repoguard: resolve handle to did and compare that to parent directory

cmd/repoguard/main.go

···
 package main
 
 import (
+	"context"
 	"flag"
 	"fmt"
 	"log"
 	"os"
 	"os/exec"
+	"path"
 	"path/filepath"
 	"strings"
 	"time"
+
+	"github.com/icyphox/bild/routes/auth"
 )
 
 var (
···
 	}
 
 	gitCommand := cmdParts[0]
-	repoName := strings.Trim(cmdParts[1], "'")
+
+	// example.com/repo
+	handlePath := strings.Trim(cmdParts[1], "'")
+	repoName := handleToDID(handlePath)
 
 	validCommands := map[string]bool{
 		"git-receive-pack":   true,
···
 		exitWithLog("access denied: invalid git command")
 	}
 
-	if !isAllowedUser(*allowedUser, repoName) {
-		exitWithLog("access denied: user not allowed")
+	did := path.Dir(repoName)
+	if gitCommand != "git-upload-pack" {
+		if !isAllowedUser(*allowedUser, did) {
+			exitWithLog("access denied: user not allowed")
+		}
 	}
 
 	fullPath := filepath.Join(*baseDirFlag, repoName)
···
 	})
 }
 
+func handleToDID(handlePath string) string {
+	handle := path.Dir(handlePath)
+
+	ident, err := auth.ResolveIdent(context.Background(), handle)
+	if err != nil {
+		exitWithLog(fmt.Sprintf("error resolving handle: %v", err))
+	}
+
+	// did:plc:foobarbaz/repo
+	didPath := filepath.Join(ident.DID.String(), path.Base(handlePath))
+
+	return didPath
+}
+
 func initLogger() {
 	var err error
 	logFile, err = os.OpenFile(*logPathFlag, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0600)
···
 	}
 }
 
-func isAllowedUser(user, repoPath string) bool {
-	fullPath := filepath.Join(*baseDirFlag, repoPath)
-	didPath := filepath.Join(fullPath, "did")
-
-	didBytes, err := os.ReadFile(didPath)
-	if err != nil {
-		return false
-	}
-
-	allowedUser := strings.TrimSpace(string(didBytes))
-	return allowedUser == user
+func isAllowedUser(user, did string) bool {
+	return user == did
 }

routes/auth/auth.go

···
 	return &Auth{store}
 }
 
-func resolveIdent(ctx context.Context, arg string) (*identity.Identity, error) {
+func ResolveIdent(ctx context.Context, arg string) (*identity.Identity, error) {
 	id, err := syntax.ParseAtIdentifier(arg)
 	if err != nil {
 		return nil, err
···
 
 func (a *Auth) CreateInitialSession(w http.ResponseWriter, r *http.Request, username, appPassword string) (AtSessionCreate, error) {
 	ctx := r.Context()
-	resolved, err := resolveIdent(ctx, username)
+	resolved, err := ResolveIdent(ctx, username)
 	if err != nil {
 		return AtSessionCreate{}, fmt.Errorf("invalid handle: %s", err)
 	}
···
 		return nil, fmt.Errorf("user is not authenticated")
 	}
 
-	return resolveIdent(r.Context(), did)
+	return ResolveIdent(r.Context(), did)
 }