progress on client

atproto/client/admin_auth.go

···
 	Password string
 }
 
-func NewAdminAuth(password string) AdminAuth {
-	return AdminAuth{Password: password}
-}
-
 func (a *AdminAuth) DoWithAuth(c *http.Client, req *http.Request) (*http.Response, error) {
 	req.SetBasicAuth("admin", a.Password)
 	return c.Do(req)
 }
+
+func NewAdminClient(host, password string) *APIClient {
+	c := NewPublicClient(host)
+	c.Auth = &AdminAuth{Password: password}
+	return c
+}

atproto/client/api_client.go

···
 
 type APIClient struct {
 	// inner HTTP client
-	Client         *http.Client
+	Client *http.Client
 
 	// host URL prefix: scheme, hostname, and port. This field is required.
-	Host           string
+	Host string
 
 	// optional auth client "middleware"
-	Auth           AuthMethod
+	Auth AuthMethod
 
 	// optional HTTP headers which will be included in all requests. Only a single value per key is included; request-level headers will override any client-level defaults.
-	DefaultHeaders http.Header
+	Headers http.Header
+
+	// optional authenticated account DID for this client. Does not change client behavior; this is included as a convenience for calling code, logging, etc.
+	AccountDID *syntax.DID
+}
+
+func NewPublicClient(host string) *APIClient {
+	return &APIClient{
+		Client: http.DefaultClient,
+		Host:   host,
+		Headers: map[string][]string{
+			"User-Agent": []string{"indigo-sdk"},
+		},
+	}
 }
 
 // High-level helper for simple JSON "Query" API calls.
···
 //
 // NOTE: this does not currently parse error response JSON body, thought it might in the future.
 func (c *APIClient) Do(ctx context.Context, req APIRequest) (*http.Response, error) {
-	httpReq, err := req.HTTPRequest(ctx, c.Host, c.DefaultHeaders)
+	httpReq, err := req.HTTPRequest(ctx, c.Host, c.Headers)
 	if err != nil {
 		return nil, err
 	}
···
 	return resp, nil
 }
 
-func NewPublicClient(host string) *APIClient {
-	return &APIClient{
-		Client: http.DefaultClient,
-		Host: host,
-		DefaultHeaders: map[string][]string{
-			"User-Agent": []string{"indigo-sdk"},
-		},
+// Returns a shallow copy of the APIClient with the provided service ref configured as a proxy header.
+//
+// To configure service proxying without creating a copy, simply set the "Atproto-Proxy" header.
+func (c *APIClient) WithService(ref string) *APIClient {
+	hdr := make(http.Header)
+	for k := range c.Headers {
+		for _, v := range c.Headers.Values(k) {
+			hdr.Add(k, v)
+		}
 	}
+
+	hdr.Set("Atproto-Proxy", ref)
+	out := APIClient{
+		Client:     c.Client,
+		Host:       c.Host,
+		Auth:       c.Auth,
+		Headers:    hdr,
+		AccountDID: c.AccountDID,
+	}
+	return &out
+}
+
+// Configures labeler header (Atproto-Accept-Labelers) with the indicated "redact" level labelers, and regular labelers.
+func (c *APIClient) SetLabelers(redact, other []syntax.DID) {
+	val := ""
+	for _, did := range redact {
+		if val != "" {
+			val = val + ","
+		}
+		val = fmt.Sprintf("%s%s;redact", val, did.String())
+	}
+	for _, did := range other {
+		if val != "" {
+			val = val + ","
+		}
+		val = val + did.String()
+	}
+	c.Headers.Set("Atproto-Accept-Labelers", val)
 }

atproto/client/api_request.go

···
 
 import (
 	"context"
-	"io"
 	"fmt"
+	"io"
 	"net/http"
 	"net/url"
 
···
 
 type APIRequest struct {
 	// HTTP method, eg "GET" (required)
-	Method      string
+	Method string
 
 	// atproto API endpoint, as NSID (required)
-	Endpoint    syntax.NSID
+	Endpoint syntax.NSID
 
 	// optional request body. if this is provided, then 'Content-Type' header should be specified
-	Body        io.Reader
+	Body io.Reader
+
+	// XXX:
+	//GetBody func() (io.ReadCloser, error)
 
 	// optional query parameters. These will be encoded as provided.
 	QueryParams url.Values
 
 	// optional HTTP headers. Only the first value will be included for each header key ("Set" behavior).
-	Headers     http.Header
+	Headers http.Header
 }
 
 // Turns the API request in to an `http.Request`.
···
 		return nil, fmt.Errorf("empty request endpoint")
 	}
 	u.Path = "/xrpc/" + r.Endpoint.String()
-	u.RawQuery = nil
+	u.RawQuery = ""
 	if r.QueryParams != nil {
 		u.RawQuery = r.QueryParams.Encode()
 	}
···
 	// ... then request-specific take priority (overwrite)
 	if r.Headers != nil {
 		for k := range r.Headers {
-			httpReq.Header.Set(k, headers.Get(k))
+			httpReq.Header.Set(k, r.Headers.Get(k))
 		}
 	}
 

atproto/client/cmd/atclient/main.go

···
 		Usage: "dev helper for atproto/client SDK",
 		Commands: []*cli.Command{
 			&cli.Command{
-				Name:   "get",
-				Usage:  "do a basic GET request",
-				Action: runGet,
+				Name:   "get-feed-public",
+				Usage:  "do a basic GET request (getAuthorFeed)",
+				Action: runGetFeedPublic,
+				Flags: []cli.Flag{
+					&cli.StringFlag{
+						Name:  "host",
+						Value: "https://public.api.bsky.app",
+						Usage: "service host",
+					},
+				},
 			},
 			&cli.Command{
-				Name:   "login-refresh",
-				Usage:  "do a basic login and GET request",
-				Action: runLoginRefresh,
+				Name:   "login-auth",
+				Usage:  "do a basic login and GET session info",
+				Action: runLoginAuth,
 				Flags: []cli.Flag{
 					&cli.StringFlag{
 						Name:     "username",
···
 					},
 				},
 			},
+			&cli.Command{
+				Name:   "get-feed-auth",
+				Usage:  "basic authenticated GET request",
+				Action: runGetFeedAuth,
+				Flags: []cli.Flag{
+					&cli.StringFlag{
+						Name:     "username",
+						Required: true,
+						Aliases:  []string{"u"},
+						Usage:    "handle or DID (not email)",
+					},
+					&cli.StringFlag{
+						Name:     "password",
+						Required: true,
+						Aliases:  []string{"p"},
+						Usage:    "password (or app password)",
+					},
+					&cli.StringFlag{
+						Name: "labelers",
+					},
+					&cli.StringFlag{
+						Name:  "appview",
+						Value: "did:web:api.bsky.app#bsky_appview",
+						Usage: "bsky appview service DID ref",
+					},
+				},
+			},
+			&cli.Command{
+				Name:   "lookup-admin",
+				Usage:  "basic PDS admin auth request (getAccountInfo)",
+				Action: runLookupAdmin,
+				Flags: []cli.Flag{
+					&cli.StringFlag{
+						Name:     "admin-password",
+						Required: true,
+						Aliases:  []string{"p"},
+						Usage:    "admin auth password",
+					},
+					&cli.StringFlag{
+						Name:     "host",
+						Required: true,
+						Usage:    "service host",
+					},
+					&cli.StringFlag{
+						Name:     "did",
+						Required: true,
+						Usage:    "account DID to lookup",
+					},
+				},
+			},
 		},
 	}
 	h := slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{Level: slog.LevelDebug})
···
 }
 
 func simpleGet(ctx context.Context, c *client.APIClient) error {
-	params := map[string]string{
-		"actor":       "atproto.com",
-		"limit":       "5",
-		"includePins": "false",
+	params := map[string][]string{
+		"actor":       []string{"atproto.com"},
+		"limit":       []string{"2"},
+		"includePins": []string{"false"},
 	}
 
 	var d json.RawMessage
···
 	return nil
 }
 
-func runGet(cctx *cli.Context) error {
-	ctx := context.Background()
+func runGetFeedPublic(cctx *cli.Context) error {
+	ctx := cctx.Context
 
 	c := client.APIClient{
-		Host: "https://public.api.bsky.app",
+		Host: cctx.String("host"),
 	}
 
 	return simpleGet(ctx, &c)
 }
 
-func runLoginRefresh(cctx *cli.Context) error {
-	ctx := context.Background()
+func runLoginAuth(cctx *cli.Context) error {
+	ctx := cctx.Context
 
 	atid, err := syntax.ParseAtIdentifier(cctx.String("username"))
 	if err != nil {
···
 	}
 
 	dir := identity.DefaultDirectory()
-	ident, err := dir.Lookup(ctx, *atid)
+
+	c, err := client.LoginWithPassword(ctx, dir, *atid, cctx.String("password"), "")
 	if err != nil {
 		return err
 	}
 
-	c := client.APIClient{
-		Host: ident.PDSEndpoint(),
+	var d json.RawMessage
+	err = c.Get(ctx, "com.atproto.server.getSession", nil, &d)
+	if err != nil {
+		return err
 	}
 
-	_, err = client.NewSession(ctx, &c, atid.String(), cctx.String("password"), "")
+	out, err := json.MarshalIndent(d, "", "  ")
 	if err != nil {
 		return err
 	}
+	fmt.Println(string(out))
+	return nil
+}
 
-	return simpleGet(ctx, &c)
+func runGetFeedAuth(cctx *cli.Context) error {
+	ctx := cctx.Context
+
+	atid, err := syntax.ParseAtIdentifier(cctx.String("username"))
+	if err != nil {
+		return err
+	}
+
+	dir := identity.DefaultDirectory()
+
+	c, err := client.LoginWithPassword(ctx, dir, *atid, cctx.String("password"), "")
+	if err != nil {
+		return err
+	}
+	c = c.WithService(cctx.String("appview"))
+
+	return simpleGet(ctx, c)
+}
+
+func runLookupAdmin(cctx *cli.Context) error {
+	ctx := cctx.Context
+
+	c := client.NewAdminClient(cctx.String("host"), cctx.String("admin-password"))
+
+	var d json.RawMessage
+	params := map[string][]string{
+		"did": []string{cctx.String("did")},
+	}
+	if err := c.Get(ctx, "com.atproto.admin.getAccountInfo", params, &d); err != nil {
+		return err
+	}
+
+	out, err := json.MarshalIndent(d, "", "  ")
+	if err != nil {
+		return err
+	}
+	fmt.Println(string(out))
+	return nil
 }

atproto/client/password_auth.go

···
+package client
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+	"sync"
+
+	comatproto "github.com/bluesky-social/indigo/api/atproto"
+	"github.com/bluesky-social/indigo/atproto/identity"
+	"github.com/bluesky-social/indigo/atproto/syntax"
+)
+
+type PasswordAuth struct {
+	Session SessionData
+	// TODO: RefreshCallback
+
+	lk sync.Mutex
+}
+
+type SessionData struct {
+	AccessToken  string
+	RefreshToken string
+	AccountDID   syntax.DID
+	Host         string
+}
+
+func (a *PasswordAuth) DoWithAuth(c *http.Client, req *http.Request) (*http.Response, error) {
+	req.Header.Set("Authorization", "Bearer "+a.Session.AccessToken)
+	resp, err := c.Do(req)
+	if err != nil {
+		return nil, err
+	}
+
+	// on success, or most errors, just return HTTP response
+	if resp.StatusCode != 400 || !strings.HasPrefix(resp.Header.Get("Content-Type"), "application/json") {
+		return resp, nil
+	}
+
+	// parse the error response body (JSON) and check the error name
+	defer resp.Body.Close()
+	var eb ErrorBody
+	if err := json.NewDecoder(resp.Body).Decode(&eb); err != nil {
+		return nil, &APIError{StatusCode: resp.StatusCode}
+	}
+	if eb.Name != "ExpiredToken" {
+		return nil, eb.APIError(resp.StatusCode)
+	}
+
+	// ok, we had an expired token, try a refresh
+	if err := a.Refresh(req.Context(), c); err != nil {
+		return nil, err
+	}
+
+	// XXX: review "retry" logic (HTTP body, headers, etc)
+	req.Header.Set("Authorization", "Bearer "+a.Session.AccessToken)
+	resp, err = c.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	// XXX: handle auth error here?
+	return resp, err
+}
+
+// TODO: need a "Logout" method as well? which takes the refresh token (not access token)
+func (a *PasswordAuth) Refresh(ctx context.Context, c *http.Client) error {
+
+	prior := a.Session.RefreshToken
+
+	a.lk.Lock()
+	defer a.lk.Unlock()
+
+	// XXX: basic concurrency check: if refresh token already changed, can bail here. should probably handle this better (accept refresh token as input?)
+	if prior != a.Session.RefreshToken {
+		return nil
+	}
+
+	u := a.Session.Host + "/xrpc/com.atproto.server.refreshSession"
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, u, nil)
+	if err != nil {
+		return err
+	}
+	// TODO: this doesn't inherit User-Agent header
+	req.Header.Set("User-Agent", "indigo-sdk")
+
+	// NOTE: using refresh token here, not access token
+	req.Header.Set("Authorization", "Bearer "+a.Session.RefreshToken)
+
+	resp, err := c.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	if !(resp.StatusCode >= 200 && resp.StatusCode < 300) {
+		var eb ErrorBody
+		if err := json.NewDecoder(resp.Body).Decode(&eb); err != nil {
+			return &APIError{StatusCode: resp.StatusCode}
+		}
+		// TODO: indicate in this error that it was from refresh process, not original request?
+		return eb.APIError(resp.StatusCode)
+	}
+
+	var out comatproto.ServerRefreshSession_Output
+	if err := json.NewDecoder(resp.Body).Decode(&out); err != nil {
+		return err
+	}
+
+	a.Session.AccessToken = out.AccessJwt
+	a.Session.RefreshToken = out.RefreshJwt
+	// TODO: callback?
+
+	return nil
+}
+
+func LoginWithPassword(ctx context.Context, dir identity.Directory, username syntax.AtIdentifier, password, authToken string) (*APIClient, error) {
+
+	ident, err := dir.Lookup(ctx, username)
+	if err != nil {
+		return nil, err
+	}
+
+	host := ident.PDSEndpoint()
+	if host == "" {
+		return nil, fmt.Errorf("account does not have PDS registered")
+	}
+
+	c := NewPublicClient(host)
+	reqBody := comatproto.ServerCreateSession_Input{
+		Identifier: ident.DID.String(),
+		Password:   password,
+	}
+	if authToken != "" {
+		reqBody.AuthFactorToken = &authToken
+	}
+
+	// TODO: copy/vendor in session objects
+	var out comatproto.ServerCreateSession_Output
+	if err := c.Post(ctx, syntax.NSID("com.atproto.server.createSession"), &reqBody, &out); err != nil {
+		return nil, err
+	}
+
+	if out.Active != nil && *out.Active == false {
+		return nil, fmt.Errorf("account is disabled: %v", out.Status)
+	}
+
+	if out.Did != ident.DID.String() {
+		return nil, fmt.Errorf("returned session DID not requested account: %s", out.Did)
+	}
+
+	ra := PasswordAuth{
+		Session: SessionData{
+			AccessToken:  out.AccessJwt,
+			RefreshToken: out.RefreshJwt,
+			AccountDID:   ident.DID,
+			Host:         c.Host,
+		},
+	}
+	c.Auth = &ra
+	c.AccountDID = &ident.DID
+	return c, nil
+}

atproto/client/refresh_auth.go

···
-package client
-
-import (
-	"context"
-	"fmt"
-	"net/http"
-	"sync"
-
-	comatproto "github.com/bluesky-social/indigo/api/atproto"
-
-	"github.com/bluesky-social/indigo/atproto/syntax"
-)
-
-type RefreshAuth struct {
-	AccessToken  string
-	RefreshToken string
-	DID          syntax.DID
-	// The AuthHost might different from any APIClient host, if there is an entryway involved
-	AuthHost string
-
-	lk sync.Mutex
-}
-
-// TODO:
-//func NewRefreshAuth(pdsHost, accountIdentifier, password string) (*RefreshAuth, error) {
-
-func (a *RefreshAuth) DoWithAuth(c *http.Client, req *http.Request) (*http.Response, error) {
-	req.Header.Set("Authorization", "Bearer "+a.AccessToken)
-	// XXX: check response. if it is 403, because access token is expired, then take a lock and do a refresh
-	// TODO: when doing a refresh request, copy at least the User-Agent header from httpReq, and re-use httpClient
-	return c.Do(req)
-}
-
-// updates the client with the new auth method
-func NewSession(ctx context.Context, client *APIClient, username, password, token string) (*RefreshAuth, error) {
-
-	reqBody := comatproto.ServerCreateSession_Input{
-		Identifier: username,
-		Password:   password,
-	}
-	if token != "" {
-		reqBody.AuthFactorToken = &token
-	}
-
-	var out comatproto.ServerCreateSession_Output
-	err := client.Post(ctx, syntax.NSID("com.atproto.server.createSession"), &reqBody, &out)
-	if err != nil {
-		return nil, err
-	}
-
-	if out.Active != nil && *out.Active == false {
-		return nil, fmt.Errorf("account is disabled: %v", out.Status)
-	}
-
-	ra := RefreshAuth{
-		AccessToken:  out.AccessJwt,
-		RefreshToken: out.RefreshJwt,
-		DID:          syntax.DID(out.Did),
-		// TODO: authHost / PDS host distinction
-		AuthHost: client.Host,
-	}
-	client.Auth = &ra
-	return &ra, nil
-}