checkpooint

server/main.go

···
 	userSessions = map[string]Session{}
 )
 
+// Session represents a minimal legacy session persisted via cookie for
+// non-OAuth flows and for compatibility with older endpoints.
+type Session struct {
+	DID        string `json:"did"`
+	Handle     string `json:"handle"`
+	AccessJWT  string `json:"accessJwt,omitempty"`
+	RefreshJWT string `json:"refreshJwt,omitempty"`
+}
+
+// handleATPSession manages a simple server-backed session store for Bluesky.
+// Client obtains tokens via @atproto/api then POSTs here to persist server-side.
+// Methods:
+//   - GET: return current session (handle, did) or 204 if none
+//   - POST: set/replace session from JSON body {did, handle, accessJwt, refreshJwt}
+//   - DELETE: clear session
+func handleATPSession(w http.ResponseWriter, r *http.Request) {
+    w.Header().Set("Content-Type", "application/json; charset=utf-8")
+    sid := getOrCreateSessionID(w, r)
+
+    switch r.Method {
+    case http.MethodGet:
+        sessionsMu.Lock()
+        s, ok := userSessions[sid]
+        sessionsMu.Unlock()
+        if !ok || s.DID == "" {
+            w.WriteHeader(http.StatusNoContent)
+            return
+        }
+        _ = json.NewEncoder(w).Encode(s)
+    case http.MethodPost:
+        // Limit body size for session payload
+        r.Body = http.MaxBytesReader(w, r.Body, 16<<10) // 16 KiB
+        var s Session
+        if err := json.NewDecoder(r.Body).Decode(&s); err != nil {
+            http.Error(w, "invalid json", http.StatusBadRequest)
+            return
+        }
+        if s.Handle == "" || s.DID == "" {
+            http.Error(w, "missing did/handle", http.StatusBadRequest)
+            return
+        }
+        sessionsMu.Lock()
+        userSessions[sid] = s
+        sessionsMu.Unlock()
+        w.WriteHeader(http.StatusNoContent)
+    case http.MethodDelete:
+        sessionsMu.Lock()
+        delete(userSessions, sid)
+        sessionsMu.Unlock()
+        w.WriteHeader(http.StatusNoContent)
+    default:
+        w.WriteHeader(http.StatusMethodNotAllowed)
+    }
+}
+
 // resolveHandle resolves a Bluesky handle to a DID using the public AppView endpoint.
 func resolveHandle(handle string) (string, error) {
 	u := "https://bsky.social/xrpc/com.atproto.identity.resolveHandle?handle=" + url.QueryEscape(handle)
···
 			if len(pb) > 0 { _, _ = w.Write(pb) }
 			return
 		}
-		w.WriteHeader(http.StatusNoContent)
+		// Verify by re-reading the record and (best-effort) the blob
+		verifyURL := pdsBaseFromUser(r) + "/xrpc/com.atproto.repo.getRecord?repo=" + s.DID + "&collection=lol.tapapp.tap.doc&rkey=" + id
+		vRes, vErr := pdsRequest(w, r, http.MethodGet, verifyURL, "", nil)
+		if vErr != nil {
+			http.Error(w, "verify failed", http.StatusBadGateway)
+			return
+		}
+		defer vRes.Body.Close()
+		if vRes.StatusCode < 200 || vRes.StatusCode >= 300 {
+			w.WriteHeader(http.StatusBadGateway)
+			return
+		}
+		var vRec struct { Value map[string]any `json:"value"` }
+		if e := json.NewDecoder(vRes.Body).Decode(&vRec); e != nil {
+			http.Error(w, "verify decode failed", http.StatusBadGateway)
+			return
+		}
+		var txt string
+		if cb, ok := vRec.Value["contentBlob"].(map[string]any); ok {
+			if ref, ok := cb["ref"].(map[string]any); ok {
+				if l, ok := ref["$link"].(string); ok && l != "" {
+					blobURL := pdsBaseFromUser(r) + "/xrpc/com.atproto.sync.getBlob?did=" + s.DID + "&cid=" + l
+					br, be := pdsRequest(w, r, http.MethodGet, blobURL, "", nil)
+					if be == nil && br.StatusCode >= 200 && br.StatusCode < 300 {
+						defer br.Body.Close()
+						bbuf := new(bytes.Buffer)
+						_, _ = bbuf.ReadFrom(br.Body)
+						txt = bbuf.String()
+					}
+				}
+			}
+		}
+		w.Header().Set("Content-Type", "application/json; charset=utf-8")
+		_ = json.NewEncoder(w).Encode(map[string]any{
+			"id": id,
+			"name": vRec.Value["name"],
+			"text": txt,
+			"updatedAt": vRec.Value["updatedAt"],
+		})
+		return
 	case http.MethodDelete:
 		// Delete the record for this rkey
 		delPayload := map[string]any{
···
 	}
 }
 
-// handleATPSession manages a simple server-backed session store for Bluesky.
-// Client obtains tokens via @atproto/api then POSTs here to persist server-side.
-// Methods:
-//   - GET: return current session (handle, did) or 204 if none
-//   - POST: set/replace session from JSON body {did, handle, accessJwt, refreshJwt}
-//   - DELETE: clear session
-func handleATPSession(w http.ResponseWriter, r *http.Request) {
-	w.Header().Set("Content-Type", "application/json; charset=utf-8")
-	sid := getOrCreateSessionID(w, r)
-
-	switch r.Method {
-	case http.MethodGet:
-		sessionsMu.Lock()
-		s, ok := userSessions[sid]
-		sessionsMu.Unlock()
-		if !ok || s.DID == "" {
-			w.WriteHeader(http.StatusNoContent)
-			return
-		}
-		_ = json.NewEncoder(w).Encode(s)
-	case http.MethodPost:
-		// Limit body size for session payload
-		r.Body = http.MaxBytesReader(w, r.Body, 16<<10) // 16 KiB
-		var s Session
-		if err := json.NewDecoder(r.Body).Decode(&s); err != nil {
-			http.Error(w, "invalid json", http.StatusBadRequest)
-			return
-		}
-		if s.Handle == "" || s.DID == "" {
-			http.Error(w, "missing did/handle", http.StatusBadRequest)
-			return
-		}
-		sessionsMu.Lock()
-		userSessions[sid] = s
-		sessionsMu.Unlock()
-		w.WriteHeader(http.StatusNoContent)
-	case http.MethodDelete:
-		sessionsMu.Lock()
-		delete(userSessions, sid)
-		sessionsMu.Unlock()
-		w.WriteHeader(http.StatusNoContent)
-	default:
-		w.WriteHeader(http.StatusMethodNotAllowed)
-	}
-}
-
 // handleATPPost posts a simple text note to Bluesky using the stored session.
 // Body: { "text": "..." }
 func handleATPPost(w http.ResponseWriter, r *http.Request) {
···
 		return
 	}
 	defer blobRes.Body.Close()
-	var blobResp struct {
-		Blob map[string]any `json:"blob"`
-	}
+	var blobResp struct { Blob map[string]any `json:"blob"` }
 	if err := json.NewDecoder(blobRes.Body).Decode(&blobResp); err != nil {
 		http.Error(w, "blob decode failed", http.StatusBadGateway)
 		return
 	}
 
-	// 2) Build record referencing the blob and upsert at fixed rkey "current"
+	// 2) Upsert at fixed rkey "current"
 	record := map[string]any{
 		"$type":       "lol.tapapp.tap.doc",
 		"contentBlob": blobResp.Blob,
 		"updatedAt":   time.Now().UTC().Format(time.RFC3339Nano),
 	}
 	putPayload := map[string]any{
-		"repo":       s.DID,
-		"collection": "lol.tapapp.tap.doc",
-		"rkey":       "current",
-		"record":     record,
+		"repo": s.DID, "collection": "lol.tapapp.tap.doc", "rkey": "current", "record": record,
 	}
-	putBuf, _ := json.Marshal(putPayload)
+	pbuf, _ := json.Marshal(putPayload)
 	putURL := pdsBaseFromUser(r) + "/xrpc/com.atproto.repo.putRecord"
-	putRes, err := pdsRequest(w, r, http.MethodPost, putURL, "application/json", putBuf)
-	if err == nil && putRes.StatusCode >= 200 && putRes.StatusCode < 300 {
-		defer putRes.Body.Close()
+	pRes, err := pdsRequest(w, r, http.MethodPost, putURL, "application/json", pbuf)
+	if err == nil && pRes.StatusCode >= 200 && pRes.StatusCode < 300 {
+		defer pRes.Body.Close()
 		w.WriteHeader(http.StatusNoContent)
 		return
 	}
-	if putRes != nil {
-		defer putRes.Body.Close()
-	}
+	if pRes != nil { defer pRes.Body.Close() }
 
-	// 3) If put failed (e.g., not found), try create with fixed rkey
+	// 3) Fallback to create
 	createPayload := map[string]any{
-		"repo":       s.DID,
-		"collection": "lol.tapapp.tap.doc",
-		"rkey":       "current",
-		"record":     record,
+		"repo": s.DID, "collection": "lol.tapapp.tap.doc", "rkey": "current", "record": record,
 	}
-	createBuf, _ := json.Marshal(createPayload)
+	cbuf, _ := json.Marshal(createPayload)
 	createURL := pdsBaseFromUser(r) + "/xrpc/com.atproto.repo.createRecord"
-	createRes, err := pdsRequest(w, r, http.MethodPost, createURL, "application/json", createBuf)
+	cRes, err := pdsRequest(w, r, http.MethodPost, createURL, "application/json", cbuf)
 	if err != nil {
 		http.Error(w, "create failed", http.StatusBadGateway)
 		return
 	}
-	defer createRes.Body.Close()
-	w.WriteHeader(createRes.StatusCode)
-	_, _ = w.Write([]byte("{}"))
-}
-
-type Session struct {
-	DID        string `json:"did"`
-	Handle     string `json:"handle"`
-	AccessJWT  string `json:"accessJwt,omitempty"`
-	RefreshJWT string `json:"refreshJwt,omitempty"`
+	defer cRes.Body.Close()
+	w.WriteHeader(cRes.StatusCode)
 }
 
 func main() {

server/pdf.go

···
 
 // getDocNameAndText fetches name and text for a document rkey from ATProto
 func getDocNameAndText(w http.ResponseWriter, r *http.Request, ctx context.Context, s Session, id string) (name, text string, status int, err error) {
-	// getRecord for rkey id
-	url := "https://bsky.social/xrpc/com.atproto.repo.getRecord?repo=" + s.DID + "&collection=lol.tapapp.tap.doc&rkey=" + id
-	req, _ := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
-	resp, err := authedDo(w, r, req)
+	// getRecord for rkey id via user's PDS
+	url := pdsBaseFromUser(r) + "/xrpc/com.atproto.repo.getRecord?repo=" + s.DID + "&collection=lol.tapapp.tap.doc&rkey=" + id
+	resp, err := pdsRequest(w, r, http.MethodGet, url, "", nil)
 	if err != nil {
 		return "", "", http.StatusBadGateway, err
 	}
···
 		}
 	}
 	if cid != "" {
-		blobURL := "https://bsky.social/xrpc/com.atproto.sync.getBlob?did=" + s.DID + "&cid=" + cid
-		bReq, _ := http.NewRequestWithContext(ctx, http.MethodGet, blobURL, nil)
-		bRes, err := authedDo(w, r, bReq)
+		blobURL := pdsBaseFromUser(r) + "/xrpc/com.atproto.sync.getBlob?did=" + s.DID + "&cid=" + cid
+		bRes, err := pdsRequest(w, r, http.MethodGet, blobURL, "", nil)
 		if err == nil && bRes.StatusCode >= 200 && bRes.StatusCode < 300 {
 			defer bRes.Body.Close()
 			buf := new(bytes.Buffer)
···
 			text = buf.String()
 		} else if bRes != nil {
 			// retry once for 5xx
-			status := bRes.StatusCode
+			st := bRes.StatusCode
 			bRes.Body.Close()
-			if status >= 500 {
-				bReq2, _ := http.NewRequestWithContext(ctx, http.MethodGet, blobURL, nil)
-				if bRes2, err2 := authedDo(w, r, bReq2); err2 == nil && bRes2.StatusCode >= 200 && bRes2.StatusCode < 300 {
+			if st >= 500 {
+				if bRes2, err2 := pdsRequest(w, r, http.MethodGet, blobURL, "", nil); err2 == nil && bRes2.StatusCode >= 200 && bRes2.StatusCode < 300 {
 					defer bRes2.Body.Close()
 					buf := new(bytes.Buffer)
 					_, _ = buf.ReadFrom(bRes2.Body)