A container registry that uses the AT Protocol for manifest storage and S3 for blob storage.
atcr.io
evan.jarrett.net
docker
container
atproto
go
Compare changes
Choose any two refs to compare.
+36
-1
CLAUDE.md
+36
-1
CLAUDE.md
···
475
476
Read access:
477
- **Public hold** (`HOLD_PUBLIC=true`): Anonymous + all authenticated users
478
-
- **Private hold** (`HOLD_PUBLIC=false`): Requires authentication + crew membership with blob:read permission
479
480
Write access:
481
- Hold owner OR crew members with blob:write permission
482
- Verified via `io.atcr.hold.crew` records in hold's embedded PDS
483
484
**Embedded PDS Endpoints** (`pkg/hold/pds/xrpc.go`):
485
···
475
476
Read access:
477
- **Public hold** (`HOLD_PUBLIC=true`): Anonymous + all authenticated users
478
+
- **Private hold** (`HOLD_PUBLIC=false`): Requires authentication + crew membership with blob:read OR blob:write permission
479
+
- **Note:** `blob:write` implicitly grants `blob:read` access (can't push without pulling)
480
481
Write access:
482
- Hold owner OR crew members with blob:write permission
483
- Verified via `io.atcr.hold.crew` records in hold's embedded PDS
484
+
485
+
**Permission Matrix:**
486
+
487
+
| User Type | Public Read | Private Read | Write | Crew Admin |
488
+
|-----------|-------------|--------------|-------|------------|
489
+
| Anonymous | Yes | No | No | No |
490
+
| Owner (captain) | Yes | Yes | Yes | Yes (implied) |
491
+
| Crew (blob:read only) | Yes | Yes | No | No |
492
+
| Crew (blob:write only) | Yes | Yes* | Yes | No |
493
+
| Crew (blob:read + blob:write) | Yes | Yes | Yes | No |
494
+
| Crew (crew:admin) | Yes | Yes | Yes | Yes |
495
+
| Authenticated non-crew | Yes | No | No | No |
496
+
497
+
*`blob:write` implicitly grants `blob:read` access
498
+
499
+
**Authorization Error Format:**
500
+
501
+
All authorization failures use consistent structured errors (`pkg/hold/pds/auth.go`):
502
+
```
503
+
access denied for [action]: [reason] (required: [permission(s)])
504
+
```
505
+
506
+
Examples:
507
+
- `access denied for blob:read: user is not a crew member (required: blob:read or blob:write)`
508
+
- `access denied for blob:write: crew member lacks permission (required: blob:write)`
509
+
- `access denied for crew:admin: user is not a crew member (required: crew:admin)`
510
+
511
+
**Shared Error Constants** (`pkg/hold/pds/auth.go`):
512
+
- `ErrMissingAuthHeader` - Missing Authorization header
513
+
- `ErrInvalidAuthFormat` - Invalid Authorization header format
514
+
- `ErrInvalidAuthScheme` - Invalid scheme (expected Bearer or DPoP)
515
+
- `ErrInvalidJWTFormat` - Malformed JWT
516
+
- `ErrMissingISSClaim` / `ErrMissingSubClaim` - Missing JWT claims
517
+
- `ErrTokenExpired` - Token has expired
518
519
**Embedded PDS Endpoints** (`pkg/hold/pds/xrpc.go`):
520
+18
-40
cmd/appview/serve.go
+18
-40
cmd/appview/serve.go
···
150
middleware.SetGlobalRefresher(refresher)
151
152
// Set global database for pull/push metrics tracking
153
-
metricsDB := db.NewMetricsDB(uiDatabase)
154
-
middleware.SetGlobalDatabase(metricsDB)
155
156
// Create RemoteHoldAuthorizer for hold authorization with caching
157
holdAuthorizer := auth.NewRemoteHoldAuthorizer(uiDatabase, testMode)
···
191
HealthChecker: healthChecker,
192
ReadmeFetcher: readmeFetcher,
193
Templates: uiTemplates,
194
})
195
}
196
}
···
212
// Create ATProto client with session provider (uses DoWithSession for DPoP nonce safety)
213
client := atproto.NewClientWithSessionProvider(pdsEndpoint, did, refresher)
214
215
-
// Ensure sailor profile exists (creates with default hold if configured)
216
-
slog.Debug("Ensuring profile exists", "component", "appview/callback", "did", did, "default_hold_did", defaultHoldDID)
217
-
if err := storage.EnsureProfile(ctx, client, defaultHoldDID); err != nil {
218
-
slog.Warn("Failed to ensure profile", "component", "appview/callback", "did", did, "error", err)
219
-
// Continue anyway - profile creation is not critical for avatar fetch
220
-
} else {
221
-
slog.Debug("Profile ensured", "component", "appview/callback", "did", did)
222
-
}
223
224
// Fetch user's profile record from PDS (contains blob references)
225
profileRecord, err := client.GetProfileRecord(ctx, did)
···
270
return nil // Non-fatal
271
}
272
273
-
var holdDID string
274
if profile != nil && profile.DefaultHold != "" {
275
// Check if defaultHold is a URL (needs migration)
276
if strings.HasPrefix(profile.DefaultHold, "http://") || strings.HasPrefix(profile.DefaultHold, "https://") {
···
286
} else {
287
slog.Debug("Updated profile with hold DID", "component", "appview/callback", "hold_did", holdDID)
288
}
289
-
} else {
290
-
// Already a DID - use it
291
-
holdDID = profile.DefaultHold
292
}
293
-
// Register crew regardless of migration (outside the migration block)
294
-
// Run in background to avoid blocking OAuth callback if hold is offline
295
-
// Use background context - don't inherit request context which gets canceled on response
296
-
slog.Debug("Attempting crew registration", "component", "appview/callback", "did", did, "hold_did", holdDID)
297
-
go func(client *atproto.Client, refresher *oauth.Refresher, holdDID string) {
298
-
ctx := context.Background()
299
-
storage.EnsureCrewMembership(ctx, client, refresher, holdDID)
300
-
}(client, refresher, holdDID)
301
-
302
}
303
304
return nil // All errors are non-fatal, logged for debugging
···
320
ctx := context.Background()
321
app := handlers.NewApp(ctx, cfg.Distribution)
322
323
-
// Wrap registry app with auth method extraction middleware
324
-
// This extracts the auth method from the JWT and stores it in the request context
325
wrappedApp := middleware.ExtractAuthMethod(app)
326
327
// Mount registry at /v2/
328
mainRouter.Handle("/v2/*", wrappedApp)
···
412
// Prevents the flood of errors when a stale session is discovered during push
413
tokenHandler.SetOAuthSessionValidator(refresher)
414
415
-
// Register token post-auth callback for profile management
416
-
// This decouples the token package from AppView-specific dependencies
417
tokenHandler.SetPostAuthCallback(func(ctx context.Context, did, handle, pdsEndpoint, accessToken string) error {
418
slog.Debug("Token post-auth callback", "component", "appview/callback", "did", did)
419
-
420
-
// Create ATProto client with validated token
421
-
atprotoClient := atproto.NewClient(pdsEndpoint, did, accessToken)
422
-
423
-
// Ensure profile exists (will create with default hold if not exists and default is configured)
424
-
if err := storage.EnsureProfile(ctx, atprotoClient, defaultHoldDID); err != nil {
425
-
// Log error but don't fail auth - profile management is not critical
426
-
slog.Warn("Failed to ensure profile", "component", "appview/callback", "did", did, "error", err)
427
-
} else {
428
-
slog.Debug("Profile ensured with default hold", "component", "appview/callback", "did", did, "default_hold_did", defaultHoldDID)
429
-
}
430
-
431
-
return nil // All errors are non-fatal
432
})
433
434
mainRouter.Get("/auth/token", tokenHandler.ServeHTTP)
···
150
middleware.SetGlobalRefresher(refresher)
151
152
// Set global database for pull/push metrics tracking
153
+
middleware.SetGlobalDatabase(uiDatabase)
154
155
// Create RemoteHoldAuthorizer for hold authorization with caching
156
holdAuthorizer := auth.NewRemoteHoldAuthorizer(uiDatabase, testMode)
···
190
HealthChecker: healthChecker,
191
ReadmeFetcher: readmeFetcher,
192
Templates: uiTemplates,
193
+
DefaultHoldDID: defaultHoldDID,
194
})
195
}
196
}
···
212
// Create ATProto client with session provider (uses DoWithSession for DPoP nonce safety)
213
client := atproto.NewClientWithSessionProvider(pdsEndpoint, did, refresher)
214
215
+
// Note: Profile and crew setup now happen automatically via UserContext.EnsureUserSetup()
216
217
// Fetch user's profile record from PDS (contains blob references)
218
profileRecord, err := client.GetProfileRecord(ctx, did)
···
263
return nil // Non-fatal
264
}
265
266
+
// Migrate profile URL→DID if needed (legacy migration, crew registration now handled by UserContext)
267
if profile != nil && profile.DefaultHold != "" {
268
// Check if defaultHold is a URL (needs migration)
269
if strings.HasPrefix(profile.DefaultHold, "http://") || strings.HasPrefix(profile.DefaultHold, "https://") {
···
279
} else {
280
slog.Debug("Updated profile with hold DID", "component", "appview/callback", "hold_did", holdDID)
281
}
282
}
283
}
284
285
return nil // All errors are non-fatal, logged for debugging
···
301
ctx := context.Background()
302
app := handlers.NewApp(ctx, cfg.Distribution)
303
304
+
// Wrap registry app with middleware chain:
305
+
// 1. ExtractAuthMethod - extracts auth method from JWT and stores in context
306
+
// 2. UserContextMiddleware - builds UserContext with identity, permissions, service tokens
307
wrappedApp := middleware.ExtractAuthMethod(app)
308
+
309
+
// Create dependencies for UserContextMiddleware
310
+
userContextDeps := &auth.Dependencies{
311
+
Refresher: refresher,
312
+
Authorizer: holdAuthorizer,
313
+
DefaultHoldDID: defaultHoldDID,
314
+
}
315
+
wrappedApp = middleware.UserContextMiddleware(userContextDeps)(wrappedApp)
316
317
// Mount registry at /v2/
318
mainRouter.Handle("/v2/*", wrappedApp)
···
402
// Prevents the flood of errors when a stale session is discovered during push
403
tokenHandler.SetOAuthSessionValidator(refresher)
404
405
+
// Register token post-auth callback
406
+
// Note: Profile and crew setup now happen automatically via UserContext.EnsureUserSetup()
407
tokenHandler.SetPostAuthCallback(func(ctx context.Context, did, handle, pdsEndpoint, accessToken string) error {
408
slog.Debug("Token post-auth callback", "component", "appview/callback", "did", did)
409
+
return nil
410
})
411
412
mainRouter.Get("/auth/token", tokenHandler.ServeHTTP)
+84
docs/HOLD_XRPC_ENDPOINTS.md
+84
docs/HOLD_XRPC_ENDPOINTS.md
···
···
1
+
# Hold Service XRPC Endpoints
2
+
3
+
This document lists all XRPC endpoints implemented in the Hold service (`pkg/hold/`).
4
+
5
+
## PDS Endpoints (`pkg/hold/pds/xrpc.go`)
6
+
7
+
### Public (No Auth Required)
8
+
9
+
| Endpoint | Method | Description |
10
+
|----------|--------|-------------|
11
+
| `/xrpc/_health` | GET | Health check |
12
+
| `/xrpc/com.atproto.server.describeServer` | GET | Server metadata |
13
+
| `/xrpc/com.atproto.repo.describeRepo` | GET | Repository information |
14
+
| `/xrpc/com.atproto.repo.getRecord` | GET | Retrieve a single record |
15
+
| `/xrpc/com.atproto.repo.listRecords` | GET | List records in a collection (paginated) |
16
+
| `/xrpc/com.atproto.sync.listRepos` | GET | List all repositories |
17
+
| `/xrpc/com.atproto.sync.getRecord` | GET | Get record as CAR file |
18
+
| `/xrpc/com.atproto.sync.getRepo` | GET | Full repository as CAR file |
19
+
| `/xrpc/com.atproto.sync.getRepoStatus` | GET | Repository hosting status |
20
+
| `/xrpc/com.atproto.sync.subscribeRepos` | GET | WebSocket firehose |
21
+
| `/xrpc/com.atproto.identity.resolveHandle` | GET | Resolve handle to DID |
22
+
| `/xrpc/app.bsky.actor.getProfile` | GET | Get actor profile |
23
+
| `/xrpc/app.bsky.actor.getProfiles` | GET | Get multiple profiles |
24
+
| `/.well-known/did.json` | GET | DID document |
25
+
| `/.well-known/atproto-did` | GET | DID for handle resolution |
26
+
27
+
### Conditional Auth (based on captain.public)
28
+
29
+
| Endpoint | Method | Description |
30
+
|----------|--------|-------------|
31
+
| `/xrpc/com.atproto.sync.getBlob` | GET/HEAD | Get blob (routes OCI vs ATProto) |
32
+
33
+
### Owner/Crew Admin Required
34
+
35
+
| Endpoint | Method | Description |
36
+
|----------|--------|-------------|
37
+
| `/xrpc/com.atproto.repo.deleteRecord` | POST | Delete a record |
38
+
| `/xrpc/com.atproto.repo.uploadBlob` | POST | Upload ATProto blob |
39
+
40
+
### DPoP Auth Required
41
+
42
+
| Endpoint | Method | Description |
43
+
|----------|--------|-------------|
44
+
| `/xrpc/io.atcr.hold.requestCrew` | POST | Request crew membership |
45
+
46
+
---
47
+
48
+
## OCI Multipart Upload Endpoints (`pkg/hold/oci/xrpc.go`)
49
+
50
+
All require `blob:write` permission via service token:
51
+
52
+
| Endpoint | Method | Description |
53
+
|----------|--------|-------------|
54
+
| `/xrpc/io.atcr.hold.initiateUpload` | POST | Start multipart upload |
55
+
| `/xrpc/io.atcr.hold.getPartUploadUrl` | POST | Get presigned URL for part |
56
+
| `/xrpc/io.atcr.hold.uploadPart` | PUT | Direct buffered part upload |
57
+
| `/xrpc/io.atcr.hold.completeUpload` | POST | Finalize multipart upload |
58
+
| `/xrpc/io.atcr.hold.abortUpload` | POST | Cancel multipart upload |
59
+
| `/xrpc/io.atcr.hold.notifyManifest` | POST | Notify manifest push (creates layer records + optional Bluesky post) |
60
+
61
+
---
62
+
63
+
## Standard ATProto Endpoints (excluding io.atcr.hold.*)
64
+
65
+
| Endpoint |
66
+
|----------|
67
+
| /xrpc/_health |
68
+
| /xrpc/com.atproto.server.describeServer |
69
+
| /xrpc/com.atproto.repo.describeRepo |
70
+
| /xrpc/com.atproto.repo.getRecord |
71
+
| /xrpc/com.atproto.repo.listRecords |
72
+
| /xrpc/com.atproto.repo.deleteRecord |
73
+
| /xrpc/com.atproto.repo.uploadBlob |
74
+
| /xrpc/com.atproto.sync.listRepos |
75
+
| /xrpc/com.atproto.sync.getRecord |
76
+
| /xrpc/com.atproto.sync.getRepo |
77
+
| /xrpc/com.atproto.sync.getRepoStatus |
78
+
| /xrpc/com.atproto.sync.getBlob |
79
+
| /xrpc/com.atproto.sync.subscribeRepos |
80
+
| /xrpc/com.atproto.identity.resolveHandle |
81
+
| /xrpc/app.bsky.actor.getProfile |
82
+
| /xrpc/app.bsky.actor.getProfiles |
83
+
| /.well-known/did.json |
84
+
| /.well-known/atproto-did |
+399
docs/VALKEY_MIGRATION.md
+399
docs/VALKEY_MIGRATION.md
···
···
1
+
# Analysis: AppView SQL Database Usage
2
+
3
+
## Overview
4
+
5
+
The AppView uses SQLite with 19 tables. The key finding: **most data is a cache of ATProto records** that could theoretically be rebuilt from users' PDS instances.
6
+
7
+
## Data Categories
8
+
9
+
### 1. MUST PERSIST (Local State Only)
10
+
11
+
These tables contain data that **cannot be reconstructed** from external sources:
12
+
13
+
| Table | Purpose | Why It Must Persist |
14
+
|-------|---------|---------------------|
15
+
| `oauth_sessions` | OAuth tokens | Refresh tokens are stateful; losing them = users must re-auth |
16
+
| `ui_sessions` | Web browser sessions | Session continuity for logged-in users |
17
+
| `devices` | Approved devices + bcrypt secrets | User authorization decisions; secrets are one-way hashed |
18
+
| `pending_device_auth` | In-flight auth flows | Short-lived (10min) but critical during auth |
19
+
| `oauth_auth_requests` | OAuth flow state | Short-lived but required for auth completion |
20
+
| `repository_stats` | Pull/push counts | **Locally tracked metrics** - not stored in ATProto |
21
+
22
+
### 2. CACHED FROM PDS (Rebuildable)
23
+
24
+
These tables are essentially a **read-through cache** of ATProto data:
25
+
26
+
| Table | Source | ATProto Collection |
27
+
|-------|--------|-------------------|
28
+
| `users` | User's PDS profile | `app.bsky.actor.profile` + DID document |
29
+
| `manifests` | User's PDS | `io.atcr.manifest` records |
30
+
| `tags` | User's PDS | `io.atcr.tag` records |
31
+
| `layers` | Derived from manifests | Parsed from manifest content |
32
+
| `manifest_references` | Derived from manifest lists | Parsed from multi-arch manifests |
33
+
| `repository_annotations` | Manifest config blob | OCI annotations from config |
34
+
| `repo_pages` | User's PDS | `io.atcr.repo.page` records |
35
+
| `stars` | User's PDS | `io.atcr.sailor.star` records (synced via Jetstream) |
36
+
| `hold_captain_records` | Hold's embedded PDS | `io.atcr.hold.captain` records |
37
+
| `hold_crew_approvals` | Hold's embedded PDS | `io.atcr.hold.crew` records |
38
+
| `hold_crew_denials` | Local authorization cache | Could re-check on demand |
39
+
40
+
### 3. OPERATIONAL
41
+
42
+
| Table | Purpose |
43
+
|-------|---------|
44
+
| `schema_migrations` | Migration tracking |
45
+
| `firehose_cursor` | Jetstream position (can restart from 0) |
46
+
47
+
## Key Insights
48
+
49
+
### What's Actually Unique to AppView?
50
+
51
+
1. **Authentication state** - OAuth sessions, devices, UI sessions
52
+
2. **Engagement metrics** - Pull/push counts (locally tracked, not in ATProto)
53
+
54
+
### What Could Be Eliminated?
55
+
56
+
If ATCR fully embraced the ATProto model:
57
+
58
+
1. **`users`** - Query PDS on demand (with caching)
59
+
2. **`manifests`, `tags`, `layers`** - Query PDS on demand (with caching)
60
+
3. **`repository_annotations`** - Fetch manifest config on demand
61
+
4. **`repo_pages`** - Query PDS on demand
62
+
5. **`hold_*` tables** - Query hold's PDS on demand
63
+
64
+
### Trade-offs
65
+
66
+
**Current approach (heavy caching):**
67
+
- Fast queries for UI (search, browse, stats)
68
+
- Offline resilience (PDS down doesn't break UI)
69
+
- Complex sync logic (Jetstream consumer, backfill)
70
+
- State can diverge from source of truth
71
+
72
+
**Lighter approach (query on demand):**
73
+
- Always fresh data
74
+
- Simpler codebase (no sync)
75
+
- Slower queries (network round-trips)
76
+
- Depends on PDS availability
77
+
78
+
## Current Limitation: No Cache-Miss Queries
79
+
80
+
**Finding:** There's no "query PDS on cache miss" logic. Users/manifests only enter the DB via:
81
+
1. OAuth login (user authenticates)
82
+
2. Jetstream events (firehose activity)
83
+
84
+
**Problem:** If someone visits `atcr.io/alice/myapp` before alice is indexed → 404
85
+
86
+
**Where this happens:**
87
+
- `pkg/appview/handlers/repository.go:50-53`: If `db.GetUserByDID()` returns nil → 404
88
+
- No fallback to `atproto.Client.ListRecords()` or similar
89
+
90
+
**This matters for Valkey migration:** If cache is ephemeral and restarts clear it, you need cache-miss logic to repopulate on demand. Otherwise:
91
+
- Restart Valkey → all users/manifests gone
92
+
- Wait for Jetstream to re-index OR implement cache-miss queries
93
+
94
+
**Cache-miss implementation design:**
95
+
96
+
Existing code to reuse: `pkg/appview/jetstream/processor.go:43-97` (`EnsureUser`)
97
+
98
+
```go
99
+
// New: pkg/appview/cache/loader.go
100
+
101
+
type Loader struct {
102
+
cache Cache // Valkey interface
103
+
client *atproto.Client
104
+
}
105
+
106
+
// GetUser with cache-miss fallback
107
+
func (l *Loader) GetUser(ctx context.Context, did string) (*User, error) {
108
+
// 1. Try cache
109
+
if user := l.cache.GetUser(did); user != nil {
110
+
return user, nil
111
+
}
112
+
113
+
// 2. Cache miss - resolve identity (already queries network)
114
+
_, handle, pdsEndpoint, err := atproto.ResolveIdentity(ctx, did)
115
+
if err != nil {
116
+
return nil, err // User doesn't exist in network
117
+
}
118
+
119
+
// 3. Fetch profile for avatar
120
+
client := atproto.NewClient(pdsEndpoint, "", "")
121
+
profile, _ := client.GetProfileRecord(ctx, did)
122
+
avatarURL := ""
123
+
if profile != nil && profile.Avatar != nil {
124
+
avatarURL = atproto.BlobCDNURL(did, profile.Avatar.Ref.Link)
125
+
}
126
+
127
+
// 4. Cache and return
128
+
user := &User{DID: did, Handle: handle, PDSEndpoint: pdsEndpoint, Avatar: avatarURL}
129
+
l.cache.SetUser(user, 1*time.Hour)
130
+
return user, nil
131
+
}
132
+
133
+
// GetManifestsForRepo with cache-miss fallback
134
+
func (l *Loader) GetManifestsForRepo(ctx context.Context, did, repo string) ([]Manifest, error) {
135
+
cacheKey := fmt.Sprintf("manifests:%s:%s", did, repo)
136
+
137
+
// 1. Try cache
138
+
if cached := l.cache.Get(cacheKey); cached != nil {
139
+
return cached.([]Manifest), nil
140
+
}
141
+
142
+
// 2. Cache miss - get user's PDS endpoint
143
+
user, err := l.GetUser(ctx, did)
144
+
if err != nil {
145
+
return nil, err
146
+
}
147
+
148
+
// 3. Query PDS for manifests
149
+
client := atproto.NewClient(user.PDSEndpoint, "", "")
150
+
records, _, err := client.ListRecordsForRepo(ctx, did, atproto.ManifestCollection, 100, "")
151
+
if err != nil {
152
+
return nil, err
153
+
}
154
+
155
+
// 4. Filter by repository and parse
156
+
var manifests []Manifest
157
+
for _, rec := range records {
158
+
var m atproto.ManifestRecord
159
+
if err := json.Unmarshal(rec.Value, &m); err != nil {
160
+
continue
161
+
}
162
+
if m.Repository == repo {
163
+
manifests = append(manifests, convertManifest(m))
164
+
}
165
+
}
166
+
167
+
// 5. Cache and return
168
+
l.cache.Set(cacheKey, manifests, 10*time.Minute)
169
+
return manifests, nil
170
+
}
171
+
```
172
+
173
+
**Handler changes:**
174
+
```go
175
+
// Before (repository.go:45-53):
176
+
owner, err := db.GetUserByDID(h.DB, did)
177
+
if owner == nil {
178
+
RenderNotFound(w, r, h.Templates, h.RegistryURL)
179
+
return
180
+
}
181
+
182
+
// After:
183
+
owner, err := h.Loader.GetUser(r.Context(), did)
184
+
if err != nil {
185
+
RenderNotFound(w, r, h.Templates, h.RegistryURL)
186
+
return
187
+
}
188
+
```
189
+
190
+
**Performance considerations:**
191
+
- Cache hit: ~1ms (Valkey lookup)
192
+
- Cache miss: ~200-500ms (PDS round-trip)
193
+
- First request after restart: slower but correct
194
+
- Jetstream still useful for proactive warming
195
+
196
+
---
197
+
198
+
## Proposed Architecture: Valkey + ATProto
199
+
200
+
### Goal
201
+
Replace SQLite with Valkey (Redis-compatible) for ephemeral state, push remaining persistent data to ATProto.
202
+
203
+
### What goes to Valkey (ephemeral, TTL-based)
204
+
205
+
| Current Table | Valkey Key Pattern | TTL | Notes |
206
+
|---------------|-------------------|-----|-------|
207
+
| `oauth_sessions` | `oauth:{did}:{session_id}` | 90 days | Lost on restart = re-auth |
208
+
| `ui_sessions` | `ui:{session_id}` | Session duration | Lost on restart = re-login |
209
+
| `oauth_auth_requests` | `authreq:{state}` | 10 min | In-flight flows |
210
+
| `pending_device_auth` | `pending:{device_code}` | 10 min | In-flight flows |
211
+
| `firehose_cursor` | `cursor:jetstream` | None | Can restart from 0 |
212
+
| All PDS cache tables | `cache:{collection}:{did}:{rkey}` | 10-60 min | Query PDS on miss |
213
+
214
+
**Benefits:**
215
+
- Multi-instance ready (shared Valkey)
216
+
- No schema migrations
217
+
- Natural TTL expiry
218
+
- Simpler code (no SQL)
219
+
220
+
### What could become ATProto records
221
+
222
+
| Current Table | Proposed Collection | Where Stored | Open Questions |
223
+
|---------------|---------------------|--------------|----------------|
224
+
| `devices` | `io.atcr.sailor.device` | User's PDS | Privacy: IP, user-agent sensitive? |
225
+
| `repository_stats` | `io.atcr.repo.stats` | Hold's PDS or User's PDS | Who owns the stats? |
226
+
227
+
**Devices → Valkey:**
228
+
- Move current device table to Valkey
229
+
- Key: `device:{did}:{device_id}` → `{name, secret_hash, ip, user_agent, created_at, last_used}`
230
+
- TTL: Long (1 year?) or no expiry
231
+
- Device list: `devices:{did}` → Set of device IDs
232
+
- Secret validation works the same, just different backend
233
+
234
+
**Service auth exploration (future):**
235
+
The challenge with pure ATProto service auth is the AppView still needs the user's OAuth session to write manifests to their PDS. The current flow:
236
+
1. User authenticates via OAuth → AppView gets OAuth tokens
237
+
2. AppView issues registry JWT to credential helper
238
+
3. Credential helper presents JWT on each push/pull
239
+
4. AppView uses OAuth session to write to user's PDS
240
+
241
+
Service auth could work for the hold side (AppView → Hold), but not for the user's OAuth session.
242
+
243
+
**Repository stats → Hold's PDS:**
244
+
245
+
**Challenge discovered:** The hold's `getBlob` endpoint only receives `did` + `cid`, not the repository name.
246
+
247
+
Current flow (`proxy_blob_store.go:358-362`):
248
+
```go
249
+
xrpcURL := fmt.Sprintf("%s%s?did=%s&cid=%s&method=%s",
250
+
p.holdURL, atproto.SyncGetBlob, p.ctx.DID, dgst.String(), operation)
251
+
```
252
+
253
+
**Implementation options:**
254
+
255
+
**Option A: Add repository parameter to getBlob (recommended)**
256
+
```go
257
+
// Modified AppView call:
258
+
xrpcURL := fmt.Sprintf("%s%s?did=%s&cid=%s&method=%s&repo=%s",
259
+
p.holdURL, atproto.SyncGetBlob, p.ctx.DID, dgst.String(), operation, p.ctx.Repository)
260
+
```
261
+
262
+
```go
263
+
// Modified hold handler (xrpc.go:969):
264
+
func (h *XRPCHandler) HandleGetBlob(w http.ResponseWriter, r *http.Request) {
265
+
did := r.URL.Query().Get("did")
266
+
cidOrDigest := r.URL.Query().Get("cid")
267
+
repo := r.URL.Query().Get("repo") // NEW
268
+
269
+
// ... existing blob handling ...
270
+
271
+
// Increment stats if repo provided
272
+
if repo != "" {
273
+
go h.pds.IncrementPullCount(did, repo) // Async, non-blocking
274
+
}
275
+
}
276
+
```
277
+
278
+
**Stats record structure:**
279
+
```
280
+
Collection: io.atcr.hold.stats
281
+
Rkey: base64(did:repository) // Deterministic, unique
282
+
283
+
{
284
+
"$type": "io.atcr.hold.stats",
285
+
"did": "did:plc:alice123",
286
+
"repository": "myapp",
287
+
"pullCount": 1542,
288
+
"pushCount": 47,
289
+
"lastPull": "2025-01-15T...",
290
+
"lastPush": "2025-01-10T...",
291
+
"createdAt": "2025-01-01T..."
292
+
}
293
+
```
294
+
295
+
**Hold-side implementation:**
296
+
```go
297
+
// New file: pkg/hold/pds/stats.go
298
+
299
+
func (p *HoldPDS) IncrementPullCount(ctx context.Context, did, repo string) error {
300
+
rkey := statsRecordKey(did, repo)
301
+
302
+
// Get or create stats record
303
+
stats, err := p.GetStatsRecord(ctx, rkey)
304
+
if err != nil || stats == nil {
305
+
stats = &atproto.StatsRecord{
306
+
Type: atproto.StatsCollection,
307
+
DID: did,
308
+
Repository: repo,
309
+
PullCount: 0,
310
+
PushCount: 0,
311
+
CreatedAt: time.Now(),
312
+
}
313
+
}
314
+
315
+
// Increment and update
316
+
stats.PullCount++
317
+
stats.LastPull = time.Now()
318
+
319
+
_, err = p.repomgr.UpdateRecord(ctx, p.uid, atproto.StatsCollection, rkey, stats)
320
+
return err
321
+
}
322
+
```
323
+
324
+
**Query endpoint (new XRPC):**
325
+
```
326
+
GET /xrpc/io.atcr.hold.getStats?did={userDID}&repo={repository}
327
+
→ Returns JSON: { pullCount, pushCount, lastPull, lastPush }
328
+
329
+
GET /xrpc/io.atcr.hold.listStats?did={userDID}
330
+
→ Returns all stats for a user across all repos on this hold
331
+
```
332
+
333
+
**AppView aggregation:**
334
+
```go
335
+
func (l *Loader) GetAggregatedStats(ctx context.Context, did, repo string) (*Stats, error) {
336
+
// 1. Get all holds that have served this repo
337
+
holdDIDs, _ := l.cache.GetHoldDIDsForRepo(did, repo)
338
+
339
+
// 2. Query each hold for stats
340
+
var total Stats
341
+
for _, holdDID := range holdDIDs {
342
+
holdURL := resolveHoldDID(holdDID)
343
+
stats, _ := queryHoldStats(ctx, holdURL, did, repo)
344
+
total.PullCount += stats.PullCount
345
+
total.PushCount += stats.PushCount
346
+
}
347
+
348
+
return &total, nil
349
+
}
350
+
```
351
+
352
+
**Files to modify:**
353
+
- `pkg/atproto/lexicon.go` - Add `StatsCollection` + `StatsRecord`
354
+
- `pkg/hold/pds/stats.go` - New file for stats operations
355
+
- `pkg/hold/pds/xrpc.go` - Add `repo` param to getBlob, add stats endpoints
356
+
- `pkg/appview/storage/proxy_blob_store.go` - Pass repository to getBlob
357
+
- `pkg/appview/cache/loader.go` - Aggregation logic
358
+
359
+
### Migration Path
360
+
361
+
**Phase 1: Add Valkey infrastructure**
362
+
- Add Valkey client to AppView
363
+
- Create store interfaces that abstract SQLite vs Valkey
364
+
- Dual-write OAuth sessions to both
365
+
366
+
**Phase 2: Migrate sessions to Valkey**
367
+
- OAuth sessions, UI sessions, auth requests, pending device auth
368
+
- Remove SQLite session tables
369
+
- Test: restart AppView, users get logged out (acceptable)
370
+
371
+
**Phase 3: Migrate devices to Valkey**
372
+
- Move device store to Valkey
373
+
- Same data structure, different backend
374
+
- Consider device expiry policy
375
+
376
+
**Phase 4: Implement hold-side stats**
377
+
- Add `io.atcr.hold.stats` collection to hold's embedded PDS
378
+
- Hold increments stats on blob access
379
+
- Add XRPC endpoint: `io.atcr.hold.getStats`
380
+
381
+
**Phase 5: AppView stats aggregation**
382
+
- Track holdDids per repo in Valkey cache
383
+
- Query holds for stats, aggregate
384
+
- Cache aggregated stats with TTL
385
+
386
+
**Phase 6: Remove SQLite (optional)**
387
+
- Keep SQLite as optional cache layer for UI queries
388
+
- Or: Query PDS on demand with Valkey caching
389
+
- Jetstream still useful for real-time updates
390
+
391
+
## Summary Table
392
+
393
+
| Category | Tables | % of Schema | Truly Persistent? |
394
+
|----------|--------|-------------|-------------------|
395
+
| Auth & Sessions + Metrics | 6 | 32% | Yes |
396
+
| PDS Cache | 11 | 58% | No (rebuildable) |
397
+
| Operational | 2 | 10% | No |
398
+
399
+
**~58% of the database is cached ATProto data that could be rebuilt from PDSes.**
+21
lexicons/io/atcr/authFullApp.json
+21
lexicons/io/atcr/authFullApp.json
···
···
1
+
{
2
+
"lexicon": 1,
3
+
"id": "io.atcr.authFullApp",
4
+
"defs": {
5
+
"main": {
6
+
"type": "permission-set",
7
+
"title": "AT Container Registry",
8
+
"title:langs": {},
9
+
"detail": "Push and pull container images to the ATProto Container Registry. Includes creating and managing image manifests, tags, and repository settings.",
10
+
"detail:langs": {},
11
+
"permissions": [
12
+
{
13
+
"type": "permission",
14
+
"resource": "repo",
15
+
"action": ["create", "update", "delete"],
16
+
"collection": ["io.atcr.manifest", "io.atcr.tag", "io.atcr.sailor.star", "io.atcr.sailor.profile", "io.atcr.repo.page"]
17
+
}
18
+
]
19
+
}
20
+
}
21
+
}
+4
-2
lexicons/io/atcr/hold/captain.json
+4
-2
lexicons/io/atcr/hold/captain.json
+4
-2
lexicons/io/atcr/hold/crew.json
+4
-2
lexicons/io/atcr/hold/crew.json
···
18
"role": {
19
"type": "string",
20
"description": "Member's role in the hold",
21
-
"knownValues": ["owner", "admin", "write", "read"]
22
},
23
"permissions": {
24
"type": "array",
25
"description": "Specific permissions granted to this member",
26
"items": {
27
-
"type": "string"
28
}
29
},
30
"addedAt": {
···
18
"role": {
19
"type": "string",
20
"description": "Member's role in the hold",
21
+
"knownValues": ["owner", "admin", "write", "read"],
22
+
"maxLength": 32
23
},
24
"permissions": {
25
"type": "array",
26
"description": "Specific permissions granted to this member",
27
"items": {
28
+
"type": "string",
29
+
"maxLength": 64
30
}
31
},
32
"addedAt": {
+6
-3
lexicons/io/atcr/hold/layer.json
+6
-3
lexicons/io/atcr/hold/layer.json
···
12
"properties": {
13
"digest": {
14
"type": "string",
15
-
"description": "Layer digest (e.g., sha256:abc123...)"
16
},
17
"size": {
18
"type": "integer",
···
20
},
21
"mediaType": {
22
"type": "string",
23
-
"description": "Media type (e.g., application/vnd.oci.image.layer.v1.tar+gzip)"
24
},
25
"repository": {
26
"type": "string",
27
-
"description": "Repository this layer belongs to"
28
},
29
"userDid": {
30
"type": "string",
···
12
"properties": {
13
"digest": {
14
"type": "string",
15
+
"description": "Layer digest (e.g., sha256:abc123...)",
16
+
"maxLength": 128
17
},
18
"size": {
19
"type": "integer",
···
21
},
22
"mediaType": {
23
"type": "string",
24
+
"description": "Media type (e.g., application/vnd.oci.image.layer.v1.tar+gzip)",
25
+
"maxLength": 128
26
},
27
"repository": {
28
"type": "string",
29
+
"description": "Repository this layer belongs to",
30
+
"maxLength": 255
31
},
32
"userDid": {
33
"type": "string",
+22
-11
lexicons/io/atcr/manifest.json
+22
-11
lexicons/io/atcr/manifest.json
···
17
},
18
"digest": {
19
"type": "string",
20
-
"description": "Content digest (e.g., 'sha256:abc123...')"
21
},
22
"holdDid": {
23
"type": "string",
···
37
"application/vnd.docker.distribution.manifest.v2+json",
38
"application/vnd.oci.image.index.v1+json",
39
"application/vnd.docker.distribution.manifest.list.v2+json"
40
-
]
41
},
42
"schemaVersion": {
43
"type": "integer",
···
92
"properties": {
93
"mediaType": {
94
"type": "string",
95
-
"description": "MIME type of the blob"
96
},
97
"size": {
98
"type": "integer",
···
100
},
101
"digest": {
102
"type": "string",
103
-
"description": "Content digest (e.g., 'sha256:...')"
104
},
105
"urls": {
106
"type": "array",
···
123
"properties": {
124
"mediaType": {
125
"type": "string",
126
-
"description": "Media type of the referenced manifest"
127
},
128
"size": {
129
"type": "integer",
···
131
},
132
"digest": {
133
"type": "string",
134
-
"description": "Content digest (e.g., 'sha256:...')"
135
},
136
"platform": {
137
"type": "ref",
···
151
"properties": {
152
"architecture": {
153
"type": "string",
154
-
"description": "CPU architecture (e.g., 'amd64', 'arm64', 'arm')"
155
},
156
"os": {
157
"type": "string",
158
-
"description": "Operating system (e.g., 'linux', 'windows', 'darwin')"
159
},
160
"osVersion": {
161
"type": "string",
162
-
"description": "Optional OS version"
163
},
164
"osFeatures": {
165
"type": "array",
166
"items": {
167
-
"type": "string"
168
},
169
"description": "Optional OS features"
170
},
171
"variant": {
172
"type": "string",
173
-
"description": "Optional CPU variant (e.g., 'v7' for ARM)"
174
}
175
}
176
}
···
17
},
18
"digest": {
19
"type": "string",
20
+
"description": "Content digest (e.g., 'sha256:abc123...')",
21
+
"maxLength": 128
22
},
23
"holdDid": {
24
"type": "string",
···
38
"application/vnd.docker.distribution.manifest.v2+json",
39
"application/vnd.oci.image.index.v1+json",
40
"application/vnd.docker.distribution.manifest.list.v2+json"
41
+
],
42
+
"maxLength": 128
43
},
44
"schemaVersion": {
45
"type": "integer",
···
94
"properties": {
95
"mediaType": {
96
"type": "string",
97
+
"description": "MIME type of the blob",
98
+
"maxLength": 128
99
},
100
"size": {
101
"type": "integer",
···
103
},
104
"digest": {
105
"type": "string",
106
+
"description": "Content digest (e.g., 'sha256:...')",
107
+
"maxLength": 128
108
},
109
"urls": {
110
"type": "array",
···
127
"properties": {
128
"mediaType": {
129
"type": "string",
130
+
"description": "Media type of the referenced manifest",
131
+
"maxLength": 128
132
},
133
"size": {
134
"type": "integer",
···
136
},
137
"digest": {
138
"type": "string",
139
+
"description": "Content digest (e.g., 'sha256:...')",
140
+
"maxLength": 128
141
},
142
"platform": {
143
"type": "ref",
···
157
"properties": {
158
"architecture": {
159
"type": "string",
160
+
"description": "CPU architecture (e.g., 'amd64', 'arm64', 'arm')",
161
+
"maxLength": 32
162
},
163
"os": {
164
"type": "string",
165
+
"description": "Operating system (e.g., 'linux', 'windows', 'darwin')",
166
+
"maxLength": 32
167
},
168
"osVersion": {
169
"type": "string",
170
+
"description": "Optional OS version",
171
+
"maxLength": 64
172
},
173
"osFeatures": {
174
"type": "array",
175
"items": {
176
+
"type": "string",
177
+
"maxLength": 64
178
},
179
"description": "Optional OS features"
180
},
181
"variant": {
182
"type": "string",
183
+
"description": "Optional CPU variant (e.g., 'v7' for ARM)",
184
+
"maxLength": 32
185
}
186
}
187
}
+2
-1
lexicons/io/atcr/tag.json
+2
-1
lexicons/io/atcr/tag.json
-25
pkg/appview/db/queries.go
-25
pkg/appview/db/queries.go
···
1634
return time.Time{}, fmt.Errorf("unable to parse timestamp: %s", s)
1635
}
1636
1637
-
// MetricsDB wraps a sql.DB and implements the metrics interface for middleware
1638
-
type MetricsDB struct {
1639
-
db *sql.DB
1640
-
}
1641
-
1642
-
// NewMetricsDB creates a new metrics database wrapper
1643
-
func NewMetricsDB(db *sql.DB) *MetricsDB {
1644
-
return &MetricsDB{db: db}
1645
-
}
1646
-
1647
-
// IncrementPullCount increments the pull count for a repository
1648
-
func (m *MetricsDB) IncrementPullCount(did, repository string) error {
1649
-
return IncrementPullCount(m.db, did, repository)
1650
-
}
1651
-
1652
-
// IncrementPushCount increments the push count for a repository
1653
-
func (m *MetricsDB) IncrementPushCount(did, repository string) error {
1654
-
return IncrementPushCount(m.db, did, repository)
1655
-
}
1656
-
1657
-
// GetLatestHoldDIDForRepo returns the hold DID from the most recent manifest for a repository
1658
-
func (m *MetricsDB) GetLatestHoldDIDForRepo(did, repository string) (string, error) {
1659
-
return GetLatestHoldDIDForRepo(m.db, did, repository)
1660
-
}
1661
-
1662
// GetFeaturedRepositories fetches top repositories sorted by stars and pulls
1663
func GetFeaturedRepositories(db *sql.DB, limit int, currentUserDID string) ([]FeaturedRepository, error) {
1664
query := `
+59
-6
pkg/appview/middleware/auth.go
+59
-6
pkg/appview/middleware/auth.go
···
11
"net/url"
12
13
"atcr.io/pkg/appview/db"
14
)
15
16
type contextKey string
17
18
const userKey contextKey = "user"
19
20
// RequireAuth is middleware that requires authentication
21
func RequireAuth(store *db.SessionStore, database *sql.DB) func(http.Handler) http.Handler {
22
return func(next http.Handler) http.Handler {
23
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
24
sessionID, ok := getSessionID(r)
···
32
return
33
}
34
35
-
sess, ok := store.Get(sessionID)
36
if !ok {
37
// Build return URL with query parameters preserved
38
returnTo := r.URL.Path
···
44
}
45
46
// Look up full user from database to get avatar
47
-
user, err := db.GetUserByDID(database, sess.DID)
48
if err != nil || user == nil {
49
// Fallback to session data if DB lookup fails
50
user = &db.User{
···
54
}
55
}
56
57
-
ctx := context.WithValue(r.Context(), userKey, user)
58
next.ServeHTTP(w, r.WithContext(ctx))
59
})
60
}
···
62
63
// OptionalAuth is middleware that optionally includes user if authenticated
64
func OptionalAuth(store *db.SessionStore, database *sql.DB) func(http.Handler) http.Handler {
65
return func(next http.Handler) http.Handler {
66
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
67
sessionID, ok := getSessionID(r)
68
if ok {
69
-
if sess, ok := store.Get(sessionID); ok {
70
// Look up full user from database to get avatar
71
-
user, err := db.GetUserByDID(database, sess.DID)
72
if err != nil || user == nil {
73
// Fallback to session data if DB lookup fails
74
user = &db.User{
···
77
PDSEndpoint: sess.PDSEndpoint,
78
}
79
}
80
-
ctx := context.WithValue(r.Context(), userKey, user)
81
r = r.WithContext(ctx)
82
}
83
}
···
11
"net/url"
12
13
"atcr.io/pkg/appview/db"
14
+
"atcr.io/pkg/auth"
15
+
"atcr.io/pkg/auth/oauth"
16
)
17
18
type contextKey string
19
20
const userKey contextKey = "user"
21
22
+
// WebAuthDeps contains dependencies for web auth middleware
23
+
type WebAuthDeps struct {
24
+
SessionStore *db.SessionStore
25
+
Database *sql.DB
26
+
Refresher *oauth.Refresher
27
+
DefaultHoldDID string
28
+
}
29
+
30
// RequireAuth is middleware that requires authentication
31
func RequireAuth(store *db.SessionStore, database *sql.DB) func(http.Handler) http.Handler {
32
+
return RequireAuthWithDeps(WebAuthDeps{
33
+
SessionStore: store,
34
+
Database: database,
35
+
})
36
+
}
37
+
38
+
// RequireAuthWithDeps is middleware that requires authentication and creates UserContext
39
+
func RequireAuthWithDeps(deps WebAuthDeps) func(http.Handler) http.Handler {
40
return func(next http.Handler) http.Handler {
41
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
42
sessionID, ok := getSessionID(r)
···
50
return
51
}
52
53
+
sess, ok := deps.SessionStore.Get(sessionID)
54
if !ok {
55
// Build return URL with query parameters preserved
56
returnTo := r.URL.Path
···
62
}
63
64
// Look up full user from database to get avatar
65
+
user, err := db.GetUserByDID(deps.Database, sess.DID)
66
if err != nil || user == nil {
67
// Fallback to session data if DB lookup fails
68
user = &db.User{
···
72
}
73
}
74
75
+
ctx := r.Context()
76
+
ctx = context.WithValue(ctx, userKey, user)
77
+
78
+
// Create UserContext for authenticated users (enables EnsureUserSetup)
79
+
if deps.Refresher != nil {
80
+
userCtx := auth.NewUserContext(sess.DID, auth.AuthMethodOAuth, r.Method, &auth.Dependencies{
81
+
Refresher: deps.Refresher,
82
+
DefaultHoldDID: deps.DefaultHoldDID,
83
+
})
84
+
userCtx.SetPDS(sess.Handle, sess.PDSEndpoint)
85
+
userCtx.EnsureUserSetup()
86
+
ctx = auth.WithUserContext(ctx, userCtx)
87
+
}
88
+
89
next.ServeHTTP(w, r.WithContext(ctx))
90
})
91
}
···
93
94
// OptionalAuth is middleware that optionally includes user if authenticated
95
func OptionalAuth(store *db.SessionStore, database *sql.DB) func(http.Handler) http.Handler {
96
+
return OptionalAuthWithDeps(WebAuthDeps{
97
+
SessionStore: store,
98
+
Database: database,
99
+
})
100
+
}
101
+
102
+
// OptionalAuthWithDeps is middleware that optionally includes user and UserContext if authenticated
103
+
func OptionalAuthWithDeps(deps WebAuthDeps) func(http.Handler) http.Handler {
104
return func(next http.Handler) http.Handler {
105
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
106
sessionID, ok := getSessionID(r)
107
if ok {
108
+
if sess, ok := deps.SessionStore.Get(sessionID); ok {
109
// Look up full user from database to get avatar
110
+
user, err := db.GetUserByDID(deps.Database, sess.DID)
111
if err != nil || user == nil {
112
// Fallback to session data if DB lookup fails
113
user = &db.User{
···
116
PDSEndpoint: sess.PDSEndpoint,
117
}
118
}
119
+
120
+
ctx := r.Context()
121
+
ctx = context.WithValue(ctx, userKey, user)
122
+
123
+
// Create UserContext for authenticated users (enables EnsureUserSetup)
124
+
if deps.Refresher != nil {
125
+
userCtx := auth.NewUserContext(sess.DID, auth.AuthMethodOAuth, r.Method, &auth.Dependencies{
126
+
Refresher: deps.Refresher,
127
+
DefaultHoldDID: deps.DefaultHoldDID,
128
+
})
129
+
userCtx.SetPDS(sess.Handle, sess.PDSEndpoint)
130
+
userCtx.EnsureUserSetup()
131
+
ctx = auth.WithUserContext(ctx, userCtx)
132
+
}
133
+
134
r = r.WithContext(ctx)
135
}
136
}
+102
-322
pkg/appview/middleware/registry.go
+102
-322
pkg/appview/middleware/registry.go
···
2
3
import (
4
"context"
5
"fmt"
6
"log/slog"
7
"net/http"
8
"strings"
9
-
"sync"
10
-
"time"
11
12
"github.com/distribution/distribution/v3"
13
-
"github.com/distribution/distribution/v3/registry/api/errcode"
14
registrymw "github.com/distribution/distribution/v3/registry/middleware/registry"
15
"github.com/distribution/distribution/v3/registry/storage/driver"
16
"github.com/distribution/reference"
17
18
-
"atcr.io/pkg/appview/readme"
19
"atcr.io/pkg/appview/storage"
20
"atcr.io/pkg/atproto"
21
"atcr.io/pkg/auth"
···
29
// authMethodKey is the context key for storing auth method from JWT
30
const authMethodKey contextKey = "auth.method"
31
32
-
// validationCacheEntry stores a validated service token with expiration
33
-
type validationCacheEntry struct {
34
-
serviceToken string
35
-
validUntil time.Time
36
-
err error // Cached error for fast-fail
37
-
mu sync.Mutex // Per-entry lock to serialize cache population
38
-
inFlight bool // True if another goroutine is fetching the token
39
-
done chan struct{} // Closed when fetch completes
40
-
}
41
-
42
-
// validationCache provides request-level caching for service tokens
43
-
// This prevents concurrent layer uploads from racing on OAuth/DPoP requests
44
-
type validationCache struct {
45
-
mu sync.RWMutex
46
-
entries map[string]*validationCacheEntry // key: "did:holdDID"
47
-
}
48
-
49
-
// newValidationCache creates a new validation cache
50
-
func newValidationCache() *validationCache {
51
-
return &validationCache{
52
-
entries: make(map[string]*validationCacheEntry),
53
-
}
54
-
}
55
-
56
-
// getOrFetch retrieves a service token from cache or fetches it
57
-
// Multiple concurrent requests for the same DID:holdDID will share the fetch operation
58
-
func (vc *validationCache) getOrFetch(ctx context.Context, cacheKey string, fetchFunc func() (string, error)) (string, error) {
59
-
// Fast path: check cache with read lock
60
-
vc.mu.RLock()
61
-
entry, exists := vc.entries[cacheKey]
62
-
vc.mu.RUnlock()
63
-
64
-
if exists {
65
-
// Entry exists, check if it's still valid
66
-
entry.mu.Lock()
67
-
68
-
// If another goroutine is fetching, wait for it
69
-
if entry.inFlight {
70
-
done := entry.done
71
-
entry.mu.Unlock()
72
-
73
-
select {
74
-
case <-done:
75
-
// Fetch completed, check result
76
-
entry.mu.Lock()
77
-
defer entry.mu.Unlock()
78
-
79
-
if entry.err != nil {
80
-
return "", entry.err
81
-
}
82
-
if time.Now().Before(entry.validUntil) {
83
-
return entry.serviceToken, nil
84
-
}
85
-
// Fall through to refetch
86
-
case <-ctx.Done():
87
-
return "", ctx.Err()
88
-
}
89
-
} else {
90
-
// Check if cached token is still valid
91
-
if entry.err != nil && time.Now().Before(entry.validUntil) {
92
-
// Return cached error (fast-fail)
93
-
entry.mu.Unlock()
94
-
return "", entry.err
95
-
}
96
-
if entry.err == nil && time.Now().Before(entry.validUntil) {
97
-
// Return cached token
98
-
token := entry.serviceToken
99
-
entry.mu.Unlock()
100
-
return token, nil
101
-
}
102
-
entry.mu.Unlock()
103
-
}
104
-
}
105
-
106
-
// Slow path: need to fetch token
107
-
vc.mu.Lock()
108
-
entry, exists = vc.entries[cacheKey]
109
-
if !exists {
110
-
// Create new entry
111
-
entry = &validationCacheEntry{
112
-
inFlight: true,
113
-
done: make(chan struct{}),
114
-
}
115
-
vc.entries[cacheKey] = entry
116
-
}
117
-
vc.mu.Unlock()
118
-
119
-
// Lock the entry to perform fetch
120
-
entry.mu.Lock()
121
-
122
-
// Double-check: another goroutine may have fetched while we waited
123
-
if !entry.inFlight {
124
-
if entry.err != nil && time.Now().Before(entry.validUntil) {
125
-
err := entry.err
126
-
entry.mu.Unlock()
127
-
return "", err
128
-
}
129
-
if entry.err == nil && time.Now().Before(entry.validUntil) {
130
-
token := entry.serviceToken
131
-
entry.mu.Unlock()
132
-
return token, nil
133
-
}
134
-
}
135
-
136
-
// Mark as in-flight and create fresh done channel for this fetch
137
-
// IMPORTANT: Always create a new channel - a closed channel is not nil
138
-
entry.done = make(chan struct{})
139
-
entry.inFlight = true
140
-
done := entry.done
141
-
entry.mu.Unlock()
142
-
143
-
// Perform the fetch (outside the lock to allow other operations)
144
-
serviceToken, err := fetchFunc()
145
-
146
-
// Update the entry with result
147
-
entry.mu.Lock()
148
-
entry.inFlight = false
149
-
150
-
if err != nil {
151
-
// Cache errors for 5 seconds (fast-fail for subsequent requests)
152
-
entry.err = err
153
-
entry.validUntil = time.Now().Add(5 * time.Second)
154
-
entry.serviceToken = ""
155
-
} else {
156
-
// Cache token for 45 seconds (covers typical Docker push operation)
157
-
entry.err = nil
158
-
entry.serviceToken = serviceToken
159
-
entry.validUntil = time.Now().Add(45 * time.Second)
160
-
}
161
-
162
-
// Signal completion to waiting goroutines
163
-
close(done)
164
-
entry.mu.Unlock()
165
-
166
-
return serviceToken, err
167
-
}
168
169
// Global variables for initialization only
170
// These are set by main.go during startup and copied into NamespaceResolver instances.
171
// After initialization, request handling uses the NamespaceResolver's instance fields.
172
var (
173
globalRefresher *oauth.Refresher
174
-
globalDatabase storage.DatabaseMetrics
175
globalAuthorizer auth.HoldAuthorizer
176
)
177
···
183
184
// SetGlobalDatabase sets the database instance during initialization
185
// Must be called before the registry starts serving requests
186
-
func SetGlobalDatabase(database storage.DatabaseMetrics) {
187
globalDatabase = database
188
}
189
···
201
// NamespaceResolver wraps a namespace and resolves names
202
type NamespaceResolver struct {
203
distribution.Namespace
204
-
defaultHoldDID string // Default hold DID (e.g., "did:web:hold01.atcr.io")
205
-
baseURL string // Base URL for error messages (e.g., "https://atcr.io")
206
-
testMode bool // If true, fallback to default hold when user's hold is unreachable
207
-
refresher *oauth.Refresher // OAuth session manager (copied from global on init)
208
-
database storage.DatabaseMetrics // Metrics database (copied from global on init)
209
-
authorizer auth.HoldAuthorizer // Hold authorization (copied from global on init)
210
-
validationCache *validationCache // Request-level service token cache
211
-
readmeFetcher *readme.Fetcher // README fetcher for repo pages
212
}
213
214
// initATProtoResolver initializes the name resolution middleware
···
235
// Copy shared services from globals into the instance
236
// This avoids accessing globals during request handling
237
return &NamespaceResolver{
238
-
Namespace: ns,
239
-
defaultHoldDID: defaultHoldDID,
240
-
baseURL: baseURL,
241
-
testMode: testMode,
242
-
refresher: globalRefresher,
243
-
database: globalDatabase,
244
-
authorizer: globalAuthorizer,
245
-
validationCache: newValidationCache(),
246
-
readmeFetcher: readme.NewFetcher(),
247
}, nil
248
-
}
249
-
250
-
// authErrorMessage creates a user-friendly auth error with login URL
251
-
func (nr *NamespaceResolver) authErrorMessage(message string) error {
252
-
loginURL := fmt.Sprintf("%s/auth/oauth/login", nr.baseURL)
253
-
fullMessage := fmt.Sprintf("%s - please re-authenticate at %s", message, loginURL)
254
-
return errcode.ErrorCodeUnauthorized.WithMessage(fullMessage)
255
}
256
257
// Repository resolves the repository name and delegates to underlying namespace
···
287
}
288
ctx = context.WithValue(ctx, holdDIDKey, holdDID)
289
290
-
// Auto-reconcile crew membership on first push/pull
291
-
// This ensures users can push immediately after docker login without web sign-in
292
-
// EnsureCrewMembership is best-effort and logs errors without failing the request
293
-
// Run in background to avoid blocking registry operations if hold is offline
294
-
if holdDID != "" && nr.refresher != nil {
295
-
slog.Debug("Auto-reconciling crew membership", "component", "registry/middleware", "did", did, "hold_did", holdDID)
296
-
client := atproto.NewClient(pdsEndpoint, did, "")
297
-
go func(ctx context.Context, client *atproto.Client, refresher *oauth.Refresher, holdDID string) {
298
-
storage.EnsureCrewMembership(ctx, client, refresher, holdDID)
299
-
}(ctx, client, nr.refresher, holdDID)
300
-
}
301
-
302
-
// Get service token for hold authentication (only if authenticated)
303
-
// Use validation cache to prevent concurrent requests from racing on OAuth/DPoP
304
-
// Route based on auth method from JWT token
305
-
var serviceToken string
306
-
authMethod, _ := ctx.Value(authMethodKey).(string)
307
-
308
-
// Only fetch service token if user is authenticated
309
-
// Unauthenticated requests (like /v2/ ping) should not trigger token fetching
310
-
if authMethod != "" {
311
-
// Create cache key: "did:holdDID"
312
-
cacheKey := fmt.Sprintf("%s:%s", did, holdDID)
313
-
314
-
// Fetch service token through validation cache
315
-
// This ensures only ONE request per DID:holdDID pair fetches the token
316
-
// Concurrent requests will wait for the first request to complete
317
-
var fetchErr error
318
-
serviceToken, fetchErr = nr.validationCache.getOrFetch(ctx, cacheKey, func() (string, error) {
319
-
if authMethod == token.AuthMethodAppPassword {
320
-
// App-password flow: use Bearer token authentication
321
-
slog.Debug("Using app-password flow for service token",
322
-
"component", "registry/middleware",
323
-
"did", did,
324
-
"cacheKey", cacheKey)
325
-
326
-
token, err := token.GetOrFetchServiceTokenWithAppPassword(ctx, did, holdDID, pdsEndpoint)
327
-
if err != nil {
328
-
slog.Error("Failed to get service token with app-password",
329
-
"component", "registry/middleware",
330
-
"did", did,
331
-
"holdDID", holdDID,
332
-
"pdsEndpoint", pdsEndpoint,
333
-
"error", err)
334
-
return "", err
335
-
}
336
-
return token, nil
337
-
} else if nr.refresher != nil {
338
-
// OAuth flow: use DPoP authentication
339
-
slog.Debug("Using OAuth flow for service token",
340
-
"component", "registry/middleware",
341
-
"did", did,
342
-
"cacheKey", cacheKey)
343
-
344
-
token, err := token.GetOrFetchServiceToken(ctx, nr.refresher, did, holdDID, pdsEndpoint)
345
-
if err != nil {
346
-
slog.Error("Failed to get service token with OAuth",
347
-
"component", "registry/middleware",
348
-
"did", did,
349
-
"holdDID", holdDID,
350
-
"pdsEndpoint", pdsEndpoint,
351
-
"error", err)
352
-
return "", err
353
-
}
354
-
return token, nil
355
-
}
356
-
return "", fmt.Errorf("no authentication method available")
357
-
})
358
-
359
-
// Handle errors from cached fetch
360
-
if fetchErr != nil {
361
-
errMsg := fetchErr.Error()
362
-
363
-
// Check for app-password specific errors
364
-
if authMethod == token.AuthMethodAppPassword {
365
-
if strings.Contains(errMsg, "expired or invalid") || strings.Contains(errMsg, "no app-password") {
366
-
return nil, nr.authErrorMessage("App-password authentication failed. Please re-authenticate with: docker login")
367
-
}
368
-
}
369
-
370
-
// Check for OAuth specific errors
371
-
if strings.Contains(errMsg, "OAuth session") || strings.Contains(errMsg, "OAuth validation") {
372
-
return nil, nr.authErrorMessage("OAuth session expired or invalidated by PDS. Your session has been cleared")
373
-
}
374
-
375
-
// Generic service token error
376
-
return nil, nr.authErrorMessage(fmt.Sprintf("Failed to obtain storage credentials: %v", fetchErr))
377
-
}
378
-
} else {
379
-
slog.Debug("Skipping service token fetch for unauthenticated request",
380
-
"component", "registry/middleware",
381
-
"did", did)
382
-
}
383
384
// Create a new reference with identity/image format
385
// Use the identity (or DID) as the namespace to ensure canonical format
···
396
return nil, err
397
}
398
399
-
// Get access token for PDS operations
400
-
// Use auth method from JWT to determine client type:
401
-
// - OAuth users: use session provider (DPoP-enabled)
402
-
// - App-password users: use Basic Auth token cache
403
-
var atprotoClient *atproto.Client
404
-
405
-
if authMethod == token.AuthMethodOAuth && nr.refresher != nil {
406
-
// OAuth flow: use session provider for locked OAuth sessions
407
-
// This prevents DPoP nonce race conditions during concurrent layer uploads
408
-
slog.Debug("Creating ATProto client with OAuth session provider",
409
-
"component", "registry/middleware",
410
-
"did", did,
411
-
"authMethod", authMethod)
412
-
atprotoClient = atproto.NewClientWithSessionProvider(pdsEndpoint, did, nr.refresher)
413
-
} else {
414
-
// App-password flow (or fallback): use Basic Auth token cache
415
-
accessToken, ok := auth.GetGlobalTokenCache().Get(did)
416
-
if !ok {
417
-
slog.Debug("No cached access token found for app-password auth",
418
-
"component", "registry/middleware",
419
-
"did", did,
420
-
"authMethod", authMethod)
421
-
accessToken = "" // Will fail on manifest push, but let it try
422
-
} else {
423
-
slog.Debug("Creating ATProto client with app-password",
424
-
"component", "registry/middleware",
425
-
"did", did,
426
-
"authMethod", authMethod,
427
-
"token_length", len(accessToken))
428
-
}
429
-
atprotoClient = atproto.NewClient(pdsEndpoint, did, accessToken)
430
-
}
431
-
432
// IMPORTANT: Use only the image name (not identity/image) for ATProto storage
433
// ATProto records are scoped to the user's DID, so we don't need the identity prefix
434
// Example: "evan.jarrett.net/debian" -> store as "debian"
435
repositoryName := imageName
436
437
-
// Default auth method to OAuth if not already set (backward compatibility with old tokens)
438
-
if authMethod == "" {
439
-
authMethod = token.AuthMethodOAuth
440
}
441
442
// Create routing repository - routes manifests to ATProto, blobs to hold service
443
// The registry is stateless - no local storage is used
444
-
// Bundle all context into a single RegistryContext struct
445
//
446
// NOTE: We create a fresh RoutingRepository on every request (no caching) because:
447
// 1. Each layer upload is a separate HTTP request (possibly different process)
448
// 2. OAuth sessions can be refreshed/invalidated between requests
449
// 3. The refresher already caches sessions efficiently (in-memory + DB)
450
-
// 4. Caching the repository with a stale ATProtoClient causes refresh token errors
451
-
registryCtx := &storage.RegistryContext{
452
-
DID: did,
453
-
Handle: handle,
454
-
HoldDID: holdDID,
455
-
PDSEndpoint: pdsEndpoint,
456
-
Repository: repositoryName,
457
-
ServiceToken: serviceToken, // Cached service token from middleware validation
458
-
ATProtoClient: atprotoClient,
459
-
AuthMethod: authMethod, // Auth method from JWT token
460
-
Database: nr.database,
461
-
Authorizer: nr.authorizer,
462
-
Refresher: nr.refresher,
463
-
ReadmeFetcher: nr.readmeFetcher,
464
-
}
465
-
466
-
return storage.NewRoutingRepository(repo, registryCtx), nil
467
}
468
469
// Repositories delegates to underlying namespace
···
498
}
499
500
if profile != nil && profile.DefaultHold != "" {
501
-
// Profile exists with defaultHold set
502
-
// In test mode, verify it's reachable before using it
503
if nr.testMode {
504
if nr.isHoldReachable(ctx, profile.DefaultHold) {
505
return profile.DefaultHold
···
533
return false
534
}
535
536
-
// ExtractAuthMethod is an HTTP middleware that extracts the auth method from the JWT Authorization header
537
-
// and stores it in the request context for later use by the registry middleware
538
func ExtractAuthMethod(next http.Handler) http.Handler {
539
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
540
// Extract Authorization header
541
authHeader := r.Header.Get("Authorization")
542
if authHeader != "" {
···
549
authMethod := token.ExtractAuthMethod(tokenString)
550
if authMethod != "" {
551
// Store in context for registry middleware
552
-
ctx := context.WithValue(r.Context(), authMethodKey, authMethod)
553
-
r = r.WithContext(ctx)
554
-
slog.Debug("Extracted auth method from JWT",
555
-
"component", "registry/middleware",
556
-
"authMethod", authMethod)
557
}
558
}
559
}
560
561
next.ServeHTTP(w, r)
562
})
563
}
···
2
3
import (
4
"context"
5
+
"database/sql"
6
"fmt"
7
"log/slog"
8
"net/http"
9
"strings"
10
11
"github.com/distribution/distribution/v3"
12
registrymw "github.com/distribution/distribution/v3/registry/middleware/registry"
13
"github.com/distribution/distribution/v3/registry/storage/driver"
14
"github.com/distribution/reference"
15
16
"atcr.io/pkg/appview/storage"
17
"atcr.io/pkg/atproto"
18
"atcr.io/pkg/auth"
···
26
// authMethodKey is the context key for storing auth method from JWT
27
const authMethodKey contextKey = "auth.method"
28
29
+
// pullerDIDKey is the context key for storing the authenticated user's DID from JWT
30
+
const pullerDIDKey contextKey = "puller.did"
31
32
// Global variables for initialization only
33
// These are set by main.go during startup and copied into NamespaceResolver instances.
34
// After initialization, request handling uses the NamespaceResolver's instance fields.
35
var (
36
globalRefresher *oauth.Refresher
37
+
globalDatabase *sql.DB
38
globalAuthorizer auth.HoldAuthorizer
39
)
40
···
46
47
// SetGlobalDatabase sets the database instance during initialization
48
// Must be called before the registry starts serving requests
49
+
func SetGlobalDatabase(database *sql.DB) {
50
globalDatabase = database
51
}
52
···
64
// NamespaceResolver wraps a namespace and resolves names
65
type NamespaceResolver struct {
66
distribution.Namespace
67
+
defaultHoldDID string // Default hold DID (e.g., "did:web:hold01.atcr.io")
68
+
baseURL string // Base URL for error messages (e.g., "https://atcr.io")
69
+
testMode bool // If true, fallback to default hold when user's hold is unreachable
70
+
refresher *oauth.Refresher // OAuth session manager (copied from global on init)
71
+
sqlDB *sql.DB // Database for hold DID lookup and metrics (copied from global on init)
72
+
authorizer auth.HoldAuthorizer // Hold authorization (copied from global on init)
73
}
74
75
// initATProtoResolver initializes the name resolution middleware
···
96
// Copy shared services from globals into the instance
97
// This avoids accessing globals during request handling
98
return &NamespaceResolver{
99
+
Namespace: ns,
100
+
defaultHoldDID: defaultHoldDID,
101
+
baseURL: baseURL,
102
+
testMode: testMode,
103
+
refresher: globalRefresher,
104
+
sqlDB: globalDatabase,
105
+
authorizer: globalAuthorizer,
106
}, nil
107
}
108
109
// Repository resolves the repository name and delegates to underlying namespace
···
139
}
140
ctx = context.WithValue(ctx, holdDIDKey, holdDID)
141
142
+
// Note: Profile and crew membership are now ensured in UserContextMiddleware
143
+
// via EnsureUserSetup() - no need to call here
144
145
// Create a new reference with identity/image format
146
// Use the identity (or DID) as the namespace to ensure canonical format
···
157
return nil, err
158
}
159
160
// IMPORTANT: Use only the image name (not identity/image) for ATProto storage
161
// ATProto records are scoped to the user's DID, so we don't need the identity prefix
162
// Example: "evan.jarrett.net/debian" -> store as "debian"
163
repositoryName := imageName
164
165
+
// Get UserContext from request context (set by UserContextMiddleware)
166
+
userCtx := auth.FromContext(ctx)
167
+
if userCtx == nil {
168
+
return nil, fmt.Errorf("UserContext not set in request context - ensure UserContextMiddleware is configured")
169
}
170
171
+
// Set target repository info on UserContext
172
+
// ATProtoClient is cached lazily via userCtx.GetATProtoClient()
173
+
userCtx.SetTarget(did, handle, pdsEndpoint, repositoryName, holdDID)
174
+
175
// Create routing repository - routes manifests to ATProto, blobs to hold service
176
// The registry is stateless - no local storage is used
177
//
178
// NOTE: We create a fresh RoutingRepository on every request (no caching) because:
179
// 1. Each layer upload is a separate HTTP request (possibly different process)
180
// 2. OAuth sessions can be refreshed/invalidated between requests
181
// 3. The refresher already caches sessions efficiently (in-memory + DB)
182
+
// 4. ATProtoClient is now cached in UserContext via GetATProtoClient()
183
+
return storage.NewRoutingRepository(repo, userCtx, nr.sqlDB), nil
184
}
185
186
// Repositories delegates to underlying namespace
···
215
}
216
217
if profile != nil && profile.DefaultHold != "" {
218
+
// In test mode, verify the hold is reachable (fall back to default if not)
219
+
// In production, trust the user's profile and return their hold
220
if nr.testMode {
221
if nr.isHoldReachable(ctx, profile.DefaultHold) {
222
return profile.DefaultHold
···
250
return false
251
}
252
253
+
// ExtractAuthMethod is an HTTP middleware that extracts the auth method and puller DID from the JWT Authorization header
254
+
// and stores them in the request context for later use by the registry middleware.
255
+
// Also stores the HTTP method for routing decisions (GET/HEAD = pull, PUT/POST = push).
256
func ExtractAuthMethod(next http.Handler) http.Handler {
257
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
258
+
ctx := r.Context()
259
+
260
+
// Store HTTP method in context for routing decisions
261
+
// This is used by routing_repository.go to distinguish pull (GET/HEAD) from push (PUT/POST)
262
+
ctx = context.WithValue(ctx, "http.request.method", r.Method)
263
+
264
// Extract Authorization header
265
authHeader := r.Header.Get("Authorization")
266
if authHeader != "" {
···
273
authMethod := token.ExtractAuthMethod(tokenString)
274
if authMethod != "" {
275
// Store in context for registry middleware
276
+
ctx = context.WithValue(ctx, authMethodKey, authMethod)
277
+
}
278
+
279
+
// Extract puller DID (Subject) from JWT
280
+
// This is the authenticated user's DID, used for service token requests
281
+
pullerDID := token.ExtractSubject(tokenString)
282
+
if pullerDID != "" {
283
+
ctx = context.WithValue(ctx, pullerDIDKey, pullerDID)
284
}
285
+
286
+
slog.Debug("Extracted auth info from JWT",
287
+
"component", "registry/middleware",
288
+
"authMethod", authMethod,
289
+
"pullerDID", pullerDID,
290
+
"httpMethod", r.Method)
291
}
292
}
293
294
+
r = r.WithContext(ctx)
295
next.ServeHTTP(w, r)
296
})
297
}
298
+
299
+
// UserContextMiddleware creates a UserContext from the extracted JWT claims
300
+
// and stores it in the request context for use throughout request processing.
301
+
// This middleware should be chained AFTER ExtractAuthMethod.
302
+
func UserContextMiddleware(deps *auth.Dependencies) func(http.Handler) http.Handler {
303
+
return func(next http.Handler) http.Handler {
304
+
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
305
+
ctx := r.Context()
306
+
307
+
// Get values set by ExtractAuthMethod
308
+
authMethod, _ := ctx.Value(authMethodKey).(string)
309
+
pullerDID, _ := ctx.Value(pullerDIDKey).(string)
310
+
311
+
// Build UserContext with all dependencies
312
+
userCtx := auth.NewUserContext(pullerDID, authMethod, r.Method, deps)
313
+
314
+
// Eagerly resolve user's PDS for authenticated users
315
+
// This is a fast path that avoids lazy loading in most cases
316
+
if userCtx.IsAuthenticated {
317
+
if err := userCtx.ResolvePDS(ctx); err != nil {
318
+
slog.Warn("Failed to resolve puller's PDS",
319
+
"component", "registry/middleware",
320
+
"did", pullerDID,
321
+
"error", err)
322
+
// Continue without PDS - will fail on service token request
323
+
}
324
+
325
+
// Ensure user has profile and crew membership (runs in background, cached)
326
+
userCtx.EnsureUserSetup()
327
+
}
328
+
329
+
// Store UserContext in request context
330
+
ctx = auth.WithUserContext(ctx, userCtx)
331
+
r = r.WithContext(ctx)
332
+
333
+
slog.Debug("Created UserContext",
334
+
"component", "registry/middleware",
335
+
"isAuthenticated", userCtx.IsAuthenticated,
336
+
"authMethod", userCtx.AuthMethod,
337
+
"action", userCtx.Action.String(),
338
+
"pullerDID", pullerDID)
339
+
340
+
next.ServeHTTP(w, r)
341
+
})
342
+
}
343
+
}
-11
pkg/appview/middleware/registry_test.go
-11
pkg/appview/middleware/registry_test.go
···
129
}
130
}
131
132
-
// TestAuthErrorMessage tests the error message formatting
133
-
func TestAuthErrorMessage(t *testing.T) {
134
-
resolver := &NamespaceResolver{
135
-
baseURL: "https://atcr.io",
136
-
}
137
-
138
-
err := resolver.authErrorMessage("OAuth session expired")
139
-
assert.Contains(t, err.Error(), "OAuth session expired")
140
-
assert.Contains(t, err.Error(), "https://atcr.io/auth/oauth/login")
141
-
}
142
-
143
// TestFindHoldDID_DefaultFallback tests default hold DID fallback
144
func TestFindHoldDID_DefaultFallback(t *testing.T) {
145
// Start a mock PDS server that returns 404 for profile and empty list for holds
+23
-14
pkg/appview/routes/routes.go
+23
-14
pkg/appview/routes/routes.go
···
29
HealthChecker *holdhealth.Checker
30
ReadmeFetcher *readme.Fetcher
31
Templates *template.Template
32
}
33
34
// RegisterUIRoutes registers all web UI and API routes on the provided router
···
36
// Extract trimmed registry URL for templates
37
registryURL := trimRegistryURL(deps.BaseURL)
38
39
// OAuth login routes (public)
40
router.Get("/auth/oauth/login", (&uihandlers.LoginHandler{
41
Templates: deps.Templates,
···
45
46
// Public routes (with optional auth for navbar)
47
// SECURITY: Public pages use read-only DB
48
-
router.Get("/", middleware.OptionalAuth(deps.SessionStore, deps.Database)(
49
&uihandlers.HomeHandler{
50
DB: deps.ReadOnlyDB,
51
Templates: deps.Templates,
···
53
},
54
).ServeHTTP)
55
56
-
router.Get("/api/recent-pushes", middleware.OptionalAuth(deps.SessionStore, deps.Database)(
57
&uihandlers.RecentPushesHandler{
58
DB: deps.ReadOnlyDB,
59
Templates: deps.Templates,
···
63
).ServeHTTP)
64
65
// SECURITY: Search uses read-only DB to prevent writes and limit access to sensitive tables
66
-
router.Get("/search", middleware.OptionalAuth(deps.SessionStore, deps.Database)(
67
&uihandlers.SearchHandler{
68
DB: deps.ReadOnlyDB,
69
Templates: deps.Templates,
···
71
},
72
).ServeHTTP)
73
74
-
router.Get("/api/search-results", middleware.OptionalAuth(deps.SessionStore, deps.Database)(
75
&uihandlers.SearchResultsHandler{
76
DB: deps.ReadOnlyDB,
77
Templates: deps.Templates,
···
80
).ServeHTTP)
81
82
// Install page (public)
83
-
router.Get("/install", middleware.OptionalAuth(deps.SessionStore, deps.Database)(
84
&uihandlers.InstallHandler{
85
Templates: deps.Templates,
86
RegistryURL: registryURL,
···
88
).ServeHTTP)
89
90
// API route for repository stats (public, read-only)
91
-
router.Get("/api/stats/{handle}/{repository}", middleware.OptionalAuth(deps.SessionStore, deps.Database)(
92
&uihandlers.GetStatsHandler{
93
DB: deps.ReadOnlyDB,
94
Directory: deps.OAuthClientApp.Dir,
···
96
).ServeHTTP)
97
98
// API routes for stars (require authentication)
99
-
router.Post("/api/stars/{handle}/{repository}", middleware.RequireAuth(deps.SessionStore, deps.Database)(
100
&uihandlers.StarRepositoryHandler{
101
DB: deps.Database, // Needs write access
102
Directory: deps.OAuthClientApp.Dir,
···
104
},
105
).ServeHTTP)
106
107
-
router.Delete("/api/stars/{handle}/{repository}", middleware.RequireAuth(deps.SessionStore, deps.Database)(
108
&uihandlers.UnstarRepositoryHandler{
109
DB: deps.Database, // Needs write access
110
Directory: deps.OAuthClientApp.Dir,
···
112
},
113
).ServeHTTP)
114
115
-
router.Get("/api/stars/{handle}/{repository}", middleware.OptionalAuth(deps.SessionStore, deps.Database)(
116
&uihandlers.CheckStarHandler{
117
DB: deps.ReadOnlyDB, // Read-only check
118
Directory: deps.OAuthClientApp.Dir,
···
121
).ServeHTTP)
122
123
// Manifest detail API endpoint
124
-
router.Get("/api/manifests/{handle}/{repository}/{digest}", middleware.OptionalAuth(deps.SessionStore, deps.Database)(
125
&uihandlers.ManifestDetailHandler{
126
DB: deps.ReadOnlyDB,
127
Directory: deps.OAuthClientApp.Dir,
···
133
HealthChecker: deps.HealthChecker,
134
}).ServeHTTP)
135
136
-
router.Get("/u/{handle}", middleware.OptionalAuth(deps.SessionStore, deps.Database)(
137
&uihandlers.UserPageHandler{
138
DB: deps.ReadOnlyDB,
139
Templates: deps.Templates,
···
152
DB: deps.ReadOnlyDB,
153
}).ServeHTTP)
154
155
-
router.Get("/r/{handle}/{repository}", middleware.OptionalAuth(deps.SessionStore, deps.Database)(
156
&uihandlers.RepositoryPageHandler{
157
DB: deps.ReadOnlyDB,
158
Templates: deps.Templates,
···
166
167
// Authenticated routes
168
router.Group(func(r chi.Router) {
169
-
r.Use(middleware.RequireAuth(deps.SessionStore, deps.Database))
170
171
r.Get("/settings", (&uihandlers.SettingsHandler{
172
Templates: deps.Templates,
···
226
router.Post("/auth/logout", logoutHandler.ServeHTTP)
227
228
// Custom 404 handler
229
-
router.NotFound(middleware.OptionalAuth(deps.SessionStore, deps.Database)(
230
&uihandlers.NotFoundHandler{
231
Templates: deps.Templates,
232
RegistryURL: registryURL,
···
29
HealthChecker *holdhealth.Checker
30
ReadmeFetcher *readme.Fetcher
31
Templates *template.Template
32
+
DefaultHoldDID string // For UserContext creation
33
}
34
35
// RegisterUIRoutes registers all web UI and API routes on the provided router
···
37
// Extract trimmed registry URL for templates
38
registryURL := trimRegistryURL(deps.BaseURL)
39
40
+
// Create web auth dependencies for middleware (enables UserContext in web routes)
41
+
webAuthDeps := middleware.WebAuthDeps{
42
+
SessionStore: deps.SessionStore,
43
+
Database: deps.Database,
44
+
Refresher: deps.Refresher,
45
+
DefaultHoldDID: deps.DefaultHoldDID,
46
+
}
47
+
48
// OAuth login routes (public)
49
router.Get("/auth/oauth/login", (&uihandlers.LoginHandler{
50
Templates: deps.Templates,
···
54
55
// Public routes (with optional auth for navbar)
56
// SECURITY: Public pages use read-only DB
57
+
router.Get("/", middleware.OptionalAuthWithDeps(webAuthDeps)(
58
&uihandlers.HomeHandler{
59
DB: deps.ReadOnlyDB,
60
Templates: deps.Templates,
···
62
},
63
).ServeHTTP)
64
65
+
router.Get("/api/recent-pushes", middleware.OptionalAuthWithDeps(webAuthDeps)(
66
&uihandlers.RecentPushesHandler{
67
DB: deps.ReadOnlyDB,
68
Templates: deps.Templates,
···
72
).ServeHTTP)
73
74
// SECURITY: Search uses read-only DB to prevent writes and limit access to sensitive tables
75
+
router.Get("/search", middleware.OptionalAuthWithDeps(webAuthDeps)(
76
&uihandlers.SearchHandler{
77
DB: deps.ReadOnlyDB,
78
Templates: deps.Templates,
···
80
},
81
).ServeHTTP)
82
83
+
router.Get("/api/search-results", middleware.OptionalAuthWithDeps(webAuthDeps)(
84
&uihandlers.SearchResultsHandler{
85
DB: deps.ReadOnlyDB,
86
Templates: deps.Templates,
···
89
).ServeHTTP)
90
91
// Install page (public)
92
+
router.Get("/install", middleware.OptionalAuthWithDeps(webAuthDeps)(
93
&uihandlers.InstallHandler{
94
Templates: deps.Templates,
95
RegistryURL: registryURL,
···
97
).ServeHTTP)
98
99
// API route for repository stats (public, read-only)
100
+
router.Get("/api/stats/{handle}/{repository}", middleware.OptionalAuthWithDeps(webAuthDeps)(
101
&uihandlers.GetStatsHandler{
102
DB: deps.ReadOnlyDB,
103
Directory: deps.OAuthClientApp.Dir,
···
105
).ServeHTTP)
106
107
// API routes for stars (require authentication)
108
+
router.Post("/api/stars/{handle}/{repository}", middleware.RequireAuthWithDeps(webAuthDeps)(
109
&uihandlers.StarRepositoryHandler{
110
DB: deps.Database, // Needs write access
111
Directory: deps.OAuthClientApp.Dir,
···
113
},
114
).ServeHTTP)
115
116
+
router.Delete("/api/stars/{handle}/{repository}", middleware.RequireAuthWithDeps(webAuthDeps)(
117
&uihandlers.UnstarRepositoryHandler{
118
DB: deps.Database, // Needs write access
119
Directory: deps.OAuthClientApp.Dir,
···
121
},
122
).ServeHTTP)
123
124
+
router.Get("/api/stars/{handle}/{repository}", middleware.OptionalAuthWithDeps(webAuthDeps)(
125
&uihandlers.CheckStarHandler{
126
DB: deps.ReadOnlyDB, // Read-only check
127
Directory: deps.OAuthClientApp.Dir,
···
130
).ServeHTTP)
131
132
// Manifest detail API endpoint
133
+
router.Get("/api/manifests/{handle}/{repository}/{digest}", middleware.OptionalAuthWithDeps(webAuthDeps)(
134
&uihandlers.ManifestDetailHandler{
135
DB: deps.ReadOnlyDB,
136
Directory: deps.OAuthClientApp.Dir,
···
142
HealthChecker: deps.HealthChecker,
143
}).ServeHTTP)
144
145
+
router.Get("/u/{handle}", middleware.OptionalAuthWithDeps(webAuthDeps)(
146
&uihandlers.UserPageHandler{
147
DB: deps.ReadOnlyDB,
148
Templates: deps.Templates,
···
161
DB: deps.ReadOnlyDB,
162
}).ServeHTTP)
163
164
+
router.Get("/r/{handle}/{repository}", middleware.OptionalAuthWithDeps(webAuthDeps)(
165
&uihandlers.RepositoryPageHandler{
166
DB: deps.ReadOnlyDB,
167
Templates: deps.Templates,
···
175
176
// Authenticated routes
177
router.Group(func(r chi.Router) {
178
+
r.Use(middleware.RequireAuthWithDeps(webAuthDeps))
179
180
r.Get("/settings", (&uihandlers.SettingsHandler{
181
Templates: deps.Templates,
···
235
router.Post("/auth/logout", logoutHandler.ServeHTTP)
236
237
// Custom 404 handler
238
+
router.NotFound(middleware.OptionalAuthWithDeps(webAuthDeps)(
239
&uihandlers.NotFoundHandler{
240
Templates: deps.Templates,
241
RegistryURL: registryURL,
-35
pkg/appview/storage/context.go
-35
pkg/appview/storage/context.go
···
1
-
package storage
2
-
3
-
import (
4
-
"atcr.io/pkg/appview/readme"
5
-
"atcr.io/pkg/atproto"
6
-
"atcr.io/pkg/auth"
7
-
"atcr.io/pkg/auth/oauth"
8
-
)
9
-
10
-
// DatabaseMetrics interface for tracking pull/push counts and querying hold DIDs
11
-
type DatabaseMetrics interface {
12
-
IncrementPullCount(did, repository string) error
13
-
IncrementPushCount(did, repository string) error
14
-
GetLatestHoldDIDForRepo(did, repository string) (string, error)
15
-
}
16
-
17
-
// RegistryContext bundles all the context needed for registry operations
18
-
// This includes both per-request data (DID, hold) and shared services
19
-
type RegistryContext struct {
20
-
// Per-request identity and routing information
21
-
DID string // User's DID (e.g., "did:plc:abc123")
22
-
Handle string // User's handle (e.g., "alice.bsky.social")
23
-
HoldDID string // Hold service DID (e.g., "did:web:hold01.atcr.io")
24
-
PDSEndpoint string // User's PDS endpoint URL
25
-
Repository string // Image repository name (e.g., "debian")
26
-
ServiceToken string // Service token for hold authentication (cached by middleware)
27
-
ATProtoClient *atproto.Client // Authenticated ATProto client for this user
28
-
AuthMethod string // Auth method used ("oauth" or "app_password")
29
-
30
-
// Shared services (same for all requests)
31
-
Database DatabaseMetrics // Metrics tracking database
32
-
Authorizer auth.HoldAuthorizer // Hold access authorization
33
-
Refresher *oauth.Refresher // OAuth session manager
34
-
ReadmeFetcher *readme.Fetcher // README fetcher for repo pages
35
-
}
···
-113
pkg/appview/storage/context_test.go
-113
pkg/appview/storage/context_test.go
···
1
-
package storage
2
-
3
-
import (
4
-
"sync"
5
-
"testing"
6
-
7
-
"atcr.io/pkg/atproto"
8
-
)
9
-
10
-
// Mock implementations for testing
11
-
type mockDatabaseMetrics struct {
12
-
mu sync.Mutex
13
-
pullCount int
14
-
pushCount int
15
-
}
16
-
17
-
func (m *mockDatabaseMetrics) IncrementPullCount(did, repository string) error {
18
-
m.mu.Lock()
19
-
defer m.mu.Unlock()
20
-
m.pullCount++
21
-
return nil
22
-
}
23
-
24
-
func (m *mockDatabaseMetrics) IncrementPushCount(did, repository string) error {
25
-
m.mu.Lock()
26
-
defer m.mu.Unlock()
27
-
m.pushCount++
28
-
return nil
29
-
}
30
-
31
-
func (m *mockDatabaseMetrics) GetLatestHoldDIDForRepo(did, repository string) (string, error) {
32
-
// Return empty string for mock - tests can override if needed
33
-
return "", nil
34
-
}
35
-
36
-
func (m *mockDatabaseMetrics) getPullCount() int {
37
-
m.mu.Lock()
38
-
defer m.mu.Unlock()
39
-
return m.pullCount
40
-
}
41
-
42
-
func (m *mockDatabaseMetrics) getPushCount() int {
43
-
m.mu.Lock()
44
-
defer m.mu.Unlock()
45
-
return m.pushCount
46
-
}
47
-
48
-
type mockHoldAuthorizer struct{}
49
-
50
-
func (m *mockHoldAuthorizer) Authorize(holdDID, userDID, permission string) (bool, error) {
51
-
return true, nil
52
-
}
53
-
54
-
func TestRegistryContext_Fields(t *testing.T) {
55
-
// Create a sample RegistryContext
56
-
ctx := &RegistryContext{
57
-
DID: "did:plc:test123",
58
-
Handle: "alice.bsky.social",
59
-
HoldDID: "did:web:hold01.atcr.io",
60
-
PDSEndpoint: "https://bsky.social",
61
-
Repository: "debian",
62
-
ServiceToken: "test-token",
63
-
ATProtoClient: &atproto.Client{
64
-
// Mock client - would need proper initialization in real tests
65
-
},
66
-
Database: &mockDatabaseMetrics{},
67
-
}
68
-
69
-
// Verify fields are accessible
70
-
if ctx.DID != "did:plc:test123" {
71
-
t.Errorf("Expected DID %q, got %q", "did:plc:test123", ctx.DID)
72
-
}
73
-
if ctx.Handle != "alice.bsky.social" {
74
-
t.Errorf("Expected Handle %q, got %q", "alice.bsky.social", ctx.Handle)
75
-
}
76
-
if ctx.HoldDID != "did:web:hold01.atcr.io" {
77
-
t.Errorf("Expected HoldDID %q, got %q", "did:web:hold01.atcr.io", ctx.HoldDID)
78
-
}
79
-
if ctx.PDSEndpoint != "https://bsky.social" {
80
-
t.Errorf("Expected PDSEndpoint %q, got %q", "https://bsky.social", ctx.PDSEndpoint)
81
-
}
82
-
if ctx.Repository != "debian" {
83
-
t.Errorf("Expected Repository %q, got %q", "debian", ctx.Repository)
84
-
}
85
-
if ctx.ServiceToken != "test-token" {
86
-
t.Errorf("Expected ServiceToken %q, got %q", "test-token", ctx.ServiceToken)
87
-
}
88
-
}
89
-
90
-
func TestRegistryContext_DatabaseInterface(t *testing.T) {
91
-
db := &mockDatabaseMetrics{}
92
-
ctx := &RegistryContext{
93
-
Database: db,
94
-
}
95
-
96
-
// Test that interface methods are callable
97
-
err := ctx.Database.IncrementPullCount("did:plc:test", "repo")
98
-
if err != nil {
99
-
t.Errorf("Unexpected error: %v", err)
100
-
}
101
-
102
-
err = ctx.Database.IncrementPushCount("did:plc:test", "repo")
103
-
if err != nil {
104
-
t.Errorf("Unexpected error: %v", err)
105
-
}
106
-
}
107
-
108
-
// TODO: Add more comprehensive tests:
109
-
// - Test ATProtoClient integration
110
-
// - Test OAuth Refresher integration
111
-
// - Test HoldAuthorizer integration
112
-
// - Test nil handling for optional fields
113
-
// - Integration tests with real components
···
-93
pkg/appview/storage/crew.go
-93
pkg/appview/storage/crew.go
···
1
-
package storage
2
-
3
-
import (
4
-
"context"
5
-
"fmt"
6
-
"io"
7
-
"log/slog"
8
-
"net/http"
9
-
"time"
10
-
11
-
"atcr.io/pkg/atproto"
12
-
"atcr.io/pkg/auth/oauth"
13
-
"atcr.io/pkg/auth/token"
14
-
)
15
-
16
-
// EnsureCrewMembership attempts to register the user as a crew member on their default hold.
17
-
// The hold's requestCrew endpoint handles all authorization logic (checking allowAllCrew, existing membership, etc).
18
-
// This is best-effort and does not fail on errors.
19
-
func EnsureCrewMembership(ctx context.Context, client *atproto.Client, refresher *oauth.Refresher, defaultHoldDID string) {
20
-
if defaultHoldDID == "" {
21
-
return
22
-
}
23
-
24
-
// Normalize URL to DID if needed
25
-
holdDID := atproto.ResolveHoldDIDFromURL(defaultHoldDID)
26
-
if holdDID == "" {
27
-
slog.Warn("failed to resolve hold DID", "defaultHold", defaultHoldDID)
28
-
return
29
-
}
30
-
31
-
// Resolve hold DID to HTTP endpoint
32
-
holdEndpoint := atproto.ResolveHoldURL(holdDID)
33
-
34
-
// Get service token for the hold
35
-
// Only works with OAuth (refresher required) - app passwords can't get service tokens
36
-
if refresher == nil {
37
-
slog.Debug("skipping crew registration - no OAuth refresher (app password flow)", "holdDID", holdDID)
38
-
return
39
-
}
40
-
41
-
// Wrap the refresher to match OAuthSessionRefresher interface
42
-
serviceToken, err := token.GetOrFetchServiceToken(ctx, refresher, client.DID(), holdDID, client.PDSEndpoint())
43
-
if err != nil {
44
-
slog.Warn("failed to get service token", "holdDID", holdDID, "error", err)
45
-
return
46
-
}
47
-
48
-
// Call requestCrew endpoint - it handles all the logic:
49
-
// - Checks allowAllCrew flag
50
-
// - Checks if already a crew member (returns success if so)
51
-
// - Creates crew record if authorized
52
-
if err := requestCrewMembership(ctx, holdEndpoint, serviceToken); err != nil {
53
-
slog.Warn("failed to request crew membership", "holdDID", holdDID, "error", err)
54
-
return
55
-
}
56
-
57
-
slog.Info("successfully registered as crew member", "holdDID", holdDID, "userDID", client.DID())
58
-
}
59
-
60
-
// requestCrewMembership calls the hold's requestCrew endpoint
61
-
// The endpoint handles all authorization and duplicate checking internally
62
-
func requestCrewMembership(ctx context.Context, holdEndpoint, serviceToken string) error {
63
-
// Add 5 second timeout to prevent hanging on offline holds
64
-
ctx, cancel := context.WithTimeout(ctx, 5*time.Second)
65
-
defer cancel()
66
-
67
-
url := fmt.Sprintf("%s%s", holdEndpoint, atproto.HoldRequestCrew)
68
-
69
-
req, err := http.NewRequestWithContext(ctx, "POST", url, nil)
70
-
if err != nil {
71
-
return err
72
-
}
73
-
74
-
req.Header.Set("Authorization", "Bearer "+serviceToken)
75
-
req.Header.Set("Content-Type", "application/json")
76
-
77
-
resp, err := http.DefaultClient.Do(req)
78
-
if err != nil {
79
-
return err
80
-
}
81
-
defer resp.Body.Close()
82
-
83
-
if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusCreated {
84
-
// Read response body to capture actual error message from hold
85
-
body, readErr := io.ReadAll(resp.Body)
86
-
if readErr != nil {
87
-
return fmt.Errorf("requestCrew failed with status %d (failed to read error body: %w)", resp.StatusCode, readErr)
88
-
}
89
-
return fmt.Errorf("requestCrew failed with status %d: %s", resp.StatusCode, string(body))
90
-
}
91
-
92
-
return nil
93
-
}
···
-14
pkg/appview/storage/crew_test.go
-14
pkg/appview/storage/crew_test.go
···
1
-
package storage
2
-
3
-
import (
4
-
"context"
5
-
"testing"
6
-
)
7
-
8
-
func TestEnsureCrewMembership_EmptyHoldDID(t *testing.T) {
9
-
// Test that empty hold DID returns early without error (best-effort function)
10
-
EnsureCrewMembership(context.Background(), nil, nil, "")
11
-
// If we get here without panic, test passes
12
-
}
13
-
14
-
// TODO: Add comprehensive tests with HTTP client mocking
···
+63
-78
pkg/appview/storage/manifest_store.go
+63
-78
pkg/appview/storage/manifest_store.go
···
3
import (
4
"bytes"
5
"context"
6
"encoding/json"
7
"errors"
8
"fmt"
9
"io"
10
"log/slog"
11
-
"maps"
12
"net/http"
13
"strings"
14
-
"sync"
15
"time"
16
17
"atcr.io/pkg/appview/readme"
18
"atcr.io/pkg/atproto"
19
"github.com/distribution/distribution/v3"
20
"github.com/opencontainers/go-digest"
21
)
···
23
// ManifestStore implements distribution.ManifestService
24
// It stores manifests in ATProto as records
25
type ManifestStore struct {
26
-
ctx *RegistryContext // Context with user/hold info
27
-
mu sync.RWMutex // Protects lastFetchedHoldDID
28
-
lastFetchedHoldDID string // Hold DID from most recently fetched manifest (for pull)
29
blobStore distribution.BlobStore // Blob store for fetching config during push
30
}
31
32
// NewManifestStore creates a new ATProto-backed manifest store
33
-
func NewManifestStore(ctx *RegistryContext, blobStore distribution.BlobStore) *ManifestStore {
34
return &ManifestStore{
35
-
ctx: ctx,
36
blobStore: blobStore,
37
}
38
}
39
40
// Exists checks if a manifest exists by digest
41
func (s *ManifestStore) Exists(ctx context.Context, dgst digest.Digest) (bool, error) {
42
rkey := digestToRKey(dgst)
43
-
_, err := s.ctx.ATProtoClient.GetRecord(ctx, atproto.ManifestCollection, rkey)
44
if err != nil {
45
// If not found, return false without error
46
if errors.Is(err, atproto.ErrRecordNotFound) {
···
54
// Get retrieves a manifest by digest
55
func (s *ManifestStore) Get(ctx context.Context, dgst digest.Digest, options ...distribution.ManifestServiceOption) (distribution.Manifest, error) {
56
rkey := digestToRKey(dgst)
57
-
record, err := s.ctx.ATProtoClient.GetRecord(ctx, atproto.ManifestCollection, rkey)
58
if err != nil {
59
return nil, distribution.ErrManifestUnknownRevision{
60
-
Name: s.ctx.Repository,
61
Revision: dgst,
62
}
63
}
···
67
return nil, fmt.Errorf("failed to unmarshal manifest record: %w", err)
68
}
69
70
-
// Store the hold DID for subsequent blob requests during pull
71
-
// Prefer HoldDID (new format) with fallback to HoldEndpoint (legacy URL format)
72
-
// The routing repository will cache this for concurrent blob fetches
73
-
s.mu.Lock()
74
-
if manifestRecord.HoldDID != "" {
75
-
// New format: DID reference (preferred)
76
-
s.lastFetchedHoldDID = manifestRecord.HoldDID
77
-
} else if manifestRecord.HoldEndpoint != "" {
78
-
// Legacy format: URL reference - convert to DID
79
-
s.lastFetchedHoldDID = atproto.ResolveHoldDIDFromURL(manifestRecord.HoldEndpoint)
80
-
}
81
-
s.mu.Unlock()
82
-
83
var ociManifest []byte
84
85
// New records: Download blob from ATProto blob storage
86
if manifestRecord.ManifestBlob != nil && manifestRecord.ManifestBlob.Ref.Link != "" {
87
-
ociManifest, err = s.ctx.ATProtoClient.GetBlob(ctx, manifestRecord.ManifestBlob.Ref.Link)
88
if err != nil {
89
return nil, fmt.Errorf("failed to download manifest blob: %w", err)
90
}
···
92
93
// Track pull count (increment asynchronously to avoid blocking the response)
94
// Only count GET requests (actual downloads), not HEAD requests (existence checks)
95
-
if s.ctx.Database != nil {
96
// Check HTTP method from context (distribution library stores it as "http.request.method")
97
if method, ok := ctx.Value("http.request.method").(string); ok && method == "GET" {
98
go func() {
99
-
if err := s.ctx.Database.IncrementPullCount(s.ctx.DID, s.ctx.Repository); err != nil {
100
-
slog.Warn("Failed to increment pull count", "did", s.ctx.DID, "repository", s.ctx.Repository, "error", err)
101
}
102
}()
103
}
···
124
dgst := digest.FromBytes(payload)
125
126
// Upload manifest as blob to PDS
127
-
blobRef, err := s.ctx.ATProtoClient.UploadBlob(ctx, payload, mediaType)
128
if err != nil {
129
return "", fmt.Errorf("failed to upload manifest blob: %w", err)
130
}
131
132
// Create manifest record with structured metadata
133
-
manifestRecord, err := atproto.NewManifestRecord(s.ctx.Repository, dgst.String(), payload)
134
if err != nil {
135
return "", fmt.Errorf("failed to create manifest record: %w", err)
136
}
137
138
// Set the blob reference, hold DID, and hold endpoint
139
manifestRecord.ManifestBlob = blobRef
140
-
manifestRecord.HoldDID = s.ctx.HoldDID // Primary reference (DID)
141
142
// Extract Dockerfile labels from config blob and add to annotations
143
// Only for image manifests (not manifest lists which don't have config blobs)
···
167
platform = fmt.Sprintf("%s/%s", ref.Platform.OS, ref.Platform.Architecture)
168
}
169
slog.Warn("Manifest list references non-existent child manifest",
170
-
"repository", s.ctx.Repository,
171
"missingDigest", ref.Digest,
172
"platform", platform)
173
return "", distribution.ErrManifestBlobUnknown{Digest: refDigest}
···
180
if err != nil {
181
// Log error but don't fail the push - labels are optional
182
slog.Warn("Failed to extract config labels", "error", err)
183
-
} else {
184
// Initialize annotations map if needed
185
if manifestRecord.Annotations == nil {
186
manifestRecord.Annotations = make(map[string]string)
187
}
188
189
-
// Copy labels to annotations (Dockerfile LABELs → manifest annotations)
190
-
maps.Copy(manifestRecord.Annotations, labels)
191
192
-
slog.Debug("Extracted labels from config blob", "count", len(labels))
193
}
194
}
195
196
// Store manifest record in ATProto
197
rkey := digestToRKey(dgst)
198
-
_, err = s.ctx.ATProtoClient.PutRecord(ctx, atproto.ManifestCollection, rkey, manifestRecord)
199
if err != nil {
200
return "", fmt.Errorf("failed to store manifest record in ATProto: %w", err)
201
}
202
203
// Track push count (increment asynchronously to avoid blocking the response)
204
-
if s.ctx.Database != nil {
205
go func() {
206
-
if err := s.ctx.Database.IncrementPushCount(s.ctx.DID, s.ctx.Repository); err != nil {
207
-
slog.Warn("Failed to increment push count", "did", s.ctx.DID, "repository", s.ctx.Repository, "error", err)
208
}
209
}()
210
}
···
214
for _, option := range options {
215
if tagOpt, ok := option.(distribution.WithTagOption); ok {
216
tag = tagOpt.Tag
217
-
tagRecord := atproto.NewTagRecord(s.ctx.ATProtoClient.DID(), s.ctx.Repository, tag, dgst.String())
218
-
tagRKey := atproto.RepositoryTagToRKey(s.ctx.Repository, tag)
219
-
_, err = s.ctx.ATProtoClient.PutRecord(ctx, atproto.TagCollection, tagRKey, tagRecord)
220
if err != nil {
221
return "", fmt.Errorf("failed to store tag in ATProto: %w", err)
222
}
···
225
226
// Notify hold about manifest upload (for layer tracking and Bluesky posts)
227
// Do this asynchronously to avoid blocking the push
228
-
if tag != "" && s.ctx.ServiceToken != "" && s.ctx.Handle != "" {
229
-
go func() {
230
defer func() {
231
if r := recover(); r != nil {
232
slog.Error("Panic in notifyHoldAboutManifest", "panic", r)
233
}
234
}()
235
-
if err := s.notifyHoldAboutManifest(context.Background(), manifestRecord, tag, dgst.String()); err != nil {
236
slog.Warn("Failed to notify hold about manifest", "error", err)
237
}
238
-
}()
239
}
240
241
// Create or update repo page asynchronously if manifest has relevant annotations
···
255
// Delete removes a manifest
256
func (s *ManifestStore) Delete(ctx context.Context, dgst digest.Digest) error {
257
rkey := digestToRKey(dgst)
258
-
return s.ctx.ATProtoClient.DeleteRecord(ctx, atproto.ManifestCollection, rkey)
259
}
260
261
// digestToRKey converts a digest to an ATProto record key
···
263
func digestToRKey(dgst digest.Digest) string {
264
// Remove the algorithm prefix (e.g., "sha256:")
265
return dgst.Encoded()
266
-
}
267
-
268
-
// GetLastFetchedHoldDID returns the hold DID from the most recently fetched manifest
269
-
// This is used by the routing repository to cache the hold for blob requests
270
-
func (s *ManifestStore) GetLastFetchedHoldDID() string {
271
-
s.mu.RLock()
272
-
defer s.mu.RUnlock()
273
-
return s.lastFetchedHoldDID
274
}
275
276
// rawManifest is a simple implementation of distribution.Manifest
···
318
319
// notifyHoldAboutManifest notifies the hold service about a manifest upload
320
// This enables the hold to create layer records and Bluesky posts
321
-
func (s *ManifestStore) notifyHoldAboutManifest(ctx context.Context, manifestRecord *atproto.ManifestRecord, tag, manifestDigest string) error {
322
-
// Skip if no service token configured (e.g., anonymous pulls)
323
-
if s.ctx.ServiceToken == "" {
324
return nil
325
}
326
327
// Resolve hold DID to HTTP endpoint
328
// For did:web, this is straightforward (e.g., did:web:hold01.atcr.io → https://hold01.atcr.io)
329
-
holdEndpoint := atproto.ResolveHoldURL(s.ctx.HoldDID)
330
331
-
// Use service token from middleware (already cached and validated)
332
-
serviceToken := s.ctx.ServiceToken
333
334
// Build notification request
335
manifestData := map[string]any{
···
378
}
379
380
notifyReq := map[string]any{
381
-
"repository": s.ctx.Repository,
382
"tag": tag,
383
-
"userDid": s.ctx.DID,
384
-
"userHandle": s.ctx.Handle,
385
"manifest": manifestData,
386
}
387
···
419
// Parse response (optional logging)
420
var notifyResp map[string]any
421
if err := json.NewDecoder(resp.Body).Decode(¬ifyResp); err == nil {
422
-
slog.Info("Hold notification successful", "repository", s.ctx.Repository, "tag", tag, "response", notifyResp)
423
}
424
425
return nil
···
430
// Only creates a new record if one doesn't exist (doesn't overwrite user's custom content)
431
func (s *ManifestStore) ensureRepoPage(ctx context.Context, manifestRecord *atproto.ManifestRecord) {
432
// Check if repo page already exists (don't overwrite user's custom content)
433
-
rkey := s.ctx.Repository
434
-
_, err := s.ctx.ATProtoClient.GetRecord(ctx, atproto.RepoPageCollection, rkey)
435
if err == nil {
436
// Record already exists - don't overwrite
437
-
slog.Debug("Repo page already exists, skipping creation", "did", s.ctx.DID, "repository", s.ctx.Repository)
438
return
439
}
440
441
// Only continue if it's a "not found" error - other errors mean we should skip
442
if !errors.Is(err, atproto.ErrRecordNotFound) {
443
-
slog.Warn("Failed to check for existing repo page", "did", s.ctx.DID, "repository", s.ctx.Repository, "error", err)
444
return
445
}
446
···
466
}
467
468
// Create new repo page record with description and optional avatar
469
-
repoPage := atproto.NewRepoPageRecord(s.ctx.Repository, description, avatarRef)
470
471
-
slog.Info("Creating repo page from manifest annotations", "did", s.ctx.DID, "repository", s.ctx.Repository, "descriptionLength", len(description), "hasAvatar", avatarRef != nil)
472
473
-
_, err = s.ctx.ATProtoClient.PutRecord(ctx, atproto.RepoPageCollection, rkey, repoPage)
474
if err != nil {
475
-
slog.Warn("Failed to create repo page", "did", s.ctx.DID, "repository", s.ctx.Repository, "error", err)
476
return
477
}
478
479
-
slog.Info("Repo page created successfully", "did", s.ctx.DID, "repository", s.ctx.Repository)
480
}
481
482
// fetchReadmeContent attempts to fetch README content from external sources
483
// Priority: io.atcr.readme annotation > derived from org.opencontainers.image.source
484
// Returns the raw markdown content, or empty string if not available
485
func (s *ManifestStore) fetchReadmeContent(ctx context.Context, annotations map[string]string) string {
486
-
if s.ctx.ReadmeFetcher == nil {
487
-
return ""
488
-
}
489
490
// Create a context with timeout for README fetching (don't block push too long)
491
fetchCtx, cancel := context.WithTimeout(ctx, 10*time.Second)
···
632
}
633
634
// Upload the icon as a blob to the user's PDS
635
-
blobRef, err := s.ctx.ATProtoClient.UploadBlob(ctx, iconData, mimeType)
636
if err != nil {
637
slog.Warn("Failed to upload icon blob", "url", iconURL, "error", err)
638
return nil
···
3
import (
4
"bytes"
5
"context"
6
+
"database/sql"
7
"encoding/json"
8
"errors"
9
"fmt"
10
"io"
11
"log/slog"
12
"net/http"
13
"strings"
14
"time"
15
16
+
"atcr.io/pkg/appview/db"
17
"atcr.io/pkg/appview/readme"
18
"atcr.io/pkg/atproto"
19
+
"atcr.io/pkg/auth"
20
"github.com/distribution/distribution/v3"
21
"github.com/opencontainers/go-digest"
22
)
···
24
// ManifestStore implements distribution.ManifestService
25
// It stores manifests in ATProto as records
26
type ManifestStore struct {
27
+
ctx *auth.UserContext // User context with identity, target, permissions
28
blobStore distribution.BlobStore // Blob store for fetching config during push
29
+
sqlDB *sql.DB // Database for pull/push counts
30
}
31
32
// NewManifestStore creates a new ATProto-backed manifest store
33
+
func NewManifestStore(userCtx *auth.UserContext, blobStore distribution.BlobStore, sqlDB *sql.DB) *ManifestStore {
34
return &ManifestStore{
35
+
ctx: userCtx,
36
blobStore: blobStore,
37
+
sqlDB: sqlDB,
38
}
39
}
40
41
// Exists checks if a manifest exists by digest
42
func (s *ManifestStore) Exists(ctx context.Context, dgst digest.Digest) (bool, error) {
43
rkey := digestToRKey(dgst)
44
+
_, err := s.ctx.GetATProtoClient().GetRecord(ctx, atproto.ManifestCollection, rkey)
45
if err != nil {
46
// If not found, return false without error
47
if errors.Is(err, atproto.ErrRecordNotFound) {
···
55
// Get retrieves a manifest by digest
56
func (s *ManifestStore) Get(ctx context.Context, dgst digest.Digest, options ...distribution.ManifestServiceOption) (distribution.Manifest, error) {
57
rkey := digestToRKey(dgst)
58
+
record, err := s.ctx.GetATProtoClient().GetRecord(ctx, atproto.ManifestCollection, rkey)
59
if err != nil {
60
return nil, distribution.ErrManifestUnknownRevision{
61
+
Name: s.ctx.TargetRepo,
62
Revision: dgst,
63
}
64
}
···
68
return nil, fmt.Errorf("failed to unmarshal manifest record: %w", err)
69
}
70
71
var ociManifest []byte
72
73
// New records: Download blob from ATProto blob storage
74
if manifestRecord.ManifestBlob != nil && manifestRecord.ManifestBlob.Ref.Link != "" {
75
+
ociManifest, err = s.ctx.GetATProtoClient().GetBlob(ctx, manifestRecord.ManifestBlob.Ref.Link)
76
if err != nil {
77
return nil, fmt.Errorf("failed to download manifest blob: %w", err)
78
}
···
80
81
// Track pull count (increment asynchronously to avoid blocking the response)
82
// Only count GET requests (actual downloads), not HEAD requests (existence checks)
83
+
if s.sqlDB != nil {
84
// Check HTTP method from context (distribution library stores it as "http.request.method")
85
if method, ok := ctx.Value("http.request.method").(string); ok && method == "GET" {
86
go func() {
87
+
if err := db.IncrementPullCount(s.sqlDB, s.ctx.TargetOwnerDID, s.ctx.TargetRepo); err != nil {
88
+
slog.Warn("Failed to increment pull count", "did", s.ctx.TargetOwnerDID, "repository", s.ctx.TargetRepo, "error", err)
89
}
90
}()
91
}
···
112
dgst := digest.FromBytes(payload)
113
114
// Upload manifest as blob to PDS
115
+
blobRef, err := s.ctx.GetATProtoClient().UploadBlob(ctx, payload, mediaType)
116
if err != nil {
117
return "", fmt.Errorf("failed to upload manifest blob: %w", err)
118
}
119
120
// Create manifest record with structured metadata
121
+
manifestRecord, err := atproto.NewManifestRecord(s.ctx.TargetRepo, dgst.String(), payload)
122
if err != nil {
123
return "", fmt.Errorf("failed to create manifest record: %w", err)
124
}
125
126
// Set the blob reference, hold DID, and hold endpoint
127
manifestRecord.ManifestBlob = blobRef
128
+
manifestRecord.HoldDID = s.ctx.TargetHoldDID // Primary reference (DID)
129
130
// Extract Dockerfile labels from config blob and add to annotations
131
// Only for image manifests (not manifest lists which don't have config blobs)
···
155
platform = fmt.Sprintf("%s/%s", ref.Platform.OS, ref.Platform.Architecture)
156
}
157
slog.Warn("Manifest list references non-existent child manifest",
158
+
"repository", s.ctx.TargetRepo,
159
"missingDigest", ref.Digest,
160
"platform", platform)
161
return "", distribution.ErrManifestBlobUnknown{Digest: refDigest}
···
168
if err != nil {
169
// Log error but don't fail the push - labels are optional
170
slog.Warn("Failed to extract config labels", "error", err)
171
+
} else if len(labels) > 0 {
172
// Initialize annotations map if needed
173
if manifestRecord.Annotations == nil {
174
manifestRecord.Annotations = make(map[string]string)
175
}
176
177
+
// Copy labels to annotations as fallback
178
+
// Only set label values for keys NOT already in manifest annotations
179
+
// This ensures explicit annotations take precedence over Dockerfile LABELs
180
+
// (which may be inherited from base images)
181
+
for key, value := range labels {
182
+
if _, exists := manifestRecord.Annotations[key]; !exists {
183
+
manifestRecord.Annotations[key] = value
184
+
}
185
+
}
186
187
+
slog.Debug("Merged labels from config blob", "labelsCount", len(labels), "annotationsCount", len(manifestRecord.Annotations))
188
}
189
}
190
191
// Store manifest record in ATProto
192
rkey := digestToRKey(dgst)
193
+
_, err = s.ctx.GetATProtoClient().PutRecord(ctx, atproto.ManifestCollection, rkey, manifestRecord)
194
if err != nil {
195
return "", fmt.Errorf("failed to store manifest record in ATProto: %w", err)
196
}
197
198
// Track push count (increment asynchronously to avoid blocking the response)
199
+
if s.sqlDB != nil {
200
go func() {
201
+
if err := db.IncrementPushCount(s.sqlDB, s.ctx.TargetOwnerDID, s.ctx.TargetRepo); err != nil {
202
+
slog.Warn("Failed to increment push count", "did", s.ctx.TargetOwnerDID, "repository", s.ctx.TargetRepo, "error", err)
203
}
204
}()
205
}
···
209
for _, option := range options {
210
if tagOpt, ok := option.(distribution.WithTagOption); ok {
211
tag = tagOpt.Tag
212
+
tagRecord := atproto.NewTagRecord(s.ctx.GetATProtoClient().DID(), s.ctx.TargetRepo, tag, dgst.String())
213
+
tagRKey := atproto.RepositoryTagToRKey(s.ctx.TargetRepo, tag)
214
+
_, err = s.ctx.GetATProtoClient().PutRecord(ctx, atproto.TagCollection, tagRKey, tagRecord)
215
if err != nil {
216
return "", fmt.Errorf("failed to store tag in ATProto: %w", err)
217
}
···
220
221
// Notify hold about manifest upload (for layer tracking and Bluesky posts)
222
// Do this asynchronously to avoid blocking the push
223
+
// Get service token before goroutine (requires context)
224
+
serviceToken, _ := s.ctx.GetServiceToken(ctx)
225
+
if tag != "" && serviceToken != "" && s.ctx.TargetOwnerHandle != "" {
226
+
go func(serviceToken string) {
227
defer func() {
228
if r := recover(); r != nil {
229
slog.Error("Panic in notifyHoldAboutManifest", "panic", r)
230
}
231
}()
232
+
if err := s.notifyHoldAboutManifest(context.Background(), manifestRecord, tag, dgst.String(), serviceToken); err != nil {
233
slog.Warn("Failed to notify hold about manifest", "error", err)
234
}
235
+
}(serviceToken)
236
}
237
238
// Create or update repo page asynchronously if manifest has relevant annotations
···
252
// Delete removes a manifest
253
func (s *ManifestStore) Delete(ctx context.Context, dgst digest.Digest) error {
254
rkey := digestToRKey(dgst)
255
+
return s.ctx.GetATProtoClient().DeleteRecord(ctx, atproto.ManifestCollection, rkey)
256
}
257
258
// digestToRKey converts a digest to an ATProto record key
···
260
func digestToRKey(dgst digest.Digest) string {
261
// Remove the algorithm prefix (e.g., "sha256:")
262
return dgst.Encoded()
263
}
264
265
// rawManifest is a simple implementation of distribution.Manifest
···
307
308
// notifyHoldAboutManifest notifies the hold service about a manifest upload
309
// This enables the hold to create layer records and Bluesky posts
310
+
func (s *ManifestStore) notifyHoldAboutManifest(ctx context.Context, manifestRecord *atproto.ManifestRecord, tag, manifestDigest, serviceToken string) error {
311
+
// Skip if no service token provided
312
+
if serviceToken == "" {
313
return nil
314
}
315
316
// Resolve hold DID to HTTP endpoint
317
// For did:web, this is straightforward (e.g., did:web:hold01.atcr.io → https://hold01.atcr.io)
318
+
holdEndpoint := atproto.ResolveHoldURL(s.ctx.TargetHoldDID)
319
320
+
// Service token is passed in (already cached and validated)
321
322
// Build notification request
323
manifestData := map[string]any{
···
366
}
367
368
notifyReq := map[string]any{
369
+
"repository": s.ctx.TargetRepo,
370
"tag": tag,
371
+
"userDid": s.ctx.TargetOwnerDID,
372
+
"userHandle": s.ctx.TargetOwnerHandle,
373
"manifest": manifestData,
374
}
375
···
407
// Parse response (optional logging)
408
var notifyResp map[string]any
409
if err := json.NewDecoder(resp.Body).Decode(¬ifyResp); err == nil {
410
+
slog.Info("Hold notification successful", "repository", s.ctx.TargetRepo, "tag", tag, "response", notifyResp)
411
}
412
413
return nil
···
418
// Only creates a new record if one doesn't exist (doesn't overwrite user's custom content)
419
func (s *ManifestStore) ensureRepoPage(ctx context.Context, manifestRecord *atproto.ManifestRecord) {
420
// Check if repo page already exists (don't overwrite user's custom content)
421
+
rkey := s.ctx.TargetRepo
422
+
_, err := s.ctx.GetATProtoClient().GetRecord(ctx, atproto.RepoPageCollection, rkey)
423
if err == nil {
424
// Record already exists - don't overwrite
425
+
slog.Debug("Repo page already exists, skipping creation", "did", s.ctx.TargetOwnerDID, "repository", s.ctx.TargetRepo)
426
return
427
}
428
429
// Only continue if it's a "not found" error - other errors mean we should skip
430
if !errors.Is(err, atproto.ErrRecordNotFound) {
431
+
slog.Warn("Failed to check for existing repo page", "did", s.ctx.TargetOwnerDID, "repository", s.ctx.TargetRepo, "error", err)
432
return
433
}
434
···
454
}
455
456
// Create new repo page record with description and optional avatar
457
+
repoPage := atproto.NewRepoPageRecord(s.ctx.TargetRepo, description, avatarRef)
458
459
+
slog.Info("Creating repo page from manifest annotations", "did", s.ctx.TargetOwnerDID, "repository", s.ctx.TargetRepo, "descriptionLength", len(description), "hasAvatar", avatarRef != nil)
460
461
+
_, err = s.ctx.GetATProtoClient().PutRecord(ctx, atproto.RepoPageCollection, rkey, repoPage)
462
if err != nil {
463
+
slog.Warn("Failed to create repo page", "did", s.ctx.TargetOwnerDID, "repository", s.ctx.TargetRepo, "error", err)
464
return
465
}
466
467
+
slog.Info("Repo page created successfully", "did", s.ctx.TargetOwnerDID, "repository", s.ctx.TargetRepo)
468
}
469
470
// fetchReadmeContent attempts to fetch README content from external sources
471
// Priority: io.atcr.readme annotation > derived from org.opencontainers.image.source
472
// Returns the raw markdown content, or empty string if not available
473
func (s *ManifestStore) fetchReadmeContent(ctx context.Context, annotations map[string]string) string {
474
475
// Create a context with timeout for README fetching (don't block push too long)
476
fetchCtx, cancel := context.WithTimeout(ctx, 10*time.Second)
···
617
}
618
619
// Upload the icon as a blob to the user's PDS
620
+
blobRef, err := s.ctx.GetATProtoClient().UploadBlob(ctx, iconData, mimeType)
621
if err != nil {
622
slog.Warn("Failed to upload icon blob", "url", iconURL, "error", err)
623
return nil
+121
-279
pkg/appview/storage/manifest_store_test.go
+121
-279
pkg/appview/storage/manifest_store_test.go
···
8
"net/http"
9
"net/http/httptest"
10
"testing"
11
-
"time"
12
13
"atcr.io/pkg/atproto"
14
"github.com/distribution/distribution/v3"
15
"github.com/opencontainers/go-digest"
16
)
17
-
18
-
// mockDatabaseMetrics removed - using the one from context_test.go
19
20
// mockBlobStore is a minimal mock of distribution.BlobStore for testing
21
type mockBlobStore struct {
···
72
return nil, nil // Not needed for current tests
73
}
74
75
-
// mockRegistryContext creates a mock RegistryContext for testing
76
-
func mockRegistryContext(client *atproto.Client, repository, holdDID, did, handle string, database DatabaseMetrics) *RegistryContext {
77
-
return &RegistryContext{
78
-
ATProtoClient: client,
79
-
Repository: repository,
80
-
HoldDID: holdDID,
81
-
DID: did,
82
-
Handle: handle,
83
-
Database: database,
84
-
}
85
}
86
87
// TestDigestToRKey tests digest to record key conversion
···
115
116
// TestNewManifestStore tests creating a new manifest store
117
func TestNewManifestStore(t *testing.T) {
118
-
client := atproto.NewClient("https://pds.example.com", "did:plc:test123", "token")
119
blobStore := newMockBlobStore()
120
-
db := &mockDatabaseMetrics{}
121
-
122
-
ctx := mockRegistryContext(client, "myapp", "did:web:hold.example.com", "did:plc:alice123", "alice.test", db)
123
-
store := NewManifestStore(ctx, blobStore)
124
125
-
if store.ctx.Repository != "myapp" {
126
-
t.Errorf("repository = %v, want myapp", store.ctx.Repository)
127
}
128
-
if store.ctx.HoldDID != "did:web:hold.example.com" {
129
-
t.Errorf("holdDID = %v, want did:web:hold.example.com", store.ctx.HoldDID)
130
}
131
-
if store.ctx.DID != "did:plc:alice123" {
132
-
t.Errorf("did = %v, want did:plc:alice123", store.ctx.DID)
133
-
}
134
-
if store.ctx.Handle != "alice.test" {
135
-
t.Errorf("handle = %v, want alice.test", store.ctx.Handle)
136
-
}
137
-
}
138
-
139
-
// TestManifestStore_GetLastFetchedHoldDID tests tracking last fetched hold DID
140
-
func TestManifestStore_GetLastFetchedHoldDID(t *testing.T) {
141
-
tests := []struct {
142
-
name string
143
-
manifestHoldDID string
144
-
manifestHoldURL string
145
-
expectedLastFetched string
146
-
}{
147
-
{
148
-
name: "prefers HoldDID",
149
-
manifestHoldDID: "did:web:hold01.atcr.io",
150
-
manifestHoldURL: "https://hold01.atcr.io",
151
-
expectedLastFetched: "did:web:hold01.atcr.io",
152
-
},
153
-
{
154
-
name: "falls back to HoldEndpoint URL conversion",
155
-
manifestHoldDID: "",
156
-
manifestHoldURL: "https://hold02.atcr.io",
157
-
expectedLastFetched: "did:web:hold02.atcr.io",
158
-
},
159
-
{
160
-
name: "empty hold references",
161
-
manifestHoldDID: "",
162
-
manifestHoldURL: "",
163
-
expectedLastFetched: "",
164
-
},
165
}
166
-
167
-
for _, tt := range tests {
168
-
t.Run(tt.name, func(t *testing.T) {
169
-
client := atproto.NewClient("https://pds.example.com", "did:plc:test123", "token")
170
-
ctx := mockRegistryContext(client, "myapp", "", "did:plc:test123", "test.handle", nil)
171
-
store := NewManifestStore(ctx, nil)
172
-
173
-
// Simulate what happens in Get() when parsing a manifest record
174
-
var manifestRecord atproto.ManifestRecord
175
-
manifestRecord.HoldDID = tt.manifestHoldDID
176
-
manifestRecord.HoldEndpoint = tt.manifestHoldURL
177
-
178
-
// Mimic the hold DID extraction logic from Get()
179
-
if manifestRecord.HoldDID != "" {
180
-
store.lastFetchedHoldDID = manifestRecord.HoldDID
181
-
} else if manifestRecord.HoldEndpoint != "" {
182
-
store.lastFetchedHoldDID = atproto.ResolveHoldDIDFromURL(manifestRecord.HoldEndpoint)
183
-
}
184
-
185
-
got := store.GetLastFetchedHoldDID()
186
-
if got != tt.expectedLastFetched {
187
-
t.Errorf("GetLastFetchedHoldDID() = %v, want %v", got, tt.expectedLastFetched)
188
-
}
189
-
})
190
}
191
}
192
···
241
blobStore.blobs[configDigest] = configData
242
243
// Create manifest store
244
-
client := atproto.NewClient("https://pds.example.com", "did:plc:test123", "token")
245
-
ctx := mockRegistryContext(client, "myapp", "", "did:plc:test123", "test.handle", nil)
246
-
store := NewManifestStore(ctx, blobStore)
247
248
// Extract labels
249
labels, err := store.extractConfigLabels(context.Background(), configDigest.String())
···
281
configDigest := digest.FromBytes(configData)
282
blobStore.blobs[configDigest] = configData
283
284
-
client := atproto.NewClient("https://pds.example.com", "did:plc:test123", "token")
285
-
ctx := mockRegistryContext(client, "myapp", "", "did:plc:test123", "test.handle", nil)
286
-
store := NewManifestStore(ctx, blobStore)
287
288
labels, err := store.extractConfigLabels(context.Background(), configDigest.String())
289
if err != nil {
···
299
// TestExtractConfigLabels_InvalidDigest tests error handling for invalid digest
300
func TestExtractConfigLabels_InvalidDigest(t *testing.T) {
301
blobStore := newMockBlobStore()
302
-
client := atproto.NewClient("https://pds.example.com", "did:plc:test123", "token")
303
-
ctx := mockRegistryContext(client, "myapp", "", "did:plc:test123", "test.handle", nil)
304
-
store := NewManifestStore(ctx, blobStore)
305
306
_, err := store.extractConfigLabels(context.Background(), "invalid-digest")
307
if err == nil {
···
318
configDigest := digest.FromBytes(configData)
319
blobStore.blobs[configDigest] = configData
320
321
-
client := atproto.NewClient("https://pds.example.com", "did:plc:test123", "token")
322
-
ctx := mockRegistryContext(client, "myapp", "", "did:plc:test123", "test.handle", nil)
323
-
store := NewManifestStore(ctx, blobStore)
324
325
_, err := store.extractConfigLabels(context.Background(), configDigest.String())
326
if err == nil {
···
328
}
329
}
330
331
-
// TestManifestStore_WithMetrics tests that metrics are tracked
332
-
func TestManifestStore_WithMetrics(t *testing.T) {
333
-
db := &mockDatabaseMetrics{}
334
-
client := atproto.NewClient("https://pds.example.com", "did:plc:test123", "token")
335
-
ctx := mockRegistryContext(client, "myapp", "did:web:hold.example.com", "did:plc:alice123", "alice.test", db)
336
-
store := NewManifestStore(ctx, nil)
337
-
338
-
if store.ctx.Database != db {
339
-
t.Error("ManifestStore should store database reference")
340
-
}
341
-
342
-
// Note: Actual metrics tracking happens in Put() and Get() which require
343
-
// full mock setup. The important thing is that the database is wired up.
344
-
}
345
-
346
-
// TestManifestStore_WithoutMetrics tests that nil database is acceptable
347
-
func TestManifestStore_WithoutMetrics(t *testing.T) {
348
-
client := atproto.NewClient("https://pds.example.com", "did:plc:test123", "token")
349
-
ctx := mockRegistryContext(client, "myapp", "did:web:hold.example.com", "did:plc:alice123", "alice.test", nil)
350
-
store := NewManifestStore(ctx, nil)
351
352
-
if store.ctx.Database != nil {
353
t.Error("ManifestStore should accept nil database")
354
}
355
}
···
399
}))
400
defer server.Close()
401
402
-
client := atproto.NewClient(server.URL, "did:plc:test123", "token")
403
-
ctx := mockRegistryContext(client, "myapp", "did:web:hold.example.com", "did:plc:test123", "test.handle", nil)
404
-
store := NewManifestStore(ctx, nil)
405
406
exists, err := store.Exists(context.Background(), tt.digest)
407
if (err != nil) != tt.wantErr {
···
517
}))
518
defer server.Close()
519
520
-
client := atproto.NewClient(server.URL, "did:plc:test123", "token")
521
-
db := &mockDatabaseMetrics{}
522
-
ctx := mockRegistryContext(client, "myapp", "did:web:hold.example.com", "did:plc:test123", "test.handle", db)
523
-
store := NewManifestStore(ctx, nil)
524
525
manifest, err := store.Get(context.Background(), tt.digest)
526
if (err != nil) != tt.wantErr {
···
541
}
542
}
543
544
-
// TestManifestStore_Get_HoldDIDTracking tests that Get() stores the holdDID
545
-
func TestManifestStore_Get_HoldDIDTracking(t *testing.T) {
546
-
ociManifest := []byte(`{"schemaVersion":2}`)
547
-
548
-
tests := []struct {
549
-
name string
550
-
manifestResp string
551
-
expectedHoldDID string
552
-
}{
553
-
{
554
-
name: "tracks HoldDID from new format",
555
-
manifestResp: `{
556
-
"uri":"at://did:plc:test123/io.atcr.manifest/abc123",
557
-
"value":{
558
-
"$type":"io.atcr.manifest",
559
-
"holdDid":"did:web:hold01.atcr.io",
560
-
"holdEndpoint":"https://hold01.atcr.io",
561
-
"mediaType":"application/vnd.oci.image.manifest.v1+json",
562
-
"manifestBlob":{"ref":{"$link":"bafytest"},"size":100}
563
-
}
564
-
}`,
565
-
expectedHoldDID: "did:web:hold01.atcr.io",
566
-
},
567
-
{
568
-
name: "tracks HoldDID from legacy HoldEndpoint",
569
-
manifestResp: `{
570
-
"uri":"at://did:plc:test123/io.atcr.manifest/abc123",
571
-
"value":{
572
-
"$type":"io.atcr.manifest",
573
-
"holdEndpoint":"https://hold02.atcr.io",
574
-
"mediaType":"application/vnd.oci.image.manifest.v1+json",
575
-
"manifestBlob":{"ref":{"$link":"bafytest"},"size":100}
576
-
}
577
-
}`,
578
-
expectedHoldDID: "did:web:hold02.atcr.io",
579
-
},
580
-
}
581
-
582
-
for _, tt := range tests {
583
-
t.Run(tt.name, func(t *testing.T) {
584
-
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
585
-
if r.URL.Path == atproto.SyncGetBlob {
586
-
w.Write(ociManifest)
587
-
return
588
-
}
589
-
w.Write([]byte(tt.manifestResp))
590
-
}))
591
-
defer server.Close()
592
-
593
-
client := atproto.NewClient(server.URL, "did:plc:test123", "token")
594
-
ctx := mockRegistryContext(client, "myapp", "", "did:plc:test123", "test.handle", nil)
595
-
store := NewManifestStore(ctx, nil)
596
-
597
-
_, err := store.Get(context.Background(), "sha256:abc123")
598
-
if err != nil {
599
-
t.Fatalf("Get() error = %v", err)
600
-
}
601
-
602
-
gotHoldDID := store.GetLastFetchedHoldDID()
603
-
if gotHoldDID != tt.expectedHoldDID {
604
-
t.Errorf("GetLastFetchedHoldDID() = %v, want %v", gotHoldDID, tt.expectedHoldDID)
605
-
}
606
-
})
607
-
}
608
-
}
609
-
610
-
// TestManifestStore_Get_OnlyCountsGETRequests verifies that HEAD requests don't increment pull count
611
-
func TestManifestStore_Get_OnlyCountsGETRequests(t *testing.T) {
612
-
ociManifest := []byte(`{"schemaVersion":2}`)
613
-
614
-
tests := []struct {
615
-
name string
616
-
httpMethod string
617
-
expectPullIncrement bool
618
-
}{
619
-
{
620
-
name: "GET request increments pull count",
621
-
httpMethod: "GET",
622
-
expectPullIncrement: true,
623
-
},
624
-
{
625
-
name: "HEAD request does not increment pull count",
626
-
httpMethod: "HEAD",
627
-
expectPullIncrement: false,
628
-
},
629
-
{
630
-
name: "POST request does not increment pull count",
631
-
httpMethod: "POST",
632
-
expectPullIncrement: false,
633
-
},
634
-
}
635
-
636
-
for _, tt := range tests {
637
-
t.Run(tt.name, func(t *testing.T) {
638
-
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
639
-
if r.URL.Path == atproto.SyncGetBlob {
640
-
w.Write(ociManifest)
641
-
return
642
-
}
643
-
w.Write([]byte(`{
644
-
"uri": "at://did:plc:test123/io.atcr.manifest/abc123",
645
-
"value": {
646
-
"$type":"io.atcr.manifest",
647
-
"holdDid":"did:web:hold01.atcr.io",
648
-
"mediaType":"application/vnd.oci.image.manifest.v1+json",
649
-
"manifestBlob":{"ref":{"$link":"bafytest"},"size":100}
650
-
}
651
-
}`))
652
-
}))
653
-
defer server.Close()
654
-
655
-
client := atproto.NewClient(server.URL, "did:plc:test123", "token")
656
-
mockDB := &mockDatabaseMetrics{}
657
-
ctx := mockRegistryContext(client, "myapp", "did:web:hold01.atcr.io", "did:plc:test123", "test.handle", mockDB)
658
-
store := NewManifestStore(ctx, nil)
659
-
660
-
// Create a context with the HTTP method stored (as distribution library does)
661
-
testCtx := context.WithValue(context.Background(), "http.request.method", tt.httpMethod)
662
-
663
-
_, err := store.Get(testCtx, "sha256:abc123")
664
-
if err != nil {
665
-
t.Fatalf("Get() error = %v", err)
666
-
}
667
-
668
-
// Wait for async goroutine to complete (metrics are incremented asynchronously)
669
-
time.Sleep(50 * time.Millisecond)
670
-
671
-
if tt.expectPullIncrement {
672
-
// Check that IncrementPullCount was called
673
-
if mockDB.getPullCount() == 0 {
674
-
t.Error("Expected pull count to be incremented for GET request, but it wasn't")
675
-
}
676
-
} else {
677
-
// Check that IncrementPullCount was NOT called
678
-
if mockDB.getPullCount() > 0 {
679
-
t.Errorf("Expected pull count NOT to be incremented for %s request, but it was (count=%d)", tt.httpMethod, mockDB.getPullCount())
680
-
}
681
-
}
682
-
})
683
-
}
684
-
}
685
-
686
// TestManifestStore_Put tests storing manifests
687
func TestManifestStore_Put(t *testing.T) {
688
ociManifest := []byte(`{
···
774
}))
775
defer server.Close()
776
777
-
client := atproto.NewClient(server.URL, "did:plc:test123", "token")
778
-
db := &mockDatabaseMetrics{}
779
-
ctx := mockRegistryContext(client, "myapp", "did:web:hold.example.com", "did:plc:test123", "test.handle", db)
780
-
store := NewManifestStore(ctx, nil)
781
782
dgst, err := store.Put(context.Background(), tt.manifest, tt.options...)
783
if (err != nil) != tt.wantErr {
···
826
}))
827
defer server.Close()
828
829
-
client := atproto.NewClient(server.URL, "did:plc:test123", "token")
830
-
ctx := mockRegistryContext(client, "myapp", "did:web:hold.example.com", "did:plc:test123", "test.handle", nil)
831
832
// Use config digest in manifest
833
ociManifestWithConfig := []byte(`{
···
842
payload: ociManifestWithConfig,
843
}
844
845
-
store := NewManifestStore(ctx, blobStore)
846
847
_, err := store.Put(context.Background(), manifest)
848
if err != nil {
···
902
}))
903
defer server.Close()
904
905
-
client := atproto.NewClient(server.URL, "did:plc:test123", "token")
906
-
ctx := mockRegistryContext(client, "myapp", "did:web:hold.example.com", "did:plc:test123", "test.handle", nil)
907
-
store := NewManifestStore(ctx, nil)
908
909
err := store.Delete(context.Background(), tt.digest)
910
if (err != nil) != tt.wantErr {
···
1058
}))
1059
defer server.Close()
1060
1061
-
client := atproto.NewClient(server.URL, "did:plc:test123", "token")
1062
-
db := &mockDatabaseMetrics{}
1063
-
ctx := mockRegistryContext(client, "myapp", "did:web:hold.example.com", "did:plc:test123", "test.handle", db)
1064
-
store := NewManifestStore(ctx, nil)
1065
1066
manifest := &rawManifest{
1067
mediaType: "application/vnd.oci.image.index.v1+json",
···
1135
}))
1136
defer server.Close()
1137
1138
-
client := atproto.NewClient(server.URL, "did:plc:test123", "token")
1139
-
ctx := mockRegistryContext(client, "myapp", "did:web:hold.example.com", "did:plc:test123", "test.handle", nil)
1140
-
store := NewManifestStore(ctx, nil)
1141
1142
// Create manifest list with both children
1143
manifestList := []byte(`{
···
8
"net/http"
9
"net/http/httptest"
10
"testing"
11
12
"atcr.io/pkg/atproto"
13
+
"atcr.io/pkg/auth"
14
"github.com/distribution/distribution/v3"
15
"github.com/opencontainers/go-digest"
16
)
17
18
// mockBlobStore is a minimal mock of distribution.BlobStore for testing
19
type mockBlobStore struct {
···
70
return nil, nil // Not needed for current tests
71
}
72
73
+
// mockUserContextForManifest creates a mock auth.UserContext for manifest store testing
74
+
func mockUserContextForManifest(pdsEndpoint, repository, holdDID, ownerDID, ownerHandle string) *auth.UserContext {
75
+
userCtx := auth.NewUserContext(ownerDID, "oauth", "PUT", nil)
76
+
userCtx.SetTarget(ownerDID, ownerHandle, pdsEndpoint, repository, holdDID)
77
+
return userCtx
78
}
79
80
// TestDigestToRKey tests digest to record key conversion
···
108
109
// TestNewManifestStore tests creating a new manifest store
110
func TestNewManifestStore(t *testing.T) {
111
blobStore := newMockBlobStore()
112
+
userCtx := mockUserContextForManifest(
113
+
"https://pds.example.com",
114
+
"myapp",
115
+
"did:web:hold.example.com",
116
+
"did:plc:alice123",
117
+
"alice.test",
118
+
)
119
+
store := NewManifestStore(userCtx, blobStore, nil)
120
121
+
if store.ctx.TargetRepo != "myapp" {
122
+
t.Errorf("repository = %v, want myapp", store.ctx.TargetRepo)
123
}
124
+
if store.ctx.TargetHoldDID != "did:web:hold.example.com" {
125
+
t.Errorf("holdDID = %v, want did:web:hold.example.com", store.ctx.TargetHoldDID)
126
}
127
+
if store.ctx.TargetOwnerDID != "did:plc:alice123" {
128
+
t.Errorf("did = %v, want did:plc:alice123", store.ctx.TargetOwnerDID)
129
}
130
+
if store.ctx.TargetOwnerHandle != "alice.test" {
131
+
t.Errorf("handle = %v, want alice.test", store.ctx.TargetOwnerHandle)
132
}
133
}
134
···
183
blobStore.blobs[configDigest] = configData
184
185
// Create manifest store
186
+
userCtx := mockUserContextForManifest(
187
+
"https://pds.example.com",
188
+
"myapp",
189
+
"",
190
+
"did:plc:test123",
191
+
"test.handle",
192
+
)
193
+
store := NewManifestStore(userCtx, blobStore, nil)
194
195
// Extract labels
196
labels, err := store.extractConfigLabels(context.Background(), configDigest.String())
···
228
configDigest := digest.FromBytes(configData)
229
blobStore.blobs[configDigest] = configData
230
231
+
userCtx := mockUserContextForManifest(
232
+
"https://pds.example.com",
233
+
"myapp",
234
+
"",
235
+
"did:plc:test123",
236
+
"test.handle",
237
+
)
238
+
store := NewManifestStore(userCtx, blobStore, nil)
239
240
labels, err := store.extractConfigLabels(context.Background(), configDigest.String())
241
if err != nil {
···
251
// TestExtractConfigLabels_InvalidDigest tests error handling for invalid digest
252
func TestExtractConfigLabels_InvalidDigest(t *testing.T) {
253
blobStore := newMockBlobStore()
254
+
userCtx := mockUserContextForManifest(
255
+
"https://pds.example.com",
256
+
"myapp",
257
+
"",
258
+
"did:plc:test123",
259
+
"test.handle",
260
+
)
261
+
store := NewManifestStore(userCtx, blobStore, nil)
262
263
_, err := store.extractConfigLabels(context.Background(), "invalid-digest")
264
if err == nil {
···
275
configDigest := digest.FromBytes(configData)
276
blobStore.blobs[configDigest] = configData
277
278
+
userCtx := mockUserContextForManifest(
279
+
"https://pds.example.com",
280
+
"myapp",
281
+
"",
282
+
"did:plc:test123",
283
+
"test.handle",
284
+
)
285
+
store := NewManifestStore(userCtx, blobStore, nil)
286
287
_, err := store.extractConfigLabels(context.Background(), configDigest.String())
288
if err == nil {
···
290
}
291
}
292
293
+
// TestManifestStore_WithoutDatabase tests that nil database is acceptable
294
+
func TestManifestStore_WithoutDatabase(t *testing.T) {
295
+
userCtx := mockUserContextForManifest(
296
+
"https://pds.example.com",
297
+
"myapp",
298
+
"did:web:hold.example.com",
299
+
"did:plc:alice123",
300
+
"alice.test",
301
+
)
302
+
store := NewManifestStore(userCtx, nil, nil)
303
304
+
if store.sqlDB != nil {
305
t.Error("ManifestStore should accept nil database")
306
}
307
}
···
351
}))
352
defer server.Close()
353
354
+
userCtx := mockUserContextForManifest(
355
+
server.URL,
356
+
"myapp",
357
+
"did:web:hold.example.com",
358
+
"did:plc:test123",
359
+
"test.handle",
360
+
)
361
+
store := NewManifestStore(userCtx, nil, nil)
362
363
exists, err := store.Exists(context.Background(), tt.digest)
364
if (err != nil) != tt.wantErr {
···
474
}))
475
defer server.Close()
476
477
+
userCtx := mockUserContextForManifest(
478
+
server.URL,
479
+
"myapp",
480
+
"did:web:hold.example.com",
481
+
"did:plc:test123",
482
+
"test.handle",
483
+
)
484
+
store := NewManifestStore(userCtx, nil, nil)
485
486
manifest, err := store.Get(context.Background(), tt.digest)
487
if (err != nil) != tt.wantErr {
···
502
}
503
}
504
505
// TestManifestStore_Put tests storing manifests
506
func TestManifestStore_Put(t *testing.T) {
507
ociManifest := []byte(`{
···
593
}))
594
defer server.Close()
595
596
+
userCtx := mockUserContextForManifest(
597
+
server.URL,
598
+
"myapp",
599
+
"did:web:hold.example.com",
600
+
"did:plc:test123",
601
+
"test.handle",
602
+
)
603
+
store := NewManifestStore(userCtx, nil, nil)
604
605
dgst, err := store.Put(context.Background(), tt.manifest, tt.options...)
606
if (err != nil) != tt.wantErr {
···
649
}))
650
defer server.Close()
651
652
+
userCtx := mockUserContextForManifest(
653
+
server.URL,
654
+
"myapp",
655
+
"did:web:hold.example.com",
656
+
"did:plc:test123",
657
+
"test.handle",
658
+
)
659
660
// Use config digest in manifest
661
ociManifestWithConfig := []byte(`{
···
670
payload: ociManifestWithConfig,
671
}
672
673
+
store := NewManifestStore(userCtx, blobStore, nil)
674
675
_, err := store.Put(context.Background(), manifest)
676
if err != nil {
···
730
}))
731
defer server.Close()
732
733
+
userCtx := mockUserContextForManifest(
734
+
server.URL,
735
+
"myapp",
736
+
"did:web:hold.example.com",
737
+
"did:plc:test123",
738
+
"test.handle",
739
+
)
740
+
store := NewManifestStore(userCtx, nil, nil)
741
742
err := store.Delete(context.Background(), tt.digest)
743
if (err != nil) != tt.wantErr {
···
891
}))
892
defer server.Close()
893
894
+
userCtx := mockUserContextForManifest(
895
+
server.URL,
896
+
"myapp",
897
+
"did:web:hold.example.com",
898
+
"did:plc:test123",
899
+
"test.handle",
900
+
)
901
+
store := NewManifestStore(userCtx, nil, nil)
902
903
manifest := &rawManifest{
904
mediaType: "application/vnd.oci.image.index.v1+json",
···
972
}))
973
defer server.Close()
974
975
+
userCtx := mockUserContextForManifest(
976
+
server.URL,
977
+
"myapp",
978
+
"did:web:hold.example.com",
979
+
"did:plc:test123",
980
+
"test.handle",
981
+
)
982
+
store := NewManifestStore(userCtx, nil, nil)
983
984
// Create manifest list with both children
985
manifestList := []byte(`{
+26
-28
pkg/appview/storage/proxy_blob_store.go
+26
-28
pkg/appview/storage/proxy_blob_store.go
···
12
"time"
13
14
"atcr.io/pkg/atproto"
15
"github.com/distribution/distribution/v3"
16
"github.com/distribution/distribution/v3/registry/api/errcode"
17
"github.com/opencontainers/go-digest"
···
32
33
// ProxyBlobStore proxies blob requests to an external storage service
34
type ProxyBlobStore struct {
35
-
ctx *RegistryContext // All context and services
36
-
holdURL string // Resolved HTTP URL for XRPC requests
37
httpClient *http.Client
38
}
39
40
// NewProxyBlobStore creates a new proxy blob store
41
-
func NewProxyBlobStore(ctx *RegistryContext) *ProxyBlobStore {
42
// Resolve DID to URL once at construction time
43
-
holdURL := atproto.ResolveHoldURL(ctx.HoldDID)
44
45
-
slog.Debug("NewProxyBlobStore created", "component", "proxy_blob_store", "hold_did", ctx.HoldDID, "hold_url", holdURL, "user_did", ctx.DID, "repo", ctx.Repository)
46
47
return &ProxyBlobStore{
48
-
ctx: ctx,
49
holdURL: holdURL,
50
httpClient: &http.Client{
51
Timeout: 5 * time.Minute, // Timeout for presigned URL requests and uploads
···
61
}
62
63
// doAuthenticatedRequest performs an HTTP request with service token authentication
64
-
// Uses the service token from middleware to authenticate requests to the hold service
65
func (p *ProxyBlobStore) doAuthenticatedRequest(ctx context.Context, req *http.Request) (*http.Response, error) {
66
-
// Use service token that middleware already validated and cached
67
-
// Middleware fails fast with HTTP 401 if OAuth session is invalid
68
-
if p.ctx.ServiceToken == "" {
69
// Should never happen - middleware validates OAuth before handlers run
70
slog.Error("No service token in context", "component", "proxy_blob_store", "did", p.ctx.DID)
71
return nil, fmt.Errorf("no service token available (middleware should have validated)")
72
}
73
74
// Add Bearer token to Authorization header
75
-
req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", p.ctx.ServiceToken))
76
77
return p.httpClient.Do(req)
78
}
79
80
// checkReadAccess validates that the user has read access to blobs in this hold
81
func (p *ProxyBlobStore) checkReadAccess(ctx context.Context) error {
82
-
if p.ctx.Authorizer == nil {
83
-
return nil // No authorization check if authorizer not configured
84
-
}
85
-
allowed, err := p.ctx.Authorizer.CheckReadAccess(ctx, p.ctx.HoldDID, p.ctx.DID)
86
if err != nil {
87
return fmt.Errorf("authorization check failed: %w", err)
88
}
89
-
if !allowed {
90
// Return 403 Forbidden instead of masquerading as missing blob
91
return errcode.ErrorCodeDenied.WithMessage("read access denied")
92
}
···
95
96
// checkWriteAccess validates that the user has write access to blobs in this hold
97
func (p *ProxyBlobStore) checkWriteAccess(ctx context.Context) error {
98
-
if p.ctx.Authorizer == nil {
99
-
return nil // No authorization check if authorizer not configured
100
-
}
101
-
102
-
slog.Debug("Checking write access", "component", "proxy_blob_store", "user_did", p.ctx.DID, "hold_did", p.ctx.HoldDID)
103
-
allowed, err := p.ctx.Authorizer.CheckWriteAccess(ctx, p.ctx.HoldDID, p.ctx.DID)
104
if err != nil {
105
slog.Error("Authorization check error", "component", "proxy_blob_store", "error", err)
106
return fmt.Errorf("authorization check failed: %w", err)
107
}
108
-
if !allowed {
109
-
slog.Warn("Write access denied", "component", "proxy_blob_store", "user_did", p.ctx.DID, "hold_did", p.ctx.HoldDID)
110
-
return errcode.ErrorCodeDenied.WithMessage(fmt.Sprintf("write access denied to hold %s", p.ctx.HoldDID))
111
}
112
-
slog.Debug("Write access allowed", "component", "proxy_blob_store", "user_did", p.ctx.DID, "hold_did", p.ctx.HoldDID)
113
return nil
114
}
115
···
356
// getPresignedURL returns the XRPC endpoint URL for blob operations
357
func (p *ProxyBlobStore) getPresignedURL(ctx context.Context, operation string, dgst digest.Digest) (string, error) {
358
// Use XRPC endpoint: /xrpc/com.atproto.sync.getBlob?did={userDID}&cid={digest}
359
-
// The 'did' parameter is the USER's DID (whose blob we're fetching), not the hold service DID
360
// Per migration doc: hold accepts OCI digest directly as cid parameter (checks for sha256: prefix)
361
xrpcURL := fmt.Sprintf("%s%s?did=%s&cid=%s&method=%s",
362
-
p.holdURL, atproto.SyncGetBlob, p.ctx.DID, dgst.String(), operation)
363
364
req, err := http.NewRequestWithContext(ctx, "GET", xrpcURL, nil)
365
if err != nil {
···
12
"time"
13
14
"atcr.io/pkg/atproto"
15
+
"atcr.io/pkg/auth"
16
"github.com/distribution/distribution/v3"
17
"github.com/distribution/distribution/v3/registry/api/errcode"
18
"github.com/opencontainers/go-digest"
···
33
34
// ProxyBlobStore proxies blob requests to an external storage service
35
type ProxyBlobStore struct {
36
+
ctx *auth.UserContext // User context with identity, target, permissions
37
+
holdURL string // Resolved HTTP URL for XRPC requests
38
httpClient *http.Client
39
}
40
41
// NewProxyBlobStore creates a new proxy blob store
42
+
func NewProxyBlobStore(userCtx *auth.UserContext) *ProxyBlobStore {
43
// Resolve DID to URL once at construction time
44
+
holdURL := atproto.ResolveHoldURL(userCtx.TargetHoldDID)
45
46
+
slog.Debug("NewProxyBlobStore created", "component", "proxy_blob_store", "hold_did", userCtx.TargetHoldDID, "hold_url", holdURL, "user_did", userCtx.TargetOwnerDID, "repo", userCtx.TargetRepo)
47
48
return &ProxyBlobStore{
49
+
ctx: userCtx,
50
holdURL: holdURL,
51
httpClient: &http.Client{
52
Timeout: 5 * time.Minute, // Timeout for presigned URL requests and uploads
···
62
}
63
64
// doAuthenticatedRequest performs an HTTP request with service token authentication
65
+
// Uses the service token from UserContext to authenticate requests to the hold service
66
func (p *ProxyBlobStore) doAuthenticatedRequest(ctx context.Context, req *http.Request) (*http.Response, error) {
67
+
// Get service token from UserContext (lazy-loaded and cached per holdDID)
68
+
serviceToken, err := p.ctx.GetServiceToken(ctx)
69
+
if err != nil {
70
+
slog.Error("Failed to get service token", "component", "proxy_blob_store", "did", p.ctx.DID, "error", err)
71
+
return nil, fmt.Errorf("failed to get service token: %w", err)
72
+
}
73
+
if serviceToken == "" {
74
// Should never happen - middleware validates OAuth before handlers run
75
slog.Error("No service token in context", "component", "proxy_blob_store", "did", p.ctx.DID)
76
return nil, fmt.Errorf("no service token available (middleware should have validated)")
77
}
78
79
// Add Bearer token to Authorization header
80
+
req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", serviceToken))
81
82
return p.httpClient.Do(req)
83
}
84
85
// checkReadAccess validates that the user has read access to blobs in this hold
86
func (p *ProxyBlobStore) checkReadAccess(ctx context.Context) error {
87
+
canRead, err := p.ctx.CanRead(ctx)
88
if err != nil {
89
return fmt.Errorf("authorization check failed: %w", err)
90
}
91
+
if !canRead {
92
// Return 403 Forbidden instead of masquerading as missing blob
93
return errcode.ErrorCodeDenied.WithMessage("read access denied")
94
}
···
97
98
// checkWriteAccess validates that the user has write access to blobs in this hold
99
func (p *ProxyBlobStore) checkWriteAccess(ctx context.Context) error {
100
+
slog.Debug("Checking write access", "component", "proxy_blob_store", "user_did", p.ctx.DID, "hold_did", p.ctx.TargetHoldDID)
101
+
canWrite, err := p.ctx.CanWrite(ctx)
102
if err != nil {
103
slog.Error("Authorization check error", "component", "proxy_blob_store", "error", err)
104
return fmt.Errorf("authorization check failed: %w", err)
105
}
106
+
if !canWrite {
107
+
slog.Warn("Write access denied", "component", "proxy_blob_store", "user_did", p.ctx.DID, "hold_did", p.ctx.TargetHoldDID)
108
+
return errcode.ErrorCodeDenied.WithMessage(fmt.Sprintf("write access denied to hold %s", p.ctx.TargetHoldDID))
109
}
110
+
slog.Debug("Write access allowed", "component", "proxy_blob_store", "user_did", p.ctx.DID, "hold_did", p.ctx.TargetHoldDID)
111
return nil
112
}
113
···
354
// getPresignedURL returns the XRPC endpoint URL for blob operations
355
func (p *ProxyBlobStore) getPresignedURL(ctx context.Context, operation string, dgst digest.Digest) (string, error) {
356
// Use XRPC endpoint: /xrpc/com.atproto.sync.getBlob?did={userDID}&cid={digest}
357
+
// The 'did' parameter is the TARGET OWNER's DID (whose blob we're fetching), not the hold service DID
358
// Per migration doc: hold accepts OCI digest directly as cid parameter (checks for sha256: prefix)
359
xrpcURL := fmt.Sprintf("%s%s?did=%s&cid=%s&method=%s",
360
+
p.holdURL, atproto.SyncGetBlob, p.ctx.TargetOwnerDID, dgst.String(), operation)
361
362
req, err := http.NewRequestWithContext(ctx, "GET", xrpcURL, nil)
363
if err != nil {
+78
-420
pkg/appview/storage/proxy_blob_store_test.go
+78
-420
pkg/appview/storage/proxy_blob_store_test.go
···
1
package storage
2
3
import (
4
-
"context"
5
"encoding/base64"
6
-
"encoding/json"
7
"fmt"
8
-
"net/http"
9
-
"net/http/httptest"
10
"strings"
11
"testing"
12
"time"
13
14
"atcr.io/pkg/atproto"
15
-
"atcr.io/pkg/auth/token"
16
-
"github.com/opencontainers/go-digest"
17
)
18
19
-
// TestGetServiceToken_CachingLogic tests the token caching mechanism
20
func TestGetServiceToken_CachingLogic(t *testing.T) {
21
-
userDID := "did:plc:test"
22
holdDID := "did:web:hold.example.com"
23
24
// Test 1: Empty cache - invalidate any existing token
25
-
token.InvalidateServiceToken(userDID, holdDID)
26
-
cachedToken, _ := token.GetServiceToken(userDID, holdDID)
27
if cachedToken != "" {
28
t.Error("Expected empty cache at start")
29
}
30
31
// Test 2: Insert token into cache
32
// Create a JWT-like token with exp claim for testing
33
-
// Format: header.payload.signature where payload has exp claim
34
testPayload := fmt.Sprintf(`{"exp":%d}`, time.Now().Add(50*time.Second).Unix())
35
testToken := "eyJhbGciOiJIUzI1NiJ9." + base64URLEncode(testPayload) + ".signature"
36
37
-
err := token.SetServiceToken(userDID, holdDID, testToken)
38
if err != nil {
39
t.Fatalf("Failed to set service token: %v", err)
40
}
41
42
// Test 3: Retrieve from cache
43
-
cachedToken, expiresAt := token.GetServiceToken(userDID, holdDID)
44
if cachedToken == "" {
45
t.Fatal("Expected token to be in cache")
46
}
···
56
// Test 4: Expired token - GetServiceToken automatically removes it
57
expiredPayload := fmt.Sprintf(`{"exp":%d}`, time.Now().Add(-1*time.Hour).Unix())
58
expiredToken := "eyJhbGciOiJIUzI1NiJ9." + base64URLEncode(expiredPayload) + ".signature"
59
-
token.SetServiceToken(userDID, holdDID, expiredToken)
60
61
// GetServiceToken should return empty string for expired token
62
-
cachedToken, _ = token.GetServiceToken(userDID, holdDID)
63
if cachedToken != "" {
64
t.Error("Expected expired token to be removed from cache")
65
}
···
70
return strings.TrimRight(base64.URLEncoding.EncodeToString([]byte(data)), "=")
71
}
72
73
-
// TestServiceToken_EmptyInContext tests that operations fail when service token is missing
74
-
func TestServiceToken_EmptyInContext(t *testing.T) {
75
-
ctx := &RegistryContext{
76
-
DID: "did:plc:test",
77
-
HoldDID: "did:web:hold.example.com",
78
-
PDSEndpoint: "https://pds.example.com",
79
-
Repository: "test-repo",
80
-
ServiceToken: "", // No service token (middleware didn't set it)
81
-
Refresher: nil,
82
-
}
83
84
-
store := NewProxyBlobStore(ctx)
85
86
-
// Try a write operation that requires authentication
87
-
testDigest := digest.FromString("test-content")
88
-
_, err := store.Stat(context.Background(), testDigest)
89
90
-
// Should fail because no service token is available
91
-
if err == nil {
92
-
t.Error("Expected error when service token is empty")
93
-
}
94
95
-
// Error should indicate authentication issue
96
-
if !strings.Contains(err.Error(), "UNAUTHORIZED") && !strings.Contains(err.Error(), "authentication") {
97
-
t.Logf("Got error (acceptable): %v", err)
98
-
}
99
}
100
101
-
// TestDoAuthenticatedRequest_BearerTokenInjection tests that Bearer tokens are added to requests
102
-
func TestDoAuthenticatedRequest_BearerTokenInjection(t *testing.T) {
103
-
// This test verifies the Bearer token injection logic
104
-
105
-
testToken := "test-bearer-token-xyz"
106
-
107
-
// Create a test server to verify the Authorization header
108
-
var receivedAuthHeader string
109
-
testServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
110
-
receivedAuthHeader = r.Header.Get("Authorization")
111
-
w.WriteHeader(http.StatusOK)
112
-
}))
113
-
defer testServer.Close()
114
-
115
-
// Create ProxyBlobStore with service token in context (set by middleware)
116
-
ctx := &RegistryContext{
117
-
DID: "did:plc:bearer-test",
118
-
HoldDID: "did:web:hold.example.com",
119
-
PDSEndpoint: "https://pds.example.com",
120
-
Repository: "test-repo",
121
-
ServiceToken: testToken, // Service token from middleware
122
-
Refresher: nil,
123
-
}
124
-
125
-
store := NewProxyBlobStore(ctx)
126
-
127
-
// Create request
128
-
req, err := http.NewRequest(http.MethodGet, testServer.URL+"/test", nil)
129
-
if err != nil {
130
-
t.Fatalf("Failed to create request: %v", err)
131
-
}
132
-
133
-
// Do authenticated request
134
-
resp, err := store.doAuthenticatedRequest(context.Background(), req)
135
-
if err != nil {
136
-
t.Fatalf("doAuthenticatedRequest failed: %v", err)
137
-
}
138
-
defer resp.Body.Close()
139
-
140
-
// Verify Bearer token was added
141
-
expectedHeader := "Bearer " + testToken
142
-
if receivedAuthHeader != expectedHeader {
143
-
t.Errorf("Expected Authorization header %s, got %s", expectedHeader, receivedAuthHeader)
144
-
}
145
}
146
147
-
// TestDoAuthenticatedRequest_ErrorWhenTokenUnavailable tests that authentication failures return proper errors
148
-
func TestDoAuthenticatedRequest_ErrorWhenTokenUnavailable(t *testing.T) {
149
-
// Create test server (should not be called since auth fails first)
150
-
called := false
151
-
testServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
152
-
called = true
153
-
w.WriteHeader(http.StatusOK)
154
-
}))
155
-
defer testServer.Close()
156
-
157
-
// Create ProxyBlobStore without service token (middleware didn't set it)
158
-
ctx := &RegistryContext{
159
-
DID: "did:plc:fallback",
160
-
HoldDID: "did:web:hold.example.com",
161
-
PDSEndpoint: "https://pds.example.com",
162
-
Repository: "test-repo",
163
-
ServiceToken: "", // No service token
164
-
Refresher: nil,
165
-
}
166
-
167
-
store := NewProxyBlobStore(ctx)
168
-
169
-
// Create request
170
-
req, err := http.NewRequest(http.MethodGet, testServer.URL+"/test", nil)
171
-
if err != nil {
172
-
t.Fatalf("Failed to create request: %v", err)
173
-
}
174
-
175
-
// Do authenticated request - should fail when no service token
176
-
resp, err := store.doAuthenticatedRequest(context.Background(), req)
177
-
if err == nil {
178
-
t.Fatal("Expected doAuthenticatedRequest to fail when no service token is available")
179
-
}
180
-
if resp != nil {
181
-
resp.Body.Close()
182
-
}
183
-
184
-
// Verify error indicates authentication/authorization issue
185
-
errStr := err.Error()
186
-
if !strings.Contains(errStr, "service token") && !strings.Contains(errStr, "UNAUTHORIZED") {
187
-
t.Errorf("Expected service token or unauthorized error, got: %v", err)
188
-
}
189
-
190
-
if called {
191
-
t.Error("Expected request to NOT be made when authentication fails")
192
-
}
193
-
}
194
-
195
-
// TestResolveHoldURL tests DID to URL conversion
196
func TestResolveHoldURL(t *testing.T) {
197
tests := []struct {
198
name string
···
200
expected string
201
}{
202
{
203
-
name: "did:web with http (TEST_MODE)",
204
holdDID: "did:web:localhost:8080",
205
expected: "http://localhost:8080",
206
},
···
228
229
// TestServiceTokenCacheExpiry tests that expired cached tokens are not used
230
func TestServiceTokenCacheExpiry(t *testing.T) {
231
-
userDID := "did:plc:expiry"
232
holdDID := "did:web:hold.example.com"
233
234
// Insert expired token
235
expiredPayload := fmt.Sprintf(`{"exp":%d}`, time.Now().Add(-1*time.Hour).Unix())
236
expiredToken := "eyJhbGciOiJIUzI1NiJ9." + base64URLEncode(expiredPayload) + ".signature"
237
-
token.SetServiceToken(userDID, holdDID, expiredToken)
238
239
// GetServiceToken should automatically remove expired tokens
240
-
cachedToken, expiresAt := token.GetServiceToken(userDID, holdDID)
241
242
// Should return empty string for expired token
243
if cachedToken != "" {
···
272
273
// TestNewProxyBlobStore tests ProxyBlobStore creation
274
func TestNewProxyBlobStore(t *testing.T) {
275
-
ctx := &RegistryContext{
276
-
DID: "did:plc:test",
277
-
HoldDID: "did:web:hold.example.com",
278
-
PDSEndpoint: "https://pds.example.com",
279
-
Repository: "test-repo",
280
-
}
281
282
-
store := NewProxyBlobStore(ctx)
283
284
if store == nil {
285
t.Fatal("Expected non-nil ProxyBlobStore")
286
}
287
288
-
if store.ctx != ctx {
289
t.Error("Expected context to be set")
290
}
291
···
310
311
testPayload := fmt.Sprintf(`{"exp":%d}`, time.Now().Add(50*time.Second).Unix())
312
testTokenStr := "eyJhbGciOiJIUzI1NiJ9." + base64URLEncode(testPayload) + ".signature"
313
-
token.SetServiceToken(userDID, holdDID, testTokenStr)
314
315
for b.Loop() {
316
-
cachedToken, expiresAt := token.GetServiceToken(userDID, holdDID)
317
318
if cachedToken == "" || time.Now().After(expiresAt) {
319
b.Error("Cache miss in benchmark")
···
321
}
322
}
323
324
-
// TestCompleteMultipartUpload_JSONFormat verifies the JSON request format sent to hold service
325
-
// This test would have caught the "partNumber" vs "part_number" bug
326
-
func TestCompleteMultipartUpload_JSONFormat(t *testing.T) {
327
-
var capturedBody map[string]any
328
-
329
-
// Mock hold service that captures the request body
330
-
holdServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
331
-
if !strings.Contains(r.URL.Path, atproto.HoldCompleteUpload) {
332
-
t.Errorf("Wrong endpoint called: %s", r.URL.Path)
333
-
}
334
-
335
-
// Capture request body
336
-
var body map[string]any
337
-
if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
338
-
t.Errorf("Failed to decode request body: %v", err)
339
-
}
340
-
capturedBody = body
341
-
342
-
w.Header().Set("Content-Type", "application/json")
343
-
w.WriteHeader(http.StatusOK)
344
-
w.Write([]byte(`{}`))
345
-
}))
346
-
defer holdServer.Close()
347
-
348
-
// Create store with mocked hold URL
349
-
ctx := &RegistryContext{
350
-
DID: "did:plc:test",
351
-
HoldDID: "did:web:hold.example.com",
352
-
PDSEndpoint: "https://pds.example.com",
353
-
Repository: "test-repo",
354
-
ServiceToken: "test-service-token", // Service token from middleware
355
-
}
356
-
store := NewProxyBlobStore(ctx)
357
-
store.holdURL = holdServer.URL
358
-
359
-
// Call completeMultipartUpload
360
-
parts := []CompletedPart{
361
-
{PartNumber: 1, ETag: "etag-1"},
362
-
{PartNumber: 2, ETag: "etag-2"},
363
-
}
364
-
err := store.completeMultipartUpload(context.Background(), "sha256:abc123", "upload-id-xyz", parts)
365
-
if err != nil {
366
-
t.Fatalf("completeMultipartUpload failed: %v", err)
367
-
}
368
-
369
-
// Verify JSON format
370
-
if capturedBody == nil {
371
-
t.Fatal("No request body was captured")
372
-
}
373
-
374
-
// Check top-level fields
375
-
if uploadID, ok := capturedBody["uploadId"].(string); !ok || uploadID != "upload-id-xyz" {
376
-
t.Errorf("Expected uploadId='upload-id-xyz', got %v", capturedBody["uploadId"])
377
-
}
378
-
if digest, ok := capturedBody["digest"].(string); !ok || digest != "sha256:abc123" {
379
-
t.Errorf("Expected digest='sha256:abc123', got %v", capturedBody["digest"])
380
-
}
381
-
382
-
// Check parts array
383
-
partsArray, ok := capturedBody["parts"].([]any)
384
-
if !ok {
385
-
t.Fatalf("Expected parts to be array, got %T", capturedBody["parts"])
386
-
}
387
-
if len(partsArray) != 2 {
388
-
t.Fatalf("Expected 2 parts, got %d", len(partsArray))
389
-
}
390
-
391
-
// Verify first part has "part_number" (not "partNumber")
392
-
part0, ok := partsArray[0].(map[string]any)
393
-
if !ok {
394
-
t.Fatalf("Expected part to be object, got %T", partsArray[0])
395
-
}
396
-
397
-
// THIS IS THE KEY CHECK - would have caught the bug
398
-
if _, hasPartNumber := part0["partNumber"]; hasPartNumber {
399
-
t.Error("Found 'partNumber' (camelCase) - should be 'part_number' (snake_case)")
400
-
}
401
-
if partNum, ok := part0["part_number"].(float64); !ok || int(partNum) != 1 {
402
-
t.Errorf("Expected part_number=1, got %v", part0["part_number"])
403
-
}
404
-
if etag, ok := part0["etag"].(string); !ok || etag != "etag-1" {
405
-
t.Errorf("Expected etag='etag-1', got %v", part0["etag"])
406
-
}
407
-
}
408
409
-
// TestGet_UsesPresignedURLDirectly verifies that Get() doesn't add auth headers to presigned URLs
410
-
// This test would have caught the presigned URL authentication bug
411
-
func TestGet_UsesPresignedURLDirectly(t *testing.T) {
412
-
blobData := []byte("test blob content")
413
-
var s3ReceivedAuthHeader string
414
-
415
-
// Mock S3 server that rejects requests with Authorization header
416
-
s3Server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
417
-
s3ReceivedAuthHeader = r.Header.Get("Authorization")
418
-
419
-
// Presigned URLs should NOT have Authorization header
420
-
if s3ReceivedAuthHeader != "" {
421
-
t.Errorf("S3 received Authorization header: %s (should be empty for presigned URLs)", s3ReceivedAuthHeader)
422
-
w.WriteHeader(http.StatusForbidden)
423
-
w.Write([]byte(`<?xml version="1.0"?><Error><Code>SignatureDoesNotMatch</Code></Error>`))
424
-
return
425
-
}
426
-
427
-
// Return blob data
428
-
w.WriteHeader(http.StatusOK)
429
-
w.Write(blobData)
430
-
}))
431
-
defer s3Server.Close()
432
-
433
-
// Mock hold service that returns presigned S3 URL
434
-
holdServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
435
-
// Return presigned URL pointing to S3 server
436
-
w.Header().Set("Content-Type", "application/json")
437
-
w.WriteHeader(http.StatusOK)
438
-
resp := map[string]string{
439
-
"url": s3Server.URL + "/blob?X-Amz-Signature=fake-signature",
440
-
}
441
-
json.NewEncoder(w).Encode(resp)
442
-
}))
443
-
defer holdServer.Close()
444
-
445
-
// Create store with service token in context
446
-
ctx := &RegistryContext{
447
-
DID: "did:plc:test",
448
-
HoldDID: "did:web:hold.example.com",
449
-
PDSEndpoint: "https://pds.example.com",
450
-
Repository: "test-repo",
451
-
ServiceToken: "test-service-token", // Service token from middleware
452
-
}
453
-
store := NewProxyBlobStore(ctx)
454
-
store.holdURL = holdServer.URL
455
-
456
-
// Call Get()
457
-
dgst := digest.FromBytes(blobData)
458
-
retrieved, err := store.Get(context.Background(), dgst)
459
if err != nil {
460
-
t.Fatalf("Get() failed: %v", err)
461
}
462
463
-
// Verify correct data was retrieved
464
-
if string(retrieved) != string(blobData) {
465
-
t.Errorf("Expected data=%s, got %s", string(blobData), string(retrieved))
466
-
}
467
-
468
-
// Verify S3 received NO Authorization header
469
-
if s3ReceivedAuthHeader != "" {
470
-
t.Errorf("S3 should not receive Authorization header for presigned URLs, got: %s", s3ReceivedAuthHeader)
471
}
472
}
473
474
-
// TestOpen_UsesPresignedURLDirectly verifies that Open() doesn't add auth headers to presigned URLs
475
-
// This test would have caught the presigned URL authentication bug
476
-
func TestOpen_UsesPresignedURLDirectly(t *testing.T) {
477
-
blobData := []byte("test blob stream content")
478
-
var s3ReceivedAuthHeader string
479
-
480
-
// Mock S3 server
481
-
s3Server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
482
-
s3ReceivedAuthHeader = r.Header.Get("Authorization")
483
-
484
-
// Presigned URLs should NOT have Authorization header
485
-
if s3ReceivedAuthHeader != "" {
486
-
t.Errorf("S3 received Authorization header: %s (should be empty)", s3ReceivedAuthHeader)
487
-
w.WriteHeader(http.StatusForbidden)
488
-
return
489
-
}
490
-
491
-
w.WriteHeader(http.StatusOK)
492
-
w.Write(blobData)
493
-
}))
494
-
defer s3Server.Close()
495
-
496
-
// Mock hold service
497
-
holdServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
498
-
w.Header().Set("Content-Type", "application/json")
499
-
w.WriteHeader(http.StatusOK)
500
-
json.NewEncoder(w).Encode(map[string]string{
501
-
"url": s3Server.URL + "/blob?X-Amz-Signature=fake",
502
-
})
503
-
}))
504
-
defer holdServer.Close()
505
-
506
-
// Create store with service token in context
507
-
ctx := &RegistryContext{
508
-
DID: "did:plc:test",
509
-
HoldDID: "did:web:hold.example.com",
510
-
PDSEndpoint: "https://pds.example.com",
511
-
Repository: "test-repo",
512
-
ServiceToken: "test-service-token", // Service token from middleware
513
-
}
514
-
store := NewProxyBlobStore(ctx)
515
-
store.holdURL = holdServer.URL
516
-
517
-
// Call Open()
518
-
dgst := digest.FromBytes(blobData)
519
-
reader, err := store.Open(context.Background(), dgst)
520
-
if err != nil {
521
-
t.Fatalf("Open() failed: %v", err)
522
-
}
523
-
defer reader.Close()
524
-
525
-
// Verify S3 received NO Authorization header
526
-
if s3ReceivedAuthHeader != "" {
527
-
t.Errorf("S3 should not receive Authorization header for presigned URLs, got: %s", s3ReceivedAuthHeader)
528
-
}
529
-
}
530
-
531
-
// TestMultipartEndpoints_CorrectURLs verifies all multipart XRPC endpoints use correct URLs
532
-
// This would have caught the old com.atproto.repo.uploadBlob vs new io.atcr.hold.* endpoints
533
-
func TestMultipartEndpoints_CorrectURLs(t *testing.T) {
534
tests := []struct {
535
-
name string
536
-
testFunc func(*ProxyBlobStore) error
537
-
expectedPath string
538
}{
539
-
{
540
-
name: "startMultipartUpload",
541
-
testFunc: func(store *ProxyBlobStore) error {
542
-
_, err := store.startMultipartUpload(context.Background(), "sha256:test")
543
-
return err
544
-
},
545
-
expectedPath: atproto.HoldInitiateUpload,
546
-
},
547
-
{
548
-
name: "getPartUploadInfo",
549
-
testFunc: func(store *ProxyBlobStore) error {
550
-
_, err := store.getPartUploadInfo(context.Background(), "sha256:test", "upload-123", 1)
551
-
return err
552
-
},
553
-
expectedPath: atproto.HoldGetPartUploadURL,
554
-
},
555
-
{
556
-
name: "completeMultipartUpload",
557
-
testFunc: func(store *ProxyBlobStore) error {
558
-
parts := []CompletedPart{{PartNumber: 1, ETag: "etag1"}}
559
-
return store.completeMultipartUpload(context.Background(), "sha256:test", "upload-123", parts)
560
-
},
561
-
expectedPath: atproto.HoldCompleteUpload,
562
-
},
563
-
{
564
-
name: "abortMultipartUpload",
565
-
testFunc: func(store *ProxyBlobStore) error {
566
-
return store.abortMultipartUpload(context.Background(), "sha256:test", "upload-123")
567
-
},
568
-
expectedPath: atproto.HoldAbortUpload,
569
-
},
570
}
571
572
for _, tt := range tests {
573
t.Run(tt.name, func(t *testing.T) {
574
-
var capturedPath string
575
-
576
-
// Mock hold service that captures request path
577
-
holdServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
578
-
capturedPath = r.URL.Path
579
-
580
-
// Return success response
581
-
w.Header().Set("Content-Type", "application/json")
582
-
w.WriteHeader(http.StatusOK)
583
-
resp := map[string]string{
584
-
"uploadId": "test-upload-id",
585
-
"url": "https://s3.example.com/presigned",
586
-
}
587
-
json.NewEncoder(w).Encode(resp)
588
-
}))
589
-
defer holdServer.Close()
590
-
591
-
// Create store with service token in context
592
-
ctx := &RegistryContext{
593
-
DID: "did:plc:test",
594
-
HoldDID: "did:web:hold.example.com",
595
-
PDSEndpoint: "https://pds.example.com",
596
-
Repository: "test-repo",
597
-
ServiceToken: "test-service-token", // Service token from middleware
598
-
}
599
-
store := NewProxyBlobStore(ctx)
600
-
store.holdURL = holdServer.URL
601
-
602
-
// Call the function
603
-
_ = tt.testFunc(store) // Ignore error, we just care about the URL
604
-
605
-
// Verify correct endpoint was called
606
-
if capturedPath != tt.expectedPath {
607
-
t.Errorf("Expected endpoint %s, got %s", tt.expectedPath, capturedPath)
608
-
}
609
-
610
-
// Verify it's NOT the old endpoint
611
-
if strings.Contains(capturedPath, "com.atproto.repo.uploadBlob") {
612
-
t.Error("Still using old com.atproto.repo.uploadBlob endpoint!")
613
}
614
})
615
}
616
}
···
1
package storage
2
3
import (
4
"encoding/base64"
5
"fmt"
6
"strings"
7
"testing"
8
"time"
9
10
"atcr.io/pkg/atproto"
11
+
"atcr.io/pkg/auth"
12
)
13
14
+
// TestGetServiceToken_CachingLogic tests the global service token caching mechanism
15
+
// These tests use the global auth cache functions directly
16
func TestGetServiceToken_CachingLogic(t *testing.T) {
17
+
userDID := "did:plc:cache-test"
18
holdDID := "did:web:hold.example.com"
19
20
// Test 1: Empty cache - invalidate any existing token
21
+
auth.InvalidateServiceToken(userDID, holdDID)
22
+
cachedToken, _ := auth.GetServiceToken(userDID, holdDID)
23
if cachedToken != "" {
24
t.Error("Expected empty cache at start")
25
}
26
27
// Test 2: Insert token into cache
28
// Create a JWT-like token with exp claim for testing
29
testPayload := fmt.Sprintf(`{"exp":%d}`, time.Now().Add(50*time.Second).Unix())
30
testToken := "eyJhbGciOiJIUzI1NiJ9." + base64URLEncode(testPayload) + ".signature"
31
32
+
err := auth.SetServiceToken(userDID, holdDID, testToken)
33
if err != nil {
34
t.Fatalf("Failed to set service token: %v", err)
35
}
36
37
// Test 3: Retrieve from cache
38
+
cachedToken, expiresAt := auth.GetServiceToken(userDID, holdDID)
39
if cachedToken == "" {
40
t.Fatal("Expected token to be in cache")
41
}
···
51
// Test 4: Expired token - GetServiceToken automatically removes it
52
expiredPayload := fmt.Sprintf(`{"exp":%d}`, time.Now().Add(-1*time.Hour).Unix())
53
expiredToken := "eyJhbGciOiJIUzI1NiJ9." + base64URLEncode(expiredPayload) + ".signature"
54
+
auth.SetServiceToken(userDID, holdDID, expiredToken)
55
56
// GetServiceToken should return empty string for expired token
57
+
cachedToken, _ = auth.GetServiceToken(userDID, holdDID)
58
if cachedToken != "" {
59
t.Error("Expected expired token to be removed from cache")
60
}
···
65
return strings.TrimRight(base64.URLEncoding.EncodeToString([]byte(data)), "=")
66
}
67
68
+
// mockUserContextForProxy creates a mock auth.UserContext for proxy blob store testing.
69
+
// It sets up both the user identity and target info, and configures test helpers
70
+
// to bypass network calls.
71
+
func mockUserContextForProxy(did, holdDID, pdsEndpoint, repository string) *auth.UserContext {
72
+
userCtx := auth.NewUserContext(did, "oauth", "PUT", nil)
73
+
userCtx.SetTarget(did, "test.handle", pdsEndpoint, repository, holdDID)
74
75
+
// Bypass PDS resolution (avoids network calls)
76
+
userCtx.SetPDSForTest("test.handle", pdsEndpoint)
77
78
+
// Set up mock authorizer that allows access
79
+
userCtx.SetAuthorizerForTest(auth.NewMockHoldAuthorizer())
80
81
+
// Set default hold DID for push resolution
82
+
userCtx.SetDefaultHoldDIDForTest(holdDID)
83
84
+
return userCtx
85
}
86
87
+
// mockUserContextForProxyWithToken creates a mock UserContext with a pre-populated service token.
88
+
func mockUserContextForProxyWithToken(did, holdDID, pdsEndpoint, repository, serviceToken string) *auth.UserContext {
89
+
userCtx := mockUserContextForProxy(did, holdDID, pdsEndpoint, repository)
90
+
userCtx.SetServiceTokenForTest(holdDID, serviceToken)
91
+
return userCtx
92
}
93
94
+
// TestResolveHoldURL tests DID to URL conversion (pure function)
95
func TestResolveHoldURL(t *testing.T) {
96
tests := []struct {
97
name string
···
99
expected string
100
}{
101
{
102
+
name: "did:web with http (localhost)",
103
holdDID: "did:web:localhost:8080",
104
expected: "http://localhost:8080",
105
},
···
127
128
// TestServiceTokenCacheExpiry tests that expired cached tokens are not used
129
func TestServiceTokenCacheExpiry(t *testing.T) {
130
+
userDID := "did:plc:expiry-test"
131
holdDID := "did:web:hold.example.com"
132
133
// Insert expired token
134
expiredPayload := fmt.Sprintf(`{"exp":%d}`, time.Now().Add(-1*time.Hour).Unix())
135
expiredToken := "eyJhbGciOiJIUzI1NiJ9." + base64URLEncode(expiredPayload) + ".signature"
136
+
auth.SetServiceToken(userDID, holdDID, expiredToken)
137
138
// GetServiceToken should automatically remove expired tokens
139
+
cachedToken, expiresAt := auth.GetServiceToken(userDID, holdDID)
140
141
// Should return empty string for expired token
142
if cachedToken != "" {
···
171
172
// TestNewProxyBlobStore tests ProxyBlobStore creation
173
func TestNewProxyBlobStore(t *testing.T) {
174
+
userCtx := mockUserContextForProxy(
175
+
"did:plc:test",
176
+
"did:web:hold.example.com",
177
+
"https://pds.example.com",
178
+
"test-repo",
179
+
)
180
181
+
store := NewProxyBlobStore(userCtx)
182
183
if store == nil {
184
t.Fatal("Expected non-nil ProxyBlobStore")
185
}
186
187
+
if store.ctx != userCtx {
188
t.Error("Expected context to be set")
189
}
190
···
209
210
testPayload := fmt.Sprintf(`{"exp":%d}`, time.Now().Add(50*time.Second).Unix())
211
testTokenStr := "eyJhbGciOiJIUzI1NiJ9." + base64URLEncode(testPayload) + ".signature"
212
+
auth.SetServiceToken(userDID, holdDID, testTokenStr)
213
214
for b.Loop() {
215
+
cachedToken, expiresAt := auth.GetServiceToken(userDID, holdDID)
216
217
if cachedToken == "" || time.Now().After(expiresAt) {
218
b.Error("Cache miss in benchmark")
···
220
}
221
}
222
223
+
// TestParseJWTExpiry tests JWT expiry parsing
224
+
func TestParseJWTExpiry(t *testing.T) {
225
+
// Create a JWT with known expiry
226
+
futureTime := time.Now().Add(1 * time.Hour).Unix()
227
+
testPayload := fmt.Sprintf(`{"exp":%d}`, futureTime)
228
+
testToken := "eyJhbGciOiJIUzI1NiJ9." + base64URLEncode(testPayload) + ".signature"
229
230
+
expiry, err := auth.ParseJWTExpiry(testToken)
231
if err != nil {
232
+
t.Fatalf("ParseJWTExpiry failed: %v", err)
233
}
234
235
+
// Verify expiry is close to what we set (within 1 second tolerance)
236
+
expectedExpiry := time.Unix(futureTime, 0)
237
+
diff := expiry.Sub(expectedExpiry)
238
+
if diff < -time.Second || diff > time.Second {
239
+
t.Errorf("Expiry mismatch: expected %v, got %v", expectedExpiry, expiry)
240
}
241
}
242
243
+
// TestParseJWTExpiry_InvalidToken tests error handling for invalid tokens
244
+
func TestParseJWTExpiry_InvalidToken(t *testing.T) {
245
tests := []struct {
246
+
name string
247
+
token string
248
}{
249
+
{"empty token", ""},
250
+
{"single part", "header"},
251
+
{"two parts", "header.payload"},
252
+
{"invalid base64 payload", "header.!!!.signature"},
253
+
{"missing exp claim", "eyJhbGciOiJIUzI1NiJ9." + base64URLEncode(`{"sub":"test"}`) + ".sig"},
254
}
255
256
for _, tt := range tests {
257
t.Run(tt.name, func(t *testing.T) {
258
+
_, err := auth.ParseJWTExpiry(tt.token)
259
+
if err == nil {
260
+
t.Error("Expected error for invalid token")
261
}
262
})
263
}
264
}
265
+
266
+
// Note: Tests for doAuthenticatedRequest, Get, Open, completeMultipartUpload, etc.
267
+
// require complex dependency mocking (OAuth refresher, PDS resolution, HoldAuthorizer).
268
+
// These should be tested at the integration level with proper infrastructure.
269
+
//
270
+
// The current unit tests cover:
271
+
// - Global service token cache (auth.GetServiceToken, auth.SetServiceToken, etc.)
272
+
// - URL resolution (atproto.ResolveHoldURL)
273
+
// - JWT parsing (auth.ParseJWTExpiry)
274
+
// - Store construction (NewProxyBlobStore)
+39
-74
pkg/appview/storage/routing_repository.go
+39
-74
pkg/appview/storage/routing_repository.go
···
6
7
import (
8
"context"
9
"log/slog"
10
-
"sync"
11
12
"github.com/distribution/distribution/v3"
13
)
14
15
-
// RoutingRepository routes manifests to ATProto and blobs to external hold service
16
-
// The registry (AppView) is stateless and NEVER stores blobs locally
17
type RoutingRepository struct {
18
distribution.Repository
19
-
Ctx *RegistryContext // All context and services (exported for token updates)
20
-
mu sync.Mutex // Protects manifestStore and blobStore
21
-
manifestStore *ManifestStore // Cached manifest store instance
22
-
blobStore *ProxyBlobStore // Cached blob store instance
23
}
24
25
// NewRoutingRepository creates a new routing repository
26
-
func NewRoutingRepository(baseRepo distribution.Repository, ctx *RegistryContext) *RoutingRepository {
27
return &RoutingRepository{
28
Repository: baseRepo,
29
-
Ctx: ctx,
30
}
31
}
32
33
// Manifests returns the ATProto-backed manifest service
34
func (r *RoutingRepository) Manifests(ctx context.Context, options ...distribution.ManifestServiceOption) (distribution.ManifestService, error) {
35
-
r.mu.Lock()
36
-
// Create or return cached manifest store
37
-
if r.manifestStore == nil {
38
-
// Ensure blob store is created first (needed for label extraction during push)
39
-
// Release lock while calling Blobs to avoid deadlock
40
-
r.mu.Unlock()
41
-
blobStore := r.Blobs(ctx)
42
-
r.mu.Lock()
43
-
44
-
// Double-check after reacquiring lock (another goroutine might have set it)
45
-
if r.manifestStore == nil {
46
-
r.manifestStore = NewManifestStore(r.Ctx, blobStore)
47
-
}
48
-
}
49
-
manifestStore := r.manifestStore
50
-
r.mu.Unlock()
51
-
52
-
return manifestStore, nil
53
}
54
55
// Blobs returns a proxy blob store that routes to external hold service
56
-
// The registry (AppView) NEVER stores blobs locally - all blobs go through hold service
57
func (r *RoutingRepository) Blobs(ctx context.Context) distribution.BlobStore {
58
-
r.mu.Lock()
59
-
// Return cached blob store if available
60
-
if r.blobStore != nil {
61
-
blobStore := r.blobStore
62
-
r.mu.Unlock()
63
-
slog.Debug("Returning cached blob store", "component", "storage/blobs", "did", r.Ctx.DID, "repo", r.Ctx.Repository)
64
-
return blobStore
65
-
}
66
-
67
-
// Determine if this is a pull (GET) or push (PUT/POST/HEAD/etc) operation
68
-
// Pull operations use the historical hold DID from the database (blobs are where they were pushed)
69
-
// Push operations use the discovery-based hold DID from user's profile/default
70
-
// This allows users to change their default hold and have new pushes go there
71
-
isPull := false
72
-
if method, ok := ctx.Value("http.request.method").(string); ok {
73
-
isPull = method == "GET"
74
-
}
75
-
76
-
holdDID := r.Ctx.HoldDID // Default to discovery-based DID
77
-
holdSource := "discovery"
78
-
79
-
// Only query database for pull operations
80
-
if isPull && r.Ctx.Database != nil {
81
-
// Query database for the latest manifest's hold DID
82
-
if dbHoldDID, err := r.Ctx.Database.GetLatestHoldDIDForRepo(r.Ctx.DID, r.Ctx.Repository); err == nil && dbHoldDID != "" {
83
-
// Use hold DID from database (pull case - use historical reference)
84
-
holdDID = dbHoldDID
85
-
holdSource = "database"
86
-
slog.Debug("Using hold from database manifest (pull)", "component", "storage/blobs", "did", r.Ctx.DID, "repo", r.Ctx.Repository, "hold", dbHoldDID)
87
-
} else if err != nil {
88
-
// Log error but don't fail - fall back to discovery-based DID
89
-
slog.Warn("Failed to query database for hold DID", "component", "storage/blobs", "error", err)
90
-
}
91
-
// If dbHoldDID is empty (no manifests yet), fall through to use discovery-based DID
92
}
93
94
if holdDID == "" {
95
-
// This should never happen if middleware is configured correctly
96
-
panic("hold DID not set in RegistryContext - ensure default_hold_did is configured in middleware")
97
}
98
99
-
slog.Debug("Using hold DID for blobs", "component", "storage/blobs", "did", r.Ctx.DID, "repo", r.Ctx.Repository, "hold", holdDID, "source", holdSource)
100
-
101
-
// Update context with the correct hold DID (may be from database or discovered)
102
-
r.Ctx.HoldDID = holdDID
103
104
-
// Create and cache proxy blob store
105
-
r.blobStore = NewProxyBlobStore(r.Ctx)
106
-
blobStore := r.blobStore
107
-
r.mu.Unlock()
108
-
return blobStore
109
}
110
111
// Tags returns the tag service
112
// Tags are stored in ATProto as io.atcr.tag records
113
func (r *RoutingRepository) Tags(ctx context.Context) distribution.TagService {
114
-
return NewTagStore(r.Ctx.ATProtoClient, r.Ctx.Repository)
115
}
···
6
7
import (
8
"context"
9
+
"database/sql"
10
"log/slog"
11
12
+
"atcr.io/pkg/auth"
13
"github.com/distribution/distribution/v3"
14
+
"github.com/distribution/reference"
15
)
16
17
+
// RoutingRepository routes manifests to ATProto and blobs to external hold service.
18
+
// The registry (AppView) is stateless and NEVER stores blobs locally.
19
+
// A new instance is created per HTTP request - no caching or synchronization needed.
20
type RoutingRepository struct {
21
distribution.Repository
22
+
userCtx *auth.UserContext
23
+
sqlDB *sql.DB
24
}
25
26
// NewRoutingRepository creates a new routing repository
27
+
func NewRoutingRepository(baseRepo distribution.Repository, userCtx *auth.UserContext, sqlDB *sql.DB) *RoutingRepository {
28
return &RoutingRepository{
29
Repository: baseRepo,
30
+
userCtx: userCtx,
31
+
sqlDB: sqlDB,
32
}
33
}
34
35
// Manifests returns the ATProto-backed manifest service
36
func (r *RoutingRepository) Manifests(ctx context.Context, options ...distribution.ManifestServiceOption) (distribution.ManifestService, error) {
37
+
// blobStore used to fetch labels from th
38
+
blobStore := r.Blobs(ctx)
39
+
return NewManifestStore(r.userCtx, blobStore, r.sqlDB), nil
40
}
41
42
// Blobs returns a proxy blob store that routes to external hold service
43
func (r *RoutingRepository) Blobs(ctx context.Context) distribution.BlobStore {
44
+
// Resolve hold DID: pull uses DB lookup, push uses profile discovery
45
+
holdDID, err := r.userCtx.ResolveHoldDID(ctx, r.sqlDB)
46
+
if err != nil {
47
+
slog.Warn("Failed to resolve hold DID", "component", "storage/blobs", "error", err)
48
+
holdDID = r.userCtx.TargetHoldDID
49
}
50
51
if holdDID == "" {
52
+
panic("hold DID not set - ensure default_hold_did is configured in middleware")
53
}
54
55
+
slog.Debug("Using hold DID for blobs", "component", "storage/blobs", "did", r.userCtx.TargetOwnerDID, "repo", r.userCtx.TargetRepo, "hold", holdDID, "action", r.userCtx.Action.String())
56
57
+
return NewProxyBlobStore(r.userCtx)
58
}
59
60
// Tags returns the tag service
61
// Tags are stored in ATProto as io.atcr.tag records
62
func (r *RoutingRepository) Tags(ctx context.Context) distribution.TagService {
63
+
return NewTagStore(r.userCtx.GetATProtoClient(), r.userCtx.TargetRepo)
64
+
}
65
+
66
+
// Named returns a reference to the repository name.
67
+
// If the base repository is set, it delegates to the base.
68
+
// Otherwise, it constructs a name from the user context.
69
+
func (r *RoutingRepository) Named() reference.Named {
70
+
if r.Repository != nil {
71
+
return r.Repository.Named()
72
+
}
73
+
// Construct from user context
74
+
name, err := reference.WithName(r.userCtx.TargetRepo)
75
+
if err != nil {
76
+
// Fallback: return a simple reference
77
+
name, _ = reference.WithName("unknown")
78
+
}
79
+
return name
80
}
+179
-301
pkg/appview/storage/routing_repository_test.go
+179
-301
pkg/appview/storage/routing_repository_test.go
···
2
3
import (
4
"context"
5
-
"sync"
6
"testing"
7
8
-
"github.com/distribution/distribution/v3"
9
"github.com/stretchr/testify/assert"
10
"github.com/stretchr/testify/require"
11
12
"atcr.io/pkg/atproto"
13
)
14
15
-
// mockDatabase is a simple mock for testing
16
-
type mockDatabase struct {
17
-
holdDID string
18
-
err error
19
-
}
20
21
-
func (m *mockDatabase) IncrementPullCount(did, repository string) error {
22
-
return nil
23
-
}
24
25
-
func (m *mockDatabase) IncrementPushCount(did, repository string) error {
26
-
return nil
27
}
28
29
-
func (m *mockDatabase) GetLatestHoldDIDForRepo(did, repository string) (string, error) {
30
-
if m.err != nil {
31
-
return "", m.err
32
-
}
33
-
return m.holdDID, nil
34
}
35
36
func TestNewRoutingRepository(t *testing.T) {
37
-
ctx := &RegistryContext{
38
-
DID: "did:plc:test123",
39
-
Repository: "debian",
40
-
HoldDID: "did:web:hold01.atcr.io",
41
-
ATProtoClient: &atproto.Client{},
42
-
}
43
-
44
-
repo := NewRoutingRepository(nil, ctx)
45
46
-
if repo.Ctx.DID != "did:plc:test123" {
47
-
t.Errorf("Expected DID %q, got %q", "did:plc:test123", repo.Ctx.DID)
48
-
}
49
50
-
if repo.Ctx.Repository != "debian" {
51
-
t.Errorf("Expected repository %q, got %q", "debian", repo.Ctx.Repository)
52
}
53
54
-
if repo.manifestStore != nil {
55
-
t.Error("Expected manifestStore to be nil initially")
56
}
57
58
-
if repo.blobStore != nil {
59
-
t.Error("Expected blobStore to be nil initially")
60
}
61
}
62
63
// TestRoutingRepository_Manifests tests the Manifests() method
64
func TestRoutingRepository_Manifests(t *testing.T) {
65
-
ctx := &RegistryContext{
66
-
DID: "did:plc:test123",
67
-
Repository: "myapp",
68
-
HoldDID: "did:web:hold01.atcr.io",
69
-
ATProtoClient: atproto.NewClient("https://pds.example.com", "did:plc:test123", ""),
70
-
}
71
72
-
repo := NewRoutingRepository(nil, ctx)
73
manifestService, err := repo.Manifests(context.Background())
74
75
require.NoError(t, err)
76
assert.NotNil(t, manifestService)
77
-
78
-
// Verify the manifest store is cached
79
-
assert.NotNil(t, repo.manifestStore, "manifest store should be cached")
80
-
81
-
// Call again and verify we get the same instance
82
-
manifestService2, err := repo.Manifests(context.Background())
83
-
require.NoError(t, err)
84
-
assert.Same(t, manifestService, manifestService2, "should return cached manifest store")
85
}
86
87
-
// TestRoutingRepository_ManifestStoreCaching tests that manifest store is cached
88
-
func TestRoutingRepository_ManifestStoreCaching(t *testing.T) {
89
-
ctx := &RegistryContext{
90
-
DID: "did:plc:test123",
91
-
Repository: "myapp",
92
-
HoldDID: "did:web:hold01.atcr.io",
93
-
ATProtoClient: atproto.NewClient("https://pds.example.com", "did:plc:test123", ""),
94
-
}
95
-
96
-
repo := NewRoutingRepository(nil, ctx)
97
-
98
-
// First call creates the store
99
-
store1, err := repo.Manifests(context.Background())
100
-
require.NoError(t, err)
101
-
assert.NotNil(t, store1)
102
-
103
-
// Second call returns cached store
104
-
store2, err := repo.Manifests(context.Background())
105
-
require.NoError(t, err)
106
-
assert.Same(t, store1, store2, "should return cached manifest store instance")
107
-
108
-
// Verify internal cache
109
-
assert.NotNil(t, repo.manifestStore)
110
-
}
111
-
112
-
// TestRoutingRepository_Blobs_PullUsesDatabase tests that GET (pull) uses database hold DID
113
-
func TestRoutingRepository_Blobs_PullUsesDatabase(t *testing.T) {
114
-
dbHoldDID := "did:web:database.hold.io"
115
-
discoveryHoldDID := "did:web:discovery.hold.io"
116
-
117
-
ctx := &RegistryContext{
118
-
DID: "did:plc:test123",
119
-
Repository: "myapp",
120
-
HoldDID: discoveryHoldDID, // Discovery-based hold (should be overridden for pull)
121
-
ATProtoClient: atproto.NewClient("https://pds.example.com", "did:plc:test123", ""),
122
-
Database: &mockDatabase{holdDID: dbHoldDID},
123
-
}
124
-
125
-
repo := NewRoutingRepository(nil, ctx)
126
-
127
-
// Create context with GET method (pull operation)
128
-
pullCtx := context.WithValue(context.Background(), "http.request.method", "GET")
129
-
blobStore := repo.Blobs(pullCtx)
130
-
131
-
assert.NotNil(t, blobStore)
132
-
// Verify the hold DID was updated to use the database value for pull
133
-
assert.Equal(t, dbHoldDID, repo.Ctx.HoldDID, "pull (GET) should use database hold DID")
134
-
}
135
-
136
-
// TestRoutingRepository_Blobs_PushUsesDiscovery tests that push operations use discovery hold DID
137
-
func TestRoutingRepository_Blobs_PushUsesDiscovery(t *testing.T) {
138
-
dbHoldDID := "did:web:database.hold.io"
139
-
discoveryHoldDID := "did:web:discovery.hold.io"
140
-
141
-
testCases := []struct {
142
-
name string
143
-
method string
144
-
}{
145
-
{"PUT", "PUT"},
146
-
{"POST", "POST"},
147
-
{"HEAD", "HEAD"},
148
-
{"PATCH", "PATCH"},
149
-
{"DELETE", "DELETE"},
150
-
}
151
-
152
-
for _, tc := range testCases {
153
-
t.Run(tc.name, func(t *testing.T) {
154
-
ctx := &RegistryContext{
155
-
DID: "did:plc:test123",
156
-
Repository: "myapp-" + tc.method, // Unique repo to avoid caching
157
-
HoldDID: discoveryHoldDID,
158
-
ATProtoClient: atproto.NewClient("https://pds.example.com", "did:plc:test123", ""),
159
-
Database: &mockDatabase{holdDID: dbHoldDID},
160
-
}
161
-
162
-
repo := NewRoutingRepository(nil, ctx)
163
-
164
-
// Create context with push method
165
-
pushCtx := context.WithValue(context.Background(), "http.request.method", tc.method)
166
-
blobStore := repo.Blobs(pushCtx)
167
-
168
-
assert.NotNil(t, blobStore)
169
-
// Verify the hold DID remains the discovery-based one for push operations
170
-
assert.Equal(t, discoveryHoldDID, repo.Ctx.HoldDID, "%s should use discovery hold DID, not database", tc.method)
171
-
})
172
-
}
173
-
}
174
-
175
-
// TestRoutingRepository_Blobs_NoMethodUsesDiscovery tests that missing method defaults to discovery
176
-
func TestRoutingRepository_Blobs_NoMethodUsesDiscovery(t *testing.T) {
177
-
dbHoldDID := "did:web:database.hold.io"
178
-
discoveryHoldDID := "did:web:discovery.hold.io"
179
-
180
-
ctx := &RegistryContext{
181
-
DID: "did:plc:test123",
182
-
Repository: "myapp-nomethod",
183
-
HoldDID: discoveryHoldDID,
184
-
ATProtoClient: atproto.NewClient("https://pds.example.com", "did:plc:test123", ""),
185
-
Database: &mockDatabase{holdDID: dbHoldDID},
186
-
}
187
-
188
-
repo := NewRoutingRepository(nil, ctx)
189
-
190
-
// Context without HTTP method (shouldn't happen in practice, but test defensive behavior)
191
-
blobStore := repo.Blobs(context.Background())
192
-
193
-
assert.NotNil(t, blobStore)
194
-
// Without method, should default to discovery (safer for push scenarios)
195
-
assert.Equal(t, discoveryHoldDID, repo.Ctx.HoldDID, "missing method should use discovery hold DID")
196
-
}
197
-
198
-
// TestRoutingRepository_Blobs_WithoutDatabase tests blob store with discovery-based hold
199
-
func TestRoutingRepository_Blobs_WithoutDatabase(t *testing.T) {
200
-
discoveryHoldDID := "did:web:discovery.hold.io"
201
-
202
-
ctx := &RegistryContext{
203
-
DID: "did:plc:nocache456",
204
-
Repository: "uncached-app",
205
-
HoldDID: discoveryHoldDID,
206
-
ATProtoClient: atproto.NewClient("https://pds.example.com", "did:plc:nocache456", ""),
207
-
Database: nil, // No database
208
-
}
209
-
210
-
repo := NewRoutingRepository(nil, ctx)
211
-
blobStore := repo.Blobs(context.Background())
212
-
213
-
assert.NotNil(t, blobStore)
214
-
// Verify the hold DID remains the discovery-based one
215
-
assert.Equal(t, discoveryHoldDID, repo.Ctx.HoldDID, "should use discovery-based hold DID")
216
-
}
217
-
218
-
// TestRoutingRepository_Blobs_DatabaseEmptyFallback tests fallback when database returns empty hold DID
219
-
func TestRoutingRepository_Blobs_DatabaseEmptyFallback(t *testing.T) {
220
-
discoveryHoldDID := "did:web:discovery.hold.io"
221
-
222
-
ctx := &RegistryContext{
223
-
DID: "did:plc:test123",
224
-
Repository: "newapp",
225
-
HoldDID: discoveryHoldDID,
226
-
ATProtoClient: atproto.NewClient("https://pds.example.com", "did:plc:test123", ""),
227
-
Database: &mockDatabase{holdDID: ""}, // Empty string (no manifests yet)
228
-
}
229
230
-
repo := NewRoutingRepository(nil, ctx)
231
blobStore := repo.Blobs(context.Background())
232
233
assert.NotNil(t, blobStore)
234
-
// Verify the hold DID falls back to discovery-based
235
-
assert.Equal(t, discoveryHoldDID, repo.Ctx.HoldDID, "should fall back to discovery-based hold DID when database returns empty")
236
-
}
237
-
238
-
// TestRoutingRepository_BlobStoreCaching tests that blob store is cached
239
-
func TestRoutingRepository_BlobStoreCaching(t *testing.T) {
240
-
ctx := &RegistryContext{
241
-
DID: "did:plc:test123",
242
-
Repository: "myapp",
243
-
HoldDID: "did:web:hold01.atcr.io",
244
-
ATProtoClient: atproto.NewClient("https://pds.example.com", "did:plc:test123", ""),
245
-
}
246
-
247
-
repo := NewRoutingRepository(nil, ctx)
248
-
249
-
// First call creates the store
250
-
store1 := repo.Blobs(context.Background())
251
-
assert.NotNil(t, store1)
252
-
253
-
// Second call returns cached store
254
-
store2 := repo.Blobs(context.Background())
255
-
assert.Same(t, store1, store2, "should return cached blob store instance")
256
-
257
-
// Verify internal cache
258
-
assert.NotNil(t, repo.blobStore)
259
}
260
261
// TestRoutingRepository_Blobs_PanicOnEmptyHoldDID tests panic when hold DID is empty
262
func TestRoutingRepository_Blobs_PanicOnEmptyHoldDID(t *testing.T) {
263
-
// Use a unique DID/repo to ensure no cache entry exists
264
-
ctx := &RegistryContext{
265
-
DID: "did:plc:emptyholdtest999",
266
-
Repository: "empty-hold-app",
267
-
HoldDID: "", // Empty hold DID should panic
268
-
ATProtoClient: atproto.NewClient("https://pds.example.com", "did:plc:emptyholdtest999", ""),
269
-
}
270
271
-
repo := NewRoutingRepository(nil, ctx)
272
273
// Should panic with empty hold DID
274
assert.Panics(t, func() {
···
278
279
// TestRoutingRepository_Tags tests the Tags() method
280
func TestRoutingRepository_Tags(t *testing.T) {
281
-
ctx := &RegistryContext{
282
-
DID: "did:plc:test123",
283
-
Repository: "myapp",
284
-
HoldDID: "did:web:hold01.atcr.io",
285
-
ATProtoClient: atproto.NewClient("https://pds.example.com", "did:plc:test123", ""),
286
-
}
287
288
-
repo := NewRoutingRepository(nil, ctx)
289
tagService := repo.Tags(context.Background())
290
291
assert.NotNil(t, tagService)
292
293
-
// Call again and verify we get a new instance (Tags() doesn't cache)
294
tagService2 := repo.Tags(context.Background())
295
assert.NotNil(t, tagService2)
296
-
// Tags service is not cached, so each call creates a new instance
297
}
298
299
-
// TestRoutingRepository_ConcurrentAccess tests concurrent access to cached stores
300
-
func TestRoutingRepository_ConcurrentAccess(t *testing.T) {
301
-
ctx := &RegistryContext{
302
-
DID: "did:plc:test123",
303
-
Repository: "myapp",
304
-
HoldDID: "did:web:hold01.atcr.io",
305
-
ATProtoClient: atproto.NewClient("https://pds.example.com", "did:plc:test123", ""),
306
}
307
308
-
repo := NewRoutingRepository(nil, ctx)
309
-
310
-
var wg sync.WaitGroup
311
-
numGoroutines := 10
312
313
-
// Track all manifest stores returned
314
-
manifestStores := make([]distribution.ManifestService, numGoroutines)
315
-
blobStores := make([]distribution.BlobStore, numGoroutines)
316
317
-
// Concurrent access to Manifests()
318
-
for i := 0; i < numGoroutines; i++ {
319
-
wg.Add(1)
320
-
go func(index int) {
321
-
defer wg.Done()
322
-
store, err := repo.Manifests(context.Background())
323
-
require.NoError(t, err)
324
-
manifestStores[index] = store
325
-
}(i)
326
}
327
328
-
wg.Wait()
329
-
330
-
// Verify all stores are non-nil (due to race conditions, they may not all be the same instance)
331
-
for i := 0; i < numGoroutines; i++ {
332
-
assert.NotNil(t, manifestStores[i], "manifest store should not be nil")
333
}
334
335
-
// After concurrent creation, subsequent calls should return the cached instance
336
-
cachedStore, err := repo.Manifests(context.Background())
337
-
require.NoError(t, err)
338
-
assert.NotNil(t, cachedStore)
339
-
340
-
// Concurrent access to Blobs()
341
-
for i := 0; i < numGoroutines; i++ {
342
-
wg.Add(1)
343
-
go func(index int) {
344
-
defer wg.Done()
345
-
blobStores[index] = repo.Blobs(context.Background())
346
-
}(i)
347
-
}
348
349
-
wg.Wait()
350
351
-
// Verify all stores are non-nil (due to race conditions, they may not all be the same instance)
352
-
for i := 0; i < numGoroutines; i++ {
353
-
assert.NotNil(t, blobStores[i], "blob store should not be nil")
354
}
355
-
356
-
// After concurrent creation, subsequent calls should return the cached instance
357
-
cachedBlobStore := repo.Blobs(context.Background())
358
-
assert.NotNil(t, cachedBlobStore)
359
}
360
361
-
// TestRoutingRepository_Blobs_PullPriority tests that database hold DID takes priority for pull (GET)
362
-
func TestRoutingRepository_Blobs_PullPriority(t *testing.T) {
363
-
dbHoldDID := "did:web:database.hold.io"
364
-
discoveryHoldDID := "did:web:discovery.hold.io"
365
366
-
ctx := &RegistryContext{
367
-
DID: "did:plc:test123",
368
-
Repository: "myapp-priority",
369
-
HoldDID: discoveryHoldDID, // Discovery-based hold
370
-
ATProtoClient: atproto.NewClient("https://pds.example.com", "did:plc:test123", ""),
371
-
Database: &mockDatabase{holdDID: dbHoldDID}, // Database has a different hold DID
372
-
}
373
374
-
repo := NewRoutingRepository(nil, ctx)
375
376
-
// For pull (GET), database should take priority
377
-
pullCtx := context.WithValue(context.Background(), "http.request.method", "GET")
378
-
blobStore := repo.Blobs(pullCtx)
379
380
-
assert.NotNil(t, blobStore)
381
-
// Database hold DID should take priority over discovery for pull operations
382
-
assert.Equal(t, dbHoldDID, repo.Ctx.HoldDID, "database hold DID should take priority over discovery for pull (GET)")
383
}
···
2
3
import (
4
"context"
5
"testing"
6
7
"github.com/stretchr/testify/assert"
8
"github.com/stretchr/testify/require"
9
10
"atcr.io/pkg/atproto"
11
+
"atcr.io/pkg/auth"
12
)
13
14
+
// mockUserContext creates a mock auth.UserContext for testing.
15
+
// It sets up both the user identity and target info, and configures
16
+
// test helpers to bypass network calls.
17
+
func mockUserContext(did, authMethod, httpMethod, targetOwnerDID, targetOwnerHandle, targetOwnerPDS, targetRepo, targetHoldDID string) *auth.UserContext {
18
+
userCtx := auth.NewUserContext(did, authMethod, httpMethod, nil)
19
+
userCtx.SetTarget(targetOwnerDID, targetOwnerHandle, targetOwnerPDS, targetRepo, targetHoldDID)
20
21
+
// Bypass PDS resolution (avoids network calls)
22
+
userCtx.SetPDSForTest(targetOwnerHandle, targetOwnerPDS)
23
+
24
+
// Set up mock authorizer that allows access
25
+
userCtx.SetAuthorizerForTest(auth.NewMockHoldAuthorizer())
26
+
27
+
// Set default hold DID for push resolution
28
+
userCtx.SetDefaultHoldDIDForTest(targetHoldDID)
29
30
+
return userCtx
31
}
32
33
+
// mockUserContextWithToken creates a mock UserContext with a pre-populated service token.
34
+
func mockUserContextWithToken(did, authMethod, httpMethod, targetOwnerDID, targetOwnerHandle, targetOwnerPDS, targetRepo, targetHoldDID, serviceToken string) *auth.UserContext {
35
+
userCtx := mockUserContext(did, authMethod, httpMethod, targetOwnerDID, targetOwnerHandle, targetOwnerPDS, targetRepo, targetHoldDID)
36
+
userCtx.SetServiceTokenForTest(targetHoldDID, serviceToken)
37
+
return userCtx
38
}
39
40
func TestNewRoutingRepository(t *testing.T) {
41
+
userCtx := mockUserContext(
42
+
"did:plc:test123", // authenticated user
43
+
"oauth", // auth method
44
+
"GET", // HTTP method
45
+
"did:plc:test123", // target owner
46
+
"test.handle", // target owner handle
47
+
"https://pds.example.com", // target owner PDS
48
+
"debian", // repository
49
+
"did:web:hold01.atcr.io", // hold DID
50
+
)
51
52
+
repo := NewRoutingRepository(nil, userCtx, nil)
53
54
+
if repo.userCtx.TargetOwnerDID != "did:plc:test123" {
55
+
t.Errorf("Expected TargetOwnerDID %q, got %q", "did:plc:test123", repo.userCtx.TargetOwnerDID)
56
}
57
58
+
if repo.userCtx.TargetRepo != "debian" {
59
+
t.Errorf("Expected TargetRepo %q, got %q", "debian", repo.userCtx.TargetRepo)
60
}
61
62
+
if repo.userCtx.TargetHoldDID != "did:web:hold01.atcr.io" {
63
+
t.Errorf("Expected TargetHoldDID %q, got %q", "did:web:hold01.atcr.io", repo.userCtx.TargetHoldDID)
64
}
65
}
66
67
// TestRoutingRepository_Manifests tests the Manifests() method
68
func TestRoutingRepository_Manifests(t *testing.T) {
69
+
userCtx := mockUserContext(
70
+
"did:plc:test123",
71
+
"oauth",
72
+
"GET",
73
+
"did:plc:test123",
74
+
"test.handle",
75
+
"https://pds.example.com",
76
+
"myapp",
77
+
"did:web:hold01.atcr.io",
78
+
)
79
80
+
repo := NewRoutingRepository(nil, userCtx, nil)
81
manifestService, err := repo.Manifests(context.Background())
82
83
require.NoError(t, err)
84
assert.NotNil(t, manifestService)
85
}
86
87
+
// TestRoutingRepository_Blobs tests the Blobs() method
88
+
func TestRoutingRepository_Blobs(t *testing.T) {
89
+
userCtx := mockUserContext(
90
+
"did:plc:test123",
91
+
"oauth",
92
+
"GET",
93
+
"did:plc:test123",
94
+
"test.handle",
95
+
"https://pds.example.com",
96
+
"myapp",
97
+
"did:web:hold01.atcr.io",
98
+
)
99
100
+
repo := NewRoutingRepository(nil, userCtx, nil)
101
blobStore := repo.Blobs(context.Background())
102
103
assert.NotNil(t, blobStore)
104
}
105
106
// TestRoutingRepository_Blobs_PanicOnEmptyHoldDID tests panic when hold DID is empty
107
func TestRoutingRepository_Blobs_PanicOnEmptyHoldDID(t *testing.T) {
108
+
// Create context without default hold and empty target hold
109
+
userCtx := auth.NewUserContext("did:plc:emptyholdtest999", "oauth", "GET", nil)
110
+
userCtx.SetTarget("did:plc:emptyholdtest999", "test.handle", "https://pds.example.com", "empty-hold-app", "")
111
+
userCtx.SetPDSForTest("test.handle", "https://pds.example.com")
112
+
userCtx.SetAuthorizerForTest(auth.NewMockHoldAuthorizer())
113
+
// Intentionally NOT setting default hold DID
114
115
+
repo := NewRoutingRepository(nil, userCtx, nil)
116
117
// Should panic with empty hold DID
118
assert.Panics(t, func() {
···
122
123
// TestRoutingRepository_Tags tests the Tags() method
124
func TestRoutingRepository_Tags(t *testing.T) {
125
+
userCtx := mockUserContext(
126
+
"did:plc:test123",
127
+
"oauth",
128
+
"GET",
129
+
"did:plc:test123",
130
+
"test.handle",
131
+
"https://pds.example.com",
132
+
"myapp",
133
+
"did:web:hold01.atcr.io",
134
+
)
135
136
+
repo := NewRoutingRepository(nil, userCtx, nil)
137
tagService := repo.Tags(context.Background())
138
139
assert.NotNil(t, tagService)
140
141
+
// Call again and verify we get a fresh instance (no caching)
142
tagService2 := repo.Tags(context.Background())
143
assert.NotNil(t, tagService2)
144
}
145
146
+
// TestRoutingRepository_UserContext tests that UserContext fields are properly set
147
+
func TestRoutingRepository_UserContext(t *testing.T) {
148
+
testCases := []struct {
149
+
name string
150
+
httpMethod string
151
+
expectedAction auth.RequestAction
152
+
}{
153
+
{"GET request is pull", "GET", auth.ActionPull},
154
+
{"HEAD request is pull", "HEAD", auth.ActionPull},
155
+
{"PUT request is push", "PUT", auth.ActionPush},
156
+
{"POST request is push", "POST", auth.ActionPush},
157
+
{"DELETE request is push", "DELETE", auth.ActionPush},
158
}
159
160
+
for _, tc := range testCases {
161
+
t.Run(tc.name, func(t *testing.T) {
162
+
userCtx := mockUserContext(
163
+
"did:plc:test123",
164
+
"oauth",
165
+
tc.httpMethod,
166
+
"did:plc:test123",
167
+
"test.handle",
168
+
"https://pds.example.com",
169
+
"myapp",
170
+
"did:web:hold01.atcr.io",
171
+
)
172
173
+
repo := NewRoutingRepository(nil, userCtx, nil)
174
175
+
assert.Equal(t, tc.expectedAction, repo.userCtx.Action, "action should match HTTP method")
176
+
})
177
}
178
+
}
179
180
+
// TestRoutingRepository_DifferentHoldDIDs tests routing with different hold DIDs
181
+
func TestRoutingRepository_DifferentHoldDIDs(t *testing.T) {
182
+
testCases := []struct {
183
+
name string
184
+
holdDID string
185
+
}{
186
+
{"did:web hold", "did:web:hold01.atcr.io"},
187
+
{"did:web with port", "did:web:localhost:8080"},
188
+
{"did:plc hold", "did:plc:xyz123"},
189
}
190
191
+
for _, tc := range testCases {
192
+
t.Run(tc.name, func(t *testing.T) {
193
+
userCtx := mockUserContext(
194
+
"did:plc:test123",
195
+
"oauth",
196
+
"PUT",
197
+
"did:plc:test123",
198
+
"test.handle",
199
+
"https://pds.example.com",
200
+
"myapp",
201
+
tc.holdDID,
202
+
)
203
204
+
repo := NewRoutingRepository(nil, userCtx, nil)
205
+
blobStore := repo.Blobs(context.Background())
206
207
+
assert.NotNil(t, blobStore, "should create blob store for %s", tc.holdDID)
208
+
})
209
}
210
}
211
212
+
// TestRoutingRepository_Named tests the Named() method
213
+
func TestRoutingRepository_Named(t *testing.T) {
214
+
userCtx := mockUserContext(
215
+
"did:plc:test123",
216
+
"oauth",
217
+
"GET",
218
+
"did:plc:test123",
219
+
"test.handle",
220
+
"https://pds.example.com",
221
+
"myapp",
222
+
"did:web:hold01.atcr.io",
223
+
)
224
225
+
repo := NewRoutingRepository(nil, userCtx, nil)
226
227
+
// Named() returns a reference.Named from the base repository
228
+
// Since baseRepo is nil, this tests our implementation handles that case
229
+
named := repo.Named()
230
231
+
// With nil base, Named() should return a name constructed from context
232
+
assert.NotNil(t, named)
233
+
assert.Contains(t, named.Name(), "myapp")
234
+
}
235
236
+
// TestATProtoResolveHoldURL tests DID to URL resolution
237
+
func TestATProtoResolveHoldURL(t *testing.T) {
238
+
tests := []struct {
239
+
name string
240
+
holdDID string
241
+
expected string
242
+
}{
243
+
{
244
+
name: "did:web simple domain",
245
+
holdDID: "did:web:hold01.atcr.io",
246
+
expected: "https://hold01.atcr.io",
247
+
},
248
+
{
249
+
name: "did:web with port (localhost)",
250
+
holdDID: "did:web:localhost:8080",
251
+
expected: "http://localhost:8080",
252
+
},
253
+
}
254
+
255
+
for _, tt := range tests {
256
+
t.Run(tt.name, func(t *testing.T) {
257
+
result := atproto.ResolveHoldURL(tt.holdDID)
258
+
assert.Equal(t, tt.expected, result)
259
+
})
260
+
}
261
}
-65
pkg/appview/utils_test.go
-65
pkg/appview/utils_test.go
···
1
-
package appview
2
-
3
-
import (
4
-
"testing"
5
-
6
-
"atcr.io/pkg/atproto"
7
-
)
8
-
9
-
func TestResolveHoldURL(t *testing.T) {
10
-
tests := []struct {
11
-
name string
12
-
input string
13
-
expected string
14
-
}{
15
-
{
16
-
name: "DID with HTTPS domain",
17
-
input: "did:web:hold.example.com",
18
-
expected: "https://hold.example.com",
19
-
},
20
-
{
21
-
name: "DID with HTTP and port (IP)",
22
-
input: "did:web:172.28.0.3:8080",
23
-
expected: "http://172.28.0.3:8080",
24
-
},
25
-
{
26
-
name: "DID with HTTP and port (localhost)",
27
-
input: "did:web:127.0.0.1:8080",
28
-
expected: "http://127.0.0.1:8080",
29
-
},
30
-
{
31
-
name: "DID with localhost",
32
-
input: "did:web:localhost:8080",
33
-
expected: "http://localhost:8080",
34
-
},
35
-
{
36
-
name: "Already HTTPS URL (passthrough)",
37
-
input: "https://hold.example.com",
38
-
expected: "https://hold.example.com",
39
-
},
40
-
{
41
-
name: "Already HTTP URL (passthrough)",
42
-
input: "http://172.28.0.3:8080",
43
-
expected: "http://172.28.0.3:8080",
44
-
},
45
-
{
46
-
name: "Plain hostname (fallback to HTTPS)",
47
-
input: "hold.example.com",
48
-
expected: "https://hold.example.com",
49
-
},
50
-
{
51
-
name: "DID with subdomain",
52
-
input: "did:web:hold01.atcr.io",
53
-
expected: "https://hold01.atcr.io",
54
-
},
55
-
}
56
-
57
-
for _, tt := range tests {
58
-
t.Run(tt.name, func(t *testing.T) {
59
-
result := atproto.ResolveHoldURL(tt.input)
60
-
if result != tt.expected {
61
-
t.Errorf("ResolveHoldURL(%q) = %q, want %q", tt.input, result, tt.expected)
62
-
}
63
-
})
64
-
}
65
-
}
···
-1
pkg/atproto/lexicon.go
-1
pkg/atproto/lexicon.go
+142
pkg/auth/cache.go
+142
pkg/auth/cache.go
···
···
1
+
// Package token provides service token caching and management for AppView.
2
+
// Service tokens are JWTs issued by a user's PDS to authorize AppView to
3
+
// act on their behalf when communicating with hold services. Tokens are
4
+
// cached with automatic expiry parsing and 10-second safety margins.
5
+
package auth
6
+
7
+
import (
8
+
"log/slog"
9
+
"sync"
10
+
"time"
11
+
)
12
+
13
+
// serviceTokenEntry represents a cached service token
14
+
type serviceTokenEntry struct {
15
+
token string
16
+
expiresAt time.Time
17
+
err error
18
+
once sync.Once
19
+
}
20
+
21
+
// Global cache for service tokens (DID:HoldDID -> token)
22
+
// Service tokens are JWTs issued by a user's PDS to authorize AppView to act on their behalf
23
+
// when communicating with hold services. These tokens are scoped to specific holds and have
24
+
// limited lifetime (typically 60s, can request up to 5min).
25
+
var (
26
+
globalServiceTokens = make(map[string]*serviceTokenEntry)
27
+
globalServiceTokensMu sync.RWMutex
28
+
)
29
+
30
+
// GetServiceToken retrieves a cached service token for the given DID and hold DID
31
+
// Returns empty string if no valid cached token exists
32
+
func GetServiceToken(did, holdDID string) (token string, expiresAt time.Time) {
33
+
cacheKey := did + ":" + holdDID
34
+
35
+
globalServiceTokensMu.RLock()
36
+
entry, exists := globalServiceTokens[cacheKey]
37
+
globalServiceTokensMu.RUnlock()
38
+
39
+
if !exists {
40
+
return "", time.Time{}
41
+
}
42
+
43
+
// Check if token is still valid
44
+
if time.Now().After(entry.expiresAt) {
45
+
// Token expired, remove from cache
46
+
globalServiceTokensMu.Lock()
47
+
delete(globalServiceTokens, cacheKey)
48
+
globalServiceTokensMu.Unlock()
49
+
return "", time.Time{}
50
+
}
51
+
52
+
return entry.token, entry.expiresAt
53
+
}
54
+
55
+
// SetServiceToken stores a service token in the cache
56
+
// Automatically parses the JWT to extract the expiry time
57
+
// Applies a 10-second safety margin (cache expires 10s before actual JWT expiry)
58
+
func SetServiceToken(did, holdDID, token string) error {
59
+
cacheKey := did + ":" + holdDID
60
+
61
+
// Parse JWT to extract expiry (don't verify signature - we trust the PDS)
62
+
expiry, err := ParseJWTExpiry(token)
63
+
if err != nil {
64
+
// If parsing fails, use default 50s TTL (conservative fallback)
65
+
slog.Warn("Failed to parse JWT expiry, using default 50s", "error", err, "cacheKey", cacheKey)
66
+
expiry = time.Now().Add(50 * time.Second)
67
+
} else {
68
+
// Apply 10s safety margin to avoid using nearly-expired tokens
69
+
expiry = expiry.Add(-10 * time.Second)
70
+
}
71
+
72
+
globalServiceTokensMu.Lock()
73
+
globalServiceTokens[cacheKey] = &serviceTokenEntry{
74
+
token: token,
75
+
expiresAt: expiry,
76
+
}
77
+
globalServiceTokensMu.Unlock()
78
+
79
+
slog.Debug("Cached service token",
80
+
"cacheKey", cacheKey,
81
+
"expiresIn", time.Until(expiry).Round(time.Second))
82
+
83
+
return nil
84
+
}
85
+
86
+
// InvalidateServiceToken removes a service token from the cache
87
+
// Used when we detect that a token is invalid or the user's session has expired
88
+
func InvalidateServiceToken(did, holdDID string) {
89
+
cacheKey := did + ":" + holdDID
90
+
91
+
globalServiceTokensMu.Lock()
92
+
delete(globalServiceTokens, cacheKey)
93
+
globalServiceTokensMu.Unlock()
94
+
95
+
slog.Debug("Invalidated service token", "cacheKey", cacheKey)
96
+
}
97
+
98
+
// GetCacheStats returns statistics about the service token cache for debugging
99
+
func GetCacheStats() map[string]any {
100
+
globalServiceTokensMu.RLock()
101
+
defer globalServiceTokensMu.RUnlock()
102
+
103
+
validCount := 0
104
+
expiredCount := 0
105
+
now := time.Now()
106
+
107
+
for _, entry := range globalServiceTokens {
108
+
if now.Before(entry.expiresAt) {
109
+
validCount++
110
+
} else {
111
+
expiredCount++
112
+
}
113
+
}
114
+
115
+
return map[string]any{
116
+
"total_entries": len(globalServiceTokens),
117
+
"valid_tokens": validCount,
118
+
"expired_tokens": expiredCount,
119
+
}
120
+
}
121
+
122
+
// CleanExpiredTokens removes expired tokens from the cache
123
+
// Can be called periodically to prevent unbounded growth (though expired tokens
124
+
// are also removed lazily on access)
125
+
func CleanExpiredTokens() {
126
+
globalServiceTokensMu.Lock()
127
+
defer globalServiceTokensMu.Unlock()
128
+
129
+
now := time.Now()
130
+
removed := 0
131
+
132
+
for key, entry := range globalServiceTokens {
133
+
if now.After(entry.expiresAt) {
134
+
delete(globalServiceTokens, key)
135
+
removed++
136
+
}
137
+
}
138
+
139
+
if removed > 0 {
140
+
slog.Debug("Cleaned expired service tokens", "count", removed)
141
+
}
142
+
}
+195
pkg/auth/cache_test.go
+195
pkg/auth/cache_test.go
···
···
1
+
package auth
2
+
3
+
import (
4
+
"testing"
5
+
"time"
6
+
)
7
+
8
+
func TestGetServiceToken_NotCached(t *testing.T) {
9
+
// Clear cache first
10
+
globalServiceTokensMu.Lock()
11
+
globalServiceTokens = make(map[string]*serviceTokenEntry)
12
+
globalServiceTokensMu.Unlock()
13
+
14
+
did := "did:plc:test123"
15
+
holdDID := "did:web:hold.example.com"
16
+
17
+
token, expiresAt := GetServiceToken(did, holdDID)
18
+
if token != "" {
19
+
t.Errorf("Expected empty token for uncached entry, got %q", token)
20
+
}
21
+
if !expiresAt.IsZero() {
22
+
t.Error("Expected zero time for uncached entry")
23
+
}
24
+
}
25
+
26
+
func TestSetServiceToken_ManualExpiry(t *testing.T) {
27
+
// Clear cache first
28
+
globalServiceTokensMu.Lock()
29
+
globalServiceTokens = make(map[string]*serviceTokenEntry)
30
+
globalServiceTokensMu.Unlock()
31
+
32
+
did := "did:plc:test123"
33
+
holdDID := "did:web:hold.example.com"
34
+
token := "invalid_jwt_token" // Will fall back to 50s default
35
+
36
+
// This should succeed with default 50s TTL since JWT parsing will fail
37
+
err := SetServiceToken(did, holdDID, token)
38
+
if err != nil {
39
+
t.Fatalf("SetServiceToken() error = %v", err)
40
+
}
41
+
42
+
// Verify token was cached
43
+
cachedToken, expiresAt := GetServiceToken(did, holdDID)
44
+
if cachedToken != token {
45
+
t.Errorf("Expected token %q, got %q", token, cachedToken)
46
+
}
47
+
if expiresAt.IsZero() {
48
+
t.Error("Expected non-zero expiry time")
49
+
}
50
+
51
+
// Expiry should be approximately 50s from now (with 10s margin subtracted in some cases)
52
+
expectedExpiry := time.Now().Add(50 * time.Second)
53
+
diff := expiresAt.Sub(expectedExpiry)
54
+
if diff < -5*time.Second || diff > 5*time.Second {
55
+
t.Errorf("Expiry time off by %v (expected ~50s from now)", diff)
56
+
}
57
+
}
58
+
59
+
func TestGetServiceToken_Expired(t *testing.T) {
60
+
// Manually insert an expired token
61
+
did := "did:plc:test123"
62
+
holdDID := "did:web:hold.example.com"
63
+
cacheKey := did + ":" + holdDID
64
+
65
+
globalServiceTokensMu.Lock()
66
+
globalServiceTokens[cacheKey] = &serviceTokenEntry{
67
+
token: "expired_token",
68
+
expiresAt: time.Now().Add(-1 * time.Hour), // 1 hour ago
69
+
}
70
+
globalServiceTokensMu.Unlock()
71
+
72
+
// Try to get - should return empty since expired
73
+
token, expiresAt := GetServiceToken(did, holdDID)
74
+
if token != "" {
75
+
t.Errorf("Expected empty token for expired entry, got %q", token)
76
+
}
77
+
if !expiresAt.IsZero() {
78
+
t.Error("Expected zero time for expired entry")
79
+
}
80
+
81
+
// Verify token was removed from cache
82
+
globalServiceTokensMu.RLock()
83
+
_, exists := globalServiceTokens[cacheKey]
84
+
globalServiceTokensMu.RUnlock()
85
+
86
+
if exists {
87
+
t.Error("Expected expired token to be removed from cache")
88
+
}
89
+
}
90
+
91
+
func TestInvalidateServiceToken(t *testing.T) {
92
+
// Set a token
93
+
did := "did:plc:test123"
94
+
holdDID := "did:web:hold.example.com"
95
+
token := "test_token"
96
+
97
+
err := SetServiceToken(did, holdDID, token)
98
+
if err != nil {
99
+
t.Fatalf("SetServiceToken() error = %v", err)
100
+
}
101
+
102
+
// Verify it's cached
103
+
cachedToken, _ := GetServiceToken(did, holdDID)
104
+
if cachedToken != token {
105
+
t.Fatal("Token should be cached")
106
+
}
107
+
108
+
// Invalidate
109
+
InvalidateServiceToken(did, holdDID)
110
+
111
+
// Verify it's gone
112
+
cachedToken, _ = GetServiceToken(did, holdDID)
113
+
if cachedToken != "" {
114
+
t.Error("Expected token to be invalidated")
115
+
}
116
+
}
117
+
118
+
func TestCleanExpiredTokens(t *testing.T) {
119
+
// Clear cache first
120
+
globalServiceTokensMu.Lock()
121
+
globalServiceTokens = make(map[string]*serviceTokenEntry)
122
+
globalServiceTokensMu.Unlock()
123
+
124
+
// Add expired and valid tokens
125
+
globalServiceTokensMu.Lock()
126
+
globalServiceTokens["expired:hold1"] = &serviceTokenEntry{
127
+
token: "expired1",
128
+
expiresAt: time.Now().Add(-1 * time.Hour),
129
+
}
130
+
globalServiceTokens["valid:hold2"] = &serviceTokenEntry{
131
+
token: "valid1",
132
+
expiresAt: time.Now().Add(1 * time.Hour),
133
+
}
134
+
globalServiceTokensMu.Unlock()
135
+
136
+
// Clean expired
137
+
CleanExpiredTokens()
138
+
139
+
// Verify only valid token remains
140
+
globalServiceTokensMu.RLock()
141
+
_, expiredExists := globalServiceTokens["expired:hold1"]
142
+
_, validExists := globalServiceTokens["valid:hold2"]
143
+
globalServiceTokensMu.RUnlock()
144
+
145
+
if expiredExists {
146
+
t.Error("Expected expired token to be removed")
147
+
}
148
+
if !validExists {
149
+
t.Error("Expected valid token to remain")
150
+
}
151
+
}
152
+
153
+
func TestGetCacheStats(t *testing.T) {
154
+
// Clear cache first
155
+
globalServiceTokensMu.Lock()
156
+
globalServiceTokens = make(map[string]*serviceTokenEntry)
157
+
globalServiceTokensMu.Unlock()
158
+
159
+
// Add some tokens
160
+
globalServiceTokensMu.Lock()
161
+
globalServiceTokens["did1:hold1"] = &serviceTokenEntry{
162
+
token: "token1",
163
+
expiresAt: time.Now().Add(1 * time.Hour),
164
+
}
165
+
globalServiceTokens["did2:hold2"] = &serviceTokenEntry{
166
+
token: "token2",
167
+
expiresAt: time.Now().Add(1 * time.Hour),
168
+
}
169
+
globalServiceTokensMu.Unlock()
170
+
171
+
stats := GetCacheStats()
172
+
if stats == nil {
173
+
t.Fatal("Expected non-nil stats")
174
+
}
175
+
176
+
// GetCacheStats returns map[string]any with "total_entries" key
177
+
totalEntries, ok := stats["total_entries"].(int)
178
+
if !ok {
179
+
t.Fatalf("Expected total_entries in stats map, got: %v", stats)
180
+
}
181
+
182
+
if totalEntries != 2 {
183
+
t.Errorf("Expected 2 entries, got %d", totalEntries)
184
+
}
185
+
186
+
// Also check valid_tokens
187
+
validTokens, ok := stats["valid_tokens"].(int)
188
+
if !ok {
189
+
t.Fatal("Expected valid_tokens in stats map")
190
+
}
191
+
192
+
if validTokens != 2 {
193
+
t.Errorf("Expected 2 valid tokens, got %d", validTokens)
194
+
}
195
+
}
+40
-33
pkg/auth/oauth/client.go
+40
-33
pkg/auth/oauth/client.go
···
72
return baseURL + "/auth/oauth/callback"
73
}
74
75
-
// GetDefaultScopes returns the default OAuth scopes for ATCR registry operations
76
-
// testMode determines whether to use transition:generic (test) or rpc scopes (production)
77
func GetDefaultScopes(did string) []string {
78
-
scopes := []string{
79
"atproto",
80
-
// Used for service token validation on holds
81
"rpc:com.atproto.repo.getRecord?aud=*",
82
// Image manifest types (single-arch)
83
"blob:application/vnd.oci.image.manifest.v1+json",
84
"blob:application/vnd.docker.distribution.manifest.v2+json",
···
87
"blob:application/vnd.docker.distribution.manifest.list.v2+json",
88
// OCI artifact manifests (for cosign signatures, SBOMs, attestations)
89
"blob:application/vnd.cncf.oras.artifact.manifest.v1+json",
90
-
// image avatars
91
"blob:image/*",
92
}
93
-
94
-
// Add repo scopes
95
-
scopes = append(scopes,
96
-
fmt.Sprintf("repo:%s", atproto.ManifestCollection),
97
-
fmt.Sprintf("repo:%s", atproto.TagCollection),
98
-
fmt.Sprintf("repo:%s", atproto.StarCollection),
99
-
fmt.Sprintf("repo:%s", atproto.SailorProfileCollection),
100
-
fmt.Sprintf("repo:%s", atproto.RepoPageCollection),
101
-
)
102
-
103
-
return scopes
104
}
105
106
// ScopesMatch checks if two scope lists are equivalent (order-independent)
···
228
// The session's PersistSessionCallback will save nonce updates to DB
229
err = fn(session)
230
231
slog.Debug("Released session lock for DoWithSession",
232
"component", "oauth/refresher",
233
"did", did,
···
236
return err
237
}
238
239
// resumeSession loads a session from storage
240
func (r *Refresher) resumeSession(ctx context.Context, did string) (*oauth.ClientSession, error) {
241
// Parse DID
···
260
return nil, fmt.Errorf("no session found for DID: %s", did)
261
}
262
263
-
// Validate that session scopes match current desired scopes
264
desiredScopes := r.clientApp.Config.Scopes
265
if !ScopesMatch(sessionData.Scopes, desiredScopes) {
266
-
slog.Debug("Scope mismatch, deleting session",
267
"did", did,
268
"storedScopes", sessionData.Scopes,
269
"desiredScopes", desiredScopes)
270
-
271
-
// Delete the session from database since scopes have changed
272
-
if err := r.clientApp.Store.DeleteSession(ctx, accountDID, sessionID); err != nil {
273
-
slog.Warn("Failed to delete session with mismatched scopes", "error", err, "did", did)
274
-
}
275
-
276
-
// Also invalidate UI sessions since OAuth is now invalid
277
-
if r.uiSessionStore != nil {
278
-
r.uiSessionStore.DeleteByDID(did)
279
-
slog.Info("Invalidated UI sessions due to scope mismatch",
280
-
"component", "oauth/refresher",
281
-
"did", did)
282
-
}
283
-
284
-
return nil, fmt.Errorf("OAuth scopes changed, re-authentication required")
285
}
286
287
// Resume session
···
72
return baseURL + "/auth/oauth/callback"
73
}
74
75
+
// GetDefaultScopes returns the default OAuth scopes for ATCR registry operations.
76
+
// Includes io.atcr.authFullApp permission-set plus individual scopes for PDS compatibility.
77
+
// Blob scopes are listed explicitly (not supported in Lexicon permission-sets).
78
func GetDefaultScopes(did string) []string {
79
+
return []string{
80
"atproto",
81
+
// Permission-set (for future PDS support)
82
+
// See lexicons/io/atcr/authFullApp.json for definition
83
+
// Uses "include:" prefix per ATProto permission spec
84
+
"include:io.atcr.authFullApp",
85
+
// com.atproto scopes must be separate (permission-sets are namespace-limited)
86
"rpc:com.atproto.repo.getRecord?aud=*",
87
+
// Blob scopes (not supported in Lexicon permission-sets)
88
// Image manifest types (single-arch)
89
"blob:application/vnd.oci.image.manifest.v1+json",
90
"blob:application/vnd.docker.distribution.manifest.v2+json",
···
93
"blob:application/vnd.docker.distribution.manifest.list.v2+json",
94
// OCI artifact manifests (for cosign signatures, SBOMs, attestations)
95
"blob:application/vnd.cncf.oras.artifact.manifest.v1+json",
96
+
// Image avatars
97
"blob:image/*",
98
}
99
}
100
101
// ScopesMatch checks if two scope lists are equivalent (order-independent)
···
223
// The session's PersistSessionCallback will save nonce updates to DB
224
err = fn(session)
225
226
+
// If request failed with auth error, delete session to force re-auth
227
+
if err != nil && isAuthError(err) {
228
+
slog.Warn("Auth error detected, deleting session to force re-auth",
229
+
"component", "oauth/refresher",
230
+
"did", did,
231
+
"error", err)
232
+
// Don't hold the lock while deleting - release first
233
+
mutex.Unlock()
234
+
_ = r.DeleteSession(ctx, did)
235
+
mutex.Lock() // Re-acquire for the deferred unlock
236
+
}
237
+
238
slog.Debug("Released session lock for DoWithSession",
239
"component", "oauth/refresher",
240
"did", did,
···
243
return err
244
}
245
246
+
// isAuthError checks if an error looks like an OAuth/auth failure
247
+
func isAuthError(err error) bool {
248
+
if err == nil {
249
+
return false
250
+
}
251
+
errStr := strings.ToLower(err.Error())
252
+
return strings.Contains(errStr, "unauthorized") ||
253
+
strings.Contains(errStr, "invalid_token") ||
254
+
strings.Contains(errStr, "insufficient_scope") ||
255
+
strings.Contains(errStr, "token expired") ||
256
+
strings.Contains(errStr, "401")
257
+
}
258
+
259
// resumeSession loads a session from storage
260
func (r *Refresher) resumeSession(ctx context.Context, did string) (*oauth.ClientSession, error) {
261
// Parse DID
···
280
return nil, fmt.Errorf("no session found for DID: %s", did)
281
}
282
283
+
// Log scope differences for debugging, but don't delete session
284
+
// The PDS will reject requests if scopes are insufficient
285
+
// (Permission-sets get expanded by PDS, so exact matching doesn't work)
286
desiredScopes := r.clientApp.Config.Scopes
287
if !ScopesMatch(sessionData.Scopes, desiredScopes) {
288
+
slog.Debug("Session scopes differ from desired (may be permission-set expansion)",
289
"did", did,
290
"storedScopes", sessionData.Scopes,
291
"desiredScopes", desiredScopes)
292
}
293
294
// Resume session
+7
-30
pkg/auth/oauth/client_test.go
+7
-30
pkg/auth/oauth/client_test.go
···
1
package oauth
2
3
import (
4
"testing"
5
)
6
7
func TestNewClientApp(t *testing.T) {
8
-
tmpDir := t.TempDir()
9
-
storePath := tmpDir + "/oauth-test.json"
10
-
keyPath := tmpDir + "/oauth-key.bin"
11
-
12
-
store, err := NewFileStore(storePath)
13
-
if err != nil {
14
-
t.Fatalf("NewFileStore() error = %v", err)
15
-
}
16
17
baseURL := "http://localhost:5000"
18
scopes := GetDefaultScopes("*")
···
32
}
33
34
func TestNewClientAppWithCustomScopes(t *testing.T) {
35
-
tmpDir := t.TempDir()
36
-
storePath := tmpDir + "/oauth-test.json"
37
-
keyPath := tmpDir + "/oauth-key.bin"
38
-
39
-
store, err := NewFileStore(storePath)
40
-
if err != nil {
41
-
t.Fatalf("NewFileStore() error = %v", err)
42
-
}
43
44
baseURL := "http://localhost:5000"
45
scopes := []string{"atproto", "custom:scope"}
···
128
// ----------------------------------------------------------------------------
129
130
func TestNewRefresher(t *testing.T) {
131
-
tmpDir := t.TempDir()
132
-
storePath := tmpDir + "/oauth-test.json"
133
-
134
-
store, err := NewFileStore(storePath)
135
-
if err != nil {
136
-
t.Fatalf("NewFileStore() error = %v", err)
137
-
}
138
139
scopes := GetDefaultScopes("*")
140
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
153
}
154
155
func TestRefresher_SetUISessionStore(t *testing.T) {
156
-
tmpDir := t.TempDir()
157
-
storePath := tmpDir + "/oauth-test.json"
158
-
159
-
store, err := NewFileStore(storePath)
160
-
if err != nil {
161
-
t.Fatalf("NewFileStore() error = %v", err)
162
-
}
163
164
scopes := GetDefaultScopes("*")
165
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
1
package oauth
2
3
import (
4
+
"github.com/bluesky-social/indigo/atproto/auth/oauth"
5
"testing"
6
)
7
8
func TestNewClientApp(t *testing.T) {
9
+
keyPath := t.TempDir() + "/oauth-key.bin"
10
+
store := oauth.NewMemStore()
11
12
baseURL := "http://localhost:5000"
13
scopes := GetDefaultScopes("*")
···
27
}
28
29
func TestNewClientAppWithCustomScopes(t *testing.T) {
30
+
keyPath := t.TempDir() + "/oauth-key.bin"
31
+
store := oauth.NewMemStore()
32
33
baseURL := "http://localhost:5000"
34
scopes := []string{"atproto", "custom:scope"}
···
117
// ----------------------------------------------------------------------------
118
119
func TestNewRefresher(t *testing.T) {
120
+
store := oauth.NewMemStore()
121
122
scopes := GetDefaultScopes("*")
123
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
136
}
137
138
func TestRefresher_SetUISessionStore(t *testing.T) {
139
+
store := oauth.NewMemStore()
140
141
scopes := GetDefaultScopes("*")
142
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
+1
-5
pkg/auth/oauth/interactive.go
+1
-5
pkg/auth/oauth/interactive.go
···
26
registerCallback func(handler http.HandlerFunc) error,
27
displayAuthURL func(string) error,
28
) (*InteractiveResult, error) {
29
-
// Create temporary file store for this flow
30
-
store, err := NewFileStore("/tmp/atcr-oauth-temp.json")
31
-
if err != nil {
32
-
return nil, fmt.Errorf("failed to create OAuth store: %w", err)
33
-
}
34
35
// Create OAuth client app with custom scopes (or defaults if nil)
36
// Interactive flows are typically for production use (credential helper, etc.)
···
26
registerCallback func(handler http.HandlerFunc) error,
27
displayAuthURL func(string) error,
28
) (*InteractiveResult, error) {
29
+
store := oauth.NewMemStore()
30
31
// Create OAuth client app with custom scopes (or defaults if nil)
32
// Interactive flows are typically for production use (credential helper, etc.)
+13
-84
pkg/auth/oauth/server_test.go
+13
-84
pkg/auth/oauth/server_test.go
···
2
3
import (
4
"context"
5
"net/http"
6
"net/http/httptest"
7
"strings"
···
11
12
func TestNewServer(t *testing.T) {
13
// Create a basic OAuth app for testing
14
-
tmpDir := t.TempDir()
15
-
storePath := tmpDir + "/oauth-test.json"
16
-
17
-
store, err := NewFileStore(storePath)
18
-
if err != nil {
19
-
t.Fatalf("NewFileStore() error = %v", err)
20
-
}
21
22
scopes := GetDefaultScopes("*")
23
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
36
}
37
38
func TestServer_SetRefresher(t *testing.T) {
39
-
tmpDir := t.TempDir()
40
-
storePath := tmpDir + "/oauth-test.json"
41
-
42
-
store, err := NewFileStore(storePath)
43
-
if err != nil {
44
-
t.Fatalf("NewFileStore() error = %v", err)
45
-
}
46
47
scopes := GetDefaultScopes("*")
48
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
60
}
61
62
func TestServer_SetPostAuthCallback(t *testing.T) {
63
-
tmpDir := t.TempDir()
64
-
storePath := tmpDir + "/oauth-test.json"
65
-
66
-
store, err := NewFileStore(storePath)
67
-
if err != nil {
68
-
t.Fatalf("NewFileStore() error = %v", err)
69
-
}
70
71
scopes := GetDefaultScopes("*")
72
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
87
}
88
89
func TestServer_SetUISessionStore(t *testing.T) {
90
-
tmpDir := t.TempDir()
91
-
storePath := tmpDir + "/oauth-test.json"
92
-
93
-
store, err := NewFileStore(storePath)
94
-
if err != nil {
95
-
t.Fatalf("NewFileStore() error = %v", err)
96
-
}
97
98
scopes := GetDefaultScopes("*")
99
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
151
// ServeAuthorize tests
152
153
func TestServer_ServeAuthorize_MissingHandle(t *testing.T) {
154
-
tmpDir := t.TempDir()
155
-
storePath := tmpDir + "/oauth-test.json"
156
-
157
-
store, err := NewFileStore(storePath)
158
-
if err != nil {
159
-
t.Fatalf("NewFileStore() error = %v", err)
160
-
}
161
162
scopes := GetDefaultScopes("*")
163
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
179
}
180
181
func TestServer_ServeAuthorize_InvalidMethod(t *testing.T) {
182
-
tmpDir := t.TempDir()
183
-
storePath := tmpDir + "/oauth-test.json"
184
-
185
-
store, err := NewFileStore(storePath)
186
-
if err != nil {
187
-
t.Fatalf("NewFileStore() error = %v", err)
188
-
}
189
190
scopes := GetDefaultScopes("*")
191
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
209
// ServeCallback tests
210
211
func TestServer_ServeCallback_InvalidMethod(t *testing.T) {
212
-
tmpDir := t.TempDir()
213
-
storePath := tmpDir + "/oauth-test.json"
214
-
215
-
store, err := NewFileStore(storePath)
216
-
if err != nil {
217
-
t.Fatalf("NewFileStore() error = %v", err)
218
-
}
219
220
scopes := GetDefaultScopes("*")
221
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
237
}
238
239
func TestServer_ServeCallback_OAuthError(t *testing.T) {
240
-
tmpDir := t.TempDir()
241
-
storePath := tmpDir + "/oauth-test.json"
242
-
243
-
store, err := NewFileStore(storePath)
244
-
if err != nil {
245
-
t.Fatalf("NewFileStore() error = %v", err)
246
-
}
247
248
scopes := GetDefaultScopes("*")
249
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
270
}
271
272
func TestServer_ServeCallback_WithPostAuthCallback(t *testing.T) {
273
-
tmpDir := t.TempDir()
274
-
storePath := tmpDir + "/oauth-test.json"
275
-
276
-
store, err := NewFileStore(storePath)
277
-
if err != nil {
278
-
t.Fatalf("NewFileStore() error = %v", err)
279
-
}
280
281
scopes := GetDefaultScopes("*")
282
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
315
},
316
}
317
318
-
tmpDir := t.TempDir()
319
-
storePath := tmpDir + "/oauth-test.json"
320
-
321
-
store, err := NewFileStore(storePath)
322
-
if err != nil {
323
-
t.Fatalf("NewFileStore() error = %v", err)
324
-
}
325
326
scopes := GetDefaultScopes("*")
327
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
345
}
346
347
func TestServer_RenderError(t *testing.T) {
348
-
tmpDir := t.TempDir()
349
-
storePath := tmpDir + "/oauth-test.json"
350
-
351
-
store, err := NewFileStore(storePath)
352
-
if err != nil {
353
-
t.Fatalf("NewFileStore() error = %v", err)
354
-
}
355
356
scopes := GetDefaultScopes("*")
357
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
380
}
381
382
func TestServer_RenderRedirectToSettings(t *testing.T) {
383
-
tmpDir := t.TempDir()
384
-
storePath := tmpDir + "/oauth-test.json"
385
-
386
-
store, err := NewFileStore(storePath)
387
-
if err != nil {
388
-
t.Fatalf("NewFileStore() error = %v", err)
389
-
}
390
391
scopes := GetDefaultScopes("*")
392
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
2
3
import (
4
"context"
5
+
"github.com/bluesky-social/indigo/atproto/auth/oauth"
6
"net/http"
7
"net/http/httptest"
8
"strings"
···
12
13
func TestNewServer(t *testing.T) {
14
// Create a basic OAuth app for testing
15
+
store := oauth.NewMemStore()
16
17
scopes := GetDefaultScopes("*")
18
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
31
}
32
33
func TestServer_SetRefresher(t *testing.T) {
34
+
store := oauth.NewMemStore()
35
36
scopes := GetDefaultScopes("*")
37
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
49
}
50
51
func TestServer_SetPostAuthCallback(t *testing.T) {
52
+
store := oauth.NewMemStore()
53
54
scopes := GetDefaultScopes("*")
55
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
70
}
71
72
func TestServer_SetUISessionStore(t *testing.T) {
73
+
store := oauth.NewMemStore()
74
75
scopes := GetDefaultScopes("*")
76
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
128
// ServeAuthorize tests
129
130
func TestServer_ServeAuthorize_MissingHandle(t *testing.T) {
131
+
store := oauth.NewMemStore()
132
133
scopes := GetDefaultScopes("*")
134
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
150
}
151
152
func TestServer_ServeAuthorize_InvalidMethod(t *testing.T) {
153
+
store := oauth.NewMemStore()
154
155
scopes := GetDefaultScopes("*")
156
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
174
// ServeCallback tests
175
176
func TestServer_ServeCallback_InvalidMethod(t *testing.T) {
177
+
store := oauth.NewMemStore()
178
179
scopes := GetDefaultScopes("*")
180
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
196
}
197
198
func TestServer_ServeCallback_OAuthError(t *testing.T) {
199
+
store := oauth.NewMemStore()
200
201
scopes := GetDefaultScopes("*")
202
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
223
}
224
225
func TestServer_ServeCallback_WithPostAuthCallback(t *testing.T) {
226
+
store := oauth.NewMemStore()
227
228
scopes := GetDefaultScopes("*")
229
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
262
},
263
}
264
265
+
store := oauth.NewMemStore()
266
267
scopes := GetDefaultScopes("*")
268
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
286
}
287
288
func TestServer_RenderError(t *testing.T) {
289
+
store := oauth.NewMemStore()
290
291
scopes := GetDefaultScopes("*")
292
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
···
315
}
316
317
func TestServer_RenderRedirectToSettings(t *testing.T) {
318
+
store := oauth.NewMemStore()
319
320
scopes := GetDefaultScopes("*")
321
clientApp, err := NewClientApp("http://localhost:5000", store, scopes, "", "AT Container Registry")
-236
pkg/auth/oauth/store.go
-236
pkg/auth/oauth/store.go
···
1
-
package oauth
2
-
3
-
import (
4
-
"context"
5
-
"encoding/json"
6
-
"fmt"
7
-
"maps"
8
-
"os"
9
-
"path/filepath"
10
-
"sync"
11
-
"time"
12
-
13
-
"github.com/bluesky-social/indigo/atproto/auth/oauth"
14
-
"github.com/bluesky-social/indigo/atproto/syntax"
15
-
)
16
-
17
-
// FileStore implements oauth.ClientAuthStore with file-based persistence
18
-
type FileStore struct {
19
-
path string
20
-
sessions map[string]*oauth.ClientSessionData // Key: "did:sessionID"
21
-
requests map[string]*oauth.AuthRequestData // Key: state
22
-
mu sync.RWMutex
23
-
}
24
-
25
-
// FileStoreData represents the JSON structure stored on disk
26
-
type FileStoreData struct {
27
-
Sessions map[string]*oauth.ClientSessionData `json:"sessions"`
28
-
Requests map[string]*oauth.AuthRequestData `json:"requests"`
29
-
}
30
-
31
-
// NewFileStore creates a new file-based OAuth store
32
-
func NewFileStore(path string) (*FileStore, error) {
33
-
store := &FileStore{
34
-
path: path,
35
-
sessions: make(map[string]*oauth.ClientSessionData),
36
-
requests: make(map[string]*oauth.AuthRequestData),
37
-
}
38
-
39
-
// Load existing data if file exists
40
-
if err := store.load(); err != nil {
41
-
if !os.IsNotExist(err) {
42
-
return nil, fmt.Errorf("failed to load store: %w", err)
43
-
}
44
-
// File doesn't exist yet, that's ok
45
-
}
46
-
47
-
return store, nil
48
-
}
49
-
50
-
// GetDefaultStorePath returns the default storage path for OAuth data
51
-
func GetDefaultStorePath() (string, error) {
52
-
// For AppView: /var/lib/atcr/oauth-sessions.json
53
-
// For CLI tools: ~/.atcr/oauth-sessions.json
54
-
55
-
// Check if running as a service (has write access to /var/lib)
56
-
servicePath := "/var/lib/atcr/oauth-sessions.json"
57
-
if err := os.MkdirAll(filepath.Dir(servicePath), 0700); err == nil {
58
-
// Can write to /var/lib, use service path
59
-
return servicePath, nil
60
-
}
61
-
62
-
// Fall back to user home directory
63
-
homeDir, err := os.UserHomeDir()
64
-
if err != nil {
65
-
return "", fmt.Errorf("failed to get home directory: %w", err)
66
-
}
67
-
68
-
atcrDir := filepath.Join(homeDir, ".atcr")
69
-
if err := os.MkdirAll(atcrDir, 0700); err != nil {
70
-
return "", fmt.Errorf("failed to create .atcr directory: %w", err)
71
-
}
72
-
73
-
return filepath.Join(atcrDir, "oauth-sessions.json"), nil
74
-
}
75
-
76
-
// GetSession retrieves a session by DID and session ID
77
-
func (s *FileStore) GetSession(ctx context.Context, did syntax.DID, sessionID string) (*oauth.ClientSessionData, error) {
78
-
s.mu.RLock()
79
-
defer s.mu.RUnlock()
80
-
81
-
key := makeSessionKey(did.String(), sessionID)
82
-
session, ok := s.sessions[key]
83
-
if !ok {
84
-
return nil, fmt.Errorf("session not found: %s/%s", did, sessionID)
85
-
}
86
-
87
-
return session, nil
88
-
}
89
-
90
-
// SaveSession saves or updates a session (upsert)
91
-
func (s *FileStore) SaveSession(ctx context.Context, sess oauth.ClientSessionData) error {
92
-
s.mu.Lock()
93
-
defer s.mu.Unlock()
94
-
95
-
key := makeSessionKey(sess.AccountDID.String(), sess.SessionID)
96
-
s.sessions[key] = &sess
97
-
98
-
return s.save()
99
-
}
100
-
101
-
// DeleteSession removes a session
102
-
func (s *FileStore) DeleteSession(ctx context.Context, did syntax.DID, sessionID string) error {
103
-
s.mu.Lock()
104
-
defer s.mu.Unlock()
105
-
106
-
key := makeSessionKey(did.String(), sessionID)
107
-
delete(s.sessions, key)
108
-
109
-
return s.save()
110
-
}
111
-
112
-
// GetAuthRequestInfo retrieves authentication request data by state
113
-
func (s *FileStore) GetAuthRequestInfo(ctx context.Context, state string) (*oauth.AuthRequestData, error) {
114
-
s.mu.RLock()
115
-
defer s.mu.RUnlock()
116
-
117
-
request, ok := s.requests[state]
118
-
if !ok {
119
-
return nil, fmt.Errorf("auth request not found: %s", state)
120
-
}
121
-
122
-
return request, nil
123
-
}
124
-
125
-
// SaveAuthRequestInfo saves authentication request data
126
-
func (s *FileStore) SaveAuthRequestInfo(ctx context.Context, info oauth.AuthRequestData) error {
127
-
s.mu.Lock()
128
-
defer s.mu.Unlock()
129
-
130
-
s.requests[info.State] = &info
131
-
132
-
return s.save()
133
-
}
134
-
135
-
// DeleteAuthRequestInfo removes authentication request data
136
-
func (s *FileStore) DeleteAuthRequestInfo(ctx context.Context, state string) error {
137
-
s.mu.Lock()
138
-
defer s.mu.Unlock()
139
-
140
-
delete(s.requests, state)
141
-
142
-
return s.save()
143
-
}
144
-
145
-
// CleanupExpired removes expired sessions and auth requests
146
-
// Should be called periodically (e.g., every hour)
147
-
func (s *FileStore) CleanupExpired() error {
148
-
s.mu.Lock()
149
-
defer s.mu.Unlock()
150
-
151
-
now := time.Now()
152
-
modified := false
153
-
154
-
// Clean up auth requests older than 10 minutes
155
-
// (OAuth flows should complete quickly)
156
-
for state := range s.requests {
157
-
// Note: AuthRequestData doesn't have a timestamp in indigo's implementation
158
-
// For now, we'll rely on the OAuth server's cleanup routine
159
-
// or we could extend AuthRequestData with metadata
160
-
_ = state // Placeholder for future expiration logic
161
-
}
162
-
163
-
// Sessions don't have expiry in the data structure
164
-
// Cleanup would need to be token-based (check token expiry)
165
-
// For now, manual cleanup via DeleteSession
166
-
_ = now
167
-
168
-
if modified {
169
-
return s.save()
170
-
}
171
-
172
-
return nil
173
-
}
174
-
175
-
// ListSessions returns all stored sessions for debugging/management
176
-
func (s *FileStore) ListSessions() map[string]*oauth.ClientSessionData {
177
-
s.mu.RLock()
178
-
defer s.mu.RUnlock()
179
-
180
-
// Return a copy to prevent external modification
181
-
result := make(map[string]*oauth.ClientSessionData)
182
-
maps.Copy(result, s.sessions)
183
-
return result
184
-
}
185
-
186
-
// load reads data from disk
187
-
func (s *FileStore) load() error {
188
-
data, err := os.ReadFile(s.path)
189
-
if err != nil {
190
-
return err
191
-
}
192
-
193
-
var storeData FileStoreData
194
-
if err := json.Unmarshal(data, &storeData); err != nil {
195
-
return fmt.Errorf("failed to parse store: %w", err)
196
-
}
197
-
198
-
if storeData.Sessions != nil {
199
-
s.sessions = storeData.Sessions
200
-
}
201
-
if storeData.Requests != nil {
202
-
s.requests = storeData.Requests
203
-
}
204
-
205
-
return nil
206
-
}
207
-
208
-
// save writes data to disk
209
-
func (s *FileStore) save() error {
210
-
storeData := FileStoreData{
211
-
Sessions: s.sessions,
212
-
Requests: s.requests,
213
-
}
214
-
215
-
data, err := json.MarshalIndent(storeData, "", " ")
216
-
if err != nil {
217
-
return fmt.Errorf("failed to marshal store: %w", err)
218
-
}
219
-
220
-
// Ensure directory exists
221
-
if err := os.MkdirAll(filepath.Dir(s.path), 0700); err != nil {
222
-
return fmt.Errorf("failed to create directory: %w", err)
223
-
}
224
-
225
-
// Write with restrictive permissions
226
-
if err := os.WriteFile(s.path, data, 0600); err != nil {
227
-
return fmt.Errorf("failed to write store: %w", err)
228
-
}
229
-
230
-
return nil
231
-
}
232
-
233
-
// makeSessionKey creates a composite key for session storage
234
-
func makeSessionKey(did, sessionID string) string {
235
-
return fmt.Sprintf("%s:%s", did, sessionID)
236
-
}
···
-631
pkg/auth/oauth/store_test.go
-631
pkg/auth/oauth/store_test.go
···
1
-
package oauth
2
-
3
-
import (
4
-
"context"
5
-
"encoding/json"
6
-
"os"
7
-
"testing"
8
-
"time"
9
-
10
-
"github.com/bluesky-social/indigo/atproto/auth/oauth"
11
-
"github.com/bluesky-social/indigo/atproto/syntax"
12
-
)
13
-
14
-
func TestNewFileStore(t *testing.T) {
15
-
tmpDir := t.TempDir()
16
-
storePath := tmpDir + "/oauth-test.json"
17
-
18
-
store, err := NewFileStore(storePath)
19
-
if err != nil {
20
-
t.Fatalf("NewFileStore() error = %v", err)
21
-
}
22
-
23
-
if store == nil {
24
-
t.Fatal("Expected non-nil store")
25
-
}
26
-
27
-
if store.path != storePath {
28
-
t.Errorf("Expected path %q, got %q", storePath, store.path)
29
-
}
30
-
31
-
if store.sessions == nil {
32
-
t.Error("Expected sessions map to be initialized")
33
-
}
34
-
35
-
if store.requests == nil {
36
-
t.Error("Expected requests map to be initialized")
37
-
}
38
-
}
39
-
40
-
func TestFileStore_LoadNonExistent(t *testing.T) {
41
-
tmpDir := t.TempDir()
42
-
storePath := tmpDir + "/nonexistent.json"
43
-
44
-
// Should succeed even if file doesn't exist
45
-
store, err := NewFileStore(storePath)
46
-
if err != nil {
47
-
t.Fatalf("NewFileStore() should succeed with non-existent file, got error: %v", err)
48
-
}
49
-
50
-
if store == nil {
51
-
t.Fatal("Expected non-nil store")
52
-
}
53
-
}
54
-
55
-
func TestFileStore_LoadCorruptedFile(t *testing.T) {
56
-
tmpDir := t.TempDir()
57
-
storePath := tmpDir + "/corrupted.json"
58
-
59
-
// Create corrupted JSON file
60
-
if err := os.WriteFile(storePath, []byte("invalid json {{{"), 0600); err != nil {
61
-
t.Fatalf("Failed to create corrupted file: %v", err)
62
-
}
63
-
64
-
// Should fail to load corrupted file
65
-
_, err := NewFileStore(storePath)
66
-
if err == nil {
67
-
t.Error("Expected error when loading corrupted file")
68
-
}
69
-
}
70
-
71
-
func TestFileStore_GetSession_NotFound(t *testing.T) {
72
-
tmpDir := t.TempDir()
73
-
storePath := tmpDir + "/oauth-test.json"
74
-
75
-
store, err := NewFileStore(storePath)
76
-
if err != nil {
77
-
t.Fatalf("NewFileStore() error = %v", err)
78
-
}
79
-
80
-
ctx := context.Background()
81
-
did, _ := syntax.ParseDID("did:plc:test123")
82
-
sessionID := "session123"
83
-
84
-
// Should return error for non-existent session
85
-
session, err := store.GetSession(ctx, did, sessionID)
86
-
if err == nil {
87
-
t.Error("Expected error for non-existent session")
88
-
}
89
-
if session != nil {
90
-
t.Error("Expected nil session for non-existent entry")
91
-
}
92
-
}
93
-
94
-
func TestFileStore_SaveAndGetSession(t *testing.T) {
95
-
tmpDir := t.TempDir()
96
-
storePath := tmpDir + "/oauth-test.json"
97
-
98
-
store, err := NewFileStore(storePath)
99
-
if err != nil {
100
-
t.Fatalf("NewFileStore() error = %v", err)
101
-
}
102
-
103
-
ctx := context.Background()
104
-
did, _ := syntax.ParseDID("did:plc:alice123")
105
-
106
-
// Create test session
107
-
sessionData := oauth.ClientSessionData{
108
-
AccountDID: did,
109
-
SessionID: "test-session-123",
110
-
HostURL: "https://pds.example.com",
111
-
Scopes: []string{"atproto", "blob:read"},
112
-
}
113
-
114
-
// Save session
115
-
if err := store.SaveSession(ctx, sessionData); err != nil {
116
-
t.Fatalf("SaveSession() error = %v", err)
117
-
}
118
-
119
-
// Retrieve session
120
-
retrieved, err := store.GetSession(ctx, did, "test-session-123")
121
-
if err != nil {
122
-
t.Fatalf("GetSession() error = %v", err)
123
-
}
124
-
125
-
if retrieved == nil {
126
-
t.Fatal("Expected non-nil session")
127
-
}
128
-
129
-
if retrieved.SessionID != sessionData.SessionID {
130
-
t.Errorf("Expected sessionID %q, got %q", sessionData.SessionID, retrieved.SessionID)
131
-
}
132
-
133
-
if retrieved.AccountDID.String() != did.String() {
134
-
t.Errorf("Expected DID %q, got %q", did.String(), retrieved.AccountDID.String())
135
-
}
136
-
137
-
if retrieved.HostURL != sessionData.HostURL {
138
-
t.Errorf("Expected hostURL %q, got %q", sessionData.HostURL, retrieved.HostURL)
139
-
}
140
-
}
141
-
142
-
func TestFileStore_UpdateSession(t *testing.T) {
143
-
tmpDir := t.TempDir()
144
-
storePath := tmpDir + "/oauth-test.json"
145
-
146
-
store, err := NewFileStore(storePath)
147
-
if err != nil {
148
-
t.Fatalf("NewFileStore() error = %v", err)
149
-
}
150
-
151
-
ctx := context.Background()
152
-
did, _ := syntax.ParseDID("did:plc:alice123")
153
-
154
-
// Save initial session
155
-
sessionData := oauth.ClientSessionData{
156
-
AccountDID: did,
157
-
SessionID: "test-session-123",
158
-
HostURL: "https://pds.example.com",
159
-
Scopes: []string{"atproto"},
160
-
}
161
-
162
-
if err := store.SaveSession(ctx, sessionData); err != nil {
163
-
t.Fatalf("SaveSession() error = %v", err)
164
-
}
165
-
166
-
// Update session with new scopes
167
-
sessionData.Scopes = []string{"atproto", "blob:read", "blob:write"}
168
-
if err := store.SaveSession(ctx, sessionData); err != nil {
169
-
t.Fatalf("SaveSession() (update) error = %v", err)
170
-
}
171
-
172
-
// Retrieve updated session
173
-
retrieved, err := store.GetSession(ctx, did, "test-session-123")
174
-
if err != nil {
175
-
t.Fatalf("GetSession() error = %v", err)
176
-
}
177
-
178
-
if len(retrieved.Scopes) != 3 {
179
-
t.Errorf("Expected 3 scopes, got %d", len(retrieved.Scopes))
180
-
}
181
-
}
182
-
183
-
func TestFileStore_DeleteSession(t *testing.T) {
184
-
tmpDir := t.TempDir()
185
-
storePath := tmpDir + "/oauth-test.json"
186
-
187
-
store, err := NewFileStore(storePath)
188
-
if err != nil {
189
-
t.Fatalf("NewFileStore() error = %v", err)
190
-
}
191
-
192
-
ctx := context.Background()
193
-
did, _ := syntax.ParseDID("did:plc:alice123")
194
-
195
-
// Save session
196
-
sessionData := oauth.ClientSessionData{
197
-
AccountDID: did,
198
-
SessionID: "test-session-123",
199
-
HostURL: "https://pds.example.com",
200
-
}
201
-
202
-
if err := store.SaveSession(ctx, sessionData); err != nil {
203
-
t.Fatalf("SaveSession() error = %v", err)
204
-
}
205
-
206
-
// Verify it exists
207
-
if _, err := store.GetSession(ctx, did, "test-session-123"); err != nil {
208
-
t.Fatalf("GetSession() should succeed before delete, got error: %v", err)
209
-
}
210
-
211
-
// Delete session
212
-
if err := store.DeleteSession(ctx, did, "test-session-123"); err != nil {
213
-
t.Fatalf("DeleteSession() error = %v", err)
214
-
}
215
-
216
-
// Verify it's gone
217
-
_, err = store.GetSession(ctx, did, "test-session-123")
218
-
if err == nil {
219
-
t.Error("Expected error after deleting session")
220
-
}
221
-
}
222
-
223
-
func TestFileStore_DeleteNonExistentSession(t *testing.T) {
224
-
tmpDir := t.TempDir()
225
-
storePath := tmpDir + "/oauth-test.json"
226
-
227
-
store, err := NewFileStore(storePath)
228
-
if err != nil {
229
-
t.Fatalf("NewFileStore() error = %v", err)
230
-
}
231
-
232
-
ctx := context.Background()
233
-
did, _ := syntax.ParseDID("did:plc:alice123")
234
-
235
-
// Delete non-existent session should not error
236
-
if err := store.DeleteSession(ctx, did, "nonexistent"); err != nil {
237
-
t.Errorf("DeleteSession() on non-existent session should not error, got: %v", err)
238
-
}
239
-
}
240
-
241
-
func TestFileStore_SaveAndGetAuthRequestInfo(t *testing.T) {
242
-
tmpDir := t.TempDir()
243
-
storePath := tmpDir + "/oauth-test.json"
244
-
245
-
store, err := NewFileStore(storePath)
246
-
if err != nil {
247
-
t.Fatalf("NewFileStore() error = %v", err)
248
-
}
249
-
250
-
ctx := context.Background()
251
-
252
-
// Create test auth request
253
-
did, _ := syntax.ParseDID("did:plc:alice123")
254
-
authRequest := oauth.AuthRequestData{
255
-
State: "test-state-123",
256
-
AuthServerURL: "https://pds.example.com",
257
-
AccountDID: &did,
258
-
Scopes: []string{"atproto", "blob:read"},
259
-
RequestURI: "urn:ietf:params:oauth:request_uri:test123",
260
-
AuthServerTokenEndpoint: "https://pds.example.com/oauth/token",
261
-
}
262
-
263
-
// Save auth request
264
-
if err := store.SaveAuthRequestInfo(ctx, authRequest); err != nil {
265
-
t.Fatalf("SaveAuthRequestInfo() error = %v", err)
266
-
}
267
-
268
-
// Retrieve auth request
269
-
retrieved, err := store.GetAuthRequestInfo(ctx, "test-state-123")
270
-
if err != nil {
271
-
t.Fatalf("GetAuthRequestInfo() error = %v", err)
272
-
}
273
-
274
-
if retrieved == nil {
275
-
t.Fatal("Expected non-nil auth request")
276
-
}
277
-
278
-
if retrieved.State != authRequest.State {
279
-
t.Errorf("Expected state %q, got %q", authRequest.State, retrieved.State)
280
-
}
281
-
282
-
if retrieved.AuthServerURL != authRequest.AuthServerURL {
283
-
t.Errorf("Expected authServerURL %q, got %q", authRequest.AuthServerURL, retrieved.AuthServerURL)
284
-
}
285
-
}
286
-
287
-
func TestFileStore_GetAuthRequestInfo_NotFound(t *testing.T) {
288
-
tmpDir := t.TempDir()
289
-
storePath := tmpDir + "/oauth-test.json"
290
-
291
-
store, err := NewFileStore(storePath)
292
-
if err != nil {
293
-
t.Fatalf("NewFileStore() error = %v", err)
294
-
}
295
-
296
-
ctx := context.Background()
297
-
298
-
// Should return error for non-existent request
299
-
_, err = store.GetAuthRequestInfo(ctx, "nonexistent-state")
300
-
if err == nil {
301
-
t.Error("Expected error for non-existent auth request")
302
-
}
303
-
}
304
-
305
-
func TestFileStore_DeleteAuthRequestInfo(t *testing.T) {
306
-
tmpDir := t.TempDir()
307
-
storePath := tmpDir + "/oauth-test.json"
308
-
309
-
store, err := NewFileStore(storePath)
310
-
if err != nil {
311
-
t.Fatalf("NewFileStore() error = %v", err)
312
-
}
313
-
314
-
ctx := context.Background()
315
-
316
-
// Save auth request
317
-
authRequest := oauth.AuthRequestData{
318
-
State: "test-state-123",
319
-
AuthServerURL: "https://pds.example.com",
320
-
}
321
-
322
-
if err := store.SaveAuthRequestInfo(ctx, authRequest); err != nil {
323
-
t.Fatalf("SaveAuthRequestInfo() error = %v", err)
324
-
}
325
-
326
-
// Verify it exists
327
-
if _, err := store.GetAuthRequestInfo(ctx, "test-state-123"); err != nil {
328
-
t.Fatalf("GetAuthRequestInfo() should succeed before delete, got error: %v", err)
329
-
}
330
-
331
-
// Delete auth request
332
-
if err := store.DeleteAuthRequestInfo(ctx, "test-state-123"); err != nil {
333
-
t.Fatalf("DeleteAuthRequestInfo() error = %v", err)
334
-
}
335
-
336
-
// Verify it's gone
337
-
_, err = store.GetAuthRequestInfo(ctx, "test-state-123")
338
-
if err == nil {
339
-
t.Error("Expected error after deleting auth request")
340
-
}
341
-
}
342
-
343
-
func TestFileStore_ListSessions(t *testing.T) {
344
-
tmpDir := t.TempDir()
345
-
storePath := tmpDir + "/oauth-test.json"
346
-
347
-
store, err := NewFileStore(storePath)
348
-
if err != nil {
349
-
t.Fatalf("NewFileStore() error = %v", err)
350
-
}
351
-
352
-
ctx := context.Background()
353
-
354
-
// Initially empty
355
-
sessions := store.ListSessions()
356
-
if len(sessions) != 0 {
357
-
t.Errorf("Expected 0 sessions, got %d", len(sessions))
358
-
}
359
-
360
-
// Add multiple sessions
361
-
did1, _ := syntax.ParseDID("did:plc:alice123")
362
-
did2, _ := syntax.ParseDID("did:plc:bob456")
363
-
364
-
session1 := oauth.ClientSessionData{
365
-
AccountDID: did1,
366
-
SessionID: "session-1",
367
-
HostURL: "https://pds1.example.com",
368
-
}
369
-
370
-
session2 := oauth.ClientSessionData{
371
-
AccountDID: did2,
372
-
SessionID: "session-2",
373
-
HostURL: "https://pds2.example.com",
374
-
}
375
-
376
-
if err := store.SaveSession(ctx, session1); err != nil {
377
-
t.Fatalf("SaveSession() error = %v", err)
378
-
}
379
-
380
-
if err := store.SaveSession(ctx, session2); err != nil {
381
-
t.Fatalf("SaveSession() error = %v", err)
382
-
}
383
-
384
-
// List sessions
385
-
sessions = store.ListSessions()
386
-
if len(sessions) != 2 {
387
-
t.Errorf("Expected 2 sessions, got %d", len(sessions))
388
-
}
389
-
390
-
// Verify we got both sessions
391
-
key1 := makeSessionKey(did1.String(), "session-1")
392
-
key2 := makeSessionKey(did2.String(), "session-2")
393
-
394
-
if sessions[key1] == nil {
395
-
t.Error("Expected session1 in list")
396
-
}
397
-
398
-
if sessions[key2] == nil {
399
-
t.Error("Expected session2 in list")
400
-
}
401
-
}
402
-
403
-
func TestFileStore_Persistence_Across_Instances(t *testing.T) {
404
-
tmpDir := t.TempDir()
405
-
storePath := tmpDir + "/oauth-test.json"
406
-
407
-
ctx := context.Background()
408
-
did, _ := syntax.ParseDID("did:plc:alice123")
409
-
410
-
// Create first store and save data
411
-
store1, err := NewFileStore(storePath)
412
-
if err != nil {
413
-
t.Fatalf("NewFileStore() error = %v", err)
414
-
}
415
-
416
-
sessionData := oauth.ClientSessionData{
417
-
AccountDID: did,
418
-
SessionID: "persistent-session",
419
-
HostURL: "https://pds.example.com",
420
-
}
421
-
422
-
if err := store1.SaveSession(ctx, sessionData); err != nil {
423
-
t.Fatalf("SaveSession() error = %v", err)
424
-
}
425
-
426
-
authRequest := oauth.AuthRequestData{
427
-
State: "persistent-state",
428
-
AuthServerURL: "https://pds.example.com",
429
-
}
430
-
431
-
if err := store1.SaveAuthRequestInfo(ctx, authRequest); err != nil {
432
-
t.Fatalf("SaveAuthRequestInfo() error = %v", err)
433
-
}
434
-
435
-
// Create second store from same file
436
-
store2, err := NewFileStore(storePath)
437
-
if err != nil {
438
-
t.Fatalf("Second NewFileStore() error = %v", err)
439
-
}
440
-
441
-
// Verify session persisted
442
-
retrievedSession, err := store2.GetSession(ctx, did, "persistent-session")
443
-
if err != nil {
444
-
t.Fatalf("GetSession() from second store error = %v", err)
445
-
}
446
-
447
-
if retrievedSession.SessionID != "persistent-session" {
448
-
t.Errorf("Expected persistent session ID, got %q", retrievedSession.SessionID)
449
-
}
450
-
451
-
// Verify auth request persisted
452
-
retrievedAuth, err := store2.GetAuthRequestInfo(ctx, "persistent-state")
453
-
if err != nil {
454
-
t.Fatalf("GetAuthRequestInfo() from second store error = %v", err)
455
-
}
456
-
457
-
if retrievedAuth.State != "persistent-state" {
458
-
t.Errorf("Expected persistent state, got %q", retrievedAuth.State)
459
-
}
460
-
}
461
-
462
-
func TestFileStore_FileSecurity(t *testing.T) {
463
-
tmpDir := t.TempDir()
464
-
storePath := tmpDir + "/oauth-test.json"
465
-
466
-
store, err := NewFileStore(storePath)
467
-
if err != nil {
468
-
t.Fatalf("NewFileStore() error = %v", err)
469
-
}
470
-
471
-
ctx := context.Background()
472
-
did, _ := syntax.ParseDID("did:plc:alice123")
473
-
474
-
// Save some data to trigger file creation
475
-
sessionData := oauth.ClientSessionData{
476
-
AccountDID: did,
477
-
SessionID: "test-session",
478
-
HostURL: "https://pds.example.com",
479
-
}
480
-
481
-
if err := store.SaveSession(ctx, sessionData); err != nil {
482
-
t.Fatalf("SaveSession() error = %v", err)
483
-
}
484
-
485
-
// Check file permissions (should be 0600)
486
-
info, err := os.Stat(storePath)
487
-
if err != nil {
488
-
t.Fatalf("Failed to stat file: %v", err)
489
-
}
490
-
491
-
mode := info.Mode()
492
-
if mode.Perm() != 0600 {
493
-
t.Errorf("Expected file permissions 0600, got %o", mode.Perm())
494
-
}
495
-
}
496
-
497
-
func TestFileStore_JSONFormat(t *testing.T) {
498
-
tmpDir := t.TempDir()
499
-
storePath := tmpDir + "/oauth-test.json"
500
-
501
-
store, err := NewFileStore(storePath)
502
-
if err != nil {
503
-
t.Fatalf("NewFileStore() error = %v", err)
504
-
}
505
-
506
-
ctx := context.Background()
507
-
did, _ := syntax.ParseDID("did:plc:alice123")
508
-
509
-
// Save data
510
-
sessionData := oauth.ClientSessionData{
511
-
AccountDID: did,
512
-
SessionID: "test-session",
513
-
HostURL: "https://pds.example.com",
514
-
}
515
-
516
-
if err := store.SaveSession(ctx, sessionData); err != nil {
517
-
t.Fatalf("SaveSession() error = %v", err)
518
-
}
519
-
520
-
// Read and verify JSON format
521
-
data, err := os.ReadFile(storePath)
522
-
if err != nil {
523
-
t.Fatalf("Failed to read file: %v", err)
524
-
}
525
-
526
-
var storeData FileStoreData
527
-
if err := json.Unmarshal(data, &storeData); err != nil {
528
-
t.Fatalf("Failed to parse JSON: %v", err)
529
-
}
530
-
531
-
if storeData.Sessions == nil {
532
-
t.Error("Expected sessions in JSON")
533
-
}
534
-
535
-
if storeData.Requests == nil {
536
-
t.Error("Expected requests in JSON")
537
-
}
538
-
}
539
-
540
-
func TestFileStore_CleanupExpired(t *testing.T) {
541
-
tmpDir := t.TempDir()
542
-
storePath := tmpDir + "/oauth-test.json"
543
-
544
-
store, err := NewFileStore(storePath)
545
-
if err != nil {
546
-
t.Fatalf("NewFileStore() error = %v", err)
547
-
}
548
-
549
-
// CleanupExpired should not error even with no data
550
-
if err := store.CleanupExpired(); err != nil {
551
-
t.Errorf("CleanupExpired() error = %v", err)
552
-
}
553
-
554
-
// Note: Current implementation doesn't actually clean anything
555
-
// since AuthRequestData and ClientSessionData don't have expiry timestamps
556
-
// This test verifies the method doesn't panic
557
-
}
558
-
559
-
func TestGetDefaultStorePath(t *testing.T) {
560
-
path, err := GetDefaultStorePath()
561
-
if err != nil {
562
-
t.Fatalf("GetDefaultStorePath() error = %v", err)
563
-
}
564
-
565
-
if path == "" {
566
-
t.Fatal("Expected non-empty path")
567
-
}
568
-
569
-
// Path should either be /var/lib/atcr or ~/.atcr
570
-
// We can't assert exact path since it depends on permissions
571
-
t.Logf("Default store path: %s", path)
572
-
}
573
-
574
-
func TestMakeSessionKey(t *testing.T) {
575
-
did := "did:plc:alice123"
576
-
sessionID := "session-456"
577
-
578
-
key := makeSessionKey(did, sessionID)
579
-
expected := "did:plc:alice123:session-456"
580
-
581
-
if key != expected {
582
-
t.Errorf("Expected key %q, got %q", expected, key)
583
-
}
584
-
}
585
-
586
-
func TestFileStore_ConcurrentAccess(t *testing.T) {
587
-
tmpDir := t.TempDir()
588
-
storePath := tmpDir + "/oauth-test.json"
589
-
590
-
store, err := NewFileStore(storePath)
591
-
if err != nil {
592
-
t.Fatalf("NewFileStore() error = %v", err)
593
-
}
594
-
595
-
ctx := context.Background()
596
-
597
-
// Run concurrent operations
598
-
done := make(chan bool)
599
-
600
-
// Writer goroutine
601
-
go func() {
602
-
for i := 0; i < 10; i++ {
603
-
did, _ := syntax.ParseDID("did:plc:alice123")
604
-
sessionData := oauth.ClientSessionData{
605
-
AccountDID: did,
606
-
SessionID: "session-1",
607
-
HostURL: "https://pds.example.com",
608
-
}
609
-
store.SaveSession(ctx, sessionData)
610
-
time.Sleep(1 * time.Millisecond)
611
-
}
612
-
done <- true
613
-
}()
614
-
615
-
// Reader goroutine
616
-
go func() {
617
-
for i := 0; i < 10; i++ {
618
-
did, _ := syntax.ParseDID("did:plc:alice123")
619
-
store.GetSession(ctx, did, "session-1")
620
-
time.Sleep(1 * time.Millisecond)
621
-
}
622
-
done <- true
623
-
}()
624
-
625
-
// Wait for both goroutines
626
-
<-done
627
-
<-done
628
-
629
-
// If we got here without panicking, the locking works
630
-
t.Log("Concurrent access test passed")
631
-
}
···
+300
pkg/auth/servicetoken.go
+300
pkg/auth/servicetoken.go
···
···
1
+
package auth
2
+
3
+
import (
4
+
"context"
5
+
"encoding/base64"
6
+
"encoding/json"
7
+
"errors"
8
+
"fmt"
9
+
"io"
10
+
"log/slog"
11
+
"net/http"
12
+
"net/url"
13
+
"strings"
14
+
"time"
15
+
16
+
"atcr.io/pkg/atproto"
17
+
"atcr.io/pkg/auth/oauth"
18
+
"github.com/bluesky-social/indigo/atproto/atclient"
19
+
indigo_oauth "github.com/bluesky-social/indigo/atproto/auth/oauth"
20
+
)
21
+
22
+
// getErrorHint provides context-specific troubleshooting hints based on API error type
23
+
func getErrorHint(apiErr *atclient.APIError) string {
24
+
switch apiErr.Name {
25
+
case "use_dpop_nonce":
26
+
return "DPoP nonce mismatch - indigo library should automatically retry with new nonce. If this persists, check for concurrent request issues or PDS session corruption."
27
+
case "invalid_client":
28
+
if apiErr.Message != "" && apiErr.Message == "Validation of \"client_assertion\" failed: \"iat\" claim timestamp check failed (it should be in the past)" {
29
+
return "JWT timestamp validation failed - system clock on AppView may be ahead of PDS clock. Check NTP sync with: timedatectl status"
30
+
}
31
+
return "OAuth client authentication failed - check client key configuration and PDS OAuth server status"
32
+
case "invalid_token", "invalid_grant":
33
+
return "OAuth tokens expired or invalidated - user will need to re-authenticate via OAuth flow"
34
+
case "server_error":
35
+
if apiErr.StatusCode == 500 {
36
+
return "PDS returned internal server error - this may occur after repeated DPoP nonce failures or other PDS-side issues. Check PDS logs for root cause."
37
+
}
38
+
return "PDS server error - check PDS health and logs"
39
+
case "invalid_dpop_proof":
40
+
return "DPoP proof validation failed - check system clock sync and DPoP key configuration"
41
+
default:
42
+
if apiErr.StatusCode == 401 || apiErr.StatusCode == 403 {
43
+
return "Authentication/authorization failed - OAuth session may be expired or revoked"
44
+
}
45
+
return "PDS rejected the request - see errorName and errorMessage for details"
46
+
}
47
+
}
48
+
49
+
// ParseJWTExpiry extracts the expiry time from a JWT without verifying the signature
50
+
// We trust tokens from the user's PDS, so signature verification isn't needed here
51
+
// Manually decodes the JWT payload to avoid algorithm compatibility issues
52
+
func ParseJWTExpiry(tokenString string) (time.Time, error) {
53
+
// JWT format: header.payload.signature
54
+
parts := strings.Split(tokenString, ".")
55
+
if len(parts) != 3 {
56
+
return time.Time{}, fmt.Errorf("invalid JWT format: expected 3 parts, got %d", len(parts))
57
+
}
58
+
59
+
// Decode the payload (second part)
60
+
payload, err := base64.RawURLEncoding.DecodeString(parts[1])
61
+
if err != nil {
62
+
return time.Time{}, fmt.Errorf("failed to decode JWT payload: %w", err)
63
+
}
64
+
65
+
// Parse the JSON payload
66
+
var claims struct {
67
+
Exp int64 `json:"exp"`
68
+
}
69
+
if err := json.Unmarshal(payload, &claims); err != nil {
70
+
return time.Time{}, fmt.Errorf("failed to parse JWT claims: %w", err)
71
+
}
72
+
73
+
if claims.Exp == 0 {
74
+
return time.Time{}, fmt.Errorf("JWT missing exp claim")
75
+
}
76
+
77
+
return time.Unix(claims.Exp, 0), nil
78
+
}
79
+
80
+
// buildServiceAuthURL constructs the URL for com.atproto.server.getServiceAuth
81
+
func buildServiceAuthURL(pdsEndpoint, holdDID string) string {
82
+
// Request 5-minute expiry (PDS may grant less)
83
+
// exp must be absolute Unix timestamp, not relative duration
84
+
expiryTime := time.Now().Unix() + 300 // 5 minutes from now
85
+
return fmt.Sprintf("%s%s?aud=%s&lxm=%s&exp=%d",
86
+
pdsEndpoint,
87
+
atproto.ServerGetServiceAuth,
88
+
url.QueryEscape(holdDID),
89
+
url.QueryEscape("com.atproto.repo.getRecord"),
90
+
expiryTime,
91
+
)
92
+
}
93
+
94
+
// parseServiceTokenResponse extracts the token from a service auth response
95
+
func parseServiceTokenResponse(resp *http.Response) (string, error) {
96
+
defer resp.Body.Close()
97
+
98
+
if resp.StatusCode != http.StatusOK {
99
+
bodyBytes, _ := io.ReadAll(resp.Body)
100
+
return "", fmt.Errorf("service auth failed with status %d: %s", resp.StatusCode, string(bodyBytes))
101
+
}
102
+
103
+
var result struct {
104
+
Token string `json:"token"`
105
+
}
106
+
if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
107
+
return "", fmt.Errorf("failed to decode service auth response: %w", err)
108
+
}
109
+
110
+
if result.Token == "" {
111
+
return "", fmt.Errorf("empty token in service auth response")
112
+
}
113
+
114
+
return result.Token, nil
115
+
}
116
+
117
+
// GetOrFetchServiceToken gets a service token for hold authentication.
118
+
// Handles both OAuth/DPoP and app-password authentication based on authMethod.
119
+
// Checks cache first, then fetches from PDS if needed.
120
+
//
121
+
// For OAuth: Uses DoWithSession() to hold a per-DID lock through the entire PDS interaction.
122
+
// This prevents DPoP nonce race conditions when multiple Docker layers upload concurrently.
123
+
//
124
+
// For app-password: Uses Bearer token authentication without locking (no DPoP complexity).
125
+
func GetOrFetchServiceToken(
126
+
ctx context.Context,
127
+
authMethod string,
128
+
refresher *oauth.Refresher, // Required for OAuth, nil for app-password
129
+
did, holdDID, pdsEndpoint string,
130
+
) (string, error) {
131
+
// Check cache first to avoid unnecessary PDS calls on every request
132
+
cachedToken, expiresAt := GetServiceToken(did, holdDID)
133
+
134
+
// Use cached token if it exists and has > 10s remaining
135
+
if cachedToken != "" && time.Until(expiresAt) > 10*time.Second {
136
+
slog.Debug("Using cached service token",
137
+
"did", did,
138
+
"authMethod", authMethod,
139
+
"expiresIn", time.Until(expiresAt).Round(time.Second))
140
+
return cachedToken, nil
141
+
}
142
+
143
+
// Cache miss or expiring soon - fetch new service token
144
+
if cachedToken == "" {
145
+
slog.Debug("Service token cache miss, fetching new token", "did", did, "authMethod", authMethod)
146
+
} else {
147
+
slog.Debug("Service token expiring soon, proactively renewing", "did", did, "authMethod", authMethod)
148
+
}
149
+
150
+
var serviceToken string
151
+
var err error
152
+
153
+
// Branch based on auth method
154
+
if authMethod == AuthMethodOAuth {
155
+
serviceToken, err = doOAuthFetch(ctx, refresher, did, holdDID, pdsEndpoint)
156
+
// OAuth-specific cleanup: delete stale session on error
157
+
if err != nil && refresher != nil {
158
+
if delErr := refresher.DeleteSession(ctx, did); delErr != nil {
159
+
slog.Warn("Failed to delete stale OAuth session",
160
+
"component", "auth/servicetoken",
161
+
"did", did,
162
+
"error", delErr)
163
+
}
164
+
}
165
+
} else {
166
+
serviceToken, err = doAppPasswordFetch(ctx, did, holdDID, pdsEndpoint)
167
+
}
168
+
169
+
// Unified error handling
170
+
if err != nil {
171
+
InvalidateServiceToken(did, holdDID)
172
+
173
+
var apiErr *atclient.APIError
174
+
if errors.As(err, &apiErr) {
175
+
slog.Error("Service token request failed",
176
+
"component", "auth/servicetoken",
177
+
"authMethod", authMethod,
178
+
"did", did,
179
+
"holdDID", holdDID,
180
+
"pdsEndpoint", pdsEndpoint,
181
+
"error", err,
182
+
"httpStatus", apiErr.StatusCode,
183
+
"errorName", apiErr.Name,
184
+
"errorMessage", apiErr.Message,
185
+
"hint", getErrorHint(apiErr))
186
+
} else {
187
+
slog.Error("Service token request failed",
188
+
"component", "auth/servicetoken",
189
+
"authMethod", authMethod,
190
+
"did", did,
191
+
"holdDID", holdDID,
192
+
"pdsEndpoint", pdsEndpoint,
193
+
"error", err)
194
+
}
195
+
return "", err
196
+
}
197
+
198
+
// Cache the token (parses JWT to extract actual expiry)
199
+
if cacheErr := SetServiceToken(did, holdDID, serviceToken); cacheErr != nil {
200
+
slog.Warn("Failed to cache service token", "error", cacheErr, "did", did, "holdDID", holdDID)
201
+
}
202
+
203
+
slog.Debug("Service token obtained", "did", did, "authMethod", authMethod)
204
+
return serviceToken, nil
205
+
}
206
+
207
+
// doOAuthFetch fetches a service token using OAuth/DPoP authentication.
208
+
// Uses DoWithSession() for per-DID locking to prevent DPoP nonce races.
209
+
// Returns (token, error) without logging - caller handles error logging.
210
+
func doOAuthFetch(
211
+
ctx context.Context,
212
+
refresher *oauth.Refresher,
213
+
did, holdDID, pdsEndpoint string,
214
+
) (string, error) {
215
+
if refresher == nil {
216
+
return "", fmt.Errorf("refresher is nil (OAuth session required)")
217
+
}
218
+
219
+
var serviceToken string
220
+
var fetchErr error
221
+
222
+
err := refresher.DoWithSession(ctx, did, func(session *indigo_oauth.ClientSession) error {
223
+
// Double-check cache after acquiring lock (double-checked locking pattern)
224
+
cachedToken, expiresAt := GetServiceToken(did, holdDID)
225
+
if cachedToken != "" && time.Until(expiresAt) > 10*time.Second {
226
+
slog.Debug("Service token cache hit after lock acquisition",
227
+
"did", did,
228
+
"expiresIn", time.Until(expiresAt).Round(time.Second))
229
+
serviceToken = cachedToken
230
+
return nil
231
+
}
232
+
233
+
serviceAuthURL := buildServiceAuthURL(pdsEndpoint, holdDID)
234
+
235
+
req, err := http.NewRequestWithContext(ctx, "GET", serviceAuthURL, nil)
236
+
if err != nil {
237
+
fetchErr = fmt.Errorf("failed to create request: %w", err)
238
+
return fetchErr
239
+
}
240
+
241
+
resp, err := session.DoWithAuth(session.Client, req, "com.atproto.server.getServiceAuth")
242
+
if err != nil {
243
+
fetchErr = fmt.Errorf("OAuth request failed: %w", err)
244
+
return fetchErr
245
+
}
246
+
247
+
token, parseErr := parseServiceTokenResponse(resp)
248
+
if parseErr != nil {
249
+
fetchErr = parseErr
250
+
return fetchErr
251
+
}
252
+
253
+
serviceToken = token
254
+
return nil
255
+
})
256
+
257
+
if err != nil {
258
+
if fetchErr != nil {
259
+
return "", fetchErr
260
+
}
261
+
return "", fmt.Errorf("failed to get OAuth session: %w", err)
262
+
}
263
+
264
+
return serviceToken, nil
265
+
}
266
+
267
+
// doAppPasswordFetch fetches a service token using Bearer token authentication.
268
+
// Returns (token, error) without logging - caller handles error logging.
269
+
func doAppPasswordFetch(
270
+
ctx context.Context,
271
+
did, holdDID, pdsEndpoint string,
272
+
) (string, error) {
273
+
accessToken, ok := GetGlobalTokenCache().Get(did)
274
+
if !ok {
275
+
return "", fmt.Errorf("no app-password access token available for DID %s", did)
276
+
}
277
+
278
+
serviceAuthURL := buildServiceAuthURL(pdsEndpoint, holdDID)
279
+
280
+
req, err := http.NewRequestWithContext(ctx, "GET", serviceAuthURL, nil)
281
+
if err != nil {
282
+
return "", fmt.Errorf("failed to create request: %w", err)
283
+
}
284
+
285
+
req.Header.Set("Authorization", "Bearer "+accessToken)
286
+
287
+
resp, err := http.DefaultClient.Do(req)
288
+
if err != nil {
289
+
return "", fmt.Errorf("request failed: %w", err)
290
+
}
291
+
292
+
if resp.StatusCode == http.StatusUnauthorized {
293
+
resp.Body.Close()
294
+
// Clear stale app-password token
295
+
GetGlobalTokenCache().Delete(did)
296
+
return "", fmt.Errorf("app-password authentication failed: token expired or invalid")
297
+
}
298
+
299
+
return parseServiceTokenResponse(resp)
300
+
}
+27
pkg/auth/servicetoken_test.go
+27
pkg/auth/servicetoken_test.go
···
···
1
+
package auth
2
+
3
+
import (
4
+
"context"
5
+
"testing"
6
+
)
7
+
8
+
func TestGetOrFetchServiceToken_NilRefresher(t *testing.T) {
9
+
ctx := context.Background()
10
+
did := "did:plc:test123"
11
+
holdDID := "did:web:hold.example.com"
12
+
pdsEndpoint := "https://pds.example.com"
13
+
14
+
// Test with nil refresher and OAuth auth method - should return error
15
+
_, err := GetOrFetchServiceToken(ctx, AuthMethodOAuth, nil, did, holdDID, pdsEndpoint)
16
+
if err == nil {
17
+
t.Error("Expected error when refresher is nil for OAuth")
18
+
}
19
+
20
+
expectedErrMsg := "refresher is nil (OAuth session required)"
21
+
if err.Error() != expectedErrMsg {
22
+
t.Errorf("Expected error message %q, got %q", expectedErrMsg, err.Error())
23
+
}
24
+
}
25
+
26
+
// Note: Full tests with mocked OAuth refresher and HTTP client will be added
27
+
// in the comprehensive test implementation phase
-175
pkg/auth/token/cache.go
-175
pkg/auth/token/cache.go
···
1
-
// Package token provides service token caching and management for AppView.
2
-
// Service tokens are JWTs issued by a user's PDS to authorize AppView to
3
-
// act on their behalf when communicating with hold services. Tokens are
4
-
// cached with automatic expiry parsing and 10-second safety margins.
5
-
package token
6
-
7
-
import (
8
-
"encoding/base64"
9
-
"encoding/json"
10
-
"fmt"
11
-
"log/slog"
12
-
"strings"
13
-
"sync"
14
-
"time"
15
-
)
16
-
17
-
// serviceTokenEntry represents a cached service token
18
-
type serviceTokenEntry struct {
19
-
token string
20
-
expiresAt time.Time
21
-
}
22
-
23
-
// Global cache for service tokens (DID:HoldDID -> token)
24
-
// Service tokens are JWTs issued by a user's PDS to authorize AppView to act on their behalf
25
-
// when communicating with hold services. These tokens are scoped to specific holds and have
26
-
// limited lifetime (typically 60s, can request up to 5min).
27
-
var (
28
-
globalServiceTokens = make(map[string]*serviceTokenEntry)
29
-
globalServiceTokensMu sync.RWMutex
30
-
)
31
-
32
-
// GetServiceToken retrieves a cached service token for the given DID and hold DID
33
-
// Returns empty string if no valid cached token exists
34
-
func GetServiceToken(did, holdDID string) (token string, expiresAt time.Time) {
35
-
cacheKey := did + ":" + holdDID
36
-
37
-
globalServiceTokensMu.RLock()
38
-
entry, exists := globalServiceTokens[cacheKey]
39
-
globalServiceTokensMu.RUnlock()
40
-
41
-
if !exists {
42
-
return "", time.Time{}
43
-
}
44
-
45
-
// Check if token is still valid
46
-
if time.Now().After(entry.expiresAt) {
47
-
// Token expired, remove from cache
48
-
globalServiceTokensMu.Lock()
49
-
delete(globalServiceTokens, cacheKey)
50
-
globalServiceTokensMu.Unlock()
51
-
return "", time.Time{}
52
-
}
53
-
54
-
return entry.token, entry.expiresAt
55
-
}
56
-
57
-
// SetServiceToken stores a service token in the cache
58
-
// Automatically parses the JWT to extract the expiry time
59
-
// Applies a 10-second safety margin (cache expires 10s before actual JWT expiry)
60
-
func SetServiceToken(did, holdDID, token string) error {
61
-
cacheKey := did + ":" + holdDID
62
-
63
-
// Parse JWT to extract expiry (don't verify signature - we trust the PDS)
64
-
expiry, err := parseJWTExpiry(token)
65
-
if err != nil {
66
-
// If parsing fails, use default 50s TTL (conservative fallback)
67
-
slog.Warn("Failed to parse JWT expiry, using default 50s", "error", err, "cacheKey", cacheKey)
68
-
expiry = time.Now().Add(50 * time.Second)
69
-
} else {
70
-
// Apply 10s safety margin to avoid using nearly-expired tokens
71
-
expiry = expiry.Add(-10 * time.Second)
72
-
}
73
-
74
-
globalServiceTokensMu.Lock()
75
-
globalServiceTokens[cacheKey] = &serviceTokenEntry{
76
-
token: token,
77
-
expiresAt: expiry,
78
-
}
79
-
globalServiceTokensMu.Unlock()
80
-
81
-
slog.Debug("Cached service token",
82
-
"cacheKey", cacheKey,
83
-
"expiresIn", time.Until(expiry).Round(time.Second))
84
-
85
-
return nil
86
-
}
87
-
88
-
// parseJWTExpiry extracts the expiry time from a JWT without verifying the signature
89
-
// We trust tokens from the user's PDS, so signature verification isn't needed here
90
-
// Manually decodes the JWT payload to avoid algorithm compatibility issues
91
-
func parseJWTExpiry(tokenString string) (time.Time, error) {
92
-
// JWT format: header.payload.signature
93
-
parts := strings.Split(tokenString, ".")
94
-
if len(parts) != 3 {
95
-
return time.Time{}, fmt.Errorf("invalid JWT format: expected 3 parts, got %d", len(parts))
96
-
}
97
-
98
-
// Decode the payload (second part)
99
-
payload, err := base64.RawURLEncoding.DecodeString(parts[1])
100
-
if err != nil {
101
-
return time.Time{}, fmt.Errorf("failed to decode JWT payload: %w", err)
102
-
}
103
-
104
-
// Parse the JSON payload
105
-
var claims struct {
106
-
Exp int64 `json:"exp"`
107
-
}
108
-
if err := json.Unmarshal(payload, &claims); err != nil {
109
-
return time.Time{}, fmt.Errorf("failed to parse JWT claims: %w", err)
110
-
}
111
-
112
-
if claims.Exp == 0 {
113
-
return time.Time{}, fmt.Errorf("JWT missing exp claim")
114
-
}
115
-
116
-
return time.Unix(claims.Exp, 0), nil
117
-
}
118
-
119
-
// InvalidateServiceToken removes a service token from the cache
120
-
// Used when we detect that a token is invalid or the user's session has expired
121
-
func InvalidateServiceToken(did, holdDID string) {
122
-
cacheKey := did + ":" + holdDID
123
-
124
-
globalServiceTokensMu.Lock()
125
-
delete(globalServiceTokens, cacheKey)
126
-
globalServiceTokensMu.Unlock()
127
-
128
-
slog.Debug("Invalidated service token", "cacheKey", cacheKey)
129
-
}
130
-
131
-
// GetCacheStats returns statistics about the service token cache for debugging
132
-
func GetCacheStats() map[string]any {
133
-
globalServiceTokensMu.RLock()
134
-
defer globalServiceTokensMu.RUnlock()
135
-
136
-
validCount := 0
137
-
expiredCount := 0
138
-
now := time.Now()
139
-
140
-
for _, entry := range globalServiceTokens {
141
-
if now.Before(entry.expiresAt) {
142
-
validCount++
143
-
} else {
144
-
expiredCount++
145
-
}
146
-
}
147
-
148
-
return map[string]any{
149
-
"total_entries": len(globalServiceTokens),
150
-
"valid_tokens": validCount,
151
-
"expired_tokens": expiredCount,
152
-
}
153
-
}
154
-
155
-
// CleanExpiredTokens removes expired tokens from the cache
156
-
// Can be called periodically to prevent unbounded growth (though expired tokens
157
-
// are also removed lazily on access)
158
-
func CleanExpiredTokens() {
159
-
globalServiceTokensMu.Lock()
160
-
defer globalServiceTokensMu.Unlock()
161
-
162
-
now := time.Now()
163
-
removed := 0
164
-
165
-
for key, entry := range globalServiceTokens {
166
-
if now.After(entry.expiresAt) {
167
-
delete(globalServiceTokens, key)
168
-
removed++
169
-
}
170
-
}
171
-
172
-
if removed > 0 {
173
-
slog.Debug("Cleaned expired service tokens", "count", removed)
174
-
}
175
-
}
···
-195
pkg/auth/token/cache_test.go
-195
pkg/auth/token/cache_test.go
···
1
-
package token
2
-
3
-
import (
4
-
"testing"
5
-
"time"
6
-
)
7
-
8
-
func TestGetServiceToken_NotCached(t *testing.T) {
9
-
// Clear cache first
10
-
globalServiceTokensMu.Lock()
11
-
globalServiceTokens = make(map[string]*serviceTokenEntry)
12
-
globalServiceTokensMu.Unlock()
13
-
14
-
did := "did:plc:test123"
15
-
holdDID := "did:web:hold.example.com"
16
-
17
-
token, expiresAt := GetServiceToken(did, holdDID)
18
-
if token != "" {
19
-
t.Errorf("Expected empty token for uncached entry, got %q", token)
20
-
}
21
-
if !expiresAt.IsZero() {
22
-
t.Error("Expected zero time for uncached entry")
23
-
}
24
-
}
25
-
26
-
func TestSetServiceToken_ManualExpiry(t *testing.T) {
27
-
// Clear cache first
28
-
globalServiceTokensMu.Lock()
29
-
globalServiceTokens = make(map[string]*serviceTokenEntry)
30
-
globalServiceTokensMu.Unlock()
31
-
32
-
did := "did:plc:test123"
33
-
holdDID := "did:web:hold.example.com"
34
-
token := "invalid_jwt_token" // Will fall back to 50s default
35
-
36
-
// This should succeed with default 50s TTL since JWT parsing will fail
37
-
err := SetServiceToken(did, holdDID, token)
38
-
if err != nil {
39
-
t.Fatalf("SetServiceToken() error = %v", err)
40
-
}
41
-
42
-
// Verify token was cached
43
-
cachedToken, expiresAt := GetServiceToken(did, holdDID)
44
-
if cachedToken != token {
45
-
t.Errorf("Expected token %q, got %q", token, cachedToken)
46
-
}
47
-
if expiresAt.IsZero() {
48
-
t.Error("Expected non-zero expiry time")
49
-
}
50
-
51
-
// Expiry should be approximately 50s from now (with 10s margin subtracted in some cases)
52
-
expectedExpiry := time.Now().Add(50 * time.Second)
53
-
diff := expiresAt.Sub(expectedExpiry)
54
-
if diff < -5*time.Second || diff > 5*time.Second {
55
-
t.Errorf("Expiry time off by %v (expected ~50s from now)", diff)
56
-
}
57
-
}
58
-
59
-
func TestGetServiceToken_Expired(t *testing.T) {
60
-
// Manually insert an expired token
61
-
did := "did:plc:test123"
62
-
holdDID := "did:web:hold.example.com"
63
-
cacheKey := did + ":" + holdDID
64
-
65
-
globalServiceTokensMu.Lock()
66
-
globalServiceTokens[cacheKey] = &serviceTokenEntry{
67
-
token: "expired_token",
68
-
expiresAt: time.Now().Add(-1 * time.Hour), // 1 hour ago
69
-
}
70
-
globalServiceTokensMu.Unlock()
71
-
72
-
// Try to get - should return empty since expired
73
-
token, expiresAt := GetServiceToken(did, holdDID)
74
-
if token != "" {
75
-
t.Errorf("Expected empty token for expired entry, got %q", token)
76
-
}
77
-
if !expiresAt.IsZero() {
78
-
t.Error("Expected zero time for expired entry")
79
-
}
80
-
81
-
// Verify token was removed from cache
82
-
globalServiceTokensMu.RLock()
83
-
_, exists := globalServiceTokens[cacheKey]
84
-
globalServiceTokensMu.RUnlock()
85
-
86
-
if exists {
87
-
t.Error("Expected expired token to be removed from cache")
88
-
}
89
-
}
90
-
91
-
func TestInvalidateServiceToken(t *testing.T) {
92
-
// Set a token
93
-
did := "did:plc:test123"
94
-
holdDID := "did:web:hold.example.com"
95
-
token := "test_token"
96
-
97
-
err := SetServiceToken(did, holdDID, token)
98
-
if err != nil {
99
-
t.Fatalf("SetServiceToken() error = %v", err)
100
-
}
101
-
102
-
// Verify it's cached
103
-
cachedToken, _ := GetServiceToken(did, holdDID)
104
-
if cachedToken != token {
105
-
t.Fatal("Token should be cached")
106
-
}
107
-
108
-
// Invalidate
109
-
InvalidateServiceToken(did, holdDID)
110
-
111
-
// Verify it's gone
112
-
cachedToken, _ = GetServiceToken(did, holdDID)
113
-
if cachedToken != "" {
114
-
t.Error("Expected token to be invalidated")
115
-
}
116
-
}
117
-
118
-
func TestCleanExpiredTokens(t *testing.T) {
119
-
// Clear cache first
120
-
globalServiceTokensMu.Lock()
121
-
globalServiceTokens = make(map[string]*serviceTokenEntry)
122
-
globalServiceTokensMu.Unlock()
123
-
124
-
// Add expired and valid tokens
125
-
globalServiceTokensMu.Lock()
126
-
globalServiceTokens["expired:hold1"] = &serviceTokenEntry{
127
-
token: "expired1",
128
-
expiresAt: time.Now().Add(-1 * time.Hour),
129
-
}
130
-
globalServiceTokens["valid:hold2"] = &serviceTokenEntry{
131
-
token: "valid1",
132
-
expiresAt: time.Now().Add(1 * time.Hour),
133
-
}
134
-
globalServiceTokensMu.Unlock()
135
-
136
-
// Clean expired
137
-
CleanExpiredTokens()
138
-
139
-
// Verify only valid token remains
140
-
globalServiceTokensMu.RLock()
141
-
_, expiredExists := globalServiceTokens["expired:hold1"]
142
-
_, validExists := globalServiceTokens["valid:hold2"]
143
-
globalServiceTokensMu.RUnlock()
144
-
145
-
if expiredExists {
146
-
t.Error("Expected expired token to be removed")
147
-
}
148
-
if !validExists {
149
-
t.Error("Expected valid token to remain")
150
-
}
151
-
}
152
-
153
-
func TestGetCacheStats(t *testing.T) {
154
-
// Clear cache first
155
-
globalServiceTokensMu.Lock()
156
-
globalServiceTokens = make(map[string]*serviceTokenEntry)
157
-
globalServiceTokensMu.Unlock()
158
-
159
-
// Add some tokens
160
-
globalServiceTokensMu.Lock()
161
-
globalServiceTokens["did1:hold1"] = &serviceTokenEntry{
162
-
token: "token1",
163
-
expiresAt: time.Now().Add(1 * time.Hour),
164
-
}
165
-
globalServiceTokens["did2:hold2"] = &serviceTokenEntry{
166
-
token: "token2",
167
-
expiresAt: time.Now().Add(1 * time.Hour),
168
-
}
169
-
globalServiceTokensMu.Unlock()
170
-
171
-
stats := GetCacheStats()
172
-
if stats == nil {
173
-
t.Fatal("Expected non-nil stats")
174
-
}
175
-
176
-
// GetCacheStats returns map[string]any with "total_entries" key
177
-
totalEntries, ok := stats["total_entries"].(int)
178
-
if !ok {
179
-
t.Fatalf("Expected total_entries in stats map, got: %v", stats)
180
-
}
181
-
182
-
if totalEntries != 2 {
183
-
t.Errorf("Expected 2 entries, got %d", totalEntries)
184
-
}
185
-
186
-
// Also check valid_tokens
187
-
validTokens, ok := stats["valid_tokens"].(int)
188
-
if !ok {
189
-
t.Fatal("Expected valid_tokens in stats map")
190
-
}
191
-
192
-
if validTokens != 2 {
193
-
t.Errorf("Expected 2 valid tokens, got %d", validTokens)
194
-
}
195
-
}
···
+19
pkg/auth/token/claims.go
+19
pkg/auth/token/claims.go
···
56
57
return claims.AuthMethod
58
}
59
+
60
+
// ExtractSubject parses a JWT token string and extracts the Subject claim (the user's DID)
61
+
// Returns the subject or empty string if not found or token is invalid
62
+
// This does NOT validate the token - it only parses it to extract the claim
63
+
func ExtractSubject(tokenString string) string {
64
+
// Parse token without validation (we only need the claims, validation is done by distribution library)
65
+
parser := jwt.NewParser(jwt.WithoutClaimsValidation())
66
+
token, _, err := parser.ParseUnverified(tokenString, &Claims{})
67
+
if err != nil {
68
+
return "" // Invalid token format
69
+
}
70
+
71
+
claims, ok := token.Claims.(*Claims)
72
+
if !ok {
73
+
return "" // Wrong claims type
74
+
}
75
+
76
+
return claims.Subject
77
+
}
-362
pkg/auth/token/servicetoken.go
-362
pkg/auth/token/servicetoken.go
···
1
-
package token
2
-
3
-
import (
4
-
"context"
5
-
"encoding/json"
6
-
"errors"
7
-
"fmt"
8
-
"io"
9
-
"log/slog"
10
-
"net/http"
11
-
"net/url"
12
-
"time"
13
-
14
-
"atcr.io/pkg/atproto"
15
-
"atcr.io/pkg/auth"
16
-
"atcr.io/pkg/auth/oauth"
17
-
"github.com/bluesky-social/indigo/atproto/atclient"
18
-
indigo_oauth "github.com/bluesky-social/indigo/atproto/auth/oauth"
19
-
)
20
-
21
-
// getErrorHint provides context-specific troubleshooting hints based on API error type
22
-
func getErrorHint(apiErr *atclient.APIError) string {
23
-
switch apiErr.Name {
24
-
case "use_dpop_nonce":
25
-
return "DPoP nonce mismatch - indigo library should automatically retry with new nonce. If this persists, check for concurrent request issues or PDS session corruption."
26
-
case "invalid_client":
27
-
if apiErr.Message != "" && apiErr.Message == "Validation of \"client_assertion\" failed: \"iat\" claim timestamp check failed (it should be in the past)" {
28
-
return "JWT timestamp validation failed - system clock on AppView may be ahead of PDS clock. Check NTP sync with: timedatectl status"
29
-
}
30
-
return "OAuth client authentication failed - check client key configuration and PDS OAuth server status"
31
-
case "invalid_token", "invalid_grant":
32
-
return "OAuth tokens expired or invalidated - user will need to re-authenticate via OAuth flow"
33
-
case "server_error":
34
-
if apiErr.StatusCode == 500 {
35
-
return "PDS returned internal server error - this may occur after repeated DPoP nonce failures or other PDS-side issues. Check PDS logs for root cause."
36
-
}
37
-
return "PDS server error - check PDS health and logs"
38
-
case "invalid_dpop_proof":
39
-
return "DPoP proof validation failed - check system clock sync and DPoP key configuration"
40
-
default:
41
-
if apiErr.StatusCode == 401 || apiErr.StatusCode == 403 {
42
-
return "Authentication/authorization failed - OAuth session may be expired or revoked"
43
-
}
44
-
return "PDS rejected the request - see errorName and errorMessage for details"
45
-
}
46
-
}
47
-
48
-
// GetOrFetchServiceToken gets a service token for hold authentication.
49
-
// Checks cache first, then fetches from PDS with OAuth/DPoP if needed.
50
-
// This is the canonical implementation used by both middleware and crew registration.
51
-
//
52
-
// IMPORTANT: Uses DoWithSession() to hold a per-DID lock through the entire PDS interaction.
53
-
// This prevents DPoP nonce race conditions when multiple Docker layers upload concurrently.
54
-
func GetOrFetchServiceToken(
55
-
ctx context.Context,
56
-
refresher *oauth.Refresher,
57
-
did, holdDID, pdsEndpoint string,
58
-
) (string, error) {
59
-
if refresher == nil {
60
-
return "", fmt.Errorf("refresher is nil (OAuth session required for service tokens)")
61
-
}
62
-
63
-
// Check cache first to avoid unnecessary PDS calls on every request
64
-
cachedToken, expiresAt := GetServiceToken(did, holdDID)
65
-
66
-
// Use cached token if it exists and has > 10s remaining
67
-
if cachedToken != "" && time.Until(expiresAt) > 10*time.Second {
68
-
slog.Debug("Using cached service token",
69
-
"did", did,
70
-
"expiresIn", time.Until(expiresAt).Round(time.Second))
71
-
return cachedToken, nil
72
-
}
73
-
74
-
// Cache miss or expiring soon - validate OAuth and get new service token
75
-
if cachedToken == "" {
76
-
slog.Debug("Service token cache miss, fetching new token", "did", did)
77
-
} else {
78
-
slog.Debug("Service token expiring soon, proactively renewing", "did", did)
79
-
}
80
-
81
-
// Use DoWithSession to hold the lock through the entire PDS interaction.
82
-
// This prevents DPoP nonce races when multiple goroutines try to fetch service tokens.
83
-
var serviceToken string
84
-
var fetchErr error
85
-
86
-
err := refresher.DoWithSession(ctx, did, func(session *indigo_oauth.ClientSession) error {
87
-
// Double-check cache after acquiring lock - another goroutine may have
88
-
// populated it while we were waiting (classic double-checked locking pattern)
89
-
cachedToken, expiresAt := GetServiceToken(did, holdDID)
90
-
if cachedToken != "" && time.Until(expiresAt) > 10*time.Second {
91
-
slog.Debug("Service token cache hit after lock acquisition",
92
-
"did", did,
93
-
"expiresIn", time.Until(expiresAt).Round(time.Second))
94
-
serviceToken = cachedToken
95
-
return nil
96
-
}
97
-
98
-
// Cache still empty/expired - proceed with PDS call
99
-
// Request 5-minute expiry (PDS may grant less)
100
-
// exp must be absolute Unix timestamp, not relative duration
101
-
// Note: OAuth scope includes #atcr_hold fragment, but service auth aud must be bare DID
102
-
expiryTime := time.Now().Unix() + 300 // 5 minutes from now
103
-
serviceAuthURL := fmt.Sprintf("%s%s?aud=%s&lxm=%s&exp=%d",
104
-
pdsEndpoint,
105
-
atproto.ServerGetServiceAuth,
106
-
url.QueryEscape(holdDID),
107
-
url.QueryEscape("com.atproto.repo.getRecord"),
108
-
expiryTime,
109
-
)
110
-
111
-
req, err := http.NewRequestWithContext(ctx, "GET", serviceAuthURL, nil)
112
-
if err != nil {
113
-
fetchErr = fmt.Errorf("failed to create service auth request: %w", err)
114
-
return fetchErr
115
-
}
116
-
117
-
// Use OAuth session to authenticate to PDS (with DPoP)
118
-
// The lock is held, so DPoP nonce negotiation is serialized per-DID
119
-
resp, err := session.DoWithAuth(session.Client, req, "com.atproto.server.getServiceAuth")
120
-
if err != nil {
121
-
// Auth error - may indicate expired tokens or corrupted session
122
-
InvalidateServiceToken(did, holdDID)
123
-
124
-
// Inspect the error to extract detailed information from indigo's APIError
125
-
var apiErr *atclient.APIError
126
-
if errors.As(err, &apiErr) {
127
-
// Log detailed API error information
128
-
slog.Error("OAuth authentication failed during service token request",
129
-
"component", "token/servicetoken",
130
-
"did", did,
131
-
"holdDID", holdDID,
132
-
"pdsEndpoint", pdsEndpoint,
133
-
"url", serviceAuthURL,
134
-
"error", err,
135
-
"httpStatus", apiErr.StatusCode,
136
-
"errorName", apiErr.Name,
137
-
"errorMessage", apiErr.Message,
138
-
"hint", getErrorHint(apiErr))
139
-
} else {
140
-
// Fallback for non-API errors (network errors, etc.)
141
-
slog.Error("OAuth authentication failed during service token request",
142
-
"component", "token/servicetoken",
143
-
"did", did,
144
-
"holdDID", holdDID,
145
-
"pdsEndpoint", pdsEndpoint,
146
-
"url", serviceAuthURL,
147
-
"error", err,
148
-
"errorType", fmt.Sprintf("%T", err),
149
-
"hint", "Network error or unexpected failure during OAuth request")
150
-
}
151
-
152
-
fetchErr = fmt.Errorf("OAuth validation failed: %w", err)
153
-
return fetchErr
154
-
}
155
-
defer resp.Body.Close()
156
-
157
-
if resp.StatusCode != http.StatusOK {
158
-
// Service auth failed
159
-
bodyBytes, _ := io.ReadAll(resp.Body)
160
-
InvalidateServiceToken(did, holdDID)
161
-
slog.Error("Service token request returned non-200 status",
162
-
"component", "token/servicetoken",
163
-
"did", did,
164
-
"holdDID", holdDID,
165
-
"pdsEndpoint", pdsEndpoint,
166
-
"statusCode", resp.StatusCode,
167
-
"responseBody", string(bodyBytes),
168
-
"hint", "PDS rejected the service token request - check PDS logs for details")
169
-
fetchErr = fmt.Errorf("service auth failed with status %d: %s", resp.StatusCode, string(bodyBytes))
170
-
return fetchErr
171
-
}
172
-
173
-
// Parse response to get service token
174
-
var result struct {
175
-
Token string `json:"token"`
176
-
}
177
-
if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
178
-
fetchErr = fmt.Errorf("failed to decode service auth response: %w", err)
179
-
return fetchErr
180
-
}
181
-
182
-
if result.Token == "" {
183
-
fetchErr = fmt.Errorf("empty token in service auth response")
184
-
return fetchErr
185
-
}
186
-
187
-
serviceToken = result.Token
188
-
return nil
189
-
})
190
-
191
-
if err != nil {
192
-
// DoWithSession failed (session load or callback error)
193
-
InvalidateServiceToken(did, holdDID)
194
-
195
-
// Try to extract detailed error information
196
-
var apiErr *atclient.APIError
197
-
if errors.As(err, &apiErr) {
198
-
slog.Error("Failed to get OAuth session for service token",
199
-
"component", "token/servicetoken",
200
-
"did", did,
201
-
"holdDID", holdDID,
202
-
"pdsEndpoint", pdsEndpoint,
203
-
"error", err,
204
-
"httpStatus", apiErr.StatusCode,
205
-
"errorName", apiErr.Name,
206
-
"errorMessage", apiErr.Message,
207
-
"hint", getErrorHint(apiErr))
208
-
} else if fetchErr == nil {
209
-
// Session load failed (not a fetch error)
210
-
slog.Error("Failed to get OAuth session for service token",
211
-
"component", "token/servicetoken",
212
-
"did", did,
213
-
"holdDID", holdDID,
214
-
"pdsEndpoint", pdsEndpoint,
215
-
"error", err,
216
-
"errorType", fmt.Sprintf("%T", err),
217
-
"hint", "OAuth session not found in database or token refresh failed")
218
-
}
219
-
220
-
// Delete the stale OAuth session to force re-authentication
221
-
// This also invalidates the UI session automatically
222
-
if delErr := refresher.DeleteSession(ctx, did); delErr != nil {
223
-
slog.Warn("Failed to delete stale OAuth session",
224
-
"component", "token/servicetoken",
225
-
"did", did,
226
-
"error", delErr)
227
-
}
228
-
229
-
if fetchErr != nil {
230
-
return "", fetchErr
231
-
}
232
-
return "", fmt.Errorf("failed to get OAuth session: %w", err)
233
-
}
234
-
235
-
// Cache the token (parses JWT to extract actual expiry)
236
-
if err := SetServiceToken(did, holdDID, serviceToken); err != nil {
237
-
slog.Warn("Failed to cache service token", "error", err, "did", did, "holdDID", holdDID)
238
-
// Non-fatal - we have the token, just won't be cached
239
-
}
240
-
241
-
slog.Debug("OAuth validation succeeded, service token obtained", "did", did)
242
-
return serviceToken, nil
243
-
}
244
-
245
-
// GetOrFetchServiceTokenWithAppPassword gets a service token using app-password Bearer authentication.
246
-
// Used when auth method is app_password instead of OAuth.
247
-
func GetOrFetchServiceTokenWithAppPassword(
248
-
ctx context.Context,
249
-
did, holdDID, pdsEndpoint string,
250
-
) (string, error) {
251
-
// Check cache first to avoid unnecessary PDS calls on every request
252
-
cachedToken, expiresAt := GetServiceToken(did, holdDID)
253
-
254
-
// Use cached token if it exists and has > 10s remaining
255
-
if cachedToken != "" && time.Until(expiresAt) > 10*time.Second {
256
-
slog.Debug("Using cached service token (app-password)",
257
-
"did", did,
258
-
"expiresIn", time.Until(expiresAt).Round(time.Second))
259
-
return cachedToken, nil
260
-
}
261
-
262
-
// Cache miss or expiring soon - get app-password token and fetch new service token
263
-
if cachedToken == "" {
264
-
slog.Debug("Service token cache miss, fetching new token with app-password", "did", did)
265
-
} else {
266
-
slog.Debug("Service token expiring soon, proactively renewing with app-password", "did", did)
267
-
}
268
-
269
-
// Get app-password access token from cache
270
-
accessToken, ok := auth.GetGlobalTokenCache().Get(did)
271
-
if !ok {
272
-
InvalidateServiceToken(did, holdDID)
273
-
slog.Error("No app-password access token found in cache",
274
-
"component", "token/servicetoken",
275
-
"did", did,
276
-
"holdDID", holdDID,
277
-
"hint", "User must re-authenticate with docker login")
278
-
return "", fmt.Errorf("no app-password access token available for DID %s", did)
279
-
}
280
-
281
-
// Call com.atproto.server.getServiceAuth on the user's PDS with Bearer token
282
-
// Request 5-minute expiry (PDS may grant less)
283
-
// exp must be absolute Unix timestamp, not relative duration
284
-
expiryTime := time.Now().Unix() + 300 // 5 minutes from now
285
-
serviceAuthURL := fmt.Sprintf("%s%s?aud=%s&lxm=%s&exp=%d",
286
-
pdsEndpoint,
287
-
atproto.ServerGetServiceAuth,
288
-
url.QueryEscape(holdDID),
289
-
url.QueryEscape("com.atproto.repo.getRecord"),
290
-
expiryTime,
291
-
)
292
-
293
-
req, err := http.NewRequestWithContext(ctx, "GET", serviceAuthURL, nil)
294
-
if err != nil {
295
-
return "", fmt.Errorf("failed to create service auth request: %w", err)
296
-
}
297
-
298
-
// Set Bearer token authentication (app-password)
299
-
req.Header.Set("Authorization", "Bearer "+accessToken)
300
-
301
-
// Make request with standard HTTP client
302
-
resp, err := http.DefaultClient.Do(req)
303
-
if err != nil {
304
-
InvalidateServiceToken(did, holdDID)
305
-
slog.Error("App-password service token request failed",
306
-
"component", "token/servicetoken",
307
-
"did", did,
308
-
"holdDID", holdDID,
309
-
"pdsEndpoint", pdsEndpoint,
310
-
"error", err)
311
-
return "", fmt.Errorf("failed to request service token: %w", err)
312
-
}
313
-
defer resp.Body.Close()
314
-
315
-
if resp.StatusCode == http.StatusUnauthorized {
316
-
// App-password token is invalid or expired - clear from cache
317
-
auth.GetGlobalTokenCache().Delete(did)
318
-
InvalidateServiceToken(did, holdDID)
319
-
slog.Error("App-password token rejected by PDS",
320
-
"component", "token/servicetoken",
321
-
"did", did,
322
-
"hint", "User must re-authenticate with docker login")
323
-
return "", fmt.Errorf("app-password authentication failed: token expired or invalid")
324
-
}
325
-
326
-
if resp.StatusCode != http.StatusOK {
327
-
// Service auth failed
328
-
bodyBytes, _ := io.ReadAll(resp.Body)
329
-
InvalidateServiceToken(did, holdDID)
330
-
slog.Error("Service token request returned non-200 status (app-password)",
331
-
"component", "token/servicetoken",
332
-
"did", did,
333
-
"holdDID", holdDID,
334
-
"pdsEndpoint", pdsEndpoint,
335
-
"statusCode", resp.StatusCode,
336
-
"responseBody", string(bodyBytes))
337
-
return "", fmt.Errorf("service auth failed with status %d: %s", resp.StatusCode, string(bodyBytes))
338
-
}
339
-
340
-
// Parse response to get service token
341
-
var result struct {
342
-
Token string `json:"token"`
343
-
}
344
-
if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
345
-
return "", fmt.Errorf("failed to decode service auth response: %w", err)
346
-
}
347
-
348
-
if result.Token == "" {
349
-
return "", fmt.Errorf("empty token in service auth response")
350
-
}
351
-
352
-
serviceToken := result.Token
353
-
354
-
// Cache the token (parses JWT to extract actual expiry)
355
-
if err := SetServiceToken(did, holdDID, serviceToken); err != nil {
356
-
slog.Warn("Failed to cache service token", "error", err, "did", did, "holdDID", holdDID)
357
-
// Non-fatal - we have the token, just won't be cached
358
-
}
359
-
360
-
slog.Debug("App-password validation succeeded, service token obtained", "did", did)
361
-
return serviceToken, nil
362
-
}
···
-27
pkg/auth/token/servicetoken_test.go
-27
pkg/auth/token/servicetoken_test.go
···
1
-
package token
2
-
3
-
import (
4
-
"context"
5
-
"testing"
6
-
)
7
-
8
-
func TestGetOrFetchServiceToken_NilRefresher(t *testing.T) {
9
-
ctx := context.Background()
10
-
did := "did:plc:test123"
11
-
holdDID := "did:web:hold.example.com"
12
-
pdsEndpoint := "https://pds.example.com"
13
-
14
-
// Test with nil refresher - should return error
15
-
_, err := GetOrFetchServiceToken(ctx, nil, did, holdDID, pdsEndpoint)
16
-
if err == nil {
17
-
t.Error("Expected error when refresher is nil")
18
-
}
19
-
20
-
expectedErrMsg := "refresher is nil"
21
-
if err.Error() != "refresher is nil (OAuth session required for service tokens)" {
22
-
t.Errorf("Expected error message to contain %q, got %q", expectedErrMsg, err.Error())
23
-
}
24
-
}
25
-
26
-
// Note: Full tests with mocked OAuth refresher and HTTP client will be added
27
-
// in the comprehensive test implementation phase
···
+784
pkg/auth/usercontext.go
+784
pkg/auth/usercontext.go
···
···
1
+
// Package auth provides UserContext for managing authenticated user state
2
+
// throughout request handling in the AppView.
3
+
package auth
4
+
5
+
import (
6
+
"context"
7
+
"database/sql"
8
+
"encoding/json"
9
+
"fmt"
10
+
"io"
11
+
"log/slog"
12
+
"net/http"
13
+
"sync"
14
+
"time"
15
+
16
+
"atcr.io/pkg/appview/db"
17
+
"atcr.io/pkg/atproto"
18
+
"atcr.io/pkg/auth/oauth"
19
+
)
20
+
21
+
// Auth method constants (duplicated from token package to avoid import cycle)
22
+
const (
23
+
AuthMethodOAuth = "oauth"
24
+
AuthMethodAppPassword = "app_password"
25
+
)
26
+
27
+
// RequestAction represents the type of registry operation
28
+
type RequestAction int
29
+
30
+
const (
31
+
ActionUnknown RequestAction = iota
32
+
ActionPull // GET/HEAD - reading from registry
33
+
ActionPush // PUT/POST/DELETE - writing to registry
34
+
ActionInspect // Metadata operations only
35
+
)
36
+
37
+
func (a RequestAction) String() string {
38
+
switch a {
39
+
case ActionPull:
40
+
return "pull"
41
+
case ActionPush:
42
+
return "push"
43
+
case ActionInspect:
44
+
return "inspect"
45
+
default:
46
+
return "unknown"
47
+
}
48
+
}
49
+
50
+
// HoldPermissions describes what the user can do on a specific hold
51
+
type HoldPermissions struct {
52
+
HoldDID string // Hold being checked
53
+
IsOwner bool // User is captain of this hold
54
+
IsCrew bool // User is a crew member
55
+
IsPublic bool // Hold allows public reads
56
+
CanRead bool // Computed: can user read blobs?
57
+
CanWrite bool // Computed: can user write blobs?
58
+
CanAdmin bool // Computed: can user manage crew?
59
+
Permissions []string // Raw permissions from crew record
60
+
}
61
+
62
+
// contextKey is unexported to prevent collisions
63
+
type contextKey struct{}
64
+
65
+
// userContextKey is the context key for UserContext
66
+
var userContextKey = contextKey{}
67
+
68
+
// userSetupCache tracks which users have had their profile/crew setup ensured
69
+
var userSetupCache sync.Map // did -> time.Time
70
+
71
+
// userSetupTTL is how long to cache user setup status (1 hour)
72
+
const userSetupTTL = 1 * time.Hour
73
+
74
+
// Dependencies bundles services needed by UserContext
75
+
type Dependencies struct {
76
+
Refresher *oauth.Refresher
77
+
Authorizer HoldAuthorizer
78
+
DefaultHoldDID string // AppView's default hold DID
79
+
}
80
+
81
+
// UserContext encapsulates authenticated user state for a request.
82
+
// Built early in the middleware chain and available throughout request processing.
83
+
//
84
+
// Two-phase initialization:
85
+
// 1. Middleware phase: Identity is set (DID, authMethod, action)
86
+
// 2. Repository() phase: Target is set via SetTarget() (owner, repo, holdDID)
87
+
type UserContext struct {
88
+
// === User Identity (set in middleware) ===
89
+
DID string // User's DID (empty if unauthenticated)
90
+
Handle string // User's handle (may be empty)
91
+
PDSEndpoint string // User's PDS endpoint
92
+
AuthMethod string // "oauth", "app_password", or ""
93
+
IsAuthenticated bool
94
+
95
+
// === Request Info ===
96
+
Action RequestAction
97
+
HTTPMethod string
98
+
99
+
// === Target Info (set by SetTarget) ===
100
+
TargetOwnerDID string // whose repo is being accessed
101
+
TargetOwnerHandle string
102
+
TargetOwnerPDS string
103
+
TargetRepo string // image name (e.g., "quickslice")
104
+
TargetHoldDID string // hold where blobs live/will live
105
+
106
+
// === Dependencies (injected) ===
107
+
refresher *oauth.Refresher
108
+
authorizer HoldAuthorizer
109
+
defaultHoldDID string
110
+
111
+
// === Cached State (lazy-loaded) ===
112
+
serviceTokens sync.Map // holdDID -> *serviceTokenEntry
113
+
permissions sync.Map // holdDID -> *HoldPermissions
114
+
pdsResolved bool
115
+
pdsResolveErr error
116
+
mu sync.Mutex // protects PDS resolution
117
+
atprotoClient *atproto.Client
118
+
atprotoClientOnce sync.Once
119
+
}
120
+
121
+
// FromContext retrieves UserContext from context.
122
+
// Returns nil if not present (unauthenticated or before middleware).
123
+
func FromContext(ctx context.Context) *UserContext {
124
+
uc, _ := ctx.Value(userContextKey).(*UserContext)
125
+
return uc
126
+
}
127
+
128
+
// WithUserContext adds UserContext to context
129
+
func WithUserContext(ctx context.Context, uc *UserContext) context.Context {
130
+
return context.WithValue(ctx, userContextKey, uc)
131
+
}
132
+
133
+
// NewUserContext creates a UserContext from extracted JWT claims.
134
+
// The deps parameter provides access to services needed for lazy operations.
135
+
func NewUserContext(did, authMethod, httpMethod string, deps *Dependencies) *UserContext {
136
+
action := ActionUnknown
137
+
switch httpMethod {
138
+
case "GET", "HEAD":
139
+
action = ActionPull
140
+
case "PUT", "POST", "PATCH", "DELETE":
141
+
action = ActionPush
142
+
}
143
+
144
+
var refresher *oauth.Refresher
145
+
var authorizer HoldAuthorizer
146
+
var defaultHoldDID string
147
+
148
+
if deps != nil {
149
+
refresher = deps.Refresher
150
+
authorizer = deps.Authorizer
151
+
defaultHoldDID = deps.DefaultHoldDID
152
+
}
153
+
154
+
return &UserContext{
155
+
DID: did,
156
+
AuthMethod: authMethod,
157
+
IsAuthenticated: did != "",
158
+
Action: action,
159
+
HTTPMethod: httpMethod,
160
+
refresher: refresher,
161
+
authorizer: authorizer,
162
+
defaultHoldDID: defaultHoldDID,
163
+
}
164
+
}
165
+
166
+
// SetPDS sets the user's PDS endpoint directly, bypassing network resolution.
167
+
// Use when PDS is already known (e.g., from previous resolution or client).
168
+
func (uc *UserContext) SetPDS(handle, pdsEndpoint string) {
169
+
uc.mu.Lock()
170
+
defer uc.mu.Unlock()
171
+
uc.Handle = handle
172
+
uc.PDSEndpoint = pdsEndpoint
173
+
uc.pdsResolved = true
174
+
uc.pdsResolveErr = nil
175
+
}
176
+
177
+
// SetTarget sets the target repository information.
178
+
// Called in Repository() after resolving the owner identity.
179
+
func (uc *UserContext) SetTarget(ownerDID, ownerHandle, ownerPDS, repo, holdDID string) {
180
+
uc.TargetOwnerDID = ownerDID
181
+
uc.TargetOwnerHandle = ownerHandle
182
+
uc.TargetOwnerPDS = ownerPDS
183
+
uc.TargetRepo = repo
184
+
uc.TargetHoldDID = holdDID
185
+
}
186
+
187
+
// ResolvePDS resolves the user's PDS endpoint (lazy, cached).
188
+
// Safe to call multiple times; resolution happens once.
189
+
func (uc *UserContext) ResolvePDS(ctx context.Context) error {
190
+
if !uc.IsAuthenticated {
191
+
return nil // Nothing to resolve for anonymous users
192
+
}
193
+
194
+
uc.mu.Lock()
195
+
defer uc.mu.Unlock()
196
+
197
+
if uc.pdsResolved {
198
+
return uc.pdsResolveErr
199
+
}
200
+
201
+
_, handle, pds, err := atproto.ResolveIdentity(ctx, uc.DID)
202
+
if err != nil {
203
+
uc.pdsResolveErr = err
204
+
uc.pdsResolved = true
205
+
return err
206
+
}
207
+
208
+
uc.Handle = handle
209
+
uc.PDSEndpoint = pds
210
+
uc.pdsResolved = true
211
+
return nil
212
+
}
213
+
214
+
// GetServiceToken returns a service token for the target hold.
215
+
// Uses internal caching with sync.Once per holdDID.
216
+
// Requires target to be set via SetTarget().
217
+
func (uc *UserContext) GetServiceToken(ctx context.Context) (string, error) {
218
+
if uc.TargetHoldDID == "" {
219
+
return "", fmt.Errorf("target hold not set (call SetTarget first)")
220
+
}
221
+
return uc.GetServiceTokenForHold(ctx, uc.TargetHoldDID)
222
+
}
223
+
224
+
// GetServiceTokenForHold returns a service token for an arbitrary hold.
225
+
// Uses internal caching with sync.Once per holdDID.
226
+
func (uc *UserContext) GetServiceTokenForHold(ctx context.Context, holdDID string) (string, error) {
227
+
if !uc.IsAuthenticated {
228
+
return "", fmt.Errorf("cannot get service token: user not authenticated")
229
+
}
230
+
231
+
// Ensure PDS is resolved
232
+
if err := uc.ResolvePDS(ctx); err != nil {
233
+
return "", fmt.Errorf("failed to resolve PDS: %w", err)
234
+
}
235
+
236
+
// Load or create cache entry
237
+
entryVal, _ := uc.serviceTokens.LoadOrStore(holdDID, &serviceTokenEntry{})
238
+
entry := entryVal.(*serviceTokenEntry)
239
+
240
+
entry.once.Do(func() {
241
+
slog.Debug("Fetching service token",
242
+
"component", "auth/context",
243
+
"userDID", uc.DID,
244
+
"holdDID", holdDID,
245
+
"authMethod", uc.AuthMethod)
246
+
247
+
// Use unified service token function (handles both OAuth and app-password)
248
+
serviceToken, err := GetOrFetchServiceToken(
249
+
ctx, uc.AuthMethod, uc.refresher, uc.DID, holdDID, uc.PDSEndpoint,
250
+
)
251
+
252
+
entry.token = serviceToken
253
+
entry.err = err
254
+
if err == nil {
255
+
// Parse JWT to get expiry
256
+
expiry, parseErr := ParseJWTExpiry(serviceToken)
257
+
if parseErr == nil {
258
+
entry.expiresAt = expiry.Add(-10 * time.Second) // Safety margin
259
+
} else {
260
+
entry.expiresAt = time.Now().Add(45 * time.Second) // Default fallback
261
+
}
262
+
}
263
+
})
264
+
265
+
return entry.token, entry.err
266
+
}
267
+
268
+
// CanRead checks if user can read blobs from target hold.
269
+
// - Public hold: any user (even anonymous)
270
+
// - Private hold: owner OR crew with blob:read/blob:write
271
+
func (uc *UserContext) CanRead(ctx context.Context) (bool, error) {
272
+
if uc.TargetHoldDID == "" {
273
+
return false, fmt.Errorf("target hold not set (call SetTarget first)")
274
+
}
275
+
276
+
if uc.authorizer == nil {
277
+
return false, fmt.Errorf("authorizer not configured")
278
+
}
279
+
280
+
return uc.authorizer.CheckReadAccess(ctx, uc.TargetHoldDID, uc.DID)
281
+
}
282
+
283
+
// CanWrite checks if user can write blobs to target hold.
284
+
// - Must be authenticated
285
+
// - Must be owner OR crew with blob:write
286
+
func (uc *UserContext) CanWrite(ctx context.Context) (bool, error) {
287
+
if uc.TargetHoldDID == "" {
288
+
return false, fmt.Errorf("target hold not set (call SetTarget first)")
289
+
}
290
+
291
+
if !uc.IsAuthenticated {
292
+
return false, nil // Anonymous writes never allowed
293
+
}
294
+
295
+
if uc.authorizer == nil {
296
+
return false, fmt.Errorf("authorizer not configured")
297
+
}
298
+
299
+
return uc.authorizer.CheckWriteAccess(ctx, uc.TargetHoldDID, uc.DID)
300
+
}
301
+
302
+
// GetPermissions returns detailed permissions for target hold.
303
+
// Lazy-loaded and cached per holdDID.
304
+
func (uc *UserContext) GetPermissions(ctx context.Context) (*HoldPermissions, error) {
305
+
if uc.TargetHoldDID == "" {
306
+
return nil, fmt.Errorf("target hold not set (call SetTarget first)")
307
+
}
308
+
return uc.GetPermissionsForHold(ctx, uc.TargetHoldDID)
309
+
}
310
+
311
+
// GetPermissionsForHold returns detailed permissions for an arbitrary hold.
312
+
// Lazy-loaded and cached per holdDID.
313
+
func (uc *UserContext) GetPermissionsForHold(ctx context.Context, holdDID string) (*HoldPermissions, error) {
314
+
// Check cache first
315
+
if cached, ok := uc.permissions.Load(holdDID); ok {
316
+
return cached.(*HoldPermissions), nil
317
+
}
318
+
319
+
if uc.authorizer == nil {
320
+
return nil, fmt.Errorf("authorizer not configured")
321
+
}
322
+
323
+
// Build permissions by querying authorizer
324
+
captain, err := uc.authorizer.GetCaptainRecord(ctx, holdDID)
325
+
if err != nil {
326
+
return nil, fmt.Errorf("failed to get captain record: %w", err)
327
+
}
328
+
329
+
perms := &HoldPermissions{
330
+
HoldDID: holdDID,
331
+
IsPublic: captain.Public,
332
+
IsOwner: uc.DID != "" && uc.DID == captain.Owner,
333
+
}
334
+
335
+
// Check crew membership if authenticated and not owner
336
+
if uc.IsAuthenticated && !perms.IsOwner {
337
+
isCrew, crewErr := uc.authorizer.IsCrewMember(ctx, holdDID, uc.DID)
338
+
if crewErr != nil {
339
+
slog.Warn("Failed to check crew membership",
340
+
"component", "auth/context",
341
+
"holdDID", holdDID,
342
+
"userDID", uc.DID,
343
+
"error", crewErr)
344
+
}
345
+
perms.IsCrew = isCrew
346
+
}
347
+
348
+
// Compute permissions based on role
349
+
if perms.IsOwner {
350
+
perms.CanRead = true
351
+
perms.CanWrite = true
352
+
perms.CanAdmin = true
353
+
} else if perms.IsCrew {
354
+
// Crew members can read and write (for now, all crew have blob:write)
355
+
// TODO: Check specific permissions from crew record
356
+
perms.CanRead = true
357
+
perms.CanWrite = true
358
+
perms.CanAdmin = false
359
+
} else if perms.IsPublic {
360
+
// Public hold - anyone can read
361
+
perms.CanRead = true
362
+
perms.CanWrite = false
363
+
perms.CanAdmin = false
364
+
} else if uc.IsAuthenticated {
365
+
// Private hold, authenticated non-crew
366
+
// Per permission matrix: cannot read private holds
367
+
perms.CanRead = false
368
+
perms.CanWrite = false
369
+
perms.CanAdmin = false
370
+
} else {
371
+
// Anonymous on private hold
372
+
perms.CanRead = false
373
+
perms.CanWrite = false
374
+
perms.CanAdmin = false
375
+
}
376
+
377
+
// Cache and return
378
+
uc.permissions.Store(holdDID, perms)
379
+
return perms, nil
380
+
}
381
+
382
+
// IsCrewMember checks if user is crew of target hold.
383
+
func (uc *UserContext) IsCrewMember(ctx context.Context) (bool, error) {
384
+
if uc.TargetHoldDID == "" {
385
+
return false, fmt.Errorf("target hold not set (call SetTarget first)")
386
+
}
387
+
388
+
if !uc.IsAuthenticated {
389
+
return false, nil
390
+
}
391
+
392
+
if uc.authorizer == nil {
393
+
return false, fmt.Errorf("authorizer not configured")
394
+
}
395
+
396
+
return uc.authorizer.IsCrewMember(ctx, uc.TargetHoldDID, uc.DID)
397
+
}
398
+
399
+
// EnsureCrewMembership is a standalone function to register as crew on a hold.
400
+
// Use this when you don't have a UserContext (e.g., OAuth callback).
401
+
// This is best-effort and logs errors without failing.
402
+
func EnsureCrewMembership(ctx context.Context, did, pdsEndpoint string, refresher *oauth.Refresher, holdDID string) {
403
+
if holdDID == "" {
404
+
return
405
+
}
406
+
407
+
// Only works with OAuth (refresher required) - app passwords can't get service tokens
408
+
if refresher == nil {
409
+
slog.Debug("skipping crew registration - no OAuth refresher (app password flow)", "holdDID", holdDID)
410
+
return
411
+
}
412
+
413
+
// Normalize URL to DID if needed
414
+
if !atproto.IsDID(holdDID) {
415
+
holdDID = atproto.ResolveHoldDIDFromURL(holdDID)
416
+
if holdDID == "" {
417
+
slog.Warn("failed to resolve hold DID", "defaultHold", holdDID)
418
+
return
419
+
}
420
+
}
421
+
422
+
// Get service token for the hold (OAuth only at this point)
423
+
serviceToken, err := GetOrFetchServiceToken(ctx, AuthMethodOAuth, refresher, did, holdDID, pdsEndpoint)
424
+
if err != nil {
425
+
slog.Warn("failed to get service token", "holdDID", holdDID, "error", err)
426
+
return
427
+
}
428
+
429
+
// Resolve hold DID to HTTP endpoint
430
+
holdEndpoint := atproto.ResolveHoldURL(holdDID)
431
+
if holdEndpoint == "" {
432
+
slog.Warn("failed to resolve hold endpoint", "holdDID", holdDID)
433
+
return
434
+
}
435
+
436
+
// Call requestCrew endpoint
437
+
if err := requestCrewMembership(ctx, holdEndpoint, serviceToken); err != nil {
438
+
slog.Warn("failed to request crew membership", "holdDID", holdDID, "error", err)
439
+
return
440
+
}
441
+
442
+
slog.Info("successfully registered as crew member", "holdDID", holdDID, "userDID", did)
443
+
}
444
+
445
+
// ensureCrewMembership attempts to register as crew on target hold (UserContext method).
446
+
// Called automatically during first push; idempotent.
447
+
// This is a best-effort operation and logs errors without failing.
448
+
// Requires SetTarget() to be called first.
449
+
func (uc *UserContext) ensureCrewMembership(ctx context.Context) error {
450
+
if uc.TargetHoldDID == "" {
451
+
return fmt.Errorf("target hold not set (call SetTarget first)")
452
+
}
453
+
return uc.EnsureCrewMembershipForHold(ctx, uc.TargetHoldDID)
454
+
}
455
+
456
+
// EnsureCrewMembershipForHold attempts to register as crew on the specified hold.
457
+
// This is the core implementation that can be called with any holdDID.
458
+
// Called automatically during first push; idempotent.
459
+
// This is a best-effort operation and logs errors without failing.
460
+
func (uc *UserContext) EnsureCrewMembershipForHold(ctx context.Context, holdDID string) error {
461
+
if holdDID == "" {
462
+
return nil // Nothing to do
463
+
}
464
+
465
+
// Normalize URL to DID if needed
466
+
if !atproto.IsDID(holdDID) {
467
+
holdDID = atproto.ResolveHoldDIDFromURL(holdDID)
468
+
if holdDID == "" {
469
+
return fmt.Errorf("failed to resolve hold DID from URL")
470
+
}
471
+
}
472
+
473
+
if !uc.IsAuthenticated {
474
+
return fmt.Errorf("cannot register as crew: user not authenticated")
475
+
}
476
+
477
+
if uc.refresher == nil {
478
+
return fmt.Errorf("cannot register as crew: OAuth session required")
479
+
}
480
+
481
+
// Get service token for the hold
482
+
serviceToken, err := uc.GetServiceTokenForHold(ctx, holdDID)
483
+
if err != nil {
484
+
return fmt.Errorf("failed to get service token: %w", err)
485
+
}
486
+
487
+
// Resolve hold DID to HTTP endpoint
488
+
holdEndpoint := atproto.ResolveHoldURL(holdDID)
489
+
if holdEndpoint == "" {
490
+
return fmt.Errorf("failed to resolve hold endpoint for %s", holdDID)
491
+
}
492
+
493
+
// Call requestCrew endpoint
494
+
return requestCrewMembership(ctx, holdEndpoint, serviceToken)
495
+
}
496
+
497
+
// requestCrewMembership calls the hold's requestCrew endpoint
498
+
// The endpoint handles all authorization and duplicate checking internally
499
+
func requestCrewMembership(ctx context.Context, holdEndpoint, serviceToken string) error {
500
+
// Add 5 second timeout to prevent hanging on offline holds
501
+
ctx, cancel := context.WithTimeout(ctx, 5*time.Second)
502
+
defer cancel()
503
+
504
+
url := fmt.Sprintf("%s%s", holdEndpoint, atproto.HoldRequestCrew)
505
+
506
+
req, err := http.NewRequestWithContext(ctx, "POST", url, nil)
507
+
if err != nil {
508
+
return err
509
+
}
510
+
511
+
req.Header.Set("Authorization", "Bearer "+serviceToken)
512
+
req.Header.Set("Content-Type", "application/json")
513
+
514
+
resp, err := http.DefaultClient.Do(req)
515
+
if err != nil {
516
+
return err
517
+
}
518
+
defer resp.Body.Close()
519
+
520
+
if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusCreated {
521
+
// Read response body to capture actual error message from hold
522
+
body, readErr := io.ReadAll(resp.Body)
523
+
if readErr != nil {
524
+
return fmt.Errorf("requestCrew failed with status %d (failed to read error body: %w)", resp.StatusCode, readErr)
525
+
}
526
+
return fmt.Errorf("requestCrew failed with status %d: %s", resp.StatusCode, string(body))
527
+
}
528
+
529
+
return nil
530
+
}
531
+
532
+
// GetUserClient returns an authenticated ATProto client for the user's own PDS.
533
+
// Used for profile operations (reading/writing to user's own repo).
534
+
// Returns nil if not authenticated or PDS not resolved.
535
+
func (uc *UserContext) GetUserClient() *atproto.Client {
536
+
if !uc.IsAuthenticated || uc.PDSEndpoint == "" {
537
+
return nil
538
+
}
539
+
540
+
if uc.AuthMethod == AuthMethodOAuth && uc.refresher != nil {
541
+
return atproto.NewClientWithSessionProvider(uc.PDSEndpoint, uc.DID, uc.refresher)
542
+
} else if uc.AuthMethod == AuthMethodAppPassword {
543
+
accessToken, _ := GetGlobalTokenCache().Get(uc.DID)
544
+
return atproto.NewClient(uc.PDSEndpoint, uc.DID, accessToken)
545
+
}
546
+
547
+
return nil
548
+
}
549
+
550
+
// EnsureUserSetup ensures the user has a profile and crew membership.
551
+
// Called once per user (cached for userSetupTTL). Runs in background - does not block.
552
+
// Safe to call on every request.
553
+
func (uc *UserContext) EnsureUserSetup() {
554
+
if !uc.IsAuthenticated || uc.DID == "" {
555
+
return
556
+
}
557
+
558
+
// Check cache - skip if recently set up
559
+
if lastSetup, ok := userSetupCache.Load(uc.DID); ok {
560
+
if time.Since(lastSetup.(time.Time)) < userSetupTTL {
561
+
return
562
+
}
563
+
}
564
+
565
+
// Run in background to avoid blocking requests
566
+
go func() {
567
+
bgCtx := context.Background()
568
+
569
+
// 1. Ensure profile exists
570
+
if client := uc.GetUserClient(); client != nil {
571
+
uc.ensureProfile(bgCtx, client)
572
+
}
573
+
574
+
// 2. Ensure crew membership on default hold
575
+
if uc.defaultHoldDID != "" {
576
+
EnsureCrewMembership(bgCtx, uc.DID, uc.PDSEndpoint, uc.refresher, uc.defaultHoldDID)
577
+
}
578
+
579
+
// Mark as set up
580
+
userSetupCache.Store(uc.DID, time.Now())
581
+
slog.Debug("User setup complete",
582
+
"component", "auth/usercontext",
583
+
"did", uc.DID,
584
+
"defaultHoldDID", uc.defaultHoldDID)
585
+
}()
586
+
}
587
+
588
+
// ensureProfile creates sailor profile if it doesn't exist.
589
+
// Inline implementation to avoid circular import with storage package.
590
+
func (uc *UserContext) ensureProfile(ctx context.Context, client *atproto.Client) {
591
+
// Check if profile already exists
592
+
profile, err := client.GetRecord(ctx, atproto.SailorProfileCollection, "self")
593
+
if err == nil && profile != nil {
594
+
return // Already exists
595
+
}
596
+
597
+
// Create profile with default hold
598
+
normalizedDID := ""
599
+
if uc.defaultHoldDID != "" {
600
+
normalizedDID = atproto.ResolveHoldDIDFromURL(uc.defaultHoldDID)
601
+
}
602
+
603
+
newProfile := atproto.NewSailorProfileRecord(normalizedDID)
604
+
if _, err := client.PutRecord(ctx, atproto.SailorProfileCollection, "self", newProfile); err != nil {
605
+
slog.Warn("Failed to create sailor profile",
606
+
"component", "auth/usercontext",
607
+
"did", uc.DID,
608
+
"error", err)
609
+
return
610
+
}
611
+
612
+
slog.Debug("Created sailor profile",
613
+
"component", "auth/usercontext",
614
+
"did", uc.DID,
615
+
"defaultHold", normalizedDID)
616
+
}
617
+
618
+
// GetATProtoClient returns a cached ATProto client for the target owner's PDS.
619
+
// Authenticated if user is owner, otherwise anonymous.
620
+
// Cached per-request (uses sync.Once).
621
+
func (uc *UserContext) GetATProtoClient() *atproto.Client {
622
+
uc.atprotoClientOnce.Do(func() {
623
+
if uc.TargetOwnerPDS == "" {
624
+
return
625
+
}
626
+
627
+
// If puller is owner and authenticated, use authenticated client
628
+
if uc.DID == uc.TargetOwnerDID && uc.IsAuthenticated {
629
+
if uc.AuthMethod == AuthMethodOAuth && uc.refresher != nil {
630
+
uc.atprotoClient = atproto.NewClientWithSessionProvider(uc.TargetOwnerPDS, uc.TargetOwnerDID, uc.refresher)
631
+
return
632
+
} else if uc.AuthMethod == AuthMethodAppPassword {
633
+
accessToken, _ := GetGlobalTokenCache().Get(uc.TargetOwnerDID)
634
+
uc.atprotoClient = atproto.NewClient(uc.TargetOwnerPDS, uc.TargetOwnerDID, accessToken)
635
+
return
636
+
}
637
+
}
638
+
639
+
// Anonymous client for reads
640
+
uc.atprotoClient = atproto.NewClient(uc.TargetOwnerPDS, uc.TargetOwnerDID, "")
641
+
})
642
+
return uc.atprotoClient
643
+
}
644
+
645
+
// ResolveHoldDID finds the hold for the target repository.
646
+
// - Pull: uses database lookup (historical from manifest)
647
+
// - Push: uses discovery (sailor profile → default)
648
+
//
649
+
// Must be called after SetTarget() is called with at least TargetOwnerDID and TargetRepo set.
650
+
// Updates TargetHoldDID on success.
651
+
func (uc *UserContext) ResolveHoldDID(ctx context.Context, sqlDB *sql.DB) (string, error) {
652
+
if uc.TargetOwnerDID == "" {
653
+
return "", fmt.Errorf("target owner not set")
654
+
}
655
+
656
+
var holdDID string
657
+
var err error
658
+
659
+
switch uc.Action {
660
+
case ActionPull:
661
+
// For pulls, look up historical hold from database
662
+
holdDID, err = uc.resolveHoldForPull(ctx, sqlDB)
663
+
case ActionPush:
664
+
// For pushes, discover hold from owner's profile
665
+
holdDID, err = uc.resolveHoldForPush(ctx)
666
+
default:
667
+
// Default to push discovery
668
+
holdDID, err = uc.resolveHoldForPush(ctx)
669
+
}
670
+
671
+
if err != nil {
672
+
return "", err
673
+
}
674
+
675
+
if holdDID == "" {
676
+
return "", fmt.Errorf("no hold DID found for %s/%s", uc.TargetOwnerDID, uc.TargetRepo)
677
+
}
678
+
679
+
uc.TargetHoldDID = holdDID
680
+
return holdDID, nil
681
+
}
682
+
683
+
// resolveHoldForPull looks up the hold from the database (historical reference)
684
+
func (uc *UserContext) resolveHoldForPull(ctx context.Context, sqlDB *sql.DB) (string, error) {
685
+
// If no database is available, fall back to discovery
686
+
if sqlDB == nil {
687
+
return uc.resolveHoldForPush(ctx)
688
+
}
689
+
690
+
// Try database lookup first
691
+
holdDID, err := db.GetLatestHoldDIDForRepo(sqlDB, uc.TargetOwnerDID, uc.TargetRepo)
692
+
if err != nil {
693
+
slog.Debug("Database lookup failed, falling back to discovery",
694
+
"component", "auth/context",
695
+
"ownerDID", uc.TargetOwnerDID,
696
+
"repo", uc.TargetRepo,
697
+
"error", err)
698
+
return uc.resolveHoldForPush(ctx)
699
+
}
700
+
701
+
if holdDID != "" {
702
+
return holdDID, nil
703
+
}
704
+
705
+
// No historical hold found, fall back to discovery
706
+
return uc.resolveHoldForPush(ctx)
707
+
}
708
+
709
+
// resolveHoldForPush discovers hold from owner's sailor profile or default
710
+
func (uc *UserContext) resolveHoldForPush(ctx context.Context) (string, error) {
711
+
// Create anonymous client to query owner's profile
712
+
client := atproto.NewClient(uc.TargetOwnerPDS, uc.TargetOwnerDID, "")
713
+
714
+
// Try to get owner's sailor profile
715
+
record, err := client.GetRecord(ctx, atproto.SailorProfileCollection, "self")
716
+
if err == nil && record != nil {
717
+
var profile atproto.SailorProfileRecord
718
+
if jsonErr := json.Unmarshal(record.Value, &profile); jsonErr == nil {
719
+
if profile.DefaultHold != "" {
720
+
// Normalize to DID if needed
721
+
holdDID := profile.DefaultHold
722
+
if !atproto.IsDID(holdDID) {
723
+
holdDID = atproto.ResolveHoldDIDFromURL(holdDID)
724
+
}
725
+
slog.Debug("Found hold from owner's profile",
726
+
"component", "auth/context",
727
+
"ownerDID", uc.TargetOwnerDID,
728
+
"holdDID", holdDID)
729
+
return holdDID, nil
730
+
}
731
+
}
732
+
}
733
+
734
+
// Fall back to default hold
735
+
if uc.defaultHoldDID != "" {
736
+
slog.Debug("Using default hold",
737
+
"component", "auth/context",
738
+
"ownerDID", uc.TargetOwnerDID,
739
+
"defaultHoldDID", uc.defaultHoldDID)
740
+
return uc.defaultHoldDID, nil
741
+
}
742
+
743
+
return "", fmt.Errorf("no hold configured for %s and no default hold set", uc.TargetOwnerDID)
744
+
}
745
+
746
+
// =============================================================================
747
+
// Test Helper Methods
748
+
// =============================================================================
749
+
// These methods are designed to make UserContext testable by allowing tests
750
+
// to bypass network-dependent code paths (PDS resolution, OAuth token fetching).
751
+
// Only use these in tests - they are not intended for production use.
752
+
753
+
// SetPDSForTest sets the PDS endpoint directly, bypassing ResolvePDS network calls.
754
+
// This allows tests to skip DID resolution which would make network requests.
755
+
// Deprecated: Use SetPDS instead.
756
+
func (uc *UserContext) SetPDSForTest(handle, pdsEndpoint string) {
757
+
uc.SetPDS(handle, pdsEndpoint)
758
+
}
759
+
760
+
// SetServiceTokenForTest pre-populates a service token for the given holdDID,
761
+
// bypassing the sync.Once and OAuth/app-password fetching logic.
762
+
// The token will appear as if it was already fetched and cached.
763
+
func (uc *UserContext) SetServiceTokenForTest(holdDID, token string) {
764
+
entry := &serviceTokenEntry{
765
+
token: token,
766
+
expiresAt: time.Now().Add(5 * time.Minute),
767
+
err: nil,
768
+
}
769
+
// Mark the sync.Once as done so real fetch won't happen
770
+
entry.once.Do(func() {})
771
+
uc.serviceTokens.Store(holdDID, entry)
772
+
}
773
+
774
+
// SetAuthorizerForTest sets the authorizer for permission checks.
775
+
// Use with MockHoldAuthorizer to control CanRead/CanWrite behavior in tests.
776
+
func (uc *UserContext) SetAuthorizerForTest(authorizer HoldAuthorizer) {
777
+
uc.authorizer = authorizer
778
+
}
779
+
780
+
// SetDefaultHoldDIDForTest sets the default hold DID for tests.
781
+
// This is used as fallback when resolving hold for push operations.
782
+
func (uc *UserContext) SetDefaultHoldDIDForTest(holdDID string) {
783
+
uc.defaultHoldDID = holdDID
784
+
}
+70
-27
pkg/hold/pds/auth.go
+70
-27
pkg/hold/pds/auth.go
···
4
"context"
5
"encoding/base64"
6
"encoding/json"
7
"fmt"
8
"io"
9
"log/slog"
···
18
"github.com/golang-jwt/jwt/v5"
19
)
20
21
// HTTPClient interface allows injecting a custom HTTP client for testing
22
type HTTPClient interface {
23
Do(*http.Request) (*http.Response, error)
···
44
// Extract Authorization header
45
authHeader := r.Header.Get("Authorization")
46
if authHeader == "" {
47
-
return nil, fmt.Errorf("missing Authorization header")
48
}
49
50
// Check for DPoP authorization scheme
51
parts := strings.SplitN(authHeader, " ", 2)
52
if len(parts) != 2 {
53
-
return nil, fmt.Errorf("invalid Authorization header format")
54
}
55
56
if parts[0] != "DPoP" {
···
59
60
accessToken := parts[1]
61
if accessToken == "" {
62
-
return nil, fmt.Errorf("missing access token")
63
}
64
65
// Extract DPoP header
66
dpopProof := r.Header.Get("DPoP")
67
if dpopProof == "" {
68
-
return nil, fmt.Errorf("missing DPoP header")
69
}
70
71
// TODO: We could verify the DPoP proof locally (signature, HTM, HTU, etc.)
···
109
// JWT format: header.payload.signature
110
parts := strings.Split(token, ".")
111
if len(parts) != 3 {
112
-
return "", "", fmt.Errorf("invalid JWT format")
113
}
114
115
// Decode payload (base64url)
···
129
}
130
131
if claims.Sub == "" {
132
-
return "", "", fmt.Errorf("missing sub claim (DID)")
133
}
134
135
if claims.Iss == "" {
136
-
return "", "", fmt.Errorf("missing iss claim (PDS)")
137
}
138
139
return claims.Sub, claims.Iss, nil
···
216
return nil, fmt.Errorf("DPoP authentication failed: %w", err)
217
}
218
} else {
219
-
return nil, fmt.Errorf("missing or invalid Authorization header (expected Bearer or DPoP)")
220
}
221
222
// Get captain record to check owner
···
243
return user, nil
244
}
245
// User is crew but doesn't have admin permission
246
-
return nil, fmt.Errorf("crew member lacks required 'crew:admin' permission")
247
}
248
}
249
250
// User is neither owner nor authorized crew
251
-
return nil, fmt.Errorf("user is not authorized (must be hold owner or crew admin)")
252
}
253
254
// ValidateBlobWriteAccess validates that the request has valid authentication
···
276
return nil, fmt.Errorf("DPoP authentication failed: %w", err)
277
}
278
} else {
279
-
return nil, fmt.Errorf("missing or invalid Authorization header (expected Bearer or DPoP)")
280
}
281
282
// Get captain record to check owner and public settings
···
303
return user, nil
304
}
305
// User is crew but doesn't have write permission
306
-
return nil, fmt.Errorf("crew member lacks required 'blob:write' permission")
307
}
308
}
309
310
// User is neither owner nor authorized crew
311
-
return nil, fmt.Errorf("user is not authorized for blob write (must be hold owner or crew with blob:write permission)")
312
}
313
314
// ValidateBlobReadAccess validates that the request has read access to blobs
315
// If captain.public = true: No auth required (returns nil user to indicate public access)
316
-
// If captain.public = false: Requires valid DPoP + OAuth and (captain OR crew with blob:read permission).
317
// The httpClient parameter is optional and defaults to http.DefaultClient if nil.
318
func ValidateBlobReadAccess(r *http.Request, pds *HoldPDS, httpClient HTTPClient) (*ValidatedUser, error) {
319
// Get captain record to check public setting
···
344
return nil, fmt.Errorf("DPoP authentication failed: %w", err)
345
}
346
} else {
347
-
return nil, fmt.Errorf("missing or invalid Authorization header (expected Bearer or DPoP)")
348
}
349
350
// Check if user is the owner (always has read access)
···
352
return user, nil
353
}
354
355
-
// Check if user is crew with blob:read permission
356
crew, err := pds.ListCrewMembers(r.Context())
357
if err != nil {
358
return nil, fmt.Errorf("failed to check crew membership: %w", err)
···
360
361
for _, member := range crew {
362
if member.Record.Member == user.DID {
363
-
// Check if this crew member has blob:read permission
364
-
if slices.Contains(member.Record.Permissions, "blob:read") {
365
return user, nil
366
}
367
-
// User is crew but doesn't have read permission
368
-
return nil, fmt.Errorf("crew member lacks required 'blob:read' permission")
369
}
370
}
371
372
// User is neither owner nor authorized crew
373
-
return nil, fmt.Errorf("user is not authorized for blob read (must be hold owner or crew with blob:read permission)")
374
}
375
376
// ServiceTokenClaims represents the claims in a service token JWT
···
385
// Extract Authorization header
386
authHeader := r.Header.Get("Authorization")
387
if authHeader == "" {
388
-
return nil, fmt.Errorf("missing Authorization header")
389
}
390
391
// Check for Bearer authorization scheme
392
parts := strings.SplitN(authHeader, " ", 2)
393
if len(parts) != 2 {
394
-
return nil, fmt.Errorf("invalid Authorization header format")
395
}
396
397
if parts[0] != "Bearer" {
···
400
401
tokenString := parts[1]
402
if tokenString == "" {
403
-
return nil, fmt.Errorf("missing token")
404
}
405
406
slog.Debug("Validating service token", "holdDID", holdDID)
···
409
// Split token: header.payload.signature
410
tokenParts := strings.Split(tokenString, ".")
411
if len(tokenParts) != 3 {
412
-
return nil, fmt.Errorf("invalid JWT format")
413
}
414
415
// Decode payload (second part) to extract claims
···
427
// Get issuer (user DID)
428
issuerDID := claims.Issuer
429
if issuerDID == "" {
430
-
return nil, fmt.Errorf("missing iss claim")
431
}
432
433
// Verify audience matches this hold service
···
445
return nil, fmt.Errorf("failed to get expiration: %w", err)
446
}
447
if exp != nil && time.Now().After(exp.Time) {
448
-
return nil, fmt.Errorf("token has expired")
449
}
450
451
// Verify JWT signature using ATProto's secp256k1 crypto
···
4
"context"
5
"encoding/base64"
6
"encoding/json"
7
+
"errors"
8
"fmt"
9
"io"
10
"log/slog"
···
19
"github.com/golang-jwt/jwt/v5"
20
)
21
22
+
// Authentication errors
23
+
var (
24
+
ErrMissingAuthHeader = errors.New("missing Authorization header")
25
+
ErrInvalidAuthFormat = errors.New("invalid Authorization header format")
26
+
ErrInvalidAuthScheme = errors.New("invalid authorization scheme: expected 'Bearer' or 'DPoP'")
27
+
ErrMissingToken = errors.New("missing token")
28
+
ErrMissingDPoPHeader = errors.New("missing DPoP header")
29
+
)
30
+
31
+
// JWT validation errors
32
+
var (
33
+
ErrInvalidJWTFormat = errors.New("invalid JWT format: expected header.payload.signature")
34
+
ErrMissingISSClaim = errors.New("missing 'iss' claim in token")
35
+
ErrMissingSubClaim = errors.New("missing 'sub' claim in token")
36
+
ErrTokenExpired = errors.New("token has expired")
37
+
)
38
+
39
+
// AuthError provides structured authorization error information
40
+
type AuthError struct {
41
+
Action string // The action being attempted: "blob:read", "blob:write", "crew:admin"
42
+
Reason string // Why access was denied
43
+
Required []string // What permission(s) would grant access
44
+
}
45
+
46
+
func (e *AuthError) Error() string {
47
+
return fmt.Sprintf("access denied for %s: %s (required: %s)",
48
+
e.Action, e.Reason, strings.Join(e.Required, " or "))
49
+
}
50
+
51
+
// NewAuthError creates a new AuthError
52
+
func NewAuthError(action, reason string, required ...string) *AuthError {
53
+
return &AuthError{
54
+
Action: action,
55
+
Reason: reason,
56
+
Required: required,
57
+
}
58
+
}
59
+
60
// HTTPClient interface allows injecting a custom HTTP client for testing
61
type HTTPClient interface {
62
Do(*http.Request) (*http.Response, error)
···
83
// Extract Authorization header
84
authHeader := r.Header.Get("Authorization")
85
if authHeader == "" {
86
+
return nil, ErrMissingAuthHeader
87
}
88
89
// Check for DPoP authorization scheme
90
parts := strings.SplitN(authHeader, " ", 2)
91
if len(parts) != 2 {
92
+
return nil, ErrInvalidAuthFormat
93
}
94
95
if parts[0] != "DPoP" {
···
98
99
accessToken := parts[1]
100
if accessToken == "" {
101
+
return nil, ErrMissingToken
102
}
103
104
// Extract DPoP header
105
dpopProof := r.Header.Get("DPoP")
106
if dpopProof == "" {
107
+
return nil, ErrMissingDPoPHeader
108
}
109
110
// TODO: We could verify the DPoP proof locally (signature, HTM, HTU, etc.)
···
148
// JWT format: header.payload.signature
149
parts := strings.Split(token, ".")
150
if len(parts) != 3 {
151
+
return "", "", ErrInvalidJWTFormat
152
}
153
154
// Decode payload (base64url)
···
168
}
169
170
if claims.Sub == "" {
171
+
return "", "", ErrMissingSubClaim
172
}
173
174
if claims.Iss == "" {
175
+
return "", "", ErrMissingISSClaim
176
}
177
178
return claims.Sub, claims.Iss, nil
···
255
return nil, fmt.Errorf("DPoP authentication failed: %w", err)
256
}
257
} else {
258
+
return nil, ErrInvalidAuthScheme
259
}
260
261
// Get captain record to check owner
···
282
return user, nil
283
}
284
// User is crew but doesn't have admin permission
285
+
return nil, NewAuthError("crew:admin", "crew member lacks permission", "crew:admin")
286
}
287
}
288
289
// User is neither owner nor authorized crew
290
+
return nil, NewAuthError("crew:admin", "user is not a crew member", "crew:admin")
291
}
292
293
// ValidateBlobWriteAccess validates that the request has valid authentication
···
315
return nil, fmt.Errorf("DPoP authentication failed: %w", err)
316
}
317
} else {
318
+
return nil, ErrInvalidAuthScheme
319
}
320
321
// Get captain record to check owner and public settings
···
342
return user, nil
343
}
344
// User is crew but doesn't have write permission
345
+
return nil, NewAuthError("blob:write", "crew member lacks permission", "blob:write")
346
}
347
}
348
349
// User is neither owner nor authorized crew
350
+
return nil, NewAuthError("blob:write", "user is not a crew member", "blob:write")
351
}
352
353
// ValidateBlobReadAccess validates that the request has read access to blobs
354
// If captain.public = true: No auth required (returns nil user to indicate public access)
355
+
// If captain.public = false: Requires valid DPoP + OAuth and (captain OR crew with blob:read or blob:write permission).
356
+
// Note: blob:write implicitly grants blob:read access.
357
// The httpClient parameter is optional and defaults to http.DefaultClient if nil.
358
func ValidateBlobReadAccess(r *http.Request, pds *HoldPDS, httpClient HTTPClient) (*ValidatedUser, error) {
359
// Get captain record to check public setting
···
384
return nil, fmt.Errorf("DPoP authentication failed: %w", err)
385
}
386
} else {
387
+
return nil, ErrInvalidAuthScheme
388
}
389
390
// Check if user is the owner (always has read access)
···
392
return user, nil
393
}
394
395
+
// Check if user is crew with blob:read or blob:write permission
396
+
// Note: blob:write implicitly grants blob:read access
397
crew, err := pds.ListCrewMembers(r.Context())
398
if err != nil {
399
return nil, fmt.Errorf("failed to check crew membership: %w", err)
···
401
402
for _, member := range crew {
403
if member.Record.Member == user.DID {
404
+
// Check if this crew member has blob:read or blob:write permission
405
+
// blob:write implicitly grants read access (can't push without pulling)
406
+
if slices.Contains(member.Record.Permissions, "blob:read") ||
407
+
slices.Contains(member.Record.Permissions, "blob:write") {
408
return user, nil
409
}
410
+
// User is crew but doesn't have read or write permission
411
+
return nil, NewAuthError("blob:read", "crew member lacks permission", "blob:read", "blob:write")
412
}
413
}
414
415
// User is neither owner nor authorized crew
416
+
return nil, NewAuthError("blob:read", "user is not a crew member", "blob:read", "blob:write")
417
}
418
419
// ServiceTokenClaims represents the claims in a service token JWT
···
428
// Extract Authorization header
429
authHeader := r.Header.Get("Authorization")
430
if authHeader == "" {
431
+
return nil, ErrMissingAuthHeader
432
}
433
434
// Check for Bearer authorization scheme
435
parts := strings.SplitN(authHeader, " ", 2)
436
if len(parts) != 2 {
437
+
return nil, ErrInvalidAuthFormat
438
}
439
440
if parts[0] != "Bearer" {
···
443
444
tokenString := parts[1]
445
if tokenString == "" {
446
+
return nil, ErrMissingToken
447
}
448
449
slog.Debug("Validating service token", "holdDID", holdDID)
···
452
// Split token: header.payload.signature
453
tokenParts := strings.Split(tokenString, ".")
454
if len(tokenParts) != 3 {
455
+
return nil, ErrInvalidJWTFormat
456
}
457
458
// Decode payload (second part) to extract claims
···
470
// Get issuer (user DID)
471
issuerDID := claims.Issuer
472
if issuerDID == "" {
473
+
return nil, ErrMissingISSClaim
474
}
475
476
// Verify audience matches this hold service
···
488
return nil, fmt.Errorf("failed to get expiration: %w", err)
489
}
490
if exp != nil && time.Now().After(exp.Time) {
491
+
return nil, ErrTokenExpired
492
}
493
494
// Verify JWT signature using ATProto's secp256k1 crypto
+110
pkg/hold/pds/auth_test.go
+110
pkg/hold/pds/auth_test.go
···
771
}
772
}
773
774
+
// TestValidateBlobReadAccess_BlobWriteImpliesRead tests that blob:write grants read access
775
+
func TestValidateBlobReadAccess_BlobWriteImpliesRead(t *testing.T) {
776
+
ownerDID := "did:plc:owner123"
777
+
778
+
pds, ctx := setupTestPDSWithBootstrap(t, ownerDID, false, false)
779
+
780
+
// Verify captain record has public=false (private hold)
781
+
_, captain, err := pds.GetCaptainRecord(ctx)
782
+
if err != nil {
783
+
t.Fatalf("Failed to get captain record: %v", err)
784
+
}
785
+
786
+
if captain.Public {
787
+
t.Error("Expected public=false for captain record")
788
+
}
789
+
790
+
// Add crew member with ONLY blob:write permission (no blob:read)
791
+
writerDID := "did:plc:writer123"
792
+
_, err = pds.AddCrewMember(ctx, writerDID, "writer", []string{"blob:write"})
793
+
if err != nil {
794
+
t.Fatalf("Failed to add crew writer: %v", err)
795
+
}
796
+
797
+
mockClient := &mockPDSClient{}
798
+
799
+
// Test writer (has only blob:write permission) can read
800
+
t.Run("crew with blob:write can read", func(t *testing.T) {
801
+
dpopHelper, err := NewDPoPTestHelper(writerDID, "https://test-pds.example.com")
802
+
if err != nil {
803
+
t.Fatalf("Failed to create DPoP helper: %v", err)
804
+
}
805
+
806
+
req := httptest.NewRequest(http.MethodGet, "/test", nil)
807
+
if err := dpopHelper.AddDPoPToRequest(req); err != nil {
808
+
t.Fatalf("Failed to add DPoP to request: %v", err)
809
+
}
810
+
811
+
// This should SUCCEED because blob:write implies blob:read
812
+
user, err := ValidateBlobReadAccess(req, pds, mockClient)
813
+
if err != nil {
814
+
t.Errorf("Expected blob:write to grant read access, got error: %v", err)
815
+
}
816
+
817
+
if user == nil {
818
+
t.Error("Expected user to be returned for valid read access")
819
+
} else if user.DID != writerDID {
820
+
t.Errorf("Expected user DID %s, got %s", writerDID, user.DID)
821
+
}
822
+
})
823
+
824
+
// Also verify that crew with only blob:read still works
825
+
t.Run("crew with blob:read can read", func(t *testing.T) {
826
+
readerDID := "did:plc:reader123"
827
+
_, err = pds.AddCrewMember(ctx, readerDID, "reader", []string{"blob:read"})
828
+
if err != nil {
829
+
t.Fatalf("Failed to add crew reader: %v", err)
830
+
}
831
+
832
+
dpopHelper, err := NewDPoPTestHelper(readerDID, "https://test-pds.example.com")
833
+
if err != nil {
834
+
t.Fatalf("Failed to create DPoP helper: %v", err)
835
+
}
836
+
837
+
req := httptest.NewRequest(http.MethodGet, "/test", nil)
838
+
if err := dpopHelper.AddDPoPToRequest(req); err != nil {
839
+
t.Fatalf("Failed to add DPoP to request: %v", err)
840
+
}
841
+
842
+
user, err := ValidateBlobReadAccess(req, pds, mockClient)
843
+
if err != nil {
844
+
t.Errorf("Expected blob:read to grant read access, got error: %v", err)
845
+
}
846
+
847
+
if user == nil {
848
+
t.Error("Expected user to be returned for valid read access")
849
+
} else if user.DID != readerDID {
850
+
t.Errorf("Expected user DID %s, got %s", readerDID, user.DID)
851
+
}
852
+
})
853
+
854
+
// Verify crew with neither permission cannot read
855
+
t.Run("crew without read or write cannot read", func(t *testing.T) {
856
+
noPermDID := "did:plc:noperm123"
857
+
_, err = pds.AddCrewMember(ctx, noPermDID, "noperm", []string{"crew:admin"})
858
+
if err != nil {
859
+
t.Fatalf("Failed to add crew member: %v", err)
860
+
}
861
+
862
+
dpopHelper, err := NewDPoPTestHelper(noPermDID, "https://test-pds.example.com")
863
+
if err != nil {
864
+
t.Fatalf("Failed to create DPoP helper: %v", err)
865
+
}
866
+
867
+
req := httptest.NewRequest(http.MethodGet, "/test", nil)
868
+
if err := dpopHelper.AddDPoPToRequest(req); err != nil {
869
+
t.Fatalf("Failed to add DPoP to request: %v", err)
870
+
}
871
+
872
+
_, err = ValidateBlobReadAccess(req, pds, mockClient)
873
+
if err == nil {
874
+
t.Error("Expected error for crew without read or write permission")
875
+
}
876
+
877
+
// Verify error message format
878
+
if !strings.Contains(err.Error(), "access denied for blob:read") {
879
+
t.Errorf("Expected structured error message, got: %v", err)
880
+
}
881
+
})
882
+
}
883
+
884
// TestValidateOwnerOrCrewAdmin tests admin permission checking
885
func TestValidateOwnerOrCrewAdmin(t *testing.T) {
886
ownerDID := "did:plc:owner123"