dir,
···
130
).ServeHTTP)
131
132
// Manifest detail API endpoint
133
+
router.Get("/api/manifests/{handle}/{repository}/{digest}", middleware.OptionalAuthWithDeps(webAuthDeps)(
134
&uihandlers.ManifestDetailHandler{
135
DB: deps.ReadOnlyDB,
136
Directory: deps.OAuthClientApp.Dir,
···
142
HealthChecker: deps.HealthChecker,
143
}).ServeHTTP)
144
145
+
router.Get("/u/{handle}", middleware.OptionalAuthWithDeps(webAuthDeps)(
146
&uihandlers.UserPageHandler{
147
DB: deps.ReadOnlyDB,
148
Templates: deps.Templates,
···
150
},
151
).ServeHTTP)
152
153
+
// OpenGraph image generation (public, cacheable)
154
+
router.Get("/og/home", (&uihandlers.DefaultOGHandler{}).ServeHTTP)
155
+
156
+
router.Get("/og/u/{handle}", (&uihandlers.UserOGHandler{
157
+
DB: deps.ReadOnlyDB,
158
+
}).ServeHTTP)
159
+
160
+
router.Get("/og/r/{handle}/{repository}", (&uihandlers.RepoOGHandler{
161
+
DB: deps.ReadOnlyDB,
162
+
}).ServeHTTP)
163
+
164
+
router.Get("/r/{handle}/{repository}", middleware.OptionalAuthWithDeps(webAuthDeps)(
165
&uihandlers.RepositoryPageHandler{
166
DB: deps.ReadOnlyDB,
167
Templates: deps.Templates,
···
169
Directory: deps.OAuthClientApp.Dir,
170
Refresher: deps.Refresher,
171
HealthChecker: deps.HealthChecker,
172
+
ReadmeFetcher: deps.ReadmeFetcher,
173
},
174
).ServeHTTP)
175
176
// Authenticated routes
177
router.Group(func(r chi.Router) {
178
+
r.Use(middleware.RequireAuthWithDeps(webAuthDeps))
179
180
r.Get("/settings", (&uihandlers.SettingsHandler{
181
Templates: deps.Templates,
···
197
Refresher: deps.Refresher,
198
}).ServeHTTP)
199
200
+
r.Post("/api/images/{repository}/avatar", (&uihandlers.UploadAvatarHandler{
201
+
DB: deps.Database,
202
+
Refresher: deps.Refresher,
203
+
}).ServeHTTP)
204
+
205
// Device approval page (authenticated)
206
r.Get("/device", (&uihandlers.DeviceApprovalPageHandler{
207
Store: deps.DeviceStore,
···
226
})
227
228
// Logout endpoint (supports both GET and POST)
229
+
// Only clears the current UI session cookie - does NOT revoke OAuth tokens
230
+
// OAuth sessions remain intact so other browser tabs/devices stay logged in
231
logoutHandler := &uihandlers.LogoutHandler{
232
+
SessionStore: deps.SessionStore,
233
}
234
router.Get("/auth/logout", logoutHandler.ServeHTTP)
235
router.Post("/auth/logout", logoutHandler.ServeHTTP)
236
+
237
+
// Custom 404 handler
238
+
router.NotFound(middleware.OptionalAuthWithDeps(webAuthDeps)(
239
+
&uihandlers.NotFoundHandler{
240
+
Templates: deps.Templates,
241
+
RegistryURL: registryURL,
242
+
},
243
+
).ServeHTTP)
244
}
245
246
// CORSMiddleware returns a middleware that sets CORS headers for API endpoints
+262
-40
pkg/appview/static/css/style.css
+262
-40
pkg/appview/static/css/style.css
···
38
--version-badge-text: #7b1fa2;
39
--version-badge-border: #ba68c8;
40
41
/* Hero section colors */
42
--hero-bg-start: #f8f9fa;
43
--hero-bg-end: #e9ecef;
···
90
--version-badge-text: #ffffff;
91
--version-badge-border: #ba68c8;
92
93
/* Hero section colors */
94
--hero-bg-start: #2d2d2d;
95
--hero-bg-end: #1a1a1a;
···
109
}
110
111
body {
112
-
font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif;
113
background: var(--bg);
114
color: var(--fg);
115
line-height: 1.6;
···
170
}
171
172
.nav-links a:hover {
173
-
background:var(--secondary);
174
border-radius: 4px;
175
}
176
···
193
}
194
195
.user-menu-btn:hover {
196
-
background:var(--secondary);
197
}
198
199
.user-avatar {
···
266
position: absolute;
267
top: calc(100% + 0.5rem);
268
right: 0;
269
-
background:var(--bg);
270
border: 1px solid var(--border);
271
border-radius: 8px;
272
box-shadow: var(--shadow-lg);
···
287
color: var(--fg);
288
text-decoration: none;
289
border: none;
290
-
background:var(--bg);
291
cursor: pointer;
292
transition: background 0.2s;
293
font-size: 0.95rem;
···
309
}
310
311
/* Buttons */
312
-
button, .btn, .btn-primary, .btn-secondary {
313
padding: 0.5rem 1rem;
314
background: var(--button-primary);
315
color: var(--btn-text);
···
322
transition: opacity 0.2s;
323
}
324
325
-
button:hover, .btn:hover, .btn-primary:hover, .btn-secondary:hover {
326
opacity: 0.9;
327
}
328
···
393
}
394
395
/* Cards */
396
-
.push-card, .repository-card {
397
border: 1px solid var(--border);
398
border-radius: 8px;
399
padding: 1rem;
400
margin-bottom: 1rem;
401
-
background:var(--bg);
402
box-shadow: var(--shadow-sm);
403
}
404
···
449
}
450
451
.digest {
452
-
font-family: 'Monaco', 'Courier New', monospace;
453
font-size: 0.85rem;
454
background: var(--code-bg);
455
padding: 0.1rem 0.3rem;
···
492
}
493
494
.docker-command-text {
495
-
font-family: 'Monaco', 'Courier New', monospace;
496
font-size: 0.85rem;
497
color: var(--fg);
498
flex: 0 1 auto;
···
510
border-radius: 4px;
511
opacity: 0;
512
visibility: hidden;
513
-
transition: opacity 0.2s, visibility 0.2s;
514
}
515
516
.docker-command:hover .copy-btn {
···
752
}
753
754
.repo-stats {
755
-
color:var(--border-dark);
756
font-size: 0.9rem;
757
display: flex;
758
gap: 0.5rem;
···
781
padding-top: 1rem;
782
}
783
784
-
.tags-section, .manifests-section {
785
margin-bottom: 1.5rem;
786
}
787
788
-
.tags-section h3, .manifests-section h3 {
789
font-size: 1.1rem;
790
margin-bottom: 0.5rem;
791
color: var(--secondary);
792
}
793
794
-
.tag-row, .manifest-row {
795
display: flex;
796
gap: 1rem;
797
align-items: center;
···
799
border-bottom: 1px solid var(--border);
800
}
801
802
-
.tag-row:last-child, .manifest-row:last-child {
803
border-bottom: none;
804
}
805
···
821
}
822
823
.settings-section {
824
-
background:var(--bg);
825
border: 1px solid var(--border);
826
border-radius: 8px;
827
padding: 1.5rem;
···
918
padding: 1rem;
919
border-radius: 4px;
920
overflow-x: auto;
921
-
font-family: 'Monaco', 'Courier New', monospace;
922
font-size: 0.85rem;
923
border: 1px solid var(--border);
924
}
···
1004
margin: 1rem 0;
1005
}
1006
1007
-
/* Load More Button */
1008
-
.load-more {
1009
-
width: 100%;
1010
-
margin-top: 1rem;
1011
-
background: var(--secondary);
1012
-
}
1013
-
1014
/* Login Page */
1015
.login-page {
1016
max-width: 450px;
···
1031
}
1032
1033
.login-form {
1034
-
background:var(--bg);
1035
padding: 2rem;
1036
border-radius: 8px;
1037
border: 1px solid var(--border);
···
1083
text-decoration: underline;
1084
}
1085
1086
/* Repository Page */
1087
.repository-page {
1088
/* Let container's max-width (1200px) control page width */
···
1090
}
1091
1092
.repository-header {
1093
-
background:var(--bg);
1094
border: 1px solid var(--border);
1095
border-radius: 8px;
1096
padding: 2rem;
···
1128
flex-shrink: 0;
1129
}
1130
1131
.repo-hero-info {
1132
flex: 1;
1133
}
···
1198
}
1199
1200
.star-btn.starred {
1201
-
border-color:var(--star);
1202
background: var(--code-bg);
1203
}
1204
···
1282
}
1283
1284
.repo-section {
1285
-
background:var(--bg);
1286
border: 1px solid var(--border);
1287
border-radius: 8px;
1288
padding: 1.5rem;
···
1297
border-bottom: 2px solid var(--border);
1298
}
1299
1300
-
.tags-list, .manifests-list {
1301
display: flex;
1302
flex-direction: column;
1303
gap: 1rem;
1304
}
1305
1306
-
.tag-item, .manifest-item {
1307
border: 1px solid var(--border);
1308
border-radius: 6px;
1309
padding: 1rem;
1310
background: var(--hover-bg);
1311
}
1312
1313
-
.tag-item-header, .manifest-item-header {
1314
display: flex;
1315
justify-content: space-between;
1316
align-items: center;
···
1440
color: var(--fg);
1441
border: 1px solid var(--border);
1442
white-space: nowrap;
1443
-
font-family: 'Monaco', 'Courier New', monospace;
1444
}
1445
1446
.platforms-inline {
···
1475
font-style: italic;
1476
}
1477
1478
/* Featured Repositories Section */
1479
.featured-section {
1480
margin-bottom: 3rem;
···
1625
1626
/* Hero Section */
1627
.hero-section {
1628
-
background: linear-gradient(135deg, var(--hero-bg-start) 0%, var(--hero-bg-end) 100%);
1629
padding: 4rem 2rem;
1630
border-bottom: 1px solid var(--border);
1631
}
···
1690
.terminal-content {
1691
padding: 1.5rem;
1692
margin: 0;
1693
-
font-family: 'Monaco', 'Courier New', monospace;
1694
font-size: 0.95rem;
1695
line-height: 1.8;
1696
color: var(--terminal-text);
···
1846
}
1847
1848
.code-block code {
1849
-
font-family: 'Monaco', 'Menlo', monospace;
1850
font-size: 0.9rem;
1851
line-height: 1.5;
1852
white-space: pre-wrap;
···
1903
flex-wrap: wrap;
1904
}
1905
1906
-
.tag-row, .manifest-row {
1907
flex-wrap: wrap;
1908
}
1909
···
1992
/* README and Repository Layout */
1993
.repo-content-layout {
1994
display: grid;
1995
-
grid-template-columns: 7fr 3fr;
1996
gap: 2rem;
1997
margin-top: 2rem;
1998
}
···
2103
background: var(--code-bg);
2104
padding: 0.2rem 0.4rem;
2105
border-radius: 3px;
2106
-
font-family: 'SFMono-Regular', Consolas, 'Liberation Mono', Menlo, monospace;
2107
font-size: 0.9em;
2108
}
2109
···
2207
padding: 0.75rem;
2208
}
2209
}
···
38
--version-badge-text: #7b1fa2;
39
--version-badge-border: #ba68c8;
40
41
+
/* Attestation badge */
42
+
--attestation-badge-bg: #d1fae5;
43
+
--attestation-badge-text: #065f46;
44
+
45
/* Hero section colors */
46
--hero-bg-start: #f8f9fa;
47
--hero-bg-end: #e9ecef;
···
94
--version-badge-text: #ffffff;
95
--version-badge-border: #ba68c8;
96
97
+
/* Attestation badge */
98
+
--attestation-badge-bg: #065f46;
99
+
--attestation-badge-text: #6ee7b7;
100
+
101
/* Hero section colors */
102
--hero-bg-start: #2d2d2d;
103
--hero-bg-end: #1a1a1a;
···
117
}
118
119
body {
120
+
font-family:
121
+
-apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue",
122
+
Arial, sans-serif;
123
background: var(--bg);
124
color: var(--fg);
125
line-height: 1.6;
···
180
}
181
182
.nav-links a:hover {
183
+
background: var(--secondary);
184
border-radius: 4px;
185
}
186
···
203
}
204
205
.user-menu-btn:hover {
206
+
background: var(--secondary);
207
}
208
209
.user-avatar {
···
276
position: absolute;
277
top: calc(100% + 0.5rem);
278
right: 0;
279
+
background: var(--bg);
280
border: 1px solid var(--border);
281
border-radius: 8px;
282
box-shadow: var(--shadow-lg);
···
297
color: var(--fg);
298
text-decoration: none;
299
border: none;
300
+
background: var(--bg);
301
cursor: pointer;
302
transition: background 0.2s;
303
font-size: 0.95rem;
···
319
}
320
321
/* Buttons */
322
+
button,
323
+
.btn,
324
+
.btn-primary,
325
+
.btn-secondary {
326
padding: 0.5rem 1rem;
327
background: var(--button-primary);
328
color: var(--btn-text);
···
335
transition: opacity 0.2s;
336
}
337
338
+
button:hover,
339
+
.btn:hover,
340
+
.btn-primary:hover,
341
+
.btn-secondary:hover {
342
opacity: 0.9;
343
}
344
···
409
}
410
411
/* Cards */
412
+
.push-card,
413
+
.repository-card {
414
border: 1px solid var(--border);
415
border-radius: 8px;
416
padding: 1rem;
417
margin-bottom: 1rem;
418
+
background: var(--bg);
419
box-shadow: var(--shadow-sm);
420
}
421
···
466
}
467
468
.digest {
469
+
font-family: "Monaco", "Courier New", monospace;
470
font-size: 0.85rem;
471
background: var(--code-bg);
472
padding: 0.1rem 0.3rem;
···
509
}
510
511
.docker-command-text {
512
+
font-family: "Monaco", "Courier New", monospace;
513
font-size: 0.85rem;
514
color: var(--fg);
515
flex: 0 1 auto;
···
527
border-radius: 4px;
528
opacity: 0;
529
visibility: hidden;
530
+
transition:
531
+
opacity 0.2s,
532
+
visibility 0.2s;
533
}
534
535
.docker-command:hover .copy-btn {
···
771
}
772
773
.repo-stats {
774
+
color: var(--border-dark);
775
font-size: 0.9rem;
776
display: flex;
777
gap: 0.5rem;
···
800
padding-top: 1rem;
801
}
802
803
+
.tags-section,
804
+
.manifests-section {
805
margin-bottom: 1.5rem;
806
}
807
808
+
.tags-section h3,
809
+
.manifests-section h3 {
810
font-size: 1.1rem;
811
margin-bottom: 0.5rem;
812
color: var(--secondary);
813
}
814
815
+
.tag-row,
816
+
.manifest-row {
817
display: flex;
818
gap: 1rem;
819
align-items: center;
···
821
border-bottom: 1px solid var(--border);
822
}
823
824
+
.tag-row:last-child,
825
+
.manifest-row:last-child {
826
border-bottom: none;
827
}
828
···
844
}
845
846
.settings-section {
847
+
background: var(--bg);
848
border: 1px solid var(--border);
849
border-radius: 8px;
850
padding: 1.5rem;
···
941
padding: 1rem;
942
border-radius: 4px;
943
overflow-x: auto;
944
+
font-family: "Monaco", "Courier New", monospace;
945
font-size: 0.85rem;
946
border: 1px solid var(--border);
947
}
···
1027
margin: 1rem 0;
1028
}
1029
1030
/* Login Page */
1031
.login-page {
1032
max-width: 450px;
···
1047
}
1048
1049
.login-form {
1050
+
background: var(--bg);
1051
padding: 2rem;
1052
border-radius: 8px;
1053
border: 1px solid var(--border);
···
1099
text-decoration: underline;
1100
}
1101
1102
+
/* Login Typeahead */
1103
+
.login-form .form-group {
1104
+
position: relative;
1105
+
}
1106
+
1107
+
.typeahead-dropdown {
1108
+
position: absolute;
1109
+
top: 100%;
1110
+
left: 0;
1111
+
right: 0;
1112
+
background: var(--bg);
1113
+
border: 1px solid var(--border);
1114
+
border-top: none;
1115
+
border-radius: 0 0 4px 4px;
1116
+
box-shadow: var(--shadow-md);
1117
+
max-height: 300px;
1118
+
overflow-y: auto;
1119
+
z-index: 1000;
1120
+
margin-top: -1px;
1121
+
}
1122
+
1123
+
.typeahead-header {
1124
+
padding: 0.5rem 0.75rem;
1125
+
font-size: 0.75rem;
1126
+
font-weight: 600;
1127
+
text-transform: uppercase;
1128
+
color: var(--secondary);
1129
+
border-bottom: 1px solid var(--border);
1130
+
}
1131
+
1132
+
.typeahead-item {
1133
+
display: flex;
1134
+
align-items: center;
1135
+
gap: 0.75rem;
1136
+
padding: 0.75rem;
1137
+
cursor: pointer;
1138
+
transition: background-color 0.15s ease;
1139
+
border-bottom: 1px solid var(--border);
1140
+
}
1141
+
1142
+
.typeahead-item:last-child {
1143
+
border-bottom: none;
1144
+
}
1145
+
1146
+
.typeahead-item:hover,
1147
+
.typeahead-item.typeahead-focused {
1148
+
background: var(--hover-bg);
1149
+
border-left: 3px solid var(--primary);
1150
+
padding-left: calc(0.75rem - 3px);
1151
+
}
1152
+
1153
+
.typeahead-avatar {
1154
+
width: 32px;
1155
+
height: 32px;
1156
+
border-radius: 50%;
1157
+
object-fit: cover;
1158
+
flex-shrink: 0;
1159
+
}
1160
+
1161
+
.typeahead-text {
1162
+
flex: 1;
1163
+
min-width: 0;
1164
+
}
1165
+
1166
+
.typeahead-displayname {
1167
+
font-weight: 500;
1168
+
color: var(--text);
1169
+
overflow: hidden;
1170
+
text-overflow: ellipsis;
1171
+
white-space: nowrap;
1172
+
}
1173
+
1174
+
.typeahead-handle {
1175
+
font-size: 0.875rem;
1176
+
color: var(--secondary);
1177
+
overflow: hidden;
1178
+
text-overflow: ellipsis;
1179
+
white-space: nowrap;
1180
+
}
1181
+
1182
+
.typeahead-recent .typeahead-handle {
1183
+
font-size: 1rem;
1184
+
color: var(--text);
1185
+
}
1186
+
1187
+
.typeahead-loading {
1188
+
padding: 0.75rem;
1189
+
text-align: center;
1190
+
color: var(--secondary);
1191
+
font-size: 0.875rem;
1192
+
}
1193
+
1194
/* Repository Page */
1195
.repository-page {
1196
/* Let container's max-width (1200px) control page width */
···
1198
}
1199
1200
.repository-header {
1201
+
background: var(--bg);
1202
border: 1px solid var(--border);
1203
border-radius: 8px;
1204
padding: 2rem;
···
1236
flex-shrink: 0;
1237
}
1238
1239
+
.repo-hero-icon-wrapper {
1240
+
position: relative;
1241
+
display: inline-block;
1242
+
flex-shrink: 0;
1243
+
}
1244
+
1245
+
.avatar-upload-overlay {
1246
+
position: absolute;
1247
+
inset: 0;
1248
+
display: flex;
1249
+
align-items: center;
1250
+
justify-content: center;
1251
+
background: rgba(0, 0, 0, 0.5);
1252
+
border-radius: 12px;
1253
+
opacity: 0;
1254
+
cursor: pointer;
1255
+
transition: opacity 0.2s ease;
1256
+
}
1257
+
1258
+
.avatar-upload-overlay i {
1259
+
color: white;
1260
+
width: 24px;
1261
+
height: 24px;
1262
+
}
1263
+
1264
+
.repo-hero-icon-wrapper:hover .avatar-upload-overlay {
1265
+
opacity: 1;
1266
+
}
1267
+
1268
.repo-hero-info {
1269
flex: 1;
1270
}
···
1335
}
1336
1337
.star-btn.starred {
1338
+
border-color: var(--star);
1339
background: var(--code-bg);
1340
}
1341
···
1419
}
1420
1421
.repo-section {
1422
+
background: var(--bg);
1423
border: 1px solid var(--border);
1424
border-radius: 8px;
1425
padding: 1.5rem;
···
1434
border-bottom: 2px solid var(--border);
1435
}
1436
1437
+
.tags-list,
1438
+
.manifests-list {
1439
display: flex;
1440
flex-direction: column;
1441
gap: 1rem;
1442
}
1443
1444
+
.tag-item,
1445
+
.manifest-item {
1446
border: 1px solid var(--border);
1447
border-radius: 6px;
1448
padding: 1rem;
1449
background: var(--hover-bg);
1450
}
1451
1452
+
.tag-item-header,
1453
+
.manifest-item-header {
1454
display: flex;
1455
justify-content: space-between;
1456
align-items: center;
···
1580
color: var(--fg);
1581
border: 1px solid var(--border);
1582
white-space: nowrap;
1583
+
font-family: "Monaco", "Courier New", monospace;
1584
}
1585
1586
.platforms-inline {
···
1615
font-style: italic;
1616
}
1617
1618
+
.badge-attestation {
1619
+
display: inline-flex;
1620
+
align-items: center;
1621
+
gap: 0.3rem;
1622
+
padding: 0.25rem 0.6rem;
1623
+
background: var(--attestation-badge-bg);
1624
+
color: var(--attestation-badge-text);
1625
+
border-radius: 12px;
1626
+
font-size: 0.75rem;
1627
+
font-weight: 600;
1628
+
margin-left: 0.5rem;
1629
+
vertical-align: middle;
1630
+
white-space: nowrap;
1631
+
}
1632
+
1633
+
.badge-attestation .lucide {
1634
+
width: 0.75rem;
1635
+
height: 0.75rem;
1636
+
}
1637
+
1638
/* Featured Repositories Section */
1639
.featured-section {
1640
margin-bottom: 3rem;
···
1785
1786
/* Hero Section */
1787
.hero-section {
1788
+
background: linear-gradient(
1789
+
135deg,
1790
+
var(--hero-bg-start) 0%,
1791
+
var(--hero-bg-end) 100%
1792
+
);
1793
padding: 4rem 2rem;
1794
border-bottom: 1px solid var(--border);
1795
}
···
1854
.terminal-content {
1855
padding: 1.5rem;
1856
margin: 0;
1857
+
font-family: "Monaco", "Courier New", monospace;
1858
font-size: 0.95rem;
1859
line-height: 1.8;
1860
color: var(--terminal-text);
···
2010
}
2011
2012
.code-block code {
2013
+
font-family: "Monaco", "Menlo", monospace;
2014
font-size: 0.9rem;
2015
line-height: 1.5;
2016
white-space: pre-wrap;
···
2067
flex-wrap: wrap;
2068
}
2069
2070
+
.tag-row,
2071
+
.manifest-row {
2072
flex-wrap: wrap;
2073
}
2074
···
2157
/* README and Repository Layout */
2158
.repo-content-layout {
2159
display: grid;
2160
+
grid-template-columns: 6fr 4fr;
2161
gap: 2rem;
2162
margin-top: 2rem;
2163
}
···
2268
background: var(--code-bg);
2269
padding: 0.2rem 0.4rem;
2270
border-radius: 3px;
2271
+
font-family:
2272
+
"SFMono-Regular", Consolas, "Liberation Mono", Menlo, monospace;
2273
font-size: 0.9em;
2274
}
2275
···
2373
padding: 0.75rem;
2374
}
2375
}
2376
+
2377
+
/* 404 Error Page */
2378
+
.error-page {
2379
+
display: flex;
2380
+
align-items: center;
2381
+
justify-content: center;
2382
+
min-height: calc(100vh - 60px);
2383
+
text-align: center;
2384
+
padding: 2rem;
2385
+
}
2386
+
2387
+
.error-content {
2388
+
max-width: 480px;
2389
+
}
2390
+
2391
+
.error-icon {
2392
+
width: 80px;
2393
+
height: 80px;
2394
+
color: var(--secondary);
2395
+
margin-bottom: 1.5rem;
2396
+
}
2397
+
2398
+
.error-code {
2399
+
font-size: 8rem;
2400
+
font-weight: 700;
2401
+
color: var(--primary);
2402
+
line-height: 1;
2403
+
margin-bottom: 0.5rem;
2404
+
}
2405
+
2406
+
.error-content h1 {
2407
+
font-size: 2rem;
2408
+
margin-bottom: 0.75rem;
2409
+
color: var(--fg);
2410
+
}
2411
+
2412
+
.error-content p {
2413
+
font-size: 1.125rem;
2414
+
color: var(--secondary);
2415
+
margin-bottom: 2rem;
2416
+
}
2417
+
2418
+
@media (max-width: 768px) {
2419
+
.error-code {
2420
+
font-size: 5rem;
2421
+
}
2422
+
2423
+
.error-icon {
2424
+
width: 60px;
2425
+
height: 60px;
2426
+
}
2427
+
2428
+
.error-content h1 {
2429
+
font-size: 1.5rem;
2430
+
}
2431
+
}
+343
pkg/appview/static/js/app.js
+343
pkg/appview/static/js/app.js
···
434
}
435
}
436
437
+
// Upload repository avatar
438
+
async function uploadAvatar(input, repository) {
439
+
const file = input.files[0];
440
+
if (!file) return;
441
+
442
+
// Client-side validation
443
+
const validTypes = ['image/png', 'image/jpeg', 'image/webp'];
444
+
if (!validTypes.includes(file.type)) {
445
+
alert('Please select a PNG, JPEG, or WebP image');
446
+
return;
447
+
}
448
+
if (file.size > 3 * 1024 * 1024) {
449
+
alert('Image must be less than 3MB');
450
+
return;
451
+
}
452
+
453
+
const formData = new FormData();
454
+
formData.append('avatar', file);
455
+
456
+
try {
457
+
const response = await fetch(`/api/images/${repository}/avatar`, {
458
+
method: 'POST',
459
+
credentials: 'include',
460
+
body: formData
461
+
});
462
+
463
+
if (response.status === 401) {
464
+
window.location.href = '/auth/oauth/login';
465
+
return;
466
+
}
467
+
468
+
if (!response.ok) {
469
+
const error = await response.text();
470
+
throw new Error(error);
471
+
}
472
+
473
+
const data = await response.json();
474
+
475
+
// Update the avatar image on the page
476
+
const wrapper = document.querySelector('.repo-hero-icon-wrapper');
477
+
if (!wrapper) return;
478
+
479
+
const existingImg = wrapper.querySelector('.repo-hero-icon');
480
+
const placeholder = wrapper.querySelector('.repo-hero-icon-placeholder');
481
+
482
+
if (existingImg) {
483
+
existingImg.src = data.avatarURL;
484
+
} else if (placeholder) {
485
+
const newImg = document.createElement('img');
486
+
newImg.src = data.avatarURL;
487
+
newImg.alt = repository;
488
+
newImg.className = 'repo-hero-icon';
489
+
placeholder.replaceWith(newImg);
490
+
}
491
+
} catch (err) {
492
+
console.error('Error uploading avatar:', err);
493
+
alert('Failed to upload avatar: ' + err.message);
494
+
}
495
+
496
+
// Clear input so same file can be selected again
497
+
input.value = '';
498
+
}
499
+
500
// Close modal when clicking outside
501
document.addEventListener('DOMContentLoaded', () => {
502
const modal = document.getElementById('manifest-delete-modal');
···
508
});
509
}
510
});
511
+
512
+
// Login page typeahead functionality
513
+
class LoginTypeahead {
514
+
constructor(inputElement) {
515
+
this.input = inputElement;
516
+
this.dropdown = null;
517
+
this.debounceTimer = null;
518
+
this.currentFocus = -1;
519
+
this.results = [];
520
+
this.isLoading = false;
521
+
522
+
this.init();
523
+
}
524
+
525
+
init() {
526
+
// Create dropdown element
527
+
this.createDropdown();
528
+
529
+
// Event listeners
530
+
this.input.addEventListener('input', (e) => this.handleInput(e));
531
+
this.input.addEventListener('keydown', (e) => this.handleKeydown(e));
532
+
this.input.addEventListener('focus', () => this.handleFocus());
533
+
534
+
// Close dropdown when clicking outside
535
+
document.addEventListener('click', (e) => {
536
+
if (!this.input.contains(e.target) && !this.dropdown.contains(e.target)) {
537
+
this.hideDropdown();
538
+
}
539
+
});
540
+
}
541
+
542
+
createDropdown() {
543
+
this.dropdown = document.createElement('div');
544
+
this.dropdown.className = 'typeahead-dropdown';
545
+
this.dropdown.style.display = 'none';
546
+
this.input.parentNode.insertBefore(this.dropdown, this.input.nextSibling);
547
+
}
548
+
549
+
handleInput(e) {
550
+
const value = e.target.value.trim();
551
+
552
+
// Clear debounce timer
553
+
clearTimeout(this.debounceTimer);
554
+
555
+
if (value.length < 2) {
556
+
this.showRecentAccounts();
557
+
return;
558
+
}
559
+
560
+
// Debounce API call (200ms)
561
+
this.debounceTimer = setTimeout(() => {
562
+
this.searchActors(value);
563
+
}, 200);
564
+
}
565
+
566
+
handleFocus() {
567
+
const value = this.input.value.trim();
568
+
if (value.length < 2) {
569
+
this.showRecentAccounts();
570
+
}
571
+
}
572
+
573
+
async searchActors(query) {
574
+
this.isLoading = true;
575
+
this.showLoading();
576
+
577
+
try {
578
+
const url = `https://public.api.bsky.app/xrpc/app.bsky.actor.searchActorsTypeahead?q=${encodeURIComponent(query)}&limit=3`;
579
+
const response = await fetch(url);
580
+
581
+
if (!response.ok) {
582
+
throw new Error('Failed to fetch suggestions');
583
+
}
584
+
585
+
const data = await response.json();
586
+
this.results = data.actors || [];
587
+
this.renderResults();
588
+
} catch (err) {
589
+
console.error('Typeahead error:', err);
590
+
this.hideDropdown();
591
+
} finally {
592
+
this.isLoading = false;
593
+
}
594
+
}
595
+
596
+
showLoading() {
597
+
this.dropdown.innerHTML = '<div class="typeahead-loading">Searching...</div>';
598
+
this.dropdown.style.display = 'block';
599
+
}
600
+
601
+
renderResults() {
602
+
if (this.results.length === 0) {
603
+
this.hideDropdown();
604
+
return;
605
+
}
606
+
607
+
this.dropdown.innerHTML = '';
608
+
this.currentFocus = -1;
609
+
610
+
this.results.slice(0, 3).forEach((actor, index) => {
611
+
const item = this.createResultItem(actor, index);
612
+
this.dropdown.appendChild(item);
613
+
});
614
+
615
+
this.dropdown.style.display = 'block';
616
+
}
617
+
618
+
createResultItem(actor, index) {
619
+
const item = document.createElement('div');
620
+
item.className = 'typeahead-item';
621
+
item.dataset.index = index;
622
+
item.dataset.handle = actor.handle;
623
+
624
+
// Avatar
625
+
const avatar = document.createElement('img');
626
+
avatar.className = 'typeahead-avatar';
627
+
avatar.src = actor.avatar || '/static/images/default-avatar.png';
628
+
avatar.alt = actor.handle;
629
+
avatar.onerror = () => {
630
+
avatar.src = '/static/images/default-avatar.png';
631
+
};
632
+
633
+
// Text container
634
+
const textContainer = document.createElement('div');
635
+
textContainer.className = 'typeahead-text';
636
+
637
+
// Display name
638
+
const displayName = document.createElement('div');
639
+
displayName.className = 'typeahead-displayname';
640
+
displayName.textContent = actor.displayName || actor.handle;
641
+
642
+
// Handle
643
+
const handle = document.createElement('div');
644
+
handle.className = 'typeahead-handle';
645
+
handle.textContent = `@${actor.handle}`;
646
+
647
+
textContainer.appendChild(displayName);
648
+
textContainer.appendChild(handle);
649
+
650
+
item.appendChild(avatar);
651
+
item.appendChild(textContainer);
652
+
653
+
// Click handler
654
+
item.addEventListener('click', () => this.selectItem(actor.handle));
655
+
656
+
return item;
657
+
}
658
+
659
+
showRecentAccounts() {
660
+
const recent = this.getRecentAccounts();
661
+
if (recent.length === 0) {
662
+
this.hideDropdown();
663
+
return;
664
+
}
665
+
666
+
this.dropdown.innerHTML = '';
667
+
this.currentFocus = -1;
668
+
669
+
const header = document.createElement('div');
670
+
header.className = 'typeahead-header';
671
+
header.textContent = 'Recent accounts';
672
+
this.dropdown.appendChild(header);
673
+
674
+
recent.forEach((handle, index) => {
675
+
const item = document.createElement('div');
676
+
item.className = 'typeahead-item typeahead-recent';
677
+
item.dataset.index = index;
678
+
item.dataset.handle = handle;
679
+
680
+
const textContainer = document.createElement('div');
681
+
textContainer.className = 'typeahead-text';
682
+
683
+
const handleDiv = document.createElement('div');
684
+
handleDiv.className = 'typeahead-handle';
685
+
handleDiv.textContent = handle;
686
+
687
+
textContainer.appendChild(handleDiv);
688
+
item.appendChild(textContainer);
689
+
690
+
item.addEventListener('click', () => this.selectItem(handle));
691
+
692
+
this.dropdown.appendChild(item);
693
+
});
694
+
695
+
this.dropdown.style.display = 'block';
696
+
}
697
+
698
+
selectItem(handle) {
699
+
this.input.value = handle;
700
+
this.hideDropdown();
701
+
this.saveRecentAccount(handle);
702
+
// Optionally submit the form automatically
703
+
// this.input.form.submit();
704
+
}
705
+
706
+
hideDropdown() {
707
+
this.dropdown.style.display = 'none';
708
+
this.currentFocus = -1;
709
+
}
710
+
711
+
handleKeydown(e) {
712
+
// If dropdown is hidden, only respond to ArrowDown to show it
713
+
if (this.dropdown.style.display === 'none') {
714
+
if (e.key === 'ArrowDown') {
715
+
e.preventDefault();
716
+
const value = this.input.value.trim();
717
+
if (value.length >= 2) {
718
+
this.searchActors(value);
719
+
} else {
720
+
this.showRecentAccounts();
721
+
}
722
+
}
723
+
return;
724
+
}
725
+
726
+
const items = this.dropdown.querySelectorAll('.typeahead-item');
727
+
728
+
if (e.key === 'ArrowDown') {
729
+
e.preventDefault();
730
+
this.currentFocus++;
731
+
if (this.currentFocus >= items.length) this.currentFocus = 0;
732
+
this.updateFocus(items);
733
+
} else if (e.key === 'ArrowUp') {
734
+
e.preventDefault();
735
+
this.currentFocus--;
736
+
if (this.currentFocus < 0) this.currentFocus = items.length - 1;
737
+
this.updateFocus(items);
738
+
} else if (e.key === 'Enter') {
739
+
if (this.currentFocus > -1 && items[this.currentFocus]) {
740
+
e.preventDefault();
741
+
const handle = items[this.currentFocus].dataset.handle;
742
+
this.selectItem(handle);
743
+
}
744
+
} else if (e.key === 'Escape') {
745
+
this.hideDropdown();
746
+
}
747
+
}
748
+
749
+
updateFocus(items) {
750
+
items.forEach((item, index) => {
751
+
if (index === this.currentFocus) {
752
+
item.classList.add('typeahead-focused');
753
+
} else {
754
+
item.classList.remove('typeahead-focused');
755
+
}
756
+
});
757
+
}
758
+
759
+
getRecentAccounts() {
760
+
try {
761
+
const recent = localStorage.getItem('atcr_recent_handles');
762
+
return recent ? JSON.parse(recent) : [];
763
+
} catch {
764
+
return [];
765
+
}
766
+
}
767
+
768
+
saveRecentAccount(handle) {
769
+
try {
770
+
let recent = this.getRecentAccounts();
771
+
// Remove if already exists
772
+
recent = recent.filter(h => h !== handle);
773
+
// Add to front
774
+
recent.unshift(handle);
775
+
// Keep only last 5
776
+
recent = recent.slice(0, 5);
777
+
localStorage.setItem('atcr_recent_handles', JSON.stringify(recent));
778
+
} catch (err) {
779
+
console.error('Failed to save recent account:', err);
780
+
}
781
+
}
782
+
}
783
+
784
+
// Initialize typeahead on login page
785
+
document.addEventListener('DOMContentLoaded', () => {
786
+
const handleInput = document.getElementById('handle');
787
+
if (handleInput && handleInput.closest('.login-form')) {
788
+
new LoginTypeahead(handleInput);
789
+
}
790
+
});
+65
-17
pkg/appview/static/static/install.ps1
+65
-17
pkg/appview/static/static/install.ps1
···
6
# Configuration
7
$BinaryName = "docker-credential-atcr.exe"
8
$InstallDir = if ($env:ATCR_INSTALL_DIR) { $env:ATCR_INSTALL_DIR } else { "$env:ProgramFiles\ATCR" }
9
-
$Version = "v0.0.1"
10
-
$TagHash = "c6cfbaf1723123907f9d23e300f6f72081e65006"
11
-
$TangledRepo = "https://tangled.org/@evan.jarrett.net/at-container-registry"
12
13
Write-Host "ATCR Credential Helper Installer for Windows" -ForegroundColor Green
14
Write-Host ""
···
17
function Get-Architecture {
18
$arch = (Get-WmiObject Win32_Processor).Architecture
19
switch ($arch) {
20
-
9 { return "x86_64" } # x64
21
-
12 { return "arm64" } # ARM64
22
default {
23
Write-Host "Unsupported architecture: $arch" -ForegroundColor Red
24
exit 1
···
26
}
27
}
28
29
-
$Arch = Get-Architecture
30
Write-Host "Detected: Windows $Arch" -ForegroundColor Green
31
32
33
if ($env:ATCR_VERSION) {
34
$Version = $env:ATCR_VERSION
35
Write-Host "Using specified version: $Version" -ForegroundColor Yellow
36
} else {
37
-
Write-Host "Using version: $Version" -ForegroundColor Green
38
}
39
40
# Download and install binary
41
function Install-Binary {
42
param (
43
-
[string]$Version,
44
-
[string]$Arch
45
)
46
47
-
$versionClean = $Version.TrimStart('v')
48
-
$fileName = "docker-credential-atcr_${versionClean}_Windows_${Arch}.zip"
49
-
$downloadUrl = "$TangledRepo/tags/$TagHash/download/$fileName"
50
-
51
-
Write-Host "Downloading from: $downloadUrl" -ForegroundColor Yellow
52
53
$tempDir = New-Item -ItemType Directory -Path "$env:TEMP\atcr-install-$(Get-Random)" -Force
54
-
$zipPath = Join-Path $tempDir $fileName
55
56
try {
57
-
Invoke-WebRequest -Uri $downloadUrl -OutFile $zipPath -UseBasicParsing
58
} catch {
59
Write-Host "Failed to download release: $_" -ForegroundColor Red
60
exit 1
···
139
140
# Main installation flow
141
try {
142
-
Install-Binary -Version $Version -Arch $Arch
143
Add-ToPath
144
Test-Installation
145
Show-Configuration
···
6
# Configuration
7
$BinaryName = "docker-credential-atcr.exe"
8
$InstallDir = if ($env:ATCR_INSTALL_DIR) { $env:ATCR_INSTALL_DIR } else { "$env:ProgramFiles\ATCR" }
9
+
$ApiUrl = if ($env:ATCR_API_URL) { $env:ATCR_API_URL } else { "https://atcr.io/api/credential-helper/version" }
10
+
11
+
# Fallback configuration (used if API is unavailable)
12
+
$FallbackVersion = "v0.0.1"
13
+
$FallbackTangledRepo = "https://tangled.org/@evan.jarrett.net/at-container-registry"
14
15
Write-Host "ATCR Credential Helper Installer for Windows" -ForegroundColor Green
16
Write-Host ""
···
19
function Get-Architecture {
20
$arch = (Get-WmiObject Win32_Processor).Architecture
21
switch ($arch) {
22
+
9 { return @{ Display = "x86_64"; Key = "amd64" } } # x64
23
+
12 { return @{ Display = "arm64"; Key = "arm64" } } # ARM64
24
default {
25
Write-Host "Unsupported architecture: $arch" -ForegroundColor Red
26
exit 1
···
28
}
29
}
30
31
+
$ArchInfo = Get-Architecture
32
+
$Arch = $ArchInfo.Display
33
+
$ArchKey = $ArchInfo.Key
34
+
$PlatformKey = "windows_$ArchKey"
35
+
36
Write-Host "Detected: Windows $Arch" -ForegroundColor Green
37
38
+
# Fetch version info from API
39
+
function Get-VersionInfo {
40
+
Write-Host "Fetching latest version info..." -ForegroundColor Yellow
41
+
42
+
try {
43
+
$response = Invoke-WebRequest -Uri $ApiUrl -UseBasicParsing -TimeoutSec 10
44
+
$json = $response.Content | ConvertFrom-Json
45
+
46
+
if ($json.latest -and $json.download_urls.$PlatformKey) {
47
+
return @{
48
+
Version = $json.latest
49
+
DownloadUrl = $json.download_urls.$PlatformKey
50
+
}
51
+
}
52
+
} catch {
53
+
Write-Host "API unavailable, using fallback version" -ForegroundColor Yellow
54
+
}
55
+
56
+
return $null
57
+
}
58
+
59
+
# Get download URL for fallback
60
+
function Get-FallbackUrl {
61
+
param([string]$Version, [string]$Arch)
62
+
63
+
$versionClean = $Version.TrimStart('v')
64
+
# Note: Windows builds use .zip format
65
+
$fileName = "docker-credential-atcr_${versionClean}_Windows_${Arch}.zip"
66
+
return "$FallbackTangledRepo/tags/$Version/download/$fileName"
67
+
}
68
+
69
+
# Determine version and download URL
70
+
$Version = $null
71
+
$DownloadUrl = $null
72
73
if ($env:ATCR_VERSION) {
74
$Version = $env:ATCR_VERSION
75
+
$DownloadUrl = Get-FallbackUrl -Version $Version -Arch $Arch
76
Write-Host "Using specified version: $Version" -ForegroundColor Yellow
77
} else {
78
+
$versionInfo = Get-VersionInfo
79
+
80
+
if ($versionInfo) {
81
+
$Version = $versionInfo.Version
82
+
$DownloadUrl = $versionInfo.DownloadUrl
83
+
Write-Host "Found latest version: $Version" -ForegroundColor Green
84
+
} else {
85
+
$Version = $FallbackVersion
86
+
$DownloadUrl = Get-FallbackUrl -Version $Version -Arch $Arch
87
+
Write-Host "Using fallback version: $Version" -ForegroundColor Yellow
88
+
}
89
}
90
91
+
Write-Host "Installing version: $Version" -ForegroundColor Green
92
+
93
# Download and install binary
94
function Install-Binary {
95
param (
96
+
[string]$DownloadUrl
97
)
98
99
+
Write-Host "Downloading from: $DownloadUrl" -ForegroundColor Yellow
100
101
$tempDir = New-Item -ItemType Directory -Path "$env:TEMP\atcr-install-$(Get-Random)" -Force
102
+
$zipPath = Join-Path $tempDir "docker-credential-atcr.zip"
103
104
try {
105
+
Invoke-WebRequest -Uri $DownloadUrl -OutFile $zipPath -UseBasicParsing
106
} catch {
107
Write-Host "Failed to download release: $_" -ForegroundColor Red
108
exit 1
···
187
188
# Main installation flow
189
try {
190
+
Install-Binary -DownloadUrl $DownloadUrl
191
Add-ToPath
192
Test-Installation
193
Show-Configuration
+63
-13
pkg/appview/static/static/install.sh
+63
-13
pkg/appview/static/static/install.sh
···
13
# Configuration
14
BINARY_NAME="docker-credential-atcr"
15
INSTALL_DIR="${INSTALL_DIR:-/usr/local/bin}"
16
-
VERSION="v0.0.1"
17
-
TAG_HASH="c6cfbaf1723123907f9d23e300f6f72081e65006"
18
-
TANGLED_REPO="https://tangled.org/@evan.jarrett.net/at-container-registry"
19
20
# Detect OS and architecture
21
detect_platform() {
···
25
case "$os" in
26
linux*)
27
OS="Linux"
28
;;
29
darwin*)
30
OS="Darwin"
31
;;
32
*)
33
echo -e "${RED}Unsupported OS: $os${NC}"
···
38
case "$arch" in
39
x86_64|amd64)
40
ARCH="x86_64"
41
;;
42
aarch64|arm64)
43
ARCH="arm64"
44
;;
45
*)
46
echo -e "${RED}Unsupported architecture: $arch${NC}"
47
exit 1
48
;;
49
esac
50
}
51
52
53
# Download and install binary
54
install_binary() {
55
-
local version="${1:-$VERSION}"
56
-
local download_url="${TANGLED_REPO}/tags/${TAG_HASH}/download/docker-credential-atcr_${version#v}_${OS}_${ARCH}.tar.gz"
57
-
58
-
echo -e "${YELLOW}Downloading from: ${download_url}${NC}"
59
60
local tmp_dir=$(mktemp -d)
61
trap "rm -rf $tmp_dir" EXIT
62
63
-
if ! curl -fsSL "$download_url" -o "$tmp_dir/docker-credential-atcr.tar.gz"; then
64
echo -e "${RED}Failed to download release${NC}"
65
exit 1
66
fi
···
120
detect_platform
121
echo -e "Detected: ${GREEN}${OS} ${ARCH}${NC}"
122
123
-
# Allow specifying version via environment variable
124
-
if [ -z "$ATCR_VERSION" ]; then
125
-
echo -e "Using version: ${GREEN}${VERSION}${NC}"
126
-
else
127
VERSION="$ATCR_VERSION"
128
-
echo -e "Using specified version: ${GREEN}${VERSION}${NC}"
129
fi
130
131
install_binary
···
13
# Configuration
14
BINARY_NAME="docker-credential-atcr"
15
INSTALL_DIR="${INSTALL_DIR:-/usr/local/bin}"
16
+
API_URL="${ATCR_API_URL:-https://atcr.io/api/credential-helper/version}"
17
+
18
+
# Fallback configuration (used if API is unavailable)
19
+
FALLBACK_VERSION="v0.0.1"
20
+
FALLBACK_TANGLED_REPO="https://tangled.org/@evan.jarrett.net/at-container-registry"
21
22
# Detect OS and architecture
23
detect_platform() {
···
27
case "$os" in
28
linux*)
29
OS="Linux"
30
+
OS_KEY="linux"
31
;;
32
darwin*)
33
OS="Darwin"
34
+
OS_KEY="darwin"
35
;;
36
*)
37
echo -e "${RED}Unsupported OS: $os${NC}"
···
42
case "$arch" in
43
x86_64|amd64)
44
ARCH="x86_64"
45
+
ARCH_KEY="amd64"
46
;;
47
aarch64|arm64)
48
ARCH="arm64"
49
+
ARCH_KEY="arm64"
50
;;
51
*)
52
echo -e "${RED}Unsupported architecture: $arch${NC}"
53
exit 1
54
;;
55
esac
56
+
57
+
PLATFORM_KEY="${OS_KEY}_${ARCH_KEY}"
58
}
59
60
+
# Fetch version info from API
61
+
fetch_version_info() {
62
+
echo -e "${YELLOW}Fetching latest version info...${NC}"
63
+
64
+
# Try to fetch from API
65
+
local api_response
66
+
if api_response=$(curl -fsSL --max-time 10 "$API_URL" 2>/dev/null); then
67
+
# Parse JSON response (requires jq or basic parsing)
68
+
if command -v jq &> /dev/null; then
69
+
VERSION=$(echo "$api_response" | jq -r '.latest')
70
+
DOWNLOAD_URL=$(echo "$api_response" | jq -r ".download_urls.${PLATFORM_KEY}")
71
+
72
+
if [ "$VERSION" != "null" ] && [ "$DOWNLOAD_URL" != "null" ] && [ -n "$VERSION" ] && [ -n "$DOWNLOAD_URL" ]; then
73
+
echo -e "${GREEN}Found latest version: ${VERSION}${NC}"
74
+
return 0
75
+
fi
76
+
else
77
+
# Fallback: basic grep parsing if jq not available
78
+
VERSION=$(echo "$api_response" | grep -o '"latest":"[^"]*"' | cut -d'"' -f4)
79
+
# Try to extract the specific platform URL
80
+
DOWNLOAD_URL=$(echo "$api_response" | grep -o "\"${PLATFORM_KEY}\":\"[^\"]*\"" | cut -d'"' -f4)
81
+
82
+
if [ -n "$VERSION" ] && [ -n "$DOWNLOAD_URL" ]; then
83
+
echo -e "${GREEN}Found latest version: ${VERSION}${NC}"
84
+
return 0
85
+
fi
86
+
fi
87
+
fi
88
+
89
+
echo -e "${YELLOW}API unavailable, using fallback version${NC}"
90
+
return 1
91
+
}
92
+
93
+
# Set fallback download URL
94
+
use_fallback() {
95
+
VERSION="$FALLBACK_VERSION"
96
+
local version_without_v="${VERSION#v}"
97
+
DOWNLOAD_URL="${FALLBACK_TANGLED_REPO}/tags/${VERSION}/download/docker-credential-atcr_${version_without_v}_${OS}_${ARCH}.tar.gz"
98
+
}
99
100
# Download and install binary
101
install_binary() {
102
+
echo -e "${YELLOW}Downloading from: ${DOWNLOAD_URL}${NC}"
103
104
local tmp_dir=$(mktemp -d)
105
trap "rm -rf $tmp_dir" EXIT
106
107
+
if ! curl -fsSL "$DOWNLOAD_URL" -o "$tmp_dir/docker-credential-atcr.tar.gz"; then
108
echo -e "${RED}Failed to download release${NC}"
109
exit 1
110
fi
···
164
detect_platform
165
echo -e "Detected: ${GREEN}${OS} ${ARCH}${NC}"
166
167
+
# Check if version is manually specified
168
+
if [ -n "$ATCR_VERSION" ]; then
169
+
echo -e "Using specified version: ${GREEN}${ATCR_VERSION}${NC}"
170
VERSION="$ATCR_VERSION"
171
+
local version_without_v="${VERSION#v}"
172
+
DOWNLOAD_URL="${FALLBACK_TANGLED_REPO}/tags/${VERSION}/download/docker-credential-atcr_${version_without_v}_${OS}_${ARCH}.tar.gz"
173
+
else
174
+
# Try to fetch from API, fall back if unavailable
175
+
if ! fetch_version_info; then
176
+
use_fallback
177
+
fi
178
+
echo -e "Installing version: ${GREEN}${VERSION}${NC}"
179
fi
180
181
install_binary
-41
pkg/appview/storage/context.go
-41
pkg/appview/storage/context.go
···
1
-
package storage
2
-
3
-
import (
4
-
"context"
5
-
6
-
"atcr.io/pkg/atproto"
7
-
"atcr.io/pkg/auth"
8
-
"atcr.io/pkg/auth/oauth"
9
-
)
10
-
11
-
// DatabaseMetrics interface for tracking pull/push counts and querying hold DIDs
12
-
type DatabaseMetrics interface {
13
-
IncrementPullCount(did, repository string) error
14
-
IncrementPushCount(did, repository string) error
15
-
GetLatestHoldDIDForRepo(did, repository string) (string, error)
16
-
}
17
-
18
-
// ReadmeCache interface for README content caching
19
-
type ReadmeCache interface {
20
-
Get(ctx context.Context, url string) (string, error)
21
-
Invalidate(url string) error
22
-
}
23
-
24
-
// RegistryContext bundles all the context needed for registry operations
25
-
// This includes both per-request data (DID, hold) and shared services
26
-
type RegistryContext struct {
27
-
// Per-request identity and routing information
28
-
DID string // User's DID (e.g., "did:plc:abc123")
29
-
Handle string // User's handle (e.g., "alice.bsky.social")
30
-
HoldDID string // Hold service DID (e.g., "did:web:hold01.atcr.io")
31
-
PDSEndpoint string // User's PDS endpoint URL
32
-
Repository string // Image repository name (e.g., "debian")
33
-
ServiceToken string // Service token for hold authentication (cached by middleware)
34
-
ATProtoClient *atproto.Client // Authenticated ATProto client for this user
35
-
36
-
// Shared services (same for all requests)
37
-
Database DatabaseMetrics // Metrics tracking database
38
-
Authorizer auth.HoldAuthorizer // Hold access authorization
39
-
Refresher *oauth.Refresher // OAuth session manager
40
-
ReadmeCache ReadmeCache // README content cache
41
-
}
···
-146
pkg/appview/storage/context_test.go
-146
pkg/appview/storage/context_test.go
···
1
-
package storage
2
-
3
-
import (
4
-
"context"
5
-
"sync"
6
-
"testing"
7
-
8
-
"atcr.io/pkg/atproto"
9
-
)
10
-
11
-
// Mock implementations for testing
12
-
type mockDatabaseMetrics struct {
13
-
mu sync.Mutex
14
-
pullCount int
15
-
pushCount int
16
-
}
17
-
18
-
func (m *mockDatabaseMetrics) IncrementPullCount(did, repository string) error {
19
-
m.mu.Lock()
20
-
defer m.mu.Unlock()
21
-
m.pullCount++
22
-
return nil
23
-
}
24
-
25
-
func (m *mockDatabaseMetrics) IncrementPushCount(did, repository string) error {
26
-
m.mu.Lock()
27
-
defer m.mu.Unlock()
28
-
m.pushCount++
29
-
return nil
30
-
}
31
-
32
-
func (m *mockDatabaseMetrics) GetLatestHoldDIDForRepo(did, repository string) (string, error) {
33
-
// Return empty string for mock - tests can override if needed
34
-
return "", nil
35
-
}
36
-
37
-
func (m *mockDatabaseMetrics) getPullCount() int {
38
-
m.mu.Lock()
39
-
defer m.mu.Unlock()
40
-
return m.pullCount
41
-
}
42
-
43
-
func (m *mockDatabaseMetrics) getPushCount() int {
44
-
m.mu.Lock()
45
-
defer m.mu.Unlock()
46
-
return m.pushCount
47
-
}
48
-
49
-
type mockReadmeCache struct{}
50
-
51
-
func (m *mockReadmeCache) Get(ctx context.Context, url string) (string, error) {
52
-
return "# Test README", nil
53
-
}
54
-
55
-
func (m *mockReadmeCache) Invalidate(url string) error {
56
-
return nil
57
-
}
58
-
59
-
type mockHoldAuthorizer struct{}
60
-
61
-
func (m *mockHoldAuthorizer) Authorize(holdDID, userDID, permission string) (bool, error) {
62
-
return true, nil
63
-
}
64
-
65
-
func TestRegistryContext_Fields(t *testing.T) {
66
-
// Create a sample RegistryContext
67
-
ctx := &RegistryContext{
68
-
DID: "did:plc:test123",
69
-
Handle: "alice.bsky.social",
70
-
HoldDID: "did:web:hold01.atcr.io",
71
-
PDSEndpoint: "https://bsky.social",
72
-
Repository: "debian",
73
-
ServiceToken: "test-token",
74
-
ATProtoClient: &atproto.Client{
75
-
// Mock client - would need proper initialization in real tests
76
-
},
77
-
Database: &mockDatabaseMetrics{},
78
-
ReadmeCache: &mockReadmeCache{},
79
-
}
80
-
81
-
// Verify fields are accessible
82
-
if ctx.DID != "did:plc:test123" {
83
-
t.Errorf("Expected DID %q, got %q", "did:plc:test123", ctx.DID)
84
-
}
85
-
if ctx.Handle != "alice.bsky.social" {
86
-
t.Errorf("Expected Handle %q, got %q", "alice.bsky.social", ctx.Handle)
87
-
}
88
-
if ctx.HoldDID != "did:web:hold01.atcr.io" {
89
-
t.Errorf("Expected HoldDID %q, got %q", "did:web:hold01.atcr.io", ctx.HoldDID)
90
-
}
91
-
if ctx.PDSEndpoint != "https://bsky.social" {
92
-
t.Errorf("Expected PDSEndpoint %q, got %q", "https://bsky.social", ctx.PDSEndpoint)
93
-
}
94
-
if ctx.Repository != "debian" {
95
-
t.Errorf("Expected Repository %q, got %q", "debian", ctx.Repository)
96
-
}
97
-
if ctx.ServiceToken != "test-token" {
98
-
t.Errorf("Expected ServiceToken %q, got %q", "test-token", ctx.ServiceToken)
99
-
}
100
-
}
101
-
102
-
func TestRegistryContext_DatabaseInterface(t *testing.T) {
103
-
db := &mockDatabaseMetrics{}
104
-
ctx := &RegistryContext{
105
-
Database: db,
106
-
}
107
-
108
-
// Test that interface methods are callable
109
-
err := ctx.Database.IncrementPullCount("did:plc:test", "repo")
110
-
if err != nil {
111
-
t.Errorf("Unexpected error: %v", err)
112
-
}
113
-
114
-
err = ctx.Database.IncrementPushCount("did:plc:test", "repo")
115
-
if err != nil {
116
-
t.Errorf("Unexpected error: %v", err)
117
-
}
118
-
}
119
-
120
-
func TestRegistryContext_ReadmeCacheInterface(t *testing.T) {
121
-
cache := &mockReadmeCache{}
122
-
ctx := &RegistryContext{
123
-
ReadmeCache: cache,
124
-
}
125
-
126
-
// Test that interface methods are callable
127
-
content, err := ctx.ReadmeCache.Get(context.Background(), "https://example.com/README.md")
128
-
if err != nil {
129
-
t.Errorf("Unexpected error: %v", err)
130
-
}
131
-
if content != "# Test README" {
132
-
t.Errorf("Expected content %q, got %q", "# Test README", content)
133
-
}
134
-
135
-
err = ctx.ReadmeCache.Invalidate("https://example.com/README.md")
136
-
if err != nil {
137
-
t.Errorf("Unexpected error: %v", err)
138
-
}
139
-
}
140
-
141
-
// TODO: Add more comprehensive tests:
142
-
// - Test ATProtoClient integration
143
-
// - Test OAuth Refresher integration
144
-
// - Test HoldAuthorizer integration
145
-
// - Test nil handling for optional fields
146
-
// - Integration tests with real components
···
-93
pkg/appview/storage/crew.go
-93
pkg/appview/storage/crew.go
···
1
-
package storage
2
-
3
-
import (
4
-
"context"
5
-
"fmt"
6
-
"io"
7
-
"log/slog"
8
-
"net/http"
9
-
"time"
10
-
11
-
"atcr.io/pkg/atproto"
12
-
"atcr.io/pkg/auth/oauth"
13
-
"atcr.io/pkg/auth/token"
14
-
)
15
-
16
-
// EnsureCrewMembership attempts to register the user as a crew member on their default hold.
17
-
// The hold's requestCrew endpoint handles all authorization logic (checking allowAllCrew, existing membership, etc).
18
-
// This is best-effort and does not fail on errors.
19
-
func EnsureCrewMembership(ctx context.Context, client *atproto.Client, refresher *oauth.Refresher, defaultHoldDID string) {
20
-
if defaultHoldDID == "" {
21
-
return
22
-
}
23
-
24
-
// Normalize URL to DID if needed
25
-
holdDID := atproto.ResolveHoldDIDFromURL(defaultHoldDID)
26
-
if holdDID == "" {
27
-
slog.Warn("failed to resolve hold DID", "defaultHold", defaultHoldDID)
28
-
return
29
-
}
30
-
31
-
// Resolve hold DID to HTTP endpoint
32
-
holdEndpoint := atproto.ResolveHoldURL(holdDID)
33
-
34
-
// Get service token for the hold
35
-
// Only works with OAuth (refresher required) - app passwords can't get service tokens
36
-
if refresher == nil {
37
-
slog.Debug("skipping crew registration - no OAuth refresher (app password flow)", "holdDID", holdDID)
38
-
return
39
-
}
40
-
41
-
// Wrap the refresher to match OAuthSessionRefresher interface
42
-
serviceToken, err := token.GetOrFetchServiceToken(ctx, refresher, client.DID(), holdDID, client.PDSEndpoint())
43
-
if err != nil {
44
-
slog.Warn("failed to get service token", "holdDID", holdDID, "error", err)
45
-
return
46
-
}
47
-
48
-
// Call requestCrew endpoint - it handles all the logic:
49
-
// - Checks allowAllCrew flag
50
-
// - Checks if already a crew member (returns success if so)
51
-
// - Creates crew record if authorized
52
-
if err := requestCrewMembership(ctx, holdEndpoint, serviceToken); err != nil {
53
-
slog.Warn("failed to request crew membership", "holdDID", holdDID, "error", err)
54
-
return
55
-
}
56
-
57
-
slog.Info("successfully registered as crew member", "holdDID", holdDID, "userDID", client.DID())
58
-
}
59
-
60
-
// requestCrewMembership calls the hold's requestCrew endpoint
61
-
// The endpoint handles all authorization and duplicate checking internally
62
-
func requestCrewMembership(ctx context.Context, holdEndpoint, serviceToken string) error {
63
-
// Add 5 second timeout to prevent hanging on offline holds
64
-
ctx, cancel := context.WithTimeout(ctx, 5*time.Second)
65
-
defer cancel()
66
-
67
-
url := fmt.Sprintf("%s%s", holdEndpoint, atproto.HoldRequestCrew)
68
-
69
-
req, err := http.NewRequestWithContext(ctx, "POST", url, nil)
70
-
if err != nil {
71
-
return err
72
-
}
73
-
74
-
req.Header.Set("Authorization", "Bearer "+serviceToken)
75
-
req.Header.Set("Content-Type", "application/json")
76
-
77
-
resp, err := http.DefaultClient.Do(req)
78
-
if err != nil {
79
-
return err
80
-
}
81
-
defer resp.Body.Close()
82
-
83
-
if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusCreated {
84
-
// Read response body to capture actual error message from hold
85
-
body, readErr := io.ReadAll(resp.Body)
86
-
if readErr != nil {
87
-
return fmt.Errorf("requestCrew failed with status %d (failed to read error body: %w)", resp.StatusCode, readErr)
88
-
}
89
-
return fmt.Errorf("requestCrew failed with status %d: %s", resp.StatusCode, string(body))
90
-
}
91
-
92
-
return nil
93
-
}
···
-14
pkg/appview/storage/crew_test.go
-14
pkg/appview/storage/crew_test.go
···
1
-
package storage
2
-
3
-
import (
4
-
"context"
5
-
"testing"
6
-
)
7
-
8
-
func TestEnsureCrewMembership_EmptyHoldDID(t *testing.T) {
9
-
// Test that empty hold DID returns early without error (best-effort function)
10
-
EnsureCrewMembership(context.Background(), nil, nil, "")
11
-
// If we get here without panic, test passes
12
-
}
13
-
14
-
// TODO: Add comprehensive tests with HTTP client mocking
···
+332
-90
pkg/appview/storage/manifest_store.go
+332
-90
pkg/appview/storage/manifest_store.go
···
3
import (
4
"bytes"
5
"context"
6
"encoding/json"
7
"errors"
8
"fmt"
9
"io"
10
"log/slog"
11
-
"maps"
12
"net/http"
13
"strings"
14
-
"sync"
15
"time"
16
17
"atcr.io/pkg/atproto"
18
"github.com/distribution/distribution/v3"
19
"github.com/opencontainers/go-digest"
20
)
···
22
// ManifestStore implements distribution.ManifestService
23
// It stores manifests in ATProto as records
24
type ManifestStore struct {
25
-
ctx *RegistryContext // Context with user/hold info
26
-
mu sync.RWMutex // Protects lastFetchedHoldDID
27
-
lastFetchedHoldDID string // Hold DID from most recently fetched manifest (for pull)
28
blobStore distribution.BlobStore // Blob store for fetching config during push
29
}
30
31
// NewManifestStore creates a new ATProto-backed manifest store
32
-
func NewManifestStore(ctx *RegistryContext, blobStore distribution.BlobStore) *ManifestStore {
33
return &ManifestStore{
34
-
ctx: ctx,
35
blobStore: blobStore,
36
}
37
}
38
39
// Exists checks if a manifest exists by digest
40
func (s *ManifestStore) Exists(ctx context.Context, dgst digest.Digest) (bool, error) {
41
rkey := digestToRKey(dgst)
42
-
_, err := s.ctx.ATProtoClient.GetRecord(ctx, atproto.ManifestCollection, rkey)
43
if err != nil {
44
// If not found, return false without error
45
if errors.Is(err, atproto.ErrRecordNotFound) {
···
53
// Get retrieves a manifest by digest
54
func (s *ManifestStore) Get(ctx context.Context, dgst digest.Digest, options ...distribution.ManifestServiceOption) (distribution.Manifest, error) {
55
rkey := digestToRKey(dgst)
56
-
record, err := s.ctx.ATProtoClient.GetRecord(ctx, atproto.ManifestCollection, rkey)
57
if err != nil {
58
return nil, distribution.ErrManifestUnknownRevision{
59
-
Name: s.ctx.Repository,
60
Revision: dgst,
61
}
62
}
···
66
return nil, fmt.Errorf("failed to unmarshal manifest record: %w", err)
67
}
68
69
-
// Store the hold DID for subsequent blob requests during pull
70
-
// Prefer HoldDID (new format) with fallback to HoldEndpoint (legacy URL format)
71
-
// The routing repository will cache this for concurrent blob fetches
72
-
s.mu.Lock()
73
-
if manifestRecord.HoldDID != "" {
74
-
// New format: DID reference (preferred)
75
-
s.lastFetchedHoldDID = manifestRecord.HoldDID
76
-
} else if manifestRecord.HoldEndpoint != "" {
77
-
// Legacy format: URL reference - convert to DID
78
-
s.lastFetchedHoldDID = atproto.ResolveHoldDIDFromURL(manifestRecord.HoldEndpoint)
79
-
}
80
-
s.mu.Unlock()
81
-
82
var ociManifest []byte
83
84
// New records: Download blob from ATProto blob storage
85
if manifestRecord.ManifestBlob != nil && manifestRecord.ManifestBlob.Ref.Link != "" {
86
-
ociManifest, err = s.ctx.ATProtoClient.GetBlob(ctx, manifestRecord.ManifestBlob.Ref.Link)
87
if err != nil {
88
return nil, fmt.Errorf("failed to download manifest blob: %w", err)
89
}
···
91
92
// Track pull count (increment asynchronously to avoid blocking the response)
93
// Only count GET requests (actual downloads), not HEAD requests (existence checks)
94
-
if s.ctx.Database != nil {
95
// Check HTTP method from context (distribution library stores it as "http.request.method")
96
if method, ok := ctx.Value("http.request.method").(string); ok && method == "GET" {
97
go func() {
98
-
if err := s.ctx.Database.IncrementPullCount(s.ctx.DID, s.ctx.Repository); err != nil {
99
-
slog.Warn("Failed to increment pull count", "did", s.ctx.DID, "repository", s.ctx.Repository, "error", err)
100
}
101
}()
102
}
···
123
dgst := digest.FromBytes(payload)
124
125
// Upload manifest as blob to PDS
126
-
blobRef, err := s.ctx.ATProtoClient.UploadBlob(ctx, payload, mediaType)
127
if err != nil {
128
return "", fmt.Errorf("failed to upload manifest blob: %w", err)
129
}
130
131
// Create manifest record with structured metadata
132
-
manifestRecord, err := atproto.NewManifestRecord(s.ctx.Repository, dgst.String(), payload)
133
if err != nil {
134
return "", fmt.Errorf("failed to create manifest record: %w", err)
135
}
136
137
// Set the blob reference, hold DID, and hold endpoint
138
manifestRecord.ManifestBlob = blobRef
139
-
manifestRecord.HoldDID = s.ctx.HoldDID // Primary reference (DID)
140
141
// Extract Dockerfile labels from config blob and add to annotations
142
// Only for image manifests (not manifest lists which don't have config blobs)
143
isManifestList := strings.Contains(manifestRecord.MediaType, "manifest.list") ||
144
strings.Contains(manifestRecord.MediaType, "image.index")
145
146
if !isManifestList && s.blobStore != nil && manifestRecord.Config != nil && manifestRecord.Config.Digest != "" {
147
labels, err := s.extractConfigLabels(ctx, manifestRecord.Config.Digest)
148
if err != nil {
149
// Log error but don't fail the push - labels are optional
150
slog.Warn("Failed to extract config labels", "error", err)
151
-
} else {
152
// Initialize annotations map if needed
153
if manifestRecord.Annotations == nil {
154
manifestRecord.Annotations = make(map[string]string)
155
}
156
157
-
// Copy labels to annotations (Dockerfile LABELs โ manifest annotations)
158
-
maps.Copy(manifestRecord.Annotations, labels)
159
160
-
slog.Debug("Extracted labels from config blob", "count", len(labels))
161
}
162
}
163
164
// Store manifest record in ATProto
165
rkey := digestToRKey(dgst)
166
-
_, err = s.ctx.ATProtoClient.PutRecord(ctx, atproto.ManifestCollection, rkey, manifestRecord)
167
if err != nil {
168
return "", fmt.Errorf("failed to store manifest record in ATProto: %w", err)
169
}
170
171
// Track push count (increment asynchronously to avoid blocking the response)
172
-
if s.ctx.Database != nil {
173
go func() {
174
-
if err := s.ctx.Database.IncrementPushCount(s.ctx.DID, s.ctx.Repository); err != nil {
175
-
slog.Warn("Failed to increment push count", "did", s.ctx.DID, "repository", s.ctx.Repository, "error", err)
176
}
177
}()
178
}
···
182
for _, option := range options {
183
if tagOpt, ok := option.(distribution.WithTagOption); ok {
184
tag = tagOpt.Tag
185
-
tagRecord := atproto.NewTagRecord(s.ctx.ATProtoClient.DID(), s.ctx.Repository, tag, dgst.String())
186
-
tagRKey := atproto.RepositoryTagToRKey(s.ctx.Repository, tag)
187
-
_, err = s.ctx.ATProtoClient.PutRecord(ctx, atproto.TagCollection, tagRKey, tagRecord)
188
if err != nil {
189
return "", fmt.Errorf("failed to store tag in ATProto: %w", err)
190
}
···
193
194
// Notify hold about manifest upload (for layer tracking and Bluesky posts)
195
// Do this asynchronously to avoid blocking the push
196
-
if tag != "" && s.ctx.ServiceToken != "" && s.ctx.Handle != "" {
197
-
go func() {
198
defer func() {
199
if r := recover(); r != nil {
200
slog.Error("Panic in notifyHoldAboutManifest", "panic", r)
201
}
202
}()
203
-
if err := s.notifyHoldAboutManifest(context.Background(), manifestRecord, tag, dgst.String()); err != nil {
204
slog.Warn("Failed to notify hold about manifest", "error", err)
205
}
206
-
}()
207
}
208
209
-
// Refresh README cache asynchronously if manifest has io.atcr.readme annotation
210
-
// This ensures fresh README content is available on repository pages
211
go func() {
212
defer func() {
213
if r := recover(); r != nil {
214
-
slog.Error("Panic in refreshReadmeCache", "panic", r)
215
}
216
}()
217
-
s.refreshReadmeCache(context.Background(), manifestRecord)
218
}()
219
220
return dgst, nil
···
223
// Delete removes a manifest
224
func (s *ManifestStore) Delete(ctx context.Context, dgst digest.Digest) error {
225
rkey := digestToRKey(dgst)
226
-
return s.ctx.ATProtoClient.DeleteRecord(ctx, atproto.ManifestCollection, rkey)
227
}
228
229
// digestToRKey converts a digest to an ATProto record key
···
233
return dgst.Encoded()
234
}
235
236
-
// GetLastFetchedHoldDID returns the hold DID from the most recently fetched manifest
237
-
// This is used by the routing repository to cache the hold for blob requests
238
-
func (s *ManifestStore) GetLastFetchedHoldDID() string {
239
-
s.mu.RLock()
240
-
defer s.mu.RUnlock()
241
-
return s.lastFetchedHoldDID
242
-
}
243
-
244
// rawManifest is a simple implementation of distribution.Manifest
245
type rawManifest struct {
246
mediaType string
···
286
287
// notifyHoldAboutManifest notifies the hold service about a manifest upload
288
// This enables the hold to create layer records and Bluesky posts
289
-
func (s *ManifestStore) notifyHoldAboutManifest(ctx context.Context, manifestRecord *atproto.ManifestRecord, tag, manifestDigest string) error {
290
-
// Skip if no service token configured (e.g., anonymous pulls)
291
-
if s.ctx.ServiceToken == "" {
292
return nil
293
}
294
295
// Resolve hold DID to HTTP endpoint
296
// For did:web, this is straightforward (e.g., did:web:hold01.atcr.io โ https://hold01.atcr.io)
297
-
holdEndpoint := atproto.ResolveHoldURL(s.ctx.HoldDID)
298
299
-
// Use service token from middleware (already cached and validated)
300
-
serviceToken := s.ctx.ServiceToken
301
302
// Build notification request
303
manifestData := map[string]any{
···
325
manifestData["layers"] = layers
326
}
327
328
notifyReq := map[string]any{
329
-
"repository": s.ctx.Repository,
330
"tag": tag,
331
-
"userDid": s.ctx.DID,
332
-
"userHandle": s.ctx.Handle,
333
"manifest": manifestData,
334
}
335
···
367
// Parse response (optional logging)
368
var notifyResp map[string]any
369
if err := json.NewDecoder(resp.Body).Decode(¬ifyResp); err == nil {
370
-
slog.Info("Hold notification successful", "repository", s.ctx.Repository, "tag", tag, "response", notifyResp)
371
}
372
373
return nil
374
}
375
376
-
// refreshReadmeCache refreshes the README cache for this manifest if it has io.atcr.readme annotation
377
-
// This should be called asynchronously after manifest push to keep README content fresh
378
-
func (s *ManifestStore) refreshReadmeCache(ctx context.Context, manifestRecord *atproto.ManifestRecord) {
379
-
// Skip if no README cache configured
380
-
if s.ctx.ReadmeCache == nil {
381
return
382
}
383
384
-
// Skip if no annotations or no README URL
385
-
if manifestRecord.Annotations == nil {
386
return
387
}
388
389
-
readmeURL, ok := manifestRecord.Annotations["io.atcr.readme"]
390
-
if !ok || readmeURL == "" {
391
return
392
}
393
394
-
slog.Info("Refreshing README cache", "did", s.ctx.DID, "repository", s.ctx.Repository, "url", readmeURL)
395
396
-
// Invalidate the cached entry first
397
-
if err := s.ctx.ReadmeCache.Invalidate(readmeURL); err != nil {
398
-
slog.Warn("Failed to invalidate README cache", "url", readmeURL, "error", err)
399
-
// Continue anyway - Get() will still fetch fresh content
400
}
401
402
-
// Fetch fresh content to populate cache
403
-
// Use context with timeout to avoid hanging on slow/dead URLs
404
-
ctxWithTimeout, cancel := context.WithTimeout(ctx, 10*time.Second)
405
defer cancel()
406
407
-
_, err := s.ctx.ReadmeCache.Get(ctxWithTimeout, readmeURL)
408
if err != nil {
409
-
slog.Warn("Failed to refresh README cache", "url", readmeURL, "error", err)
410
-
// Not a critical error - cache will be refreshed on next page view
411
-
return
412
}
413
414
-
slog.Info("README cache refreshed successfully", "url", readmeURL)
415
}
···
3
import (
4
"bytes"
5
"context"
6
+
"database/sql"
7
"encoding/json"
8
"errors"
9
"fmt"
10
"io"
11
"log/slog"
12
"net/http"
13
"strings"
14
"time"
15
16
+
"atcr.io/pkg/appview/db"
17
+
"atcr.io/pkg/appview/readme"
18
"atcr.io/pkg/atproto"
19
+
"atcr.io/pkg/auth"
20
"github.com/distribution/distribution/v3"
21
"github.com/opencontainers/go-digest"
22
)
···
24
// ManifestStore implements distribution.ManifestService
25
// It stores manifests in ATProto as records
26
type ManifestStore struct {
27
+
ctx *auth.UserContext // User context with identity, target, permissions
28
blobStore distribution.BlobStore // Blob store for fetching config during push
29
+
sqlDB *sql.DB // Database for pull/push counts
30
}
31
32
// NewManifestStore creates a new ATProto-backed manifest store
33
+
func NewManifestStore(userCtx *auth.UserContext, blobStore distribution.BlobStore, sqlDB *sql.DB) *ManifestStore {
34
return &ManifestStore{
35
+
ctx: userCtx,
36
blobStore: blobStore,
37
+
sqlDB: sqlDB,
38
}
39
}
40
41
// Exists checks if a manifest exists by digest
42
func (s *ManifestStore) Exists(ctx context.Context, dgst digest.Digest) (bool, error) {
43
rkey := digestToRKey(dgst)
44
+
_, err := s.ctx.GetATProtoClient().GetRecord(ctx, atproto.ManifestCollection, rkey)
45
if err != nil {
46
// If not found, return false without error
47
if errors.Is(err, atproto.ErrRecordNotFound) {
···
55
// Get retrieves a manifest by digest
56
func (s *ManifestStore) Get(ctx context.Context, dgst digest.Digest, options ...distribution.ManifestServiceOption) (distribution.Manifest, error) {
57
rkey := digestToRKey(dgst)
58
+
record, err := s.ctx.GetATProtoClient().GetRecord(ctx, atproto.ManifestCollection, rkey)
59
if err != nil {
60
return nil, distribution.ErrManifestUnknownRevision{
61
+
Name: s.ctx.TargetRepo,
62
Revision: dgst,
63
}
64
}
···
68
return nil, fmt.Errorf("failed to unmarshal manifest record: %w", err)
69
}
70
71
var ociManifest []byte
72
73
// New records: Download blob from ATProto blob storage
74
if manifestRecord.ManifestBlob != nil && manifestRecord.ManifestBlob.Ref.Link != "" {
75
+
ociManifest, err = s.ctx.GetATProtoClient().GetBlob(ctx, manifestRecord.ManifestBlob.Ref.Link)
76
if err != nil {
77
return nil, fmt.Errorf("failed to download manifest blob: %w", err)
78
}
···
80
81
// Track pull count (increment asynchronously to avoid blocking the response)
82
// Only count GET requests (actual downloads), not HEAD requests (existence checks)
83
+
if s.sqlDB != nil {
84
// Check HTTP method from context (distribution library stores it as "http.request.method")
85
if method, ok := ctx.Value("http.request.method").(string); ok && method == "GET" {
86
go func() {
87
+
if err := db.IncrementPullCount(s.sqlDB, s.ctx.TargetOwnerDID, s.ctx.TargetRepo); err != nil {
88
+
slog.Warn("Failed to increment pull count", "did", s.ctx.TargetOwnerDID, "repository", s.ctx.TargetRepo, "error", err)
89
}
90
}()
91
}
···
112
dgst := digest.FromBytes(payload)
113
114
// Upload manifest as blob to PDS
115
+
blobRef, err := s.ctx.GetATProtoClient().UploadBlob(ctx, payload, mediaType)
116
if err != nil {
117
return "", fmt.Errorf("failed to upload manifest blob: %w", err)
118
}
119
120
// Create manifest record with structured metadata
121
+
manifestRecord, err := atproto.NewManifestRecord(s.ctx.TargetRepo, dgst.String(), payload)
122
if err != nil {
123
return "", fmt.Errorf("failed to create manifest record: %w", err)
124
}
125
126
// Set the blob reference, hold DID, and hold endpoint
127
manifestRecord.ManifestBlob = blobRef
128
+
manifestRecord.HoldDID = s.ctx.TargetHoldDID // Primary reference (DID)
129
130
// Extract Dockerfile labels from config blob and add to annotations
131
// Only for image manifests (not manifest lists which don't have config blobs)
132
isManifestList := strings.Contains(manifestRecord.MediaType, "manifest.list") ||
133
strings.Contains(manifestRecord.MediaType, "image.index")
134
135
+
// Validate manifest list child references
136
+
// Reject manifest lists that reference non-existent child manifests
137
+
// This matches Docker Hub/ECR behavior and prevents users from accidentally pushing
138
+
// manifest lists where the underlying images don't exist
139
+
if isManifestList {
140
+
for _, ref := range manifestRecord.Manifests {
141
+
// Check if referenced manifest exists in user's PDS
142
+
refDigest, err := digest.Parse(ref.Digest)
143
+
if err != nil {
144
+
return "", fmt.Errorf("invalid digest in manifest list: %s", ref.Digest)
145
+
}
146
+
147
+
exists, err := s.Exists(ctx, refDigest)
148
+
if err != nil {
149
+
return "", fmt.Errorf("failed to check manifest reference: %w", err)
150
+
}
151
+
152
+
if !exists {
153
+
platform := "unknown"
154
+
if ref.Platform != nil {
155
+
platform = fmt.Sprintf("%s/%s", ref.Platform.OS, ref.Platform.Architecture)
156
+
}
157
+
slog.Warn("Manifest list references non-existent child manifest",
158
+
"repository", s.ctx.TargetRepo,
159
+
"missingDigest", ref.Digest,
160
+
"platform", platform)
161
+
return "", distribution.ErrManifestBlobUnknown{Digest: refDigest}
162
+
}
163
+
}
164
+
}
165
+
166
if !isManifestList && s.blobStore != nil && manifestRecord.Config != nil && manifestRecord.Config.Digest != "" {
167
labels, err := s.extractConfigLabels(ctx, manifestRecord.Config.Digest)
168
if err != nil {
169
// Log error but don't fail the push - labels are optional
170
slog.Warn("Failed to extract config labels", "error", err)
171
+
} else if len(labels) > 0 {
172
// Initialize annotations map if needed
173
if manifestRecord.Annotations == nil {
174
manifestRecord.Annotations = make(map[string]string)
175
}
176
177
+
// Copy labels to annotations as fallback
178
+
// Only set label values for keys NOT already in manifest annotations
179
+
// This ensures explicit annotations take precedence over Dockerfile LABELs
180
+
// (which may be inherited from base images)
181
+
for key, value := range labels {
182
+
if _, exists := manifestRecord.Annotations[key]; !exists {
183
+
manifestRecord.Annotations[key] = value
184
+
}
185
+
}
186
187
+
slog.Debug("Merged labels from config blob", "labelsCount", len(labels), "annotationsCount", len(manifestRecord.Annotations))
188
}
189
}
190
191
// Store manifest record in ATProto
192
rkey := digestToRKey(dgst)
193
+
_, err = s.ctx.GetATProtoClient().PutRecord(ctx, atproto.ManifestCollection, rkey, manifestRecord)
194
if err != nil {
195
return "", fmt.Errorf("failed to store manifest record in ATProto: %w", err)
196
}
197
198
// Track push count (increment asynchronously to avoid blocking the response)
199
+
if s.sqlDB != nil {
200
go func() {
201
+
if err := db.IncrementPushCount(s.sqlDB, s.ctx.TargetOwnerDID, s.ctx.TargetRepo); err != nil {
202
+
slog.Warn("Failed to increment push count", "did", s.ctx.TargetOwnerDID, "repository", s.ctx.TargetRepo, "error", err)
203
}
204
}()
205
}
···
209
for _, option := range options {
210
if tagOpt, ok := option.(distribution.WithTagOption); ok {
211
tag = tagOpt.Tag
212
+
tagRecord := atproto.NewTagRecord(s.ctx.GetATProtoClient().DID(), s.ctx.TargetRepo, tag, dgst.String())
213
+
tagRKey := atproto.RepositoryTagToRKey(s.ctx.TargetRepo, tag)
214
+
_, err = s.ctx.GetATProtoClient().PutRecord(ctx, atproto.TagCollection, tagRKey, tagRecord)
215
if err != nil {
216
return "", fmt.Errorf("failed to store tag in ATProto: %w", err)
217
}
···
220
221
// Notify hold about manifest upload (for layer tracking and Bluesky posts)
222
// Do this asynchronously to avoid blocking the push
223
+
// Get service token before goroutine (requires context)
224
+
serviceToken, _ := s.ctx.GetServiceToken(ctx)
225
+
if tag != "" && serviceToken != "" && s.ctx.TargetOwnerHandle != "" {
226
+
go func(serviceToken string) {
227
defer func() {
228
if r := recover(); r != nil {
229
slog.Error("Panic in notifyHoldAboutManifest", "panic", r)
230
}
231
}()
232
+
if err := s.notifyHoldAboutManifest(context.Background(), manifestRecord, tag, dgst.String(), serviceToken); err != nil {
233
slog.Warn("Failed to notify hold about manifest", "error", err)
234
}
235
+
}(serviceToken)
236
}
237
238
+
// Create or update repo page asynchronously if manifest has relevant annotations
239
+
// This ensures repository metadata is synced to user's PDS
240
go func() {
241
defer func() {
242
if r := recover(); r != nil {
243
+
slog.Error("Panic in ensureRepoPage", "panic", r)
244
}
245
}()
246
+
s.ensureRepoPage(context.Background(), manifestRecord)
247
}()
248
249
return dgst, nil
···
252
// Delete removes a manifest
253
func (s *ManifestStore) Delete(ctx context.Context, dgst digest.Digest) error {
254
rkey := digestToRKey(dgst)
255
+
return s.ctx.GetATProtoClient().DeleteRecord(ctx, atproto.ManifestCollection, rkey)
256
}
257
258
// digestToRKey converts a digest to an ATProto record key
···
262
return dgst.Encoded()
263
}
264
265
// rawManifest is a simple implementation of distribution.Manifest
266
type rawManifest struct {
267
mediaType string
···
307
308
// notifyHoldAboutManifest notifies the hold service about a manifest upload
309
// This enables the hold to create layer records and Bluesky posts
310
+
func (s *ManifestStore) notifyHoldAboutManifest(ctx context.Context, manifestRecord *atproto.ManifestRecord, tag, manifestDigest, serviceToken string) error {
311
+
// Skip if no service token provided
312
+
if serviceToken == "" {
313
return nil
314
}
315
316
// Resolve hold DID to HTTP endpoint
317
// For did:web, this is straightforward (e.g., did:web:hold01.atcr.io โ https://hold01.atcr.io)
318
+
holdEndpoint := atproto.ResolveHoldURL(s.ctx.TargetHoldDID)
319
320
+
// Service token is passed in (already cached and validated)
321
322
// Build notification request
323
manifestData := map[string]any{
···
345
manifestData["layers"] = layers
346
}
347
348
+
// Add manifests if present (for multi-arch images / manifest lists)
349
+
if len(manifestRecord.Manifests) > 0 {
350
+
manifests := make([]map[string]any, len(manifestRecord.Manifests))
351
+
for i, m := range manifestRecord.Manifests {
352
+
mData := map[string]any{
353
+
"digest": m.Digest,
354
+
"size": m.Size,
355
+
"mediaType": m.MediaType,
356
+
}
357
+
if m.Platform != nil {
358
+
mData["platform"] = map[string]any{
359
+
"os": m.Platform.OS,
360
+
"architecture": m.Platform.Architecture,
361
+
}
362
+
}
363
+
manifests[i] = mData
364
+
}
365
+
manifestData["manifests"] = manifests
366
+
}
367
+
368
notifyReq := map[string]any{
369
+
"repository": s.ctx.TargetRepo,
370
"tag": tag,
371
+
"userDid": s.ctx.TargetOwnerDID,
372
+
"userHandle": s.ctx.TargetOwnerHandle,
373
"manifest": manifestData,
374
}
375
···
407
// Parse response (optional logging)
408
var notifyResp map[string]any
409
if err := json.NewDecoder(resp.Body).Decode(¬ifyResp); err == nil {
410
+
slog.Info("Hold notification successful", "repository", s.ctx.TargetRepo, "tag", tag, "response", notifyResp)
411
}
412
413
return nil
414
}
415
416
+
// ensureRepoPage creates or updates a repo page record in the user's PDS if needed
417
+
// This syncs repository metadata from manifest annotations to the io.atcr.repo.page collection
418
+
// Only creates a new record if one doesn't exist (doesn't overwrite user's custom content)
419
+
func (s *ManifestStore) ensureRepoPage(ctx context.Context, manifestRecord *atproto.ManifestRecord) {
420
+
// Check if repo page already exists (don't overwrite user's custom content)
421
+
rkey := s.ctx.TargetRepo
422
+
_, err := s.ctx.GetATProtoClient().GetRecord(ctx, atproto.RepoPageCollection, rkey)
423
+
if err == nil {
424
+
// Record already exists - don't overwrite
425
+
slog.Debug("Repo page already exists, skipping creation", "did", s.ctx.TargetOwnerDID, "repository", s.ctx.TargetRepo)
426
return
427
}
428
429
+
// Only continue if it's a "not found" error - other errors mean we should skip
430
+
if !errors.Is(err, atproto.ErrRecordNotFound) {
431
+
slog.Warn("Failed to check for existing repo page", "did", s.ctx.TargetOwnerDID, "repository", s.ctx.TargetRepo, "error", err)
432
return
433
}
434
435
+
// Get annotations (may be nil if image has no OCI labels)
436
+
annotations := manifestRecord.Annotations
437
+
if annotations == nil {
438
+
annotations = make(map[string]string)
439
+
}
440
+
441
+
// Try to fetch README content from external sources
442
+
// Priority: io.atcr.readme annotation > derived from org.opencontainers.image.source > org.opencontainers.image.description
443
+
description := s.fetchReadmeContent(ctx, annotations)
444
+
445
+
// If no README content could be fetched, fall back to description annotation
446
+
if description == "" {
447
+
description = annotations["org.opencontainers.image.description"]
448
+
}
449
+
450
+
// Try to fetch and upload icon from io.atcr.icon annotation
451
+
var avatarRef *atproto.ATProtoBlobRef
452
+
if iconURL := annotations["io.atcr.icon"]; iconURL != "" {
453
+
avatarRef = s.fetchAndUploadIcon(ctx, iconURL)
454
+
}
455
+
456
+
// Create new repo page record with description and optional avatar
457
+
repoPage := atproto.NewRepoPageRecord(s.ctx.TargetRepo, description, avatarRef)
458
+
459
+
slog.Info("Creating repo page from manifest annotations", "did", s.ctx.TargetOwnerDID, "repository", s.ctx.TargetRepo, "descriptionLength", len(description), "hasAvatar", avatarRef != nil)
460
+
461
+
_, err = s.ctx.GetATProtoClient().PutRecord(ctx, atproto.RepoPageCollection, rkey, repoPage)
462
+
if err != nil {
463
+
slog.Warn("Failed to create repo page", "did", s.ctx.TargetOwnerDID, "repository", s.ctx.TargetRepo, "error", err)
464
return
465
}
466
467
+
slog.Info("Repo page created successfully", "did", s.ctx.TargetOwnerDID, "repository", s.ctx.TargetRepo)
468
+
}
469
+
470
+
// fetchReadmeContent attempts to fetch README content from external sources
471
+
// Priority: io.atcr.readme annotation > derived from org.opencontainers.image.source
472
+
// Returns the raw markdown content, or empty string if not available
473
+
func (s *ManifestStore) fetchReadmeContent(ctx context.Context, annotations map[string]string) string {
474
+
475
+
// Create a context with timeout for README fetching (don't block push too long)
476
+
fetchCtx, cancel := context.WithTimeout(ctx, 10*time.Second)
477
+
defer cancel()
478
479
+
// Priority 1: Direct README URL from io.atcr.readme annotation
480
+
if readmeURL := annotations["io.atcr.readme"]; readmeURL != "" {
481
+
content, err := s.fetchRawReadme(fetchCtx, readmeURL)
482
+
if err != nil {
483
+
slog.Debug("Failed to fetch README from io.atcr.readme annotation", "url", readmeURL, "error", err)
484
+
} else if content != "" {
485
+
slog.Info("Fetched README from io.atcr.readme annotation", "url", readmeURL, "length", len(content))
486
+
return content
487
+
}
488
+
}
489
+
490
+
// Priority 2: Derive README URL from org.opencontainers.image.source
491
+
if sourceURL := annotations["org.opencontainers.image.source"]; sourceURL != "" {
492
+
// Try main branch first, then master
493
+
for _, branch := range []string{"main", "master"} {
494
+
readmeURL := readme.DeriveReadmeURL(sourceURL, branch)
495
+
if readmeURL == "" {
496
+
continue
497
+
}
498
+
499
+
content, err := s.fetchRawReadme(fetchCtx, readmeURL)
500
+
if err != nil {
501
+
// Only log non-404 errors (404 is expected when trying main vs master)
502
+
if !readme.Is404(err) {
503
+
slog.Debug("Failed to fetch README from source URL", "url", readmeURL, "branch", branch, "error", err)
504
+
}
505
+
continue
506
+
}
507
+
508
+
if content != "" {
509
+
slog.Info("Fetched README from source URL", "sourceURL", sourceURL, "branch", branch, "length", len(content))
510
+
return content
511
+
}
512
+
}
513
+
}
514
+
515
+
return ""
516
+
}
517
+
518
+
// fetchRawReadme fetches raw markdown content from a URL
519
+
// Returns the raw markdown (not rendered HTML) for storage in the repo page record
520
+
func (s *ManifestStore) fetchRawReadme(ctx context.Context, readmeURL string) (string, error) {
521
+
// Use a simple HTTP client to fetch raw content
522
+
// We want raw markdown, not rendered HTML (the Fetcher renders to HTML)
523
+
req, err := http.NewRequestWithContext(ctx, "GET", readmeURL, nil)
524
+
if err != nil {
525
+
return "", fmt.Errorf("failed to create request: %w", err)
526
+
}
527
+
528
+
req.Header.Set("User-Agent", "ATCR-README-Fetcher/1.0")
529
+
530
+
client := &http.Client{
531
+
Timeout: 10 * time.Second,
532
+
CheckRedirect: func(req *http.Request, via []*http.Request) error {
533
+
if len(via) >= 5 {
534
+
return fmt.Errorf("too many redirects")
535
+
}
536
+
return nil
537
+
},
538
+
}
539
+
540
+
resp, err := client.Do(req)
541
+
if err != nil {
542
+
return "", fmt.Errorf("failed to fetch URL: %w", err)
543
+
}
544
+
defer resp.Body.Close()
545
+
546
+
if resp.StatusCode != http.StatusOK {
547
+
return "", fmt.Errorf("unexpected status code: %d", resp.StatusCode)
548
+
}
549
+
550
+
// Limit content size to 100KB (repo page description has 100KB limit in lexicon)
551
+
limitedReader := io.LimitReader(resp.Body, 100*1024)
552
+
content, err := io.ReadAll(limitedReader)
553
+
if err != nil {
554
+
return "", fmt.Errorf("failed to read response body: %w", err)
555
}
556
557
+
return string(content), nil
558
+
}
559
+
560
+
// fetchAndUploadIcon fetches an image from a URL and uploads it as a blob to the user's PDS
561
+
// Returns the blob reference for use in the repo page record, or nil on error
562
+
func (s *ManifestStore) fetchAndUploadIcon(ctx context.Context, iconURL string) *atproto.ATProtoBlobRef {
563
+
// Create a context with timeout for icon fetching
564
+
fetchCtx, cancel := context.WithTimeout(ctx, 10*time.Second)
565
defer cancel()
566
567
+
// Fetch the icon
568
+
req, err := http.NewRequestWithContext(fetchCtx, "GET", iconURL, nil)
569
+
if err != nil {
570
+
slog.Debug("Failed to create icon request", "url", iconURL, "error", err)
571
+
return nil
572
+
}
573
+
574
+
req.Header.Set("User-Agent", "ATCR-Icon-Fetcher/1.0")
575
+
576
+
client := &http.Client{
577
+
Timeout: 10 * time.Second,
578
+
CheckRedirect: func(req *http.Request, via []*http.Request) error {
579
+
if len(via) >= 5 {
580
+
return fmt.Errorf("too many redirects")
581
+
}
582
+
return nil
583
+
},
584
+
}
585
+
586
+
resp, err := client.Do(req)
587
+
if err != nil {
588
+
slog.Debug("Failed to fetch icon", "url", iconURL, "error", err)
589
+
return nil
590
+
}
591
+
defer resp.Body.Close()
592
+
593
+
if resp.StatusCode != http.StatusOK {
594
+
slog.Debug("Icon fetch returned non-OK status", "url", iconURL, "status", resp.StatusCode)
595
+
return nil
596
+
}
597
+
598
+
// Validate content type - only allow images
599
+
contentType := resp.Header.Get("Content-Type")
600
+
mimeType := detectImageMimeType(contentType, iconURL)
601
+
if mimeType == "" {
602
+
slog.Debug("Icon has unsupported content type", "url", iconURL, "contentType", contentType)
603
+
return nil
604
+
}
605
+
606
+
// Limit icon size to 3MB (matching lexicon maxSize)
607
+
limitedReader := io.LimitReader(resp.Body, 3*1024*1024)
608
+
iconData, err := io.ReadAll(limitedReader)
609
if err != nil {
610
+
slog.Debug("Failed to read icon data", "url", iconURL, "error", err)
611
+
return nil
612
}
613
614
+
if len(iconData) == 0 {
615
+
slog.Debug("Icon data is empty", "url", iconURL)
616
+
return nil
617
+
}
618
+
619
+
// Upload the icon as a blob to the user's PDS
620
+
blobRef, err := s.ctx.GetATProtoClient().UploadBlob(ctx, iconData, mimeType)
621
+
if err != nil {
622
+
slog.Warn("Failed to upload icon blob", "url", iconURL, "error", err)
623
+
return nil
624
+
}
625
+
626
+
slog.Info("Uploaded icon blob", "url", iconURL, "size", len(iconData), "mimeType", mimeType, "cid", blobRef.Ref.Link)
627
+
return blobRef
628
+
}
629
+
630
+
// detectImageMimeType determines the MIME type for an image
631
+
// Uses Content-Type header first, then falls back to extension-based detection
632
+
// Only allows types accepted by the lexicon: image/png, image/jpeg, image/webp
633
+
func detectImageMimeType(contentType, url string) string {
634
+
// Check Content-Type header first
635
+
switch {
636
+
case strings.HasPrefix(contentType, "image/png"):
637
+
return "image/png"
638
+
case strings.HasPrefix(contentType, "image/jpeg"):
639
+
return "image/jpeg"
640
+
case strings.HasPrefix(contentType, "image/webp"):
641
+
return "image/webp"
642
+
}
643
+
644
+
// Fall back to URL extension detection
645
+
lowerURL := strings.ToLower(url)
646
+
switch {
647
+
case strings.HasSuffix(lowerURL, ".png"):
648
+
return "image/png"
649
+
case strings.HasSuffix(lowerURL, ".jpg"), strings.HasSuffix(lowerURL, ".jpeg"):
650
+
return "image/jpeg"
651
+
case strings.HasSuffix(lowerURL, ".webp"):
652
+
return "image/webp"
653
+
}
654
+
655
+
// Unknown or unsupported type - reject
656
+
return ""
657
}
+361
-272
pkg/appview/storage/manifest_store_test.go
+361
-272
pkg/appview/storage/manifest_store_test.go
···
3
import (
4
"context"
5
"encoding/json"
6
"io"
7
"net/http"
8
"net/http/httptest"
9
"testing"
10
-
"time"
11
12
"atcr.io/pkg/atproto"
13
"github.com/distribution/distribution/v3"
14
"github.com/opencontainers/go-digest"
15
)
16
-
17
-
// mockDatabaseMetrics removed - using the one from context_test.go
18
19
// mockBlobStore is a minimal mock of distribution.BlobStore for testing
20
type mockBlobStore struct {
···
71
return nil, nil // Not needed for current tests
72
}
73
74
-
// mockRegistryContext creates a mock RegistryContext for testing
75
-
func mockRegistryContext(client *atproto.Client, repository, holdDID, did, handle string, database DatabaseMetrics) *RegistryContext {
76
-
return &RegistryContext{
77
-
ATProtoClient: client,
78
-
Repository: repository,
79
-
HoldDID: holdDID,
80
-
DID: did,
81
-
Handle: handle,
82
-
Database: database,
83
-
}
84
}
85
86
// TestDigestToRKey tests digest to record key conversion
···
114
115
// TestNewManifestStore tests creating a new manifest store
116
func TestNewManifestStore(t *testing.T) {
117
-
client := atproto.NewClient("https://pds.example.com", "did:plc:test123", "token")
118
blobStore := newMockBlobStore()
119
-
db := &mockDatabaseMetrics{}
120
-
121
-
ctx := mockRegistryContext(client, "myapp", "did:web:hold.example.com", "did:plc:alice123", "alice.test", db)
122
-
store := NewManifestStore(ctx, blobStore)
123
124
-
if store.ctx.Repository != "myapp" {
125
-
t.Errorf("repository = %v, want myapp", store.ctx.Repository)
126
}
127
-
if store.ctx.HoldDID != "did:web:hold.example.com" {
128
-
t.Errorf("holdDID = %v, want did:web:hold.example.com", store.ctx.HoldDID)
129
}
130
-
if store.ctx.DID != "did:plc:alice123" {
131
-
t.Errorf("did = %v, want did:plc:alice123", store.ctx.DID)
132
}
133
-
if store.ctx.Handle != "alice.test" {
134
-
t.Errorf("handle = %v, want alice.test", store.ctx.Handle)
135
-
}
136
-
}
137
-
138
-
// TestManifestStore_GetLastFetchedHoldDID tests tracking last fetched hold DID
139
-
func TestManifestStore_GetLastFetchedHoldDID(t *testing.T) {
140
-
tests := []struct {
141
-
name string
142
-
manifestHoldDID string
143
-
manifestHoldURL string
144
-
expectedLastFetched string
145
-
}{
146
-
{
147
-
name: "prefers HoldDID",
148
-
manifestHoldDID: "did:web:hold01.atcr.io",
149
-
manifestHoldURL: "https://hold01.atcr.io",
150
-
expectedLastFetched: "did:web:hold01.atcr.io",
151
-
},
152
-
{
153
-
name: "falls back to HoldEndpoint URL conversion",
154
-
manifestHoldDID: "",
155
-
manifestHoldURL: "https://hold02.atcr.io",
156
-
expectedLastFetched: "did:web:hold02.atcr.io",
157
-
},
158
-
{
159
-
name: "empty hold references",
160
-
manifestHoldDID: "",
161
-
manifestHoldURL: "",
162
-
expectedLastFetched: "",
163
-
},
164
-
}
165
-
166
-
for _, tt := range tests {
167
-
t.Run(tt.name, func(t *testing.T) {
168
-
client := atproto.NewClient("https://pds.example.com", "did:plc:test123", "token")
169
-
ctx := mockRegistryContext(client, "myapp", "", "did:plc:test123", "test.handle", nil)
170
-
store := NewManifestStore(ctx, nil)
171
-
172
-
// Simulate what happens in Get() when parsing a manifest record
173
-
var manifestRecord atproto.ManifestRecord
174
-
manifestRecord.HoldDID = tt.manifestHoldDID
175
-
manifestRecord.HoldEndpoint = tt.manifestHoldURL
176
-
177
-
// Mimic the hold DID extraction logic from Get()
178
-
if manifestRecord.HoldDID != "" {
179
-
store.lastFetchedHoldDID = manifestRecord.HoldDID
180
-
} else if manifestRecord.HoldEndpoint != "" {
181
-
store.lastFetchedHoldDID = atproto.ResolveHoldDIDFromURL(manifestRecord.HoldEndpoint)
182
-
}
183
-
184
-
got := store.GetLastFetchedHoldDID()
185
-
if got != tt.expectedLastFetched {
186
-
t.Errorf("GetLastFetchedHoldDID() = %v, want %v", got, tt.expectedLastFetched)
187
-
}
188
-
})
189
}
190
}
191
···
240
blobStore.blobs[configDigest] = configData
241
242
// Create manifest store
243
-
client := atproto.NewClient("https://pds.example.com", "did:plc:test123", "token")
244
-
ctx := mockRegistryContext(client, "myapp", "", "did:plc:test123", "test.handle", nil)
245
-
store := NewManifestStore(ctx, blobStore)
246
247
// Extract labels
248
labels, err := store.extractConfigLabels(context.Background(), configDigest.String())
···
280
configDigest := digest.FromBytes(configData)
281
blobStore.blobs[configDigest] = configData
282
283
-
client := atproto.NewClient("https://pds.example.com", "did:plc:test123", "token")
284
-
ctx := mockRegistryContext(client, "myapp", "", "did:plc:test123", "test.handle", nil)
285
-
store := NewManifestStore(ctx, blobStore)
286
287
labels, err := store.extractConfigLabels(context.Background(), configDigest.String())
288
if err != nil {
···
298
// TestExtractConfigLabels_InvalidDigest tests error handling for invalid digest
299
func TestExtractConfigLabels_InvalidDigest(t *testing.T) {
300
blobStore := newMockBlobStore()
301
-
client := atproto.NewClient("https://pds.example.com", "did:plc:test123", "token")
302
-
ctx := mockRegistryContext(client, "myapp", "", "did:plc:test123", "test.handle", nil)
303
-
store := NewManifestStore(ctx, blobStore)
304
305
_, err := store.extractConfigLabels(context.Background(), "invalid-digest")
306
if err == nil {
···
317
configDigest := digest.FromBytes(configData)
318
blobStore.blobs[configDigest] = configData
319
320
-
client := atproto.NewClient("https://pds.example.com", "did:plc:test123", "token")
321
-
ctx := mockRegistryContext(client, "myapp", "", "did:plc:test123", "test.handle", nil)
322
-
store := NewManifestStore(ctx, blobStore)
323
324
_, err := store.extractConfigLabels(context.Background(), configDigest.String())
325
if err == nil {
···
327
}
328
}
329
330
-
// TestManifestStore_WithMetrics tests that metrics are tracked
331
-
func TestManifestStore_WithMetrics(t *testing.T) {
332
-
db := &mockDatabaseMetrics{}
333
-
client := atproto.NewClient("https://pds.example.com", "did:plc:test123", "token")
334
-
ctx := mockRegistryContext(client, "myapp", "did:web:hold.example.com", "did:plc:alice123", "alice.test", db)
335
-
store := NewManifestStore(ctx, nil)
336
337
-
if store.ctx.Database != db {
338
-
t.Error("ManifestStore should store database reference")
339
-
}
340
-
341
-
// Note: Actual metrics tracking happens in Put() and Get() which require
342
-
// full mock setup. The important thing is that the database is wired up.
343
-
}
344
-
345
-
// TestManifestStore_WithoutMetrics tests that nil database is acceptable
346
-
func TestManifestStore_WithoutMetrics(t *testing.T) {
347
-
client := atproto.NewClient("https://pds.example.com", "did:plc:test123", "token")
348
-
ctx := mockRegistryContext(client, "myapp", "did:web:hold.example.com", "did:plc:alice123", "alice.test", nil)
349
-
store := NewManifestStore(ctx, nil)
350
-
351
-
if store.ctx.Database != nil {
352
t.Error("ManifestStore should accept nil database")
353
}
354
}
···
398
}))
399
defer server.Close()
400
401
-
client := atproto.NewClient(server.URL, "did:plc:test123", "token")
402
-
ctx := mockRegistryContext(client, "myapp", "did:web:hold.example.com", "did:plc:test123", "test.handle", nil)
403
-
store := NewManifestStore(ctx, nil)
404
405
exists, err := store.Exists(context.Background(), tt.digest)
406
if (err != nil) != tt.wantErr {
···
516
}))
517
defer server.Close()
518
519
-
client := atproto.NewClient(server.URL, "did:plc:test123", "token")
520
-
db := &mockDatabaseMetrics{}
521
-
ctx := mockRegistryContext(client, "myapp", "did:web:hold.example.com", "did:plc:test123", "test.handle", db)
522
-
store := NewManifestStore(ctx, nil)
523
524
manifest, err := store.Get(context.Background(), tt.digest)
525
if (err != nil) != tt.wantErr {
···
540
}
541
}
542
543
-
// TestManifestStore_Get_HoldDIDTracking tests that Get() stores the holdDID
544
-
func TestManifestStore_Get_HoldDIDTracking(t *testing.T) {
545
-
ociManifest := []byte(`{"schemaVersion":2}`)
546
-
547
-
tests := []struct {
548
-
name string
549
-
manifestResp string
550
-
expectedHoldDID string
551
-
}{
552
-
{
553
-
name: "tracks HoldDID from new format",
554
-
manifestResp: `{
555
-
"uri":"at://did:plc:test123/io.atcr.manifest/abc123",
556
-
"value":{
557
-
"$type":"io.atcr.manifest",
558
-
"holdDid":"did:web:hold01.atcr.io",
559
-
"holdEndpoint":"https://hold01.atcr.io",
560
-
"mediaType":"application/vnd.oci.image.manifest.v1+json",
561
-
"manifestBlob":{"ref":{"$link":"bafytest"},"size":100}
562
-
}
563
-
}`,
564
-
expectedHoldDID: "did:web:hold01.atcr.io",
565
-
},
566
-
{
567
-
name: "tracks HoldDID from legacy HoldEndpoint",
568
-
manifestResp: `{
569
-
"uri":"at://did:plc:test123/io.atcr.manifest/abc123",
570
-
"value":{
571
-
"$type":"io.atcr.manifest",
572
-
"holdEndpoint":"https://hold02.atcr.io",
573
-
"mediaType":"application/vnd.oci.image.manifest.v1+json",
574
-
"manifestBlob":{"ref":{"$link":"bafytest"},"size":100}
575
-
}
576
-
}`,
577
-
expectedHoldDID: "did:web:hold02.atcr.io",
578
-
},
579
-
}
580
-
581
-
for _, tt := range tests {
582
-
t.Run(tt.name, func(t *testing.T) {
583
-
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
584
-
if r.URL.Path == atproto.SyncGetBlob {
585
-
w.Write(ociManifest)
586
-
return
587
-
}
588
-
w.Write([]byte(tt.manifestResp))
589
-
}))
590
-
defer server.Close()
591
-
592
-
client := atproto.NewClient(server.URL, "did:plc:test123", "token")
593
-
ctx := mockRegistryContext(client, "myapp", "", "did:plc:test123", "test.handle", nil)
594
-
store := NewManifestStore(ctx, nil)
595
-
596
-
_, err := store.Get(context.Background(), "sha256:abc123")
597
-
if err != nil {
598
-
t.Fatalf("Get() error = %v", err)
599
-
}
600
-
601
-
gotHoldDID := store.GetLastFetchedHoldDID()
602
-
if gotHoldDID != tt.expectedHoldDID {
603
-
t.Errorf("GetLastFetchedHoldDID() = %v, want %v", gotHoldDID, tt.expectedHoldDID)
604
-
}
605
-
})
606
-
}
607
-
}
608
-
609
-
// TestManifestStore_Get_OnlyCountsGETRequests verifies that HEAD requests don't increment pull count
610
-
func TestManifestStore_Get_OnlyCountsGETRequests(t *testing.T) {
611
-
ociManifest := []byte(`{"schemaVersion":2}`)
612
-
613
-
tests := []struct {
614
-
name string
615
-
httpMethod string
616
-
expectPullIncrement bool
617
-
}{
618
-
{
619
-
name: "GET request increments pull count",
620
-
httpMethod: "GET",
621
-
expectPullIncrement: true,
622
-
},
623
-
{
624
-
name: "HEAD request does not increment pull count",
625
-
httpMethod: "HEAD",
626
-
expectPullIncrement: false,
627
-
},
628
-
{
629
-
name: "POST request does not increment pull count",
630
-
httpMethod: "POST",
631
-
expectPullIncrement: false,
632
-
},
633
-
}
634
-
635
-
for _, tt := range tests {
636
-
t.Run(tt.name, func(t *testing.T) {
637
-
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
638
-
if r.URL.Path == atproto.SyncGetBlob {
639
-
w.Write(ociManifest)
640
-
return
641
-
}
642
-
w.Write([]byte(`{
643
-
"uri": "at://did:plc:test123/io.atcr.manifest/abc123",
644
-
"value": {
645
-
"$type":"io.atcr.manifest",
646
-
"holdDid":"did:web:hold01.atcr.io",
647
-
"mediaType":"application/vnd.oci.image.manifest.v1+json",
648
-
"manifestBlob":{"ref":{"$link":"bafytest"},"size":100}
649
-
}
650
-
}`))
651
-
}))
652
-
defer server.Close()
653
-
654
-
client := atproto.NewClient(server.URL, "did:plc:test123", "token")
655
-
mockDB := &mockDatabaseMetrics{}
656
-
ctx := mockRegistryContext(client, "myapp", "did:web:hold01.atcr.io", "did:plc:test123", "test.handle", mockDB)
657
-
store := NewManifestStore(ctx, nil)
658
-
659
-
// Create a context with the HTTP method stored (as distribution library does)
660
-
testCtx := context.WithValue(context.Background(), "http.request.method", tt.httpMethod)
661
-
662
-
_, err := store.Get(testCtx, "sha256:abc123")
663
-
if err != nil {
664
-
t.Fatalf("Get() error = %v", err)
665
-
}
666
-
667
-
// Wait for async goroutine to complete (metrics are incremented asynchronously)
668
-
time.Sleep(50 * time.Millisecond)
669
-
670
-
if tt.expectPullIncrement {
671
-
// Check that IncrementPullCount was called
672
-
if mockDB.getPullCount() == 0 {
673
-
t.Error("Expected pull count to be incremented for GET request, but it wasn't")
674
-
}
675
-
} else {
676
-
// Check that IncrementPullCount was NOT called
677
-
if mockDB.getPullCount() > 0 {
678
-
t.Errorf("Expected pull count NOT to be incremented for %s request, but it was (count=%d)", tt.httpMethod, mockDB.getPullCount())
679
-
}
680
-
}
681
-
})
682
-
}
683
-
}
684
-
685
// TestManifestStore_Put tests storing manifests
686
func TestManifestStore_Put(t *testing.T) {
687
ociManifest := []byte(`{
···
773
}))
774
defer server.Close()
775
776
-
client := atproto.NewClient(server.URL, "did:plc:test123", "token")
777
-
db := &mockDatabaseMetrics{}
778
-
ctx := mockRegistryContext(client, "myapp", "did:web:hold.example.com", "did:plc:test123", "test.handle", db)
779
-
store := NewManifestStore(ctx, nil)
780
781
dgst, err := store.Put(context.Background(), tt.manifest, tt.options...)
782
if (err != nil) != tt.wantErr {
···
825
}))
826
defer server.Close()
827
828
-
client := atproto.NewClient(server.URL, "did:plc:test123", "token")
829
-
ctx := mockRegistryContext(client, "myapp", "did:web:hold.example.com", "did:plc:test123", "test.handle", nil)
830
831
// Use config digest in manifest
832
ociManifestWithConfig := []byte(`{
···
841
payload: ociManifestWithConfig,
842
}
843
844
-
store := NewManifestStore(ctx, blobStore)
845
846
_, err := store.Put(context.Background(), manifest)
847
if err != nil {
···
901
}))
902
defer server.Close()
903
904
-
client := atproto.NewClient(server.URL, "did:plc:test123", "token")
905
-
ctx := mockRegistryContext(client, "myapp", "did:web:hold.example.com", "did:plc:test123", "test.handle", nil)
906
-
store := NewManifestStore(ctx, nil)
907
908
err := store.Delete(context.Background(), tt.digest)
909
if (err != nil) != tt.wantErr {
···
912
})
913
}
914
}
···
3
import (
4
"context"
5
"encoding/json"
6
+
"errors"
7
"io"
8
"net/http"
9
"net/http/httptest"
10
"testing"
11
12
"atcr.io/pkg/atproto"
13
+
"atcr.io/pkg/auth"
14
"github.com/distribution/distribution/v3"
15
"github.com/opencontainers/go-digest"
16
)
17
18
// mockBlobStore is a minimal mock of distribution.BlobStore for testing
19
type mockBlobStore struct {
···
70
return nil, nil // Not needed for current tests
71
}
72
73
+
// mockUserContextForManifest creates a mock auth.UserContext for manifest store testing
74
+
func mockUserContextForManifest(pdsEndpoint, repository, holdDID, ownerDID, ownerHandle string) *auth.UserContext {
75
+
userCtx := auth.NewUserContext(ownerDID, "oauth", "PUT", nil)
76
+
userCtx.SetTarget(ownerDID, ownerHandle, pdsEndpoint, repository, holdDID)
77
+
return userCtx
78
}
79
80
// TestDigestToRKey tests digest to record key conversion
···
108
109
// TestNewManifestStore tests creating a new manifest store
110
func TestNewManifestStore(t *testing.T) {
111
blobStore := newMockBlobStore()
112
+
userCtx := mockUserContextForManifest(
113
+
"https://pds.example.com",
114
+
"myapp",
115
+
"did:web:hold.example.com",
116
+
"did:plc:alice123",
117
+
"alice.test",
118
+
)
119
+
store := NewManifestStore(userCtx, blobStore, nil)
120
121
+
if store.ctx.TargetRepo != "myapp" {
122
+
t.Errorf("repository = %v, want myapp", store.ctx.TargetRepo)
123
}
124
+
if store.ctx.TargetHoldDID != "did:web:hold.example.com" {
125
+
t.Errorf("holdDID = %v, want did:web:hold.example.com", store.ctx.TargetHoldDID)
126
}
127
+
if store.ctx.TargetOwnerDID != "did:plc:alice123" {
128
+
t.Errorf("did = %v, want did:plc:alice123", store.ctx.TargetOwnerDID)
129
}
130
+
if store.ctx.TargetOwnerHandle != "alice.test" {
131
+
t.Errorf("handle = %v, want alice.test", store.ctx.TargetOwnerHandle)
132
}
133
}
134
···
183
blobStore.blobs[configDigest] = configData
184
185
// Create manifest store
186
+
userCtx := mockUserContextForManifest(
187
+
"https://pds.example.com",
188
+
"myapp",
189
+
"",
190
+
"did:plc:test123",
191
+
"test.handle",
192
+
)
193
+
store := NewManifestStore(userCtx, blobStore, nil)
194
195
// Extract labels
196
labels, err := store.extractConfigLabels(context.Background(), configDigest.String())
···
228
configDigest := digest.FromBytes(configData)
229
blobStore.blobs[configDigest] = configData
230
231
+
userCtx := mockUserContextForManifest(
232
+
"https://pds.example.com",
233
+
"myapp",
234
+
"",
235
+
"did:plc:test123",
236
+
"test.handle",
237
+
)
238
+
store := NewManifestStore(userCtx, blobStore, nil)
239
240
labels, err := store.extractConfigLabels(context.Background(), configDigest.String())
241
if err != nil {
···
251
// TestExtractConfigLabels_InvalidDigest tests error handling for invalid digest
252
func TestExtractConfigLabels_InvalidDigest(t *testing.T) {
253
blobStore := newMockBlobStore()
254
+
userCtx := mockUserContextForManifest(
255
+
"https://pds.example.com",
256
+
"myapp",
257
+
"",
258
+
"did:plc:test123",
259
+
"test.handle",
260
+
)
261
+
store := NewManifestStore(userCtx, blobStore, nil)
262
263
_, err := store.extractConfigLabels(context.Background(), "invalid-digest")
264
if err == nil {
···
275
configDigest := digest.FromBytes(configData)
276
blobStore.blobs[configDigest] = configData
277
278
+
userCtx := mockUserContextForManifest(
279
+
"https://pds.example.com",
280
+
"myapp",
281
+
"",
282
+
"did:plc:test123",
283
+
"test.handle",
284
+
)
285
+
store := NewManifestStore(userCtx, blobStore, nil)
286
287
_, err := store.extractConfigLabels(context.Background(), configDigest.String())
288
if err == nil {
···
290
}
291
}
292
293
+
// TestManifestStore_WithoutDatabase tests that nil database is acceptable
294
+
func TestManifestStore_WithoutDatabase(t *testing.T) {
295
+
userCtx := mockUserContextForManifest(
296
+
"https://pds.example.com",
297
+
"myapp",
298
+
"did:web:hold.example.com",
299
+
"did:plc:alice123",
300
+
"alice.test",
301
+
)
302
+
store := NewManifestStore(userCtx, nil, nil)
303
304
+
if store.sqlDB != nil {
305
t.Error("ManifestStore should accept nil database")
306
}
307
}
···
351
}))
352
defer server.Close()
353
354
+
userCtx := mockUserContextForManifest(
355
+
server.URL,
356
+
"myapp",
357
+
"did:web:hold.example.com",
358
+
"did:plc:test123",
359
+
"test.handle",
360
+
)
361
+
store := NewManifestStore(userCtx, nil, nil)
362
363
exists, err := store.Exists(context.Background(), tt.digest)
364
if (err != nil) != tt.wantErr {
···
474
}))
475
defer server.Close()
476
477
+
userCtx := mockUserContextForManifest(
478
+
server.URL,
479
+
"myapp",
480
+
"did:web:hold.example.com",
481
+
"did:plc:test123",
482
+
"test.handle",
483
+
)
484
+
store := NewManifestStore(userCtx, nil, nil)
485
486
manifest, err := store.Get(context.Background(), tt.digest)
487
if (err != nil) != tt.wantErr {
···
502
}
503
}
504
505
// TestManifestStore_Put tests storing manifests
506
func TestManifestStore_Put(t *testing.T) {
507
ociManifest := []byte(`{
···
593
}))
594
defer server.Close()
595
596
+
userCtx := mockUserContextForManifest(
597
+
server.URL,
598
+
"myapp",
599
+
"did:web:hold.example.com",
600
+
"did:plc:test123",
601
+
"test.handle",
602
+
)
603
+
store := NewManifestStore(userCtx, nil, nil)
604
605
dgst, err := store.Put(context.Background(), tt.manifest, tt.options...)
606
if (err != nil) != tt.wantErr {
···
649
}))
650
defer server.Close()
651
652
+
userCtx := mockUserContextForManifest(
653
+
server.URL,
654
+
"myapp",
655
+
"did:web:hold.example.com",
656
+
"did:plc:test123",
657
+
"test.handle",
658
+
)
659
660
// Use config digest in manifest
661
ociManifestWithConfig := []byte(`{
···
670
payload: ociManifestWithConfig,
671
}
672
673
+
store := NewManifestStore(userCtx, blobStore, nil)
674
675
_, err := store.Put(context.Background(), manifest)
676
if err != nil {
···
730
}))
731
defer server.Close()
732
733
+
userCtx := mockUserContextForManifest(
734
+
server.URL,
735
+
"myapp",
736
+
"did:web:hold.example.com",
737
+
"did:plc:test123",
738
+
"test.handle",
739
+
)
740
+
store := NewManifestStore(userCtx, nil, nil)
741
742
err := store.Delete(context.Background(), tt.digest)
743
if (err != nil) != tt.wantErr {
···
746
})
747
}
748
}
749
+
750
+
// TestManifestStore_Put_ManifestListValidation tests validation of manifest list child references
751
+
func TestManifestStore_Put_ManifestListValidation(t *testing.T) {
752
+
// Create a valid child manifest that exists
753
+
childManifest := []byte(`{
754
+
"schemaVersion":2,
755
+
"mediaType":"application/vnd.oci.image.manifest.v1+json",
756
+
"config":{"digest":"sha256:config123","size":100},
757
+
"layers":[{"digest":"sha256:layer1","size":200}]
758
+
}`)
759
+
childDigest := digest.FromBytes(childManifest)
760
+
761
+
tests := []struct {
762
+
name string
763
+
manifestList []byte
764
+
childExists bool // Whether the child manifest exists
765
+
wantErr bool
766
+
wantErrType string // "ErrManifestBlobUnknown" or empty
767
+
checkErrDigest string // Expected digest in error
768
+
}{
769
+
{
770
+
name: "valid manifest list - child exists",
771
+
manifestList: []byte(`{
772
+
"schemaVersion":2,
773
+
"mediaType":"application/vnd.oci.image.index.v1+json",
774
+
"manifests":[
775
+
{"digest":"` + childDigest.String() + `","size":300,"mediaType":"application/vnd.oci.image.manifest.v1+json","platform":{"os":"linux","architecture":"amd64"}}
776
+
]
777
+
}`),
778
+
childExists: true,
779
+
wantErr: false,
780
+
},
781
+
{
782
+
name: "invalid manifest list - child does not exist",
783
+
manifestList: []byte(`{
784
+
"schemaVersion":2,
785
+
"mediaType":"application/vnd.oci.image.index.v1+json",
786
+
"manifests":[
787
+
{"digest":"sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef","size":300,"mediaType":"application/vnd.oci.image.manifest.v1+json","platform":{"os":"linux","architecture":"amd64"}}
788
+
]
789
+
}`),
790
+
childExists: false,
791
+
wantErr: true,
792
+
wantErrType: "ErrManifestBlobUnknown",
793
+
checkErrDigest: "sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
794
+
},
795
+
{
796
+
name: "attestation-only manifest list - attestation must also exist",
797
+
manifestList: []byte(`{
798
+
"schemaVersion":2,
799
+
"mediaType":"application/vnd.oci.image.index.v1+json",
800
+
"manifests":[
801
+
{"digest":"sha256:4444444444444444444444444444444444444444444444444444444444444444","size":100,"mediaType":"application/vnd.oci.image.manifest.v1+json","platform":{"os":"unknown","architecture":"unknown"}}
802
+
]
803
+
}`),
804
+
childExists: false,
805
+
wantErr: true,
806
+
wantErrType: "ErrManifestBlobUnknown",
807
+
checkErrDigest: "sha256:4444444444444444444444444444444444444444444444444444444444444444",
808
+
},
809
+
{
810
+
name: "mixed manifest list - real platform missing, attestation present",
811
+
manifestList: []byte(`{
812
+
"schemaVersion":2,
813
+
"mediaType":"application/vnd.oci.image.index.v1+json",
814
+
"manifests":[
815
+
{"digest":"sha256:1111111111111111111111111111111111111111111111111111111111111111","size":300,"mediaType":"application/vnd.oci.image.manifest.v1+json","platform":{"os":"linux","architecture":"arm64"}},
816
+
{"digest":"sha256:5555555555555555555555555555555555555555555555555555555555555555","size":100,"mediaType":"application/vnd.oci.image.manifest.v1+json","platform":{"os":"unknown","architecture":"unknown"}}
817
+
]
818
+
}`),
819
+
childExists: false,
820
+
wantErr: true,
821
+
wantErrType: "ErrManifestBlobUnknown",
822
+
checkErrDigest: "sha256:1111111111111111111111111111111111111111111111111111111111111111",
823
+
},
824
+
{
825
+
name: "docker manifest list media type - child missing",
826
+
manifestList: []byte(`{
827
+
"schemaVersion":2,
828
+
"mediaType":"application/vnd.docker.distribution.manifest.list.v2+json",
829
+
"manifests":[
830
+
{"digest":"sha256:2222222222222222222222222222222222222222222222222222222222222222","size":300,"mediaType":"application/vnd.docker.distribution.manifest.v2+json","platform":{"os":"linux","architecture":"amd64"}}
831
+
]
832
+
}`),
833
+
childExists: false,
834
+
wantErr: true,
835
+
wantErrType: "ErrManifestBlobUnknown",
836
+
checkErrDigest: "sha256:2222222222222222222222222222222222222222222222222222222222222222",
837
+
},
838
+
{
839
+
name: "manifest list with nil platform - should still validate",
840
+
manifestList: []byte(`{
841
+
"schemaVersion":2,
842
+
"mediaType":"application/vnd.oci.image.index.v1+json",
843
+
"manifests":[
844
+
{"digest":"sha256:3333333333333333333333333333333333333333333333333333333333333333","size":300,"mediaType":"application/vnd.oci.image.manifest.v1+json"}
845
+
]
846
+
}`),
847
+
childExists: false,
848
+
wantErr: true,
849
+
wantErrType: "ErrManifestBlobUnknown",
850
+
checkErrDigest: "sha256:3333333333333333333333333333333333333333333333333333333333333333",
851
+
},
852
+
}
853
+
854
+
for _, tt := range tests {
855
+
t.Run(tt.name, func(t *testing.T) {
856
+
// Track GetRecord calls for manifest existence checks
857
+
getRecordCalls := make(map[string]bool)
858
+
859
+
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
860
+
// Handle uploadBlob
861
+
if r.URL.Path == atproto.RepoUploadBlob {
862
+
w.WriteHeader(http.StatusOK)
863
+
w.Write([]byte(`{"blob":{"$type":"blob","ref":{"$link":"bafytest"},"mimeType":"application/json","size":100}}`))
864
+
return
865
+
}
866
+
867
+
// Handle getRecord (for Exists check)
868
+
if r.URL.Path == atproto.RepoGetRecord {
869
+
rkey := r.URL.Query().Get("rkey")
870
+
getRecordCalls[rkey] = true
871
+
872
+
// If child should exist, return it; otherwise return RecordNotFound
873
+
if tt.childExists || rkey == childDigest.Encoded() {
874
+
w.WriteHeader(http.StatusOK)
875
+
w.Write([]byte(`{"uri":"at://did:plc:test123/io.atcr.manifest/` + rkey + `","cid":"bafytest","value":{}}`))
876
+
} else {
877
+
w.WriteHeader(http.StatusBadRequest)
878
+
w.Write([]byte(`{"error":"RecordNotFound","message":"Record not found"}`))
879
+
}
880
+
return
881
+
}
882
+
883
+
// Handle putRecord
884
+
if r.URL.Path == atproto.RepoPutRecord {
885
+
w.WriteHeader(http.StatusOK)
886
+
w.Write([]byte(`{"uri":"at://did:plc:test123/io.atcr.manifest/test123","cid":"bafytest"}`))
887
+
return
888
+
}
889
+
890
+
w.WriteHeader(http.StatusOK)
891
+
}))
892
+
defer server.Close()
893
+
894
+
userCtx := mockUserContextForManifest(
895
+
server.URL,
896
+
"myapp",
897
+
"did:web:hold.example.com",
898
+
"did:plc:test123",
899
+
"test.handle",
900
+
)
901
+
store := NewManifestStore(userCtx, nil, nil)
902
+
903
+
manifest := &rawManifest{
904
+
mediaType: "application/vnd.oci.image.index.v1+json",
905
+
payload: tt.manifestList,
906
+
}
907
+
908
+
_, err := store.Put(context.Background(), manifest)
909
+
910
+
if (err != nil) != tt.wantErr {
911
+
t.Errorf("Put() error = %v, wantErr %v", err, tt.wantErr)
912
+
return
913
+
}
914
+
915
+
if tt.wantErr && tt.wantErrType == "ErrManifestBlobUnknown" {
916
+
// Check that the error is of the correct type
917
+
var blobErr distribution.ErrManifestBlobUnknown
918
+
if !errors.As(err, &blobErr) {
919
+
t.Errorf("Put() error type = %T, want distribution.ErrManifestBlobUnknown", err)
920
+
return
921
+
}
922
+
923
+
// Check that the error contains the expected digest
924
+
if tt.checkErrDigest != "" {
925
+
expectedDigest, _ := digest.Parse(tt.checkErrDigest)
926
+
if blobErr.Digest != expectedDigest {
927
+
t.Errorf("ErrManifestBlobUnknown.Digest = %v, want %v", blobErr.Digest, expectedDigest)
928
+
}
929
+
}
930
+
}
931
+
})
932
+
}
933
+
}
934
+
935
+
// TestManifestStore_Put_ManifestListValidation_MultipleChildren tests validation with multiple child manifests
936
+
func TestManifestStore_Put_ManifestListValidation_MultipleChildren(t *testing.T) {
937
+
// Create two valid child manifests
938
+
childManifest1 := []byte(`{"schemaVersion":2,"mediaType":"application/vnd.oci.image.manifest.v1+json","config":{"digest":"sha256:config1","size":100},"layers":[]}`)
939
+
childManifest2 := []byte(`{"schemaVersion":2,"mediaType":"application/vnd.oci.image.manifest.v1+json","config":{"digest":"sha256:config2","size":100},"layers":[]}`)
940
+
childDigest1 := digest.FromBytes(childManifest1)
941
+
childDigest2 := digest.FromBytes(childManifest2)
942
+
943
+
// Track which manifests exist
944
+
existingManifests := map[string]bool{
945
+
childDigest1.Encoded(): true,
946
+
childDigest2.Encoded(): true,
947
+
}
948
+
949
+
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
950
+
if r.URL.Path == atproto.RepoUploadBlob {
951
+
w.Write([]byte(`{"blob":{"$type":"blob","ref":{"$link":"bafytest"},"size":100}}`))
952
+
return
953
+
}
954
+
955
+
if r.URL.Path == atproto.RepoGetRecord {
956
+
rkey := r.URL.Query().Get("rkey")
957
+
if existingManifests[rkey] {
958
+
w.Write([]byte(`{"uri":"at://did:plc:test123/io.atcr.manifest/` + rkey + `","cid":"bafytest","value":{}}`))
959
+
} else {
960
+
w.WriteHeader(http.StatusBadRequest)
961
+
w.Write([]byte(`{"error":"RecordNotFound"}`))
962
+
}
963
+
return
964
+
}
965
+
966
+
if r.URL.Path == atproto.RepoPutRecord {
967
+
w.Write([]byte(`{"uri":"at://did:plc:test123/io.atcr.manifest/test123","cid":"bafytest"}`))
968
+
return
969
+
}
970
+
971
+
w.WriteHeader(http.StatusOK)
972
+
}))
973
+
defer server.Close()
974
+
975
+
userCtx := mockUserContextForManifest(
976
+
server.URL,
977
+
"myapp",
978
+
"did:web:hold.example.com",
979
+
"did:plc:test123",
980
+
"test.handle",
981
+
)
982
+
store := NewManifestStore(userCtx, nil, nil)
983
+
984
+
// Create manifest list with both children
985
+
manifestList := []byte(`{
986
+
"schemaVersion":2,
987
+
"mediaType":"application/vnd.oci.image.index.v1+json",
988
+
"manifests":[
989
+
{"digest":"` + childDigest1.String() + `","size":300,"mediaType":"application/vnd.oci.image.manifest.v1+json","platform":{"os":"linux","architecture":"amd64"}},
990
+
{"digest":"` + childDigest2.String() + `","size":300,"mediaType":"application/vnd.oci.image.manifest.v1+json","platform":{"os":"linux","architecture":"arm64"}}
991
+
]
992
+
}`)
993
+
994
+
manifest := &rawManifest{
995
+
mediaType: "application/vnd.oci.image.index.v1+json",
996
+
payload: manifestList,
997
+
}
998
+
999
+
_, err := store.Put(context.Background(), manifest)
1000
+
if err != nil {
1001
+
t.Errorf("Put() should succeed when all child manifests exist, got error: %v", err)
1002
+
}
1003
+
}
+26
-28
pkg/appview/storage/proxy_blob_store.go
+26
-28
pkg/appview/storage/proxy_blob_store.go
···
12
"time"
13
14
"atcr.io/pkg/atproto"
15
"github.com/distribution/distribution/v3"
16
"github.com/distribution/distribution/v3/registry/api/errcode"
17
"github.com/opencontainers/go-digest"
···
32
33
// ProxyBlobStore proxies blob requests to an external storage service
34
type ProxyBlobStore struct {
35
-
ctx *RegistryContext // All context and services
36
-
holdURL string // Resolved HTTP URL for XRPC requests
37
httpClient *http.Client
38
}
39
40
// NewProxyBlobStore creates a new proxy blob store
41
-
func NewProxyBlobStore(ctx *RegistryContext) *ProxyBlobStore {
42
// Resolve DID to URL once at construction time
43
-
holdURL := atproto.ResolveHoldURL(ctx.HoldDID)
44
45
-
slog.Debug("NewProxyBlobStore created", "component", "proxy_blob_store", "hold_did", ctx.HoldDID, "hold_url", holdURL, "user_did", ctx.DID, "repo", ctx.Repository)
46
47
return &ProxyBlobStore{
48
-
ctx: ctx,
49
holdURL: holdURL,
50
httpClient: &http.Client{
51
Timeout: 5 * time.Minute, // Timeout for presigned URL requests and uploads
···
61
}
62
63
// doAuthenticatedRequest performs an HTTP request with service token authentication
64
-
// Uses the service token from middleware to authenticate requests to the hold service
65
func (p *ProxyBlobStore) doAuthenticatedRequest(ctx context.Context, req *http.Request) (*http.Response, error) {
66
-
// Use service token that middleware already validated and cached
67
-
// Middleware fails fast with HTTP 401 if OAuth session is invalid
68
-
if p.ctx.ServiceToken == "" {
69
// Should never happen - middleware validates OAuth before handlers run
70
slog.Error("No service token in context", "component", "proxy_blob_store", "did", p.ctx.DID)
71
return nil, fmt.Errorf("no service token available (middleware should have validated)")
72
}
73
74
// Add Bearer token to Authorization header
75
-
req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", p.ctx.ServiceToken))
76
77
return p.httpClient.Do(req)
78
}
79
80
// checkReadAccess validates that the user has read access to blobs in this hold
81
func (p *ProxyBlobStore) checkReadAccess(ctx context.Context) error {
82
-
if p.ctx.Authorizer == nil {
83
-
return nil // No authorization check if authorizer not configured
84
-
}
85
-
allowed, err := p.ctx.Authorizer.CheckReadAccess(ctx, p.ctx.HoldDID, p.ctx.DID)
86
if err != nil {
87
return fmt.Errorf("authorization check failed: %w", err)
88
}
89
-
if !allowed {
90
// Return 403 Forbidden instead of masquerading as missing blob
91
return errcode.ErrorCodeDenied.WithMessage("read access denied")
92
}
···
95
96
// checkWriteAccess validates that the user has write access to blobs in this hold
97
func (p *ProxyBlobStore) checkWriteAccess(ctx context.Context) error {
98
-
if p.ctx.Authorizer == nil {
99
-
return nil // No authorization check if authorizer not configured
100
-
}
101
-
102
-
slog.Debug("Checking write access", "component", "proxy_blob_store", "user_did", p.ctx.DID, "hold_did", p.ctx.HoldDID)
103
-
allowed, err := p.ctx.Authorizer.CheckWriteAccess(ctx, p.ctx.HoldDID, p.ctx.DID)
104
if err != nil {
105
slog.Error("Authorization check error", "component", "proxy_blob_store", "error", err)
106
return fmt.Errorf("authorization check failed: %w", err)
107
}
108
-
if !allowed {
109
-
slog.Warn("Write access denied", "component", "proxy_blob_store", "user_did", p.ctx.DID, "hold_did", p.ctx.HoldDID)
110
-
return errcode.ErrorCodeDenied.WithMessage(fmt.Sprintf("write access denied to hold %s", p.ctx.HoldDID))
111
}
112
-
slog.Debug("Write access allowed", "component", "proxy_blob_store", "user_did", p.ctx.DID, "hold_did", p.ctx.HoldDID)
113
return nil
114
}
115
···
356
// getPresignedURL returns the XRPC endpoint URL for blob operations
357
func (p *ProxyBlobStore) getPresignedURL(ctx context.Context, operation string, dgst digest.Digest) (string, error) {
358
// Use XRPC endpoint: /xrpc/com.atproto.sync.getBlob?did={userDID}&cid={digest}
359
-
// The 'did' parameter is the USER's DID (whose blob we're fetching), not the hold service DID
360
// Per migration doc: hold accepts OCI digest directly as cid parameter (checks for sha256: prefix)
361
xrpcURL := fmt.Sprintf("%s%s?did=%s&cid=%s&method=%s",
362
-
p.holdURL, atproto.SyncGetBlob, p.ctx.DID, dgst.String(), operation)
363
364
req, err := http.NewRequestWithContext(ctx, "GET", xrpcURL, nil)
365
if err != nil {
···
12
"time"
13
14
"atcr.io/pkg/atproto"
15
+
"atcr.io/pkg/auth"
16
"github.com/distribution/distribution/v3"
17
"github.com/distribution/distribution/v3/registry/api/errcode"
18
"github.com/opencontainers/go-digest"
···
33
34
// ProxyBlobStore proxies blob requests to an external storage service
35
type ProxyBlobStore struct {
36
+
ctx *auth.UserContext // User context with identity, target, permissions
37
+
holdURL string // Resolved HTTP URL for XRPC requests
38
httpClient *http.Client
39
}
40
41
// NewProxyBlobStore creates a new proxy blob store
42
+
func NewProxyBlobStore(userCtx *auth.UserContext) *ProxyBlobStore {
43
// Resolve DID to URL once at construction time
44
+
holdURL := atproto.ResolveHoldURL(userCtx.TargetHoldDID)
45
46
+
slog.Debug("NewProxyBlobStore created", "component", "proxy_blob_store", "hold_did", userCtx.TargetHoldDID, "hold_url", holdURL, "user_did", userCtx.TargetOwnerDID, "repo", userCtx.TargetRepo)
47
48
return &ProxyBlobStore{
49
+
ctx: userCtx,
50
holdURL: holdURL,
51
httpClient: &http.Client{
52
Timeout: 5 * time.Minute, // Timeout for presigned URL requests and uploads
···
62
}
63
64
// doAuthenticatedRequest performs an HTTP request with service token authentication
65
+
// Uses the service token from UserContext to authenticate requests to the hold service
66
func (p *ProxyBlobStore) doAuthenticatedRequest(ctx context.Context, req *http.Request) (*http.Response, error) {
67
+
// Get service token from UserContext (lazy-loaded and cached per holdDID)
68
+
serviceToken, err := p.ctx.GetServiceToken(ctx)
69
+
if err != nil {
70
+
slog.Error("Failed to get service token", "component", "proxy_blob_store", "did", p.ctx.DID, "error", err)
71
+
return nil, fmt.Errorf("failed to get service token: %w", err)
72
+
}
73
+
if serviceToken == "" {
74
// Should never happen - middleware validates OAuth before handlers run
75
slog.Error("No service token in context", "component", "proxy_blob_store", "did", p.ctx.DID)
76
return nil, fmt.Errorf("no service token available (middleware should have validated)")
77
}
78
79
// Add Bearer token to Authorization header
80
+
req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", serviceToken))
81
82
return p.httpClient.Do(req)
83
}
84
85
// checkReadAccess validates that the user has read access to blobs in this hold
86
func (p *ProxyBlobStore) checkReadAccess(ctx context.Context) error {
87
+
canRead, err := p.ctx.CanRead(ctx)
88
if err != nil {
89
return fmt.Errorf("authorization check failed: %w", err)
90
}
91
+
if !canRead {
92
// Return 403 Forbidden instead of masquerading as missing blob
93
return errcode.ErrorCodeDenied.WithMessage("read access denied")
94
}
···
97
98
// checkWriteAccess validates that the user has write access to blobs in this hold
99
func (p *ProxyBlobStore) checkWriteAccess(ctx context.Context) error {
100
+
slog.Debug("Checking write access", "component", "proxy_blob_store", "user_did", p.ctx.DID, "hold_did", p.ctx.TargetHoldDID)
101
+
canWrite, err := p.ctx.CanWrite(ctx)
102
if err != nil {
103
slog.Error("Authorization check error", "component", "proxy_blob_store", "error", err)
104
return fmt.Errorf("authorization check failed: %w", err)
105
}
106
+
if !canWrite {
107
+
slog.Warn("Write access denied", "component", "proxy_blob_store", "user_did", p.ctx.DID, "hold_did", p.ctx.TargetHoldDID)
108
+
return errcode.ErrorCodeDenied.WithMessage(fmt.Sprintf("write access denied to hold %s", p.ctx.TargetHoldDID))
109
}
110
+
slog.Debug("Write access allowed", "component", "proxy_blob_store", "user_did", p.ctx.DID, "hold_did", p.ctx.TargetHoldDID)
111
return nil
112
}
113
···
354
// getPresignedURL returns the XRPC endpoint URL for blob operations
355
func (p *ProxyBlobStore) getPresignedURL(ctx context.Context, operation string, dgst digest.Digest) (string, error) {
356
// Use XRPC endpoint: /xrpc/com.atproto.sync.getBlob?did={userDID}&cid={digest}
357
+
// The 'did' parameter is the TARGET OWNER's DID (whose blob we're fetching), not the hold service DID
358
// Per migration doc: hold accepts OCI digest directly as cid parameter (checks for sha256: prefix)
359
xrpcURL := fmt.Sprintf("%s%s?did=%s&cid=%s&method=%s",
360
+
p.holdURL, atproto.SyncGetBlob, p.ctx.TargetOwnerDID, dgst.String(), operation)
361
362
req, err := http.NewRequestWithContext(ctx, "GET", xrpcURL, nil)
363
if err != nil {
+78
-420
pkg/appview/storage/proxy_blob_store_test.go
+78
-420
pkg/appview/storage/proxy_blob_store_test.go
···
1
package storage
2
3
import (
4
-
"context"
5
"encoding/base64"
6
-
"encoding/json"
7
"fmt"
8
-
"net/http"
9
-
"net/http/httptest"
10
"strings"
11
"testing"
12
"time"
13
14
"atcr.io/pkg/atproto"
15
-
"atcr.io/pkg/auth/token"
16
-
"github.com/opencontainers/go-digest"
17
)
18
19
-
// TestGetServiceToken_CachingLogic tests the token caching mechanism
20
func TestGetServiceToken_CachingLogic(t *testing.T) {
21
-
userDID := "did:plc:test"
22
holdDID := "did:web:hold.example.com"
23
24
// Test 1: Empty cache - invalidate any existing token
25
-
token.InvalidateServiceToken(userDID, holdDID)
26
-
cachedToken, _ := token.GetServiceToken(userDID, holdDID)
27
if cachedToken != "" {
28
t.Error("Expected empty cache at start")
29
}
30
31
// Test 2: Insert token into cache
32
// Create a JWT-like token with exp claim for testing
33
-
// Format: header.payload.signature where payload has exp claim
34
testPayload := fmt.Sprintf(`{"exp":%d}`, time.Now().Add(50*time.Second).Unix())
35
testToken := "eyJhbGciOiJIUzI1NiJ9." + base64URLEncode(testPayload) + ".signature"
36
37
-
err := token.SetServiceToken(userDID, holdDID, testToken)
38
if err != nil {
39
t.Fatalf("Failed to set service token: %v", err)
40
}
41
42
// Test 3: Retrieve from cache
43
-
cachedToken, expiresAt := token.GetServiceToken(userDID, holdDID)
44
if cachedToken == "" {
45
t.Fatal("Expected token to be in cache")
46
}
···
56
// Test 4: Expired token - GetServiceToken automatically removes it
57
expiredPayload := fmt.Sprintf(`{"exp":%d}`, time.Now().Add(-1*time.Hour).Unix())
58
expiredToken := "eyJhbGciOiJIUzI1NiJ9." + base64URLEncode(expiredPayload) + ".signature"
59
-
token.SetServiceToken(userDID, holdDID, expiredToken)
60
61
// GetServiceToken should return empty string for expired token
62
-
cachedToken, _ = token.GetServiceToken(userDID, holdDID)
63
if cachedToken != "" {
64
t.Error("Expected expired token to be removed from cache")
65
}
···
70
return strings.TrimRight(base64.URLEncoding.EncodeToString([]byte(data)), "=")
71
}
72
73
-
// TestServiceToken_EmptyInContext tests that operations fail when service token is missing
74
-
func TestServiceToken_EmptyInContext(t *testing.T) {
75
-
ctx := &RegistryContext{
76
-
DID: "did:plc:test",
77
-
HoldDID: "did:web:hold.example.com",
78
-
PDSEndpoint: "https://pds.example.com",
79
-
Repository: "test-repo",
80
-
ServiceToken: "", // No service token (middleware didn't set it)
81
-
Refresher: nil,
82
-
}
83
84
-
store := NewProxyBlobStore(ctx)
85
86
-
// Try a write operation that requires authentication
87
-
testDigest := digest.FromString("test-content")
88
-
_, err := store.Stat(context.Background(), testDigest)
89
90
-
// Should fail because no service token is available
91
-
if err == nil {
92
-
t.Error("Expected error when service token is empty")
93
-
}
94
95
-
// Error should indicate authentication issue
96
-
if !strings.Contains(err.Error(), "UNAUTHORIZED") && !strings.Contains(err.Error(), "authentication") {
97
-
t.Logf("Got error (acceptable): %v", err)
98
-
}
99
}
100
101
-
// TestDoAuthenticatedRequest_BearerTokenInjection tests that Bearer tokens are added to requests
102
-
func TestDoAuthenticatedRequest_BearerTokenInjection(t *testing.T) {
103
-
// This test verifies the Bearer token injection logic
104
-
105
-
testToken := "test-bearer-token-xyz"
106
-
107
-
// Create a test server to verify the Authorization header
108
-
var receivedAuthHeader string
109
-
testServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
110
-
receivedAuthHeader = r.Header.Get("Authorization")
111
-
w.WriteHeader(http.StatusOK)
112
-
}))
113
-
defer testServer.Close()
114
-
115
-
// Create ProxyBlobStore with service token in context (set by middleware)
116
-
ctx := &RegistryContext{
117
-
DID: "did:plc:bearer-test",
118
-
HoldDID: "did:web:hold.example.com",
119
-
PDSEndpoint: "https://pds.example.com",
120
-
Repository: "test-repo",
121
-
ServiceToken: testToken, // Service token from middleware
122
-
Refresher: nil,
123
-
}
124
-
125
-
store := NewProxyBlobStore(ctx)
126
-
127
-
// Create request
128
-
req, err := http.NewRequest(http.MethodGet, testServer.URL+"/test", nil)
129
-
if err != nil {
130
-
t.Fatalf("Failed to create request: %v", err)
131
-
}
132
-
133
-
// Do authenticated request
134
-
resp, err := store.doAuthenticatedRequest(context.Background(), req)
135
-
if err != nil {
136
-
t.Fatalf("doAuthenticatedRequest failed: %v", err)
137
-
}
138
-
defer resp.Body.Close()
139
-
140
-
// Verify Bearer token was added
141
-
expectedHeader := "Bearer " + testToken
142
-
if receivedAuthHeader != expectedHeader {
143
-
t.Errorf("Expected Authorization header %s, got %s", expectedHeader, receivedAuthHeader)
144
-
}
145
}
146
147
-
// TestDoAuthenticatedRequest_ErrorWhenTokenUnavailable tests that authentication failures return proper errors
148
-
func TestDoAuthenticatedRequest_ErrorWhenTokenUnavailable(t *testing.T) {
149
-
// Create test server (should not be called since auth fails first)
150
-
called := false
151
-
testServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
152
-
called = true
153
-
w.WriteHeader(http.StatusOK)
154
-
}))
155
-
defer testServer.Close()
156
-
157
-
// Create ProxyBlobStore without service token (middleware didn't set it)
158
-
ctx := &RegistryContext{
159
-
DID: "did:plc:fallback",
160
-
HoldDID: "did:web:hold.example.com",
161
-
PDSEndpoint: "https://pds.example.com",
162
-
Repository: "test-repo",
163
-
ServiceToken: "", // No service token
164
-
Refresher: nil,
165
-
}
166
-
167
-
store := NewProxyBlobStore(ctx)
168
-
169
-
// Create request
170
-
req, err := http.NewRequest(http.MethodGet, testServer.URL+"/test", nil)
171
-
if err != nil {
172
-
t.Fatalf("Failed to create request: %v", err)
173
-
}
174
-
175
-
// Do authenticated request - should fail when no service token
176
-
resp, err := store.doAuthenticatedRequest(context.Background(), req)
177
-
if err == nil {
178
-
t.Fatal("Expected doAuthenticatedRequest to fail when no service token is available")
179
-
}
180
-
if resp != nil {
181
-
resp.Body.Close()
182
-
}
183
-
184
-
// Verify error indicates authentication/authorization issue
185
-
errStr := err.Error()
186
-
if !strings.Contains(errStr, "service token") && !strings.Contains(errStr, "UNAUTHORIZED") {
187
-
t.Errorf("Expected service token or unauthorized error, got: %v", err)
188
-
}
189
-
190
-
if called {
191
-
t.Error("Expected request to NOT be made when authentication fails")
192
-
}
193
-
}
194
-
195
-
// TestResolveHoldURL tests DID to URL conversion
196
func TestResolveHoldURL(t *testing.T) {
197
tests := []struct {
198
name string
···
200
expected string
201
}{
202
{
203
-
name: "did:web with http (TEST_MODE)",
204
holdDID: "did:web:localhost:8080",
205
expected: "http://localhost:8080",
206
},
···
228
229
// TestServiceTokenCacheExpiry tests that expired cached tokens are not used
230
func TestServiceTokenCacheExpiry(t *testing.T) {
231
-
userDID := "did:plc:expiry"
232
holdDID := "did:web:hold.example.com"
233
234
// Insert expired token
235
expiredPayload := fmt.Sprintf(`{"exp":%d}`, time.Now().Add(-1*time.Hour).Unix())
236
expiredToken := "eyJhbGciOiJIUzI1NiJ9." + base64URLEncode(expiredPayload) + ".signature"
237
-
token.SetServiceToken(userDID, holdDID, expiredToken)
238
239
// GetServiceToken should automatically remove expired tokens
240
-
cachedToken, expiresAt := token.GetServiceToken(userDID, holdDID)
241
242
// Should return empty string for expired token
243
if cachedToken != "" {
···
272
273
// TestNewProxyBlobStore tests ProxyBlobStore creation
274
func TestNewProxyBlobStore(t *testing.T) {
275
-
ctx := &RegistryContext{
276
-
DID: "did:plc:test",
277
-
HoldDID: "did:web:hold.example.com",
278
-
PDSEndpoint: "https://pds.example.com",
279
-
Repository: "test-repo",
280
-
}
281
282
-
store := NewProxyBlobStore(ctx)
283
284
if store == nil {
285
t.Fatal("Expected non-nil ProxyBlobStore")
286
}
287
288
-
if store.ctx != ctx {
289
t.Error("Expected context to be set")
290
}
291
···
310
311
testPayload := fmt.Sprintf(`{"exp":%d}`, time.Now().Add(50*time.Second).Unix())
312
testTokenStr := "eyJhbGciOiJIUzI1NiJ9." + base64URLEncode(testPayload) + ".signature"
313
-
token.SetServiceToken(userDID, holdDID, testTokenStr)
314
315
for b.Loop() {
316
-
cachedToken, expiresAt := token.GetServiceToken(userDID, holdDID)
317
318
if cachedToken == "" || time.Now().After(expiresAt) {
319
b.Error("Cache miss in benchmark")
···
321
}
322
}
323
324
-
// TestCompleteMultipartUpload_JSONFormat verifies the JSON request format sent to hold service
325
-
// This test would have caught the "partNumber" vs "part_number" bug
326
-
func TestCompleteMultipartUpload_JSONFormat(t *testing.T) {
327
-
var capturedBody map[string]any
328
-
329
-
// Mock hold service that captures the request body
330
-
holdServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
331
-
if !strings.Contains(r.URL.Path, atproto.HoldCompleteUpload) {
332
-
t.Errorf("Wrong endpoint called: %s", r.URL.Path)
333
-
}
334
-
335
-
// Capture request body
336
-
var body map[string]any
337
-
if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
338
-
t.Errorf("Failed to decode request body: %v", err)
339
-
}
340
-
capturedBody = body
341
-
342
-
w.Header().Set("Content-Type", "application/json")
343
-
w.WriteHeader(http.StatusOK)
344
-
w.Write([]byte(`{}`))
345
-
}))
346
-
defer holdServer.Close()
347
-
348
-
// Create store with mocked hold URL
349
-
ctx := &RegistryContext{
350
-
DID: "did:plc:test",
351
-
HoldDID: "did:web:hold.example.com",
352
-
PDSEndpoint: "https://pds.example.com",
353
-
Repository: "test-repo",
354
-
ServiceToken: "test-service-token", // Service token from middleware
355
-
}
356
-
store := NewProxyBlobStore(ctx)
357
-
store.holdURL = holdServer.URL
358
-
359
-
// Call completeMultipartUpload
360
-
parts := []CompletedPart{
361
-
{PartNumber: 1, ETag: "etag-1"},
362
-
{PartNumber: 2, ETag: "etag-2"},
363
-
}
364
-
err := store.completeMultipartUpload(context.Background(), "sha256:abc123", "upload-id-xyz", parts)
365
-
if err != nil {
366
-
t.Fatalf("completeMultipartUpload failed: %v", err)
367
-
}
368
-
369
-
// Verify JSON format
370
-
if capturedBody == nil {
371
-
t.Fatal("No request body was captured")
372
-
}
373
-
374
-
// Check top-level fields
375
-
if uploadID, ok := capturedBody["uploadId"].(string); !ok || uploadID != "upload-id-xyz" {
376
-
t.Errorf("Expected uploadId='upload-id-xyz', got %v", capturedBody["uploadId"])
377
-
}
378
-
if digest, ok := capturedBody["digest"].(string); !ok || digest != "sha256:abc123" {
379
-
t.Errorf("Expected digest='sha256:abc123', got %v", capturedBody["digest"])
380
-
}
381
-
382
-
// Check parts array
383
-
partsArray, ok := capturedBody["parts"].([]any)
384
-
if !ok {
385
-
t.Fatalf("Expected parts to be array, got %T", capturedBody["parts"])
386
-
}
387
-
if len(partsArray) != 2 {
388
-
t.Fatalf("Expected 2 parts, got %d", len(partsArray))
389
-
}
390
-
391
-
// Verify first part has "part_number" (not "partNumber")
392
-
part0, ok := partsArray[0].(map[string]any)
393
-
if !ok {
394
-
t.Fatalf("Expected part to be object, got %T", partsArray[0])
395
-
}
396
-
397
-
// THIS IS THE KEY CHECK - would have caught the bug
398
-
if _, hasPartNumber := part0["partNumber"]; hasPartNumber {
399
-
t.Error("Found 'partNumber' (camelCase) - should be 'part_number' (snake_case)")
400
-
}
401
-
if partNum, ok := part0["part_number"].(float64); !ok || int(partNum) != 1 {
402
-
t.Errorf("Expected part_number=1, got %v", part0["part_number"])
403
-
}
404
-
if etag, ok := part0["etag"].(string); !ok || etag != "etag-1" {
405
-
t.Errorf("Expected etag='etag-1', got %v", part0["etag"])
406
-
}
407
-
}
408
409
-
// TestGet_UsesPresignedURLDirectly verifies that Get() doesn't add auth headers to presigned URLs
410
-
// This test would have caught the presigned URL authentication bug
411
-
func TestGet_UsesPresignedURLDirectly(t *testing.T) {
412
-
blobData := []byte("test blob content")
413
-
var s3ReceivedAuthHeader string
414
-
415
-
// Mock S3 server that rejects requests with Authorization header
416
-
s3Server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
417
-
s3ReceivedAuthHeader = r.Header.Get("Authorization")
418
-
419
-
// Presigned URLs should NOT have Authorization header
420
-
if s3ReceivedAuthHeader != "" {
421
-
t.Errorf("S3 received Authorization header: %s (should be empty for presigned URLs)", s3ReceivedAuthHeader)
422
-
w.WriteHeader(http.StatusForbidden)
423
-
w.Write([]byte(`<?xml version="1.0"?><Error><Code>SignatureDoesNotMatch</Code></Error>`))
424
-
return
425
-
}
426
-
427
-
// Return blob data
428
-
w.WriteHeader(http.StatusOK)
429
-
w.Write(blobData)
430
-
}))
431
-
defer s3Server.Close()
432
-
433
-
// Mock hold service that returns presigned S3 URL
434
-
holdServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
435
-
// Return presigned URL pointing to S3 server
436
-
w.Header().Set("Content-Type", "application/json")
437
-
w.WriteHeader(http.StatusOK)
438
-
resp := map[string]string{
439
-
"url": s3Server.URL + "/blob?X-Amz-Signature=fake-signature",
440
-
}
441
-
json.NewEncoder(w).Encode(resp)
442
-
}))
443
-
defer holdServer.Close()
444
-
445
-
// Create store with service token in context
446
-
ctx := &RegistryContext{
447
-
DID: "did:plc:test",
448
-
HoldDID: "did:web:hold.example.com",
449
-
PDSEndpoint: "https://pds.example.com",
450
-
Repository: "test-repo",
451
-
ServiceToken: "test-service-token", // Service token from middleware
452
-
}
453
-
store := NewProxyBlobStore(ctx)
454
-
store.holdURL = holdServer.URL
455
-
456
-
// Call Get()
457
-
dgst := digest.FromBytes(blobData)
458
-
retrieved, err := store.Get(context.Background(), dgst)
459
if err != nil {
460
-
t.Fatalf("Get() failed: %v", err)
461
}
462
463
-
// Verify correct data was retrieved
464
-
if string(retrieved) != string(blobData) {
465
-
t.Errorf("Expected data=%s, got %s", string(blobData), string(retrieved))
466
-
}
467
-
468
-
// Verify S3 received NO Authorization header
469
-
if s3ReceivedAuthHeader != "" {
470
-
t.Errorf("S3 should not receive Authorization header for presigned URLs, got: %s", s3ReceivedAuthHeader)
471
}
472
}
473
474
-
// TestOpen_UsesPresignedURLDirectly verifies that Open() doesn't add auth headers to presigned URLs
475
-
// This test would have caught the presigned URL authentication bug
476
-
func TestOpen_UsesPresignedURLDirectly(t *testing.T) {
477
-
blobData := []byte("test blob stream content")
478
-
var s3ReceivedAuthHeader string
479
-
480
-
// Mock S3 server
481
-
s3Server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
482
-
s3ReceivedAuthHeader = r.Header.Get("Authorization")
483
-
484
-
// Presigned URLs should NOT have Authorization header
485
-
if s3ReceivedAuthHeader != "" {
486
-
t.Errorf("S3 received Authorization header: %s (should be empty)", s3ReceivedAuthHeader)
487
-
w.WriteHeader(http.StatusForbidden)
488
-
return
489
-
}
490
-
491
-
w.WriteHeader(http.StatusOK)
492
-
w.Write(blobData)
493
-
}))
494
-
defer s3Server.Close()
495
-
496
-
// Mock hold service
497
-
holdServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
498
-
w.Header().Set("Content-Type", "application/json")
499
-
w.WriteHeader(http.StatusOK)
500
-
json.NewEncoder(w).Encode(map[string]string{
501
-
"url": s3Server.URL + "/blob?X-Amz-Signature=fake",
502
-
})
503
-
}))
504
-
defer holdServer.Close()
505
-
506
-
// Create store with service token in context
507
-
ctx := &RegistryContext{
508
-
DID: "did:plc:test",
509
-
HoldDID: "did:web:hold.example.com",
510
-
PDSEndpoint: "https://pds.example.com",
511
-
Repository: "test-repo",
512
-
ServiceToken: "test-service-token", // Service token from middleware
513
-
}
514
-
store := NewProxyBlobStore(ctx)
515
-
store.holdURL = holdServer.URL
516
-
517
-
// Call Open()
518
-
dgst := digest.FromBytes(blobData)
519
-
reader, err := store.Open(context.Background(), dgst)
520
-
if err != nil {
521
-
t.Fatalf("Open() failed: %v", err)
522
-
}
523
-
defer reader.Close()
524
-
525
-
// Verify S3 received NO Authorization header
526
-
if s3ReceivedAuthHeader != "" {
527
-
t.Errorf("S3 should not receive Authorization header for presigned URLs, got: %s", s3ReceivedAuthHeader)
528
-
}
529
-
}
530
-
531
-
// TestMultipartEndpoints_CorrectURLs verifies all multipart XRPC endpoints use correct URLs
532
-
// This would have caught the old com.atproto.repo.uploadBlob vs new io.atcr.hold.* endpoints
533
-
func TestMultipartEndpoints_CorrectURLs(t *testing.T) {
534
tests := []struct {
535
-
name string
536
-
testFunc func(*ProxyBlobStore) error
537
-
expectedPath string
538
}{
539
-
{
540
-
name: "startMultipartUpload",
541
-
testFunc: func(store *ProxyBlobStore) error {
542
-
_, err := store.startMultipartUpload(context.Background(), "sha256:test")
543
-
return err
544
-
},
545
-
expectedPath: atproto.HoldInitiateUpload,
546
-
},
547
-
{
548
-
name: "getPartUploadInfo",
549
-
testFunc: func(store *ProxyBlobStore) error {
550
-
_, err := store.getPartUploadInfo(context.Background(), "sha256:test", "upload-123", 1)
551
-
return err
552
-
},
553
-
expectedPath: atproto.HoldGetPartUploadURL,
554
-
},
555
-
{
556
-
name: "completeMultipartUpload",
557
-
testFunc: func(store *ProxyBlobStore) error {
558
-
parts := []CompletedPart{{PartNumber: 1, ETag: "etag1"}}
559
-
return store.completeMultipartUpload(context.Background(), "sha256:test", "upload-123", parts)
560
-
},
561
-
expectedPath: atproto.HoldCompleteUpload,
562
-
},
563
-
{
564
-
name: "abortMultipartUpload",
565
-
testFunc: func(store *ProxyBlobStore) error {
566
-
return store.abortMultipartUpload(context.Background(), "sha256:test", "upload-123")
567
-
},
568
-
expectedPath: atproto.HoldAbortUpload,
569
-
},
570
}
571
572
for _, tt := range tests {
573
t.Run(tt.name, func(t *testing.T) {
574
-
var capturedPath string
575
-
576
-
// Mock hold service that captures request path
577
-
holdServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
578
-
capturedPath = r.URL.Path
579
-
580
-
// Return success response
581
-
w.Header().Set("Content-Type", "application/json")
582
-
w.WriteHeader(http.StatusOK)
583
-
resp := map[string]string{
584
-
"uploadId": "test-upload-id",
585
-
"url": "https://s3.example.com/presigned",
586
-
}
587
-
json.NewEncoder(w).Encode(resp)
588
-
}))
589
-
defer holdServer.Close()
590
-
591
-
// Create store with service token in context
592
-
ctx := &RegistryContext{
593
-
DID: "did:plc:test",
594
-
HoldDID: "did:web:hold.example.com",
595
-
PDSEndpoint: "https://pds.example.com",
596
-
Repository: "test-repo",
597
-
ServiceToken: "test-service-token", // Service token from middleware
598
-
}
599
-
store := NewProxyBlobStore(ctx)
600
-
store.holdURL = holdServer.URL
601
-
602
-
// Call the function
603
-
_ = tt.testFunc(store) // Ignore error, we just care about the URL
604
-
605
-
// Verify correct endpoint was called
606
-
if capturedPath != tt.expectedPath {
607
-
t.Errorf("Expected endpoint %s, got %s", tt.expectedPath, capturedPath)
608
-
}
609
-
610
-
// Verify it's NOT the old endpoint
611
-
if strings.Contains(capturedPath, "com.atproto.repo.uploadBlob") {
612
-
t.Error("Still using old com.atproto.repo.uploadBlob endpoint!")
613
}
614
})
615
}
616
}
···
1
package storage
2
3
import (
4
"encoding/base64"
5
"fmt"
6
"strings"
7
"testing"
8
"time"
9
10
"atcr.io/pkg/atproto"
11
+
"atcr.io/pkg/auth"
12
)
13
14
+
// TestGetServiceToken_CachingLogic tests the global service token caching mechanism
15
+
// These tests use the global auth cache functions directly
16
func TestGetServiceToken_CachingLogic(t *testing.T) {
17
+
userDID := "did:plc:cache-test"
18
holdDID := "did:web:hold.example.com"
19
20
// Test 1: Empty cache - invalidate any existing token
21
+
auth.InvalidateServiceToken(userDID, holdDID)
22
+
cachedToken, _ := auth.GetServiceToken(userDID, holdDID)
23
if cachedToken != "" {
24
t.Error("Expected empty cache at start")
25
}
26
27
// Test 2: Insert token into cache
28
// Create a JWT-like token with exp claim for testing
29
testPayload := fmt.Sprintf(`{"exp":%d}`, time.Now().Add(50*time.Second).Unix())
30
testToken := "eyJhbGciOiJIUzI1NiJ9." + base64URLEncode(testPayload) + ".signature"
31
32
+
err := auth.SetServiceToken(userDID, holdDID, testToken)
33
if err != nil {
34
t.Fatalf("Failed to set service token: %v", err)
35
}
36
37
// Test 3: Retrieve from cache
38
+
cachedToken, expiresAt := auth.GetServiceToken(userDID, holdDID)
39
if cachedToken == "" {
40
t.Fatal("Expected token to be in cache")
41
}
···
51
// Test 4: Expired token - GetServiceToken automatically removes it
52
expiredPayload := fmt.Sprintf(`{"exp":%d}`, time.Now().Add(-1*time.Hour).Unix())
53
expiredToken := "eyJhbGciOiJIUzI1NiJ9." + base64URLEncode(expiredPayload) + ".signature"
54
+
auth.SetServiceToken(userDID, holdDID, expiredToken)
55
56
// GetServiceToken should return empty string for expired token
57
+
cachedToken, _ = auth.GetServiceToken(userDID, holdDID)
58
if cachedToken != "" {
59
t.Error("Expected expired token to be removed from cache")
60
}
···
65
return strings.TrimRight(base64.URLEncoding.EncodeToString([]byte(data)), "=")
66
}
67
68
+
// mockUserContextForProxy creates a mock auth.UserContext for proxy blob store testing.
69
+
// It sets up both the user identity and target info, and configures test helpers
70
+
// to bypass network calls.
71
+
func mockUserContextForProxy(did, holdDID, pdsEndpoint, repository string) *auth.UserContext {
72
+
userCtx := auth.NewUserContext(did, "oauth", "PUT", nil)
73
+
userCtx.SetTarget(did, "test.handle", pdsEndpoint, repository, holdDID)
74
75
+
// Bypass PDS resolution (avoids network calls)
76
+
userCtx.SetPDSForTest("test.handle", pdsEndpoint)
77
78
+
// Set up mock authorizer that allows access
79
+
userCtx.SetAuthorizerForTest(auth.NewMockHoldAuthorizer())
80
81
+
// Set default hold DID for push resolution
82
+
userCtx.SetDefaultHoldDIDForTest(holdDID)
83
84
+
return userCtx
85
}
86
87
+
// mockUserContextForProxyWithToken creates a mock UserContext with a pre-populated service token.
88
+
func mockUserContextForProxyWithToken(did, holdDID, pdsEndpoint, repository, serviceToken string) *auth.UserContext {
89
+
userCtx := mockUserContextForProxy(did, holdDID, pdsEndpoint, repository)
90
+
userCtx.SetServiceTokenForTest(holdDID, serviceToken)
91
+
return userCtx
92
}
93
94
+
// TestResolveHoldURL tests DID to URL conversion (pure function)
95
func TestResolveHoldURL(t *testing.T) {
96
tests := []struct {
97
name string
···
99
expected string
100
}{
101
{
102
+
name: "did:web with http (localhost)",
103
holdDID: "did:web:localhost:8080",
104
expected: "http://localhost:8080",
105
},
···
127
128
// TestServiceTokenCacheExpiry tests that expired cached tokens are not used
129
func TestServiceTokenCacheExpiry(t *testing.T) {
130
+
userDID := "did:plc:expiry-test"
131
holdDID := "did:web:hold.example.com"
132
133
// Insert expired token
134
expiredPayload := fmt.Sprintf(`{"exp":%d}`, time.Now().Add(-1*time.Hour).Unix())
135
expiredToken := "eyJhbGciOiJIUzI1NiJ9." + base64URLEncode(expiredPayload) + ".signature"
136
+
auth.SetServiceToken(userDID, holdDID, expiredToken)
137
138
// GetServiceToken should automatically remove expired tokens
139
+
cachedToken, expiresAt := auth.GetServiceToken(userDID, holdDID)
140
141
// Should return empty string for expired token
142
if cachedToken != "" {
···
171
172
// TestNewProxyBlobStore tests ProxyBlobStore creation
173
func TestNewProxyBlobStore(t *testing.T) {
174
+
userCtx := mockUserContextForProxy(
175
+
"did:plc:test",
176
+
"did:web:hold.example.com",
177
+
"https://pds.example.com",
178
+
"test-repo",
179
+
)
180
181
+
store := NewProxyBlobStore(userCtx)
182
183
if store == nil {
184
t.Fatal("Expected non-nil ProxyBlobStore")
185
}
186
187
+
if store.ctx != userCtx {
188
t.Error("Expected context to be set")
189
}
190
···
209
210
testPayload := fmt.Sprintf(`{"exp":%d}`, time.Now().Add(50*time.Second).Unix())
211
testTokenStr := "eyJhbGciOiJIUzI1NiJ9." + base64URLEncode(testPayload) + ".signature"
212
+
auth.SetServiceToken(userDID, holdDID, testTokenStr)
213
214
for b.Loop() {
215
+
cachedToken, expiresAt := auth.GetServiceToken(userDID, holdDID)
216
217
if cachedToken == "" || time.Now().After(expiresAt) {
218
b.Error("Cache miss in benchmark")
···
220
}
221
}
222
223
+
// TestParseJWTExpiry tests JWT expiry parsing
224
+
func TestParseJWTExpiry(t *testing.T) {
225
+
// Create a JWT with known expiry
226
+
futureTime := time.Now().Add(1 * time.Hour).Unix()
227
+
testPayload := fmt.Sprintf(`{"exp":%d}`, futureTime)
228
+
testToken := "eyJhbGciOiJIUzI1NiJ9." + base64URLEncode(testPayload) + ".signature"
229
230
+
expiry, err := auth.ParseJWTExpiry(testToken)
231
if err != nil {
232
+
t.Fatalf("ParseJWTExpiry failed: %v", err)
233
}
234
235
+
// Verify expiry is close to what we set (within 1 second tolerance)
236
+
expectedExpiry := time.Unix(futureTime, 0)
237
+
diff := expiry.Sub(expectedExpiry)
238
+
if diff < -time.Second || diff > time.Second {
239
+
t.Errorf("Expiry mismatch: expected %v, got %v", expectedExpiry, expiry)
240
}
241
}
242
243
+
// TestParseJWTExpiry_InvalidToken tests error handling for invalid tokens
244
+
func TestParseJWTExpiry_InvalidToken(t *testing.T) {
245
tests := []struct {
246
+
name string
247
+
token string
248
}{
249
+
{"empty token", ""},
250
+
{"single part", "header"},
251
+
{"two parts", "header.payload"},
252
+
{"invalid base64 payload", "header.!!!.signature"},
253
+
{"missing exp claim", "eyJhbGciOiJIUzI1NiJ9." + base64URLEncode(`{"sub":"test"}`) + ".sig"},
254
}
255
256
for _, tt := range tests {
257
t.Run(tt.name, func(t *testing.T) {
258
+
_, err := auth.ParseJWTExpiry(tt.token)
259
+
if err == nil {
260
+
t.Error("Expected error for invalid token")
261
}
262
})
263
}
264
}
265
+
266
+
// Note: Tests for doAuthenticatedRequest, Get, Open, completeMultipartUpload, etc.
267
+
// require complex dependency mocking (OAuth refresher, PDS resolution, HoldAuthorizer).
268
+
// These should be tested at the integration level with proper infrastructure.
269
+
//
270
+
// The current unit tests cover:
271
+
// - Global service token cache (auth.GetServiceToken, auth.SetServiceToken, etc.)
272
+
// - URL resolution (atproto.ResolveHoldURL)
273
+
// - JWT parsing (auth.ParseJWTExpiry)
274
+
// - Store construction (NewProxyBlobStore)
+39
-66
pkg/appview/storage/routing_repository.go
+39
-66
pkg/appview/storage/routing_repository.go
···
6
7
import (
8
"context"
9
"log/slog"
10
-
"sync"
11
12
"github.com/distribution/distribution/v3"
13
)
14
15
-
// RoutingRepository routes manifests to ATProto and blobs to external hold service
16
-
// The registry (AppView) is stateless and NEVER stores blobs locally
17
type RoutingRepository struct {
18
distribution.Repository
19
-
Ctx *RegistryContext // All context and services (exported for token updates)
20
-
mu sync.Mutex // Protects manifestStore and blobStore
21
-
manifestStore *ManifestStore // Cached manifest store instance
22
-
blobStore *ProxyBlobStore // Cached blob store instance
23
}
24
25
// NewRoutingRepository creates a new routing repository
26
-
func NewRoutingRepository(baseRepo distribution.Repository, ctx *RegistryContext) *RoutingRepository {
27
return &RoutingRepository{
28
Repository: baseRepo,
29
-
Ctx: ctx,
30
}
31
}
32
33
// Manifests returns the ATProto-backed manifest service
34
func (r *RoutingRepository) Manifests(ctx context.Context, options ...distribution.ManifestServiceOption) (distribution.ManifestService, error) {
35
-
r.mu.Lock()
36
-
// Create or return cached manifest store
37
-
if r.manifestStore == nil {
38
-
// Ensure blob store is created first (needed for label extraction during push)
39
-
// Release lock while calling Blobs to avoid deadlock
40
-
r.mu.Unlock()
41
-
blobStore := r.Blobs(ctx)
42
-
r.mu.Lock()
43
-
44
-
// Double-check after reacquiring lock (another goroutine might have set it)
45
-
if r.manifestStore == nil {
46
-
r.manifestStore = NewManifestStore(r.Ctx, blobStore)
47
-
}
48
-
}
49
-
manifestStore := r.manifestStore
50
-
r.mu.Unlock()
51
-
52
-
return manifestStore, nil
53
}
54
55
// Blobs returns a proxy blob store that routes to external hold service
56
-
// The registry (AppView) NEVER stores blobs locally - all blobs go through hold service
57
func (r *RoutingRepository) Blobs(ctx context.Context) distribution.BlobStore {
58
-
r.mu.Lock()
59
-
// Return cached blob store if available
60
-
if r.blobStore != nil {
61
-
blobStore := r.blobStore
62
-
r.mu.Unlock()
63
-
slog.Debug("Returning cached blob store", "component", "storage/blobs", "did", r.Ctx.DID, "repo", r.Ctx.Repository)
64
-
return blobStore
65
-
}
66
-
67
-
// For pull operations, check database for hold DID from the most recent manifest
68
-
// This ensures blobs are fetched from the hold recorded in the manifest, not re-discovered
69
-
holdDID := r.Ctx.HoldDID // Default to discovery-based DID
70
-
holdSource := "discovery"
71
-
72
-
if r.Ctx.Database != nil {
73
-
// Query database for the latest manifest's hold DID
74
-
if dbHoldDID, err := r.Ctx.Database.GetLatestHoldDIDForRepo(r.Ctx.DID, r.Ctx.Repository); err == nil && dbHoldDID != "" {
75
-
// Use hold DID from database (pull case - use historical reference)
76
-
holdDID = dbHoldDID
77
-
holdSource = "database"
78
-
slog.Debug("Using hold from database manifest", "component", "storage/blobs", "did", r.Ctx.DID, "repo", r.Ctx.Repository, "hold", dbHoldDID)
79
-
} else if err != nil {
80
-
// Log error but don't fail - fall back to discovery-based DID
81
-
slog.Warn("Failed to query database for hold DID", "component", "storage/blobs", "error", err)
82
-
}
83
-
// If dbHoldDID is empty (no manifests yet), fall through to use discovery-based DID
84
}
85
86
if holdDID == "" {
87
-
// This should never happen if middleware is configured correctly
88
-
panic("hold DID not set in RegistryContext - ensure default_hold_did is configured in middleware")
89
}
90
91
-
slog.Debug("Using hold DID for blobs", "component", "storage/blobs", "did", r.Ctx.DID, "repo", r.Ctx.Repository, "hold", holdDID, "source", holdSource)
92
-
93
-
// Update context with the correct hold DID (may be from database or discovered)
94
-
r.Ctx.HoldDID = holdDID
95
96
-
// Create and cache proxy blob store
97
-
r.blobStore = NewProxyBlobStore(r.Ctx)
98
-
blobStore := r.blobStore
99
-
r.mu.Unlock()
100
-
return blobStore
101
}
102
103
// Tags returns the tag service
104
// Tags are stored in ATProto as io.atcr.tag records
105
func (r *RoutingRepository) Tags(ctx context.Context) distribution.TagService {
106
-
return NewTagStore(r.Ctx.ATProtoClient, r.Ctx.Repository)
107
}
···
6
7
import (
8
"context"
9
+
"database/sql"
10
"log/slog"
11
12
+
"atcr.io/pkg/auth"
13
"github.com/distribution/distribution/v3"
14
+
"github.com/distribution/reference"
15
)
16
17
+
// RoutingRepository routes manifests to ATProto and blobs to external hold service.
18
+
// The registry (AppView) is stateless and NEVER stores blobs locally.
19
+
// A new instance is created per HTTP request - no caching or synchronization needed.
20
type RoutingRepository struct {
21
distribution.Repository
22
+
userCtx *auth.UserContext
23
+
sqlDB *sql.DB
24
}
25
26
// NewRoutingRepository creates a new routing repository
27
+
func NewRoutingRepository(baseRepo distribution.Repository, userCtx *auth.UserContext, sqlDB *sql.DB) *RoutingRepository {
28
return &RoutingRepository{
29
Repository: baseRepo,
30
+
userCtx: userCtx,
31
+
sqlDB: sqlDB,
32
}
33
}
34
35
// Manifests returns the ATProto-backed manifest service
36
func (r *RoutingRepository) Manifests(ctx context.Context, options ...distribution.ManifestServiceOption) (distribution.ManifestService, error) {
37
+
// blobStore used to fetch labels from th
38
+
blobStore := r.Blobs(ctx)
39
+
return NewManifestStore(r.userCtx, blobStore, r.sqlDB), nil
40
}
41
42
// Blobs returns a proxy blob store that routes to external hold service
43
func (r *RoutingRepository) Blobs(ctx context.Context) distribution.BlobStore {
44
+
// Resolve hold DID: pull uses DB lookup, push uses profile discovery
45
+
holdDID, err := r.userCtx.ResolveHoldDID(ctx, r.sqlDB)
46
+
if err != nil {
47
+
slog.Warn("Failed to resolve hold DID", "component", "storage/blobs", "error", err)
48
+
holdDID = r.userCtx.TargetHoldDID
49
}
50
51
if holdDID == "" {
52
+
panic("hold DID not set - ensure default_hold_did is configured in middleware")
53
}
54
55
+
slog.Debug("Using hold DID for blobs", "component", "storage/blobs", "did", r.userCtx.TargetOwnerDID, "repo", r.userCtx.TargetRepo, "hold", holdDID, "action", r.userCtx.Action.String())
56
57
+
return NewProxyBlobStore(r.userCtx)
58
}
59
60
// Tags returns the tag service
61
// Tags are stored in ATProto as io.atcr.tag records
62
func (r *RoutingRepository) Tags(ctx context.Context) distribution.TagService {
63
+
return NewTagStore(r.userCtx.GetATProtoClient(), r.userCtx.TargetRepo)
64
+
}
65
+
66
+
// Named returns a reference to the repository name.
67
+
// If the base repository is set, it delegates to the base.
68
+
// Otherwise, it constructs a name from the user context.
69
+
func (r *RoutingRepository) Named() reference.Named {
70
+
if r.Repository != nil {
71
+
return r.Repository.Named()
72
+
}
73
+
// Construct from user context
74
+
name, err := reference.WithName(r.userCtx.TargetRepo)
75
+
if err != nil {
76
+
// Fallback: return a simple reference
77
+
name, _ = reference.WithName("unknown")
78
+
}
79
+
return name
80
}
+179
-232
pkg/appview/storage/routing_repository_test.go
+179
-232
pkg/appview/storage/routing_repository_test.go
···
2
3
import (
4
"context"
5
-
"sync"
6
"testing"
7
8
-
"github.com/distribution/distribution/v3"
9
"github.com/stretchr/testify/assert"
10
"github.com/stretchr/testify/require"
11
12
"atcr.io/pkg/atproto"
13
)
14
15
-
// mockDatabase is a simple mock for testing
16
-
type mockDatabase struct {
17
-
holdDID string
18
-
err error
19
-
}
20
21
-
func (m *mockDatabase) IncrementPullCount(did, repository string) error {
22
-
return nil
23
-
}
24
25
-
func (m *mockDatabase) IncrementPushCount(did, repository string) error {
26
-
return nil
27
}
28
29
-
func (m *mockDatabase) GetLatestHoldDIDForRepo(did, repository string) (string, error) {
30
-
if m.err != nil {
31
-
return "", m.err
32
-
}
33
-
return m.holdDID, nil
34
}
35
36
func TestNewRoutingRepository(t *testing.T) {
37
-
ctx := &RegistryContext{
38
-
DID: "did:plc:test123",
39
-
Repository: "debian",
40
-
HoldDID: "did:web:hold01.atcr.io",
41
-
ATProtoClient: &atproto.Client{},
42
-
}
43
44
-
repo := NewRoutingRepository(nil, ctx)
45
46
-
if repo.Ctx.DID != "did:plc:test123" {
47
-
t.Errorf("Expected DID %q, got %q", "did:plc:test123", repo.Ctx.DID)
48
}
49
50
-
if repo.Ctx.Repository != "debian" {
51
-
t.Errorf("Expected repository %q, got %q", "debian", repo.Ctx.Repository)
52
-
}
53
-
54
-
if repo.manifestStore != nil {
55
-
t.Error("Expected manifestStore to be nil initially")
56
}
57
58
-
if repo.blobStore != nil {
59
-
t.Error("Expected blobStore to be nil initially")
60
}
61
}
62
63
// TestRoutingRepository_Manifests tests the Manifests() method
64
func TestRoutingRepository_Manifests(t *testing.T) {
65
-
ctx := &RegistryContext{
66
-
DID: "did:plc:test123",
67
-
Repository: "myapp",
68
-
HoldDID: "did:web:hold01.atcr.io",
69
-
ATProtoClient: atproto.NewClient("https://pds.example.com", "did:plc:test123", ""),
70
-
}
71
72
-
repo := NewRoutingRepository(nil, ctx)
73
manifestService, err := repo.Manifests(context.Background())
74
75
require.NoError(t, err)
76
assert.NotNil(t, manifestService)
77
-
78
-
// Verify the manifest store is cached
79
-
assert.NotNil(t, repo.manifestStore, "manifest store should be cached")
80
-
81
-
// Call again and verify we get the same instance
82
-
manifestService2, err := repo.Manifests(context.Background())
83
-
require.NoError(t, err)
84
-
assert.Same(t, manifestService, manifestService2, "should return cached manifest store")
85
}
86
87
-
// TestRoutingRepository_ManifestStoreCaching tests that manifest store is cached
88
-
func TestRoutingRepository_ManifestStoreCaching(t *testing.T) {
89
-
ctx := &RegistryContext{
90
-
DID: "did:plc:test123",
91
-
Repository: "myapp",
92
-
HoldDID: "did:web:hold01.atcr.io",
93
-
ATProtoClient: atproto.NewClient("https://pds.example.com", "did:plc:test123", ""),
94
-
}
95
-
96
-
repo := NewRoutingRepository(nil, ctx)
97
-
98
-
// First call creates the store
99
-
store1, err := repo.Manifests(context.Background())
100
-
require.NoError(t, err)
101
-
assert.NotNil(t, store1)
102
-
103
-
// Second call returns cached store
104
-
store2, err := repo.Manifests(context.Background())
105
-
require.NoError(t, err)
106
-
assert.Same(t, store1, store2, "should return cached manifest store instance")
107
-
108
-
// Verify internal cache
109
-
assert.NotNil(t, repo.manifestStore)
110
-
}
111
-
112
-
// TestRoutingRepository_Blobs_WithDatabase tests blob store with database hold DID
113
-
func TestRoutingRepository_Blobs_WithDatabase(t *testing.T) {
114
-
dbHoldDID := "did:web:database.hold.io"
115
-
116
-
ctx := &RegistryContext{
117
-
DID: "did:plc:test123",
118
-
Repository: "myapp",
119
-
HoldDID: "did:web:default.hold.io", // Discovery-based hold (should be overridden)
120
-
ATProtoClient: atproto.NewClient("https://pds.example.com", "did:plc:test123", ""),
121
-
Database: &mockDatabase{holdDID: dbHoldDID},
122
-
}
123
124
-
repo := NewRoutingRepository(nil, ctx)
125
blobStore := repo.Blobs(context.Background())
126
127
assert.NotNil(t, blobStore)
128
-
// Verify the hold DID was updated to use the database value
129
-
assert.Equal(t, dbHoldDID, repo.Ctx.HoldDID, "should use database hold DID")
130
-
}
131
-
132
-
// TestRoutingRepository_Blobs_WithoutDatabase tests blob store with discovery-based hold
133
-
func TestRoutingRepository_Blobs_WithoutDatabase(t *testing.T) {
134
-
discoveryHoldDID := "did:web:discovery.hold.io"
135
-
136
-
ctx := &RegistryContext{
137
-
DID: "did:plc:nocache456",
138
-
Repository: "uncached-app",
139
-
HoldDID: discoveryHoldDID,
140
-
ATProtoClient: atproto.NewClient("https://pds.example.com", "did:plc:nocache456", ""),
141
-
Database: nil, // No database
142
-
}
143
-
144
-
repo := NewRoutingRepository(nil, ctx)
145
-
blobStore := repo.Blobs(context.Background())
146
-
147
-
assert.NotNil(t, blobStore)
148
-
// Verify the hold DID remains the discovery-based one
149
-
assert.Equal(t, discoveryHoldDID, repo.Ctx.HoldDID, "should use discovery-based hold DID")
150
-
}
151
-
152
-
// TestRoutingRepository_Blobs_DatabaseEmptyFallback tests fallback when database returns empty hold DID
153
-
func TestRoutingRepository_Blobs_DatabaseEmptyFallback(t *testing.T) {
154
-
discoveryHoldDID := "did:web:discovery.hold.io"
155
-
156
-
ctx := &RegistryContext{
157
-
DID: "did:plc:test123",
158
-
Repository: "newapp",
159
-
HoldDID: discoveryHoldDID,
160
-
ATProtoClient: atproto.NewClient("https://pds.example.com", "did:plc:test123", ""),
161
-
Database: &mockDatabase{holdDID: ""}, // Empty string (no manifests yet)
162
-
}
163
-
164
-
repo := NewRoutingRepository(nil, ctx)
165
-
blobStore := repo.Blobs(context.Background())
166
-
167
-
assert.NotNil(t, blobStore)
168
-
// Verify the hold DID falls back to discovery-based
169
-
assert.Equal(t, discoveryHoldDID, repo.Ctx.HoldDID, "should fall back to discovery-based hold DID when database returns empty")
170
-
}
171
-
172
-
// TestRoutingRepository_BlobStoreCaching tests that blob store is cached
173
-
func TestRoutingRepository_BlobStoreCaching(t *testing.T) {
174
-
ctx := &RegistryContext{
175
-
DID: "did:plc:test123",
176
-
Repository: "myapp",
177
-
HoldDID: "did:web:hold01.atcr.io",
178
-
ATProtoClient: atproto.NewClient("https://pds.example.com", "did:plc:test123", ""),
179
-
}
180
-
181
-
repo := NewRoutingRepository(nil, ctx)
182
-
183
-
// First call creates the store
184
-
store1 := repo.Blobs(context.Background())
185
-
assert.NotNil(t, store1)
186
-
187
-
// Second call returns cached store
188
-
store2 := repo.Blobs(context.Background())
189
-
assert.Same(t, store1, store2, "should return cached blob store instance")
190
-
191
-
// Verify internal cache
192
-
assert.NotNil(t, repo.blobStore)
193
}
194
195
// TestRoutingRepository_Blobs_PanicOnEmptyHoldDID tests panic when hold DID is empty
196
func TestRoutingRepository_Blobs_PanicOnEmptyHoldDID(t *testing.T) {
197
-
// Use a unique DID/repo to ensure no cache entry exists
198
-
ctx := &RegistryContext{
199
-
DID: "did:plc:emptyholdtest999",
200
-
Repository: "empty-hold-app",
201
-
HoldDID: "", // Empty hold DID should panic
202
-
ATProtoClient: atproto.NewClient("https://pds.example.com", "did:plc:emptyholdtest999", ""),
203
-
}
204
205
-
repo := NewRoutingRepository(nil, ctx)
206
207
// Should panic with empty hold DID
208
assert.Panics(t, func() {
···
212
213
// TestRoutingRepository_Tags tests the Tags() method
214
func TestRoutingRepository_Tags(t *testing.T) {
215
-
ctx := &RegistryContext{
216
-
DID: "did:plc:test123",
217
-
Repository: "myapp",
218
-
HoldDID: "did:web:hold01.atcr.io",
219
-
ATProtoClient: atproto.NewClient("https://pds.example.com", "did:plc:test123", ""),
220
-
}
221
222
-
repo := NewRoutingRepository(nil, ctx)
223
tagService := repo.Tags(context.Background())
224
225
assert.NotNil(t, tagService)
226
227
-
// Call again and verify we get a new instance (Tags() doesn't cache)
228
tagService2 := repo.Tags(context.Background())
229
assert.NotNil(t, tagService2)
230
-
// Tags service is not cached, so each call creates a new instance
231
}
232
233
-
// TestRoutingRepository_ConcurrentAccess tests concurrent access to cached stores
234
-
func TestRoutingRepository_ConcurrentAccess(t *testing.T) {
235
-
ctx := &RegistryContext{
236
-
DID: "did:plc:test123",
237
-
Repository: "myapp",
238
-
HoldDID: "did:web:hold01.atcr.io",
239
-
ATProtoClient: atproto.NewClient("https://pds.example.com", "did:plc:test123", ""),
240
}
241
242
-
repo := NewRoutingRepository(nil, ctx)
243
244
-
var wg sync.WaitGroup
245
-
numGoroutines := 10
246
247
-
// Track all manifest stores returned
248
-
manifestStores := make([]distribution.ManifestService, numGoroutines)
249
-
blobStores := make([]distribution.BlobStore, numGoroutines)
250
251
-
// Concurrent access to Manifests()
252
-
for i := 0; i < numGoroutines; i++ {
253
-
wg.Add(1)
254
-
go func(index int) {
255
-
defer wg.Done()
256
-
store, err := repo.Manifests(context.Background())
257
-
require.NoError(t, err)
258
-
manifestStores[index] = store
259
-
}(i)
260
}
261
262
-
wg.Wait()
263
-
264
-
// Verify all stores are non-nil (due to race conditions, they may not all be the same instance)
265
-
for i := 0; i < numGoroutines; i++ {
266
-
assert.NotNil(t, manifestStores[i], "manifest store should not be nil")
267
-
}
268
269
-
// After concurrent creation, subsequent calls should return the cached instance
270
-
cachedStore, err := repo.Manifests(context.Background())
271
-
require.NoError(t, err)
272
-
assert.NotNil(t, cachedStore)
273
274
-
// Concurrent access to Blobs()
275
-
for i := 0; i < numGoroutines; i++ {
276
-
wg.Add(1)
277
-
go func(index int) {
278
-
defer wg.Done()
279
-
blobStores[index] = repo.Blobs(context.Background())
280
-
}(i)
281
}
282
283
-
wg.Wait()
284
285
-
// Verify all stores are non-nil (due to race conditions, they may not all be the same instance)
286
-
for i := 0; i < numGoroutines; i++ {
287
-
assert.NotNil(t, blobStores[i], "blob store should not be nil")
288
-
}
289
290
-
// After concurrent creation, subsequent calls should return the cached instance
291
-
cachedBlobStore := repo.Blobs(context.Background())
292
-
assert.NotNil(t, cachedBlobStore)
293
}
294
295
-
// TestRoutingRepository_Blobs_Priority tests that database hold DID takes priority over discovery
296
-
func TestRoutingRepository_Blobs_Priority(t *testing.T) {
297
-
dbHoldDID := "did:web:database.hold.io"
298
-
discoveryHoldDID := "did:web:discovery.hold.io"
299
300
-
ctx := &RegistryContext{
301
-
DID: "did:plc:test123",
302
-
Repository: "myapp",
303
-
HoldDID: discoveryHoldDID, // Discovery-based hold
304
-
ATProtoClient: atproto.NewClient("https://pds.example.com", "did:plc:test123", ""),
305
-
Database: &mockDatabase{holdDID: dbHoldDID}, // Database has a different hold DID
306
}
307
-
308
-
repo := NewRoutingRepository(nil, ctx)
309
-
blobStore := repo.Blobs(context.Background())
310
-
311
-
assert.NotNil(t, blobStore)
312
-
// Database hold DID should take priority over discovery
313
-
assert.Equal(t, dbHoldDID, repo.Ctx.HoldDID, "database hold DID should take priority over discovery")
314
}
···
2
3
import (
4
"context"
5
"testing"
6
7
"github.com/stretchr/testify/assert"
8
"github.com/stretchr/testify/require"
9
10
"atcr.io/pkg/atproto"
11
+
"atcr.io/pkg/auth"
12
)
13
14
+
// mockUserContext creates a mock auth.UserContext for testing.
15
+
// It sets up both the user identity and target info, and configures
16
+
// test helpers to bypass network calls.
17
+
func mockUserContext(did, authMethod, httpMethod, targetOwnerDID, targetOwnerHandle, targetOwnerPDS, targetRepo, targetHoldDID string) *auth.UserContext {
18
+
userCtx := auth.NewUserContext(did, authMethod, httpMethod, nil)
19
+
userCtx.SetTarget(targetOwnerDID, targetOwnerHandle, targetOwnerPDS, targetRepo, targetHoldDID)
20
+
21
+
// Bypass PDS resolution (avoids network calls)
22
+
userCtx.SetPDSForTest(targetOwnerHandle, targetOwnerPDS)
23
24
+
// Set up mock authorizer that allows access
25
+
userCtx.SetAuthorizerForTest(auth.NewMockHoldAuthorizer())
26
27
+
// Set default hold DID for push resolution
28
+
userCtx.SetDefaultHoldDIDForTest(targetHoldDID)
29
+
30
+
return userCtx
31
}
32
33
+
// mockUserContextWithToken creates a mock UserContext with a pre-populated service token.
34
+
func mockUserContextWithToken(did, authMethod, httpMethod, targetOwnerDID, targetOwnerHandle, targetOwnerPDS, targetRepo, targetHoldDID, serviceToken string) *auth.UserContext {
35
+
userCtx := mockUserContext(did, authMethod, httpMethod, targetOwnerDID, targetOwnerHandle, targetOwnerPDS, targetRepo, targetHoldDID)
36
+
userCtx.SetServiceTokenForTest(targetHoldDID, serviceToken)
37
+
return userCtx
38
}
39
40
func TestNewRoutingRepository(t *testing.T) {
41
+
userCtx := mockUserContext(
42
+
"did:plc:test123", // authenticated user
43
+
"oauth", // auth method
44
+
"GET", // HTTP method
45
+
"did:plc:test123", // target owner
46
+
"test.handle", // target owner handle
47
+
"https://pds.example.com", // target owner PDS
48
+
"debian", // repository
49
+
"did:web:hold01.atcr.io", // hold DID
50
+
)
51
52
+
repo := NewRoutingRepository(nil, userCtx, nil)
53
54
+
if repo.userCtx.TargetOwnerDID != "did:plc:test123" {
55
+
t.Errorf("Expected TargetOwnerDID %q, got %q", "did:plc:test123", repo.userCtx.TargetOwnerDID)
56
}
57
58
+
if repo.userCtx.TargetRepo != "debian" {
59
+
t.Errorf("Expected TargetRepo %q, got %q", "debian", repo.userCtx.TargetRepo)
60
}
61
62
+
if repo.userCtx.TargetHoldDID != "did:web:hold01.atcr.io" {
63
+
t.Errorf("Expected TargetHoldDID %q, got %q", "did:web:hold01.atcr.io", repo.userCtx.TargetHoldDID)
64
}
65
}
66
67
// TestRoutingRepository_Manifests tests the Manifests() method
68
func TestRoutingRepository_Manifests(t *testing.T) {
69
+
userCtx := mockUserContext(
70
+
"did:plc:test123",
71
+
"oauth",
72
+
"GET",
73
+
"did:plc:test123",
74
+
"test.handle",
75
+
"https://pds.example.com",
76
+
"myapp",
77
+
"did:web:hold01.atcr.io",
78
+
)
79
80
+
repo := NewRoutingRepository(nil, userCtx, nil)
81
manifestService, err := repo.Manifests(context.Background())
82
83
require.NoError(t, err)
84
assert.NotNil(t, manifestService)
85
}
86
87
+
// TestRoutingRepository_Blobs tests the Blobs() method
88
+
func TestRoutingRepository_Blobs(t *testing.T) {
89
+
userCtx := mockUserContext(
90
+
"did:plc:test123",
91
+
"oauth",
92
+
"GET",
93
+
"did:plc:test123",
94
+
"test.handle",
95
+
"https://pds.example.com",
96
+
"myapp",
97
+
"did:web:hold01.atcr.io",
98
+
)
99
100
+
repo := NewRoutingRepository(nil, userCtx, nil)
101
blobStore := repo.Blobs(context.Background())
102
103
assert.NotNil(t, blobStore)
104
}
105
106
// TestRoutingRepository_Blobs_PanicOnEmptyHoldDID tests panic when hold DID is empty
107
func TestRoutingRepository_Blobs_PanicOnEmptyHoldDID(t *testing.T) {
108
+
// Create context without default hold and empty target hold
109
+
userCtx := auth.NewUserContext("did:plc:emptyholdtest999", "oauth", "GET", nil)
110
+
userCtx.SetTarget("did:plc:emptyholdtest999", "test.handle", "https://pds.example.com", "empty-hold-app", "")
111
+
userCtx.SetPDSForTest("test.handle", "https://pds.example.com")
112
+
userCtx.SetAuthorizerForTest(auth.NewMockHoldAuthorizer())
113
+
// Intentionally NOT setting default hold DID
114
115
+
repo := NewRoutingRepository(nil, userCtx, nil)
116
117
// Should panic with empty hold DID
118
assert.Panics(t, func() {
···
122
123
// TestRoutingRepository_Tags tests the Tags() method
124
func TestRoutingRepository_Tags(t *testing.T) {
125
+
userCtx := mockUserContext(
126
+
"did:plc:test123",
127
+
"oauth",
128
+
"GET",
129
+
"did:plc:test123",
130
+
"test.handle",
131
+
"https://pds.example.com",
132
+
"myapp",
133
+
"did:web:hold01.atcr.io",
134
+
)
135
136
+
repo := NewRoutingRepository(nil, userCtx, nil)
137
tagService := repo.Tags(context.Background())
138
139
assert.NotNil(t, tagService)
140
141
+
// Call again and verify we get a fresh instance (no caching)
142
tagService2 := repo.Tags(context.Background())
143
assert.NotNil(t, tagService2)
144
}
145
146
+
// TestRoutingRepository_UserContext tests that UserContext fields are properly set
147
+
func TestRoutingRepository_UserContext(t *testing.T) {
148
+
testCases := []struct {
149
+
name string
150
+
httpMethod string
151
+
expectedAction auth.RequestAction
152
+
}{
153
+
{"GET request is pull", "GET", auth.ActionPull},
154
+
{"HEAD request is pull", "HEAD", auth.ActionPull},
155
+
{"PUT request is push", "PUT", auth.ActionPush},
156
+
{"POST request is push", "POST", auth.ActionPush},
157
+
{"DELETE request is push", "DELETE", auth.ActionPush},
158
}
159
160
+
for _, tc := range testCases {
161
+
t.Run(tc.name, func(t *testing.T) {
162
+
userCtx := mockUserContext(
163
+
"did:plc:test123",
164
+
"oauth",
165
+
tc.httpMethod,
166
+
"did:plc:test123",
167
+
"test.handle",
168
+
"https://pds.example.com",
169
+
"myapp",
170
+
"did:web:hold01.atcr.io",
171
+
)
172
173
+
repo := NewRoutingRepository(nil, userCtx, nil)
174
175
+
assert.Equal(t, tc.expectedAction, repo.userCtx.Action, "action should match HTTP method")
176
+
})
177
+
}
178
+
}
179
180
+
// TestRoutingRepository_DifferentHoldDIDs tests routing with different hold DIDs
181
+
func TestRoutingRepository_DifferentHoldDIDs(t *testing.T) {
182
+
testCases := []struct {
183
+
name string
184
+
holdDID string
185
+
}{
186
+
{"did:web hold", "did:web:hold01.atcr.io"},
187
+
{"did:web with port", "did:web:localhost:8080"},
188
+
{"did:plc hold", "did:plc:xyz123"},
189
}
190
191
+
for _, tc := range testCases {
192
+
t.Run(tc.name, func(t *testing.T) {
193
+
userCtx := mockUserContext(
194
+
"did:plc:test123",
195
+
"oauth",
196
+
"PUT",
197
+
"did:plc:test123",
198
+
"test.handle",
199
+
"https://pds.example.com",
200
+
"myapp",
201
+
tc.holdDID,
202
+
)
203
204
+
repo := NewRoutingRepository(nil, userCtx, nil)
205
+
blobStore := repo.Blobs(context.Background())
206
207
+
assert.NotNil(t, blobStore, "should create blob store for %s", tc.holdDID)
208
+
})
209
}
210
+
}
211
212
+
// TestRoutingRepository_Named tests the Named() method
213
+
func TestRoutingRepository_Named(t *testing.T) {
214
+
userCtx := mockUserContext(
215
+
"did:plc:test123",
216
+
"oauth",
217
+
"GET",
218
+
"did:plc:test123",
219
+
"test.handle",
220
+
"https://pds.example.com",
221
+
"myapp",
222
+
"did:web:hold01.atcr.io",
223
+
)
224
225
+
repo := NewRoutingRepository(nil, userCtx, nil)
226
227
+
// Named() returns a reference.Named from the base repository
228
+
// Since baseRepo is nil, this tests our implementation handles that case
229
+
named := repo.Named()
230
+
231
+
// With nil base, Named() should return a name constructed from context
232
+
assert.NotNil(t, named)
233
+
assert.Contains(t, named.Name(), "myapp")
234
}
235
236
+
// TestATProtoResolveHoldURL tests DID to URL resolution
237
+
func TestATProtoResolveHoldURL(t *testing.T) {
238
+
tests := []struct {
239
+
name string
240
+
holdDID string
241
+
expected string
242
+
}{
243
+
{
244
+
name: "did:web simple domain",
245
+
holdDID: "did:web:hold01.atcr.io",
246
+
expected: "https://hold01.atcr.io",
247
+
},
248
+
{
249
+
name: "did:web with port (localhost)",
250
+
holdDID: "did:web:localhost:8080",
251
+
expected: "http://localhost:8080",
252
+
},
253
+
}
254
255
+
for _, tt := range tests {
256
+
t.Run(tt.name, func(t *testing.T) {
257
+
result := atproto.ResolveHoldURL(tt.holdDID)
258
+
assert.Equal(t, tt.expected, result)
259
+
})
260
}
261
}
+22
pkg/appview/templates/pages/404.html
+22
pkg/appview/templates/pages/404.html
···
···
1
+
{{ define "404" }}
2
+
<!DOCTYPE html>
3
+
<html lang="en">
4
+
<head>
5
+
<title>404 - Lost at Sea | ATCR</title>
6
+
{{ template "head" . }}
7
+
</head>
8
+
<body>
9
+
{{ template "nav-simple" . }}
10
+
<main class="error-page">
11
+
<div class="error-content">
12
+
<i data-lucide="anchor" class="error-icon"></i>
13
+
<div class="error-code">404</div>
14
+
<h1>Lost at Sea</h1>
15
+
<p>The page you're looking for has drifted into uncharted waters.</p>
16
+
<a href="/" class="btn btn-primary">Return to Port</a>
17
+
</div>
18
+
</main>
19
+
<script>lucide.createIcons();</script>
20
+
</body>
21
+
</html>
22
+
{{ end }}
+14
pkg/appview/templates/pages/home.html
+14
pkg/appview/templates/pages/home.html
···
3
<html lang="en">
4
<head>
5
<title>ATCR - Distributed Container Registry</title>
6
+
<!-- Open Graph -->
7
+
<meta property="og:title" content="ATCR - Distributed Container Registry">
8
+
<meta property="og:description" content="Push and pull Docker images on the AT Protocol. Same Docker, decentralized.">
9
+
<meta property="og:image" content="https://{{ .RegistryURL }}/og/home">
10
+
<meta property="og:image:width" content="1200">
11
+
<meta property="og:image:height" content="630">
12
+
<meta property="og:type" content="website">
13
+
<meta property="og:url" content="https://{{ .RegistryURL }}">
14
+
<meta property="og:site_name" content="ATCR">
15
+
<!-- Twitter Card (used by Discord) -->
16
+
<meta name="twitter:card" content="summary_large_image">
17
+
<meta name="twitter:title" content="ATCR - Distributed Container Registry">
18
+
<meta name="twitter:description" content="Push and pull Docker images on the AT Protocol. Same Docker, decentralized.">
19
+
<meta name="twitter:image" content="https://{{ .RegistryURL }}/og/home">
20
{{ template "head" . }}
21
</head>
22
<body>
+1
pkg/appview/templates/pages/login.html
+1
pkg/appview/templates/pages/login.html
+36
-7
pkg/appview/templates/pages/repository.html
+36
-7
pkg/appview/templates/pages/repository.html
···
3
<html lang="en">
4
<head>
5
<title>{{ if .Repository.Title }}{{ .Repository.Title }}{{ else }}{{ .Owner.Handle }}/{{ .Repository.Name }}{{ end }} - ATCR</title>
6
{{ template "head" . }}
7
</head>
8
<body>
···
13
<!-- Repository Header -->
14
<div class="repository-header">
15
<div class="repo-hero">
16
-
{{ if .Repository.IconURL }}
17
-
<img src="{{ .Repository.IconURL }}" alt="{{ .Repository.Name }}" class="repo-hero-icon">
18
-
{{ else }}
19
-
<div class="repo-hero-icon-placeholder">{{ firstChar .Repository.Name }}</div>
20
-
{{ end }}
21
<div class="repo-hero-info">
22
<h1>
23
<a href="/u/{{ .Owner.Handle }}" class="owner-link">{{ .Owner.Handle }}</a>
···
109
{{ if .Tags }}
110
<div class="tags-list">
111
{{ range .Tags }}
112
-
<div class="tag-item" id="tag-{{ .Tag.Tag }}">
113
<div class="tag-item-header">
114
<div>
115
<span class="tag-name-large">{{ .Tag.Tag }}</span>
116
{{ if .IsMultiArch }}
117
<span class="badge-multi">Multi-arch</span>
118
{{ end }}
119
</div>
120
<div style="display: flex; gap: 1rem; align-items: center;">
···
125
<button class="delete-btn"
126
hx-delete="/api/images/{{ $.Repository.Name }}/tags/{{ .Tag.Tag }}"
127
hx-confirm="Delete tag {{ .Tag.Tag }}?"
128
-
hx-target="#tag-{{ .Tag.Tag }}"
129
hx-swap="outerHTML">
130
<i data-lucide="trash-2"></i>
131
</button>
···
175
<span class="manifest-type"><i data-lucide="package"></i> Multi-arch</span>
176
{{ else }}
177
<span class="manifest-type"><i data-lucide="file-text"></i> Image</span>
178
{{ end }}
179
{{ if .Pending }}
180
<span class="checking-badge"
···
3
<html lang="en">
4
<head>
5
<title>{{ if .Repository.Title }}{{ .Repository.Title }}{{ else }}{{ .Owner.Handle }}/{{ .Repository.Name }}{{ end }} - ATCR</title>
6
+
<!-- Open Graph -->
7
+
<meta property="og:title" content="{{ .Owner.Handle }}/{{ .Repository.Name }} - ATCR">
8
+
<meta property="og:description" content="{{ if .Repository.Description }}{{ .Repository.Description }}{{ else }}Container image on ATCR{{ end }}">
9
+
<meta property="og:image" content="https://{{ .RegistryURL }}/og/r/{{ .Owner.Handle }}/{{ .Repository.Name }}">
10
+
<meta property="og:image:width" content="1200">
11
+
<meta property="og:image:height" content="630">
12
+
<meta property="og:type" content="website">
13
+
<meta property="og:url" content="https://{{ .RegistryURL }}/r/{{ .Owner.Handle }}/{{ .Repository.Name }}">
14
+
<meta property="og:site_name" content="ATCR">
15
+
<!-- Twitter Card (used by Discord) -->
16
+
<meta name="twitter:card" content="summary_large_image">
17
+
<meta name="twitter:title" content="{{ .Owner.Handle }}/{{ .Repository.Name }} - ATCR">
18
+
<meta name="twitter:description" content="{{ if .Repository.Description }}{{ .Repository.Description }}{{ else }}Container image on ATCR{{ end }}">
19
+
<meta name="twitter:image" content="https://{{ .RegistryURL }}/og/r/{{ .Owner.Handle }}/{{ .Repository.Name }}">
20
{{ template "head" . }}
21
</head>
22
<body>
···
27
<!-- Repository Header -->
28
<div class="repository-header">
29
<div class="repo-hero">
30
+
<div class="repo-hero-icon-wrapper">
31
+
{{ if .Repository.IconURL }}
32
+
<img src="{{ .Repository.IconURL }}" alt="{{ .Repository.Name }}" class="repo-hero-icon">
33
+
{{ else }}
34
+
<div class="repo-hero-icon-placeholder">{{ firstChar .Repository.Name }}</div>
35
+
{{ end }}
36
+
{{ if $.IsOwner }}
37
+
<label class="avatar-upload-overlay" for="avatar-upload">
38
+
<i data-lucide="plus"></i>
39
+
</label>
40
+
<input type="file" id="avatar-upload" accept="image/png,image/jpeg,image/webp"
41
+
onchange="uploadAvatar(this, '{{ .Repository.Name }}')" hidden>
42
+
{{ end }}
43
+
</div>
44
<div class="repo-hero-info">
45
<h1>
46
<a href="/u/{{ .Owner.Handle }}" class="owner-link">{{ .Owner.Handle }}</a>
···
132
{{ if .Tags }}
133
<div class="tags-list">
134
{{ range .Tags }}
135
+
<div class="tag-item" id="tag-{{ sanitizeID .Tag.Tag }}">
136
<div class="tag-item-header">
137
<div>
138
<span class="tag-name-large">{{ .Tag.Tag }}</span>
139
{{ if .IsMultiArch }}
140
<span class="badge-multi">Multi-arch</span>
141
+
{{ end }}
142
+
{{ if .HasAttestations }}
143
+
<span class="badge-attestation"><i data-lucide="shield-check"></i> Attestations</span>
144
{{ end }}
145
</div>
146
<div style="display: flex; gap: 1rem; align-items: center;">
···
151
<button class="delete-btn"
152
hx-delete="/api/images/{{ $.Repository.Name }}/tags/{{ .Tag.Tag }}"
153
hx-confirm="Delete tag {{ .Tag.Tag }}?"
154
+
hx-target="#tag-{{ sanitizeID .Tag.Tag }}"
155
hx-swap="outerHTML">
156
<i data-lucide="trash-2"></i>
157
</button>
···
201
<span class="manifest-type"><i data-lucide="package"></i> Multi-arch</span>
202
{{ else }}
203
<span class="manifest-type"><i data-lucide="file-text"></i> Image</span>
204
+
{{ end }}
205
+
{{ if .HasAttestations }}
206
+
<span class="badge-attestation"><i data-lucide="shield-check"></i> Attestations</span>
207
{{ end }}
208
{{ if .Pending }}
209
<span class="checking-badge"
+22
-2
pkg/appview/templates/pages/user.html
+22
-2
pkg/appview/templates/pages/user.html
···
3
<html lang="en">
4
<head>
5
<title>{{ .ViewedUser.Handle }} - ATCR</title>
6
{{ template "head" . }}
7
</head>
8
<body>
···
13
<div class="user-profile">
14
{{ if .ViewedUser.Avatar }}
15
<img src="{{ .ViewedUser.Avatar }}" alt="{{ .ViewedUser.Handle }}" class="profile-avatar">
16
-
{{ else }}
17
<div class="profile-avatar-placeholder">{{ firstChar .ViewedUser.Handle }}</div>
18
{{ end }}
19
<h1>{{ .ViewedUser.Handle }}</h1>
20
</div>
21
22
-
{{ if .Repositories }}
23
<div class="featured-grid">
24
{{ range .Repositories }}
25
{{ template "repo-card" . }}
···
3
<html lang="en">
4
<head>
5
<title>{{ .ViewedUser.Handle }} - ATCR</title>
6
+
<!-- Open Graph -->
7
+
<meta property="og:title" content="{{ .ViewedUser.Handle }} - ATCR">
8
+
<meta property="og:description" content="Container images by {{ .ViewedUser.Handle }} on ATCR">
9
+
<meta property="og:image" content="https://{{ .RegistryURL }}/og/u/{{ .ViewedUser.Handle }}">
10
+
<meta property="og:image:width" content="1200">
11
+
<meta property="og:image:height" content="630">
12
+
<meta property="og:type" content="profile">
13
+
<meta property="og:url" content="https://{{ .RegistryURL }}/u/{{ .ViewedUser.Handle }}">
14
+
<meta property="og:site_name" content="ATCR">
15
+
<!-- Twitter Card (used by Discord) -->
16
+
<meta name="twitter:card" content="summary_large_image">
17
+
<meta name="twitter:title" content="{{ .ViewedUser.Handle }} - ATCR">
18
+
<meta name="twitter:description" content="Container images by {{ .ViewedUser.Handle }} on ATCR">
19
+
<meta name="twitter:image" content="https://{{ .RegistryURL }}/og/u/{{ .ViewedUser.Handle }}">
20
{{ template "head" . }}
21
</head>
22
<body>
···
27
<div class="user-profile">
28
{{ if .ViewedUser.Avatar }}
29
<img src="{{ .ViewedUser.Avatar }}" alt="{{ .ViewedUser.Handle }}" class="profile-avatar">
30
+
{{ else if .HasProfile }}
31
<div class="profile-avatar-placeholder">{{ firstChar .ViewedUser.Handle }}</div>
32
+
{{ else }}
33
+
<div class="profile-avatar-placeholder">?</div>
34
{{ end }}
35
<h1>{{ .ViewedUser.Handle }}</h1>
36
</div>
37
38
+
{{ if not .HasProfile }}
39
+
<div class="empty-state">
40
+
<p>This user hasn't set up their ATCR profile yet.</p>
41
+
</div>
42
+
{{ else if .Repositories }}
43
<div class="featured-grid">
44
{{ range .Repositories }}
45
{{ template "repo-card" . }}
-9
pkg/appview/templates/partials/push-list.html
-9
pkg/appview/templates/partials/push-list.html
···
44
</div>
45
{{ end }}
46
47
-
{{ if .HasMore }}
48
-
<button class="load-more"
49
-
hx-get="/api/recent-pushes?offset={{ .NextOffset }}"
50
-
hx-target="#push-list"
51
-
hx-swap="beforeend">
52
-
Load More
53
-
</button>
54
-
{{ end }}
55
-
56
{{ if eq (len .Pushes) 0 }}
57
<div class="empty-state">
58
<p>No pushes yet. Start using ATCR by pushing your first image!</p>
+5
-2
pkg/appview/ui.go
+5
-2
pkg/appview/ui.go
···
85
},
86
87
"sanitizeID": func(s string) string {
88
+
// Replace special CSS selector characters with dashes
89
// e.g., "sha256:abc123" becomes "sha256-abc123"
90
+
// e.g., "v0.0.2" becomes "v0-0-2"
91
+
s = strings.ReplaceAll(s, ":", "-")
92
+
s = strings.ReplaceAll(s, ".", "-")
93
+
return s
94
},
95
96
"parseLicenses": func(licensesStr string) []licenses.LicenseInfo {
+15
pkg/appview/ui_test.go
+15
pkg/appview/ui_test.go
···
483
input: "abc:",
484
expected: "abc-",
485
},
486
+
{
487
+
name: "version tag with periods",
488
+
input: "v0.0.2",
489
+
expected: "v0-0-2",
490
+
},
491
+
{
492
+
name: "colons and periods",
493
+
input: "sha256:abc.def",
494
+
expected: "sha256-abc-def",
495
+
},
496
+
{
497
+
name: "only period",
498
+
input: ".",
499
+
expected: "-",
500
+
},
501
}
502
503
for _, tt := range tests {
-65
pkg/appview/utils_test.go
-65
pkg/appview/utils_test.go
···
1
-
package appview
2
-
3
-
import (
4
-
"testing"
5
-
6
-
"atcr.io/pkg/atproto"
7
-
)
8
-
9
-
func TestResolveHoldURL(t *testing.T) {
10
-
tests := []struct {
11
-
name string
12
-
input string
13
-
expected string
14
-
}{
15
-
{
16
-
name: "DID with HTTPS domain",
17
-
input: "did:web:hold.example.com",
18
-
expected: "https://hold.example.com",
19
-
},
20
-
{
21
-
name: "DID with HTTP and port (IP)",
22
-
input: "did:web:172.28.0.3:8080",
23
-
expected: "http://172.28.0.3:8080",
24
-
},
25
-
{
26
-
name: "DID with HTTP and port (localhost)",
27
-
input: "did:web:127.0.0.1:8080",
28
-
expected: "http://127.0.0.1:8080",
29
-
},
30
-
{
31
-
name: "DID with localhost",
32
-
input: "did:web:localhost:8080",
33
-
expected: "http://localhost:8080",
34
-
},
35
-
{
36
-
name: "Already HTTPS URL (passthrough)",
37
-
input: "https://hold.example.com",
38
-
expected: "https://hold.example.com",
39
-
},
40
-
{
41
-
name: "Already HTTP URL (passthrough)",
42
-
input: "http://172.28.0.3:8080",
43
-
expected: "http://172.28.0.3:8080",
44
-
},
45
-
{
46
-
name: "Plain hostname (fallback to HTTPS)",
47
-
input: "hold.example.com",
48
-
expected: "https://hold.example.com",
49
-
},
50
-
{
51
-
name: "DID with subdomain",
52
-
input: "did:web:hold01.atcr.io",
53
-
expected: "https://hold01.atcr.io",
54
-
},
55
-
}
56
-
57
-
for _, tt := range tests {
58
-
t.Run(tt.name, func(t *testing.T) {
59
-
result := atproto.ResolveHoldURL(tt.input)
60
-
if result != tt.expected {
61
-
t.Errorf("ResolveHoldURL(%q) = %q, want %q", tt.input, result, tt.expected)
62
-
}
63
-
})
64
-
}
65
-
}
···
+74
-57
pkg/atproto/client.go
+74
-57
pkg/atproto/client.go
···
12
"strings"
13
14
"github.com/bluesky-social/indigo/atproto/atclient"
15
)
16
17
// Sentinel errors
···
19
ErrRecordNotFound = errors.New("record not found")
20
)
21
22
// Client wraps ATProto operations for the registry
23
type Client struct {
24
pdsEndpoint string
25
did string
26
accessToken string // For Basic Auth only
27
httpClient *http.Client
28
-
useIndigoClient bool // true if using indigo's OAuth client (handles auth automatically)
29
-
indigoClient *atclient.APIClient // indigo's API client for OAuth requests
30
}
31
32
// NewClient creates a new ATProto client for Basic Auth tokens (app passwords)
···
39
}
40
}
41
42
-
// NewClientWithIndigoClient creates an ATProto client using indigo's API client
43
-
// This uses indigo's native XRPC methods with automatic DPoP handling
44
-
func NewClientWithIndigoClient(pdsEndpoint, did string, indigoClient *atclient.APIClient) *Client {
45
return &Client{
46
pdsEndpoint: pdsEndpoint,
47
did: did,
48
-
useIndigoClient: true,
49
-
indigoClient: indigoClient,
50
-
httpClient: indigoClient.Client, // Keep for any fallback cases
51
}
52
}
53
···
67
"record": record,
68
}
69
70
-
// Use indigo API client (OAuth with DPoP)
71
-
if c.useIndigoClient && c.indigoClient != nil {
72
var result Record
73
-
err := c.indigoClient.Post(ctx, "com.atproto.repo.putRecord", payload, &result)
74
if err != nil {
75
return nil, fmt.Errorf("putRecord failed: %w", err)
76
}
···
113
114
// GetRecord retrieves a record from the ATProto repository
115
func (c *Client) GetRecord(ctx context.Context, collection, rkey string) (*Record, error) {
116
-
// Use indigo API client (OAuth with DPoP)
117
-
if c.useIndigoClient && c.indigoClient != nil {
118
-
params := map[string]any{
119
-
"repo": c.did,
120
-
"collection": collection,
121
-
"rkey": rkey,
122
-
}
123
124
var result Record
125
-
err := c.indigoClient.Get(ctx, "com.atproto.repo.getRecord", params, &result)
126
if err != nil {
127
// Check for RecordNotFound error from indigo's APIError type
128
var apiErr *atclient.APIError
···
187
"rkey": rkey,
188
}
189
190
-
// Use indigo API client (OAuth with DPoP)
191
-
if c.useIndigoClient && c.indigoClient != nil {
192
-
var result map[string]any // deleteRecord returns empty object on success
193
-
err := c.indigoClient.Post(ctx, "com.atproto.repo.deleteRecord", payload, &result)
194
if err != nil {
195
return fmt.Errorf("deleteRecord failed: %w", err)
196
}
···
279
280
// UploadBlob uploads binary data to the PDS and returns a blob reference
281
func (c *Client) UploadBlob(ctx context.Context, data []byte, mimeType string) (*ATProtoBlobRef, error) {
282
-
// Use indigo API client (OAuth with DPoP)
283
-
if c.useIndigoClient && c.indigoClient != nil {
284
var result struct {
285
Blob ATProtoBlobRef `json:"blob"`
286
}
287
288
-
err := c.indigoClient.LexDo(ctx,
289
-
"POST",
290
-
mimeType,
291
-
"com.atproto.repo.uploadBlob",
292
-
nil,
293
-
data,
294
-
&result,
295
-
)
296
if err != nil {
297
return nil, fmt.Errorf("uploadBlob failed: %w", err)
298
}
···
510
// GetActorProfile fetches an actor's profile from their PDS
511
// The actor parameter can be a DID or handle
512
func (c *Client) GetActorProfile(ctx context.Context, actor string) (*ActorProfile, error) {
513
-
// Use indigo API client (OAuth with DPoP)
514
-
if c.useIndigoClient && c.indigoClient != nil {
515
-
params := map[string]any{
516
-
"actor": actor,
517
-
}
518
-
519
-
var profile ActorProfile
520
-
err := c.indigoClient.Get(ctx, "app.bsky.actor.getProfile", params, &profile)
521
-
if err != nil {
522
-
return nil, fmt.Errorf("getProfile failed: %w", err)
523
-
}
524
-
return &profile, nil
525
-
}
526
-
527
-
// Basic Auth (app passwords)
528
url := fmt.Sprintf("%s/xrpc/app.bsky.actor.getProfile?actor=%s", c.pdsEndpoint, actor)
529
530
req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
···
563
// GetProfileRecord fetches the app.bsky.actor.profile record from PDS
564
// This returns the raw profile record with blob references (not CDN URLs)
565
func (c *Client) GetProfileRecord(ctx context.Context, did string) (*ProfileRecord, error) {
566
-
// Use indigo API client (OAuth with DPoP)
567
-
if c.useIndigoClient && c.indigoClient != nil {
568
-
params := map[string]any{
569
-
"repo": did,
570
-
"collection": "app.bsky.actor.profile",
571
-
"rkey": "self",
572
-
}
573
574
var result struct {
575
Value ProfileRecord `json:"value"`
576
}
577
-
578
-
err := c.indigoClient.Get(ctx, "com.atproto.repo.getRecord", params, &result)
579
if err != nil {
580
return nil, fmt.Errorf("getRecord failed: %w", err)
581
}
···
12
"strings"
13
14
"github.com/bluesky-social/indigo/atproto/atclient"
15
+
indigo_oauth "github.com/bluesky-social/indigo/atproto/auth/oauth"
16
)
17
18
// Sentinel errors
···
20
ErrRecordNotFound = errors.New("record not found")
21
)
22
23
+
// SessionProvider provides locked OAuth sessions for PDS operations.
24
+
// This interface allows the ATProto client to use DoWithSession() for each PDS call,
25
+
// preventing DPoP nonce race conditions during concurrent operations.
26
+
type SessionProvider interface {
27
+
// DoWithSession executes fn with a locked OAuth session.
28
+
// The lock is held for the entire duration, serializing DPoP nonce updates.
29
+
DoWithSession(ctx context.Context, did string, fn func(session *indigo_oauth.ClientSession) error) error
30
+
}
31
+
32
// Client wraps ATProto operations for the registry
33
type Client struct {
34
pdsEndpoint string
35
did string
36
accessToken string // For Basic Auth only
37
httpClient *http.Client
38
+
sessionProvider SessionProvider // For locked OAuth sessions (prevents DPoP nonce races)
39
}
40
41
// NewClient creates a new ATProto client for Basic Auth tokens (app passwords)
···
48
}
49
}
50
51
+
// NewClientWithSessionProvider creates an ATProto client that uses locked OAuth sessions.
52
+
// This is the preferred constructor for concurrent operations (e.g., Docker layer uploads)
53
+
// as it prevents DPoP nonce race conditions by serializing PDS calls per-DID.
54
+
//
55
+
// Each PDS call acquires a per-DID lock, ensuring that:
56
+
// - Only one goroutine at a time can negotiate DPoP nonces with the PDS
57
+
// - The session's nonce is saved to DB before other goroutines load it
58
+
// - Concurrent manifest operations don't cause nonce thrashing
59
+
func NewClientWithSessionProvider(pdsEndpoint, did string, sessionProvider SessionProvider) *Client {
60
return &Client{
61
pdsEndpoint: pdsEndpoint,
62
did: did,
63
+
sessionProvider: sessionProvider,
64
+
httpClient: &http.Client{},
65
}
66
}
67
···
81
"record": record,
82
}
83
84
+
// Use session provider (locked OAuth with DPoP) - prevents nonce races
85
+
if c.sessionProvider != nil {
86
var result Record
87
+
err := c.sessionProvider.DoWithSession(ctx, c.did, func(session *indigo_oauth.ClientSession) error {
88
+
apiClient := session.APIClient()
89
+
return apiClient.Post(ctx, "com.atproto.repo.putRecord", payload, &result)
90
+
})
91
if err != nil {
92
return nil, fmt.Errorf("putRecord failed: %w", err)
93
}
···
130
131
// GetRecord retrieves a record from the ATProto repository
132
func (c *Client) GetRecord(ctx context.Context, collection, rkey string) (*Record, error) {
133
+
params := map[string]any{
134
+
"repo": c.did,
135
+
"collection": collection,
136
+
"rkey": rkey,
137
+
}
138
139
+
// Use session provider (locked OAuth with DPoP) - prevents nonce races
140
+
if c.sessionProvider != nil {
141
var result Record
142
+
err := c.sessionProvider.DoWithSession(ctx, c.did, func(session *indigo_oauth.ClientSession) error {
143
+
apiClient := session.APIClient()
144
+
return apiClient.Get(ctx, "com.atproto.repo.getRecord", params, &result)
145
+
})
146
if err != nil {
147
// Check for RecordNotFound error from indigo's APIError type
148
var apiErr *atclient.APIError
···
207
"rkey": rkey,
208
}
209
210
+
// Use session provider (locked OAuth with DPoP) - prevents nonce races
211
+
if c.sessionProvider != nil {
212
+
err := c.sessionProvider.DoWithSession(ctx, c.did, func(session *indigo_oauth.ClientSession) error {
213
+
apiClient := session.APIClient()
214
+
var result map[string]any // deleteRecord returns empty object on success
215
+
return apiClient.Post(ctx, "com.atproto.repo.deleteRecord", payload, &result)
216
+
})
217
if err != nil {
218
return fmt.Errorf("deleteRecord failed: %w", err)
219
}
···
302
303
// UploadBlob uploads binary data to the PDS and returns a blob reference
304
func (c *Client) UploadBlob(ctx context.Context, data []byte, mimeType string) (*ATProtoBlobRef, error) {
305
+
// Use session provider (locked OAuth with DPoP) - prevents nonce races
306
+
if c.sessionProvider != nil {
307
var result struct {
308
Blob ATProtoBlobRef `json:"blob"`
309
}
310
311
+
err := c.sessionProvider.DoWithSession(ctx, c.did, func(session *indigo_oauth.ClientSession) error {
312
+
apiClient := session.APIClient()
313
+
// IMPORTANT: Use io.Reader for blob uploads
314
+
// LexDo JSON-encodes []byte (base64), but streams io.Reader as raw bytes
315
+
// Use the actual MIME type so PDS can validate against blob:image/* scope
316
+
return apiClient.LexDo(ctx,
317
+
"POST",
318
+
mimeType,
319
+
"com.atproto.repo.uploadBlob",
320
+
nil,
321
+
bytes.NewReader(data),
322
+
&result,
323
+
)
324
+
})
325
if err != nil {
326
return nil, fmt.Errorf("uploadBlob failed: %w", err)
327
}
···
539
// GetActorProfile fetches an actor's profile from their PDS
540
// The actor parameter can be a DID or handle
541
func (c *Client) GetActorProfile(ctx context.Context, actor string) (*ActorProfile, error) {
542
+
// Basic Auth (app passwords) or unauthenticated
543
url := fmt.Sprintf("%s/xrpc/app.bsky.actor.getProfile?actor=%s", c.pdsEndpoint, actor)
544
545
req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
···
578
// GetProfileRecord fetches the app.bsky.actor.profile record from PDS
579
// This returns the raw profile record with blob references (not CDN URLs)
580
func (c *Client) GetProfileRecord(ctx context.Context, did string) (*ProfileRecord, error) {
581
+
params := map[string]any{
582
+
"repo": did,
583
+
"collection": "app.bsky.actor.profile",
584
+
"rkey": "self",
585
+
}
586
587
+
// Use session provider (locked OAuth with DPoP) - prevents nonce races
588
+
if c.sessionProvider != nil {
589
var result struct {
590
Value ProfileRecord `json:"value"`
591
}
592
+
err := c.sessionProvider.DoWithSession(ctx, c.did, func(session *indigo_oauth.ClientSession) error {
593
+
apiClient := session.APIClient()
594
+
return apiClient.Get(ctx, "com.atproto.repo.getRecord", params, &result)
595
+
})
596
if err != nil {
597
return nil, fmt.Errorf("getRecord failed: %w", err)
598
}
+2
-17
pkg/atproto/client_test.go
+2
-17
pkg/atproto/client_test.go
···
23
if client.accessToken != "token123" {
24
t.Errorf("accessToken = %v, want token123", client.accessToken)
25
}
26
-
if client.useIndigoClient {
27
-
t.Error("useIndigoClient should be false for Basic Auth client")
28
}
29
}
30
···
1001
if client.PDSEndpoint() != expectedEndpoint {
1002
t.Errorf("PDSEndpoint() = %v, want %v", client.PDSEndpoint(), expectedEndpoint)
1003
}
1004
-
}
1005
-
1006
-
// TestNewClientWithIndigoClient tests client initialization with Indigo client
1007
-
func TestNewClientWithIndigoClient(t *testing.T) {
1008
-
// Note: We can't easily create a real indigo client in tests without complex setup
1009
-
// We pass nil for the indigo client, which is acceptable for testing the constructor
1010
-
// The actual client.go code will handle nil indigo client by checking before use
1011
-
1012
-
// Skip this test for now as it requires a real indigo client
1013
-
// The function is tested indirectly through integration tests
1014
-
t.Skip("Skipping TestNewClientWithIndigoClient - requires real indigo client setup")
1015
-
1016
-
// When properly set up with a real indigo client, the test would look like:
1017
-
// client := NewClientWithIndigoClient("https://pds.example.com", "did:plc:test123", indigoClient)
1018
-
// if !client.useIndigoClient { t.Error("useIndigoClient should be true") }
1019
}
1020
1021
// TestListRecordsError tests error handling in ListRecords
···
23
if client.accessToken != "token123" {
24
t.Errorf("accessToken = %v, want token123", client.accessToken)
25
}
26
+
if client.sessionProvider != nil {
27
+
t.Error("sessionProvider should be nil for Basic Auth client")
28
}
29
}
30
···
1001
if client.PDSEndpoint() != expectedEndpoint {
1002
t.Errorf("PDSEndpoint() = %v, want %v", client.PDSEndpoint(), expectedEndpoint)
1003
}
1004
}
1005
1006
// TestListRecordsError tests error handling in ListRecords
+43
-14
pkg/atproto/lexicon.go
+43
-14
pkg/atproto/lexicon.go
···
18
// TagCollection is the collection name for image tags
19
TagCollection = "io.atcr.tag"
20
21
-
// HoldCollection is the collection name for storage holds (BYOS)
22
-
HoldCollection = "io.atcr.hold"
23
-
24
// HoldCrewCollection is the collection name for hold crew (membership) - LEGACY BYOS model
25
// Stored in owner's PDS for BYOS holds
26
HoldCrewCollection = "io.atcr.hold.crew"
···
42
// Stored in hold's embedded PDS (singleton record at rkey "self")
43
TangledProfileCollection = "sh.tangled.actor.profile"
44
45
// SailorProfileCollection is the collection name for user profiles
46
SailorProfileCollection = "io.atcr.sailor.profile"
47
48
// StarCollection is the collection name for repository stars
49
StarCollection = "io.atcr.sailor.star"
50
)
51
52
// ManifestRecord represents a container image manifest stored in ATProto
···
306
CreatedAt time.Time `json:"createdAt"`
307
}
308
309
-
// NewHoldRecord creates a new hold record
310
-
func NewHoldRecord(endpoint, owner string, public bool) *HoldRecord {
311
-
return &HoldRecord{
312
-
Type: HoldCollection,
313
-
Endpoint: endpoint,
314
-
Owner: owner,
315
-
Public: public,
316
-
CreatedAt: time.Now(),
317
-
}
318
-
}
319
-
320
// SailorProfileRecord represents a user's profile with registry preferences
321
// Stored in the user's PDS to configure default hold and other settings
322
type SailorProfileRecord struct {
···
342
return &SailorProfileRecord{
343
Type: SailorProfileCollection,
344
DefaultHold: defaultHold,
345
CreatedAt: now,
346
UpdatedAt: now,
347
}
···
18
// TagCollection is the collection name for image tags
19
TagCollection = "io.atcr.tag"
20
21
// HoldCrewCollection is the collection name for hold crew (membership) - LEGACY BYOS model
22
// Stored in owner's PDS for BYOS holds
23
HoldCrewCollection = "io.atcr.hold.crew"
···
39
// Stored in hold's embedded PDS (singleton record at rkey "self")
40
TangledProfileCollection = "sh.tangled.actor.profile"
41
42
+
// BskyPostCollection is the collection name for Bluesky posts
43
+
BskyPostCollection = "app.bsky.feed.post"
44
+
45
// SailorProfileCollection is the collection name for user profiles
46
SailorProfileCollection = "io.atcr.sailor.profile"
47
48
// StarCollection is the collection name for repository stars
49
StarCollection = "io.atcr.sailor.star"
50
+
51
+
// RepoPageCollection is the collection name for repository page metadata
52
+
// Stored in user's PDS with rkey = repository name
53
+
RepoPageCollection = "io.atcr.repo.page"
54
)
55
56
// ManifestRecord represents a container image manifest stored in ATProto
···
310
CreatedAt time.Time `json:"createdAt"`
311
}
312
313
// SailorProfileRecord represents a user's profile with registry preferences
314
// Stored in the user's PDS to configure default hold and other settings
315
type SailorProfileRecord struct {
···
335
return &SailorProfileRecord{
336
Type: SailorProfileCollection,
337
DefaultHold: defaultHold,
338
+
CreatedAt: now,
339
+
UpdatedAt: now,
340
+
}
341
+
}
342
+
343
+
// RepoPageRecord represents repository page metadata (description + avatar)
344
+
// Stored in the user's PDS with rkey = repository name
345
+
// Users can edit this directly in their PDS to customize their repository page
346
+
type RepoPageRecord struct {
347
+
// Type should be "io.atcr.repo.page"
348
+
Type string `json:"$type"`
349
+
350
+
// Repository is the name of the repository (e.g., "myapp")
351
+
Repository string `json:"repository"`
352
+
353
+
// Description is the markdown README/description content
354
+
Description string `json:"description,omitempty"`
355
+
356
+
// Avatar is the repository avatar/icon blob reference
357
+
Avatar *ATProtoBlobRef `json:"avatar,omitempty"`
358
+
359
+
// CreatedAt timestamp
360
+
CreatedAt time.Time `json:"createdAt"`
361
+
362
+
// UpdatedAt timestamp
363
+
UpdatedAt time.Time `json:"updatedAt"`
364
+
}
365
+
366
+
// NewRepoPageRecord creates a new repo page record
367
+
func NewRepoPageRecord(repository, description string, avatar *ATProtoBlobRef) *RepoPageRecord {
368
+
now := time.Now()
369
+
return &RepoPageRecord{
370
+
Type: RepoPageCollection,
371
+
Repository: repository,
372
+
Description: description,
373
+
Avatar: avatar,
374
CreatedAt: now,
375
UpdatedAt: now,
376
}
+132
-50
pkg/atproto/lexicon_test.go
+132
-50
pkg/atproto/lexicon_test.go
···
452
}
453
}
454
455
-
func TestNewHoldRecord(t *testing.T) {
456
-
tests := []struct {
457
-
name string
458
-
endpoint string
459
-
owner string
460
-
public bool
461
-
}{
462
-
{
463
-
name: "public hold",
464
-
endpoint: "https://hold1.example.com",
465
-
owner: "did:plc:alice123",
466
-
public: true,
467
-
},
468
-
{
469
-
name: "private hold",
470
-
endpoint: "https://hold2.example.com",
471
-
owner: "did:plc:bob456",
472
-
public: false,
473
-
},
474
-
}
475
-
476
-
for _, tt := range tests {
477
-
t.Run(tt.name, func(t *testing.T) {
478
-
before := time.Now()
479
-
record := NewHoldRecord(tt.endpoint, tt.owner, tt.public)
480
-
after := time.Now()
481
-
482
-
if record.Type != HoldCollection {
483
-
t.Errorf("Type = %v, want %v", record.Type, HoldCollection)
484
-
}
485
-
486
-
if record.Endpoint != tt.endpoint {
487
-
t.Errorf("Endpoint = %v, want %v", record.Endpoint, tt.endpoint)
488
-
}
489
-
490
-
if record.Owner != tt.owner {
491
-
t.Errorf("Owner = %v, want %v", record.Owner, tt.owner)
492
-
}
493
-
494
-
if record.Public != tt.public {
495
-
t.Errorf("Public = %v, want %v", record.Public, tt.public)
496
-
}
497
-
498
-
if record.CreatedAt.Before(before) || record.CreatedAt.After(after) {
499
-
t.Errorf("CreatedAt = %v, want between %v and %v", record.CreatedAt, before, after)
500
-
}
501
-
})
502
-
}
503
-
}
504
-
505
func TestNewSailorProfileRecord(t *testing.T) {
506
tests := []struct {
507
name string
···
1285
t.Errorf("CreatedAt = %q, want %q", decoded.CreatedAt, record.CreatedAt)
1286
}
1287
}
···
452
}
453
}
454
455
func TestNewSailorProfileRecord(t *testing.T) {
456
tests := []struct {
457
name string
···
1235
t.Errorf("CreatedAt = %q, want %q", decoded.CreatedAt, record.CreatedAt)
1236
}
1237
}
1238
+
1239
+
func TestNewRepoPageRecord(t *testing.T) {
1240
+
tests := []struct {
1241
+
name string
1242
+
repository string
1243
+
description string
1244
+
avatar *ATProtoBlobRef
1245
+
}{
1246
+
{
1247
+
name: "with description only",
1248
+
repository: "myapp",
1249
+
description: "# My App\n\nA cool container image.",
1250
+
avatar: nil,
1251
+
},
1252
+
{
1253
+
name: "with avatar only",
1254
+
repository: "another-app",
1255
+
description: "",
1256
+
avatar: &ATProtoBlobRef{
1257
+
Type: "blob",
1258
+
Ref: Link{Link: "bafyreiabc123"},
1259
+
MimeType: "image/png",
1260
+
Size: 1024,
1261
+
},
1262
+
},
1263
+
{
1264
+
name: "with both description and avatar",
1265
+
repository: "full-app",
1266
+
description: "This is a full description.",
1267
+
avatar: &ATProtoBlobRef{
1268
+
Type: "blob",
1269
+
Ref: Link{Link: "bafyreiabc456"},
1270
+
MimeType: "image/jpeg",
1271
+
Size: 2048,
1272
+
},
1273
+
},
1274
+
{
1275
+
name: "empty values",
1276
+
repository: "",
1277
+
description: "",
1278
+
avatar: nil,
1279
+
},
1280
+
}
1281
+
1282
+
for _, tt := range tests {
1283
+
t.Run(tt.name, func(t *testing.T) {
1284
+
before := time.Now()
1285
+
record := NewRepoPageRecord(tt.repository, tt.description, tt.avatar)
1286
+
after := time.Now()
1287
+
1288
+
if record.Type != RepoPageCollection {
1289
+
t.Errorf("Type = %v, want %v", record.Type, RepoPageCollection)
1290
+
}
1291
+
1292
+
if record.Repository != tt.repository {
1293
+
t.Errorf("Repository = %v, want %v", record.Repository, tt.repository)
1294
+
}
1295
+
1296
+
if record.Description != tt.description {
1297
+
t.Errorf("Description = %v, want %v", record.Description, tt.description)
1298
+
}
1299
+
1300
+
if tt.avatar == nil && record.Avatar != nil {
1301
+
t.Error("Avatar should be nil")
1302
+
}
1303
+
1304
+
if tt.avatar != nil {
1305
+
if record.Avatar == nil {
1306
+
t.Fatal("Avatar should not be nil")
1307
+
}
1308
+
if record.Avatar.Ref.Link != tt.avatar.Ref.Link {
1309
+
t.Errorf("Avatar.Ref.Link = %v, want %v", record.Avatar.Ref.Link, tt.avatar.Ref.Link)
1310
+
}
1311
+
}
1312
+
1313
+
if record.CreatedAt.Before(before) || record.CreatedAt.After(after) {
1314
+
t.Errorf("CreatedAt = %v, want between %v and %v", record.CreatedAt, before, after)
1315
+
}
1316
+
1317
+
if record.UpdatedAt.Before(before) || record.UpdatedAt.After(after) {
1318
+
t.Errorf("UpdatedAt = %v, want between %v and %v", record.UpdatedAt, before, after)
1319
+
}
1320
+
1321
+
// CreatedAt and UpdatedAt should be equal for new records
1322
+
if !record.CreatedAt.Equal(record.UpdatedAt) {
1323
+
t.Errorf("CreatedAt (%v) != UpdatedAt (%v)", record.CreatedAt, record.UpdatedAt)
1324
+
}
1325
+
})
1326
+
}
1327
+
}
1328
+
1329
+
func TestRepoPageRecord_JSONSerialization(t *testing.T) {
1330
+
record := NewRepoPageRecord(
1331
+
"myapp",
1332
+
"# My App\n\nA description with **markdown**.",
1333
+
&ATProtoBlobRef{
1334
+
Type: "blob",
1335
+
Ref: Link{Link: "bafyreiabc123"},
1336
+
MimeType: "image/png",
1337
+
Size: 1024,
1338
+
},
1339
+
)
1340
+
1341
+
// Serialize to JSON
1342
+
jsonData, err := json.Marshal(record)
1343
+
if err != nil {
1344
+
t.Fatalf("json.Marshal() error = %v", err)
1345
+
}
1346
+
1347
+
// Deserialize from JSON
1348
+
var decoded RepoPageRecord
1349
+
if err := json.Unmarshal(jsonData, &decoded); err != nil {
1350
+
t.Fatalf("json.Unmarshal() error = %v", err)
1351
+
}
1352
+
1353
+
// Verify fields
1354
+
if decoded.Type != record.Type {
1355
+
t.Errorf("Type = %v, want %v", decoded.Type, record.Type)
1356
+
}
1357
+
if decoded.Repository != record.Repository {
1358
+
t.Errorf("Repository = %v, want %v", decoded.Repository, record.Repository)
1359
+
}
1360
+
if decoded.Description != record.Description {
1361
+
t.Errorf("Description = %v, want %v", decoded.Description, record.Description)
1362
+
}
1363
+
if decoded.Avatar == nil {
1364
+
t.Fatal("Avatar should not be nil")
1365
+
}
1366
+
if decoded.Avatar.Ref.Link != record.Avatar.Ref.Link {
1367
+
t.Errorf("Avatar.Ref.Link = %v, want %v", decoded.Avatar.Ref.Link, record.Avatar.Ref.Link)
1368
+
}
1369
+
}
+142
pkg/auth/cache.go
+142
pkg/auth/cache.go
···
···
1
+
// Package token provides service token caching and management for AppView.
2
+
// Service tokens are JWTs issued by a user's PDS to authorize AppView to
3
+
// act on their behalf when communicating with hold services. Tokens are
4
+
// cached with automatic expiry parsing and 10-second safety margins.
5
+
package auth
6
+
7
+
import (
8
+
"log/slog"
9
+
"sync"
10
+
"time"
11
+
)
12
+
13
+
// serviceTokenEntry represents a cached service token
14
+
type serviceTokenEntry struct {
15
+
token string
16
+
expiresAt time.Time
17
+
err error
18
+
once sync.Once
19
+
}
20
+
21
+
// Global cache for service tokens (DID:HoldDID -> token)
22
+
// Service tokens are JWTs issued by a user's PDS to authorize AppView to act on their behalf
23
+
// when communicating with hold services. These tokens are scoped to specific holds and have
24
+
// limited lifetime (typically 60s, can request up to 5min).
25
+
var (
26
+
globalServiceTokens = make(map[string]*serviceTokenEntry)
27
+
globalServiceTokensMu sync.RWMutex
28
+
)
29
+
30
+
// GetServiceToken retrieves a cached service token for the given DID and hold DID
31
+
// Returns empty string if no valid cached token exists
32
+
func GetServiceToken(did, holdDID string) (token string, expiresAt time.Time) {
33
+
cacheKey := did + ":" + holdDID
34
+
35
+
globalServiceTokensMu.RLock()
36
+
entry, exists := globalServiceTokens[cacheKey]
37
+
globalServiceTokensMu.RUnlock()
38
+
39
+
if !exists {
40
+
return "", time.Time{}
41
+
}
42
+
43
+
// Check if token is still valid
44
+
if time.Now().After(entry.expiresAt) {
45
+
// Token expired, remove from cache
46
+
globalServiceTokensMu.Lock()
47
+
delete(globalServiceTokens, cacheKey)
48
+
globalServiceTokensMu.Unlock()
49
+
return "", time.Time{}
50
+
}
51
+
52
+
return entry.token, entry.expiresAt
53
+
}
54
+
55
+
// SetServiceToken stores a service token in the cache
56
+
// Automatically parses the JWT to extract the expiry time
57
+
// Applies a 10-second safety margin (cache expires 10s before actual JWT expiry)
58
+
func SetServiceToken(did, holdDID, token string) error {
59
+
cacheKey := did + ":" + holdDID
60
+
61
+
// Parse JWT to extract expiry (don't verify signature - we trust the PDS)
62
+
expiry, err := ParseJWTExpiry(token)
63
+
if err != nil {
64
+
// If parsing fails, use default 50s TTL (conservative fallback)
65
+
slog.Warn("Failed to parse JWT expiry, using default 50s", "error", err, "cacheKey", cacheKey)
66
+
expiry = time.Now().Add(50 * time.Second)
67
+
} else {
68
+
// Apply 10s safety margin to avoid using nearly-expired tokens
69
+
expiry = expiry.Add(-10 * time.Second)
70
+
}
71
+
72
+
globalServiceTokensMu.Lock()
73
+
globalServiceTokens[cacheKey] = &serviceTokenEntry{
74
+
token: token,
75
+
expiresAt: expiry,
76
+
}
77
+
globalServiceTokensMu.Unlock()
78
+
79
+
slog.Debug("Cached service token",
80
+
"cacheKey", cacheKey,
81
+
"expiresIn", time.Until(expiry).Round(time.Second))
82
+
83
+
return nil
84
+
}
85
+
86
+
// InvalidateServiceToken removes a service token from the cache
87
+
// Used when we detect that a token is invalid or the user's session has expired
88
+
func InvalidateServiceToken(did, holdDID string) {
89
+
cacheKey := did + ":" + holdDID
90
+
91
+
globalServiceTokensMu.Lock()
92
+
delete(globalServiceTokens, cacheKey)
93
+
globalServiceTokensMu.Unlock()
94
+
95
+
slog.Debug("Invalidated service token", "cacheKey", cacheKey)
96
+
}
97
+
98
+
// GetCacheStats returns statistics about the service token cache for debugging
99
+
func GetCacheStats() map[string]any {
100
+
globalServiceTokensMu.RLock()
101
+
defer globalServiceTokensMu.RUnlock()
102
+
103
+
validCount := 0
104
+
expiredCount := 0
105
+
now := time.Now()
106
+
107
+
for _, entry := range globalServiceTokens {
108
+
if now.Before(entry.expiresAt) {
109
+
validCount++
110
+
} else {
111
+
expiredCount++
112
+
}
113
+
}
114
+
115
+
return map[string]any{
116
+
"total_entries": len(globalServiceTokens),
117
+
"valid_tokens": validCount,
118
+
"expired_tokens": expiredCount,
119
+
}
120
+
}
121
+
122
+
// CleanExpiredTokens removes expired tokens from the cache
123
+
// Can be called periodically to prevent unbounded growth (though expired tokens
124
+
// are also removed lazily on access)
125
+
func CleanExpiredTokens() {
126
+
globalServiceTokensMu.Lock()
127
+
defer globalServiceTokensMu.Unlock()
128
+
129
+
now := time.Now()
130
+
removed := 0
131
+
132
+
for key, entry := range globalServiceTokens {
133
+
if now.After(entry.expiresAt) {
134
+
delete(globalServiceTokens, key)
135
+
removed++
136
+
}
137
+
}
138
+
139
+
if removed > 0 {
140
+
slog.Debug("Cleaned expired service tokens", "count", removed)
141
+
}
142
+
}
+195
pkg/auth/cache_test.go
+195
pkg/auth/cache_test.go
···
···
1
+
package auth
2
+
3
+
import (
4
+
"testing"
5
+
"time"
6
+
)
7
+
8
+
func TestGetServiceToken_NotCached(t *testing.T) {
9
+
// Clear cache first
10
+
globalServiceTokensMu.Lock()
11
+
globalServiceTokens = make(map[string]*serviceTokenEntry)
12
+
globalServiceTokensMu.Unlock()
13
+
14
+
did := "did:plc:test123"
15
+
holdDID := "did:web:hold.example.com"
16
+
17
+
token, expiresAt := GetServiceToken(did, holdDID)
18
+
if token != "" {
19
+
t.Errorf("Expected empty token for uncached entry, got %q", token)
20
+
}
21
+
if !expiresAt.IsZero() {
22
+
t.Error("Expected zero time for uncached entry")
23
+
}
24
+
}
25
+
26
+
func TestSetServiceToken_ManualExpiry(t *testing.T) {
27
+
// Clear cache first
28
+
globalServiceTokensMu.Lock()
29
+
globalServiceTokens = make(map[string]*serviceTokenEntry)
30
+
globalServiceTokensMu.Unlock()
31
+
32
+
did := "did:plc:test123"
33
+
holdDID := "did:web:hold.example.com"
34
+
token := "invalid_jwt_token" // Will fall back to 50s default
35
+
36
+
// This should succeed with default 50s TTL since JWT parsing will fail
37
+
err := SetServiceToken(did, holdDID, token)
38
+
if err != nil {
39
+
t.Fatalf("SetServiceToken() error = %v", err)
40
+
}
41
+
42
+
// Verify token was cached
43
+
cachedToken, expiresAt := GetServiceToken(did, holdDID)
44
+
if cachedToken != token {
45
+
t.Errorf("Expected token %q, got %q", token, cachedToken)
46
+
}
47
+
if expiresAt.IsZero() {
48
+
t.Error("Expected non-zero expiry time")
49
+
}
50
+
51
+
// Expiry should be approximately 50s from now (with 10s margin subtracted in some cases)
52
+
expectedExpiry := time.Now().Add(50 * time.Second)
53
+
diff := expiresAt.Sub(expectedExpiry)
54
+
if diff < -5*time.Second || diff > 5*time.Second {
55
+
t.Errorf("Expiry time off by %v (expected ~50s from now)", diff)
56
+
}
57
+
}
58
+
59
+
func TestGetServiceToken_Expired(t *testing.T) {
60
+
// Manually insert an expired token
61
+
did := "did:plc:test123"
62
+
holdDID := "did:web:hold.example.com"
63
+
cacheKey := did + ":" + holdDID
64
+
65
+
globalServiceTokensMu.Lock()
66
+
globalServiceTokens[cacheKey] = &serviceTokenEntry{
67
+
token: "expired_token",
68
+
expiresAt: time.Now().Add(-1 * time.Hour), // 1 hour ago
69
+
}
70
+
globalServiceTokensMu.Unlock()
71
+
72
+
// Try to get - should return empty since expired
73
+
token, expiresAt := GetServiceToken(did, holdDID)
74
+
if token != "" {
75
+
t.Errorf("Expected empty token for expired entry, got %q", token)
76
+
}
77
+
if !expiresAt.IsZero() {
78
+
t.Error("Expected zero time for expired entry")
79
+
}
80
+
81
+
// Verify token was removed from cache
82
+
globalServiceTokensMu.RLock()
83
+
_, exists := globalServiceTokens[cacheKey]
84
+
globalServiceTokensMu.RUnlock()
85
+
86
+
if exists {
87
+
t.Error("Expected expired token to be removed from cache")
88
+
}
89
+
}
90
+
91
+
func TestInvalidateServiceToken(t *testing.T) {
92
+
// Set a token
93
+
did := "did:plc:test123"
94
+
holdDID := "did:web:hold.example.com"
95
+
token := "test_token"
96
+
97
+
err := SetServiceToken(did, holdDID, token)
98
+
if err != nil {
99
+
t.Fatalf("SetServiceToken() error = %v", err)
100
+
}
101
+
102
+
// Verify it's cached
103
+
cachedToken, _ := GetServiceToken(did, holdDID)
104
+
if cachedToken != token {
105
+
t.Fatal("Token should be cached")
106
+
}
107
+
108
+
// Invalidate
109
+
InvalidateServiceToken(did, holdDID)
110
+
111
+
// Verify it's gone
112
+
cachedToken, _ = GetServiceToken(did, holdDID)
113
+
if cachedToken != "" {
114
+
t.Error("Expected token to be invalidated")
115
+
}
116
+
}
117
+
118
+
func TestCleanExpiredTokens(t *testing.T) {
119
+
// Clear cache first
120
+
globalServiceTokensMu.Lock()
121
+
globalServiceTokens = make(map[string]*serviceTokenEntry)
122
+
globalServiceTokensMu.Unlock()
123
+
124
+
// Add expired and valid tokens
125
+
globalServiceTokensMu.Lock()
126
+
globalServiceTokens["expired:hold1"] = &serviceTokenEntry{
127
+
token: "expired1",
128
+
expiresAt: time.Now().Add(-1 * time.Hour),
129
+
}
130
+
globalServiceTokens["valid:hold2"] = &serviceTokenEntry{
131
+
token: "valid1",
132
+
expiresAt: time.Now().Add(1 * time.Hour),
133
+
}
134
+
globalServiceTokensMu.Unlock()
135
+
136
+
// Clean expired
137
+
CleanExpiredTokens()
138
+
139
+
// Verify only valid token remains
140
+
globalServiceTokensMu.RLock()
141
+
_, expiredExists := globalServiceTokens["expired:hold1"]
142
+
_, validExists := globalServiceTokens["valid:hold2"]
143
+
globalServiceTokensMu.RUnlock()
144
+
145
+
if expiredExists {
146
+
t.Error("Expected expired token to be removed")
147
+
}
148
+
if !validExists {
149
+
t.Error("Expected valid token to remain")
150
+
}
151
+
}
152
+
153
+
func TestGetCacheStats(t *testing.T) {
154
+
// Clear cache first
155
+
globalServiceTokensMu.Lock()
156
+
globalServiceTokens = make(map[string]*serviceTokenEntry)
157
+
globalServiceTokensMu.Unlock()
158
+
159
+
// Add some tokens
160
+
globalServiceTokensMu.Lock()
161
+
globalServiceTokens["did1:hold1"] = &serviceTokenEntry{
162
+
token: "token1",
163
+
expiresAt: time.Now().Add(1 * time.Hour),
164
+
}
165
+
globalServiceTokens["did2:hold2"] = &serviceTokenEntry{
166
+
token: "token2",
167
+
expiresAt: time.Now().Add(1 * time.Hour),
168
+
}
169
+
globalServiceTokensMu.Unlock()
170
+
171
+
stats := GetCacheStats()
172
+
if stats == nil {
173
+
t.Fatal("Expected non-nil stats")
174
+
}
175
+
176
+
// GetCacheStats returns map[string]any with "total_entries" key
177
+
totalEntries, ok := stats["total_entries"].(int)
178
+
if !ok {
179
+
t.Fatalf("Expected total_entries in stats map, got: %v", stats)
180
+
}
181
+
182
+
if totalEntries != 2 {
183
+
t.Errorf("Expected 2 entries, got %d", totalEntries)
184
+
}
185
+
186
+
// Also check valid_tokens
187
+
validTokens, ok := stats["valid_tokens"].(int)
188
+
if !ok {
189
+
t.Fatal("Expected valid_tokens in stats map")
190
+
}
191
+
192
+
if validTokens != 2 {
193
+
t.Errorf("Expected 2 valid tokens, got %d", validTokens)
194
+
}
195
+
}
+191
-34
pkg/auth/oauth/client.go
+191
-34
pkg/auth/oauth/client.go
···
9
"fmt"
10
"log/slog"
11
"strings"
12
"time"
13
14
"atcr.io/pkg/atproto"
···
26
27
// If production (not localhost), automatically set up confidential client
28
if !isLocalhost(baseURL) {
29
-
clientID := baseURL + "/client-metadata.json"
30
config = oauth.NewPublicConfig(clientID, redirectURI, scopes)
31
32
// Generate or load P-256 key
···
46
return nil, fmt.Errorf("failed to configure confidential client: %w", err)
47
}
48
49
-
slog.Info("Configured confidential OAuth client", "key_id", keyID, "key_path", keyPath)
50
} else {
51
config = oauth.NewLocalhostConfig(redirectURI, scopes)
52
···
64
return baseURL + "/auth/oauth/callback"
65
}
66
67
-
// GetDefaultScopes returns the default OAuth scopes for ATCR registry operations
68
-
// testMode determines whether to use transition:generic (test) or rpc scopes (production)
69
func GetDefaultScopes(did string) []string {
70
-
scopes := []string{
71
"atproto",
72
// Image manifest types (single-arch)
73
"blob:application/vnd.oci.image.manifest.v1+json",
74
"blob:application/vnd.docker.distribution.manifest.v2+json",
···
77
"blob:application/vnd.docker.distribution.manifest.list.v2+json",
78
// OCI artifact manifests (for cosign signatures, SBOMs, attestations)
79
"blob:application/vnd.cncf.oras.artifact.manifest.v1+json",
80
-
// Used for service token validation on holds
81
-
"rpc:com.atproto.repo.getRecord?aud=*",
82
}
83
-
84
-
// Add repo scopes
85
-
scopes = append(scopes,
86
-
fmt.Sprintf("repo:%s", atproto.ManifestCollection),
87
-
fmt.Sprintf("repo:%s", atproto.TagCollection),
88
-
fmt.Sprintf("repo:%s", atproto.StarCollection),
89
-
fmt.Sprintf("repo:%s", atproto.SailorProfileCollection),
90
-
)
91
-
92
-
return scopes
93
}
94
95
// ScopesMatch checks if two scope lists are equivalent (order-independent)
···
146
type Refresher struct {
147
clientApp *oauth.ClientApp
148
uiSessionStore UISessionStore // For invalidating UI sessions on OAuth failures
149
}
150
151
// NewRefresher creates a new session refresher
···
160
r.uiSessionStore = store
161
}
162
163
-
// GetSession gets a fresh OAuth session for a DID
164
-
// Loads session from database on every request (database is source of truth)
165
-
func (r *Refresher) GetSession(ctx context.Context, did string) (*oauth.ClientSession, error) {
166
-
return r.resumeSession(ctx, did)
167
}
168
169
// resumeSession loads a session from storage
···
190
return nil, fmt.Errorf("no session found for DID: %s", did)
191
}
192
193
-
// Validate that session scopes match current desired scopes
194
desiredScopes := r.clientApp.Config.Scopes
195
if !ScopesMatch(sessionData.Scopes, desiredScopes) {
196
-
slog.Debug("Scope mismatch, deleting session",
197
"did", did,
198
"storedScopes", sessionData.Scopes,
199
"desiredScopes", desiredScopes)
200
-
201
-
// Delete the session from database since scopes have changed
202
-
if err := r.clientApp.Store.DeleteSession(ctx, accountDID, sessionID); err != nil {
203
-
slog.Warn("Failed to delete session with mismatched scopes", "error", err, "did", did)
204
-
}
205
-
206
-
return nil, fmt.Errorf("OAuth scopes changed, re-authentication required")
207
}
208
209
// Resume session
···
213
}
214
215
// Set up callback to persist token updates to SQLite
216
-
// This ensures that when indigo automatically refreshes tokens,
217
-
// the new tokens are saved to the database immediately
218
session.PersistSessionCallback = func(callbackCtx context.Context, updatedData *oauth.ClientSessionData) {
219
if err := r.clientApp.Store.SaveSession(callbackCtx, *updatedData); err != nil {
220
slog.Error("Failed to persist OAuth session update",
···
223
"sessionID", sessionID,
224
"error", err)
225
} else {
226
-
slog.Debug("Persisted OAuth token refresh to database",
227
"component", "oauth/refresher",
228
"did", did,
229
-
"sessionID", sessionID)
230
}
231
}
232
return session, nil
233
}
···
9
"fmt"
10
"log/slog"
11
"strings"
12
+
"sync"
13
"time"
14
15
"atcr.io/pkg/atproto"
···
27
28
// If production (not localhost), automatically set up confidential client
29
if !isLocalhost(baseURL) {
30
+
clientID := baseURL + "/oauth-client-metadata.json"
31
config = oauth.NewPublicConfig(clientID, redirectURI, scopes)
32
33
// Generate or load P-256 key
···
47
return nil, fmt.Errorf("failed to configure confidential client: %w", err)
48
}
49
50
+
// Log clock information for debugging timestamp issues
51
+
now := time.Now()
52
+
slog.Info("Configured confidential OAuth client",
53
+
"key_id", keyID,
54
+
"key_path", keyPath,
55
+
"system_time_unix", now.Unix(),
56
+
"system_time_rfc3339", now.Format(time.RFC3339),
57
+
"timezone", now.Location().String())
58
} else {
59
config = oauth.NewLocalhostConfig(redirectURI, scopes)
60
···
72
return baseURL + "/auth/oauth/callback"
73
}
74
75
+
// GetDefaultScopes returns the default OAuth scopes for ATCR registry operations.
76
+
// Includes io.atcr.authFullApp permission-set plus individual scopes for PDS compatibility.
77
+
// Blob scopes are listed explicitly (not supported in Lexicon permission-sets).
78
func GetDefaultScopes(did string) []string {
79
+
return []string{
80
"atproto",
81
+
// Permission-set (for future PDS support)
82
+
// See lexicons/io/atcr/authFullApp.json for definition
83
+
// Uses "include:" prefix per ATProto permission spec
84
+
"include:io.atcr.authFullApp",
85
+
// com.atproto scopes must be separate (permission-sets are namespace-limited)
86
+
"rpc:com.atproto.repo.getRecord?aud=*",
87
+
// Blob scopes (not supported in Lexicon permission-sets)
88
// Image manifest types (single-arch)
89
"blob:application/vnd.oci.image.manifest.v1+json",
90
"blob:application/vnd.docker.distribution.manifest.v2+json",
···
93
"blob:application/vnd.docker.distribution.manifest.list.v2+json",
94
// OCI artifact manifests (for cosign signatures, SBOMs, attestations)
95
"blob:application/vnd.cncf.oras.artifact.manifest.v1+json",
96
+
// Image avatars
97
+
"blob:image/*",
98
}
99
}
100
101
// ScopesMatch checks if two scope lists are equivalent (order-independent)
···
152
type Refresher struct {
153
clientApp *oauth.ClientApp
154
uiSessionStore UISessionStore // For invalidating UI sessions on OAuth failures
155
+
didLocks sync.Map // Per-DID mutexes to prevent concurrent DPoP nonce races
156
}
157
158
// NewRefresher creates a new session refresher
···
167
r.uiSessionStore = store
168
}
169
170
+
// DoWithSession executes a function with a locked OAuth session.
171
+
// The lock is held for the entire duration of the function, preventing DPoP nonce races.
172
+
//
173
+
// This is the preferred way to make PDS requests that require OAuth/DPoP authentication.
174
+
// The lock is held through the entire PDS interaction, ensuring that:
175
+
// 1. Only one goroutine at a time can negotiate DPoP nonces with the PDS for a given DID
176
+
// 2. The session's PersistSessionCallback saves the updated nonce before other goroutines load
177
+
// 3. Concurrent layer uploads don't race on stale nonces
178
+
//
179
+
// Why locking is critical:
180
+
// During docker push, multiple layers upload concurrently. Each layer creates a new
181
+
// ClientSession by loading from database. Without locking, this race condition occurs:
182
+
// 1. Layer A loads session with stale DPoP nonce from DB
183
+
// 2. Layer B loads session with same stale nonce (A hasn't updated DB yet)
184
+
// 3. Layer A makes request โ 401 "use_dpop_nonce" โ gets fresh nonce โ saves to DB
185
+
// 4. Layer B makes request โ 401 "use_dpop_nonce" (using stale nonce from step 2)
186
+
// 5. DPoP nonce thrashing continues, eventually causing 500 errors
187
+
//
188
+
// With per-DID locking:
189
+
// 1. Layer A acquires lock, loads session, handles nonce negotiation, saves, releases lock
190
+
// 2. Layer B acquires lock AFTER A releases, loads fresh nonce from DB, succeeds
191
+
//
192
+
// Example usage:
193
+
//
194
+
// var result MyResult
195
+
// err := refresher.DoWithSession(ctx, did, func(session *oauth.ClientSession) error {
196
+
// resp, err := session.DoWithAuth(session.Client, req, "com.atproto.server.getServiceAuth")
197
+
// if err != nil {
198
+
// return err
199
+
// }
200
+
// // Parse response into result...
201
+
// return nil
202
+
// })
203
+
func (r *Refresher) DoWithSession(ctx context.Context, did string, fn func(session *oauth.ClientSession) error) error {
204
+
// Get or create a mutex for this DID
205
+
mutexInterface, _ := r.didLocks.LoadOrStore(did, &sync.Mutex{})
206
+
mutex := mutexInterface.(*sync.Mutex)
207
+
208
+
// Hold the lock for the ENTIRE operation (load + PDS request + nonce save)
209
+
mutex.Lock()
210
+
defer mutex.Unlock()
211
+
212
+
slog.Debug("Acquired session lock for DoWithSession",
213
+
"component", "oauth/refresher",
214
+
"did", did)
215
+
216
+
// Load session while holding lock
217
+
session, err := r.resumeSession(ctx, did)
218
+
if err != nil {
219
+
return err
220
+
}
221
+
222
+
// Execute the function (PDS request) while still holding lock
223
+
// The session's PersistSessionCallback will save nonce updates to DB
224
+
err = fn(session)
225
+
226
+
// If request failed with auth error, delete session to force re-auth
227
+
if err != nil && isAuthError(err) {
228
+
slog.Warn("Auth error detected, deleting session to force re-auth",
229
+
"component", "oauth/refresher",
230
+
"did", did,
231
+
"error", err)
232
+
// Don't hold the lock while deleting - release first
233
+
mutex.Unlock()
234
+
_ = r.DeleteSession(ctx, did)
235
+
mutex.Lock() // Re-acquire for the deferred unlock
236
+
}
237
+
238
+
slog.Debug("Released session lock for DoWithSession",
239
+
"component", "oauth/refresher",
240
+
"did", did,
241
+
"success", err == nil)
242
+
243
+
return err
244
+
}
245
+
246
+
// isAuthError checks if an error looks like an OAuth/auth failure
247
+
func isAuthError(err error) bool {
248
+
if err == nil {
249
+
return false
250
+
}
251
+
errStr := strings.ToLower(err.Error())
252
+
return strings.Contains(errStr, "unauthorized") ||
253
+
strings.Contains(errStr, "invalid_token") ||
254
+
strings.Contains(errStr, "insufficient_scope") ||
255
+
strings.Contains(errStr, "token expired") ||
256
+
strings.Contains(errStr, "401")
257
}
258
259
// resumeSession loads a session from storage
···
280
return nil, fmt.Errorf("no session found for DID: %s", did)
281
}
282
283
+
// Log scope differences for debugging, but don't delete session
284
+
// The PDS will reject requests if scopes are insufficient
285
+
// (Permission-sets get expanded by PDS, so exact matching doesn't work)
286
desiredScopes := r.clientApp.Config.Scopes
287
if !ScopesMatch(sessionData.Scopes, desiredScopes) {
288
+
slog.Debug("Session scopes differ from desired (may be permission-set expansion)",
289
"did", did,
290
"storedScopes", sessionData.Scopes,
291
"desiredScopes", desiredScopes)
292
}
293
294
// Resume session
···
298
}
299
300
// Set up callback to persist token updates to SQLite
301
+
// This ensures that when indigo automatically refreshes tokens or updates DPoP nonces,
302
+
// the new state is saved to the database immediately
303
session.PersistSessionCallback = func(callbackCtx context.Context, updatedData *oauth.ClientSessionData) {
304
if err := r.clientApp.Store.SaveSession(callbackCtx, *updatedData); err != nil {
305
slog.Error("Failed to persist OAuth session update",
···
308
"sessionID", sessionID,
309
"error", err)
310
} else {
311
+
// Log session updates (token refresh, DPoP nonce updates, etc.)
312
+
// Note: updatedData contains the full session state including DPoP nonce,
313
+
// but we don't log sensitive data like tokens or nonces themselves
314
+
slog.Debug("Persisted OAuth session update to database",
315
"component", "oauth/refresher",
316
"did", did,
317
+
"sessionID", sessionID,
318
+
"hint", "This includes token refresh and DPoP nonce updates")
319
}
320
}
321
return session, nil
322
}
323
+
324
+
// DeleteSession removes an OAuth session from storage and optionally invalidates the UI session
325
+
// This is called when OAuth authentication fails to force re-authentication
326
+
func (r *Refresher) DeleteSession(ctx context.Context, did string) error {
327
+
// Parse DID
328
+
accountDID, err := syntax.ParseDID(did)
329
+
if err != nil {
330
+
return fmt.Errorf("failed to parse DID: %w", err)
331
+
}
332
+
333
+
// Get the session ID before deleting (for logging)
334
+
type sessionGetter interface {
335
+
GetLatestSessionForDID(ctx context.Context, did string) (*oauth.ClientSessionData, string, error)
336
+
}
337
+
338
+
getter, ok := r.clientApp.Store.(sessionGetter)
339
+
if !ok {
340
+
return fmt.Errorf("store must implement GetLatestSessionForDID")
341
+
}
342
+
343
+
_, sessionID, err := getter.GetLatestSessionForDID(ctx, did)
344
+
if err != nil {
345
+
// No session to delete - this is fine
346
+
slog.Debug("No OAuth session to delete", "did", did)
347
+
return nil
348
+
}
349
+
350
+
// Delete OAuth session from database
351
+
if err := r.clientApp.Store.DeleteSession(ctx, accountDID, sessionID); err != nil {
352
+
slog.Warn("Failed to delete OAuth session", "did", did, "sessionID", sessionID, "error", err)
353
+
return fmt.Errorf("failed to delete OAuth session: %w", err)
354
+
}
355
+
356
+
slog.Info("Deleted stale OAuth session",
357
+
"component", "oauth/refresher",
358
+
"did", did,
359
+
"sessionID", sessionID,
360
+
"reason", "OAuth authentication failed")
361
+
362
+
// Also invalidate the UI session if store is configured
363
+
if r.uiSessionStore != nil {
364
+
r.uiSessionStore.DeleteByDID(did)
365
+
slog.Info("Invalidated UI session for DID",
366
+
"component", "oauth/refresher",
367
+
"did", did,
368
+
"reason", "OAuth session deleted")
369
+
}
370
+
371
+
return nil
372
+
}
373
+
374
+
// ValidateSession checks if an OAuth session is usable by attempting to load it.
375
+
// This triggers token refresh if needed (via indigo's auto-refresh in DoWithSession).
376
+
// Returns nil if session is valid, error if session is invalid/expired/needs re-auth.
377
+
//
378
+
// This is used by the token handler to validate OAuth sessions before issuing JWTs,
379
+
// preventing the flood of errors that occurs when a stale session is discovered
380
+
// during parallel layer uploads.
381
+
func (r *Refresher) ValidateSession(ctx context.Context, did string) error {
382
+
return r.DoWithSession(ctx, did, func(session *oauth.ClientSession) error {
383
+
// Session loaded and refreshed successfully
384
+
// DoWithSession already handles token refresh if needed
385
+
slog.Debug("OAuth session validated successfully",
386
+
"component", "oauth/refresher",
387
+
"did", did)
388
+
return nil
389
+
})
390
+
}
+7
-30
pkg/auth/oauth/client_test.go
+7
-30
pkg/auth/oauth/client_test.go
···
1
package oauth
2
3
import (
4
"testing"
5
)
6
7
func TestNewClientApp(t *testing.T) {
8
-
tmpDir := t.TempDir()
9
-
storePath := tmpDir + "/oauth-test.json"
10
-
keyPath := tmpDir + "/oauth-key.bin"
11
-
12
-
store, err := NewFileStore(storePath)
13
-
if err != nil {
14
-
t.Fatalf("NewFileStore() error = %v", err)
15
-
}
16
17
baseURL := "http://localhost:5000"
18
scopes := GetDefaultScopes("*")
···
32
}
33
34
func TestNewClientAppWithCustomScopes(t *testing.T) {
35
-
tmpDir := t.TempDir()
36
-
storePath := tmpDir + "/oauth-test.json"
37
-
keyPath := tmpDir + "/oauth-key.bin"
38
-
39
-
store, err := NewFileStore(storePath)
40
-
if err != nil {
41
-
t.Fatalf("NewFileStore() error = %v", err)
42
-
}
43
44
baseURL := "http://localhost:5000"
45
scopes := []string{"atproto", "custom:scope"}
···
128
// ----------------------------------------------------------------------------
129
130
func TestNewRefresher(t *testing.T) {
131
-
tmpDir := t.TempDir()
132
-
storePath := tmpDir + "/oauth-test.json"
133
-
134
-
store, err := NewFileStore(storePath)
135
-
if err != nil {
136
-
t.Fatalf("NewFileStore() error = %v", err)
137
-
}
138
139
scopes := GetDefaultScopes("*")
140
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
153
}
154
155
func TestRefresher_SetUISessionStore(t *testing.T) {
156
-
tmpDir := t.TempDir()
157
-
storePath := tmpDir + "/oauth-test.json"
158
-
159
-
store, err := NewFileStore(storePath)
160
-
if err != nil {
161
-
t.Fatalf("NewFileStore() error = %v", err)
162
-
}
163
164
scopes := GetDefaultScopes("*")
165
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
1
package oauth
2
3
import (
4
+
"github.com/bluesky-social/indigo/atproto/auth/oauth"
5
"testing"
6
)
7
8
func TestNewClientApp(t *testing.T) {
9
+
keyPath := t.TempDir() + "/oauth-key.bin"
10
+
store := oauth.NewMemStore()
11
12
baseURL := "http://localhost:5000"
13
scopes := GetDefaultScopes("*")
···
27
}
28
29
func TestNewClientAppWithCustomScopes(t *testing.T) {
30
+
keyPath := t.TempDir() + "/oauth-key.bin"
31
+
store := oauth.NewMemStore()
32
33
baseURL := "http://localhost:5000"
34
scopes := []string{"atproto", "custom:scope"}
···
117
// ----------------------------------------------------------------------------
118
119
func TestNewRefresher(t *testing.T) {
120
+
store := oauth.NewMemStore()
121
122
scopes := GetDefaultScopes("*")
123
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
136
}
137
138
func TestRefresher_SetUISessionStore(t *testing.T) {
139
+
store := oauth.NewMemStore()
140
141
scopes := GetDefaultScopes("*")
142
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
+1
-5
pkg/auth/oauth/interactive.go
+1
-5
pkg/auth/oauth/interactive.go
···
26
registerCallback func(handler http.HandlerFunc) error,
27
displayAuthURL func(string) error,
28
) (*InteractiveResult, error) {
29
-
// Create temporary file store for this flow
30
-
store, err := NewFileStore("/tmp/atcr-oauth-temp.json")
31
-
if err != nil {
32
-
return nil, fmt.Errorf("failed to create OAuth store: %w", err)
33
-
}
34
35
// Create OAuth client app with custom scopes (or defaults if nil)
36
// Interactive flows are typically for production use (credential helper, etc.)
···
26
registerCallback func(handler http.HandlerFunc) error,
27
displayAuthURL func(string) error,
28
) (*InteractiveResult, error) {
29
+
store := oauth.NewMemStore()
30
31
// Create OAuth client app with custom scopes (or defaults if nil)
32
// Interactive flows are typically for production use (credential helper, etc.)
+50
pkg/auth/oauth/server.go
+50
pkg/auth/oauth/server.go
···
2
3
import (
4
"context"
5
"fmt"
6
"html/template"
7
"log/slog"
···
10
"time"
11
12
"atcr.io/pkg/atproto"
13
"github.com/bluesky-social/indigo/atproto/auth/oauth"
14
)
15
16
// UISessionStore is the interface for UI session management
17
// UISessionStore is defined in client.go (session management section)
18
19
// UserStore is the interface for user management
20
type UserStore interface {
···
112
}
113
114
// Process OAuth callback via indigo (handles state validation internally)
115
sessionData, err := s.clientApp.ProcessCallback(r.Context(), r.URL.Query())
116
if err != nil {
117
s.renderError(w, fmt.Sprintf("Failed to process OAuth callback: %v", err))
118
return
119
}
···
2
3
import (
4
"context"
5
+
"errors"
6
"fmt"
7
"html/template"
8
"log/slog"
···
11
"time"
12
13
"atcr.io/pkg/atproto"
14
+
"github.com/bluesky-social/indigo/atproto/atclient"
15
"github.com/bluesky-social/indigo/atproto/auth/oauth"
16
)
17
18
// UISessionStore is the interface for UI session management
19
// UISessionStore is defined in client.go (session management section)
20
+
21
+
// getOAuthErrorHint provides troubleshooting hints for OAuth errors during token exchange
22
+
func getOAuthErrorHint(apiErr *atclient.APIError) string {
23
+
switch apiErr.Name {
24
+
case "invalid_client":
25
+
if strings.Contains(apiErr.Message, "iat") && strings.Contains(apiErr.Message, "timestamp") {
26
+
return "JWT timestamp validation failed - AppView system clock may be ahead of PDS clock. Check NTP sync: timedatectl status. Typical tolerance is ยฑ30 seconds."
27
+
}
28
+
return "OAuth client authentication failed during token exchange - check client key and PDS OAuth configuration"
29
+
case "invalid_grant":
30
+
return "Authorization code is invalid, expired, or already used - user should retry OAuth flow from beginning"
31
+
case "use_dpop_nonce":
32
+
return "DPoP nonce challenge during token exchange - indigo should retry automatically, persistent failures indicate PDS issue"
33
+
case "invalid_dpop_proof":
34
+
return "DPoP proof validation failed - check system clock sync between AppView and PDS"
35
+
case "unauthorized_client":
36
+
return "PDS rejected the client - check client metadata URL is accessible and scopes are supported"
37
+
case "invalid_request":
38
+
return "Malformed token request - check OAuth flow parameters (code, redirect_uri, state)"
39
+
case "server_error":
40
+
return "PDS internal error during token exchange - check PDS logs for root cause"
41
+
default:
42
+
if apiErr.StatusCode == 400 {
43
+
return "Bad request during OAuth token exchange - check error details and PDS logs"
44
+
}
45
+
return "OAuth token exchange failed - see errorName and errorMessage for PDS response"
46
+
}
47
+
}
48
49
// UserStore is the interface for user management
50
type UserStore interface {
···
142
}
143
144
// Process OAuth callback via indigo (handles state validation internally)
145
+
// This performs token exchange with the PDS using authorization code
146
sessionData, err := s.clientApp.ProcessCallback(r.Context(), r.URL.Query())
147
if err != nil {
148
+
// Detailed error logging for token exchange failures
149
+
var apiErr *atclient.APIError
150
+
if errors.As(err, &apiErr) {
151
+
slog.Error("OAuth callback failed - token exchange error",
152
+
"component", "oauth/server",
153
+
"error", err,
154
+
"httpStatus", apiErr.StatusCode,
155
+
"errorName", apiErr.Name,
156
+
"errorMessage", apiErr.Message,
157
+
"hint", getOAuthErrorHint(apiErr),
158
+
"queryParams", r.URL.Query().Encode())
159
+
} else {
160
+
slog.Error("OAuth callback failed - unknown error",
161
+
"component", "oauth/server",
162
+
"error", err,
163
+
"errorType", fmt.Sprintf("%T", err),
164
+
"queryParams", r.URL.Query().Encode())
165
+
}
166
+
167
s.renderError(w, fmt.Sprintf("Failed to process OAuth callback: %v", err))
168
return
169
}
+13
-84
pkg/auth/oauth/server_test.go
+13
-84
pkg/auth/oauth/server_test.go
···
2
3
import (
4
"context"
5
"net/http"
6
"net/http/httptest"
7
"strings"
···
11
12
func TestNewServer(t *testing.T) {
13
// Create a basic OAuth app for testing
14
-
tmpDir := t.TempDir()
15
-
storePath := tmpDir + "/oauth-test.json"
16
-
17
-
store, err := NewFileStore(storePath)
18
-
if err != nil {
19
-
t.Fatalf("NewFileStore() error = %v", err)
20
-
}
21
22
scopes := GetDefaultScopes("*")
23
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
36
}
37
38
func TestServer_SetRefresher(t *testing.T) {
39
-
tmpDir := t.TempDir()
40
-
storePath := tmpDir + "/oauth-test.json"
41
-
42
-
store, err := NewFileStore(storePath)
43
-
if err != nil {
44
-
t.Fatalf("NewFileStore() error = %v", err)
45
-
}
46
47
scopes := GetDefaultScopes("*")
48
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
60
}
61
62
func TestServer_SetPostAuthCallback(t *testing.T) {
63
-
tmpDir := t.TempDir()
64
-
storePath := tmpDir + "/oauth-test.json"
65
-
66
-
store, err := NewFileStore(storePath)
67
-
if err != nil {
68
-
t.Fatalf("NewFileStore() error = %v", err)
69
-
}
70
71
scopes := GetDefaultScopes("*")
72
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
87
}
88
89
func TestServer_SetUISessionStore(t *testing.T) {
90
-
tmpDir := t.TempDir()
91
-
storePath := tmpDir + "/oauth-test.json"
92
-
93
-
store, err := NewFileStore(storePath)
94
-
if err != nil {
95
-
t.Fatalf("NewFileStore() error = %v", err)
96
-
}
97
98
scopes := GetDefaultScopes("*")
99
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
151
// ServeAuthorize tests
152
153
func TestServer_ServeAuthorize_MissingHandle(t *testing.T) {
154
-
tmpDir := t.TempDir()
155
-
storePath := tmpDir + "/oauth-test.json"
156
-
157
-
store, err := NewFileStore(storePath)
158
-
if err != nil {
159
-
t.Fatalf("NewFileStore() error = %v", err)
160
-
}
161
162
scopes := GetDefaultScopes("*")
163
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
179
}
180
181
func TestServer_ServeAuthorize_InvalidMethod(t *testing.T) {
182
-
tmpDir := t.TempDir()
183
-
storePath := tmpDir + "/oauth-test.json"
184
-
185
-
store, err := NewFileStore(storePath)
186
-
if err != nil {
187
-
t.Fatalf("NewFileStore() error = %v", err)
188
-
}
189
190
scopes := GetDefaultScopes("*")
191
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
209
// ServeCallback tests
210
211
func TestServer_ServeCallback_InvalidMethod(t *testing.T) {
212
-
tmpDir := t.TempDir()
213
-
storePath := tmpDir + "/oauth-test.json"
214
-
215
-
store, err := NewFileStore(storePath)
216
-
if err != nil {
217
-
t.Fatalf("NewFileStore() error = %v", err)
218
-
}
219
220
scopes := GetDefaultScopes("*")
221
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
237
}
238
239
func TestServer_ServeCallback_OAuthError(t *testing.T) {
240
-
tmpDir := t.TempDir()
241
-
storePath := tmpDir + "/oauth-test.json"
242
-
243
-
store, err := NewFileStore(storePath)
244
-
if err != nil {
245
-
t.Fatalf("NewFileStore() error = %v", err)
246
-
}
247
248
scopes := GetDefaultScopes("*")
249
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
270
}
271
272
func TestServer_ServeCallback_WithPostAuthCallback(t *testing.T) {
273
-
tmpDir := t.TempDir()
274
-
storePath := tmpDir + "/oauth-test.json"
275
-
276
-
store, err := NewFileStore(storePath)
277
-
if err != nil {
278
-
t.Fatalf("NewFileStore() error = %v", err)
279
-
}
280
281
scopes := GetDefaultScopes("*")
282
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
315
},
316
}
317
318
-
tmpDir := t.TempDir()
319
-
storePath := tmpDir + "/oauth-test.json"
320
-
321
-
store, err := NewFileStore(storePath)
322
-
if err != nil {
323
-
t.Fatalf("NewFileStore() error = %v", err)
324
-
}
325
326
scopes := GetDefaultScopes("*")
327
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
345
}
346
347
func TestServer_RenderError(t *testing.T) {
348
-
tmpDir := t.TempDir()
349
-
storePath := tmpDir + "/oauth-test.json"
350
-
351
-
store, err := NewFileStore(storePath)
352
-
if err != nil {
353
-
t.Fatalf("NewFileStore() error = %v", err)
354
-
}
355
356
scopes := GetDefaultScopes("*")
357
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
380
}
381
382
func TestServer_RenderRedirectToSettings(t *testing.T) {
383
-
tmpDir := t.TempDir()
384
-
storePath := tmpDir + "/oauth-test.json"
385
-
386
-
store, err := NewFileStore(storePath)
387
-
if err != nil {
388
-
t.Fatalf("NewFileStore() error = %v", err)
389
-
}
390
391
scopes := GetDefaultScopes("*")
392
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
2
3
import (
4
"context"
5
+
"github.com/bluesky-social/indigo/atproto/auth/oauth"
6
"net/http"
7
"net/http/httptest"
8
"strings"
···
12
13
func TestNewServer(t *testing.T) {
14
// Create a basic OAuth app for testing
15
+
store := oauth.NewMemStore()
16
17
scopes := GetDefaultScopes("*")
18
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
31
}
32
33
func TestServer_SetRefresher(t *testing.T) {
34
+
store := oauth.NewMemStore()
35
36
scopes := GetDefaultScopes("*")
37
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
49
}
50
51
func TestServer_SetPostAuthCallback(t *testing.T) {
52
+
store := oauth.NewMemStore()
53
54
scopes := GetDefaultScopes("*")
55
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
70
}
71
72
func TestServer_SetUISessionStore(t *testing.T) {
73
+
store := oauth.NewMemStore()
74
75
scopes := GetDefaultScopes("*")
76
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
128
// ServeAuthorize tests
129
130
func TestServer_ServeAuthorize_MissingHandle(t *testing.T) {
131
+
store := oauth.NewMemStore()
132
133
scopes := GetDefaultScopes("*")
134
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
150
}
151
152
func TestServer_ServeAuthorize_InvalidMethod(t *testing.T) {
153
+
store := oauth.NewMemStore()
154
155
scopes := GetDefaultScopes("*")
156
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
174
// ServeCallback tests
175
176
func TestServer_ServeCallback_InvalidMethod(t *testing.T) {
177
+
store := oauth.NewMemStore()
178
179
scopes := GetDefaultScopes("*")
180
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
196
}
197
198
func TestServer_ServeCallback_OAuthError(t *testing.T) {
199
+
store := oauth.NewMemStore()
200
201
scopes := GetDefaultScopes("*")
202
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
223
}
224
225
func TestServer_ServeCallback_WithPostAuthCallback(t *testing.T) {
226
+
store := oauth.NewMemStore()
227
228
scopes := GetDefaultScopes("*")
229
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
262
},
263
}
264
265
+
store := oauth.NewMemStore()
266
267
scopes := GetDefaultScopes("*")
268
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
286
}
287
288
func TestServer_RenderError(t *testing.T) {
289
+
store := oauth.NewMemStore()
290
291
scopes := GetDefaultScopes("*")
292
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
315
}
316
317
func TestServer_RenderRedirectToSettings(t *testing.T) {
318
+
store := oauth.NewMemStore()
319
320
scopes := GetDefaultScopes("*")
321
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
-236
pkg/auth/oauth/store.go
-236
pkg/auth/oauth/store.go
···
1
-
package oauth
2
-
3
-
import (
4
-
"context"
5
-
"encoding/json"
6
-
"fmt"
7
-
"maps"
8
-
"os"
9
-
"path/filepath"
10
-
"sync"
11
-
"time"
12
-
13
-
"github.com/bluesky-social/indigo/atproto/auth/oauth"
14
-
"github.com/bluesky-social/indigo/atproto/syntax"
15
-
)
16
-
17
-
// FileStore implements oauth.ClientAuthStore with file-based persistence
18
-
type FileStore struct {
19
-
path string
20
-
sessions map[string]*oauth.ClientSessionData // Key: "did:sessionID"
21
-
requests map[string]*oauth.AuthRequestData // Key: state
22
-
mu sync.RWMutex
23
-
}
24
-
25
-
// FileStoreData represents the JSON structure stored on disk
26
-
type FileStoreData struct {
27
-
Sessions map[string]*oauth.ClientSessionData `json:"sessions"`
28
-
Requests map[string]*oauth.AuthRequestData `json:"requests"`
29
-
}
30
-
31
-
// NewFileStore creates a new file-based OAuth store
32
-
func NewFileStore(path string) (*FileStore, error) {
33
-
store := &FileStore{
34
-
path: path,
35
-
sessions: make(map[string]*oauth.ClientSessionData),
36
-
requests: make(map[string]*oauth.AuthRequestData),
37
-
}
38
-
39
-
// Load existing data if file exists
40
-
if err := store.load(); err != nil {
41
-
if !os.IsNotExist(err) {
42
-
return nil, fmt.Errorf("failed to load store: %w", err)
43
-
}
44
-
// File doesn't exist yet, that's ok
45
-
}
46
-
47
-
return store, nil
48
-
}
49
-
50
-
// GetDefaultStorePath returns the default storage path for OAuth data
51
-
func GetDefaultStorePath() (string, error) {
52
-
// For AppView: /var/lib/atcr/oauth-sessions.json
53
-
// For CLI tools: ~/.atcr/oauth-sessions.json
54
-
55
-
// Check if running as a service (has write access to /var/lib)
56
-
servicePath := "/var/lib/atcr/oauth-sessions.json"
57
-
if err := os.MkdirAll(filepath.Dir(servicePath), 0700); err == nil {
58
-
// Can write to /var/lib, use service path
59
-
return servicePath, nil
60
-
}
61
-
62
-
// Fall back to user home directory
63
-
homeDir, err := os.UserHomeDir()
64
-
if err != nil {
65
-
return "", fmt.Errorf("failed to get home directory: %w", err)
66
-
}
67
-
68
-
atcrDir := filepath.Join(homeDir, ".atcr")
69
-
if err := os.MkdirAll(atcrDir, 0700); err != nil {
70
-
return "", fmt.Errorf("failed to create .atcr directory: %w", err)
71
-
}
72
-
73
-
return filepath.Join(atcrDir, "oauth-sessions.json"), nil
74
-
}
75
-
76
-
// GetSession retrieves a session by DID and session ID
77
-
func (s *FileStore) GetSession(ctx context.Context, did syntax.DID, sessionID string) (*oauth.ClientSessionData, error) {
78
-
s.mu.RLock()
79
-
defer s.mu.RUnlock()
80
-
81
-
key := makeSessionKey(did.String(), sessionID)
82
-
session, ok := s.sessions[key]
83
-
if !ok {
84
-
return nil, fmt.Errorf("session not found: %s/%s", did, sessionID)
85
-
}
86
-
87
-
return session, nil
88
-
}
89
-
90
-
// SaveSession saves or updates a session (upsert)
91
-
func (s *FileStore) SaveSession(ctx context.Context, sess oauth.ClientSessionData) error {
92
-
s.mu.Lock()
93
-
defer s.mu.Unlock()
94
-
95
-
key := makeSessionKey(sess.AccountDID.String(), sess.SessionID)
96
-
s.sessions[key] = &sess
97
-
98
-
return s.save()
99
-
}
100
-
101
-
// DeleteSession removes a session
102
-
func (s *FileStore) DeleteSession(ctx context.Context, did syntax.DID, sessionID string) error {
103
-
s.mu.Lock()
104
-
defer s.mu.Unlock()
105
-
106
-
key := makeSessionKey(did.String(), sessionID)
107
-
delete(s.sessions, key)
108
-
109
-
return s.save()
110
-
}
111
-
112
-
// GetAuthRequestInfo retrieves authentication request data by state
113
-
func (s *FileStore) GetAuthRequestInfo(ctx context.Context, state string) (*oauth.AuthRequestData, error) {
114
-
s.mu.RLock()
115
-
defer s.mu.RUnlock()
116
-
117
-
request, ok := s.requests[state]
118
-
if !ok {
119
-
return nil, fmt.Errorf("auth request not found: %s", state)
120
-
}
121
-
122
-
return request, nil
123
-
}
124
-
125
-
// SaveAuthRequestInfo saves authentication request data
126
-
func (s *FileStore) SaveAuthRequestInfo(ctx context.Context, info oauth.AuthRequestData) error {
127
-
s.mu.Lock()
128
-
defer s.mu.Unlock()
129
-
130
-
s.requests[info.State] = &info
131
-
132
-
return s.save()
133
-
}
134
-
135
-
// DeleteAuthRequestInfo removes authentication request data
136
-
func (s *FileStore) DeleteAuthRequestInfo(ctx context.Context, state string) error {
137
-
s.mu.Lock()
138
-
defer s.mu.Unlock()
139
-
140
-
delete(s.requests, state)
141
-
142
-
return s.save()
143
-
}
144
-
145
-
// CleanupExpired removes expired sessions and auth requests
146
-
// Should be called periodically (e.g., every hour)
147
-
func (s *FileStore) CleanupExpired() error {
148
-
s.mu.Lock()
149
-
defer s.mu.Unlock()
150
-
151
-
now := time.Now()
152
-
modified := false
153
-
154
-
// Clean up auth requests older than 10 minutes
155
-
// (OAuth flows should complete quickly)
156
-
for state := range s.requests {
157
-
// Note: AuthRequestData doesn't have a timestamp in indigo's implementation
158
-
// For now, we'll rely on the OAuth server's cleanup routine
159
-
// or we could extend AuthRequestData with metadata
160
-
_ = state // Placeholder for future expiration logic
161
-
}
162
-
163
-
// Sessions don't have expiry in the data structure
164
-
// Cleanup would need to be token-based (check token expiry)
165
-
// For now, manual cleanup via DeleteSession
166
-
_ = now
167
-
168
-
if modified {
169
-
return s.save()
170
-
}
171
-
172
-
return nil
173
-
}
174
-
175
-
// ListSessions returns all stored sessions for debugging/management
176
-
func (s *FileStore) ListSessions() map[string]*oauth.ClientSessionData {
177
-
s.mu.RLock()
178
-
defer s.mu.RUnlock()
179
-
180
-
// Return a copy to prevent external modification
181
-
result := make(map[string]*oauth.ClientSessionData)
182
-
maps.Copy(result, s.sessions)
183
-
return result
184
-
}
185
-
186
-
// load reads data from disk
187
-
func (s *FileStore) load() error {
188
-
data, err := os.ReadFile(s.path)
189
-
if err != nil {
190
-
return err
191
-
}
192
-
193
-
var storeData FileStoreData
194
-
if err := json.Unmarshal(data, &storeData); err != nil {
195
-
return fmt.Errorf("failed to parse store: %w", err)
196
-
}
197
-
198
-
if storeData.Sessions != nil {
199
-
s.sessions = storeData.Sessions
200
-
}
201
-
if storeData.Requests != nil {
202
-
s.requests = storeData.Requests
203
-
}
204
-
205
-
return nil
206
-
}
207
-
208
-
// save writes data to disk
209
-
func (s *FileStore) save() error {
210
-
storeData := FileStoreData{
211
-
Sessions: s.sessions,
212
-
Requests: s.requests,
213
-
}
214
-
215
-
data, err := json.MarshalIndent(storeData, "", " ")
216
-
if err != nil {
217
-
return fmt.Errorf("failed to marshal store: %w", err)
218
-
}
219
-
220
-
// Ensure directory exists
221
-
if err := os.MkdirAll(filepath.Dir(s.path), 0700); err != nil {
222
-
return fmt.Errorf("failed to create directory: %w", err)
223
-
}
224
-
225
-
// Write with restrictive permissions
226
-
if err := os.WriteFile(s.path, data, 0600); err != nil {
227
-
return fmt.Errorf("failed to write store: %w", err)
228
-
}
229
-
230
-
return nil
231
-
}
232
-
233
-
// makeSessionKey creates a composite key for session storage
234
-
func makeSessionKey(did, sessionID string) string {
235
-
return fmt.Sprintf("%s:%s", did, sessionID)
236
-
}
···
-631
pkg/auth/oauth/store_test.go
-631
pkg/auth/oauth/store_test.go
···
1
-
package oauth
2
-
3
-
import (
4
-
"context"
5
-
"encoding/json"
6
-
"os"
7
-
"testing"
8
-
"time"
9
-
10
-
"github.com/bluesky-social/indigo/atproto/auth/oauth"
11
-
"github.com/bluesky-social/indigo/atproto/syntax"
12
-
)
13
-
14
-
func TestNewFileStore(t *testing.T) {
15
-
tmpDir := t.TempDir()
16
-
storePath := tmpDir + "/oauth-test.json"
17
-
18
-
store, err := NewFileStore(storePath)
19
-
if err != nil {
20
-
t.Fatalf("NewFileStore() error = %v", err)
21
-
}
22
-
23
-
if store == nil {
24
-
t.Fatal("Expected non-nil store")
25
-
}
26
-
27
-
if store.path != storePath {
28
-
t.Errorf("Expected path %q, got %q", storePath, store.path)
29
-
}
30
-
31
-
if store.sessions == nil {
32
-
t.Error("Expected sessions map to be initialized")
33
-
}
34
-
35
-
if store.requests == nil {
36
-
t.Error("Expected requests map to be initialized")
37
-
}
38
-
}
39
-
40
-
func TestFileStore_LoadNonExistent(t *testing.T) {
41
-
tmpDir := t.TempDir()
42
-
storePath := tmpDir + "/nonexistent.json"
43
-
44
-
// Should succeed even if file doesn't exist
45
-
store, err := NewFileStore(storePath)
46
-
if err != nil {
47
-
t.Fatalf("NewFileStore() should succeed with non-existent file, got error: %v", err)
48
-
}
49
-
50
-
if store == nil {
51
-
t.Fatal("Expected non-nil store")
52
-
}
53
-
}
54
-
55
-
func TestFileStore_LoadCorruptedFile(t *testing.T) {
56
-
tmpDir := t.TempDir()
57
-
storePath := tmpDir + "/corrupted.json"
58
-
59
-
// Create corrupted JSON file
60
-
if err := os.WriteFile(storePath, []byte("invalid json {{{"), 0600); err != nil {
61
-
t.Fatalf("Failed to create corrupted file: %v", err)
62
-
}
63
-
64
-
// Should fail to load corrupted file
65
-
_, err := NewFileStore(storePath)
66
-
if err == nil {
67
-
t.Error("Expected error when loading corrupted file")
68
-
}
69
-
}
70
-
71
-
func TestFileStore_GetSession_NotFound(t *testing.T) {
72
-
tmpDir := t.TempDir()
73
-
storePath := tmpDir + "/oauth-test.json"
74
-
75
-
store, err := NewFileStore(storePath)
76
-
if err != nil {
77
-
t.Fatalf("NewFileStore() error = %v", err)
78
-
}
79
-
80
-
ctx := context.Background()
81
-
did, _ := syntax.ParseDID("did:plc:test123")
82
-
sessionID := "session123"
83
-
84
-
// Should return error for non-existent session
85
-
session, err := store.GetSession(ctx, did, sessionID)
86
-
if err == nil {
87
-
t.Error("Expected error for non-existent session")
88
-
}
89
-
if session != nil {
90
-
t.Error("Expected nil session for non-existent entry")
91
-
}
92
-
}
93
-
94
-
func TestFileStore_SaveAndGetSession(t *testing.T) {
95
-
tmpDir := t.TempDir()
96
-
storePath := tmpDir + "/oauth-test.json"
97
-
98
-
store, err := NewFileStore(storePath)
99
-
if err != nil {
100
-
t.Fatalf("NewFileStore() error = %v", err)
101
-
}
102
-
103
-
ctx := context.Background()
104
-
did, _ := syntax.ParseDID("did:plc:alice123")
105
-
106
-
// Create test session
107
-
sessionData := oauth.ClientSessionData{
108
-
AccountDID: did,
109
-
SessionID: "test-session-123",
110
-
HostURL: "https://pds.example.com",
111
-
Scopes: []string{"atproto", "blob:read"},
112
-
}
113
-
114
-
// Save session
115
-
if err := store.SaveSession(ctx, sessionData); err != nil {
116
-
t.Fatalf("SaveSession() error = %v", err)
117
-
}
118
-
119
-
// Retrieve session
120
-
retrieved, err := store.GetSession(ctx, did, "test-session-123")
121
-
if err != nil {
122
-
t.Fatalf("GetSession() error = %v", err)
123
-
}
124
-
125
-
if retrieved == nil {
126
-
t.Fatal("Expected non-nil session")
127
-
}
128
-
129
-
if retrieved.SessionID != sessionData.SessionID {
130
-
t.Errorf("Expected sessionID %q, got %q", sessionData.SessionID, retrieved.SessionID)
131
-
}
132
-
133
-
if retrieved.AccountDID.String() != did.String() {
134
-
t.Errorf("Expected DID %q, got %q", did.String(), retrieved.AccountDID.String())
135
-
}
136
-
137
-
if retrieved.HostURL != sessionData.HostURL {
138
-
t.Errorf("Expected hostURL %q, got %q", sessionData.HostURL, retrieved.HostURL)
139
-
}
140
-
}
141
-
142
-
func TestFileStore_UpdateSession(t *testing.T) {
143
-
tmpDir := t.TempDir()
144
-
storePath := tmpDir + "/oauth-test.json"
145
-
146
-
store, err := NewFileStore(storePath)
147
-
if err != nil {
148
-
t.Fatalf("NewFileStore() error = %v", err)
149
-
}
150
-
151
-
ctx := context.Background()
152
-
did, _ := syntax.ParseDID("did:plc:alice123")
153
-
154
-
// Save initial session
155
-
sessionData := oauth.ClientSessionData{
156
-
AccountDID: did,
157
-
SessionID: "test-session-123",
158
-
HostURL: "https://pds.example.com",
159
-
Scopes: []string{"atproto"},
160
-
}
161
-
162
-
if err := store.SaveSession(ctx, sessionData); err != nil {
163
-
t.Fatalf("SaveSession() error = %v", err)
164
-
}
165
-
166
-
// Update session with new scopes
167
-
sessionData.Scopes = []string{"atproto", "blob:read", "blob:write"}
168
-
if err := store.SaveSession(ctx, sessionData); err != nil {
169
-
t.Fatalf("SaveSession() (update) error = %v", err)
170
-
}
171
-
172
-
// Retrieve updated session
173
-
retrieved, err := store.GetSession(ctx, did, "test-session-123")
174
-
if err != nil {
175
-
t.Fatalf("GetSession() error = %v", err)
176
-
}
177
-
178
-
if len(retrieved.Scopes) != 3 {
179
-
t.Errorf("Expected 3 scopes, got %d", len(retrieved.Scopes))
180
-
}
181
-
}
182
-
183
-
func TestFileStore_DeleteSession(t *testing.T) {
184
-
tmpDir := t.TempDir()
185
-
storePath := tmpDir + "/oauth-test.json"
186
-
187
-
store, err := NewFileStore(storePath)
188
-
if err != nil {
189
-
t.Fatalf("NewFileStore() error = %v", err)
190
-
}
191
-
192
-
ctx := context.Background()
193
-
did, _ := syntax.ParseDID("did:plc:alice123")
194
-
195
-
// Save session
196
-
sessionData := oauth.ClientSessionData{
197
-
AccountDID: did,
198
-
SessionID: "test-session-123",
199
-
HostURL: "https://pds.example.com",
200
-
}
201
-
202
-
if err := store.SaveSession(ctx, sessionData); err != nil {
203
-
t.Fatalf("SaveSession() error = %v", err)
204
-
}
205
-
206
-
// Verify it exists
207
-
if _, err := store.GetSession(ctx, did, "test-session-123"); err != nil {
208
-
t.Fatalf("GetSession() should succeed before delete, got error: %v", err)
209
-
}
210
-
211
-
// Delete session
212
-
if err := store.DeleteSession(ctx, did, "test-session-123"); err != nil {
213
-
t.Fatalf("DeleteSession() error = %v", err)
214
-
}
215
-
216
-
// Verify it's gone
217
-
_, err = store.GetSession(ctx, did, "test-session-123")
218
-
if err == nil {
219
-
t.Error("Expected error after deleting session")
220
-
}
221
-
}
222
-
223
-
func TestFileStore_DeleteNonExistentSession(t *testing.T) {
224
-
tmpDir := t.TempDir()
225
-
storePath := tmpDir + "/oauth-test.json"
226
-
227
-
store, err := NewFileStore(storePath)
228
-
if err != nil {
229
-
t.Fatalf("NewFileStore() error = %v", err)
230
-
}
231
-
232
-
ctx := context.Background()
233
-
did, _ := syntax.ParseDID("did:plc:alice123")
234
-
235
-
// Delete non-existent session should not error
236
-
if err := store.DeleteSession(ctx, did, "nonexistent"); err != nil {
237
-
t.Errorf("DeleteSession() on non-existent session should not error, got: %v", err)
238
-
}
239
-
}
240
-
241
-
func TestFileStore_SaveAndGetAuthRequestInfo(t *testing.T) {
242
-
tmpDir := t.TempDir()
243
-
storePath := tmpDir + "/oauth-test.json"
244
-
245
-
store, err := NewFileStore(storePath)
246
-
if err != nil {
247
-
t.Fatalf("NewFileStore() error = %v", err)
248
-
}
249
-
250
-
ctx := context.Background()
251
-
252
-
// Create test auth request
253
-
did, _ := syntax.ParseDID("did:plc:alice123")
254
-
authRequest := oauth.AuthRequestData{
255
-
State: "test-state-123",
256
-
AuthServerURL: "https://pds.example.com",
257
-
AccountDID: &did,
258
-
Scopes: []string{"atproto", "blob:read"},
259
-
RequestURI: "urn:ietf:params:oauth:request_uri:test123",
260
-
AuthServerTokenEndpoint: "https://pds.example.com/oauth/token",
261
-
}
262
-
263
-
// Save auth request
264
-
if err := store.SaveAuthRequestInfo(ctx, authRequest); err != nil {
265
-
t.Fatalf("SaveAuthRequestInfo() error = %v", err)
266
-
}
267
-
268
-
// Retrieve auth request
269
-
retrieved, err := store.GetAuthRequestInfo(ctx, "test-state-123")
270
-
if err != nil {
271
-
t.Fatalf("GetAuthRequestInfo() error = %v", err)
272
-
}
273
-
274
-
if retrieved == nil {
275
-
t.Fatal("Expected non-nil auth request")
276
-
}
277
-
278
-
if retrieved.State != authRequest.State {
279
-
t.Errorf("Expected state %q, got %q", authRequest.State, retrieved.State)
280
-
}
281
-
282
-
if retrieved.AuthServerURL != authRequest.AuthServerURL {
283
-
t.Errorf("Expected authServerURL %q, got %q", authRequest.AuthServerURL, retrieved.AuthServerURL)
284
-
}
285
-
}
286
-
287
-
func TestFileStore_GetAuthRequestInfo_NotFound(t *testing.T) {
288
-
tmpDir := t.TempDir()
289
-
storePath := tmpDir + "/oauth-test.json"
290
-
291
-
store, err := NewFileStore(storePath)
292
-
if err != nil {
293
-
t.Fatalf("NewFileStore() error = %v", err)
294
-
}
295
-
296
-
ctx := context.Background()
297
-
298
-
// Should return error for non-existent request
299
-
_, err = store.GetAuthRequestInfo(ctx, "nonexistent-state")
300
-
if err == nil {
301
-
t.Error("Expected error for non-existent auth request")
302
-
}
303
-
}
304
-
305
-
func TestFileStore_DeleteAuthRequestInfo(t *testing.T) {
306
-
tmpDir := t.TempDir()
307
-
storePath := tmpDir + "/oauth-test.json"
308
-
309
-
store, err := NewFileStore(storePath)
310
-
if err != nil {
311
-
t.Fatalf("NewFileStore() error = %v", err)
312
-
}
313
-
314
-
ctx := context.Background()
315
-
316
-
// Save auth request
317
-
authRequest := oauth.AuthRequestData{
318
-
State: "test-state-123",
319
-
AuthServerURL: "https://pds.example.com",
320
-
}
321
-
322
-
if err := store.SaveAuthRequestInfo(ctx, authRequest); err != nil {
323
-
t.Fatalf("SaveAuthRequestInfo() error = %v", err)
324
-
}
325
-
326
-
// Verify it exists
327
-
if _, err := store.GetAuthRequestInfo(ctx, "test-state-123"); err != nil {
328
-
t.Fatalf("GetAuthRequestInfo() should succeed before delete, got error: %v", err)
329
-
}
330
-
331
-
// Delete auth request
332
-
if err := store.DeleteAuthRequestInfo(ctx, "test-state-123"); err != nil {
333
-
t.Fatalf("DeleteAuthRequestInfo() error = %v", err)
334
-
}
335
-
336
-
// Verify it's gone
337
-
_, err = store.GetAuthRequestInfo(ctx, "test-state-123")
338
-
if err == nil {
339
-
t.Error("Expected error after deleting auth request")
340
-
}
341
-
}
342
-
343
-
func TestFileStore_ListSessions(t *testing.T) {
344
-
tmpDir := t.TempDir()
345
-
storePath := tmpDir + "/oauth-test.json"
346
-
347
-
store, err := NewFileStore(storePath)
348
-
if err != nil {
349
-
t.Fatalf("NewFileStore() error = %v", err)
350
-
}
351
-
352
-
ctx := context.Background()
353
-
354
-
// Initially empty
355
-
sessions := store.ListSessions()
356
-
if len(sessions) != 0 {
357
-
t.Errorf("Expected 0 sessions, got %d", len(sessions))
358
-
}
359
-
360
-
// Add multiple sessions
361
-
did1, _ := syntax.ParseDID("did:plc:alice123")
362
-
did2, _ := syntax.ParseDID("did:plc:bob456")
363
-
364
-
session1 := oauth.ClientSessionData{
365
-
AccountDID: did1,
366
-
SessionID: "session-1",
367
-
HostURL: "https://pds1.example.com",
368
-
}
369
-
370
-
session2 := oauth.ClientSessionData{
371
-
AccountDID: did2,
372
-
SessionID: "session-2",
373
-
HostURL: "https://pds2.example.com",
374
-
}
375
-
376
-
if err := store.SaveSession(ctx, session1); err != nil {
377
-
t.Fatalf("SaveSession() error = %v", err)
378
-
}
379
-
380
-
if err := store.SaveSession(ctx, session2); err != nil {
381
-
t.Fatalf("SaveSession() error = %v", err)
382
-
}
383
-
384
-
// List sessions
385
-
sessions = store.ListSessions()
386
-
if len(sessions) != 2 {
387
-
t.Errorf("Expected 2 sessions, got %d", len(sessions))
388
-
}
389
-
390
-
// Verify we got both sessions
391
-
key1 := makeSessionKey(did1.String(), "session-1")
392
-
key2 := makeSessionKey(did2.String(), "session-2")
393
-
394
-
if sessions[key1] == nil {
395
-
t.Error("Expected session1 in list")
396
-
}
397
-
398
-
if sessions[key2] == nil {
399
-
t.Error("Expected session2 in list")
400
-
}
401
-
}
402
-
403
-
func TestFileStore_Persistence_Across_Instances(t *testing.T) {
404
-
tmpDir := t.TempDir()
405
-
storePath := tmpDir + "/oauth-test.json"
406
-
407
-
ctx := context.Background()
408
-
did, _ := syntax.ParseDID("did:plc:alice123")
409
-
410
-
// Create first store and save data
411
-
store1, err := NewFileStore(storePath)
412
-
if err != nil {
413
-
t.Fatalf("NewFileStore() error = %v", err)
414
-
}
415
-
416
-
sessionData := oauth.ClientSessionData{
417
-
AccountDID: did,
418
-
SessionID: "persistent-session",
419
-
HostURL: "https://pds.example.com",
420
-
}
421
-
422
-
if err := store1.SaveSession(ctx, sessionData); err != nil {
423
-
t.Fatalf("SaveSession() error = %v", err)
424
-
}
425
-
426
-
authRequest := oauth.AuthRequestData{
427
-
State: "persistent-state",
428
-
AuthServerURL: "https://pds.example.com",
429
-
}
430
-
431
-
if err := store1.SaveAuthRequestInfo(ctx, authRequest); err != nil {
432
-
t.Fatalf("SaveAuthRequestInfo() error = %v", err)
433
-
}
434
-
435
-
// Create second store from same file
436
-
store2, err := NewFileStore(storePath)
437
-
if err != nil {
438
-
t.Fatalf("Second NewFileStore() error = %v", err)
439
-
}
440
-
441
-
// Verify session persisted
442
-
retrievedSession, err := store2.GetSession(ctx, did, "persistent-session")
443
-
if err != nil {
444
-
t.Fatalf("GetSession() from second store error = %v", err)
445
-
}
446
-
447
-
if retrievedSession.SessionID != "persistent-session" {
448
-
t.Errorf("Expected persistent session ID, got %q", retrievedSession.SessionID)
449
-
}
450
-
451
-
// Verify auth request persisted
452
-
retrievedAuth, err := store2.GetAuthRequestInfo(ctx, "persistent-state")
453
-
if err != nil {
454
-
t.Fatalf("GetAuthRequestInfo() from second store error = %v", err)
455
-
}
456
-
457
-
if retrievedAuth.State != "persistent-state" {
458
-
t.Errorf("Expected persistent state, got %q", retrievedAuth.State)
459
-
}
460
-
}
461
-
462
-
func TestFileStore_FileSecurity(t *testing.T) {
463
-
tmpDir := t.TempDir()
464
-
storePath := tmpDir + "/oauth-test.json"
465
-
466
-
store, err := NewFileStore(storePath)
467
-
if err != nil {
468
-
t.Fatalf("NewFileStore() error = %v", err)
469
-
}
470
-
471
-
ctx := context.Background()
472
-
did, _ := syntax.ParseDID("did:plc:alice123")
473
-
474
-
// Save some data to trigger file creation
475
-
sessionData := oauth.ClientSessionData{
476
-
AccountDID: did,
477
-
SessionID: "test-session",
478
-
HostURL: "https://pds.example.com",
479
-
}
480
-
481
-
if err := store.SaveSession(ctx, sessionData); err != nil {
482
-
t.Fatalf("SaveSession() error = %v", err)
483
-
}
484
-
485
-
// Check file permissions (should be 0600)
486
-
info, err := os.Stat(storePath)
487
-
if err != nil {
488
-
t.Fatalf("Failed to stat file: %v", err)
489
-
}
490
-
491
-
mode := info.Mode()
492
-
if mode.Perm() != 0600 {
493
-
t.Errorf("Expected file permissions 0600, got %o", mode.Perm())
494
-
}
495
-
}
496
-
497
-
func TestFileStore_JSONFormat(t *testing.T) {
498
-
tmpDir := t.TempDir()
499
-
storePath := tmpDir + "/oauth-test.json"
500
-
501
-
store, err := NewFileStore(storePath)
502
-
if err != nil {
503
-
t.Fatalf("NewFileStore() error = %v", err)
504
-
}
505
-
506
-
ctx := context.Background()
507
-
did, _ := syntax.ParseDID("did:plc:alice123")
508
-
509
-
// Save data
510
-
sessionData := oauth.ClientSessionData{
511
-
AccountDID: did,
512
-
SessionID: "test-session",
513
-
HostURL: "https://pds.example.com",
514
-
}
515
-
516
-
if err := store.SaveSession(ctx, sessionData); err != nil {
517
-
t.Fatalf("SaveSession() error = %v", err)
518
-
}
519
-
520
-
// Read and verify JSON format
521
-
data, err := os.ReadFile(storePath)
522
-
if err != nil {
523
-
t.Fatalf("Failed to read file: %v", err)
524
-
}
525
-
526
-
var storeData FileStoreData
527
-
if err := json.Unmarshal(data, &storeData); err != nil {
528
-
t.Fatalf("Failed to parse JSON: %v", err)
529
-
}
530
-
531
-
if storeData.Sessions == nil {
532
-
t.Error("Expected sessions in JSON")
533
-
}
534
-
535
-
if storeData.Requests == nil {
536
-
t.Error("Expected requests in JSON")
537
-
}
538
-
}
539
-
540
-
func TestFileStore_CleanupExpired(t *testing.T) {
541
-
tmpDir := t.TempDir()
542
-
storePath := tmpDir + "/oauth-test.json"
543
-
544
-
store, err := NewFileStore(storePath)
545
-
if err != nil {
546
-
t.Fatalf("NewFileStore() error = %v", err)
547
-
}
548
-
549
-
// CleanupExpired should not error even with no data
550
-
if err := store.CleanupExpired(); err != nil {
551
-
t.Errorf("CleanupExpired() error = %v", err)
552
-
}
553
-
554
-
// Note: Current implementation doesn't actually clean anything
555
-
// since AuthRequestData and ClientSessionData don't have expiry timestamps
556
-
// This test verifies the method doesn't panic
557
-
}
558
-
559
-
func TestGetDefaultStorePath(t *testing.T) {
560
-
path, err := GetDefaultStorePath()
561
-
if err != nil {
562
-
t.Fatalf("GetDefaultStorePath() error = %v", err)
563
-
}
564
-
565
-
if path == "" {
566
-
t.Fatal("Expected non-empty path")
567
-
}
568
-
569
-
// Path should either be /var/lib/atcr or ~/.atcr
570
-
// We can't assert exact path since it depends on permissions
571
-
t.Logf("Default store path: %s", path)
572
-
}
573
-
574
-
func TestMakeSessionKey(t *testing.T) {
575
-
did := "did:plc:alice123"
576
-
sessionID := "session-456"
577
-
578
-
key := makeSessionKey(did, sessionID)
579
-
expected := "did:plc:alice123:session-456"
580
-
581
-
if key != expected {
582
-
t.Errorf("Expected key %q, got %q", expected, key)
583
-
}
584
-
}
585
-
586
-
func TestFileStore_ConcurrentAccess(t *testing.T) {
587
-
tmpDir := t.TempDir()
588
-
storePath := tmpDir + "/oauth-test.json"
589
-
590
-
store, err := NewFileStore(storePath)
591
-
if err != nil {
592
-
t.Fatalf("NewFileStore() error = %v", err)
593
-
}
594
-
595
-
ctx := context.Background()
596
-
597
-
// Run concurrent operations
598
-
done := make(chan bool)
599
-
600
-
// Writer goroutine
601
-
go func() {
602
-
for i := 0; i < 10; i++ {
603
-
did, _ := syntax.ParseDID("did:plc:alice123")
604
-
sessionData := oauth.ClientSessionData{
605
-
AccountDID: did,
606
-
SessionID: "session-1",
607
-
HostURL: "https://pds.example.com",
608
-
}
609
-
store.SaveSession(ctx, sessionData)
610
-
time.Sleep(1 * time.Millisecond)
611
-
}
612
-
done <- true
613
-
}()
614
-
615
-
// Reader goroutine
616
-
go func() {
617
-
for i := 0; i < 10; i++ {
618
-
did, _ := syntax.ParseDID("did:plc:alice123")
619
-
store.GetSession(ctx, did, "session-1")
620
-
time.Sleep(1 * time.Millisecond)
621
-
}
622
-
done <- true
623
-
}()
624
-
625
-
// Wait for both goroutines
626
-
<-done
627
-
<-done
628
-
629
-
// If we got here without panicking, the locking works
630
-
t.Log("Concurrent access test passed")
631
-
}
···
+300
pkg/auth/servicetoken.go
+300
pkg/auth/servicetoken.go
···
···
1
+
package auth
2
+
3
+
import (
4
+
"context"
5
+
"encoding/base64"
6
+
"encoding/json"
7
+
"errors"
8
+
"fmt"
9
+
"io"
10
+
"log/slog"
11
+
"net/http"
12
+
"net/url"
13
+
"strings"
14
+
"time"
15
+
16
+
"atcr.io/pkg/atproto"
17
+
"atcr.io/pkg/auth/oauth"
18
+
"github.com/bluesky-social/indigo/atproto/atclient"
19
+
indigo_oauth "github.com/bluesky-social/indigo/atproto/auth/oauth"
20
+
)
21
+
22
+
// getErrorHint provides context-specific troubleshooting hints based on API error type
23
+
func getErrorHint(apiErr *atclient.APIError) string {
24
+
switch apiErr.Name {
25
+
case "use_dpop_nonce":
26
+
return "DPoP nonce mismatch - indigo library should automatically retry with new nonce. If this persists, check for concurrent request issues or PDS session corruption."
27
+
case "invalid_client":
28
+
if apiErr.Message != "" && apiErr.Message == "Validation of \"client_assertion\" failed: \"iat\" claim timestamp check failed (it should be in the past)" {
29
+
return "JWT timestamp validation failed - system clock on AppView may be ahead of PDS clock. Check NTP sync with: timedatectl status"
30
+
}
31
+
return "OAuth client authentication failed - check client key configuration and PDS OAuth server status"
32
+
case "invalid_token", "invalid_grant":
33
+
return "OAuth tokens expired or invalidated - user will need to re-authenticate via OAuth flow"
34
+
case "server_error":
35
+
if apiErr.StatusCode == 500 {
36
+
return "PDS returned internal server error - this may occur after repeated DPoP nonce failures or other PDS-side issues. Check PDS logs for root cause."
37
+
}
38
+
return "PDS server error - check PDS health and logs"
39
+
case "invalid_dpop_proof":
40
+
return "DPoP proof validation failed - check system clock sync and DPoP key configuration"
41
+
default:
42
+
if apiErr.StatusCode == 401 || apiErr.StatusCode == 403 {
43
+
return "Authentication/authorization failed - OAuth session may be expired or revoked"
44
+
}
45
+
return "PDS rejected the request - see errorName and errorMessage for details"
46
+
}
47
+
}
48
+
49
+
// ParseJWTExpiry extracts the expiry time from a JWT without verifying the signature
50
+
// We trust tokens from the user's PDS, so signature verification isn't needed here
51
+
// Manually decodes the JWT payload to avoid algorithm compatibility issues
52
+
func ParseJWTExpiry(tokenString string) (time.Time, error) {
53
+
// JWT format: header.payload.signature
54
+
parts := strings.Split(tokenString, ".")
55
+
if len(parts) != 3 {
56
+
return time.Time{}, fmt.Errorf("invalid JWT format: expected 3 parts, got %d", len(parts))
57
+
}
58
+
59
+
// Decode the payload (second part)
60
+
payload, err := base64.RawURLEncoding.DecodeString(parts[1])
61
+
if err != nil {
62
+
return time.Time{}, fmt.Errorf("failed to decode JWT payload: %w", err)
63
+
}
64
+
65
+
// Parse the JSON payload
66
+
var claims struct {
67
+
Exp int64 `json:"exp"`
68
+
}
69
+
if err := json.Unmarshal(payload, &claims); err != nil {
70
+
return time.Time{}, fmt.Errorf("failed to parse JWT claims: %w", err)
71
+
}
72
+
73
+
if claims.Exp == 0 {
74
+
return time.Time{}, fmt.Errorf("JWT missing exp claim")
75
+
}
76
+
77
+
return time.Unix(claims.Exp, 0), nil
78
+
}
79
+
80
+
// buildServiceAuthURL constructs the URL for com.atproto.server.getServiceAuth
81
+
func buildServiceAuthURL(pdsEndpoint, holdDID string) string {
82
+
// Request 5-minute expiry (PDS may grant less)
83
+
// exp must be absolute Unix timestamp, not relative duration
84
+
expiryTime := time.Now().Unix() + 300 // 5 minutes from now
85
+
return fmt.Sprintf("%s%s?aud=%s&lxm=%s&exp=%d",
86
+
pdsEndpoint,
87
+
atproto.ServerGetServiceAuth,
88
+
url.QueryEscape(holdDID),
89
+
url.QueryEscape("com.atproto.repo.getRecord"),
90
+
expiryTime,
91
+
)
92
+
}
93
+
94
+
// parseServiceTokenResponse extracts the token from a service auth response
95
+
func parseServiceTokenResponse(resp *http.Response) (string, error) {
96
+
defer resp.Body.Close()
97
+
98
+
if resp.StatusCode != http.StatusOK {
99
+
bodyBytes, _ := io.ReadAll(resp.Body)
100
+
return "", fmt.Errorf("service auth failed with status %d: %s", resp.StatusCode, string(bodyBytes))
101
+
}
102
+
103
+
var result struct {
104
+
Token string `json:"token"`
105
+
}
106
+
if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
107
+
return "", fmt.Errorf("failed to decode service auth response: %w", err)
108
+
}
109
+
110
+
if result.Token == "" {
111
+
return "", fmt.Errorf("empty token in service auth response")
112
+
}
113
+
114
+
return result.Token, nil
115
+
}
116
+
117
+
// GetOrFetchServiceToken gets a service token for hold authentication.
118
+
// Handles both OAuth/DPoP and app-password authentication based on authMethod.
119
+
// Checks cache first, then fetches from PDS if needed.
120
+
//
121
+
// For OAuth: Uses DoWithSession() to hold a per-DID lock through the entire PDS interaction.
122
+
// This prevents DPoP nonce race conditions when multiple Docker layers upload concurrently.
123
+
//
124
+
// For app-password: Uses Bearer token authentication without locking (no DPoP complexity).
125
+
func GetOrFetchServiceToken(
126
+
ctx context.Context,
127
+
authMethod string,
128
+
refresher *oauth.Refresher, // Required for OAuth, nil for app-password
129
+
did, holdDID, pdsEndpoint string,
130
+
) (string, error) {
131
+
// Check cache first to avoid unnecessary PDS calls on every request
132
+
cachedToken, expiresAt := GetServiceToken(did, holdDID)
133
+
134
+
// Use cached token if it exists and has > 10s remaining
135
+
if cachedToken != "" && time.Until(expiresAt) > 10*time.Second {
136
+
slog.Debug("Using cached service token",
137
+
"did", did,
138
+
"authMethod", authMethod,
139
+
"expiresIn", time.Until(expiresAt).Round(time.Second))
140
+
return cachedToken, nil
141
+
}
142
+
143
+
// Cache miss or expiring soon - fetch new service token
144
+
if cachedToken == "" {
145
+
slog.Debug("Service token cache miss, fetching new token", "did", did, "authMethod", authMethod)
146
+
} else {
147
+
slog.Debug("Service token expiring soon, proactively renewing", "did", did, "authMethod", authMethod)
148
+
}
149
+
150
+
var serviceToken string
151
+
var err error
152
+
153
+
// Branch based on auth method
154
+
if authMethod == AuthMethodOAuth {
155
+
serviceToken, err = doOAuthFetch(ctx, refresher, did, holdDID, pdsEndpoint)
156
+
// OAuth-specific cleanup: delete stale session on error
157
+
if err != nil && refresher != nil {
158
+
if delErr := refresher.DeleteSession(ctx, did); delErr != nil {
159
+
slog.Warn("Failed to delete stale OAuth session",
160
+
"component", "auth/servicetoken",
161
+
"did", did,
162
+
"error", delErr)
163
+
}
164
+
}
165
+
} else {
166
+
serviceToken, err = doAppPasswordFetch(ctx, did, holdDID, pdsEndpoint)
167
+
}
168
+
169
+
// Unified error handling
170
+
if err != nil {
171
+
InvalidateServiceToken(did, holdDID)
172
+
173
+
var apiErr *atclient.APIError
174
+
if errors.As(err, &apiErr) {
175
+
slog.Error("Service token request failed",
176
+
"component", "auth/servicetoken",
177
+
"authMethod", authMethod,
178
+
"did", did,
179
+
"holdDID", holdDID,
180
+
"pdsEndpoint", pdsEndpoint,
181
+
"error", err,
182
+
"httpStatus", apiErr.StatusCode,
183
+
"errorName", apiErr.Name,
184
+
"errorMessage", apiErr.Message,
185
+
"hint", getErrorHint(apiErr))
186
+
} else {
187
+
slog.Error("Service token request failed",
188
+
"component", "auth/servicetoken",
189
+
"authMethod", authMethod,
190
+
"did", did,
191
+
"holdDID", holdDID,
192
+
"pdsEndpoint", pdsEndpoint,
193
+
"error", err)
194
+
}
195
+
return "", err
196
+
}
197
+
198
+
// Cache the token (parses JWT to extract actual expiry)
199
+
if cacheErr := SetServiceToken(did, holdDID, serviceToken); cacheErr != nil {
200
+
slog.Warn("Failed to cache service token", "error", cacheErr, "did", did, "holdDID", holdDID)
201
+
}
202
+
203
+
slog.Debug("Service token obtained", "did", did, "authMethod", authMethod)
204
+
return serviceToken, nil
205
+
}
206
+
207
+
// doOAuthFetch fetches a service token using OAuth/DPoP authentication.
208
+
// Uses DoWithSession() for per-DID locking to prevent DPoP nonce races.
209
+
// Returns (token, error) without logging - caller handles error logging.
210
+
func doOAuthFetch(
211
+
ctx context.Context,
212
+
refresher *oauth.Refresher,
213
+
did, holdDID, pdsEndpoint string,
214
+
) (string, error) {
215
+
if refresher == nil {
216
+
return "", fmt.Errorf("refresher is nil (OAuth session required)")
217
+
}
218
+
219
+
var serviceToken string
220
+
var fetchErr error
221
+
222
+
err := refresher.DoWithSession(ctx, did, func(session *indigo_oauth.ClientSession) error {
223
+
// Double-check cache after acquiring lock (double-checked locking pattern)
224
+
cachedToken, expiresAt := GetServiceToken(did, holdDID)
225
+
if cachedToken != "" && time.Until(expiresAt) > 10*time.Second {
226
+
slog.Debug("Service token cache hit after lock acquisition",
227
+
"did", did,
228
+
"expiresIn", time.Until(expiresAt).Round(time.Second))
229
+
serviceToken = cachedToken
230
+
return nil
231
+
}
232
+
233
+
serviceAuthURL := buildServiceAuthURL(pdsEndpoint, holdDID)
234
+
235
+
req, err := http.NewRequestWithContext(ctx, "GET", serviceAuthURL, nil)
236
+
if err != nil {
237
+
fetchErr = fmt.Errorf("failed to create request: %w", err)
238
+
return fetchErr
239
+
}
240
+
241
+
resp, err := session.DoWithAuth(session.Client, req, "com.atproto.server.getServiceAuth")
242
+
if err != nil {
243
+
fetchErr = fmt.Errorf("OAuth request failed: %w", err)
244
+
return fetchErr
245
+
}
246
+
247
+
token, parseErr := parseServiceTokenResponse(resp)
248
+
if parseErr != nil {
249
+
fetchErr = parseErr
250
+
return fetchErr
251
+
}
252
+
253
+
serviceToken = token
254
+
return nil
255
+
})
256
+
257
+
if err != nil {
258
+
if fetchErr != nil {
259
+
return "", fetchErr
260
+
}
261
+
return "", fmt.Errorf("failed to get OAuth session: %w", err)
262
+
}
263
+
264
+
return serviceToken, nil
265
+
}
266
+
267
+
// doAppPasswordFetch fetches a service token using Bearer token authentication.
268
+
// Returns (token, error) without logging - caller handles error logging.
269
+
func doAppPasswordFetch(
270
+
ctx context.Context,
271
+
did, holdDID, pdsEndpoint string,
272
+
) (string, error) {
273
+
accessToken, ok := GetGlobalTokenCache().Get(did)
274
+
if !ok {
275
+
return "", fmt.Errorf("no app-password access token available for DID %s", did)
276
+
}
277
+
278
+
serviceAuthURL := buildServiceAuthURL(pdsEndpoint, holdDID)
279
+
280
+
req, err := http.NewRequestWithContext(ctx, "GET", serviceAuthURL, nil)
281
+
if err != nil {
282
+
return "", fmt.Errorf("failed to create request: %w", err)
283
+
}
284
+
285
+
req.Header.Set("Authorization", "Bearer "+accessToken)
286
+
287
+
resp, err := http.DefaultClient.Do(req)
288
+
if err != nil {
289
+
return "", fmt.Errorf("request failed: %w", err)
290
+
}
291
+
292
+
if resp.StatusCode == http.StatusUnauthorized {
293
+
resp.Body.Close()
294
+
// Clear stale app-password token
295
+
GetGlobalTokenCache().Delete(did)
296
+
return "", fmt.Errorf("app-password authentication failed: token expired or invalid")
297
+
}
298
+
299
+
return parseServiceTokenResponse(resp)
300
+
}
+27
pkg/auth/servicetoken_test.go
+27
pkg/auth/servicetoken_test.go
···
···
1
+
package auth
2
+
3
+
import (
4
+
"context"
5
+
"testing"
6
+
)
7
+
8
+
func TestGetOrFetchServiceToken_NilRefresher(t *testing.T) {
9
+
ctx := context.Background()
10
+
did := "did:plc:test123"
11
+
holdDID := "did:web:hold.example.com"
12
+
pdsEndpoint := "https://pds.example.com"
13
+
14
+
// Test with nil refresher and OAuth auth method - should return error
15
+
_, err := GetOrFetchServiceToken(ctx, AuthMethodOAuth, nil, did, holdDID, pdsEndpoint)
16
+
if err == nil {
17
+
t.Error("Expected error when refresher is nil for OAuth")
18
+
}
19
+
20
+
expectedErrMsg := "refresher is nil (OAuth session required)"
21
+
if err.Error() != expectedErrMsg {
22
+
t.Errorf("Expected error message %q, got %q", expectedErrMsg, err.Error())
23
+
}
24
+
}
25
+
26
+
// Note: Full tests with mocked OAuth refresher and HTTP client will be added
27
+
// in the comprehensive test implementation phase
-175
pkg/auth/token/cache.go
-175
pkg/auth/token/cache.go
···
1
-
// Package token provides service token caching and management for AppView.
2
-
// Service tokens are JWTs issued by a user's PDS to authorize AppView to
3
-
// act on their behalf when communicating with hold services. Tokens are
4
-
// cached with automatic expiry parsing and 10-second safety margins.
5
-
package token
6
-
7
-
import (
8
-
"encoding/base64"
9
-
"encoding/json"
10
-
"fmt"
11
-
"log/slog"
12
-
"strings"
13
-
"sync"
14
-
"time"
15
-
)
16
-
17
-
// serviceTokenEntry represents a cached service token
18
-
type serviceTokenEntry struct {
19
-
token string
20
-
expiresAt time.Time
21
-
}
22
-
23
-
// Global cache for service tokens (DID:HoldDID -> token)
24
-
// Service tokens are JWTs issued by a user's PDS to authorize AppView to act on their behalf
25
-
// when communicating with hold services. These tokens are scoped to specific holds and have
26
-
// limited lifetime (typically 60s, can request up to 5min).
27
-
var (
28
-
globalServiceTokens = make(map[string]*serviceTokenEntry)
29
-
globalServiceTokensMu sync.RWMutex
30
-
)
31
-
32
-
// GetServiceToken retrieves a cached service token for the given DID and hold DID
33
-
// Returns empty string if no valid cached token exists
34
-
func GetServiceToken(did, holdDID string) (token string, expiresAt time.Time) {
35
-
cacheKey := did + ":" + holdDID
36
-
37
-
globalServiceTokensMu.RLock()
38
-
entry, exists := globalServiceTokens[cacheKey]
39
-
globalServiceTokensMu.RUnlock()
40
-
41
-
if !exists {
42
-
return "", time.Time{}
43
-
}
44
-
45
-
// Check if token is still valid
46
-
if time.Now().After(entry.expiresAt) {
47
-
// Token expired, remove from cache
48
-
globalServiceTokensMu.Lock()
49
-
delete(globalServiceTokens, cacheKey)
50
-
globalServiceTokensMu.Unlock()
51
-
return "", time.Time{}
52
-
}
53
-
54
-
return entry.token, entry.expiresAt
55
-
}
56
-
57
-
// SetServiceToken stores a service token in the cache
58
-
// Automatically parses the JWT to extract the expiry time
59
-
// Applies a 10-second safety margin (cache expires 10s before actual JWT expiry)
60
-
func SetServiceToken(did, holdDID, token string) error {
61
-
cacheKey := did + ":" + holdDID
62
-
63
-
// Parse JWT to extract expiry (don't verify signature - we trust the PDS)
64
-
expiry, err := parseJWTExpiry(token)
65
-
if err != nil {
66
-
// If parsing fails, use default 50s TTL (conservative fallback)
67
-
slog.Warn("Failed to parse JWT expiry, using default 50s", "error", err, "cacheKey", cacheKey)
68
-
expiry = time.Now().Add(50 * time.Second)
69
-
} else {
70
-
// Apply 10s safety margin to avoid using nearly-expired tokens
71
-
expiry = expiry.Add(-10 * time.Second)
72
-
}
73
-
74
-
globalServiceTokensMu.Lock()
75
-
globalServiceTokens[cacheKey] = &serviceTokenEntry{
76
-
token: token,
77
-
expiresAt: expiry,
78
-
}
79
-
globalServiceTokensMu.Unlock()
80
-
81
-
slog.Debug("Cached service token",
82
-
"cacheKey", cacheKey,
83
-
"expiresIn", time.Until(expiry).Round(time.Second))
84
-
85
-
return nil
86
-
}
87
-
88
-
// parseJWTExpiry extracts the expiry time from a JWT without verifying the signature
89
-
// We trust tokens from the user's PDS, so signature verification isn't needed here
90
-
// Manually decodes the JWT payload to avoid algorithm compatibility issues
91
-
func parseJWTExpiry(tokenString string) (time.Time, error) {
92
-
// JWT format: header.payload.signature
93
-
parts := strings.Split(tokenString, ".")
94
-
if len(parts) != 3 {
95
-
return time.Time{}, fmt.Errorf("invalid JWT format: expected 3 parts, got %d", len(parts))
96
-
}
97
-
98
-
// Decode the payload (second part)
99
-
payload, err := base64.RawURLEncoding.DecodeString(parts[1])
100
-
if err != nil {
101
-
return time.Time{}, fmt.Errorf("failed to decode JWT payload: %w", err)
102
-
}
103
-
104
-
// Parse the JSON payload
105
-
var claims struct {
106
-
Exp int64 `json:"exp"`
107
-
}
108
-
if err := json.Unmarshal(payload, &claims); err != nil {
109
-
return time.Time{}, fmt.Errorf("failed to parse JWT claims: %w", err)
110
-
}
111
-
112
-
if claims.Exp == 0 {
113
-
return time.Time{}, fmt.Errorf("JWT missing exp claim")
114
-
}
115
-
116
-
return time.Unix(claims.Exp, 0), nil
117
-
}
118
-
119
-
// InvalidateServiceToken removes a service token from the cache
120
-
// Used when we detect that a token is invalid or the user's session has expired
121
-
func InvalidateServiceToken(did, holdDID string) {
122
-
cacheKey := did + ":" + holdDID
123
-
124
-
globalServiceTokensMu.Lock()
125
-
delete(globalServiceTokens, cacheKey)
126
-
globalServiceTokensMu.Unlock()
127
-
128
-
slog.Debug("Invalidated service token", "cacheKey", cacheKey)
129
-
}
130
-
131
-
// GetCacheStats returns statistics about the service token cache for debugging
132
-
func GetCacheStats() map[string]any {
133
-
globalServiceTokensMu.RLock()
134
-
defer globalServiceTokensMu.RUnlock()
135
-
136
-
validCount := 0
137
-
expiredCount := 0
138
-
now := time.Now()
139
-
140
-
for _, entry := range globalServiceTokens {
141
-
if now.Before(entry.expiresAt) {
142
-
validCount++
143
-
} else {
144
-
expiredCount++
145
-
}
146
-
}
147
-
148
-
return map[string]any{
149
-
"total_entries": len(globalServiceTokens),
150
-
"valid_tokens": validCount,
151
-
"expired_tokens": expiredCount,
152
-
}
153
-
}
154
-
155
-
// CleanExpiredTokens removes expired tokens from the cache
156
-
// Can be called periodically to prevent unbounded growth (though expired tokens
157
-
// are also removed lazily on access)
158
-
func CleanExpiredTokens() {
159
-
globalServiceTokensMu.Lock()
160
-
defer globalServiceTokensMu.Unlock()
161
-
162
-
now := time.Now()
163
-
removed := 0
164
-
165
-
for key, entry := range globalServiceTokens {
166
-
if now.After(entry.expiresAt) {
167
-
delete(globalServiceTokens, key)
168
-
removed++
169
-
}
170
-
}
171
-
172
-
if removed > 0 {
173
-
slog.Debug("Cleaned expired service tokens", "count", removed)
174
-
}
175
-
}
···
-195
pkg/auth/token/cache_test.go
-195
pkg/auth/token/cache_test.go
···
1
-
package token
2
-
3
-
import (
4
-
"testing"
5
-
"time"
6
-
)
7
-
8
-
func TestGetServiceToken_NotCached(t *testing.T) {
9
-
// Clear cache first
10
-
globalServiceTokensMu.Lock()
11
-
globalServiceTokens = make(map[string]*serviceTokenEntry)
12
-
globalServiceTokensMu.Unlock()
13
-
14
-
did := "did:plc:test123"
15
-
holdDID := "did:web:hold.example.com"
16
-
17
-
token, expiresAt := GetServiceToken(did, holdDID)
18
-
if token != "" {
19
-
t.Errorf("Expected empty token for uncached entry, got %q", token)
20
-
}
21
-
if !expiresAt.IsZero() {
22
-
t.Error("Expected zero time for uncached entry")
23
-
}
24
-
}
25
-
26
-
func TestSetServiceToken_ManualExpiry(t *testing.T) {
27
-
// Clear cache first
28
-
globalServiceTokensMu.Lock()
29
-
globalServiceTokens = make(map[string]*serviceTokenEntry)
30
-
globalServiceTokensMu.Unlock()
31
-
32
-
did := "did:plc:test123"
33
-
holdDID := "did:web:hold.example.com"
34
-
token := "invalid_jwt_token" // Will fall back to 50s default
35
-
36
-
// This should succeed with default 50s TTL since JWT parsing will fail
37
-
err := SetServiceToken(did, holdDID, token)
38
-
if err != nil {
39
-
t.Fatalf("SetServiceToken() error = %v", err)
40
-
}
41
-
42
-
// Verify token was cached
43
-
cachedToken, expiresAt := GetServiceToken(did, holdDID)
44
-
if cachedToken != token {
45
-
t.Errorf("Expected token %q, got %q", token, cachedToken)
46
-
}
47
-
if expiresAt.IsZero() {
48
-
t.Error("Expected non-zero expiry time")
49
-
}
50
-
51
-
// Expiry should be approximately 50s from now (with 10s margin subtracted in some cases)
52
-
expectedExpiry := time.Now().Add(50 * time.Second)
53
-
diff := expiresAt.Sub(expectedExpiry)
54
-
if diff < -5*time.Second || diff > 5*time.Second {
55
-
t.Errorf("Expiry time off by %v (expected ~50s from now)", diff)
56
-
}
57
-
}
58
-
59
-
func TestGetServiceToken_Expired(t *testing.T) {
60
-
// Manually insert an expired token
61
-
did := "did:plc:test123"
62
-
holdDID := "did:web:hold.example.com"
63
-
cacheKey := did + ":" + holdDID
64
-
65
-
globalServiceTokensMu.Lock()
66
-
globalServiceTokens[cacheKey] = &serviceTokenEntry{
67
-
token: "expired_token",
68
-
expiresAt: time.Now().Add(-1 * time.Hour), // 1 hour ago
69
-
}
70
-
globalServiceTokensMu.Unlock()
71
-
72
-
// Try to get - should return empty since expired
73
-
token, expiresAt := GetServiceToken(did, holdDID)
74
-
if token != "" {
75
-
t.Errorf("Expected empty token for expired entry, got %q", token)
76
-
}
77
-
if !expiresAt.IsZero() {
78
-
t.Error("Expected zero time for expired entry")
79
-
}
80
-
81
-
// Verify token was removed from cache
82
-
globalServiceTokensMu.RLock()
83
-
_, exists := globalServiceTokens[cacheKey]
84
-
globalServiceTokensMu.RUnlock()
85
-
86
-
if exists {
87
-
t.Error("Expected expired token to be removed from cache")
88
-
}
89
-
}
90
-
91
-
func TestInvalidateServiceToken(t *testing.T) {
92
-
// Set a token
93
-
did := "did:plc:test123"
94
-
holdDID := "did:web:hold.example.com"
95
-
token := "test_token"
96
-
97
-
err := SetServiceToken(did, holdDID, token)
98
-
if err != nil {
99
-
t.Fatalf("SetServiceToken() error = %v", err)
100
-
}
101
-
102
-
// Verify it's cached
103
-
cachedToken, _ := GetServiceToken(did, holdDID)
104
-
if cachedToken != token {
105
-
t.Fatal("Token should be cached")
106
-
}
107
-
108
-
// Invalidate
109
-
InvalidateServiceToken(did, holdDID)
110
-
111
-
// Verify it's gone
112
-
cachedToken, _ = GetServiceToken(did, holdDID)
113
-
if cachedToken != "" {
114
-
t.Error("Expected token to be invalidated")
115
-
}
116
-
}
117
-
118
-
func TestCleanExpiredTokens(t *testing.T) {
119
-
// Clear cache first
120
-
globalServiceTokensMu.Lock()
121
-
globalServiceTokens = make(map[string]*serviceTokenEntry)
122
-
globalServiceTokensMu.Unlock()
123
-
124
-
// Add expired and valid tokens
125
-
globalServiceTokensMu.Lock()
126
-
globalServiceTokens["expired:hold1"] = &serviceTokenEntry{
127
-
token: "expired1",
128
-
expiresAt: time.Now().Add(-1 * time.Hour),
129
-
}
130
-
globalServiceTokens["valid:hold2"] = &serviceTokenEntry{
131
-
token: "valid1",
132
-
expiresAt: time.Now().Add(1 * time.Hour),
133
-
}
134
-
globalServiceTokensMu.Unlock()
135
-
136
-
// Clean expired
137
-
CleanExpiredTokens()
138
-
139
-
// Verify only valid token remains
140
-
globalServiceTokensMu.RLock()
141
-
_, expiredExists := globalServiceTokens["expired:hold1"]
142
-
_, validExists := globalServiceTokens["valid:hold2"]
143
-
globalServiceTokensMu.RUnlock()
144
-
145
-
if expiredExists {
146
-
t.Error("Expected expired token to be removed")
147
-
}
148
-
if !validExists {
149
-
t.Error("Expected valid token to remain")
150
-
}
151
-
}
152
-
153
-
func TestGetCacheStats(t *testing.T) {
154
-
// Clear cache first
155
-
globalServiceTokensMu.Lock()
156
-
globalServiceTokens = make(map[string]*serviceTokenEntry)
157
-
globalServiceTokensMu.Unlock()
158
-
159
-
// Add some tokens
160
-
globalServiceTokensMu.Lock()
161
-
globalServiceTokens["did1:hold1"] = &serviceTokenEntry{
162
-
token: "token1",
163
-
expiresAt: time.Now().Add(1 * time.Hour),
164
-
}
165
-
globalServiceTokens["did2:hold2"] = &serviceTokenEntry{
166
-
token: "token2",
167
-
expiresAt: time.Now().Add(1 * time.Hour),
168
-
}
169
-
globalServiceTokensMu.Unlock()
170
-
171
-
stats := GetCacheStats()
172
-
if stats == nil {
173
-
t.Fatal("Expected non-nil stats")
174
-
}
175
-
176
-
// GetCacheStats returns map[string]any with "total_entries" key
177
-
totalEntries, ok := stats["total_entries"].(int)
178
-
if !ok {
179
-
t.Fatalf("Expected total_entries in stats map, got: %v", stats)
180
-
}
181
-
182
-
if totalEntries != 2 {
183
-
t.Errorf("Expected 2 entries, got %d", totalEntries)
184
-
}
185
-
186
-
// Also check valid_tokens
187
-
validTokens, ok := stats["valid_tokens"].(int)
188
-
if !ok {
189
-
t.Fatal("Expected valid_tokens in stats map")
190
-
}
191
-
192
-
if validTokens != 2 {
193
-
t.Errorf("Expected 2 valid tokens, got %d", validTokens)
194
-
}
195
-
}
···
+49
-3
pkg/auth/token/claims.go
+49
-3
pkg/auth/token/claims.go
···
7
"github.com/golang-jwt/jwt/v5"
8
)
9
10
// Claims represents the JWT claims for registry authentication
11
// This follows the Docker Registry token specification
12
type Claims struct {
13
jwt.RegisteredClaims
14
-
Access []auth.AccessEntry `json:"access,omitempty"`
15
}
16
17
// NewClaims creates a new Claims structure with standard fields
18
-
func NewClaims(subject, issuer, audience string, expiration time.Duration, access []auth.AccessEntry) *Claims {
19
now := time.Now()
20
return &Claims{
21
RegisteredClaims: jwt.RegisteredClaims{
···
26
NotBefore: jwt.NewNumericDate(now),
27
ExpiresAt: jwt.NewNumericDate(now.Add(expiration)),
28
},
29
-
Access: access,
30
}
31
}
···
7
"github.com/golang-jwt/jwt/v5"
8
)
9
10
+
// Auth method constants
11
+
const (
12
+
AuthMethodOAuth = "oauth"
13
+
AuthMethodAppPassword = "app_password"
14
+
)
15
+
16
// Claims represents the JWT claims for registry authentication
17
// This follows the Docker Registry token specification
18
type Claims struct {
19
jwt.RegisteredClaims
20
+
Access []auth.AccessEntry `json:"access,omitempty"`
21
+
AuthMethod string `json:"auth_method,omitempty"` // "oauth" or "app_password"
22
}
23
24
// NewClaims creates a new Claims structure with standard fields
25
+
func NewClaims(subject, issuer, audience string, expiration time.Duration, access []auth.AccessEntry, authMethod string) *Claims {
26
now := time.Now()
27
return &Claims{
28
RegisteredClaims: jwt.RegisteredClaims{
···
33
NotBefore: jwt.NewNumericDate(now),
34
ExpiresAt: jwt.NewNumericDate(now.Add(expiration)),
35
},
36
+
Access: access,
37
+
AuthMethod: authMethod, // "oauth" or "app_password"
38
+
}
39
+
}
40
+
41
+
// ExtractAuthMethod parses a JWT token string and extracts the auth_method claim
42
+
// Returns the auth method or empty string if not found or token is invalid
43
+
// This does NOT validate the token - it only parses it to extract the claim
44
+
func ExtractAuthMethod(tokenString string) string {
45
+
// Parse token without validation (we only need the claims, validation is done by distribution library)
46
+
parser := jwt.NewParser(jwt.WithoutClaimsValidation())
47
+
token, _, err := parser.ParseUnverified(tokenString, &Claims{})
48
+
if err != nil {
49
+
return "" // Invalid token format
50
}
51
+
52
+
claims, ok := token.Claims.(*Claims)
53
+
if !ok {
54
+
return "" // Wrong claims type
55
+
}
56
+
57
+
return claims.AuthMethod
58
+
}
59
+
60
+
// ExtractSubject parses a JWT token string and extracts the Subject claim (the user's DID)
61
+
// Returns the subject or empty string if not found or token is invalid
62
+
// This does NOT validate the token - it only parses it to extract the claim
63
+
func ExtractSubject(tokenString string) string {
64
+
// Parse token without validation (we only need the claims, validation is done by distribution library)
65
+
parser := jwt.NewParser(jwt.WithoutClaimsValidation())
66
+
token, _, err := parser.ParseUnverified(tokenString, &Claims{})
67
+
if err != nil {
68
+
return "" // Invalid token format
69
+
}
70
+
71
+
claims, ok := token.Claims.(*Claims)
72
+
if !ok {
73
+
return "" // Wrong claims type
74
+
}
75
+
76
+
return claims.Subject
77
}
+2
-2
pkg/auth/token/claims_test.go
+2
-2
pkg/auth/token/claims_test.go
···
20
},
21
}
22
23
-
claims := NewClaims(subject, issuer, audience, expiration, access)
24
25
if claims.Subject != subject {
26
t.Errorf("Expected subject %q, got %q", subject, claims.Subject)
···
69
}
70
71
func TestNewClaims_EmptyAccess(t *testing.T) {
72
-
claims := NewClaims("did:plc:user123", "atcr.io", "registry", 15*time.Minute, nil)
73
74
if claims.Access != nil {
75
t.Error("Expected Access to be nil when not provided")
···
20
},
21
}
22
23
+
claims := NewClaims(subject, issuer, audience, expiration, access, AuthMethodOAuth)
24
25
if claims.Subject != subject {
26
t.Errorf("Expected subject %q, got %q", subject, claims.Subject)
···
69
}
70
71
func TestNewClaims_EmptyAccess(t *testing.T) {
72
+
claims := NewClaims("did:plc:user123", "atcr.io", "registry", 15*time.Minute, nil, AuthMethodOAuth)
73
74
if claims.Access != nil {
75
t.Error("Expected Access to be nil when not provided")
+64
-6
pkg/auth/token/handler.go
+64
-6
pkg/auth/token/handler.go
···
20
// without coupling the token package to AppView-specific dependencies.
21
type PostAuthCallback func(ctx context.Context, did, handle, pdsEndpoint, accessToken string) error
22
23
// Handler handles /auth/token requests
24
type Handler struct {
25
-
issuer *Issuer
26
-
validator *auth.SessionValidator
27
-
deviceStore *db.DeviceStore // For validating device secrets
28
-
postAuthCallback PostAuthCallback
29
}
30
31
// NewHandler creates a new token handler
···
43
h.postAuthCallback = callback
44
}
45
46
// TokenResponse represents the response from /auth/token
47
type TokenResponse struct {
48
Token string `json:"token,omitempty"` // Legacy field
···
80
(use your ATProto handle + app-password)`, message, baseURL, r.Host), http.StatusUnauthorized)
81
}
82
83
// ServeHTTP handles the token request
84
func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
85
slog.Debug("Received token request", "method", r.Method, "path", r.URL.Path)
···
119
var did string
120
var handle string
121
var accessToken string
122
123
// 1. Check if it's a device secret (starts with "atcr_device_")
124
if strings.HasPrefix(password, "atcr_device_") {
···
129
return
130
}
131
132
did = device.DID
133
handle = device.Handle
134
// Device is linked to OAuth session via DID
135
// OAuth refresher will provide access token when needed via middleware
136
} else {
···
142
sendAuthError(w, r, "authentication failed")
143
return
144
}
145
146
slog.Debug("App password validated successfully",
147
"did", did,
···
178
}
179
180
// Issue JWT token
181
-
tokenString, err := h.issuer.Issue(did, access)
182
if err != nil {
183
slog.Error("Failed to issue token", "error", err, "did", did)
184
http.Error(w, fmt.Sprintf("failed to issue token: %v", err), http.StatusInternalServerError)
185
return
186
}
187
188
-
slog.Debug("Issued JWT token", "tokenLength", len(tokenString), "did", did)
189
190
// Return token response
191
now := time.Now()
···
20
// without coupling the token package to AppView-specific dependencies.
21
type PostAuthCallback func(ctx context.Context, did, handle, pdsEndpoint, accessToken string) error
22
23
+
// OAuthSessionValidator validates OAuth sessions before issuing tokens
24
+
// This interface allows the token handler to verify OAuth sessions are usable
25
+
// (not just that they exist) without depending directly on the OAuth implementation.
26
+
type OAuthSessionValidator interface {
27
+
// ValidateSession checks if OAuth session is usable by attempting to load/refresh it
28
+
// Returns nil if session is valid, error if session is invalid/expired/needs re-auth
29
+
ValidateSession(ctx context.Context, did string) error
30
+
}
31
+
32
// Handler handles /auth/token requests
33
type Handler struct {
34
+
issuer *Issuer
35
+
validator *auth.SessionValidator
36
+
deviceStore *db.DeviceStore // For validating device secrets
37
+
postAuthCallback PostAuthCallback
38
+
oauthSessionValidator OAuthSessionValidator
39
}
40
41
// NewHandler creates a new token handler
···
53
h.postAuthCallback = callback
54
}
55
56
+
// SetOAuthSessionValidator sets the OAuth session validator for validating device auth
57
+
// When set, the handler will validate OAuth sessions are usable before issuing tokens for device auth
58
+
// This prevents the flood of errors that occurs when a stale session is discovered during push
59
+
func (h *Handler) SetOAuthSessionValidator(validator OAuthSessionValidator) {
60
+
h.oauthSessionValidator = validator
61
+
}
62
+
63
// TokenResponse represents the response from /auth/token
64
type TokenResponse struct {
65
Token string `json:"token,omitempty"` // Legacy field
···
97
(use your ATProto handle + app-password)`, message, baseURL, r.Host), http.StatusUnauthorized)
98
}
99
100
+
// AuthErrorResponse is returned when authentication fails in a way the credential helper can handle
101
+
type AuthErrorResponse struct {
102
+
Error string `json:"error"`
103
+
Message string `json:"message"`
104
+
LoginURL string `json:"login_url,omitempty"`
105
+
}
106
+
107
+
// sendOAuthSessionExpiredError sends a JSON error response when OAuth session is missing
108
+
// This allows the credential helper to detect this specific error and open the browser
109
+
func sendOAuthSessionExpiredError(w http.ResponseWriter, r *http.Request) {
110
+
baseURL := getBaseURL(r)
111
+
loginURL := baseURL + "/auth/oauth/login"
112
+
113
+
w.Header().Set("WWW-Authenticate", `Basic realm="ATCR Registry"`)
114
+
w.Header().Set("Content-Type", "application/json")
115
+
w.WriteHeader(http.StatusUnauthorized)
116
+
117
+
resp := AuthErrorResponse{
118
+
Error: "oauth_session_expired",
119
+
Message: "OAuth session expired or invalidated. Please re-authenticate in your browser.",
120
+
LoginURL: loginURL,
121
+
}
122
+
json.NewEncoder(w).Encode(resp)
123
+
}
124
+
125
// ServeHTTP handles the token request
126
func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
127
slog.Debug("Received token request", "method", r.Method, "path", r.URL.Path)
···
161
var did string
162
var handle string
163
var accessToken string
164
+
var authMethod string
165
166
// 1. Check if it's a device secret (starts with "atcr_device_")
167
if strings.HasPrefix(password, "atcr_device_") {
···
172
return
173
}
174
175
+
// Validate OAuth session is usable (not just exists)
176
+
// Device secrets are permanent, but they require a working OAuth session to push
177
+
// By validating here, we prevent the flood of errors that occurs when a stale
178
+
// session is discovered during parallel layer uploads
179
+
if h.oauthSessionValidator != nil {
180
+
if err := h.oauthSessionValidator.ValidateSession(r.Context(), device.DID); err != nil {
181
+
slog.Debug("OAuth session validation failed", "did", device.DID, "error", err)
182
+
sendOAuthSessionExpiredError(w, r)
183
+
return
184
+
}
185
+
}
186
+
187
did = device.DID
188
handle = device.Handle
189
+
authMethod = AuthMethodOAuth
190
// Device is linked to OAuth session via DID
191
// OAuth refresher will provide access token when needed via middleware
192
} else {
···
198
sendAuthError(w, r, "authentication failed")
199
return
200
}
201
+
202
+
authMethod = AuthMethodAppPassword
203
204
slog.Debug("App password validated successfully",
205
"did", did,
···
236
}
237
238
// Issue JWT token
239
+
tokenString, err := h.issuer.Issue(did, access, authMethod)
240
if err != nil {
241
slog.Error("Failed to issue token", "error", err, "did", did)
242
http.Error(w, fmt.Sprintf("failed to issue token: %v", err), http.StatusInternalServerError)
243
return
244
}
245
246
+
slog.Debug("Issued JWT token", "tokenLength", len(tokenString), "did", did, "authMethod", authMethod)
247
248
// Return token response
249
now := time.Now()
+2
-2
pkg/auth/token/issuer.go
+2
-2
pkg/auth/token/issuer.go
···
60
}
61
62
// Issue creates and signs a new JWT token
63
+
func (i *Issuer) Issue(subject string, access []auth.AccessEntry, authMethod string) (string, error) {
64
+
claims := NewClaims(subject, i.issuer, i.service, i.expiration, access, authMethod)
65
66
slog.Debug("Creating JWT token",
67
"issuer", i.issuer,
+6
-6
pkg/auth/token/issuer_test.go
+6
-6
pkg/auth/token/issuer_test.go
···
150
},
151
}
152
153
-
token, err := issuer.Issue(subject, access)
154
if err != nil {
155
t.Fatalf("Issue() error = %v", err)
156
}
···
174
t.Fatalf("NewIssuer() error = %v", err)
175
}
176
177
-
token, err := issuer.Issue("did:plc:user123", nil)
178
if err != nil {
179
t.Fatalf("Issue() error = %v", err)
180
}
···
201
},
202
}
203
204
-
tokenString, err := issuer.Issue(subject, access)
205
if err != nil {
206
t.Fatalf("Issue() error = %v", err)
207
}
···
271
t.Fatalf("NewIssuer() error = %v", err)
272
}
273
274
-
tokenString, err := issuer.Issue("did:plc:user123", nil)
275
if err != nil {
276
t.Fatalf("Issue() error = %v", err)
277
}
···
388
go func(idx int) {
389
defer wg.Done()
390
subject := "did:plc:user" + string(rune('0'+idx))
391
-
token, err := issuer.Issue(subject, nil)
392
tokens[idx] = token
393
errors[idx] = err
394
}(i)
···
569
t.Fatalf("NewIssuer() error = %v", err)
570
}
571
572
-
tokenString, err := issuer.Issue("did:plc:user123", nil)
573
if err != nil {
574
t.Fatalf("Issue() error = %v", err)
575
}
···
150
},
151
}
152
153
+
token, err := issuer.Issue(subject, access, AuthMethodOAuth)
154
if err != nil {
155
t.Fatalf("Issue() error = %v", err)
156
}
···
174
t.Fatalf("NewIssuer() error = %v", err)
175
}
176
177
+
token, err := issuer.Issue("did:plc:user123", nil, AuthMethodOAuth)
178
if err != nil {
179
t.Fatalf("Issue() error = %v", err)
180
}
···
201
},
202
}
203
204
+
tokenString, err := issuer.Issue(subject, access, AuthMethodOAuth)
205
if err != nil {
206
t.Fatalf("Issue() error = %v", err)
207
}
···
271
t.Fatalf("NewIssuer() error = %v", err)
272
}
273
274
+
tokenString, err := issuer.Issue("did:plc:user123", nil, "oauth")
275
if err != nil {
276
t.Fatalf("Issue() error = %v", err)
277
}
···
388
go func(idx int) {
389
defer wg.Done()
390
subject := "did:plc:user" + string(rune('0'+idx))
391
+
token, err := issuer.Issue(subject, nil, AuthMethodOAuth)
392
tokens[idx] = token
393
errors[idx] = err
394
}(i)
···
569
t.Fatalf("NewIssuer() error = %v", err)
570
}
571
572
+
tokenString, err := issuer.Issue("did:plc:user123", nil, AuthMethodOAuth)
573
if err != nil {
574
t.Fatalf("Issue() error = %v", err)
575
}
-110
pkg/auth/token/servicetoken.go
-110
pkg/auth/token/servicetoken.go
···
1
-
package token
2
-
3
-
import (
4
-
"context"
5
-
"encoding/json"
6
-
"fmt"
7
-
"io"
8
-
"log/slog"
9
-
"net/http"
10
-
"net/url"
11
-
"time"
12
-
13
-
"atcr.io/pkg/atproto"
14
-
"atcr.io/pkg/auth/oauth"
15
-
)
16
-
17
-
// GetOrFetchServiceToken gets a service token for hold authentication.
18
-
// Checks cache first, then fetches from PDS with OAuth/DPoP if needed.
19
-
// This is the canonical implementation used by both middleware and crew registration.
20
-
func GetOrFetchServiceToken(
21
-
ctx context.Context,
22
-
refresher *oauth.Refresher,
23
-
did, holdDID, pdsEndpoint string,
24
-
) (string, error) {
25
-
if refresher == nil {
26
-
return "", fmt.Errorf("refresher is nil (OAuth session required for service tokens)")
27
-
}
28
-
29
-
// Check cache first to avoid unnecessary PDS calls on every request
30
-
cachedToken, expiresAt := GetServiceToken(did, holdDID)
31
-
32
-
// Use cached token if it exists and has > 10s remaining
33
-
if cachedToken != "" && time.Until(expiresAt) > 10*time.Second {
34
-
slog.Debug("Using cached service token",
35
-
"did", did,
36
-
"expiresIn", time.Until(expiresAt).Round(time.Second))
37
-
return cachedToken, nil
38
-
}
39
-
40
-
// Cache miss or expiring soon - validate OAuth and get new service token
41
-
if cachedToken == "" {
42
-
slog.Debug("Service token cache miss, fetching new token", "did", did)
43
-
} else {
44
-
slog.Debug("Service token expiring soon, proactively renewing", "did", did)
45
-
}
46
-
47
-
session, err := refresher.GetSession(ctx, did)
48
-
if err != nil {
49
-
// OAuth session unavailable - fail
50
-
InvalidateServiceToken(did, holdDID)
51
-
return "", fmt.Errorf("failed to get OAuth session: %w", err)
52
-
}
53
-
54
-
// Call com.atproto.server.getServiceAuth on the user's PDS
55
-
// Request 5-minute expiry (PDS may grant less)
56
-
// exp must be absolute Unix timestamp, not relative duration
57
-
// Note: OAuth scope includes #atcr_hold fragment, but service auth aud must be bare DID
58
-
expiryTime := time.Now().Unix() + 300 // 5 minutes from now
59
-
serviceAuthURL := fmt.Sprintf("%s%s?aud=%s&lxm=%s&exp=%d",
60
-
pdsEndpoint,
61
-
atproto.ServerGetServiceAuth,
62
-
url.QueryEscape(holdDID),
63
-
url.QueryEscape("com.atproto.repo.getRecord"),
64
-
expiryTime,
65
-
)
66
-
67
-
req, err := http.NewRequestWithContext(ctx, "GET", serviceAuthURL, nil)
68
-
if err != nil {
69
-
return "", fmt.Errorf("failed to create service auth request: %w", err)
70
-
}
71
-
72
-
// Use OAuth session to authenticate to PDS (with DPoP)
73
-
resp, err := session.DoWithAuth(session.Client, req, "com.atproto.server.getServiceAuth")
74
-
if err != nil {
75
-
// Auth error - may indicate expired tokens or corrupted session
76
-
InvalidateServiceToken(did, holdDID)
77
-
return "", fmt.Errorf("OAuth validation failed: %w", err)
78
-
}
79
-
defer resp.Body.Close()
80
-
81
-
if resp.StatusCode != http.StatusOK {
82
-
// Service auth failed
83
-
bodyBytes, _ := io.ReadAll(resp.Body)
84
-
InvalidateServiceToken(did, holdDID)
85
-
return "", fmt.Errorf("service auth failed with status %d: %s", resp.StatusCode, string(bodyBytes))
86
-
}
87
-
88
-
// Parse response to get service token
89
-
var result struct {
90
-
Token string `json:"token"`
91
-
}
92
-
if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
93
-
return "", fmt.Errorf("failed to decode service auth response: %w", err)
94
-
}
95
-
96
-
if result.Token == "" {
97
-
return "", fmt.Errorf("empty token in service auth response")
98
-
}
99
-
100
-
serviceToken := result.Token
101
-
102
-
// Cache the token (parses JWT to extract actual expiry)
103
-
if err := SetServiceToken(did, holdDID, serviceToken); err != nil {
104
-
slog.Warn("Failed to cache service token", "error", err, "did", did, "holdDID", holdDID)
105
-
// Non-fatal - we have the token, just won't be cached
106
-
}
107
-
108
-
slog.Debug("OAuth validation succeeded, service token obtained", "did", did)
109
-
return serviceToken, nil
110
-
}
···
-27
pkg/auth/token/servicetoken_test.go
-27
pkg/auth/token/servicetoken_test.go
···
1
-
package token
2
-
3
-
import (
4
-
"context"
5
-
"testing"
6
-
)
7
-
8
-
func TestGetOrFetchServiceToken_NilRefresher(t *testing.T) {
9
-
ctx := context.Background()
10
-
did := "did:plc:test123"
11
-
holdDID := "did:web:hold.example.com"
12
-
pdsEndpoint := "https://pds.example.com"
13
-
14
-
// Test with nil refresher - should return error
15
-
_, err := GetOrFetchServiceToken(ctx, nil, did, holdDID, pdsEndpoint)
16
-
if err == nil {
17
-
t.Error("Expected error when refresher is nil")
18
-
}
19
-
20
-
expectedErrMsg := "refresher is nil"
21
-
if err.Error() != "refresher is nil (OAuth session required for service tokens)" {
22
-
t.Errorf("Expected error message to contain %q, got %q", expectedErrMsg, err.Error())
23
-
}
24
-
}
25
-
26
-
// Note: Full tests with mocked OAuth refresher and HTTP client will be added
27
-
// in the comprehensive test implementation phase
···
+784
pkg/auth/usercontext.go
+784
pkg/auth/usercontext.go
···
···
1
+
// Package auth provides UserContext for managing authenticated user state
2
+
// throughout request handling in the AppView.
3
+
package auth
4
+
5
+
import (
6
+
"context"
7
+
"database/sql"
8
+
"encoding/json"
9
+
"fmt"
10
+
"io"
11
+
"log/slog"
12
+
"net/http"
13
+
"sync"
14
+
"time"
15
+
16
+
"atcr.io/pkg/appview/db"
17
+
"atcr.io/pkg/atproto"
18
+
"atcr.io/pkg/auth/oauth"
19
+
)
20
+
21
+
// Auth method constants (duplicated from token package to avoid import cycle)
22
+
const (
23
+
AuthMethodOAuth = "oauth"
24
+
AuthMethodAppPassword = "app_password"
25
+
)
26
+
27
+
// RequestAction represents the type of registry operation
28
+
type RequestAction int
29
+
30
+
const (
31
+
ActionUnknown RequestAction = iota
32
+
ActionPull // GET/HEAD - reading from registry
33
+
ActionPush // PUT/POST/DELETE - writing to registry
34
+
ActionInspect // Metadata operations only
35
+
)
36
+
37
+
func (a RequestAction) String() string {
38
+
switch a {
39
+
case ActionPull:
40
+
return "pull"
41
+
case ActionPush:
42
+
return "push"
43
+
case ActionInspect:
44
+
return "inspect"
45
+
default:
46
+
return "unknown"
47
+
}
48
+
}
49
+
50
+
// HoldPermissions describes what the user can do on a specific hold
51
+
type HoldPermissions struct {
52
+
HoldDID string // Hold being checked
53
+
IsOwner bool // User is captain of this hold
54
+
IsCrew bool // User is a crew member
55
+
IsPublic bool // Hold allows public reads
56
+
CanRead bool // Computed: can user read blobs?
57
+
CanWrite bool // Computed: can user write blobs?
58
+
CanAdmin bool // Computed: can user manage crew?
59
+
Permissions []string // Raw permissions from crew record
60
+
}
61
+
62
+
// contextKey is unexported to prevent collisions
63
+
type contextKey struct{}
64
+
65
+
// userContextKey is the context key for UserContext
66
+
var userContextKey = contextKey{}
67
+
68
+
// userSetupCache tracks which users have had their profile/crew setup ensured
69
+
var userSetupCache sync.Map // did -> time.Time
70
+
71
+
// userSetupTTL is how long to cache user setup status (1 hour)
72
+
const userSetupTTL = 1 * time.Hour
73
+
74
+
// Dependencies bundles services needed by UserContext
75
+
type Dependencies struct {
76
+
Refresher *oauth.Refresher
77
+
Authorizer HoldAuthorizer
78
+
DefaultHoldDID string // AppView's default hold DID
79
+
}
80
+
81
+
// UserContext encapsulates authenticated user state for a request.
82
+
// Built early in the middleware chain and available throughout request processing.
83
+
//
84
+
// Two-phase initialization:
85
+
// 1. Middleware phase: Identity is set (DID, authMethod, action)
86
+
// 2. Repository() phase: Target is set via SetTarget() (owner, repo, holdDID)
87
+
type UserContext struct {
88
+
// === User Identity (set in middleware) ===
89
+
DID string // User's DID (empty if unauthenticated)
90
+
Handle string // User's handle (may be empty)
91
+
PDSEndpoint string // User's PDS endpoint
92
+
AuthMethod string // "oauth", "app_password", or ""
93
+
IsAuthenticated bool
94
+
95
+
// === Request Info ===
96
+
Action RequestAction
97
+
HTTPMethod string
98
+
99
+
// === Target Info (set by SetTarget) ===
100
+
TargetOwnerDID string // whose repo is being accessed
101
+
TargetOwnerHandle string
102
+
TargetOwnerPDS string
103
+
TargetRepo string // image name (e.g., "quickslice")
104
+
TargetHoldDID string // hold where blobs live/will live
105
+
106
+
// === Dependencies (injected) ===
107
+
refresher *oauth.Refresher
108
+
authorizer HoldAuthorizer
109
+
defaultHoldDID string
110
+
111
+
// === Cached State (lazy-loaded) ===
112
+
serviceTokens sync.Map // holdDID -> *serviceTokenEntry
113
+
permissions sync.Map // holdDID -> *HoldPermissions
114
+
pdsResolved bool
115
+
pdsResolveErr error
116
+
mu sync.Mutex // protects PDS resolution
117
+
atprotoClient *atproto.Client
118
+
atprotoClientOnce sync.Once
119
+
}
120
+
121
+
// FromContext retrieves UserContext from context.
122
+
// Returns nil if not present (unauthenticated or before middleware).
123
+
func FromContext(ctx context.Context) *UserContext {
124
+
uc, _ := ctx.Value(userContextKey).(*UserContext)
125
+
return uc
126
+
}
127
+
128
+
// WithUserContext adds UserContext to context
129
+
func WithUserContext(ctx context.Context, uc *UserContext) context.Context {
130
+
return context.WithValue(ctx, userContextKey, uc)
131
+
}
132
+
133
+
// NewUserContext creates a UserContext from extracted JWT claims.
134
+
// The deps parameter provides access to services needed for lazy operations.
135
+
func NewUserContext(did, authMethod, httpMethod string, deps *Dependencies) *UserContext {
136
+
action := ActionUnknown
137
+
switch httpMethod {
138
+
case "GET", "HEAD":
139
+
action = ActionPull
140
+
case "PUT", "POST", "PATCH", "DELETE":
141
+
action = ActionPush
142
+
}
143
+
144
+
var refresher *oauth.Refresher
145
+
var authorizer HoldAuthorizer
146
+
var defaultHoldDID string
147
+
148
+
if deps != nil {
149
+
refresher = deps.Refresher
150
+
authorizer = deps.Authorizer
151
+
defaultHoldDID = deps.DefaultHoldDID
152
+
}
153
+
154
+
return &UserContext{
155
+
DID: did,
156
+
AuthMethod: authMethod,
157
+
IsAuthenticated: did != "",
158
+
Action: action,
159
+
HTTPMethod: httpMethod,
160
+
refresher: refresher,
161
+
authorizer: authorizer,
162
+
defaultHoldDID: defaultHoldDID,
163
+
}
164
+
}
165
+
166
+
// SetPDS sets the user's PDS endpoint directly, bypassing network resolution.
167
+
// Use when PDS is already known (e.g., from previous resolution or client).
168
+
func (uc *UserContext) SetPDS(handle, pdsEndpoint string) {
169
+
uc.mu.Lock()
170
+
defer uc.mu.Unlock()
171
+
uc.Handle = handle
172
+
uc.PDSEndpoint = pdsEndpoint
173
+
uc.pdsResolved = true
174
+
uc.pdsResolveErr = nil
175
+
}
176
+
177
+
// SetTarget sets the target repository information.
178
+
// Called in Repository() after resolving the owner identity.
179
+
func (uc *UserContext) SetTarget(ownerDID, ownerHandle, ownerPDS, repo, holdDID string) {
180
+
uc.TargetOwnerDID = ownerDID
181
+
uc.TargetOwnerHandle = ownerHandle
182
+
uc.TargetOwnerPDS = ownerPDS
183
+
uc.TargetRepo = repo
184
+
uc.TargetHoldDID = holdDID
185
+
}
186
+
187
+
// ResolvePDS resolves the user's PDS endpoint (lazy, cached).
188
+
// Safe to call multiple times; resolution happens once.
189
+
func (uc *UserContext) ResolvePDS(ctx context.Context) error {
190
+
if !uc.IsAuthenticated {
191
+
return nil // Nothing to resolve for anonymous users
192
+
}
193
+
194
+
uc.mu.Lock()
195
+
defer uc.mu.Unlock()
196
+
197
+
if uc.pdsResolved {
198
+
return uc.pdsResolveErr
199
+
}
200
+
201
+
_, handle, pds, err := atproto.ResolveIdentity(ctx, uc.DID)
202
+
if err != nil {
203
+
uc.pdsResolveErr = err
204
+
uc.pdsResolved = true
205
+
return err
206
+
}
207
+
208
+
uc.Handle = handle
209
+
uc.PDSEndpoint = pds
210
+
uc.pdsResolved = true
211
+
return nil
212
+
}
213
+
214
+
// GetServiceToken returns a service token for the target hold.
215
+
// Uses internal caching with sync.Once per holdDID.
216
+
// Requires target to be set via SetTarget().
217
+
func (uc *UserContext) GetServiceToken(ctx context.Context) (string, error) {
218
+
if uc.TargetHoldDID == "" {
219
+
return "", fmt.Errorf("target hold not set (call SetTarget first)")
220
+
}
221
+
return uc.GetServiceTokenForHold(ctx, uc.TargetHoldDID)
222
+
}
223
+
224
+
// GetServiceTokenForHold returns a service token for an arbitrary hold.
225
+
// Uses internal caching with sync.Once per holdDID.
226
+
func (uc *UserContext) GetServiceTokenForHold(ctx context.Context, holdDID string) (string, error) {
227
+
if !uc.IsAuthenticated {
228
+
return "", fmt.Errorf("cannot get service token: user not authenticated")
229
+
}
230
+
231
+
// Ensure PDS is resolved
232
+
if err := uc.ResolvePDS(ctx); err != nil {
233
+
return "", fmt.Errorf("failed to resolve PDS: %w", err)
234
+
}
235
+
236
+
// Load or create cache entry
237
+
entryVal, _ := uc.serviceTokens.LoadOrStore(holdDID, &serviceTokenEntry{})
238
+
entry := entryVal.(*serviceTokenEntry)
239
+
240
+
entry.once.Do(func() {
241
+
slog.Debug("Fetching service token",
242
+
"component", "auth/context",
243
+
"userDID", uc.DID,
244
+
"holdDID", holdDID,
245
+
"authMethod", uc.AuthMethod)
246
+
247
+
// Use unified service token function (handles both OAuth and app-password)
248
+
serviceToken, err := GetOrFetchServiceToken(
249
+
ctx, uc.AuthMethod, uc.refresher, uc.DID, holdDID, uc.PDSEndpoint,
250
+
)
251
+
252
+
entry.token = serviceToken
253
+
entry.err = err
254
+
if err == nil {
255
+
// Parse JWT to get expiry
256
+
expiry, parseErr := ParseJWTExpiry(serviceToken)
257
+
if parseErr == nil {
258
+
entry.expiresAt = expiry.Add(-10 * time.Second) // Safety margin
259
+
} else {
260
+
entry.expiresAt = time.Now().Add(45 * time.Second) // Default fallback
261
+
}
262
+
}
263
+
})
264
+
265
+
return entry.token, entry.err
266
+
}
267
+
268
+
// CanRead checks if user can read blobs from target hold.
269
+
// - Public hold: any user (even anonymous)
270
+
// - Private hold: owner OR crew with blob:read/blob:write
271
+
func (uc *UserContext) CanRead(ctx context.Context) (bool, error) {
272
+
if uc.TargetHoldDID == "" {
273
+
return false, fmt.Errorf("target hold not set (call SetTarget first)")
274
+
}
275
+
276
+
if uc.authorizer == nil {
277
+
return false, fmt.Errorf("authorizer not configured")
278
+
}
279
+
280
+
return uc.authorizer.CheckReadAccess(ctx, uc.TargetHoldDID, uc.DID)
281
+
}
282
+
283
+
// CanWrite checks if user can write blobs to target hold.
284
+
// - Must be authenticated
285
+
// - Must be owner OR crew with blob:write
286
+
func (uc *UserContext) CanWrite(ctx context.Context) (bool, error) {
287
+
if uc.TargetHoldDID == "" {
288
+
return false, fmt.Errorf("target hold not set (call SetTarget first)")
289
+
}
290
+
291
+
if !uc.IsAuthenticated {
292
+
return false, nil // Anonymous writes never allowed
293
+
}
294
+
295
+
if uc.authorizer == nil {
296
+
return false, fmt.Errorf("authorizer not configured")
297
+
}
298
+
299
+
return uc.authorizer.CheckWriteAccess(ctx, uc.TargetHoldDID, uc.DID)
300
+
}
301
+
302
+
// GetPermissions returns detailed permissions for target hold.
303
+
// Lazy-loaded and cached per holdDID.
304
+
func (uc *UserContext) GetPermissions(ctx context.Context) (*HoldPermissions, error) {
305
+
if uc.TargetHoldDID == "" {
306
+
return nil, fmt.Errorf("target hold not set (call SetTarget first)")
307
+
}
308
+
return uc.GetPermissionsForHold(ctx, uc.TargetHoldDID)
309
+
}
310
+
311
+
// GetPermissionsForHold returns detailed permissions for an arbitrary hold.
312
+
// Lazy-loaded and cached per holdDID.
313
+
func (uc *UserContext) GetPermissionsForHold(ctx context.Context, holdDID string) (*HoldPermissions, error) {
314
+
// Check cache first
315
+
if cached, ok := uc.permissions.Load(holdDID); ok {
316
+
return cached.(*HoldPermissions), nil
317
+
}
318
+
319
+
if uc.authorizer == nil {
320
+
return nil, fmt.Errorf("authorizer not configured")
321
+
}
322
+
323
+
// Build permissions by querying authorizer
324
+
captain, err := uc.authorizer.GetCaptainRecord(ctx, holdDID)
325
+
if err != nil {
326
+
return nil, fmt.Errorf("failed to get captain record: %w", err)
327
+
}
328
+
329
+
perms := &HoldPermissions{
330
+
HoldDID: holdDID,
331
+
IsPublic: captain.Public,
332
+
IsOwner: uc.DID != "" && uc.DID == captain.Owner,
333
+
}
334
+
335
+
// Check crew membership if authenticated and not owner
336
+
if uc.IsAuthenticated && !perms.IsOwner {
337
+
isCrew, crewErr := uc.authorizer.IsCrewMember(ctx, holdDID, uc.DID)
338
+
if crewErr != nil {
339
+
slog.Warn("Failed to check crew membership",
340
+
"component", "auth/context",
341
+
"holdDID", holdDID,
342
+
"userDID", uc.DID,
343
+
"error", crewErr)
344
+
}
345
+
perms.IsCrew = isCrew
346
+
}
347
+
348
+
// Compute permissions based on role
349
+
if perms.IsOwner {
350
+
perms.CanRead = true
351
+
perms.CanWrite = true
352
+
perms.CanAdmin = true
353
+
} else if perms.IsCrew {
354
+
// Crew members can read and write (for now, all crew have blob:write)
355
+
// TODO: Check specific permissions from crew record
356
+
perms.CanRead = true
357
+
perms.CanWrite = true
358
+
perms.CanAdmin = false
359
+
} else if perms.IsPublic {
360
+
// Public hold - anyone can read
361
+
perms.CanRead = true
362
+
perms.CanWrite = false
363
+
perms.CanAdmin = false
364
+
} else if uc.IsAuthenticated {
365
+
// Private hold, authenticated non-crew
366
+
// Per permission matrix: cannot read private holds
367
+
perms.CanRead = false
368
+
perms.CanWrite = false
369
+
perms.CanAdmin = false
370
+
} else {
371
+
// Anonymous on private hold
372
+
perms.CanRead = false
373
+
perms.CanWrite = false
374
+
perms.CanAdmin = false
375
+
}
376
+
377
+
// Cache and return
378
+
uc.permissions.Store(holdDID, perms)
379
+
return perms, nil
380
+
}
381
+
382
+
// IsCrewMember checks if user is crew of target hold.
383
+
func (uc *UserContext) IsCrewMember(ctx context.Context) (bool, error) {
384
+
if uc.TargetHoldDID == "" {
385
+
return false, fmt.Errorf("target hold not set (call SetTarget first)")
386
+
}
387
+
388
+
if !uc.IsAuthenticated {
389
+
return false, nil
390
+
}
391
+
392
+
if uc.authorizer == nil {
393
+
return false, fmt.Errorf("authorizer not configured")
394
+
}
395
+
396
+
return uc.authorizer.IsCrewMember(ctx, uc.TargetHoldDID, uc.DID)
397
+
}
398
+
399
+
// EnsureCrewMembership is a standalone function to register as crew on a hold.
400
+
// Use this when you don't have a UserContext (e.g., OAuth callback).
401
+
// This is best-effort and logs errors without failing.
402
+
func EnsureCrewMembership(ctx context.Context, did, pdsEndpoint string, refresher *oauth.Refresher, holdDID string) {
403
+
if holdDID == "" {
404
+
return
405
+
}
406
+
407
+
// Only works with OAuth (refresher required) - app passwords can't get service tokens
408
+
if refresher == nil {
409
+
slog.Debug("skipping crew registration - no OAuth refresher (app password flow)", "holdDID", holdDID)
410
+
return
411
+
}
412
+
413
+
// Normalize URL to DID if needed
414
+
if !atproto.IsDID(holdDID) {
415
+
holdDID = atproto.ResolveHoldDIDFromURL(holdDID)
416
+
if holdDID == "" {
417
+
slog.Warn("failed to resolve hold DID", "defaultHold", holdDID)
418
+
return
419
+
}
420
+
}
421
+
422
+
// Get service token for the hold (OAuth only at this point)
423
+
serviceToken, err := GetOrFetchServiceToken(ctx, AuthMethodOAuth, refresher, did, holdDID, pdsEndpoint)
424
+
if err != nil {
425
+
slog.Warn("failed to get service token", "holdDID", holdDID, "error", err)
426
+
return
427
+
}
428
+
429
+
// Resolve hold DID to HTTP endpoint
430
+
holdEndpoint := atproto.ResolveHoldURL(holdDID)
431
+
if holdEndpoint == "" {
432
+
slog.Warn("failed to resolve hold endpoint", "holdDID", holdDID)
433
+
return
434
+
}
435
+
436
+
// Call requestCrew endpoint
437
+
if err := requestCrewMembership(ctx, holdEndpoint, serviceToken); err != nil {
438
+
slog.Warn("failed to request crew membership", "holdDID", holdDID, "error", err)
439
+
return
440
+
}
441
+
442
+
slog.Info("successfully registered as crew member", "holdDID", holdDID, "userDID", did)
443
+
}
444
+
445
+
// ensureCrewMembership attempts to register as crew on target hold (UserContext method).
446
+
// Called automatically during first push; idempotent.
447
+
// This is a best-effort operation and logs errors without failing.
448
+
// Requires SetTarget() to be called first.
449
+
func (uc *UserContext) ensureCrewMembership(ctx context.Context) error {
450
+
if uc.TargetHoldDID == "" {
451
+
return fmt.Errorf("target hold not set (call SetTarget first)")
452
+
}
453
+
return uc.EnsureCrewMembershipForHold(ctx, uc.TargetHoldDID)
454
+
}
455
+
456
+
// EnsureCrewMembershipForHold attempts to register as crew on the specified hold.
457
+
// This is the core implementation that can be called with any holdDID.
458
+
// Called automatically during first push; idempotent.
459
+
// This is a best-effort operation and logs errors without failing.
460
+
func (uc *UserContext) EnsureCrewMembershipForHold(ctx context.Context, holdDID string) error {
461
+
if holdDID == "" {
462
+
return nil // Nothing to do
463
+
}
464
+
465
+
// Normalize URL to DID if needed
466
+
if !atproto.IsDID(holdDID) {
467
+
holdDID = atproto.ResolveHoldDIDFromURL(holdDID)
468
+
if holdDID == "" {
469
+
return fmt.Errorf("failed to resolve hold DID from URL")
470
+
}
471
+
}
472
+
473
+
if !uc.IsAuthenticated {
474
+
return fmt.Errorf("cannot register as crew: user not authenticated")
475
+
}
476
+
477
+
if uc.refresher == nil {
478
+
return fmt.Errorf("cannot register as crew: OAuth session required")
479
+
}
480
+
481
+
// Get service token for the hold
482
+
serviceToken, err := uc.GetServiceTokenForHold(ctx, holdDID)
483
+
if err != nil {
484
+
return fmt.Errorf("failed to get service token: %w", err)
485
+
}
486
+
487
+
// Resolve hold DID to HTTP endpoint
488
+
holdEndpoint := atproto.ResolveHoldURL(holdDID)
489
+
if holdEndpoint == "" {
490
+
return fmt.Errorf("failed to resolve hold endpoint for %s", holdDID)
491
+
}
492
+
493
+
// Call requestCrew endpoint
494
+
return requestCrewMembership(ctx, holdEndpoint, serviceToken)
495
+
}
496
+
497
+
// requestCrewMembership calls the hold's requestCrew endpoint
498
+
// The endpoint handles all authorization and duplicate checking internally
499
+
func requestCrewMembership(ctx context.Context, holdEndpoint, serviceToken string) error {
500
+
// Add 5 second timeout to prevent hanging on offline holds
501
+
ctx, cancel := context.WithTimeout(ctx, 5*time.Second)
502
+
defer cancel()
503
+
504
+
url := fmt.Sprintf("%s%s", holdEndpoint, atproto.HoldRequestCrew)
505
+
506
+
req, err := http.NewRequestWithContext(ctx, "POST", url, nil)
507
+
if err != nil {
508
+
return err
509
+
}
510
+
511
+
req.Header.Set("Authorization", "Bearer "+serviceToken)
512
+
req.Header.Set("Content-Type", "application/json")
513
+
514
+
resp, err := http.DefaultClient.Do(req)
515
+
if err != nil {
516
+
return err
517
+
}
518
+
defer resp.Body.Close()
519
+
520
+
if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusCreated {
521
+
// Read response body to capture actual error message from hold
522
+
body, readErr := io.ReadAll(resp.Body)
523
+
if readErr != nil {
524
+
return fmt.Errorf("requestCrew failed with status %d (failed to read error body: %w)", resp.StatusCode, readErr)
525
+
}
526
+
return fmt.Errorf("requestCrew failed with status %d: %s", resp.StatusCode, string(body))
527
+
}
528
+
529
+
return nil
530
+
}
531
+
532
+
// GetUserClient returns an authenticated ATProto client for the user's own PDS.
533
+
// Used for profile operations (reading/writing to user's own repo).
534
+
// Returns nil if not authenticated or PDS not resolved.
535
+
func (uc *UserContext) GetUserClient() *atproto.Client {
536
+
if !uc.IsAuthenticated || uc.PDSEndpoint == "" {
537
+
return nil
538
+
}
539
+
540
+
if uc.AuthMethod == AuthMethodOAuth && uc.refresher != nil {
541
+
return atproto.NewClientWithSessionProvider(uc.PDSEndpoint, uc.DID, uc.refresher)
542
+
} else if uc.AuthMethod == AuthMethodAppPassword {
543
+
accessToken, _ := GetGlobalTokenCache().Get(uc.DID)
544
+
return atproto.NewClient(uc.PDSEndpoint, uc.DID, accessToken)
545
+
}
546
+
547
+
return nil
548
+
}
549
+
550
+
// EnsureUserSetup ensures the user has a profile and crew membership.
551
+
// Called once per user (cached for userSetupTTL). Runs in background - does not block.
552
+
// Safe to call on every request.
553
+
func (uc *UserContext) EnsureUserSetup() {
554
+
if !uc.IsAuthenticated || uc.DID == "" {
555
+
return
556
+
}
557
+
558
+
// Check cache - skip if recently set up
559
+
if lastSetup, ok := userSetupCache.Load(uc.DID); ok {
560
+
if time.Since(lastSetup.(time.Time)) < userSetupTTL {
561
+
return
562
+
}
563
+
}
564
+
565
+
// Run in background to avoid blocking requests
566
+
go func() {
567
+
bgCtx := context.Background()
568
+
569
+
// 1. Ensure profile exists
570
+
if client := uc.GetUserClient(); client != nil {
571
+
uc.ensureProfile(bgCtx, client)
572
+
}
573
+
574
+
// 2. Ensure crew membership on default hold
575
+
if uc.defaultHoldDID != "" {
576
+
EnsureCrewMembership(bgCtx, uc.DID, uc.PDSEndpoint, uc.refresher, uc.defaultHoldDID)
577
+
}
578
+
579
+
// Mark as set up
580
+
userSetupCache.Store(uc.DID, time.Now())
581
+
slog.Debug("User setup complete",
582
+
"component", "auth/usercontext",
583
+
"did", uc.DID,
584
+
"defaultHoldDID", uc.defaultHoldDID)
585
+
}()
586
+
}
587
+
588
+
// ensureProfile creates sailor profile if it doesn't exist.
589
+
// Inline implementation to avoid circular import with storage package.
590
+
func (uc *UserContext) ensureProfile(ctx context.Context, client *atproto.Client) {
591
+
// Check if profile already exists
592
+
profile, err := client.GetRecord(ctx, atproto.SailorProfileCollection, "self")
593
+
if err == nil && profile != nil {
594
+
return // Already exists
595
+
}
596
+
597
+
// Create profile with default hold
598
+
normalizedDID := ""
599
+
if uc.defaultHoldDID != "" {
600
+
normalizedDID = atproto.ResolveHoldDIDFromURL(uc.defaultHoldDID)
601
+
}
602
+
603
+
newProfile := atproto.NewSailorProfileRecord(normalizedDID)
604
+
if _, err := client.PutRecord(ctx, atproto.SailorProfileCollection, "self", newProfile); err != nil {
605
+
slog.Warn("Failed to create sailor profile",
606
+
"component", "auth/usercontext",
607
+
"did", uc.DID,
608
+
"error", err)
609
+
return
610
+
}
611
+
612
+
slog.Debug("Created sailor profile",
613
+
"component", "auth/usercontext",
614
+
"did", uc.DID,
615
+
"defaultHold", normalizedDID)
616
+
}
617
+
618
+
// GetATProtoClient returns a cached ATProto client for the target owner's PDS.
619
+
// Authenticated if user is owner, otherwise anonymous.
620
+
// Cached per-request (uses sync.Once).
621
+
func (uc *UserContext) GetATProtoClient() *atproto.Client {
622
+
uc.atprotoClientOnce.Do(func() {
623
+
if uc.TargetOwnerPDS == "" {
624
+
return
625
+
}
626
+
627
+
// If puller is owner and authenticated, use authenticated client
628
+
if uc.DID == uc.TargetOwnerDID && uc.IsAuthenticated {
629
+
if uc.AuthMethod == AuthMethodOAuth && uc.refresher != nil {
630
+
uc.atprotoClient = atproto.NewClientWithSessionProvider(uc.TargetOwnerPDS, uc.TargetOwnerDID, uc.refresher)
631
+
return
632
+
} else if uc.AuthMethod == AuthMethodAppPassword {
633
+
accessToken, _ := GetGlobalTokenCache().Get(uc.TargetOwnerDID)
634
+
uc.atprotoClient = atproto.NewClient(uc.TargetOwnerPDS, uc.TargetOwnerDID, accessToken)
635
+
return
636
+
}
637
+
}
638
+
639
+
// Anonymous client for reads
640
+
uc.atprotoClient = atproto.NewClient(uc.TargetOwnerPDS, uc.TargetOwnerDID, "")
641
+
})
642
+
return uc.atprotoClient
643
+
}
644
+
645
+
// ResolveHoldDID finds the hold for the target repository.
646
+
// - Pull: uses database lookup (historical from manifest)
647
+
// - Push: uses discovery (sailor profile โ default)
648
+
//
649
+
// Must be called after SetTarget() is called with at least TargetOwnerDID and TargetRepo set.
650
+
// Updates TargetHoldDID on success.
651
+
func (uc *UserContext) ResolveHoldDID(ctx context.Context, sqlDB *sql.DB) (string, error) {
652
+
if uc.TargetOwnerDID == "" {
653
+
return "", fmt.Errorf("target owner not set")
654
+
}
655
+
656
+
var holdDID string
657
+
var err error
658
+
659
+
switch uc.Action {
660
+
case ActionPull:
661
+
// For pulls, look up historical hold from database
662
+
holdDID, err = uc.resolveHoldForPull(ctx, sqlDB)
663
+
case ActionPush:
664
+
// For pushes, discover hold from owner's profile
665
+
holdDID, err = uc.resolveHoldForPush(ctx)
666
+
default:
667
+
// Default to push discovery
668
+
holdDID, err = uc.resolveHoldForPush(ctx)
669
+
}
670
+
671
+
if err != nil {
672
+
return "", err
673
+
}
674
+
675
+
if holdDID == "" {
676
+
return "", fmt.Errorf("no hold DID found for %s/%s", uc.TargetOwnerDID, uc.TargetRepo)
677
+
}
678
+
679
+
uc.TargetHoldDID = holdDID
680
+
return holdDID, nil
681
+
}
682
+
683
+
// resolveHoldForPull looks up the hold from the database (historical reference)
684
+
func (uc *UserContext) resolveHoldForPull(ctx context.Context, sqlDB *sql.DB) (string, error) {
685
+
// If no database is available, fall back to discovery
686
+
if sqlDB == nil {
687
+
return uc.resolveHoldForPush(ctx)
688
+
}
689
+
690
+
// Try database lookup first
691
+
holdDID, err := db.GetLatestHoldDIDForRepo(sqlDB, uc.TargetOwnerDID, uc.TargetRepo)
692
+
if err != nil {
693
+
slog.Debug("Database lookup failed, falling back to discovery",
694
+
"component", "auth/context",
695
+
"ownerDID", uc.TargetOwnerDID,
696
+
"repo", uc.TargetRepo,
697
+
"error", err)
698
+
return uc.resolveHoldForPush(ctx)
699
+
}
700
+
701
+
if holdDID != "" {
702
+
return holdDID, nil
703
+
}
704
+
705
+
// No historical hold found, fall back to discovery
706
+
return uc.resolveHoldForPush(ctx)
707
+
}
708
+
709
+
// resolveHoldForPush discovers hold from owner's sailor profile or default
710
+
func (uc *UserContext) resolveHoldForPush(ctx context.Context) (string, error) {
711
+
// Create anonymous client to query owner's profile
712
+
client := atproto.NewClient(uc.TargetOwnerPDS, uc.TargetOwnerDID, "")
713
+
714
+
// Try to get owner's sailor profile
715
+
record, err := client.GetRecord(ctx, atproto.SailorProfileCollection, "self")
716
+
if err == nil && record != nil {
717
+
var profile atproto.SailorProfileRecord
718
+
if jsonErr := json.Unmarshal(record.Value, &profile); jsonErr == nil {
719
+
if profile.DefaultHold != "" {
720
+
// Normalize to DID if needed
721
+
holdDID := profile.DefaultHold
722
+
if !atproto.IsDID(holdDID) {
723
+
holdDID = atproto.ResolveHoldDIDFromURL(holdDID)
724
+
}
725
+
slog.Debug("Found hold from owner's profile",
726
+
"component", "auth/context",
727
+
"ownerDID", uc.TargetOwnerDID,
728
+
"holdDID", holdDID)
729
+
return holdDID, nil
730
+
}
731
+
}
732
+
}
733
+
734
+
// Fall back to default hold
735
+
if uc.defaultHoldDID != "" {
736
+
slog.Debug("Using default hold",
737
+
"component", "auth/context",
738
+
"ownerDID", uc.TargetOwnerDID,
739
+
"defaultHoldDID", uc.defaultHoldDID)
740
+
return uc.defaultHoldDID, nil
741
+
}
742
+
743
+
return "", fmt.Errorf("no hold configured for %s and no default hold set", uc.TargetOwnerDID)
744
+
}
745
+
746
+
// =============================================================================
747
+
// Test Helper Methods
748
+
// =============================================================================
749
+
// These methods are designed to make UserContext testable by allowing tests
750
+
// to bypass network-dependent code paths (PDS resolution, OAuth token fetching).
751
+
// Only use these in tests - they are not intended for production use.
752
+
753
+
// SetPDSForTest sets the PDS endpoint directly, bypassing ResolvePDS network calls.
754
+
// This allows tests to skip DID resolution which would make network requests.
755
+
// Deprecated: Use SetPDS instead.
756
+
func (uc *UserContext) SetPDSForTest(handle, pdsEndpoint string) {
757
+
uc.SetPDS(handle, pdsEndpoint)
758
+
}
759
+
760
+
// SetServiceTokenForTest pre-populates a service token for the given holdDID,
761
+
// bypassing the sync.Once and OAuth/app-password fetching logic.
762
+
// The token will appear as if it was already fetched and cached.
763
+
func (uc *UserContext) SetServiceTokenForTest(holdDID, token string) {
764
+
entry := &serviceTokenEntry{
765
+
token: token,
766
+
expiresAt: time.Now().Add(5 * time.Minute),
767
+
err: nil,
768
+
}
769
+
// Mark the sync.Once as done so real fetch won't happen
770
+
entry.once.Do(func() {})
771
+
uc.serviceTokens.Store(holdDID, entry)
772
+
}
773
+
774
+
// SetAuthorizerForTest sets the authorizer for permission checks.
775
+
// Use with MockHoldAuthorizer to control CanRead/CanWrite behavior in tests.
776
+
func (uc *UserContext) SetAuthorizerForTest(authorizer HoldAuthorizer) {
777
+
uc.authorizer = authorizer
778
+
}
779
+
780
+
// SetDefaultHoldDIDForTest sets the default hold DID for tests.
781
+
// This is used as fallback when resolving hold for push operations.
782
+
func (uc *UserContext) SetDefaultHoldDIDForTest(holdDID string) {
783
+
uc.defaultHoldDID = holdDID
784
+
}
+54
pkg/hold/config.go
+54
pkg/hold/config.go
···
6
package hold
7
8
import (
9
"fmt"
10
"os"
11
"path/filepath"
12
"time"
···
67
// DisablePresignedURLs forces proxy mode even with S3 configured (for testing) (from env: DISABLE_PRESIGNED_URLS)
68
DisablePresignedURLs bool `yaml:"disable_presigned_urls"`
69
70
// ReadTimeout for HTTP requests
71
ReadTimeout time.Duration `yaml:"read_timeout"`
72
···
103
cfg.Server.Public = os.Getenv("HOLD_PUBLIC") == "true"
104
cfg.Server.TestMode = os.Getenv("TEST_MODE") == "true"
105
cfg.Server.DisablePresignedURLs = os.Getenv("DISABLE_PRESIGNED_URLS") == "true"
106
cfg.Server.ReadTimeout = 5 * time.Minute // Increased for large blob uploads
107
cfg.Server.WriteTimeout = 5 * time.Minute // Increased for large blob uploads
108
···
180
}
181
return defaultValue
182
}
···
6
package hold
7
8
import (
9
+
"bytes"
10
+
"encoding/json"
11
"fmt"
12
+
"net/http"
13
+
"net/url"
14
"os"
15
"path/filepath"
16
"time"
···
71
// DisablePresignedURLs forces proxy mode even with S3 configured (for testing) (from env: DISABLE_PRESIGNED_URLS)
72
DisablePresignedURLs bool `yaml:"disable_presigned_urls"`
73
74
+
// RelayEndpoint is the ATProto relay URL to request crawl from on startup (from env: HOLD_RELAY_ENDPOINT)
75
+
// If empty, no crawl request is made. Default: https://bsky.network
76
+
RelayEndpoint string `yaml:"relay_endpoint"`
77
+
78
// ReadTimeout for HTTP requests
79
ReadTimeout time.Duration `yaml:"read_timeout"`
80
···
111
cfg.Server.Public = os.Getenv("HOLD_PUBLIC") == "true"
112
cfg.Server.TestMode = os.Getenv("TEST_MODE") == "true"
113
cfg.Server.DisablePresignedURLs = os.Getenv("DISABLE_PRESIGNED_URLS") == "true"
114
+
cfg.Server.RelayEndpoint = os.Getenv("HOLD_RELAY_ENDPOINT")
115
cfg.Server.ReadTimeout = 5 * time.Minute // Increased for large blob uploads
116
cfg.Server.WriteTimeout = 5 * time.Minute // Increased for large blob uploads
117
···
189
}
190
return defaultValue
191
}
192
+
193
+
// RequestCrawl sends a crawl request to the ATProto relay for the given hostname.
194
+
// This makes the hold's PDS discoverable by the relay network.
195
+
func RequestCrawl(relayEndpoint, publicURL string) error {
196
+
if relayEndpoint == "" {
197
+
return nil // No relay configured, skip
198
+
}
199
+
200
+
// Extract hostname from public URL
201
+
parsed, err := url.Parse(publicURL)
202
+
if err != nil {
203
+
return fmt.Errorf("failed to parse public URL: %w", err)
204
+
}
205
+
hostname := parsed.Host
206
+
207
+
// Build the request URL
208
+
requestURL := relayEndpoint + "/xrpc/com.atproto.sync.requestCrawl"
209
+
210
+
// Create request body
211
+
body := map[string]string{"hostname": hostname}
212
+
bodyJSON, err := json.Marshal(body)
213
+
if err != nil {
214
+
return fmt.Errorf("failed to marshal request body: %w", err)
215
+
}
216
+
217
+
// Make the request
218
+
client := &http.Client{Timeout: 10 * time.Second}
219
+
req, err := http.NewRequest("POST", requestURL, bytes.NewReader(bodyJSON))
220
+
if err != nil {
221
+
return fmt.Errorf("failed to create request: %w", err)
222
+
}
223
+
req.Header.Set("Content-Type", "application/json")
224
+
225
+
resp, err := client.Do(req)
226
+
if err != nil {
227
+
return fmt.Errorf("failed to send request: %w", err)
228
+
}
229
+
defer resp.Body.Close()
230
+
231
+
if resp.StatusCode < 200 || resp.StatusCode >= 300 {
232
+
return fmt.Errorf("relay returned status %d", resp.StatusCode)
233
+
}
234
+
235
+
return nil
236
+
}
+25
-1
pkg/hold/oci/xrpc.go
+25
-1
pkg/hold/oci/xrpc.go
···
230
Size int64 `json:"size"`
231
MediaType string `json:"mediaType"`
232
} `json:"layers"`
233
} `json:"manifest"`
234
}
235
···
276
}
277
}
278
279
-
// Calculate total size from all layers
280
var totalSize int64
281
for _, layer := range req.Manifest.Layers {
282
totalSize += layer.Size
283
}
284
totalSize += req.Manifest.Config.Size // Add config blob size
285
286
// Create Bluesky post if enabled
287
var postURI string
288
postCreated := false
···
295
296
postURI, err = h.pds.CreateManifestPost(
297
ctx,
298
req.Repository,
299
req.Tag,
300
req.UserHandle,
301
req.UserDID,
302
manifestDigest,
303
totalSize,
304
)
305
if err != nil {
306
slog.Error("Failed to create manifest post", "error", err)
···
230
Size int64 `json:"size"`
231
MediaType string `json:"mediaType"`
232
} `json:"layers"`
233
+
Manifests []struct {
234
+
Digest string `json:"digest"`
235
+
Size int64 `json:"size"`
236
+
MediaType string `json:"mediaType"`
237
+
Platform *struct {
238
+
OS string `json:"os"`
239
+
Architecture string `json:"architecture"`
240
+
} `json:"platform"`
241
+
} `json:"manifests"`
242
} `json:"manifest"`
243
}
244
···
285
}
286
}
287
288
+
// Check if this is a multi-arch image (has manifests instead of layers)
289
+
isMultiArch := len(req.Manifest.Manifests) > 0
290
+
291
+
// Calculate total size from all layers (for single-arch images)
292
var totalSize int64
293
for _, layer := range req.Manifest.Layers {
294
totalSize += layer.Size
295
}
296
totalSize += req.Manifest.Config.Size // Add config blob size
297
298
+
// Extract platforms for multi-arch images
299
+
var platforms []string
300
+
if isMultiArch {
301
+
for _, m := range req.Manifest.Manifests {
302
+
if m.Platform != nil {
303
+
platforms = append(platforms, m.Platform.OS+"/"+m.Platform.Architecture)
304
+
}
305
+
}
306
+
}
307
+
308
// Create Bluesky post if enabled
309
var postURI string
310
postCreated := false
···
317
318
postURI, err = h.pds.CreateManifestPost(
319
ctx,
320
+
h.driver,
321
req.Repository,
322
req.Tag,
323
req.UserHandle,
324
req.UserDID,
325
manifestDigest,
326
totalSize,
327
+
platforms,
328
)
329
if err != nil {
330
slog.Error("Failed to create manifest post", "error", err)
+70
-27
pkg/hold/pds/auth.go
+70
-27
pkg/hold/pds/auth.go
···
4
"context"
5
"encoding/base64"
6
"encoding/json"
7
"fmt"
8
"io"
9
"log/slog"
···
18
"github.com/golang-jwt/jwt/v5"
19
)
20
21
// HTTPClient interface allows injecting a custom HTTP client for testing
22
type HTTPClient interface {
23
Do(*http.Request) (*http.Response, error)
···
44
// Extract Authorization header
45
authHeader := r.Header.Get("Authorization")
46
if authHeader == "" {
47
-
return nil, fmt.Errorf("missing Authorization header")
48
}
49
50
// Check for DPoP authorization scheme
51
parts := strings.SplitN(authHeader, " ", 2)
52
if len(parts) != 2 {
53
-
return nil, fmt.Errorf("invalid Authorization header format")
54
}
55
56
if parts[0] != "DPoP" {
···
59
60
accessToken := parts[1]
61
if accessToken == "" {
62
-
return nil, fmt.Errorf("missing access token")
63
}
64
65
// Extract DPoP header
66
dpopProof := r.Header.Get("DPoP")
67
if dpopProof == "" {
68
-
return nil, fmt.Errorf("missing DPoP header")
69
}
70
71
// TODO: We could verify the DPoP proof locally (signature, HTM, HTU, etc.)
···
109
// JWT format: header.payload.signature
110
parts := strings.Split(token, ".")
111
if len(parts) != 3 {
112
-
return "", "", fmt.Errorf("invalid JWT format")
113
}
114
115
// Decode payload (base64url)
···
129
}
130
131
if claims.Sub == "" {
132
-
return "", "", fmt.Errorf("missing sub claim (DID)")
133
}
134
135
if claims.Iss == "" {
136
-
return "", "", fmt.Errorf("missing iss claim (PDS)")
137
}
138
139
return claims.Sub, claims.Iss, nil
···
216
return nil, fmt.Errorf("DPoP authentication failed: %w", err)
217
}
218
} else {
219
-
return nil, fmt.Errorf("missing or invalid Authorization header (expected Bearer or DPoP)")
220
}
221
222
// Get captain record to check owner
···
243
return user, nil
244
}
245
// User is crew but doesn't have admin permission
246
-
return nil, fmt.Errorf("crew member lacks required 'crew:admin' permission")
247
}
248
}
249
250
// User is neither owner nor authorized crew
251
-
return nil, fmt.Errorf("user is not authorized (must be hold owner or crew admin)")
252
}
253
254
// ValidateBlobWriteAccess validates that the request has valid authentication
···
276
return nil, fmt.Errorf("DPoP authentication failed: %w", err)
277
}
278
} else {
279
-
return nil, fmt.Errorf("missing or invalid Authorization header (expected Bearer or DPoP)")
280
}
281
282
// Get captain record to check owner and public settings
···
303
return user, nil
304
}
305
// User is crew but doesn't have write permission
306
-
return nil, fmt.Errorf("crew member lacks required 'blob:write' permission")
307
}
308
}
309
310
// User is neither owner nor authorized crew
311
-
return nil, fmt.Errorf("user is not authorized for blob write (must be hold owner or crew with blob:write permission)")
312
}
313
314
// ValidateBlobReadAccess validates that the request has read access to blobs
315
// If captain.public = true: No auth required (returns nil user to indicate public access)
316
-
// If captain.public = false: Requires valid DPoP + OAuth and (captain OR crew with blob:read permission).
317
// The httpClient parameter is optional and defaults to http.DefaultClient if nil.
318
func ValidateBlobReadAccess(r *http.Request, pds *HoldPDS, httpClient HTTPClient) (*ValidatedUser, error) {
319
// Get captain record to check public setting
···
344
return nil, fmt.Errorf("DPoP authentication failed: %w", err)
345
}
346
} else {
347
-
return nil, fmt.Errorf("missing or invalid Authorization header (expected Bearer or DPoP)")
348
}
349
350
// Check if user is the owner (always has read access)
···
352
return user, nil
353
}
354
355
-
// Check if user is crew with blob:read permission
356
crew, err := pds.ListCrewMembers(r.Context())
357
if err != nil {
358
return nil, fmt.Errorf("failed to check crew membership: %w", err)
···
360
361
for _, member := range crew {
362
if member.Record.Member == user.DID {
363
-
// Check if this crew member has blob:read permission
364
-
if slices.Contains(member.Record.Permissions, "blob:read") {
365
return user, nil
366
}
367
-
// User is crew but doesn't have read permission
368
-
return nil, fmt.Errorf("crew member lacks required 'blob:read' permission")
369
}
370
}
371
372
// User is neither owner nor authorized crew
373
-
return nil, fmt.Errorf("user is not authorized for blob read (must be hold owner or crew with blob:read permission)")
374
}
375
376
// ServiceTokenClaims represents the claims in a service token JWT
···
385
// Extract Authorization header
386
authHeader := r.Header.Get("Authorization")
387
if authHeader == "" {
388
-
return nil, fmt.Errorf("missing Authorization header")
389
}
390
391
// Check for Bearer authorization scheme
392
parts := strings.SplitN(authHeader, " ", 2)
393
if len(parts) != 2 {
394
-
return nil, fmt.Errorf("invalid Authorization header format")
395
}
396
397
if parts[0] != "Bearer" {
···
400
401
tokenString := parts[1]
402
if tokenString == "" {
403
-
return nil, fmt.Errorf("missing token")
404
}
405
406
slog.Debug("Validating service token", "holdDID", holdDID)
···
409
// Split token: header.payload.signature
410
tokenParts := strings.Split(tokenString, ".")
411
if len(tokenParts) != 3 {
412
-
return nil, fmt.Errorf("invalid JWT format")
413
}
414
415
// Decode payload (second part) to extract claims
···
427
// Get issuer (user DID)
428
issuerDID := claims.Issuer
429
if issuerDID == "" {
430
-
return nil, fmt.Errorf("missing iss claim")
431
}
432
433
// Verify audience matches this hold service
···
445
return nil, fmt.Errorf("failed to get expiration: %w", err)
446
}
447
if exp != nil && time.Now().After(exp.Time) {
448
-
return nil, fmt.Errorf("token has expired")
449
}
450
451
// Verify JWT signature using ATProto's secp256k1 crypto
···
4
"context"
5
"encoding/base64"
6
"encoding/json"
7
+
"errors"
8
"fmt"
9
"io"
10
"log/slog"
···
19
"github.com/golang-jwt/jwt/v5"
20
)
21
22
+
// Authentication errors
23
+
var (
24
+
ErrMissingAuthHeader = errors.New("missing Authorization header")
25
+
ErrInvalidAuthFormat = errors.New("invalid Authorization header format")
26
+
ErrInvalidAuthScheme = errors.New("invalid authorization scheme: expected 'Bearer' or 'DPoP'")
27
+
ErrMissingToken = errors.New("missing token")
28
+
ErrMissingDPoPHeader = errors.New("missing DPoP header")
29
+
)
30
+
31
+
// JWT validation errors
32
+
var (
33
+
ErrInvalidJWTFormat = errors.New("invalid JWT format: expected header.payload.signature")
34
+
ErrMissingISSClaim = errors.New("missing 'iss' claim in token")
35
+
ErrMissingSubClaim = errors.New("missing 'sub' claim in token")
36
+
ErrTokenExpired = errors.New("token has expired")
37
+
)
38
+
39
+
// AuthError provides structured authorization error information
40
+
type AuthError struct {
41
+
Action string // The action being attempted: "blob:read", "blob:write", "crew:admin"
42
+
Reason string // Why access was denied
43
+
Required []string // What permission(s) would grant access
44
+
}
45
+
46
+
func (e *AuthError) Error() string {
47
+
return fmt.Sprintf("access denied for %s: %s (required: %s)",
48
+
e.Action, e.Reason, strings.Join(e.Required, " or "))
49
+
}
50
+
51
+
// NewAuthError creates a new AuthError
52
+
func NewAuthError(action, reason string, required ...string) *AuthError {
53
+
return &AuthError{
54
+
Action: action,
55
+
Reason: reason,
56
+
Required: required,
57
+
}
58
+
}
59
+
60
// HTTPClient interface allows injecting a custom HTTP client for testing
61
type HTTPClient interface {
62
Do(*http.Request) (*http.Response, error)
···
83
// Extract Authorization header
84
authHeader := r.Header.Get("Authorization")
85
if authHeader == "" {
86
+
return nil, ErrMissingAuthHeader
87
}
88
89
// Check for DPoP authorization scheme
90
parts := strings.SplitN(authHeader, " ", 2)
91
if len(parts) != 2 {
92
+
return nil, ErrInvalidAuthFormat
93
}
94
95
if parts[0] != "DPoP" {
···
98
99
accessToken := parts[1]
100
if accessToken == "" {
101
+
return nil, ErrMissingToken
102
}
103
104
// Extract DPoP header
105
dpopProof := r.Header.Get("DPoP")
106
if dpopProof == "" {
107
+
return nil, ErrMissingDPoPHeader
108
}
109
110
// TODO: We could verify the DPoP proof locally (signature, HTM, HTU, etc.)
···
148
// JWT format: header.payload.signature
149
parts := strings.Split(token, ".")
150
if len(parts) != 3 {
151
+
return "", "", ErrInvalidJWTFormat
152
}
153
154
// Decode payload (base64url)
···
168
}
169
170
if claims.Sub == "" {
171
+
return "", "", ErrMissingSubClaim
172
}
173
174
if claims.Iss == "" {
175
+
return "", "", ErrMissingISSClaim
176
}
177
178
return claims.Sub, claims.Iss, nil
···
255
return nil, fmt.Errorf("DPoP authentication failed: %w", err)
256
}
257
} else {
258
+
return nil, ErrInvalidAuthScheme
259
}
260
261
// Get captain record to check owner
···
282
return user, nil
283
}
284
// User is crew but doesn't have admin permission
285
+
return nil, NewAuthError("crew:admin", "crew member lacks permission", "crew:admin")
286
}
287
}
288
289
// User is neither owner nor authorized crew
290
+
return nil, NewAuthError("crew:admin", "user is not a crew member", "crew:admin")
291
}
292
293
// ValidateBlobWriteAccess validates that the request has valid authentication
···
315
return nil, fmt.Errorf("DPoP authentication failed: %w", err)
316
}
317
} else {
318
+
return nil, ErrInvalidAuthScheme
319
}
320
321
// Get captain record to check owner and public settings
···
342
return user, nil
343
}
344
// User is crew but doesn't have write permission
345
+
return nil, NewAuthError("blob:write", "crew member lacks permission", "blob:write")
346
}
347
}
348
349
// User is neither owner nor authorized crew
350
+
return nil, NewAuthError("blob:write", "user is not a crew member", "blob:write")
351
}
352
353
// ValidateBlobReadAccess validates that the request has read access to blobs
354
// If captain.public = true: No auth required (returns nil user to indicate public access)
355
+
// If captain.public = false: Requires valid DPoP + OAuth and (captain OR crew with blob:read or blob:write permission).
356
+
// Note: blob:write implicitly grants blob:read access.
357
// The httpClient parameter is optional and defaults to http.DefaultClient if nil.
358
func ValidateBlobReadAccess(r *http.Request, pds *HoldPDS, httpClient HTTPClient) (*ValidatedUser, error) {
359
// Get captain record to check public setting
···
384
return nil, fmt.Errorf("DPoP authentication failed: %w", err)
385
}
386
} else {
387
+
return nil, ErrInvalidAuthScheme
388
}
389
390
// Check if user is the owner (always has read access)
···
392
return user, nil
393
}
394
395
+
// Check if user is crew with blob:read or blob:write permission
396
+
// Note: blob:write implicitly grants blob:read access
397
crew, err := pds.ListCrewMembers(r.Context())
398
if err != nil {
399
return nil, fmt.Errorf("failed to check crew membership: %w", err)
···
401
402
for _, member := range crew {
403
if member.Record.Member == user.DID {
404
+
// Check if this crew member has blob:read or blob:write permission
405
+
// blob:write implicitly grants read access (can't push without pulling)
406
+
if slices.Contains(member.Record.Permissions, "blob:read") ||
407
+
slices.Contains(member.Record.Permissions, "blob:write") {
408
return user, nil
409
}
410
+
// User is crew but doesn't have read or write permission
411
+
return nil, NewAuthError("blob:read", "crew member lacks permission", "blob:read", "blob:write")
412
}
413
}
414
415
// User is neither owner nor authorized crew
416
+
return nil, NewAuthError("blob:read", "user is not a crew member", "blob:read", "blob:write")
417
}
418
419
// ServiceTokenClaims represents the claims in a service token JWT
···
428
// Extract Authorization header
429
authHeader := r.Header.Get("Authorization")
430
if authHeader == "" {
431
+
return nil, ErrMissingAuthHeader
432
}
433
434
// Check for Bearer authorization scheme
435
parts := strings.SplitN(authHeader, " ", 2)
436
if len(parts) != 2 {
437
+
return nil, ErrInvalidAuthFormat
438
}
439
440
if parts[0] != "Bearer" {
···
443
444
tokenString := parts[1]
445
if tokenString == "" {
446
+
return nil, ErrMissingToken
447
}
448
449
slog.Debug("Validating service token", "holdDID", holdDID)
···
452
// Split token: header.payload.signature
453
tokenParts := strings.Split(tokenString, ".")
454
if len(tokenParts) != 3 {
455
+
return nil, ErrInvalidJWTFormat
456
}
457
458
// Decode payload (second part) to extract claims
···
470
// Get issuer (user DID)
471
issuerDID := claims.Issuer
472
if issuerDID == "" {
473
+
return nil, ErrMissingISSClaim
474
}
475
476
// Verify audience matches this hold service
···
488
return nil, fmt.Errorf("failed to get expiration: %w", err)
489
}
490
if exp != nil && time.Now().After(exp.Time) {
491
+
return nil, ErrTokenExpired
492
}
493
494
// Verify JWT signature using ATProto's secp256k1 crypto
+110
pkg/hold/pds/auth_test.go
+110
pkg/hold/pds/auth_test.go
···
771
}
772
}
773
774
+
// TestValidateBlobReadAccess_BlobWriteImpliesRead tests that blob:write grants read access
775
+
func TestValidateBlobReadAccess_BlobWriteImpliesRead(t *testing.T) {
776
+
ownerDID := "did:plc:owner123"
777
+
778
+
pds, ctx := setupTestPDSWithBootstrap(t, ownerDID, false, false)
779
+
780
+
// Verify captain record has public=false (private hold)
781
+
_, captain, err := pds.GetCaptainRecord(ctx)
782
+
if err != nil {
783
+
t.Fatalf("Failed to get captain record: %v", err)
784
+
}
785
+
786
+
if captain.Public {
787
+
t.Error("Expected public=false for captain record")
788
+
}
789
+
790
+
// Add crew member with ONLY blob:write permission (no blob:read)
791
+
writerDID := "did:plc:writer123"
792
+
_, err = pds.AddCrewMember(ctx, writerDID, "writer", []string{"blob:write"})
793
+
if err != nil {
794
+
t.Fatalf("Failed to add crew writer: %v", err)
795
+
}
796
+
797
+
mockClient := &mockPDSClient{}
798
+
799
+
// Test writer (has only blob:write permission) can read
800
+
t.Run("crew with blob:write can read", func(t *testing.T) {
801
+
dpopHelper, err := NewDPoPTestHelper(writerDID, "https://test-pds.example.com")
802
+
if err != nil {
803
+
t.Fatalf("Failed to create DPoP helper: %v", err)
804
+
}
805
+
806
+
req := httptest.NewRequest(http.MethodGet, "/test", nil)
807
+
if err := dpopHelper.AddDPoPToRequest(req); err != nil {
808
+
t.Fatalf("Failed to add DPoP to request: %v", err)
809
+
}
810
+
811
+
// This should SUCCEED because blob:write implies blob:read
812
+
user, err := ValidateBlobReadAccess(req, pds, mockClient)
813
+
if err != nil {
814
+
t.Errorf("Expected blob:write to grant read access, got error: %v", err)
815
+
}
816
+
817
+
if user == nil {
818
+
t.Error("Expected user to be returned for valid read access")
819
+
} else if user.DID != writerDID {
820
+
t.Errorf("Expected user DID %s, got %s", writerDID, user.DID)
821
+
}
822
+
})
823
+
824
+
// Also verify that crew with only blob:read still works
825
+
t.Run("crew with blob:read can read", func(t *testing.T) {
826
+
readerDID := "did:plc:reader123"
827
+
_, err = pds.AddCrewMember(ctx, readerDID, "reader", []string{"blob:read"})
828
+
if err != nil {
829
+
t.Fatalf("Failed to add crew reader: %v", err)
830
+
}
831
+
832
+
dpopHelper, err := NewDPoPTestHelper(readerDID, "https://test-pds.example.com")
833
+
if err != nil {
834
+
t.Fatalf("Failed to create DPoP helper: %v", err)
835
+
}
836
+
837
+
req := httptest.NewRequest(http.MethodGet, "/test", nil)
838
+
if err := dpopHelper.AddDPoPToRequest(req); err != nil {
839
+
t.Fatalf("Failed to add DPoP to request: %v", err)
840
+
}
841
+
842
+
user, err := ValidateBlobReadAccess(req, pds, mockClient)
843
+
if err != nil {
844
+
t.Errorf("Expected blob:read to grant read access, got error: %v", err)
845
+
}
846
+
847
+
if user == nil {
848
+
t.Error("Expected user to be returned for valid read access")
849
+
} else if user.DID != readerDID {
850
+
t.Errorf("Expected user DID %s, got %s", readerDID, user.DID)
851
+
}
852
+
})
853
+
854
+
// Verify crew with neither permission cannot read
855
+
t.Run("crew without read or write cannot read", func(t *testing.T) {
856
+
noPermDID := "did:plc:noperm123"
857
+
_, err = pds.AddCrewMember(ctx, noPermDID, "noperm", []string{"crew:admin"})
858
+
if err != nil {
859
+
t.Fatalf("Failed to add crew member: %v", err)
860
+
}
861
+
862
+
dpopHelper, err := NewDPoPTestHelper(noPermDID, "https://test-pds.example.com")
863
+
if err != nil {
864
+
t.Fatalf("Failed to create DPoP helper: %v", err)
865
+
}
866
+
867
+
req := httptest.NewRequest(http.MethodGet, "/test", nil)
868
+
if err := dpopHelper.AddDPoPToRequest(req); err != nil {
869
+
t.Fatalf("Failed to add DPoP to request: %v", err)
870
+
}
871
+
872
+
_, err = ValidateBlobReadAccess(req, pds, mockClient)
873
+
if err == nil {
874
+
t.Error("Expected error for crew without read or write permission")
875
+
}
876
+
877
+
// Verify error message format
878
+
if !strings.Contains(err.Error(), "access denied for blob:read") {
879
+
t.Errorf("Expected structured error message, got: %v", err)
880
+
}
881
+
})
882
+
}
883
+
884
// TestValidateOwnerOrCrewAdmin tests admin permission checking
885
func TestValidateOwnerOrCrewAdmin(t *testing.T) {
886
ownerDID := "did:plc:owner123"
+92
-74
pkg/hold/pds/manifest_post.go
+92
-74
pkg/hold/pds/manifest_post.go
···
3
import (
4
"context"
5
"fmt"
6
"log/slog"
7
"strings"
8
"time"
9
10
bsky "github.com/bluesky-social/indigo/api/bsky"
11
)
12
13
// CreateManifestPost creates a Bluesky post announcing a manifest upload
14
-
// Includes facets for clickable mentions and links
15
func (p *HoldPDS) CreateManifestPost(
16
ctx context.Context,
17
repository, tag, userHandle, userDID, digest string,
18
totalSize int64,
19
) (string, error) {
20
now := time.Now()
21
22
// Build AppView repository URL
23
appViewURL := fmt.Sprintf("https://atcr.io/r/%s/%s", userHandle, repository)
24
25
-
// Format post text components
26
-
digestShort := formatDigest(digest)
27
-
sizeStr := formatSize(totalSize)
28
repoWithTag := fmt.Sprintf("%s:%s", repository, tag)
29
30
-
// Build text: "@alice.bsky.social just pushed hsm-secrets-operator:latest\nDigest: sha256:abc...def Size: 12.2 MB"
31
-
text := fmt.Sprintf("@%s just pushed %s\nDigest: %s Size: %s", userHandle, repoWithTag, digestShort, sizeStr)
32
33
-
// Create facets for mentions and links
34
-
facets := buildFacets(text, userHandle, userDID, repoWithTag, appViewURL)
35
36
-
// Create post struct with facets
37
post := &bsky.FeedPost{
38
-
LexiconTypeID: "app.bsky.feed.post",
39
Text: text,
40
Facets: facets,
41
CreatedAt: now.Format(time.RFC3339),
42
}
43
44
// Create record with auto-generated TID
45
rkey, recordCID, err := p.repomgr.CreateRecord(
46
ctx,
47
p.uid,
48
-
"app.bsky.feed.post",
49
post,
50
)
51
···
54
}
55
56
// Build ATProto URI for the post
57
-
postURI := fmt.Sprintf("at://%s/app.bsky.feed.post/%s", p.did, rkey)
58
59
slog.Info("Created manifest post",
60
"uri", postURI,
···
63
return postURI, nil
64
}
65
66
-
// formatDigest truncates digest to first 10 chars
67
-
// Example: sha256:abc1234567890fedcba9876543210 -> sha256:abc1234567...
68
-
func formatDigest(digest string) string {
69
-
if !strings.HasPrefix(digest, "sha256:") {
70
-
return digest // Return as-is if not sha256
71
}
72
73
-
hash := strings.TrimPrefix(digest, "sha256:")
74
-
if len(hash) <= 10 {
75
-
return digest // Too short to truncate
76
}
77
78
-
return fmt.Sprintf("sha256:%s...", hash[:10])
79
}
80
81
// formatSize converts bytes to human-readable format
···
98
return fmt.Sprintf("%d B", bytes)
99
}
100
}
101
-
102
-
// buildFacets creates mention and link facets for rich text
103
-
// IMPORTANT: Byte offsets must be calculated for UTF-8 encoded text
104
-
func buildFacets(text, userHandle, userDID, repoWithTag, appViewURL string) []*bsky.RichtextFacet {
105
-
facets := []*bsky.RichtextFacet{}
106
-
107
-
// Find mention: "@alice.bsky.social"
108
-
mentionText := "@" + userHandle
109
-
mentionStart := strings.Index(text, mentionText)
110
-
if mentionStart >= 0 {
111
-
// Calculate byte offsets (not character offsets!)
112
-
byteStart := int64(len(text[:mentionStart]))
113
-
byteEnd := int64(len(text[:mentionStart+len(mentionText)]))
114
-
115
-
facets = append(facets, &bsky.RichtextFacet{
116
-
Index: &bsky.RichtextFacet_ByteSlice{
117
-
ByteStart: byteStart,
118
-
ByteEnd: byteEnd,
119
-
},
120
-
Features: []*bsky.RichtextFacet_Features_Elem{
121
-
{
122
-
RichtextFacet_Mention: &bsky.RichtextFacet_Mention{
123
-
Did: userDID,
124
-
},
125
-
},
126
-
},
127
-
})
128
-
}
129
-
130
-
// Find repository link: "hsm-secrets-operator:latest"
131
-
linkStart := strings.Index(text, repoWithTag)
132
-
if linkStart >= 0 {
133
-
// Calculate byte offsets
134
-
byteStart := int64(len(text[:linkStart]))
135
-
byteEnd := int64(len(text[:linkStart+len(repoWithTag)]))
136
-
137
-
facets = append(facets, &bsky.RichtextFacet{
138
-
Index: &bsky.RichtextFacet_ByteSlice{
139
-
ByteStart: byteStart,
140
-
ByteEnd: byteEnd,
141
-
},
142
-
Features: []*bsky.RichtextFacet_Features_Elem{
143
-
{
144
-
RichtextFacet_Link: &bsky.RichtextFacet_Link{
145
-
Uri: appViewURL,
146
-
},
147
-
},
148
-
},
149
-
})
150
-
}
151
-
152
-
return facets
153
-
}
···
3
import (
4
"context"
5
"fmt"
6
+
"io"
7
"log/slog"
8
+
"net/http"
9
"strings"
10
"time"
11
12
+
"atcr.io/pkg/atproto"
13
bsky "github.com/bluesky-social/indigo/api/bsky"
14
+
"github.com/distribution/distribution/v3/registry/storage/driver"
15
)
16
17
// CreateManifestPost creates a Bluesky post announcing a manifest upload
18
+
// Includes mention facet for the user and an OG card embed with thumbnail
19
func (p *HoldPDS) CreateManifestPost(
20
ctx context.Context,
21
+
storageDriver driver.StorageDriver,
22
repository, tag, userHandle, userDID, digest string,
23
totalSize int64,
24
+
platforms []string,
25
) (string, error) {
26
now := time.Now()
27
28
// Build AppView repository URL
29
appViewURL := fmt.Sprintf("https://atcr.io/r/%s/%s", userHandle, repository)
30
31
+
// Build simplified text with mention - OG card handles the link
32
repoWithTag := fmt.Sprintf("%s:%s", repository, tag)
33
+
text := fmt.Sprintf("@%s pushed %s", userHandle, repoWithTag)
34
35
+
// Only build mention facet - the OG card embed provides the link
36
+
facets := buildMentionFacet(text, userHandle, userDID)
37
38
+
// Build embed with OG card
39
+
var embed *bsky.FeedPost_Embed
40
+
41
+
ogImageData, err := fetchOGImage(ctx, userHandle, repository)
42
+
if err != nil {
43
+
slog.Warn("Failed to fetch OG image, posting without embed", "error", err)
44
+
} else {
45
+
// Upload OG image as blob
46
+
thumbBlob, err := uploadBlobToStorage(ctx, storageDriver, p.did, ogImageData, "image/png")
47
+
if err != nil {
48
+
slog.Warn("Failed to upload OG image blob", "error", err)
49
+
} else {
50
+
// Build dynamic description
51
+
var description string
52
+
if len(platforms) > 0 {
53
+
description = fmt.Sprintf("Multi-arch: %s", strings.Join(platforms, ", "))
54
+
} else {
55
+
description = fmt.Sprintf("Pushed %s to ATCR", formatSize(totalSize))
56
+
}
57
+
58
+
embed = &bsky.FeedPost_Embed{
59
+
EmbedExternal: &bsky.EmbedExternal{
60
+
LexiconTypeID: "app.bsky.embed.external",
61
+
External: &bsky.EmbedExternal_External{
62
+
Uri: appViewURL,
63
+
Title: fmt.Sprintf("%s/%s:%s", userHandle, repository, tag),
64
+
Description: description,
65
+
Thumb: thumbBlob,
66
+
},
67
+
},
68
+
}
69
+
}
70
+
}
71
72
+
// Create post struct with facets and embed
73
post := &bsky.FeedPost{
74
+
LexiconTypeID: atproto.BskyPostCollection,
75
Text: text,
76
Facets: facets,
77
+
Embed: embed,
78
CreatedAt: now.Format(time.RFC3339),
79
+
Langs: []string{"en"},
80
}
81
82
// Create record with auto-generated TID
83
rkey, recordCID, err := p.repomgr.CreateRecord(
84
ctx,
85
p.uid,
86
+
atproto.BskyPostCollection,
87
post,
88
)
89
···
92
}
93
94
// Build ATProto URI for the post
95
+
postURI := fmt.Sprintf("at://%s/%s/%s", p.did, atproto.BskyPostCollection, rkey)
96
97
slog.Info("Created manifest post",
98
"uri", postURI,
···
101
return postURI, nil
102
}
103
104
+
// fetchOGImage downloads the OG card image from AppView
105
+
func fetchOGImage(ctx context.Context, userHandle, repository string) ([]byte, error) {
106
+
url := fmt.Sprintf("https://atcr.io/og/r/%s/%s", userHandle, repository)
107
+
108
+
req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
109
+
if err != nil {
110
+
return nil, err
111
}
112
113
+
client := &http.Client{Timeout: 10 * time.Second}
114
+
resp, err := client.Do(req)
115
+
if err != nil {
116
+
return nil, err
117
}
118
+
defer resp.Body.Close()
119
120
+
if resp.StatusCode != http.StatusOK {
121
+
return nil, fmt.Errorf("OG image fetch failed: %d", resp.StatusCode)
122
+
}
123
+
124
+
return io.ReadAll(resp.Body)
125
+
}
126
+
127
+
// buildMentionFacet creates a mention facet for the user handle
128
+
// IMPORTANT: Byte offsets must be calculated for UTF-8 encoded text
129
+
func buildMentionFacet(text, userHandle, userDID string) []*bsky.RichtextFacet {
130
+
mentionText := "@" + userHandle
131
+
mentionStart := strings.Index(text, mentionText)
132
+
if mentionStart < 0 {
133
+
return nil
134
+
}
135
+
136
+
byteStart := int64(len(text[:mentionStart]))
137
+
byteEnd := int64(len(text[:mentionStart+len(mentionText)]))
138
+
139
+
return []*bsky.RichtextFacet{{
140
+
Index: &bsky.RichtextFacet_ByteSlice{
141
+
ByteStart: byteStart,
142
+
ByteEnd: byteEnd,
143
+
},
144
+
Features: []*bsky.RichtextFacet_Features_Elem{{
145
+
RichtextFacet_Mention: &bsky.RichtextFacet_Mention{
146
+
Did: userDID,
147
+
},
148
+
}},
149
+
}}
150
}
151
152
// formatSize converts bytes to human-readable format
···
169
return fmt.Sprintf("%d B", bytes)
170
}
171
}
+144
-163
pkg/hold/pds/manifest_post_test.go
+144
-163
pkg/hold/pds/manifest_post_test.go
···
4
"strings"
5
"testing"
6
7
bsky "github.com/bluesky-social/indigo/api/bsky"
8
)
9
-
10
-
func TestFormatDigest(t *testing.T) {
11
-
tests := []struct {
12
-
name string
13
-
digest string
14
-
expected string
15
-
}{
16
-
{
17
-
name: "standard sha256 digest",
18
-
digest: "sha256:abc1234567890fedcba9876543210",
19
-
expected: "sha256:abc1234567...", // First 10 chars
20
-
},
21
-
{
22
-
name: "short digest (no truncation)",
23
-
digest: "sha256:abc123",
24
-
expected: "sha256:abc123",
25
-
},
26
-
{
27
-
name: "non-sha256 digest",
28
-
digest: "sha512:abc123",
29
-
expected: "sha512:abc123",
30
-
},
31
-
{
32
-
name: "real sha256 digest",
33
-
digest: "sha256:e692418e4cbaf90ca69d05a66403747baa33ee08806650b51fab815ad7fc331f",
34
-
expected: "sha256:e692418e4c...", // First 10 chars
35
-
},
36
-
}
37
-
38
-
for _, tt := range tests {
39
-
t.Run(tt.name, func(t *testing.T) {
40
-
result := formatDigest(tt.digest)
41
-
if result != tt.expected {
42
-
t.Errorf("formatDigest(%q) = %q, want %q", tt.digest, result, tt.expected)
43
-
}
44
-
})
45
-
}
46
-
}
47
48
func TestFormatSize(t *testing.T) {
49
tests := []struct {
···
103
}
104
}
105
106
-
func TestBuildFacets(t *testing.T) {
107
tests := []struct {
108
-
name string
109
-
text string
110
-
userHandle string
111
-
userDID string
112
-
repoWithTag string
113
-
appViewURL string
114
-
wantFacets int // number of facets expected
115
}{
116
{
117
-
name: "standard post with mention and link",
118
-
text: "@alice.bsky.social just pushed myapp:latest\nDigest: sha256:abc...def Size: 12.2 MB",
119
-
userHandle: "alice.bsky.social",
120
-
userDID: "did:plc:alice123",
121
-
repoWithTag: "myapp:latest",
122
-
appViewURL: "https://atcr.io/r/alice.bsky.social/myapp",
123
-
wantFacets: 2,
124
},
125
{
126
-
name: "no matches found",
127
-
text: "random text",
128
-
userHandle: "alice.bsky.social",
129
-
userDID: "did:plc:alice123",
130
-
repoWithTag: "myapp:latest",
131
-
appViewURL: "https://atcr.io/r/alice.bsky.social/myapp",
132
-
wantFacets: 0,
133
},
134
{
135
-
name: "only mention found",
136
-
text: "@alice.bsky.social did something",
137
-
userHandle: "alice.bsky.social",
138
-
userDID: "did:plc:alice123",
139
-
repoWithTag: "myapp:latest",
140
-
appViewURL: "https://atcr.io/r/alice.bsky.social/myapp",
141
-
wantFacets: 1,
142
},
143
}
144
145
for _, tt := range tests {
146
t.Run(tt.name, func(t *testing.T) {
147
-
facets := buildFacets(tt.text, tt.userHandle, tt.userDID, tt.repoWithTag, tt.appViewURL)
148
149
if len(facets) != tt.wantFacets {
150
-
t.Errorf("buildFacets() returned %d facets, want %d", len(facets), tt.wantFacets)
151
}
152
153
// Verify facet structure for standard case
154
-
if tt.name == "standard post with mention and link" && len(facets) == 2 {
155
-
// Check mention facet
156
mentionFacet := facets[0]
157
if mentionFacet.Index == nil {
158
t.Error("mention facet has nil Index")
···
163
if mentionFacet.Features[0].RichtextFacet_Mention == nil {
164
t.Error("mention facet feature is not a mention")
165
}
166
-
167
-
// Check link facet
168
-
linkFacet := facets[1]
169
-
if linkFacet.Index == nil {
170
-
t.Error("link facet has nil Index")
171
-
}
172
-
if len(linkFacet.Features) != 1 {
173
-
t.Errorf("link facet has %d features, want 1", len(linkFacet.Features))
174
-
}
175
-
if linkFacet.Features[0].RichtextFacet_Link == nil {
176
-
t.Error("link facet feature is not a link")
177
-
}
178
-
if linkFacet.Features[0].RichtextFacet_Link.Uri != tt.appViewURL {
179
-
t.Errorf("link facet URI = %q, want %q", linkFacet.Features[0].RichtextFacet_Link.Uri, tt.appViewURL)
180
}
181
}
182
})
183
}
184
}
185
186
-
func TestBuildFacets_ByteOffsets(t *testing.T) {
187
// Test that byte offsets are correctly calculated
188
-
text := "@alice.bsky.social just pushed myapp:latest"
189
userHandle := "alice.bsky.social"
190
userDID := "did:plc:alice123"
191
-
repoWithTag := "myapp:latest"
192
-
appViewURL := "https://atcr.io/r/alice.bsky.social/myapp"
193
194
-
facets := buildFacets(text, userHandle, userDID, repoWithTag, appViewURL)
195
196
-
if len(facets) != 2 {
197
-
t.Fatalf("expected 2 facets, got %d", len(facets))
198
}
199
200
// Check mention facet byte offsets
···
215
if extractedMention != mentionText {
216
t.Errorf("extracted mention = %q, want %q", extractedMention, mentionText)
217
}
218
-
219
-
// Check link facet byte offsets
220
-
linkFacet := facets[1]
221
-
linkStart := len("@alice.bsky.social just pushed ")
222
-
expectedLinkStart := int64(linkStart)
223
-
expectedLinkEnd := int64(linkStart + len(repoWithTag))
224
-
225
-
if linkFacet.Index.ByteStart != expectedLinkStart {
226
-
t.Errorf("link ByteStart = %d, want %d", linkFacet.Index.ByteStart, expectedLinkStart)
227
-
}
228
-
if linkFacet.Index.ByteEnd != expectedLinkEnd {
229
-
t.Errorf("link ByteEnd = %d, want %d", linkFacet.Index.ByteEnd, expectedLinkEnd)
230
-
}
231
-
232
-
// Verify the link text extraction
233
-
extractedLink := text[linkFacet.Index.ByteStart:linkFacet.Index.ByteEnd]
234
-
if extractedLink != repoWithTag {
235
-
t.Errorf("extracted link = %q, want %q", extractedLink, repoWithTag)
236
-
}
237
}
238
239
-
func TestBuildFacets_UTF8Handling(t *testing.T) {
240
// Test with Unicode characters to ensure byte offsets work correctly
241
-
text := "@alice.bsky.social just pushed ๐myapp:latest"
242
userHandle := "alice.bsky.social"
243
userDID := "did:plc:alice123"
244
-
repoWithTag := "๐myapp:latest" // Note: emoji is multi-byte
245
-
appViewURL := "https://atcr.io/r/alice.bsky.social/myapp"
246
247
-
facets := buildFacets(text, userHandle, userDID, repoWithTag, appViewURL)
248
249
-
if len(facets) != 2 {
250
-
t.Fatalf("expected 2 facets, got %d", len(facets))
251
}
252
253
// Verify that byte extraction works with UTF-8
···
257
if extractedMention != expectedMention {
258
t.Errorf("extracted mention = %q, want %q", extractedMention, expectedMention)
259
}
260
261
-
linkFacet := facets[1]
262
-
extractedLink := text[linkFacet.Index.ByteStart:linkFacet.Index.ByteEnd]
263
-
if extractedLink != repoWithTag {
264
-
t.Errorf("extracted link = %q, want %q", extractedLink, repoWithTag)
265
}
266
-
}
267
268
-
func TestBuildFacets_NoOverlap(t *testing.T) {
269
-
// Ensure facets don't overlap
270
-
text := "@alice.bsky.social just pushed myapp:latest"
271
-
userHandle := "alice.bsky.social"
272
-
userDID := "did:plc:alice123"
273
-
repoWithTag := "myapp:latest"
274
-
appViewURL := "https://atcr.io/r/alice.bsky.social/myapp"
275
276
-
facets := buildFacets(text, userHandle, userDID, repoWithTag, appViewURL)
277
278
-
if len(facets) != 2 {
279
-
t.Fatalf("expected 2 facets, got %d", len(facets))
280
}
281
282
-
// Facets should not overlap
283
-
facet1 := facets[0]
284
-
facet2 := facets[1]
285
286
-
if facet1.Index.ByteEnd > facet2.Index.ByteStart {
287
-
t.Errorf("facets overlap: facet1 ends at %d, facet2 starts at %d",
288
-
facet1.Index.ByteEnd, facet2.Index.ByteStart)
289
}
290
}
291
292
-
func TestBuildFacets_RealWorldExample(t *testing.T) {
293
-
// Test with the actual example from the requirements
294
-
repository := "hsm-secrets-operator"
295
tag := "latest"
296
-
userHandle := "evan.jarrett.net"
297
-
userDID := "did:plc:pddp4xt5lgnv2qsegbzzs4xg"
298
-
digest := "sha256:e692418e4cbaf90ca69d05a66403747baa33ee08806650b51fab815ad7fc331f"
299
-
totalSize := int64(12800000) // ~12.2 MB
300
301
repoWithTag := repository + ":" + tag
302
-
digestShort := formatDigest(digest)
303
-
sizeStr := formatSize(totalSize)
304
305
-
text := "@" + userHandle + " just pushed " + repoWithTag + "\nDigest: " + digestShort + " Size: " + sizeStr
306
-
appViewURL := "https://atcr.io/r/" + userHandle + "/" + repository
307
308
-
facets := buildFacets(text, userHandle, userDID, repoWithTag, appViewURL)
309
-
310
-
// Should have 2 facets: mention and link
311
-
if len(facets) != 2 {
312
-
t.Fatalf("expected 2 facets, got %d", len(facets))
313
}
314
315
// Verify the complete post structure
316
post := &bsky.FeedPost{
317
-
LexiconTypeID: "app.bsky.feed.post",
318
Text: text,
319
Facets: facets,
320
}
321
322
if post.Text == "" {
323
t.Error("post text is empty")
324
}
325
326
-
if len(post.Facets) != 2 {
327
-
t.Errorf("post has %d facets, want 2", len(post.Facets))
328
-
}
329
-
330
// Verify text contains expected components
331
expectedTexts := []string{
332
"@" + userHandle,
333
repoWithTag,
334
-
digestShort,
335
-
sizeStr,
336
}
337
338
for _, expected := range expectedTexts {
339
-
if !strings.Contains(text, expected) {
340
t.Errorf("post text missing expected component: %q", expected)
341
}
342
}
343
}
···
4
"strings"
5
"testing"
6
7
+
"atcr.io/pkg/atproto"
8
bsky "github.com/bluesky-social/indigo/api/bsky"
9
)
10
11
func TestFormatSize(t *testing.T) {
12
tests := []struct {
···
66
}
67
}
68
69
+
func TestBuildMentionFacet(t *testing.T) {
70
tests := []struct {
71
+
name string
72
+
text string
73
+
userHandle string
74
+
userDID string
75
+
wantFacets int // number of facets expected
76
}{
77
{
78
+
name: "standard post with mention",
79
+
text: "@alice.bsky.social pushed myapp:latest",
80
+
userHandle: "alice.bsky.social",
81
+
userDID: "did:plc:alice123",
82
+
wantFacets: 1,
83
},
84
{
85
+
name: "no mention found",
86
+
text: "random text",
87
+
userHandle: "alice.bsky.social",
88
+
userDID: "did:plc:alice123",
89
+
wantFacets: 0,
90
},
91
{
92
+
name: "mention at start",
93
+
text: "@alice.bsky.social did something",
94
+
userHandle: "alice.bsky.social",
95
+
userDID: "did:plc:alice123",
96
+
wantFacets: 1,
97
},
98
}
99
100
for _, tt := range tests {
101
t.Run(tt.name, func(t *testing.T) {
102
+
facets := buildMentionFacet(tt.text, tt.userHandle, tt.userDID)
103
104
if len(facets) != tt.wantFacets {
105
+
t.Errorf("buildMentionFacet() returned %d facets, want %d", len(facets), tt.wantFacets)
106
}
107
108
// Verify facet structure for standard case
109
+
if tt.wantFacets > 0 && len(facets) > 0 {
110
mentionFacet := facets[0]
111
if mentionFacet.Index == nil {
112
t.Error("mention facet has nil Index")
···
117
if mentionFacet.Features[0].RichtextFacet_Mention == nil {
118
t.Error("mention facet feature is not a mention")
119
}
120
+
if mentionFacet.Features[0].RichtextFacet_Mention.Did != tt.userDID {
121
+
t.Errorf("mention DID = %q, want %q", mentionFacet.Features[0].RichtextFacet_Mention.Did, tt.userDID)
122
}
123
}
124
})
125
}
126
}
127
128
+
func TestBuildMentionFacet_ByteOffsets(t *testing.T) {
129
// Test that byte offsets are correctly calculated
130
+
text := "@alice.bsky.social pushed myapp:latest"
131
userHandle := "alice.bsky.social"
132
userDID := "did:plc:alice123"
133
134
+
facets := buildMentionFacet(text, userHandle, userDID)
135
136
+
if len(facets) != 1 {
137
+
t.Fatalf("expected 1 facet, got %d", len(facets))
138
}
139
140
// Check mention facet byte offsets
···
155
if extractedMention != mentionText {
156
t.Errorf("extracted mention = %q, want %q", extractedMention, mentionText)
157
}
158
}
159
160
+
func TestBuildMentionFacet_UTF8Handling(t *testing.T) {
161
// Test with Unicode characters to ensure byte offsets work correctly
162
+
text := "@alice.bsky.social pushed ๐myapp:latest"
163
userHandle := "alice.bsky.social"
164
userDID := "did:plc:alice123"
165
166
+
facets := buildMentionFacet(text, userHandle, userDID)
167
168
+
if len(facets) != 1 {
169
+
t.Fatalf("expected 1 facet, got %d", len(facets))
170
}
171
172
// Verify that byte extraction works with UTF-8
···
176
if extractedMention != expectedMention {
177
t.Errorf("extracted mention = %q, want %q", extractedMention, expectedMention)
178
}
179
+
}
180
181
+
func TestSimplifiedPostFormat(t *testing.T) {
182
+
// Test the new simplified post format: "@user pushed repo:tag"
183
+
repository := "hsm-secrets-operator"
184
+
tag := "latest"
185
+
userHandle := "evan.jarrett.net"
186
+
userDID := "did:plc:pddp4xt5lgnv2qsegbzzs4xg"
187
+
188
+
repoWithTag := repository + ":" + tag
189
+
text := "@" + userHandle + " pushed " + repoWithTag
190
+
191
+
facets := buildMentionFacet(text, userHandle, userDID)
192
+
193
+
// Should have 1 facet: mention only (link is provided by embed)
194
+
if len(facets) != 1 {
195
+
t.Fatalf("expected 1 facet, got %d", len(facets))
196
+
}
197
+
198
+
// Verify the complete post structure
199
+
post := &bsky.FeedPost{
200
+
LexiconTypeID: atproto.BskyPostCollection,
201
+
Text: text,
202
+
Facets: facets,
203
+
Langs: []string{"en"},
204
}
205
206
+
if post.Text == "" {
207
+
t.Error("post text is empty")
208
+
}
209
210
+
if len(post.Facets) != 1 {
211
+
t.Errorf("post has %d facets, want 1", len(post.Facets))
212
+
}
213
214
+
// Verify text contains expected components
215
+
expectedTexts := []string{
216
+
"@" + userHandle,
217
+
repoWithTag,
218
}
219
220
+
for _, expected := range expectedTexts {
221
+
if !strings.Contains(text, expected) {
222
+
t.Errorf("post text missing expected component: %q", expected)
223
+
}
224
+
}
225
226
+
// Verify post does NOT contain digest or size (now in embed description)
227
+
if strings.Contains(text, "Digest:") {
228
+
t.Error("simplified post should not contain Digest:")
229
+
}
230
+
if strings.Contains(text, "Size:") {
231
+
t.Error("simplified post should not contain Size:")
232
}
233
}
234
235
+
func TestSimplifiedPostFormat_MultiArch(t *testing.T) {
236
+
// Test the new simplified post format for multi-arch images
237
+
repository := "myapp"
238
tag := "latest"
239
+
userHandle := "alice.bsky.social"
240
+
userDID := "did:plc:alice123"
241
242
repoWithTag := repository + ":" + tag
243
+
text := "@" + userHandle + " pushed " + repoWithTag
244
245
+
facets := buildMentionFacet(text, userHandle, userDID)
246
247
+
// Should have 1 facet: mention only
248
+
if len(facets) != 1 {
249
+
t.Fatalf("expected 1 facet, got %d", len(facets))
250
}
251
252
// Verify the complete post structure
253
post := &bsky.FeedPost{
254
+
LexiconTypeID: atproto.BskyPostCollection,
255
Text: text,
256
Facets: facets,
257
+
Langs: []string{"en"},
258
}
259
260
if post.Text == "" {
261
t.Error("post text is empty")
262
}
263
264
// Verify text contains expected components
265
expectedTexts := []string{
266
"@" + userHandle,
267
repoWithTag,
268
}
269
270
for _, expected := range expectedTexts {
271
+
if !strings.Contains(post.Text, expected) {
272
t.Errorf("post text missing expected component: %q", expected)
273
}
274
+
}
275
+
276
+
// Verify Platforms is NOT in text (now in embed description)
277
+
if strings.Contains(post.Text, "Platforms:") {
278
+
t.Error("simplified post should not contain Platforms:")
279
+
}
280
+
}
281
+
282
+
func TestEmbedDescription(t *testing.T) {
283
+
// Test the dynamic description generation for embeds
284
+
tests := []struct {
285
+
name string
286
+
platforms []string
287
+
totalSize int64
288
+
wantContain string
289
+
}{
290
+
{
291
+
name: "single-arch with size",
292
+
platforms: []string{},
293
+
totalSize: 12800000, // ~12.2 MB
294
+
wantContain: "Pushed 12.2 MB to ATCR",
295
+
},
296
+
{
297
+
name: "multi-arch with platforms",
298
+
platforms: []string{"linux/amd64", "linux/arm64"},
299
+
totalSize: 0,
300
+
wantContain: "Multi-arch: linux/amd64, linux/arm64",
301
+
},
302
+
{
303
+
name: "single platform",
304
+
platforms: []string{"linux/amd64"},
305
+
totalSize: 0,
306
+
wantContain: "Multi-arch: linux/amd64",
307
+
},
308
+
}
309
+
310
+
for _, tt := range tests {
311
+
t.Run(tt.name, func(t *testing.T) {
312
+
var description string
313
+
if len(tt.platforms) > 0 {
314
+
description = "Multi-arch: " + strings.Join(tt.platforms, ", ")
315
+
} else {
316
+
description = "Pushed " + formatSize(tt.totalSize) + " to ATCR"
317
+
}
318
+
319
+
if !strings.Contains(description, tt.wantContain) {
320
+
t.Errorf("description = %q, want to contain %q", description, tt.wantContain)
321
+
}
322
+
})
323
}
324
}
+4
-8
pkg/hold/pds/status.go
+4
-8
pkg/hold/pds/status.go
···
6
"log/slog"
7
"time"
8
9
bsky "github.com/bluesky-social/indigo/api/bsky"
10
-
)
11
-
12
-
const (
13
-
// StatusPostCollection is the collection name for Bluesky posts
14
-
StatusPostCollection = "app.bsky.feed.post"
15
)
16
17
// SetStatus creates a new status post on Bluesky
···
40
// Create post struct
41
now := time.Now()
42
post := &bsky.FeedPost{
43
-
LexiconTypeID: "app.bsky.feed.post",
44
Text: text,
45
CreatedAt: now.Format(time.RFC3339),
46
}
47
48
// Use repomgr.CreateRecord to create the post with auto-generated TID
49
// CreateRecord automatically generates a unique TID using the repo's clock
50
-
rkey, recordCID, err := p.repomgr.CreateRecord(ctx, p.uid, StatusPostCollection, post)
51
if err != nil {
52
return fmt.Errorf("failed to create status post: %w", err)
53
}
54
55
slog.Info("Created status post",
56
-
"collection", StatusPostCollection,
57
"rkey", rkey,
58
"cid", recordCID.String(),
59
"text", text)
···
6
"log/slog"
7
"time"
8
9
+
"atcr.io/pkg/atproto"
10
bsky "github.com/bluesky-social/indigo/api/bsky"
11
)
12
13
// SetStatus creates a new status post on Bluesky
···
36
// Create post struct
37
now := time.Now()
38
post := &bsky.FeedPost{
39
+
LexiconTypeID: atproto.BskyPostCollection,
40
Text: text,
41
CreatedAt: now.Format(time.RFC3339),
42
}
43
44
// Use repomgr.CreateRecord to create the post with auto-generated TID
45
// CreateRecord automatically generates a unique TID using the repo's clock
46
+
rkey, recordCID, err := p.repomgr.CreateRecord(ctx, p.uid, atproto.BskyPostCollection, post)
47
if err != nil {
48
return fmt.Errorf("failed to create status post: %w", err)
49
}
50
51
slog.Info("Created status post",
52
+
"collection", atproto.BskyPostCollection,
53
"rkey", rkey,
54
"cid", recordCID.String(),
55
"text", text)
+3
-10
pkg/hold/pds/status_test.go
+3
-10
pkg/hold/pds/status_test.go
···
61
listPosts := func() ([]map[string]any, error) {
62
req := makeXRPCGetRequest(atproto.RepoListRecords, map[string]string{
63
"repo": did,
64
-
"collection": StatusPostCollection,
65
"limit": "100",
66
"reverse": "true", // Most recent first
67
})
···
134
}
135
// URI format: at://did:web:test.example.com/app.bsky.feed.post/3m3c4...
136
// We just check that it contains the collection
137
-
if !contains(uri, StatusPostCollection) {
138
-
t.Errorf("Expected URI to contain collection %s, got %s", StatusPostCollection, uri)
139
}
140
})
141
···
224
t.Errorf("Expected text '๐ด Current status: offline', got '%s'", text)
225
}
226
})
227
-
}
228
-
229
-
func TestStatusPostCollection(t *testing.T) {
230
-
// Verify constant
231
-
if StatusPostCollection != "app.bsky.feed.post" {
232
-
t.Errorf("Expected StatusPostCollection 'app.bsky.feed.post', got '%s'", StatusPostCollection)
233
-
}
234
}
235
236
// Helper function to check if a string contains a substring
···
61
listPosts := func() ([]map[string]any, error) {
62
req := makeXRPCGetRequest(atproto.RepoListRecords, map[string]string{
63
"repo": did,
64
+
"collection": atproto.BskyPostCollection,
65
"limit": "100",
66
"reverse": "true", // Most recent first
67
})
···
134
}
135
// URI format: at://did:web:test.example.com/app.bsky.feed.post/3m3c4...
136
// We just check that it contains the collection
137
+
if !contains(uri, atproto.BskyPostCollection) {
138
+
t.Errorf("Expected URI to contain collection %s, got %s", atproto.BskyPostCollection, uri)
139
}
140
})
141
···
224
t.Errorf("Expected text '๐ด Current status: offline', got '%s'", text)
225
}
226
})
227
}
228
229
// Helper function to check if a string contains a substring
+1
-1
pkg/hold/pds/xrpc.go
+1
-1
pkg/hold/pds/xrpc.go
+101
scripts/dpop-monitor.sh
+101
scripts/dpop-monitor.sh
···
···
1
+
#!/bin/bash
2
+
# Monitor PDS logs for DPoP JWTs and compare iat timestamps
3
+
# Usage: ./dpop-monitor.sh [pod-name]
4
+
5
+
POD="${1:-atproto-pds-6d5c45457d-wcmhc}"
6
+
7
+
echo "Monitoring DPoP JWTs from pod: $POD"
8
+
echo "Press Ctrl+C to stop"
9
+
echo "-------------------------------------------"
10
+
11
+
kubectl logs -f "$POD" 2>/dev/null | while read -r line; do
12
+
# Extract DPoP JWT from the line
13
+
dpop=$(echo "$line" | grep -oP '"dpop":"[^"]+' | sed 's/"dpop":"//')
14
+
15
+
if [ -n "$dpop" ]; then
16
+
# Extract log timestamp (milliseconds)
17
+
log_time_ms=$(echo "$line" | grep -oP '"time":\d+' | grep -oP '\d+')
18
+
19
+
# Extract URL
20
+
url=$(echo "$line" | grep -oP '"url":"[^"]+' | sed 's/"url":"//')
21
+
22
+
# Extract status code
23
+
status=$(echo "$line" | grep -oP '"statusCode":\d+' | grep -oP '\d+')
24
+
25
+
# Extract client IP (cf-connecting-ip)
26
+
client_ip=$(echo "$line" | grep -oP '"cf-connecting-ip":"[^"]+' | sed 's/"cf-connecting-ip":"//')
27
+
28
+
# Extract user-agent to identify the source
29
+
user_agent=$(echo "$line" | grep -oP '"user-agent":"[^"]+' | sed 's/"user-agent":"//')
30
+
31
+
# Extract referer (often contains the source app)
32
+
referer=$(echo "$line" | grep -oP '"referer":"[^"]+' | sed 's/"referer":"//' | grep -oP 'https://[^/]+' | sed 's|https://||')
33
+
34
+
# Decode JWT payload (second part between dots)
35
+
payload=$(echo "$dpop" | cut -d. -f2)
36
+
37
+
# Add padding if needed for base64
38
+
padding=$((4 - ${#payload} % 4))
39
+
if [ $padding -ne 4 ]; then
40
+
payload="${payload}$(printf '=%.0s' $(seq 1 $padding))"
41
+
fi
42
+
43
+
# Decode and extract iat
44
+
decoded=$(echo "$payload" | base64 -d 2>/dev/null)
45
+
iat=$(echo "$decoded" | grep -oP '"iat":\d+' | grep -oP '\d+')
46
+
exp=$(echo "$decoded" | grep -oP '"exp":\d+' | grep -oP '\d+')
47
+
htu=$(echo "$decoded" | grep -oP '"htu":"[^"]+' | sed 's/"htu":"//')
48
+
49
+
if [ -n "$iat" ] && [ -n "$log_time_ms" ]; then
50
+
# Convert log time to seconds
51
+
log_time_s=$((log_time_ms / 1000))
52
+
53
+
# Calculate difference (positive = token from future, negative = token from past)
54
+
diff=$((iat - log_time_s))
55
+
56
+
# Determine source - prefer referer, then htu domain, then user-agent
57
+
if [ -n "$referer" ]; then
58
+
source="$referer"
59
+
else
60
+
# Extract domain from htu (the target of the DPoP request)
61
+
htu_domain=$(echo "$htu" | grep -oP 'https://[^/]+' | sed 's|https://||')
62
+
63
+
# For server-to-server calls, try to identify by known IPs
64
+
case "$client_ip" in
65
+
152.44.36.124) source="atcr.io" ;;
66
+
2a04:3541:8000:1000:*) source="tangled.org" ;;
67
+
*)
68
+
if echo "$user_agent" | grep -q "indigo-sdk"; then
69
+
source="indigo-sdk"
70
+
elif echo "$user_agent" | grep -q "Go-http-client"; then
71
+
source="Go-app"
72
+
else
73
+
source="${user_agent:0:30}"
74
+
fi
75
+
source="$source ($client_ip)"
76
+
;;
77
+
esac
78
+
fi
79
+
80
+
# Color coding
81
+
if [ $diff -gt 0 ]; then
82
+
color="\033[31m" # Red - future token (problem!)
83
+
status_text="FUTURE"
84
+
elif [ $diff -lt -5 ]; then
85
+
color="\033[33m" # Yellow - old token
86
+
status_text="OLD"
87
+
else
88
+
color="\033[32m" # Green - ok
89
+
status_text="OK"
90
+
fi
91
+
reset="\033[0m"
92
+
93
+
echo ""
94
+
echo -e "${color}[$status_text]${reset} Diff: ${diff}s | Source: $source | Status: $status"
95
+
echo " iat (token): $iat ($(date -d @$iat -u '+%H:%M:%S UTC'))"
96
+
echo " PDS received: $log_time_s ($(date -d @$log_time_s -u '+%H:%M:%S UTC'))"
97
+
echo " URL: $url"
98
+
[ -n "$client_ip" ] && echo " Client IP: $client_ip"
99
+
fi
100
+
fi
101
+
done