microcosm.blue / microcosm-rs
Constellation, Spacedust, Slingshot, UFOs: atproto crates and services for microcosm
fork atom

Compare changes

Choose any two refs to compare.

options
unified split
Changed files
+13084 -1282
.github
FUNDING.yml
workflows
build.yml
checks.yml
Cargo.lock
Cargo.toml
Makefile
constellation
Cargo.toml
LICENSE
LICENSE.future
readme.md
src
bin
main.rs
server
filters.rs
mod.rs
storage
mem_store.rs
mod.rs
rocks_store.rs
templates
dids.html.j2
get-backlinks.html.j2
get-many-to-many-counts.html.j2
hello.html.j2
links.html.j2
try-it-macros.html.j2
cozy-setup (move to another repo).md
jetstream
Cargo.toml
src
error.rs
events.rs
lib.rs
legacy
cozy-setup (move to another repo).md
old-readme-details.md
original-notes.md
ufos ops (move to micro-ops).md
links
Cargo.toml
src
lib.rs
record.rs
pocket
.gitignore
Cargo.toml
api-description.md
src
lib.rs
main.rs
server.rs
storage.rs
token.rs
static
index.html
quasar
Cargo.toml
readme.md
src
lib.rs
main.rs
storage.rs
readme.md
reflector
Cargo.toml
readme.md
src
main.rs
slingshot
.gitignore
Cargo.toml
api-description.md
readme.md
src
consumer.rs
error.rs
firehose_cache.rs
healthcheck.rs
identity.rs
lib.rs
main.rs
record.rs
server.rs
static
favicon.ico
index.html
spacedust
Cargo.toml
src
bin
import_car_file.rs
import_scraped.rs
scrape_pds.rs
consumer.rs
delay.rs
error.rs
lib.rs
main.rs
removable_delay_queue.rs
server.rs
storage
car
drive.rs
mod.rs
walk.rs
fjall
mod.rs
mod.rs
subscriber.rs
static
favicon.ico
index.html
ufos
Cargo.toml
src
consumer.rs
db_types.rs
index_html.rs
lib.rs
main.rs
server
collections_query.rs
mod.rs
storage.rs
storage_fjall.rs
who-am-i
.gitignore
Cargo.toml
demo
index.html
serve
readme.md
src
expiring_task_map.rs
jwt.rs
lib.rs
main.rs
oauth.rs
server.rs
static
favicon.ico
style.css
templates
auth-fail.hbs
authorized.hbs
base-base.hbs
base-framed.hbs
base-full.hbs
hello.hbs
prompt-error.hbs
prompt.hbs
+15
.github/FUNDING.yml
··· 1 + # These are supported funding model platforms 2 + 3 + github: uniphil 4 + patreon: # Replace with a single Patreon username 5 + open_collective: # Replace with a single Open Collective username 6 + ko_fi: # Replace with a single Ko-fi username 7 + tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel 8 + community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry 9 + liberapay: # Replace with a single Liberapay username 10 + issuehunt: # Replace with a single IssueHunt username 11 + lfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry 12 + polar: # Replace with a single Polar username 13 + buy_me_a_coffee: # Replace with a single Buy Me a Coffee username 14 + thanks_dev: # Replace with a single thanks.dev username 15 + custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2']
+21
.github/workflows/build.yml
··· 1 + name: Build 2 + 3 + on: 4 + push: 5 + tags: 6 + - "reflector-v*.*.*" 7 + 8 + jobs: 9 + build: 10 + runs-on: ubuntu-latest 11 + permissions: 12 + contents: write 13 + 14 + steps: 15 + - uses: actions/checkout@v4 16 + - name: build reflector 17 + run: cargo build --bin reflector --release && mv target/release/reflector target/release/reflector_amd64 18 + - name: release 19 + uses: softprops/action-gh-release@v2 20 + with: 21 + files: target/release/reflector_amd64
+4 -2
.github/workflows/checks.yml
··· 16 16 - uses: actions/checkout@v4 17 17 - name: Build lib 18 18 run: cargo build --verbose 19 + - name: Check (default features) 20 + run: cargo check 19 21 - name: Run tests 20 - run: cargo test --verbose 22 + run: cargo test --all-features --verbose 21 23 22 24 style: 23 25 runs-on: ubuntu-24.04 ··· 26 28 - name: get nightly toolchain for jetstream fmt 27 29 run: rustup toolchain install nightly --allow-downgrade -c rustfmt 28 30 - name: fmt 29 - run: cargo fmt --package links --package constellation --package ufos -- --check 31 + run: cargo fmt --package links --package constellation --package ufos --package spacedust --package who-am-i --package slingshot --package pocket -- --check 30 32 - name: fmt jetstream (nightly) 31 33 run: cargo +nightly fmt --package jetstream -- --check 32 34 - name: clippy
+2923 -270
Cargo.lock
··· 24 24 checksum = "e89da841a80418a9b391ebaea17f5c112ffaaa96f621d2c285b5174da76b9011" 25 25 dependencies = [ 26 26 "cfg-if", 27 + "getrandom 0.2.15", 27 28 "once_cell", 28 29 "version_check", 29 30 "zerocopy 0.7.35", ··· 111 112 112 113 [[package]] 113 114 name = "anyhow" 114 - version = "1.0.97" 115 + version = "1.0.100" 115 116 source = "registry+https://github.com/rust-lang/crates.io-index" 116 - checksum = "dcfed56ad506cb2c684a14971b8861fdc3baaaae314b9e5f9bb532cbe3ba7a4f" 117 + checksum = "a23eb6b1614318a8071c9b2521f36b424b2c83db5eb3a0fead4a6c0809af6e61" 117 118 118 119 [[package]] 119 120 name = "arbitrary" ··· 122 123 checksum = "dde20b3d026af13f561bdd0f15edf01fc734f0dafcedbaf42bba506a9517f223" 123 124 124 125 [[package]] 126 + name = "arc-swap" 127 + version = "1.7.1" 128 + source = "registry+https://github.com/rust-lang/crates.io-index" 129 + checksum = "69f7f8c3906b62b754cd5326047894316021dcfe5a194c8ea52bdd94934a3457" 130 + 131 + [[package]] 132 + name = "arrayref" 133 + version = "0.3.9" 134 + source = "registry+https://github.com/rust-lang/crates.io-index" 135 + checksum = "76a2e8124351fda1ef8aaaa3bbd7ebbcb486bbcd4225aca0aa0d84bb2db8fecb" 136 + 137 + [[package]] 125 138 name = "arrayvec" 126 139 version = "0.7.6" 127 140 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 155 168 "proc-macro2", 156 169 "quote", 157 170 "serde", 158 - "syn", 171 + "syn 2.0.106", 159 172 ] 160 173 161 174 [[package]] ··· 174 187 ] 175 188 176 189 [[package]] 190 + name = "asn1-rs" 191 + version = "0.7.1" 192 + source = "registry+https://github.com/rust-lang/crates.io-index" 193 + checksum = "56624a96882bb8c26d61312ae18cb45868e5a9992ea73c58e45c3101e56a1e60" 194 + dependencies = [ 195 + "asn1-rs-derive", 196 + "asn1-rs-impl", 197 + "displaydoc", 198 + "nom", 199 + "num-traits", 200 + "rusticata-macros", 201 + "thiserror 2.0.17", 202 + "time", 203 + ] 204 + 205 + [[package]] 206 + name = "asn1-rs-derive" 207 + version = "0.6.0" 208 + source = "registry+https://github.com/rust-lang/crates.io-index" 209 + checksum = "3109e49b1e4909e9db6515a30c633684d68cdeaa252f215214cb4fa1a5bfee2c" 210 + dependencies = [ 211 + "proc-macro2", 212 + "quote", 213 + "syn 2.0.106", 214 + "synstructure", 215 + ] 216 + 217 + [[package]] 218 + name = "asn1-rs-impl" 219 + version = "0.2.0" 220 + source = "registry+https://github.com/rust-lang/crates.io-index" 221 + checksum = "7b18050c2cd6fe86c3a76584ef5e0baf286d038cda203eb6223df2cc413565f7" 222 + dependencies = [ 223 + "proc-macro2", 224 + "quote", 225 + "syn 2.0.106", 226 + ] 227 + 228 + [[package]] 229 + name = "async-channel" 230 + version = "2.5.0" 231 + source = "registry+https://github.com/rust-lang/crates.io-index" 232 + checksum = "924ed96dd52d1b75e9c1a3e6275715fd320f5f9439fb5a4a11fa51f4221158d2" 233 + dependencies = [ 234 + "concurrent-queue", 235 + "event-listener-strategy", 236 + "futures-core", 237 + "pin-project-lite", 238 + ] 239 + 240 + [[package]] 241 + name = "async-compression" 242 + version = "0.4.25" 243 + source = "registry+https://github.com/rust-lang/crates.io-index" 244 + checksum = "40f6024f3f856663b45fd0c9b6f2024034a702f453549449e0d84a305900dad4" 245 + dependencies = [ 246 + "flate2", 247 + "futures-core", 248 + "memchr", 249 + "pin-project-lite", 250 + "tokio", 251 + ] 252 + 253 + [[package]] 177 254 name = "async-lock" 178 255 version = "3.4.0" 179 256 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 203 280 dependencies = [ 204 281 "proc-macro2", 205 282 "quote", 206 - "syn", 283 + "syn 2.0.106", 207 284 ] 208 285 209 286 [[package]] 287 + name = "async-task" 288 + version = "4.7.1" 289 + source = "registry+https://github.com/rust-lang/crates.io-index" 290 + checksum = "8b75356056920673b02621b35afd0f7dda9306d03c79a30f5c56c44cf256e3de" 291 + 292 + [[package]] 210 293 name = "async-trait" 211 294 version = "0.1.88" 212 295 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 214 297 dependencies = [ 215 298 "proc-macro2", 216 299 "quote", 217 - "syn", 300 + "syn 2.0.106", 218 301 ] 219 302 220 303 [[package]] ··· 225 308 226 309 [[package]] 227 310 name = "atrium-api" 228 - version = "0.25.3" 229 - source = "git+https://github.com/uniphil/atrium?branch=fix%2Fnsid-allow-nonleading-name-digits#c4364f318d337bbc3e3e3aaf97c9f971e95f5f7e" 311 + version = "0.25.4" 312 + source = "registry+https://github.com/rust-lang/crates.io-index" 313 + checksum = "46355d3245edc7b3160b2a45fe55d09a6963ebd3eee0252feb6b72fb0eb71463" 230 314 dependencies = [ 231 - "atrium-common", 232 - "atrium-xrpc", 315 + "atrium-common 0.1.2 (registry+https://github.com/rust-lang/crates.io-index)", 316 + "atrium-xrpc 0.12.3 (registry+https://github.com/rust-lang/crates.io-index)", 233 317 "chrono", 234 318 "http", 235 319 "ipld-core", ··· 239 323 "serde_bytes", 240 324 "serde_json", 241 325 "thiserror 1.0.69", 326 + "tokio", 327 + "trait-variant", 328 + ] 329 + 330 + [[package]] 331 + name = "atrium-api" 332 + version = "0.25.4" 333 + source = "git+https://github.com/uniphil/atrium.git?branch=fix%2Fresolve-handle-https-accept-whitespace#80a355991ac9b48ba3f559d12aac74f071fc638c" 334 + dependencies = [ 335 + "atrium-common 0.1.2 (git+https://github.com/uniphil/atrium.git?branch=fix%2Fresolve-handle-https-accept-whitespace)", 336 + "atrium-xrpc 0.12.3 (git+https://github.com/uniphil/atrium.git?branch=fix%2Fresolve-handle-https-accept-whitespace)", 337 + "chrono", 338 + "http", 339 + "ipld-core", 340 + "langtag", 341 + "regex", 342 + "serde", 343 + "serde_bytes", 344 + "serde_json", 345 + "thiserror 1.0.69", 346 + "tokio", 242 347 "trait-variant", 243 348 ] 244 349 245 350 [[package]] 246 351 name = "atrium-common" 247 352 version = "0.1.2" 248 - source = "git+https://github.com/uniphil/atrium?branch=fix%2Fnsid-allow-nonleading-name-digits#c4364f318d337bbc3e3e3aaf97c9f971e95f5f7e" 353 + source = "registry+https://github.com/rust-lang/crates.io-index" 354 + checksum = "9ed5610654043faa396a5a15afac0ac646d76aebe45aebd7cef4f8b96b0ab7f4" 249 355 dependencies = [ 250 356 "dashmap", 251 357 "lru", ··· 257 363 ] 258 364 259 365 [[package]] 366 + name = "atrium-common" 367 + version = "0.1.2" 368 + source = "git+https://github.com/uniphil/atrium.git?branch=fix%2Fresolve-handle-https-accept-whitespace#80a355991ac9b48ba3f559d12aac74f071fc638c" 369 + dependencies = [ 370 + "dashmap", 371 + "lru", 372 + "moka", 373 + "thiserror 1.0.69", 374 + "tokio", 375 + "trait-variant", 376 + "web-time", 377 + ] 378 + 379 + [[package]] 380 + name = "atrium-crypto" 381 + version = "0.1.2" 382 + source = "registry+https://github.com/rust-lang/crates.io-index" 383 + checksum = "73a3da430c71dd9006d61072c20771f264e5c498420a49c32305ceab8bd71955" 384 + dependencies = [ 385 + "ecdsa", 386 + "k256", 387 + "multibase", 388 + "p256", 389 + "thiserror 1.0.69", 390 + ] 391 + 392 + [[package]] 393 + name = "atrium-identity" 394 + version = "0.1.5" 395 + source = "registry+https://github.com/rust-lang/crates.io-index" 396 + checksum = "c9e2d42bb4dbea038f4f5f45e3af2a89d61a9894a75f06aa550b74a60d2be380" 397 + dependencies = [ 398 + "atrium-api 0.25.4 (registry+https://github.com/rust-lang/crates.io-index)", 399 + "atrium-common 0.1.2 (registry+https://github.com/rust-lang/crates.io-index)", 400 + "atrium-xrpc 0.12.3 (registry+https://github.com/rust-lang/crates.io-index)", 401 + "serde", 402 + "serde_html_form", 403 + "serde_json", 404 + "thiserror 1.0.69", 405 + "trait-variant", 406 + ] 407 + 408 + [[package]] 409 + name = "atrium-identity" 410 + version = "0.1.5" 411 + source = "git+https://github.com/uniphil/atrium.git?branch=fix%2Fresolve-handle-https-accept-whitespace#80a355991ac9b48ba3f559d12aac74f071fc638c" 412 + dependencies = [ 413 + "atrium-api 0.25.4 (git+https://github.com/uniphil/atrium.git?branch=fix%2Fresolve-handle-https-accept-whitespace)", 414 + "atrium-common 0.1.2 (git+https://github.com/uniphil/atrium.git?branch=fix%2Fresolve-handle-https-accept-whitespace)", 415 + "atrium-xrpc 0.12.3 (git+https://github.com/uniphil/atrium.git?branch=fix%2Fresolve-handle-https-accept-whitespace)", 416 + "serde", 417 + "serde_html_form", 418 + "serde_json", 419 + "thiserror 1.0.69", 420 + "trait-variant", 421 + ] 422 + 423 + [[package]] 424 + name = "atrium-oauth" 425 + version = "0.1.3" 426 + source = "registry+https://github.com/rust-lang/crates.io-index" 427 + checksum = "ca22dc4eaf77fd9bf050b21192ac58cd654a437d28e000ec114ebd93a51d36f5" 428 + dependencies = [ 429 + "atrium-api 0.25.4 (registry+https://github.com/rust-lang/crates.io-index)", 430 + "atrium-common 0.1.2 (registry+https://github.com/rust-lang/crates.io-index)", 431 + "atrium-identity 0.1.5 (registry+https://github.com/rust-lang/crates.io-index)", 432 + "atrium-xrpc 0.12.3 (registry+https://github.com/rust-lang/crates.io-index)", 433 + "base64 0.22.1", 434 + "chrono", 435 + "dashmap", 436 + "ecdsa", 437 + "elliptic-curve", 438 + "jose-jwa", 439 + "jose-jwk", 440 + "p256", 441 + "rand 0.8.5", 442 + "reqwest", 443 + "serde", 444 + "serde_html_form", 445 + "serde_json", 446 + "sha2", 447 + "thiserror 1.0.69", 448 + "tokio", 449 + "trait-variant", 450 + ] 451 + 452 + [[package]] 453 + name = "atrium-oauth" 454 + version = "0.1.3" 455 + source = "git+https://github.com/uniphil/atrium.git?branch=fix%2Fresolve-handle-https-accept-whitespace#80a355991ac9b48ba3f559d12aac74f071fc638c" 456 + dependencies = [ 457 + "atrium-api 0.25.4 (git+https://github.com/uniphil/atrium.git?branch=fix%2Fresolve-handle-https-accept-whitespace)", 458 + "atrium-common 0.1.2 (git+https://github.com/uniphil/atrium.git?branch=fix%2Fresolve-handle-https-accept-whitespace)", 459 + "atrium-identity 0.1.5 (git+https://github.com/uniphil/atrium.git?branch=fix%2Fresolve-handle-https-accept-whitespace)", 460 + "atrium-xrpc 0.12.3 (git+https://github.com/uniphil/atrium.git?branch=fix%2Fresolve-handle-https-accept-whitespace)", 461 + "base64 0.22.1", 462 + "chrono", 463 + "dashmap", 464 + "ecdsa", 465 + "elliptic-curve", 466 + "jose-jwa", 467 + "jose-jwk", 468 + "p256", 469 + "rand 0.8.5", 470 + "reqwest", 471 + "serde", 472 + "serde_html_form", 473 + "serde_json", 474 + "sha2", 475 + "thiserror 1.0.69", 476 + "tokio", 477 + "trait-variant", 478 + ] 479 + 480 + [[package]] 260 481 name = "atrium-xrpc" 261 482 version = "0.12.3" 262 - source = "git+https://github.com/uniphil/atrium?branch=fix%2Fnsid-allow-nonleading-name-digits#c4364f318d337bbc3e3e3aaf97c9f971e95f5f7e" 483 + source = "registry+https://github.com/rust-lang/crates.io-index" 484 + checksum = "0216ad50ce34e9ff982e171c3659e65dedaa2ed5ac2994524debdc9a9647ffa8" 263 485 dependencies = [ 264 486 "http", 265 487 "serde", ··· 270 492 ] 271 493 272 494 [[package]] 495 + name = "atrium-xrpc" 496 + version = "0.12.3" 497 + source = "git+https://github.com/uniphil/atrium.git?branch=fix%2Fresolve-handle-https-accept-whitespace#80a355991ac9b48ba3f559d12aac74f071fc638c" 498 + dependencies = [ 499 + "http", 500 + "serde", 501 + "serde_html_form", 502 + "serde_json", 503 + "thiserror 1.0.69", 504 + "trait-variant", 505 + ] 506 + 507 + [[package]] 508 + name = "auto_enums" 509 + version = "0.8.7" 510 + source = "registry+https://github.com/rust-lang/crates.io-index" 511 + checksum = "9c170965892137a3a9aeb000b4524aa3cc022a310e709d848b6e1cdce4ab4781" 512 + dependencies = [ 513 + "derive_utils", 514 + "proc-macro2", 515 + "quote", 516 + "syn 2.0.106", 517 + ] 518 + 519 + [[package]] 273 520 name = "autocfg" 274 521 version = "1.4.0" 275 522 source = "registry+https://github.com/rust-lang/crates.io-index" 276 523 checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26" 277 524 278 525 [[package]] 526 + name = "aws-lc-rs" 527 + version = "1.13.1" 528 + source = "registry+https://github.com/rust-lang/crates.io-index" 529 + checksum = "93fcc8f365936c834db5514fc45aee5b1202d677e6b40e48468aaaa8183ca8c7" 530 + dependencies = [ 531 + "aws-lc-sys", 532 + "zeroize", 533 + ] 534 + 535 + [[package]] 536 + name = "aws-lc-sys" 537 + version = "0.29.0" 538 + source = "registry+https://github.com/rust-lang/crates.io-index" 539 + checksum = "61b1d86e7705efe1be1b569bab41d4fa1e14e220b60a160f78de2db687add079" 540 + dependencies = [ 541 + "bindgen 0.69.5", 542 + "cc", 543 + "cmake", 544 + "dunce", 545 + "fs_extra", 546 + ] 547 + 548 + [[package]] 279 549 name = "axum" 280 - version = "0.8.3" 550 + version = "0.8.4" 281 551 source = "registry+https://github.com/rust-lang/crates.io-index" 282 - checksum = "de45108900e1f9b9242f7f2e254aa3e2c029c921c258fe9e6b4217eeebd54288" 552 + checksum = "021e862c184ae977658b36c4500f7feac3221ca5da43e3f25bd04ab6c79a29b5" 283 553 dependencies = [ 284 554 "axum-core", 285 555 "bytes", ··· 338 608 "axum", 339 609 "axum-core", 340 610 "bytes", 611 + "cookie", 612 + "form_urlencoded", 341 613 "futures-util", 342 614 "headers", 343 615 "http", ··· 347 619 "pin-project-lite", 348 620 "rustversion", 349 621 "serde", 622 + "serde_html_form", 623 + "serde_path_to_error", 350 624 "tower", 351 625 "tower-layer", 352 626 "tower-service", ··· 368 642 ] 369 643 370 644 [[package]] 645 + name = "axum-template" 646 + version = "3.0.0" 647 + source = "registry+https://github.com/rust-lang/crates.io-index" 648 + checksum = "3df50f7d669bfc3a8c348f08f536fe37e7acfbeded3cfdffd2ad3d76725fc40c" 649 + dependencies = [ 650 + "axum", 651 + "handlebars", 652 + "serde", 653 + "thiserror 2.0.17", 654 + ] 655 + 656 + [[package]] 371 657 name = "backtrace" 372 658 version = "0.3.74" 373 659 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 379 665 "miniz_oxide", 380 666 "object", 381 667 "rustc-demangle", 382 - "windows-targets", 668 + "windows-targets 0.52.6", 383 669 ] 384 670 385 671 [[package]] ··· 389 675 checksum = "4cbbc9d0964165b47557570cce6c952866c2678457aca742aafc9fb771d30270" 390 676 391 677 [[package]] 678 + name = "base16ct" 679 + version = "0.2.0" 680 + source = "registry+https://github.com/rust-lang/crates.io-index" 681 + checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf" 682 + 683 + [[package]] 684 + name = "base256emoji" 685 + version = "1.0.2" 686 + source = "registry+https://github.com/rust-lang/crates.io-index" 687 + checksum = "b5e9430d9a245a77c92176e649af6e275f20839a48389859d1661e9a128d077c" 688 + dependencies = [ 689 + "const-str", 690 + "match-lookup", 691 + ] 692 + 693 + [[package]] 392 694 name = "base64" 393 695 version = "0.21.7" 394 696 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 399 701 version = "0.22.1" 400 702 source = "registry+https://github.com/rust-lang/crates.io-index" 401 703 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6" 704 + 705 + [[package]] 706 + name = "base64ct" 707 + version = "1.8.0" 708 + source = "registry+https://github.com/rust-lang/crates.io-index" 709 + checksum = "55248b47b0caf0546f7988906588779981c43bb1bc9d0c44087278f80cdb44ba" 402 710 403 711 [[package]] 404 712 name = "basic-toml" ··· 450 758 "itertools 0.12.1", 451 759 "lazy_static", 452 760 "lazycell", 761 + "log", 762 + "prettyplease", 453 763 "proc-macro2", 454 764 "quote", 455 765 "regex", 456 766 "rustc-hash 1.1.0", 457 767 "shlex", 458 - "syn", 768 + "syn 2.0.106", 769 + "which", 459 770 ] 460 771 461 772 [[package]] ··· 473 784 "regex", 474 785 "rustc-hash 1.1.0", 475 786 "shlex", 476 - "syn", 787 + "syn 2.0.106", 477 788 ] 478 789 479 790 [[package]] ··· 491 802 "regex", 492 803 "rustc-hash 2.1.1", 493 804 "shlex", 494 - "syn", 805 + "syn 2.0.106", 806 + ] 807 + 808 + [[package]] 809 + name = "bitcoin-io" 810 + version = "0.1.3" 811 + source = "registry+https://github.com/rust-lang/crates.io-index" 812 + checksum = "0b47c4ab7a93edb0c7198c5535ed9b52b63095f4e9b45279c6736cec4b856baf" 813 + 814 + [[package]] 815 + name = "bitcoin_hashes" 816 + version = "0.14.0" 817 + source = "registry+https://github.com/rust-lang/crates.io-index" 818 + checksum = "bb18c03d0db0247e147a21a6faafd5a7eb851c743db062de72018b6b7e8e4d16" 819 + dependencies = [ 820 + "bitcoin-io", 821 + "hex-conservative", 495 822 ] 496 823 497 824 [[package]] ··· 499 826 version = "2.9.0" 500 827 source = "registry+https://github.com/rust-lang/crates.io-index" 501 828 checksum = "5c8214115b7bf84099f1309324e63141d4c5d7cc26862f97a0a857dbefe165bd" 829 + 830 + [[package]] 831 + name = "blake3" 832 + version = "1.8.2" 833 + source = "registry+https://github.com/rust-lang/crates.io-index" 834 + checksum = "3888aaa89e4b2a40fca9848e400f6a658a5a3978de7be858e209cafa8be9a4a0" 835 + dependencies = [ 836 + "arrayref", 837 + "arrayvec", 838 + "cc", 839 + "cfg-if", 840 + "constant_time_eq", 841 + ] 502 842 503 843 [[package]] 504 844 name = "block-buffer" ··· 528 868 checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b" 529 869 530 870 [[package]] 871 + name = "byteorder-lite" 872 + version = "0.1.0" 873 + source = "registry+https://github.com/rust-lang/crates.io-index" 874 + checksum = "8f1fe948ff07f4bd06c30984e69f5b4899c516a3ef74f34df92a2df2ab535495" 875 + 876 + [[package]] 531 877 name = "bytes" 532 878 version = "1.10.1" 533 879 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 540 886 checksum = "6236364b88b9b6d0bc181ba374cf1ab55ba3ef97a1cb6f8cddad48a273767fb5" 541 887 542 888 [[package]] 889 + name = "byteview" 890 + version = "0.8.0" 891 + source = "registry+https://github.com/rust-lang/crates.io-index" 892 + checksum = "1e6b0e42e210b794e14b152c6fe1a55831e30ef4a0f5dc39d73d714fb5f1906c" 893 + 894 + [[package]] 543 895 name = "bzip2-sys" 544 896 version = "0.1.13+1.0.8" 545 897 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 551 903 552 904 [[package]] 553 905 name = "camino" 554 - version = "1.1.9" 906 + version = "1.2.1" 555 907 source = "registry+https://github.com/rust-lang/crates.io-index" 556 - checksum = "8b96ec4966b5813e2c0507c1f86115c8c5abaadc3980879c3424042a02fd1ad3" 908 + checksum = "276a59bf2b2c967788139340c9f0c5b12d7fd6630315c15c217e559de85d2609" 557 909 dependencies = [ 558 - "serde", 910 + "serde_core", 559 911 ] 560 912 561 913 [[package]] ··· 571 923 572 924 [[package]] 573 925 name = "cardinality-estimator-safe" 574 - version = "4.0.1" 926 + version = "4.0.2" 575 927 source = "registry+https://github.com/rust-lang/crates.io-index" 576 - checksum = "b41ec0cd313b46ba3b508377544b25aa1d56d05ce9e657e77dfb001d5e726e53" 928 + checksum = "dc9887b4092040ea9a416fc3de9769ee7783e3cd5c168c941e6a8de69723b971" 577 929 dependencies = [ 578 930 "digest", 579 931 "enum_dispatch", ··· 581 933 ] 582 934 583 935 [[package]] 936 + name = "cbor4ii" 937 + version = "0.2.14" 938 + source = "registry+https://github.com/rust-lang/crates.io-index" 939 + checksum = "b544cf8c89359205f4f990d0e6f3828db42df85b5dac95d09157a250eb0749c4" 940 + dependencies = [ 941 + "serde", 942 + ] 943 + 944 + [[package]] 945 + name = "cbor4ii" 946 + version = "1.2.0" 947 + source = "registry+https://github.com/rust-lang/crates.io-index" 948 + checksum = "b28d2802395e3bccd95cc4ae984bff7444b6c1f5981da46a41360c42a2c7e2d9" 949 + 950 + [[package]] 584 951 name = "cc" 585 952 version = "1.2.18" 586 953 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 628 995 ] 629 996 630 997 [[package]] 998 + name = "ciborium" 999 + version = "0.2.2" 1000 + source = "registry+https://github.com/rust-lang/crates.io-index" 1001 + checksum = "42e69ffd6f0917f5c029256a24d0161db17cea3997d185db0d35926308770f0e" 1002 + dependencies = [ 1003 + "ciborium-io", 1004 + "ciborium-ll", 1005 + "serde", 1006 + ] 1007 + 1008 + [[package]] 1009 + name = "ciborium-io" 1010 + version = "0.2.2" 1011 + source = "registry+https://github.com/rust-lang/crates.io-index" 1012 + checksum = "05afea1e0a06c9be33d539b876f1ce3692f4afea2cb41f740e7743225ed1c757" 1013 + 1014 + [[package]] 1015 + name = "ciborium-ll" 1016 + version = "0.2.2" 1017 + source = "registry+https://github.com/rust-lang/crates.io-index" 1018 + checksum = "57663b653d948a338bfb3eeba9bb2fd5fcfaecb9e199e87e1eda4d9e8b240fd9" 1019 + dependencies = [ 1020 + "ciborium-io", 1021 + "half", 1022 + ] 1023 + 1024 + [[package]] 631 1025 name = "cid" 632 1026 version = "0.11.1" 633 1027 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 638 1032 "multihash", 639 1033 "serde", 640 1034 "serde_bytes", 641 - "unsigned-varint", 1035 + "unsigned-varint 0.8.0", 642 1036 ] 643 1037 644 1038 [[package]] ··· 654 1048 655 1049 [[package]] 656 1050 name = "clap" 657 - version = "4.5.35" 1051 + version = "4.5.48" 658 1052 source = "registry+https://github.com/rust-lang/crates.io-index" 659 - checksum = "d8aa86934b44c19c50f87cc2790e19f54f7a67aedb64101c2e1a2e5ecfb73944" 1053 + checksum = "e2134bb3ea021b78629caa971416385309e0131b351b25e01dc16fb54e1b5fae" 660 1054 dependencies = [ 661 1055 "clap_builder", 662 1056 "clap_derive", ··· 664 1058 665 1059 [[package]] 666 1060 name = "clap_builder" 667 - version = "4.5.35" 1061 + version = "4.5.48" 668 1062 source = "registry+https://github.com/rust-lang/crates.io-index" 669 - checksum = "2414dbb2dd0695280da6ea9261e327479e9d37b0630f6b53ba2a11c60c679fd9" 1063 + checksum = "c2ba64afa3c0a6df7fa517765e31314e983f51dda798ffba27b988194fb65dc9" 670 1064 dependencies = [ 671 1065 "anstream", 672 1066 "anstyle", 673 1067 "clap_lex", 674 - "strsim", 1068 + "strsim 0.11.1", 675 1069 ] 676 1070 677 1071 [[package]] 678 1072 name = "clap_derive" 679 - version = "4.5.32" 1073 + version = "4.5.47" 680 1074 source = "registry+https://github.com/rust-lang/crates.io-index" 681 - checksum = "09176aae279615badda0765c0c0b3f6ed53f4709118af73cf4655d85d1530cd7" 1075 + checksum = "bbfd7eae0b0f1a6e63d4b13c9c478de77c2eb546fba158ad50b4203dc24b9f9c" 682 1076 dependencies = [ 683 1077 "heck", 684 1078 "proc-macro2", 685 1079 "quote", 686 - "syn", 1080 + "syn 2.0.106", 687 1081 ] 688 1082 689 1083 [[package]] ··· 704 1098 ] 705 1099 706 1100 [[package]] 1101 + name = "cmake" 1102 + version = "0.1.54" 1103 + source = "registry+https://github.com/rust-lang/crates.io-index" 1104 + checksum = "e7caa3f9de89ddbe2c607f4101924c5abec803763ae9534e4f4d7d8f84aa81f0" 1105 + dependencies = [ 1106 + "cc", 1107 + ] 1108 + 1109 + [[package]] 1110 + name = "cmsketch" 1111 + version = "0.2.2" 1112 + source = "registry+https://github.com/rust-lang/crates.io-index" 1113 + checksum = "553c840ee51da812c6cd621f9f7e07dfb00a49f91283a8e6380c78cba4f61aba" 1114 + dependencies = [ 1115 + "paste", 1116 + ] 1117 + 1118 + [[package]] 707 1119 name = "colorchoice" 708 1120 version = "1.0.3" 709 1121 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 725 1137 ] 726 1138 727 1139 [[package]] 1140 + name = "const-oid" 1141 + version = "0.9.6" 1142 + source = "registry+https://github.com/rust-lang/crates.io-index" 1143 + checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8" 1144 + 1145 + [[package]] 1146 + name = "const-str" 1147 + version = "0.4.3" 1148 + source = "registry+https://github.com/rust-lang/crates.io-index" 1149 + checksum = "2f421161cb492475f1661ddc9815a745a1c894592070661180fdec3d4872e9c3" 1150 + 1151 + [[package]] 1152 + name = "constant_time_eq" 1153 + version = "0.3.1" 1154 + source = "registry+https://github.com/rust-lang/crates.io-index" 1155 + checksum = "7c74b8349d32d297c9134b8c88677813a227df8f779daa29bfc29c183fe3dca6" 1156 + 1157 + [[package]] 728 1158 name = "constellation" 729 1159 version = "0.1.0" 730 1160 dependencies = [ ··· 737 1167 "clap", 738 1168 "ctrlc", 739 1169 "flume", 740 - "fs4", 1170 + "fs4 0.12.0", 741 1171 "headers-accept", 742 1172 "links", 743 1173 "mediatype", 744 1174 "metrics", 745 - "metrics-exporter-prometheus", 1175 + "metrics-exporter-prometheus 0.16.2", 746 1176 "metrics-process", 747 1177 "num-format", 748 1178 "ratelimit", ··· 755 1185 "tokio", 756 1186 "tokio-util", 757 1187 "tower-http", 758 - "tungstenite", 1188 + "tungstenite 0.26.2", 759 1189 "zstd", 760 1190 ] 761 1191 762 1192 [[package]] 1193 + name = "cookie" 1194 + version = "0.18.1" 1195 + source = "registry+https://github.com/rust-lang/crates.io-index" 1196 + checksum = "4ddef33a339a91ea89fb53151bd0a4689cfce27055c291dfa69945475d22c747" 1197 + dependencies = [ 1198 + "base64 0.22.1", 1199 + "hmac", 1200 + "percent-encoding", 1201 + "rand 0.8.5", 1202 + "sha2", 1203 + "subtle", 1204 + "time", 1205 + "version_check", 1206 + ] 1207 + 1208 + [[package]] 763 1209 name = "core-foundation" 764 1210 version = "0.9.4" 765 1211 source = "registry+https://github.com/rust-lang/crates.io-index" 766 1212 checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f" 1213 + dependencies = [ 1214 + "core-foundation-sys", 1215 + "libc", 1216 + ] 1217 + 1218 + [[package]] 1219 + name = "core-foundation" 1220 + version = "0.10.1" 1221 + source = "registry+https://github.com/rust-lang/crates.io-index" 1222 + checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6" 767 1223 dependencies = [ 768 1224 "core-foundation-sys", 769 1225 "libc", ··· 794 1250 ] 795 1251 796 1252 [[package]] 1253 + name = "crc32fast" 1254 + version = "1.4.2" 1255 + source = "registry+https://github.com/rust-lang/crates.io-index" 1256 + checksum = "a97769d94ddab943e4510d138150169a2758b5ef3eb191a9ee688de3e23ef7b3" 1257 + dependencies = [ 1258 + "cfg-if", 1259 + ] 1260 + 1261 + [[package]] 1262 + name = "critical-section" 1263 + version = "1.2.0" 1264 + source = "registry+https://github.com/rust-lang/crates.io-index" 1265 + checksum = "790eea4361631c5e7d22598ecd5723ff611904e3344ce8720784c93e3d83d40b" 1266 + 1267 + [[package]] 797 1268 name = "crossbeam-channel" 798 1269 version = "0.5.15" 799 1270 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 828 1299 checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28" 829 1300 830 1301 [[package]] 1302 + name = "crunchy" 1303 + version = "0.2.4" 1304 + source = "registry+https://github.com/rust-lang/crates.io-index" 1305 + checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5" 1306 + 1307 + [[package]] 1308 + name = "crypto-bigint" 1309 + version = "0.5.5" 1310 + source = "registry+https://github.com/rust-lang/crates.io-index" 1311 + checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76" 1312 + dependencies = [ 1313 + "generic-array", 1314 + "rand_core 0.6.4", 1315 + "subtle", 1316 + "zeroize", 1317 + ] 1318 + 1319 + [[package]] 831 1320 name = "crypto-common" 832 1321 version = "0.1.6" 833 1322 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 839 1328 840 1329 [[package]] 841 1330 name = "ctrlc" 842 - version = "3.4.6" 1331 + version = "3.4.7" 843 1332 source = "registry+https://github.com/rust-lang/crates.io-index" 844 - checksum = "697b5419f348fd5ae2478e8018cb016c00a5881c7f46c717de98ffd135a5651c" 1333 + checksum = "46f93780a459b7d656ef7f071fe699c4d3d2cb201c4b24d085b6ddc505276e73" 845 1334 dependencies = [ 846 1335 "nix", 847 1336 "windows-sys 0.59.0", ··· 849 1338 850 1339 [[package]] 851 1340 name = "darling" 1341 + version = "0.14.4" 1342 + source = "registry+https://github.com/rust-lang/crates.io-index" 1343 + checksum = "7b750cb3417fd1b327431a470f388520309479ab0bf5e323505daf0290cd3850" 1344 + dependencies = [ 1345 + "darling_core 0.14.4", 1346 + "darling_macro 0.14.4", 1347 + ] 1348 + 1349 + [[package]] 1350 + name = "darling" 852 1351 version = "0.20.11" 853 1352 source = "registry+https://github.com/rust-lang/crates.io-index" 854 1353 checksum = "fc7f46116c46ff9ab3eb1597a45688b6715c6e628b5c133e288e709a29bcb4ee" 855 1354 dependencies = [ 856 - "darling_core", 857 - "darling_macro", 1355 + "darling_core 0.20.11", 1356 + "darling_macro 0.20.11", 1357 + ] 1358 + 1359 + [[package]] 1360 + name = "darling_core" 1361 + version = "0.14.4" 1362 + source = "registry+https://github.com/rust-lang/crates.io-index" 1363 + checksum = "109c1ca6e6b7f82cc233a97004ea8ed7ca123a9af07a8230878fcfda9b158bf0" 1364 + dependencies = [ 1365 + "fnv", 1366 + "ident_case", 1367 + "proc-macro2", 1368 + "quote", 1369 + "strsim 0.10.0", 1370 + "syn 1.0.109", 858 1371 ] 859 1372 860 1373 [[package]] ··· 867 1380 "ident_case", 868 1381 "proc-macro2", 869 1382 "quote", 870 - "strsim", 871 - "syn", 1383 + "strsim 0.11.1", 1384 + "syn 2.0.106", 1385 + ] 1386 + 1387 + [[package]] 1388 + name = "darling_macro" 1389 + version = "0.14.4" 1390 + source = "registry+https://github.com/rust-lang/crates.io-index" 1391 + checksum = "a4aab4dbc9f7611d8b55048a3a16d2d010c2c8334e46304b40ac1cc14bf3b48e" 1392 + dependencies = [ 1393 + "darling_core 0.14.4", 1394 + "quote", 1395 + "syn 1.0.109", 872 1396 ] 873 1397 874 1398 [[package]] ··· 877 1401 source = "registry+https://github.com/rust-lang/crates.io-index" 878 1402 checksum = "fc34b93ccb385b40dc71c6fceac4b2ad23662c7eeb248cf10d529b7e055b6ead" 879 1403 dependencies = [ 880 - "darling_core", 1404 + "darling_core 0.20.11", 881 1405 "quote", 882 - "syn", 1406 + "syn 2.0.106", 883 1407 ] 884 1408 885 1409 [[package]] ··· 894 1418 "lock_api", 895 1419 "once_cell", 896 1420 "parking_lot_core", 1421 + ] 1422 + 1423 + [[package]] 1424 + name = "dasl" 1425 + version = "0.2.0" 1426 + source = "registry+https://github.com/rust-lang/crates.io-index" 1427 + checksum = "b59666035a4386b0fd272bd78da4cbc3ccb558941e97579ab00f0eb4639f2a49" 1428 + dependencies = [ 1429 + "blake3", 1430 + "cbor4ii 1.2.0", 1431 + "data-encoding", 1432 + "data-encoding-macro", 1433 + "scopeguard", 1434 + "serde", 1435 + "serde_bytes", 1436 + "sha2", 1437 + "thiserror 2.0.17", 897 1438 ] 898 1439 899 1440 [[package]] 900 1441 name = "data-encoding" 901 - version = "2.8.0" 1442 + version = "2.9.0" 902 1443 source = "registry+https://github.com/rust-lang/crates.io-index" 903 - checksum = "575f75dfd25738df5b91b8e43e14d44bda14637a58fae779fd2b064f8bf3e010" 1444 + checksum = "2a2330da5de22e8a3cb63252ce2abb30116bf5265e89c0e01bc17015ce30a476" 904 1445 905 1446 [[package]] 906 1447 name = "data-encoding-macro" 907 - version = "0.1.17" 1448 + version = "0.1.18" 908 1449 source = "registry+https://github.com/rust-lang/crates.io-index" 909 - checksum = "9f9724adfcf41f45bf652b3995837669d73c4d49a1b5ac1ff82905ac7d9b5558" 1450 + checksum = "47ce6c96ea0102f01122a185683611bd5ac8d99e62bc59dd12e6bda344ee673d" 910 1451 dependencies = [ 911 1452 "data-encoding", 912 1453 "data-encoding-macro-internal", ··· 914 1455 915 1456 [[package]] 916 1457 name = "data-encoding-macro-internal" 917 - version = "0.1.15" 1458 + version = "0.1.16" 918 1459 source = "registry+https://github.com/rust-lang/crates.io-index" 919 - checksum = "18e4fdb82bd54a12e42fb58a800dcae6b9e13982238ce2296dc3570b92148e1f" 1460 + checksum = "8d162beedaa69905488a8da94f5ac3edb4dd4788b732fadb7bd120b2625c1976" 920 1461 dependencies = [ 921 1462 "data-encoding", 922 - "syn", 1463 + "syn 2.0.106", 923 1464 ] 924 1465 925 1466 [[package]] ··· 929 1470 checksum = "ffe7ed1d93f4553003e20b629abe9085e1e81b1429520f897f8f8860bc6dfc21" 930 1471 931 1472 [[package]] 1473 + name = "der" 1474 + version = "0.7.10" 1475 + source = "registry+https://github.com/rust-lang/crates.io-index" 1476 + checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb" 1477 + dependencies = [ 1478 + "const-oid", 1479 + "pem-rfc7468", 1480 + "zeroize", 1481 + ] 1482 + 1483 + [[package]] 1484 + name = "der-parser" 1485 + version = "10.0.0" 1486 + source = "registry+https://github.com/rust-lang/crates.io-index" 1487 + checksum = "07da5016415d5a3c4dd39b11ed26f915f52fc4e0dc197d87908bc916e51bc1a6" 1488 + dependencies = [ 1489 + "asn1-rs", 1490 + "displaydoc", 1491 + "nom", 1492 + "num-bigint", 1493 + "num-traits", 1494 + "rusticata-macros", 1495 + ] 1496 + 1497 + [[package]] 932 1498 name = "deranged" 933 1499 version = "0.4.0" 934 1500 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 939 1505 ] 940 1506 941 1507 [[package]] 1508 + name = "derive_builder" 1509 + version = "0.20.2" 1510 + source = "registry+https://github.com/rust-lang/crates.io-index" 1511 + checksum = "507dfb09ea8b7fa618fcf76e953f4f5e192547945816d5358edffe39f6f94947" 1512 + dependencies = [ 1513 + "derive_builder_macro", 1514 + ] 1515 + 1516 + [[package]] 1517 + name = "derive_builder_core" 1518 + version = "0.20.2" 1519 + source = "registry+https://github.com/rust-lang/crates.io-index" 1520 + checksum = "2d5bcf7b024d6835cfb3d473887cd966994907effbe9227e8c8219824d06c4e8" 1521 + dependencies = [ 1522 + "darling 0.20.11", 1523 + "proc-macro2", 1524 + "quote", 1525 + "syn 2.0.106", 1526 + ] 1527 + 1528 + [[package]] 1529 + name = "derive_builder_macro" 1530 + version = "0.20.2" 1531 + source = "registry+https://github.com/rust-lang/crates.io-index" 1532 + checksum = "ab63b0e2bf4d5928aff72e83a7dace85d7bba5fe12dcc3c5a572d78caffd3f3c" 1533 + dependencies = [ 1534 + "derive_builder_core", 1535 + "syn 2.0.106", 1536 + ] 1537 + 1538 + [[package]] 1539 + name = "derive_more" 1540 + version = "2.0.1" 1541 + source = "registry+https://github.com/rust-lang/crates.io-index" 1542 + checksum = "093242cf7570c207c83073cf82f79706fe7b8317e98620a47d5be7c3d8497678" 1543 + dependencies = [ 1544 + "derive_more-impl", 1545 + ] 1546 + 1547 + [[package]] 1548 + name = "derive_more-impl" 1549 + version = "2.0.1" 1550 + source = "registry+https://github.com/rust-lang/crates.io-index" 1551 + checksum = "bda628edc44c4bb645fbe0f758797143e4e07926f7ebf4e9bdfbd3d2ce621df3" 1552 + dependencies = [ 1553 + "proc-macro2", 1554 + "quote", 1555 + "syn 2.0.106", 1556 + "unicode-xid", 1557 + ] 1558 + 1559 + [[package]] 1560 + name = "derive_utils" 1561 + version = "0.15.0" 1562 + source = "registry+https://github.com/rust-lang/crates.io-index" 1563 + checksum = "ccfae181bab5ab6c5478b2ccb69e4c68a02f8c3ec72f6616bfec9dbc599d2ee0" 1564 + dependencies = [ 1565 + "proc-macro2", 1566 + "quote", 1567 + "syn 2.0.106", 1568 + ] 1569 + 1570 + [[package]] 942 1571 name = "digest" 943 1572 version = "0.10.7" 944 1573 source = "registry+https://github.com/rust-lang/crates.io-index" 945 1574 checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292" 946 1575 dependencies = [ 947 1576 "block-buffer", 1577 + "const-oid", 948 1578 "crypto-common", 1579 + "subtle", 949 1580 ] 950 1581 951 1582 [[package]] ··· 977 1608 dependencies = [ 978 1609 "proc-macro2", 979 1610 "quote", 980 - "syn", 1611 + "syn 2.0.106", 981 1612 ] 982 1613 983 1614 [[package]] ··· 987 1618 checksum = "c0d05e1c0dbad51b52c38bda7adceef61b9efc2baf04acfe8726a8c4630a6f57" 988 1619 989 1620 [[package]] 1621 + name = "downcast-rs" 1622 + version = "1.2.1" 1623 + source = "registry+https://github.com/rust-lang/crates.io-index" 1624 + checksum = "75b325c5dbd37f80359721ad39aca5a29fb04c89279657cffdda8736d0c0b9d2" 1625 + 1626 + [[package]] 990 1627 name = "dropshot" 991 - version = "0.16.0" 1628 + version = "0.16.3" 992 1629 source = "registry+https://github.com/rust-lang/crates.io-index" 993 - checksum = "a37c505dad56e0c1fa5ed47e29fab1a1ab2d1a9d93e952024bb47168969705f6" 1630 + checksum = "eedf902e40c1024b8ed9ca16378a54e9655cdf0e698245ba82d81a3778dcbc54" 994 1631 dependencies = [ 995 1632 "async-stream", 996 1633 "async-trait", ··· 1007 1644 "http-body-util", 1008 1645 "hyper", 1009 1646 "hyper-util", 1010 - "indexmap 2.9.0", 1647 + "indexmap 2.11.4", 1011 1648 "multer", 1012 1649 "openapiv3", 1013 1650 "paste", 1014 1651 "percent-encoding", 1015 - "rustls", 1652 + "rustls 0.22.4", 1016 1653 "rustls-pemfile", 1017 1654 "schemars", 1018 1655 "scopeguard", ··· 1027 1664 "slog-bunyan", 1028 1665 "slog-json", 1029 1666 "slog-term", 1030 - "thiserror 2.0.12", 1667 + "thiserror 2.0.17", 1031 1668 "tokio", 1032 - "tokio-rustls", 1033 - "toml", 1669 + "tokio-rustls 0.25.0", 1670 + "toml 0.9.7", 1034 1671 "uuid", 1035 1672 "version_check", 1036 1673 "waitgroup", ··· 1038 1675 1039 1676 [[package]] 1040 1677 name = "dropshot_endpoint" 1041 - version = "0.16.0" 1678 + version = "0.16.4" 1042 1679 source = "registry+https://github.com/rust-lang/crates.io-index" 1043 - checksum = "8b1a6db3728f0195e3ad62807649913aaba06d45421e883416e555e51464ef67" 1680 + checksum = "89d09440e73a9dcf8a0f7fbd6ab889a7751d59f0fe76e5082a0a6d5623ec6da3" 1044 1681 dependencies = [ 1045 1682 "heck", 1046 1683 "proc-macro2", ··· 1048 1685 "semver", 1049 1686 "serde", 1050 1687 "serde_tokenstream", 1051 - "syn", 1688 + "syn 2.0.106", 1052 1689 ] 1690 + 1691 + [[package]] 1692 + name = "dunce" 1693 + version = "1.0.5" 1694 + source = "registry+https://github.com/rust-lang/crates.io-index" 1695 + checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813" 1053 1696 1054 1697 [[package]] 1055 1698 name = "dyn-clone" ··· 1058 1701 checksum = "1c7a8fb8a9fbf66c1f703fe16184d10ca0ee9d23be5b4436400408ba54a95005" 1059 1702 1060 1703 [[package]] 1704 + name = "ecdsa" 1705 + version = "0.16.9" 1706 + source = "registry+https://github.com/rust-lang/crates.io-index" 1707 + checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca" 1708 + dependencies = [ 1709 + "der", 1710 + "digest", 1711 + "elliptic-curve", 1712 + "rfc6979", 1713 + "signature", 1714 + "spki", 1715 + ] 1716 + 1717 + [[package]] 1061 1718 name = "either" 1062 1719 version = "1.15.0" 1063 1720 source = "registry+https://github.com/rust-lang/crates.io-index" 1064 1721 checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719" 1065 1722 1066 1723 [[package]] 1724 + name = "elliptic-curve" 1725 + version = "0.13.8" 1726 + source = "registry+https://github.com/rust-lang/crates.io-index" 1727 + checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47" 1728 + dependencies = [ 1729 + "base16ct", 1730 + "crypto-bigint", 1731 + "digest", 1732 + "ff", 1733 + "generic-array", 1734 + "group", 1735 + "pem-rfc7468", 1736 + "pkcs8", 1737 + "rand_core 0.6.4", 1738 + "sec1", 1739 + "subtle", 1740 + "zeroize", 1741 + ] 1742 + 1743 + [[package]] 1067 1744 name = "encoding_rs" 1068 1745 version = "0.8.35" 1069 1746 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 1073 1750 ] 1074 1751 1075 1752 [[package]] 1753 + name = "enum-as-inner" 1754 + version = "0.6.1" 1755 + source = "registry+https://github.com/rust-lang/crates.io-index" 1756 + checksum = "a1e6a265c649f3f5979b601d26f1d05ada116434c87741c9493cb56218f76cbc" 1757 + dependencies = [ 1758 + "heck", 1759 + "proc-macro2", 1760 + "quote", 1761 + "syn 2.0.106", 1762 + ] 1763 + 1764 + [[package]] 1076 1765 name = "enum_dispatch" 1077 1766 version = "0.3.13" 1078 1767 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 1081 1770 "once_cell", 1082 1771 "proc-macro2", 1083 1772 "quote", 1084 - "syn", 1773 + "syn 2.0.106", 1085 1774 ] 1086 1775 1087 1776 [[package]] ··· 1145 1834 ] 1146 1835 1147 1836 [[package]] 1837 + name = "fallible-iterator" 1838 + version = "0.3.0" 1839 + source = "registry+https://github.com/rust-lang/crates.io-index" 1840 + checksum = "2acce4a10f12dc2fb14a218589d4f1f62ef011b2d0cc4b3cb1bba8e94da14649" 1841 + 1842 + [[package]] 1843 + name = "fallible-streaming-iterator" 1844 + version = "0.1.9" 1845 + source = "registry+https://github.com/rust-lang/crates.io-index" 1846 + checksum = "7360491ce676a36bf9bb3c56c1aa791658183a54d2744120f27285738d90465a" 1847 + 1848 + [[package]] 1148 1849 name = "fastrand" 1149 1850 version = "2.3.0" 1150 1851 source = "registry+https://github.com/rust-lang/crates.io-index" 1151 1852 checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be" 1152 1853 1153 1854 [[package]] 1855 + name = "ff" 1856 + version = "0.13.1" 1857 + source = "registry+https://github.com/rust-lang/crates.io-index" 1858 + checksum = "c0b50bfb653653f9ca9095b427bed08ab8d75a137839d9ad64eb11810d5b6393" 1859 + dependencies = [ 1860 + "rand_core 0.6.4", 1861 + "subtle", 1862 + ] 1863 + 1864 + [[package]] 1154 1865 name = "fjall" 1155 - version = "2.8.0" 1866 + version = "2.11.2" 1156 1867 source = "registry+https://github.com/rust-lang/crates.io-index" 1157 - checksum = "26b2ced3483989a62b3533c9f99054d73b527c6c0045cf22b00fe87956f1a46f" 1868 + checksum = "0b25ad44cd4360a0448a9b5a0a6f1c7a621101cca4578706d43c9a821418aebc" 1158 1869 dependencies = [ 1159 1870 "byteorder", 1160 - "byteview", 1871 + "byteview 0.6.1", 1161 1872 "dashmap", 1162 1873 "log", 1163 - "lsm-tree", 1874 + "lsm-tree 2.10.4", 1164 1875 "path-absolutize", 1165 1876 "std-semaphore", 1166 1877 "tempfile", ··· 1168 1879 ] 1169 1880 1170 1881 [[package]] 1882 + name = "fjall" 1883 + version = "2.11.2" 1884 + source = "git+https://github.com/fjall-rs/fjall.git#42d811f7c8cc9004407d520d37d2a1d8d246c03d" 1885 + dependencies = [ 1886 + "byteorder", 1887 + "byteview 0.6.1", 1888 + "dashmap", 1889 + "log", 1890 + "lsm-tree 2.10.4", 1891 + "path-absolutize", 1892 + "std-semaphore", 1893 + "tempfile", 1894 + "xxhash-rust", 1895 + ] 1896 + 1897 + [[package]] 1898 + name = "fjall" 1899 + version = "3.0.0-pre.0" 1900 + source = "registry+https://github.com/rust-lang/crates.io-index" 1901 + checksum = "467588c1f15d1cfa9e43f02a45cf55d82fa1f12a6ae961b848c520458525600c" 1902 + dependencies = [ 1903 + "byteorder-lite", 1904 + "byteview 0.8.0", 1905 + "dashmap", 1906 + "log", 1907 + "lsm-tree 3.0.0-pre.0", 1908 + "std-semaphore", 1909 + "tempfile", 1910 + "xxhash-rust", 1911 + ] 1912 + 1913 + [[package]] 1914 + name = "flate2" 1915 + version = "1.1.2" 1916 + source = "registry+https://github.com/rust-lang/crates.io-index" 1917 + checksum = "4a3d7db9596fecd151c5f638c0ee5d5bd487b6e0ea232e5dc96d5250f6f94b1d" 1918 + dependencies = [ 1919 + "crc32fast", 1920 + "miniz_oxide", 1921 + ] 1922 + 1923 + [[package]] 1171 1924 name = "fluent-uri" 1172 1925 version = "0.3.2" 1173 1926 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 1183 1936 source = "registry+https://github.com/rust-lang/crates.io-index" 1184 1937 checksum = "da0e4dd2a88388a1f4ccc7c9ce104604dab68d9f408dc34cd45823d5a9069095" 1185 1938 dependencies = [ 1939 + "futures-core", 1940 + "futures-sink", 1941 + "nanorand", 1186 1942 "spin", 1187 1943 ] 1188 1944 ··· 1223 1979 ] 1224 1980 1225 1981 [[package]] 1982 + name = "foyer" 1983 + version = "0.18.0" 1984 + source = "registry+https://github.com/rust-lang/crates.io-index" 1985 + checksum = "0b4d8e96374206ff1b4265f2e2e6e1f80bc3048957b2a1e7fdeef929d68f318f" 1986 + dependencies = [ 1987 + "equivalent", 1988 + "foyer-common", 1989 + "foyer-memory", 1990 + "foyer-storage", 1991 + "madsim-tokio", 1992 + "mixtrics", 1993 + "pin-project", 1994 + "serde", 1995 + "thiserror 2.0.17", 1996 + "tokio", 1997 + "tracing", 1998 + ] 1999 + 2000 + [[package]] 2001 + name = "foyer-common" 2002 + version = "0.18.0" 2003 + source = "registry+https://github.com/rust-lang/crates.io-index" 2004 + checksum = "911b8e3f23d5fe55b0b240f75af1d2fa5cb7261d3f9b38ef1c57bbc9f0449317" 2005 + dependencies = [ 2006 + "bincode 1.3.3", 2007 + "bytes", 2008 + "cfg-if", 2009 + "itertools 0.14.0", 2010 + "madsim-tokio", 2011 + "mixtrics", 2012 + "parking_lot", 2013 + "pin-project", 2014 + "serde", 2015 + "thiserror 2.0.17", 2016 + "tokio", 2017 + "twox-hash", 2018 + ] 2019 + 2020 + [[package]] 2021 + name = "foyer-intrusive-collections" 2022 + version = "0.10.0-dev" 2023 + source = "registry+https://github.com/rust-lang/crates.io-index" 2024 + checksum = "6e4fee46bea69e0596130e3210e65d3424e0ac1e6df3bde6636304bdf1ca4a3b" 2025 + dependencies = [ 2026 + "memoffset", 2027 + ] 2028 + 2029 + [[package]] 2030 + name = "foyer-memory" 2031 + version = "0.18.0" 2032 + source = "registry+https://github.com/rust-lang/crates.io-index" 2033 + checksum = "506883d5a8500dea1b1662f7180f3534bdcbfa718d3253db7179552ef83612fa" 2034 + dependencies = [ 2035 + "arc-swap", 2036 + "bitflags", 2037 + "cmsketch", 2038 + "equivalent", 2039 + "foyer-common", 2040 + "foyer-intrusive-collections", 2041 + "hashbrown 0.15.2", 2042 + "itertools 0.14.0", 2043 + "madsim-tokio", 2044 + "mixtrics", 2045 + "parking_lot", 2046 + "pin-project", 2047 + "serde", 2048 + "thiserror 2.0.17", 2049 + "tokio", 2050 + "tracing", 2051 + ] 2052 + 2053 + [[package]] 2054 + name = "foyer-storage" 2055 + version = "0.18.0" 2056 + source = "registry+https://github.com/rust-lang/crates.io-index" 2057 + checksum = "1ba8403a54a2f2032fb647e49c442e5feeb33f3989f7024f1b178341a016f06d" 2058 + dependencies = [ 2059 + "allocator-api2", 2060 + "anyhow", 2061 + "auto_enums", 2062 + "bytes", 2063 + "equivalent", 2064 + "flume", 2065 + "foyer-common", 2066 + "foyer-memory", 2067 + "fs4 0.13.1", 2068 + "futures-core", 2069 + "futures-util", 2070 + "itertools 0.14.0", 2071 + "libc", 2072 + "lz4", 2073 + "madsim-tokio", 2074 + "ordered_hash_map", 2075 + "parking_lot", 2076 + "paste", 2077 + "pin-project", 2078 + "rand 0.9.1", 2079 + "serde", 2080 + "thiserror 2.0.17", 2081 + "tokio", 2082 + "tracing", 2083 + "twox-hash", 2084 + "zstd", 2085 + ] 2086 + 2087 + [[package]] 1226 2088 name = "fs4" 1227 2089 version = "0.12.0" 1228 2090 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 1233 2095 ] 1234 2096 1235 2097 [[package]] 2098 + name = "fs4" 2099 + version = "0.13.1" 2100 + source = "registry+https://github.com/rust-lang/crates.io-index" 2101 + checksum = "8640e34b88f7652208ce9e88b1a37a2ae95227d84abec377ccd3c5cfeb141ed4" 2102 + dependencies = [ 2103 + "rustix 1.0.5", 2104 + "windows-sys 0.59.0", 2105 + ] 2106 + 2107 + [[package]] 2108 + name = "fs_extra" 2109 + version = "1.3.0" 2110 + source = "registry+https://github.com/rust-lang/crates.io-index" 2111 + checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c" 2112 + 2113 + [[package]] 1236 2114 name = "futures" 1237 2115 version = "0.3.31" 1238 2116 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 1288 2166 dependencies = [ 1289 2167 "proc-macro2", 1290 2168 "quote", 1291 - "syn", 2169 + "syn 2.0.106", 1292 2170 ] 1293 2171 1294 2172 [[package]] ··· 1342 2220 dependencies = [ 1343 2221 "typenum", 1344 2222 "version_check", 2223 + "zeroize", 1345 2224 ] 1346 2225 1347 2226 [[package]] ··· 1351 2230 checksum = "c4567c8db10ae91089c99af84c68c38da3ec2f087c3f82960bcdbf3656b6f4d7" 1352 2231 dependencies = [ 1353 2232 "cfg-if", 2233 + "js-sys", 1354 2234 "libc", 1355 2235 "wasi 0.11.0+wasi-snapshot-preview1", 2236 + "wasm-bindgen", 1356 2237 ] 1357 2238 1358 2239 [[package]] ··· 1362 2243 checksum = "26145e563e54f2cadc477553f1ec5ee650b00862f0a58bcd12cbdc5f0ea2d2f4" 1363 2244 dependencies = [ 1364 2245 "cfg-if", 2246 + "js-sys", 1365 2247 "libc", 1366 2248 "r-efi", 1367 2249 "wasi 0.14.2+wasi-0.2.4", 2250 + "wasm-bindgen", 1368 2251 ] 1369 2252 1370 2253 [[package]] ··· 1380 2263 checksum = "a8d1add55171497b4705a648c6b583acafb01d58050a51727785f0b2c8e0a2b2" 1381 2264 1382 2265 [[package]] 2266 + name = "group" 2267 + version = "0.13.0" 2268 + source = "registry+https://github.com/rust-lang/crates.io-index" 2269 + checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63" 2270 + dependencies = [ 2271 + "ff", 2272 + "rand_core 0.6.4", 2273 + "subtle", 2274 + ] 2275 + 2276 + [[package]] 1383 2277 name = "guardian" 1384 2278 version = "1.3.0" 1385 2279 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 1397 2291 "futures-core", 1398 2292 "futures-sink", 1399 2293 "http", 1400 - "indexmap 2.9.0", 2294 + "indexmap 2.11.4", 1401 2295 "slab", 1402 2296 "tokio", 1403 2297 "tokio-util", ··· 1405 2299 ] 1406 2300 1407 2301 [[package]] 2302 + name = "half" 2303 + version = "2.6.0" 2304 + source = "registry+https://github.com/rust-lang/crates.io-index" 2305 + checksum = "459196ed295495a68f7d7fe1d84f6c4b7ff0e21fe3017b2f283c6fac3ad803c9" 2306 + dependencies = [ 2307 + "cfg-if", 2308 + "crunchy", 2309 + ] 2310 + 2311 + [[package]] 2312 + name = "handlebars" 2313 + version = "6.3.2" 2314 + source = "registry+https://github.com/rust-lang/crates.io-index" 2315 + checksum = "759e2d5aea3287cb1190c8ec394f42866cb5bf74fcbf213f354e3c856ea26098" 2316 + dependencies = [ 2317 + "derive_builder", 2318 + "log", 2319 + "num-order", 2320 + "pest", 2321 + "pest_derive", 2322 + "serde", 2323 + "serde_json", 2324 + "thiserror 2.0.17", 2325 + "walkdir", 2326 + ] 2327 + 2328 + [[package]] 1408 2329 name = "hashbrown" 1409 2330 version = "0.12.3" 1410 2331 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 1412 2333 1413 2334 [[package]] 1414 2335 name = "hashbrown" 2336 + version = "0.13.2" 2337 + source = "registry+https://github.com/rust-lang/crates.io-index" 2338 + checksum = "43a3c133739dddd0d2990f9a4bdf8eb4b21ef50e4851ca85ab661199821d510e" 2339 + dependencies = [ 2340 + "ahash", 2341 + ] 2342 + 2343 + [[package]] 2344 + name = "hashbrown" 1415 2345 version = "0.14.5" 1416 2346 source = "registry+https://github.com/rust-lang/crates.io-index" 1417 2347 checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1" ··· 1425 2355 "allocator-api2", 1426 2356 "equivalent", 1427 2357 "foldhash", 2358 + ] 2359 + 2360 + [[package]] 2361 + name = "hashlink" 2362 + version = "0.10.0" 2363 + source = "registry+https://github.com/rust-lang/crates.io-index" 2364 + checksum = "7382cf6263419f2d8df38c55d7da83da5c18aef87fc7a7fc1fb1e344edfe14c1" 2365 + dependencies = [ 2366 + "hashbrown 0.15.2", 1428 2367 ] 1429 2368 1430 2369 [[package]] ··· 1481 2420 checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70" 1482 2421 1483 2422 [[package]] 2423 + name = "hex-conservative" 2424 + version = "0.2.1" 2425 + source = "registry+https://github.com/rust-lang/crates.io-index" 2426 + checksum = "5313b072ce3c597065a808dbf612c4c8e8590bdbf8b579508bf7a762c5eae6cd" 2427 + dependencies = [ 2428 + "arrayvec", 2429 + ] 2430 + 2431 + [[package]] 2432 + name = "hickory-proto" 2433 + version = "0.25.2" 2434 + source = "registry+https://github.com/rust-lang/crates.io-index" 2435 + checksum = "f8a6fe56c0038198998a6f217ca4e7ef3a5e51f46163bd6dd60b5c71ca6c6502" 2436 + dependencies = [ 2437 + "async-trait", 2438 + "cfg-if", 2439 + "data-encoding", 2440 + "enum-as-inner", 2441 + "futures-channel", 2442 + "futures-io", 2443 + "futures-util", 2444 + "idna", 2445 + "ipnet", 2446 + "once_cell", 2447 + "rand 0.9.1", 2448 + "ring", 2449 + "thiserror 2.0.17", 2450 + "tinyvec", 2451 + "tokio", 2452 + "tracing", 2453 + "url", 2454 + ] 2455 + 2456 + [[package]] 2457 + name = "hickory-resolver" 2458 + version = "0.25.2" 2459 + source = "registry+https://github.com/rust-lang/crates.io-index" 2460 + checksum = "dc62a9a99b0bfb44d2ab95a7208ac952d31060efc16241c87eaf36406fecf87a" 2461 + dependencies = [ 2462 + "cfg-if", 2463 + "futures-util", 2464 + "hickory-proto", 2465 + "ipconfig", 2466 + "moka", 2467 + "once_cell", 2468 + "parking_lot", 2469 + "rand 0.9.1", 2470 + "resolv-conf", 2471 + "smallvec", 2472 + "thiserror 2.0.17", 2473 + "tokio", 2474 + "tracing", 2475 + ] 2476 + 2477 + [[package]] 2478 + name = "hmac" 2479 + version = "0.12.1" 2480 + source = "registry+https://github.com/rust-lang/crates.io-index" 2481 + checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e" 2482 + dependencies = [ 2483 + "digest", 2484 + ] 2485 + 2486 + [[package]] 2487 + name = "home" 2488 + version = "0.5.11" 2489 + source = "registry+https://github.com/rust-lang/crates.io-index" 2490 + checksum = "589533453244b0995c858700322199b2becb13b627df2851f64a2775d024abcf" 2491 + dependencies = [ 2492 + "windows-sys 0.59.0", 2493 + ] 2494 + 2495 + [[package]] 1484 2496 name = "hostname" 1485 2497 version = "0.3.1" 1486 2498 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 1579 2591 ] 1580 2592 1581 2593 [[package]] 2594 + name = "hyper-rustls" 2595 + version = "0.27.7" 2596 + source = "registry+https://github.com/rust-lang/crates.io-index" 2597 + checksum = "e3c93eb611681b207e1fe55d5a71ecf91572ec8a6705cdb6857f7d8d5242cf58" 2598 + dependencies = [ 2599 + "http", 2600 + "hyper", 2601 + "hyper-util", 2602 + "rustls 0.23.31", 2603 + "rustls-native-certs", 2604 + "rustls-pki-types", 2605 + "tokio", 2606 + "tokio-rustls 0.26.2", 2607 + "tower-service", 2608 + ] 2609 + 2610 + [[package]] 2611 + name = "hyper-tls" 2612 + version = "0.6.0" 2613 + source = "registry+https://github.com/rust-lang/crates.io-index" 2614 + checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0" 2615 + dependencies = [ 2616 + "bytes", 2617 + "http-body-util", 2618 + "hyper", 2619 + "hyper-util", 2620 + "native-tls", 2621 + "tokio", 2622 + "tokio-native-tls", 2623 + "tower-service", 2624 + ] 2625 + 2626 + [[package]] 1582 2627 name = "hyper-util" 1583 - version = "0.1.11" 2628 + version = "0.1.16" 1584 2629 source = "registry+https://github.com/rust-lang/crates.io-index" 1585 - checksum = "497bbc33a26fdd4af9ed9c70d63f61cf56a938375fbb32df34db9b1cd6d643f2" 2630 + checksum = "8d9b05277c7e8da2c93a568989bb6207bef0112e8d17df7a6eda4a3cf143bc5e" 1586 2631 dependencies = [ 2632 + "base64 0.22.1", 1587 2633 "bytes", 1588 2634 "futures-channel", 2635 + "futures-core", 1589 2636 "futures-util", 1590 2637 "http", 1591 2638 "http-body", 1592 2639 "hyper", 2640 + "ipnet", 1593 2641 "libc", 2642 + "percent-encoding", 1594 2643 "pin-project-lite", 1595 - "socket2", 2644 + "socket2 0.6.0", 2645 + "system-configuration", 1596 2646 "tokio", 1597 2647 "tower-service", 1598 2648 "tracing", 2649 + "windows-registry", 1599 2650 ] 1600 2651 1601 2652 [[package]] ··· 1610 2661 "js-sys", 1611 2662 "log", 1612 2663 "wasm-bindgen", 1613 - "windows-core 0.61.0", 2664 + "windows-core", 1614 2665 ] 1615 2666 1616 2667 [[package]] ··· 1737 2788 dependencies = [ 1738 2789 "proc-macro2", 1739 2790 "quote", 1740 - "syn", 2791 + "syn 2.0.106", 1741 2792 ] 1742 2793 1743 2794 [[package]] ··· 1780 2831 1781 2832 [[package]] 1782 2833 name = "indexmap" 1783 - version = "2.9.0" 2834 + version = "2.11.4" 1784 2835 source = "registry+https://github.com/rust-lang/crates.io-index" 1785 - checksum = "cea70ddb795996207ad57735b50c5982d8844f38ba9ee5f1aedcfb708a2aa11e" 2836 + checksum = "4b0f83760fb341a774ed326568e19f5a863af4a952def8c39f9ab92fd95b88e5" 1786 2837 dependencies = [ 1787 2838 "equivalent", 1788 2839 "hashbrown 0.15.2", 1789 2840 "serde", 2841 + "serde_core", 1790 2842 ] 1791 2843 1792 2844 [[package]] ··· 1796 2848 checksum = "11274e5e8e89b8607cfedc2910b6626e998779b48a019151c7604d0adcb86ac6" 1797 2849 dependencies = [ 1798 2850 "compare", 2851 + ] 2852 + 2853 + [[package]] 2854 + name = "io-uring" 2855 + version = "0.7.9" 2856 + source = "registry+https://github.com/rust-lang/crates.io-index" 2857 + checksum = "d93587f37623a1a17d94ef2bc9ada592f5465fe7732084ab7beefabe5c77c0c4" 2858 + dependencies = [ 2859 + "bitflags", 2860 + "cfg-if", 2861 + "libc", 2862 + ] 2863 + 2864 + [[package]] 2865 + name = "ipconfig" 2866 + version = "0.3.2" 2867 + source = "registry+https://github.com/rust-lang/crates.io-index" 2868 + checksum = "b58db92f96b720de98181bbbe63c831e87005ab460c1bf306eb2622b4707997f" 2869 + dependencies = [ 2870 + "socket2 0.5.9", 2871 + "widestring", 2872 + "windows-sys 0.48.0", 2873 + "winreg", 1799 2874 ] 1800 2875 1801 2876 [[package]] ··· 1816 2891 checksum = "469fb0b9cefa57e3ef31275ee7cacb78f2fdca44e4765491884a2b119d4eb130" 1817 2892 1818 2893 [[package]] 2894 + name = "iri-string" 2895 + version = "0.7.8" 2896 + source = "registry+https://github.com/rust-lang/crates.io-index" 2897 + checksum = "dbc5ebe9c3a1a7a5127f920a418f7585e9e758e911d0466ed004f393b0e380b2" 2898 + dependencies = [ 2899 + "memchr", 2900 + "serde", 2901 + ] 2902 + 2903 + [[package]] 2904 + name = "iroh-car" 2905 + version = "0.5.1" 2906 + source = "registry+https://github.com/rust-lang/crates.io-index" 2907 + checksum = "cb7f8cd4cb9aa083fba8b52e921764252d0b4dcb1cd6d120b809dbfe1106e81a" 2908 + dependencies = [ 2909 + "anyhow", 2910 + "cid", 2911 + "futures", 2912 + "serde", 2913 + "serde_ipld_dagcbor", 2914 + "thiserror 1.0.69", 2915 + "tokio", 2916 + "unsigned-varint 0.7.2", 2917 + ] 2918 + 2919 + [[package]] 1819 2920 name = "is-terminal" 1820 2921 version = "0.4.16" 1821 2922 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 1851 2952 ] 1852 2953 1853 2954 [[package]] 2955 + name = "itertools" 2956 + version = "0.14.0" 2957 + source = "registry+https://github.com/rust-lang/crates.io-index" 2958 + checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285" 2959 + dependencies = [ 2960 + "either", 2961 + ] 2962 + 2963 + [[package]] 1854 2964 name = "itoa" 1855 2965 version = "1.0.15" 1856 2966 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 1862 2972 dependencies = [ 1863 2973 "anyhow", 1864 2974 "async-trait", 1865 - "atrium-api", 2975 + "atrium-api 0.25.4 (git+https://github.com/uniphil/atrium.git?branch=fix%2Fresolve-handle-https-accept-whitespace)", 1866 2976 "chrono", 1867 2977 "clap", 1868 2978 "futures-util", 1869 2979 "log", 2980 + "metrics", 1870 2981 "serde", 1871 2982 "serde_json", 1872 - "thiserror 2.0.12", 2983 + "thiserror 2.0.17", 1873 2984 "tokio", 1874 - "tokio-tungstenite", 2985 + "tokio-tungstenite 0.26.2", 1875 2986 "url", 1876 2987 "zstd", 1877 2988 ] ··· 1897 3008 dependencies = [ 1898 3009 "proc-macro2", 1899 3010 "quote", 1900 - "syn", 3011 + "syn 2.0.106", 1901 3012 ] 1902 3013 1903 3014 [[package]] ··· 1911 3022 ] 1912 3023 1913 3024 [[package]] 3025 + name = "jose-b64" 3026 + version = "0.1.2" 3027 + source = "registry+https://github.com/rust-lang/crates.io-index" 3028 + checksum = "bec69375368709666b21c76965ce67549f2d2db7605f1f8707d17c9656801b56" 3029 + dependencies = [ 3030 + "base64ct", 3031 + "serde", 3032 + "subtle", 3033 + "zeroize", 3034 + ] 3035 + 3036 + [[package]] 3037 + name = "jose-jwa" 3038 + version = "0.1.2" 3039 + source = "registry+https://github.com/rust-lang/crates.io-index" 3040 + checksum = "9ab78e053fe886a351d67cf0d194c000f9d0dcb92906eb34d853d7e758a4b3a7" 3041 + dependencies = [ 3042 + "serde", 3043 + ] 3044 + 3045 + [[package]] 3046 + name = "jose-jwk" 3047 + version = "0.1.2" 3048 + source = "registry+https://github.com/rust-lang/crates.io-index" 3049 + checksum = "280fa263807fe0782ecb6f2baadc28dffc04e00558a58e33bfdb801d11fd58e7" 3050 + dependencies = [ 3051 + "jose-b64", 3052 + "jose-jwa", 3053 + "p256", 3054 + "p384", 3055 + "rsa", 3056 + "serde", 3057 + "zeroize", 3058 + ] 3059 + 3060 + [[package]] 1914 3061 name = "js-sys" 1915 3062 version = "0.3.77" 1916 3063 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 1921 3068 ] 1922 3069 1923 3070 [[package]] 3071 + name = "jsonwebtoken" 3072 + version = "9.3.1" 3073 + source = "registry+https://github.com/rust-lang/crates.io-index" 3074 + checksum = "5a87cc7a48537badeae96744432de36f4be2b4a34a05a5ef32e9dd8a1c169dde" 3075 + dependencies = [ 3076 + "base64 0.22.1", 3077 + "js-sys", 3078 + "pem", 3079 + "ring", 3080 + "serde", 3081 + "serde_json", 3082 + "simple_asn1", 3083 + ] 3084 + 3085 + [[package]] 3086 + name = "jwt-compact" 3087 + version = "0.9.0-beta.1" 3088 + source = "git+https://github.com/fatfingers23/jwt-compact.git#aed088b8ff5ad44ef2785c453f6a4b7916728b1c" 3089 + dependencies = [ 3090 + "anyhow", 3091 + "base64ct", 3092 + "chrono", 3093 + "ciborium", 3094 + "hmac", 3095 + "lazy_static", 3096 + "rand_core 0.6.4", 3097 + "secp256k1", 3098 + "serde", 3099 + "serde_json", 3100 + "sha2", 3101 + "smallvec", 3102 + "subtle", 3103 + "zeroize", 3104 + ] 3105 + 3106 + [[package]] 3107 + name = "k256" 3108 + version = "0.13.4" 3109 + source = "registry+https://github.com/rust-lang/crates.io-index" 3110 + checksum = "f6e3919bbaa2945715f0bb6d3934a173d1e9a59ac23767fbaaef277265a7411b" 3111 + dependencies = [ 3112 + "cfg-if", 3113 + "ecdsa", 3114 + "elliptic-curve", 3115 + "sha2", 3116 + ] 3117 + 3118 + [[package]] 1924 3119 name = "langtag" 1925 3120 version = "0.3.4" 1926 3121 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 1934 3129 version = "1.5.0" 1935 3130 source = "registry+https://github.com/rust-lang/crates.io-index" 1936 3131 checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe" 3132 + dependencies = [ 3133 + "spin", 3134 + ] 1937 3135 1938 3136 [[package]] 1939 3137 name = "lazycell" ··· 1943 3141 1944 3142 [[package]] 1945 3143 name = "libc" 1946 - version = "0.2.171" 3144 + version = "0.2.174" 1947 3145 source = "registry+https://github.com/rust-lang/crates.io-index" 1948 - checksum = "c19937216e9d3aa9956d9bb8dfc0b0c8beb6058fc4f7a4dc4d850edf86a237d6" 3146 + checksum = "1171693293099992e19cddea4e8b849964e9846f4acee11b3948bcc337be8776" 1949 3147 1950 3148 [[package]] 1951 3149 name = "libfuzzer-sys" ··· 1964 3162 checksum = "fc2f4eb4bc735547cfed7c0a4922cbd04a4655978c09b54f1f7b228750664c34" 1965 3163 dependencies = [ 1966 3164 "cfg-if", 1967 - "windows-targets", 3165 + "windows-targets 0.52.6", 1968 3166 ] 1969 3167 1970 3168 [[package]] ··· 2010 3208 ] 2011 3209 2012 3210 [[package]] 3211 + name = "libsqlite3-sys" 3212 + version = "0.35.0" 3213 + source = "registry+https://github.com/rust-lang/crates.io-index" 3214 + checksum = "133c182a6a2c87864fe97778797e46c7e999672690dc9fa3ee8e241aa4a9c13f" 3215 + dependencies = [ 3216 + "pkg-config", 3217 + "vcpkg", 3218 + ] 3219 + 3220 + [[package]] 2013 3221 name = "libz-sys" 2014 3222 version = "1.1.22" 2015 3223 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 2025 3233 version = "0.1.0" 2026 3234 dependencies = [ 2027 3235 "anyhow", 3236 + "dasl", 2028 3237 "fluent-uri", 2029 3238 "nom", 2030 - "thiserror 2.0.12", 3239 + "serde", 3240 + "thiserror 2.0.17", 2031 3241 "tinyjson", 2032 3242 ] 2033 3243 ··· 2061 3271 2062 3272 [[package]] 2063 3273 name = "log" 2064 - version = "0.4.27" 3274 + version = "0.4.28" 2065 3275 source = "registry+https://github.com/rust-lang/crates.io-index" 2066 - checksum = "13dc2df351e3202783a1fe0d44375f7295ffb4049267b0f3018346dc122a1d94" 3276 + checksum = "34080505efa8e45a4b816c349525ebe327ceaa8559756f0356cba97ef3bf7432" 2067 3277 2068 3278 [[package]] 2069 3279 name = "loom" ··· 2088 3298 ] 2089 3299 2090 3300 [[package]] 3301 + name = "lru-slab" 3302 + version = "0.1.2" 3303 + source = "registry+https://github.com/rust-lang/crates.io-index" 3304 + checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154" 3305 + 3306 + [[package]] 2091 3307 name = "lsm-tree" 2092 - version = "2.8.0" 3308 + version = "2.10.4" 2093 3309 source = "registry+https://github.com/rust-lang/crates.io-index" 2094 - checksum = "d0a63a5e98a38b51765274137d8aedfbd848da5f4d016867e186b673fcc06a8c" 3310 + checksum = "799399117a2bfb37660e08be33f470958babb98386b04185288d829df362ea15" 2095 3311 dependencies = [ 2096 3312 "byteorder", 2097 3313 "crossbeam-skiplist", ··· 2112 3328 ] 2113 3329 2114 3330 [[package]] 3331 + name = "lsm-tree" 3332 + version = "3.0.0-pre.0" 3333 + source = "registry+https://github.com/rust-lang/crates.io-index" 3334 + checksum = "be375d45e348328e78582dffbda4f1709dd52fca27c1a81c7bf6ca134e6335f7" 3335 + dependencies = [ 3336 + "byteorder-lite", 3337 + "byteview 0.8.0", 3338 + "crossbeam-skiplist", 3339 + "enum_dispatch", 3340 + "interval-heap", 3341 + "log", 3342 + "lz4_flex", 3343 + "quick_cache", 3344 + "rustc-hash 2.1.1", 3345 + "self_cell", 3346 + "sfa", 3347 + "tempfile", 3348 + "varint-rs", 3349 + "xxhash-rust", 3350 + ] 3351 + 3352 + [[package]] 3353 + name = "lz4" 3354 + version = "1.28.1" 3355 + source = "registry+https://github.com/rust-lang/crates.io-index" 3356 + checksum = "a20b523e860d03443e98350ceaac5e71c6ba89aea7d960769ec3ce37f4de5af4" 3357 + dependencies = [ 3358 + "lz4-sys", 3359 + ] 3360 + 3361 + [[package]] 2115 3362 name = "lz4-sys" 2116 3363 version = "1.11.1+lz4-1.10.0" 2117 3364 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 2123 3370 2124 3371 [[package]] 2125 3372 name = "lz4_flex" 2126 - version = "0.11.3" 3373 + version = "0.11.5" 2127 3374 source = "registry+https://github.com/rust-lang/crates.io-index" 2128 - checksum = "75761162ae2b0e580d7e7c390558127e5f01b4194debd6221fd8c207fc80e3f5" 3375 + checksum = "08ab2867e3eeeca90e844d1940eab391c9dc5228783db2ed999acbc0a9ed375a" 2129 3376 2130 3377 [[package]] 2131 3378 name = "mach2" ··· 2137 3384 ] 2138 3385 2139 3386 [[package]] 3387 + name = "madsim" 3388 + version = "0.2.32" 3389 + source = "registry+https://github.com/rust-lang/crates.io-index" 3390 + checksum = "db6694555643da293dfb89e33c2880a13b62711d64b6588bc7df6ce4110b27f1" 3391 + dependencies = [ 3392 + "ahash", 3393 + "async-channel", 3394 + "async-stream", 3395 + "async-task", 3396 + "bincode 1.3.3", 3397 + "bytes", 3398 + "downcast-rs", 3399 + "futures-util", 3400 + "lazy_static", 3401 + "libc", 3402 + "madsim-macros", 3403 + "naive-timer", 3404 + "panic-message", 3405 + "rand 0.8.5", 3406 + "rand_xoshiro 0.6.0", 3407 + "rustversion", 3408 + "serde", 3409 + "spin", 3410 + "tokio", 3411 + "tokio-util", 3412 + "toml 0.8.23", 3413 + "tracing", 3414 + "tracing-subscriber", 3415 + ] 3416 + 3417 + [[package]] 3418 + name = "madsim-macros" 3419 + version = "0.2.12" 3420 + source = "registry+https://github.com/rust-lang/crates.io-index" 3421 + checksum = "f3d248e97b1a48826a12c3828d921e8548e714394bf17274dd0a93910dc946e1" 3422 + dependencies = [ 3423 + "darling 0.14.4", 3424 + "proc-macro2", 3425 + "quote", 3426 + "syn 1.0.109", 3427 + ] 3428 + 3429 + [[package]] 3430 + name = "madsim-tokio" 3431 + version = "0.2.30" 3432 + source = "registry+https://github.com/rust-lang/crates.io-index" 3433 + checksum = "7d3eb2acc57c82d21d699119b859e2df70a91dbdb84734885a1e72be83bdecb5" 3434 + dependencies = [ 3435 + "madsim", 3436 + "spin", 3437 + "tokio", 3438 + ] 3439 + 3440 + [[package]] 3441 + name = "match-lookup" 3442 + version = "0.1.1" 3443 + source = "registry+https://github.com/rust-lang/crates.io-index" 3444 + checksum = "1265724d8cb29dbbc2b0f06fffb8bf1a8c0cf73a78eede9ba73a4a66c52a981e" 3445 + dependencies = [ 3446 + "proc-macro2", 3447 + "quote", 3448 + "syn 1.0.109", 3449 + ] 3450 + 3451 + [[package]] 2140 3452 name = "match_cfg" 2141 3453 version = "0.1.0" 2142 3454 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 2144 3456 2145 3457 [[package]] 2146 3458 name = "matchers" 2147 - version = "0.1.0" 3459 + version = "0.2.0" 2148 3460 source = "registry+https://github.com/rust-lang/crates.io-index" 2149 - checksum = "8263075bb86c5a1b1427b5ae862e8889656f126e9f77c484496e8b47cf5c5558" 3461 + checksum = "d1525a2a28c7f4fa0fc98bb91ae755d1e2d1505079e05539e35bc876b5d65ae9" 2150 3462 dependencies = [ 2151 - "regex-automata 0.1.10", 3463 + "regex-automata", 2152 3464 ] 2153 3465 2154 3466 [[package]] ··· 2170 3482 checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3" 2171 3483 2172 3484 [[package]] 3485 + name = "memoffset" 3486 + version = "0.9.1" 3487 + source = "registry+https://github.com/rust-lang/crates.io-index" 3488 + checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a" 3489 + dependencies = [ 3490 + "autocfg", 3491 + ] 3492 + 3493 + [[package]] 2173 3494 name = "metrics" 2174 - version = "0.24.1" 3495 + version = "0.24.2" 2175 3496 source = "registry+https://github.com/rust-lang/crates.io-index" 2176 - checksum = "7a7deb012b3b2767169ff203fadb4c6b0b82b947512e5eb9e0b78c2e186ad9e3" 3497 + checksum = "25dea7ac8057892855ec285c440160265225438c3c45072613c25a4b26e98ef5" 2177 3498 dependencies = [ 2178 3499 "ahash", 2179 3500 "portable-atomic", ··· 2189 3510 "http-body-util", 2190 3511 "hyper", 2191 3512 "hyper-util", 2192 - "indexmap 2.9.0", 3513 + "indexmap 2.11.4", 2193 3514 "ipnet", 2194 3515 "metrics", 2195 - "metrics-util", 3516 + "metrics-util 0.19.0", 2196 3517 "quanta", 2197 3518 "thiserror 1.0.69", 2198 3519 "tokio", ··· 2200 3521 ] 2201 3522 2202 3523 [[package]] 3524 + name = "metrics-exporter-prometheus" 3525 + version = "0.17.2" 3526 + source = "registry+https://github.com/rust-lang/crates.io-index" 3527 + checksum = "2b166dea96003ee2531cf14833efedced545751d800f03535801d833313f8c15" 3528 + dependencies = [ 3529 + "base64 0.22.1", 3530 + "http-body-util", 3531 + "hyper", 3532 + "hyper-rustls", 3533 + "hyper-util", 3534 + "indexmap 2.11.4", 3535 + "ipnet", 3536 + "metrics", 3537 + "metrics-util 0.20.0", 3538 + "quanta", 3539 + "thiserror 2.0.17", 3540 + "tokio", 3541 + "tracing", 3542 + ] 3543 + 3544 + [[package]] 2203 3545 name = "metrics-process" 2204 3546 version = "2.4.0" 2205 3547 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 2227 3569 "metrics", 2228 3570 "quanta", 2229 3571 "rand 0.8.5", 2230 - "rand_xoshiro", 3572 + "rand_xoshiro 0.6.0", 3573 + "sketches-ddsketch", 3574 + ] 3575 + 3576 + [[package]] 3577 + name = "metrics-util" 3578 + version = "0.20.0" 3579 + source = "registry+https://github.com/rust-lang/crates.io-index" 3580 + checksum = "fe8db7a05415d0f919ffb905afa37784f71901c9a773188876984b4f769ab986" 3581 + dependencies = [ 3582 + "crossbeam-epoch", 3583 + "crossbeam-utils", 3584 + "hashbrown 0.15.2", 3585 + "metrics", 3586 + "quanta", 3587 + "rand 0.9.1", 3588 + "rand_xoshiro 0.7.0", 2231 3589 "sketches-ddsketch", 2232 3590 ] 2233 3591 ··· 2274 3632 ] 2275 3633 2276 3634 [[package]] 3635 + name = "mixtrics" 3636 + version = "0.2.0" 3637 + source = "registry+https://github.com/rust-lang/crates.io-index" 3638 + checksum = "adbcddf5a90b959eea97ae505e0391f5c6dd411fbf546d43b9c59ad1c3bd4391" 3639 + dependencies = [ 3640 + "itertools 0.14.0", 3641 + "parking_lot", 3642 + ] 3643 + 3644 + [[package]] 2277 3645 name = "moka" 2278 3646 version = "0.12.10" 2279 3647 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 2309 3677 "memchr", 2310 3678 "mime", 2311 3679 "spin", 3680 + "tokio", 2312 3681 "version_check", 2313 3682 ] 2314 3683 2315 3684 [[package]] 2316 3685 name = "multibase" 2317 - version = "0.9.1" 3686 + version = "0.9.2" 2318 3687 source = "registry+https://github.com/rust-lang/crates.io-index" 2319 - checksum = "9b3539ec3c1f04ac9748a260728e855f261b4977f5c3406612c884564f329404" 3688 + checksum = "8694bb4835f452b0e3bb06dbebb1d6fc5385b6ca1caf2e55fd165c042390ec77" 2320 3689 dependencies = [ 2321 3690 "base-x", 3691 + "base256emoji", 2322 3692 "data-encoding", 2323 3693 "data-encoding-macro", 2324 3694 ] ··· 2331 3701 dependencies = [ 2332 3702 "core2", 2333 3703 "serde", 2334 - "unsigned-varint", 3704 + "unsigned-varint 0.8.0", 3705 + ] 3706 + 3707 + [[package]] 3708 + name = "naive-timer" 3709 + version = "0.2.0" 3710 + source = "registry+https://github.com/rust-lang/crates.io-index" 3711 + checksum = "034a0ad7deebf0c2abcf2435950a6666c3c15ea9d8fad0c0f48efa8a7f843fed" 3712 + 3713 + [[package]] 3714 + name = "nanorand" 3715 + version = "0.7.0" 3716 + source = "registry+https://github.com/rust-lang/crates.io-index" 3717 + checksum = "6a51313c5820b0b02bd422f4b44776fbf47961755c74ce64afc73bfad10226c3" 3718 + dependencies = [ 3719 + "getrandom 0.2.15", 2335 3720 ] 2336 3721 2337 3722 [[package]] ··· 2346 3731 "openssl-probe", 2347 3732 "openssl-sys", 2348 3733 "schannel", 2349 - "security-framework", 3734 + "security-framework 2.11.1", 2350 3735 "security-framework-sys", 2351 3736 "tempfile", 2352 3737 ] 2353 3738 2354 3739 [[package]] 2355 3740 name = "nix" 2356 - version = "0.29.0" 3741 + version = "0.30.1" 2357 3742 source = "registry+https://github.com/rust-lang/crates.io-index" 2358 - checksum = "71e2746dc3a24dd78b3cfcb7be93368c6de9963d30f43a6a73998a9cf4b17b46" 3743 + checksum = "74523f3a35e05aba87a1d978330aef40f67b0304ac79c1c00b294c9830543db6" 2359 3744 dependencies = [ 2360 3745 "bitflags", 2361 3746 "cfg-if", ··· 2375 3760 2376 3761 [[package]] 2377 3762 name = "nu-ansi-term" 2378 - version = "0.46.0" 3763 + version = "0.50.1" 3764 + source = "registry+https://github.com/rust-lang/crates.io-index" 3765 + checksum = "d4a28e057d01f97e61255210fcff094d74ed0466038633e95017f5beb68e4399" 3766 + dependencies = [ 3767 + "windows-sys 0.52.0", 3768 + ] 3769 + 3770 + [[package]] 3771 + name = "num-bigint" 3772 + version = "0.4.6" 2379 3773 source = "registry+https://github.com/rust-lang/crates.io-index" 2380 - checksum = "77a8165726e8236064dbb45459242600304b42a5ea24ee2948e18e023bf7ba84" 3774 + checksum = "a5e44f723f1133c9deac646763579fdb3ac745e418f2a7af9cd0c431da1f20b9" 2381 3775 dependencies = [ 2382 - "overload", 2383 - "winapi", 3776 + "num-integer", 3777 + "num-traits", 3778 + ] 3779 + 3780 + [[package]] 3781 + name = "num-bigint-dig" 3782 + version = "0.8.4" 3783 + source = "registry+https://github.com/rust-lang/crates.io-index" 3784 + checksum = "dc84195820f291c7697304f3cbdadd1cb7199c0efc917ff5eafd71225c136151" 3785 + dependencies = [ 3786 + "byteorder", 3787 + "lazy_static", 3788 + "libm", 3789 + "num-integer", 3790 + "num-iter", 3791 + "num-traits", 3792 + "rand 0.8.5", 3793 + "smallvec", 3794 + "zeroize", 2384 3795 ] 2385 3796 2386 3797 [[package]] ··· 2400 3811 ] 2401 3812 2402 3813 [[package]] 3814 + name = "num-integer" 3815 + version = "0.1.46" 3816 + source = "registry+https://github.com/rust-lang/crates.io-index" 3817 + checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f" 3818 + dependencies = [ 3819 + "num-traits", 3820 + ] 3821 + 3822 + [[package]] 3823 + name = "num-iter" 3824 + version = "0.1.45" 3825 + source = "registry+https://github.com/rust-lang/crates.io-index" 3826 + checksum = "1429034a0490724d0075ebb2bc9e875d6503c3cf69e235a8941aa757d83ef5bf" 3827 + dependencies = [ 3828 + "autocfg", 3829 + "num-integer", 3830 + "num-traits", 3831 + ] 3832 + 3833 + [[package]] 3834 + name = "num-modular" 3835 + version = "0.6.1" 3836 + source = "registry+https://github.com/rust-lang/crates.io-index" 3837 + checksum = "17bb261bf36fa7d83f4c294f834e91256769097b3cb505d44831e0a179ac647f" 3838 + 3839 + [[package]] 3840 + name = "num-order" 3841 + version = "1.2.0" 3842 + source = "registry+https://github.com/rust-lang/crates.io-index" 3843 + checksum = "537b596b97c40fcf8056d153049eb22f481c17ebce72a513ec9286e4986d1bb6" 3844 + dependencies = [ 3845 + "num-modular", 3846 + ] 3847 + 3848 + [[package]] 2403 3849 name = "num-traits" 2404 3850 version = "0.2.19" 2405 3851 source = "registry+https://github.com/rust-lang/crates.io-index" 2406 3852 checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841" 2407 3853 dependencies = [ 2408 3854 "autocfg", 3855 + "libm", 2409 3856 ] 2410 3857 2411 3858 [[package]] ··· 2427 3874 ] 2428 3875 2429 3876 [[package]] 3877 + name = "oid-registry" 3878 + version = "0.8.1" 3879 + source = "registry+https://github.com/rust-lang/crates.io-index" 3880 + checksum = "12f40cff3dde1b6087cc5d5f5d4d65712f34016a03ed60e9c08dcc392736b5b7" 3881 + dependencies = [ 3882 + "asn1-rs", 3883 + ] 3884 + 3885 + [[package]] 2430 3886 name = "once_cell" 2431 3887 version = "1.21.3" 2432 3888 source = "registry+https://github.com/rust-lang/crates.io-index" 2433 3889 checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d" 3890 + dependencies = [ 3891 + "critical-section", 3892 + "portable-atomic", 3893 + ] 2434 3894 2435 3895 [[package]] 2436 3896 name = "openapiv3" 2437 - version = "2.0.0" 3897 + version = "2.2.0" 2438 3898 source = "registry+https://github.com/rust-lang/crates.io-index" 2439 - checksum = "cc02deea53ffe807708244e5914f6b099ad7015a207ee24317c22112e17d9c5c" 3899 + checksum = "5c8d427828b22ae1fff2833a03d8486c2c881367f1c336349f307f321e7f4d05" 2440 3900 dependencies = [ 2441 - "indexmap 2.9.0", 3901 + "indexmap 2.11.4", 2442 3902 "serde", 2443 3903 "serde_json", 2444 3904 ] ··· 2466 3926 dependencies = [ 2467 3927 "proc-macro2", 2468 3928 "quote", 2469 - "syn", 3929 + "syn 2.0.106", 2470 3930 ] 2471 3931 2472 3932 [[package]] ··· 2498 3958 ] 2499 3959 2500 3960 [[package]] 2501 - name = "overload" 2502 - version = "0.1.1" 3961 + name = "ordered_hash_map" 3962 + version = "0.4.0" 2503 3963 source = "registry+https://github.com/rust-lang/crates.io-index" 2504 - checksum = "b15813163c1d831bf4a13c3610c05c0d03b39feb07f7e09fa234dac9b15aaf39" 3964 + checksum = "ab0e5f22bf6dd04abd854a8874247813a8fa2c8c1260eba6fbb150270ce7c176" 3965 + dependencies = [ 3966 + "hashbrown 0.13.2", 3967 + ] 3968 + 3969 + [[package]] 3970 + name = "p256" 3971 + version = "0.13.2" 3972 + source = "registry+https://github.com/rust-lang/crates.io-index" 3973 + checksum = "c9863ad85fa8f4460f9c48cb909d38a0d689dba1f6f6988a5e3e0d31071bcd4b" 3974 + dependencies = [ 3975 + "ecdsa", 3976 + "elliptic-curve", 3977 + "primeorder", 3978 + "sha2", 3979 + ] 3980 + 3981 + [[package]] 3982 + name = "p384" 3983 + version = "0.13.1" 3984 + source = "registry+https://github.com/rust-lang/crates.io-index" 3985 + checksum = "fe42f1670a52a47d448f14b6a5c61dd78fce51856e68edaa38f7ae3a46b8d6b6" 3986 + dependencies = [ 3987 + "elliptic-curve", 3988 + "primeorder", 3989 + ] 3990 + 3991 + [[package]] 3992 + name = "panic-message" 3993 + version = "0.3.0" 3994 + source = "registry+https://github.com/rust-lang/crates.io-index" 3995 + checksum = "384e52fd8fbd4cbe3c317e8216260c21a0f9134de108cea8a4dd4e7e152c472d" 2505 3996 2506 3997 [[package]] 2507 3998 name = "parking" ··· 2529 4020 "libc", 2530 4021 "redox_syscall", 2531 4022 "smallvec", 2532 - "windows-targets", 4023 + "windows-targets 0.52.6", 2533 4024 ] 2534 4025 2535 4026 [[package]] ··· 2557 4048 ] 2558 4049 2559 4050 [[package]] 4051 + name = "pem" 4052 + version = "3.0.5" 4053 + source = "registry+https://github.com/rust-lang/crates.io-index" 4054 + checksum = "38af38e8470ac9dee3ce1bae1af9c1671fffc44ddfd8bd1d0a3445bf349a8ef3" 4055 + dependencies = [ 4056 + "base64 0.22.1", 4057 + "serde", 4058 + ] 4059 + 4060 + [[package]] 4061 + name = "pem-rfc7468" 4062 + version = "0.7.0" 4063 + source = "registry+https://github.com/rust-lang/crates.io-index" 4064 + checksum = "88b39c9bfcfc231068454382784bb460aae594343fb030d46e9f50a645418412" 4065 + dependencies = [ 4066 + "base64ct", 4067 + ] 4068 + 4069 + [[package]] 2560 4070 name = "percent-encoding" 2561 4071 version = "2.3.1" 2562 4072 source = "registry+https://github.com/rust-lang/crates.io-index" 2563 4073 checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e" 2564 4074 2565 4075 [[package]] 4076 + name = "pest" 4077 + version = "2.8.1" 4078 + source = "registry+https://github.com/rust-lang/crates.io-index" 4079 + checksum = "1db05f56d34358a8b1066f67cbb203ee3e7ed2ba674a6263a1d5ec6db2204323" 4080 + dependencies = [ 4081 + "memchr", 4082 + "thiserror 2.0.17", 4083 + "ucd-trie", 4084 + ] 4085 + 4086 + [[package]] 4087 + name = "pest_derive" 4088 + version = "2.8.1" 4089 + source = "registry+https://github.com/rust-lang/crates.io-index" 4090 + checksum = "bb056d9e8ea77922845ec74a1c4e8fb17e7c218cc4fc11a15c5d25e189aa40bc" 4091 + dependencies = [ 4092 + "pest", 4093 + "pest_generator", 4094 + ] 4095 + 4096 + [[package]] 4097 + name = "pest_generator" 4098 + version = "2.8.1" 4099 + source = "registry+https://github.com/rust-lang/crates.io-index" 4100 + checksum = "87e404e638f781eb3202dc82db6760c8ae8a1eeef7fb3fa8264b2ef280504966" 4101 + dependencies = [ 4102 + "pest", 4103 + "pest_meta", 4104 + "proc-macro2", 4105 + "quote", 4106 + "syn 2.0.106", 4107 + ] 4108 + 4109 + [[package]] 4110 + name = "pest_meta" 4111 + version = "2.8.1" 4112 + source = "registry+https://github.com/rust-lang/crates.io-index" 4113 + checksum = "edd1101f170f5903fde0914f899bb503d9ff5271d7ba76bbb70bea63690cc0d5" 4114 + dependencies = [ 4115 + "pest", 4116 + "sha2", 4117 + ] 4118 + 4119 + [[package]] 4120 + name = "pin-project" 4121 + version = "1.1.10" 4122 + source = "registry+https://github.com/rust-lang/crates.io-index" 4123 + checksum = "677f1add503faace112b9f1373e43e9e054bfdd22ff1a63c1bc485eaec6a6a8a" 4124 + dependencies = [ 4125 + "pin-project-internal", 4126 + ] 4127 + 4128 + [[package]] 4129 + name = "pin-project-internal" 4130 + version = "1.1.10" 4131 + source = "registry+https://github.com/rust-lang/crates.io-index" 4132 + checksum = "6e918e4ff8c4549eb882f14b3a4bc8c8bc93de829416eacf579f1207a8fbf861" 4133 + dependencies = [ 4134 + "proc-macro2", 4135 + "quote", 4136 + "syn 2.0.106", 4137 + ] 4138 + 4139 + [[package]] 2566 4140 name = "pin-project-lite" 2567 4141 version = "0.2.16" 2568 4142 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 2575 4149 checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184" 2576 4150 2577 4151 [[package]] 4152 + name = "pkcs1" 4153 + version = "0.7.5" 4154 + source = "registry+https://github.com/rust-lang/crates.io-index" 4155 + checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f" 4156 + dependencies = [ 4157 + "der", 4158 + "pkcs8", 4159 + "spki", 4160 + ] 4161 + 4162 + [[package]] 4163 + name = "pkcs8" 4164 + version = "0.10.2" 4165 + source = "registry+https://github.com/rust-lang/crates.io-index" 4166 + checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7" 4167 + dependencies = [ 4168 + "der", 4169 + "spki", 4170 + ] 4171 + 4172 + [[package]] 2578 4173 name = "pkg-config" 2579 4174 version = "0.3.32" 2580 4175 source = "registry+https://github.com/rust-lang/crates.io-index" 2581 4176 checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c" 2582 4177 2583 4178 [[package]] 4179 + name = "pocket" 4180 + version = "0.1.0" 4181 + dependencies = [ 4182 + "atrium-crypto", 4183 + "clap", 4184 + "jwt-compact", 4185 + "log", 4186 + "poem", 4187 + "poem-openapi", 4188 + "reqwest", 4189 + "rusqlite", 4190 + "serde", 4191 + "serde_json", 4192 + "thiserror 2.0.17", 4193 + "tokio", 4194 + "tracing-subscriber", 4195 + ] 4196 + 4197 + [[package]] 4198 + name = "poem" 4199 + version = "3.1.12" 4200 + source = "registry+https://github.com/rust-lang/crates.io-index" 4201 + checksum = "9f977080932c87287147dca052951c3e2696f8759863f6b4e4c0c9ffe7a4cc8b" 4202 + dependencies = [ 4203 + "base64 0.22.1", 4204 + "bytes", 4205 + "chrono", 4206 + "futures-util", 4207 + "headers", 4208 + "http", 4209 + "http-body-util", 4210 + "httpdate", 4211 + "hyper", 4212 + "hyper-util", 4213 + "mime", 4214 + "mime_guess", 4215 + "multer", 4216 + "nix", 4217 + "parking_lot", 4218 + "percent-encoding", 4219 + "pin-project-lite", 4220 + "poem-derive", 4221 + "quick-xml", 4222 + "rcgen", 4223 + "regex", 4224 + "reqwest", 4225 + "rfc7239", 4226 + "ring", 4227 + "rustls-pemfile", 4228 + "serde", 4229 + "serde_json", 4230 + "serde_urlencoded", 4231 + "serde_yaml", 4232 + "smallvec", 4233 + "sync_wrapper", 4234 + "tempfile", 4235 + "thiserror 2.0.17", 4236 + "tokio", 4237 + "tokio-rustls 0.26.2", 4238 + "tokio-stream", 4239 + "tokio-util", 4240 + "tracing", 4241 + "wildmatch", 4242 + "x509-parser", 4243 + ] 4244 + 4245 + [[package]] 4246 + name = "poem-derive" 4247 + version = "3.1.12" 4248 + source = "registry+https://github.com/rust-lang/crates.io-index" 4249 + checksum = "056e2fea6de1cb240ffe23cfc4fc370b629f8be83b5f27e16b7acd5231a72de4" 4250 + dependencies = [ 4251 + "proc-macro-crate", 4252 + "proc-macro2", 4253 + "quote", 4254 + "syn 2.0.106", 4255 + ] 4256 + 4257 + [[package]] 4258 + name = "poem-openapi" 4259 + version = "5.1.16" 4260 + source = "registry+https://github.com/rust-lang/crates.io-index" 4261 + checksum = "1ccbcc395bf4dd03df1da32da351b6b6732e4074ce27ddec315650e52a2be44c" 4262 + dependencies = [ 4263 + "base64 0.22.1", 4264 + "bytes", 4265 + "derive_more", 4266 + "futures-util", 4267 + "indexmap 2.11.4", 4268 + "itertools 0.14.0", 4269 + "mime", 4270 + "num-traits", 4271 + "poem", 4272 + "poem-openapi-derive", 4273 + "quick-xml", 4274 + "regex", 4275 + "serde", 4276 + "serde_json", 4277 + "serde_urlencoded", 4278 + "serde_yaml", 4279 + "thiserror 2.0.17", 4280 + "tokio", 4281 + ] 4282 + 4283 + [[package]] 4284 + name = "poem-openapi-derive" 4285 + version = "5.1.16" 4286 + source = "registry+https://github.com/rust-lang/crates.io-index" 4287 + checksum = "41273b691a3d467a8c44d05506afba9f7b6bd56c9cdf80123de13fe52d7ec587" 4288 + dependencies = [ 4289 + "darling 0.20.11", 4290 + "http", 4291 + "indexmap 2.11.4", 4292 + "mime", 4293 + "proc-macro-crate", 4294 + "proc-macro2", 4295 + "quote", 4296 + "regex", 4297 + "syn 2.0.106", 4298 + "thiserror 2.0.17", 4299 + ] 4300 + 4301 + [[package]] 2584 4302 name = "portable-atomic" 2585 4303 version = "1.11.0" 2586 4304 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 2611 4329 ] 2612 4330 2613 4331 [[package]] 4332 + name = "prettyplease" 4333 + version = "0.2.34" 4334 + source = "registry+https://github.com/rust-lang/crates.io-index" 4335 + checksum = "6837b9e10d61f45f987d50808f83d1ee3d206c66acf650c3e4ae2e1f6ddedf55" 4336 + dependencies = [ 4337 + "proc-macro2", 4338 + "syn 2.0.106", 4339 + ] 4340 + 4341 + [[package]] 4342 + name = "primeorder" 4343 + version = "0.13.6" 4344 + source = "registry+https://github.com/rust-lang/crates.io-index" 4345 + checksum = "353e1ca18966c16d9deb1c69278edbc5f194139612772bd9537af60ac231e1e6" 4346 + dependencies = [ 4347 + "elliptic-curve", 4348 + ] 4349 + 4350 + [[package]] 4351 + name = "proc-macro-crate" 4352 + version = "3.3.0" 4353 + source = "registry+https://github.com/rust-lang/crates.io-index" 4354 + checksum = "edce586971a4dfaa28950c6f18ed55e0406c1ab88bbce2c6f6293a7aaba73d35" 4355 + dependencies = [ 4356 + "toml_edit", 4357 + ] 4358 + 4359 + [[package]] 2614 4360 name = "proc-macro2" 2615 4361 version = "1.0.94" 2616 4362 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 2657 4403 ] 2658 4404 2659 4405 [[package]] 4406 + name = "quasar" 4407 + version = "0.1.0" 4408 + dependencies = [ 4409 + "clap", 4410 + "fjall 2.11.2 (registry+https://github.com/rust-lang/crates.io-index)", 4411 + ] 4412 + 4413 + [[package]] 4414 + name = "quick-xml" 4415 + version = "0.36.2" 4416 + source = "registry+https://github.com/rust-lang/crates.io-index" 4417 + checksum = "f7649a7b4df05aed9ea7ec6f628c67c9953a43869b8bc50929569b2999d443fe" 4418 + dependencies = [ 4419 + "memchr", 4420 + "serde", 4421 + ] 4422 + 4423 + [[package]] 2660 4424 name = "quick_cache" 2661 - version = "0.6.12" 4425 + version = "0.6.16" 2662 4426 source = "registry+https://github.com/rust-lang/crates.io-index" 2663 - checksum = "8f8ed0655cbaf18a26966142ad23b95d8ab47221c50c4f73a1db7d0d2d6e3da8" 4427 + checksum = "9ad6644cb07b7f3488b9f3d2fde3b4c0a7fa367cafefb39dff93a659f76eb786" 2664 4428 dependencies = [ 2665 4429 "equivalent", 2666 4430 "hashbrown 0.15.2", 2667 4431 ] 2668 4432 2669 4433 [[package]] 4434 + name = "quinn" 4435 + version = "0.11.8" 4436 + source = "registry+https://github.com/rust-lang/crates.io-index" 4437 + checksum = "626214629cda6781b6dc1d316ba307189c85ba657213ce642d9c77670f8202c8" 4438 + dependencies = [ 4439 + "bytes", 4440 + "cfg_aliases", 4441 + "pin-project-lite", 4442 + "quinn-proto", 4443 + "quinn-udp", 4444 + "rustc-hash 2.1.1", 4445 + "rustls 0.23.31", 4446 + "socket2 0.5.9", 4447 + "thiserror 2.0.17", 4448 + "tokio", 4449 + "tracing", 4450 + "web-time", 4451 + ] 4452 + 4453 + [[package]] 4454 + name = "quinn-proto" 4455 + version = "0.11.12" 4456 + source = "registry+https://github.com/rust-lang/crates.io-index" 4457 + checksum = "49df843a9161c85bb8aae55f101bc0bac8bcafd637a620d9122fd7e0b2f7422e" 4458 + dependencies = [ 4459 + "bytes", 4460 + "getrandom 0.3.3", 4461 + "lru-slab", 4462 + "rand 0.9.1", 4463 + "ring", 4464 + "rustc-hash 2.1.1", 4465 + "rustls 0.23.31", 4466 + "rustls-pki-types", 4467 + "slab", 4468 + "thiserror 2.0.17", 4469 + "tinyvec", 4470 + "tracing", 4471 + "web-time", 4472 + ] 4473 + 4474 + [[package]] 4475 + name = "quinn-udp" 4476 + version = "0.5.13" 4477 + source = "registry+https://github.com/rust-lang/crates.io-index" 4478 + checksum = "fcebb1209ee276352ef14ff8732e24cc2b02bbac986cd74a4c81bcb2f9881970" 4479 + dependencies = [ 4480 + "cfg_aliases", 4481 + "libc", 4482 + "once_cell", 4483 + "socket2 0.5.9", 4484 + "tracing", 4485 + "windows-sys 0.59.0", 4486 + ] 4487 + 4488 + [[package]] 2670 4489 name = "quote" 2671 4490 version = "1.0.40" 2672 4491 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 2750 4569 ] 2751 4570 2752 4571 [[package]] 4572 + name = "rand_xoshiro" 4573 + version = "0.7.0" 4574 + source = "registry+https://github.com/rust-lang/crates.io-index" 4575 + checksum = "f703f4665700daf5512dcca5f43afa6af89f09db47fb56be587f80636bda2d41" 4576 + dependencies = [ 4577 + "rand_core 0.9.3", 4578 + ] 4579 + 4580 + [[package]] 2753 4581 name = "ratelimit" 2754 4582 version = "0.10.0" 2755 4583 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 2770 4598 ] 2771 4599 2772 4600 [[package]] 4601 + name = "rcgen" 4602 + version = "0.12.1" 4603 + source = "registry+https://github.com/rust-lang/crates.io-index" 4604 + checksum = "48406db8ac1f3cbc7dcdb56ec355343817958a356ff430259bb07baf7607e1e1" 4605 + dependencies = [ 4606 + "pem", 4607 + "ring", 4608 + "time", 4609 + "yasna", 4610 + ] 4611 + 4612 + [[package]] 2773 4613 name = "redox_syscall" 2774 4614 version = "0.5.11" 2775 4615 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 2806 4646 dependencies = [ 2807 4647 "proc-macro2", 2808 4648 "quote", 2809 - "syn", 4649 + "syn 2.0.106", 4650 + ] 4651 + 4652 + [[package]] 4653 + name = "reflector" 4654 + version = "0.1.0" 4655 + dependencies = [ 4656 + "clap", 4657 + "log", 4658 + "poem", 4659 + "serde", 4660 + "tokio", 4661 + "tracing-subscriber", 2810 4662 ] 2811 4663 2812 4664 [[package]] ··· 2817 4669 dependencies = [ 2818 4670 "aho-corasick", 2819 4671 "memchr", 2820 - "regex-automata 0.4.9", 2821 - "regex-syntax 0.8.5", 2822 - ] 2823 - 2824 - [[package]] 2825 - name = "regex-automata" 2826 - version = "0.1.10" 2827 - source = "registry+https://github.com/rust-lang/crates.io-index" 2828 - checksum = "6c230d73fb8d8c1b9c0b3135c5142a8acee3a0558fb8db5cf1cb65f8d7862132" 2829 - dependencies = [ 2830 - "regex-syntax 0.6.29", 4672 + "regex-automata", 4673 + "regex-syntax", 2831 4674 ] 2832 4675 2833 4676 [[package]] ··· 2838 4681 dependencies = [ 2839 4682 "aho-corasick", 2840 4683 "memchr", 2841 - "regex-syntax 0.8.5", 4684 + "regex-syntax", 2842 4685 ] 2843 4686 2844 4687 [[package]] 2845 4688 name = "regex-syntax" 2846 - version = "0.6.29" 4689 + version = "0.8.5" 2847 4690 source = "registry+https://github.com/rust-lang/crates.io-index" 2848 - checksum = "f162c6dd7b008981e4d40210aca20b4bd0f9b60ca9271061b07f78537722f2e1" 4691 + checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c" 2849 4692 2850 4693 [[package]] 2851 - name = "regex-syntax" 2852 - version = "0.8.5" 4694 + name = "repo-stream" 4695 + version = "0.2.2" 2853 4696 source = "registry+https://github.com/rust-lang/crates.io-index" 2854 - checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c" 4697 + checksum = "093b48e604c138949bf3d4a1a9bc1165feb1db28a73af0101c84eb703d279f43" 4698 + dependencies = [ 4699 + "bincode 2.0.1", 4700 + "futures", 4701 + "futures-core", 4702 + "ipld-core", 4703 + "iroh-car", 4704 + "log", 4705 + "multibase", 4706 + "rusqlite", 4707 + "serde", 4708 + "serde_bytes", 4709 + "serde_ipld_dagcbor", 4710 + "sha2", 4711 + "thiserror 2.0.17", 4712 + "tokio", 4713 + ] 4714 + 4715 + [[package]] 4716 + name = "reqwest" 4717 + version = "0.12.24" 4718 + source = "registry+https://github.com/rust-lang/crates.io-index" 4719 + checksum = "9d0946410b9f7b082a427e4ef5c8ff541a88b357bc6c637c40db3a68ac70a36f" 4720 + dependencies = [ 4721 + "async-compression", 4722 + "base64 0.22.1", 4723 + "bytes", 4724 + "encoding_rs", 4725 + "futures-core", 4726 + "futures-util", 4727 + "h2", 4728 + "http", 4729 + "http-body", 4730 + "http-body-util", 4731 + "hyper", 4732 + "hyper-rustls", 4733 + "hyper-tls", 4734 + "hyper-util", 4735 + "js-sys", 4736 + "log", 4737 + "mime", 4738 + "native-tls", 4739 + "percent-encoding", 4740 + "pin-project-lite", 4741 + "quinn", 4742 + "rustls 0.23.31", 4743 + "rustls-native-certs", 4744 + "rustls-pki-types", 4745 + "serde", 4746 + "serde_json", 4747 + "serde_urlencoded", 4748 + "sync_wrapper", 4749 + "tokio", 4750 + "tokio-native-tls", 4751 + "tokio-rustls 0.26.2", 4752 + "tokio-util", 4753 + "tower", 4754 + "tower-http", 4755 + "tower-service", 4756 + "url", 4757 + "wasm-bindgen", 4758 + "wasm-bindgen-futures", 4759 + "wasm-streams", 4760 + "web-sys", 4761 + ] 4762 + 4763 + [[package]] 4764 + name = "resolv-conf" 4765 + version = "0.7.4" 4766 + source = "registry+https://github.com/rust-lang/crates.io-index" 4767 + checksum = "95325155c684b1c89f7765e30bc1c42e4a6da51ca513615660cb8a62ef9a88e3" 4768 + 4769 + [[package]] 4770 + name = "rfc6979" 4771 + version = "0.4.0" 4772 + source = "registry+https://github.com/rust-lang/crates.io-index" 4773 + checksum = "f8dd2a808d456c4a54e300a23e9f5a67e122c3024119acbfd73e3bf664491cb2" 4774 + dependencies = [ 4775 + "hmac", 4776 + "subtle", 4777 + ] 4778 + 4779 + [[package]] 4780 + name = "rfc7239" 4781 + version = "0.1.3" 4782 + source = "registry+https://github.com/rust-lang/crates.io-index" 4783 + checksum = "4a82f1d1e38e9a85bb58ffcfadf22ed6f2c94e8cd8581ec2b0f80a2a6858350f" 4784 + dependencies = [ 4785 + "uncased", 4786 + ] 2855 4787 2856 4788 [[package]] 2857 4789 name = "ring" ··· 2887 4819 ] 2888 4820 2889 4821 [[package]] 4822 + name = "rsa" 4823 + version = "0.9.8" 4824 + source = "registry+https://github.com/rust-lang/crates.io-index" 4825 + checksum = "78928ac1ed176a5ca1d17e578a1825f3d81ca54cf41053a592584b020cfd691b" 4826 + dependencies = [ 4827 + "const-oid", 4828 + "digest", 4829 + "num-bigint-dig", 4830 + "num-integer", 4831 + "num-traits", 4832 + "pkcs1", 4833 + "pkcs8", 4834 + "rand_core 0.6.4", 4835 + "signature", 4836 + "spki", 4837 + "subtle", 4838 + "zeroize", 4839 + ] 4840 + 4841 + [[package]] 4842 + name = "rusqlite" 4843 + version = "0.37.0" 4844 + source = "registry+https://github.com/rust-lang/crates.io-index" 4845 + checksum = "165ca6e57b20e1351573e3729b958bc62f0e48025386970b6e4d29e7a7e71f3f" 4846 + dependencies = [ 4847 + "bitflags", 4848 + "fallible-iterator", 4849 + "fallible-streaming-iterator", 4850 + "hashlink", 4851 + "libsqlite3-sys", 4852 + "smallvec", 4853 + ] 4854 + 4855 + [[package]] 2890 4856 name = "rustc-demangle" 2891 4857 version = "0.1.24" 2892 4858 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 2914 4880 ] 2915 4881 2916 4882 [[package]] 4883 + name = "rusticata-macros" 4884 + version = "4.1.0" 4885 + source = "registry+https://github.com/rust-lang/crates.io-index" 4886 + checksum = "faf0c4a6ece9950b9abdb62b1cfcf2a68b3b67a10ba445b3bb85be2a293d0632" 4887 + dependencies = [ 4888 + "nom", 4889 + ] 4890 + 4891 + [[package]] 2917 4892 name = "rustix" 2918 4893 version = "0.38.44" 2919 4894 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 2948 4923 "log", 2949 4924 "ring", 2950 4925 "rustls-pki-types", 2951 - "rustls-webpki", 4926 + "rustls-webpki 0.102.8", 2952 4927 "subtle", 2953 4928 "zeroize", 2954 4929 ] 2955 4930 2956 4931 [[package]] 4932 + name = "rustls" 4933 + version = "0.23.31" 4934 + source = "registry+https://github.com/rust-lang/crates.io-index" 4935 + checksum = "c0ebcbd2f03de0fc1122ad9bb24b127a5a6cd51d72604a3f3c50ac459762b6cc" 4936 + dependencies = [ 4937 + "aws-lc-rs", 4938 + "log", 4939 + "once_cell", 4940 + "ring", 4941 + "rustls-pki-types", 4942 + "rustls-webpki 0.103.4", 4943 + "subtle", 4944 + "zeroize", 4945 + ] 4946 + 4947 + [[package]] 4948 + name = "rustls-native-certs" 4949 + version = "0.8.1" 4950 + source = "registry+https://github.com/rust-lang/crates.io-index" 4951 + checksum = "7fcff2dd52b58a8d98a70243663a0d234c4e2b79235637849d15913394a247d3" 4952 + dependencies = [ 4953 + "openssl-probe", 4954 + "rustls-pki-types", 4955 + "schannel", 4956 + "security-framework 3.2.0", 4957 + ] 4958 + 4959 + [[package]] 2957 4960 name = "rustls-pemfile" 2958 4961 version = "2.2.0" 2959 4962 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 2964 4967 2965 4968 [[package]] 2966 4969 name = "rustls-pki-types" 2967 - version = "1.11.0" 4970 + version = "1.12.0" 2968 4971 source = "registry+https://github.com/rust-lang/crates.io-index" 2969 - checksum = "917ce264624a4b4db1c364dcc35bfca9ded014d0a958cd47ad3e960e988ea51c" 4972 + checksum = "229a4a4c221013e7e1f1a043678c5cc39fe5171437c88fb47151a21e6f5b5c79" 4973 + dependencies = [ 4974 + "web-time", 4975 + "zeroize", 4976 + ] 2970 4977 2971 4978 [[package]] 2972 4979 name = "rustls-webpki" ··· 2980 4987 ] 2981 4988 2982 4989 [[package]] 4990 + name = "rustls-webpki" 4991 + version = "0.103.4" 4992 + source = "registry+https://github.com/rust-lang/crates.io-index" 4993 + checksum = "0a17884ae0c1b773f1ccd2bd4a8c72f16da897310a98b0e84bf349ad5ead92fc" 4994 + dependencies = [ 4995 + "aws-lc-rs", 4996 + "ring", 4997 + "rustls-pki-types", 4998 + "untrusted", 4999 + ] 5000 + 5001 + [[package]] 2983 5002 name = "rustversion" 2984 5003 version = "1.0.20" 2985 5004 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 2992 5011 checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f" 2993 5012 2994 5013 [[package]] 5014 + name = "same-file" 5015 + version = "1.0.6" 5016 + source = "registry+https://github.com/rust-lang/crates.io-index" 5017 + checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502" 5018 + dependencies = [ 5019 + "winapi-util", 5020 + ] 5021 + 5022 + [[package]] 2995 5023 name = "schannel" 2996 5024 version = "0.1.27" 2997 5025 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 3023 5051 "proc-macro2", 3024 5052 "quote", 3025 5053 "serde_derive_internals", 3026 - "syn", 5054 + "syn 2.0.106", 3027 5055 ] 3028 5056 3029 5057 [[package]] ··· 3039 5067 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49" 3040 5068 3041 5069 [[package]] 5070 + name = "sec1" 5071 + version = "0.7.3" 5072 + source = "registry+https://github.com/rust-lang/crates.io-index" 5073 + checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc" 5074 + dependencies = [ 5075 + "base16ct", 5076 + "der", 5077 + "generic-array", 5078 + "pkcs8", 5079 + "subtle", 5080 + "zeroize", 5081 + ] 5082 + 5083 + [[package]] 5084 + name = "secp256k1" 5085 + version = "0.30.0" 5086 + source = "registry+https://github.com/rust-lang/crates.io-index" 5087 + checksum = "b50c5943d326858130af85e049f2661ba3c78b26589b8ab98e65e80ae44a1252" 5088 + dependencies = [ 5089 + "bitcoin_hashes", 5090 + "rand 0.8.5", 5091 + "secp256k1-sys", 5092 + ] 5093 + 5094 + [[package]] 5095 + name = "secp256k1-sys" 5096 + version = "0.10.1" 5097 + source = "registry+https://github.com/rust-lang/crates.io-index" 5098 + checksum = "d4387882333d3aa8cb20530a17c69a3752e97837832f34f6dccc760e715001d9" 5099 + dependencies = [ 5100 + "cc", 5101 + ] 5102 + 5103 + [[package]] 3042 5104 name = "security-framework" 3043 5105 version = "2.11.1" 3044 5106 source = "registry+https://github.com/rust-lang/crates.io-index" 3045 5107 checksum = "897b2245f0b511c87893af39b033e5ca9cce68824c4d7e7630b5a1d339658d02" 3046 5108 dependencies = [ 3047 5109 "bitflags", 3048 - "core-foundation", 5110 + "core-foundation 0.9.4", 5111 + "core-foundation-sys", 5112 + "libc", 5113 + "security-framework-sys", 5114 + ] 5115 + 5116 + [[package]] 5117 + name = "security-framework" 5118 + version = "3.2.0" 5119 + source = "registry+https://github.com/rust-lang/crates.io-index" 5120 + checksum = "271720403f46ca04f7ba6f55d438f8bd878d6b8ca0a1046e8228c4145bcbb316" 5121 + dependencies = [ 5122 + "bitflags", 5123 + "core-foundation 0.10.1", 3049 5124 "core-foundation-sys", 3050 5125 "libc", 3051 5126 "security-framework-sys", ··· 3063 5138 3064 5139 [[package]] 3065 5140 name = "self_cell" 3066 - version = "1.1.0" 5141 + version = "1.2.0" 3067 5142 source = "registry+https://github.com/rust-lang/crates.io-index" 3068 - checksum = "c2fdfc24bc566f839a2da4c4295b82db7d25a24253867d5c64355abb5799bdbe" 5143 + checksum = "0f7d95a54511e0c7be3f51e8867aa8cf35148d7b9445d44de2f943e2b206e749" 3069 5144 3070 5145 [[package]] 3071 5146 name = "semver" ··· 3075 5150 3076 5151 [[package]] 3077 5152 name = "serde" 3078 - version = "1.0.219" 5153 + version = "1.0.228" 3079 5154 source = "registry+https://github.com/rust-lang/crates.io-index" 3080 - checksum = "5f0e2c6ed6606019b4e29e69dbaba95b11854410e5347d525002456dbbb786b6" 5155 + checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e" 3081 5156 dependencies = [ 5157 + "serde_core", 3082 5158 "serde_derive", 3083 5159 ] 3084 5160 3085 5161 [[package]] 3086 5162 name = "serde_bytes" 3087 - version = "0.11.17" 5163 + version = "0.11.19" 3088 5164 source = "registry+https://github.com/rust-lang/crates.io-index" 3089 - checksum = "8437fd221bde2d4ca316d61b90e337e9e702b3820b87d63caa9ba6c02bd06d96" 5165 + checksum = "a5d440709e79d88e51ac01c4b72fc6cb7314017bb7da9eeff678aa94c10e3ea8" 3090 5166 dependencies = [ 3091 5167 "serde", 5168 + "serde_core", 5169 + ] 5170 + 5171 + [[package]] 5172 + name = "serde_core" 5173 + version = "1.0.228" 5174 + source = "registry+https://github.com/rust-lang/crates.io-index" 5175 + checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad" 5176 + dependencies = [ 5177 + "serde_derive", 3092 5178 ] 3093 5179 3094 5180 [[package]] 3095 5181 name = "serde_derive" 3096 - version = "1.0.219" 5182 + version = "1.0.228" 3097 5183 source = "registry+https://github.com/rust-lang/crates.io-index" 3098 - checksum = "5b0276cf7f2c73365f7157c8123c21cd9a50fbbd844757af28ca1f5925fc2a00" 5184 + checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79" 3099 5185 dependencies = [ 3100 5186 "proc-macro2", 3101 5187 "quote", 3102 - "syn", 5188 + "syn 2.0.106", 3103 5189 ] 3104 5190 3105 5191 [[package]] ··· 3110 5196 dependencies = [ 3111 5197 "proc-macro2", 3112 5198 "quote", 3113 - "syn", 5199 + "syn 2.0.106", 3114 5200 ] 3115 5201 3116 5202 [[package]] ··· 3120 5206 checksum = "9d2de91cf02bbc07cde38891769ccd5d4f073d22a40683aa4bc7a95781aaa2c4" 3121 5207 dependencies = [ 3122 5208 "form_urlencoded", 3123 - "indexmap 2.9.0", 5209 + "indexmap 2.11.4", 3124 5210 "itoa", 3125 5211 "ryu", 3126 5212 "serde", 3127 5213 ] 3128 5214 3129 5215 [[package]] 5216 + name = "serde_ipld_dagcbor" 5217 + version = "0.6.4" 5218 + source = "registry+https://github.com/rust-lang/crates.io-index" 5219 + checksum = "46182f4f08349a02b45c998ba3215d3f9de826246ba02bb9dddfe9a2a2100778" 5220 + dependencies = [ 5221 + "cbor4ii 0.2.14", 5222 + "ipld-core", 5223 + "scopeguard", 5224 + "serde", 5225 + ] 5226 + 5227 + [[package]] 3130 5228 name = "serde_json" 3131 - version = "1.0.140" 5229 + version = "1.0.145" 3132 5230 source = "registry+https://github.com/rust-lang/crates.io-index" 3133 - checksum = "20068b6e96dc6c9bd23e01df8827e6c7e1f2fddd43c21810382803c136b99373" 5231 + checksum = "402a6f66d8c709116cf22f558eab210f5a50187f702eb4d7e5ef38d9a7f1c79c" 3134 5232 dependencies = [ 3135 5233 "itoa", 3136 5234 "memchr", 3137 5235 "ryu", 3138 5236 "serde", 5237 + "serde_core", 3139 5238 ] 3140 5239 3141 5240 [[package]] ··· 3158 5257 "percent-encoding", 3159 5258 "ryu", 3160 5259 "serde", 3161 - "thiserror 2.0.12", 5260 + "thiserror 2.0.17", 3162 5261 ] 3163 5262 3164 5263 [[package]] 3165 5264 name = "serde_spanned" 3166 - version = "0.6.8" 5265 + version = "0.6.9" 3167 5266 source = "registry+https://github.com/rust-lang/crates.io-index" 3168 - checksum = "87607cb1398ed59d48732e575a4c28a7a8ebf2454b964fe3f224f2afc07909e1" 5267 + checksum = "bf41e0cfaf7226dca15e8197172c295a782857fcb97fad1808a166870dee75a3" 3169 5268 dependencies = [ 3170 5269 "serde", 3171 5270 ] 3172 5271 3173 5272 [[package]] 5273 + name = "serde_spanned" 5274 + version = "1.0.2" 5275 + source = "registry+https://github.com/rust-lang/crates.io-index" 5276 + checksum = "5417783452c2be558477e104686f7de5dae53dba813c28435e0e70f82d9b04ee" 5277 + dependencies = [ 5278 + "serde_core", 5279 + ] 5280 + 5281 + [[package]] 3174 5282 name = "serde_tokenstream" 3175 5283 version = "0.2.2" 3176 5284 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 3179 5287 "proc-macro2", 3180 5288 "quote", 3181 5289 "serde", 3182 - "syn", 5290 + "syn 2.0.106", 3183 5291 ] 3184 5292 3185 5293 [[package]] ··· 3204 5312 "chrono", 3205 5313 "hex", 3206 5314 "indexmap 1.9.3", 3207 - "indexmap 2.9.0", 5315 + "indexmap 2.11.4", 3208 5316 "serde", 3209 5317 "serde_derive", 3210 5318 "serde_json", ··· 3218 5326 source = "registry+https://github.com/rust-lang/crates.io-index" 3219 5327 checksum = "8d00caa5193a3c8362ac2b73be6b9e768aa5a4b2f721d8f4b339600c3cb51f8e" 3220 5328 dependencies = [ 3221 - "darling", 5329 + "darling 0.20.11", 3222 5330 "proc-macro2", 3223 5331 "quote", 3224 - "syn", 5332 + "syn 2.0.106", 5333 + ] 5334 + 5335 + [[package]] 5336 + name = "serde_yaml" 5337 + version = "0.9.34+deprecated" 5338 + source = "registry+https://github.com/rust-lang/crates.io-index" 5339 + checksum = "6a8b1a1a2ebf674015cc02edccce75287f1a0130d394307b36743c2f5d504b47" 5340 + dependencies = [ 5341 + "indexmap 2.11.4", 5342 + "itoa", 5343 + "ryu", 5344 + "serde", 5345 + "unsafe-libyaml", 5346 + ] 5347 + 5348 + [[package]] 5349 + name = "sfa" 5350 + version = "0.0.1" 5351 + source = "registry+https://github.com/rust-lang/crates.io-index" 5352 + checksum = "e5f5f9dc21f55409f15103d5a7e7601b804935923c7fe4746dc806c3a422a038" 5353 + dependencies = [ 5354 + "byteorder-lite", 5355 + "log", 5356 + "xxhash-rust", 3225 5357 ] 3226 5358 3227 5359 [[package]] ··· 3271 5403 ] 3272 5404 3273 5405 [[package]] 5406 + name = "signature" 5407 + version = "2.2.0" 5408 + source = "registry+https://github.com/rust-lang/crates.io-index" 5409 + checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de" 5410 + dependencies = [ 5411 + "digest", 5412 + "rand_core 0.6.4", 5413 + ] 5414 + 5415 + [[package]] 5416 + name = "simple_asn1" 5417 + version = "0.6.3" 5418 + source = "registry+https://github.com/rust-lang/crates.io-index" 5419 + checksum = "297f631f50729c8c99b84667867963997ec0b50f32b2a7dbcab828ef0541e8bb" 5420 + dependencies = [ 5421 + "num-bigint", 5422 + "num-traits", 5423 + "thiserror 2.0.17", 5424 + "time", 5425 + ] 5426 + 5427 + [[package]] 3274 5428 name = "sketches-ddsketch" 3275 5429 version = "0.3.0" 3276 5430 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 3286 5440 ] 3287 5441 3288 5442 [[package]] 5443 + name = "slingshot" 5444 + version = "0.1.0" 5445 + dependencies = [ 5446 + "atrium-api 0.25.4 (git+https://github.com/uniphil/atrium.git?branch=fix%2Fresolve-handle-https-accept-whitespace)", 5447 + "atrium-common 0.1.2 (git+https://github.com/uniphil/atrium.git?branch=fix%2Fresolve-handle-https-accept-whitespace)", 5448 + "atrium-identity 0.1.5 (git+https://github.com/uniphil/atrium.git?branch=fix%2Fresolve-handle-https-accept-whitespace)", 5449 + "atrium-oauth 0.1.3 (git+https://github.com/uniphil/atrium.git?branch=fix%2Fresolve-handle-https-accept-whitespace)", 5450 + "clap", 5451 + "ctrlc", 5452 + "foyer", 5453 + "hickory-resolver", 5454 + "jetstream", 5455 + "links", 5456 + "log", 5457 + "metrics", 5458 + "metrics-exporter-prometheus 0.17.2", 5459 + "poem", 5460 + "poem-openapi", 5461 + "reqwest", 5462 + "rustls 0.23.31", 5463 + "serde", 5464 + "serde_json", 5465 + "thiserror 2.0.17", 5466 + "time", 5467 + "tokio", 5468 + "tokio-util", 5469 + "tracing-subscriber", 5470 + "url", 5471 + ] 5472 + 5473 + [[package]] 3289 5474 name = "slog" 3290 5475 version = "2.7.0" 3291 5476 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 3357 5542 ] 3358 5543 3359 5544 [[package]] 5545 + name = "socket2" 5546 + version = "0.6.0" 5547 + source = "registry+https://github.com/rust-lang/crates.io-index" 5548 + checksum = "233504af464074f9d066d7b5416c5f9b894a5862a6506e306f7b816cdd6f1807" 5549 + dependencies = [ 5550 + "libc", 5551 + "windows-sys 0.59.0", 5552 + ] 5553 + 5554 + [[package]] 5555 + name = "spacedust" 5556 + version = "0.1.0" 5557 + dependencies = [ 5558 + "anyhow", 5559 + "async-channel", 5560 + "async-trait", 5561 + "clap", 5562 + "ctrlc", 5563 + "dasl", 5564 + "dropshot", 5565 + "env_logger", 5566 + "fjall 3.0.0-pre.0", 5567 + "futures", 5568 + "http", 5569 + "ipld-core", 5570 + "jetstream", 5571 + "links", 5572 + "log", 5573 + "metrics", 5574 + "metrics-exporter-prometheus 0.17.2", 5575 + "rand 0.9.1", 5576 + "repo-stream", 5577 + "reqwest", 5578 + "schemars", 5579 + "semver", 5580 + "serde", 5581 + "serde_ipld_dagcbor", 5582 + "serde_json", 5583 + "serde_qs", 5584 + "thiserror 2.0.17", 5585 + "tinyjson", 5586 + "tokio", 5587 + "tokio-tungstenite 0.27.0", 5588 + "tokio-util", 5589 + ] 5590 + 5591 + [[package]] 3360 5592 name = "spin" 3361 5593 version = "0.9.8" 3362 5594 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 3366 5598 ] 3367 5599 3368 5600 [[package]] 5601 + name = "spki" 5602 + version = "0.7.3" 5603 + source = "registry+https://github.com/rust-lang/crates.io-index" 5604 + checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d" 5605 + dependencies = [ 5606 + "base64ct", 5607 + "der", 5608 + ] 5609 + 5610 + [[package]] 3369 5611 name = "stable_deref_trait" 3370 5612 version = "1.2.0" 3371 5613 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 3379 5621 3380 5622 [[package]] 3381 5623 name = "strsim" 5624 + version = "0.10.0" 5625 + source = "registry+https://github.com/rust-lang/crates.io-index" 5626 + checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623" 5627 + 5628 + [[package]] 5629 + name = "strsim" 3382 5630 version = "0.11.1" 3383 5631 source = "registry+https://github.com/rust-lang/crates.io-index" 3384 5632 checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f" ··· 3391 5639 3392 5640 [[package]] 3393 5641 name = "syn" 3394 - version = "2.0.100" 5642 + version = "1.0.109" 3395 5643 source = "registry+https://github.com/rust-lang/crates.io-index" 3396 - checksum = "b09a44accad81e1ba1cd74a32461ba89dee89095ba17b32f5d03683b1b1fc2a0" 5644 + checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237" 5645 + dependencies = [ 5646 + "proc-macro2", 5647 + "quote", 5648 + "unicode-ident", 5649 + ] 5650 + 5651 + [[package]] 5652 + name = "syn" 5653 + version = "2.0.106" 5654 + source = "registry+https://github.com/rust-lang/crates.io-index" 5655 + checksum = "ede7c438028d4436d71104916910f5bb611972c5cfd7f89b8300a8186e6fada6" 3397 5656 dependencies = [ 3398 5657 "proc-macro2", 3399 5658 "quote", ··· 3405 5664 version = "1.0.2" 3406 5665 source = "registry+https://github.com/rust-lang/crates.io-index" 3407 5666 checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263" 5667 + dependencies = [ 5668 + "futures-core", 5669 + ] 3408 5670 3409 5671 [[package]] 3410 5672 name = "synstructure" ··· 3414 5676 dependencies = [ 3415 5677 "proc-macro2", 3416 5678 "quote", 3417 - "syn", 5679 + "syn 2.0.106", 5680 + ] 5681 + 5682 + [[package]] 5683 + name = "system-configuration" 5684 + version = "0.6.1" 5685 + source = "registry+https://github.com/rust-lang/crates.io-index" 5686 + checksum = "3c879d448e9d986b661742763247d3693ed13609438cf3d006f51f5368a5ba6b" 5687 + dependencies = [ 5688 + "bitflags", 5689 + "core-foundation 0.9.4", 5690 + "system-configuration-sys", 5691 + ] 5692 + 5693 + [[package]] 5694 + name = "system-configuration-sys" 5695 + version = "0.6.0" 5696 + source = "registry+https://github.com/rust-lang/crates.io-index" 5697 + checksum = "8e1d1b10ced5ca923a1fcb8d03e96b8d3268065d724548c0211415ff6ac6bac4" 5698 + dependencies = [ 5699 + "core-foundation-sys", 5700 + "libc", 3418 5701 ] 3419 5702 3420 5703 [[package]] ··· 3431 5714 3432 5715 [[package]] 3433 5716 name = "tempfile" 3434 - version = "3.19.1" 5717 + version = "3.23.0" 3435 5718 source = "registry+https://github.com/rust-lang/crates.io-index" 3436 - checksum = "7437ac7763b9b123ccf33c338a5cc1bac6f69b45a136c19bdd8a65e3916435bf" 5719 + checksum = "2d31c77bdf42a745371d260a26ca7163f1e0924b64afa0b688e61b5a9fa02f16" 3437 5720 dependencies = [ 3438 5721 "fastrand", 3439 5722 "getrandom 0.3.3", ··· 3464 5747 3465 5748 [[package]] 3466 5749 name = "thiserror" 3467 - version = "2.0.12" 5750 + version = "2.0.17" 3468 5751 source = "registry+https://github.com/rust-lang/crates.io-index" 3469 - checksum = "567b8a2dae586314f7be2a752ec7474332959c6460e02bde30d702a66d488708" 5752 + checksum = "f63587ca0f12b72a0600bcba1d40081f830876000bb46dd2337a3051618f4fc8" 3470 5753 dependencies = [ 3471 - "thiserror-impl 2.0.12", 5754 + "thiserror-impl 2.0.17", 3472 5755 ] 3473 5756 3474 5757 [[package]] ··· 3479 5762 dependencies = [ 3480 5763 "proc-macro2", 3481 5764 "quote", 3482 - "syn", 5765 + "syn 2.0.106", 3483 5766 ] 3484 5767 3485 5768 [[package]] 3486 5769 name = "thiserror-impl" 3487 - version = "2.0.12" 5770 + version = "2.0.17" 3488 5771 source = "registry+https://github.com/rust-lang/crates.io-index" 3489 - checksum = "7f7cf42b4507d8ea322120659672cf1b9dbb93f8f2d4ecfd6e51350ff5b17a1d" 5772 + checksum = "3ff15c8ecd7de3849db632e14d18d2571fa09dfc5ed93479bc4485c7a517c913" 3490 5773 dependencies = [ 3491 5774 "proc-macro2", 3492 5775 "quote", 3493 - "syn", 5776 + "syn 2.0.106", 3494 5777 ] 3495 5778 3496 5779 [[package]] ··· 3573 5856 ] 3574 5857 3575 5858 [[package]] 5859 + name = "tinyvec" 5860 + version = "1.9.0" 5861 + source = "registry+https://github.com/rust-lang/crates.io-index" 5862 + checksum = "09b3661f17e86524eccd4371ab0429194e0d7c008abb45f7a7495b1719463c71" 5863 + dependencies = [ 5864 + "tinyvec_macros", 5865 + ] 5866 + 5867 + [[package]] 5868 + name = "tinyvec_macros" 5869 + version = "0.1.1" 5870 + source = "registry+https://github.com/rust-lang/crates.io-index" 5871 + checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20" 5872 + 5873 + [[package]] 3576 5874 name = "tokio" 3577 - version = "1.44.2" 5875 + version = "1.47.1" 3578 5876 source = "registry+https://github.com/rust-lang/crates.io-index" 3579 - checksum = "e6b88822cbe49de4185e3a4cbf8321dd487cf5fe0c5c65695fef6346371e9c48" 5877 + checksum = "89e49afdadebb872d3145a5638b59eb0691ea23e46ca484037cfab3b76b95038" 3580 5878 dependencies = [ 3581 5879 "backtrace", 3582 5880 "bytes", 5881 + "io-uring", 3583 5882 "libc", 3584 5883 "mio", 3585 5884 "parking_lot", 3586 5885 "pin-project-lite", 3587 5886 "signal-hook-registry", 3588 - "socket2", 5887 + "slab", 5888 + "socket2 0.6.0", 3589 5889 "tokio-macros", 3590 - "windows-sys 0.52.0", 5890 + "windows-sys 0.59.0", 3591 5891 ] 3592 5892 3593 5893 [[package]] ··· 3598 5898 dependencies = [ 3599 5899 "proc-macro2", 3600 5900 "quote", 3601 - "syn", 5901 + "syn 2.0.106", 3602 5902 ] 3603 5903 3604 5904 [[package]] ··· 3617 5917 source = "registry+https://github.com/rust-lang/crates.io-index" 3618 5918 checksum = "775e0c0f0adb3a2f22a00c4745d728b479985fc15ee7ca6a2608388c5569860f" 3619 5919 dependencies = [ 3620 - "rustls", 5920 + "rustls 0.22.4", 3621 5921 "rustls-pki-types", 3622 5922 "tokio", 3623 5923 ] 3624 5924 3625 5925 [[package]] 5926 + name = "tokio-rustls" 5927 + version = "0.26.2" 5928 + source = "registry+https://github.com/rust-lang/crates.io-index" 5929 + checksum = "8e727b36a1a0e8b74c376ac2211e40c2c8af09fb4013c60d910495810f008e9b" 5930 + dependencies = [ 5931 + "rustls 0.23.31", 5932 + "tokio", 5933 + ] 5934 + 5935 + [[package]] 5936 + name = "tokio-stream" 5937 + version = "0.1.17" 5938 + source = "registry+https://github.com/rust-lang/crates.io-index" 5939 + checksum = "eca58d7bba4a75707817a2c44174253f9236b2d5fbd055602e9d5c07c139a047" 5940 + dependencies = [ 5941 + "futures-core", 5942 + "pin-project-lite", 5943 + "tokio", 5944 + ] 5945 + 5946 + [[package]] 3626 5947 name = "tokio-tungstenite" 3627 5948 version = "0.26.2" 3628 5949 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 3633 5954 "native-tls", 3634 5955 "tokio", 3635 5956 "tokio-native-tls", 3636 - "tungstenite", 5957 + "tungstenite 0.26.2", 5958 + ] 5959 + 5960 + [[package]] 5961 + name = "tokio-tungstenite" 5962 + version = "0.27.0" 5963 + source = "registry+https://github.com/rust-lang/crates.io-index" 5964 + checksum = "489a59b6730eda1b0171fcfda8b121f4bee2b35cba8645ca35c5f7ba3eb736c1" 5965 + dependencies = [ 5966 + "futures-util", 5967 + "log", 5968 + "tokio", 5969 + "tungstenite 0.27.0", 3637 5970 ] 3638 5971 3639 5972 [[package]] ··· 3651 5984 3652 5985 [[package]] 3653 5986 name = "toml" 3654 - version = "0.8.20" 5987 + version = "0.8.23" 3655 5988 source = "registry+https://github.com/rust-lang/crates.io-index" 3656 - checksum = "cd87a5cdd6ffab733b2f74bc4fd7ee5fff6634124999ac278c35fc78c6120148" 5989 + checksum = "dc1beb996b9d83529a9e75c17a1686767d148d70663143c7854d8b4a09ced362" 3657 5990 dependencies = [ 3658 5991 "serde", 3659 - "serde_spanned", 3660 - "toml_datetime", 5992 + "serde_spanned 0.6.9", 5993 + "toml_datetime 0.6.11", 3661 5994 "toml_edit", 3662 5995 ] 3663 5996 3664 5997 [[package]] 5998 + name = "toml" 5999 + version = "0.9.7" 6000 + source = "registry+https://github.com/rust-lang/crates.io-index" 6001 + checksum = "00e5e5d9bf2475ac9d4f0d9edab68cc573dc2fd644b0dba36b0c30a92dd9eaa0" 6002 + dependencies = [ 6003 + "indexmap 2.11.4", 6004 + "serde_core", 6005 + "serde_spanned 1.0.2", 6006 + "toml_datetime 0.7.2", 6007 + "toml_parser", 6008 + "toml_writer", 6009 + "winnow", 6010 + ] 6011 + 6012 + [[package]] 3665 6013 name = "toml_datetime" 3666 - version = "0.6.8" 6014 + version = "0.6.11" 3667 6015 source = "registry+https://github.com/rust-lang/crates.io-index" 3668 - checksum = "0dd7358ecb8fc2f8d014bf86f6f638ce72ba252a2c3a2572f2a795f1d23efb41" 6016 + checksum = "22cddaf88f4fbc13c51aebbf5f8eceb5c7c5a9da2ac40a13519eb5b0a0e8f11c" 3669 6017 dependencies = [ 3670 6018 "serde", 3671 6019 ] 3672 6020 3673 6021 [[package]] 6022 + name = "toml_datetime" 6023 + version = "0.7.2" 6024 + source = "registry+https://github.com/rust-lang/crates.io-index" 6025 + checksum = "32f1085dec27c2b6632b04c80b3bb1b4300d6495d1e129693bdda7d91e72eec1" 6026 + dependencies = [ 6027 + "serde_core", 6028 + ] 6029 + 6030 + [[package]] 3674 6031 name = "toml_edit" 3675 - version = "0.22.24" 6032 + version = "0.22.27" 3676 6033 source = "registry+https://github.com/rust-lang/crates.io-index" 3677 - checksum = "17b4795ff5edd201c7cd6dca065ae59972ce77d1b80fa0a84d94950ece7d1474" 6034 + checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a" 3678 6035 dependencies = [ 3679 - "indexmap 2.9.0", 6036 + "indexmap 2.11.4", 3680 6037 "serde", 3681 - "serde_spanned", 3682 - "toml_datetime", 6038 + "serde_spanned 0.6.9", 6039 + "toml_datetime 0.6.11", 6040 + "toml_write", 6041 + "winnow", 6042 + ] 6043 + 6044 + [[package]] 6045 + name = "toml_parser" 6046 + version = "1.0.3" 6047 + source = "registry+https://github.com/rust-lang/crates.io-index" 6048 + checksum = "4cf893c33be71572e0e9aa6dd15e6677937abd686b066eac3f8cd3531688a627" 6049 + dependencies = [ 3683 6050 "winnow", 3684 6051 ] 3685 6052 3686 6053 [[package]] 6054 + name = "toml_write" 6055 + version = "0.1.2" 6056 + source = "registry+https://github.com/rust-lang/crates.io-index" 6057 + checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801" 6058 + 6059 + [[package]] 6060 + name = "toml_writer" 6061 + version = "1.0.3" 6062 + source = "registry+https://github.com/rust-lang/crates.io-index" 6063 + checksum = "d163a63c116ce562a22cda521fcc4d79152e7aba014456fb5eb442f6d6a10109" 6064 + 6065 + [[package]] 3687 6066 name = "tower" 3688 6067 version = "0.5.2" 3689 6068 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 3701 6080 3702 6081 [[package]] 3703 6082 name = "tower-http" 3704 - version = "0.6.2" 6083 + version = "0.6.6" 3705 6084 source = "registry+https://github.com/rust-lang/crates.io-index" 3706 - checksum = "403fa3b783d4b626a8ad51d766ab03cb6d2dbfc46b1c5d4448395e6628dc9697" 6085 + checksum = "adc82fd73de2a9722ac5da747f12383d2bfdb93591ee6c58486e0097890f05f2" 3707 6086 dependencies = [ 3708 6087 "bitflags", 3709 6088 "bytes", 6089 + "futures-util", 3710 6090 "http", 6091 + "http-body", 6092 + "iri-string", 3711 6093 "pin-project-lite", 6094 + "tower", 3712 6095 "tower-layer", 3713 6096 "tower-service", 3714 6097 ] ··· 3733 6116 dependencies = [ 3734 6117 "log", 3735 6118 "pin-project-lite", 6119 + "tracing-attributes", 3736 6120 "tracing-core", 3737 6121 ] 3738 6122 3739 6123 [[package]] 6124 + name = "tracing-attributes" 6125 + version = "0.1.30" 6126 + source = "registry+https://github.com/rust-lang/crates.io-index" 6127 + checksum = "81383ab64e72a7a8b8e13130c49e3dab29def6d0c7d76a03087b3cf71c5c6903" 6128 + dependencies = [ 6129 + "proc-macro2", 6130 + "quote", 6131 + "syn 2.0.106", 6132 + ] 6133 + 6134 + [[package]] 3740 6135 name = "tracing-core" 3741 6136 version = "0.1.33" 3742 6137 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 3759 6154 3760 6155 [[package]] 3761 6156 name = "tracing-subscriber" 3762 - version = "0.3.19" 6157 + version = "0.3.20" 3763 6158 source = "registry+https://github.com/rust-lang/crates.io-index" 3764 - checksum = "e8189decb5ac0fa7bc8b96b7cb9b2701d60d48805aca84a238004d665fcc4008" 6159 + checksum = "2054a14f5307d601f88daf0553e1cbf472acc4f2c51afab632431cdcd72124d5" 3765 6160 dependencies = [ 3766 6161 "matchers", 3767 6162 "nu-ansi-term", 3768 6163 "once_cell", 3769 - "regex", 6164 + "regex-automata", 3770 6165 "sharded-slab", 3771 6166 "smallvec", 3772 6167 "thread_local", ··· 3783 6178 dependencies = [ 3784 6179 "proc-macro2", 3785 6180 "quote", 3786 - "syn", 6181 + "syn 2.0.106", 3787 6182 ] 3788 6183 3789 6184 [[package]] ··· 3806 6201 "native-tls", 3807 6202 "rand 0.9.1", 3808 6203 "sha1", 3809 - "thiserror 2.0.12", 6204 + "thiserror 2.0.17", 3810 6205 "url", 3811 6206 "utf-8", 3812 6207 ] 3813 6208 3814 6209 [[package]] 6210 + name = "tungstenite" 6211 + version = "0.27.0" 6212 + source = "registry+https://github.com/rust-lang/crates.io-index" 6213 + checksum = "eadc29d668c91fcc564941132e17b28a7ceb2f3ebf0b9dae3e03fd7a6748eb0d" 6214 + dependencies = [ 6215 + "bytes", 6216 + "data-encoding", 6217 + "http", 6218 + "httparse", 6219 + "log", 6220 + "rand 0.9.1", 6221 + "sha1", 6222 + "thiserror 2.0.17", 6223 + "utf-8", 6224 + ] 6225 + 6226 + [[package]] 6227 + name = "twox-hash" 6228 + version = "2.1.1" 6229 + source = "registry+https://github.com/rust-lang/crates.io-index" 6230 + checksum = "8b907da542cbced5261bd3256de1b3a1bf340a3d37f93425a07362a1d687de56" 6231 + dependencies = [ 6232 + "rand 0.9.1", 6233 + ] 6234 + 6235 + [[package]] 3815 6236 name = "typenum" 3816 6237 version = "1.18.0" 3817 6238 source = "registry+https://github.com/rust-lang/crates.io-index" 3818 6239 checksum = "1dccffe3ce07af9386bfd29e80c0ab1a8205a2fc34e4bcd40364df902cfa8f3f" 6240 + 6241 + [[package]] 6242 + name = "ucd-trie" 6243 + version = "0.1.7" 6244 + source = "registry+https://github.com/rust-lang/crates.io-index" 6245 + checksum = "2896d95c02a80c6d6a5d6e953d479f5ddf2dfdb6a244441010e373ac0fb88971" 3819 6246 3820 6247 [[package]] 3821 6248 name = "ufos" ··· 3830 6257 "clap", 3831 6258 "dropshot", 3832 6259 "env_logger", 3833 - "fjall", 6260 + "fjall 2.11.2 (git+https://github.com/fjall-rs/fjall.git)", 3834 6261 "getrandom 0.3.3", 3835 6262 "http", 3836 6263 "jetstream", 3837 6264 "log", 3838 - "lsm-tree", 6265 + "lsm-tree 2.10.4", 6266 + "metrics", 6267 + "metrics-exporter-prometheus 0.17.2", 3839 6268 "schemars", 3840 6269 "semver", 3841 6270 "serde", ··· 3843 6272 "serde_qs", 3844 6273 "sha2", 3845 6274 "tempfile", 3846 - "thiserror 2.0.12", 6275 + "thiserror 2.0.17", 3847 6276 "tikv-jemallocator", 3848 6277 "tokio", 3849 6278 "tokio-util", ··· 3862 6291 ] 3863 6292 3864 6293 [[package]] 6294 + name = "uncased" 6295 + version = "0.9.10" 6296 + source = "registry+https://github.com/rust-lang/crates.io-index" 6297 + checksum = "e1b88fcfe09e89d3866a5c11019378088af2d24c3fbd4f0543f96b479ec90697" 6298 + dependencies = [ 6299 + "version_check", 6300 + ] 6301 + 6302 + [[package]] 3865 6303 name = "unicase" 3866 6304 version = "2.8.1" 3867 6305 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 3874 6312 checksum = "5a5f39404a5da50712a4c1eecf25e90dd62b613502b7e925fd4e4d19b5c96512" 3875 6313 3876 6314 [[package]] 6315 + name = "unicode-xid" 6316 + version = "0.2.6" 6317 + source = "registry+https://github.com/rust-lang/crates.io-index" 6318 + checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853" 6319 + 6320 + [[package]] 6321 + name = "unsafe-libyaml" 6322 + version = "0.2.11" 6323 + source = "registry+https://github.com/rust-lang/crates.io-index" 6324 + checksum = "673aac59facbab8a9007c7f6108d11f63b603f7cabff99fabf650fea5c32b861" 6325 + 6326 + [[package]] 6327 + name = "unsigned-varint" 6328 + version = "0.7.2" 6329 + source = "registry+https://github.com/rust-lang/crates.io-index" 6330 + checksum = "6889a77d49f1f013504cec6bf97a2c730394adedaeb1deb5ea08949a50541105" 6331 + 6332 + [[package]] 3877 6333 name = "unsigned-varint" 3878 6334 version = "0.8.0" 3879 6335 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 3928 6384 3929 6385 [[package]] 3930 6386 name = "uuid" 3931 - version = "1.16.0" 6387 + version = "1.18.1" 3932 6388 source = "registry+https://github.com/rust-lang/crates.io-index" 3933 - checksum = "458f7a779bf54acc9f347480ac654f68407d3aab21269a6e3c9f922acd9e2da9" 6389 + checksum = "2f87b8aa10b915a06587d0dec516c282ff295b475d94abf425d62b57710070a2" 3934 6390 dependencies = [ 3935 6391 "getrandom 0.3.3", 6392 + "js-sys", 3936 6393 "serde", 6394 + "wasm-bindgen", 3937 6395 ] 3938 6396 3939 6397 [[package]] ··· 3944 6402 3945 6403 [[package]] 3946 6404 name = "value-log" 3947 - version = "1.8.0" 6405 + version = "1.9.0" 3948 6406 source = "registry+https://github.com/rust-lang/crates.io-index" 3949 - checksum = "fd29b17c041f94e0885179637289815cd038f0c9fc19c4549d5a97017404fb7d" 6407 + checksum = "62fc7c4ce161f049607ecea654dca3f2d727da5371ae85e2e4f14ce2b98ed67c" 3950 6408 dependencies = [ 3951 6409 "byteorder", 3952 - "byteview", 6410 + "byteview 0.6.1", 3953 6411 "interval-heap", 3954 6412 "log", 3955 6413 "path-absolutize", ··· 3993 6451 ] 3994 6452 3995 6453 [[package]] 6454 + name = "walkdir" 6455 + version = "2.5.0" 6456 + source = "registry+https://github.com/rust-lang/crates.io-index" 6457 + checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b" 6458 + dependencies = [ 6459 + "same-file", 6460 + "winapi-util", 6461 + ] 6462 + 6463 + [[package]] 3996 6464 name = "want" 3997 6465 version = "0.3.1" 3998 6466 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 4038 6506 "log", 4039 6507 "proc-macro2", 4040 6508 "quote", 4041 - "syn", 6509 + "syn 2.0.106", 4042 6510 "wasm-bindgen-shared", 4043 6511 ] 4044 6512 4045 6513 [[package]] 6514 + name = "wasm-bindgen-futures" 6515 + version = "0.4.50" 6516 + source = "registry+https://github.com/rust-lang/crates.io-index" 6517 + checksum = "555d470ec0bc3bb57890405e5d4322cc9ea83cebb085523ced7be4144dac1e61" 6518 + dependencies = [ 6519 + "cfg-if", 6520 + "js-sys", 6521 + "once_cell", 6522 + "wasm-bindgen", 6523 + "web-sys", 6524 + ] 6525 + 6526 + [[package]] 4046 6527 name = "wasm-bindgen-macro" 4047 6528 version = "0.2.100" 4048 6529 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 4060 6541 dependencies = [ 4061 6542 "proc-macro2", 4062 6543 "quote", 4063 - "syn", 6544 + "syn 2.0.106", 4064 6545 "wasm-bindgen-backend", 4065 6546 "wasm-bindgen-shared", 4066 6547 ] ··· 4075 6556 ] 4076 6557 4077 6558 [[package]] 6559 + name = "wasm-streams" 6560 + version = "0.4.2" 6561 + source = "registry+https://github.com/rust-lang/crates.io-index" 6562 + checksum = "15053d8d85c7eccdbefef60f06769760a563c7f0a9d6902a13d35c7800b0ad65" 6563 + dependencies = [ 6564 + "futures-util", 6565 + "js-sys", 6566 + "wasm-bindgen", 6567 + "wasm-bindgen-futures", 6568 + "web-sys", 6569 + ] 6570 + 6571 + [[package]] 4078 6572 name = "web-sys" 4079 6573 version = "0.3.77" 4080 6574 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 4095 6589 ] 4096 6590 4097 6591 [[package]] 6592 + name = "which" 6593 + version = "4.4.2" 6594 + source = "registry+https://github.com/rust-lang/crates.io-index" 6595 + checksum = "87ba24419a2078cd2b0f2ede2691b6c66d8e47836da3b6db8265ebad47afbfc7" 6596 + dependencies = [ 6597 + "either", 6598 + "home", 6599 + "once_cell", 6600 + "rustix 0.38.44", 6601 + ] 6602 + 6603 + [[package]] 6604 + name = "who-am-i" 6605 + version = "0.1.0" 6606 + dependencies = [ 6607 + "atrium-api 0.25.4 (registry+https://github.com/rust-lang/crates.io-index)", 6608 + "atrium-common 0.1.2 (registry+https://github.com/rust-lang/crates.io-index)", 6609 + "atrium-identity 0.1.5 (registry+https://github.com/rust-lang/crates.io-index)", 6610 + "atrium-oauth 0.1.3 (registry+https://github.com/rust-lang/crates.io-index)", 6611 + "axum", 6612 + "axum-extra", 6613 + "axum-template", 6614 + "clap", 6615 + "ctrlc", 6616 + "dashmap", 6617 + "elliptic-curve", 6618 + "handlebars", 6619 + "hickory-resolver", 6620 + "jose-jwk", 6621 + "jsonwebtoken", 6622 + "metrics", 6623 + "metrics-exporter-prometheus 0.17.2", 6624 + "p256", 6625 + "pkcs8", 6626 + "rand 0.9.1", 6627 + "reqwest", 6628 + "serde", 6629 + "serde_json", 6630 + "thiserror 2.0.17", 6631 + "tokio", 6632 + "tokio-util", 6633 + "url", 6634 + ] 6635 + 6636 + [[package]] 6637 + name = "widestring" 6638 + version = "1.2.0" 6639 + source = "registry+https://github.com/rust-lang/crates.io-index" 6640 + checksum = "dd7cf3379ca1aac9eea11fba24fd7e315d621f8dfe35c8d7d2be8b793726e07d" 6641 + 6642 + [[package]] 6643 + name = "wildmatch" 6644 + version = "2.4.0" 6645 + source = "registry+https://github.com/rust-lang/crates.io-index" 6646 + checksum = "68ce1ab1f8c62655ebe1350f589c61e505cf94d385bc6a12899442d9081e71fd" 6647 + 6648 + [[package]] 4098 6649 name = "winapi" 4099 6650 version = "0.3.9" 4100 6651 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 4111 6662 checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6" 4112 6663 4113 6664 [[package]] 6665 + name = "winapi-util" 6666 + version = "0.1.9" 6667 + source = "registry+https://github.com/rust-lang/crates.io-index" 6668 + checksum = "cf221c93e13a30d793f7645a0e7762c55d169dbb0a49671918a2319d289b10bb" 6669 + dependencies = [ 6670 + "windows-sys 0.59.0", 6671 + ] 6672 + 6673 + [[package]] 4114 6674 name = "winapi-x86_64-pc-windows-gnu" 4115 6675 version = "0.4.0" 4116 6676 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 4122 6682 source = "registry+https://github.com/rust-lang/crates.io-index" 4123 6683 checksum = "dd04d41d93c4992d421894c18c8b43496aa748dd4c081bac0dc93eb0489272b6" 4124 6684 dependencies = [ 4125 - "windows-core 0.58.0", 4126 - "windows-targets", 6685 + "windows-core", 6686 + "windows-targets 0.52.6", 4127 6687 ] 4128 6688 4129 6689 [[package]] ··· 4132 6692 source = "registry+https://github.com/rust-lang/crates.io-index" 4133 6693 checksum = "6ba6d44ec8c2591c134257ce647b7ea6b20335bf6379a27dac5f1641fcf59f99" 4134 6694 dependencies = [ 4135 - "windows-implement 0.58.0", 4136 - "windows-interface 0.58.0", 6695 + "windows-implement", 6696 + "windows-interface", 4137 6697 "windows-result 0.2.0", 4138 6698 "windows-strings 0.1.0", 4139 - "windows-targets", 4140 - ] 4141 - 4142 - [[package]] 4143 - name = "windows-core" 4144 - version = "0.61.0" 4145 - source = "registry+https://github.com/rust-lang/crates.io-index" 4146 - checksum = "4763c1de310c86d75a878046489e2e5ba02c649d185f21c67d4cf8a56d098980" 4147 - dependencies = [ 4148 - "windows-implement 0.60.0", 4149 - "windows-interface 0.59.1", 4150 - "windows-link", 4151 - "windows-result 0.3.2", 4152 - "windows-strings 0.4.0", 6699 + "windows-targets 0.52.6", 4153 6700 ] 4154 6701 4155 6702 [[package]] ··· 4160 6707 dependencies = [ 4161 6708 "proc-macro2", 4162 6709 "quote", 4163 - "syn", 4164 - ] 4165 - 4166 - [[package]] 4167 - name = "windows-implement" 4168 - version = "0.60.0" 4169 - source = "registry+https://github.com/rust-lang/crates.io-index" 4170 - checksum = "a47fddd13af08290e67f4acabf4b459f647552718f683a7b415d290ac744a836" 4171 - dependencies = [ 4172 - "proc-macro2", 4173 - "quote", 4174 - "syn", 6710 + "syn 2.0.106", 4175 6711 ] 4176 6712 4177 6713 [[package]] ··· 4182 6718 dependencies = [ 4183 6719 "proc-macro2", 4184 6720 "quote", 4185 - "syn", 4186 - ] 4187 - 4188 - [[package]] 4189 - name = "windows-interface" 4190 - version = "0.59.1" 4191 - source = "registry+https://github.com/rust-lang/crates.io-index" 4192 - checksum = "bd9211b69f8dcdfa817bfd14bf1c97c9188afa36f4750130fcdf3f400eca9fa8" 4193 - dependencies = [ 4194 - "proc-macro2", 4195 - "quote", 4196 - "syn", 6721 + "syn 2.0.106", 4197 6722 ] 4198 6723 4199 6724 [[package]] ··· 4201 6726 version = "0.1.1" 4202 6727 source = "registry+https://github.com/rust-lang/crates.io-index" 4203 6728 checksum = "76840935b766e1b0a05c0066835fb9ec80071d4c09a16f6bd5f7e655e3c14c38" 6729 + 6730 + [[package]] 6731 + name = "windows-registry" 6732 + version = "0.5.2" 6733 + source = "registry+https://github.com/rust-lang/crates.io-index" 6734 + checksum = "b3bab093bdd303a1240bb99b8aba8ea8a69ee19d34c9e2ef9594e708a4878820" 6735 + dependencies = [ 6736 + "windows-link", 6737 + "windows-result 0.3.4", 6738 + "windows-strings 0.4.2", 6739 + ] 4204 6740 4205 6741 [[package]] 4206 6742 name = "windows-result" ··· 4208 6744 source = "registry+https://github.com/rust-lang/crates.io-index" 4209 6745 checksum = "1d1043d8214f791817bab27572aaa8af63732e11bf84aa21a45a78d6c317ae0e" 4210 6746 dependencies = [ 4211 - "windows-targets", 6747 + "windows-targets 0.52.6", 4212 6748 ] 4213 6749 4214 6750 [[package]] 4215 6751 name = "windows-result" 4216 - version = "0.3.2" 6752 + version = "0.3.4" 4217 6753 source = "registry+https://github.com/rust-lang/crates.io-index" 4218 - checksum = "c64fd11a4fd95df68efcfee5f44a294fe71b8bc6a91993e2791938abcc712252" 6754 + checksum = "56f42bd332cc6c8eac5af113fc0c1fd6a8fd2aa08a0119358686e5160d0586c6" 4219 6755 dependencies = [ 4220 6756 "windows-link", 4221 6757 ] ··· 4227 6763 checksum = "4cd9b125c486025df0eabcb585e62173c6c9eddcec5d117d3b6e8c30e2ee4d10" 4228 6764 dependencies = [ 4229 6765 "windows-result 0.2.0", 4230 - "windows-targets", 6766 + "windows-targets 0.52.6", 4231 6767 ] 4232 6768 4233 6769 [[package]] 4234 6770 name = "windows-strings" 4235 - version = "0.4.0" 6771 + version = "0.4.2" 4236 6772 source = "registry+https://github.com/rust-lang/crates.io-index" 4237 - checksum = "7a2ba9642430ee452d5a7aa78d72907ebe8cfda358e8cb7918a2050581322f97" 6773 + checksum = "56e6c93f3a0c3b36176cb1327a4958a0353d5d166c2a35cb268ace15e91d3b57" 4238 6774 dependencies = [ 4239 6775 "windows-link", 4240 6776 ] 4241 6777 4242 6778 [[package]] 4243 6779 name = "windows-sys" 6780 + version = "0.48.0" 6781 + source = "registry+https://github.com/rust-lang/crates.io-index" 6782 + checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9" 6783 + dependencies = [ 6784 + "windows-targets 0.48.5", 6785 + ] 6786 + 6787 + [[package]] 6788 + name = "windows-sys" 4244 6789 version = "0.52.0" 4245 6790 source = "registry+https://github.com/rust-lang/crates.io-index" 4246 6791 checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d" 4247 6792 dependencies = [ 4248 - "windows-targets", 6793 + "windows-targets 0.52.6", 4249 6794 ] 4250 6795 4251 6796 [[package]] ··· 4254 6799 source = "registry+https://github.com/rust-lang/crates.io-index" 4255 6800 checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b" 4256 6801 dependencies = [ 4257 - "windows-targets", 6802 + "windows-targets 0.52.6", 6803 + ] 6804 + 6805 + [[package]] 6806 + name = "windows-targets" 6807 + version = "0.48.5" 6808 + source = "registry+https://github.com/rust-lang/crates.io-index" 6809 + checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c" 6810 + dependencies = [ 6811 + "windows_aarch64_gnullvm 0.48.5", 6812 + "windows_aarch64_msvc 0.48.5", 6813 + "windows_i686_gnu 0.48.5", 6814 + "windows_i686_msvc 0.48.5", 6815 + "windows_x86_64_gnu 0.48.5", 6816 + "windows_x86_64_gnullvm 0.48.5", 6817 + "windows_x86_64_msvc 0.48.5", 4258 6818 ] 4259 6819 4260 6820 [[package]] ··· 4263 6823 source = "registry+https://github.com/rust-lang/crates.io-index" 4264 6824 checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973" 4265 6825 dependencies = [ 4266 - "windows_aarch64_gnullvm", 4267 - "windows_aarch64_msvc", 4268 - "windows_i686_gnu", 6826 + "windows_aarch64_gnullvm 0.52.6", 6827 + "windows_aarch64_msvc 0.52.6", 6828 + "windows_i686_gnu 0.52.6", 4269 6829 "windows_i686_gnullvm", 4270 - "windows_i686_msvc", 4271 - "windows_x86_64_gnu", 4272 - "windows_x86_64_gnullvm", 4273 - "windows_x86_64_msvc", 6830 + "windows_i686_msvc 0.52.6", 6831 + "windows_x86_64_gnu 0.52.6", 6832 + "windows_x86_64_gnullvm 0.52.6", 6833 + "windows_x86_64_msvc 0.52.6", 4274 6834 ] 6835 + 6836 + [[package]] 6837 + name = "windows_aarch64_gnullvm" 6838 + version = "0.48.5" 6839 + source = "registry+https://github.com/rust-lang/crates.io-index" 6840 + checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8" 4275 6841 4276 6842 [[package]] 4277 6843 name = "windows_aarch64_gnullvm" ··· 4281 6847 4282 6848 [[package]] 4283 6849 name = "windows_aarch64_msvc" 6850 + version = "0.48.5" 6851 + source = "registry+https://github.com/rust-lang/crates.io-index" 6852 + checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc" 6853 + 6854 + [[package]] 6855 + name = "windows_aarch64_msvc" 4284 6856 version = "0.52.6" 4285 6857 source = "registry+https://github.com/rust-lang/crates.io-index" 4286 6858 checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469" 4287 6859 4288 6860 [[package]] 4289 6861 name = "windows_i686_gnu" 6862 + version = "0.48.5" 6863 + source = "registry+https://github.com/rust-lang/crates.io-index" 6864 + checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e" 6865 + 6866 + [[package]] 6867 + name = "windows_i686_gnu" 4290 6868 version = "0.52.6" 4291 6869 source = "registry+https://github.com/rust-lang/crates.io-index" 4292 6870 checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b" ··· 4299 6877 4300 6878 [[package]] 4301 6879 name = "windows_i686_msvc" 6880 + version = "0.48.5" 6881 + source = "registry+https://github.com/rust-lang/crates.io-index" 6882 + checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406" 6883 + 6884 + [[package]] 6885 + name = "windows_i686_msvc" 4302 6886 version = "0.52.6" 4303 6887 source = "registry+https://github.com/rust-lang/crates.io-index" 4304 6888 checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66" 4305 6889 4306 6890 [[package]] 4307 6891 name = "windows_x86_64_gnu" 6892 + version = "0.48.5" 6893 + source = "registry+https://github.com/rust-lang/crates.io-index" 6894 + checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e" 6895 + 6896 + [[package]] 6897 + name = "windows_x86_64_gnu" 4308 6898 version = "0.52.6" 4309 6899 source = "registry+https://github.com/rust-lang/crates.io-index" 4310 6900 checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78" 4311 6901 4312 6902 [[package]] 4313 6903 name = "windows_x86_64_gnullvm" 6904 + version = "0.48.5" 6905 + source = "registry+https://github.com/rust-lang/crates.io-index" 6906 + checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc" 6907 + 6908 + [[package]] 6909 + name = "windows_x86_64_gnullvm" 4314 6910 version = "0.52.6" 4315 6911 source = "registry+https://github.com/rust-lang/crates.io-index" 4316 6912 checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d" 4317 6913 4318 6914 [[package]] 4319 6915 name = "windows_x86_64_msvc" 6916 + version = "0.48.5" 6917 + source = "registry+https://github.com/rust-lang/crates.io-index" 6918 + checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538" 6919 + 6920 + [[package]] 6921 + name = "windows_x86_64_msvc" 4320 6922 version = "0.52.6" 4321 6923 source = "registry+https://github.com/rust-lang/crates.io-index" 4322 6924 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec" 4323 6925 4324 6926 [[package]] 4325 6927 name = "winnow" 4326 - version = "0.7.6" 6928 + version = "0.7.13" 4327 6929 source = "registry+https://github.com/rust-lang/crates.io-index" 4328 - checksum = "63d3fcd9bba44b03821e7d699eeee959f3126dcc4aa8e4ae18ec617c2a5cea10" 6930 + checksum = "21a0236b59786fed61e2a80582dd500fe61f18b5dca67a4a067d0bc9039339cf" 4329 6931 dependencies = [ 4330 6932 "memchr", 4331 6933 ] 4332 6934 4333 6935 [[package]] 6936 + name = "winreg" 6937 + version = "0.50.0" 6938 + source = "registry+https://github.com/rust-lang/crates.io-index" 6939 + checksum = "524e57b2c537c0f9b1e69f1965311ec12182b4122e45035b1508cd24d2adadb1" 6940 + dependencies = [ 6941 + "cfg-if", 6942 + "windows-sys 0.48.0", 6943 + ] 6944 + 6945 + [[package]] 4334 6946 name = "wit-bindgen-rt" 4335 6947 version = "0.39.0" 4336 6948 source = "registry+https://github.com/rust-lang/crates.io-index" ··· 4361 6973 ] 4362 6974 4363 6975 [[package]] 6976 + name = "x509-parser" 6977 + version = "0.17.0" 6978 + source = "registry+https://github.com/rust-lang/crates.io-index" 6979 + checksum = "4569f339c0c402346d4a75a9e39cf8dad310e287eef1ff56d4c68e5067f53460" 6980 + dependencies = [ 6981 + "asn1-rs", 6982 + "data-encoding", 6983 + "der-parser", 6984 + "lazy_static", 6985 + "nom", 6986 + "oid-registry", 6987 + "rusticata-macros", 6988 + "thiserror 2.0.17", 6989 + "time", 6990 + ] 6991 + 6992 + [[package]] 4364 6993 name = "xxhash-rust" 4365 6994 version = "0.8.15" 4366 6995 source = "registry+https://github.com/rust-lang/crates.io-index" 4367 6996 checksum = "fdd20c5420375476fbd4394763288da7eb0cc0b8c11deed431a91562af7335d3" 6997 + 6998 + [[package]] 6999 + name = "yasna" 7000 + version = "0.5.2" 7001 + source = "registry+https://github.com/rust-lang/crates.io-index" 7002 + checksum = "e17bb3549cc1321ae1296b9cdc2698e2b6cb1992adfa19a8c72e5b7a738f44cd" 7003 + dependencies = [ 7004 + "time", 7005 + ] 4368 7006 4369 7007 [[package]] 4370 7008 name = "yoke" ··· 4386 7024 dependencies = [ 4387 7025 "proc-macro2", 4388 7026 "quote", 4389 - "syn", 7027 + "syn 2.0.106", 4390 7028 "synstructure", 4391 7029 ] 4392 7030 ··· 4416 7054 dependencies = [ 4417 7055 "proc-macro2", 4418 7056 "quote", 4419 - "syn", 7057 + "syn 2.0.106", 4420 7058 ] 4421 7059 4422 7060 [[package]] ··· 4427 7065 dependencies = [ 4428 7066 "proc-macro2", 4429 7067 "quote", 4430 - "syn", 7068 + "syn 2.0.106", 4431 7069 ] 4432 7070 4433 7071 [[package]] ··· 4447 7085 dependencies = [ 4448 7086 "proc-macro2", 4449 7087 "quote", 4450 - "syn", 7088 + "syn 2.0.106", 4451 7089 "synstructure", 4452 7090 ] 4453 7091 ··· 4456 7094 version = "1.8.1" 4457 7095 source = "registry+https://github.com/rust-lang/crates.io-index" 4458 7096 checksum = "ced3678a2879b30306d323f4542626697a464a97c0a07c9aebf7ebca65cd4dde" 7097 + dependencies = [ 7098 + "serde", 7099 + "zeroize_derive", 7100 + ] 7101 + 7102 + [[package]] 7103 + name = "zeroize_derive" 7104 + version = "1.4.2" 7105 + source = "registry+https://github.com/rust-lang/crates.io-index" 7106 + checksum = "ce36e65b0d2999d2aafac989fb249189a141aee1f53c612c1f37d72631959f69" 7107 + dependencies = [ 7108 + "proc-macro2", 7109 + "quote", 7110 + "syn 2.0.106", 7111 + ] 4459 7112 4460 7113 [[package]] 4461 7114 name = "zerovec" ··· 4476 7129 dependencies = [ 4477 7130 "proc-macro2", 4478 7131 "quote", 4479 - "syn", 7132 + "syn 2.0.106", 4480 7133 ] 4481 7134 4482 7135 [[package]]
+6
Cargo.toml
··· 6 6 "jetstream", 7 7 "ufos", 8 8 "ufos/fuzz", 9 + "spacedust", 10 + "who-am-i", 11 + "slingshot", 12 + "quasar", 13 + "pocket", 14 + "reflector", 9 15 ]
+9 -2
Makefile
··· 2 2 all: check 3 3 4 4 test: 5 - cargo test 5 + cargo test --all-features 6 6 7 7 fmt: 8 - cargo fmt --package links --package constellation --package ufos 8 + cargo fmt --package links \ 9 + --package constellation \ 10 + --package ufos \ 11 + --package spacedust \ 12 + --package who-am-i \ 13 + --package slingshot \ 14 + --package pocket \ 15 + --package reflector 9 16 cargo +nightly fmt --package jetstream 10 17 11 18 clippy:
+1 -1
constellation/Cargo.toml
··· 8 8 anyhow = "1.0.95" 9 9 askama = { version = "0.12.1", features = ["serde-json"] } 10 10 axum = "0.8.1" 11 - axum-extra = { version = "0.10.0", features = ["typed-header"] } 11 + axum-extra = { version = "0.10.0", features = ["query", "typed-header"] } 12 12 axum-metrics = "0.2" 13 13 bincode = "1.3.3" 14 14 clap = { version = "4.5.26", features = ["derive"] }
+661
constellation/LICENSE
··· 1 + GNU AFFERO GENERAL PUBLIC LICENSE 2 + Version 3, 19 November 2007 3 + 4 + Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/> 5 + Everyone is permitted to copy and distribute verbatim copies 6 + of this license document, but changing it is not allowed. 7 + 8 + Preamble 9 + 10 + The GNU Affero General Public License is a free, copyleft license for 11 + software and other kinds of works, specifically designed to ensure 12 + cooperation with the community in the case of network server software. 13 + 14 + The licenses for most software and other practical works are designed 15 + to take away your freedom to share and change the works. By contrast, 16 + our General Public Licenses are intended to guarantee your freedom to 17 + share and change all versions of a program--to make sure it remains free 18 + software for all its users. 19 + 20 + When we speak of free software, we are referring to freedom, not 21 + price. Our General Public Licenses are designed to make sure that you 22 + have the freedom to distribute copies of free software (and charge for 23 + them if you wish), that you receive source code or can get it if you 24 + want it, that you can change the software or use pieces of it in new 25 + free programs, and that you know you can do these things. 26 + 27 + Developers that use our General Public Licenses protect your rights 28 + with two steps: (1) assert copyright on the software, and (2) offer 29 + you this License which gives you legal permission to copy, distribute 30 + and/or modify the software. 31 + 32 + A secondary benefit of defending all users' freedom is that 33 + improvements made in alternate versions of the program, if they 34 + receive widespread use, become available for other developers to 35 + incorporate. Many developers of free software are heartened and 36 + encouraged by the resulting cooperation. However, in the case of 37 + software used on network servers, this result may fail to come about. 38 + The GNU General Public License permits making a modified version and 39 + letting the public access it on a server without ever releasing its 40 + source code to the public. 41 + 42 + The GNU Affero General Public License is designed specifically to 43 + ensure that, in such cases, the modified source code becomes available 44 + to the community. It requires the operator of a network server to 45 + provide the source code of the modified version running there to the 46 + users of that server. Therefore, public use of a modified version, on 47 + a publicly accessible server, gives the public access to the source 48 + code of the modified version. 49 + 50 + An older license, called the Affero General Public License and 51 + published by Affero, was designed to accomplish similar goals. This is 52 + a different license, not a version of the Affero GPL, but Affero has 53 + released a new version of the Affero GPL which permits relicensing under 54 + this license. 55 + 56 + The precise terms and conditions for copying, distribution and 57 + modification follow. 58 + 59 + TERMS AND CONDITIONS 60 + 61 + 0. Definitions. 62 + 63 + "This License" refers to version 3 of the GNU Affero General Public License. 64 + 65 + "Copyright" also means copyright-like laws that apply to other kinds of 66 + works, such as semiconductor masks. 67 + 68 + "The Program" refers to any copyrightable work licensed under this 69 + License. Each licensee is addressed as "you". "Licensees" and 70 + "recipients" may be individuals or organizations. 71 + 72 + To "modify" a work means to copy from or adapt all or part of the work 73 + in a fashion requiring copyright permission, other than the making of an 74 + exact copy. The resulting work is called a "modified version" of the 75 + earlier work or a work "based on" the earlier work. 76 + 77 + A "covered work" means either the unmodified Program or a work based 78 + on the Program. 79 + 80 + To "propagate" a work means to do anything with it that, without 81 + permission, would make you directly or secondarily liable for 82 + infringement under applicable copyright law, except executing it on a 83 + computer or modifying a private copy. Propagation includes copying, 84 + distribution (with or without modification), making available to the 85 + public, and in some countries other activities as well. 86 + 87 + To "convey" a work means any kind of propagation that enables other 88 + parties to make or receive copies. Mere interaction with a user through 89 + a computer network, with no transfer of a copy, is not conveying. 90 + 91 + An interactive user interface displays "Appropriate Legal Notices" 92 + to the extent that it includes a convenient and prominently visible 93 + feature that (1) displays an appropriate copyright notice, and (2) 94 + tells the user that there is no warranty for the work (except to the 95 + extent that warranties are provided), that licensees may convey the 96 + work under this License, and how to view a copy of this License. If 97 + the interface presents a list of user commands or options, such as a 98 + menu, a prominent item in the list meets this criterion. 99 + 100 + 1. Source Code. 101 + 102 + The "source code" for a work means the preferred form of the work 103 + for making modifications to it. "Object code" means any non-source 104 + form of a work. 105 + 106 + A "Standard Interface" means an interface that either is an official 107 + standard defined by a recognized standards body, or, in the case of 108 + interfaces specified for a particular programming language, one that 109 + is widely used among developers working in that language. 110 + 111 + The "System Libraries" of an executable work include anything, other 112 + than the work as a whole, that (a) is included in the normal form of 113 + packaging a Major Component, but which is not part of that Major 114 + Component, and (b) serves only to enable use of the work with that 115 + Major Component, or to implement a Standard Interface for which an 116 + implementation is available to the public in source code form. A 117 + "Major Component", in this context, means a major essential component 118 + (kernel, window system, and so on) of the specific operating system 119 + (if any) on which the executable work runs, or a compiler used to 120 + produce the work, or an object code interpreter used to run it. 121 + 122 + The "Corresponding Source" for a work in object code form means all 123 + the source code needed to generate, install, and (for an executable 124 + work) run the object code and to modify the work, including scripts to 125 + control those activities. However, it does not include the work's 126 + System Libraries, or general-purpose tools or generally available free 127 + programs which are used unmodified in performing those activities but 128 + which are not part of the work. For example, Corresponding Source 129 + includes interface definition files associated with source files for 130 + the work, and the source code for shared libraries and dynamically 131 + linked subprograms that the work is specifically designed to require, 132 + such as by intimate data communication or control flow between those 133 + subprograms and other parts of the work. 134 + 135 + The Corresponding Source need not include anything that users 136 + can regenerate automatically from other parts of the Corresponding 137 + Source. 138 + 139 + The Corresponding Source for a work in source code form is that 140 + same work. 141 + 142 + 2. Basic Permissions. 143 + 144 + All rights granted under this License are granted for the term of 145 + copyright on the Program, and are irrevocable provided the stated 146 + conditions are met. This License explicitly affirms your unlimited 147 + permission to run the unmodified Program. The output from running a 148 + covered work is covered by this License only if the output, given its 149 + content, constitutes a covered work. This License acknowledges your 150 + rights of fair use or other equivalent, as provided by copyright law. 151 + 152 + You may make, run and propagate covered works that you do not 153 + convey, without conditions so long as your license otherwise remains 154 + in force. You may convey covered works to others for the sole purpose 155 + of having them make modifications exclusively for you, or provide you 156 + with facilities for running those works, provided that you comply with 157 + the terms of this License in conveying all material for which you do 158 + not control copyright. Those thus making or running the covered works 159 + for you must do so exclusively on your behalf, under your direction 160 + and control, on terms that prohibit them from making any copies of 161 + your copyrighted material outside their relationship with you. 162 + 163 + Conveying under any other circumstances is permitted solely under 164 + the conditions stated below. Sublicensing is not allowed; section 10 165 + makes it unnecessary. 166 + 167 + 3. Protecting Users' Legal Rights From Anti-Circumvention Law. 168 + 169 + No covered work shall be deemed part of an effective technological 170 + measure under any applicable law fulfilling obligations under article 171 + 11 of the WIPO copyright treaty adopted on 20 December 1996, or 172 + similar laws prohibiting or restricting circumvention of such 173 + measures. 174 + 175 + When you convey a covered work, you waive any legal power to forbid 176 + circumvention of technological measures to the extent such circumvention 177 + is effected by exercising rights under this License with respect to 178 + the covered work, and you disclaim any intention to limit operation or 179 + modification of the work as a means of enforcing, against the work's 180 + users, your or third parties' legal rights to forbid circumvention of 181 + technological measures. 182 + 183 + 4. Conveying Verbatim Copies. 184 + 185 + You may convey verbatim copies of the Program's source code as you 186 + receive it, in any medium, provided that you conspicuously and 187 + appropriately publish on each copy an appropriate copyright notice; 188 + keep intact all notices stating that this License and any 189 + non-permissive terms added in accord with section 7 apply to the code; 190 + keep intact all notices of the absence of any warranty; and give all 191 + recipients a copy of this License along with the Program. 192 + 193 + You may charge any price or no price for each copy that you convey, 194 + and you may offer support or warranty protection for a fee. 195 + 196 + 5. Conveying Modified Source Versions. 197 + 198 + You may convey a work based on the Program, or the modifications to 199 + produce it from the Program, in the form of source code under the 200 + terms of section 4, provided that you also meet all of these conditions: 201 + 202 + a) The work must carry prominent notices stating that you modified 203 + it, and giving a relevant date. 204 + 205 + b) The work must carry prominent notices stating that it is 206 + released under this License and any conditions added under section 207 + 7. This requirement modifies the requirement in section 4 to 208 + "keep intact all notices". 209 + 210 + c) You must license the entire work, as a whole, under this 211 + License to anyone who comes into possession of a copy. This 212 + License will therefore apply, along with any applicable section 7 213 + additional terms, to the whole of the work, and all its parts, 214 + regardless of how they are packaged. This License gives no 215 + permission to license the work in any other way, but it does not 216 + invalidate such permission if you have separately received it. 217 + 218 + d) If the work has interactive user interfaces, each must display 219 + Appropriate Legal Notices; however, if the Program has interactive 220 + interfaces that do not display Appropriate Legal Notices, your 221 + work need not make them do so. 222 + 223 + A compilation of a covered work with other separate and independent 224 + works, which are not by their nature extensions of the covered work, 225 + and which are not combined with it such as to form a larger program, 226 + in or on a volume of a storage or distribution medium, is called an 227 + "aggregate" if the compilation and its resulting copyright are not 228 + used to limit the access or legal rights of the compilation's users 229 + beyond what the individual works permit. Inclusion of a covered work 230 + in an aggregate does not cause this License to apply to the other 231 + parts of the aggregate. 232 + 233 + 6. Conveying Non-Source Forms. 234 + 235 + You may convey a covered work in object code form under the terms 236 + of sections 4 and 5, provided that you also convey the 237 + machine-readable Corresponding Source under the terms of this License, 238 + in one of these ways: 239 + 240 + a) Convey the object code in, or embodied in, a physical product 241 + (including a physical distribution medium), accompanied by the 242 + Corresponding Source fixed on a durable physical medium 243 + customarily used for software interchange. 244 + 245 + b) Convey the object code in, or embodied in, a physical product 246 + (including a physical distribution medium), accompanied by a 247 + written offer, valid for at least three years and valid for as 248 + long as you offer spare parts or customer support for that product 249 + model, to give anyone who possesses the object code either (1) a 250 + copy of the Corresponding Source for all the software in the 251 + product that is covered by this License, on a durable physical 252 + medium customarily used for software interchange, for a price no 253 + more than your reasonable cost of physically performing this 254 + conveying of source, or (2) access to copy the 255 + Corresponding Source from a network server at no charge. 256 + 257 + c) Convey individual copies of the object code with a copy of the 258 + written offer to provide the Corresponding Source. This 259 + alternative is allowed only occasionally and noncommercially, and 260 + only if you received the object code with such an offer, in accord 261 + with subsection 6b. 262 + 263 + d) Convey the object code by offering access from a designated 264 + place (gratis or for a charge), and offer equivalent access to the 265 + Corresponding Source in the same way through the same place at no 266 + further charge. You need not require recipients to copy the 267 + Corresponding Source along with the object code. If the place to 268 + copy the object code is a network server, the Corresponding Source 269 + may be on a different server (operated by you or a third party) 270 + that supports equivalent copying facilities, provided you maintain 271 + clear directions next to the object code saying where to find the 272 + Corresponding Source. Regardless of what server hosts the 273 + Corresponding Source, you remain obligated to ensure that it is 274 + available for as long as needed to satisfy these requirements. 275 + 276 + e) Convey the object code using peer-to-peer transmission, provided 277 + you inform other peers where the object code and Corresponding 278 + Source of the work are being offered to the general public at no 279 + charge under subsection 6d. 280 + 281 + A separable portion of the object code, whose source code is excluded 282 + from the Corresponding Source as a System Library, need not be 283 + included in conveying the object code work. 284 + 285 + A "User Product" is either (1) a "consumer product", which means any 286 + tangible personal property which is normally used for personal, family, 287 + or household purposes, or (2) anything designed or sold for incorporation 288 + into a dwelling. In determining whether a product is a consumer product, 289 + doubtful cases shall be resolved in favor of coverage. For a particular 290 + product received by a particular user, "normally used" refers to a 291 + typical or common use of that class of product, regardless of the status 292 + of the particular user or of the way in which the particular user 293 + actually uses, or expects or is expected to use, the product. A product 294 + is a consumer product regardless of whether the product has substantial 295 + commercial, industrial or non-consumer uses, unless such uses represent 296 + the only significant mode of use of the product. 297 + 298 + "Installation Information" for a User Product means any methods, 299 + procedures, authorization keys, or other information required to install 300 + and execute modified versions of a covered work in that User Product from 301 + a modified version of its Corresponding Source. The information must 302 + suffice to ensure that the continued functioning of the modified object 303 + code is in no case prevented or interfered with solely because 304 + modification has been made. 305 + 306 + If you convey an object code work under this section in, or with, or 307 + specifically for use in, a User Product, and the conveying occurs as 308 + part of a transaction in which the right of possession and use of the 309 + User Product is transferred to the recipient in perpetuity or for a 310 + fixed term (regardless of how the transaction is characterized), the 311 + Corresponding Source conveyed under this section must be accompanied 312 + by the Installation Information. But this requirement does not apply 313 + if neither you nor any third party retains the ability to install 314 + modified object code on the User Product (for example, the work has 315 + been installed in ROM). 316 + 317 + The requirement to provide Installation Information does not include a 318 + requirement to continue to provide support service, warranty, or updates 319 + for a work that has been modified or installed by the recipient, or for 320 + the User Product in which it has been modified or installed. Access to a 321 + network may be denied when the modification itself materially and 322 + adversely affects the operation of the network or violates the rules and 323 + protocols for communication across the network. 324 + 325 + Corresponding Source conveyed, and Installation Information provided, 326 + in accord with this section must be in a format that is publicly 327 + documented (and with an implementation available to the public in 328 + source code form), and must require no special password or key for 329 + unpacking, reading or copying. 330 + 331 + 7. Additional Terms. 332 + 333 + "Additional permissions" are terms that supplement the terms of this 334 + License by making exceptions from one or more of its conditions. 335 + Additional permissions that are applicable to the entire Program shall 336 + be treated as though they were included in this License, to the extent 337 + that they are valid under applicable law. If additional permissions 338 + apply only to part of the Program, that part may be used separately 339 + under those permissions, but the entire Program remains governed by 340 + this License without regard to the additional permissions. 341 + 342 + When you convey a copy of a covered work, you may at your option 343 + remove any additional permissions from that copy, or from any part of 344 + it. (Additional permissions may be written to require their own 345 + removal in certain cases when you modify the work.) You may place 346 + additional permissions on material, added by you to a covered work, 347 + for which you have or can give appropriate copyright permission. 348 + 349 + Notwithstanding any other provision of this License, for material you 350 + add to a covered work, you may (if authorized by the copyright holders of 351 + that material) supplement the terms of this License with terms: 352 + 353 + a) Disclaiming warranty or limiting liability differently from the 354 + terms of sections 15 and 16 of this License; or 355 + 356 + b) Requiring preservation of specified reasonable legal notices or 357 + author attributions in that material or in the Appropriate Legal 358 + Notices displayed by works containing it; or 359 + 360 + c) Prohibiting misrepresentation of the origin of that material, or 361 + requiring that modified versions of such material be marked in 362 + reasonable ways as different from the original version; or 363 + 364 + d) Limiting the use for publicity purposes of names of licensors or 365 + authors of the material; or 366 + 367 + e) Declining to grant rights under trademark law for use of some 368 + trade names, trademarks, or service marks; or 369 + 370 + f) Requiring indemnification of licensors and authors of that 371 + material by anyone who conveys the material (or modified versions of 372 + it) with contractual assumptions of liability to the recipient, for 373 + any liability that these contractual assumptions directly impose on 374 + those licensors and authors. 375 + 376 + All other non-permissive additional terms are considered "further 377 + restrictions" within the meaning of section 10. If the Program as you 378 + received it, or any part of it, contains a notice stating that it is 379 + governed by this License along with a term that is a further 380 + restriction, you may remove that term. If a license document contains 381 + a further restriction but permits relicensing or conveying under this 382 + License, you may add to a covered work material governed by the terms 383 + of that license document, provided that the further restriction does 384 + not survive such relicensing or conveying. 385 + 386 + If you add terms to a covered work in accord with this section, you 387 + must place, in the relevant source files, a statement of the 388 + additional terms that apply to those files, or a notice indicating 389 + where to find the applicable terms. 390 + 391 + Additional terms, permissive or non-permissive, may be stated in the 392 + form of a separately written license, or stated as exceptions; 393 + the above requirements apply either way. 394 + 395 + 8. Termination. 396 + 397 + You may not propagate or modify a covered work except as expressly 398 + provided under this License. Any attempt otherwise to propagate or 399 + modify it is void, and will automatically terminate your rights under 400 + this License (including any patent licenses granted under the third 401 + paragraph of section 11). 402 + 403 + However, if you cease all violation of this License, then your 404 + license from a particular copyright holder is reinstated (a) 405 + provisionally, unless and until the copyright holder explicitly and 406 + finally terminates your license, and (b) permanently, if the copyright 407 + holder fails to notify you of the violation by some reasonable means 408 + prior to 60 days after the cessation. 409 + 410 + Moreover, your license from a particular copyright holder is 411 + reinstated permanently if the copyright holder notifies you of the 412 + violation by some reasonable means, this is the first time you have 413 + received notice of violation of this License (for any work) from that 414 + copyright holder, and you cure the violation prior to 30 days after 415 + your receipt of the notice. 416 + 417 + Termination of your rights under this section does not terminate the 418 + licenses of parties who have received copies or rights from you under 419 + this License. If your rights have been terminated and not permanently 420 + reinstated, you do not qualify to receive new licenses for the same 421 + material under section 10. 422 + 423 + 9. Acceptance Not Required for Having Copies. 424 + 425 + You are not required to accept this License in order to receive or 426 + run a copy of the Program. Ancillary propagation of a covered work 427 + occurring solely as a consequence of using peer-to-peer transmission 428 + to receive a copy likewise does not require acceptance. However, 429 + nothing other than this License grants you permission to propagate or 430 + modify any covered work. These actions infringe copyright if you do 431 + not accept this License. Therefore, by modifying or propagating a 432 + covered work, you indicate your acceptance of this License to do so. 433 + 434 + 10. Automatic Licensing of Downstream Recipients. 435 + 436 + Each time you convey a covered work, the recipient automatically 437 + receives a license from the original licensors, to run, modify and 438 + propagate that work, subject to this License. You are not responsible 439 + for enforcing compliance by third parties with this License. 440 + 441 + An "entity transaction" is a transaction transferring control of an 442 + organization, or substantially all assets of one, or subdividing an 443 + organization, or merging organizations. If propagation of a covered 444 + work results from an entity transaction, each party to that 445 + transaction who receives a copy of the work also receives whatever 446 + licenses to the work the party's predecessor in interest had or could 447 + give under the previous paragraph, plus a right to possession of the 448 + Corresponding Source of the work from the predecessor in interest, if 449 + the predecessor has it or can get it with reasonable efforts. 450 + 451 + You may not impose any further restrictions on the exercise of the 452 + rights granted or affirmed under this License. For example, you may 453 + not impose a license fee, royalty, or other charge for exercise of 454 + rights granted under this License, and you may not initiate litigation 455 + (including a cross-claim or counterclaim in a lawsuit) alleging that 456 + any patent claim is infringed by making, using, selling, offering for 457 + sale, or importing the Program or any portion of it. 458 + 459 + 11. Patents. 460 + 461 + A "contributor" is a copyright holder who authorizes use under this 462 + License of the Program or a work on which the Program is based. The 463 + work thus licensed is called the contributor's "contributor version". 464 + 465 + A contributor's "essential patent claims" are all patent claims 466 + owned or controlled by the contributor, whether already acquired or 467 + hereafter acquired, that would be infringed by some manner, permitted 468 + by this License, of making, using, or selling its contributor version, 469 + but do not include claims that would be infringed only as a 470 + consequence of further modification of the contributor version. For 471 + purposes of this definition, "control" includes the right to grant 472 + patent sublicenses in a manner consistent with the requirements of 473 + this License. 474 + 475 + Each contributor grants you a non-exclusive, worldwide, royalty-free 476 + patent license under the contributor's essential patent claims, to 477 + make, use, sell, offer for sale, import and otherwise run, modify and 478 + propagate the contents of its contributor version. 479 + 480 + In the following three paragraphs, a "patent license" is any express 481 + agreement or commitment, however denominated, not to enforce a patent 482 + (such as an express permission to practice a patent or covenant not to 483 + sue for patent infringement). To "grant" such a patent license to a 484 + party means to make such an agreement or commitment not to enforce a 485 + patent against the party. 486 + 487 + If you convey a covered work, knowingly relying on a patent license, 488 + and the Corresponding Source of the work is not available for anyone 489 + to copy, free of charge and under the terms of this License, through a 490 + publicly available network server or other readily accessible means, 491 + then you must either (1) cause the Corresponding Source to be so 492 + available, or (2) arrange to deprive yourself of the benefit of the 493 + patent license for this particular work, or (3) arrange, in a manner 494 + consistent with the requirements of this License, to extend the patent 495 + license to downstream recipients. "Knowingly relying" means you have 496 + actual knowledge that, but for the patent license, your conveying the 497 + covered work in a country, or your recipient's use of the covered work 498 + in a country, would infringe one or more identifiable patents in that 499 + country that you have reason to believe are valid. 500 + 501 + If, pursuant to or in connection with a single transaction or 502 + arrangement, you convey, or propagate by procuring conveyance of, a 503 + covered work, and grant a patent license to some of the parties 504 + receiving the covered work authorizing them to use, propagate, modify 505 + or convey a specific copy of the covered work, then the patent license 506 + you grant is automatically extended to all recipients of the covered 507 + work and works based on it. 508 + 509 + A patent license is "discriminatory" if it does not include within 510 + the scope of its coverage, prohibits the exercise of, or is 511 + conditioned on the non-exercise of one or more of the rights that are 512 + specifically granted under this License. You may not convey a covered 513 + work if you are a party to an arrangement with a third party that is 514 + in the business of distributing software, under which you make payment 515 + to the third party based on the extent of your activity of conveying 516 + the work, and under which the third party grants, to any of the 517 + parties who would receive the covered work from you, a discriminatory 518 + patent license (a) in connection with copies of the covered work 519 + conveyed by you (or copies made from those copies), or (b) primarily 520 + for and in connection with specific products or compilations that 521 + contain the covered work, unless you entered into that arrangement, 522 + or that patent license was granted, prior to 28 March 2007. 523 + 524 + Nothing in this License shall be construed as excluding or limiting 525 + any implied license or other defenses to infringement that may 526 + otherwise be available to you under applicable patent law. 527 + 528 + 12. No Surrender of Others' Freedom. 529 + 530 + If conditions are imposed on you (whether by court order, agreement or 531 + otherwise) that contradict the conditions of this License, they do not 532 + excuse you from the conditions of this License. If you cannot convey a 533 + covered work so as to satisfy simultaneously your obligations under this 534 + License and any other pertinent obligations, then as a consequence you may 535 + not convey it at all. For example, if you agree to terms that obligate you 536 + to collect a royalty for further conveying from those to whom you convey 537 + the Program, the only way you could satisfy both those terms and this 538 + License would be to refrain entirely from conveying the Program. 539 + 540 + 13. Remote Network Interaction; Use with the GNU General Public License. 541 + 542 + Notwithstanding any other provision of this License, if you modify the 543 + Program, your modified version must prominently offer all users 544 + interacting with it remotely through a computer network (if your version 545 + supports such interaction) an opportunity to receive the Corresponding 546 + Source of your version by providing access to the Corresponding Source 547 + from a network server at no charge, through some standard or customary 548 + means of facilitating copying of software. This Corresponding Source 549 + shall include the Corresponding Source for any work covered by version 3 550 + of the GNU General Public License that is incorporated pursuant to the 551 + following paragraph. 552 + 553 + Notwithstanding any other provision of this License, you have 554 + permission to link or combine any covered work with a work licensed 555 + under version 3 of the GNU General Public License into a single 556 + combined work, and to convey the resulting work. The terms of this 557 + License will continue to apply to the part which is the covered work, 558 + but the work with which it is combined will remain governed by version 559 + 3 of the GNU General Public License. 560 + 561 + 14. Revised Versions of this License. 562 + 563 + The Free Software Foundation may publish revised and/or new versions of 564 + the GNU Affero General Public License from time to time. Such new versions 565 + will be similar in spirit to the present version, but may differ in detail to 566 + address new problems or concerns. 567 + 568 + Each version is given a distinguishing version number. If the 569 + Program specifies that a certain numbered version of the GNU Affero General 570 + Public License "or any later version" applies to it, you have the 571 + option of following the terms and conditions either of that numbered 572 + version or of any later version published by the Free Software 573 + Foundation. If the Program does not specify a version number of the 574 + GNU Affero General Public License, you may choose any version ever published 575 + by the Free Software Foundation. 576 + 577 + If the Program specifies that a proxy can decide which future 578 + versions of the GNU Affero General Public License can be used, that proxy's 579 + public statement of acceptance of a version permanently authorizes you 580 + to choose that version for the Program. 581 + 582 + Later license versions may give you additional or different 583 + permissions. However, no additional obligations are imposed on any 584 + author or copyright holder as a result of your choosing to follow a 585 + later version. 586 + 587 + 15. Disclaimer of Warranty. 588 + 589 + THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY 590 + APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT 591 + HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY 592 + OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, 593 + THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 594 + PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM 595 + IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF 596 + ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 597 + 598 + 16. Limitation of Liability. 599 + 600 + IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING 601 + WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS 602 + THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY 603 + GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE 604 + USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF 605 + DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD 606 + PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), 607 + EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF 608 + SUCH DAMAGES. 609 + 610 + 17. Interpretation of Sections 15 and 16. 611 + 612 + If the disclaimer of warranty and limitation of liability provided 613 + above cannot be given local legal effect according to their terms, 614 + reviewing courts shall apply local law that most closely approximates 615 + an absolute waiver of all civil liability in connection with the 616 + Program, unless a warranty or assumption of liability accompanies a 617 + copy of the Program in return for a fee. 618 + 619 + END OF TERMS AND CONDITIONS 620 + 621 + How to Apply These Terms to Your New Programs 622 + 623 + If you develop a new program, and you want it to be of the greatest 624 + possible use to the public, the best way to achieve this is to make it 625 + free software which everyone can redistribute and change under these terms. 626 + 627 + To do so, attach the following notices to the program. It is safest 628 + to attach them to the start of each source file to most effectively 629 + state the exclusion of warranty; and each file should have at least 630 + the "copyright" line and a pointer to where the full notice is found. 631 + 632 + <one line to give the program's name and a brief idea of what it does.> 633 + Copyright (C) <year> <name of author> 634 + 635 + This program is free software: you can redistribute it and/or modify 636 + it under the terms of the GNU Affero General Public License as published 637 + by the Free Software Foundation, either version 3 of the License, or 638 + (at your option) any later version. 639 + 640 + This program is distributed in the hope that it will be useful, 641 + but WITHOUT ANY WARRANTY; without even the implied warranty of 642 + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 643 + GNU Affero General Public License for more details. 644 + 645 + You should have received a copy of the GNU Affero General Public License 646 + along with this program. If not, see <https://www.gnu.org/licenses/>. 647 + 648 + Also add information on how to contact you by electronic and paper mail. 649 + 650 + If your software can interact with users remotely through a computer 651 + network, you should also make sure that it provides a way for users to 652 + get its source. For example, if your program is a web application, its 653 + interface could display a "Source" link that leads users to an archive 654 + of the code. There are many ways you could offer source, and different 655 + solutions will be better for different programs; see section 13 for the 656 + specific requirements. 657 + 658 + You should also get your employer (if you work as a programmer) or school, 659 + if any, to sign a "copyright disclaimer" for the program, if necessary. 660 + For more information on this, and how to apply and follow the GNU AGPL, see 661 + <https://www.gnu.org/licenses/>.
+3
constellation/LICENSE.future
··· 1 + constellation's source code is currently only available under the AGPL license. 2 + 3 + it MAY be relicensed in the future to MIT and/or Apache 2.0, at the sole discretion of the microcosm organization, but is not available under these licenses today.
+9
constellation/readme.md
··· 83 83 ``` 84 84 85 85 86 + ## Contributions 87 + 88 + ### Licensing 89 + 90 + Constellation's source code is currently available exclusively under the AGPL license (see [LICENSE](./LICENSE)). 91 + 92 + In the future, its code MAY become available under the MIT and/or Apache2.0 licenses, at the sole discretion of the microcosm organization. Contributing implies acceptance with this possible future licensing change. The change has not happed yet and is not guaranteed. 93 + 94 + 86 95 some todos 87 96 88 97 - [x] find links and write them to rocksdb
+57 -14
constellation/src/bin/main.rs
··· 1 1 use anyhow::{bail, Result}; 2 2 use clap::{Parser, ValueEnum}; 3 3 use metrics_exporter_prometheus::PrometheusBuilder; 4 + use std::net::SocketAddr; 4 5 use std::num::NonZero; 5 6 use std::path::PathBuf; 6 7 use std::sync::{atomic::AtomicU32, Arc}; ··· 21 22 #[derive(Parser, Debug)] 22 23 #[command(version, about, long_about = None)] 23 24 struct Args { 24 - #[arg(short, long)] 25 + /// constellation server's listen address 26 + #[arg(long)] 27 + #[clap(default_value = "0.0.0.0:6789")] 28 + bind: SocketAddr, 29 + /// metrics server's listen address 30 + #[arg(long)] 31 + #[clap(default_value = "0.0.0.0:8765")] 32 + bind_metrics: SocketAddr, 25 33 /// Jetstream server to connect to (exclusive with --fixture). Provide either a wss:// URL, or a shorhand value: 26 34 /// 'us-east-1', 'us-east-2', 'us-west-1', or 'us-west-2' 27 35 #[arg(short, long)] ··· 46 54 /// Saved jsonl from jetstream to use instead of a live subscription 47 55 #[arg(short, long)] 48 56 fixture: Option<PathBuf>, 57 + /// run a scan across the target id table and write all key -> ids to id -> keys 58 + #[arg(long, action)] 59 + repair_target_ids: bool, 49 60 } 50 61 51 62 #[derive(Debug, Clone, ValueEnum)] ··· 78 89 let stream = jetstream_url(&args.jetstream); 79 90 println!("using jetstream server {stream:?}...",); 80 91 92 + let bind = args.bind; 93 + let metrics_bind = args.bind_metrics; 94 + 81 95 let stay_alive = CancellationToken::new(); 82 96 83 97 match args.backend { 84 - StorageBackend::Memory => run(MemStorage::new(), fixture, None, stream, stay_alive), 98 + StorageBackend::Memory => run( 99 + MemStorage::new(), 100 + fixture, 101 + None, 102 + stream, 103 + bind, 104 + metrics_bind, 105 + stay_alive, 106 + ), 85 107 #[cfg(feature = "rocks")] 86 108 StorageBackend::Rocks => { 87 109 let storage_dir = args.data.clone().unwrap_or("rocks.test".into()); ··· 96 118 rocks.start_backup(backup_dir, auto_backup, stay_alive.clone())?; 97 119 } 98 120 println!("rocks ready."); 99 - run(rocks, fixture, args.data, stream, stay_alive) 121 + std::thread::scope(|s| { 122 + if args.repair_target_ids { 123 + let rocks = rocks.clone(); 124 + let stay_alive = stay_alive.clone(); 125 + s.spawn(move || { 126 + let rep = rocks.run_repair(time::Duration::from_millis(0), stay_alive); 127 + eprintln!("repair finished: {rep:?}"); 128 + rep 129 + }); 130 + } 131 + s.spawn(|| { 132 + let r = run( 133 + rocks, 134 + fixture, 135 + args.data, 136 + stream, 137 + bind, 138 + metrics_bind, 139 + stay_alive, 140 + ); 141 + eprintln!("run finished: {r:?}"); 142 + r 143 + }); 144 + }); 145 + Ok(()) 100 146 } 101 147 } 102 148 } ··· 106 152 fixture: Option<PathBuf>, 107 153 data_dir: Option<PathBuf>, 108 154 stream: String, 155 + bind: SocketAddr, 156 + metrics_bind: SocketAddr, 109 157 stay_alive: CancellationToken, 110 158 ) -> Result<()> { 111 159 ctrlc::set_handler({ ··· 150 198 .build() 151 199 .expect("axum startup") 152 200 .block_on(async { 153 - install_metrics_server()?; 154 - serve(readable, "0.0.0.0:6789", staying_alive).await 201 + install_metrics_server(metrics_bind)?; 202 + serve(readable, bind, staying_alive).await 155 203 }) 156 204 .unwrap(); 157 205 stay_alive.drop_guard(); ··· 184 232 185 233 'monitor: loop { 186 234 match readable.get_stats() { 187 - Ok(StorageStats { dids, targetables, linking_records }) => { 235 + Ok(StorageStats { dids, targetables, linking_records, .. }) => { 188 236 metrics::gauge!("storage.stats.dids").set(dids as f64); 189 237 metrics::gauge!("storage.stats.targetables").set(targetables as f64); 190 238 metrics::gauge!("storage.stats.linking_records").set(linking_records as f64); ··· 218 266 Ok(()) 219 267 } 220 268 221 - fn install_metrics_server() -> Result<()> { 269 + fn install_metrics_server(metrics_bind: SocketAddr) -> Result<()> { 222 270 println!("installing metrics server..."); 223 - let host = [0, 0, 0, 0]; 224 - let port = 8765; 225 271 PrometheusBuilder::new() 226 272 .set_quantiles(&[0.5, 0.9, 0.99, 1.0])? 227 273 .set_bucket_duration(time::Duration::from_secs(30))? 228 274 .set_bucket_count(NonZero::new(10).unwrap()) // count * duration = 5 mins. stuff doesn't happen that fast here. 229 275 .set_enable_unit_suffix(true) 230 - .with_http_listener((host, port)) 276 + .with_http_listener(metrics_bind) 231 277 .install()?; 232 - println!( 233 - "metrics server installed! listening on http://{}.{}.{}.{}:{port}", 234 - host[0], host[1], host[2], host[3] 235 - ); 278 + println!("metrics server installed! listening at {metrics_bind:?}"); 236 279 Ok(()) 237 280 } 238 281
+8 -6
constellation/src/server/filters.rs
··· 5 5 Ok({ 6 6 if let Some(link) = parse_any_link(s) { 7 7 match link { 8 - Link::AtUri(at_uri) => at_uri.strip_prefix("at://").map(|noproto| { 9 - format!("https://atproto-browser-plus-links.vercel.app/at/{noproto}") 10 - }), 11 - Link::Did(did) => Some(format!( 12 - "https://atproto-browser-plus-links.vercel.app/at/{did}" 13 - )), 8 + Link::AtUri(at_uri) => at_uri 9 + .strip_prefix("at://") 10 + .map(|noproto| format!("https://pdsls.dev/at://{noproto}")), 11 + Link::Did(did) => Some(format!("https://pdsls.dev/at://{did}")), 14 12 Link::Uri(uri) => Some(uri), 15 13 } 16 14 } else { ··· 22 20 pub fn human_number(n: &u64) -> askama::Result<String> { 23 21 Ok(n.to_formatted_string(&Locale::en)) 24 22 } 23 + 24 + pub fn to_u64(n: usize) -> askama::Result<u64> { 25 + Ok(n as u64) 26 + }
+322 -23
constellation/src/server/mod.rs
··· 14 14 use std::collections::{HashMap, HashSet}; 15 15 use std::time::{Duration, UNIX_EPOCH}; 16 16 use tokio::net::{TcpListener, ToSocketAddrs}; 17 - use tokio::task::block_in_place; 17 + use tokio::task::spawn_blocking; 18 18 use tokio_util::sync::CancellationToken; 19 19 20 20 use crate::storage::{LinkReader, StorageStats}; ··· 28 28 const DEFAULT_CURSOR_LIMIT: u64 = 16; 29 29 const DEFAULT_CURSOR_LIMIT_MAX: u64 = 100; 30 30 31 - const INDEX_BEGAN_AT_TS: u64 = 1738083600; // TODO: not this 31 + fn get_default_cursor_limit() -> u64 { 32 + DEFAULT_CURSOR_LIMIT 33 + } 34 + 35 + fn to500(e: tokio::task::JoinError) -> http::StatusCode { 36 + eprintln!("handler error: {e}"); 37 + http::StatusCode::INTERNAL_SERVER_ERROR 38 + } 32 39 33 40 pub async fn serve<S, A>(store: S, addr: A, stay_alive: CancellationToken) -> anyhow::Result<()> 34 41 where ··· 41 48 "/", 42 49 get({ 43 50 let store = store.clone(); 44 - move |accept| async { block_in_place(|| hello(accept, store)) } 51 + move |accept| async { 52 + spawn_blocking(|| hello(accept, store)) 53 + .await 54 + .map_err(to500)? 55 + } 56 + }), 57 + ) 58 + .route( 59 + "/xrpc/blue.microcosm.links.getManyToManyCounts", 60 + get({ 61 + let store = store.clone(); 62 + move |accept, query| async { 63 + spawn_blocking(|| get_many_to_many_counts(accept, query, store)) 64 + .await 65 + .map_err(to500)? 66 + } 45 67 }), 46 68 ) 47 69 .route( 48 70 "/links/count", 49 71 get({ 50 72 let store = store.clone(); 51 - move |accept, query| async { block_in_place(|| count_links(accept, query, store)) } 73 + move |accept, query| async { 74 + spawn_blocking(|| count_links(accept, query, store)) 75 + .await 76 + .map_err(to500)? 77 + } 52 78 }), 53 79 ) 54 80 .route( ··· 56 82 get({ 57 83 let store = store.clone(); 58 84 move |accept, query| async { 59 - block_in_place(|| count_distinct_dids(accept, query, store)) 85 + spawn_blocking(|| count_distinct_dids(accept, query, store)) 86 + .await 87 + .map_err(to500)? 88 + } 89 + }), 90 + ) 91 + .route( 92 + "/xrpc/blue.microcosm.links.getBacklinks", 93 + get({ 94 + let store = store.clone(); 95 + move |accept, query| async { 96 + spawn_blocking(|| get_backlinks(accept, query, store)) 97 + .await 98 + .map_err(to500)? 60 99 } 61 100 }), 62 101 ) ··· 64 103 "/links", 65 104 get({ 66 105 let store = store.clone(); 67 - move |accept, query| async { block_in_place(|| get_links(accept, query, store)) } 106 + move |accept, query| async { 107 + spawn_blocking(|| get_links(accept, query, store)) 108 + .await 109 + .map_err(to500)? 110 + } 68 111 }), 69 112 ) 70 113 .route( ··· 72 115 get({ 73 116 let store = store.clone(); 74 117 move |accept, query| async { 75 - block_in_place(|| get_distinct_dids(accept, query, store)) 118 + spawn_blocking(|| get_distinct_dids(accept, query, store)) 119 + .await 120 + .map_err(to500)? 76 121 } 77 122 }), 78 123 ) ··· 82 127 get({ 83 128 let store = store.clone(); 84 129 move |accept, query| async { 85 - block_in_place(|| count_all_links(accept, query, store)) 130 + spawn_blocking(|| count_all_links(accept, query, store)) 131 + .await 132 + .map_err(to500)? 86 133 } 87 134 }), 88 135 ) ··· 91 138 get({ 92 139 let store = store.clone(); 93 140 move |accept, query| async { 94 - block_in_place(|| explore_links(accept, query, store)) 141 + spawn_blocking(|| explore_links(accept, query, store)) 142 + .await 143 + .map_err(to500)? 95 144 } 96 145 }), 97 146 ) ··· 150 199 #[template(path = "hello.html.j2")] 151 200 struct HelloReponse { 152 201 help: &'static str, 153 - days_indexed: u64, 202 + days_indexed: Option<u64>, 154 203 stats: StorageStats, 155 204 } 156 205 fn hello( ··· 160 209 let stats = store 161 210 .get_stats() 162 211 .map_err(|_| http::StatusCode::INTERNAL_SERVER_ERROR)?; 163 - let days_indexed = (UNIX_EPOCH + Duration::from_secs(INDEX_BEGAN_AT_TS)) 164 - .elapsed() 212 + let days_indexed = stats 213 + .started_at 214 + .map(|c| (UNIX_EPOCH + Duration::from_micros(c)).elapsed()) 215 + .transpose() 165 216 .map_err(|_| http::StatusCode::INTERNAL_SERVER_ERROR)? 166 - .as_secs() 167 - / 86400; 217 + .map(|d| d.as_secs() / 86_400); 168 218 Ok(acceptable(accept, HelloReponse { 169 219 help: "open this URL in a web browser (or request with Accept: text/html) for information about this API.", 170 220 days_indexed, ··· 173 223 } 174 224 175 225 #[derive(Clone, Deserialize)] 226 + #[serde(rename_all = "camelCase")] 227 + struct GetManyToManyCountsQuery { 228 + subject: String, 229 + source: String, 230 + /// path to the secondary link in the linking record 231 + path_to_other: String, 232 + /// filter to linking records (join of the m2m) by these DIDs 233 + #[serde(default)] 234 + did: Vec<String>, 235 + /// filter to specific secondary records 236 + #[serde(default)] 237 + other_subject: Vec<String>, 238 + cursor: Option<OpaqueApiCursor>, 239 + /// Set the max number of links to return per page of results 240 + #[serde(default = "get_default_cursor_limit")] 241 + limit: u64, 242 + } 243 + #[derive(Serialize)] 244 + struct OtherSubjectCount { 245 + subject: String, 246 + total: u64, 247 + distinct: u64, 248 + } 249 + #[derive(Template, Serialize)] 250 + #[template(path = "get-many-to-many-counts.html.j2")] 251 + struct GetManyToManyCountsResponse { 252 + counts_by_other_subject: Vec<OtherSubjectCount>, 253 + cursor: Option<OpaqueApiCursor>, 254 + #[serde(skip_serializing)] 255 + query: GetManyToManyCountsQuery, 256 + } 257 + fn get_many_to_many_counts( 258 + accept: ExtractAccept, 259 + query: axum_extra::extract::Query<GetManyToManyCountsQuery>, 260 + store: impl LinkReader, 261 + ) -> Result<impl IntoResponse, http::StatusCode> { 262 + let cursor_key = query 263 + .cursor 264 + .clone() 265 + .map(|oc| ApiKeyedCursor::try_from(oc).map_err(|_| http::StatusCode::BAD_REQUEST)) 266 + .transpose()? 267 + .map(|c| c.next); 268 + 269 + let limit = query.limit; 270 + if limit > DEFAULT_CURSOR_LIMIT_MAX { 271 + return Err(http::StatusCode::BAD_REQUEST); 272 + } 273 + 274 + let filter_dids: HashSet<Did> = HashSet::from_iter( 275 + query 276 + .did 277 + .iter() 278 + .map(|d| d.trim()) 279 + .filter(|d| !d.is_empty()) 280 + .map(|d| Did(d.to_string())), 281 + ); 282 + 283 + let filter_other_subjects: HashSet<String> = HashSet::from_iter( 284 + query 285 + .other_subject 286 + .iter() 287 + .map(|s| s.trim().to_string()) 288 + .filter(|s| !s.is_empty()), 289 + ); 290 + 291 + let Some((collection, path)) = query.source.split_once(':') else { 292 + return Err(http::StatusCode::BAD_REQUEST); 293 + }; 294 + let path = format!(".{path}"); 295 + 296 + let path_to_other = format!(".{}", query.path_to_other); 297 + 298 + let paged = store 299 + .get_many_to_many_counts( 300 + &query.subject, 301 + collection, 302 + &path, 303 + &path_to_other, 304 + limit, 305 + cursor_key, 306 + &filter_dids, 307 + &filter_other_subjects, 308 + ) 309 + .map_err(|_| http::StatusCode::INTERNAL_SERVER_ERROR)?; 310 + 311 + let cursor = paged.next.map(|next| ApiKeyedCursor { next }.into()); 312 + 313 + let items = paged 314 + .items 315 + .into_iter() 316 + .map(|(subject, total, distinct)| OtherSubjectCount { 317 + subject, 318 + total, 319 + distinct, 320 + }) 321 + .collect(); 322 + 323 + Ok(acceptable( 324 + accept, 325 + GetManyToManyCountsResponse { 326 + counts_by_other_subject: items, 327 + cursor, 328 + query: (*query).clone(), 329 + }, 330 + )) 331 + } 332 + 333 + #[derive(Clone, Deserialize)] 176 334 struct GetLinksCountQuery { 177 335 target: String, 178 336 collection: String, ··· 233 391 } 234 392 235 393 #[derive(Clone, Deserialize)] 394 + struct GetBacklinksQuery { 395 + /// The link target 396 + /// 397 + /// can be an AT-URI, plain DID, or regular URI 398 + subject: String, 399 + /// Filter links only from this link source 400 + /// 401 + /// eg.: `app.bsky.feed.like:subject.uri` 402 + source: String, 403 + cursor: Option<OpaqueApiCursor>, 404 + /// Filter links only from these DIDs 405 + /// 406 + /// include multiple times to filter by multiple source DIDs 407 + #[serde(default)] 408 + did: Vec<String>, 409 + /// Set the max number of links to return per page of results 410 + #[serde(default = "get_default_cursor_limit")] 411 + limit: u64, 412 + // TODO: allow reverse (er, forward) order as well 413 + } 414 + #[derive(Template, Serialize)] 415 + #[template(path = "get-backlinks.html.j2")] 416 + struct GetBacklinksResponse { 417 + total: u64, 418 + records: Vec<RecordId>, 419 + cursor: Option<OpaqueApiCursor>, 420 + #[serde(skip_serializing)] 421 + query: GetBacklinksQuery, 422 + #[serde(skip_serializing)] 423 + collection: String, 424 + #[serde(skip_serializing)] 425 + path: String, 426 + } 427 + fn get_backlinks( 428 + accept: ExtractAccept, 429 + query: axum_extra::extract::Query<GetBacklinksQuery>, // supports multiple param occurrences 430 + store: impl LinkReader, 431 + ) -> Result<impl IntoResponse, http::StatusCode> { 432 + let until = query 433 + .cursor 434 + .clone() 435 + .map(|oc| ApiCursor::try_from(oc).map_err(|_| http::StatusCode::BAD_REQUEST)) 436 + .transpose()? 437 + .map(|c| c.next); 438 + 439 + let limit = query.limit; 440 + if limit > DEFAULT_CURSOR_LIMIT_MAX { 441 + return Err(http::StatusCode::BAD_REQUEST); 442 + } 443 + 444 + let filter_dids: HashSet<Did> = HashSet::from_iter( 445 + query 446 + .did 447 + .iter() 448 + .map(|d| d.trim()) 449 + .filter(|d| !d.is_empty()) 450 + .map(|d| Did(d.to_string())), 451 + ); 452 + 453 + let Some((collection, path)) = query.source.split_once(':') else { 454 + return Err(http::StatusCode::BAD_REQUEST); 455 + }; 456 + let path = format!(".{path}"); 457 + 458 + let paged = store 459 + .get_links( 460 + &query.subject, 461 + collection, 462 + &path, 463 + limit, 464 + until, 465 + &filter_dids, 466 + ) 467 + .map_err(|_| http::StatusCode::INTERNAL_SERVER_ERROR)?; 468 + 469 + let cursor = paged.next.map(|next| { 470 + ApiCursor { 471 + version: paged.version, 472 + next, 473 + } 474 + .into() 475 + }); 476 + 477 + Ok(acceptable( 478 + accept, 479 + GetBacklinksResponse { 480 + total: paged.total, 481 + records: paged.items, 482 + cursor, 483 + query: (*query).clone(), 484 + collection: collection.to_string(), 485 + path, 486 + }, 487 + )) 488 + } 489 + 490 + #[derive(Clone, Deserialize)] 236 491 struct GetLinkItemsQuery { 237 492 target: String, 238 493 collection: String, 239 494 path: String, 240 495 cursor: Option<OpaqueApiCursor>, 496 + /// Filter links only from these DIDs 497 + /// 498 + /// include multiple times to filter by multiple source DIDs 499 + #[serde(default)] 500 + did: Vec<String>, 501 + /// [deprecated] Filter links only from these DIDs 502 + /// 503 + /// format: comma-separated sequence of DIDs 504 + /// 505 + /// errors: if `did` parameter is also present 506 + /// 507 + /// deprecated: use `did`, which can be repeated multiple times 241 508 from_dids: Option<String>, // comma separated: gross 242 - limit: Option<u64>, 509 + #[serde(default = "get_default_cursor_limit")] 510 + limit: u64, 243 511 // TODO: allow reverse (er, forward) order as well 244 512 } 245 513 #[derive(Template, Serialize)] ··· 256 524 } 257 525 fn get_links( 258 526 accept: ExtractAccept, 259 - query: Query<GetLinkItemsQuery>, 527 + query: axum_extra::extract::Query<GetLinkItemsQuery>, // supports multiple param occurrences 260 528 store: impl LinkReader, 261 529 ) -> Result<impl IntoResponse, http::StatusCode> { 262 530 let until = query ··· 266 534 .transpose()? 267 535 .map(|c| c.next); 268 536 269 - let limit = query.limit.unwrap_or(DEFAULT_CURSOR_LIMIT); 537 + let limit = query.limit; 270 538 if limit > DEFAULT_CURSOR_LIMIT_MAX { 271 539 return Err(http::StatusCode::BAD_REQUEST); 272 540 } 273 541 274 - let filter_dids = &query 275 - .from_dids 276 - .clone() 277 - .map(|comma_joined| HashSet::from_iter(comma_joined.split(',').map(|d| Did(d.to_string())))) 278 - .unwrap_or_default(); 542 + let mut filter_dids: HashSet<Did> = HashSet::from_iter( 543 + query 544 + .did 545 + .iter() 546 + .map(|d| d.trim()) 547 + .filter(|d| !d.is_empty()) 548 + .map(|d| Did(d.to_string())), 549 + ); 550 + 551 + if let Some(comma_joined) = &query.from_dids { 552 + if !filter_dids.is_empty() { 553 + return Err(http::StatusCode::BAD_REQUEST); 554 + } 555 + for did in comma_joined.split(',') { 556 + filter_dids.insert(Did(did.to_string())); 557 + } 558 + } 279 559 280 560 let paged = store 281 561 .get_links( ··· 284 564 &query.path, 285 565 limit, 286 566 until, 287 - filter_dids, 567 + &filter_dids, 288 568 ) 289 569 .map_err(|_| http::StatusCode::INTERNAL_SERVER_ERROR)?; 290 570 ··· 447 727 OpaqueApiCursor(bincode::DefaultOptions::new().serialize(&item).unwrap()) 448 728 } 449 729 } 730 + 731 + #[derive(Serialize, Deserialize)] // for bincode 732 + struct ApiKeyedCursor { 733 + next: String, // the key 734 + } 735 + 736 + impl TryFrom<OpaqueApiCursor> for ApiKeyedCursor { 737 + type Error = bincode::Error; 738 + 739 + fn try_from(item: OpaqueApiCursor) -> Result<Self, Self::Error> { 740 + bincode::DefaultOptions::new().deserialize(&item.0) 741 + } 742 + } 743 + 744 + impl From<ApiKeyedCursor> for OpaqueApiCursor { 745 + fn from(item: ApiKeyedCursor) -> Self { 746 + OpaqueApiCursor(bincode::DefaultOptions::new().serialize(&item).unwrap()) 747 + } 748 + }
+78 -1
constellation/src/storage/mem_store.rs
··· 1 - use super::{LinkReader, LinkStorage, PagedAppendingCollection, StorageStats}; 1 + use super::{ 2 + LinkReader, LinkStorage, PagedAppendingCollection, PagedOrderedCollection, StorageStats, 3 + }; 2 4 use crate::{ActionableEvent, CountsByCount, Did, RecordId}; 3 5 use anyhow::Result; 4 6 use links::CollectedLink; ··· 132 134 } 133 135 134 136 impl LinkReader for MemStorage { 137 + fn get_many_to_many_counts( 138 + &self, 139 + target: &str, 140 + collection: &str, 141 + path: &str, 142 + path_to_other: &str, 143 + limit: u64, 144 + after: Option<String>, 145 + filter_dids: &HashSet<Did>, 146 + filter_to_targets: &HashSet<String>, 147 + ) -> Result<PagedOrderedCollection<(String, u64, u64), String>> { 148 + let data = self.0.lock().unwrap(); 149 + let Some(paths) = data.targets.get(&Target::new(target)) else { 150 + return Ok(PagedOrderedCollection::default()); 151 + }; 152 + let Some(linkers) = paths.get(&Source::new(collection, path)) else { 153 + return Ok(PagedOrderedCollection::default()); 154 + }; 155 + 156 + let path_to_other = RecordPath::new(path_to_other); 157 + let filter_to_targets: HashSet<Target> = 158 + HashSet::from_iter(filter_to_targets.iter().map(|s| Target::new(s))); 159 + 160 + let mut grouped_counts: HashMap<Target, (u64, HashSet<Did>)> = HashMap::new(); 161 + for (did, rkey) in linkers.iter().flatten().cloned() { 162 + if !filter_dids.is_empty() && !filter_dids.contains(&did) { 163 + continue; 164 + } 165 + if let Some(fwd_target) = data 166 + .links 167 + .get(&did) 168 + .unwrap_or(&HashMap::new()) 169 + .get(&RepoId { 170 + collection: collection.to_string(), 171 + rkey, 172 + }) 173 + .unwrap_or(&Vec::new()) 174 + .iter() 175 + .filter_map(|(path, target)| { 176 + if *path == path_to_other 177 + && (filter_to_targets.is_empty() || filter_to_targets.contains(target)) 178 + { 179 + Some(target) 180 + } else { 181 + None 182 + } 183 + }) 184 + .take(1) 185 + .next() 186 + { 187 + let e = grouped_counts.entry(fwd_target.clone()).or_default(); 188 + e.0 += 1; 189 + e.1.insert(did.clone()); 190 + } 191 + } 192 + let mut items: Vec<(String, u64, u64)> = grouped_counts 193 + .iter() 194 + .map(|(k, (n, u))| (k.0.clone(), *n, u.len() as u64)) 195 + .collect(); 196 + items.sort(); 197 + items = items 198 + .into_iter() 199 + .skip_while(|(t, _, _)| after.as_ref().map(|a| t <= a).unwrap_or(false)) 200 + .take(limit as usize) 201 + .collect(); 202 + let next = if items.len() as u64 >= limit { 203 + items.last().map(|(t, _, _)| t.clone()) 204 + } else { 205 + None 206 + }; 207 + Ok(PagedOrderedCollection { items, next }) 208 + } 209 + 135 210 fn get_count(&self, target: &str, collection: &str, path: &str) -> Result<u64> { 136 211 let data = self.0.lock().unwrap(); 137 212 let Some(paths) = data.targets.get(&Target::new(target)) else { ··· 353 428 dids, 354 429 targetables, 355 430 linking_records, 431 + started_at: None, 432 + other_data: Default::default(), 356 433 }) 357 434 } 358 435 }
+225
constellation/src/storage/mod.rs
··· 19 19 pub total: u64, 20 20 } 21 21 22 + /// A paged collection whose keys are sorted instead of indexed 23 + /// 24 + /// this has weaker guarantees than PagedAppendingCollection: it might 25 + /// return a totally consistent snapshot. but it should avoid duplicates 26 + /// and each page should at least be internally consistent. 27 + #[derive(Debug, PartialEq, Default)] 28 + pub struct PagedOrderedCollection<T, K: Ord> { 29 + pub items: Vec<T>, 30 + pub next: Option<K>, 31 + } 32 + 22 33 #[derive(Debug, Deserialize, Serialize, PartialEq)] 23 34 pub struct StorageStats { 24 35 /// estimate of how many accounts we've seen create links. the _subjects_ of any links are not represented here. ··· 33 44 /// records with multiple links are single-counted. 34 45 /// for LSM stores, deleted links don't decrement this, and updated records with any links will likely increment it. 35 46 pub linking_records: u64, 47 + 48 + /// first jetstream cursor when this instance first started 49 + pub started_at: Option<u64>, 50 + 51 + /// anything else we want to throw in 52 + pub other_data: HashMap<String, u64>, 36 53 } 37 54 38 55 pub trait LinkStorage: Send + Sync { ··· 48 65 } 49 66 50 67 pub trait LinkReader: Clone + Send + Sync + 'static { 68 + #[allow(clippy::too_many_arguments)] 69 + fn get_many_to_many_counts( 70 + &self, 71 + target: &str, 72 + collection: &str, 73 + path: &str, 74 + path_to_other: &str, 75 + limit: u64, 76 + after: Option<String>, 77 + filter_dids: &HashSet<Did>, 78 + filter_to_targets: &HashSet<String>, 79 + ) -> Result<PagedOrderedCollection<(String, u64, u64), String>>; 80 + 51 81 fn get_count(&self, target: &str, collection: &str, path: &str) -> Result<u64>; 52 82 53 83 fn get_distinct_did_count(&self, target: &str, collection: &str, path: &str) -> Result<u64>; ··· 1326 1356 counts 1327 1357 }); 1328 1358 assert_stats(storage.get_stats()?, 1..=1, 2..=2, 1..=1); 1359 + }); 1360 + 1361 + //////// many-to-many ///////// 1362 + 1363 + test_each_storage!(get_m2m_counts_empty, |storage| { 1364 + assert_eq!( 1365 + storage.get_many_to_many_counts( 1366 + "a.com", 1367 + "a.b.c", 1368 + ".d.e", 1369 + ".f.g", 1370 + 10, 1371 + None, 1372 + &HashSet::new(), 1373 + &HashSet::new(), 1374 + )?, 1375 + PagedOrderedCollection { 1376 + items: vec![], 1377 + next: None, 1378 + } 1379 + ); 1380 + }); 1381 + 1382 + test_each_storage!(get_m2m_counts_single, |storage| { 1383 + storage.push( 1384 + &ActionableEvent::CreateLinks { 1385 + record_id: RecordId { 1386 + did: "did:plc:asdf".into(), 1387 + collection: "app.t.c".into(), 1388 + rkey: "asdf".into(), 1389 + }, 1390 + links: vec![ 1391 + CollectedLink { 1392 + target: Link::Uri("a.com".into()), 1393 + path: ".abc.uri".into(), 1394 + }, 1395 + CollectedLink { 1396 + target: Link::Uri("b.com".into()), 1397 + path: ".def.uri".into(), 1398 + }, 1399 + CollectedLink { 1400 + target: Link::Uri("b.com".into()), 1401 + path: ".ghi.uri".into(), 1402 + }, 1403 + ], 1404 + }, 1405 + 0, 1406 + )?; 1407 + assert_eq!( 1408 + storage.get_many_to_many_counts( 1409 + "a.com", 1410 + "app.t.c", 1411 + ".abc.uri", 1412 + ".def.uri", 1413 + 10, 1414 + None, 1415 + &HashSet::new(), 1416 + &HashSet::new(), 1417 + )?, 1418 + PagedOrderedCollection { 1419 + items: vec![("b.com".to_string(), 1, 1)], 1420 + next: None, 1421 + } 1422 + ); 1423 + }); 1424 + 1425 + test_each_storage!(get_m2m_counts_filters, |storage| { 1426 + storage.push( 1427 + &ActionableEvent::CreateLinks { 1428 + record_id: RecordId { 1429 + did: "did:plc:asdf".into(), 1430 + collection: "app.t.c".into(), 1431 + rkey: "asdf".into(), 1432 + }, 1433 + links: vec![ 1434 + CollectedLink { 1435 + target: Link::Uri("a.com".into()), 1436 + path: ".abc.uri".into(), 1437 + }, 1438 + CollectedLink { 1439 + target: Link::Uri("b.com".into()), 1440 + path: ".def.uri".into(), 1441 + }, 1442 + ], 1443 + }, 1444 + 0, 1445 + )?; 1446 + storage.push( 1447 + &ActionableEvent::CreateLinks { 1448 + record_id: RecordId { 1449 + did: "did:plc:asdfasdf".into(), 1450 + collection: "app.t.c".into(), 1451 + rkey: "asdf".into(), 1452 + }, 1453 + links: vec![ 1454 + CollectedLink { 1455 + target: Link::Uri("a.com".into()), 1456 + path: ".abc.uri".into(), 1457 + }, 1458 + CollectedLink { 1459 + target: Link::Uri("b.com".into()), 1460 + path: ".def.uri".into(), 1461 + }, 1462 + ], 1463 + }, 1464 + 1, 1465 + )?; 1466 + storage.push( 1467 + &ActionableEvent::CreateLinks { 1468 + record_id: RecordId { 1469 + did: "did:plc:fdsa".into(), 1470 + collection: "app.t.c".into(), 1471 + rkey: "asdf".into(), 1472 + }, 1473 + links: vec![ 1474 + CollectedLink { 1475 + target: Link::Uri("a.com".into()), 1476 + path: ".abc.uri".into(), 1477 + }, 1478 + CollectedLink { 1479 + target: Link::Uri("c.com".into()), 1480 + path: ".def.uri".into(), 1481 + }, 1482 + ], 1483 + }, 1484 + 2, 1485 + )?; 1486 + storage.push( 1487 + &ActionableEvent::CreateLinks { 1488 + record_id: RecordId { 1489 + did: "did:plc:fdsa".into(), 1490 + collection: "app.t.c".into(), 1491 + rkey: "asdf2".into(), 1492 + }, 1493 + links: vec![ 1494 + CollectedLink { 1495 + target: Link::Uri("a.com".into()), 1496 + path: ".abc.uri".into(), 1497 + }, 1498 + CollectedLink { 1499 + target: Link::Uri("c.com".into()), 1500 + path: ".def.uri".into(), 1501 + }, 1502 + ], 1503 + }, 1504 + 3, 1505 + )?; 1506 + assert_eq!( 1507 + storage.get_many_to_many_counts( 1508 + "a.com", 1509 + "app.t.c", 1510 + ".abc.uri", 1511 + ".def.uri", 1512 + 10, 1513 + None, 1514 + &HashSet::new(), 1515 + &HashSet::new(), 1516 + )?, 1517 + PagedOrderedCollection { 1518 + items: vec![("b.com".to_string(), 2, 2), ("c.com".to_string(), 2, 1),], 1519 + next: None, 1520 + } 1521 + ); 1522 + assert_eq!( 1523 + storage.get_many_to_many_counts( 1524 + "a.com", 1525 + "app.t.c", 1526 + ".abc.uri", 1527 + ".def.uri", 1528 + 10, 1529 + None, 1530 + &HashSet::from_iter([Did("did:plc:fdsa".to_string())]), 1531 + &HashSet::new(), 1532 + )?, 1533 + PagedOrderedCollection { 1534 + items: vec![("c.com".to_string(), 2, 1),], 1535 + next: None, 1536 + } 1537 + ); 1538 + assert_eq!( 1539 + storage.get_many_to_many_counts( 1540 + "a.com", 1541 + "app.t.c", 1542 + ".abc.uri", 1543 + ".def.uri", 1544 + 10, 1545 + None, 1546 + &HashSet::new(), 1547 + &HashSet::from_iter(["b.com".to_string()]), 1548 + )?, 1549 + PagedOrderedCollection { 1550 + items: vec![("b.com".to_string(), 2, 2),], 1551 + next: None, 1552 + } 1553 + ); 1329 1554 }); 1330 1555 }
+342 -40
constellation/src/storage/rocks_store.rs
··· 1 - use super::{ActionableEvent, LinkReader, LinkStorage, PagedAppendingCollection, StorageStats}; 1 + use super::{ 2 + ActionableEvent, LinkReader, LinkStorage, PagedAppendingCollection, PagedOrderedCollection, 3 + StorageStats, 4 + }; 2 5 use crate::{CountsByCount, Did, RecordId}; 3 6 use anyhow::{bail, Result}; 4 7 use bincode::Options as BincodeOptions; ··· 11 14 MultiThreaded, Options, PrefixRange, ReadOptions, WriteBatch, 12 15 }; 13 16 use serde::{Deserialize, Serialize}; 14 - use std::collections::{HashMap, HashSet}; 17 + use std::collections::{BTreeMap, HashMap, HashSet}; 15 18 use std::io::Read; 16 19 use std::marker::PhantomData; 17 20 use std::path::{Path, PathBuf}; ··· 20 23 Arc, 21 24 }; 22 25 use std::thread; 23 - use std::time::{Duration, Instant}; 26 + use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH}; 24 27 use tokio_util::sync::CancellationToken; 25 28 26 29 static DID_IDS_CF: &str = "did_ids"; ··· 29 32 static LINK_TARGETS_CF: &str = "link_targets"; 30 33 31 34 static JETSTREAM_CURSOR_KEY: &str = "jetstream_cursor"; 35 + static STARTED_AT_KEY: &str = "jetstream_first_cursor"; 36 + // add reverse mappings for targets if this db was running before that was a thing 37 + static TARGET_ID_REPAIR_STATE_KEY: &str = "target_id_table_repair_state"; 38 + 39 + static COZY_FIRST_CURSOR: u64 = 1_738_083_600_000_000; // constellation.microcosm.blue started 40 + 41 + #[derive(Debug, Clone, Serialize, Deserialize)] 42 + struct TargetIdRepairState { 43 + /// start time for repair, microseconds timestamp 44 + current_us_started_at: u64, 45 + /// id table's latest id when repair started 46 + id_when_started: u64, 47 + /// id table id 48 + latest_repaired_i: u64, 49 + } 50 + impl AsRocksValue for TargetIdRepairState {} 51 + impl ValueFromRocks for TargetIdRepairState {} 32 52 33 53 // todo: actually understand and set these options probably better 34 54 fn rocks_opts_base() -> Options { ··· 56 76 #[derive(Debug, Clone)] 57 77 pub struct RocksStorage { 58 78 pub db: Arc<DBWithThreadMode<MultiThreaded>>, // TODO: mov seqs here (concat merge op will be fun) 59 - did_id_table: IdTable<Did, DidIdValue, true>, 60 - target_id_table: IdTable<TargetKey, TargetId, false>, 79 + did_id_table: IdTable<Did, DidIdValue>, 80 + target_id_table: IdTable<TargetKey, TargetId>, 61 81 is_writer: bool, 62 82 backup_task: Arc<Option<thread::JoinHandle<Result<()>>>>, 63 83 } ··· 85 105 fn cf_descriptor(&self) -> ColumnFamilyDescriptor { 86 106 ColumnFamilyDescriptor::new(&self.name, rocks_opts_base()) 87 107 } 88 - fn init<const WITH_REVERSE: bool>( 89 - self, 90 - db: &DBWithThreadMode<MultiThreaded>, 91 - ) -> Result<IdTable<Orig, IdVal, WITH_REVERSE>> { 108 + fn init(self, db: &DBWithThreadMode<MultiThreaded>) -> Result<IdTable<Orig, IdVal>> { 92 109 if db.cf_handle(&self.name).is_none() { 93 110 bail!("failed to get cf handle from db -- was the db open with our .cf_descriptor()?"); 94 111 } ··· 119 136 } 120 137 } 121 138 #[derive(Debug, Clone)] 122 - struct IdTable<Orig, IdVal: IdTableValue, const WITH_REVERSE: bool> 139 + struct IdTable<Orig, IdVal: IdTableValue> 123 140 where 124 141 Orig: KeyFromRocks, 125 142 for<'a> &'a Orig: AsRocksKey, ··· 127 144 base: IdTableBase<Orig, IdVal>, 128 145 priv_id_seq: u64, 129 146 } 130 - impl<Orig: Clone, IdVal: IdTableValue, const WITH_REVERSE: bool> IdTable<Orig, IdVal, WITH_REVERSE> 147 + impl<Orig: Clone, IdVal: IdTableValue> IdTable<Orig, IdVal> 131 148 where 132 149 Orig: KeyFromRocks, 133 150 for<'v> &'v IdVal: AsRocksValue, ··· 139 156 _key_marker: PhantomData, 140 157 _val_marker: PhantomData, 141 158 name: name.into(), 142 - id_seq: Arc::new(AtomicU64::new(0)), // zero is "uninint", first seq num will be 1 159 + id_seq: Arc::new(AtomicU64::new(0)), // zero is "uninit", first seq num will be 1 143 160 } 144 161 } 145 162 fn get_id_val( ··· 178 195 id_value 179 196 })) 180 197 } 198 + 181 199 fn estimate_count(&self) -> u64 { 182 200 self.base.id_seq.load(Ordering::SeqCst) - 1 // -1 because seq zero is reserved 183 201 } 184 - } 185 - impl<Orig: Clone, IdVal: IdTableValue> IdTable<Orig, IdVal, true> 186 - where 187 - Orig: KeyFromRocks, 188 - for<'v> &'v IdVal: AsRocksValue, 189 - for<'k> &'k Orig: AsRocksKey, 190 - { 202 + 191 203 fn get_or_create_id_val( 192 204 &mut self, 193 205 db: &DBWithThreadMode<MultiThreaded>, ··· 215 227 } 216 228 } 217 229 } 218 - impl<Orig: Clone, IdVal: IdTableValue> IdTable<Orig, IdVal, false> 219 - where 220 - Orig: KeyFromRocks, 221 - for<'v> &'v IdVal: AsRocksValue, 222 - for<'k> &'k Orig: AsRocksKey, 223 - { 224 - fn get_or_create_id_val( 225 - &mut self, 226 - db: &DBWithThreadMode<MultiThreaded>, 227 - batch: &mut WriteBatch, 228 - orig: &Orig, 229 - ) -> Result<IdVal> { 230 - let cf = db.cf_handle(&self.base.name).unwrap(); 231 - self.__get_or_create_id_val(&cf, db, batch, orig) 232 - } 233 - } 234 230 235 231 impl IdTableValue for DidIdValue { 236 232 fn new(v: u64) -> Self { ··· 249 245 } 250 246 } 251 247 248 + fn now() -> u64 { 249 + SystemTime::now() 250 + .duration_since(UNIX_EPOCH) 251 + .unwrap() 252 + .as_micros() as u64 253 + } 254 + 252 255 impl RocksStorage { 253 256 pub fn new(path: impl AsRef<Path>) -> Result<Self> { 254 257 Self::describe_metrics(); 255 - RocksStorage::open_readmode(path, false) 258 + let me = RocksStorage::open_readmode(path, false)?; 259 + me.global_init()?; 260 + Ok(me) 256 261 } 257 262 258 263 pub fn open_readonly(path: impl AsRef<Path>) -> Result<Self> { ··· 260 265 } 261 266 262 267 fn open_readmode(path: impl AsRef<Path>, readonly: bool) -> Result<Self> { 263 - let did_id_table = IdTable::<_, _, true>::setup(DID_IDS_CF); 264 - let target_id_table = IdTable::<_, _, false>::setup(TARGET_IDS_CF); 268 + let did_id_table = IdTable::setup(DID_IDS_CF); 269 + let target_id_table = IdTable::setup(TARGET_IDS_CF); 265 270 271 + // note: global stuff like jetstream cursor goes in the default cf 272 + // these are bonus extra cfs 266 273 let cfs = vec![ 267 274 // id reference tables 268 275 did_id_table.cf_descriptor(), ··· 296 303 is_writer: !readonly, 297 304 backup_task: None.into(), 298 305 }) 306 + } 307 + 308 + fn global_init(&self) -> Result<()> { 309 + let first_run = self.db.get(JETSTREAM_CURSOR_KEY)?.is_some(); 310 + if first_run { 311 + self.db.put(STARTED_AT_KEY, _rv(now()))?; 312 + 313 + // hack / temporary: if we're a new db, put in a completed repair 314 + // state so we don't run repairs (repairs are for old-code dbs) 315 + let completed = TargetIdRepairState { 316 + id_when_started: 0, 317 + current_us_started_at: 0, 318 + latest_repaired_i: 0, 319 + }; 320 + self.db.put(TARGET_ID_REPAIR_STATE_KEY, _rv(completed))?; 321 + } 322 + Ok(()) 323 + } 324 + 325 + pub fn run_repair(&self, breather: Duration, stay_alive: CancellationToken) -> Result<bool> { 326 + let mut state = match self 327 + .db 328 + .get(TARGET_ID_REPAIR_STATE_KEY)? 329 + .map(|s| _vr(&s)) 330 + .transpose()? 331 + { 332 + Some(s) => s, 333 + None => TargetIdRepairState { 334 + id_when_started: self.did_id_table.priv_id_seq, 335 + current_us_started_at: now(), 336 + latest_repaired_i: 0, 337 + }, 338 + }; 339 + 340 + eprintln!("initial repair state: {state:?}"); 341 + 342 + let cf = self.db.cf_handle(TARGET_IDS_CF).unwrap(); 343 + 344 + let mut iter = self.db.raw_iterator_cf(&cf); 345 + iter.seek_to_first(); 346 + 347 + eprintln!("repair iterator sent to first key"); 348 + 349 + // skip ahead if we're done some, or take a single first step 350 + for _ in 0..state.latest_repaired_i { 351 + iter.next(); 352 + } 353 + 354 + eprintln!( 355 + "repair iterator skipped to {}th key", 356 + state.latest_repaired_i 357 + ); 358 + 359 + let mut maybe_done = false; 360 + 361 + let mut write_fast = rocksdb::WriteOptions::default(); 362 + write_fast.set_sync(false); 363 + write_fast.disable_wal(true); 364 + 365 + while !stay_alive.is_cancelled() && !maybe_done { 366 + // let mut batch = WriteBatch::default(); 367 + 368 + let mut any_written = false; 369 + 370 + for _ in 0..1000 { 371 + if state.latest_repaired_i % 1_000_000 == 0 { 372 + eprintln!("target iter at {}", state.latest_repaired_i); 373 + } 374 + state.latest_repaired_i += 1; 375 + 376 + if !iter.valid() { 377 + eprintln!("invalid iter, are we done repairing?"); 378 + maybe_done = true; 379 + break; 380 + }; 381 + 382 + // eprintln!("iterator seems to be valid! getting the key..."); 383 + let raw_key = iter.key().unwrap(); 384 + if raw_key.len() == 8 { 385 + // eprintln!("found an 8-byte key, skipping it since it's probably an id..."); 386 + iter.next(); 387 + continue; 388 + } 389 + let target: TargetKey = _kr::<TargetKey>(raw_key)?; 390 + let target_id: TargetId = _vr(iter.value().unwrap())?; 391 + 392 + self.db 393 + .put_cf_opt(&cf, target_id.id().to_be_bytes(), _rv(&target), &write_fast)?; 394 + any_written = true; 395 + iter.next(); 396 + } 397 + 398 + if any_written { 399 + self.db 400 + .put(TARGET_ID_REPAIR_STATE_KEY, _rv(state.clone()))?; 401 + std::thread::sleep(breather); 402 + } 403 + } 404 + 405 + eprintln!("repair iterator done."); 406 + 407 + Ok(false) 299 408 } 300 409 301 410 pub fn start_backup( ··· 826 935 } 827 936 828 937 impl LinkReader for RocksStorage { 938 + fn get_many_to_many_counts( 939 + &self, 940 + target: &str, 941 + collection: &str, 942 + path: &str, 943 + path_to_other: &str, 944 + limit: u64, 945 + after: Option<String>, 946 + filter_dids: &HashSet<Did>, 947 + filter_to_targets: &HashSet<String>, 948 + ) -> Result<PagedOrderedCollection<(String, u64, u64), String>> { 949 + let collection = Collection(collection.to_string()); 950 + let path = RPath(path.to_string()); 951 + 952 + let target_key = TargetKey(Target(target.to_string()), collection.clone(), path.clone()); 953 + 954 + // unfortunately the cursor is a, uh, stringified number. 955 + // this was easier for the memstore (plain target, not target id), and 956 + // making it generic is a bit awful. 957 + // so... parse the number out of a string here :( 958 + // TODO: this should bubble up to a BAD_REQUEST response 959 + let after = after.map(|s| s.parse::<u64>().map(TargetId)).transpose()?; 960 + 961 + let Some(target_id) = self.target_id_table.get_id_val(&self.db, &target_key)? else { 962 + eprintln!("nothin doin for this target, {target_key:?}"); 963 + return Ok(Default::default()); 964 + }; 965 + 966 + let filter_did_ids: HashMap<DidId, bool> = filter_dids 967 + .iter() 968 + .filter_map(|did| self.did_id_table.get_id_val(&self.db, did).transpose()) 969 + .collect::<Result<Vec<DidIdValue>>>()? 970 + .into_iter() 971 + .map(|DidIdValue(id, active)| (id, active)) 972 + .collect(); 973 + 974 + // stored targets are keyed by triples of (target, collection, path). 975 + // target filtering only consideres the target itself, so we actually 976 + // need to do a prefix iteration of all target ids for this target and 977 + // keep them all. 978 + // i *think* the number of keys at a target prefix should usually be 979 + // pretty small, so this is hopefully fine. but if it turns out to be 980 + // large, we can push this filtering back into the main links loop and 981 + // do forward db queries per backlink to get the raw target back out. 982 + let mut filter_to_target_ids: HashSet<TargetId> = HashSet::new(); 983 + for t in filter_to_targets { 984 + for (_, target_id) in self.iter_targets_for_target(&Target(t.to_string())) { 985 + filter_to_target_ids.insert(target_id); 986 + } 987 + } 988 + 989 + let linkers = self.get_target_linkers(&target_id)?; 990 + 991 + let mut grouped_counts: BTreeMap<TargetId, (u64, HashSet<DidId>)> = BTreeMap::new(); 992 + 993 + for (did_id, rkey) in linkers.0 { 994 + if did_id.is_empty() { 995 + continue; 996 + } 997 + 998 + if !filter_did_ids.is_empty() && filter_did_ids.get(&did_id) != Some(&true) { 999 + continue; 1000 + } 1001 + 1002 + let record_link_key = RecordLinkKey(did_id, collection.clone(), rkey); 1003 + let Some(targets) = self.get_record_link_targets(&record_link_key)? else { 1004 + continue; 1005 + }; 1006 + 1007 + let Some(fwd_target) = targets 1008 + .0 1009 + .into_iter() 1010 + .filter_map(|RecordLinkTarget(rpath, target_id)| { 1011 + if rpath.0 == path_to_other 1012 + && (filter_to_target_ids.is_empty() 1013 + || filter_to_target_ids.contains(&target_id)) 1014 + { 1015 + Some(target_id) 1016 + } else { 1017 + None 1018 + } 1019 + }) 1020 + .take(1) 1021 + .next() 1022 + else { 1023 + eprintln!("no forward match"); 1024 + continue; 1025 + }; 1026 + 1027 + // small relief: we page over target ids, so we can already bail 1028 + // reprocessing previous pages here 1029 + if after.as_ref().map(|a| fwd_target <= *a).unwrap_or(false) { 1030 + continue; 1031 + } 1032 + 1033 + // aand we can skip target ids that must be on future pages 1034 + // (this check continues after the did-lookup, which we have to do) 1035 + let page_is_full = grouped_counts.len() as u64 >= limit; 1036 + if page_is_full { 1037 + let current_max = grouped_counts.keys().next_back().unwrap(); // limit should be non-zero bleh 1038 + if fwd_target > *current_max { 1039 + continue; 1040 + } 1041 + } 1042 + 1043 + // bit painful: 2-step lookup to make sure this did is active 1044 + let Some(did) = self.did_id_table.get_val_from_id(&self.db, did_id.0)? else { 1045 + eprintln!("failed to look up did from did_id {did_id:?}"); 1046 + continue; 1047 + }; 1048 + let Some(DidIdValue(_, active)) = self.did_id_table.get_id_val(&self.db, &did)? else { 1049 + eprintln!("failed to look up did_value from did_id {did_id:?}: {did:?}: data consistency bug?"); 1050 + continue; 1051 + }; 1052 + if !active { 1053 + continue; 1054 + } 1055 + 1056 + // page-management, continued 1057 + // if we have a full page, and we're inserting a *new* key less than 1058 + // the current max, then we can evict the current max 1059 + let mut should_evict = false; 1060 + let entry = grouped_counts.entry(fwd_target.clone()).or_insert_with(|| { 1061 + // this is a *new* key, so kick the max if we're full 1062 + should_evict = page_is_full; 1063 + Default::default() 1064 + }); 1065 + entry.0 += 1; 1066 + entry.1.insert(did_id); 1067 + 1068 + if should_evict { 1069 + grouped_counts.pop_last(); 1070 + } 1071 + } 1072 + 1073 + let mut items: Vec<(String, u64, u64)> = Vec::with_capacity(grouped_counts.len()); 1074 + for (target_id, (n, dids)) in &grouped_counts { 1075 + let Some(target) = self 1076 + .target_id_table 1077 + .get_val_from_id(&self.db, target_id.0)? 1078 + else { 1079 + eprintln!("failed to look up target from target_id {target_id:?}"); 1080 + continue; 1081 + }; 1082 + items.push((target.0 .0, *n, dids.len() as u64)); 1083 + } 1084 + 1085 + let next = if grouped_counts.len() as u64 >= limit { 1086 + // yeah.... it's a number saved as a string......sorry 1087 + grouped_counts 1088 + .keys() 1089 + .next_back() 1090 + .map(|k| format!("{}", k.0)) 1091 + } else { 1092 + None 1093 + }; 1094 + 1095 + Ok(PagedOrderedCollection { items, next }) 1096 + } 1097 + 829 1098 fn get_count(&self, target: &str, collection: &str, path: &str) -> Result<u64> { 830 1099 let target_key = TargetKey( 831 1100 Target(target.to_string()), ··· 1042 1311 .map(|s| s.parse::<u64>()) 1043 1312 .transpose()? 1044 1313 .unwrap_or(0); 1314 + let started_at = self 1315 + .db 1316 + .get(STARTED_AT_KEY)? 1317 + .map(|c| _vr(&c)) 1318 + .transpose()? 1319 + .unwrap_or(COZY_FIRST_CURSOR); 1320 + 1321 + let other_data = self 1322 + .db 1323 + .get(TARGET_ID_REPAIR_STATE_KEY)? 1324 + .map(|s| _vr(&s)) 1325 + .transpose()? 1326 + .map( 1327 + |TargetIdRepairState { 1328 + current_us_started_at, 1329 + id_when_started, 1330 + latest_repaired_i, 1331 + }| { 1332 + HashMap::from([ 1333 + ("current_us_started_at".to_string(), current_us_started_at), 1334 + ("id_when_started".to_string(), id_when_started), 1335 + ("latest_repaired_i".to_string(), latest_repaired_i), 1336 + ]) 1337 + }, 1338 + ) 1339 + .unwrap_or(HashMap::default()); 1340 + 1045 1341 Ok(StorageStats { 1046 1342 dids, 1047 1343 targetables, 1048 1344 linking_records, 1345 + started_at: Some(started_at), 1346 + other_data, 1049 1347 }) 1050 1348 } 1051 1349 } ··· 1071 1369 impl AsRocksValue for &TargetId {} 1072 1370 impl KeyFromRocks for TargetKey {} 1073 1371 impl ValueFromRocks for TargetId {} 1372 + 1373 + // temp? 1374 + impl KeyFromRocks for TargetId {} 1375 + impl AsRocksValue for &TargetKey {} 1074 1376 1075 1377 // target_links table 1076 1378 impl AsRocksKey for &TargetId {} ··· 1142 1444 } 1143 1445 1144 1446 // target ids 1145 - #[derive(Debug, Clone, Serialize, Deserialize)] 1447 + #[derive(Debug, Clone, Serialize, Deserialize, PartialOrd, Ord, PartialEq, Eq, Hash)] 1146 1448 struct TargetId(u64); // key 1147 1449 1148 - #[derive(Debug, Clone, Serialize, Deserialize)] 1450 + #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, Hash)] 1149 1451 pub struct Target(pub String); // the actual target/uri 1150 1452 1151 1453 // targets (uris, dids, etc.): the reverse index
+1 -1
constellation/templates/dids.html.j2
··· 27 27 {% for did in linking_dids %} 28 28 <pre style="display: block; margin: 1em 2em" class="code"><strong>DID</strong>: {{ did.0 }} 29 29 -> see <a href="/links/all?target={{ did.0|urlencode }}">links to this DID</a> 30 - -> browse <a href="https://atproto-browser-plus-links.vercel.app/at/{{ did.0|urlencode }}">this DID record</a></pre> 30 + -> browse <a href="https://pdsls.dev/at://{{ did.0|urlencode }}">this DID record</a></pre> 31 31 {% endfor %} 32 32 33 33 {% if let Some(c) = cursor %}
+54
constellation/templates/get-backlinks.html.j2
··· 1 + {% extends "base.html.j2" %} 2 + {% import "try-it-macros.html.j2" as try_it %} 3 + 4 + {% block title %}Backlinks{% endblock %} 5 + {% block description %}All {{ query.source }} records with links to {{ query.subject }}{% endblock %} 6 + 7 + {% block content %} 8 + 9 + {% call try_it::get_backlinks(query.subject, query.source, query.did, query.limit) %} 10 + 11 + <h2> 12 + Links to <code>{{ query.subject }}</code> 13 + {% if let Some(browseable_uri) = query.subject|to_browseable %} 14 + <small style="font-weight: normal; font-size: 1rem"><a href="{{ browseable_uri }}">browse record</a></small> 15 + {% endif %} 16 + </h2> 17 + 18 + <p><strong>{{ total|human_number }} links</strong> from <code>{{ query.source }}</code>.</p> 19 + 20 + <ul> 21 + <li>See distinct linking DIDs at <code>/links/distinct-dids</code>: <a href="/links/distinct-dids?target={{ query.subject|urlencode }}&collection={{ collection|urlencode }}&path={{ path|urlencode }}">/links/distinct-dids?target={{ query.subject }}&collection={{ collection }}&path={{ path }}</a></li> 22 + <li>See all links to this target at <code>/links/all</code>: <a href="/links/all?target={{ query.subject|urlencode }}">/links/all?target={{ query.subject }}</a></li> 23 + </ul> 24 + 25 + <h3>Links, most recent first:</h3> 26 + 27 + {% for record in records %} 28 + <pre style="display: block; margin: 1em 2em" class="code"><strong>DID</strong>: {{ record.did().0 }} (<a href="/links/all?target={{ record.did().0|urlencode }}">DID links</a>) 29 + <strong>Collection</strong>: {{ record.collection }} 30 + <strong>RKey</strong>: {{ record.rkey }} 31 + -> <a href="https://pdsls.dev/at://{{ record.did().0 }}/{{ record.collection }}/{{ record.rkey }}">browse record</a></pre> 32 + {% endfor %} 33 + 34 + {% if let Some(c) = cursor %} 35 + <form method="get" action="/xrpc/blue.microcosm.links.getBacklinks"> 36 + <input type="hidden" name="subject" value="{{ query.subject }}" /> 37 + <input type="hidden" name="source" value="{{ query.source }}" /> 38 + <input type="hidden" name="limit" value="{{ query.limit }}" /> 39 + {% for did in query.did %} 40 + <input type="hidden" name="did" value="{{ did }}" /> 41 + {% endfor %} 42 + <input type="hidden" name="cursor" value={{ c|json|safe }} /> 43 + <button type="submit">next page&hellip;</button> 44 + </form> 45 + {% else %} 46 + <button disabled><em>end of results</em></button> 47 + {% endif %} 48 + 49 + <details> 50 + <summary>Raw JSON response</summary> 51 + <pre class="code">{{ self|tojson }}</pre> 52 + </details> 53 + 54 + {% endblock %}
+67
constellation/templates/get-many-to-many-counts.html.j2
··· 1 + {% extends "base.html.j2" %} 2 + {% import "try-it-macros.html.j2" as try_it %} 3 + 4 + {% block title %}Many to Many counts{% endblock %} 5 + {% block description %}Counts of many-to-many {{ query.source }} join records with links to {{ query.subject }} and a secondary target at {{ query.path_to_other }}{% endblock %} 6 + 7 + {% block content %} 8 + 9 + {% call try_it::get_many_to_many_counts( 10 + query.subject, 11 + query.source, 12 + query.path_to_other, 13 + query.did, 14 + query.other_subject, 15 + query.limit, 16 + ) %} 17 + 18 + <h2> 19 + Many-to-many links to <code>{{ query.subject }}</code> joining through <code>{{ query.path_to_other }}</code> 20 + {% if let Some(browseable_uri) = query.subject|to_browseable %} 21 + <small style="font-weight: normal; font-size: 1rem"><a href="{{ browseable_uri }}">browse record</a></small> 22 + {% endif %} 23 + </h2> 24 + 25 + <p><strong>{% if cursor.is_some() || query.cursor.is_some() %}more than {% endif %}{{ counts_by_other_subject.len()|to_u64|human_number }} joins</strong> <code>{{ query.source }}→{{ query.path_to_other }}</code></p> 26 + 27 + <ul> 28 + <li>See direct backlinks at <code>/xrpc/blue.microcosm.links.getBacklinks</code>: <a href="/xrpc/blue.microcosm.links.getBacklinks?subject={{ query.subject|urlencode }}&source={{ query.source|urlencode }}">/xrpc/blue.microcosm.links.getBacklinks?subject={{ query.subject }}&source={{ query.source }}</a></li> 29 + <li>See all links to this target at <code>/links/all</code>: <a href="/links/all?target={{ query.subject|urlencode }}">/links/all?target={{ query.subject }}</a></li> 30 + </ul> 31 + 32 + <h3>Counts by other subject:</h3> 33 + 34 + {% for counts in counts_by_other_subject %} 35 + <pre style="display: block; margin: 1em 2em" class="code"><strong>Joined subject</strong>: {{ counts.subject }} 36 + <strong>Joining records</strong>: {{ counts.total }} 37 + <strong>Unique joiner ids</strong>: {{ counts.distinct }} 38 + -> {% if let Some(browseable_uri) = counts.subject|to_browseable -%} 39 + <a href="{{ browseable_uri }}">browse record</a> 40 + {%- endif %}</pre> 41 + {% endfor %} 42 + 43 + {% if let Some(c) = cursor %} 44 + <form method="get" action="/xrpc/blue.microcosm.links.getManyToManyCounts"> 45 + <input type="hidden" name="subject" value="{{ query.subject }}" /> 46 + <input type="hidden" name="source" value="{{ query.source }}" /> 47 + <input type="hidden" name="pathToOther" value="{{ query.path_to_other }}" /> 48 + {% for did in query.did %} 49 + <input type="hidden" name="did" value="{{ did }}" /> 50 + {% endfor %} 51 + {% for otherSubject in query.other_subject %} 52 + <input type="hidden" name="otherSubject" value="{{ otherSubject }}" /> 53 + {% endfor %} 54 + <input type="hidden" name="limit" value="{{ query.limit }}" /> 55 + <input type="hidden" name="cursor" value={{ c|json|safe }} /> 56 + <button type="submit">next page&hellip;</button> 57 + </form> 58 + {% else %} 59 + <button disabled><em>end of results</em></button> 60 + {% endif %} 61 + 62 + <details> 63 + <summary>Raw JSON response</summary> 64 + <pre class="code">{{ self|tojson }}</pre> 65 + </details> 66 + 67 + {% endblock %}
+65 -7
constellation/templates/hello.html.j2
··· 19 19 <p>It works by recursively walking <em>all</em> records coming through the firehose, searching for anything that looks like a link. Links are indexed by the target they point at, the collection the record came from, and the JSON path to the link in that record.</p> 20 20 21 21 <p> 22 - This server has indexed <span class="stat">{{ stats.linking_records|human_number }}</span> links between <span class="stat">{{ stats.targetables|human_number }}</span> targets and sources from <span class="stat">{{ stats.dids|human_number }}</span> identities over <span class="stat">{{ days_indexed|human_number }}</span> days.<br/> 23 - <small>(indexing new records in real time, backfill still TODO)</small> 22 + This server has indexed <span class="stat">{{ stats.linking_records|human_number }}</span> links between <span class="stat">{{ stats.targetables|human_number }}</span> targets and sources from <span class="stat">{{ stats.dids|human_number }}</span> identities over <span class="stat"> 23 + {%- if let Some(days) = days_indexed %} 24 + {{ days|human_number }} 25 + {% else %} 26 + ??? 27 + {% endif -%} 28 + </span> days.<br/> 29 + <small>(indexing new records in real time, backfill coming soon!)</small> 24 30 </p> 25 31 26 - <p>The API is currently <strong>unstable</strong>. But feel free to use it! If you want to be nice, put your project name and bsky username (or email) in your user-agent header for api requests.</p> 32 + {# {% for k, v in stats.other_data.iter() %} 33 + <p><strong>{{ k }}</strong>: {{ v }}</p> 34 + {% endfor %} #} 35 + 36 + <p>You're welcome to use this public instance! Please do not build the torment nexus. If you want to be nice, put your project name and bsky username (or email) in your user-agent header for api requests.</p> 27 37 28 38 29 39 <h2>API Endpoints</h2> 30 40 41 + <h3 class="route"><code>GET /xrpc/blue.microcosm.links.getBacklinks</code></h3> 42 + 43 + <p>A list of records linking to any record, identity, or uri.</p> 44 + 45 + <h4>Query parameters:</h4> 46 + 47 + <ul> 48 + <li><p><code>subject</code>: required, must url-encode. Example: <code>at://did:plc:vc7f4oafdgxsihk4cry2xpze/app.bsky.feed.post/3lgwdn7vd722r</code></p></li> 49 + <li><p><code>source</code>: required. Example: <code>app.bsky.feed.like:subject.uri</code></p></li> 50 + <li><p><code>did</code>: optional, filter links to those from specific users. Include multiple times to filter by multiple users. Example: <code>did=did:plc:vc7f4oafdgxsihk4cry2xpze&did=did:plc:vc7f4oafdgxsihk4cry2xpze</code></p></li> 51 + <li><p><code>limit</code>: optional. Default: <code>16</code>. Maximum: <code>100</code></p></li> 52 + </ul> 53 + 54 + <p style="margin-bottom: 0"><strong>Try it:</strong></p> 55 + {% call try_it::get_backlinks("at://did:plc:a4pqq234yw7fqbddawjo7y35/app.bsky.feed.post/3m237ilwc372e", "app.bsky.feed.like:subject.uri", [""], 16) %} 56 + 57 + 58 + <h3 class="route"><code>GET /xrpc/blue.microcosm.links.getManyToManyCounts</code></h3> 59 + 60 + <p>TODO: description</p> 61 + 62 + <h4>Query parameters:</h4> 63 + 64 + <ul> 65 + <li><p><code>subject</code>: required, must url-encode. Example: <code>at://did:plc:vc7f4oafdgxsihk4cry2xpze/app.bsky.feed.post/3lgwdn7vd722r</code></p></li> 66 + <li><p><code>source</code>: required. Example: <code>app.bsky.feed.like:subject.uri</code></p></li> 67 + <li><p><code>pathToOther</code>: required. Path to the secondary link in the many-to-many record. Example: <code>otherThing.uri</code></p></li> 68 + <li><p><code>did</code>: optional, filter links to those from specific users. Include multiple times to filter by multiple users. Example: <code>did=did:plc:vc7f4oafdgxsihk4cry2xpze&did=did:plc:vc7f4oafdgxsihk4cry2xpze</code></p></li> 69 + <li><p><code>otherSubject</code>: optional, filter secondary links to specific subjects. Include multiple times to filter by multiple users. Example: <code>at://did:plc:vc7f4oafdgxsihk4cry2xpze/app.bsky.feed.post/3lgwdn7vd722r</code></p></li> 70 + <li><p><code>limit</code>: optional. Default: <code>16</code>. Maximum: <code>100</code></p></li> 71 + </ul> 72 + 73 + <p style="margin-bottom: 0"><strong>Try it:</strong></p> 74 + {% call try_it::get_many_to_many_counts( 75 + "at://did:plc:wshs7t2adsemcrrd4snkeqli/sh.tangled.label.definition/good-first-issue", 76 + "sh.tangled.label.op:add[].key", 77 + "subject", 78 + [""], 79 + [""], 80 + 25, 81 + ) %} 82 + 83 + 31 84 <h3 class="route"><code>GET /links</code></h3> 32 85 33 86 <p>A list of records linking to a target.</p> 34 87 88 + <p>[DEPRECATED]: use <code>GET /xrpc/blue.microcosm.links.getBacklinks</code>. New apps should avoid it, but this endpoint <strong>will</strong> remain supported for the forseeable future.</p> 89 + 35 90 <h4>Query parameters:</h4> 36 91 37 92 <ul> 38 - <li><code>target</code>: required, must url-encode. Example: <code>at://did:plc:vc7f4oafdgxsihk4cry2xpze/app.bsky.feed.post/3lgwdn7vd722r</code></li> 39 - <li><code>collection</code>: required. Example: <code>app.bsky.feed.like</code></li> 40 - <li><code>path</code>: required, must url-encode. Example: <code>.subject.uri</code></li> 93 + <li><p><code>target</code>: required, must url-encode. Example: <code>at://did:plc:vc7f4oafdgxsihk4cry2xpze/app.bsky.feed.post/3lgwdn7vd722r</code></p></li> 94 + <li><p><code>collection</code>: required. Example: <code>app.bsky.feed.like</code></p></li> 95 + <li><p><code>path</code>: required, must url-encode. Example: <code>.subject.uri</code></p></li> 96 + <li><p><code>did</code>: optional, filter links to those from specific users. Include multiple times to filter by multiple users. Example: <code>did=did:plc:vc7f4oafdgxsihk4cry2xpze&did=did:plc:vc7f4oafdgxsihk4cry2xpze</code></p></li> 97 + <li><p><code>from_dids</code> [deprecated]: optional. Use <code>did</code> instead. Example: <code>from_dids=did:plc:vc7f4oafdgxsihk4cry2xpze,did:plc:vc7f4oafdgxsihk4cry2xpze</code></p></li> 98 + <li><p><code>limit</code>: optional. Default: <code>16</code>. Maximum: <code>100</code></p></li> 41 99 </ul> 42 100 43 101 <p style="margin-bottom: 0"><strong>Try it:</strong></p> 44 - {% call try_it::links("at://did:plc:vc7f4oafdgxsihk4cry2xpze/app.bsky.feed.post/3lgwdn7vd722r", "app.bsky.feed.like", ".subject.uri") %} 102 + {% call try_it::links("at://did:plc:a4pqq234yw7fqbddawjo7y35/app.bsky.feed.post/3m237ilwc372e", "app.bsky.feed.like", ".subject.uri", [""], 16) %} 45 103 46 104 47 105 <h3 class="route"><code>GET /links/distinct-dids</code></h3>
+2 -2
constellation/templates/links.html.j2
··· 6 6 7 7 {% block content %} 8 8 9 - {% call try_it::links(query.target, query.collection, query.path) %} 9 + {% call try_it::links(query.target, query.collection, query.path, query.did, query.limit) %} 10 10 11 11 <h2> 12 12 Links to <code>{{ query.target }}</code> ··· 28 28 <pre style="display: block; margin: 1em 2em" class="code"><strong>DID</strong>: {{ record.did().0 }} (<a href="/links/all?target={{ record.did().0|urlencode }}">DID links</a>) 29 29 <strong>Collection</strong>: {{ record.collection }} 30 30 <strong>RKey</strong>: {{ record.rkey }} 31 - -> <a href="https://atproto-browser-plus-links.vercel.app/at/{{ record.did().0|urlencode }}/{{ record.collection }}/{{ record.rkey }}">browse record</a></pre> 31 + -> <a href="https://pdsls.dev/at://{{ record.did().0 }}/{{ record.collection }}/{{ record.rkey }}">browse record</a></pre> 32 32 {% endfor %} 33 33 34 34 {% if let Some(c) = cursor %}
+88 -3
constellation/templates/try-it-macros.html.j2
··· 1 - {% macro links(target, collection, path) %} 1 + {% macro get_backlinks(subject, source, dids, limit) %} 2 + <form method="get" action="/xrpc/blue.microcosm.links.getBacklinks"> 3 + <pre class="code"><strong>GET</strong> /xrpc/blue.microcosm.links.getBacklinks 4 + ?subject= <input type="text" name="subject" value="{{ subject }}" placeholder="at-uri, did, uri..." /> 5 + &source= <input type="text" name="source" value="{{ source }}" placeholder="app.bsky.feed.like:subject.uri" /> 6 + {%- for did in dids %}{% if !did.is_empty() %} 7 + &did= <input type="text" name="did" value="{{ did }}" placeholder="did:plc:..." />{% endif %}{% endfor %} 8 + <span id="did-placeholder"></span> <button id="add-did">+ did filter</button> 9 + &limit= <input type="number" name="limit" value="{{ limit }}" max="100" placeholder="100" /> <button type="submit">get links</button></pre> 10 + </form> 11 + <script> 12 + const addDidButton = document.getElementById('add-did'); 13 + const didPlaceholder = document.getElementById('did-placeholder'); 14 + addDidButton.addEventListener('click', e => { 15 + e.preventDefault(); 16 + const i = document.createElement('input'); 17 + i.placeholder = 'did:plc:...'; 18 + i.name = "did" 19 + const p = addDidButton.parentNode; 20 + p.insertBefore(document.createTextNode('&did= '), didPlaceholder); 21 + p.insertBefore(i, didPlaceholder); 22 + p.insertBefore(document.createTextNode('\n '), didPlaceholder); 23 + }); 24 + </script> 25 + {% endmacro %} 26 + 27 + {% macro get_many_to_many_counts(subject, source, pathToOther, dids, otherSubjects, limit) %} 28 + <form method="get" action="/xrpc/blue.microcosm.links.getManyToManyCounts"> 29 + <pre class="code"><strong>GET</strong> /xrpc/blue.microcosm.links.getManyToManyCounts 30 + ?subject= <input type="text" name="subject" value="{{ subject }}" placeholder="at-uri, did, uri..." /> 31 + &source= <input type="text" name="source" value="{{ source }}" placeholder="app.bsky.feed.like:subject.uri" /> 32 + &pathToOther= <input type="text" name="pathToOther" value="{{ pathToOther }}" placeholder="otherThing.uri" /> 33 + {%- for did in dids %}{% if !did.is_empty() %} 34 + &did= <input type="text" name="did" value="{{ did }}" placeholder="did:plc:..." />{% endif %}{% endfor %} 35 + <span id="m2m-subject-placeholder"></span> <button id="m2m-add-subject">+ other subject filter</button> 36 + {%- for otherSubject in otherSubjects %}{% if !otherSubject.is_empty() %} 37 + &otherSubject= <input type="text" name="did" value="{{ otherSubject }}" placeholder="at-uri, did, uri..." />{% endif %}{% endfor %} 38 + <span id="m2m-did-placeholder"></span> <button id="m2m-add-did">+ did filter</button> 39 + &limit= <input type="number" name="limit" value="{{ limit }}" max="100" placeholder="100" /> <button type="submit">get links</button></pre> 40 + </form> 41 + <script> 42 + const m2mAddDidButton = document.getElementById('m2m-add-did'); 43 + const m2mDidPlaceholder = document.getElementById('m2m-did-placeholder'); 44 + m2mAddDidButton.addEventListener('click', e => { 45 + e.preventDefault(); 46 + const i = document.createElement('input'); 47 + i.placeholder = 'did:plc:...'; 48 + i.name = "did" 49 + const p = m2mAddDidButton.parentNode; 50 + p.insertBefore(document.createTextNode('&did= '), m2mDidPlaceholder); 51 + p.insertBefore(i, m2mDidPlaceholder); 52 + p.insertBefore(document.createTextNode('\n '), m2mDidPlaceholder); 53 + }); 54 + const m2mAddSubjectButton = document.getElementById('m2m-add-subject'); 55 + const m2mSubjectPlaceholder = document.getElementById('m2m-subject-placeholder'); 56 + m2mAddSubjectButton.addEventListener('click', e => { 57 + e.preventDefault(); 58 + const i = document.createElement('input'); 59 + i.placeholder = 'at-uri, did, uri...'; 60 + i.name = "otherSubject" 61 + const p = m2mAddSubjectButton.parentNode; 62 + p.insertBefore(document.createTextNode('&otherSubject= '), m2mSubjectPlaceholder); 63 + p.insertBefore(i, m2mSubjectPlaceholder); 64 + p.insertBefore(document.createTextNode('\n '), m2mSubjectPlaceholder); 65 + }); 66 + </script> 67 + {% endmacro %} 68 + 69 + {% macro links(target, collection, path, dids, limit) %} 2 70 <form method="get" action="/links"> 3 71 <pre class="code"><strong>GET</strong> /links 4 72 ?target= <input type="text" name="target" value="{{ target }}" placeholder="target" /> 5 73 &collection= <input type="text" name="collection" value="{{ collection }}" placeholder="collection" /> 6 - &path= <input type="text" name="path" value="{{ path }}" placeholder="path" /> <button type="submit">get links</button></pre> 74 + &path= <input type="text" name="path" value="{{ path }}" placeholder="path" /> 75 + {%- for did in dids %}{% if !did.is_empty() %} 76 + &did= <input type="text" name="did" value="{{ did }}" placeholder="did:plc:..." />{% endif %}{% endfor %} 77 + <span id="did-placeholder"></span> <button id="add-did">+ did filter</button> 78 + &limit= <input type="number" name="limit" value="{{ limit }}" max="100" placeholder="100" /> <button type="submit">get links</button></pre> 7 79 </form> 80 + <script> 81 + const addDidButton = document.getElementById('add-did'); 82 + const didPlaceholder = document.getElementById('did-placeholder'); 83 + addDidButton.addEventListener('click', e => { 84 + e.preventDefault(); 85 + const i = document.createElement('input'); 86 + i.placeholder = 'did:plc:...'; 87 + i.name = "did" 88 + const p = addDidButton.parentNode; 89 + p.insertBefore(document.createTextNode('&did= '), didPlaceholder); 90 + p.insertBefore(i, didPlaceholder); 91 + p.insertBefore(document.createTextNode('\n '), didPlaceholder); 92 + }); 93 + </script> 8 94 {% endmacro %} 9 - 10 95 11 96 {% macro dids(target, collection, path) %} 12 97 <form method="get" action="/links/distinct-dids">
-496
cozy-setup (move to another repo).md
··· 1 - cozy-ucosm 2 - 3 - 4 - ## gateway 5 - 6 - - tailscale (exit node enabled) 7 - -> allow ipv4 and ipv6 forwarding 8 - - caddy 9 - 10 - ```bash 11 - apt install golang 12 - go install github.com/caddyserver/xcaddy/cmd/xcaddy@latest 13 - go/bin/xcaddy build \ 14 - --with github.com/caddyserver/cache-handler \ 15 - --with github.com/darkweak/storages/badger/caddy \ 16 - --with github.com/mholt/caddy-ratelimit 17 - # then https://caddyserver.com/docs/running#manual-installation 18 - 19 - mkdir /var/cache/caddy-badger 20 - chown -R caddy:caddy /var/cache/caddy-badger/ 21 - ``` 22 - 23 - - `/etc/caddy/Caddyfile` 24 - 25 - ``` 26 - { 27 - cache { 28 - badger 29 - api { 30 - prometheus 31 - } 32 - } 33 - } 34 - 35 - links.bsky.bad-example.com { 36 - reverse_proxy link-aggregator:6789 37 - 38 - @browser `{header.Origin.startsWith("Mozilla/5.0")` 39 - rate_limit { 40 - zone global_burst { 41 - key {remote_host} 42 - events 10 43 - window 1s 44 - } 45 - zone global_general { 46 - key {remote_host} 47 - events 100 48 - window 60s 49 - log_key true 50 - } 51 - zone website_harsh_limit { 52 - key {header.Origin} 53 - match { 54 - expression {header.User-Agent}.startsWith("Mozilla/5.0") 55 - } 56 - events 1000 57 - window 30s 58 - log_key true 59 - } 60 - } 61 - respond /souin-api/metrics "denied" 403 # does not work 62 - cache { 63 - ttl 3s 64 - stale 1h 65 - default_cache_control public, s-maxage=3 66 - badger { 67 - path /var/cache/caddy-badger/links 68 - } 69 - } 70 - } 71 - 72 - gateway:80 { 73 - metrics 74 - cache 75 - } 76 - ``` 77 - well... the gateway fell over IMMEDIATELY with like 2 req/sec from deletions, with that ^^ config. for now i removed everything except the reverse proxy config + normal caddy metrics and it's running fine on vanilla caddy. i did try reducing the rate-limiting configs to a single, fixed-key global limit but it still ate all the ram and died. maybe badger w/ the cache config was still a problem. maybe it would have been ok on a machine with more than 1GB mem. 78 - 79 - 80 - alternative proxies: 81 - 82 - - nginx. i should probably just use this. acme-client is a piece of cake to set up, and i know how to configure it. 83 - - haproxy. also kind of familiar, it's old and stable. no idea how it handle low-mem (our 1gb) vs nginx. 84 - - sozu. popular rust thing, fast. doesn't have rate-limiting or cache feature? 85 - - rpxy. like caddy (auto-tls) but in rust and actually fast? has an "experimental" cache feature. but the cache feature looks good. 86 - - rama. build-your-own proxy. not sure that it has both cache and limiter in their standard features? 87 - - pingora. build-your-own cloudflare, so like, probably stable. has tools for cache and limiting. low-mem...? 88 - - cache stuff in pingora seems a little... hit and miss (byeeeee). only a test impl for Storage for the main cache feature? 89 - - but the rate-limiter has a guide: https://github.com/cloudflare/pingora/blob/main/docs/user_guide/rate_limiter.md 90 - 91 - what i want is low-resource reverse proxy with built-in rate-limiting and caching. but maybe cache (and/or ratelimiting) could be external to the reverse proxy 92 - - varnish is a dedicated cache. has https://github.com/varnish/varnish-modules/blob/master/src/vmod_vsthrottle.vcc 93 - - apache traffic control has experimental rate-limiting plugins 94 - 95 - 96 - - victoriametrics 97 - 98 - ```bash 99 - curl -LO https://github.com/VictoriaMetrics/VictoriaMetrics/releases/download/v1.109.1/victoria-metrics-linux-amd64-v1.109.1.tar.gz 100 - tar xzf victoria-metrics-linux-amd64-v1.109.1.tar.gz 101 - # and then https://docs.victoriametrics.com/quick-start/#starting-vm-single-from-a-binary 102 - sudo mkdir /etc/victoria-metrics && sudo chown -R victoriametrics:victoriametrics /etc/victoria-metrics 103 - 104 - ``` 105 - 106 - - `/etc/victoria-metrics/prometheus.yml` 107 - 108 - ```yaml 109 - global: 110 - scrape_interval: '15s' 111 - 112 - scrape_configs: 113 - - job_name: 'link_aggregator' 114 - static_configs: 115 - - targets: ['link-aggregator:8765'] 116 - - job_name: 'gateway:caddy' 117 - static_configs: 118 - - targets: ['gateway:80/metrics'] 119 - - job_name: 'gateway:cache' 120 - static_configs: 121 - - targets: ['gateway:80/souin-api/metrics'] 122 - ``` 123 - 124 - - `ExecStart` in `/etc/systemd/system/victoriametrics.service`: 125 - 126 - ``` 127 - ExecStart=/usr/local/bin/victoria-metrics-prod -storageDataPath=/var/lib/victoria-metrics -retentionPeriod=90d -selfScrapeInterval=1m -promscrape.config=/etc/victoria-metrics/prometheus.yml 128 - ``` 129 - 130 - - grafana 131 - 132 - followed `https://grafana.com/docs/grafana/latest/setup-grafana/installation/debian/#install-grafana-on-debian-or-ubuntu` 133 - 134 - something something something then 135 - 136 - ``` 137 - sudo grafana-cli --pluginUrl https://github.com/VictoriaMetrics/victoriametrics-datasource/releases/download/v0.11.1/victoriametrics-datasource-v0.11.1.zip plugins install victoriametrics 138 - ``` 139 - 140 - - raspi node_exporter 141 - 142 - ```bash 143 - curl -LO https://github.com/prometheus/node_exporter/releases/download/v1.8.2/node_exporter-1.8.2.linux-armv7.tar.gz 144 - tar xzf node_exporter-1.8.2.linux-armv7.tar.gz 145 - sudo cp node_exporter-1.8.2.linux-armv7/node_exporter /usr/local/bin/ 146 - sudo useradd --no-create-home --shell /bin/false node_exporter 147 - sudo nano /etc/systemd/system/node_exporter.service 148 - # [Unit] 149 - # Description=Node Exporter 150 - # Wants=network-online.target 151 - # After=network-online.target 152 - 153 - # [Service] 154 - # User=node_exporter 155 - # Group=node_exporter 156 - # Type=simple 157 - # ExecStart=/usr/local/bin/node_exporter 158 - # Restart=always 159 - # RestartSec=3 160 - 161 - # [Install] 162 - # WantedBy=multi-user.target 163 - sudo systemctl daemon-reload 164 - sudo systemctl enable node_exporter.service 165 - sudo systemctl start node_exporter.service 166 - ``` 167 - 168 - todo: get raspi vcgencmd outputs into metrics 169 - 170 - - nginx on gateway 171 - 172 - ```nginx 173 - # in http 174 - 175 - ## 176 - # cozy cache 177 - ## 178 - proxy_cache_path /var/cache/nginx keys_zone=cozy_zone:10m; 179 - 180 - ## 181 - # cozy limit 182 - ## 183 - limit_req_zone $binary_remote_addr zone=cozy_ip_limit:10m rate=50r/s; 184 - limit_req_zone $server_name zone=cozy_global_limit:10m rate=1000r/s; 185 - 186 - # in sites-available/constellation.microcosm.blue 187 - 188 - upstream cozy_link_aggregator { 189 - server link-aggregator:6789; 190 - keepalive 16; 191 - } 192 - 193 - server { 194 - listen 8080; 195 - listen [::]:8080; 196 - 197 - server_name constellation.microcosm.blue; 198 - 199 - proxy_cache cozy_zone; 200 - proxy_cache_background_update on; 201 - proxy_cache_key "$scheme$proxy_host$uri$is_args$args$http_accept"; 202 - proxy_cache_lock on; # make simlutaneous requests for the same uri wait for it to appear in cache instead of hitting origin 203 - proxy_cache_lock_age 1s; 204 - proxy_cache_lock_timeout 2s; 205 - proxy_cache_valid 10s; # default -- should be explicitly set in the response headers 206 - proxy_cache_valid any 15s; # non-200s default 207 - proxy_read_timeout 5s; 208 - proxy_send_timeout 15s; 209 - proxy_socket_keepalive on; 210 - 211 - limit_req zone=cozy_ip_limit nodelay burst=100; 212 - limit_req zone=cozy_global_limit; 213 - limit_req_status 429; 214 - 215 - location / { 216 - proxy_pass http://cozy_link_aggregator; 217 - include proxy_params; 218 - proxy_http_version 1.1; 219 - proxy_set_header Connection ""; # for keepalive 220 - } 221 - } 222 - ``` 223 - 224 - also `systemctl edit nginx` and paste 225 - 226 - ``` 227 - [Service] 228 - Restart=always 229 - ``` 230 - 231 - —https://serverfault.com/a/1003373 232 - 233 - now making browsers redirect to the microcosm.blue url: 234 - 235 - ``` 236 - [...] 237 - server_name links.bsky.bad-example.com; 238 - 239 - add_header Access-Control-Allow-Origin * always; # bit of hack to have it here but nginx doesn't like it in the `if` 240 - if ($http_user_agent ~ ^Mozilla/) { 241 - # for now send *browsers* to the new location, hopefully without impacting api requests 242 - # (yeah we're doing UA test here and content-negotatiation in the app. whatever.) 243 - return 301 https://constellation.microcosm.blue$request_uri; 244 - } 245 - [...] 246 - ``` 247 - 248 - - nginx metrics 249 - 250 - - download nginx-prometheus-exporter 251 - https://github.com/nginx/nginx-prometheus-exporter/releases/download/v1.4.1/nginx-prometheus-exporter_1.4.1_linux_amd64.tar.gz 252 - 253 - - err actually going to make mistakes and try with snap 254 - `snap install nginx-prometheus-exporter` 255 - - so it got a binary for me but no systemd task set up. boooo. 256 - `snap remove nginx-prometheus-exporter` 257 - 258 - - ```bash 259 - curl -LO https://github.com/nginx/nginx-prometheus-exporter/releases/download/v1.4.1/nginx-prometheus-exporter_1.4.1_linux_amd64.tar.gz 260 - tar xzf nginx-prometheus-exporter_1.4.1_linux_amd64.tar.gz 261 - mv nginx-prometheus-exporter /usr/local/bin 262 - useradd --no-create-home --shell /bin/false nginx-prometheus-exporter 263 - nano /etc/systemd/system/nginx-prometheus-exporter.service 264 - # [Unit] 265 - # Description=NGINX Exporter 266 - # Wants=network-online.target 267 - # After=network-online.target 268 - 269 - # [Service] 270 - # User=nginx-prometheus-exporter 271 - # Group=nginx-prometheus-exporter 272 - # Type=simple 273 - # ExecStart=/usr/local/bin/nginx-prometheus-exporter --nginx.scrape-uri=http://gateway:8080/stub_status --web.listen-address=gateway:9113 274 - # Restart=always 275 - # RestartSec=3 276 - 277 - # [Install] 278 - # WantedBy=multi-user.target 279 - systemctl daemon-reload 280 - systemctl start nginx-prometheus-exporter.service 281 - systemctl enable nginx-prometheus-exporter.service 282 - ``` 283 - 284 - - nginx `/etc/nginx/sites-available/gateway-nginx-status` 285 - 286 - ```nginx 287 - server { 288 - listen 8080; 289 - listen [::]:8080; 290 - 291 - server_name gateway; 292 - 293 - location /stub_status { 294 - stub_status; 295 - } 296 - location / { 297 - return 404; 298 - } 299 - } 300 - ``` 301 - 302 - ```bash 303 - ln -s /etc/nginx/sites-available/gateway-nginx-status /etc/nginx/sites-enabled/ 304 - ``` 305 - 306 - 307 - ## bootes (pi5) 308 - 309 - - mount sd card, touch `ssh` file echo `echo "pi:$(echo raspberry | openssl passwd -6 -stdin)" > userconf.txt` 310 - - raspi-config: enable pcie 3, set hostname, enable ssh 311 - - put ssh key into `.ssh/authorized_keys` 312 - - put `PasswordAuthentication no` in `/etc/ssh/sshd_config` 313 - - `sudo apt update && sudo apt upgrade` 314 - - `sudo apt install xfsprogs` 315 - - `sudo mkfs.xfs -L c11n-kv /dev/nvme0n1` 316 - - `sudo mount /dev/nvme0n1 /mnt` 317 - - set up tailscale 318 - - `sudo tailscale up` 319 - - `git clone https://github.com/atcosm/links.git` 320 - - tailscale: disable bootes key expiry 321 - - rustup `curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh` 322 - - `cd links/constellation` 323 - - `sudo apt install libssl-dev` needed 324 - - `sudo apt install clang` needed for bindgen 325 - - (in tmux) `cargo build --release` 326 - - `mkdir ~/backup` 327 - - `sudo mount.cifs "//truenas.local/folks data" /home/pi/backup -o user=phil,uid=pi` 328 - - `sudo chown pi:pi /mnt/` 329 - - `RUST_BACKTRACE=full cargo run --bin rocks-restore-from-backup --release -- --from-backup-dir "/home/pi/backup/constellation-index" --to-data-dir /mnt/constellation-index` 330 - etc 331 - - follow above `- raspi node_exporter` 332 - - configure victoriametrics to scrape the new pi 333 - - configure ulimit before starting! `ulimit -n 16384` 334 - - `RUST_BACKTRACE=full cargo run --release -- --backend rocks --data /mnt/constellation-index/ --jetstream us-east-2 --backup /home/pi/backup/constellation-index --backup-interval 6 --max-old-backups 20` 335 - - add server to nginx gateway upstream: ` server 100.123.79.12:6789; # bootes` 336 - - stop backups from running on the older instance! `RUST_BACKTRACE=full cargo run --release -- --backend rocks --data /mnt/links-2.rocks/ --jetstream us-east-1` 337 - - stop upstreaming requests to older instance in nginx 338 - 339 - 340 - - systemd unit for running: `sudo nano /etc/systemd/system/constellation.service` 341 - 342 - ```toml 343 - [Unit] 344 - Description=Constellation backlinks index 345 - After=network.target 346 - 347 - [Service] 348 - User=pi 349 - WorkingDirectory=/home/pi/links/constellation 350 - ExecStart=/home/pi/links/target/release/main --backend rocks --data /mnt/constellation-index/ --jetstream us-east-2 --backup /home/pi/backup/constellation-index --backup-interval 6 --max-old-backups 20 351 - LimitNOFILE=16384 352 - Restart=always 353 - 354 - [Install] 355 - WantedBy=multi-user.target 356 - ``` 357 - 358 - 359 - - todo: overlayfs? would need to figure out builds/updates still, also i guess logs are currently written to sd? (oof) 360 - - todo: cross-compile for raspi? 361 - 362 - --- 363 - 364 - some todos 365 - 366 - - [x] tailscale: exit node 367 - - [!] link_aggregator: use exit node 368 - -> worked, but reverted for now: tailscale on raspi was consuming ~50% cpu for the jetstream traffic. this might be near its max since it would have been catching up at the time (max jetstream throughput) but it feels a bit too much. we have to trust the jetstream server and link_aggregator doesn't (yet) make any other external connections, so for now the raspi connects directly from my home again. 369 - - [x] caddy: reverse proxy 370 - - [x] build with cache and rate-limit plugins 371 - - [x] configure systemd to keep it alive 372 - - [x] configure caddy cache 373 - - [x] configure caddy rate-limit 374 - - [ ] configure ~caddy~ nginx to use a health check (once it's added) 375 - - [ ] ~configure caddy to only expose cache metrics to tailnet :/~ 376 - - [x] make some grafana dashboards 377 - - [ ] raspi: mount /dev/sda on boot 378 - - [ ] raspi: run link_aggregator via systemd so it starts on startup (and restarts?) 379 - 380 - - [x] use nginx instead of caddy 381 - - [x] nginx: enable cache 382 - - [x] nginx: rate-limit 383 - - [ ] nginx: get metrics 384 - 385 - 386 - 387 - 388 - --- 389 - 390 - nginx cors for constellation + small burst bump 391 - 392 - ```nginx 393 - upstream cozy_constellation { 394 - server <tailnet ip>:6789; # bootes; ip so that we don't race on reboot with tailscale coming up, which nginx doesn't like 395 - keepalive 16; 396 - } 397 - 398 - server { 399 - server_name constellation.microcosm.blue; 400 - 401 - proxy_cache cozy_zone; 402 - proxy_cache_background_update on; 403 - proxy_cache_key "$scheme$proxy_host$uri$is_args$args$http_accept"; 404 - proxy_cache_lock on; # make simlutaneous requests for the same uri wait for it to appear in cache instead of hitting origin 405 - proxy_cache_lock_age 1s; 406 - proxy_cache_lock_timeout 2s; 407 - proxy_cache_valid 10s; # default -- should be explicitly set in the response headers 408 - proxy_cache_valid any 2s; # non-200s default 409 - proxy_read_timeout 5s; 410 - proxy_send_timeout 15s; 411 - proxy_socket_keepalive on; 412 - 413 - # take over cors responsibility from upsteram. `always` applies it to error responses. 414 - proxy_hide_header 'Access-Control-Allow-Origin'; 415 - proxy_hide_header 'Access-Control-Allowed-Methods'; 416 - proxy_hide_header 'Access-Control-Allow-Headers'; 417 - add_header 'Access-Control-Allow-Origin' '*' always; 418 - add_header 'Access-Control-Allow-Methods' 'GET' always; 419 - add_header 'Access-Control-Allow-Headers' '*' always; 420 - 421 - 422 - limit_req zone=cozy_ip_limit nodelay burst=150; 423 - limit_req zone=cozy_global_limit burst=1800; 424 - limit_req_status 429; 425 - 426 - location / { 427 - proxy_pass http://cozy_constellation; 428 - include proxy_params; 429 - proxy_http_version 1.1; 430 - proxy_set_header Connection ""; # for keepalive 431 - } 432 - 433 - 434 - listen 443 ssl; # managed by Certbot 435 - ssl_certificate /etc/letsencrypt/live/constellation.microcosm.blue/fullchain.pem; # managed by Certbot 436 - ssl_certificate_key /etc/letsencrypt/live/constellation.microcosm.blue/privkey.pem; # managed by Certbot 437 - include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot 438 - ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot 439 - 440 - } 441 - 442 - server { 443 - if ($host = constellation.microcosm.blue) { 444 - return 301 https://$host$request_uri; 445 - } # managed by Certbot 446 - 447 - 448 - server_name constellation.microcosm.blue; 449 - listen 80; 450 - return 404; # managed by Certbot 451 - } 452 - ``` 453 - 454 - re-reading about `nodelay`, i should probably remove it -- nginx would then queue requests to upstream, but still service them at the configured limit. it's fine for my internet since the global limit isn't nodelay, but probably less "fair" to clients if there's contention around the global limit (earlier requests would get all of theirs serviced before later ones can get in the queue) 455 - 456 - leaving it for now though. 457 - 458 - 459 - ### nginx logs to prom 460 - 461 - ```bash 462 - curl -LO https://github.com/martin-helmich/prometheus-nginxlog-exporter/releases/download/v1.11.0/prometheus-nginxlog-exporter_1.11.0_linux_amd64.deb 463 - apt install ./prometheus-nginxlog-exporter_1.11.0_linux_amd64.deb 464 - systemctl enable prometheus-nginxlog-exporter.service 465 - 466 - ``` 467 - 468 - have it run as www-data (maybe not the best idea but...) 469 - file `/usr/lib/systemd/system/prometheus-nginxlog-exporter.service` 470 - set User under service and remove capabilities bounding 471 - 472 - ```systemd 473 - User=www-data 474 - #CapabilityBoundingSet= 475 - ``` 476 - 477 - in `nginx.conf` in `http`: 478 - 479 - ```nginx 480 - log_format constellation_format "$remote_addr - $remote_user [$time_local] \"$request\" $status $body_bytes_sent \"$http_referer\" \"$http_user_agent\" \"$http_x_forwarded_for\""; 481 - ``` 482 - 483 - in `sites-available/constellation.microcosm.blue` in `server`: 484 - 485 - ```nginx 486 - # log format must match prometheus-nginx-log-exporter 487 - access_log /var/log/nginx/constellation-access.log constellation_format; 488 - ``` 489 - 490 - config at `/etc/prometheus-nginxlog-exporter.hcl` 491 - 492 - 493 - 494 - ```bash 495 - systemctl start prometheus-nginxlog-exporter.service 496 - ```
+6 -1
jetstream/Cargo.toml
··· 10 10 11 11 [dependencies] 12 12 async-trait = "0.1.83" 13 - atrium-api = { git = "https://github.com/uniphil/atrium", branch = "fix/nsid-allow-nonleading-name-digits", default-features = false, features = [ 13 + atrium-api = { git = "https://github.com/uniphil/atrium.git", branch = "fix/resolve-handle-https-accept-whitespace", default-features = false, features = [ 14 14 "namespace-appbsky", 15 15 ] } 16 16 tokio = { version = "1.44.2", features = ["full", "sync", "time"] } ··· 20 20 "url", 21 21 ] } 22 22 futures-util = "0.3.31" 23 + metrics = { version = "0.24.2", optional = true } 23 24 url = "2.5.4" 24 25 serde = { version = "1.0.215", features = ["derive"] } 25 26 serde_json = { version = "1.0.140", features = ["raw_value"] } ··· 31 32 [dev-dependencies] 32 33 anyhow = "1.0.93" 33 34 clap = { version = "4.5.20", features = ["derive"] } 35 + 36 + [features] 37 + default = [] 38 + metrics = ["dep:metrics"]
+2 -6
jetstream/src/error.rs
··· 36 36 /// See [websocket_task](crate::websocket_task). 37 37 #[derive(Error, Debug)] 38 38 pub enum JetstreamEventError { 39 - #[error("received websocket message that could not be deserialized as JSON: {0}")] 40 - ReceivedMalformedJSON(#[from] serde_json::Error), 41 39 #[error("failed to load built-in zstd dictionary for decoding: {0}")] 42 40 CompressionDictionaryError(io::Error), 43 - #[error("failed to decode zstd-compressed message: {0}")] 44 - CompressionDecoderError(io::Error), 45 - #[error("all receivers were dropped but the websocket connection failed to close cleanly")] 46 - WebSocketCloseFailure, 47 41 #[error("failed to send ping or pong: {0}")] 48 42 PingPongError(#[from] tokio_tungstenite::tungstenite::Error), 43 + #[error("no messages received within ttl")] 44 + NoMessagesReceived, 49 45 #[error("jetstream event receiver closed")] 50 46 ReceiverClosedError, 51 47 }
+11
jetstream/src/events.rs
··· 142 142 let t: SystemTime = self.into(); 143 143 t.elapsed() 144 144 } 145 + /// Compute the age of the cursor vs the local clock 146 + /// 147 + /// Converts the resulting duration into an f64, which can be negative! 148 + /// 149 + /// Warning: this exploits the internal implementation detail of jetstream cursors 150 + pub fn elapsed_micros_f64(&self) -> f64 { 151 + match self.elapsed() { 152 + Ok(d) => d.as_micros() as f64, 153 + Err(e) => -(e.duration().as_micros() as f64), 154 + } 155 + } 145 156 /// Get the immediate next cursor value 146 157 /// 147 158 /// This is possible for the implementation of jetstream cursors
+128 -8
jetstream/src/lib.rs
··· 14 14 stream::StreamExt, 15 15 SinkExt, 16 16 }; 17 + #[cfg(feature = "metrics")] 18 + use metrics::{ 19 + counter, 20 + describe_counter, 21 + Unit, 22 + }; 17 23 use tokio::{ 18 24 net::TcpStream, 19 25 sync::mpsc::{ ··· 21 27 Receiver, 22 28 Sender, 23 29 }, 30 + time::timeout, 24 31 }; 25 32 use tokio_tungstenite::{ 26 33 connect_async, ··· 194 201 /// can help prevent that if your consumer sometimes pauses, at a cost of higher memory 195 202 /// usage while events are buffered. 196 203 pub channel_size: usize, 204 + /// How long since the last jetstream message before we consider the connection dead 205 + /// 206 + /// Default: 15s 207 + pub liveliness_ttl: Duration, 197 208 } 198 209 199 210 impl Default for JetstreamConfig { ··· 207 218 omit_user_agent_jetstream_info: false, 208 219 replay_on_reconnect: false, 209 220 channel_size: 4096, // a few seconds of firehose buffer 221 + liveliness_ttl: Duration::from_secs(15), 210 222 } 211 223 } 212 224 } ··· 299 311 } 300 312 } 301 313 314 + #[cfg(feature = "metrics")] 315 + fn describe_metrics() { 316 + describe_counter!( 317 + "jetstream_connects", 318 + Unit::Count, 319 + "how many times we've tried to connect" 320 + ); 321 + describe_counter!( 322 + "jetstream_disconnects", 323 + Unit::Count, 324 + "how many times we've been disconnected" 325 + ); 326 + describe_counter!( 327 + "jetstream_total_events_received", 328 + Unit::Count, 329 + "total number of events received" 330 + ); 331 + describe_counter!( 332 + "jetstream_total_bytes_received", 333 + Unit::Count, 334 + "total uncompressed bytes received, not including websocket overhead" 335 + ); 336 + describe_counter!( 337 + "jetstream_total_event_errors", 338 + Unit::Count, 339 + "total errors when handling events" 340 + ); 341 + describe_counter!( 342 + "jetstream_total_events_sent", 343 + Unit::Count, 344 + "total events sent to the consumer" 345 + ); 346 + } 347 + 302 348 impl JetstreamConnector { 303 349 /// Create a Jetstream connector with a valid [JetstreamConfig]. 304 350 /// 305 351 /// After creation, you can call [connect] to connect to the provided Jetstream instance. 306 352 pub fn new(config: JetstreamConfig) -> Result<Self, ConfigValidationError> { 353 + #[cfg(feature = "metrics")] 354 + describe_metrics(); 355 + 307 356 // We validate the configuration here so any issues are caught early. 308 357 config.validate()?; 309 358 Ok(JetstreamConnector { config }) ··· 337 386 338 387 let (send_channel, receive_channel) = channel(self.config.channel_size); 339 388 let replay_on_reconnect = self.config.replay_on_reconnect; 389 + let liveliness_ttl = self.config.liveliness_ttl; 340 390 let build_request = self.config.get_request_builder(); 341 391 342 392 tokio::task::spawn(async move { ··· 359 409 } 360 410 }; 361 411 412 + #[cfg(feature = "metrics")] 413 + if let Some(host) = req.uri().host() { 414 + let retry = if retry_attempt > 0 { "yes" } else { "no" }; 415 + counter!("jetstream_connects", "host" => host.to_string(), "retry" => retry) 416 + .increment(1); 417 + } 418 + 362 419 let mut last_cursor = connect_cursor; 363 420 retry_attempt += 1; 364 421 if let Ok((ws_stream, _)) = connect_async(req).await { 365 422 let t_connected = Instant::now(); 366 423 log::info!("jetstream connected. starting websocket task..."); 367 - if let Err(e) = 368 - websocket_task(dict, ws_stream, send_channel.clone(), &mut last_cursor) 369 - .await 424 + if let Err(e) = websocket_task( 425 + dict, 426 + ws_stream, 427 + send_channel.clone(), 428 + &mut last_cursor, 429 + liveliness_ttl, 430 + ) 431 + .await 370 432 { 371 - if let JetstreamEventError::ReceiverClosedError = e { 372 - log::error!("Jetstream receiver channel closed. Exiting consumer."); 373 - return; 433 + match e { 434 + JetstreamEventError::ReceiverClosedError => { 435 + #[cfg(feature="metrics")] 436 + counter!("jetstream_disconnects", "reason" => "channel", "fatal" => "yes").increment(1); 437 + log::error!("Jetstream receiver channel closed. Exiting consumer."); 438 + return; 439 + } 440 + JetstreamEventError::CompressionDictionaryError(_) => { 441 + #[cfg(feature="metrics")] 442 + counter!("jetstream_disconnects", "reason" => "zstd", "fatal" => "no").increment(1); 443 + } 444 + JetstreamEventError::NoMessagesReceived => { 445 + #[cfg(feature="metrics")] 446 + counter!("jetstream_disconnects", "reason" => "ttl", "fatal" => "no").increment(1); 447 + } 448 + JetstreamEventError::PingPongError(_) => { 449 + #[cfg(feature="metrics")] 450 + counter!("jetstream_disconnects", "reason" => "pingpong", "fatal" => "no").increment(1); 451 + } 374 452 } 375 - log::error!("Jetstream closed after encountering error: {e:?}"); 453 + log::warn!("Jetstream closed after encountering error: {e:?}"); 376 454 } else { 455 + #[cfg(feature = "metrics")] 456 + counter!("jetstream_disconnects", "reason" => "close", "fatal" => "no") 457 + .increment(1); 377 458 log::warn!("Jetstream connection closed cleanly"); 378 459 } 379 460 if t_connected.elapsed() > Duration::from_secs(success_threshold_s) { ··· 416 497 ws: WebSocketStream<MaybeTlsStream<TcpStream>>, 417 498 send_channel: JetstreamSender, 418 499 last_cursor: &mut Option<Cursor>, 500 + liveliness_ttl: Duration, 419 501 ) -> Result<(), JetstreamEventError> { 420 502 // TODO: Use the write half to allow the user to change configuration settings on the fly. 421 503 let (mut socket_write, mut socket_read) = ws.split(); 422 504 423 505 let mut closing_connection = false; 424 506 loop { 425 - match socket_read.next().await { 507 + let next = match timeout(liveliness_ttl, socket_read.next()).await { 508 + Ok(n) => n, 509 + Err(_) => { 510 + log::warn!("jetstream no events for {liveliness_ttl:?}, closing"); 511 + _ = socket_write.close().await; 512 + return Err(JetstreamEventError::NoMessagesReceived); 513 + } 514 + }; 515 + match next { 426 516 Some(Ok(message)) => match message { 427 517 Message::Text(json) => { 518 + #[cfg(feature = "metrics")] 519 + { 520 + counter!("jetstream_total_events_received", "compressed" => "false") 521 + .increment(1); 522 + counter!("jetstream_total_bytes_received", "compressed" => "false") 523 + .increment(json.len() as u64); 524 + } 428 525 let event: JetstreamEvent = match serde_json::from_str(&json) { 429 526 Ok(ev) => ev, 430 527 Err(e) => { 528 + #[cfg(feature = "metrics")] 529 + counter!("jetstream_total_event_errors", "reason" => "deserialize") 530 + .increment(1); 431 531 log::warn!( 432 532 "failed to parse json: {e:?} (from {})", 433 533 json.get(..24).unwrap_or(&json) ··· 439 539 440 540 if let Some(last) = last_cursor { 441 541 if event_cursor <= *last { 542 + #[cfg(feature = "metrics")] 543 + counter!("jetstream_total_event_errors", "reason" => "old") 544 + .increment(1); 442 545 log::warn!("event cursor {event_cursor:?} was not newer than the last one: {last:?}. dropping event."); 443 546 continue; 444 547 } ··· 453 556 } else if let Some(last) = last_cursor.as_mut() { 454 557 *last = event_cursor; 455 558 } 559 + #[cfg(feature = "metrics")] 560 + counter!("jetstream_total_events_sent").increment(1); 456 561 } 457 562 Message::Binary(zstd_json) => { 563 + #[cfg(feature = "metrics")] 564 + { 565 + counter!("jetstream_total_events_received", "compressed" => "true") 566 + .increment(1); 567 + counter!("jetstream_total_bytes_received", "compressed" => "true") 568 + .increment(zstd_json.len() as u64); 569 + } 458 570 let mut cursor = IoCursor::new(zstd_json); 459 571 let decoder = 460 572 zstd::stream::Decoder::with_prepared_dictionary(&mut cursor, &dictionary) ··· 463 575 let event: JetstreamEvent = match serde_json::from_reader(decoder) { 464 576 Ok(ev) => ev, 465 577 Err(e) => { 578 + #[cfg(feature = "metrics")] 579 + counter!("jetstream_total_event_errors", "reason" => "deserialize") 580 + .increment(1); 466 581 log::warn!("failed to parse json: {e:?}"); 467 582 continue; 468 583 } ··· 471 586 472 587 if let Some(last) = last_cursor { 473 588 if event_cursor <= *last { 589 + #[cfg(feature = "metrics")] 590 + counter!("jetstream_total_event_errors", "reason" => "old") 591 + .increment(1); 474 592 log::warn!("event cursor {event_cursor:?} was not newer than the last one: {last:?}. dropping event."); 475 593 continue; 476 594 } ··· 485 603 } else if let Some(last) = last_cursor.as_mut() { 486 604 *last = event_cursor; 487 605 } 606 + #[cfg(feature = "metrics")] 607 + counter!("jetstream_total_events_sent").increment(1); 488 608 } 489 609 Message::Ping(vec) => { 490 610 log::trace!("Ping recieved, responding");
+496
legacy/cozy-setup (move to another repo).md
··· 1 + cozy-ucosm 2 + 3 + 4 + ## gateway 5 + 6 + - tailscale (exit node enabled) 7 + -> allow ipv4 and ipv6 forwarding 8 + - caddy 9 + 10 + ```bash 11 + apt install golang 12 + go install github.com/caddyserver/xcaddy/cmd/xcaddy@latest 13 + go/bin/xcaddy build \ 14 + --with github.com/caddyserver/cache-handler \ 15 + --with github.com/darkweak/storages/badger/caddy \ 16 + --with github.com/mholt/caddy-ratelimit 17 + # then https://caddyserver.com/docs/running#manual-installation 18 + 19 + mkdir /var/cache/caddy-badger 20 + chown -R caddy:caddy /var/cache/caddy-badger/ 21 + ``` 22 + 23 + - `/etc/caddy/Caddyfile` 24 + 25 + ``` 26 + { 27 + cache { 28 + badger 29 + api { 30 + prometheus 31 + } 32 + } 33 + } 34 + 35 + links.bsky.bad-example.com { 36 + reverse_proxy link-aggregator:6789 37 + 38 + @browser `{header.Origin.startsWith("Mozilla/5.0")` 39 + rate_limit { 40 + zone global_burst { 41 + key {remote_host} 42 + events 10 43 + window 1s 44 + } 45 + zone global_general { 46 + key {remote_host} 47 + events 100 48 + window 60s 49 + log_key true 50 + } 51 + zone website_harsh_limit { 52 + key {header.Origin} 53 + match { 54 + expression {header.User-Agent}.startsWith("Mozilla/5.0") 55 + } 56 + events 1000 57 + window 30s 58 + log_key true 59 + } 60 + } 61 + respond /souin-api/metrics "denied" 403 # does not work 62 + cache { 63 + ttl 3s 64 + stale 1h 65 + default_cache_control public, s-maxage=3 66 + badger { 67 + path /var/cache/caddy-badger/links 68 + } 69 + } 70 + } 71 + 72 + gateway:80 { 73 + metrics 74 + cache 75 + } 76 + ``` 77 + well... the gateway fell over IMMEDIATELY with like 2 req/sec from deletions, with that ^^ config. for now i removed everything except the reverse proxy config + normal caddy metrics and it's running fine on vanilla caddy. i did try reducing the rate-limiting configs to a single, fixed-key global limit but it still ate all the ram and died. maybe badger w/ the cache config was still a problem. maybe it would have been ok on a machine with more than 1GB mem. 78 + 79 + 80 + alternative proxies: 81 + 82 + - nginx. i should probably just use this. acme-client is a piece of cake to set up, and i know how to configure it. 83 + - haproxy. also kind of familiar, it's old and stable. no idea how it handle low-mem (our 1gb) vs nginx. 84 + - sozu. popular rust thing, fast. doesn't have rate-limiting or cache feature? 85 + - rpxy. like caddy (auto-tls) but in rust and actually fast? has an "experimental" cache feature. but the cache feature looks good. 86 + - rama. build-your-own proxy. not sure that it has both cache and limiter in their standard features? 87 + - pingora. build-your-own cloudflare, so like, probably stable. has tools for cache and limiting. low-mem...? 88 + - cache stuff in pingora seems a little... hit and miss (byeeeee). only a test impl for Storage for the main cache feature? 89 + - but the rate-limiter has a guide: https://github.com/cloudflare/pingora/blob/main/docs/user_guide/rate_limiter.md 90 + 91 + what i want is low-resource reverse proxy with built-in rate-limiting and caching. but maybe cache (and/or ratelimiting) could be external to the reverse proxy 92 + - varnish is a dedicated cache. has https://github.com/varnish/varnish-modules/blob/master/src/vmod_vsthrottle.vcc 93 + - apache traffic control has experimental rate-limiting plugins 94 + 95 + 96 + - victoriametrics 97 + 98 + ```bash 99 + curl -LO https://github.com/VictoriaMetrics/VictoriaMetrics/releases/download/v1.109.1/victoria-metrics-linux-amd64-v1.109.1.tar.gz 100 + tar xzf victoria-metrics-linux-amd64-v1.109.1.tar.gz 101 + # and then https://docs.victoriametrics.com/quick-start/#starting-vm-single-from-a-binary 102 + sudo mkdir /etc/victoria-metrics && sudo chown -R victoriametrics:victoriametrics /etc/victoria-metrics 103 + 104 + ``` 105 + 106 + - `/etc/victoria-metrics/prometheus.yml` 107 + 108 + ```yaml 109 + global: 110 + scrape_interval: '15s' 111 + 112 + scrape_configs: 113 + - job_name: 'link_aggregator' 114 + static_configs: 115 + - targets: ['link-aggregator:8765'] 116 + - job_name: 'gateway:caddy' 117 + static_configs: 118 + - targets: ['gateway:80/metrics'] 119 + - job_name: 'gateway:cache' 120 + static_configs: 121 + - targets: ['gateway:80/souin-api/metrics'] 122 + ``` 123 + 124 + - `ExecStart` in `/etc/systemd/system/victoriametrics.service`: 125 + 126 + ``` 127 + ExecStart=/usr/local/bin/victoria-metrics-prod -storageDataPath=/var/lib/victoria-metrics -retentionPeriod=90d -selfScrapeInterval=1m -promscrape.config=/etc/victoria-metrics/prometheus.yml 128 + ``` 129 + 130 + - grafana 131 + 132 + followed `https://grafana.com/docs/grafana/latest/setup-grafana/installation/debian/#install-grafana-on-debian-or-ubuntu` 133 + 134 + something something something then 135 + 136 + ``` 137 + sudo grafana-cli --pluginUrl https://github.com/VictoriaMetrics/victoriametrics-datasource/releases/download/v0.11.1/victoriametrics-datasource-v0.11.1.zip plugins install victoriametrics 138 + ``` 139 + 140 + - raspi node_exporter 141 + 142 + ```bash 143 + curl -LO https://github.com/prometheus/node_exporter/releases/download/v1.8.2/node_exporter-1.8.2.linux-armv7.tar.gz 144 + tar xzf node_exporter-1.8.2.linux-armv7.tar.gz 145 + sudo cp node_exporter-1.8.2.linux-armv7/node_exporter /usr/local/bin/ 146 + sudo useradd --no-create-home --shell /bin/false node_exporter 147 + sudo nano /etc/systemd/system/node_exporter.service 148 + # [Unit] 149 + # Description=Node Exporter 150 + # Wants=network-online.target 151 + # After=network-online.target 152 + 153 + # [Service] 154 + # User=node_exporter 155 + # Group=node_exporter 156 + # Type=simple 157 + # ExecStart=/usr/local/bin/node_exporter 158 + # Restart=always 159 + # RestartSec=3 160 + 161 + # [Install] 162 + # WantedBy=multi-user.target 163 + sudo systemctl daemon-reload 164 + sudo systemctl enable node_exporter.service 165 + sudo systemctl start node_exporter.service 166 + ``` 167 + 168 + todo: get raspi vcgencmd outputs into metrics 169 + 170 + - nginx on gateway 171 + 172 + ```nginx 173 + # in http 174 + 175 + ## 176 + # cozy cache 177 + ## 178 + proxy_cache_path /var/cache/nginx keys_zone=cozy_zone:10m; 179 + 180 + ## 181 + # cozy limit 182 + ## 183 + limit_req_zone $binary_remote_addr zone=cozy_ip_limit:10m rate=50r/s; 184 + limit_req_zone $server_name zone=cozy_global_limit:10m rate=1000r/s; 185 + 186 + # in sites-available/constellation.microcosm.blue 187 + 188 + upstream cozy_link_aggregator { 189 + server link-aggregator:6789; 190 + keepalive 16; 191 + } 192 + 193 + server { 194 + listen 8080; 195 + listen [::]:8080; 196 + 197 + server_name constellation.microcosm.blue; 198 + 199 + proxy_cache cozy_zone; 200 + proxy_cache_background_update on; 201 + proxy_cache_key "$scheme$proxy_host$uri$is_args$args$http_accept"; 202 + proxy_cache_lock on; # make simlutaneous requests for the same uri wait for it to appear in cache instead of hitting origin 203 + proxy_cache_lock_age 1s; 204 + proxy_cache_lock_timeout 2s; 205 + proxy_cache_valid 10s; # default -- should be explicitly set in the response headers 206 + proxy_cache_valid any 15s; # non-200s default 207 + proxy_read_timeout 5s; 208 + proxy_send_timeout 15s; 209 + proxy_socket_keepalive on; 210 + 211 + limit_req zone=cozy_ip_limit nodelay burst=100; 212 + limit_req zone=cozy_global_limit; 213 + limit_req_status 429; 214 + 215 + location / { 216 + proxy_pass http://cozy_link_aggregator; 217 + include proxy_params; 218 + proxy_http_version 1.1; 219 + proxy_set_header Connection ""; # for keepalive 220 + } 221 + } 222 + ``` 223 + 224 + also `systemctl edit nginx` and paste 225 + 226 + ``` 227 + [Service] 228 + Restart=always 229 + ``` 230 + 231 + —https://serverfault.com/a/1003373 232 + 233 + now making browsers redirect to the microcosm.blue url: 234 + 235 + ``` 236 + [...] 237 + server_name links.bsky.bad-example.com; 238 + 239 + add_header Access-Control-Allow-Origin * always; # bit of hack to have it here but nginx doesn't like it in the `if` 240 + if ($http_user_agent ~ ^Mozilla/) { 241 + # for now send *browsers* to the new location, hopefully without impacting api requests 242 + # (yeah we're doing UA test here and content-negotatiation in the app. whatever.) 243 + return 301 https://constellation.microcosm.blue$request_uri; 244 + } 245 + [...] 246 + ``` 247 + 248 + - nginx metrics 249 + 250 + - download nginx-prometheus-exporter 251 + https://github.com/nginx/nginx-prometheus-exporter/releases/download/v1.4.1/nginx-prometheus-exporter_1.4.1_linux_amd64.tar.gz 252 + 253 + - err actually going to make mistakes and try with snap 254 + `snap install nginx-prometheus-exporter` 255 + - so it got a binary for me but no systemd task set up. boooo. 256 + `snap remove nginx-prometheus-exporter` 257 + 258 + - ```bash 259 + curl -LO https://github.com/nginx/nginx-prometheus-exporter/releases/download/v1.4.1/nginx-prometheus-exporter_1.4.1_linux_amd64.tar.gz 260 + tar xzf nginx-prometheus-exporter_1.4.1_linux_amd64.tar.gz 261 + mv nginx-prometheus-exporter /usr/local/bin 262 + useradd --no-create-home --shell /bin/false nginx-prometheus-exporter 263 + nano /etc/systemd/system/nginx-prometheus-exporter.service 264 + # [Unit] 265 + # Description=NGINX Exporter 266 + # Wants=network-online.target 267 + # After=network-online.target 268 + 269 + # [Service] 270 + # User=nginx-prometheus-exporter 271 + # Group=nginx-prometheus-exporter 272 + # Type=simple 273 + # ExecStart=/usr/local/bin/nginx-prometheus-exporter --nginx.scrape-uri=http://gateway:8080/stub_status --web.listen-address=gateway:9113 274 + # Restart=always 275 + # RestartSec=3 276 + 277 + # [Install] 278 + # WantedBy=multi-user.target 279 + systemctl daemon-reload 280 + systemctl start nginx-prometheus-exporter.service 281 + systemctl enable nginx-prometheus-exporter.service 282 + ``` 283 + 284 + - nginx `/etc/nginx/sites-available/gateway-nginx-status` 285 + 286 + ```nginx 287 + server { 288 + listen 8080; 289 + listen [::]:8080; 290 + 291 + server_name gateway; 292 + 293 + location /stub_status { 294 + stub_status; 295 + } 296 + location / { 297 + return 404; 298 + } 299 + } 300 + ``` 301 + 302 + ```bash 303 + ln -s /etc/nginx/sites-available/gateway-nginx-status /etc/nginx/sites-enabled/ 304 + ``` 305 + 306 + 307 + ## bootes (pi5) 308 + 309 + - mount sd card, touch `ssh` file echo `echo "pi:$(echo raspberry | openssl passwd -6 -stdin)" > userconf.txt` 310 + - raspi-config: enable pcie 3, set hostname, enable ssh 311 + - put ssh key into `.ssh/authorized_keys` 312 + - put `PasswordAuthentication no` in `/etc/ssh/sshd_config` 313 + - `sudo apt update && sudo apt upgrade` 314 + - `sudo apt install xfsprogs` 315 + - `sudo mkfs.xfs -L c11n-kv /dev/nvme0n1` 316 + - `sudo mount /dev/nvme0n1 /mnt` 317 + - set up tailscale 318 + - `sudo tailscale up` 319 + - `git clone https://github.com/atcosm/links.git` 320 + - tailscale: disable bootes key expiry 321 + - rustup `curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh` 322 + - `cd links/constellation` 323 + - `sudo apt install libssl-dev` needed 324 + - `sudo apt install clang` needed for bindgen 325 + - (in tmux) `cargo build --release` 326 + - `mkdir ~/backup` 327 + - `sudo mount.cifs "//truenas.local/folks data" /home/pi/backup -o user=phil,uid=pi` 328 + - `sudo chown pi:pi /mnt/` 329 + - `RUST_BACKTRACE=full cargo run --bin rocks-restore-from-backup --release -- --from-backup-dir "/home/pi/backup/constellation-index" --to-data-dir /mnt/constellation-index` 330 + etc 331 + - follow above `- raspi node_exporter` 332 + - configure victoriametrics to scrape the new pi 333 + - configure ulimit before starting! `ulimit -n 16384` 334 + - `RUST_BACKTRACE=full cargo run --release -- --backend rocks --data /mnt/constellation-index/ --jetstream us-east-2 --backup /home/pi/backup/constellation-index --backup-interval 6 --max-old-backups 20` 335 + - add server to nginx gateway upstream: ` server 100.123.79.12:6789; # bootes` 336 + - stop backups from running on the older instance! `RUST_BACKTRACE=full cargo run --release -- --backend rocks --data /mnt/links-2.rocks/ --jetstream us-east-1` 337 + - stop upstreaming requests to older instance in nginx 338 + 339 + 340 + - systemd unit for running: `sudo nano /etc/systemd/system/constellation.service` 341 + 342 + ```ini 343 + [Unit] 344 + Description=Constellation backlinks index 345 + After=network.target 346 + 347 + [Service] 348 + User=pi 349 + WorkingDirectory=/home/pi/links/constellation 350 + ExecStart=/home/pi/links/target/release/main --backend rocks --data /mnt/constellation-index/ --jetstream us-east-2 --backup /home/pi/backup/constellation-index --backup-interval 6 --max-old-backups 20 351 + LimitNOFILE=16384 352 + Restart=always 353 + 354 + [Install] 355 + WantedBy=multi-user.target 356 + ``` 357 + 358 + 359 + - todo: overlayfs? would need to figure out builds/updates still, also i guess logs are currently written to sd? (oof) 360 + - todo: cross-compile for raspi? 361 + 362 + --- 363 + 364 + some todos 365 + 366 + - [x] tailscale: exit node 367 + - [!] link_aggregator: use exit node 368 + -> worked, but reverted for now: tailscale on raspi was consuming ~50% cpu for the jetstream traffic. this might be near its max since it would have been catching up at the time (max jetstream throughput) but it feels a bit too much. we have to trust the jetstream server and link_aggregator doesn't (yet) make any other external connections, so for now the raspi connects directly from my home again. 369 + - [x] caddy: reverse proxy 370 + - [x] build with cache and rate-limit plugins 371 + - [x] configure systemd to keep it alive 372 + - [x] configure caddy cache 373 + - [x] configure caddy rate-limit 374 + - [ ] configure ~caddy~ nginx to use a health check (once it's added) 375 + - [ ] ~configure caddy to only expose cache metrics to tailnet :/~ 376 + - [x] make some grafana dashboards 377 + - [ ] raspi: mount /dev/sda on boot 378 + - [ ] raspi: run link_aggregator via systemd so it starts on startup (and restarts?) 379 + 380 + - [x] use nginx instead of caddy 381 + - [x] nginx: enable cache 382 + - [x] nginx: rate-limit 383 + - [ ] nginx: get metrics 384 + 385 + 386 + 387 + 388 + --- 389 + 390 + nginx cors for constellation + small burst bump 391 + 392 + ```nginx 393 + upstream cozy_constellation { 394 + server <tailnet ip>:6789; # bootes; ip so that we don't race on reboot with tailscale coming up, which nginx doesn't like 395 + keepalive 16; 396 + } 397 + 398 + server { 399 + server_name constellation.microcosm.blue; 400 + 401 + proxy_cache cozy_zone; 402 + proxy_cache_background_update on; 403 + proxy_cache_key "$scheme$proxy_host$uri$is_args$args$http_accept"; 404 + proxy_cache_lock on; # make simlutaneous requests for the same uri wait for it to appear in cache instead of hitting origin 405 + proxy_cache_lock_age 1s; 406 + proxy_cache_lock_timeout 2s; 407 + proxy_cache_valid 10s; # default -- should be explicitly set in the response headers 408 + proxy_cache_valid any 2s; # non-200s default 409 + proxy_read_timeout 5s; 410 + proxy_send_timeout 15s; 411 + proxy_socket_keepalive on; 412 + 413 + # take over cors responsibility from upsteram. `always` applies it to error responses. 414 + proxy_hide_header 'Access-Control-Allow-Origin'; 415 + proxy_hide_header 'Access-Control-Allowed-Methods'; 416 + proxy_hide_header 'Access-Control-Allow-Headers'; 417 + add_header 'Access-Control-Allow-Origin' '*' always; 418 + add_header 'Access-Control-Allow-Methods' 'GET' always; 419 + add_header 'Access-Control-Allow-Headers' '*' always; 420 + 421 + 422 + limit_req zone=cozy_ip_limit nodelay burst=150; 423 + limit_req zone=cozy_global_limit burst=1800; 424 + limit_req_status 429; 425 + 426 + location / { 427 + proxy_pass http://cozy_constellation; 428 + include proxy_params; 429 + proxy_http_version 1.1; 430 + proxy_set_header Connection ""; # for keepalive 431 + } 432 + 433 + 434 + listen 443 ssl; # managed by Certbot 435 + ssl_certificate /etc/letsencrypt/live/constellation.microcosm.blue/fullchain.pem; # managed by Certbot 436 + ssl_certificate_key /etc/letsencrypt/live/constellation.microcosm.blue/privkey.pem; # managed by Certbot 437 + include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot 438 + ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot 439 + 440 + } 441 + 442 + server { 443 + if ($host = constellation.microcosm.blue) { 444 + return 301 https://$host$request_uri; 445 + } # managed by Certbot 446 + 447 + 448 + server_name constellation.microcosm.blue; 449 + listen 80; 450 + return 404; # managed by Certbot 451 + } 452 + ``` 453 + 454 + re-reading about `nodelay`, i should probably remove it -- nginx would then queue requests to upstream, but still service them at the configured limit. it's fine for my internet since the global limit isn't nodelay, but probably less "fair" to clients if there's contention around the global limit (earlier requests would get all of theirs serviced before later ones can get in the queue) 455 + 456 + leaving it for now though. 457 + 458 + 459 + ### nginx logs to prom 460 + 461 + ```bash 462 + curl -LO https://github.com/martin-helmich/prometheus-nginxlog-exporter/releases/download/v1.11.0/prometheus-nginxlog-exporter_1.11.0_linux_amd64.deb 463 + apt install ./prometheus-nginxlog-exporter_1.11.0_linux_amd64.deb 464 + systemctl enable prometheus-nginxlog-exporter.service 465 + 466 + ``` 467 + 468 + have it run as www-data (maybe not the best idea but...) 469 + file `/usr/lib/systemd/system/prometheus-nginxlog-exporter.service` 470 + set User under service and remove capabilities bounding 471 + 472 + ```systemd 473 + User=www-data 474 + #CapabilityBoundingSet= 475 + ``` 476 + 477 + in `nginx.conf` in `http`: 478 + 479 + ```nginx 480 + log_format constellation_format "$remote_addr - $remote_user [$time_local] \"$request\" $status $body_bytes_sent \"$http_referer\" \"$http_user_agent\" \"$http_x_forwarded_for\""; 481 + ``` 482 + 483 + in `sites-available/constellation.microcosm.blue` in `server`: 484 + 485 + ```nginx 486 + # log format must match prometheus-nginx-log-exporter 487 + access_log /var/log/nginx/constellation-access.log constellation_format; 488 + ``` 489 + 490 + config at `/etc/prometheus-nginxlog-exporter.hcl` 491 + 492 + 493 + 494 + ```bash 495 + systemctl start prometheus-nginxlog-exporter.service 496 + ```
+35
legacy/old-readme-details.md
··· 1 + [Constellation](./constellation/) 2 + -------------------------------------------- 3 + 4 + A global atproto backlink index ✨ 5 + 6 + - Self hostable: handles the full write throughput of the global atproto firehose on a raspberry pi 4b + single SSD 7 + - Storage efficient: less than 2GB/day disk consumption indexing all references in all lexicons and all non-atproto URLs 8 + - Handles record deletion, account de/re-activation, and account deletion, ensuring accurate link counts and respecting users data choices 9 + - Simple JSON API 10 + 11 + All social interactions in atproto tend to be represented by links (or references) between PDS records. This index can answer questions like "how many likes does a bsky post have", "who follows an account", "what are all the comments on a [frontpage](https://frontpage.fyi/) post", and more. 12 + 13 + - **status**: works! api is unstable and likely to change, and no known instances have a full network backfill yet. 14 + - source: [./constellation/](./constellation/) 15 + - public instance: [constellation.microcosm.blue](https://constellation.microcosm.blue/) 16 + 17 + _note: the public instance currently runs on a little raspberry pi in my house, feel free to use it! it comes with only with best-effort uptime, no commitment to not breaking the api for now, and possible rate-limiting. if you want to be nice you can put your project name and bsky username (or email) in your user-agent header for api requests._ 18 + 19 + 20 + App: Spacedust 21 + -------------- 22 + 23 + A notification subscription service 💫 24 + 25 + using the same "link source" concept as [constellation](./constellation/), offer webhook notifications for new references created to records 26 + 27 + - **status**: in design 28 + 29 + 30 + Library: [links](./links/) 31 + ------------------------------------ 32 + 33 + A rust crate (not published on crates.io yet) for optimistically parsing links out of arbitrary atproto PDS records, and potentially canonicalizing them 34 + 35 + - **status**: unstable, might remain an internal lib for constellation (and spacedust, soon)
+123
legacy/original-notes.md
··· 1 + --- 2 + 3 + 4 + old notes follow, ignore 5 + ------------------------ 6 + 7 + 8 + as far as i can tell, atproto lexicons today don't follow much of a convention for referencing across documents: sometimes it's a StrongRef, sometimes it's a DID, sometimes it's a bare at-uri. lexicon authors choose any old link-sounding key name for the key in their document. 9 + 10 + it's pretty messy so embrace the mess: atproto wants to be part of the web, so this library will also extract URLs and other URIs if you want it to. all the links. 11 + 12 + 13 + why 14 + --- 15 + 16 + the atproto firehose that bluesky sprays at you will contain raw _contents_ from peoples' pdses. these are isolated, decontextualized updates. it's very easy to build some kinds of interesting downstream apps off of this feed. 17 + 18 + - bluesky posts (firesky, deletions, ) 19 + - blueksy post stats (emojis, ) 20 + - trending keywords () 21 + 22 + but bringing almost kind of _context_ into your project requires a big step up in complexity and potentially cost: you're entering "appview" territory. _how many likes does a post have? who follows this account?_ 23 + 24 + you own your atproto data: it's kept in your personal data repository (PDS) and noone else can write to it. when someone likes your post, they create a "like" record in their _own_ pds, and that like belongs to _them_, not to you/your post. 25 + 26 + in the firehose you'll see a `app.bsky.feed.post` record created, with no details about who has liked it. then you'll see separate `app.bsky.feed.like` records show up for each like that comes in on that post, with no context about the post except a random-looking reference to it. storing these in order to do so is up to you! 27 + 28 + **so, why** 29 + 30 + everything is links, and they're a mess, but they all kinda work the same, so maybe some tooling can bring down that big step in complexity from firehose raw-content apps -> apps requiring any social context. 31 + 32 + everything is links: 33 + 34 + - likes 35 + - follows 36 + - blocks 37 + - reposts 38 + - quotes 39 + 40 + some low-level things you could make from links: 41 + 42 + - notification streams (part of ucosm) 43 + - a global reverse index (part of ucosm) 44 + 45 + i think that making these low-level services as easy to use as jetstream could open up pathways for building more atproto apps that operate at full scale with interesting features for reasonable effort at low cost to operate. 46 + 47 + 48 + extracting links 49 + --------------- 50 + 51 + 52 + - low-level: pass a &str of a field value and get a parsed link back 53 + 54 + - med-level: pass a &str of record in json form and get a list of parsed links + json paths back. (todo: should also handle dag-cbor prob?) 55 + 56 + - high-ish level: pass the json record and maybe apply some pre-loaded rules based on known lexicons to get the best result. 57 + 58 + for now, a link is only considered if it matches for the entire value of the record's field -- links embedded in text content are not included. note that urls in bluesky posts _will_ still be extracted, since they are broken out into facets. 59 + 60 + 61 + resolving / canonicalizing links 62 + -------------------------------- 63 + 64 + 65 + ### at-uris 66 + 67 + every at-uri has at least two equivalent forms, one with a `DID`, and one with an account handle. the at-uri spec [illustrates this by example](https://atproto.com/specs/at-uri-scheme): 68 + 69 + - `at://did:plc:44ybard66vv44zksje25o7dz/app.bsky.feed.post/3jwdwj2ctlk26` 70 + - `at://bnewbold.bsky.team/app.bsky.feed.post/3jwdwj2ctlk26` 71 + 72 + some applications, like a reverse link index, may wish to canonicalize at-uris to a single form. the `DID`-form is stable as an account changes its handle and probably the right choice to canonicalize to, but maybe some apps would actually perfer to canonicalise to handles? 73 + 74 + hopefully atrium will make it easy to resolve at-uris. 75 + 76 + 77 + ### urls 78 + 79 + canonicalizing URLs is more annoying but also a bit more established. lots of details. 80 + 81 + - do we have to deal with punycode? 82 + - follow redirects (todo: only permanent ones, or all?) 83 + - check for rel=canonical http header and possibly follow it 84 + - check link rel=canonical meta tag and possibly follow it 85 + - do we need to check site maps?? 86 + - do we have to care at all about AMP? 87 + - do we want anything to do with url shorteners?? 88 + - how do multilingual sites affect this? 89 + - do we have to care about `script type="application/ld+json"` ??? 90 + 91 + ugh. is there a crate for this. 92 + 93 + 94 + ### relative uris? 95 + 96 + links might be relative, in which case they might need to be made absolute before being useful. is that a concern for this library, or up to the user? (seems like we might not have context here to determine its absolute) 97 + 98 + 99 + ### canonicalizing 100 + 101 + there should be a few async functions available to canonicalize already-parsed links. 102 + 103 + - what happens if a link can't be resolved? 104 + 105 + 106 + --- 107 + 108 + - using `tinyjson` because it's nice -- maybe should switch to serde_json to share deps with atrium? 109 + 110 + - would use atrium for parsing at-uris, but it's not in there. there's a did-only version in the non-lib commands.rs. its identifier parser is strict to did + handle, which makes sense, but for our purposes we might want to allow unknown methods too? 111 + 112 + - rsky-syntax has an aturi 113 + - adenosyne also 114 + - might come back to these 115 + 116 + 117 + ------- 118 + 119 + rocks 120 + 121 + ```bash 122 + ROCKSDB_LIB_DIR=/nix/store/z2chn0hsik0clridr8mlprx1cngh1g3c-rocksdb-9.7.3/lib/ cargo build 123 + ```
+196
legacy/ufos ops (move to micro-ops).md
··· 1 + ufos ops 2 + 3 + btrfs snapshots: snapper 4 + 5 + ```bash 6 + sudo apt install snapper 7 + sudo snapper -c ufos-db create-config /mnt/ufos-db 8 + 9 + # edit /etc/snapper/configs/ufos-db 10 + # change 11 + TIMELINE_MIN_AGE="1800" 12 + TIMELINE_LIMIT_HOURLY="10" 13 + TIMELINE_LIMIT_DAILY="10" 14 + TIMELINE_LIMIT_WEEKLY="0" 15 + TIMELINE_LIMIT_MONTHLY="10" 16 + TIMELINE_LIMIT_YEARLY="10" 17 + # to 18 + TIMELINE_MIN_AGE="1800" 19 + TIMELINE_LIMIT_HOURLY="22" 20 + TIMELINE_LIMIT_DAILY="4" 21 + TIMELINE_LIMIT_WEEKLY="0" 22 + TIMELINE_LIMIT_MONTHLY="0" 23 + TIMELINE_LIMIT_YEARLY="0" 24 + ``` 25 + 26 + this should be enough? 27 + 28 + list snapshots: 29 + 30 + ```bash 31 + sudo snapper -c ufos-db list 32 + ``` 33 + 34 + systemd 35 + 36 + create file: `/etc/systemd/system/ufos.service` 37 + 38 + ```ini 39 + [Unit] 40 + Description=UFOs-API 41 + After=network.target 42 + 43 + [Service] 44 + User=pi 45 + WorkingDirectory=/home/pi/ 46 + ExecStart=/home/pi/ufos --jetstream us-west-2 --data /mnt/ufos-db/ 47 + Environment="RUST_LOG=info" 48 + LimitNOFILE=16384 49 + Restart=always 50 + 51 + [Install] 52 + WantedBy=multi-user.target 53 + ``` 54 + 55 + then 56 + 57 + ```bash 58 + sudo systemctl daemon-reload 59 + sudo systemctl enable ufos 60 + sudo systemctl start ufos 61 + ``` 62 + 63 + monitor with 64 + 65 + ```bash 66 + journalctl -u ufos -f 67 + ``` 68 + 69 + make sure a backup dir exists 70 + 71 + ```bash 72 + mkdir /home/pi/backup 73 + ``` 74 + 75 + mount the NAS 76 + 77 + ```bash 78 + sudo mount.cifs "//truenas.local/folks data" /home/pi/backup -o user=phil,uid=pi 79 + ``` 80 + 81 + manual rsync 82 + 83 + ```bash 84 + sudo rsync -ahP --delete /mnt/ufos-db/.snapshots/1/snapshot/ backup/ufos/ 85 + ``` 86 + 87 + backup script sketch 88 + 89 + ```bash 90 + NUM=$(sudo snapper --csvout -c ufos-db list --type single --columns number | tail -n1) 91 + sudo rsync -ahP --delete "/mnt/ufos-db/.snapshots/${NUM}/snapshot/" backup/ufos/ 92 + ``` 93 + 94 + just crontab it? 95 + 96 + `sudo crontab -e` 97 + ```bash 98 + 0 1/6 * * * rsync -ahP --delete "/mnt/ufos-db/.snapshots/$(sudo snapper --csvout -c ufos-db list --columns number | tail -n1)/snapshot/" backup/ufos/ 99 + ``` 100 + 101 + ^^ try once initial backup is done 102 + 103 + 104 + --columns subvolume,number 105 + 106 + subvolume 107 + number 108 + 109 + 110 + 111 + 112 + gateway: follow constellation for nginx->prom thing 113 + 114 + config at `/etc/prometheus-nginxlog-exporter.hcl` 115 + 116 + before: `/etc/prometheus-nginxlog-exporter.hcl` 117 + 118 + ```hcl 119 + listen { 120 + port = 4044 121 + } 122 + 123 + namespace "nginx" { 124 + source = { 125 + files = [ 126 + "/var/log/nginx/constellation-access.log" 127 + ] 128 + } 129 + 130 + format = "$remote_addr - $remote_user [$time_local] \"$request\" $status $upstream_cache_status $body_bytes_sent \"$http_referer\" \"$http_user_agent\" \"$http_x_forwarded_for\"" 131 + 132 + labels { 133 + app = "constellation" 134 + } 135 + 136 + relabel "cache_status" { 137 + from = "upstream_cache_status" 138 + } 139 + } 140 + ``` 141 + 142 + after: 143 + 144 + ```hcl 145 + listen { 146 + port = 4044 147 + } 148 + 149 + namespace "constellation" { 150 + source = { 151 + files = [ 152 + "/var/log/nginx/constellation-access.log" 153 + ] 154 + } 155 + 156 + format = "$remote_addr - $remote_user [$time_local] \"$request\" $status $upstream_cache_status $body_bytes_sent \"$http_referer\" \"$http_user_agent\" \"$http_x_forwarded_for\"" 157 + 158 + labels { 159 + app = "constellation" 160 + } 161 + 162 + relabel "cache_status" { 163 + from = "upstream_cache_status" 164 + } 165 + 166 + namespace_label = "vhost" 167 + metrics_override = { prefix = "nginx" } 168 + } 169 + 170 + namespace "ufos" { 171 + source = { 172 + files = [ 173 + "/var/log/nginx/ufos-access.log" 174 + ] 175 + } 176 + 177 + format = "$remote_addr - $remote_user [$time_local] \"$request\" $status $upstream_cache_status $body_bytes_sent \"$http_referer\" \"$http_user_agent\" \"$http_x_forwarded_for\"" 178 + 179 + labels { 180 + app = "ufos" 181 + } 182 + 183 + relabel "cache_status" { 184 + from = "upstream_cache_status" 185 + } 186 + 187 + namespace_label = "vhost" 188 + metrics_override = { prefix = "nginx" } 189 + } 190 + ``` 191 + 192 + 193 + ```bash 194 + systemctl start prometheus-nginxlog-exporter.service 195 + ``` 196 +
+2
links/Cargo.toml
··· 5 5 6 6 [dependencies] 7 7 anyhow = "1.0.95" 8 + dasl = "0.2.0" 8 9 fluent-uri = "0.3.2" 9 10 nom = "7.1.3" 11 + serde = { version = "1.0.228", features = ["derive"] } 10 12 thiserror = "2.0.9" 11 13 tinyjson = "2.5.1"
+18 -2
links/src/lib.rs
··· 1 1 use fluent_uri::Uri; 2 + use serde::{Deserialize, Serialize}; 2 3 3 4 pub mod at_uri; 4 5 pub mod did; ··· 6 7 7 8 pub use record::collect_links; 8 9 9 - #[derive(Debug, Clone, Ord, Eq, PartialOrd, PartialEq)] 10 + #[derive(Debug, Clone, Ord, Eq, PartialOrd, PartialEq, Serialize, Deserialize)] 10 11 pub enum Link { 11 12 AtUri(String), 12 13 Uri(String), ··· 42 43 None 43 44 } 44 45 } 46 + pub fn did(&self) -> Option<String> { 47 + let did = match self { 48 + Link::AtUri(s) => { 49 + let rest = s.strip_prefix("at://")?; // todo: this might be safe to unwrap? 50 + if let Some((did, _)) = rest.split_once("/") { 51 + did 52 + } else { 53 + rest 54 + } 55 + } 56 + Link::Uri(_) => return None, 57 + Link::Did(did) => did, 58 + }; 59 + Some(did.to_string()) 60 + } 45 61 } 46 62 47 - #[derive(Debug, PartialEq)] 63 + #[derive(Debug, Clone, PartialEq, Serialize, Deserialize)] 48 64 pub struct CollectedLink { 49 65 pub path: String, 50 66 pub target: Link,
+41
links/src/record.rs
··· 1 + use dasl::drisl::Value as DrislValue; 1 2 use tinyjson::JsonValue; 2 3 3 4 use crate::{parse_any_link, CollectedLink}; ··· 36 37 } 37 38 } 38 39 40 + pub fn walk_drisl(path: &str, v: &DrislValue, found: &mut Vec<CollectedLink>) { 41 + match v { 42 + DrislValue::Map(o) => { 43 + for (key, child) in o { 44 + walk_drisl(&format!("{path}.{key}"), child, found) 45 + } 46 + } 47 + DrislValue::Array(a) => { 48 + for child in a { 49 + let child_p = match child { 50 + DrislValue::Map(o) => { 51 + if let Some(DrislValue::Text(t)) = o.get("$type") { 52 + format!("{path}[{t}]") 53 + } else { 54 + format!("{path}[]") 55 + } 56 + } 57 + _ => format!("{path}[]"), 58 + }; 59 + walk_drisl(&child_p, child, found) 60 + } 61 + } 62 + DrislValue::Text(s) => { 63 + if let Some(link) = parse_any_link(s) { 64 + found.push(CollectedLink { 65 + path: path.to_string(), 66 + target: link, 67 + }); 68 + } 69 + } 70 + _ => {} 71 + } 72 + } 73 + 39 74 pub fn collect_links(v: &JsonValue) -> Vec<CollectedLink> { 40 75 let mut found = vec![]; 41 76 walk_record("", v, &mut found); 77 + found 78 + } 79 + 80 + pub fn collect_links_drisl(v: &DrislValue) -> Vec<CollectedLink> { 81 + let mut found = vec![]; 82 + walk_drisl("", v, &mut found); 42 83 found 43 84 } 44 85
+1
pocket/.gitignore
··· 1 + prefs.sqlite3*
+19
pocket/Cargo.toml
··· 1 + [package] 2 + name = "pocket" 3 + version = "0.1.0" 4 + edition = "2024" 5 + 6 + [dependencies] 7 + atrium-crypto = "0.1.2" 8 + clap = { version = "4.5.41", features = ["derive"] } 9 + jwt-compact = { git = "https://github.com/fatfingers23/jwt-compact.git", features = ["es256k"] } 10 + log = "0.4.27" 11 + poem = { version = "3.1.12", features = ["acme", "static-files"] } 12 + poem-openapi = { version = "5.1.16", features = ["scalar"] } 13 + reqwest = { version = "0.12.22", features = ["json"] } 14 + rusqlite = "0.37.0" 15 + serde = { version = "1.0.219", features = ["derive"] } 16 + serde_json = { version = "1.0.141" } 17 + thiserror = "2.0.16" 18 + tokio = { version = "1.47.0", features = ["full"] } 19 + tracing-subscriber = { version = "0.3.19", features = ["env-filter"] }
+17
pocket/api-description.md
··· 1 + _A pocket dimension to stash a bit of non-public user data._ 2 + 3 + 4 + # Pocket: user preference storage 5 + 6 + This API leverages atproto service proxying to offer a bit of per-user per-app non-public data storage. 7 + Perfect for things like application preferences that might be better left out of the public PDS data. 8 + 9 + The intent is to use oauth scopes to isolate storage on a per-application basis, and to allow easy data migration from a community hosted instance to your own if you end up needing that. 10 + 11 + 12 + ### Current status 13 + 14 + > [!important] 15 + > Pocket is currently in a **v0, pre-release state**. There is one production instance and you can use it! Expect short downtimes for restarts as development progresses and occaisional data loss until it's stable. 16 + 17 + ATProto might end up adding a similar feature to [PDSs](https://atproto.com/guides/glossary#pds-personal-data-server). If/when that happens, you should use it instead of this!
+7
pocket/src/lib.rs
··· 1 + mod server; 2 + mod storage; 3 + mod token; 4 + 5 + pub use server::serve; 6 + pub use storage::Storage; 7 + pub use token::TokenVerifier;
+34
pocket/src/main.rs
··· 1 + use clap::Parser; 2 + use pocket::{Storage, serve}; 3 + use std::path::PathBuf; 4 + 5 + /// Slingshot record edge cache 6 + #[derive(Parser, Debug, Clone)] 7 + #[command(version, about, long_about = None)] 8 + struct Args { 9 + /// path to the sqlite db file 10 + #[arg(long)] 11 + db: Option<PathBuf>, 12 + /// just initialize the db and exit 13 + #[arg(long, action)] 14 + init_db: bool, 15 + /// the domain for serving a did doc (unused if running behind reflector) 16 + #[arg(long)] 17 + domain: Option<String>, 18 + } 19 + 20 + #[tokio::main] 21 + async fn main() { 22 + tracing_subscriber::fmt::init(); 23 + log::info!("👖 hi"); 24 + let args = Args::parse(); 25 + let domain = args.domain.unwrap_or("bad-example.com".into()); 26 + let db_path = args.db.unwrap_or("prefs.sqlite3".into()); 27 + if args.init_db { 28 + Storage::init(&db_path).unwrap(); 29 + log::info!("👖 initialized db at {db_path:?}. bye") 30 + } else { 31 + let storage = Storage::connect(db_path).unwrap(); 32 + serve(&domain, storage).await 33 + } 34 + }
+265
pocket/src/server.rs
··· 1 + use crate::{Storage, TokenVerifier}; 2 + use poem::{ 3 + Endpoint, EndpointExt, Route, Server, 4 + endpoint::{StaticFileEndpoint, make_sync}, 5 + http::Method, 6 + listener::TcpListener, 7 + middleware::{CatchPanic, Cors, Tracing}, 8 + }; 9 + use poem_openapi::{ 10 + ApiResponse, ContactObject, ExternalDocumentObject, Object, OpenApi, OpenApiService, 11 + SecurityScheme, Tags, 12 + auth::Bearer, 13 + payload::{Json, PlainText}, 14 + types::Example, 15 + }; 16 + use serde::Serialize; 17 + use serde_json::{Value, json}; 18 + use std::sync::{Arc, Mutex}; 19 + 20 + #[derive(Debug, SecurityScheme)] 21 + #[oai(ty = "bearer")] 22 + struct XrpcAuth(Bearer); 23 + 24 + #[derive(Tags)] 25 + enum ApiTags { 26 + /// Custom pocket APIs 27 + #[oai(rename = "Pocket APIs")] 28 + Pocket, 29 + } 30 + 31 + #[derive(Object)] 32 + #[oai(example = true)] 33 + struct XrpcErrorResponseObject { 34 + /// Should correspond an error `name` in the lexicon errors array 35 + error: String, 36 + /// Human-readable description and possibly additonal context 37 + message: String, 38 + } 39 + impl Example for XrpcErrorResponseObject { 40 + fn example() -> Self { 41 + Self { 42 + error: "PreferencesNotFound".to_string(), 43 + message: "No preferences were found for this user".to_string(), 44 + } 45 + } 46 + } 47 + type XrpcError = Json<XrpcErrorResponseObject>; 48 + fn xrpc_error(error: impl AsRef<str>, message: impl AsRef<str>) -> XrpcError { 49 + Json(XrpcErrorResponseObject { 50 + error: error.as_ref().to_string(), 51 + message: message.as_ref().to_string(), 52 + }) 53 + } 54 + 55 + #[derive(Debug, Object)] 56 + #[oai(example = true)] 57 + struct BskyPrefsObject { 58 + /// at-uri for this record 59 + preferences: Value, 60 + } 61 + impl Example for BskyPrefsObject { 62 + fn example() -> Self { 63 + Self { 64 + preferences: json!({ 65 + "hello": "world", 66 + }), 67 + } 68 + } 69 + } 70 + 71 + #[derive(ApiResponse)] 72 + enum GetBskyPrefsResponse { 73 + /// Record found 74 + #[oai(status = 200)] 75 + Ok(Json<BskyPrefsObject>), 76 + /// Bad request or no preferences to return 77 + #[oai(status = 400)] 78 + BadRequest(XrpcError), 79 + } 80 + 81 + #[derive(ApiResponse)] 82 + enum PutBskyPrefsResponse { 83 + /// Record found 84 + #[oai(status = 200)] 85 + Ok(PlainText<String>), 86 + /// Bad request or no preferences to return 87 + #[oai(status = 400)] 88 + BadRequest(XrpcError), 89 + // /// Server errors 90 + // #[oai(status = 500)] 91 + // ServerError(XrpcError), 92 + } 93 + 94 + struct Xrpc { 95 + verifier: TokenVerifier, 96 + storage: Arc<Mutex<Storage>>, 97 + } 98 + 99 + #[OpenApi] 100 + impl Xrpc { 101 + /// com.bad-example.pocket.getPreferences 102 + /// 103 + /// get stored preferencess 104 + #[oai( 105 + path = "/com.bad-example.pocket.getPreferences", 106 + method = "get", 107 + tag = "ApiTags::Pocket" 108 + )] 109 + async fn pocket_get_prefs(&self, XrpcAuth(auth): XrpcAuth) -> GetBskyPrefsResponse { 110 + let (did, aud) = match self 111 + .verifier 112 + .verify("com.bad-example.pocket.getPreferences", &auth.token) 113 + .await 114 + { 115 + Ok(d) => d, 116 + Err(e) => return GetBskyPrefsResponse::BadRequest(xrpc_error("boooo", e.to_string())), 117 + }; 118 + log::info!("verified did: {did}/{aud}"); 119 + 120 + let storage = self.storage.clone(); 121 + 122 + let Ok(Ok(res)) = tokio::task::spawn_blocking(move || { 123 + storage 124 + .lock() 125 + .unwrap() 126 + .get(&did, &aud) 127 + .inspect_err(|e| log::error!("failed to get prefs: {e}")) 128 + }) 129 + .await 130 + else { 131 + return GetBskyPrefsResponse::BadRequest(xrpc_error("boooo", "failed to get from db")); 132 + }; 133 + 134 + let Some(serialized) = res else { 135 + return GetBskyPrefsResponse::BadRequest(xrpc_error( 136 + "NotFound", 137 + "could not find prefs for u", 138 + )); 139 + }; 140 + 141 + let preferences = match serde_json::from_str(&serialized) { 142 + Ok(v) => v, 143 + Err(e) => { 144 + log::error!("failed to deserialize prefs: {e}"); 145 + return GetBskyPrefsResponse::BadRequest(xrpc_error( 146 + "boooo", 147 + "failed to deserialize prefs", 148 + )); 149 + } 150 + }; 151 + 152 + GetBskyPrefsResponse::Ok(Json(BskyPrefsObject { preferences })) 153 + } 154 + 155 + /// com.bad-example.pocket.putPreferences 156 + /// 157 + /// store bluesky prefs 158 + #[oai( 159 + path = "/com.bad-example.pocket.putPreferences", 160 + method = "post", 161 + tag = "ApiTags::Pocket" 162 + )] 163 + async fn pocket_put_prefs( 164 + &self, 165 + XrpcAuth(auth): XrpcAuth, 166 + Json(prefs): Json<BskyPrefsObject>, 167 + ) -> PutBskyPrefsResponse { 168 + let (did, aud) = match self 169 + .verifier 170 + .verify("com.bad-example.pocket.putPreferences", &auth.token) 171 + .await 172 + { 173 + Ok(d) => d, 174 + Err(e) => return PutBskyPrefsResponse::BadRequest(xrpc_error("boooo", e.to_string())), 175 + }; 176 + log::info!("verified did: {did}/{aud}"); 177 + log::warn!("received prefs: {prefs:?}"); 178 + 179 + let storage = self.storage.clone(); 180 + let serialized = prefs.preferences.to_string(); 181 + 182 + let Ok(Ok(())) = tokio::task::spawn_blocking(move || { 183 + storage 184 + .lock() 185 + .unwrap() 186 + .put(&did, &aud, &serialized) 187 + .inspect_err(|e| log::error!("failed to insert prefs: {e}")) 188 + }) 189 + .await 190 + else { 191 + return PutBskyPrefsResponse::BadRequest(xrpc_error("boooo", "failed to put to db")); 192 + }; 193 + 194 + PutBskyPrefsResponse::Ok(PlainText("saved.".to_string())) 195 + } 196 + } 197 + 198 + #[derive(Debug, Clone, Serialize)] 199 + #[serde(rename_all = "camelCase")] 200 + struct AppViewService { 201 + id: String, 202 + r#type: String, 203 + service_endpoint: String, 204 + } 205 + #[derive(Debug, Clone, Serialize)] 206 + struct AppViewDoc { 207 + id: String, 208 + service: [AppViewService; 2], 209 + } 210 + /// Serve a did document for did:web for this to be an xrpc appview 211 + fn get_did_doc(domain: &str) -> impl Endpoint + use<> { 212 + let doc = poem::web::Json(AppViewDoc { 213 + id: format!("did:web:{domain}"), 214 + service: [ 215 + AppViewService { 216 + id: "#pocket_prefs".to_string(), 217 + r#type: "PocketPreferences".to_string(), 218 + service_endpoint: format!("https://{domain}"), 219 + }, 220 + AppViewService { 221 + id: "#bsky_appview".to_string(), 222 + r#type: "BlueskyAppview".to_string(), 223 + service_endpoint: format!("https://{domain}"), 224 + }, 225 + ], 226 + }); 227 + make_sync(move |_| doc.clone()) 228 + } 229 + 230 + pub async fn serve(domain: &str, storage: Storage) -> () { 231 + let verifier = TokenVerifier::default(); 232 + let api_service = OpenApiService::new( 233 + Xrpc { 234 + verifier, 235 + storage: Arc::new(Mutex::new(storage)), 236 + }, 237 + "Pocket", 238 + env!("CARGO_PKG_VERSION"), 239 + ) 240 + .server(domain) 241 + .url_prefix("/xrpc") 242 + .contact( 243 + ContactObject::new() 244 + .name("@microcosm.blue") 245 + .url("https://bsky.app/profile/microcosm.blue"), 246 + ) 247 + .description(include_str!("../api-description.md")) 248 + .external_document(ExternalDocumentObject::new("https://microcosm.blue/pocket")); 249 + 250 + let app = Route::new() 251 + .nest("/openapi", api_service.spec_endpoint()) 252 + .nest("/xrpc/", api_service) 253 + .at("/.well-known/did.json", get_did_doc(domain)) 254 + .at("/", StaticFileEndpoint::new("./static/index.html")) 255 + .with( 256 + Cors::new() 257 + .allow_method(Method::GET) 258 + .allow_method(Method::POST), 259 + ) 260 + .with(CatchPanic::new()) 261 + .with(Tracing); 262 + 263 + let listener = TcpListener::bind("127.0.0.1:3000"); 264 + Server::new(listener).name("pocket").run(app).await.unwrap(); 265 + }
+50
pocket/src/storage.rs
··· 1 + use rusqlite::{Connection, OptionalExtension, Result}; 2 + use std::path::Path; 3 + 4 + pub struct Storage { 5 + con: Connection, 6 + } 7 + 8 + impl Storage { 9 + pub fn connect(path: impl AsRef<Path>) -> Result<Self> { 10 + let con = Connection::open(path)?; 11 + con.pragma_update(None, "journal_mode", "WAL")?; 12 + con.pragma_update(None, "synchronous", "NORMAL")?; 13 + con.pragma_update(None, "busy_timeout", "100")?; 14 + con.pragma_update(None, "foreign_keys", "ON")?; 15 + Ok(Self { con }) 16 + } 17 + pub fn init(path: impl AsRef<Path>) -> Result<Self> { 18 + let me = Self::connect(path)?; 19 + me.con.execute( 20 + r#" 21 + create table prefs ( 22 + actor text not null, 23 + aud text not null, 24 + pref text not null, 25 + primary key (actor, aud) 26 + ) strict"#, 27 + (), 28 + )?; 29 + Ok(me) 30 + } 31 + pub fn put(&self, actor: &str, aud: &str, pref: &str) -> Result<()> { 32 + self.con.execute( 33 + r#"insert into prefs (actor, aud, pref) 34 + values (?1, ?2, ?3) 35 + on conflict do update set pref = excluded.pref"#, 36 + [actor, aud, pref], 37 + )?; 38 + Ok(()) 39 + } 40 + pub fn get(&self, actor: &str, aud: &str) -> Result<Option<String>> { 41 + self.con 42 + .query_one( 43 + r#"select pref from prefs 44 + where actor = ?1 and aud = ?2"#, 45 + [actor, aud], 46 + |row| row.get(0), 47 + ) 48 + .optional() 49 + } 50 + }
+143
pocket/src/token.rs
··· 1 + use atrium_crypto::did::parse_multikey; 2 + use atrium_crypto::verify::Verifier; 3 + use jwt_compact::UntrustedToken; 4 + use serde::Deserialize; 5 + use std::collections::HashMap; 6 + use std::time::Duration; 7 + use thiserror::Error; 8 + 9 + #[derive(Debug, Deserialize)] 10 + struct MiniDoc { 11 + signing_key: String, 12 + did: String, 13 + } 14 + 15 + #[derive(Error, Debug)] 16 + pub enum VerifyError { 17 + #[error("The cross-service authorization token failed verification: {0}")] 18 + VerificationFailed(&'static str), 19 + #[error("Error trying to resolve the DID to a signing key, retry in a moment: {0}")] 20 + ResolutionFailed(&'static str), 21 + } 22 + 23 + pub struct TokenVerifier { 24 + client: reqwest::Client, 25 + } 26 + 27 + impl TokenVerifier { 28 + pub fn new() -> Self { 29 + let client = reqwest::Client::builder() 30 + .user_agent(format!( 31 + "microcosm pocket v{} (dev: @bad-example.com)", 32 + env!("CARGO_PKG_VERSION") 33 + )) 34 + .no_proxy() 35 + .timeout(Duration::from_secs(12)) // slingshot timeout is 10s 36 + .build() 37 + .unwrap(); 38 + Self { client } 39 + } 40 + 41 + pub async fn verify( 42 + &self, 43 + expected_lxm: &str, 44 + token: &str, 45 + ) -> Result<(String, String), VerifyError> { 46 + let untrusted = UntrustedToken::new(token).unwrap(); 47 + 48 + // danger! unfortunately we need to decode the DID from the jwt body before we have a public key to verify the jwt with 49 + let Ok(untrusted_claims) = 50 + untrusted.deserialize_claims_unchecked::<HashMap<String, String>>() 51 + else { 52 + return Err(VerifyError::VerificationFailed( 53 + "could not deserialize jtw claims", 54 + )); 55 + }; 56 + 57 + // get the (untrusted!) claimed DID 58 + let Some(untrusted_did) = untrusted_claims.custom.get("iss") else { 59 + return Err(VerifyError::VerificationFailed( 60 + "jwt must include the user's did in `iss`", 61 + )); 62 + }; 63 + 64 + // bail if it's not even a user-ish did 65 + if !untrusted_did.starts_with("did:") { 66 + return Err(VerifyError::VerificationFailed("iss should be a did")); 67 + } 68 + if untrusted_did.contains("#") { 69 + return Err(VerifyError::VerificationFailed( 70 + "iss should be a user did without a service identifier", 71 + )); 72 + } 73 + 74 + let endpoint = 75 + "https://slingshot.microcosm.blue/xrpc/com.bad-example.identity.resolveMiniDoc"; 76 + let doc: MiniDoc = self 77 + .client 78 + .get(format!("{endpoint}?identifier={untrusted_did}")) 79 + .send() 80 + .await 81 + .map_err(|_| VerifyError::ResolutionFailed("failed to fetch minidoc"))? 82 + .error_for_status() 83 + .map_err(|_| VerifyError::ResolutionFailed("non-ok response for minidoc"))? 84 + .json() 85 + .await 86 + .map_err(|_| VerifyError::ResolutionFailed("failed to parse json to minidoc"))?; 87 + 88 + // sanity check before we go ahead with this signing key 89 + if doc.did != *untrusted_did { 90 + return Err(VerifyError::VerificationFailed( 91 + "wtf, resolveMiniDoc returned a doc for a different DID, slingshot bug", 92 + )); 93 + } 94 + 95 + let Ok((alg, public_key)) = parse_multikey(&doc.signing_key) else { 96 + return Err(VerifyError::VerificationFailed( 97 + "could not parse signing key form minidoc", 98 + )); 99 + }; 100 + 101 + // i _guess_ we've successfully bootstrapped the verification of the jwt unless this fails 102 + if let Err(e) = Verifier::default().verify( 103 + alg, 104 + &public_key, 105 + &untrusted.signed_data, 106 + untrusted.signature_bytes(), 107 + ) { 108 + log::warn!("jwt verification failed: {e}"); 109 + return Err(VerifyError::VerificationFailed( 110 + "jwt signature verification failed", 111 + )); 112 + } 113 + 114 + // past this point we're should have established trust. crossing ts and dotting is. 115 + let did = &untrusted_did; 116 + let claims = &untrusted_claims; 117 + 118 + let Some(aud) = claims.custom.get("aud") else { 119 + return Err(VerifyError::VerificationFailed("missing aud")); 120 + }; 121 + let Some(mut aud) = aud.strip_prefix("did:web:") else { 122 + return Err(VerifyError::VerificationFailed("expected a did:web aud")); 123 + }; 124 + if let Some((aud_without_hash, _)) = aud.split_once("#") { 125 + log::warn!("aud claim is missing service id fragment: {aud:?}"); 126 + aud = aud_without_hash; 127 + } 128 + let Some(lxm) = claims.custom.get("lxm") else { 129 + return Err(VerifyError::VerificationFailed("missing lxm")); 130 + }; 131 + if lxm != expected_lxm { 132 + return Err(VerifyError::VerificationFailed("wrong lxm")); 133 + } 134 + 135 + Ok((did.to_string(), aud.to_string())) 136 + } 137 + } 138 + 139 + impl Default for TokenVerifier { 140 + fn default() -> Self { 141 + Self::new() 142 + } 143 + }
+67
pocket/static/index.html
··· 1 + <!doctype html> 2 + <html lang="en"> 3 + <head> 4 + <meta charset="utf-8" /> 5 + <title>Pocket: atproto user preference storage</title> 6 + <meta name="viewport" content="width=device-width, initial-scale=1" /> 7 + <meta name="description" content="API Documentation for Pocket, a simple user-preference storage system for atproto" /> 8 + <style> 9 + :root { 10 + --scalar-small: 13px; 11 + } 12 + .scalar-app .markdown .markdown-alert { 13 + font-size: var(--scalar-small); 14 + } 15 + .sidebar-heading-link-title { 16 + line-height: 1.2; 17 + } 18 + .custom-header { 19 + height: 42px; 20 + background-color: #221828; 21 + box-shadow: inset 0 -1px 0 var(--scalar-border-color); 22 + color: var(--scalar-color-1); 23 + font-size: var(--scalar-font-size-3); 24 + font-family: 'Iowan Old Style', 'Palatino Linotype', 'URW Palladio L', P052, serif; 25 + padding: 0 18px; 26 + justify-content: space-between; 27 + } 28 + .custom-header, 29 + .custom-header nav { 30 + display: flex; 31 + align-items: center; 32 + gap: 18px; 33 + } 34 + .custom-header a:hover { 35 + color: var(--scalar-color-2); 36 + } 37 + 38 + .light-mode .custom-header { 39 + background-color: thistle; 40 + } 41 + </style> 42 + </head> 43 + <body> 44 + <header class="custom-header scalar-app"> 45 + <p> 46 + TODO: thing 47 + </p> 48 + <nav> 49 + <b>a <a href="https://microcosm.blue">microcosm</a> project</b> 50 + <a href="https://bsky.app/profile/microcosm.blue">@microcosm.blue</a> 51 + <a href="https://github.com/at-microcosm">github</a> 52 + </nav> 53 + </header> 54 + 55 + <script id="api-reference" type="application/json" data-url="/openapi"></script> 56 + 57 + <script> 58 + var configuration = { 59 + theme: 'purple', 60 + hideModels: true, 61 + } 62 + document.getElementById('api-reference').dataset.configuration = JSON.stringify(configuration) 63 + </script> 64 + 65 + <script src="https://cdn.jsdelivr.net/npm/@scalar/api-reference"></script> 66 + </body> 67 + </html>
+8
quasar/Cargo.toml
··· 1 + [package] 2 + name = "quasar" 3 + version = "0.1.0" 4 + edition = "2024" 5 + 6 + [dependencies] 7 + clap = { version = "4.5.46", features = ["derive"] } 8 + fjall = "2.11.2"
+3
quasar/readme.md
··· 1 + # quasar 2 + 3 + indexed replay and fan-out for event stream services (wip)
+3
quasar/src/lib.rs
··· 1 + mod storage; 2 + 3 + pub use storage::Storage;
+3
quasar/src/main.rs
··· 1 + fn main() { 2 + println!("Hello, world!"); 3 + }
+4
quasar/src/storage.rs
··· 1 + 2 + pub trait Storage { 3 + 4 + }
+57 -129
readme.md
··· 1 - microcosm: links 2 - ================ 3 - 4 - this repo contains libraries and apps for working with cross-record references in at-protocol. 5 - 1 + microcosm HTTP APIs + rust crates 2 + ================================= 3 + [![@microcosm.blue: bluesky](https://img.shields.io/badge/@microcosm.blue-bluesky-blue)](https://bsky.app/profile/microcosm.blue) 4 + [![microcosm discord: join](https://img.shields.io/badge/microcosm_discord-join-purple)](https://discord.gg/tcDfe4PGVB) 5 + [![github sponsors: support](https://img.shields.io/badge/github_sponsors-support-pink)](https://github.com/sponsors/uniphil/) 6 + [![ko-fi: support](https://img.shields.io/badge/ko--fi-support-pink)](https://ko-fi.com/bad_example) 6 7 7 - App: [Constellation](./constellation/) 8 - -------------------------------------------- 8 + Welcome! Documentation is under active development. If you like reading API docs, you'll probably hit the ground running! 9 9 10 - A global atproto backlink index ✨ 10 + Tutorials, how-to guides, and client SDK libraries are all in the works for gentler on-ramps, but are not quite ready yet. But don't let that stop you! Hop in the [microcosm discord](https://discord.gg/tcDfe4PGVB), or post questions and tag [@bad-example.com](https://bsky.app/profile/bad-example.com) on Bluesky if you get stuck anywhere. 11 11 12 - - Self hostable: handles the full write throughput of the global atproto firehose on a raspberry pi 4b + single SSD 13 - - Storage efficient: less than 2GB/day disk consumption indexing all references in all lexicons and all non-atproto URLs 14 - - Handles record deletion, account de/re-activation, and account deletion, ensuring accurate link counts and respecting users data choices 15 - - Simple JSON API 12 + > [!tip] 13 + > This repository's primary home is moving to tangled: [@microcosm.blue/microcosm-rs](https://tangled.sh/@microcosm.blue/microcosm-rs). It will continue to be mirrored on [github](https://github.com/at-microcosm/microcosm-rs) for the forseeable future, and it's fine to open issues or pulls in either place! 16 14 17 - All social interactions in atproto tend to be represented by links (or references) between PDS records. This index can answer questions like "how many likes does a bsky post have", "who follows an account", "what are all the comments on a [frontpage](https://frontpage.fyi/) post", and more. 18 15 19 - - **status**: works! api is unstable and likely to change, and no known instances have a full network backfill yet. 20 - - source: [./constellation/](./constellation/) 21 - - public instance: [constellation.microcosm.blue](https://constellation.microcosm.blue/) 22 - 23 - _note: the public instance currently runs on a little raspberry pi in my house, feel free to use it! it comes with only with best-effort uptime, no commitment to not breaking the api for now, and possible rate-limiting. if you want to be nice you can put your project name and bsky username (or email) in your user-agent header for api requests._ 24 - 25 - 26 - App: Spacedust 27 - -------------- 28 - 29 - A notification subscription service 💫 30 - 31 - using the same "link source" concept as [constellation](./constellation/), offer webhook notifications for new references created to records 32 - 33 - - **status**: in design 34 - 35 - 36 - Library: [links](./links/) 16 + 🌌 [Constellation](./constellation/) 37 17 ------------------------------------ 38 18 39 - A rust crate (not published on crates.io yet) for optimistically parsing links out of arbitrary atproto PDS records, and potentially canonicalizing them 40 - 41 - - **status**: unstable, might remain an internal lib for constellation (and spacedust, soon) 42 - 43 - 44 - 45 - --- 46 - 47 - 48 - old notes follow, ignore 49 - ------------------------ 50 - 51 - 52 - as far as i can tell, atproto lexicons today don't follow much of a convention for referencing across documents: sometimes it's a StrongRef, sometimes it's a DID, sometimes it's a bare at-uri. lexicon authors choose any old link-sounding key name for the key in their document. 53 - 54 - it's pretty messy so embrace the mess: atproto wants to be part of the web, so this library will also extract URLs and other URIs if you want it to. all the links. 55 - 56 - 57 - why 58 - --- 59 - 60 - the atproto firehose that bluesky sprays at you will contain raw _contents_ from peoples' pdses. these are isolated, decontextualized updates. it's very easy to build some kinds of interesting downstream apps off of this feed. 61 - 62 - - bluesky posts (firesky, deletions, ) 63 - - blueksy post stats (emojis, ) 64 - - trending keywords () 65 - 66 - but bringing almost kind of _context_ into your project requires a big step up in complexity and potentially cost: you're entering "appview" territory. _how many likes does a post have? who follows this account?_ 67 - 68 - you own your atproto data: it's kept in your personal data repository (PDS) and noone else can write to it. when someone likes your post, they create a "like" record in their _own_ pds, and that like belongs to _them_, not to you/your post. 69 - 70 - in the firehose you'll see a `app.bsky.feed.post` record created, with no details about who has liked it. then you'll see separate `app.bsky.feed.like` records show up for each like that comes in on that post, with no context about the post except a random-looking reference to it. storing these in order to do so is up to you! 71 - 72 - **so, why** 73 - 74 - everything is links, and they're a mess, but they all kinda work the same, so maybe some tooling can bring down that big step in complexity from firehose raw-content apps -> apps requiring any social context. 75 - 76 - everything is links: 77 - 78 - - likes 79 - - follows 80 - - blocks 81 - - reposts 82 - - quotes 83 - 84 - some low-level things you could make from links: 85 - 86 - - notification streams (part of ucosm) 87 - - a global reverse index (part of ucosm) 88 - 89 - i think that making these low-level services as easy to use as jetstream could open up pathways for building more atproto apps that operate at full scale with interesting features for reasonable effort at low cost to operate. 19 + A global atproto interactions backlink index as a simple JSON API. Works with every lexicon, runs on a raspberry pi, consumes less than 2GiB of disk per day. Handles record deletion, account de/re-activation, and account deletion, ensuring accurate link counts while respecting users' data choices. 90 20 21 + - Source: [./constellation/](./constellation/) 22 + - [Public instance/API docs](https://constellation.microcosm.blue/) 23 + - Status: used in production. APIs will change but backwards compatibility will be maintained as long as needed. 91 24 92 - extracting links 93 - --------------- 94 25 26 + 🎇 [Spacedust](./spacedust/) 27 + ---------------------------- 95 28 96 - - low-level: pass a &str of a field value and get a parsed link back 29 + A global atproto interactions firehose. Extracts all at-uris, DIDs, and URLs from every lexicon in the firehose, and exposes them over a websocket modelled after [jetstream](github.com/bluesky-social/jetstream). 97 30 98 - - med-level: pass a &str of record in json form and get a list of parsed links + json paths back. (todo: should also handle dag-cbor prob?) 31 + - Source: [./spacedust/](./spacedust/) 32 + - [Public instance/API docs](https://spacedust.microcosm.blue/) 33 + - Status: v0: the basics work and the APIs are in place! missing cursor replay, forward link storage, and delete event link hydration. 99 34 100 - - high-ish level: pass the json record and maybe apply some pre-loaded rules based on known lexicons to get the best result. 35 + ### Demos: 101 36 102 - for now, a link is only considered if it matches for the entire value of the record's field -- links embedded in text content are not included. note that urls in bluesky posts _will_ still be extracted, since they are broken out into facets. 37 + - [Spacedust notifications](https://notifications.microcosm.blue/): web push notifications for _every_ atproto app 38 + - [Zero-Bluesky real-time interaction-updating post embed](https://bsky.bad-example.com/zero-bluesky-realtime-embed/) 103 39 104 40 105 - resolving / canonicalizing links 106 - -------------------------------- 41 + 🛰️ [Slingshot](./slingshot) 42 + --------------------------- 107 43 44 + A fast, eager, production-grade edge cache for atproto records and identities. Pre-caches all records from the firehose and maintains a longer-term cache of requested records on disk. 108 45 109 - ### at-uris 46 + - Source: [./slingshot/](./slingshot/) 47 + - [Public instance/API docs](https://slingshot.microcosm.blue/) 48 + - Status: v0: most XRPC APIs are working. cache storage is being reworked. 110 49 111 - every at-uri has at least two equivalent forms, one with a `DID`, and one with an account handle. the at-uri spec [illustrates this by example](https://atproto.com/specs/at-uri-scheme): 112 50 113 - - `at://did:plc:44ybard66vv44zksje25o7dz/app.bsky.feed.post/3jwdwj2ctlk26` 114 - - `at://bnewbold.bsky.team/app.bsky.feed.post/3jwdwj2ctlk26` 51 + 🛸 [UFOs API](./ufos) 52 + --------------------- 115 53 116 - some applications, like a reverse link index, may wish to canonicalize at-uris to a single form. the `DID`-form is stable as an account changes its handle and probably the right choice to canonicalize to, but maybe some apps would actually perfer to canonicalise to handles? 54 + Timeseries stats and sample records for every [collection](https://atproto.com/guides/glossary#collection) ever seen in the atproto firehose. Unique users are counted in hyperloglog sketches enabling arbitrary cardinality aggregation across time buckets and/or NSIDs. 117 55 118 - hopefully atrium will make it easy to resolve at-uris. 56 + - Source: [./ufos/](./ufos/) 57 + - [Public instance/API docs](https://ufos-api.microcosm.blue/) 58 + - Status: Used in production. It has APIs and they work! Needs improvement on indexing; needs more indexes and some more APIs to the data exposed. 119 59 60 + > [!tip] 61 + > See also: [UFOs atproto explorer](https://ufos.microcosm.blue/) built on UFOs API. ([source](github.com/at-microcosm/spacedust-utils)) 120 62 121 - ### urls 122 63 123 - canonicalizing URLs is more annoying but also a bit more established. lots of details. 64 + 💫 [Links](./links) 65 + ------------------- 124 66 125 - - do we have to deal with punycode? 126 - - follow redirects (todo: only permanent ones, or all?) 127 - - check for rel=canonical http header and possibly follow it 128 - - check link rel=canonical meta tag and possibly follow it 129 - - do we need to check site maps?? 130 - - do we have to care at all about AMP? 131 - - do we want anything to do with url shorteners?? 132 - - how do multilingual sites affect this? 133 - - do we have to care about `script type="application/ld+json"` ??? 67 + Rust library for parsing and extracting links (at-uris, DIDs, and URLs) from atproto records. 134 68 135 - ugh. is there a crate for this. 69 + - Source: [./links/](./links/) 70 + - Status: not yet published to crates.io; needs some rework 136 71 137 72 138 - ### relative uris? 139 - 140 - links might be relative, in which case they might need to be made absolute before being useful. is that a concern for this library, or up to the user? (seems like we might not have context here to determine its absolute) 141 - 142 - 143 - ### canonicalizing 144 - 145 - there should be a few async functions available to canonicalize already-parsed links. 146 - 147 - - what happens if a link can't be resolved? 73 + 🛩️ [Jetstream](./jetstream) 74 + --------------------------- 148 75 76 + A low-overhead jetstream client with cursor handling and automatic reconnect. 149 77 150 - --- 78 + - Source: [./links/](./links/) 79 + - Status: used in multiple apps in production, but not yet published to crates.io; some rework planned 151 80 152 - - using `tinyjson` because it's nice -- maybe should switch to serde_json to share deps with atrium? 81 + > [!tip] 82 + > See also: [Rocketman](https://github.com/teal-fm/cadet/tree/main/rocketman), another excellent rust jetstream client which shares some lineage and _is_ published on crates.io. 153 83 154 - - would use atrium for parsing at-uris, but it's not in there. there's a did-only version in the non-lib commands.rs. its identifier parser is strict to did + handle, which makes sense, but for our purposes we might want to allow unknown methods too? 155 84 156 - - rsky-syntax has an aturi 157 - - adenosyne also 158 - - might come back to these 159 85 86 + 🔭 Deprecated: [Who am I](./who-am-i) 87 + ------------------------------------- 160 88 161 - ------- 89 + An identity bridge for microcosm demos, that kinda worked. Fixing its problems is about equivalent to reinventing a lot of OIDC, so it's being retired. 162 90 163 - rocks 91 + - Source: [./who-am-i/](./who-am-i/) 92 + - Status: ready for retirement. 164 93 165 - ```bash 166 - ROCKSDB_LIB_DIR=/nix/store/z2chn0hsik0clridr8mlprx1cngh1g3c-rocksdb-9.7.3/lib/ cargo build 167 - ``` 94 + > [!warning] 95 + > `who-am-i` is still in use for the Spacedust Notifications demo, but that will hopefully be migrated to use atproto oauth directly instead.
+12
reflector/Cargo.toml
··· 1 + [package] 2 + name = "reflector" 3 + version = "0.1.0" 4 + edition = "2024" 5 + 6 + [dependencies] 7 + clap = { version = "4.5.47", features = ["derive"] } 8 + log = "0.4.28" 9 + poem = "3.1.12" 10 + serde = { version = "1.0.219", features = ["derive"] } 11 + tokio = "1.47.1" 12 + tracing-subscriber = { version = "0.3.20", features = ["env-filter"] }
+9
reflector/readme.md
··· 1 + # reflector 2 + 3 + a tiny did:web service server that maps subdomains to a single service endpoint 4 + 5 + receiving requests from multiple subdomains is left as a problem for the reverse proxy to solve, since acme wildcard certificates (ie. letsencrypt) require the most complicated and involved challenge type (DNS). 6 + 7 + caddy [has good support for](https://caddyserver.com/docs/caddyfile/patterns#wildcard-certificates) configuring the wildcard DNS challenge with various DNS providers, and also supports [on-demand](https://caddyserver.com/docs/automatic-https#using-on-demand-tls) provisioning via the simpler methods. 8 + 9 + if you only need a small fixed number of subdomains, you can also use certbot or otherwise individually configure them in your reverse proxy.
+112
reflector/src/main.rs
··· 1 + use clap::Parser; 2 + use poem::{ 3 + EndpointExt, Response, Route, Server, get, handler, 4 + http::StatusCode, 5 + listener::TcpListener, 6 + middleware::{AddData, Tracing}, 7 + web::{Data, Json, Query, TypedHeader, headers::Host}, 8 + }; 9 + use serde::{Deserialize, Serialize}; 10 + 11 + #[handler] 12 + fn hello() -> String { 13 + "ɹoʇɔǝʅⅎǝɹ".to_string() 14 + } 15 + 16 + #[derive(Debug, Serialize)] 17 + struct DidDoc { 18 + id: String, 19 + service: [DidService; 1], 20 + } 21 + 22 + #[derive(Debug, Clone, Serialize)] 23 + #[serde(rename_all = "camelCase")] 24 + struct DidService { 25 + id: String, 26 + r#type: String, 27 + service_endpoint: String, 28 + } 29 + 30 + #[handler] 31 + fn did_doc(TypedHeader(host): TypedHeader<Host>, service: Data<&DidService>) -> Json<DidDoc> { 32 + Json(DidDoc { 33 + id: format!("did:web:{}", host.hostname()), 34 + service: [service.clone()], 35 + }) 36 + } 37 + 38 + #[derive(Deserialize)] 39 + struct AskQuery { 40 + domain: String, 41 + } 42 + #[handler] 43 + fn ask_caddy( 44 + Data(parent): Data<&Option<String>>, 45 + Query(AskQuery { domain }): Query<AskQuery>, 46 + ) -> Response { 47 + if let Some(parent) = parent 48 + && let Some(prefix) = domain.strip_suffix(&format!(".{parent}")) 49 + && !prefix.contains('.') 50 + { 51 + // no sub-sub-domains allowed 52 + return Response::builder().body("ok"); 53 + }; 54 + Response::builder() 55 + .status(StatusCode::FORBIDDEN) 56 + .body("nope") 57 + } 58 + 59 + /// Slingshot record edge cache 60 + #[derive(Parser, Debug, Clone)] 61 + #[command(version, about, long_about = None)] 62 + struct Args { 63 + /// The DID document service ID to serve 64 + /// 65 + /// must start with a '#', like `#bsky_appview' 66 + #[arg(long)] 67 + id: String, 68 + /// Service type 69 + /// 70 + /// Not sure exactly what its requirements are. 'BlueskyAppview' for example 71 + #[arg(long)] 72 + r#type: String, 73 + /// The HTTPS endpoint for the service 74 + #[arg(long)] 75 + service_endpoint: String, 76 + /// The parent domain; requests should come from subdomains of this 77 + #[arg(long)] 78 + domain: Option<String>, 79 + } 80 + 81 + impl From<Args> for DidService { 82 + fn from(a: Args) -> Self { 83 + Self { 84 + id: a.id, 85 + r#type: a.r#type, 86 + service_endpoint: a.service_endpoint, 87 + } 88 + } 89 + } 90 + 91 + #[tokio::main(flavor = "current_thread")] 92 + async fn main() { 93 + tracing_subscriber::fmt::init(); 94 + log::info!("ɹoʇɔǝʅⅎǝɹ"); 95 + 96 + let args = Args::parse(); 97 + let domain = args.domain.clone(); 98 + let service: DidService = args.into(); 99 + 100 + Server::new(TcpListener::bind("0.0.0.0:3001")) 101 + .run( 102 + Route::new() 103 + .at("/", get(hello)) 104 + .at("/.well-known/did.json", get(did_doc)) 105 + .at("/ask", get(ask_caddy)) 106 + .with(AddData::new(service)) 107 + .with(AddData::new(domain)) 108 + .with(Tracing), 109 + ) 110 + .await 111 + .unwrap() 112 + }
+1
slingshot/.gitignore
··· 1 + foyer
+31
slingshot/Cargo.toml
··· 1 + [package] 2 + name = "slingshot" 3 + version = "0.1.0" 4 + edition = "2024" 5 + 6 + [dependencies] 7 + atrium-api = { git = "https://github.com/uniphil/atrium.git", branch = "fix/resolve-handle-https-accept-whitespace", default-features = false } 8 + atrium-common = { git = "https://github.com/uniphil/atrium.git", branch = "fix/resolve-handle-https-accept-whitespace" } 9 + atrium-identity = { git = "https://github.com/uniphil/atrium.git", branch = "fix/resolve-handle-https-accept-whitespace" } 10 + atrium-oauth = { git = "https://github.com/uniphil/atrium.git", branch = "fix/resolve-handle-https-accept-whitespace" } 11 + clap = { version = "4.5.41", features = ["derive"] } 12 + ctrlc = "3.4.7" 13 + foyer = { version = "0.18.0", features = ["serde"] } 14 + hickory-resolver = "0.25.2" 15 + jetstream = { path = "../jetstream", features = ["metrics"] } 16 + links = { path = "../links" } 17 + log = "0.4.27" 18 + metrics = "0.24.2" 19 + metrics-exporter-prometheus = { version = "0.17.1", features = ["http-listener"] } 20 + poem = { version = "3.1.12", features = ["acme", "static-files"] } 21 + poem-openapi = { version = "5.1.16", features = ["scalar"] } 22 + reqwest = { version = "0.12.22", features = ["json"] } 23 + rustls = "0.23.31" 24 + serde = { version = "1.0.219", features = ["derive"] } 25 + serde_json = { version = "1.0.141", features = ["raw_value"] } 26 + thiserror = "2.0.12" 27 + time = { version = "0.3.41", features = ["serde"] } 28 + tokio = { version = "1.47.0", features = ["full"] } 29 + tokio-util = "0.7.15" 30 + tracing-subscriber = { version = "0.3.19", features = ["env-filter"] } 31 + url = "2.5.4"
+93
slingshot/api-description.md
··· 1 + _A [gravitational slingshot](https://en.wikipedia.org/wiki/Gravity_assist) makes use of the gravity and relative movements of celestial bodies to accelerate a spacecraft and change its trajectory._ 2 + 3 + 4 + # Slingshot: edge record cache 5 + 6 + Applications in [ATProtocol](https://atproto.com/) store data in users' own [PDS](https://atproto.com/guides/self-hosting) (Personal Data Server), which are distributed across thousands of independently-run servers all over the world. Trying to access this data poses challenges for client applications: 7 + 8 + - A PDS might be far away with long network latency 9 + - or may be on an unreliable connection 10 + - or overloaded when you need it, or offline, or… 11 + 12 + Large projects like [Bluesky](https://bsky.app/) control their performance and reliability by syncing all app-relevant data from PDSs into first-party databases. But for new apps, building out this additional data infrastructure adds significant effort and complexity up front. 13 + 14 + **Slingshot is a fast, eager, production-grade cache of data in the [ATmosphere](https://atproto.com/)**, offering performance and reliability without custom infrastructure. 15 + 16 + 17 + ### Current status 18 + 19 + > [!important] 20 + > Slingshot is currently in a **v0, pre-release state**. There is one production instance and you can use it! Expect short downtimes for restarts as development progresses and lower cache hit-rates as the internal storage caches are adjusted and reset. 21 + 22 + The core APIs will not change, since they are standard third-party `com.atproto` query APIs from ATProtocol. 23 + 24 + 25 + ## Eager caching 26 + 27 + In many cases, Slingshot can cache the data you need *before* first request! 28 + 29 + Slingshot subscribes to the global [Firehose](https://atproto.com/specs/sync#firehose) of data updates. It keeps a short-term rolling indexed window of *all* data, and automatically promotes content likely to be requested to its longer-term main cache. _(automatic promotion is still a work in progress)_ 30 + 31 + When there is a cache miss, Slingshot can often still accelerate record fetching, since it keeps a large cache of resolved identities: it can usually request from the correct PDS without extra lookups. 32 + 33 + 34 + ## Precise invalidation 35 + 36 + The fireshose includes **update** and **delete** events, which Slingshot uses to ensure stale and deleted data is removed within a very short window. Additonally, identity and account-level events can trigger rapid cleanup of data for deactivated and deleted accounts. _(some of this is still a work in progress)_ 37 + 38 + 39 + ## Low-trust 40 + 41 + The "AT" in ATProtocol [stands for _Authenticated Transfer_](https://atproto.com/guides/glossary#at-protocol): all data is cryptographically signed, which makes it possible to broadcast data through third parties and trust that it's real _without_ having to directly contact the originating server. 42 + 43 + Two core standard query APIs are supported to balance convenience and trust. They both fetch [records](https://atproto.com/guides/glossary#record): 44 + 45 + ### [`com.atproto.repo.getRecord`](#tag/comatproto-queries/get/xrpc/com.atproto.repo.getRecord) 46 + 47 + - convenient `JSON` response format 48 + - cannot be proven authentic 49 + 50 + ### [`com.atproto.sync.getRecord`](#tag/comatproto-queries/get/xrpc/com.atproto.sync.getRecord) 51 + 52 + - [`DAG-CBOR`](https://atproto.com/specs/data-model)-encoded response requires extra libraries to decode, but 53 + - includes a cryptographic proof of authenticity! 54 + 55 + _(work on this endpoint is in progress)_ 56 + 57 + 58 + ## Service proxying 59 + 60 + Clients can proxy atproto queries through their own PDS with [Service Proxying](https://atproto.com/specs/xrpc#service-proxying), and this is supported by Slingshot. The Slingshot instance must be started the `--domain` argument specified. 61 + 62 + Service-proxied requests can specify a Slingshot instance via the `atproto-proxy` header: 63 + 64 + ```http 65 + GET /xrpc/com.bad-example.identity.resolveMiniDoc?identifier=bad-example.com 66 + Host: <your pds> 67 + atproto-proxy: did:web:<slingshot domain>#slingshot 68 + ``` 69 + 70 + Where `<your pds>` is the user's own PDS host, and `<slingshot domain>` is the domain that the slingshot instance is deployed at (eg. `slingshot.microcosm.blue`). See the [Service Proxying](https://atproto.com/specs/xrpc#service-proxying) docs for more. 71 + 72 + > [!tip] 73 + > Service proxying is supported but completely optional. All APIs are directly accessible over the public internet, and GeoDNS helps route users to the closest instance to them for the lowest possible latency. (_note: deploying multiple slingshot instances with GeoDNS is still TODO_) 74 + 75 + 76 + ## Ergonomic APIs 77 + 78 + - Slingshot also offers variants of the `getRecord` endpoints that accept a full `at-uri` as a parameter, to save clients from needing to parse and validate all parts of a record location. 79 + 80 + - Bi-directionally verifying identity endpoints, so you can directly exchange atproto [`handle`](https://atproto.com/guides/glossary#handle)s for [`DID`](https://atproto.com/guides/glossary#did-decentralized-id)s without extra steps, plus a convenient [Mini-Doc](#tag/slingshot-specific-queries/get/xrpc/com.bad-example.identity.resolveMiniDoc) verified identity summary. 81 + 82 + 83 + ## Part of microcosm 84 + 85 + [Microcosm](https://www.microcosm.blue/) is a collection of services and independent community-run infrastructure for ATProtocol. 86 + 87 + Slingshot excels when combined with _shallow indexing_ services, which offer fast queries of global data relationships but with only references to the data records. Microcosm has a few! 88 + 89 + - [🌌 Constellation](https://constellation.microcosm.blue/), a global backlink index (all social interactions in atproto are links!) 90 + - [🎇 Spacedust](https://spacedust.microcosm.blue/), a firehose of all social interactions 91 + 92 + > [!success] 93 + > All microcosm projects are [open source](https://tangled.sh/@bad-example.com/microcosm-links). **You can help sustain Slingshot** and all of microcosm by becoming a [Github sponsor](https://github.com/sponsors/uniphil/) or a [Ko-fi supporter](https://ko-fi.com/bad_example)!
+7
slingshot/readme.md
··· 1 + # slingshot: atproto record edge cache 2 + 3 + local dev running: 4 + 5 + ```bash 6 + RUST_LOG=info,slingshot=trace ulimit -n 4096 && RUST_LOG=info cargo run -- --jetstream us-east-1 --cache-dir ./foyer 7 + ```
+80
slingshot/src/consumer.rs
··· 1 + use crate::CachedRecord; 2 + use crate::error::ConsumerError; 3 + use foyer::HybridCache; 4 + use jetstream::{ 5 + DefaultJetstreamEndpoints, JetstreamCompression, JetstreamConfig, JetstreamConnector, 6 + events::{CommitOp, Cursor, EventKind}, 7 + }; 8 + use tokio_util::sync::CancellationToken; 9 + 10 + pub async fn consume( 11 + jetstream_endpoint: String, 12 + cursor: Option<Cursor>, 13 + no_zstd: bool, 14 + shutdown: CancellationToken, 15 + cache: HybridCache<String, CachedRecord>, 16 + ) -> Result<(), ConsumerError> { 17 + let endpoint = DefaultJetstreamEndpoints::endpoint_or_shortcut(&jetstream_endpoint); 18 + if endpoint == jetstream_endpoint { 19 + log::info!("consumer: connecting jetstream at {endpoint}"); 20 + } else { 21 + log::info!("consumer: connecting jetstream at {jetstream_endpoint} => {endpoint}"); 22 + } 23 + let config: JetstreamConfig = JetstreamConfig { 24 + endpoint, 25 + compression: if no_zstd { 26 + JetstreamCompression::None 27 + } else { 28 + JetstreamCompression::Zstd 29 + }, 30 + replay_on_reconnect: true, 31 + channel_size: 1024, // buffer up to ~1s of jetstream events 32 + ..Default::default() 33 + }; 34 + let mut receiver = JetstreamConnector::new(config)? 35 + .connect_cursor(cursor) 36 + .await?; 37 + 38 + log::info!("consumer: receiving messages.."); 39 + loop { 40 + if shutdown.is_cancelled() { 41 + log::info!("consumer: exiting for shutdown"); 42 + return Ok(()); 43 + } 44 + let Some(mut event) = receiver.recv().await else { 45 + log::error!("consumer: could not receive event, bailing"); 46 + break; 47 + }; 48 + 49 + if event.kind != EventKind::Commit { 50 + continue; 51 + } 52 + let Some(ref mut commit) = event.commit else { 53 + log::warn!("consumer: commit event missing commit data, ignoring"); 54 + continue; 55 + }; 56 + 57 + // TODO: something a bit more robust 58 + let at_uri = format!( 59 + "at://{}/{}/{}", 60 + &*event.did, &*commit.collection, &*commit.rkey 61 + ); 62 + 63 + if commit.operation == CommitOp::Delete { 64 + cache.insert(at_uri, CachedRecord::Deleted); 65 + } else { 66 + let Some(record) = commit.record.take() else { 67 + log::warn!("consumer: commit insert or update missing record, ignoring"); 68 + continue; 69 + }; 70 + let Some(cid) = commit.cid.take() else { 71 + log::warn!("consumer: commit insert or update missing CID, ignoring"); 72 + continue; 73 + }; 74 + 75 + cache.insert(at_uri, CachedRecord::Found((cid, record).into())); 76 + } 77 + } 78 + 79 + Err(ConsumerError::JetstreamEnded) 80 + }
+93
slingshot/src/error.rs
··· 1 + use crate::ErrorResponseObject; 2 + use thiserror::Error; 3 + 4 + #[derive(Debug, Error)] 5 + pub enum ConsumerError { 6 + #[error(transparent)] 7 + JetstreamConnectionError(#[from] jetstream::error::ConnectionError), 8 + #[error(transparent)] 9 + JetstreamConfigValidationError(#[from] jetstream::error::ConfigValidationError), 10 + #[error("jetstream ended")] 11 + JetstreamEnded, 12 + #[error("delay queue output dropped")] 13 + DelayQueueOutputDropped, 14 + } 15 + 16 + #[derive(Debug, Error)] 17 + pub enum ServerError { 18 + #[error("server build error: {0}")] 19 + AcmeBuildError(std::io::Error), 20 + #[error("server exited: {0}")] 21 + ServerExited(std::io::Error), 22 + } 23 + 24 + #[derive(Debug, Error)] 25 + pub enum IdentityError { 26 + #[error("whatever: {0}")] 27 + WhateverError(String), 28 + #[error("bad DID: {0}")] 29 + BadDid(&'static str), 30 + #[error("identity types got mixed up: {0}")] 31 + IdentityValTypeMixup(String), 32 + #[error("foyer error: {0}")] 33 + FoyerError(#[from] foyer::Error), 34 + 35 + #[error("failed to resolve: {0}")] 36 + ResolutionFailed(#[from] atrium_identity::Error), 37 + // #[error("identity resolved but no handle found for user")] 38 + // NoHandle, 39 + #[error("found handle {0:?} but it appears invalid: {1}")] 40 + InvalidHandle(String, &'static str), 41 + 42 + #[error("could not convert atrium did doc to partial mini doc: {0}")] 43 + BadDidDoc(String), 44 + 45 + #[error("wrong key for clearing refresh queue: {0}")] 46 + RefreshQueueKeyError(&'static str), 47 + } 48 + 49 + #[derive(Debug, Error)] 50 + pub enum HealthCheckError { 51 + #[error("failed to send checkin: {0}")] 52 + HealthCheckError(#[from] reqwest::Error), 53 + } 54 + 55 + #[derive(Debug, Error)] 56 + pub enum MainTaskError { 57 + #[error(transparent)] 58 + ConsumerTaskError(#[from] ConsumerError), 59 + #[error(transparent)] 60 + ServerTaskError(#[from] ServerError), 61 + #[error(transparent)] 62 + IdentityTaskError(#[from] IdentityError), 63 + #[error(transparent)] 64 + HealthCheckError(#[from] HealthCheckError), 65 + #[error("firehose cache failed to close: {0}")] 66 + FirehoseCacheCloseError(foyer::Error), 67 + } 68 + 69 + #[derive(Debug, Error)] 70 + pub enum RecordError { 71 + #[error("identity error: {0}")] 72 + IdentityError(#[from] IdentityError), 73 + #[error("repo could not be validated as either a DID or an atproto handle")] 74 + BadRepo, 75 + #[error("could not get record: {0}")] 76 + NotFound(&'static str), 77 + #[error("could nto parse pds url: {0}")] 78 + UrlParseError(#[from] url::ParseError), 79 + #[error("reqwest send failed: {0}")] 80 + SendError(reqwest::Error), 81 + #[error("reqwest raised for status: {0}")] 82 + StatusError(reqwest::Error), 83 + #[error("reqwest failed to parse json: {0}")] 84 + ParseJsonError(reqwest::Error), 85 + #[error("upstream getRecord did not include a CID")] 86 + MissingUpstreamCid, 87 + #[error("upstream CID was not valid: {0}")] 88 + BadUpstreamCid(String), 89 + #[error("upstream atproto-looking bad request")] 90 + UpstreamBadRequest(ErrorResponseObject), 91 + #[error("upstream non-atproto bad request")] 92 + UpstreamBadBadNotGoodRequest(reqwest::Error), 93 + }
+22
slingshot/src/firehose_cache.rs
··· 1 + use crate::CachedRecord; 2 + use foyer::{DirectFsDeviceOptions, Engine, HybridCache, HybridCacheBuilder}; 3 + use std::path::Path; 4 + 5 + pub async fn firehose_cache( 6 + cache_dir: impl AsRef<Path>, 7 + ) -> Result<HybridCache<String, CachedRecord>, String> { 8 + let cache = HybridCacheBuilder::new() 9 + .with_name("firehose") 10 + .memory(64 * 2_usize.pow(20)) 11 + .with_weighter(|k: &String, v| k.len() + std::mem::size_of_val(v)) 12 + .storage(Engine::large()) 13 + .with_device_options( 14 + DirectFsDeviceOptions::new(cache_dir) 15 + .with_capacity(2_usize.pow(30)) // TODO: configurable (1GB to have something) 16 + .with_file_size(16 * 2_usize.pow(20)), // note: this does limit the max cached item size, warning jumbo records 17 + ) 18 + .build() 19 + .await 20 + .map_err(|e| format!("foyer setup error: {e:?}"))?; 21 + Ok(cache) 22 + }
+32
slingshot/src/healthcheck.rs
··· 1 + use crate::error::HealthCheckError; 2 + use reqwest::Client; 3 + use std::time::Duration; 4 + use tokio::time::sleep; 5 + use tokio_util::sync::CancellationToken; 6 + 7 + pub async fn healthcheck( 8 + endpoint: String, 9 + shutdown: CancellationToken, 10 + ) -> Result<(), HealthCheckError> { 11 + let client = Client::builder() 12 + .user_agent(format!( 13 + "microcosm slingshot v{} (dev: @bad-example.com)", 14 + env!("CARGO_PKG_VERSION") 15 + )) 16 + .no_proxy() 17 + .timeout(Duration::from_secs(10)) 18 + .build()?; 19 + 20 + loop { 21 + tokio::select! { 22 + res = client.get(&endpoint).send() => { 23 + let _ = res 24 + .and_then(|r| r.error_for_status()) 25 + .inspect_err(|e| log::error!("failed to send healthcheck: {e}")); 26 + }, 27 + _ = shutdown.cancelled() => break, 28 + } 29 + sleep(Duration::from_secs(51)).await; 30 + } 31 + Ok(()) 32 + }
+525
slingshot/src/identity.rs
··· 1 + use hickory_resolver::{ResolveError, TokioResolver}; 2 + use std::collections::{HashSet, VecDeque}; 3 + use std::path::Path; 4 + use std::sync::Arc; 5 + /// for now we're gonna just keep doing more cache 6 + /// 7 + /// plc.director x foyer, ttl kept with data, refresh deferred to background on fetch 8 + /// 9 + /// things we need: 10 + /// 11 + /// 1. handle -> DID resolution: getRecord must accept a handle for `repo` param 12 + /// 2. DID -> PDS resolution: so we know where to getRecord 13 + /// 3. DID -> handle resolution: for bidirectional handle validation and in case we want to offer this 14 + use std::time::Duration; 15 + use tokio::sync::Mutex; 16 + use tokio_util::sync::CancellationToken; 17 + 18 + use crate::error::IdentityError; 19 + use atrium_api::{ 20 + did_doc::DidDocument, 21 + types::string::{Did, Handle}, 22 + }; 23 + use atrium_common::resolver::Resolver; 24 + use atrium_identity::{ 25 + did::{CommonDidResolver, CommonDidResolverConfig, DEFAULT_PLC_DIRECTORY_URL}, 26 + handle::{AtprotoHandleResolver, AtprotoHandleResolverConfig, DnsTxtResolver}, 27 + }; 28 + use atrium_oauth::DefaultHttpClient; // it's probably not worth bringing all of atrium_oauth for this but 29 + use foyer::{DirectFsDeviceOptions, Engine, HybridCache, HybridCacheBuilder}; 30 + use serde::{Deserialize, Serialize}; 31 + use time::UtcDateTime; 32 + 33 + /// once we have something resolved, don't re-resolve until after this period 34 + const MIN_TTL: Duration = Duration::from_secs(4 * 3600); // probably shoudl have a max ttl 35 + const MIN_NOT_FOUND_TTL: Duration = Duration::from_secs(60); 36 + 37 + #[derive(Debug, Clone, Hash, PartialEq, Eq, Serialize, Deserialize)] 38 + enum IdentityKey { 39 + Handle(Handle), 40 + Did(Did), 41 + } 42 + 43 + #[derive(Debug, Serialize, Deserialize)] 44 + struct IdentityVal(UtcDateTime, IdentityData); 45 + 46 + #[derive(Debug, Serialize, Deserialize)] 47 + enum IdentityData { 48 + NotFound, 49 + Did(Did), 50 + Doc(PartialMiniDoc), 51 + } 52 + 53 + /// partial representation of a com.bad-example.identity mini atproto doc 54 + /// 55 + /// partial because the handle is not verified 56 + #[derive(Debug, Clone, Serialize, Deserialize)] 57 + pub struct PartialMiniDoc { 58 + /// an atproto handle (**unverified**) 59 + /// 60 + /// the first valid atproto handle from the did doc's aka 61 + pub unverified_handle: Handle, 62 + /// the did's atproto pds url (TODO: type this?) 63 + /// 64 + /// note: atrium *does* actually parse it into a URI, it just doesn't return 65 + /// that for some reason 66 + pub pds: String, 67 + /// for now we're just pulling this straight from the did doc 68 + /// 69 + /// would be nice to type and validate it 70 + /// 71 + /// this is the publicKeyMultibase from the did doc. 72 + /// legacy key encoding not supported. 73 + /// `id`, `type`, and `controller` must be checked, but aren't stored. 74 + pub signing_key: String, 75 + } 76 + 77 + impl TryFrom<DidDocument> for PartialMiniDoc { 78 + type Error = String; 79 + fn try_from(did_doc: DidDocument) -> Result<Self, Self::Error> { 80 + // must use the first valid handle 81 + let mut unverified_handle = None; 82 + let Some(ref doc_akas) = did_doc.also_known_as else { 83 + return Err("did doc missing `also_known_as`".to_string()); 84 + }; 85 + for aka in doc_akas { 86 + let Some(maybe_handle) = aka.strip_prefix("at://") else { 87 + continue; 88 + }; 89 + let Ok(valid_handle) = Handle::new(maybe_handle.to_string()) else { 90 + continue; 91 + }; 92 + unverified_handle = Some(valid_handle); 93 + break; 94 + } 95 + let Some(unverified_handle) = unverified_handle else { 96 + return Err("no valid atproto handles in `also_known_as`".to_string()); 97 + }; 98 + 99 + // atrium seems to get service endpoint getters 100 + let Some(pds) = did_doc.get_pds_endpoint() else { 101 + return Err("no valid pds service found".to_string()); 102 + }; 103 + 104 + // TODO can't use atrium's get_signing_key() becuase it fails to check type and controller 105 + // so if we check those and reject it, we might miss a later valid key in the array 106 + // (todo is to fix atrium) 107 + // actually: atrium might be flexible for legacy reps. for now we're rejecting legacy rep. 108 + 109 + // must use the first valid signing key 110 + let mut signing_key = None; 111 + let Some(verification_methods) = did_doc.verification_method else { 112 + return Err("no verification methods found".to_string()); 113 + }; 114 + for method in verification_methods { 115 + if method.id != format!("{}#atproto", did_doc.id) { 116 + continue; 117 + } 118 + if method.r#type != "Multikey" { 119 + continue; 120 + } 121 + if method.controller != did_doc.id { 122 + continue; 123 + } 124 + let Some(key) = method.public_key_multibase else { 125 + continue; 126 + }; 127 + signing_key = Some(key); 128 + break; 129 + } 130 + let Some(signing_key) = signing_key else { 131 + return Err("no valid atproto signing key found in verification methods".to_string()); 132 + }; 133 + 134 + Ok(PartialMiniDoc { 135 + unverified_handle, 136 + pds, 137 + signing_key, 138 + }) 139 + } 140 + } 141 + 142 + /// multi-producer *single-consumer* queue structures (wrap in arc-mutex plz) 143 + /// 144 + /// the hashset allows testing for presense of items in the queue. 145 + /// this has absolutely no support for multiple queue consumers. 146 + #[derive(Debug, Default)] 147 + struct RefreshQueue { 148 + queue: VecDeque<IdentityKey>, 149 + items: HashSet<IdentityKey>, 150 + } 151 + 152 + #[derive(Clone)] 153 + pub struct Identity { 154 + handle_resolver: Arc<AtprotoHandleResolver<HickoryDnsTxtResolver, DefaultHttpClient>>, 155 + did_resolver: Arc<CommonDidResolver<DefaultHttpClient>>, 156 + cache: HybridCache<IdentityKey, IdentityVal>, 157 + /// multi-producer *single consumer* queue 158 + refresh_queue: Arc<Mutex<RefreshQueue>>, 159 + /// just a lock to ensure only one refresher (queue consumer) is running (to be improved with a better refresher) 160 + refresher: Arc<Mutex<()>>, 161 + } 162 + 163 + impl Identity { 164 + pub async fn new(cache_dir: impl AsRef<Path>) -> Result<Self, IdentityError> { 165 + let http_client = Arc::new(DefaultHttpClient::default()); 166 + let handle_resolver = AtprotoHandleResolver::new(AtprotoHandleResolverConfig { 167 + dns_txt_resolver: HickoryDnsTxtResolver::new().unwrap(), 168 + http_client: http_client.clone(), 169 + }); 170 + let did_resolver = CommonDidResolver::new(CommonDidResolverConfig { 171 + plc_directory_url: DEFAULT_PLC_DIRECTORY_URL.to_string(), 172 + http_client: http_client.clone(), 173 + }); 174 + 175 + let cache = HybridCacheBuilder::new() 176 + .with_name("identity") 177 + .memory(16 * 2_usize.pow(20)) 178 + .with_weighter(|k, v| std::mem::size_of_val(k) + std::mem::size_of_val(v)) 179 + .storage(Engine::small()) 180 + .with_device_options( 181 + DirectFsDeviceOptions::new(cache_dir) 182 + .with_capacity(2_usize.pow(30)) // TODO: configurable (1GB to have something) 183 + .with_file_size(2_usize.pow(20)), // note: this does limit the max cached item size, warning jumbo records 184 + ) 185 + .build() 186 + .await?; 187 + 188 + Ok(Self { 189 + handle_resolver: Arc::new(handle_resolver), 190 + did_resolver: Arc::new(did_resolver), 191 + cache, 192 + refresh_queue: Default::default(), 193 + refresher: Default::default(), 194 + }) 195 + } 196 + 197 + /// Resolve (and verify!) an atproto handle to a DID 198 + /// 199 + /// The result can be stale 200 + /// 201 + /// `None` if the handle can't be found or verification fails 202 + pub async fn handle_to_did(&self, handle: Handle) -> Result<Option<Did>, IdentityError> { 203 + let Some(did) = self.handle_to_unverified_did(&handle).await? else { 204 + return Ok(None); 205 + }; 206 + let Some(doc) = self.did_to_partial_mini_doc(&did).await? else { 207 + return Ok(None); 208 + }; 209 + if doc.unverified_handle != handle { 210 + return Ok(None); 211 + } 212 + Ok(Some(did)) 213 + } 214 + 215 + /// Resolve a DID to a pds url 216 + /// 217 + /// This *also* incidentally resolves and verifies the handle, which might 218 + /// make it slower than expected 219 + pub async fn did_to_pds(&self, did: Did) -> Result<Option<String>, IdentityError> { 220 + let Some(mini_doc) = self.did_to_partial_mini_doc(&did).await? else { 221 + return Ok(None); 222 + }; 223 + Ok(Some(mini_doc.pds)) 224 + } 225 + 226 + /// Resolve (and cache but **not verify**) a handle to a DID 227 + async fn handle_to_unverified_did( 228 + &self, 229 + handle: &Handle, 230 + ) -> Result<Option<Did>, IdentityError> { 231 + let key = IdentityKey::Handle(handle.clone()); 232 + let entry = self 233 + .cache 234 + .fetch(key.clone(), { 235 + let handle = handle.clone(); 236 + let resolver = self.handle_resolver.clone(); 237 + || async move { 238 + match resolver.resolve(&handle).await { 239 + Ok(did) => Ok(IdentityVal(UtcDateTime::now(), IdentityData::Did(did))), 240 + Err(atrium_identity::Error::NotFound) => { 241 + Ok(IdentityVal(UtcDateTime::now(), IdentityData::NotFound)) 242 + } 243 + Err(other) => Err(foyer::Error::Other(Box::new({ 244 + log::debug!("other error resolving handle: {other:?}"); 245 + IdentityError::ResolutionFailed(other) 246 + }))), 247 + } 248 + } 249 + }) 250 + .await?; 251 + 252 + let now = UtcDateTime::now(); 253 + let IdentityVal(last_fetch, data) = entry.value(); 254 + match data { 255 + IdentityData::Doc(_) => { 256 + log::error!("identity value mixup: got a doc from a handle key (should be a did)"); 257 + Err(IdentityError::IdentityValTypeMixup(handle.to_string())) 258 + } 259 + IdentityData::NotFound => { 260 + if (now - *last_fetch) >= MIN_NOT_FOUND_TTL { 261 + self.queue_refresh(key).await; 262 + } 263 + Ok(None) 264 + } 265 + IdentityData::Did(did) => { 266 + if (now - *last_fetch) >= MIN_TTL { 267 + self.queue_refresh(key).await; 268 + } 269 + Ok(Some(did.clone())) 270 + } 271 + } 272 + } 273 + 274 + /// Fetch (and cache) a partial mini doc from a did 275 + pub async fn did_to_partial_mini_doc( 276 + &self, 277 + did: &Did, 278 + ) -> Result<Option<PartialMiniDoc>, IdentityError> { 279 + let key = IdentityKey::Did(did.clone()); 280 + let entry = self 281 + .cache 282 + .fetch(key.clone(), { 283 + let did = did.clone(); 284 + let resolver = self.did_resolver.clone(); 285 + || async move { 286 + match resolver.resolve(&did).await { 287 + Ok(did_doc) => { 288 + // TODO: fix in atrium: should verify id is did 289 + if did_doc.id != did.to_string() { 290 + return Err(foyer::Error::other(Box::new( 291 + IdentityError::BadDidDoc( 292 + "did doc's id did not match did".to_string(), 293 + ), 294 + ))); 295 + } 296 + let mini_doc = did_doc.try_into().map_err(|e| { 297 + foyer::Error::Other(Box::new(IdentityError::BadDidDoc(e))) 298 + })?; 299 + Ok(IdentityVal(UtcDateTime::now(), IdentityData::Doc(mini_doc))) 300 + } 301 + Err(atrium_identity::Error::NotFound) => { 302 + Ok(IdentityVal(UtcDateTime::now(), IdentityData::NotFound)) 303 + } 304 + Err(other) => Err(foyer::Error::Other(Box::new( 305 + IdentityError::ResolutionFailed(other), 306 + ))), 307 + } 308 + } 309 + }) 310 + .await?; 311 + 312 + let now = UtcDateTime::now(); 313 + let IdentityVal(last_fetch, data) = entry.value(); 314 + match data { 315 + IdentityData::Did(_) => { 316 + log::error!("identity value mixup: got a did from a did key (should be a doc)"); 317 + Err(IdentityError::IdentityValTypeMixup(did.to_string())) 318 + } 319 + IdentityData::NotFound => { 320 + if (now - *last_fetch) >= MIN_NOT_FOUND_TTL { 321 + self.queue_refresh(key).await; 322 + } 323 + Ok(None) 324 + } 325 + IdentityData::Doc(mini_did) => { 326 + if (now - *last_fetch) >= MIN_TTL { 327 + self.queue_refresh(key).await; 328 + } 329 + Ok(Some(mini_did.clone())) 330 + } 331 + } 332 + } 333 + 334 + /// put a refresh task on the queue 335 + /// 336 + /// this can be safely called from multiple concurrent tasks 337 + async fn queue_refresh(&self, key: IdentityKey) { 338 + // todo: max queue size 339 + let mut q = self.refresh_queue.lock().await; 340 + if !q.items.contains(&key) { 341 + q.items.insert(key.clone()); 342 + q.queue.push_back(key); 343 + } 344 + } 345 + 346 + /// find out what's next in the queue. concurrent consumers are not allowed. 347 + /// 348 + /// intent is to leave the item in the queue while refreshing, so that a 349 + /// producer will not re-add it if it's in progress. there's definitely 350 + /// better ways to do this, but this is ~simple for as far as a single 351 + /// consumer can take us. 352 + /// 353 + /// we could take it from the queue but leave it in the set and remove from 354 + /// set later, but splitting them apart feels more bug-prone. 355 + async fn peek_refresh(&self) -> Option<IdentityKey> { 356 + let q = self.refresh_queue.lock().await; 357 + q.queue.front().cloned() 358 + } 359 + 360 + /// call to clear the latest key from the refresh queue. concurrent consumers not allowed. 361 + /// 362 + /// must provide the last peeked refresh queue item as a small safety check 363 + async fn complete_refresh(&self, key: &IdentityKey) -> Result<(), IdentityError> { 364 + let mut q = self.refresh_queue.lock().await; 365 + 366 + let Some(queue_key) = q.queue.pop_front() else { 367 + // gone from queue + since we're in an error condition, make sure it's not stuck in items 368 + // (not toctou because we have the lock) 369 + // bolder here than below and removing from items because if the queue is *empty*, then we 370 + // know it hasn't been re-added since losing sync. 371 + if q.items.remove(key) { 372 + log::error!("identity refresh: queue de-sync: not in "); 373 + } else { 374 + log::warn!( 375 + "identity refresh: tried to complete with wrong key. are multiple queue consumers running?" 376 + ); 377 + } 378 + return Err(IdentityError::RefreshQueueKeyError("no key in queue")); 379 + }; 380 + 381 + if queue_key != *key { 382 + // extra weird case here, what's the most defensive behaviour? 383 + // we have two keys: ours should have been first but isn't. this shouldn't happen, so let's 384 + // just leave items alone for it. risks unbounded growth but we're in a bad place already. 385 + // the other key is the one we just popped. we didn't want it, so maybe we should put it 386 + // back, BUT if we somehow ended up with concurrent consumers, we have bigger problems. take 387 + // responsibility for taking it instead: remove it from items as well, and just drop it. 388 + // 389 + // hope that whoever calls us takes this error seriously. 390 + if q.items.remove(&queue_key) { 391 + log::warn!( 392 + "identity refresh: queue de-sync + dropping a bystander key without refreshing it!" 393 + ); 394 + } else { 395 + // you thought things couldn't get weirder? (i mean hopefully they can't) 396 + log::error!("identity refresh: queue de-sync + bystander key also de-sync!?"); 397 + } 398 + return Err(IdentityError::RefreshQueueKeyError( 399 + "wrong key at front of queue", 400 + )); 401 + } 402 + 403 + if q.items.remove(key) { 404 + Ok(()) 405 + } else { 406 + log::error!("identity refresh: queue de-sync: key not in items"); 407 + Err(IdentityError::RefreshQueueKeyError("key not in items")) 408 + } 409 + } 410 + 411 + /// run the refresh queue consumer 412 + pub async fn run_refresher(&self, shutdown: CancellationToken) -> Result<(), IdentityError> { 413 + let _guard = self 414 + .refresher 415 + .try_lock() 416 + .expect("there to only be one refresher running"); 417 + loop { 418 + if shutdown.is_cancelled() { 419 + log::info!("identity refresher: exiting for shutdown: closing cache..."); 420 + if let Err(e) = self.cache.close().await { 421 + log::error!("cache close errored: {e}"); 422 + } else { 423 + log::info!("identity cache closed.") 424 + } 425 + return Ok(()); 426 + } 427 + let Some(task_key) = self.peek_refresh().await else { 428 + tokio::time::sleep(tokio::time::Duration::from_millis(100)).await; 429 + continue; 430 + }; 431 + match task_key { 432 + IdentityKey::Handle(ref handle) => { 433 + log::trace!("refreshing handle {handle:?}"); 434 + match self.handle_resolver.resolve(handle).await { 435 + Ok(did) => { 436 + self.cache.insert( 437 + task_key.clone(), 438 + IdentityVal(UtcDateTime::now(), IdentityData::Did(did)), 439 + ); 440 + } 441 + Err(atrium_identity::Error::NotFound) => { 442 + self.cache.insert( 443 + task_key.clone(), 444 + IdentityVal(UtcDateTime::now(), IdentityData::NotFound), 445 + ); 446 + } 447 + Err(err) => { 448 + log::warn!( 449 + "failed to refresh handle: {err:?}. leaving stale (should we eventually do something?)" 450 + ); 451 + } 452 + } 453 + self.complete_refresh(&task_key).await?; // failures are bugs, so break loop 454 + } 455 + IdentityKey::Did(ref did) => { 456 + log::trace!("refreshing did doc: {did:?}"); 457 + 458 + match self.did_resolver.resolve(did).await { 459 + Ok(did_doc) => { 460 + // TODO: fix in atrium: should verify id is did 461 + if did_doc.id != did.to_string() { 462 + log::warn!( 463 + "refreshed did doc failed: wrong did doc id. dropping refresh." 464 + ); 465 + continue; 466 + } 467 + let mini_doc = match did_doc.try_into() { 468 + Ok(md) => md, 469 + Err(e) => { 470 + log::warn!( 471 + "converting mini doc failed: {e:?}. dropping refresh." 472 + ); 473 + continue; 474 + } 475 + }; 476 + self.cache.insert( 477 + task_key.clone(), 478 + IdentityVal(UtcDateTime::now(), IdentityData::Doc(mini_doc)), 479 + ); 480 + } 481 + Err(atrium_identity::Error::NotFound) => { 482 + self.cache.insert( 483 + task_key.clone(), 484 + IdentityVal(UtcDateTime::now(), IdentityData::NotFound), 485 + ); 486 + } 487 + Err(err) => { 488 + log::warn!( 489 + "failed to refresh did doc: {err:?}. leaving stale (should we eventually do something?)" 490 + ); 491 + } 492 + } 493 + 494 + self.complete_refresh(&task_key).await?; // failures are bugs, so break loop 495 + } 496 + } 497 + } 498 + } 499 + } 500 + 501 + pub struct HickoryDnsTxtResolver(TokioResolver); 502 + 503 + impl HickoryDnsTxtResolver { 504 + fn new() -> Result<Self, ResolveError> { 505 + Ok(Self(TokioResolver::builder_tokio()?.build())) 506 + } 507 + } 508 + 509 + impl DnsTxtResolver for HickoryDnsTxtResolver { 510 + async fn resolve( 511 + &self, 512 + query: &str, 513 + ) -> core::result::Result<Vec<String>, Box<dyn std::error::Error + Send + Sync>> { 514 + match self.0.txt_lookup(query).await { 515 + Ok(r) => { 516 + metrics::counter!("whoami_resolve_dns_txt", "success" => "true").increment(1); 517 + Ok(r.iter().map(|r| r.to_string()).collect()) 518 + } 519 + Err(e) => { 520 + metrics::counter!("whoami_resolve_dns_txt", "success" => "false").increment(1); 521 + Err(e.into()) 522 + } 523 + } 524 + } 525 + }
+14
slingshot/src/lib.rs
··· 1 + mod consumer; 2 + pub mod error; 3 + mod firehose_cache; 4 + mod healthcheck; 5 + mod identity; 6 + mod record; 7 + mod server; 8 + 9 + pub use consumer::consume; 10 + pub use firehose_cache::firehose_cache; 11 + pub use healthcheck::healthcheck; 12 + pub use identity::Identity; 13 + pub use record::{CachedRecord, ErrorResponseObject, Repo}; 14 + pub use server::serve;
+194
slingshot/src/main.rs
··· 1 + // use foyer::HybridCache; 2 + // use foyer::{Engine, DirectFsDeviceOptions, HybridCacheBuilder}; 3 + use metrics_exporter_prometheus::PrometheusBuilder; 4 + use slingshot::{ 5 + Identity, Repo, consume, error::MainTaskError, firehose_cache, healthcheck, serve, 6 + }; 7 + use std::path::PathBuf; 8 + 9 + use clap::Parser; 10 + use tokio_util::sync::CancellationToken; 11 + 12 + /// Slingshot record edge cache 13 + #[derive(Parser, Debug, Clone)] 14 + #[command(version, about, long_about = None)] 15 + struct Args { 16 + /// Jetstream server to connect to (exclusive with --fixture). Provide either a wss:// URL, or a shorhand value: 17 + /// 'us-east-1', 'us-east-2', 'us-west-1', or 'us-west-2' 18 + #[arg(long)] 19 + jetstream: String, 20 + /// don't request zstd-compressed jetstream events 21 + /// 22 + /// reduces CPU at the expense of more ingress bandwidth 23 + #[arg(long, action)] 24 + jetstream_no_zstd: bool, 25 + /// where to keep disk caches 26 + #[arg(long)] 27 + cache_dir: PathBuf, 28 + /// the domain pointing to this server 29 + /// 30 + /// if present: 31 + /// - a did:web document will be served at /.well-known/did.json 32 + /// - an HTTPS certs will be automatically configured with Acme/letsencrypt 33 + /// - TODO: a rate-limiter will be installed 34 + #[arg(long)] 35 + domain: Option<String>, 36 + /// email address for letsencrypt contact 37 + /// 38 + /// recommended in production, i guess? 39 + #[arg(long)] 40 + acme_contact: Option<String>, 41 + /// a location to cache acme https certs 42 + /// 43 + /// only used if --host is specified. omitting requires re-requesting certs 44 + /// on every restart, and letsencrypt has rate limits that are easy to hit. 45 + /// 46 + /// recommended in production, but mind the file permissions. 47 + #[arg(long)] 48 + certs: Option<PathBuf>, 49 + /// an web address to send healtcheck pings to every ~51s or so 50 + #[arg(long)] 51 + healthcheck: Option<String>, 52 + } 53 + 54 + #[tokio::main] 55 + async fn main() -> Result<(), String> { 56 + tracing_subscriber::fmt::init(); 57 + 58 + let shutdown = CancellationToken::new(); 59 + 60 + let ctrlc_shutdown = shutdown.clone(); 61 + ctrlc::set_handler(move || ctrlc_shutdown.cancel()).expect("failed to set ctrl-c handler"); 62 + 63 + let args = Args::parse(); 64 + 65 + if let Err(e) = install_metrics_server() { 66 + log::error!("failed to install metrics server: {e:?}"); 67 + } else { 68 + log::info!("metrics listening at http://0.0.0.0:8765"); 69 + } 70 + 71 + std::fs::create_dir_all(&args.cache_dir).map_err(|e| { 72 + format!( 73 + "failed to ensure cache parent dir: {e:?} (dir: {:?})", 74 + args.cache_dir 75 + ) 76 + })?; 77 + let cache_dir = args.cache_dir.canonicalize().map_err(|e| { 78 + format!( 79 + "failed to canonicalize cache_dir: {e:?} (dir: {:?})", 80 + args.cache_dir 81 + ) 82 + })?; 83 + log::info!("cache dir ready at at {cache_dir:?}."); 84 + 85 + log::info!("setting up firehose cache..."); 86 + let cache = firehose_cache(cache_dir.join("./firehose")).await?; 87 + log::info!("firehose cache ready."); 88 + 89 + let mut tasks: tokio::task::JoinSet<Result<(), MainTaskError>> = tokio::task::JoinSet::new(); 90 + 91 + log::info!("starting identity service..."); 92 + let identity = Identity::new(cache_dir.join("./identity")) 93 + .await 94 + .map_err(|e| format!("identity setup failed: {e:?}"))?; 95 + log::info!("identity service ready."); 96 + let identity_refresher = identity.clone(); 97 + let identity_shutdown = shutdown.clone(); 98 + tasks.spawn(async move { 99 + identity_refresher.run_refresher(identity_shutdown).await?; 100 + Ok(()) 101 + }); 102 + 103 + let repo = Repo::new(identity.clone()); 104 + 105 + let server_shutdown = shutdown.clone(); 106 + let server_cache_handle = cache.clone(); 107 + tasks.spawn(async move { 108 + serve( 109 + server_cache_handle, 110 + identity, 111 + repo, 112 + args.domain, 113 + args.acme_contact, 114 + args.certs, 115 + server_shutdown, 116 + ) 117 + .await?; 118 + Ok(()) 119 + }); 120 + 121 + let consumer_shutdown = shutdown.clone(); 122 + let consumer_cache = cache.clone(); 123 + tasks.spawn(async move { 124 + consume( 125 + args.jetstream, 126 + None, 127 + args.jetstream_no_zstd, 128 + consumer_shutdown, 129 + consumer_cache, 130 + ) 131 + .await?; 132 + Ok(()) 133 + }); 134 + 135 + if let Some(hc) = args.healthcheck { 136 + let healthcheck_shutdown = shutdown.clone(); 137 + tasks.spawn(async move { 138 + healthcheck(hc, healthcheck_shutdown).await?; 139 + Ok(()) 140 + }); 141 + } 142 + 143 + tokio::select! { 144 + _ = shutdown.cancelled() => log::warn!("shutdown requested"), 145 + Some(r) = tasks.join_next() => { 146 + log::warn!("a task exited, shutting down: {r:?}"); 147 + shutdown.cancel(); 148 + } 149 + } 150 + 151 + tasks.spawn(async move { 152 + cache 153 + .close() 154 + .await 155 + .map_err(MainTaskError::FirehoseCacheCloseError) 156 + }); 157 + 158 + tokio::select! { 159 + _ = async { 160 + while let Some(completed) = tasks.join_next().await { 161 + log::info!("shutdown: task completed: {completed:?}"); 162 + } 163 + } => {}, 164 + _ = tokio::time::sleep(std::time::Duration::from_secs(30)) => { 165 + log::info!("shutdown: not all tasks completed on time. aborting..."); 166 + tasks.shutdown().await; 167 + }, 168 + } 169 + 170 + log::info!("bye!"); 171 + 172 + Ok(()) 173 + } 174 + 175 + fn install_metrics_server() -> Result<(), metrics_exporter_prometheus::BuildError> { 176 + log::info!("installing metrics server..."); 177 + let host = [0, 0, 0, 0]; 178 + let port = 8765; 179 + PrometheusBuilder::new() 180 + .set_quantiles(&[0.5, 0.9, 0.99, 1.0])? 181 + .set_bucket_duration(std::time::Duration::from_secs(300))? 182 + .set_bucket_count(std::num::NonZero::new(12).unwrap()) // count * duration = 60 mins. stuff doesn't happen that fast here. 183 + .set_enable_unit_suffix(false) // this seemed buggy for constellation (sometimes wouldn't engage) 184 + .with_http_listener((host, port)) 185 + .install()?; 186 + log::info!( 187 + "metrics server installed! listening on http://{}.{}.{}.{}:{port}", 188 + host[0], 189 + host[1], 190 + host[2], 191 + host[3] 192 + ); 193 + Ok(()) 194 + }
+155
slingshot/src/record.rs
··· 1 + //! cached record storage 2 + 3 + use crate::{Identity, error::RecordError}; 4 + use atrium_api::types::string::{Cid, Did, Nsid, RecordKey}; 5 + use reqwest::{Client, StatusCode}; 6 + use serde::{Deserialize, Serialize}; 7 + use serde_json::value::RawValue; 8 + use std::str::FromStr; 9 + use std::time::Duration; 10 + use url::Url; 11 + 12 + #[derive(Debug, Serialize, Deserialize)] 13 + pub struct RawRecord { 14 + cid: Cid, 15 + record: String, 16 + } 17 + 18 + // TODO: should be able to do typed CID 19 + impl From<(Cid, Box<RawValue>)> for RawRecord { 20 + fn from((cid, rv): (Cid, Box<RawValue>)) -> Self { 21 + Self { 22 + cid, 23 + record: rv.get().to_string(), 24 + } 25 + } 26 + } 27 + 28 + /// only for use with stored (validated) values, not general strings 29 + impl From<&RawRecord> for (Cid, Box<RawValue>) { 30 + fn from(RawRecord { cid, record }: &RawRecord) -> Self { 31 + ( 32 + cid.clone(), 33 + RawValue::from_string(record.to_string()) 34 + .expect("stored string from RawValue to be valid"), 35 + ) 36 + } 37 + } 38 + 39 + #[derive(Debug, Serialize, Deserialize)] 40 + pub enum CachedRecord { 41 + Found(RawRecord), 42 + Deleted, 43 + } 44 + 45 + //////// upstream record fetching 46 + 47 + #[derive(Deserialize)] 48 + struct RecordResponseObject { 49 + #[allow(dead_code)] // expect it to be there but we ignore it 50 + uri: String, 51 + /// CID for this exact version of the record 52 + /// 53 + /// this is optional in the spec and that's potentially TODO for slingshot 54 + cid: Option<String>, 55 + /// the record itself as JSON 56 + value: Box<RawValue>, 57 + } 58 + 59 + #[derive(Debug, Deserialize)] 60 + pub struct ErrorResponseObject { 61 + pub error: String, 62 + pub message: String, 63 + } 64 + 65 + #[derive(Clone)] 66 + pub struct Repo { 67 + identity: Identity, 68 + client: Client, 69 + } 70 + 71 + impl Repo { 72 + pub fn new(identity: Identity) -> Self { 73 + let client = Client::builder() 74 + .user_agent(format!( 75 + "microcosm slingshot v{} (dev: @bad-example.com)", 76 + env!("CARGO_PKG_VERSION") 77 + )) 78 + .no_proxy() 79 + .timeout(Duration::from_secs(10)) 80 + .build() 81 + .unwrap(); 82 + Repo { identity, client } 83 + } 84 + 85 + pub async fn get_record( 86 + &self, 87 + did: &Did, 88 + collection: &Nsid, 89 + rkey: &RecordKey, 90 + cid: &Option<Cid>, 91 + ) -> Result<CachedRecord, RecordError> { 92 + let Some(pds) = self.identity.did_to_pds(did.clone()).await? else { 93 + return Err(RecordError::NotFound("could not get pds for DID")); 94 + }; 95 + 96 + // cid gets set to None for a retry, if it's Some and we got NotFound 97 + let mut cid = cid; 98 + 99 + let res = loop { 100 + // TODO: throttle outgoing requests by host probably, generally guard against outgoing requests 101 + let mut params = vec![ 102 + ("repo", did.to_string()), 103 + ("collection", collection.to_string()), 104 + ("rkey", rkey.to_string()), 105 + ]; 106 + if let Some(cid) = cid { 107 + params.push(("cid", cid.as_ref().to_string())); 108 + } 109 + let mut url = Url::parse_with_params(&pds, &params)?; 110 + url.set_path("/xrpc/com.atproto.repo.getRecord"); 111 + 112 + let res = self 113 + .client 114 + .get(url.clone()) 115 + .send() 116 + .await 117 + .map_err(RecordError::SendError)?; 118 + 119 + if res.status() == StatusCode::BAD_REQUEST { 120 + // 1. if we're not able to parse json, it's not something we can handle 121 + let err = res 122 + .json::<ErrorResponseObject>() 123 + .await 124 + .map_err(RecordError::UpstreamBadBadNotGoodRequest)?; 125 + // 2. if we are, is it a NotFound? and if so, did we try with a CID? 126 + // if so, retry with no CID (api handler will reject for mismatch but 127 + // with a nice error + warm cache) 128 + if err.error == "NotFound" && cid.is_some() { 129 + cid = &None; 130 + continue; 131 + } else { 132 + return Err(RecordError::UpstreamBadRequest(err)); 133 + } 134 + } 135 + break res; 136 + }; 137 + 138 + let data = res 139 + .error_for_status() 140 + .map_err(RecordError::StatusError)? // TODO atproto error handling (think about handling not found) 141 + .json::<RecordResponseObject>() 142 + .await 143 + .map_err(RecordError::ParseJsonError)?; // todo... 144 + 145 + let Some(cid) = data.cid else { 146 + return Err(RecordError::MissingUpstreamCid); 147 + }; 148 + let cid = Cid::from_str(&cid).map_err(|e| RecordError::BadUpstreamCid(e.to_string()))?; 149 + 150 + Ok(CachedRecord::Found(RawRecord { 151 + cid, 152 + record: data.value.to_string(), 153 + })) 154 + } 155 + }
+778
slingshot/src/server.rs
··· 1 + use crate::{ 2 + CachedRecord, ErrorResponseObject, Identity, Repo, 3 + error::{RecordError, ServerError}, 4 + }; 5 + use atrium_api::types::string::{Cid, Did, Handle, Nsid, RecordKey}; 6 + use foyer::HybridCache; 7 + use links::at_uri::parse_at_uri as normalize_at_uri; 8 + use serde::Serialize; 9 + use std::path::PathBuf; 10 + use std::str::FromStr; 11 + use std::sync::Arc; 12 + use tokio_util::sync::CancellationToken; 13 + 14 + use poem::{ 15 + Endpoint, EndpointExt, Route, Server, 16 + endpoint::{StaticFileEndpoint, make_sync}, 17 + http::Method, 18 + listener::{ 19 + Listener, TcpListener, 20 + acme::{AutoCert, LETS_ENCRYPT_PRODUCTION}, 21 + }, 22 + middleware::{CatchPanic, Cors, Tracing}, 23 + }; 24 + use poem_openapi::{ 25 + ApiResponse, ContactObject, ExternalDocumentObject, Object, OpenApi, OpenApiService, Tags, 26 + param::Query, payload::Json, types::Example, 27 + }; 28 + 29 + fn example_handle() -> String { 30 + "bad-example.com".to_string() 31 + } 32 + fn example_did() -> String { 33 + "did:plc:hdhoaan3xa3jiuq4fg4mefid".to_string() 34 + } 35 + fn example_collection() -> String { 36 + "app.bsky.feed.like".to_string() 37 + } 38 + fn example_rkey() -> String { 39 + "3lv4ouczo2b2a".to_string() 40 + } 41 + fn example_uri() -> String { 42 + format!( 43 + "at://{}/{}/{}", 44 + example_did(), 45 + example_collection(), 46 + example_rkey() 47 + ) 48 + } 49 + fn example_pds() -> String { 50 + "https://porcini.us-east.host.bsky.network".to_string() 51 + } 52 + fn example_signing_key() -> String { 53 + "zQ3shpq1g134o7HGDb86CtQFxnHqzx5pZWknrVX2Waum3fF6j".to_string() 54 + } 55 + 56 + #[derive(Object)] 57 + #[oai(example = true)] 58 + struct XrpcErrorResponseObject { 59 + /// Should correspond an error `name` in the lexicon errors array 60 + error: String, 61 + /// Human-readable description and possibly additonal context 62 + message: String, 63 + } 64 + impl Example for XrpcErrorResponseObject { 65 + fn example() -> Self { 66 + Self { 67 + error: "RecordNotFound".to_string(), 68 + message: "This record was deleted".to_string(), 69 + } 70 + } 71 + } 72 + type XrpcError = Json<XrpcErrorResponseObject>; 73 + fn xrpc_error(error: impl AsRef<str>, message: impl AsRef<str>) -> XrpcError { 74 + Json(XrpcErrorResponseObject { 75 + error: error.as_ref().to_string(), 76 + message: message.as_ref().to_string(), 77 + }) 78 + } 79 + 80 + fn bad_request_handler_get_record(err: poem::Error) -> GetRecordResponse { 81 + GetRecordResponse::BadRequest(Json(XrpcErrorResponseObject { 82 + error: "InvalidRequest".to_string(), 83 + message: format!("Bad request, here's some info that maybe should not be exposed: {err}"), 84 + })) 85 + } 86 + 87 + fn bad_request_handler_resolve_mini(err: poem::Error) -> ResolveMiniIDResponse { 88 + ResolveMiniIDResponse::BadRequest(Json(XrpcErrorResponseObject { 89 + error: "InvalidRequest".to_string(), 90 + message: format!("Bad request, here's some info that maybe should not be exposed: {err}"), 91 + })) 92 + } 93 + 94 + fn bad_request_handler_resolve_handle(err: poem::Error) -> JustDidResponse { 95 + JustDidResponse::BadRequest(Json(XrpcErrorResponseObject { 96 + error: "InvalidRequest".to_string(), 97 + message: format!("Bad request, here's some info that maybe should not be exposed: {err}"), 98 + })) 99 + } 100 + 101 + #[derive(Object)] 102 + #[oai(example = true)] 103 + struct FoundRecordResponseObject { 104 + /// at-uri for this record 105 + uri: String, 106 + /// CID for this exact version of the record 107 + /// 108 + /// Slingshot will always return the CID, despite it not being a required 109 + /// response property in the official lexicon. 110 + /// 111 + /// TODO: probably actually let it be optional, idk are some pds's weirdly 112 + /// not returning it? 113 + cid: Option<String>, 114 + /// the record itself as JSON 115 + value: serde_json::Value, 116 + } 117 + impl Example for FoundRecordResponseObject { 118 + fn example() -> Self { 119 + Self { 120 + uri: example_uri(), 121 + cid: Some("bafyreialv3mzvvxaoyrfrwoer3xmabbmdchvrbyhayd7bga47qjbycy74e".to_string()), 122 + value: serde_json::json!({ 123 + "$type": "app.bsky.feed.like", 124 + "createdAt": "2025-07-29T18:02:02.327Z", 125 + "subject": { 126 + "cid": "bafyreia2gy6eyk5qfetgahvshpq35vtbwy6negpy3gnuulcdi723mi7vxy", 127 + "uri": "at://did:plc:vwzwgnygau7ed7b7wt5ux7y2/app.bsky.feed.post/3lv4lkb4vgs2k" 128 + } 129 + }), 130 + } 131 + } 132 + } 133 + 134 + #[derive(ApiResponse)] 135 + #[oai(bad_request_handler = "bad_request_handler_get_record")] 136 + enum GetRecordResponse { 137 + /// Record found 138 + #[oai(status = 200)] 139 + Ok(Json<FoundRecordResponseObject>), 140 + /// Bad request or no record to return 141 + /// 142 + /// The only error name in the repo.getRecord lexicon is `RecordNotFound`, 143 + /// but the [canonical api docs](https://docs.bsky.app/docs/api/com-atproto-repo-get-record) 144 + /// also list `InvalidRequest`, `ExpiredToken`, and `InvalidToken`. Of 145 + /// these, slingshot will only generate `RecordNotFound` or `InvalidRequest`, 146 + /// but may return any proxied error code from the upstream repo. 147 + #[oai(status = 400)] 148 + BadRequest(XrpcError), 149 + /// Server errors 150 + #[oai(status = 500)] 151 + ServerError(XrpcError), 152 + } 153 + 154 + #[derive(Object)] 155 + #[oai(example = true)] 156 + struct MiniDocResponseObject { 157 + /// DID, bi-directionally verified if a handle was provided in the query. 158 + did: String, 159 + /// The validated handle of the account or `handle.invalid` if the handle 160 + /// did not bi-directionally match the DID document. 161 + handle: String, 162 + /// The identity's PDS URL 163 + pds: String, 164 + /// The atproto signing key publicKeyMultibase 165 + /// 166 + /// Legacy key encoding not supported. the key is returned directly; `id`, 167 + /// `type`, and `controller` are omitted. 168 + signing_key: String, 169 + } 170 + impl Example for MiniDocResponseObject { 171 + fn example() -> Self { 172 + Self { 173 + did: example_did(), 174 + handle: example_handle(), 175 + pds: example_pds(), 176 + signing_key: example_signing_key(), 177 + } 178 + } 179 + } 180 + 181 + #[derive(ApiResponse)] 182 + #[oai(bad_request_handler = "bad_request_handler_resolve_mini")] 183 + enum ResolveMiniIDResponse { 184 + /// Identity resolved 185 + #[oai(status = 200)] 186 + Ok(Json<MiniDocResponseObject>), 187 + /// Bad request or identity not resolved 188 + #[oai(status = 400)] 189 + BadRequest(XrpcError), 190 + } 191 + 192 + #[derive(Object)] 193 + #[oai(example = true)] 194 + struct FoundDidResponseObject { 195 + /// the DID, bi-directionally verified if using Slingshot 196 + did: String, 197 + } 198 + impl Example for FoundDidResponseObject { 199 + fn example() -> Self { 200 + Self { did: example_did() } 201 + } 202 + } 203 + 204 + #[derive(ApiResponse)] 205 + #[oai(bad_request_handler = "bad_request_handler_resolve_handle")] 206 + enum JustDidResponse { 207 + /// Resolution succeeded 208 + #[oai(status = 200)] 209 + Ok(Json<FoundDidResponseObject>), 210 + /// Bad request, failed to resolve, or failed to verify 211 + /// 212 + /// `error` will be one of `InvalidRequest`, `HandleNotFound`. 213 + #[oai(status = 400)] 214 + BadRequest(XrpcError), 215 + /// Something went wrong trying to complete the request 216 + #[oai(status = 500)] 217 + ServerError(XrpcError), 218 + } 219 + 220 + struct Xrpc { 221 + cache: HybridCache<String, CachedRecord>, 222 + identity: Identity, 223 + repo: Arc<Repo>, 224 + } 225 + 226 + #[derive(Tags)] 227 + enum ApiTags { 228 + /// Core ATProtocol-compatible APIs. 229 + /// 230 + /// > [!tip] 231 + /// > Upstream documentation is available at 232 + /// > https://docs.bsky.app/docs/category/http-reference 233 + /// 234 + /// These queries are usually executed directly against the PDS containing 235 + /// the data being requested. Slingshot offers a caching view of the same 236 + /// contents with better expected performance and reliability. 237 + #[oai(rename = "com.atproto.* queries")] 238 + ComAtproto, 239 + /// Additional and improved APIs. 240 + /// 241 + /// These APIs offer small tweaks to the core ATProtocol APIs, with more 242 + /// more convenient [request parameters](#tag/slingshot-specific-queries/GET/xrpc/com.bad-example.repo.getUriRecord) 243 + /// or [response formats](#tag/slingshot-specific-queries/GET/xrpc/com.bad-example.identity.resolveMiniDoc). 244 + /// 245 + /// > [!important] 246 + /// > At the moment, these are namespaced under the `com.bad-example.*` NSID 247 + /// > prefix, but as they stabilize they may be migrated to an org namespace 248 + /// > like `blue.microcosm.*`. Support for asliasing to `com.bad-example.*` 249 + /// > will be maintained as long as it's in use. 250 + #[oai(rename = "slingshot-specific queries")] 251 + Custom, 252 + } 253 + 254 + #[OpenApi] 255 + impl Xrpc { 256 + /// com.atproto.repo.getRecord 257 + /// 258 + /// Get a single record from a repository. Does not require auth. 259 + /// 260 + /// > [!tip] 261 + /// > See also the [canonical `com.atproto` XRPC documentation](https://docs.bsky.app/docs/api/com-atproto-repo-get-record) 262 + /// > that this endpoint aims to be compatible with. 263 + #[oai( 264 + path = "/com.atproto.repo.getRecord", 265 + method = "get", 266 + tag = "ApiTags::ComAtproto" 267 + )] 268 + async fn get_record( 269 + &self, 270 + /// The DID or handle of the repo 271 + #[oai(example = "example_did")] 272 + Query(repo): Query<String>, 273 + /// The NSID of the record collection 274 + #[oai(example = "example_collection")] 275 + Query(collection): Query<String>, 276 + /// The Record key 277 + #[oai(example = "example_rkey")] 278 + Query(rkey): Query<String>, 279 + /// Optional: the CID of the version of the record. 280 + /// 281 + /// If not specified, then return the most recent version. 282 + /// 283 + /// If a stale `CID` is specified and a newer version of the record 284 + /// exists, Slingshot returns a `NotFound` error. That is: Slingshot 285 + /// only retains the most recent version of a record. 286 + Query(cid): Query<Option<String>>, 287 + ) -> GetRecordResponse { 288 + self.get_record_impl(repo, collection, rkey, cid).await 289 + } 290 + 291 + /// com.bad-example.repo.getUriRecord 292 + /// 293 + /// Ergonomic complement to [`com.atproto.repo.getRecord`](https://docs.bsky.app/docs/api/com-atproto-repo-get-record) 294 + /// which accepts an `at-uri` instead of individual repo/collection/rkey params 295 + #[oai( 296 + path = "/com.bad-example.repo.getUriRecord", 297 + method = "get", 298 + tag = "ApiTags::Custom" 299 + )] 300 + async fn get_uri_record( 301 + &self, 302 + /// The at-uri of the record 303 + /// 304 + /// The identifier can be a DID or an atproto handle, and the collection 305 + /// and rkey segments must be present. 306 + #[oai(example = "example_uri")] 307 + Query(at_uri): Query<String>, 308 + /// Optional: the CID of the version of the record. 309 + /// 310 + /// If not specified, then return the most recent version. 311 + /// 312 + /// > [!tip] 313 + /// > If specified and a newer version of the record exists, returns 404 not 314 + /// > found. That is: slingshot only retains the most recent version of a 315 + /// > record. 316 + Query(cid): Query<Option<String>>, 317 + ) -> GetRecordResponse { 318 + let bad_at_uri = || { 319 + GetRecordResponse::BadRequest(xrpc_error( 320 + "InvalidRequest", 321 + "at-uri does not appear to be valid", 322 + )) 323 + }; 324 + 325 + let Some(normalized) = normalize_at_uri(&at_uri) else { 326 + return bad_at_uri(); 327 + }; 328 + 329 + // TODO: move this to links 330 + let Some(rest) = normalized.strip_prefix("at://") else { 331 + return bad_at_uri(); 332 + }; 333 + let Some((repo, rest)) = rest.split_once('/') else { 334 + return bad_at_uri(); 335 + }; 336 + let Some((collection, rest)) = rest.split_once('/') else { 337 + return bad_at_uri(); 338 + }; 339 + let rkey = if let Some((rkey, _rest)) = rest.split_once('?') { 340 + rkey 341 + } else { 342 + rest 343 + }; 344 + 345 + self.get_record_impl( 346 + repo.to_string(), 347 + collection.to_string(), 348 + rkey.to_string(), 349 + cid, 350 + ) 351 + .await 352 + } 353 + 354 + /// com.atproto.identity.resolveHandle 355 + /// 356 + /// Resolves an atproto [`handle`](https://atproto.com/guides/glossary#handle) 357 + /// (hostname) to a [`DID`](https://atproto.com/guides/glossary#did-decentralized-id). 358 + /// 359 + /// > [!tip] 360 + /// > Compatibility note: Slingshot will **always bi-directionally verify 361 + /// > against the DID document**, which is optional according to the 362 + /// > authoritative lexicon. 363 + /// 364 + /// > [!tip] 365 + /// > See the [canonical `com.atproto` XRPC documentation](https://docs.bsky.app/docs/api/com-atproto-identity-resolve-handle) 366 + /// > that this endpoint aims to be compatible with. 367 + #[oai( 368 + path = "/com.atproto.identity.resolveHandle", 369 + method = "get", 370 + tag = "ApiTags::ComAtproto" 371 + )] 372 + async fn resolve_handle( 373 + &self, 374 + /// The handle to resolve. 375 + #[oai(example = "example_handle")] 376 + Query(handle): Query<String>, 377 + ) -> JustDidResponse { 378 + let Ok(handle) = Handle::new(handle) else { 379 + return JustDidResponse::BadRequest(xrpc_error("InvalidRequest", "not a valid handle")); 380 + }; 381 + 382 + let Ok(alleged_did) = self.identity.handle_to_did(handle.clone()).await else { 383 + return JustDidResponse::ServerError(xrpc_error("Failed", "Could not resolve handle")); 384 + }; 385 + 386 + let Some(alleged_did) = alleged_did else { 387 + return JustDidResponse::BadRequest(xrpc_error( 388 + "HandleNotFound", 389 + "Could not resolve handle to a DID", 390 + )); 391 + }; 392 + 393 + let Ok(partial_doc) = self.identity.did_to_partial_mini_doc(&alleged_did).await else { 394 + return JustDidResponse::ServerError(xrpc_error("Failed", "Could not fetch DID doc")); 395 + }; 396 + 397 + let Some(partial_doc) = partial_doc else { 398 + return JustDidResponse::BadRequest(xrpc_error( 399 + "HandleNotFound", 400 + "Resolved handle but could not find DID doc for the DID", 401 + )); 402 + }; 403 + 404 + if partial_doc.unverified_handle != handle { 405 + return JustDidResponse::BadRequest(xrpc_error( 406 + "HandleNotFound", 407 + "Resolved handle failed bi-directional validation", 408 + )); 409 + } 410 + 411 + JustDidResponse::Ok(Json(FoundDidResponseObject { 412 + did: alleged_did.to_string(), 413 + })) 414 + } 415 + 416 + /// com.bad-example.identity.resolveMiniDoc 417 + /// 418 + /// Like [com.atproto.identity.resolveIdentity](https://docs.bsky.app/docs/api/com-atproto-identity-resolve-identity) 419 + /// but instead of the full `didDoc` it returns an atproto-relevant subset. 420 + #[oai( 421 + path = "/com.bad-example.identity.resolveMiniDoc", 422 + method = "get", 423 + tag = "ApiTags::Custom" 424 + )] 425 + async fn resolve_mini_id( 426 + &self, 427 + /// Handle or DID to resolve 428 + #[oai(example = "example_handle")] 429 + Query(identifier): Query<String>, 430 + ) -> ResolveMiniIDResponse { 431 + let invalid = |reason: &'static str| { 432 + ResolveMiniIDResponse::BadRequest(xrpc_error("InvalidRequest", reason)) 433 + }; 434 + 435 + let mut unverified_handle = None; 436 + let did = match Did::new(identifier.clone()) { 437 + Ok(did) => did, 438 + Err(_) => { 439 + let Ok(alleged_handle) = Handle::new(identifier) else { 440 + return invalid("identifier was not a valid DID or handle"); 441 + }; 442 + 443 + match self.identity.handle_to_did(alleged_handle.clone()).await { 444 + Ok(res) => { 445 + if let Some(did) = res { 446 + // we did it joe 447 + unverified_handle = Some(alleged_handle); 448 + did 449 + } else { 450 + return invalid("Could not resolve handle identifier to a DID"); 451 + } 452 + } 453 + Err(e) => { 454 + log::debug!("failed to resolve handle: {e}"); 455 + // TODO: ServerError not BadRequest 456 + return invalid("errored while trying to resolve handle to DID"); 457 + } 458 + } 459 + } 460 + }; 461 + let Ok(partial_doc) = self.identity.did_to_partial_mini_doc(&did).await else { 462 + return invalid("failed to get DID doc"); 463 + }; 464 + let Some(partial_doc) = partial_doc else { 465 + return invalid("failed to find DID doc"); 466 + }; 467 + 468 + // ok so here's where we're at: 469 + // ✅ we have a DID 470 + // ✅ we have a partial doc 471 + // 🔶 if we have a handle, it's from the `identifier` (user-input) 472 + // -> then we just need to compare to the partial doc to confirm 473 + // -> else we need to resolve the DID doc's to a handle and check 474 + let handle = if let Some(h) = unverified_handle { 475 + if h == partial_doc.unverified_handle { 476 + h.to_string() 477 + } else { 478 + "handle.invalid".to_string() 479 + } 480 + } else { 481 + let Ok(handle_did) = self 482 + .identity 483 + .handle_to_did(partial_doc.unverified_handle.clone()) 484 + .await 485 + else { 486 + return invalid("failed to get did doc's handle"); 487 + }; 488 + let Some(handle_did) = handle_did else { 489 + return invalid("failed to resolve did doc's handle"); 490 + }; 491 + if handle_did == did { 492 + partial_doc.unverified_handle.to_string() 493 + } else { 494 + "handle.invalid".to_string() 495 + } 496 + }; 497 + 498 + ResolveMiniIDResponse::Ok(Json(MiniDocResponseObject { 499 + did: did.to_string(), 500 + handle, 501 + pds: partial_doc.pds, 502 + signing_key: partial_doc.signing_key, 503 + })) 504 + } 505 + 506 + async fn get_record_impl( 507 + &self, 508 + repo: String, 509 + collection: String, 510 + rkey: String, 511 + cid: Option<String>, 512 + ) -> GetRecordResponse { 513 + let did = match Did::new(repo.clone()) { 514 + Ok(did) => did, 515 + Err(_) => { 516 + let Ok(handle) = Handle::new(repo) else { 517 + return GetRecordResponse::BadRequest(xrpc_error( 518 + "InvalidRequest", 519 + "repo was not a valid DID or handle", 520 + )); 521 + }; 522 + match self.identity.handle_to_did(handle).await { 523 + Ok(res) => { 524 + if let Some(did) = res { 525 + did 526 + } else { 527 + return GetRecordResponse::BadRequest(xrpc_error( 528 + "InvalidRequest", 529 + "Could not resolve handle repo to a DID", 530 + )); 531 + } 532 + } 533 + Err(e) => { 534 + log::debug!("handle resolution failed: {e}"); 535 + return GetRecordResponse::ServerError(xrpc_error( 536 + "ResolutionFailed", 537 + "errored while trying to resolve handle to DID", 538 + )); 539 + } 540 + } 541 + } 542 + }; 543 + 544 + let Ok(collection) = Nsid::new(collection) else { 545 + return GetRecordResponse::BadRequest(xrpc_error( 546 + "InvalidRequest", 547 + "invalid NSID for collection", 548 + )); 549 + }; 550 + 551 + let Ok(rkey) = RecordKey::new(rkey) else { 552 + return GetRecordResponse::BadRequest(xrpc_error("InvalidRequest", "invalid rkey")); 553 + }; 554 + 555 + let cid: Option<Cid> = if let Some(cid) = cid { 556 + let Ok(cid) = Cid::from_str(&cid) else { 557 + return GetRecordResponse::BadRequest(xrpc_error("InvalidRequest", "invalid CID")); 558 + }; 559 + Some(cid) 560 + } else { 561 + None 562 + }; 563 + 564 + let at_uri = format!("at://{}/{}/{}", &*did, &*collection, &*rkey); 565 + 566 + let fr = self 567 + .cache 568 + .fetch(at_uri.clone(), { 569 + let cid = cid.clone(); 570 + let repo_api = self.repo.clone(); 571 + || async move { 572 + repo_api 573 + .get_record(&did, &collection, &rkey, &cid) 574 + .await 575 + .map_err(|e| foyer::Error::Other(Box::new(e))) 576 + } 577 + }) 578 + .await; 579 + 580 + let entry = match fr { 581 + Ok(e) => e, 582 + Err(foyer::Error::Other(e)) => { 583 + let record_error = match e.downcast::<RecordError>() { 584 + Ok(e) => e, 585 + Err(e) => { 586 + log::error!("error (foyer other) getting cache entry, {e:?}"); 587 + return GetRecordResponse::ServerError(xrpc_error( 588 + "ServerError", 589 + "sorry, something went wrong", 590 + )); 591 + } 592 + }; 593 + let RecordError::UpstreamBadRequest(ErrorResponseObject { error, message }) = 594 + *record_error 595 + else { 596 + log::error!("RecordError getting cache entry, {record_error:?}"); 597 + return GetRecordResponse::ServerError(xrpc_error( 598 + "ServerError", 599 + "sorry, something went wrong", 600 + )); 601 + }; 602 + 603 + // all of the noise around here is so that we can ultimately reach this: 604 + // upstream BadRequest extracted from the foyer result which we can proxy back 605 + return GetRecordResponse::BadRequest(xrpc_error( 606 + error, 607 + format!("Upstream bad request: {message}"), 608 + )); 609 + } 610 + Err(e) => { 611 + log::error!("error (foyer) getting cache entry, {e:?}"); 612 + return GetRecordResponse::ServerError(xrpc_error( 613 + "ServerError", 614 + "sorry, something went wrong", 615 + )); 616 + } 617 + }; 618 + 619 + match *entry { 620 + CachedRecord::Found(ref raw) => { 621 + let (found_cid, raw_value) = raw.into(); 622 + if cid.clone().map(|c| c != found_cid).unwrap_or(false) { 623 + return GetRecordResponse::BadRequest(Json(XrpcErrorResponseObject { 624 + error: "RecordNotFound".to_string(), 625 + message: "A record was found but its CID did not match that requested" 626 + .to_string(), 627 + })); 628 + } 629 + // TODO: thank u stellz: https://gist.github.com/stella3d/51e679e55b264adff89d00a1e58d0272 630 + let value = 631 + serde_json::from_str(raw_value.get()).expect("RawValue to be valid json"); 632 + GetRecordResponse::Ok(Json(FoundRecordResponseObject { 633 + uri: at_uri, 634 + cid: Some(found_cid.as_ref().to_string()), 635 + value, 636 + })) 637 + } 638 + CachedRecord::Deleted => GetRecordResponse::BadRequest(Json(XrpcErrorResponseObject { 639 + error: "RecordNotFound".to_string(), 640 + message: "This record was deleted".to_string(), 641 + })), 642 + } 643 + } 644 + 645 + // TODO 646 + // #[oai(path = "/com.atproto.identity.resolveHandle", method = "get")] 647 + // #[oai(path = "/com.atproto.identity.resolveDid", method = "get")] 648 + // but these are both not specified to do bidirectional validation, which is what we want to offer 649 + // com.atproto.identity.resolveIdentity seems right, but requires returning the full did-doc 650 + // would be nice if there were two queries: 651 + // did -> verified handle + pds url 652 + // handle -> verified did + pds url 653 + // 654 + // we could do horrible things and implement resolveIdentity with only a stripped-down fake did doc 655 + // but this will *definitely* cause problems because eg. we're not currently storing pubkeys and 656 + // those are a little bit important 657 + } 658 + 659 + #[derive(Debug, Clone, Serialize)] 660 + #[serde(rename_all = "camelCase")] 661 + struct AppViewService { 662 + id: String, 663 + r#type: String, 664 + service_endpoint: String, 665 + } 666 + #[derive(Debug, Clone, Serialize)] 667 + struct AppViewDoc { 668 + id: String, 669 + service: [AppViewService; 1], 670 + } 671 + /// Serve a did document for did:web for this to be an xrpc appview 672 + /// 673 + /// No slingshot endpoints currently require auth, so it's not necessary to do 674 + /// service proxying, however clients may wish to: 675 + /// 676 + /// - PDS proxying offers a level of client IP anonymity from slingshot 677 + /// - slingshot *may* implement more generous per-user rate-limits for proxied requests in the future 678 + fn get_did_doc(domain: &str) -> impl Endpoint + use<> { 679 + let doc = poem::web::Json(AppViewDoc { 680 + id: format!("did:web:{domain}"), 681 + service: [AppViewService { 682 + id: "#slingshot".to_string(), 683 + r#type: "SlingshotRecordProxy".to_string(), 684 + service_endpoint: format!("https://{domain}"), 685 + }], 686 + }); 687 + make_sync(move |_| doc.clone()) 688 + } 689 + 690 + pub async fn serve( 691 + cache: HybridCache<String, CachedRecord>, 692 + identity: Identity, 693 + repo: Repo, 694 + domain: Option<String>, 695 + acme_contact: Option<String>, 696 + certs: Option<PathBuf>, 697 + shutdown: CancellationToken, 698 + ) -> Result<(), ServerError> { 699 + let repo = Arc::new(repo); 700 + let api_service = OpenApiService::new( 701 + Xrpc { 702 + cache, 703 + identity, 704 + repo, 705 + }, 706 + "Slingshot", 707 + env!("CARGO_PKG_VERSION"), 708 + ) 709 + .server(if let Some(ref h) = domain { 710 + format!("https://{h}") 711 + } else { 712 + "http://localhost:3000".to_string() 713 + }) 714 + .url_prefix("/xrpc") 715 + .contact( 716 + ContactObject::new() 717 + .name("@microcosm.blue") 718 + .url("https://bsky.app/profile/microcosm.blue"), 719 + ) 720 + .description(include_str!("../api-description.md")) 721 + .external_document(ExternalDocumentObject::new( 722 + "https://microcosm.blue/slingshot", 723 + )); 724 + 725 + let mut app = Route::new() 726 + .at("/", StaticFileEndpoint::new("./static/index.html")) 727 + .nest("/openapi", api_service.spec_endpoint()) 728 + .nest("/xrpc/", api_service); 729 + 730 + if let Some(domain) = domain { 731 + rustls::crypto::aws_lc_rs::default_provider() 732 + .install_default() 733 + .expect("alskfjalksdjf"); 734 + 735 + app = app.at("/.well-known/did.json", get_did_doc(&domain)); 736 + 737 + let mut auto_cert = AutoCert::builder() 738 + .directory_url(LETS_ENCRYPT_PRODUCTION) 739 + .domain(&domain); 740 + if let Some(contact) = acme_contact { 741 + auto_cert = auto_cert.contact(contact); 742 + } 743 + if let Some(certs) = certs { 744 + auto_cert = auto_cert.cache_path(certs); 745 + } 746 + let auto_cert = auto_cert.build().map_err(ServerError::AcmeBuildError)?; 747 + 748 + run( 749 + TcpListener::bind("0.0.0.0:443").acme(auto_cert), 750 + app, 751 + shutdown, 752 + ) 753 + .await 754 + } else { 755 + run(TcpListener::bind("127.0.0.1:3000"), app, shutdown).await 756 + } 757 + } 758 + 759 + async fn run<L>(listener: L, app: Route, shutdown: CancellationToken) -> Result<(), ServerError> 760 + where 761 + L: Listener + 'static, 762 + { 763 + let app = app 764 + .with( 765 + Cors::new() 766 + .allow_origin_regex("*") 767 + .allow_methods([Method::GET]) 768 + .allow_credentials(false), 769 + ) 770 + .with(CatchPanic::new()) 771 + .with(Tracing); 772 + Server::new(listener) 773 + .name("slingshot") 774 + .run_with_graceful_shutdown(app, shutdown.cancelled(), None) 775 + .await 776 + .map_err(ServerError::ServerExited) 777 + .inspect(|()| log::info!("server ended. goodbye.")) 778 + }
slingshot/static/favicon.ico

This is a binary file and will not be displayed.

+67
slingshot/static/index.html
··· 1 + <!doctype html> 2 + <html lang="en"> 3 + <head> 4 + <meta charset="utf-8" /> 5 + <title>Slingshot: atproto edge record cache</title> 6 + <meta name="viewport" content="width=device-width, initial-scale=1" /> 7 + <meta name="description" content="API Documentation for Slingshot, a firehose-listening atproto edge record and identity cache." /> 8 + <style> 9 + :root { 10 + --scalar-small: 13px; 11 + } 12 + .scalar-app .markdown .markdown-alert { 13 + font-size: var(--scalar-small); 14 + } 15 + .sidebar-heading-link-title { 16 + line-height: 1.2; 17 + } 18 + .custom-header { 19 + height: 42px; 20 + background-color: #221828; 21 + box-shadow: inset 0 -1px 0 var(--scalar-border-color); 22 + color: var(--scalar-color-1); 23 + font-size: var(--scalar-font-size-3); 24 + font-family: 'Iowan Old Style', 'Palatino Linotype', 'URW Palladio L', P052, serif; 25 + padding: 0 18px; 26 + justify-content: space-between; 27 + } 28 + .custom-header, 29 + .custom-header nav { 30 + display: flex; 31 + align-items: center; 32 + gap: 18px; 33 + } 34 + .custom-header a:hover { 35 + color: var(--scalar-color-2); 36 + } 37 + 38 + .light-mode .custom-header { 39 + background-color: thistle; 40 + } 41 + </style> 42 + </head> 43 + <body> 44 + <header class="custom-header scalar-app"> 45 + <p> 46 + TODO: thing 47 + </p> 48 + <nav> 49 + <b>a <a href="https://microcosm.blue">microcosm</a> project</b> 50 + <a href="https://bsky.app/profile/microcosm.blue">@microcosm.blue</a> 51 + <a href="https://github.com/at-microcosm">github</a> 52 + </nav> 53 + </header> 54 + 55 + <script id="api-reference" type="application/json" data-url="/openapi"></script> 56 + 57 + <script> 58 + var configuration = { 59 + theme: 'purple', 60 + hideModels: true, 61 + } 62 + document.getElementById('api-reference').dataset.configuration = JSON.stringify(configuration) 63 + </script> 64 + 65 + <script src="https://cdn.jsdelivr.net/npm/@scalar/api-reference"></script> 66 + </body> 67 + </html>
+37
spacedust/Cargo.toml
··· 1 + [package] 2 + name = "spacedust" 3 + version = "0.1.0" 4 + edition = "2024" 5 + 6 + [dependencies] 7 + anyhow = "1.0.100" 8 + async-channel = "2.5.0" 9 + async-trait = "0.1.88" 10 + clap = { version = "4.5.40", features = ["derive"] } 11 + ctrlc = "3.4.7" 12 + dasl = "0.2.0" 13 + dropshot = "0.16.2" 14 + env_logger = "0.11.8" 15 + fjall = "3.0.0-pre.0" 16 + futures = "0.3.31" 17 + http = "1.3.1" 18 + ipld-core = { version = "0.4.2", features = ["serde"] } 19 + jetstream = { path = "../jetstream", features = ["metrics"] } 20 + links = { path = "../links" } 21 + log = "0.4.27" 22 + metrics = "0.24.2" 23 + metrics-exporter-prometheus = { version = "0.17.1", features = ["http-listener"] } 24 + rand = "0.9.1" 25 + repo-stream = "0.2.2" 26 + reqwest = { version = "0.12.24", features = ["json", "stream"] } 27 + schemars = "0.8.22" 28 + semver = "1.0.26" 29 + serde = { version = "1.0.219", features = ["derive"] } 30 + serde_ipld_dagcbor = "0.6.4" 31 + serde_json = "1.0.140" 32 + serde_qs = "1.0.0-rc.3" 33 + thiserror = "2.0.12" 34 + tinyjson = "2.5.1" 35 + tokio = { version = "1.45.1", features = ["full"] } 36 + tokio-tungstenite = "0.27.0" 37 + tokio-util = "0.7.15"
+21
spacedust/src/bin/import_car_file.rs
··· 1 + use clap::Parser; 2 + use std::path::PathBuf; 3 + 4 + type Result<T> = std::result::Result<T, Box<dyn std::error::Error>>; 5 + 6 + #[derive(Debug, Parser)] 7 + struct Args { 8 + #[arg()] 9 + file: PathBuf, 10 + } 11 + 12 + #[tokio::main] 13 + async fn main() -> Result<()> { 14 + env_logger::init(); 15 + 16 + let Args { file } = Args::parse(); 17 + 18 + let _reader = tokio::fs::File::open(file).await?; 19 + 20 + Ok(()) 21 + }
+258
spacedust/src/bin/import_scraped.rs
··· 1 + use clap::Parser; 2 + use links::CollectedLink; 3 + use repo_stream::{ 4 + DiskBuilder, DiskStore, Driver, DriverBuilder, Processable, drive::DriverBuilderWithProcessor, 5 + drive::NeedDisk, 6 + }; 7 + use std::path::PathBuf; 8 + use std::sync::{ 9 + Arc, 10 + atomic::{AtomicUsize, Ordering}, 11 + }; 12 + use tokio::{io::AsyncRead, task::JoinSet}; 13 + 14 + type Result<T> = anyhow::Result<T>; //std::result::Result<T, Box<dyn std::error::Error>>; 15 + 16 + #[derive(Debug, Clone, serde::Serialize, serde::Deserialize)] 17 + struct CollectedProcessed(CollectedLink); 18 + 19 + impl Processable for CollectedProcessed { 20 + fn get_size(&self) -> usize { 21 + self.0.path.capacity() + self.0.target.as_str().len() 22 + } 23 + } 24 + 25 + #[derive(Debug, Clone, serde::Serialize, serde::Deserialize)] 26 + struct ErrString(String); 27 + 28 + impl Processable for ErrString { 29 + fn get_size(&self) -> usize { 30 + self.0.capacity() 31 + } 32 + } 33 + 34 + type Processed = std::result::Result<Vec<CollectedProcessed>, ErrString>; 35 + 36 + /// hacky for now: put errors in strings 🤷‍♀️ 37 + fn process(block: Vec<u8>) -> Processed { 38 + let value: dasl::drisl::Value = dasl::drisl::from_slice(&block) 39 + .map_err(|e| ErrString(format!("failed to parse block with drisl: {e:?}")))?; 40 + let links = links::record::collect_links_drisl(&value) 41 + .into_iter() 42 + .map(CollectedProcessed) 43 + .collect(); 44 + Ok(links) 45 + } 46 + 47 + #[derive(Debug, Parser)] 48 + struct Args { 49 + #[arg(long)] 50 + cars_folder: PathBuf, 51 + #[arg(long)] 52 + mem_workers: usize, 53 + #[arg(long)] 54 + disk_workers: usize, 55 + #[arg(long)] 56 + disk_folder: PathBuf, 57 + } 58 + 59 + async fn get_cars( 60 + cars_folder: PathBuf, 61 + tx: async_channel::Sender<tokio::io::BufReader<tokio::fs::File>>, 62 + ) -> Result<()> { 63 + let mut dir = tokio::fs::read_dir(cars_folder).await?; 64 + while let Some(entry) = dir.next_entry().await? { 65 + if !entry.file_type().await?.is_file() { 66 + continue; 67 + } 68 + let reader = tokio::fs::File::open(&entry.path()).await?; 69 + let reader = tokio::io::BufReader::new(reader); 70 + tx.send(reader).await?; 71 + } 72 + Ok(()) 73 + } 74 + 75 + async fn drive_mem<R: AsyncRead + Unpin + Send + Sync + 'static>( 76 + f: R, 77 + builder: &DriverBuilderWithProcessor<Processed>, 78 + disk_tx: &async_channel::Sender<NeedDisk<R, Processed>>, 79 + ) -> Result<Option<(usize, usize)>> { 80 + let mut n = 0; 81 + let mut n_records = 0; 82 + match builder.load_car(f).await? { 83 + Driver::Memory(_commit, mut driver) => { 84 + while let Some(chunk) = driver.next_chunk(512).await? { 85 + n_records += chunk.len(); 86 + for (_key, links) in chunk { 87 + match links { 88 + Ok(links) => n += links.len(), 89 + Err(e) => eprintln!("wat: {e:?}"), 90 + } 91 + } 92 + } 93 + Ok(Some((n, n_records))) 94 + } 95 + Driver::Disk(need_disk) => { 96 + disk_tx.send(need_disk).await?; 97 + Ok(None) 98 + } 99 + } 100 + } 101 + 102 + async fn mem_worker<R: AsyncRead + Unpin + Send + Sync + 'static>( 103 + car_rx: async_channel::Receiver<R>, 104 + disk_tx: async_channel::Sender<NeedDisk<R, Processed>>, 105 + n: Arc<AtomicUsize>, 106 + n_records: Arc<AtomicUsize>, 107 + ) -> Result<()> { 108 + let builder = DriverBuilder::new() 109 + .with_block_processor(process) // don't care just counting records 110 + .with_mem_limit_mb(128); 111 + while let Ok(f) = car_rx.recv().await { 112 + let driven = match drive_mem(f, &builder, &disk_tx).await { 113 + Ok(d) => d, 114 + Err(e) => { 115 + eprintln!("failed to drive mem: {e:?}. skipping..."); 116 + continue; 117 + } 118 + }; 119 + if let Some((drove, recs)) = driven { 120 + n.fetch_add(drove, Ordering::Relaxed); 121 + n_records.fetch_add(recs, Ordering::Relaxed); 122 + } 123 + } 124 + Ok(()) 125 + } 126 + 127 + async fn drive_disk<R: AsyncRead + Unpin>( 128 + needed: NeedDisk<R, Processed>, 129 + store: DiskStore, 130 + ) -> Result<(usize, usize, DiskStore)> { 131 + let (_commit, mut driver) = needed.finish_loading(store).await?; 132 + let mut n = 0; 133 + let mut n_records = 0; 134 + while let Some(chunk) = driver.next_chunk(512).await? { 135 + n_records += chunk.len(); 136 + for (_key, links) in chunk { 137 + match links { 138 + Ok(links) => n += links.len(), 139 + Err(e) => eprintln!("wat: {e:?}"), 140 + } 141 + } 142 + } 143 + let store = driver.reset_store().await?; 144 + Ok((n, n_records, store)) 145 + } 146 + 147 + async fn disk_worker<R: AsyncRead + Unpin>( 148 + worker_id: usize, 149 + disk_rx: async_channel::Receiver<NeedDisk<R, Processed>>, 150 + folder: PathBuf, 151 + n: Arc<AtomicUsize>, 152 + n_records: Arc<AtomicUsize>, 153 + disk_workers_active: Arc<AtomicUsize>, 154 + ) -> Result<()> { 155 + let mut file = folder; 156 + file.push(format!("disk-worker-{worker_id}.sqlite")); 157 + let builder = DiskBuilder::new().with_cache_size_mb(128); 158 + let mut store = builder.open(file.clone()).await?; 159 + while let Ok(needed) = disk_rx.recv().await { 160 + let active = disk_workers_active.fetch_add(1, Ordering::AcqRel); 161 + println!("-> disk workers active: {}", active + 1); 162 + let (drove, records) = match drive_disk(needed, store).await { 163 + Ok((d, r, s)) => { 164 + store = s; 165 + (d, r) 166 + } 167 + Err(e) => { 168 + eprintln!("failed to drive disk: {e:?}. skipping..."); 169 + store = builder.open(file.clone()).await?; 170 + continue; 171 + } 172 + }; 173 + n.fetch_add(drove, Ordering::Relaxed); 174 + n_records.fetch_add(records, Ordering::Relaxed); 175 + let were_active = disk_workers_active.fetch_sub(1, Ordering::AcqRel); 176 + println!("<- disk workers active: {}", were_active - 1); 177 + } 178 + Ok(()) 179 + } 180 + 181 + #[tokio::main] 182 + async fn main() -> Result<()> { 183 + env_logger::init(); 184 + 185 + let Args { 186 + cars_folder, 187 + disk_folder, 188 + disk_workers, 189 + mem_workers, 190 + } = Args::parse(); 191 + 192 + let mut set = JoinSet::<Result<()>>::new(); 193 + 194 + let (cars_tx, cars_rx) = async_channel::bounded(2); 195 + set.spawn(get_cars(cars_folder, cars_tx)); 196 + 197 + let n: Arc<AtomicUsize> = Arc::new(0.into()); 198 + let n_records: Arc<AtomicUsize> = Arc::new(0.into()); 199 + let disk_workers_active: Arc<AtomicUsize> = Arc::new(0.into()); 200 + 201 + set.spawn({ 202 + let n = n.clone(); 203 + let n_records = n_records.clone(); 204 + let mut interval = tokio::time::interval(std::time::Duration::from_secs(10)); 205 + async move { 206 + let mut last_n = n.load(Ordering::Relaxed); 207 + let mut last_n_records = n.load(Ordering::Relaxed); 208 + loop { 209 + interval.tick().await; 210 + let n = n.load(Ordering::Relaxed); 211 + let n_records = n_records.load(Ordering::Relaxed); 212 + let diff_n = n - last_n; 213 + let diff_records = n_records - last_n_records; 214 + println!("rate: {} rec/sec; {} n/sec", diff_records / 10, diff_n / 10); 215 + if n_records > 0 && diff_records == 0 { 216 + println!("zero encountered, stopping rate calculation polling."); 217 + break Ok(()); 218 + } 219 + last_n = n; 220 + last_n_records = n_records; 221 + } 222 + } 223 + }); 224 + 225 + let (needs_disk_tx, needs_disk_rx) = async_channel::bounded(disk_workers); 226 + 227 + for _ in 0..mem_workers { 228 + set.spawn(mem_worker( 229 + cars_rx.clone(), 230 + needs_disk_tx.clone(), 231 + n.clone(), 232 + n_records.clone(), 233 + )); 234 + } 235 + drop(cars_rx); 236 + drop(needs_disk_tx); 237 + 238 + tokio::fs::create_dir_all(disk_folder.clone()).await?; 239 + for id in 0..disk_workers { 240 + set.spawn(disk_worker( 241 + id, 242 + needs_disk_rx.clone(), 243 + disk_folder.clone(), 244 + n.clone(), 245 + n_records.clone(), 246 + disk_workers_active.clone(), 247 + )); 248 + } 249 + drop(needs_disk_rx); 250 + 251 + while let Some(res) = set.join_next().await { 252 + println!("task from set joined: {res:?}"); 253 + } 254 + 255 + eprintln!("total records processed: {n_records:?}; total n: {n:?}"); 256 + 257 + Ok(()) 258 + }
+137
spacedust/src/bin/scrape_pds.rs
··· 1 + use clap::Parser; 2 + use reqwest::Url; 3 + use serde::Deserialize; 4 + use std::path::PathBuf; 5 + use tokio::io::AsyncWriteExt; 6 + use tokio::{sync::mpsc, time}; 7 + 8 + type Result<T> = std::result::Result<T, Box<dyn std::error::Error>>; 9 + 10 + use futures::StreamExt; 11 + 12 + #[derive(Debug, Parser)] 13 + struct Args { 14 + #[arg(long)] 15 + pds: Url, 16 + #[arg(long)] 17 + throttle_ms: u64, // 100ms per pds? 18 + #[arg(long)] 19 + folder: PathBuf, 20 + } 21 + 22 + async fn download_repo( 23 + client: &reqwest::Client, 24 + mut pds: Url, 25 + did: String, 26 + mut path: PathBuf, 27 + ) -> Result<()> { 28 + path.push(format!("{did}.car")); 29 + let f = tokio::fs::File::create(path).await?; 30 + let mut w = tokio::io::BufWriter::new(f); 31 + 32 + pds.set_path("/xrpc/com.atproto.sync.getRepo"); 33 + pds.set_query(Some(&format!("did={did}"))); 34 + let mut byte_stream = client.get(pds).send().await?.bytes_stream(); 35 + 36 + while let Some(stuff) = byte_stream.next().await { 37 + tokio::io::copy(&mut stuff?.as_ref(), &mut w).await?; 38 + } 39 + w.flush().await?; 40 + 41 + Ok(()) 42 + } 43 + 44 + #[derive(Debug, Deserialize)] 45 + struct RepoInfo { 46 + did: String, 47 + active: bool, 48 + } 49 + 50 + #[derive(Debug, Deserialize)] 51 + struct ListReposResponse { 52 + cursor: Option<String>, 53 + repos: Vec<RepoInfo>, 54 + } 55 + 56 + fn get_pds_dids(client: reqwest::Client, mut pds: Url) -> mpsc::Receiver<String> { 57 + let (tx, rx) = mpsc::channel(2); 58 + tokio::task::spawn(async move { 59 + pds.set_path("/xrpc/com.atproto.sync.listRepos"); 60 + let mut cursor = None; 61 + 62 + loop { 63 + if let Some(c) = cursor { 64 + pds.set_query(Some(&format!("cursor={c}"))); 65 + } 66 + let res: ListReposResponse = client 67 + .get(pds.clone()) 68 + .send() 69 + .await 70 + .expect("to send request") 71 + .error_for_status() 72 + .expect("to be ok") 73 + .json() 74 + .await 75 + .expect("json response"); 76 + for repo in res.repos { 77 + if repo.active { 78 + tx.send(repo.did) 79 + .await 80 + .expect("to be able to send on the channel"); 81 + } 82 + } 83 + cursor = res.cursor; 84 + if cursor.is_none() { 85 + break; 86 + } 87 + } 88 + }); 89 + rx 90 + } 91 + 92 + #[tokio::main] 93 + async fn main() -> Result<()> { 94 + env_logger::init(); 95 + 96 + let Args { 97 + pds, 98 + throttle_ms, 99 + folder, 100 + } = Args::parse(); 101 + 102 + tokio::fs::create_dir_all(folder.clone()).await?; 103 + 104 + let client = reqwest::Client::builder() 105 + .user_agent("microcosm/spacedust-testing") 106 + .build()?; 107 + 108 + let mut dids = get_pds_dids(client.clone(), pds.clone()); 109 + 110 + let mut interval = time::interval(time::Duration::from_millis(throttle_ms)); 111 + let mut oks = 0; 112 + let mut single_fails = 0; 113 + let mut double_fails = 0; 114 + 115 + while let Some(did) = dids.recv().await { 116 + interval.tick().await; 117 + println!("did: {did:?}"); 118 + if let Err(e) = download_repo(&client, pds.clone(), did.clone(), folder.clone()).await { 119 + single_fails += 1; 120 + eprintln!("failed to download repo for did: {did:?}: {e:?}. retrying in a moment..."); 121 + tokio::time::sleep(time::Duration::from_secs(3)).await; 122 + interval.reset(); 123 + if let Err(e) = download_repo(&client, pds.clone(), did.clone(), folder.clone()).await { 124 + double_fails += 1; 125 + eprintln!("failed again: {e:?}. moving on in a moment..."); 126 + tokio::time::sleep(time::Duration::from_secs(1)).await; 127 + continue; 128 + } 129 + } 130 + oks += 1; 131 + println!(" -> done. did: {did:?}"); 132 + } 133 + 134 + eprintln!("got {oks} repos. single fails: {single_fails}; doubles: {double_fails}."); 135 + 136 + Ok(()) 137 + }
+116
spacedust/src/consumer.rs
··· 1 + use crate::ClientMessage; 2 + use crate::error::ConsumerError; 3 + use crate::removable_delay_queue; 4 + use jetstream::{ 5 + DefaultJetstreamEndpoints, JetstreamCompression, JetstreamConfig, JetstreamConnector, 6 + events::{CommitOp, Cursor, EventKind}, 7 + }; 8 + use links::collect_links; 9 + use std::sync::Arc; 10 + use tokio::sync::broadcast; 11 + use tokio_util::sync::CancellationToken; 12 + 13 + const MAX_LINKS_PER_EVENT: usize = 100; 14 + 15 + pub async fn consume( 16 + b: broadcast::Sender<Arc<ClientMessage>>, 17 + d: removable_delay_queue::Input<(String, usize), Arc<ClientMessage>>, 18 + jetstream_endpoint: String, 19 + cursor: Option<Cursor>, 20 + no_zstd: bool, 21 + shutdown: CancellationToken, 22 + ) -> Result<(), ConsumerError> { 23 + let endpoint = DefaultJetstreamEndpoints::endpoint_or_shortcut(&jetstream_endpoint); 24 + if endpoint == jetstream_endpoint { 25 + log::info!("consumer: connecting jetstream at {endpoint}"); 26 + } else { 27 + log::info!("consumer: connecting jetstream at {jetstream_endpoint} => {endpoint}"); 28 + } 29 + let config: JetstreamConfig = JetstreamConfig { 30 + endpoint, 31 + compression: if no_zstd { 32 + JetstreamCompression::None 33 + } else { 34 + JetstreamCompression::Zstd 35 + }, 36 + replay_on_reconnect: true, 37 + channel_size: 1024, // buffer up to ~1s of jetstream events 38 + ..Default::default() 39 + }; 40 + let mut receiver = JetstreamConnector::new(config)? 41 + .connect_cursor(cursor) 42 + .await?; 43 + 44 + log::info!("consumer: receiving messages.."); 45 + loop { 46 + if shutdown.is_cancelled() { 47 + log::info!("consumer: exiting for shutdown"); 48 + return Ok(()); 49 + } 50 + let Some(event) = receiver.recv().await else { 51 + log::error!("consumer: could not receive event, bailing"); 52 + break; 53 + }; 54 + 55 + if event.kind != EventKind::Commit { 56 + continue; 57 + } 58 + let Some(ref commit) = event.commit else { 59 + log::warn!("consumer: commit event missing commit data, ignoring"); 60 + continue; 61 + }; 62 + 63 + // TODO: something a bit more robust 64 + let at_uri = format!( 65 + "at://{}/{}/{}", 66 + &*event.did, &*commit.collection, &*commit.rkey 67 + ); 68 + 69 + // TODO: keep a buffer and remove quick deletes to debounce notifs 70 + // for now we just drop all deletes eek 71 + if commit.operation == CommitOp::Delete { 72 + d.remove_range((at_uri.clone(), 0)..=(at_uri.clone(), MAX_LINKS_PER_EVENT)) 73 + .await; 74 + continue; 75 + } 76 + let Some(ref record) = commit.record else { 77 + log::warn!("consumer: commit update/delete missing record, ignoring"); 78 + continue; 79 + }; 80 + 81 + let jv = match record.get().parse() { 82 + Ok(v) => v, 83 + Err(e) => { 84 + log::warn!("consumer: record failed to parse, ignoring: {e}"); 85 + continue; 86 + } 87 + }; 88 + 89 + for (i, link) in collect_links(&jv).into_iter().enumerate() { 90 + if i >= MAX_LINKS_PER_EVENT { 91 + // todo: indicate if the link limit was reached (-> links omitted) 92 + log::warn!("consumer: event has too many links, ignoring the rest"); 93 + metrics::counter!("consumer_dropped_links", "reason" => "too_many_links") 94 + .increment(1); 95 + break; 96 + } 97 + let client_message = match ClientMessage::new_link(link, &at_uri, commit) { 98 + Ok(m) => m, 99 + Err(e) => { 100 + // TODO indicate to clients that a link has been dropped 101 + log::warn!("consumer: failed to serialize link to json: {e:?}"); 102 + metrics::counter!("consumer_dropped_links", "reason" => "failed_to_serialize") 103 + .increment(1); 104 + continue; 105 + } 106 + }; 107 + let message = Arc::new(client_message); 108 + let _ = b.send(message.clone()); // only errors if no subscribers are connected, which is just fine. 109 + d.enqueue((at_uri.clone(), i), message) 110 + .await 111 + .map_err(|_| ConsumerError::DelayQueueOutputDropped)?; 112 + } 113 + } 114 + 115 + Err(ConsumerError::JetstreamEnded) 116 + }
+22
spacedust/src/delay.rs
··· 1 + use crate::error::DelayError; 2 + use crate::removable_delay_queue; 3 + use tokio::sync::broadcast; 4 + use tokio_util::sync::CancellationToken; 5 + 6 + pub async fn to_broadcast<T>( 7 + source: removable_delay_queue::Output<(String, usize), T>, 8 + dest: broadcast::Sender<T>, 9 + shutdown: CancellationToken, 10 + ) -> Result<(), DelayError> { 11 + loop { 12 + tokio::select! { 13 + ev = source.next() => match ev { 14 + Some(event) => { 15 + let _ = dest.send(event); // only errors of there are no listeners, but that's normal 16 + }, 17 + None => return Err(DelayError::DelayEnded), 18 + }, 19 + _ = shutdown.cancelled() => return Ok(()), 20 + } 21 + } 22 + }
+55
spacedust/src/error.rs
··· 1 + use thiserror::Error; 2 + 3 + #[derive(Debug, Error)] 4 + pub enum MainTaskError { 5 + #[error(transparent)] 6 + ConsumerTaskError(#[from] ConsumerError), 7 + #[error(transparent)] 8 + ServerTaskError(#[from] ServerError), 9 + #[error(transparent)] 10 + DelayTaskError(#[from] DelayError), 11 + } 12 + 13 + #[derive(Debug, Error)] 14 + pub enum ConsumerError { 15 + #[error(transparent)] 16 + JetstreamConnectionError(#[from] jetstream::error::ConnectionError), 17 + #[error(transparent)] 18 + JetstreamConfigValidationError(#[from] jetstream::error::ConfigValidationError), 19 + #[error("jetstream ended")] 20 + JetstreamEnded, 21 + #[error("delay queue output dropped")] 22 + DelayQueueOutputDropped, 23 + } 24 + 25 + #[derive(Debug, Error)] 26 + pub enum SubscriberUpdateError { 27 + #[error("failed to parse json for subscriber update: {0}")] 28 + FailedToParseMessage(serde_json::Error), 29 + #[error("more wantedSources were requested than allowed (max 1,000)")] 30 + TooManySourcesWanted, 31 + #[error("more wantedSubjectDids were requested than allowed (max 10,000)")] 32 + TooManyDidsWanted, 33 + #[error("more wantedSubjects were requested than allowed (max 50,000)")] 34 + TooManySubjectsWanted, 35 + } 36 + 37 + #[derive(Debug, Error)] 38 + pub enum DelayError { 39 + #[error("delay ended")] 40 + DelayEnded, 41 + } 42 + 43 + #[derive(Debug, Error)] 44 + pub enum ServerError { 45 + #[error("failed to configure server logger: {0}")] 46 + ConfigLogError(std::io::Error), 47 + #[error("failed to render json for openapi: {0}")] 48 + OpenApiJsonFail(serde_json::Error), 49 + #[error(transparent)] 50 + FailedToBuildServer(#[from] dropshot::BuildError), 51 + #[error("server exited: {0}")] 52 + ServerExited(String), 53 + #[error("server closed badly: {0}")] 54 + BadClose(String), 55 + }
+105
spacedust/src/lib.rs
··· 1 + pub mod consumer; 2 + pub mod delay; 3 + pub mod error; 4 + pub mod removable_delay_queue; 5 + pub mod server; 6 + pub mod storage; 7 + pub mod subscriber; 8 + 9 + use jetstream::events::CommitEvent; 10 + use links::CollectedLink; 11 + use serde::{Deserialize, Serialize}; 12 + use server::MultiSubscribeQuery; 13 + use tokio_tungstenite::tungstenite::Message; 14 + 15 + #[derive(Debug)] 16 + pub struct FilterableProperties { 17 + /// Full unmodified DID, at-uri, or url 18 + pub subject: String, 19 + /// User/identity DID. 20 + /// 21 + /// Will match both bare-DIDs and DIDs extracted from at-uris. 22 + /// `None` for any URL. 23 + pub subject_did: Option<String>, 24 + /// Link source -- collection NSID joined with `:` to the record property path. 25 + pub source: String, 26 + } 27 + 28 + /// A serialized message with filterable properties attached 29 + #[derive(Debug)] 30 + pub struct ClientMessage { 31 + pub message: Message, // always Message::Text 32 + pub properties: FilterableProperties, 33 + } 34 + 35 + impl ClientMessage { 36 + pub fn new_link( 37 + link: CollectedLink, 38 + at_uri: &str, 39 + commit: &CommitEvent, 40 + ) -> Result<Self, serde_json::Error> { 41 + let subject_did = link.target.did(); 42 + 43 + let subject = link.target.into_string(); 44 + 45 + let undotted = link.path.strip_prefix('.').unwrap_or_else(|| { 46 + eprintln!("link path did not have expected '.' prefix: {}", link.path); 47 + "" 48 + }); 49 + let source = format!("{}:{undotted}", &*commit.collection); 50 + 51 + let client_link_event = ClientLinkEvent { 52 + operation: "create", 53 + source: source.clone(), 54 + source_record: at_uri.to_string(), 55 + source_rev: commit.rev.to_string(), 56 + subject: subject.clone(), 57 + }; 58 + 59 + let client_event = ClientEvent { 60 + kind: "link", 61 + origin: "live", // TODO: indicate when we're locally replaying jetstream on reconnect?? maybe not. 62 + link: client_link_event, 63 + }; 64 + 65 + let client_event_json = serde_json::to_string(&client_event)?; 66 + 67 + let message = Message::Text(client_event_json.into()); 68 + 69 + let properties = FilterableProperties { 70 + subject, 71 + subject_did, 72 + source, 73 + }; 74 + 75 + Ok(ClientMessage { 76 + message, 77 + properties, 78 + }) 79 + } 80 + } 81 + 82 + #[derive(Debug, Serialize)] 83 + #[serde(rename_all = "snake_case")] 84 + pub struct ClientEvent { 85 + kind: &'static str, // "link" 86 + origin: &'static str, // "live", "replay", "backfill" 87 + link: ClientLinkEvent, 88 + } 89 + 90 + #[derive(Debug, Serialize)] 91 + struct ClientLinkEvent { 92 + operation: &'static str, // "create", "delete" (prob no update, though maybe for rev?) 93 + source: String, 94 + source_record: String, 95 + source_rev: String, 96 + subject: String, 97 + // TODO: include the record too? would save clients a level of hydration 98 + // ^^ no, not for now. until we backfill + support broader deletes at *least*. 99 + } 100 + 101 + #[derive(Debug, Deserialize)] 102 + #[serde(tag = "type", content = "payload", rename_all = "snake_case")] 103 + pub enum SubscriberSourcedMessage { 104 + OptionsUpdate(MultiSubscribeQuery), 105 + }
+144
spacedust/src/main.rs
··· 1 + use spacedust::consumer; 2 + use spacedust::delay; 3 + use spacedust::error::MainTaskError; 4 + use spacedust::removable_delay_queue::removable_delay_queue; 5 + use spacedust::server; 6 + 7 + use clap::Parser; 8 + use metrics_exporter_prometheus::PrometheusBuilder; 9 + use std::time::Duration; 10 + use tokio::sync::broadcast; 11 + use tokio_util::sync::CancellationToken; 12 + 13 + /// Aggregate links in the at-mosphere 14 + #[derive(Parser, Debug, Clone)] 15 + #[command(version, about, long_about = None)] 16 + struct Args { 17 + /// Jetstream server to connect to (exclusive with --fixture). Provide either a wss:// URL, or a shorhand value: 18 + /// 'us-east-1', 'us-east-2', 'us-west-1', or 'us-west-2' 19 + #[arg(long)] 20 + jetstream: String, 21 + /// don't request zstd-compressed jetstream events 22 + /// 23 + /// reduces CPU at the expense of more ingress bandwidth 24 + #[arg(long, action)] 25 + jetstream_no_zstd: bool, 26 + } 27 + 28 + #[tokio::main] 29 + async fn main() -> Result<(), String> { 30 + env_logger::init(); 31 + 32 + // tokio broadcast keeps a single main output queue for all subscribers. 33 + // each subscriber clones off a copy of an individual value for each recv. 34 + // since there's no large per-client buffer, we can make this one kind of 35 + // big and accommodate more slow/bursty clients. 36 + // 37 + // in fact, we *could* even keep lagging clients alive, inserting lag- 38 + // indicating messages to their output.... but for now we'll drop them to 39 + // avoid accumulating zombies. 40 + // 41 + // events on the channel are individual links as they are discovered. a link 42 + // contains a source and a target. the target is an at-uri, so it's up to 43 + // ~1KB max; source is a collection + link path, which can be more but in 44 + // practice the whole link rarely approaches 1KB total. 45 + // 46 + // TODO: determine if a pathological case could blow this up (eg 1MB link 47 + // paths + slow subscriber -> 16GiB queue) 48 + let (b, _) = broadcast::channel(16_384); 49 + let consumer_sender = b.clone(); 50 + let (d, _) = broadcast::channel(16_384); 51 + let consumer_delayed_sender = d.clone(); 52 + 53 + let delay = Duration::from_secs(21); 54 + let (delay_queue_sender, delay_queue_receiver) = removable_delay_queue(delay); 55 + 56 + let shutdown = CancellationToken::new(); 57 + 58 + let ctrlc_shutdown = shutdown.clone(); 59 + ctrlc::set_handler(move || ctrlc_shutdown.cancel()).expect("failed to set ctrl-c handler"); 60 + 61 + let args = Args::parse(); 62 + 63 + if let Err(e) = install_metrics_server() { 64 + log::error!("failed to install metrics server: {e:?}"); 65 + }; 66 + 67 + let mut tasks: tokio::task::JoinSet<Result<(), MainTaskError>> = tokio::task::JoinSet::new(); 68 + 69 + let server_shutdown = shutdown.clone(); 70 + tasks.spawn(async move { 71 + server::serve(b, d, server_shutdown).await?; 72 + Ok(()) 73 + }); 74 + 75 + let consumer_shutdown = shutdown.clone(); 76 + tasks.spawn(async move { 77 + consumer::consume( 78 + consumer_sender, 79 + delay_queue_sender, 80 + args.jetstream, 81 + None, 82 + args.jetstream_no_zstd, 83 + consumer_shutdown, 84 + ) 85 + .await?; 86 + Ok(()) 87 + }); 88 + 89 + let delay_shutdown = shutdown.clone(); 90 + tasks.spawn(async move { 91 + delay::to_broadcast( 92 + delay_queue_receiver, 93 + consumer_delayed_sender, 94 + delay_shutdown, 95 + ) 96 + .await?; 97 + Ok(()) 98 + }); 99 + 100 + tokio::select! { 101 + _ = shutdown.cancelled() => log::warn!("shutdown requested"), 102 + Some(r) = tasks.join_next() => { 103 + log::warn!("a task exited, shutting down: {r:?}"); 104 + shutdown.cancel(); 105 + } 106 + } 107 + 108 + tokio::select! { 109 + _ = async { 110 + while let Some(completed) = tasks.join_next().await { 111 + log::info!("shutdown: task completed: {completed:?}"); 112 + } 113 + } => {}, 114 + _ = tokio::time::sleep(std::time::Duration::from_secs(3)) => { 115 + log::info!("shutdown: not all tasks completed on time. aborting..."); 116 + tasks.shutdown().await; 117 + }, 118 + } 119 + 120 + log::info!("bye!"); 121 + 122 + Ok(()) 123 + } 124 + 125 + fn install_metrics_server() -> Result<(), metrics_exporter_prometheus::BuildError> { 126 + log::info!("installing metrics server..."); 127 + let host = [0, 0, 0, 0]; 128 + let port = 8765; 129 + PrometheusBuilder::new() 130 + .set_quantiles(&[0.5, 0.9, 0.99, 1.0])? 131 + .set_bucket_duration(std::time::Duration::from_secs(300))? 132 + .set_bucket_count(std::num::NonZero::new(12).unwrap()) // count * duration = 60 mins. stuff doesn't happen that fast here. 133 + .set_enable_unit_suffix(false) // this seemed buggy for constellation (sometimes wouldn't engage) 134 + .with_http_listener((host, port)) 135 + .install()?; 136 + log::info!( 137 + "metrics server installed! listening on http://{}.{}.{}.{}:{port}", 138 + host[0], 139 + host[1], 140 + host[2], 141 + host[3] 142 + ); 143 + Ok(()) 144 + }
+125
spacedust/src/removable_delay_queue.rs
··· 1 + use std::collections::{BTreeMap, VecDeque}; 2 + use std::ops::RangeBounds; 3 + use std::sync::Arc; 4 + use std::time::{Duration, Instant}; 5 + use thiserror::Error; 6 + use tokio::sync::Mutex; 7 + 8 + #[derive(Debug, Error)] 9 + pub enum EnqueueError<T> { 10 + #[error("queue ouput dropped")] 11 + OutputDropped(T), 12 + } 13 + 14 + pub trait Key: Eq + Ord + Clone {} 15 + impl<T: Eq + Ord + Clone> Key for T {} 16 + 17 + #[derive(Debug)] 18 + struct Queue<K: Key, T> { 19 + queue: VecDeque<(Instant, K)>, 20 + items: BTreeMap<K, T>, 21 + } 22 + 23 + pub struct Input<K: Key, T> { 24 + q: Arc<Mutex<Queue<K, T>>>, 25 + } 26 + 27 + impl<K: Key, T> Input<K, T> { 28 + /// if a key is already present, its previous item will be overwritten and 29 + /// its delay time will be reset for the new item. 30 + /// 31 + /// errors if the remover has been dropped 32 + pub async fn enqueue(&self, key: K, item: T) -> Result<(), EnqueueError<T>> { 33 + if Arc::strong_count(&self.q) == 1 { 34 + return Err(EnqueueError::OutputDropped(item)); 35 + } 36 + // TODO: try to push out an old element first 37 + // for now we just hope there's a listener 38 + let now = Instant::now(); 39 + let mut q = self.q.lock().await; 40 + q.queue.push_back((now, key.clone())); 41 + q.items.insert(key, item); 42 + Ok(()) 43 + } 44 + /// remove an item from the queue, by key 45 + /// 46 + /// the item itself is removed, but the key will remain in the queue -- it 47 + /// will simply be skipped over when a new output item is requested. this 48 + /// keeps the removal cheap (=btreemap remove), for a bit of space overhead 49 + pub async fn remove_range(&self, range: impl RangeBounds<K>) { 50 + let n = { 51 + let mut q = self.q.lock().await; 52 + let keys = q 53 + .items 54 + .range(range) 55 + .map(|(k, _)| k) 56 + .cloned() 57 + .collect::<Vec<_>>(); 58 + for k in &keys { 59 + q.items.remove(k); 60 + } 61 + keys.len() 62 + }; 63 + if n == 0 { 64 + metrics::counter!("delay_queue_remove_not_found").increment(1); 65 + } else { 66 + metrics::counter!("delay_queue_remove_total_records").increment(1); 67 + metrics::counter!("delay_queue_remove_total_links").increment(n as u64); 68 + } 69 + } 70 + } 71 + 72 + pub struct Output<K: Key, T> { 73 + delay: Duration, 74 + q: Arc<Mutex<Queue<K, T>>>, 75 + } 76 + 77 + impl<K: Key, T> Output<K, T> { 78 + pub async fn next(&self) -> Option<T> { 79 + let get = || async { 80 + let mut q = self.q.lock().await; 81 + metrics::gauge!("delay_queue_queue_len").set(q.queue.len() as f64); 82 + metrics::gauge!("delay_queue_queue_capacity").set(q.queue.capacity() as f64); 83 + while let Some((t, k)) = q.queue.pop_front() { 84 + // skip over queued keys that were removed from items 85 + if let Some(item) = q.items.remove(&k) { 86 + return Some((t, item)); 87 + } 88 + } 89 + None 90 + }; 91 + loop { 92 + if let Some((t, item)) = get().await { 93 + let now = Instant::now(); 94 + let expected_release = t + self.delay; 95 + if expected_release.saturating_duration_since(now) > Duration::from_millis(1) { 96 + tokio::time::sleep_until(expected_release.into()).await; 97 + metrics::counter!("delay_queue_emit_total", "early" => "yes").increment(1); 98 + metrics::histogram!("delay_queue_emit_overshoot").record(0); 99 + } else { 100 + let overshoot = now.saturating_duration_since(expected_release); 101 + metrics::counter!("delay_queue_emit_total", "early" => "no").increment(1); 102 + metrics::histogram!("delay_queue_emit_overshoot") 103 + .record(overshoot.as_secs_f64()); 104 + } 105 + return Some(item); 106 + } else if Arc::strong_count(&self.q) == 1 { 107 + return None; 108 + } 109 + // the queue is *empty*, so we need to wait at least as long as the current delay 110 + tokio::time::sleep(self.delay).await; 111 + metrics::counter!("delay_queue_entirely_empty_total").increment(1); 112 + } 113 + } 114 + } 115 + 116 + pub fn removable_delay_queue<K: Key, T>(delay: Duration) -> (Input<K, T>, Output<K, T>) { 117 + let q: Arc<Mutex<Queue<K, T>>> = Arc::new(Mutex::new(Queue { 118 + queue: VecDeque::new(), 119 + items: BTreeMap::new(), 120 + })); 121 + 122 + let input = Input::<K, T> { q: q.clone() }; 123 + let output = Output::<K, T> { q, delay }; 124 + (input, output) 125 + }
+339
spacedust/src/server.rs
··· 1 + use crate::ClientMessage; 2 + use crate::error::ServerError; 3 + use crate::subscriber::Subscriber; 4 + use dropshot::{ 5 + ApiDescription, ApiEndpointBodyContentType, Body, ConfigDropshot, ConfigLogging, 6 + ConfigLoggingLevel, ExtractorMetadata, HttpError, HttpResponse, Query, RequestContext, 7 + ServerBuilder, ServerContext, SharedExtractor, WebsocketConnection, channel, endpoint, 8 + }; 9 + use http::{ 10 + Response, StatusCode, 11 + header::{ORIGIN, USER_AGENT}, 12 + }; 13 + use metrics::{counter, histogram}; 14 + use std::sync::Arc; 15 + 16 + use async_trait::async_trait; 17 + use schemars::JsonSchema; 18 + use serde::{Deserialize, Serialize}; 19 + use std::collections::HashSet; 20 + use tokio::sync::broadcast; 21 + use tokio::time::Instant; 22 + use tokio_tungstenite::tungstenite::protocol::{Role, WebSocketConfig}; 23 + use tokio_util::sync::CancellationToken; 24 + 25 + const INDEX_HTML: &str = include_str!("../static/index.html"); 26 + const FAVICON: &[u8] = include_bytes!("../static/favicon.ico"); 27 + 28 + pub async fn serve( 29 + b: broadcast::Sender<Arc<ClientMessage>>, 30 + d: broadcast::Sender<Arc<ClientMessage>>, 31 + shutdown: CancellationToken, 32 + ) -> Result<(), ServerError> { 33 + let config_logging = ConfigLogging::StderrTerminal { 34 + level: ConfigLoggingLevel::Info, 35 + }; 36 + 37 + let log = config_logging 38 + .to_logger("example-basic") 39 + .map_err(ServerError::ConfigLogError)?; 40 + 41 + let mut api = ApiDescription::new(); 42 + api.register(index).unwrap(); 43 + api.register(favicon).unwrap(); 44 + api.register(openapi).unwrap(); 45 + api.register(subscribe).unwrap(); 46 + 47 + // TODO: put spec in a once cell / lazy lock thing? 48 + let spec = Arc::new( 49 + api.openapi( 50 + "Spacedust", 51 + env!("CARGO_PKG_VERSION") 52 + .parse() 53 + .inspect_err(|e| { 54 + eprintln!("failed to parse cargo package version for openapi: {e:?}") 55 + }) 56 + .unwrap_or(semver::Version::new(0, 0, 1)), 57 + ) 58 + .description("A configurable ATProto notifications firehose.") 59 + .contact_name("part of @microcosm.blue") 60 + .contact_url("https://microcosm.blue") 61 + .json() 62 + .map_err(ServerError::OpenApiJsonFail)?, 63 + ); 64 + 65 + let sub_shutdown = shutdown.clone(); 66 + let ctx = Context { 67 + spec, 68 + b, 69 + d, 70 + shutdown: sub_shutdown, 71 + }; 72 + 73 + let server = ServerBuilder::new(api, ctx, log) 74 + .config(ConfigDropshot { 75 + bind_address: "0.0.0.0:9998".parse().unwrap(), 76 + ..Default::default() 77 + }) 78 + .start()?; 79 + 80 + tokio::select! { 81 + s = server.wait_for_shutdown() => { 82 + s.map_err(ServerError::ServerExited)?; 83 + log::info!("server shut down normally."); 84 + }, 85 + _ = shutdown.cancelled() => { 86 + log::info!("shutting down: closing server"); 87 + server.close().await.map_err(ServerError::BadClose)?; 88 + }, 89 + } 90 + Ok(()) 91 + } 92 + 93 + #[derive(Debug, Clone)] 94 + struct Context { 95 + pub spec: Arc<serde_json::Value>, 96 + pub b: broadcast::Sender<Arc<ClientMessage>>, 97 + pub d: broadcast::Sender<Arc<ClientMessage>>, 98 + pub shutdown: CancellationToken, 99 + } 100 + 101 + async fn instrument_handler<T, H, R>(ctx: &RequestContext<T>, handler: H) -> Result<R, HttpError> 102 + where 103 + R: HttpResponse, 104 + H: Future<Output = Result<R, HttpError>>, 105 + T: ServerContext, 106 + { 107 + let start = Instant::now(); 108 + let result = handler.await; 109 + let latency = start.elapsed(); 110 + let status_code = match &result { 111 + Ok(response) => response.status_code(), 112 + Err(e) => e.status_code.as_status(), 113 + } 114 + .as_str() // just the number (.to_string()'s Display does eg `200 OK`) 115 + .to_string(); 116 + let endpoint = ctx.endpoint.operation_id.clone(); 117 + let headers = ctx.request.headers(); 118 + let origin = headers 119 + .get(ORIGIN) 120 + .and_then(|v| v.to_str().ok()) 121 + .unwrap_or("") 122 + .to_string(); 123 + let ua = headers 124 + .get(USER_AGENT) 125 + .and_then(|v| v.to_str().ok()) 126 + .map(|ua| { 127 + if ua.starts_with("Mozilla/5.0 ") { 128 + "browser" 129 + } else { 130 + ua 131 + } 132 + }) 133 + .unwrap_or("") 134 + .to_string(); 135 + counter!("server_requests_total", 136 + "endpoint" => endpoint.clone(), 137 + "origin" => origin, 138 + "ua" => ua, 139 + "status_code" => status_code, 140 + ) 141 + .increment(1); 142 + histogram!("server_handler_latency", "endpoint" => endpoint).record(latency.as_micros() as f64); 143 + result 144 + } 145 + 146 + use dropshot::{HttpResponseHeaders, HttpResponseOk}; 147 + 148 + pub type OkCorsResponse<T> = Result<HttpResponseHeaders<HttpResponseOk<T>>, HttpError>; 149 + 150 + /// Helper for constructing Ok responses: return OkCors(T).into() 151 + /// (not happy with this yet) 152 + pub struct OkCors<T: Serialize + JsonSchema + Send + Sync>(pub T); 153 + 154 + impl<T> From<OkCors<T>> for OkCorsResponse<T> 155 + where 156 + T: Serialize + JsonSchema + Send + Sync, 157 + { 158 + fn from(ok: OkCors<T>) -> OkCorsResponse<T> { 159 + let mut res = HttpResponseHeaders::new_unnamed(HttpResponseOk(ok.0)); 160 + res.headers_mut() 161 + .insert("access-control-allow-origin", "*".parse().unwrap()); 162 + Ok(res) 163 + } 164 + } 165 + 166 + // TODO: cors for HttpError 167 + 168 + /// Serve index page as html 169 + #[endpoint { 170 + method = GET, 171 + path = "/", 172 + /* 173 + * not useful to have this in openapi 174 + */ 175 + unpublished = true, 176 + }] 177 + async fn index(ctx: RequestContext<Context>) -> Result<Response<Body>, HttpError> { 178 + instrument_handler(&ctx, async { 179 + Ok(Response::builder() 180 + .status(StatusCode::OK) 181 + .header(http::header::CONTENT_TYPE, "text/html") 182 + .body(INDEX_HTML.into())?) 183 + }) 184 + .await 185 + } 186 + 187 + /// Serve index page as html 188 + #[endpoint { 189 + method = GET, 190 + path = "/favicon.ico", 191 + /* 192 + * not useful to have this in openapi 193 + */ 194 + unpublished = true, 195 + }] 196 + async fn favicon(ctx: RequestContext<Context>) -> Result<Response<Body>, HttpError> { 197 + instrument_handler(&ctx, async { 198 + Ok(Response::builder() 199 + .status(StatusCode::OK) 200 + .header(http::header::CONTENT_TYPE, "image/x-icon") 201 + .body(FAVICON.to_vec().into())?) 202 + }) 203 + .await 204 + } 205 + 206 + /// Meta: get the openapi spec for this api 207 + #[endpoint { 208 + method = GET, 209 + path = "/openapi", 210 + /* 211 + * not useful to have this in openapi 212 + */ 213 + unpublished = true, 214 + }] 215 + async fn openapi(ctx: RequestContext<Context>) -> OkCorsResponse<serde_json::Value> { 216 + instrument_handler(&ctx, async { 217 + let spec = (*ctx.context().spec).clone(); 218 + OkCors(spec).into() 219 + }) 220 + .await 221 + } 222 + 223 + /// The real type that gets deserialized 224 + #[derive(Debug, Deserialize, JsonSchema)] 225 + #[serde(rename_all = "camelCase")] 226 + pub struct MultiSubscribeQuery { 227 + #[serde(default)] 228 + pub wanted_subjects: HashSet<String>, 229 + #[serde(default)] 230 + pub wanted_subject_dids: HashSet<String>, 231 + #[serde(default)] 232 + pub wanted_sources: HashSet<String>, 233 + } 234 + /// The fake corresponding type for docs that dropshot won't freak out about a 235 + /// vec for 236 + #[derive(Deserialize, JsonSchema)] 237 + #[allow(dead_code)] 238 + #[serde(rename_all = "camelCase")] 239 + struct MultiSubscribeQueryForDocs { 240 + /// One or more at-uris to receive links about 241 + /// 242 + /// The at-uri must be url-encoded 243 + /// 244 + /// Pass this parameter multiple times to specify multiple collections, like 245 + /// `wantedSubjects=[...]&wantedSubjects=[...]` 246 + pub wanted_subjects: String, 247 + /// One or more DIDs to receive links about 248 + /// 249 + /// Pass this parameter multiple times to specify multiple collections 250 + pub wanted_subject_dids: String, 251 + /// One or more link sources to receive links about 252 + /// 253 + /// TODO: docs about link sources 254 + /// 255 + /// eg, a bluesky like's link source: `app.bsky.feed.like:subject.uri` 256 + /// 257 + /// Pass this parameter multiple times to specify multiple sources 258 + pub wanted_sources: String, 259 + } 260 + 261 + // The `SharedExtractor` implementation for Query<QueryType> describes how to 262 + // construct an instance of `Query<QueryType>` from an HTTP request: namely, by 263 + // parsing the query string to an instance of `QueryType`. 264 + #[async_trait] 265 + impl SharedExtractor for MultiSubscribeQuery { 266 + async fn from_request<Context: ServerContext>( 267 + ctx: &RequestContext<Context>, 268 + ) -> Result<MultiSubscribeQuery, HttpError> { 269 + let raw_query = ctx.request.uri().query().unwrap_or(""); 270 + let q = serde_qs::from_str(raw_query).map_err(|e| { 271 + HttpError::for_bad_request(None, format!("unable to parse query string: {e}")) 272 + })?; 273 + Ok(q) 274 + } 275 + 276 + fn metadata(body_content_type: ApiEndpointBodyContentType) -> ExtractorMetadata { 277 + // HACK: query type switcheroo: passing MultiSubscribeQuery to 278 + // `metadata` would "helpfully" panic because dropshot believes we can 279 + // only have scalar types in a query. 280 + // 281 + // so instead we have a fake second type whose only job is to look the 282 + // same as MultiSubscribeQuery exept that it has `String` instead of 283 + // `Vec<String>`, which dropshot will accept, and generate ~close-enough 284 + // docs for. 285 + <Query<MultiSubscribeQueryForDocs> as SharedExtractor>::metadata(body_content_type) 286 + } 287 + } 288 + 289 + #[derive(Deserialize, JsonSchema)] 290 + #[serde(rename_all = "camelCase")] 291 + struct ScalarSubscribeQuery { 292 + /// Bypass the 21-sec delay buffer 293 + /// 294 + /// By default, spacedust holds all firehose links for 21 seconds before 295 + /// emitting them, to prevent quickly- undone interactions from generating 296 + /// notifications. 297 + /// 298 + /// Setting `instant` to true bypasses this buffer, allowing faster (and 299 + /// noisier) notification delivery. 300 + /// 301 + /// Typically [a little less than 1%](https://bsky.app/profile/bad-example.com/post/3ls32wctsrs2l) 302 + /// of links links get deleted within 21s of being created. 303 + #[serde(default)] 304 + pub instant: bool, 305 + } 306 + 307 + #[channel { 308 + protocol = WEBSOCKETS, 309 + path = "/subscribe", 310 + }] 311 + async fn subscribe( 312 + reqctx: RequestContext<Context>, 313 + query: MultiSubscribeQuery, 314 + scalar_query: Query<ScalarSubscribeQuery>, 315 + upgraded: WebsocketConnection, 316 + ) -> dropshot::WebsocketChannelResult { 317 + let ws = tokio_tungstenite::WebSocketStream::from_raw_socket( 318 + upgraded.into_inner(), 319 + Role::Server, 320 + Some(WebSocketConfig::default().max_message_size( 321 + Some(10 * 2_usize.pow(20)), // 10MiB, matching jetstream 322 + )), 323 + ) 324 + .await; 325 + 326 + let Context { b, d, shutdown, .. } = reqctx.context(); 327 + let sub_token = shutdown.child_token(); 328 + 329 + let q = scalar_query.into_inner(); 330 + let subscription = if q.instant { b } else { d }.subscribe(); 331 + log::info!("starting subscriber with broadcast: instant={}", q.instant); 332 + 333 + Subscriber::new(query, sub_token) 334 + .start(ws, subscription) 335 + .await 336 + .map_err(|e| format!("boo: {e:?}"))?; 337 + 338 + Ok(()) 339 + }
spacedust/src/storage/car/drive.rs

This is a binary file and will not be displayed.

+1
spacedust/src/storage/car/mod.rs
··· 1 +
spacedust/src/storage/car/walk.rs

This is a binary file and will not be displayed.

+9
spacedust/src/storage/fjall/mod.rs
··· 1 + use crate::storage::Storage; 2 + 3 + pub struct FjallStorage {} 4 + 5 + impl Storage for FjallStorage { 6 + fn import_car() { 7 + todo!() 8 + } 9 + }
+6
spacedust/src/storage/mod.rs
··· 1 + pub mod car; 2 + pub mod fjall; 3 + 4 + pub trait Storage { 5 + fn import_car() {} 6 + }
+164
spacedust/src/subscriber.rs
··· 1 + use crate::error::SubscriberUpdateError; 2 + use crate::server::MultiSubscribeQuery; 3 + use crate::{ClientMessage, FilterableProperties, SubscriberSourcedMessage}; 4 + use dropshot::WebsocketConnectionRaw; 5 + use futures::SinkExt; 6 + use futures::StreamExt; 7 + use std::error::Error; 8 + use std::sync::Arc; 9 + use std::time::Duration; 10 + use tokio::sync::broadcast::{self, error::RecvError}; 11 + use tokio::time::interval; 12 + use tokio_tungstenite::{WebSocketStream, tungstenite::Message}; 13 + use tokio_util::sync::CancellationToken; 14 + 15 + const PING_PERIOD: Duration = Duration::from_secs(30); 16 + 17 + pub struct Subscriber { 18 + query: MultiSubscribeQuery, 19 + shutdown: CancellationToken, 20 + } 21 + 22 + impl Subscriber { 23 + pub fn new(query: MultiSubscribeQuery, shutdown: CancellationToken) -> Self { 24 + Self { query, shutdown } 25 + } 26 + 27 + pub async fn start( 28 + mut self, 29 + ws: WebSocketStream<WebsocketConnectionRaw>, 30 + mut receiver: broadcast::Receiver<Arc<ClientMessage>>, 31 + ) -> Result<(), Box<dyn Error>> { 32 + let mut ping_state = None; 33 + let (mut ws_sender, mut ws_receiver) = ws.split(); 34 + let mut ping_interval = interval(PING_PERIOD); 35 + let _guard = self.shutdown.clone().drop_guard(); 36 + 37 + // TODO: do we need to timeout ws sends?? 38 + 39 + metrics::counter!("subscribers_connected_total").increment(1); 40 + metrics::gauge!("subscribers_connected").increment(1); 41 + 42 + loop { 43 + tokio::select! { 44 + l = receiver.recv() => match l { 45 + Ok(link) => if self.filter(&link.properties) 46 + && let Err(e) = ws_sender.send(link.message.clone()).await 47 + { 48 + log::warn!("failed to send link, dropping subscriber: {e:?}"); 49 + break; 50 + }, 51 + Err(RecvError::Closed) => self.shutdown.cancel(), 52 + Err(RecvError::Lagged(n)) => { 53 + log::warn!("dropping lagging subscriber (missed {n} messages already)"); 54 + self.shutdown.cancel(); 55 + } 56 + }, 57 + cm = ws_receiver.next() => match cm { 58 + Some(Ok(Message::Ping(state))) => { 59 + if let Err(e) = ws_sender.send(Message::Pong(state)).await { 60 + log::error!("failed to reply pong to subscriber: {e:?}"); 61 + break; 62 + } 63 + } 64 + Some(Ok(Message::Pong(state))) => { 65 + if let Some(expected_state) = ping_state { 66 + if *state == expected_state { 67 + ping_state = None; // good 68 + } else { 69 + log::error!("subscriber returned a pong with the wrong state, dropping"); 70 + self.shutdown.cancel(); 71 + } 72 + } else { 73 + log::error!("subscriber sent a pong when none was expected"); 74 + self.shutdown.cancel(); 75 + } 76 + } 77 + Some(Ok(Message::Text(raw))) => { 78 + if let Err(e) = self.query.update_from_raw(&raw) { 79 + log::error!("subscriber options could not be updated, dropping: {e:?}"); 80 + // TODO: send client an explanation 81 + self.shutdown.cancel(); 82 + } 83 + log::trace!("subscriber updated with opts: {:?}", self.query); 84 + }, 85 + Some(Ok(m)) => log::trace!("subscriber sent an unexpected message: {m:?}"), 86 + Some(Err(e)) => { 87 + log::error!("failed to receive subscriber message: {e:?}"); 88 + break; 89 + } 90 + None => { 91 + log::trace!("end of subscriber messages. bye!"); 92 + break; 93 + } 94 + }, 95 + _ = ping_interval.tick() => { 96 + if ping_state.is_some() { 97 + log::warn!("did not recieve pong within {PING_PERIOD:?}, dropping subscriber"); 98 + self.shutdown.cancel(); 99 + } else { 100 + let new_state: [u8; 8] = rand::random(); 101 + let ping = new_state.to_vec().into(); 102 + ping_state = Some(new_state); 103 + if let Err(e) = ws_sender.send(Message::Ping(ping)).await { 104 + log::error!("failed to send ping to subscriber, dropping: {e:?}"); 105 + self.shutdown.cancel(); 106 + } 107 + } 108 + } 109 + _ = self.shutdown.cancelled() => { 110 + log::info!("subscriber shutdown requested, bye!"); 111 + if let Err(e) = ws_sender.close().await { 112 + log::warn!("failed to close subscriber: {e:?}"); 113 + } 114 + break; 115 + }, 116 + } 117 + } 118 + log::trace!("end of subscriber. bye!"); 119 + metrics::gauge!("subscribers_connected").decrement(1); 120 + Ok(()) 121 + } 122 + 123 + fn filter(&self, properties: &FilterableProperties) -> bool { 124 + let query = &self.query; 125 + 126 + // subject + subject DIDs are logical OR 127 + if !(query.wanted_subjects.is_empty() && query.wanted_subject_dids.is_empty() 128 + || query.wanted_subjects.contains(&properties.subject) 129 + || properties 130 + .subject_did 131 + .as_ref() 132 + .map(|did| query.wanted_subject_dids.contains(did)) 133 + .unwrap_or(false)) 134 + { 135 + // wowwww ^^ fix that 136 + return false; 137 + } 138 + 139 + // subjects together with sources are logical AND 140 + if !(query.wanted_sources.is_empty() || query.wanted_sources.contains(&properties.source)) { 141 + return false; 142 + } 143 + 144 + true 145 + } 146 + } 147 + 148 + impl MultiSubscribeQuery { 149 + pub fn update_from_raw(&mut self, s: &str) -> Result<(), SubscriberUpdateError> { 150 + let SubscriberSourcedMessage::OptionsUpdate(opts) = 151 + serde_json::from_str(s).map_err(SubscriberUpdateError::FailedToParseMessage)?; 152 + if opts.wanted_sources.len() > 1_000 { 153 + return Err(SubscriberUpdateError::TooManySourcesWanted); 154 + } 155 + if opts.wanted_subject_dids.len() > 10_000 { 156 + return Err(SubscriberUpdateError::TooManyDidsWanted); 157 + } 158 + if opts.wanted_subjects.len() > 50_000 { 159 + return Err(SubscriberUpdateError::TooManySubjectsWanted); 160 + } 161 + *self = opts; 162 + Ok(()) 163 + } 164 + }
spacedust/static/favicon.ico

This is a binary file and will not be displayed.

+54
spacedust/static/index.html
··· 1 + <!doctype html> 2 + <html lang="en"> 3 + <head> 4 + <meta charset="utf-8" /> 5 + <title>Spacedust documentation</title> 6 + <meta name="viewport" content="width=device-width, initial-scale=1" /> 7 + <meta name="description" content="API Documentation for Spacedust, a configurable ATProto notifications firehose" /> 8 + <style> 9 + .custom-header { 10 + height: 42px; 11 + background-color: #221828; 12 + box-shadow: inset 0 -1px 0 var(--scalar-border-color); 13 + color: var(--scalar-color-1); 14 + font-size: var(--scalar-font-size-3); 15 + font-family: 'Iowan Old Style', 'Palatino Linotype', 'URW Palladio L', P052, serif; 16 + padding: 0 18px; 17 + justify-content: space-between; 18 + } 19 + .custom-header, 20 + .custom-header nav { 21 + display: flex; 22 + align-items: center; 23 + gap: 18px; 24 + } 25 + .custom-header a:hover { 26 + color: var(--scalar-color-2); 27 + } 28 + </style> 29 + </head> 30 + <body> 31 + <header class="custom-header scalar-app"> 32 + <p> 33 + TODO: pdsls jetstream link 34 + <a href="https://ufos.microcosm.blue">Launch 🛸 UFOs app</a>: Explore lexicons 35 + </p> 36 + <nav> 37 + <b>a <a href="https://microcosm.blue">microcosm</a> project</b> 38 + <a href="https://bsky.app/profile/microcosm.blue">@microcosm.blue</a> 39 + <a href="https://github.com/at-microcosm">github</a> 40 + </nav> 41 + </header> 42 + 43 + <script id="api-reference" type="application/json" data-url="/openapi"></script> 44 + 45 + <script> 46 + var configuration = { 47 + theme: 'purple', 48 + } 49 + document.getElementById('api-reference').dataset.configuration = JSON.stringify(configuration) 50 + </script> 51 + 52 + <script src="https://cdn.jsdelivr.net/npm/@scalar/api-reference"></script> 53 + </body> 54 + </html>
+5 -3
ufos/Cargo.toml
··· 8 8 async-trait = "0.1.88" 9 9 base64 = "0.22.1" 10 10 bincode = { version = "2.0.1", features = ["serde"] } 11 - cardinality-estimator-safe = { version = "4.0.1", features = ["with_serde", "with_digest"] } 11 + cardinality-estimator-safe = { version = "4.0.2", features = ["with_serde", "with_digest"] } 12 12 chrono = { version = "0.4.41", features = ["serde"] } 13 13 clap = { version = "4.5.31", features = ["derive"] } 14 14 dropshot = "0.16.0" 15 15 env_logger = "0.11.7" 16 - fjall = { version = "2.8.0", features = ["lz4"] } 16 + fjall = { git = "https://github.com/fjall-rs/fjall.git", features = ["lz4"] } 17 17 getrandom = "0.3.3" 18 18 http = "1.3.1" 19 - jetstream = { path = "../jetstream" } 19 + jetstream = { path = "../jetstream", features = ["metrics"] } 20 20 log = "0.4.26" 21 21 lsm-tree = "2.6.6" 22 + metrics = "0.24.2" 23 + metrics-exporter-prometheus = { version = "0.17.0", default-features = false, features = ["http-listener"] } 22 24 schemars = { version = "0.8.22", features = ["raw_value", "chrono"] } 23 25 semver = "1.0.26" 24 26 serde = "1.0.219"
+38 -5
ufos/src/consumer.rs
··· 5 5 DefaultJetstreamEndpoints, JetstreamCompression, JetstreamConfig, JetstreamConnector, 6 6 JetstreamReceiver, 7 7 }; 8 + use metrics::{ 9 + counter, describe_counter, describe_gauge, describe_histogram, gauge, histogram, Unit, 10 + }; 8 11 use std::mem; 9 12 use std::time::Duration; 10 13 use tokio::sync::mpsc::{channel, Receiver, Sender}; ··· 79 82 batch_sender: Sender<LimitedBatch>, 80 83 sketch_secret: SketchSecretPrefix, 81 84 ) -> Self { 85 + describe_counter!( 86 + "batcher_batches_sent", 87 + Unit::Count, 88 + "how many batches of events were sent from Batcher to storage" 89 + ); 90 + describe_gauge!( 91 + "batcher_batch_age", 92 + Unit::Microseconds, 93 + "how old the last-sent batch was" 94 + ); 95 + describe_gauge!( 96 + "batcher_send_queue_capacity", 97 + Unit::Count, 98 + "how many spaces are available for batches in the send queue" 99 + ); 100 + describe_histogram!( 101 + "batcher_total_collections", 102 + Unit::Count, 103 + "how many collections are in this batch" 104 + ); 82 105 let mut rate_limit = tokio::time::interval(std::time::Duration::from_millis(3)); 83 106 rate_limit.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Delay); 84 107 Self { ··· 188 211 // holds up all consumer progress until it can send to the channel 189 212 // use this when the current batch is too full to add more to it 190 213 async fn send_current_batch_now(&mut self, small: bool, referrer: &str) -> anyhow::Result<()> { 214 + let size_label = if small { "small" } else { "full" }; 215 + let queue_cap = self.batch_sender.capacity(); 216 + 217 + if let Some(cursor) = self.current_batch.initial_cursor { 218 + gauge!("batcher_batch_age", "size" => size_label).set(cursor.elapsed_micros_f64()); 219 + } 220 + histogram!("batcher_total_collections", "size" => size_label) 221 + .record(self.current_batch.batch.total_collections() as f64); 222 + gauge!("batcher_send_queue_capacity").set(queue_cap as f64); 223 + 191 224 let beginning = match self.current_batch.initial_cursor.map(|c| c.elapsed()) { 192 225 None => "unknown".to_string(), 193 - Some(Ok(t)) => format!("{:?}", t), 226 + Some(Ok(t)) => format!("{t:?}"), 194 227 Some(Err(e)) => format!("+{:?}", e.duration()), 195 228 }; 196 - log::info!( 197 - "sending batch now from {beginning}, {}, queue capacity: {}, referrer: {referrer}", 198 - if small { "small" } else { "full" }, 199 - self.batch_sender.capacity(), 229 + log::trace!( 230 + "sending batch now from {beginning}, {size_label}, queue capacity: {queue_cap}, referrer: {referrer}", 200 231 ); 201 232 let current = mem::take(&mut self.current_batch); 202 233 self.rate_limit.tick().await; 203 234 self.batch_sender 204 235 .send_timeout(current.batch, Duration::from_secs_f64(SEND_TIMEOUT_S)) 205 236 .await?; 237 + counter!("batcher_batches_sent", "size" => size_label, "referrer" => referrer.to_string()) 238 + .increment(1); 206 239 Ok(()) 207 240 } 208 241 }
+2 -2
ufos/src/db_types.rs
··· 427 427 ] { 428 428 let serialized = s.to_string().to_db_bytes()?; 429 429 let prefixed = String::sub_prefix(pre)?; 430 - assert_eq!(serialized.starts_with(&prefixed), is_pre, "{}", desc); 430 + assert_eq!(serialized.starts_with(&prefixed), is_pre, "{desc}"); 431 431 } 432 432 Ok(()) 433 433 } ··· 445 445 ] { 446 446 let serialized = Nsid::new(s.to_string()).unwrap().to_db_bytes()?; 447 447 let prefixed = Nsid::sub_prefix(pre)?; 448 - assert_eq!(serialized.starts_with(&prefixed), is_pre, "{}", desc); 448 + assert_eq!(serialized.starts_with(&prefixed), is_pre, "{desc}"); 449 449 } 450 450 Ok(()) 451 451 }
+6 -3
ufos/src/index_html.rs
··· 2 2 <html lang="en"> 3 3 <head> 4 4 <meta charset="utf-8" /> 5 - <title>UFOs API Documentation</title> 5 + <title>UFOs API documentation</title> 6 6 <meta name="viewport" content="width=device-width, initial-scale=1" /> 7 7 <meta name="description" content="API Documentation for UFOs: Samples and stats for all atproto lexicons." /> 8 8 <style> 9 9 .custom-header { 10 10 height: 42px; 11 - background-color: var(--scalar-background-1); 11 + background-color: #221828; 12 12 box-shadow: inset 0 -1px 0 var(--scalar-border-color); 13 13 color: var(--scalar-color-1); 14 14 font-size: var(--scalar-font-size-3); ··· 29 29 </head> 30 30 <body> 31 31 <header class="custom-header scalar-app"> 32 - <b>a <a href="https://microcosm.blue">microcosm</a> project</b> 32 + <p> 33 + <a href="https://ufos.microcosm.blue">Launch 🛸 UFOs app</a>: Explore lexicons 34 + </p> 33 35 <nav> 36 + <b>a <a href="https://microcosm.blue">microcosm</a> project</b> 34 37 <a href="https://bsky.app/profile/microcosm.blue">@microcosm.blue</a> 35 38 <a href="https://github.com/at-microcosm">github</a> 36 39 </nav>
+29 -3
ufos/src/lib.rs
··· 10 10 11 11 use crate::db_types::{EncodingError, EncodingResult}; 12 12 use crate::error::BatchInsertError; 13 - use crate::store_types::SketchSecretPrefix; 13 + use crate::store_types::{CountsValue, SketchSecretPrefix}; 14 14 use cardinality_estimator_safe::{Element, Sketch}; 15 15 use error::FirehoseEventError; 16 16 use jetstream::events::{CommitEvent, CommitOp, Cursor}; ··· 281 281 pub struct NsidCount { 282 282 nsid: String, 283 283 creates: u64, 284 - // TODO: add updates and deletes 284 + updates: u64, 285 + deletes: u64, 285 286 dids_estimate: u64, 287 + } 288 + impl NsidCount { 289 + pub fn new(nsid: &Nsid, counts: &CountsValue) -> Self { 290 + let crud = counts.counts(); 291 + Self { 292 + nsid: nsid.to_string(), 293 + creates: crud.creates, 294 + updates: crud.updates, 295 + deletes: crud.deletes, 296 + dids_estimate: counts.dids().estimate() as u64, 297 + } 298 + } 286 299 } 287 300 288 301 #[derive(Debug, PartialEq, Serialize, JsonSchema)] 289 302 pub struct PrefixCount { 290 303 prefix: String, 291 304 creates: u64, 292 - // TODO: add updates and deletes 305 + updates: u64, 306 + deletes: u64, 293 307 dids_estimate: u64, 308 + } 309 + impl PrefixCount { 310 + pub fn new(prefix: &str, counts: &CountsValue) -> Self { 311 + let crud = counts.counts(); 312 + Self { 313 + prefix: prefix.to_string(), 314 + creates: crud.creates, 315 + updates: crud.updates, 316 + deletes: crud.deletes, 317 + dids_estimate: counts.dids().estimate() as u64, 318 + } 319 + } 294 320 } 295 321 296 322 #[derive(Debug, PartialEq, Serialize, JsonSchema)]
+85 -11
ufos/src/main.rs
··· 1 1 use clap::Parser; 2 2 use jetstream::events::Cursor; 3 + use metrics::{describe_gauge, gauge, Unit}; 4 + use metrics_exporter_prometheus::PrometheusBuilder; 3 5 use std::path::PathBuf; 4 6 use std::time::{Duration, SystemTime}; 7 + use tokio::task::JoinSet; 5 8 use ufos::consumer; 6 9 use ufos::file_consumer; 7 10 use ufos::server; ··· 70 73 Ok(()) 71 74 } 72 75 73 - async fn go<B: StoreBackground>( 76 + async fn go<B: StoreBackground + 'static>( 74 77 args: Args, 75 78 read_store: impl StoreReader + 'static + Clone, 76 79 mut write_store: impl StoreWriter<B> + 'static, 77 80 cursor: Option<Cursor>, 78 81 sketch_secret: SketchSecretPrefix, 79 82 ) -> anyhow::Result<()> { 83 + let mut whatever_tasks: JoinSet<anyhow::Result<()>> = JoinSet::new(); 84 + let mut consumer_tasks: JoinSet<anyhow::Result<()>> = JoinSet::new(); 85 + 80 86 println!("starting server with storage..."); 81 87 let serving = server::serve(read_store.clone()); 88 + whatever_tasks.spawn(async move { 89 + serving.await.map_err(|e| { 90 + log::warn!("server ended: {e}"); 91 + anyhow::anyhow!(e) 92 + }) 93 + }); 82 94 83 95 if args.pause_writer { 84 96 log::info!("not starting jetstream or the write loop."); 85 - serving.await.map_err(|e| anyhow::anyhow!(e))?; 97 + for t in whatever_tasks.join_all().await { 98 + if let Err(e) = t { 99 + return Err(anyhow::anyhow!(e)); 100 + } 101 + } 86 102 return Ok(()); 87 103 } 88 104 ··· 100 116 let rolling = write_store 101 117 .background_tasks(args.reroll)? 102 118 .run(args.backfill); 103 - let consuming = write_store.receive_batches(batches); 119 + whatever_tasks.spawn(async move { 120 + rolling 121 + .await 122 + .inspect_err(|e| log::warn!("rollup ended: {e}"))?; 123 + Ok(()) 124 + }); 104 125 105 - let stating = do_update_stuff(read_store); 126 + consumer_tasks.spawn(async move { 127 + write_store 128 + .receive_batches(batches) 129 + .await 130 + .inspect_err(|e| log::warn!("consumer ended: {e}"))?; 131 + Ok(()) 132 + }); 106 133 107 - tokio::select! { 108 - z = serving => log::warn!("serve task ended: {z:?}"), 109 - z = rolling => log::warn!("rollup task ended: {z:?}"), 110 - z = consuming => log::warn!("consuming task ended: {z:?}"), 111 - z = stating => log::warn!("status task ended: {z:?}"), 112 - }; 134 + whatever_tasks.spawn(async move { 135 + do_update_stuff(read_store).await; 136 + log::warn!("status task ended"); 137 + Ok(()) 138 + }); 139 + 140 + install_metrics_server()?; 141 + 142 + for (i, t) in consumer_tasks.join_all().await.iter().enumerate() { 143 + log::warn!("task {i} done: {t:?}"); 144 + } 145 + 146 + println!("consumer tasks all completed, killing the others"); 147 + whatever_tasks.shutdown().await; 113 148 114 149 println!("bye!"); 115 150 116 151 Ok(()) 117 152 } 118 153 154 + fn install_metrics_server() -> anyhow::Result<()> { 155 + log::info!("installing metrics server..."); 156 + let host = [0, 0, 0, 0]; 157 + let port = 8765; 158 + PrometheusBuilder::new() 159 + .set_quantiles(&[0.5, 0.9, 0.99, 1.0])? 160 + .set_bucket_duration(Duration::from_secs(60))? 161 + .set_bucket_count(std::num::NonZero::new(10).unwrap()) // count * duration = 10 mins. stuff doesn't happen that fast here. 162 + .set_enable_unit_suffix(false) // this seemed buggy for constellation (sometimes wouldn't engage) 163 + .with_http_listener((host, port)) 164 + .install()?; 165 + log::info!( 166 + "metrics server installed! listening on http://{}.{}.{}.{}:{port}", 167 + host[0], 168 + host[1], 169 + host[2], 170 + host[3] 171 + ); 172 + Ok(()) 173 + } 174 + 119 175 async fn do_update_stuff(read_store: impl StoreReader) { 176 + describe_gauge!( 177 + "persisted_cursor_age", 178 + Unit::Microseconds, 179 + "microseconds between our clock and the latest persisted event's cursor" 180 + ); 181 + describe_gauge!( 182 + "rollup_cursor_age", 183 + Unit::Microseconds, 184 + "microseconds between our clock and the latest rollup cursor" 185 + ); 120 186 let started_at = std::time::SystemTime::now(); 121 187 let mut first_cursor = None; 122 188 let mut first_rollup = None; ··· 127 193 interval.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Delay); 128 194 loop { 129 195 interval.tick().await; 196 + read_store.update_metrics(); 130 197 match read_store.get_consumer_info().await { 131 198 Err(e) => log::warn!("failed to get jetstream consumer info: {e:?}"), 132 199 Ok(ConsumerInfo::Jetstream { ··· 170 237 started_at: SystemTime, 171 238 now: SystemTime, 172 239 ) { 240 + if let Some(cursor) = latest_cursor { 241 + gauge!("persisted_cursor_age").set(cursor.elapsed_micros_f64()); 242 + } 243 + if let Some(cursor) = rollup_cursor { 244 + gauge!("rollup_cursor_age").set(cursor.elapsed_micros_f64()); 245 + } 246 + 173 247 let nice_dt_two_maybes = |earlier: Option<Cursor>, later: Option<Cursor>| match (earlier, later) 174 248 { 175 249 (Some(earlier), Some(later)) => match later.duration_since(&earlier) { ··· 208 282 let rollup_rate = rate(rollup_cursor, last_rollup, dt_real); 209 283 let rollup_avg = rate(rollup_cursor, first_rollup, dt_real_total); 210 284 211 - log::info!( 285 + log::trace!( 212 286 "cursor: {} behind (→{}, {cursor_rate}x, {cursor_avg}x avg). rollup: {} behind (→{}, {rollup_rate}x, {rollup_avg}x avg).", 213 287 latest_cursor.map(|c| c.elapsed().map(nice_duration).unwrap_or("++".to_string())).unwrap_or("?".to_string()), 214 288 nice_dt_two_maybes(last_cursor, latest_cursor),
+1 -1
ufos/src/server/collections_query.rs
··· 53 53 ) -> Result<MultiCollectionQuery, HttpError> { 54 54 let raw_query = ctx.request.uri().query().unwrap_or(""); 55 55 let q = serde_qs::from_str(raw_query).map_err(|e| { 56 - HttpError::for_bad_request(None, format!("unable to parse query string: {}", e)) 56 + HttpError::for_bad_request(None, format!("unable to parse query string: {e}")) 57 57 })?; 58 58 Ok(q) 59 59 }
+310 -181
ufos/src/server/mod.rs
··· 19 19 use dropshot::ConfigLogging; 20 20 use dropshot::ConfigLoggingLevel; 21 21 use dropshot::HttpError; 22 + use dropshot::HttpResponse; 22 23 use dropshot::Query; 23 24 use dropshot::RequestContext; 24 25 use dropshot::ServerBuilder; 25 - 26 - use http::{Response, StatusCode}; 26 + use dropshot::ServerContext; 27 + use http::{ 28 + header::{ORIGIN, USER_AGENT}, 29 + Response, StatusCode, 30 + }; 31 + use metrics::{counter, describe_counter, describe_histogram, histogram, Unit}; 27 32 use schemars::JsonSchema; 28 33 use serde::{Deserialize, Serialize}; 29 34 use std::collections::{HashMap, HashSet}; 35 + use std::future::Future; 30 36 use std::sync::Arc; 37 + use std::time::Instant; 31 38 use std::time::{Duration, SystemTime, UNIX_EPOCH}; 32 39 40 + fn describe_metrics() { 41 + describe_counter!( 42 + "server_requests_total", 43 + Unit::Count, 44 + "total requests handled" 45 + ); 46 + describe_histogram!( 47 + "server_handler_latency", 48 + Unit::Microseconds, 49 + "time to respond to a request in microseconds, excluding dropshot overhead" 50 + ); 51 + } 52 + 53 + async fn instrument_handler<T, H, R>(ctx: &RequestContext<T>, handler: H) -> Result<R, HttpError> 54 + where 55 + R: HttpResponse, 56 + H: Future<Output = Result<R, HttpError>>, 57 + T: ServerContext, 58 + { 59 + let start = Instant::now(); 60 + let result = handler.await; 61 + let latency = start.elapsed(); 62 + let status_code = match &result { 63 + Ok(response) => response.status_code(), 64 + Err(ref e) => e.status_code.as_status(), 65 + } 66 + .as_str() // just the number (.to_string()'s Display does eg `200 OK`) 67 + .to_string(); 68 + let endpoint = ctx.endpoint.operation_id.clone(); 69 + let headers = ctx.request.headers(); 70 + let origin = headers 71 + .get(ORIGIN) 72 + .and_then(|v| v.to_str().ok()) 73 + .unwrap_or("") 74 + .to_string(); 75 + let ua = headers 76 + .get(USER_AGENT) 77 + .and_then(|v| v.to_str().ok()) 78 + .map(|ua| { 79 + if ua.starts_with("Mozilla/5.0 ") { 80 + "browser" 81 + } else { 82 + ua 83 + } 84 + }) 85 + .unwrap_or("") 86 + .to_string(); 87 + counter!("server_requests_total", 88 + "endpoint" => endpoint.clone(), 89 + "origin" => origin, 90 + "ua" => ua, 91 + "status_code" => status_code, 92 + ) 93 + .increment(1); 94 + histogram!("server_handler_latency", "endpoint" => endpoint).record(latency.as_micros() as f64); 95 + result 96 + } 97 + 33 98 struct Context { 34 99 pub spec: Arc<serde_json::Value>, 35 100 storage: Box<dyn StoreReader>, ··· 63 128 */ 64 129 unpublished = true, 65 130 }] 66 - async fn index(_ctx: RequestContext<Context>) -> Result<Response<Body>, HttpError> { 67 - Ok(Response::builder() 68 - .status(StatusCode::OK) 69 - .header(http::header::CONTENT_TYPE, "text/html") 70 - .body(INDEX_HTML.into())?) 131 + async fn index(ctx: RequestContext<Context>) -> Result<Response<Body>, HttpError> { 132 + instrument_handler(&ctx, async { 133 + Ok(Response::builder() 134 + .status(StatusCode::OK) 135 + .header(http::header::CONTENT_TYPE, "text/html") 136 + .body(INDEX_HTML.into())?) 137 + }) 138 + .await 71 139 } 72 140 73 141 /// Meta: get the openapi spec for this api ··· 80 148 unpublished = true, 81 149 }] 82 150 async fn get_openapi(ctx: RequestContext<Context>) -> OkCorsResponse<serde_json::Value> { 83 - let spec = (*ctx.context().spec).clone(); 84 - OkCors(spec).into() 151 + instrument_handler(&ctx, async { 152 + let spec = (*ctx.context().spec).clone(); 153 + OkCors(spec).into() 154 + }) 155 + .await 85 156 } 86 157 87 158 #[derive(Debug, Serialize, JsonSchema)] ··· 100 171 let failed_to_get = 101 172 |what| move |e| HttpError::for_internal_error(format!("failed to get {what}: {e:?}")); 102 173 103 - let storage_info = storage 104 - .get_storage_stats() 105 - .await 106 - .map_err(failed_to_get("storage info"))?; 174 + instrument_handler(&ctx, async { 175 + let storage_info = storage 176 + .get_storage_stats() 177 + .await 178 + .map_err(failed_to_get("storage info"))?; 107 179 108 - let consumer = storage 109 - .get_consumer_info() 110 - .await 111 - .map_err(failed_to_get("consumer info"))?; 180 + let consumer = storage 181 + .get_consumer_info() 182 + .await 183 + .map_err(failed_to_get("consumer info"))?; 112 184 113 - OkCors(MetaInfo { 114 - storage_name: storage.name(), 115 - storage: storage_info, 116 - consumer, 185 + OkCors(MetaInfo { 186 + storage_name: storage.name(), 187 + storage: storage_info, 188 + consumer, 189 + }) 190 + .into() 117 191 }) 118 - .into() 192 + .await 119 193 } 120 194 121 195 // TODO: replace with normal (🙃) multi-qs value somehow ··· 168 242 collection_query: Query<RecordsCollectionsQuery>, 169 243 ) -> OkCorsResponse<Vec<ApiRecord>> { 170 244 let Context { storage, .. } = ctx.context(); 171 - let mut limit = 42; 172 - let query = collection_query.into_inner(); 173 - let collections = if let Some(provided_collection) = query.collection { 174 - to_multiple_nsids(&provided_collection) 175 - .map_err(|reason| HttpError::for_bad_request(None, reason))? 176 - } else { 177 - limit = 12; 178 - let min_time_ago = SystemTime::now() - Duration::from_secs(86_400 * 3); // we want at least 3 days of data 179 - let since: WeekTruncatedCursor = Cursor::at(min_time_ago).into(); 180 - let (collections, _) = storage 181 - .get_collections( 182 - 1000, 183 - Default::default(), 184 - Some(since.try_as().unwrap()), 185 - None, 186 - ) 245 + instrument_handler(&ctx, async { 246 + let mut limit = 42; 247 + let query = collection_query.into_inner(); 248 + let collections = if let Some(provided_collection) = query.collection { 249 + to_multiple_nsids(&provided_collection) 250 + .map_err(|reason| HttpError::for_bad_request(None, reason))? 251 + } else { 252 + limit = 12; 253 + let min_time_ago = SystemTime::now() - Duration::from_secs(86_400 * 3); // we want at least 3 days of data 254 + let since: WeekTruncatedCursor = Cursor::at(min_time_ago).into(); 255 + let (collections, _) = storage 256 + .get_collections( 257 + 1000, 258 + Default::default(), 259 + Some(since.try_as().unwrap()), 260 + None, 261 + ) 262 + .await 263 + .map_err(|e| HttpError::for_internal_error(e.to_string()))?; 264 + collections 265 + .into_iter() 266 + .map(|c| Nsid::new(c.nsid).unwrap()) 267 + .collect() 268 + }; 269 + 270 + let records = storage 271 + .get_records_by_collections(collections, limit, true) 187 272 .await 188 - .map_err(|e| HttpError::for_internal_error(e.to_string()))?; 189 - collections 273 + .map_err(|e| HttpError::for_internal_error(e.to_string()))? 190 274 .into_iter() 191 - .map(|c| Nsid::new(c.nsid).unwrap()) 192 - .collect() 193 - }; 275 + .map(|r| r.into()) 276 + .collect(); 194 277 195 - let records = storage 196 - .get_records_by_collections(collections, limit, true) 197 - .await 198 - .map_err(|e| HttpError::for_internal_error(e.to_string()))? 199 - .into_iter() 200 - .map(|r| r.into()) 201 - .collect(); 202 - 203 - OkCors(records).into() 278 + OkCors(records).into() 279 + }) 280 + .await 204 281 } 205 282 206 283 #[derive(Debug, Deserialize, JsonSchema)] ··· 232 309 query: Query<CollectionsStatsQuery>, 233 310 ) -> OkCorsResponse<HashMap<String, JustCount>> { 234 311 let Context { storage, .. } = ctx.context(); 235 - let q = query.into_inner(); 236 - let collections: HashSet<Nsid> = collections_query.try_into()?; 312 + 313 + instrument_handler(&ctx, async { 314 + let q = query.into_inner(); 315 + let collections: HashSet<Nsid> = collections_query.try_into()?; 237 316 238 - let since = q.since.map(dt_to_cursor).transpose()?.unwrap_or_else(|| { 239 - let week_ago_secs = 7 * 86_400; 240 - let week_ago = SystemTime::now() - Duration::from_secs(week_ago_secs); 241 - Cursor::at(week_ago).into() 242 - }); 317 + let since = q.since.map(dt_to_cursor).transpose()?.unwrap_or_else(|| { 318 + let week_ago_secs = 7 * 86_400; 319 + let week_ago = SystemTime::now() - Duration::from_secs(week_ago_secs); 320 + Cursor::at(week_ago).into() 321 + }); 243 322 244 - let until = q.until.map(dt_to_cursor).transpose()?; 323 + let until = q.until.map(dt_to_cursor).transpose()?; 245 324 246 - let mut seen_by_collection = HashMap::with_capacity(collections.len()); 325 + let mut seen_by_collection = HashMap::with_capacity(collections.len()); 247 326 248 - for collection in &collections { 249 - let counts = storage 250 - .get_collection_counts(collection, since, until) 251 - .await 252 - .map_err(|e| HttpError::for_internal_error(format!("boooo: {e:?}")))?; 327 + for collection in &collections { 328 + let counts = storage 329 + .get_collection_counts(collection, since, until) 330 + .await 331 + .map_err(|e| HttpError::for_internal_error(format!("boooo: {e:?}")))?; 253 332 254 - seen_by_collection.insert(collection.to_string(), counts); 255 - } 333 + seen_by_collection.insert(collection.to_string(), counts); 334 + } 256 335 257 - OkCors(seen_by_collection).into() 336 + OkCors(seen_by_collection).into() 337 + }) 338 + .await 258 339 } 259 340 260 341 #[derive(Debug, Serialize, JsonSchema)] ··· 337 418 let Context { storage, .. } = ctx.context(); 338 419 let q = query.into_inner(); 339 420 340 - if q.cursor.is_some() && q.order.is_some() { 341 - let msg = "`cursor` is mutually exclusive with `order`. ordered results cannot be paged."; 342 - return Err(HttpError::for_bad_request(None, msg.to_string())); 343 - } 421 + instrument_handler(&ctx, async { 422 + if q.cursor.is_some() && q.order.is_some() { 423 + let msg = 424 + "`cursor` is mutually exclusive with `order`. ordered results cannot be paged."; 425 + return Err(HttpError::for_bad_request(None, msg.to_string())); 426 + } 344 427 345 - let order = if let Some(ref o) = q.order { 346 - o.into() 347 - } else { 348 - let cursor = q 349 - .cursor 350 - .and_then(|c| if c.is_empty() { None } else { Some(c) }) 351 - .map(|c| URL_SAFE_NO_PAD.decode(&c)) 352 - .transpose() 353 - .map_err(|e| HttpError::for_bad_request(None, format!("invalid cursor: {e:?}")))?; 354 - OrderCollectionsBy::Lexi { cursor } 355 - }; 428 + let order = if let Some(ref o) = q.order { 429 + o.into() 430 + } else { 431 + let cursor = q 432 + .cursor 433 + .and_then(|c| if c.is_empty() { None } else { Some(c) }) 434 + .map(|c| URL_SAFE_NO_PAD.decode(&c)) 435 + .transpose() 436 + .map_err(|e| HttpError::for_bad_request(None, format!("invalid cursor: {e:?}")))?; 437 + OrderCollectionsBy::Lexi { cursor } 438 + }; 356 439 357 - let limit = match (q.limit, q.order) { 358 - (Some(limit), _) => limit, 359 - (None, Some(_)) => 32, 360 - (None, None) => 100, 361 - }; 440 + let limit = match (q.limit, q.order) { 441 + (Some(limit), _) => limit, 442 + (None, Some(_)) => 32, 443 + (None, None) => 100, 444 + }; 362 445 363 - if !(1..=200).contains(&limit) { 364 - let msg = format!("limit not in 1..=200: {}", limit); 365 - return Err(HttpError::for_bad_request(None, msg)); 366 - } 446 + if !(1..=200).contains(&limit) { 447 + let msg = format!("limit not in 1..=200: {limit}"); 448 + return Err(HttpError::for_bad_request(None, msg)); 449 + } 367 450 368 - let since = q.since.map(dt_to_cursor).transpose()?; 369 - let until = q.until.map(dt_to_cursor).transpose()?; 451 + let since = q.since.map(dt_to_cursor).transpose()?; 452 + let until = q.until.map(dt_to_cursor).transpose()?; 370 453 371 - let (collections, next_cursor) = storage 372 - .get_collections(limit, order, since, until) 373 - .await 374 - .map_err(|e| HttpError::for_internal_error(format!("oh shoot: {e:?}")))?; 454 + let (collections, next_cursor) = storage 455 + .get_collections(limit, order, since, until) 456 + .await 457 + .map_err(|e| HttpError::for_internal_error(format!("oh shoot: {e:?}")))?; 375 458 376 - let next_cursor = next_cursor.map(|c| URL_SAFE_NO_PAD.encode(c)); 459 + let next_cursor = next_cursor.map(|c| URL_SAFE_NO_PAD.encode(c)); 377 460 378 - OkCors(CollectionsResponse { 379 - collections, 380 - cursor: next_cursor, 461 + OkCors(CollectionsResponse { 462 + collections, 463 + cursor: next_cursor, 464 + }) 465 + .into() 381 466 }) 382 - .into() 467 + .await 383 468 } 384 469 385 470 #[derive(Debug, Serialize, JsonSchema)] ··· 459 544 let Context { storage, .. } = ctx.context(); 460 545 let q = query.into_inner(); 461 546 462 - let prefix = NsidPrefix::new(&q.prefix).map_err(|e| { 463 - HttpError::for_bad_request( 464 - None, 465 - format!("{:?} was not a valid NSID prefix: {e:?}", q.prefix), 466 - ) 467 - })?; 547 + instrument_handler(&ctx, async { 548 + let prefix = NsidPrefix::new(&q.prefix).map_err(|e| { 549 + HttpError::for_bad_request( 550 + None, 551 + format!("{:?} was not a valid NSID prefix: {e:?}", q.prefix), 552 + ) 553 + })?; 468 554 469 - if q.cursor.is_some() && q.order.is_some() { 470 - let msg = "`cursor` is mutually exclusive with `order`. ordered results cannot be paged."; 471 - return Err(HttpError::for_bad_request(None, msg.to_string())); 472 - } 555 + if q.cursor.is_some() && q.order.is_some() { 556 + let msg = 557 + "`cursor` is mutually exclusive with `order`. ordered results cannot be paged."; 558 + return Err(HttpError::for_bad_request(None, msg.to_string())); 559 + } 473 560 474 - let order = if let Some(ref o) = q.order { 475 - o.into() 476 - } else { 477 - let cursor = q 478 - .cursor 479 - .and_then(|c| if c.is_empty() { None } else { Some(c) }) 480 - .map(|c| URL_SAFE_NO_PAD.decode(&c)) 481 - .transpose() 482 - .map_err(|e| HttpError::for_bad_request(None, format!("invalid cursor: {e:?}")))?; 483 - OrderCollectionsBy::Lexi { cursor } 484 - }; 561 + let order = if let Some(ref o) = q.order { 562 + o.into() 563 + } else { 564 + let cursor = q 565 + .cursor 566 + .and_then(|c| if c.is_empty() { None } else { Some(c) }) 567 + .map(|c| URL_SAFE_NO_PAD.decode(&c)) 568 + .transpose() 569 + .map_err(|e| HttpError::for_bad_request(None, format!("invalid cursor: {e:?}")))?; 570 + OrderCollectionsBy::Lexi { cursor } 571 + }; 485 572 486 - let limit = match (q.limit, q.order) { 487 - (Some(limit), _) => limit, 488 - (None, Some(_)) => 32, 489 - (None, None) => 100, 490 - }; 573 + let limit = match (q.limit, q.order) { 574 + (Some(limit), _) => limit, 575 + (None, Some(_)) => 32, 576 + (None, None) => 100, 577 + }; 491 578 492 - if !(1..=200).contains(&limit) { 493 - let msg = format!("limit not in 1..=200: {}", limit); 494 - return Err(HttpError::for_bad_request(None, msg)); 495 - } 579 + if !(1..=200).contains(&limit) { 580 + let msg = format!("limit not in 1..=200: {limit}"); 581 + return Err(HttpError::for_bad_request(None, msg)); 582 + } 496 583 497 - let since = q.since.map(dt_to_cursor).transpose()?; 498 - let until = q.until.map(dt_to_cursor).transpose()?; 584 + let since = q.since.map(dt_to_cursor).transpose()?; 585 + let until = q.until.map(dt_to_cursor).transpose()?; 499 586 500 - let (total, children, next_cursor) = storage 501 - .get_prefix(prefix, limit, order, since, until) 502 - .await 503 - .map_err(|e| HttpError::for_internal_error(format!("oh shoot: {e:?}")))?; 587 + let (total, children, next_cursor) = storage 588 + .get_prefix(prefix, limit, order, since, until) 589 + .await 590 + .map_err(|e| HttpError::for_internal_error(format!("oh shoot: {e:?}")))?; 504 591 505 - let next_cursor = next_cursor.map(|c| URL_SAFE_NO_PAD.encode(c)); 592 + let next_cursor = next_cursor.map(|c| URL_SAFE_NO_PAD.encode(c)); 506 593 507 - OkCors(PrefixResponse { 508 - total, 509 - children, 510 - cursor: next_cursor, 594 + OkCors(PrefixResponse { 595 + total, 596 + children, 597 + cursor: next_cursor, 598 + }) 599 + .into() 511 600 }) 512 - .into() 601 + .await 513 602 } 514 603 515 604 #[derive(Debug, Deserialize, JsonSchema)] ··· 549 638 let Context { storage, .. } = ctx.context(); 550 639 let q = query.into_inner(); 551 640 552 - let since = q.since.map(dt_to_cursor).transpose()?.unwrap_or_else(|| { 553 - let week_ago_secs = 7 * 86_400; 554 - let week_ago = SystemTime::now() - Duration::from_secs(week_ago_secs); 555 - Cursor::at(week_ago).into() 556 - }); 641 + instrument_handler(&ctx, async { 642 + let since = q.since.map(dt_to_cursor).transpose()?.unwrap_or_else(|| { 643 + let week_ago_secs = 7 * 86_400; 644 + let week_ago = SystemTime::now() - Duration::from_secs(week_ago_secs); 645 + Cursor::at(week_ago).into() 646 + }); 557 647 558 - let until = q.until.map(dt_to_cursor).transpose()?; 648 + let until = q.until.map(dt_to_cursor).transpose()?; 559 649 560 - let step = if let Some(secs) = q.step { 561 - if secs < 3600 { 562 - let msg = format!("step is too small: {}", secs); 563 - Err(HttpError::for_bad_request(None, msg))?; 564 - } 565 - (secs / 3600) * 3600 // trucate to hour 566 - } else { 567 - 86_400 568 - }; 650 + let step = if let Some(secs) = q.step { 651 + if secs < 3600 { 652 + let msg = format!("step is too small: {secs}"); 653 + Err(HttpError::for_bad_request(None, msg))?; 654 + } 655 + (secs / 3600) * 3600 // trucate to hour 656 + } else { 657 + 86_400 658 + }; 569 659 570 - let nsid = Nsid::new(q.collection).map_err(|e| { 571 - HttpError::for_bad_request(None, format!("collection was not a valid NSID: {:?}", e)) 572 - })?; 660 + let nsid = Nsid::new(q.collection).map_err(|e| { 661 + HttpError::for_bad_request(None, format!("collection was not a valid NSID: {e:?}")) 662 + })?; 573 663 574 - let (range_cursors, series) = storage 575 - .get_timeseries(vec![nsid], since, until, step) 576 - .await 577 - .map_err(|e| HttpError::for_internal_error(format!("oh shoot: {e:?}")))?; 664 + let (range_cursors, series) = storage 665 + .get_timeseries(vec![nsid], since, until, step) 666 + .await 667 + .map_err(|e| HttpError::for_internal_error(format!("oh shoot: {e:?}")))?; 578 668 579 - let range = range_cursors 580 - .into_iter() 581 - .map(|c| DateTime::<Utc>::from_timestamp_micros(c.to_raw_u64() as i64).unwrap()) 582 - .collect(); 669 + let range = range_cursors 670 + .into_iter() 671 + .map(|c| DateTime::<Utc>::from_timestamp_micros(c.to_raw_u64() as i64).unwrap()) 672 + .collect(); 583 673 584 - let series = series 585 - .into_iter() 586 - .map(|(k, v)| (k.to_string(), v.iter().map(Into::into).collect())) 587 - .collect(); 674 + let series = series 675 + .into_iter() 676 + .map(|(k, v)| (k.to_string(), v.iter().map(Into::into).collect())) 677 + .collect(); 678 + 679 + OkCors(CollectionTimeseriesResponse { range, series }).into() 680 + }) 681 + .await 682 + } 588 683 589 - OkCors(CollectionTimeseriesResponse { range, series }).into() 684 + #[derive(Debug, Deserialize, JsonSchema)] 685 + struct SearchQuery { 686 + /// Query 687 + /// 688 + /// at least two alphanumeric (+hyphen) characters must be present 689 + q: String, 690 + } 691 + #[derive(Debug, Serialize, JsonSchema)] 692 + struct SearchResponse { 693 + matches: Vec<NsidCount>, 694 + } 695 + /// Search lexicons 696 + #[endpoint { 697 + method = GET, 698 + path = "/search" 699 + }] 700 + async fn search_collections( 701 + ctx: RequestContext<Context>, 702 + query: Query<SearchQuery>, 703 + ) -> OkCorsResponse<SearchResponse> { 704 + let Context { storage, .. } = ctx.context(); 705 + let q = query.into_inner(); 706 + instrument_handler(&ctx, async { 707 + // TODO: query validation 708 + // TODO: also handle multi-space stuff (ufos-app tries to on client) 709 + let terms: Vec<String> = q.q.split(' ').map(Into::into).collect(); 710 + let matches = storage 711 + .search_collections(terms) 712 + .await 713 + .map_err(|e| HttpError::for_internal_error(format!("oh ugh: {e:?}")))?; 714 + OkCors(SearchResponse { matches }).into() 715 + }) 716 + .await 590 717 } 591 718 592 719 pub async fn serve(storage: impl StoreReader + 'static) -> Result<(), String> { 720 + describe_metrics(); 593 721 let log = ConfigLogging::StderrTerminal { 594 - level: ConfigLoggingLevel::Info, 722 + level: ConfigLoggingLevel::Warn, 595 723 } 596 - .to_logger("hello-ufos") 724 + .to_logger("server") 597 725 .map_err(|e| e.to_string())?; 598 726 599 727 let mut api = ApiDescription::new(); ··· 606 734 api.register(get_collections).unwrap(); 607 735 api.register(get_prefix).unwrap(); 608 736 api.register(get_timeseries).unwrap(); 737 + api.register(search_collections).unwrap(); 609 738 610 739 let context = Context { 611 740 spec: Arc::new( 612 741 api.openapi( 613 - "UFOs: Every lexicon in the ATmosphere", 742 + "UFOs API: Every lexicon in the ATmosphere", 614 743 env!("CARGO_PKG_VERSION") 615 744 .parse() 616 745 .inspect_err(|e| { ··· 633 762 ..Default::default() 634 763 }) 635 764 .start() 636 - .map_err(|error| format!("failed to start server: {}", error))? 765 + .map_err(|error| format!("failed to start server: {error}"))? 637 766 .await 638 767 }
+26 -5
ufos/src/storage.rs
··· 5 5 }; 6 6 use async_trait::async_trait; 7 7 use jetstream::exports::{Did, Nsid}; 8 + use metrics::{describe_histogram, histogram, Unit}; 8 9 use std::collections::{HashMap, HashSet}; 9 10 use std::path::Path; 10 - use std::time::{Duration, SystemTime}; 11 + use std::time::{Duration, Instant}; 11 12 use tokio::sync::mpsc::Receiver; 12 13 use tokio_util::sync::CancellationToken; 13 14 ··· 35 36 self, 36 37 mut batches: Receiver<EventBatch<LIMIT>>, 37 38 ) -> StorageResult<()> { 39 + describe_histogram!( 40 + "storage_slow_batches", 41 + Unit::Microseconds, 42 + "batches that took more than 3s to insert" 43 + ); 44 + describe_histogram!( 45 + "storage_batch_insert_time", 46 + Unit::Microseconds, 47 + "total time to insert one commit batch" 48 + ); 38 49 while let Some(event_batch) = batches.recv().await { 39 50 let token = CancellationToken::new(); 40 51 let cancelled = token.clone(); 41 52 tokio::spawn(async move { 42 - let started = SystemTime::now(); 53 + let started = Instant::now(); 43 54 let mut concerned = false; 44 55 loop { 45 56 tokio::select! { 46 - _ = tokio::time::sleep(Duration::from_secs_f64(3.)) => { 47 - log::warn!("taking a long time to insert an event batch ({:?})...", started.elapsed()); 57 + _ = tokio::time::sleep(Duration::from_secs(3)) => { 58 + if !concerned { 59 + log::warn!("taking a long time to insert an event batch..."); 60 + } 48 61 concerned = true; 49 62 } 50 63 _ = cancelled.cancelled() => { 51 64 if concerned { 52 65 log::warn!("finally inserted slow event batch (or failed) after {:?}", started.elapsed()); 66 + histogram!("storage_slow_batches").record(started.elapsed().as_micros() as f64); 53 67 } 54 68 break 55 69 } ··· 60 74 let mut me = self.clone(); 61 75 move || { 62 76 let _guard = token.drop_guard(); 63 - me.insert_batch(event_batch) 77 + let t0 = Instant::now(); 78 + let r = me.insert_batch(event_batch); 79 + histogram!("storage_batch_insert_time").record(t0.elapsed().as_micros() as f64); 80 + r 64 81 } 65 82 }) 66 83 .await??; ··· 94 111 #[async_trait] 95 112 pub trait StoreReader: Send + Sync { 96 113 fn name(&self) -> String; 114 + 115 + fn update_metrics(&self) {} 97 116 98 117 async fn get_storage_stats(&self) -> StorageResult<serde_json::Value>; 99 118 ··· 137 156 limit: usize, 138 157 expand_each_collection: bool, 139 158 ) -> StorageResult<Vec<UFOsRecord>>; 159 + 160 + async fn search_collections(&self, terms: Vec<String>) -> StorageResult<Vec<NsidCount>>; 140 161 }
+182 -54
ufos/src/storage_fjall.rs
··· 23 23 Batch as FjallBatch, Config, Keyspace, PartitionCreateOptions, PartitionHandle, Snapshot, 24 24 }; 25 25 use jetstream::events::Cursor; 26 + use lsm_tree::AbstractTree; 27 + use metrics::{ 28 + counter, describe_counter, describe_gauge, describe_histogram, gauge, histogram, Unit, 29 + }; 26 30 use std::collections::{HashMap, HashSet}; 27 31 use std::iter::Peekable; 28 32 use std::ops::Bound; ··· 39 43 /// 40 44 /// new data format, roughly: 41 45 /// 42 - /// Partion: 'global' 46 + /// Partition: 'global' 43 47 /// 44 48 /// - Global sequence counter (is the jetstream cursor -- monotonic with many gaps) 45 49 /// - key: "js_cursor" (literal) ··· 226 230 feeds: feeds.clone(), 227 231 records: records.clone(), 228 232 rollups: rollups.clone(), 233 + queues: queues.clone(), 229 234 }; 235 + reader.describe_metrics(); 230 236 let writer = FjallWriter { 231 237 bg_taken: Arc::new(AtomicBool::new(false)), 232 238 keyspace, ··· 236 242 rollups, 237 243 queues, 238 244 }; 245 + writer.describe_metrics(); 239 246 Ok((reader, writer, js_cursor, sketch_secret)) 240 247 } 241 248 } ··· 249 256 feeds: PartitionHandle, 250 257 records: PartitionHandle, 251 258 rollups: PartitionHandle, 259 + queues: PartitionHandle, 252 260 } 253 261 254 262 /// An iterator that knows how to skip over deleted/invalidated records ··· 380 388 type CollectionSerieses = HashMap<Nsid, Vec<CountsValue>>; 381 389 382 390 impl FjallReader { 391 + fn describe_metrics(&self) { 392 + describe_gauge!( 393 + "storage_fjall_l0_run_count", 394 + Unit::Count, 395 + "number of L0 runs in a partition" 396 + ); 397 + describe_gauge!( 398 + "storage_fjall_keyspace_disk_space", 399 + Unit::Bytes, 400 + "total storage used according to fjall" 401 + ); 402 + describe_gauge!( 403 + "storage_fjall_journal_count", 404 + Unit::Count, 405 + "total keyspace journals according to fjall" 406 + ); 407 + describe_gauge!( 408 + "storage_fjall_keyspace_sequence", 409 + Unit::Count, 410 + "fjall keyspace sequence" 411 + ); 412 + } 413 + 383 414 fn get_storage_stats(&self) -> StorageResult<serde_json::Value> { 384 415 let rollup_cursor = 385 416 get_static_neu::<NewRollupCursorKey, NewRollupCursorValue>(&self.global)? ··· 507 538 merged.merge(&counts); 508 539 } 509 540 } 510 - out.push(NsidCount { 511 - nsid: nsid.to_string(), 512 - creates: merged.counts().creates, 513 - dids_estimate: merged.dids().estimate() as u64, 514 - }); 541 + out.push(NsidCount::new(&nsid, &merged)); 515 542 } 516 543 517 544 let next_cursor = current_nsid.map(|s| s.to_db_bytes()).transpose()?; ··· 617 644 .into_iter() 618 645 .rev() 619 646 .take(limit) 620 - .map(|(nsid, cv)| NsidCount { 621 - nsid: nsid.to_string(), 622 - creates: cv.counts().creates, 623 - dids_estimate: cv.dids().estimate() as u64, 624 - }) 647 + .map(|(nsid, cv)| NsidCount::new(&nsid, &cv)) 625 648 .collect(); 626 649 Ok(counts) 627 650 } ··· 727 750 let mut prefix_count = CountsValue::default(); 728 751 #[derive(Debug, Clone, PartialEq)] 729 752 enum Child { 730 - FullNsid(String), 753 + FullNsid(Nsid), 731 754 ChildPrefix(String), 732 755 } 733 756 impl Child { 734 757 fn from_prefix(nsid: &Nsid, prefix: &NsidPrefix) -> Option<Self> { 735 758 if prefix.is_group_of(nsid) { 736 - return Some(Child::FullNsid(nsid.to_string())); 759 + return Some(Child::FullNsid(nsid.clone())); 737 760 } 738 761 let suffix = nsid.as_str().strip_prefix(&format!("{}.", prefix.0))?; 739 762 let (segment, _) = suffix.split_once('.').unwrap(); ··· 742 765 } 743 766 fn is_before(&self, other: &Child) -> bool { 744 767 match (self, other) { 745 - (Child::FullNsid(s), Child::ChildPrefix(o)) if s == o => true, 746 - (Child::ChildPrefix(s), Child::FullNsid(o)) if s == o => false, 747 - (Child::FullNsid(s), Child::FullNsid(o)) => s < o, 768 + (Child::FullNsid(s), Child::ChildPrefix(o)) if s.as_str() == o => true, 769 + (Child::ChildPrefix(s), Child::FullNsid(o)) if s == o.as_str() => false, 770 + (Child::FullNsid(s), Child::FullNsid(o)) => s.as_str() < o.as_str(), 748 771 (Child::ChildPrefix(s), Child::ChildPrefix(o)) => s < o, 749 - (Child::FullNsid(s), Child::ChildPrefix(o)) => s < o, 750 - (Child::ChildPrefix(s), Child::FullNsid(o)) => s < o, 772 + (Child::FullNsid(s), Child::ChildPrefix(o)) => s.to_string() < *o, 773 + (Child::ChildPrefix(s), Child::FullNsid(o)) => *s < o.to_string(), 751 774 } 752 775 } 753 776 fn into_inner(self) -> String { 754 777 match self { 755 - Child::FullNsid(s) => s, 778 + Child::FullNsid(s) => s.to_string(), 756 779 Child::ChildPrefix(s) => s, 757 780 } 758 781 } ··· 791 814 } 792 815 } 793 816 items.push(match child { 794 - Child::FullNsid(nsid) => PrefixChild::Collection(NsidCount { 795 - nsid, 796 - creates: merged.counts().creates, 797 - dids_estimate: merged.dids().estimate() as u64, 798 - }), 799 - Child::ChildPrefix(prefix) => PrefixChild::Prefix(PrefixCount { 800 - prefix, 801 - creates: merged.counts().creates, 802 - dids_estimate: merged.dids().estimate() as u64, 803 - }), 817 + Child::FullNsid(nsid) => PrefixChild::Collection(NsidCount::new(&nsid, &merged)), 818 + Child::ChildPrefix(prefix) => { 819 + PrefixChild::Prefix(PrefixCount::new(&prefix, &merged)) 820 + } 804 821 }); 805 822 } 806 823 ··· 982 999 } 983 1000 Ok(merged) 984 1001 } 1002 + 1003 + fn search_collections(&self, terms: Vec<String>) -> StorageResult<Vec<NsidCount>> { 1004 + let start = AllTimeRollupKey::start()?; 1005 + let end = AllTimeRollupKey::end()?; 1006 + let mut matches = Vec::new(); 1007 + let limit = 16; // TODO: param 1008 + for kv in self.rollups.range((start, end)) { 1009 + let (key_bytes, val_bytes) = kv?; 1010 + let key = db_complete::<AllTimeRollupKey>(&key_bytes)?; 1011 + let nsid = key.collection(); 1012 + for term in &terms { 1013 + if nsid.contains(term) { 1014 + let counts = db_complete::<CountsValue>(&val_bytes)?; 1015 + matches.push(NsidCount::new(nsid, &counts)); 1016 + break; 1017 + } 1018 + } 1019 + if matches.len() >= limit { 1020 + break; 1021 + } 1022 + } 1023 + // TODO: indicate incomplete results 1024 + Ok(matches) 1025 + } 985 1026 } 986 1027 987 1028 #[async_trait] 988 1029 impl StoreReader for FjallReader { 989 1030 fn name(&self) -> String { 990 1031 "fjall storage v2".into() 1032 + } 1033 + fn update_metrics(&self) { 1034 + gauge!("storage_fjall_l0_run_count", "partition" => "global") 1035 + .set(self.global.tree.l0_run_count() as f64); 1036 + gauge!("storage_fjall_l0_run_count", "partition" => "feeds") 1037 + .set(self.feeds.tree.l0_run_count() as f64); 1038 + gauge!("storage_fjall_l0_run_count", "partition" => "records") 1039 + .set(self.records.tree.l0_run_count() as f64); 1040 + gauge!("storage_fjall_l0_run_count", "partition" => "rollups") 1041 + .set(self.rollups.tree.l0_run_count() as f64); 1042 + gauge!("storage_fjall_l0_run_count", "partition" => "queues") 1043 + .set(self.queues.tree.l0_run_count() as f64); 1044 + gauge!("storage_fjall_keyspace_disk_space").set(self.keyspace.disk_space() as f64); 1045 + gauge!("storage_fjall_journal_count").set(self.keyspace.journal_count() as f64); 1046 + gauge!("storage_fjall_keyspace_sequence").set(self.keyspace.instant() as f64); 991 1047 } 992 1048 async fn get_storage_stats(&self) -> StorageResult<serde_json::Value> { 993 1049 let s = self.clone(); ··· 1061 1117 FjallReader::get_records_by_collections(&s, collections, limit, expand_each_collection) 1062 1118 }) 1063 1119 .await? 1120 + } 1121 + async fn search_collections(&self, terms: Vec<String>) -> StorageResult<Vec<NsidCount>> { 1122 + let s = self.clone(); 1123 + tokio::task::spawn_blocking(move || FjallReader::search_collections(&s, terms)).await? 1064 1124 } 1065 1125 } 1066 1126 ··· 1076 1136 } 1077 1137 1078 1138 impl FjallWriter { 1139 + fn describe_metrics(&self) { 1140 + describe_histogram!( 1141 + "storage_insert_batch_db_batch_items", 1142 + Unit::Count, 1143 + "how many items are in the fjall batch for batched inserts" 1144 + ); 1145 + describe_histogram!( 1146 + "storage_rollup_counts_db_batch_items", 1147 + Unit::Count, 1148 + "how many items are in the fjall batch for a timlies rollup" 1149 + ); 1150 + describe_counter!( 1151 + "storage_delete_account_partial_commits", 1152 + Unit::Count, 1153 + "fjall checkpoint commits for cleaning up accounts with too many records" 1154 + ); 1155 + describe_counter!( 1156 + "storage_delete_account_completions", 1157 + Unit::Count, 1158 + "total count of account deletes handled" 1159 + ); 1160 + describe_counter!( 1161 + "storage_delete_account_records_deleted", 1162 + Unit::Count, 1163 + "total records deleted when handling account deletes" 1164 + ); 1165 + describe_histogram!( 1166 + "storage_trim_dirty_nsids", 1167 + Unit::Count, 1168 + "number of NSIDs trimmed" 1169 + ); 1170 + describe_histogram!( 1171 + "storage_trim_duration", 1172 + Unit::Microseconds, 1173 + "how long it took to trim the dirty NSIDs" 1174 + ); 1175 + describe_counter!( 1176 + "storage_trim_removed", 1177 + Unit::Count, 1178 + "how many records were removed during trim" 1179 + ); 1180 + } 1079 1181 fn rollup_delete_account( 1080 1182 &mut self, 1081 1183 cursor: Cursor, ··· 1207 1309 AllTimeRecordsKey::new(new_creates_count.into(), &nsid).to_db_bytes()?, 1208 1310 ), 1209 1311 }; 1210 - batch.remove(&self.rollups, &old_k); // TODO: when fjall gets weak delete, this will hopefully work way better 1312 + // remove_weak is allowed here because the secondary ranking index only ever inserts once at a key 1313 + batch.remove_weak(&self.rollups, &old_k); 1211 1314 batch.insert(&self.rollups, &new_k, ""); 1212 1315 } 1213 1316 ··· 1231 1334 AllTimeDidsKey::new(new_dids_estimate.into(), &nsid).to_db_bytes()?, 1232 1335 ), 1233 1336 }; 1234 - batch.remove(&self.rollups, &old_k); // TODO: when fjall gets weak delete, this will hopefully work way better 1337 + // remove_weak is allowed here because the secondary ranking index only ever inserts once at a key 1338 + batch.remove_weak(&self.rollups, &old_k); 1235 1339 batch.insert(&self.rollups, &new_k, ""); 1236 1340 } 1237 1341 ··· 1241 1345 1242 1346 insert_batch_static_neu::<NewRollupCursorKey>(&mut batch, &self.global, last_cursor)?; 1243 1347 1348 + histogram!("storage_rollup_counts_db_batch_items").record(batch.len() as f64); 1244 1349 batch.commit()?; 1245 1350 Ok((cursors_advanced, dirty_nsids)) 1246 1351 } ··· 1249 1354 impl StoreWriter<FjallBackground> for FjallWriter { 1250 1355 fn background_tasks(&mut self, reroll: bool) -> StorageResult<FjallBackground> { 1251 1356 if self.bg_taken.swap(true, Ordering::SeqCst) { 1252 - Err(StorageError::BackgroundAlreadyStarted) 1253 - } else { 1254 - if reroll { 1255 - log::info!("reroll: resetting rollup cursor..."); 1256 - insert_static_neu::<NewRollupCursorKey>(&self.global, Cursor::from_start())?; 1257 - log::info!("reroll: clearing trim cursors..."); 1258 - let mut batch = self.keyspace.batch(); 1259 - for kv in self 1260 - .global 1261 - .prefix(TrimCollectionCursorKey::from_prefix_to_db_bytes( 1262 - &Default::default(), 1263 - )?) 1264 - { 1265 - let (k, _) = kv?; 1266 - batch.remove(&self.global, k); 1267 - } 1268 - let n = batch.len(); 1269 - batch.commit()?; 1270 - log::info!("reroll: cleared {n} trim cursors."); 1357 + return Err(StorageError::BackgroundAlreadyStarted); 1358 + } 1359 + if reroll { 1360 + log::info!("reroll: resetting rollup cursor..."); 1361 + insert_static_neu::<NewRollupCursorKey>(&self.global, Cursor::from_start())?; 1362 + log::info!("reroll: clearing trim cursors..."); 1363 + let mut batch = self.keyspace.batch(); 1364 + for kv in self 1365 + .global 1366 + .prefix(TrimCollectionCursorKey::from_prefix_to_db_bytes( 1367 + &Default::default(), 1368 + )?) 1369 + { 1370 + let (k, _) = kv?; 1371 + batch.remove(&self.global, k); 1271 1372 } 1272 - Ok(FjallBackground(self.clone())) 1373 + let n = batch.len(); 1374 + batch.commit()?; 1375 + log::info!("reroll: cleared {n} trim cursors."); 1273 1376 } 1377 + Ok(FjallBackground(self.clone())) 1274 1378 } 1275 1379 1276 1380 fn insert_batch<const LIMIT: usize>( ··· 1346 1450 latest.to_db_bytes()?, 1347 1451 ); 1348 1452 1453 + histogram!("storage_insert_batch_db_batch_items").record(batch.len() as f64); 1349 1454 batch.commit()?; 1350 1455 Ok(()) 1351 1456 } ··· 1500 1605 candidate_new_feed_lower_cursor = Some(feed_key.cursor()); 1501 1606 } 1502 1607 1503 - self.feeds.remove(&location_key_bytes)?; 1608 + self.records.remove(&location_key_bytes)?; 1504 1609 self.feeds.remove(key_bytes)?; 1505 1610 records_deleted += 1; 1506 1611 } ··· 1527 1632 batch.remove(&self.records, key_bytes); 1528 1633 records_deleted += 1; 1529 1634 if batch.len() >= MAX_BATCHED_ACCOUNT_DELETE_RECORDS { 1635 + counter!("storage_delete_account_partial_commits").increment(1); 1530 1636 batch.commit()?; 1531 1637 batch = self.keyspace.batch(); 1532 1638 } 1533 1639 } 1640 + counter!("storage_delete_account_completions").increment(1); 1641 + counter!("storage_delete_account_records_deleted").increment(records_deleted as u64); 1534 1642 batch.commit()?; 1535 1643 Ok(records_deleted) 1536 1644 } ··· 1585 1693 break; 1586 1694 } 1587 1695 } 1696 + let dt = t0.elapsed(); 1697 + log::trace!("finished trimming {n} nsids in {dt:?}: {total_danglers} dangling and {total_deleted} total removed."); 1698 + histogram!("storage_trim_dirty_nsids").record(completed.len() as f64); 1699 + histogram!("storage_trim_duration").record(dt.as_micros() as f64); 1700 + counter!("storage_trim_removed", "dangling" => "true").increment(total_danglers as u64); 1701 + if total_deleted >= total_danglers { 1702 + counter!("storage_trim_removed", "dangling" => "false").increment((total_deleted - total_danglers) as u64); 1703 + } else { 1704 + // TODO: probably think through what's happening here 1705 + log::warn!("weird trim case: more danglers than deleted? metric will be missing for dangling=false. deleted={total_deleted} danglers={total_danglers}"); 1706 + } 1588 1707 for c in completed { 1589 1708 dirty_nsids.remove(&c); 1590 1709 } 1591 - log::info!("finished trimming {n} nsids in {:?}: {total_danglers} dangling and {total_deleted} total removed.", t0.elapsed()); 1592 1710 }, 1593 1711 }; 1594 1712 } ··· 2617 2735 vec![PrefixChild::Collection(NsidCount { 2618 2736 nsid: "a.a.a".to_string(), 2619 2737 creates: 1, 2738 + updates: 0, 2739 + deletes: 0, 2620 2740 dids_estimate: 1 2621 2741 }),] 2622 2742 ); ··· 2663 2783 vec![PrefixChild::Prefix(PrefixCount { 2664 2784 prefix: "a.a.a".to_string(), 2665 2785 creates: 1, 2666 - dids_estimate: 1 2786 + updates: 0, 2787 + deletes: 0, 2788 + dids_estimate: 1, 2667 2789 }),] 2668 2790 ); 2669 2791 assert_eq!(cursor, None); ··· 2718 2840 vec![PrefixChild::Prefix(PrefixCount { 2719 2841 prefix: "a.a.a".to_string(), 2720 2842 creates: 2, 2843 + updates: 0, 2844 + deletes: 0, 2721 2845 dids_estimate: 1 2722 2846 }),] 2723 2847 ); ··· 2786 2910 PrefixChild::Collection(NsidCount { 2787 2911 nsid: "a.a.a.a".to_string(), 2788 2912 creates: 1, 2913 + updates: 0, 2914 + deletes: 0, 2789 2915 dids_estimate: 1 2790 2916 }), 2791 2917 PrefixChild::Prefix(PrefixCount { 2792 2918 prefix: "a.a.a.a".to_string(), 2793 2919 creates: 1, 2920 + updates: 0, 2921 + deletes: 0, 2794 2922 dids_estimate: 1 2795 2923 }), 2796 2924 ]
+2
who-am-i/.gitignore
··· 1 + *.pem 2 + jwks.json
+37
who-am-i/Cargo.toml
··· 1 + [package] 2 + name = "who-am-i" 3 + version = "0.1.0" 4 + edition = "2024" 5 + 6 + [dependencies] 7 + atrium-api = { version = "0.25.4", default-features = false } 8 + atrium-common = "0.1.2" 9 + atrium-identity = "0.1.5" 10 + atrium-oauth = "0.1.3" 11 + axum = "0.8.4" 12 + axum-extra = { version = "0.10.1", features = ["cookie-signed", "typed-header"] } 13 + axum-template = { version = "3.0.0", features = ["handlebars"] } 14 + clap = { version = "4.5.40", features = ["derive", "env"] } 15 + ctrlc = "3.4.7" 16 + dashmap = "6.1.0" 17 + elliptic-curve = "0.13.8" 18 + handlebars = { version = "6.3.2", features = ["dir_source"] } 19 + hickory-resolver = "0.25.2" 20 + jose-jwk = "0.1.2" 21 + jsonwebtoken = "9.3.1" 22 + metrics = "0.24.2" 23 + p256 = "0.13.2" 24 + pkcs8 = "0.10.2" 25 + rand = "0.9.1" 26 + reqwest = { version = "0.12.22", features = ["native-tls-vendored"] } 27 + serde = { version = "1.0.219", features = ["derive"] } 28 + serde_json = "1.0.140" 29 + thiserror = "2.0.12" 30 + tokio = { version = "1.45.1", features = ["full", "macros"] } 31 + tokio-util = "0.7.15" 32 + url = "2.5.4" 33 + 34 + [dependencies.metrics-exporter-prometheus] 35 + version = "0.17.2" 36 + default-features = false 37 + features = ["http-listener", "async-runtime"]
+37
who-am-i/demo/index.html
··· 1 + <!doctype html> 2 + <html> 3 + <head> 4 + <style> 5 + body { 6 + background: #333; 7 + color: #ccc; 8 + font-family: sans-serif; 9 + } 10 + </style> 11 + </head> 12 + 13 + <body> 14 + <h1>hey <span id="who"></span></h1> 15 + <p><code id="jwt"></code></p> 16 + 17 + <iframe src="http://127.0.0.1:9997/prompt" id="whoami" style="border: none" height="160" width="320"></iframe> 18 + 19 + <script type="text/javascript"> 20 + (whoami => { 21 + const handleMessage = ev => { 22 + if (ev.source !== whoami.contentWindow) { 23 + // TODO: ALSO CHECK ev.origin!!!! 24 + console.log('nah'); 25 + return; 26 + } 27 + whoami.remove(); 28 + window.removeEventListener('message', handleMessage); 29 + 30 + document.getElementById('who').textContent = ev.data.handle; 31 + document.getElementById('jwt').textContent = ev.data.token; 32 + } 33 + window.addEventListener('message', handleMessage); 34 + })(document.getElementById('whoami')); 35 + </script> 36 + </body> 37 + </html>
+4
who-am-i/demo/serve
··· 1 + #!/usr/bin/env bash 2 + 3 + echo "note: you might need to access via http://127.0.0.1:8888 (not localhost) for the iframe to get its cookies" 4 + python3 -m http.server 8888
+66
who-am-i/readme.md
··· 1 + # who am i 2 + 3 + a little auth service for microcosm demos 4 + 5 + **you probably SHOULD NOT USE THIS in any serious environment** 6 + 7 + for now the deployment is restricted to microcosm -- expanding it for wider use likely requires solving a number of challenges that oauth exists for. 8 + 9 + 10 + ## a little auth service 11 + 12 + - you drop an iframe and a short few lines of JS on your web page, and get a nice-ish atproto login prompt. 13 + - if the user has ever authorized this service before (and within some expiration), they will be presented with an in-frame one-click option to proceed. 14 + - otherwise they get bounced over to the normal atproto oauth flow (in a popup or new tab) 15 + - you get a callback containing 16 + - a verified DID and handle 17 + - a JWT containing the same that can be verified by public key 18 + - **no write permissions** or any atproto permissions at all, just a verified identity 19 + 20 + **you probably SHOULD NOT USE THIS in any serious environment** 21 + 22 + 23 + ### problems 24 + 25 + - clickjacking: if this were allowed on arbitrary domains, malicious sites could trick users into proving their atproto identity. 26 + - all the other problems oauth exists to solve: it's a little tricky to hook around the oauth flow so there are probably some annoying attacks. 27 + - auth in front of auth: it's just a bit awkward to run an auth service that acts as an intermediary for a more-real auth behind it, but that's worse, less secure, and doesn't conform to any standards. 28 + 29 + so, **you probably SHOULD NOT USE THIS in any serious environment** 30 + 31 + 32 + ## why 33 + 34 + sometimes you want to make a thing that people can use with an atproto identity, and you might not want to let them put in any else's identity. apps that operate on public data like skircle, cred.blue, and the microcosm spacedust notifications demo don't require any special permission to operate for any user, and that's sometimes fine, but sometimes creepy/stalker-y/etc. 35 + 36 + to avoid building a small torment nexus for a microcosm demo (while also not wanting to get deep into oauth or operate a demo-specific auth backend), i made this little service to just get a verified identity. 37 + 38 + note: **you probably SHOULD NOT USE THIS in any serious environment** 39 + 40 + --- 41 + 42 + since the requirements (read-only, just verifying identity) seem modest, i was hoping that a fairly simple implementation could be Good Enough, but in the time that i was willing to spend on it, the simple version without major obvious weaknesses i was hoping for didn't emerge. 43 + 44 + it's still nice to have an explicit opt-in on a per-demo basis for microcosm so it will be used for that. it's allow-listed for the microcosm domain however (so not deployed on any adversarial hosting pages), so it's simultaenously overkill and restrictive. 45 + 46 + i will get back to oauth eventually and hopefully roll out a microcosm service to make it easy for clients (and demos), but there are a few more things in the pipeline to get to first. 47 + 48 + 49 + ### todo 50 + 51 + provide a pubkey-signed JWT of the identity (just the DID as `sub` probably). (**you probably SHOULD NOT USE THIS in any serious environment**) 52 + 53 + 54 + ## building 55 + 56 + for raspi 1 model b: 57 + 58 + atrium-oauth uses reqwest with default tls config that requires openssl which `cross` doesn't have a good time getting the os deps for. 59 + 60 + fortunately, simply *enabling* a differnent tls feature for reqwest actually stops the default problematic one from causing problems, so we have a `reqwest` direct dependency with a feature enabled, even though it's never imported into actual code, 61 + 62 + it builds with 63 + 64 + ```bash 65 + cross build --release --target arm-unknown-linux-gnueabihf 66 + ```
+89
who-am-i/src/expiring_task_map.rs
··· 1 + use dashmap::DashMap; 2 + use rand::{Rng, distr::Alphanumeric}; 3 + use std::sync::Arc; 4 + use std::time::Duration; 5 + use tokio::task::{JoinHandle, spawn}; 6 + use tokio::time::sleep; 7 + use tokio_util::sync::{CancellationToken, DropGuard}; 8 + 9 + pub struct ExpiringTaskMap<T>(TaskMap<T>); 10 + 11 + /// need to manually implement clone because T is allowed to not be clone 12 + impl<T> Clone for ExpiringTaskMap<T> { 13 + fn clone(&self) -> Self { 14 + Self(self.0.clone()) 15 + } 16 + } 17 + 18 + impl<T: Send + 'static> ExpiringTaskMap<T> { 19 + pub fn new(expiration: Duration) -> Self { 20 + let map = TaskMap { 21 + map: Arc::new(DashMap::new()), 22 + expiration, 23 + }; 24 + Self(map) 25 + } 26 + 27 + pub fn dispatch<F>(&self, task: F, cancel: CancellationToken) -> String 28 + where 29 + F: Future<Output = T> + Send + 'static, 30 + { 31 + let TaskMap { 32 + ref map, 33 + expiration, 34 + } = self.0; 35 + let task_key: String = rand::rng() 36 + .sample_iter(&Alphanumeric) 37 + .take(24) 38 + .map(char::from) 39 + .collect(); 40 + 41 + // spawn a tokio task and put the join handle in the map for later retrieval 42 + map.insert(task_key.clone(), (cancel.clone().drop_guard(), spawn(task))); 43 + 44 + // spawn a second task to clean up the map in case it doesn't get claimed 45 + let k = task_key.clone(); 46 + let map = map.clone(); 47 + spawn(async move { 48 + if cancel 49 + .run_until_cancelled(sleep(expiration)) 50 + .await 51 + .is_some() 52 + // the (sleep) task completed first 53 + { 54 + map.remove(&k); 55 + cancel.cancel(); 56 + metrics::counter!("whoami_task_map_completions", "result" => "expired") 57 + .increment(1); 58 + } 59 + }); 60 + 61 + task_key 62 + } 63 + 64 + pub fn take(&self, key: &str) -> Option<JoinHandle<T>> { 65 + if let Some((_key, (_guard, handle))) = self.0.map.remove(key) { 66 + // when the _guard drops, it cancels the token for us 67 + metrics::counter!("whoami_task_map_completions", "result" => "retrieved").increment(1); 68 + Some(handle) 69 + } else { 70 + metrics::counter!("whoami_task_map_gones").increment(1); 71 + None 72 + } 73 + } 74 + } 75 + 76 + struct TaskMap<T> { 77 + map: Arc<DashMap<String, (DropGuard, JoinHandle<T>)>>, 78 + expiration: Duration, 79 + } 80 + 81 + /// need to manually implement clone because T is allowed to not be clone 82 + impl<T> Clone for TaskMap<T> { 83 + fn clone(&self) -> Self { 84 + Self { 85 + map: self.map.clone(), 86 + expiration: self.expiration, 87 + } 88 + } 89 + }
+93
who-am-i/src/jwt.rs
··· 1 + use elliptic_curve::SecretKey; 2 + use jose_jwk::{Class, Jwk, Key, Parameters}; 3 + use jsonwebtoken::{Algorithm, EncodingKey, Header, encode, errors::Error as JWTError}; 4 + use pkcs8::DecodePrivateKey; 5 + use serde::Serialize; 6 + use std::fs; 7 + use std::io::Error as IOError; 8 + use std::path::Path; 9 + use std::string::FromUtf8Error; 10 + use std::time::{Duration, SystemTime, UNIX_EPOCH}; 11 + use thiserror::Error; 12 + 13 + #[derive(Debug, Error)] 14 + pub enum TokensSetupError { 15 + #[error("failed to read private key")] 16 + ReadPrivateKey(IOError), 17 + #[error("failed to retrieve private key: {0}")] 18 + PrivateKey(JWTError), 19 + #[error("failed to read private key")] 20 + ReadJwks(IOError), 21 + #[error("failed to retrieve jwks: {0}")] 22 + DecodeJwks(FromUtf8Error), 23 + } 24 + 25 + #[derive(Debug, Error)] 26 + pub enum TokenMintingError { 27 + #[error("failed to mint: {0}")] 28 + EncodingError(#[from] JWTError), 29 + } 30 + 31 + pub struct Tokens { 32 + encoding_key: EncodingKey, 33 + jwk: Jwk, 34 + } 35 + 36 + impl Tokens { 37 + pub fn from_files(priv_f: impl AsRef<Path>) -> Result<Self, TokensSetupError> { 38 + let private_key_data: Vec<u8> = 39 + fs::read(priv_f).map_err(TokensSetupError::ReadPrivateKey)?; 40 + let encoding_key = 41 + EncodingKey::from_ec_pem(&private_key_data).map_err(TokensSetupError::PrivateKey)?; 42 + 43 + let jwk_key_string = String::from_utf8(private_key_data).unwrap(); 44 + let mut jwk = SecretKey::<p256::NistP256>::from_pkcs8_pem(&jwk_key_string) 45 + .map(|secret_key| Jwk { 46 + key: Key::from(&secret_key.into()), 47 + prm: Parameters { 48 + kid: Some("who-am-i-00".to_string()), 49 + cls: Some(Class::Signing), 50 + ..Default::default() 51 + }, 52 + }) 53 + .expect("to get private key"); 54 + 55 + // CRITICAL: this is what turns the private jwk into a public one: the 56 + // `d` parameter is the secret for an EC key; a pubkey just has no `d`. 57 + // 58 + // this feels baaaadd but hey we're just copying atrium 59 + // https://github.com/atrium-rs/atrium/blob/b48810f84d83d037ee89b79b8566df9e0f2a6dae/atrium-oauth/src/keyset.rs#L41 60 + let Key::Ec(ref mut ec) = jwk.key else { 61 + unimplemented!() 62 + }; 63 + ec.d = None; // CRITICAL 64 + 65 + Ok(Self { encoding_key, jwk }) 66 + } 67 + 68 + pub fn mint(&self, t: impl ToString) -> Result<String, TokenMintingError> { 69 + let sub = t.to_string(); 70 + 71 + let dt_now = SystemTime::now() 72 + .duration_since(UNIX_EPOCH) 73 + .expect("unix epoch is in the past"); 74 + let dt_exp = dt_now + Duration::from_secs(30 * 86_400); 75 + let exp = dt_exp.as_secs(); 76 + 77 + let mut header = Header::new(Algorithm::ES256); 78 + header.kid = Some("who-am-i-00".to_string()); 79 + // todo: consider setting jku? 80 + 81 + Ok(encode(&header, &Claims { sub, exp }, &self.encoding_key)?) 82 + } 83 + 84 + pub fn jwk(&self) -> Jwk { 85 + self.jwk.clone() 86 + } 87 + } 88 + 89 + #[derive(Debug, Serialize)] 90 + struct Claims { 91 + sub: String, 92 + exp: u64, 93 + }
+9
who-am-i/src/lib.rs
··· 1 + mod expiring_task_map; 2 + mod jwt; 3 + mod oauth; 4 + mod server; 5 + 6 + pub use expiring_task_map::ExpiringTaskMap; 7 + pub use jwt::Tokens; 8 + pub use oauth::{OAuth, OAuthCallbackParams, OAuthCompleteError, ResolveHandleError}; 9 + pub use server::serve;
+120
who-am-i/src/main.rs
··· 1 + use clap::{ArgAction, Parser}; 2 + use metrics_exporter_prometheus::{BuildError as PromBuildError, PrometheusBuilder}; 3 + use std::path::PathBuf; 4 + use tokio_util::sync::CancellationToken; 5 + use who_am_i::{Tokens, serve}; 6 + 7 + /// Aggregate links in the at-mosphere 8 + #[derive(Parser, Debug, Clone)] 9 + #[command(version, about, long_about = None)] 10 + struct Args { 11 + /// secret key from which the cookie-signing key is derived 12 + /// 13 + /// must have at least 512 bits (64 bytes) of randomness 14 + /// 15 + /// eg: `cat /dev/urandom | head -c 64 | base64` 16 + #[arg(long, env)] 17 + app_secret: String, 18 + /// path to at-oauth private key (PEM pk8 format) 19 + /// 20 + /// generate with: 21 + /// 22 + /// openssl ecparam -genkey -noout -name prime256v1 \ 23 + /// | openssl pkcs8 -topk8 -nocrypt -out <PATH-TO-PRIV-KEY>.pem 24 + #[arg(long, env)] 25 + oauth_private_key: Option<PathBuf>, 26 + /// path to jwt private key (PEM pk8 format) 27 + /// 28 + /// generate with: 29 + /// 30 + /// openssl ecparam -genkey -noout -name prime256v1 \ 31 + /// | openssl pkcs8 -topk8 -nocrypt -out <PATH-TO-PRIV-KEY>.pem 32 + #[arg(long)] 33 + jwt_private_key: PathBuf, 34 + /// this server's client-reachable base url, for oauth redirect + jwt check 35 + /// 36 + /// required unless running in localhost mode with --dev 37 + #[arg(long, env)] 38 + base_url: Option<String>, 39 + /// host:port to bind to on startup 40 + #[arg(long, env, default_value = "127.0.0.1:9997")] 41 + bind: String, 42 + /// Enable dev mode 43 + /// 44 + /// enables automatic template reloading, uses localhost oauth config, etc 45 + #[arg(long, action)] 46 + dev: bool, 47 + /// Hosts who are allowed to one-click auth 48 + /// 49 + /// Pass this argument multiple times to allow multiple hosts 50 + #[arg(long = "allow_host", short = 'a', action = ArgAction::Append)] 51 + allowed_hosts: Vec<String>, 52 + } 53 + 54 + #[tokio::main(flavor = "current_thread")] 55 + async fn main() { 56 + let shutdown = CancellationToken::new(); 57 + 58 + let ctrlc_shutdown = shutdown.clone(); 59 + ctrlc::set_handler(move || ctrlc_shutdown.cancel()).expect("failed to set ctrl-c handler"); 60 + 61 + let args = Args::parse(); 62 + 63 + // let bind = args.bind.to_socket_addrs().expect("--bind must be ToSocketAddrs"); 64 + 65 + let base = args.base_url.unwrap_or_else(|| { 66 + if args.dev { 67 + format!("http://{}", args.bind) 68 + } else { 69 + panic!("not in --dev mode so --base-url is required") 70 + } 71 + }); 72 + 73 + if !args.dev && args.oauth_private_key.is_none() { 74 + panic!("--at-oauth-key is required except in --dev"); 75 + } else if args.dev && args.oauth_private_key.is_some() { 76 + eprintln!("warn: --at-oauth-key is ignored in dev (localhost config)"); 77 + } 78 + 79 + if args.allowed_hosts.is_empty() { 80 + panic!("at least one --allowed-host host must be set"); 81 + } 82 + 83 + println!("starting with allowed_hosts hosts:"); 84 + for host in &args.allowed_hosts { 85 + println!(" - {host}"); 86 + } 87 + 88 + let tokens = Tokens::from_files(args.jwt_private_key).unwrap(); 89 + 90 + if let Err(e) = install_metrics_server() { 91 + eprintln!("failed to install metrics server: {e:?}"); 92 + }; 93 + 94 + serve( 95 + shutdown, 96 + args.app_secret, 97 + args.oauth_private_key, 98 + tokens, 99 + base, 100 + args.bind, 101 + args.allowed_hosts, 102 + args.dev, 103 + ) 104 + .await; 105 + } 106 + 107 + fn install_metrics_server() -> Result<(), PromBuildError> { 108 + println!("installing metrics server..."); 109 + let host = [0, 0, 0, 0]; 110 + let port = 8765; 111 + PrometheusBuilder::new() 112 + .set_enable_unit_suffix(false) 113 + .with_http_listener((host, port)) 114 + .install()?; 115 + println!( 116 + "metrics server installed! listening on http://{}.{}.{}.{}:{port}", 117 + host[0], host[1], host[2], host[3] 118 + ); 119 + Ok(()) 120 + }
+268
who-am-i/src/oauth.rs
··· 1 + use jose_jwk::Class; 2 + use jose_jwk::Jwk; 3 + use jose_jwk::Key; 4 + use jose_jwk::Parameters; 5 + use std::fs; 6 + use std::path::PathBuf; 7 + // use p256::SecretKey; 8 + use atrium_api::{agent::SessionManager, types::string::Did}; 9 + use atrium_common::resolver::Resolver; 10 + use atrium_identity::{ 11 + did::{CommonDidResolver, CommonDidResolverConfig, DEFAULT_PLC_DIRECTORY_URL}, 12 + handle::{AtprotoHandleResolver, AtprotoHandleResolverConfig, DnsTxtResolver}, 13 + }; 14 + use atrium_oauth::{ 15 + AtprotoClientMetadata, AtprotoLocalhostClientMetadata, AuthMethod, AuthorizeOptions, 16 + CallbackParams, DefaultHttpClient, GrantType, KnownScope, OAuthClient, OAuthClientConfig, 17 + OAuthClientMetadata, OAuthResolverConfig, Scope, 18 + store::{session::MemorySessionStore, state::MemoryStateStore}, 19 + }; 20 + use elliptic_curve::SecretKey; 21 + use hickory_resolver::{ResolveError, TokioResolver}; 22 + use jose_jwk::JwkSet; 23 + use pkcs8::DecodePrivateKey; 24 + use serde::Deserialize; 25 + use std::sync::Arc; 26 + use thiserror::Error; 27 + 28 + const READONLY_SCOPE: [Scope; 1] = [Scope::Known(KnownScope::Atproto)]; 29 + 30 + #[derive(Debug, Deserialize)] 31 + pub struct CallbackErrorParams { 32 + error: String, 33 + error_description: Option<String>, 34 + #[allow(dead_code)] 35 + state: Option<String>, // TODO: we _should_ use state to associate the auth request but how to do that with atrium is unclear 36 + iss: Option<String>, 37 + } 38 + 39 + #[derive(Debug, Deserialize)] 40 + #[serde(untagged)] 41 + pub enum OAuthCallbackParams { 42 + Granted(CallbackParams), 43 + Failed(CallbackErrorParams), 44 + } 45 + 46 + type Client = OAuthClient< 47 + MemoryStateStore, 48 + MemorySessionStore, 49 + CommonDidResolver<DefaultHttpClient>, 50 + AtprotoHandleResolver<HickoryDnsTxtResolver, DefaultHttpClient>, 51 + >; 52 + 53 + #[derive(Clone)] 54 + pub struct OAuth { 55 + client: Arc<Client>, 56 + did_resolver: Arc<CommonDidResolver<DefaultHttpClient>>, 57 + } 58 + 59 + #[derive(Debug, Error)] 60 + pub enum AuthSetupError { 61 + #[error("failed to intiialize atrium client: {0}")] 62 + AtriumClientError(atrium_oauth::Error), 63 + #[error("failed to initialize hickory dns resolver: {0}")] 64 + HickoryResolverError(ResolveError), 65 + } 66 + 67 + #[derive(Debug, Error)] 68 + pub enum OAuthCompleteError { 69 + #[error("the user denied request: {description:?} (from {issuer:?})")] 70 + Denied { 71 + description: Option<String>, 72 + issuer: Option<String>, 73 + }, 74 + #[error("the request failed: {error}: {description:?} (from {issuer:?})")] 75 + Failed { 76 + error: String, 77 + description: Option<String>, 78 + issuer: Option<String>, 79 + }, 80 + #[error("failed to complete oauth callback: {0}")] 81 + CallbackFailed(atrium_oauth::Error), 82 + #[error("the authorized session did not contain a DID")] 83 + NoDid, 84 + } 85 + 86 + #[derive(Debug, Error)] 87 + pub enum ResolveHandleError { 88 + #[error("failed to resolve: {0}")] 89 + ResolutionFailed(#[from] atrium_identity::Error), 90 + #[error("identity resolved but no handle found for user")] 91 + NoHandle, 92 + #[error("found handle {0:?} but it appears invalid: {1}")] 93 + InvalidHandle(String, &'static str), 94 + } 95 + 96 + impl OAuth { 97 + pub fn new(oauth_private_key: Option<PathBuf>, base: String) -> Result<Self, AuthSetupError> { 98 + let http_client = Arc::new(DefaultHttpClient::default()); 99 + let did_resolver = || { 100 + CommonDidResolver::new(CommonDidResolverConfig { 101 + plc_directory_url: DEFAULT_PLC_DIRECTORY_URL.to_string(), 102 + http_client: http_client.clone(), 103 + }) 104 + }; 105 + let dns_txt_resolver = 106 + HickoryDnsTxtResolver::new().map_err(AuthSetupError::HickoryResolverError)?; 107 + 108 + let resolver = OAuthResolverConfig { 109 + did_resolver: did_resolver(), 110 + handle_resolver: AtprotoHandleResolver::new(AtprotoHandleResolverConfig { 111 + dns_txt_resolver, 112 + http_client: Arc::clone(&http_client), 113 + }), 114 + authorization_server_metadata: Default::default(), 115 + protected_resource_metadata: Default::default(), 116 + }; 117 + 118 + let state_store = MemoryStateStore::default(); 119 + let session_store = MemorySessionStore::default(); 120 + 121 + let client = if let Some(path) = oauth_private_key { 122 + let key_contents: Vec<u8> = fs::read(path).unwrap(); 123 + let key_string = String::from_utf8(key_contents).unwrap(); 124 + let key = SecretKey::<p256::NistP256>::from_pkcs8_pem(&key_string) 125 + .map(|secret_key| Jwk { 126 + key: Key::from(&secret_key.into()), 127 + prm: Parameters { 128 + kid: Some("at-oauth-00".to_string()), 129 + cls: Some(Class::Signing), 130 + ..Default::default() 131 + }, 132 + }) 133 + .expect("to get private key"); 134 + OAuthClient::new(OAuthClientConfig { 135 + client_metadata: AtprotoClientMetadata { 136 + client_id: format!("{base}/client-metadata.json"), 137 + client_uri: Some(base.clone()), 138 + redirect_uris: vec![format!("{base}/authorized")], 139 + token_endpoint_auth_method: AuthMethod::PrivateKeyJwt, 140 + grant_types: vec![GrantType::AuthorizationCode, GrantType::RefreshToken], 141 + scopes: READONLY_SCOPE.to_vec(), 142 + jwks_uri: Some(format!("{base}/.well-known/jwks.json")), 143 + token_endpoint_auth_signing_alg: Some(String::from("ES256")), 144 + }, 145 + keys: Some(vec![key]), 146 + resolver, 147 + state_store, 148 + session_store, 149 + }) 150 + .map_err(AuthSetupError::AtriumClientError)? 151 + } else { 152 + OAuthClient::new(OAuthClientConfig { 153 + client_metadata: AtprotoLocalhostClientMetadata { 154 + redirect_uris: Some(vec![String::from("http://127.0.0.1:9997/authorized")]), 155 + scopes: Some(READONLY_SCOPE.to_vec()), 156 + }, 157 + keys: None, 158 + resolver, 159 + state_store, 160 + session_store, 161 + }) 162 + .map_err(AuthSetupError::AtriumClientError)? 163 + }; 164 + 165 + Ok(Self { 166 + client: Arc::new(client), 167 + did_resolver: Arc::new(did_resolver()), 168 + }) 169 + } 170 + 171 + pub fn client_metadata(&self) -> OAuthClientMetadata { 172 + self.client.client_metadata.clone() 173 + } 174 + 175 + pub fn jwks(&self) -> JwkSet { 176 + self.client.jwks() 177 + } 178 + 179 + pub async fn begin(&self, handle: &str) -> Result<String, atrium_oauth::Error> { 180 + let auth_opts = AuthorizeOptions { 181 + scopes: READONLY_SCOPE.to_vec(), 182 + ..Default::default() 183 + }; 184 + self.client.authorize(handle, auth_opts).await 185 + } 186 + 187 + /// Finally, resolve the oauth flow to a verified DID 188 + pub async fn complete(&self, params: OAuthCallbackParams) -> Result<Did, OAuthCompleteError> { 189 + let params = match params { 190 + OAuthCallbackParams::Granted(params) => params, 191 + OAuthCallbackParams::Failed(p) if p.error == "access_denied" => { 192 + return Err(OAuthCompleteError::Denied { 193 + description: p.error_description.clone(), 194 + issuer: p.iss.clone(), 195 + }); 196 + } 197 + OAuthCallbackParams::Failed(p) => { 198 + return Err(OAuthCompleteError::Failed { 199 + error: p.error.clone(), 200 + description: p.error_description.clone(), 201 + issuer: p.iss.clone(), 202 + }); 203 + } 204 + }; 205 + let (session, _) = self 206 + .client 207 + .callback(params) 208 + .await 209 + .map_err(OAuthCompleteError::CallbackFailed)?; 210 + let Some(did) = session.did().await else { 211 + return Err(OAuthCompleteError::NoDid); 212 + }; 213 + Ok(did) 214 + } 215 + 216 + pub async fn resolve_handle(&self, did: Did) -> Result<String, ResolveHandleError> { 217 + // TODO: this is only half the resolution? or is atrium checking dns? 218 + let doc = self.did_resolver.resolve(&did).await?; 219 + let Some(aka) = doc.also_known_as else { 220 + return Err(ResolveHandleError::NoHandle); 221 + }; 222 + let Some(at_uri_handle) = aka.first() else { 223 + return Err(ResolveHandleError::NoHandle); 224 + }; 225 + if aka.len() > 1 { 226 + eprintln!("more than one handle found for {did:?}"); 227 + } 228 + let Some(bare_handle) = at_uri_handle.strip_prefix("at://") else { 229 + return Err(ResolveHandleError::InvalidHandle( 230 + at_uri_handle.to_string(), 231 + "did not start with 'at://'", 232 + )); 233 + }; 234 + if bare_handle.is_empty() { 235 + return Err(ResolveHandleError::InvalidHandle( 236 + at_uri_handle.to_string(), 237 + "empty handle", 238 + )); 239 + } 240 + Ok(bare_handle.to_string()) 241 + } 242 + } 243 + 244 + pub struct HickoryDnsTxtResolver(TokioResolver); 245 + 246 + impl HickoryDnsTxtResolver { 247 + fn new() -> Result<Self, ResolveError> { 248 + Ok(Self(TokioResolver::builder_tokio()?.build())) 249 + } 250 + } 251 + 252 + impl DnsTxtResolver for HickoryDnsTxtResolver { 253 + async fn resolve( 254 + &self, 255 + query: &str, 256 + ) -> core::result::Result<Vec<String>, Box<dyn std::error::Error + Send + Sync>> { 257 + match self.0.txt_lookup(query).await { 258 + Ok(r) => { 259 + metrics::counter!("whoami_resolve_dns_txt", "success" => "true").increment(1); 260 + Ok(r.iter().map(|r| r.to_string()).collect()) 261 + } 262 + Err(e) => { 263 + metrics::counter!("whoami_resolve_dns_txt", "success" => "false").increment(1); 264 + Err(e.into()) 265 + } 266 + } 267 + } 268 + }
+525
who-am-i/src/server.rs
··· 1 + use atrium_api::types::string::Did; 2 + use atrium_oauth::OAuthClientMetadata; 3 + use axum::{ 4 + Router, 5 + extract::{FromRef, Json as ExtractJson, Query, State}, 6 + http::{ 7 + StatusCode, 8 + header::{CONTENT_SECURITY_POLICY, CONTENT_TYPE, HeaderMap, ORIGIN, REFERER}, 9 + }, 10 + response::{IntoResponse, Json, Redirect, Response}, 11 + routing::{get, post}, 12 + }; 13 + use axum_extra::extract::cookie::{Cookie, Expiration, Key, SameSite, SignedCookieJar}; 14 + use axum_template::{RenderHtml, engine::Engine}; 15 + use handlebars::{Handlebars, handlebars_helper}; 16 + use jose_jwk::JwkSet; 17 + use std::path::PathBuf; 18 + 19 + use serde::Deserialize; 20 + use serde_json::{Value, json}; 21 + use std::collections::HashSet; 22 + use std::sync::Arc; 23 + use std::time::{Duration, SystemTime}; 24 + use tokio::net::TcpListener; 25 + use tokio_util::sync::CancellationToken; 26 + use url::Url; 27 + 28 + use crate::{ 29 + ExpiringTaskMap, OAuth, OAuthCallbackParams, OAuthCompleteError, ResolveHandleError, Tokens, 30 + }; 31 + 32 + const FAVICON: &[u8] = include_bytes!("../static/favicon.ico"); 33 + const STYLE_CSS: &str = include_str!("../static/style.css"); 34 + 35 + const HELLO_COOKIE_KEY: &str = "hello-who-am-i"; 36 + const DID_COOKIE_KEY: &str = "did"; 37 + 38 + const COOKIE_EXPIRATION: Duration = Duration::from_secs(30 * 86_400); 39 + 40 + type AppEngine = Engine<Handlebars<'static>>; 41 + 42 + #[derive(Clone)] 43 + struct AppState { 44 + pub key: Key, 45 + pub allowed_hosts: Arc<HashSet<String>>, 46 + pub engine: AppEngine, 47 + pub oauth: Arc<OAuth>, 48 + pub resolve_handles: ExpiringTaskMap<Result<String, ResolveHandleError>>, 49 + pub shutdown: CancellationToken, 50 + pub tokens: Arc<Tokens>, 51 + } 52 + 53 + impl FromRef<AppState> for Key { 54 + fn from_ref(state: &AppState) -> Self { 55 + state.key.clone() 56 + } 57 + } 58 + 59 + #[allow(clippy::too_many_arguments)] 60 + pub async fn serve( 61 + shutdown: CancellationToken, 62 + app_secret: String, 63 + oauth_private_key: Option<PathBuf>, 64 + tokens: Tokens, 65 + base: String, 66 + bind: String, 67 + allowed_hosts: Vec<String>, 68 + dev: bool, 69 + ) { 70 + let mut hbs = Handlebars::new(); 71 + hbs.set_dev_mode(dev); 72 + hbs.register_templates_directory("templates", Default::default()) 73 + .unwrap(); 74 + 75 + handlebars_helper!(json: |v: Value| serde_json::to_string(&v).unwrap()); 76 + hbs.register_helper("json", Box::new(json)); 77 + 78 + // clients have to pick up their identity-resolving tasks within this period 79 + let task_pickup_expiration = Duration::from_secs(15); 80 + 81 + let oauth = OAuth::new(oauth_private_key, base).unwrap(); 82 + 83 + let state = AppState { 84 + engine: Engine::new(hbs), 85 + key: Key::from(app_secret.as_bytes()), // TODO: via config 86 + allowed_hosts: Arc::new(HashSet::from_iter(allowed_hosts)), 87 + oauth: Arc::new(oauth), 88 + resolve_handles: ExpiringTaskMap::new(task_pickup_expiration), 89 + shutdown: shutdown.clone(), 90 + tokens: Arc::new(tokens), 91 + }; 92 + 93 + let app = Router::new() 94 + .route("/", get(hello)) 95 + .route("/favicon.ico", get(favicon)) // todo MIME 96 + .route("/style.css", get(css)) 97 + .route("/prompt", get(prompt)) 98 + .route("/user-info", post(user_info)) 99 + .route("/client-metadata.json", get(client_metadata)) 100 + .route("/auth", get(start_oauth)) 101 + .route("/authorized", get(complete_oauth)) 102 + .route("/disconnect", post(disconnect)) 103 + .route("/.well-known/jwks.json", get(jwks)) 104 + .with_state(state); 105 + 106 + eprintln!("starting server at http://{bind}"); 107 + let listener = TcpListener::bind(bind) 108 + .await 109 + .expect("listener binding to work"); 110 + 111 + axum::serve(listener, app) 112 + .with_graceful_shutdown(async move { shutdown.cancelled().await }) 113 + .await 114 + .unwrap(); 115 + } 116 + 117 + #[derive(Debug, Deserialize)] 118 + struct HelloQuery { 119 + auth_reload: Option<String>, 120 + auth_failed: Option<String>, 121 + } 122 + async fn hello( 123 + State(AppState { 124 + engine, 125 + resolve_handles, 126 + shutdown, 127 + oauth, 128 + .. 129 + }): State<AppState>, 130 + Query(params): Query<HelloQuery>, 131 + mut jar: SignedCookieJar, 132 + ) -> Response { 133 + let is_auth_reload = params.auth_reload.is_some(); 134 + let auth_failed = params.auth_failed.is_some(); 135 + let no_cookie = jar.get(HELLO_COOKIE_KEY).is_none(); 136 + jar = jar.add(hello_cookie()); 137 + 138 + let info = if let Some(did) = jar.get(DID_COOKIE_KEY) { 139 + if let Ok(did) = Did::new(did.value_trimmed().to_string()) { 140 + // push cookie expiry 141 + jar = jar.add(cookie(&did)); 142 + let fetch_key = resolve_handles.dispatch( 143 + { 144 + let oauth = oauth.clone(); 145 + let did = did.clone(); 146 + async move { oauth.resolve_handle(did.clone()).await } 147 + }, 148 + shutdown.child_token(), 149 + ); 150 + json!({ 151 + "did": did, 152 + "fetch_key": fetch_key, 153 + "is_auth_reload": is_auth_reload, 154 + "auth_failed": auth_failed, 155 + "no_cookie": no_cookie, 156 + }) 157 + } else { 158 + jar = jar.remove(DID_COOKIE_KEY); 159 + json!({ 160 + "is_auth_reload": is_auth_reload, 161 + "auth_failed": auth_failed, 162 + "no_cookie": no_cookie, 163 + }) 164 + } 165 + } else { 166 + json!({ 167 + "is_auth_reload": is_auth_reload, 168 + "auth_failed": auth_failed, 169 + "no_cookie": no_cookie, 170 + }) 171 + }; 172 + let frame_headers = [(CONTENT_SECURITY_POLICY, "frame-ancestors 'none'")]; 173 + (frame_headers, jar, RenderHtml("hello", engine, info)).into_response() 174 + } 175 + 176 + async fn css() -> impl IntoResponse { 177 + let headers = [ 178 + (CONTENT_TYPE, "text/css"), 179 + // (CACHE_CONTROL, "") // TODO 180 + ]; 181 + (headers, STYLE_CSS) 182 + } 183 + 184 + async fn favicon() -> impl IntoResponse { 185 + ([(CONTENT_TYPE, "image/x-icon")], FAVICON) 186 + } 187 + 188 + fn hello_cookie() -> Cookie<'static> { 189 + Cookie::build((HELLO_COOKIE_KEY, "hiiii")) 190 + .http_only(true) 191 + .secure(true) 192 + .same_site(SameSite::None) 193 + .expires(Expiration::DateTime( 194 + (SystemTime::now() + COOKIE_EXPIRATION).into(), 195 + )) // wtf safari needs this to not be a session cookie?? 196 + .max_age(COOKIE_EXPIRATION.try_into().unwrap()) 197 + .path("/") 198 + .into() 199 + } 200 + 201 + fn cookie(did: &Did) -> Cookie<'static> { 202 + Cookie::build((DID_COOKIE_KEY, did.to_string())) 203 + .http_only(true) 204 + .secure(true) 205 + .same_site(SameSite::None) 206 + .expires(Expiration::DateTime( 207 + (SystemTime::now() + COOKIE_EXPIRATION).into(), 208 + )) // wtf safari needs this to not be a session cookie?? 209 + .max_age(COOKIE_EXPIRATION.try_into().unwrap()) 210 + .path("/") 211 + .into() 212 + } 213 + 214 + #[derive(Debug, Deserialize)] 215 + struct PromptQuery { 216 + // this must *ONLY* be used for the postmessage target origin 217 + app: Option<String>, 218 + } 219 + async fn prompt( 220 + State(AppState { 221 + allowed_hosts, 222 + engine, 223 + oauth, 224 + resolve_handles, 225 + shutdown, 226 + tokens, 227 + .. 228 + }): State<AppState>, 229 + Query(params): Query<PromptQuery>, 230 + jar: SignedCookieJar, 231 + headers: HeaderMap, 232 + ) -> impl IntoResponse { 233 + let err = |reason, check_frame, detail| { 234 + metrics::counter!("whoami_auth_prompt", "ok" => "false", "reason" => reason).increment(1); 235 + let info = json!({ 236 + "reason": reason, 237 + "check_frame": check_frame, 238 + "detail": detail, 239 + }); 240 + let html = RenderHtml("prompt-error", engine.clone(), info); 241 + (StatusCode::BAD_REQUEST, html).into_response() 242 + }; 243 + 244 + let Some(parent) = headers.get(ORIGIN).or_else(|| { 245 + eprintln!("referrer fallback"); 246 + // TODO: referer should only be used for localhost?? 247 + headers.get(REFERER) 248 + }) else { 249 + return err("Missing origin and no referrer for fallback", true, None); 250 + }; 251 + let Ok(parent) = parent.to_str() else { 252 + return err("Unreadable origin or referrer", true, None); 253 + }; 254 + eprintln!( 255 + "rolling with parent: {parent:?} (from origin? {})", 256 + headers.get(ORIGIN).is_some() 257 + ); 258 + let Ok(url) = Url::parse(parent) else { 259 + return err("Bad origin or referrer", true, None); 260 + }; 261 + let Some(parent_host) = url.host_str() else { 262 + return err("Origin or referrer missing host", true, None); 263 + }; 264 + if !allowed_hosts.contains(parent_host) { 265 + return err( 266 + "Login is not allowed on this page", 267 + false, 268 + Some(parent_host), 269 + ); 270 + } 271 + if let Some(ref app) = params.app 272 + && !allowed_hosts.contains(app) 273 + { 274 + return err("Login is not allowed for this app", false, Some(app)); 275 + } 276 + let parent_origin = url.origin().ascii_serialization(); 277 + if parent_origin == "null" { 278 + return err("Origin or referrer header value is opaque", true, None); 279 + } 280 + 281 + let all_allowed = allowed_hosts 282 + .iter() 283 + .map(|h| format!("https://{h}")) 284 + .collect::<Vec<_>>() 285 + .join(" "); 286 + let csp = format!("frame-ancestors 'self' {parent_origin} {all_allowed}"); 287 + let frame_headers = [(CONTENT_SECURITY_POLICY, &csp)]; 288 + 289 + if let Some(did) = jar.get(DID_COOKIE_KEY) { 290 + let Ok(did) = Did::new(did.value_trimmed().to_string()) else { 291 + return err("Bad cookie", false, None); 292 + }; 293 + 294 + // push cookie expiry 295 + let jar = jar.add(cookie(&did)); 296 + 297 + let token = match tokens.mint(&*did) { 298 + Ok(t) => t, 299 + Err(e) => { 300 + eprintln!("failed to create JWT: {e:?}"); 301 + return err("failed to create JWT", false, None); 302 + } 303 + }; 304 + 305 + let fetch_key = resolve_handles.dispatch( 306 + { 307 + let oauth = oauth.clone(); 308 + let did = did.clone(); 309 + async move { oauth.resolve_handle(did.clone()).await } 310 + }, 311 + shutdown.child_token(), 312 + ); 313 + 314 + metrics::counter!("whoami_auth_prompt", "ok" => "true", "known" => "true").increment(1); 315 + let info = json!({ 316 + "did": did, 317 + "token": token, 318 + "fetch_key": fetch_key, 319 + "parent_host": parent_host, 320 + "parent_origin": parent_origin, 321 + "parent_target": params.app.map(|h| format!("https://{h}")), 322 + }); 323 + (frame_headers, jar, RenderHtml("prompt", engine, info)).into_response() 324 + } else { 325 + metrics::counter!("whoami_auth_prompt", "ok" => "true", "known" => "false").increment(1); 326 + let info = json!({ 327 + "parent_host": parent_host, 328 + "parent_origin": parent_origin, 329 + }); 330 + (frame_headers, RenderHtml("prompt", engine, info)).into_response() 331 + } 332 + } 333 + 334 + #[derive(Debug, Deserialize)] 335 + struct UserInfoParams { 336 + fetch_key: String, 337 + } 338 + async fn user_info( 339 + State(AppState { 340 + resolve_handles, .. 341 + }): State<AppState>, 342 + ExtractJson(params): ExtractJson<UserInfoParams>, 343 + ) -> impl IntoResponse { 344 + let err = |status, reason: &str| { 345 + metrics::counter!("whoami_user_info", "found" => "false", "reason" => reason.to_string()) 346 + .increment(1); 347 + (status, Json(json!({ "reason": reason }))).into_response() 348 + }; 349 + 350 + let Some(task_handle) = resolve_handles.take(&params.fetch_key) else { 351 + return err(StatusCode::NOT_FOUND, "fetch key does not exist or expired"); 352 + }; 353 + 354 + match task_handle.await { 355 + Err(task_err) => { 356 + eprintln!("task join error? {task_err:?}"); 357 + err(StatusCode::INTERNAL_SERVER_ERROR, "server errored") 358 + } 359 + Ok(Err(ResolveHandleError::ResolutionFailed(atrium_identity::Error::NotFound))) => { 360 + err(StatusCode::NOT_FOUND, "handle not found") 361 + } 362 + Ok(Err(ResolveHandleError::ResolutionFailed(e))) => { 363 + eprintln!("handle resolution failed: {e:?}"); 364 + err( 365 + StatusCode::INTERNAL_SERVER_ERROR, 366 + "handle resolution failed", 367 + ) 368 + } 369 + Ok(Err(ResolveHandleError::NoHandle)) => err( 370 + StatusCode::INTERNAL_SERVER_ERROR, 371 + "resolved identity but did not find a handle", 372 + ), 373 + Ok(Err(ResolveHandleError::InvalidHandle(_h, reason))) => err( 374 + StatusCode::INTERNAL_SERVER_ERROR, 375 + &format!("handle appears invalid: {reason}"), 376 + ), 377 + Ok(Ok(handle)) => { 378 + metrics::counter!("whoami_user_info", "found" => "true").increment(1); 379 + Json(json!({ "handle": handle })).into_response() 380 + } 381 + } 382 + } 383 + 384 + async fn client_metadata( 385 + State(AppState { oauth, .. }): State<AppState>, 386 + ) -> Json<OAuthClientMetadata> { 387 + Json(oauth.client_metadata()) 388 + } 389 + 390 + #[derive(Debug, Deserialize)] 391 + struct BeginOauthParams { 392 + handle: String, 393 + } 394 + async fn start_oauth( 395 + State(AppState { oauth, engine, .. }): State<AppState>, 396 + Query(params): Query<BeginOauthParams>, 397 + jar: SignedCookieJar, 398 + ) -> Response { 399 + // if any existing session was active, clear it first 400 + // ...this might help a confusion attack w multiple sign-in flows or smth 401 + let jar = jar.remove(DID_COOKIE_KEY); 402 + 403 + use atrium_identity::Error as IdError; 404 + use atrium_oauth::Error as OAuthError; 405 + 406 + let err = |code, reason: &str| { 407 + metrics::counter!("whoami_auth_start", "ok" => "false", "reason" => reason.to_string()) 408 + .increment(1); 409 + let info = json!({ 410 + "result": "fail", 411 + "reason": reason, 412 + }); 413 + (code, RenderHtml("auth-fail", engine.clone(), info)).into_response() 414 + }; 415 + 416 + match oauth.begin(&params.handle).await { 417 + Err(OAuthError::Identity( 418 + IdError::NotFound | IdError::HttpStatus(StatusCode::NOT_FOUND), 419 + )) => err(StatusCode::NOT_FOUND, "handle not found"), 420 + Err(OAuthError::Identity(IdError::AtIdentifier(r))) => err(StatusCode::BAD_REQUEST, &r), 421 + Err(e) => { 422 + eprintln!("begin auth failed: {e:?}"); 423 + err(StatusCode::INTERNAL_SERVER_ERROR, "unknown") 424 + } 425 + Ok(auth_url) => { 426 + metrics::counter!("whoami_auth_start", "ok" => "true").increment(1); 427 + (jar, Redirect::to(&auth_url)).into_response() 428 + } 429 + } 430 + } 431 + 432 + async fn complete_oauth( 433 + State(AppState { 434 + engine, 435 + resolve_handles, 436 + oauth, 437 + shutdown, 438 + tokens, 439 + .. 440 + }): State<AppState>, 441 + Query(params): Query<OAuthCallbackParams>, 442 + jar: SignedCookieJar, 443 + ) -> Response { 444 + let err = |code, result, reason: &str| { 445 + metrics::counter!("whoami_auth_complete", "ok" => "false", "reason" => reason.to_string()) 446 + .increment(1); 447 + let info = json!({ 448 + "result": result, 449 + "reason": reason, 450 + }); 451 + (code, RenderHtml("auth-fail", engine.clone(), info)).into_response() 452 + }; 453 + 454 + let did = match oauth.complete(params).await { 455 + Ok(did) => did, 456 + Err(e) => { 457 + return match e { 458 + OAuthCompleteError::Denied { description, .. } => { 459 + let desc = description.unwrap_or("permission to share was denied".to_string()); 460 + err(StatusCode::FORBIDDEN, "deny", desc.as_str()) 461 + } 462 + OAuthCompleteError::Failed { .. } => { 463 + eprintln!("auth completion failed: {e:?}"); 464 + err( 465 + StatusCode::INTERNAL_SERVER_ERROR, 466 + "fail", 467 + "failed to complete", 468 + ) 469 + } 470 + OAuthCompleteError::CallbackFailed(e) => { 471 + eprintln!("auth callback failed: {e:?}"); 472 + err( 473 + StatusCode::INTERNAL_SERVER_ERROR, 474 + "fail", 475 + "failed to complete callback", 476 + ) 477 + } 478 + OAuthCompleteError::NoDid => err(StatusCode::BAD_REQUEST, "fail", "no DID found"), 479 + }; 480 + } 481 + }; 482 + 483 + let jar = jar.add(cookie(&did)); 484 + 485 + let token = match tokens.mint(&*did) { 486 + Ok(t) => t, 487 + Err(e) => { 488 + eprintln!("failed to create JWT: {e:?}"); 489 + return err( 490 + StatusCode::INTERNAL_SERVER_ERROR, 491 + "fail", 492 + "failed to create JWT", 493 + ); 494 + } 495 + }; 496 + 497 + let fetch_key = resolve_handles.dispatch( 498 + { 499 + let oauth = oauth.clone(); 500 + let did = did.clone(); 501 + async move { oauth.resolve_handle(did.clone()).await } 502 + }, 503 + shutdown.child_token(), 504 + ); 505 + 506 + metrics::counter!("whoami_auth_complete", "ok" => "true").increment(1); 507 + let info = json!({ 508 + "did": did, 509 + "token": token, 510 + "fetch_key": fetch_key, 511 + }); 512 + (jar, RenderHtml("authorized", engine, info)).into_response() 513 + } 514 + 515 + async fn disconnect(jar: SignedCookieJar) -> impl IntoResponse { 516 + metrics::counter!("whoami_disconnect").increment(1); 517 + let jar = jar.remove(DID_COOKIE_KEY); 518 + (jar, Json(json!({ "ok": true }))) 519 + } 520 + 521 + async fn jwks(State(AppState { oauth, tokens, .. }): State<AppState>) -> Json<JwkSet> { 522 + let mut jwks = oauth.jwks(); 523 + jwks.keys.push(tokens.jwk()); 524 + Json(jwks) 525 + }
who-am-i/static/favicon.ico

This is a binary file and will not be displayed.

+195
who-am-i/static/style.css
··· 1 + body { 2 + color: #434; 3 + font-family: 'Iowan Old Style', 'Palatino Linotype', 'URW Palladio L', P052, serif; 4 + margin: 0; 5 + min-height: 100vh; 6 + padding: 0; 7 + } 8 + .wrap { 9 + border: 2px solid #221828; 10 + border-radius: 0.5rem; 11 + box-sizing: border-box; 12 + overflow: hidden; 13 + display: flex; 14 + flex-direction: column; 15 + min-height: 100vh; 16 + } 17 + .wrap.unframed { 18 + border-radius: 0; 19 + border-width: 0.4rem; 20 + } 21 + header { 22 + background: #221828; 23 + display: flex; 24 + justify-content: space-between; 25 + padding: 0 0.25rem; 26 + color: #c9b; 27 + display: flex; 28 + gap: 0.5rem; 29 + align-items: baseline; 30 + } 31 + header > * { 32 + flex-basis: 33%; 33 + } 34 + header > .empty { 35 + font-size: 0.8rem; 36 + opacity: 0.5; 37 + } 38 + header > .title { 39 + text-align: center; 40 + } 41 + header > a.micro { 42 + text-decoration: none; 43 + font-size: 0.8rem; 44 + text-align: right; 45 + opacity: 0.5; 46 + } 47 + header > a.micro:hover { 48 + opacity: 1; 49 + } 50 + main { 51 + background: #ccc; 52 + display: flex; 53 + flex-direction: column; 54 + flex-grow: 1; 55 + padding: 0.25rem 0.5rem; 56 + } 57 + .mini-content { 58 + margin: 1rem auto 0; 59 + padding: 1rem 0.5rem; 60 + max-width: 21rem; 61 + } 62 + 63 + .explain { 64 + border-bottom: 1px dashed #888; 65 + margin-bottom: 1rem; 66 + padding-bottom: 2rem; 67 + } 68 + .explain p { 69 + text-align: left; 70 + } 71 + 72 + #error-message { 73 + font-size: 0.8rem; 74 + color: #a31; 75 + } 76 + 77 + #error-message:not(.hidden) + #prompt { 78 + display: none !important; 79 + } 80 + 81 + #error-message, 82 + p { 83 + margin: 1rem 0 0; 84 + text-align: center; 85 + } 86 + p.detail { 87 + font-size: 0.8rem; 88 + } 89 + p.detail.no { 90 + font-style: italic; 91 + } 92 + .parent-host { 93 + font-weight: bold; 94 + color: #48c; 95 + display: inline-block; 96 + padding: 0 0.125rem; 97 + border-radius: 0.25rem; 98 + border: 1px solid #aaa; 99 + font-size: 0.8rem; 100 + } 101 + 102 + #loader { 103 + display: flex; 104 + flex-grow: 1; 105 + justify-content: center; 106 + align-items: center; 107 + } 108 + .spinner { 109 + animation: rotation 1.618s ease-in-out infinite; 110 + border-radius: 50%; 111 + border: 3px dashed #434; 112 + box-sizing: border-box; 113 + display: inline-block; 114 + height: 1.5em; 115 + width: 1.5em; 116 + } 117 + @keyframes rotation { 118 + 0% { transform: rotate(0deg) } 119 + 100% { transform: rotate(360deg) } 120 + } 121 + /* loader visibility is mutually exclusive with its immediate sibling */ 122 + #loader:not(.hidden) + * { 123 + display: none !important; 124 + } 125 + 126 + #user-info { 127 + flex-grow: 1; 128 + display: flex; 129 + flex-direction: column; 130 + justify-content: center; 131 + } 132 + .action { 133 + background: #eee; 134 + display: flex; 135 + justify-content: space-between; 136 + padding: 0.5rem 0.25rem 0.5rem 0.5rem; 137 + font-size: 0.8rem; 138 + align-items: baseline; 139 + border-radius: 0.5rem; 140 + border: 1px solid #bbb; 141 + cursor: pointer; 142 + } 143 + .action:hover { 144 + background: #fff; 145 + } 146 + #form-action:not(.hidden) + .action { 147 + display: none !important; 148 + } 149 + 150 + #connect, 151 + #allow, 152 + #revoke { 153 + background: transparent; 154 + border: none; 155 + border-left: 1px solid #bbb; 156 + padding: 0 0.5rem; 157 + color: #375; 158 + font: inherit; 159 + cursor: pointer; 160 + } 161 + #revoke { 162 + color: #a31; 163 + } 164 + #action:hover #allow { 165 + color: #285; 166 + } 167 + 168 + #need-storage { 169 + font-size: 0.8rem; 170 + } 171 + .problem { 172 + color: #a31; 173 + } 174 + 175 + #or { 176 + font-size: 0.8rem; 177 + text-align: center; 178 + } 179 + #or p { 180 + margin: 0 0 1rem; 181 + } 182 + 183 + input.handle { 184 + border: none; 185 + border-bottom: 1px dashed #aaa; 186 + background: transparent; 187 + } 188 + 189 + .hidden { 190 + display: none !important; 191 + } 192 + 193 + .hello-connect-plz { 194 + margin: 1.667rem 0 0.667rem; 195 + }
+20
who-am-i/templates/auth-fail.hbs
··· 1 + {{#*inline "main"}} 2 + <p> 3 + Auth failed: {{ reason }} 4 + </p> 5 + 6 + <div id="user-info"> 7 + auth failed. 8 + </div> 9 + 10 + <script> 11 + localStorage.setItem("who-am-i", JSON.stringify({ 12 + result: {{{json result}}}, 13 + reason: {{{json reason}}}, 14 + })); 15 + 16 + window.close(); 17 + </script> 18 + {{/inline}} 19 + 20 + {{#> base-framed}}{{/base-framed}}
+19
who-am-i/templates/authorized.hbs
··· 1 + <!doctype html> 2 + <meta charset="utf-8" /> 3 + <title>great job!</title> 4 + 5 + <h1>oauth success!</h1> 6 + <p>this window should automatically close itself (probably a bug if it hasn't)</p> 7 + 8 + <script> 9 + // TODO: tie this back to its source........... 10 + 11 + localStorage.setItem("who-am-i", JSON.stringify({ 12 + result: "success", 13 + did: {{{json did}}}, 14 + token: {{{json token}}}, 15 + fetch_key: {{{json fetch_key}}}, 16 + })); 17 + // TODO: probably also wait for a reply from the frame and show an error if not 18 + window.close(); 19 + </script>
+17
who-am-i/templates/base-base.hbs
··· 1 + <!doctype html> 2 + <html lang="en"> 3 + <head> 4 + <meta charset="utf-8" /> 5 + <title>who-am-i</title> 6 + <meta name="description" content="{{> description }}"> 7 + <meta property="og:type" content="website"> 8 + <meta property="og:description" content="{{> description}}"> 9 + <!-- <meta property="og:image" content=""> --> 10 + 11 + <meta name="viewport" content="width=device-width, initial-scale=1.0" /> 12 + <link href="/style.css" rel="stylesheet" type="text/css" /> 13 + </head> 14 + <body> 15 + {{> body}} 16 + </body> 17 + </html>
+28
who-am-i/templates/base-framed.hbs
··· 1 + {{#*inline "description"}}{{/inline}} 2 + 3 + {{#*inline "body"}} 4 + <div class="wrap"> 5 + <header> 6 + <div class="empty">🔒</div> 7 + <code class="title" style="font-family: monospace;" 8 + >who-am-i</code> 9 + <a href="https://microcosm.blue" target="_blank" class="micro" 10 + ><span style="color: #f396a9">m</span 11 + ><span style="color: #f49c5c">i</span 12 + ><span style="color: #c7b04c">c</span 13 + ><span style="color: #92be4c">r</span 14 + ><span style="color: #4ec688">o</span 15 + ><span style="color: #51c2b6">c</span 16 + ><span style="color: #54bed7">o</span 17 + ><span style="color: #8fb1f1">s</span 18 + ><span style="color: #ce9df1">m</span 19 + ></a> 20 + </header> 21 + 22 + <main> 23 + {{> main}} 24 + </main> 25 + </div> 26 + {{/inline}} 27 + 28 + {{#> base-base}}{{/base-base}}
+26
who-am-i/templates/base-full.hbs
··· 1 + {{#*inline "body"}} 2 + <div class="wrap unframed"> 3 + <header> 4 + <div class="empty">🔒</div> 5 + <code class="title" style="font-family: monospace;" 6 + >who-am-i</code> 7 + <a href="https://microcosm.blue" target="_blank" class="micro" 8 + ><span style="color: #f396a9">m</span 9 + ><span style="color: #f49c5c">i</span 10 + ><span style="color: #c7b04c">c</span 11 + ><span style="color: #92be4c">r</span 12 + ><span style="color: #4ec688">o</span 13 + ><span style="color: #51c2b6">c</span 14 + ><span style="color: #54bed7">o</span 15 + ><span style="color: #8fb1f1">s</span 16 + ><span style="color: #ce9df1">m</span 17 + ></a> 18 + </header> 19 + 20 + <main> 21 + {{> main}} 22 + </main> 23 + </div> 24 + {{/inline}} 25 + 26 + {{#> base-base}}{{/base-base}}
+122
who-am-i/templates/hello.hbs
··· 1 + {{#*inline "description"}}A little identity-verifying auth service for microcosm demos{{/inline}} 2 + 3 + {{#*inline "main"}} 4 + <div class="mini-content"> 5 + <div class="explain"> 6 + <p>This is a little identity-verifying service for microcosm demos.</p> 7 + <p>Only <strong>read access to your public data</strong> is required to connect: connecting does not grant any ability to modify your account or data.</p> 8 + </div> 9 + 10 + {{#if did}} 11 + <p id="error-message" class="hidden"></p> 12 + 13 + <p id="prompt" class="detail"> 14 + Connected identity: 15 + </p> 16 + 17 + <div id="loader"> 18 + <span class="spinner"></span> 19 + </div> 20 + 21 + <div id="user-info"> 22 + <div id="handle-action" class="action"> 23 + <span id="handle-view" class="handle"></span> 24 + <button id="revoke">disconnect</button> 25 + </div> 26 + </div> 27 + <script> 28 + const errorEl = document.getElementById('error-message'); 29 + const loaderEl = document.getElementById('loader'); 30 + const handleViewEl = document.getElementById('handle-view'); 31 + const revokeEl = document.getElementById('revoke'); // for known-did 32 + 33 + function err(e, msg) { 34 + loaderEl.classList.add('hidden'); 35 + errorEl.classList.remove('hidden'); 36 + errorEl.textContent = msg || e; 37 + throw new Error(e); 38 + } 39 + 40 + // already-known user 41 + ({{{json did}}}) && (async () => { 42 + 43 + const handle = await lookUp({{{json fetch_key}}}); 44 + 45 + loaderEl.classList.add('hidden'); 46 + handleViewEl.textContent = `@${handle}`; 47 + revokeEl.addEventListener('click', async () => { 48 + try { 49 + let res = await fetch('/disconnect', { method: 'POST', credentials: 'include' }); 50 + if (!res.ok) throw res; 51 + } catch (e) { 52 + err(e, 'failed to clear session, sorry'); 53 + } 54 + window.location.replace(location.pathname); 55 + window.location.reload(); // backup, in case there is no query? 56 + }); 57 + })(); 58 + 59 + async function lookUp(fetch_key) { 60 + let info; 61 + try { 62 + const resp = await fetch('/user-info', { 63 + method: 'POST', 64 + headers: {'Content-Type': 'application/json'}, 65 + body: JSON.stringify({ fetch_key }), 66 + }); 67 + if (!resp.ok) throw resp; 68 + info = await resp.json(); 69 + } catch (e) { 70 + err(e, 'failed to resolve handle from DID') 71 + } 72 + return info.handle; 73 + } 74 + </script> 75 + {{else}} 76 + 77 + <p class="hello-connect-plz">Connect your handle</p> 78 + 79 + {{#if is_auth_reload}} 80 + {{#if no_cookie}} 81 + <p id="prompt" class="detail no"> 82 + No identity connected. Your browser may be blocking access for connecting. 83 + </p> 84 + {{else}} 85 + {{#if auth_failed}} 86 + <p id="prompt" class="detail no"> 87 + No identity connected. Connecting failed or was denied. 88 + </p> 89 + {{else}} 90 + <p id="prompt" class="detail no"> 91 + No identity connected. 92 + </p> 93 + {{/if}} 94 + {{/if}} 95 + {{/if}} 96 + 97 + <div id="user-info"> 98 + <form id="form-action" action="/auth" target="_blank" method="GET" class="action {{#if did}}hidden{{/if}}"> 99 + <label> 100 + @<input id="handle-input" class="handle" name="handle" placeholder="example.bsky.social" /> 101 + </label> 102 + <button id="connect" type="submit">connect</button> 103 + </form> 104 + </div> 105 + {{/if}} 106 + 107 + </div> 108 + <script> 109 + window.addEventListener('storage', e => { 110 + console.log('eyyy got storage', e); 111 + if (e.key !== 'who-am-i') return; 112 + if (!e.newValue) return; 113 + if (e.newValue.result === 'success') { 114 + window.location = '/?auth_reload=1'; 115 + } else { 116 + window.location = '/?auth_reload=1&auth_failed=1'; 117 + } 118 + }); 119 + </script> 120 + {{/inline}} 121 + 122 + {{#> base-full}}{{/base-full}}
+18
who-am-i/templates/prompt-error.hbs
··· 1 + {{#*inline "main"}} 2 + <div class="prompt-error"> 3 + <p class="went-wrong">Something went wrong :(</p> 4 + <p class="reason">{{ reason }}</p> 5 + <p class="reason detail">{{ detail }}</p> 6 + <p id="maybe-not-in-iframe" class="hidden"> 7 + Possibly related: this prompt is meant to be shown in an iframe, but it seems like it's not. 8 + </p> 9 + </div> 10 + 11 + <script> 12 + if ({{{json check_frame}}} && window.self === window.top) { 13 + document.getElementById('maybe-not-in-iframe').classList.remove('hidden'); 14 + } 15 + </script> 16 + {{/inline}} 17 + 18 + {{#> base-framed}}{{/base-framed}}
+187
who-am-i/templates/prompt.hbs
··· 1 + {{#*inline "main"}} 2 + <p> 3 + Connect in the ATmosphere 4 + </p> 5 + 6 + <p id="error-message" class="hidden"></p> 7 + 8 + <p id="prompt" class="detail"> 9 + <span class="parent-host">{{ parent_host }}</span> wants to confirm your handle 10 + </p> 11 + 12 + <div id="loader" {{#unless did}}class="hidden"{{/unless}}> 13 + <span class="spinner"></span> 14 + </div> 15 + 16 + <div id="user-info"> 17 + <form id="form-action" action="/auth" method="GET" target="_blank" class="action {{#if did}}hidden{{/if}}"> 18 + <label> 19 + @<input id="handle-input" class="handle" name="handle" placeholder="example.bsky.social" /> 20 + </label> 21 + <button id="connect" type="submit">connect</button> 22 + </form> 23 + 24 + <div id="handle-action" class="action"> 25 + <span id="handle-view" class="handle"></span> 26 + <button id="allow">Allow</button> 27 + </div> 28 + </div> 29 + 30 + <div id="need-storage" class="hidden"> 31 + <p class="problem">Sorry, your browser is blocking access.</p> 32 + <p> 33 + Try <a href="/" target="_blank">connecting directly</a> first (but no promises). 34 + Clicking <button id="desperation">this button</button> might also help. 35 + </p> 36 + </div> 37 + 38 + 39 + 40 + <script> 41 + const errorEl = document.getElementById('error-message'); 42 + const promptEl = document.getElementById('prompt'); 43 + const loaderEl = document.getElementById('loader'); 44 + const infoEl = document.getElementById('user-info'); 45 + const handleInputEl = document.getElementById('handle-input'); 46 + const handleViewEl = document.getElementById('handle-view'); 47 + const formEl = document.getElementById('form-action'); // for anon 48 + const allowEl = document.getElementById('handle-action'); // for known-did 49 + const connectEl = document.getElementById('connect'); // for anon 50 + const needStorageEl = document.getElementById('need-storage'); // for safari/frame isolation 51 + const desperationEl = document.getElementById('desperation'); 52 + 53 + function err(e, msg) { 54 + loaderEl.classList.add('hidden'); 55 + errorEl.classList.remove('hidden'); 56 + errorEl.textContent = msg || e; 57 + throw new Error(e); 58 + } 59 + 60 + // already-known user 61 + ({{{json did}}}) && (async () => { 62 + const handle = await lookUp({{{json fetch_key}}}); 63 + loaderEl.classList.add('hidden'); 64 + handleViewEl.textContent = `@${handle}`; 65 + allowEl.addEventListener('click', () => shareAllow(handle, {{{json token}}})); 66 + })(); 67 + 68 + // anon user 69 + formEl.onsubmit = e => { 70 + e.preventDefault(); 71 + loaderEl.classList.remove('hidden'); 72 + // TODO: include expected referer! (..this system is probably bad) 73 + // maybe a random localstorage key that we specifically listen for? 74 + const url = new URL('/auth', window.location); 75 + url.searchParams.set('handle', handleInputEl.value); 76 + window.open(url, '_blank'); 77 + }; 78 + 79 + // check if we may be partitioned, preventing access after auth completion 80 + // this should only happen if on a browser that implements storage access api 81 + if ('hasStorageAccess' in document) { 82 + document.hasStorageAccess().then((hasAccess) => { 83 + if (!hasAccess) { 84 + promptEl.classList.add('hidden'); 85 + infoEl.classList.add('hidden'); 86 + needStorageEl.classList.remove('hidden'); 87 + desperation.addEventListener('click', () => { 88 + document.requestStorageAccess({ 89 + cookies: true, 90 + localStorage: true, 91 + }).then( 92 + () => { 93 + desperation.textContent = "(maybe helped?)"; 94 + setTimeout(() => location.reload(), 350); 95 + }, 96 + () => desperation.textContent = "(doubtful)", 97 + ); 98 + }) 99 + } 100 + }); 101 + } 102 + 103 + window.addEventListener('storage', async e => { 104 + // here's a fun minor vuln: we can't tell which flow triggers the storage event. 105 + // so if you have two flows going, it grants for both (or the first responder?) if you grant for either. 106 + // (letting this slide while parent pages are allowlisted to microcosm only) 107 + 108 + if (e.key !== 'who-am-i') return; 109 + if (e.newValue === null) return; 110 + 111 + const details = e.newValue; 112 + if (!details) { 113 + console.error("hmm, heard from localstorage but did not get DID", details, e); 114 + err('sorry, something went wrong getting your details'); 115 + } 116 + 117 + let parsed; 118 + try { 119 + parsed = JSON.parse(details); 120 + } catch (e) { 121 + err(e, "something went wrong getting the details back"); 122 + } 123 + 124 + const fail = (e, msg) => { 125 + loaderEl.classList.add('hidden'); 126 + formEl.classList.remove('hidden'); 127 + handleInputEl.focus(); 128 + handleInputEl.select(); 129 + err(e, msg); 130 + } 131 + 132 + if (parsed.result === "fail") { 133 + fail(`uh oh: ${parsed.reason}`); 134 + } 135 + 136 + if (parsed.result === "deny") { 137 + fail(parsed.reason); 138 + } 139 + 140 + infoEl.classList.add('hidden'); 141 + 142 + const handle = await lookUp(parsed.fetch_key); 143 + 144 + shareAllow(handle, parsed.token); 145 + }); 146 + 147 + async function lookUp(fetch_key) { 148 + let info; 149 + try { 150 + const resp = await fetch('/user-info', { 151 + method: 'POST', 152 + headers: { 'Content-Type': 'application/json' }, 153 + body: JSON.stringify({ fetch_key }), 154 + }); 155 + if (!resp.ok) throw resp; 156 + info = await resp.json(); 157 + } catch (e) { 158 + err(e, `failed to resolve handle from DID with ${fetch_key}`); 159 + } 160 + return info.handle; 161 + } 162 + 163 + const parentTarget = {{{json parent_target}}} ?? {{{json parent_origin}}}; 164 + 165 + const shareAllow = (handle, token) => { 166 + try { 167 + top.postMessage( 168 + { action: "allow", handle, token }, 169 + parentTarget, 170 + ); 171 + } catch (e) { 172 + err(e, 'Identity verified but failed to connect with app'); 173 + }; 174 + promptEl.textContent = '✔️ shared'; 175 + } 176 + 177 + const shareDeny = reason => { 178 + top.postMessage( 179 + { action: "deny", reason }, 180 + parentTarget, 181 + ); 182 + } 183 + </script> 184 + 185 + {{/inline}} 186 + 187 + {{#> base-framed}}{{/base-framed}}