add viewer auth

api/server/auth.go

···
+package server
+
+import (
+	"fmt"
+
+	"github.com/bluesky-social/indigo/atproto/atcrypto"
+	"github.com/golang-jwt/jwt/v5"
+)
+
+func initSigningMethods() {
+	if jwt.GetSigningMethod("ES256K") == nil {
+		jwt.RegisterSigningMethod("ES256K", func() jwt.SigningMethod {
+			return &SigningMethodAtproto{
+				alg: "ES256K",
+			}
+		})
+	}
+
+	if jwt.GetSigningMethod("ES256") == nil {
+		jwt.RegisterSigningMethod("ES256", func() jwt.SigningMethod {
+			return &SigningMethodAtproto{
+				alg: "ES256",
+			}
+		})
+	}
+}
+
+type SigningMethodAtproto struct {
+	alg string
+}
+
+func (sm *SigningMethodAtproto) Verify(signingString string, sig []byte, key any) error {
+	pub, ok := key.(atcrypto.PublicKey)
+	if !ok {
+		return fmt.Errorf("wrong key type")
+	}
+	return pub.HashAndVerifyLenient([]byte(signingString), sig)
+}
+
+func (sm *SigningMethodAtproto) Sign(signingString string, key any) ([]byte, error) {
+	return nil, fmt.Errorf("signing not supported")
+}
+
+func (sm *SigningMethodAtproto) Alg() string {
+	return sm.alg
+}

api/server/feedgetposts.go

···
 
 func (s *Server) handleGetPosts(e echo.Context) error {
 	ctx := e.Request().Context()
+	viewer := getViewer(e)
 
-	logger := s.logger.With("name", "handleGetPost")
+	logger := s.logger.With("name", "handleGetPost", "viewer", viewer)
 
 	var input GetFeedPostsInput
 	if err := e.Bind(&input); err != nil {
···
 		return NewValidationError("uris", "all URIs must be valid AT-URIs")
 	}
 
-	postViews, err := s.getPostViews(ctx, input.Uris, "")
+	postViews, err := s.getPostViews(ctx, input.Uris, viewer)
 	if err != nil {
 		logger.Error("failed to get posts", "err", err)
 		return ErrInternalServerErr
···
 
 func (s *Server) handleGetActorPosts(e echo.Context) error {
 	ctx := e.Request().Context()
+	viewer := getViewer(e)
 
-	logger := s.logger.With("name", "handleGetActorPosts")
+	logger := s.logger.With("name", "handleGetActorPosts", "viewer", viewer)
 
 	var input GetFeedActorPostsInput
 	if err := e.Bind(&input); err != nil {
···
 		return ErrInternalServerErr
 	}
 
-	postViews, err := s.postsToPostViews(ctx, resp.Posts, "") // TODO: set viewer
+	postViews, err := s.postsToPostViews(ctx, resp.Posts, viewer)
 	if err != nil {
 		s.logger.Error("failed to get post views", "err", err)
 		return ErrInternalServerErr

api/server/identity.go

···
 	"context"
 	"errors"
 	"fmt"
-	"strings"
 
 	"github.com/bluesky-social/indigo/atproto/syntax"
 )
···
 	ErrActorNotValid      = errors.New("actor was not a valid did or handle")
 )
 
-func (s *Server) handleFromDid(ctx context.Context, did string) (string, error) {
-	doc, err := s.passport.FetchDoc(ctx, did)
+func (s *Server) handleFromDid(ctx context.Context, did syntax.DID) (syntax.Handle, error) {
+	doc, err := s.directory.LookupDID(ctx, did)
 	if err != nil {
 		return "", fmt.Errorf("failed to fetch did doc: %w", err)
 	}
-	for _, aka := range doc.AlsoKnownAs {
-		if after, ok := strings.CutPrefix(aka, "at://"); ok {
-			return after, nil
-		}
-	}
-	return "", ErrAtHandleNotPresent
+
+	return doc.Handle, nil
 }
 
 // Given either a valid DID or handle, finds both the DID and handle for said actor and returns them.
···
 func (s *Server) fetchDidHandleFromActor(ctx context.Context, actor string) (string, string, error) {
 	logger := s.logger.With("name", "fetchDidHandleForActor", "actor", actor)
 
-	var did string
-	var handle string
+	var did *syntax.DID
+	var handle *syntax.Handle
 	if parsed, err := syntax.ParseDID(actor); err == nil {
-		did = parsed.String()
+		did = &parsed
 	} else if parsed, err := syntax.ParseHandle(actor); err == nil {
-		handle = parsed.String()
+		handle = &parsed
 	}
 
 	logger = logger.With("did", did, "handle", handle)
 
-	if did == "" && handle == "" {
+	if did == nil && handle == nil {
 		logger.Error("actor was not a valid did or handle")
 		return "", "", ErrActorNotValid
 	}
 
-	if did != "" {
-		maybeHandle, err := s.handleFromDid(ctx, did)
+	if did != nil {
+		maybeHandle, err := s.handleFromDid(ctx, *did)
 		if err != nil {
 			logger.Error("error getting handle", "err", err)
 			return "", "", err
 		}
-		handle = maybeHandle
-	} else if handle != "" {
-		maybeDid, err := s.passport.ResolveHandle(ctx, handle)
+		handle = &maybeHandle
+	} else if handle != nil {
+		maybeDid, err := s.directory.ResolveHandle(ctx, *handle)
 		if err != nil {
 			logger.Error("error getting did", "err", err)
 			return "", "", err
 		}
-		did = maybeDid
+		did = &maybeDid
 	}
 
-	return did, handle, nil
+	return did.String(), handle.String(), nil
 }

api/server/server.go

···
 	"net/http"
 	"os"
 	"os/signal"
+	"strings"
 	"syscall"
 	"time"
 
-	"github.com/bluesky-social/go-util/pkg/robusthttp"
-	"github.com/haileyok/cocoon/identity"
+	"github.com/bluesky-social/indigo/atproto/atcrypto"
+	"github.com/bluesky-social/indigo/atproto/identity"
+	"github.com/bluesky-social/indigo/atproto/syntax"
+	"github.com/golang-jwt/jwt/v5"
 	"github.com/labstack/echo-contrib/echoprometheus"
 	"github.com/labstack/echo/v4"
 	"github.com/labstack/echo/v4/middleware"
 	slogecho "github.com/samber/slog-echo"
 	"github.com/vylet-app/go/database/client"
+	"golang.org/x/time/rate"
 )
 
 type Server struct {
-	logger   *slog.Logger
-	httpd    *http.Server
-	echo     *echo.Echo
-	client   *client.Client
-	passport *identity.Passport
+	logger    *slog.Logger
+	httpd     *http.Server
+	echo      *echo.Echo
+	client    *client.Client
+	directory *identity.CacheDirectory
 }
 
 type Args struct {
···
 	if args.Logger == nil {
 		args.Logger = slog.Default()
 	}
+
+	initSigningMethods()
 
 	logger := args.Logger
 
···
 		return nil, fmt.Errorf("failed to create new database client: %w", err)
 	}
 
-	passport := identity.NewPassport(robusthttp.NewClient(), identity.NewMemCache(10_000))
+	baseDirectory := identity.BaseDirectory{
+		PLCURL: "https://plc.directory",
+		HTTPClient: http.Client{
+			Timeout: time.Second * 5,
+		},
+		PLCLimiter:            rate.NewLimiter(rate.Limit(10), 1),
+		TryAuthoritativeDNS:   false,
+		SkipDNSDomainSuffixes: []string{".bsky.social", ".staging.bsky.dev"},
+	}
+	directory := identity.NewCacheDirectory(&baseDirectory, 100_000, time.Hour*48, time.Minute*15, time.Minute*15)
 
 	server := Server{
-		logger:   logger,
-		echo:     echo,
-		httpd:    &httpd,
-		client:   client,
-		passport: passport,
+		logger:    logger,
+		echo:      echo,
+		httpd:     &httpd,
+		client:    client,
+		directory: &directory,
 	}
 
 	server.echo.HTTPErrorHandler = server.errorHandler
+	server.echo.Use(server.didAuthMiddleware())
 
 	server.registerHandlers()
 
···
 	s.echo.GET("/xrpc/app.vylet.feed.getPosts", s.handleGetPosts)
 	s.echo.GET("/xrpc/app.vylet.feed.getSubjectLikes", s.handleGetSubjectLikes)
 	s.echo.GET("/xrpc/app.vylet.feed.getActorPosts", s.handleGetActorPosts)
+
+	// SAMPLE
+	s.echo.GET("/xrpc/authed", nil, requireAuth)
 }
 
 func (s *Server) errorHandler(err error, c echo.Context) {
···
 		c.Logger().Error(err)
 	}
 }
+
+type AtProtoClaims struct {
+	Sub string `json:"sub"`
+	Aud string `json:"aud"`
+	Iss string `json:"iss"`
+	jwt.RegisteredClaims
+}
+
+func (s *Server) getKeyForDid(ctx context.Context, did syntax.DID) (atcrypto.PublicKey, error) {
+	ident, err := s.directory.LookupDID(ctx, did)
+	if err != nil {
+		return nil, err
+	}
+	return ident.PublicKey()
+}
+
+func (s *Server) fetchKey(ctx context.Context) func(tok *jwt.Token) (any, error) {
+	return func(tok *jwt.Token) (any, error) {
+		issuer, ok := tok.Claims.(jwt.MapClaims)["iss"].(string)
+		if !ok {
+			return nil, fmt.Errorf("missing 'iss' field from auth header JWT")
+		}
+
+		did, err := syntax.ParseDID(issuer)
+		if err != nil {
+			return nil, fmt.Errorf("invalid DID in 'iss' field from auth header JWT")
+		}
+
+		k, err := s.getKeyForDid(ctx, did)
+		if err != nil {
+			return nil, fmt.Errorf("failed to look up public key for DID (%q): %w", did, err)
+		}
+
+		return k, nil
+	}
+}
+
+func (s *Server) checkJwt(ctx context.Context, token string) (string, error) {
+	ctx, cancel := context.WithTimeout(ctx, time.Second*5)
+	defer cancel()
+
+	validMethods := []string{"ES256K", "ES256"}
+	config := []jwt.ParserOption{jwt.WithValidMethods(validMethods)}
+
+	p := jwt.NewParser(config...)
+	t, err := p.Parse(token, s.fetchKey(ctx))
+	if err != nil {
+		return "", fmt.Errorf("failed to parse auth header jwt: %w", err)
+	}
+
+	clms, ok := t.Claims.(jwt.MapClaims)
+	if !ok {
+		return "", fmt.Errorf("invalid token claims")
+	}
+
+	did, ok := clms["iss"].(string)
+	if !ok {
+		return "", fmt.Errorf("no issuer present in returned claims")
+	}
+
+	return did, nil
+}
+
+func (s *Server) didAuthMiddleware() echo.MiddlewareFunc {
+	return func(next echo.HandlerFunc) echo.HandlerFunc {
+		return func(e echo.Context) error {
+			authHeader := e.Request().Header.Get("Authorization")
+
+			if authHeader == "" {
+				return next(e)
+			}
+
+			if !strings.HasPrefix(authHeader, "Bearer ") {
+				return echo.NewHTTPError(http.StatusUnauthorized, "Invalid authorization format")
+			}
+
+			tokenString := strings.TrimPrefix(authHeader, "Bearer ")
+
+			ctx := e.Request().Context()
+			userDid, err := s.checkJwt(ctx, tokenString)
+			if err != nil {
+				return echo.NewHTTPError(http.StatusUnauthorized,
+					fmt.Sprintf("Token verification failed: %v", err))
+			}
+
+			e.Set("viewer", userDid)
+
+			return next(e)
+		}
+	}
+}
+
+func requireAuth(next echo.HandlerFunc) echo.HandlerFunc {
+	return func(e echo.Context) error {
+		viewer := getViewer(e)
+
+		if viewer == "" {
+			return ErrUnauthorized
+		}
+
+		return next(e)
+	}
+}
+
+func getViewer(e echo.Context) string {
+	viewer, ok := e.Get("viewer").(string)
+	if ok {
+		return viewer
+	}
+	return ""
+}

go.mod

···
 	github.com/bluesky-social/go-util v0.0.0-20251012040650-2ebbf57f5934
 	github.com/bluesky-social/indigo v0.0.0-20251206005924-d49b45419635
 	github.com/gocql/gocql v1.7.0
+	github.com/golang-jwt/jwt/v4 v4.5.2
+	github.com/golang-jwt/jwt/v5 v5.2.2
 	github.com/golang-migrate/migrate/v4 v4.19.1
 	github.com/gorilla/websocket v1.5.1
 	github.com/haileyok/cocoon v0.6.0
···
 	github.com/joho/godotenv v1.5.1
 	github.com/labstack/echo-contrib v0.17.4
 	github.com/labstack/echo/v4 v4.13.3
+	github.com/multiformats/go-multihash v0.2.3
 	github.com/prometheus/client_golang v1.23.2
 	github.com/samber/slog-echo v1.18.0
 	github.com/twmb/franz-go v1.19.5
 	github.com/urfave/cli/v2 v2.27.7
 	github.com/whyrusleeping/cbor-gen v0.2.1-0.20241030202151-b7a6831be65e
+	golang.org/x/sync v0.18.0
 	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028
 	google.golang.org/grpc v1.74.2
 	google.golang.org/protobuf v1.36.9
···
 	github.com/multiformats/go-base32 v0.1.0 // indirect
 	github.com/multiformats/go-base36 v0.2.0 // indirect
 	github.com/multiformats/go-multibase v0.2.0 // indirect
-	github.com/multiformats/go-multihash v0.2.3 // indirect
 	github.com/multiformats/go-varint v0.0.7 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/opentracing/opentracing-go v1.2.0 // indirect
···
 	golang.org/x/crypto v0.45.0 // indirect
 	golang.org/x/mod v0.29.0 // indirect
 	golang.org/x/net v0.47.0 // indirect
-	golang.org/x/sync v0.18.0 // indirect
 	golang.org/x/sys v0.38.0 // indirect
 	golang.org/x/text v0.31.0 // indirect
 	golang.org/x/time v0.12.0 // indirect

go.sum

···
 github.com/gocql/gocql v1.7.0/go.mod h1:vnlvXyFZeLBF0Wy+RS8hrOdbn0UWsWtdg07XJnFxZ+4=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
+github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI=
+github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
+github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
+github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
 github.com/golang-migrate/migrate/v4 v4.19.1 h1:OCyb44lFuQfYXYLx1SCxPZQGU7mcaZ7gH9yH4jSFbBA=
 github.com/golang-migrate/migrate/v4 v4.19.1/go.mod h1:CTcgfjxhaUtsLipnLoQRWCrjYXycRz/g5+RWDuYgPrE=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=