Much bigger refactor; break out separate packages

api/api.go

···
 	ActorProfileNSID = "app.atyo.actor.profile"
 	PingNSID         = "app.atyo.ping"
 
-	SelfActorProfile = "self"
+	ActorProfileRKeySelf = "self"
 )

internal/auth/auth.go

···
+package auth
+
+import (
+	"context"
+	"fmt"
+	"os"
+
+	"atyo.app/internal/lookup"
+	"github.com/bluesky-social/indigo/api/atproto"
+	"github.com/bluesky-social/indigo/lex/util"
+	"github.com/bluesky-social/indigo/xrpc"
+)
+
+type Client struct {
+	directory *lookup.Directory
+	xrpc      *xrpc.Client
+}
+
+func NewClient(directory *lookup.Directory) *Client {
+	return &Client{
+		directory: directory,
+		xrpc:      &xrpc.Client{},
+	}
+}
+
+func (c *Client) IsLoggedIn() bool {
+	return c.xrpc.Auth != nil
+}
+
+// LexDo implements [util.LexClient].
+func (c *Client) LexDo(
+	ctx context.Context,
+	method, inputEncoding, endpoint string,
+	params map[string]any,
+	bodyData, out any,
+) error {
+	return c.xrpc.LexDo(ctx, method, inputEncoding, endpoint, params, bodyData, out)
+}
+
+func (c *Client) PutRecord(
+	ctx context.Context,
+	collection string,
+	record *util.LexiconTypeDecoder,
+	rkey string,
+) error {
+	output, err := atproto.RepoPutRecord(ctx, c, &atproto.RepoPutRecord_Input{
+		Collection: collection,
+		Record:     record,
+		Repo:       c.xrpc.Auth.Did,
+		Rkey:       rkey,
+	})
+
+	fmt.Fprintln(os.Stderr, "Created record: "+output.Uri)
+
+	return err
+}

internal/auth/basic.go

···
+package auth
+
+import (
+	"context"
+	"fmt"
+	"os"
+
+	"github.com/bluesky-social/indigo/api/atproto"
+	"github.com/bluesky-social/indigo/atproto/identity"
+	"github.com/bluesky-social/indigo/xrpc"
+)
+
+func (c *Client) Login(
+	ctx context.Context,
+	user, password string,
+	authFactorToken *string,
+) (did *identity.Identity, err error) {
+	// Gotta look up the PDS for the given handle/did
+	did, err = c.directory.LookupID(ctx, user)
+	if err != nil {
+		return nil, err
+	}
+
+	pds := did.PDSEndpoint()
+	if pds == "" {
+		return nil, fmt.Errorf("failed to retrieve account PDS")
+	}
+
+	fmt.Fprintln(os.Stderr, "sending login request to "+pds)
+
+	// clear out existing auth first
+	// TODO: use refresh token etc instead of this
+	c.xrpc = &xrpc.Client{Host: pds}
+
+	loginResult, err := atproto.ServerCreateSession(
+		ctx,
+		c.xrpc,
+		&atproto.ServerCreateSession_Input{
+			Identifier:      user,
+			Password:        password,
+			AuthFactorToken: authFactorToken,
+		},
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	// TODO(#3) persist
+	c.xrpc.Auth = &xrpc.AuthInfo{
+		AccessJwt:  loginResult.AccessJwt,
+		RefreshJwt: loginResult.RefreshJwt, // TODO persist in db or something?
+		Handle:     loginResult.Handle,
+		Did:        loginResult.Did,
+	}
+
+	return did, nil
+}

internal/errs/http.go

···
+package errs
+
+import "net/http"
+
+type Http struct {
+	Code    int
+	Message string
+}
+
+func (e *Http) Write(w http.ResponseWriter) {
+	http.Error(w, e.Error(), e.Code)
+}
+
+func (e *Http) Error() string {
+	return e.Message
+}

internal/lookup/identity.go

···
+package lookup
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"os"
+	"strings"
+
+	"atyo.app/internal/errs"
+	id "github.com/bluesky-social/indigo/atproto/identity"
+	"github.com/bluesky-social/indigo/atproto/syntax"
+)
+
+type Directory struct {
+	dir id.Directory
+}
+
+func NewDirectory() *Directory {
+	return &Directory{dir: id.DefaultDirectory()}
+}
+
+func (d *Directory) LookupID(ctx context.Context, targetStr string) (*id.Identity, error) {
+	targetStr = strings.TrimPrefix(targetStr, "@")
+
+	target, err := syntax.ParseAtIdentifier(targetStr)
+	if err != nil {
+		return nil, &errs.Http{
+			http.StatusBadRequest,
+			"Invalid target identity `" + targetStr + "`",
+		}
+	}
+
+	targetId, err := d.dir.Lookup(ctx, *target)
+	if err != nil {
+		return nil, &errs.Http{
+			http.StatusNotFound,
+			"Target `" + targetStr + "` not found",
+		}
+	}
+
+	fmt.Fprintln(
+		os.Stderr,
+		"resolved to `"+targetId.Handle.String()+"` ("+targetId.DID.String()+")",
+	)
+
+	return targetId, nil
+}

internal/ping/client.go

···
+package ping
+
+import (
+	"atyo.app/internal/auth"
+	"atyo.app/internal/lookup"
+	"github.com/bluesky-social/indigo/atproto/syntax"
+	"github.com/bluesky-social/indigo/xrpc"
+)
+
+type Client struct {
+	auth      *auth.Client
+	relay     *xrpc.Client
+	keys      *KeyManager
+	directory *lookup.Directory
+	tids      syntax.TIDClock
+}
+
+func NewClient(auth *auth.Client, keys *KeyManager, dir *lookup.Directory) *Client {
+	// https://docs.bsky.app/blog/relay-sync-updates
+	relay := &xrpc.Client{Host: "https://relay1.us-west.bsky.network"}
+
+	return &Client{
+		auth:      auth,
+		relay:     relay,
+		keys:      keys,
+		directory: dir,
+		tids:      syntax.NewTIDClock(0), // TODO random number (store in DB)
+	}
+}

internal/server/error.go

···
-package appview
-
-import "net/http"
-
-type httpError struct {
-	Code    int
-	Message string
-}
-
-func (e *httpError) Write(w http.ResponseWriter) {
-	http.Error(w, e.Error(), e.Code)
-}
-
-func (e *httpError) Error() string {
-	return e.Message
-}

internal/server/identity.go

···
-package appview
-
-import (
-	"context"
-	"fmt"
-	"net/http"
-	"os"
-	"strings"
-
-	"github.com/bluesky-social/indigo/atproto/identity"
-	"github.com/bluesky-social/indigo/atproto/syntax"
-)
-
-func (s *Server) lookupId(
-	ctx context.Context,
-	targetStr string,
-) (*identity.Identity, *httpError) {
-	targetStr = strings.TrimPrefix(targetStr, "@")
-
-	target, err := syntax.ParseAtIdentifier(targetStr)
-	if err != nil {
-		return nil, &httpError{
-			http.StatusBadRequest,
-			"Invalid target identity `" + targetStr + "`",
-		}
-	}
-
-	targetId, err := s.directory.Lookup(ctx, *target)
-	if err != nil {
-		return nil, &httpError{
-			http.StatusNotFound,
-			"Target `" + targetStr + "` not found",
-		}
-	}
-
-	fmt.Fprintln(
-		os.Stderr,
-		"resolved to `"+targetId.Handle.String()+"` ("+targetId.DID.String()+")",
-	)
-
-	return targetId, nil
-}

internal/server/ingest_pings.go internal/ping/ingest_pings.go

···
-package appview
+package ping
 
 import (
+	"context"
 	"encoding/hex"
-	"encoding/json"
+	"errors"
 	"fmt"
 	"net/http"
 	"os"
···
 
 	"atyo.app/api"
 	"atyo.app/api/atyo"
+	"atyo.app/internal/errs"
 	"github.com/bluesky-social/indigo/api/atproto"
 	"github.com/bluesky-social/indigo/lex/util"
 	"github.com/bluesky-social/indigo/xrpc"
···
 )
 
 type jsonPings struct {
-	Pings []jsonPing `json:"pings"`
+	Pings []Ping `json:"pings"`
 }
 
-type jsonPing struct {
+type Ping struct {
 	FromDID    string              `json:"from_did"`
-	FromHandle *string             `json:"from_handle",omitempty`
+	FromHandle *string             `json:"from_handle,omitempty"`
 	Contents   *atyo.Ping_Contents `json:"contents"`
 }
 
-func (s *Server) fetchPings(w http.ResponseWriter, req *http.Request) {
-	key, err := s.keys.fetchPrivKey()
+const (
+	// TODO: maybe there's an API to filter by DIDs, follow list, or we could even just
+	// lookup each did in our follow list and query the PDS directly, not sure.
+	maxRepos          = 20
+	maxRecordsPerRepo = 10
+)
+
+func (c *Client) FetchPings(ctx context.Context) ([]Ping, error) {
+	key, err := c.keys.fetchPrivKey()
 	if err != nil {
-		http.Error(w, err.Error(), http.StatusUnauthorized)
+		return nil, errors.Join(
+			fmt.Errorf(
+				"%w: %w",
+				&errs.Http{http.StatusUnauthorized, "no key found to decode pings"},
+				err,
+			),
+		)
 	}
 
 	// TODO for now let's be dumb and fetch the whole world; later
 	// we can store a tid or something in the sqlite db and fetch from that point
-
-	// TODO: maybe there's an API to filter by DIDs, follow list, or we could even just
-	// lookup each did in our follow list and query the PDS directly, not sure.
-	response, err := atproto.SyncListReposByCollection(
-		req.Context(),
-		s.relayClient,
-		api.PingNSID,
-		"",
-		20,
-	)
+	//
+	response, err := atproto.SyncListReposByCollection(ctx, c.relay, api.PingNSID, "", maxRepos)
 	if err != nil {
-		http.Error(
-			w,
-			"failed to fetch upstream repos: "+err.Error(),
-			http.StatusInternalServerError,
-		)
-		return
+		return nil, errors.New("failed to list repos to crawl")
 	}
 
-	var results jsonPings
+	result := make([]Ping, 0)
 
 	// TODO pagination, store cursors if necessary. Unlikely to matter for a while lol
 	// Maybe also asyncify? This kind of thing probably works well with a
 	// worker pool or something when the record count gets bigger
 	for _, repo := range response.Repos {
-		id, lookupErr := s.lookupId(req.Context(), repo.Did)
-		if err != nil {
-			fmt.Fprintf(
-				os.Stderr,
-				"failed to resolve id %s: %s\n",
-				repo.Did, lookupErr,
-			)
+		id, lookupErr := c.directory.LookupID(ctx, repo.Did)
+		if lookupErr != nil {
+			fmt.Fprintf(os.Stderr, "failed to resolve id %s: %s\n", repo.Did, lookupErr)
 			continue
 		}
 
 		// TODO: seems like there should be a "sync" way to do this, but I guess it won't
 		// matter once I start handling things "live" off the firehose instead of this
-		repoClient := &xrpc.Client{Host: id.PDSEndpoint()}
+		client := &xrpc.Client{Host: id.PDSEndpoint()}
 
 		// TODO need to hit the corresponding PDS, or can we rely on relay proxy here
 		records, err := atproto.RepoListRecords(
-			req.Context(),
-			repoClient,
+			ctx,
+			client,
 			api.PingNSID,
-			"",
-			3,
+			"", // latest CID
+			maxRecordsPerRepo,
 			repo.Did,
 			false,
 		)
 
 		if err != nil {
-			fmt.Fprintf(
-				os.Stderr,
-				"failed to fetch from %s: %s\n",
-				repo.Did, err,
-			)
+			fmt.Fprintf(os.Stderr, "failed to fetch from %s: %s\n", repo.Did, err)
 			continue
 		}
-
-		fmt.Fprintf(
-			os.Stderr,
-			"got %d records for %s\n",
-			len(records.Records), repo.Did,
-		)
+		fmt.Fprintf(os.Stderr, "got %d records for %s\n", len(records.Records), repo.Did)
 
 		for _, record := range records.Records {
 			ping, ok := record.Value.Val.(*atyo.Ping)
 			if !ok {
-				fmt.Fprintf(
-					os.Stderr,
-					"failed to convert %s to ping",
-					record.Uri,
-				)
+				fmt.Fprintf(os.Stderr, "failed to convert %s to ping", record.Uri)
 				continue
 			}
 
-			contents, err := s.decodePingContents(ping, key)
+			contents, err := decodePingContents(ping, key)
 			if err != nil {
 				fmt.Fprintln(os.Stderr, "failed to decode ping ", record.Uri, " - ", err)
 				continue
 			}
 			if contents != nil {
-				from, _ := s.lookupId(req.Context(), repo.Did)
+				from, _ := c.directory.LookupID(ctx, repo.Did)
 				var fromHandle *string
 				if from != nil {
 					handle := from.Handle.String()
 					fromHandle = &handle
 				}
 
-				results.Pings = append(results.Pings, jsonPing{
+				result = append(result, Ping{
 					FromDID:    repo.Did,
 					FromHandle: fromHandle,
 					Contents:   contents,
···
 		}
 	}
 
-	resultBytes, err := json.Marshal(&results)
-	if err != nil {
-		http.Error(w, "Failed to encode JSON result: "+err.Error(), http.StatusInternalServerError)
-		return
-	}
-
-	w.Write(resultBytes)
+	return result, nil
 }
 
-func (s *Server) decodePingContents(ping *atyo.Ping, privateKey *[sharedKeyLen]byte) (*atyo.Ping_Contents, error) {
+func decodePingContents(ping *atyo.Ping, privateKey *[sharedKeyLen]byte) (*atyo.Ping_Contents, error) {
 	contents := ping.Contents
 
 	if len(contents) < sharedKeyLen {

internal/server/keys.go internal/ping/keys.go

···
-package appview
+package ping
 
 import (
 	"context"
···
 
 	"atyo.app/api"
 	"atyo.app/api/atyo"
+	"atyo.app/internal/auth"
 	"github.com/bluesky-social/indigo/api/atproto"
 	"github.com/bluesky-social/indigo/atproto/identity"
 	"github.com/bluesky-social/indigo/atproto/syntax"
···
 )
 
 type KeyManager struct {
-	client              *xrpc.Client
-	authenticatedClient *xrpc.Client
-	selfPrivateKey      *[32]byte
-	cache               map[string]*[32]byte
+	client         *auth.Client
+	selfPrivateKey *[32]byte
+	cache          map[string]*[32]byte
+}
+
+func NewKeyManager(client *auth.Client) *KeyManager {
+	return &KeyManager{client: client}
 }
 
 // TODO: get pubkey from atproto profile; probably needs a new lexicon
···
 }
 
 func (k *KeyManager) fetchProfile(ctx context.Context, id *identity.Identity) (*atproto.RepoGetRecord_Output, *atyo.ActorProfile, error) {
+	pds := id.PDSEndpoint()
+	if pds == "" {
+		return nil, nil, fmt.Errorf("failed to fetch PDS endpoing for  %s", id.DID)
+	}
+
+	// use an ephemeral client, since we're fetching directly from the PDS
+	client := &xrpc.Client{Host: id.PDSEndpoint()}
+
 	record, err := atproto.RepoGetRecord(
 		ctx,
-		// hmm should this be a relay instance or something? Need to check this
-		// when fetching a record for someone with a different PDS (ugh which means
-		// I need an account that uses a different PDS which maybe means selfhosting)
-		k.client,
-		"",
+		client,
+		"", // empty cid = most recent version
 		api.ActorProfileNSID,
 		id.DID.String(),
-		api.SelfActorProfile,
+		api.ActorProfileRKeySelf,
 	)
 	if err != nil {
 		return nil, nil, err
···
 	return nil, fmt.Errorf("no private key set, maybe login required?")
 }
 
-func (k *KeyManager) genAndPublishKeyPair(ctx context.Context, did string) error {
+func (k *KeyManager) GenAndPublishKeyPair(ctx context.Context, did string) error {
 	selfPubKey, selfPrivKey, err := box.GenerateKey(rand.Reader)
 	if err != nil {
 		panic(err)
···
 	// for now (and is also what tangled.sh appears to do).
 
 	var swapRecord *string
-	existing, _ := atproto.RepoGetRecord(ctx, k.authenticatedClient, "", api.ActorProfileNSID, did, api.SelfActorProfile)
+	existing, _ := atproto.RepoGetRecord(ctx, k.client, "", api.ActorProfileNSID, did, api.ActorProfileRKeySelf)
 	if existing != nil {
 		swapRecord = existing.Cid
 	}
 
 	_, err = atproto.RepoPutRecord(
 		ctx,
-		k.authenticatedClient,
+		k.client,
 		&atproto.RepoPutRecord_Input{
 			Collection: api.ActorProfileNSID,
 			Repo:       did,
-			Rkey:       api.SelfActorProfile,
+			Rkey:       api.ActorProfileRKeySelf,
 			SwapRecord: swapRecord,
 			Record: &util.LexiconTypeDecoder{
 				Val: &atyo.ActorProfile{

internal/server/login.go

···
-package appview
-
-import (
-	"encoding/json"
-	"errors"
-	"fmt"
-	"net/http"
-	"os"
-
-	"github.com/bluesky-social/indigo/api/atproto"
-	"github.com/bluesky-social/indigo/xrpc"
-)
-
-func (s *Server) login(w http.ResponseWriter, req *http.Request) {
-	user := req.FormValue("username")
-	pass := req.FormValue("password")
-
-	fmt.Fprintln(os.Stderr, "Attempting login as `"+user+"`")
-
-	var authFactorToken *string
-	if req.Form.Has("authFactorToken") {
-		tok := req.FormValue("authFactorToken")
-		authFactorToken = &tok
-	}
-
-	// Gotta look up the PDS for the given handle/did
-	did, lookupErr := s.lookupId(req.Context(), user)
-	if lookupErr != nil {
-		http.Error(w, lookupErr.Message, lookupErr.Code)
-		return
-	}
-
-	// clear out existing auth first
-	// TODO: use refresh token etc instead of this
-	s.authenticatedClient.Host = did.PDSEndpoint()
-	s.authenticatedClient.Auth = nil
-
-	fmt.Fprintln(os.Stderr, "sending login request to "+s.authenticatedClient.Host)
-
-	loginResult, err := atproto.ServerCreateSession(
-		req.Context(),
-		s.authenticatedClient,
-		&atproto.ServerCreateSession_Input{
-			Identifier:      user,
-			Password:        pass,
-			AuthFactorToken: authFactorToken,
-		},
-	)
-	if err != nil {
-		handleXrpcError(w, err)
-		s.authenticatedClient.Host = s.client.Host
-		return
-	}
-
-	s.authenticatedClient.Auth = &xrpc.AuthInfo{
-		AccessJwt:  loginResult.AccessJwt,
-		RefreshJwt: loginResult.RefreshJwt, // TODO persist in db or something?
-		Handle:     loginResult.Handle,
-		Did:        loginResult.Did,
-	}
-
-	// for now, just create a key and publish it on every login. In the future
-	// this private key should live in sqlite db instead or something,
-	// so we don't need to republish it every time lmao. Also we should in theory
-	// make this more of an update than a replace but it's fine for now
-
-	if err = s.keys.genAndPublishKeyPair(req.Context(), loginResult.Did); err != nil {
-		http.Error(
-			w,
-			"Failed to create profile record: "+err.Error(),
-			http.StatusInternalServerError,
-		)
-
-	}
-
-	resp, err := json.Marshal(loginResult)
-	if err != nil {
-		http.Error(w, "failed to re-serialize login response", http.StatusInternalServerError)
-	}
-	_, err = w.Write(resp)
-	if err != nil {
-		fmt.Fprintln(os.Stderr, err)
-	}
-}
-
-func handleXrpcError(w http.ResponseWriter, err error) {
-	var xErr *xrpc.Error
-	if errors.As(err, &xErr) {
-		// Hmm maybe this should be a 50x or certain codes should translate...
-		http.Error(w, xErr.Error(), xErr.StatusCode)
-		return
-	}
-
-	http.Error(w, err.Error(), http.StatusInternalServerError)
-}

internal/server/oauth.go

···
-package appview
-
-import (
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"net/url"
-)
-
-// https://atproto.com/specs/oauth#client-id-metadata-document
-type clientMetadata struct {
-	ClientID                    string   `json:"client_id"`
-	ClientName                  string   `json:"client_name"`
-	SubjectType                 string   `json:"subject_type"`
-	ClientURI                   string   `json:"client_uri"`
-	RedirectURIs                []string `json:"redirect_uris"`
-	GrantTypes                  []string `json:"grant_types"`
-	ResponseTypes               []string `json:"response_types"`
-	ApplicationType             string   `json:"application_type"`
-	DpopBoundAccessTokens       bool     `json:"dpop_bound_access_tokens"`
-	JwksURI                     string   `json:"jwks_uri"`
-	Scope                       string   `json:"scope"`
-	TokenEndpointAuthMethod     string   `json:"token_endpoint_auth_method"`
-	TokenEndpointAuthSigningAlg string   `json:"token_endpoint_auth_signing_alg"`
-}
-
-func newClientMetadata() clientMetadata {
-	makeRedirectURIs := func(c string) []string {
-		return []string{fmt.Sprintf("%s/oauth/callback", c)}
-	}
-
-	// TODO: configurable host
-	clientURI := "http://127.0.0.1:3000"
-	redirectURIs := makeRedirectURIs(clientURI)
-
-	query := url.Values{}
-	query.Add("redirect_uri", redirectURIs[0])
-	query.Add("scope", "atproto transition:generic")
-	clientID := fmt.Sprintf("http://localhost?%s", query.Encode())
-
-	jwksURI := fmt.Sprintf("%s/oauth/jwks.json", clientURI)
-
-	return clientMetadata{
-		ClientID:                    clientID,
-		ClientName:                  "ATyo",
-		SubjectType:                 "public",
-		ClientURI:                   clientURI,
-		RedirectURIs:                redirectURIs,
-		GrantTypes:                  []string{"authorization_code", "refresh_token"},
-		ResponseTypes:               []string{"code"},
-		ApplicationType:             "web",
-		DpopBoundAccessTokens:       true,
-		JwksURI:                     jwksURI,
-		Scope:                       "atproto transition:generic",
-		TokenEndpointAuthMethod:     "private_key_jwt",
-		TokenEndpointAuthSigningAlg: "ES256",
-	}
-}
-
-// Serve client metadata for OAuth.
-func (*Server) handleOAuthMetadata(w http.ResponseWriter, req *http.Request) {
-	w.Header().Set("Content-Type", "application/json")
-	w.WriteHeader(http.StatusOK)
-	meta := newClientMetadata()
-	json.NewEncoder(w).Encode(meta)
-}
-
-func (*Server) handleJwks(w http.ResponseWriter, req *http.Request) {
-	// TODO
-}
-
-func (*Server) handleOAuthCallback(w http.ResponseWriter, req *http.Request) {
-	// TODO
-}

internal/server/router.go

···
 package appview
 
 import (
+	"encoding/json"
+	"errors"
+	"fmt"
 	"net/http"
+	"os"
 
-	"github.com/bluesky-social/indigo/atproto/identity"
-	"github.com/bluesky-social/indigo/atproto/syntax"
+	"atyo.app/internal/auth"
+	"atyo.app/internal/errs"
+	"atyo.app/internal/lookup"
+	"atyo.app/internal/ping"
 	"github.com/bluesky-social/indigo/xrpc"
 )
 
 type Server struct {
-	directory           *identity.BaseDirectory
-	keys                *KeyManager
-	client              *xrpc.Client
-	relayClient         *xrpc.Client
-	authenticatedClient *xrpc.Client
-	tidClock            syntax.TIDClock
+	directory *lookup.Directory
+	client    *auth.Client
+	keys      *ping.KeyManager
+	pings     *ping.Client
 }
 
 func NewServer() *Server {
-	// https://docs.bsky.app/docs/advanced-guides/api-directory#bluesky-services
-	client := &xrpc.Client{Host: "https://bsky.social"}
-	// For new Sync 1.1 APIs: https://docs.bsky.app/blog/relay-sync-updates
-	relayClient := &xrpc.Client{Host: "https://relay1.us-west.bsky.network"}
-	authClient := &xrpc.Client{}
+	dir := lookup.NewDirectory()
+	client := auth.NewClient(dir)
+	keys := ping.NewKeyManager(client)
 
 	return &Server{
-		directory:           &identity.BaseDirectory{},
-		client:              client,
-		relayClient:         relayClient,
-		authenticatedClient: authClient,
-		keys: &KeyManager{
-			client:              client,
-			authenticatedClient: authClient,
-		},
-		tidClock: syntax.NewTIDClock(0), // this int needs to be unique per instance-ish
+		directory: dir,
+		client:    client,
+		keys:      keys,
+		pings:     ping.NewClient(client, keys, dir),
 	}
 }
 
 func (s *Server) InitializeRoutes() *http.ServeMux {
 	mux := http.NewServeMux()
 
-	// static web app / client
+	// Static web app/client
 	mux.HandleFunc("GET /", s.handleStatic)
 
-	// app functionality
+	// App functionality
 	mux.HandleFunc("POST /ping/{target}", s.sendPing)
 	mux.HandleFunc("GET /ping", s.fetchPings)
 
-	// auth
+	// Auth
 	mux.HandleFunc("POST /login", s.login)
 
-	// TODO: oauth handlers
-	// mux.HandleFunc("GET /oauth/client-metadata.json", r.handleOAuthMetadata)
-	// mux.HandleFunc("GET /oauth/jwks.json", r.handleJwks)
-	// mux.HandleFunc("GET /oauth/callback", r.handleOAuthCallback)
+	return mux
+}
+
+func (s *Server) handleStatic(w http.ResponseWriter, req *http.Request) {
+	http.ServeFile(w, req, "client")
+}
+
+func (s *Server) sendPing(w http.ResponseWriter, req *http.Request) {
+	target := req.PathValue("target")
+
+	err := s.pings.SendPing(req.Context(), target)
+	if err != nil {
+		handleErr(w, err)
+		return
+	}
+
+	w.WriteHeader(http.StatusNoContent)
+}
+
+func (s *Server) fetchPings(w http.ResponseWriter, req *http.Request) {
+	pings, err := s.pings.FetchPings(req.Context())
+	if err != nil {
+		handleErr(w, err)
+		return
+	}
+
+	output := struct {
+		Pings []ping.Ping `json:"pings"`
+	}{Pings: pings}
+
+	bytes, err := json.Marshal(output)
+	if err != nil {
+		handleErr(w, err)
+		return
+	}
 
-	return mux
+	_, err = w.Write(bytes)
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "failed to write response: "+err.Error())
+	}
 }
 
-// Static assets (i.e. the client application).
-func (*Server) handleStatic(w http.ResponseWriter, req *http.Request) {
-	http.ServeFile(w, req, "public")
+func (s *Server) login(w http.ResponseWriter, req *http.Request) {
+	user := req.FormValue("username")
+	pass := req.FormValue("password")
+
+	fmt.Fprintln(os.Stderr, "Attempting login as `"+user+"`")
+
+	var authFactorToken *string
+	if req.Form.Has("authFactorToken") {
+		tok := req.FormValue("authFactorToken")
+		authFactorToken = &tok
+	}
+
+	did, err := s.client.Login(req.Context(), user, pass, authFactorToken)
+	if err != nil {
+		handleErr(w, err)
+		return
+	}
+
+	// for now, just create a key and publish it on every login. In the future
+	// this private key should live in sqlite db instead or something,
+	// so we don't need to republish it every time lmao. Also we should in theory
+	// make this more of an update than a replace but it's fine for now
+	if err = s.keys.GenAndPublishKeyPair(req.Context(), did.DID.String()); err != nil {
+		http.Error(
+			w,
+			"Failed to create profile record: "+err.Error(),
+			http.StatusInternalServerError,
+		)
+		return
+	}
+
+	// TODO set some auth cookies or something, SPA style or redirect?
+	bytes, err := json.Marshal(did.DIDDocument())
+	if err != nil {
+		http.Error(w, "failed to encode DID document as JSON: "+err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	_, err = w.Write(bytes)
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "failed to write JSON response: "+err.Error())
+	}
+}
+
+func handleErr(w http.ResponseWriter, err error) {
+	var xErr *xrpc.Error
+	if errors.As(err, &xErr) {
+		// Hmm maybe this should be a 50x or certain codes should translate...
+		http.Error(w, xErr.Error(), xErr.StatusCode)
+		return
+	}
+
+	var hErr *errs.Http
+	if errors.As(err, &hErr) {
+		http.Error(w, hErr.Message, hErr.Code)
+		return
+	}
+
+	http.Error(w, err.Error(), http.StatusInternalServerError)
 }

internal/server/send_ping.go internal/ping/send_ping.go

···
-package appview
+package ping
 
 import (
 	"bytes"
 	"context"
 	"crypto/rand"
 	"encoding/hex"
-	"encoding/json"
+	"errors"
 	"fmt"
-	"net/http"
 	"os"
 
 	"atyo.app/api"
 	"atyo.app/api/atyo"
-	"github.com/bluesky-social/indigo/api/atproto"
 	"github.com/bluesky-social/indigo/atproto/identity"
 	"github.com/bluesky-social/indigo/atproto/syntax"
 	"github.com/bluesky-social/indigo/lex/util"
···
 
 // Basic ping functionality.
 // - `target` should be a DID or handle
-func (s *Server) sendPing(w http.ResponseWriter, req *http.Request) {
-	fmt.Fprintln(os.Stderr, "got request for ping to `"+req.PathValue("target")+"`")
-
-	targetId, hErr := s.lookupId(req.Context(), req.PathValue("target"))
-	if hErr != nil {
-		http.Error(w, hErr.Message, hErr.Code)
-	}
+func (c *Client) SendPing(ctx context.Context, target string) error {
+	fmt.Fprintln(os.Stderr, "got request for ping to `"+target+"`")
 
-	ping, hErr := s.buildPing(req.Context(), targetId)
-	if hErr != nil {
-		http.Error(w, hErr.Error(), hErr.Code)
-		return
+	targetId, err := c.directory.LookupID(ctx, target)
+	if err != nil {
+		return fmt.Errorf("failed to lookup %q: %w", target, err)
 	}
 
-	jsonPing, err := json.Marshal(ping)
+	ping, err := c.buildPing(ctx, targetId)
 	if err != nil {
-		http.Error(
-			w,
-			"Failed to serialize ping: "+err.Error(),
-			http.StatusInternalServerError,
-		)
-		return
+		return fmt.Errorf("failed to create ping: %w", err)
 	}
 
-	_, err = atproto.RepoPutRecord(
-		req.Context(),
-		s.authenticatedClient,
-		&atproto.RepoPutRecord_Input{
-			Collection: api.PingNSID,
-			Record:     &util.LexiconTypeDecoder{Val: ping},
-			Repo:       s.authenticatedClient.Auth.Did,
-			Rkey:       s.tidClock.Next().String(),
-		},
+	err = c.auth.PutRecord(
+		ctx,
+		api.PingNSID,
+		&util.LexiconTypeDecoder{Val: ping},
+		c.tids.Next().String(),
 	)
 	if err != nil {
-		http.Error(w, "failed to put record: "+err.Error(), http.StatusInternalServerError)
-		return
+		return fmt.Errorf("failed to write ping record: %w", err)
 	}
 
-	_, err = w.Write(jsonPing)
-	if err != nil {
-		fmt.Fprintln(os.Stderr, err)
-	}
+	return nil
 }
 
 const (
···
 //
 // Roughly based on the Scuttlebutt protocol for pivate messages:
 // https://ssbc.github.io/scuttlebutt-protocol-guide/#private-messages
-func (s *Server) buildPing(ctx context.Context, target *identity.Identity) (*atyo.Ping, *httpError) {
+func (c *Client) buildPing(ctx context.Context, target *identity.Identity) (*atyo.Ping, error) {
 	// NOTE: CBOR marshaller needs to serialize Ping_Empty{} directly,
 	// while the JSON serializer needs Ping_Contents{}. Just an odd quirk
 	emptyPing := &atyo.Ping_Empty{}
···
 	var secretMessage bytes.Buffer
 	err := emptyPing.MarshalCBOR(&secretMessage)
 	if err != nil {
-		return nil, &httpError{
-			http.StatusInternalServerError,
-			"failed to marshal ping contents as CBOR",
-		}
+		return nil, errors.New("failed to marshal ping contents as CBOR")
 	}
 
 	// This nonce is actually used once with the shared secret and once
···
 
 	ephemeralPubKey, ephemeralPrivKey, err := box.GenerateKey(rand.Reader)
 	if err != nil {
-		return nil, &httpError{
-			http.StatusInternalServerError,
-			"failed to generate shared keypair",
-		}
+		return nil, errors.New("failed to generate shared keypair")
 	}
 
-	targetPubkey, err := s.keys.fetchUserPubKey(ctx, target)
+	targetPubkey, err := c.keys.fetchUserPubKey(ctx, target)
 	if err != nil {
-		return nil, &httpError{
-			http.StatusNotFound,
-			"Could not find atyo.app id for `" + target.Handle.String() + "`: " + err.Error(),
-		}
+		return nil, fmt.Errorf("Could not find atyo.app ID for %q: %w", target, err)
 	}
 
 	const numRecipients = 1

public/index.html client/index.html

···
             throw new Error(`response status: ${response.status}: ${body}`);
           }
 
-          const result = await response.json();
-          status.textContent += "Success! ";
-          status.textContent += JSON.stringify(result, null, "  ");
+          status.textContent += "Success!";
+          if (response.status != 204) {
+            const result = await response.json();
+            status.textContent += "\n" + JSON.stringify(result, null, "  ");
+          }
         } catch (err) {
           status.textContent += `${err}`;
         }