feature: dns resolver cleanup and hickory-dns feature flag

Signed-off-by: Nick Gerakines <[e-mail]>

crates/atproto-client/Cargo.toml

···
 secrecy = { workspace = true, optional = true }
 
 [features]
+default = ["hickory-dns"]
 clap = ["dep:clap", "dep:rpassword", "dep:secrecy"]
+hickory-dns = ["atproto-identity/hickory-dns", "atproto-oauth/hickory-dns"]
 
 [lints]
 workspace = true

crates/atproto-client/src/bin/atproto-client-app-password.rs

···
 use atproto_identity::{
     config::{CertificateBundles, DnsNameservers, default_env, optional_env, version},
     plc,
-    resolve::{create_resolver, resolve_subject},
+    resolve::{HickoryDnsResolver, resolve_subject},
     web,
 };
 use clap::Parser;
···
     client_builder = client_builder.user_agent(user_agent);
     let http_client = client_builder.build()?;
 
-    let dns_resolver = create_resolver(dns_nameservers.as_ref());
+    let dns_resolver = HickoryDnsResolver::create_resolver(dns_nameservers.as_ref());
 
     println!("Resolving subject: {}", subject);
 

crates/atproto-client/src/bin/atproto-client-auth.rs

···
 use atproto_identity::{
     config::{CertificateBundles, DnsNameservers, default_env, optional_env, version},
     plc,
-    resolve::{create_resolver, resolve_subject},
+    resolve::{HickoryDnsResolver, resolve_subject},
     web,
 };
 use clap::{Parser, Subcommand};
···
     client_builder = client_builder.user_agent(user_agent);
     let http_client = client_builder.build()?;
 
-    let dns_resolver = create_resolver(dns_nameservers.as_ref());
+    let dns_resolver = HickoryDnsResolver::create_resolver(dns_nameservers.as_ref());
 
     match args.command {
         Commands::Login {

crates/atproto-client/src/bin/atproto-client-dpop.rs

···
     config::{CertificateBundles, DnsNameservers, default_env, optional_env, version},
     key::identify_key,
     plc,
-    resolve::{create_resolver, resolve_subject},
+    resolve::{HickoryDnsResolver, resolve_subject},
     web,
 };
 use clap::Parser;
···
     client_builder = client_builder.user_agent(user_agent);
     let http_client = client_builder.build()?;
 
-    let dns_resolver = create_resolver(dns_nameservers.as_ref());
+    let dns_resolver = HickoryDnsResolver::create_resolver(dns_nameservers.as_ref());
 
     println!("Resolving subject: {}", subject);
 

crates/atproto-identity/Cargo.toml

···
 test = false
 bench = false
 doc = true
-required-features = ["clap"]
+required-features = ["clap", "hickory-dns"]
 
 [[bin]]
 name = "atproto-identity-sign"
···
 [dependencies]
 anyhow.workspace = true
 ecdsa.workspace = true
-hickory-resolver.workspace = true
+hickory-resolver = { workspace = true, optional = true }
 k256 = { workspace = true, features = ["jwk"] }
 multibase.workspace = true
 p256 = { workspace = true, features = ["jwk"] }
···
 zeroize = { workspace = true, optional = true }
 
 [features]
-default = ["lru", "axum"]
+default = ["lru", "axum", "hickory-dns"]
 lru = ["dep:lru"]
 axum = ["dep:axum", "dep:http"]
 clap = ["dep:clap"]
 zeroize = ["dep:zeroize"]
+hickory-dns = ["dep:hickory-resolver"]
 
 [lints]
 workspace = true

crates/atproto-identity/src/bin/atproto-identity-resolve.rs

···
 use atproto_identity::{
     config::{CertificateBundles, DnsNameservers, default_env, optional_env, version},
     plc::query as plc_query,
-    resolve::{InputType, create_resolver, parse_input, resolve_subject},
+    resolve::{InputType, HickoryDnsResolver, parse_input, resolve_subject},
     web::query as web_query,
 };
 use clap::Parser;
···
     client_builder = client_builder.user_agent(user_agent);
     let http_client = client_builder.build()?;
 
-    let dns_resolver = create_resolver(dns_nameservers.as_ref());
+    let dns_resolver = HickoryDnsResolver::create_resolver(dns_nameservers.as_ref());
 
     for subject in args.subjects {
         let resolved_did = resolve_subject(&http_client, &dns_resolver, &subject).await;

crates/atproto-identity/src/errors.rs

···
     ConflictingDIDsFound,
 
     /// Occurs when DNS TXT record lookup fails
+    #[cfg(feature = "hickory-dns")]
     #[error("error-atproto-identity-resolve-4 DNS resolution failed: {error:?}")]
     DNSResolutionFailed {
         /// The underlying DNS resolution error
         error: hickory_resolver::ResolveError,
     },
+
+    /// Occurs when DNS TXT record lookup fails (generic version for when hickory-dns is not enabled)
+    #[cfg(not(feature = "hickory-dns"))]
+    #[error("error-atproto-identity-resolve-4 DNS resolution failed")]
+    DNSResolutionFailed,
 
     /// Occurs when HTTP request to .well-known/atproto-did endpoint fails
     #[error("error-atproto-identity-resolve-5 HTTP resolution failed: {error:?}")]

crates/atproto-identity/src/resolve.rs

···
 //! 4. For DIDs: return the identifier directly
 
 use anyhow::Result;
+#[cfg(feature = "hickory-dns")]
 use hickory_resolver::{
     Resolver, TokioResolver,
     config::{NameServerConfigGroup, ResolverConfig},
···
 use crate::validation::{is_valid_did_method_plc, is_valid_handle};
 use crate::web::query as web_query;
 
+/// Trait for DNS resolution operations.
+/// Provides async DNS TXT record lookups for handle resolution.
+#[async_trait::async_trait]
+pub trait DnsResolver: Send + Sync {
+    /// Resolves TXT records for a given domain name.
+    /// Returns a vector of strings representing the TXT record values.
+    async fn resolve_txt(&self, domain: &str) -> Result<Vec<String>, ResolveError>;
+}
+
+/// Hickory DNS implementation of the DnsResolver trait.
+/// Wraps hickory_resolver::TokioResolver for TXT record resolution.
+#[cfg(feature = "hickory-dns")]
+#[derive(Clone)]
+pub struct HickoryDnsResolver {
+    resolver: TokioResolver,
+}
+
+#[cfg(feature = "hickory-dns")]
+impl HickoryDnsResolver {
+    /// Creates a new HickoryDnsResolver with the given TokioResolver.
+    pub fn new(resolver: TokioResolver) -> Self {
+        Self { resolver }
+    }
+
+    /// Creates a DNS resolver with custom or system nameservers.
+    /// Uses custom nameservers if provided, otherwise system defaults.
+    pub fn create_resolver(nameservers: &[std::net::IpAddr]) -> Self {
+        // Initialize the DNS resolver with custom nameservers if configured
+        let tokio_resolver = if !nameservers.is_empty() {
+            tracing::debug!("Using custom DNS nameservers: {:?}", nameservers);
+            let nameserver_group = NameServerConfigGroup::from_ips_clear(nameservers, 53, true);
+            let resolver_config = ResolverConfig::from_parts(None, vec![], nameserver_group);
+            Resolver::builder_with_config(resolver_config, TokioConnectionProvider::default()).build()
+        } else {
+            tracing::debug!("Using system default DNS nameservers");
+            Resolver::builder_tokio().unwrap().build()
+        };
+        Self::new(tokio_resolver)
+    }
+}
+
+#[cfg(feature = "hickory-dns")]
+#[async_trait::async_trait]
+impl DnsResolver for HickoryDnsResolver {
+    async fn resolve_txt(&self, domain: &str) -> Result<Vec<String>, ResolveError> {
+        let lookup = self.resolver
+            .txt_lookup(domain)
+            .instrument(tracing::info_span!("txt_lookup"))
+            .await
+            .map_err(|error| ResolveError::DNSResolutionFailed { error })?;
+
+        Ok(lookup
+            .iter()
+            .map(|record| record.to_string())
+            .collect())
+    }
+}
+
 /// Type of input identifier for resolution.
 /// Distinguishes between handles and different DID methods.
 pub enum InputType {
···
 /// Resolves a handle to DID using DNS TXT records.
 /// Looks up _atproto.{handle} TXT record for DID value.
 #[instrument(skip(dns_resolver), err)]
-pub async fn resolve_handle_dns(
-    dns_resolver: &TokioResolver,
+pub async fn resolve_handle_dns<R: DnsResolver + ?Sized>(
+    dns_resolver: &R,
     lookup_dns: &str,
 ) -> Result<String, ResolveError> {
-    let lookup = dns_resolver
-        .txt_lookup(&format!("_atproto.{}", lookup_dns))
-        .instrument(tracing::info_span!("txt_lookup"))
-        .await
-        .map_err(|error| ResolveError::DNSResolutionFailed { error })?;
+    let txt_records = dns_resolver
+        .resolve_txt(&format!("_atproto.{}", lookup_dns))
+        .await?;
 
-    let dids = lookup
+    let dids = txt_records
         .iter()
         .filter_map(|record| {
             record
-                .to_string()
                 .strip_prefix("did=")
                 .map(|did| did.to_string())
         })
···
 /// Resolves a handle to DID using both DNS and HTTP methods.
 /// Returns DID if both methods agree, or error if conflicting.
 #[instrument(skip(http_client, dns_resolver), err)]
-pub async fn resolve_handle(
+pub async fn resolve_handle<R: DnsResolver + ?Sized>(
     http_client: &reqwest::Client,
-    dns_resolver: &TokioResolver,
+    dns_resolver: &R,
     handle: &str,
 ) -> Result<String, ResolveError> {
     let trimmed = {
···
 /// Resolves any subject (handle or DID) to a canonical DID.
 /// Handles all supported identifier formats automatically.
 #[instrument(skip(http_client, dns_resolver), err)]
-pub async fn resolve_subject(
+pub async fn resolve_subject<R: DnsResolver + ?Sized>(
     http_client: &reqwest::Client,
-    dns_resolver: &TokioResolver,
+    dns_resolver: &R,
     subject: &str,
 ) -> Result<String, ResolveError> {
     match parse_input(subject)? {
···
     }
 }
 
-/// Creates a DNS resolver with custom or system nameservers.
-/// Uses custom nameservers if provided, otherwise system defaults.
-pub fn create_resolver(nameservers: &[std::net::IpAddr]) -> TokioResolver {
-    // Initialize the DNS resolver with custom nameservers if configured
-    if !nameservers.is_empty() {
-        tracing::debug!("Using custom DNS nameservers: {:?}", nameservers);
-        let nameserver_group = NameServerConfigGroup::from_ips_clear(nameservers, 53, true);
-        let resolver_config = ResolverConfig::from_parts(None, vec![], nameserver_group);
-        Resolver::builder_with_config(resolver_config, TokioConnectionProvider::default()).build()
-    } else {
-        tracing::debug!("Using system default DNS nameservers");
-        Resolver::builder_tokio().unwrap().build()
-    }
-}
 
 /// Core identity resolution components for AT Protocol subjects.
 ///
···
 /// handles and DIDs to their corresponding DID documents.
 pub struct InnerIdentityResolver {
     /// DNS resolver for handle-to-DID resolution via TXT records.
-    pub dns_resolver: TokioResolver,
+    pub dns_resolver: Box<dyn DnsResolver>,
     /// HTTP client for DID document retrieval and well-known endpoint queries.
     pub http_client: Client,
     /// Hostname of the PLC directory server for `did:plc` resolution.
···
     /// Takes a handle or DID, resolves it to a canonical DID, then retrieves
     /// the corresponding DID document from the appropriate source (PLC directory or web).
     pub async fn resolve(&self, subject: &str) -> Result<Document> {
-        let resolved_did = resolve_subject(&self.http_client, &self.dns_resolver, subject).await?;
+        let resolved_did = resolve_subject(&self.http_client, &*self.dns_resolver, subject).await?;
 
         match parse_input(&resolved_did) {
             Ok(InputType::Plc(did)) => plc_query(&self.http_client, &self.plc_hostname, &did)

crates/atproto-jetstream/Cargo.toml

···
 clap = { workspace = true, optional = true }
 
 [features]
+default = ["hickory-dns"]
 clap = ["dep:clap"]
+hickory-dns = ["atproto-identity/hickory-dns"]
 
 [lints]
 workspace = true

crates/atproto-oauth-aip/Cargo.toml

···
 zeroize = { workspace = true, optional = true }
 
 [features]
+default = ["hickory-dns"]
 zeroize = ["dep:zeroize", "atproto-oauth/zeroize"]
+hickory-dns = ["atproto-oauth/hickory-dns"]
 
 [lints]
 workspace = true

crates/atproto-oauth-axum/Cargo.toml

···
 zeroize = { workspace = true, optional = true }
 
 [features]
+default = ["hickory-dns"]
 clap = ["dep:clap", "dep:rpassword", "dep:secrecy"]
 zeroize = ["dep:zeroize", "atproto-identity/zeroize", "atproto-oauth/zeroize"]
+hickory-dns = ["atproto-identity/hickory-dns", "atproto-oauth/hickory-dns"]
 
 [lints]
 workspace = true

crates/atproto-oauth-axum/src/bin/atproto-oauth-tool.rs

···
     config::{CertificateBundles, DnsNameservers, default_env, optional_env, require_env, version},
     key::{KeyData, KeyProvider, KeyType, generate_key, identify_key, to_public},
     plc,
-    resolve::{create_resolver, resolve_subject},
+    resolve::{resolve_subject},
     storage::DidDocumentStorage,
     storage_lru::LruDidDocumentStorage,
     web,
 };
+
+#[cfg(feature = "hickory-dns")]
+use atproto_identity::resolve::HickoryDnsResolver;
 use atproto_oauth::{
     pkce,
     resources::pds_resources,
···
 use axum::{Router, extract::FromRef, routing::get};
 use chrono::{Duration, Utc};
 use clap::{Parser, Subcommand};
-use hickory_resolver::TokioResolver;
 use rand::distributions::{Alphanumeric, DistString};
 use rpassword::read_password;
 use secrecy::{ExposeSecret, SecretString};
···
 
 pub struct InnerWebContext {
     pub http_client: reqwest::Client,
-    pub dns_resolver: TokioResolver,
+    #[cfg(feature = "hickory-dns")]
+    pub dns_resolver: HickoryDnsResolver,
+    #[cfg(not(feature = "hickory-dns"))]
+    pub dns_resolver: Box<dyn atproto_identity::resolve::DnsResolver>,
     pub oauth_client_config: OAuthClientConfig,
     pub oauth_storage: Arc<dyn OAuthRequestStorage + Send + Sync>,
     pub document_storage: Arc<dyn DidDocumentStorage + Send + Sync>,
···
     client_builder = client_builder.user_agent(user_agent);
     let http_client = client_builder.build()?;
 
-    let dns_resolver = create_resolver(dns_nameservers.as_ref());
+    let dns_resolver = HickoryDnsResolver::create_resolver(dns_nameservers.as_ref());
 
     let external_base = require_env("EXTERNAL_BASE")?;
     let port = default_env("PORT", "8080");
···
 #[allow(clippy::too_many_arguments)]
 async fn handle_login_command(
     http_client: &reqwest::Client,
-    dns_resolver: &TokioResolver,
+    #[cfg(feature = "hickory-dns")]
+    dns_resolver: &HickoryDnsResolver,
+    #[cfg(not(feature = "hickory-dns"))]
+    dns_resolver: &dyn atproto_identity::resolve::DnsResolver,
     private_signing_key: &str,
     subject: &str,
     external_base: &str,
···
         http_client,
         &oauth_client,
         &dpop_key,
-        subject,
+        Some(subject),
         &authorization_server,
         &oauth_request_state,
     )
···
 #[allow(clippy::too_many_arguments)]
 async fn handle_refresh_command(
     http_client: &reqwest::Client,
-    dns_resolver: &TokioResolver,
+    #[cfg(feature = "hickory-dns")]
+    dns_resolver: &HickoryDnsResolver,
+    #[cfg(not(feature = "hickory-dns"))]
+    dns_resolver: &dyn atproto_identity::resolve::DnsResolver,
     private_signing_key: &str,
     subject: &str,
     external_base: &str,

crates/atproto-oauth/Cargo.toml

···
 zeroize = { workspace = true, optional = true }
 
 [features]
-default = ["lru", "axum"]
+default = ["lru", "axum", "hickory-dns"]
 lru = ["dep:lru"]
 axum = ["dep:axum", "dep:http"]
 zeroize = ["dep:zeroize", "atproto-identity/zeroize"]
+hickory-dns = ["atproto-identity/hickory-dns"]
 
 [lints]
 workspace = true

crates/atproto-record/Cargo.toml

···
 clap = { workspace = true, optional = true }
 
 [features]
+default = ["hickory-dns"]
 clap = ["dep:clap"]
+hickory-dns = ["atproto-identity/hickory-dns"]
 
 [lints]
 workspace = true

crates/atproto-xrpcs-helloworld/Cargo.toml

···
 clap = { workspace = true, optional = true }
 
 [features]
+default = ["hickory-dns"]
 clap = ["dep:clap"]
+hickory-dns = ["atproto-identity/hickory-dns", "atproto-oauth/hickory-dns", "atproto-xrpcs/hickory-dns"]
 
 [lints]
 workspace = true

crates/atproto-xrpcs-helloworld/src/main.rs

···
     axum::state::DidDocumentStorageExtractor,
     config::{CertificateBundles, DnsNameservers, default_env, optional_env, require_env, version},
     key::{KeyData, KeyProvider, identify_key, to_public},
-    resolve::{IdentityResolver, InnerIdentityResolver, create_resolver},
+    resolve::{IdentityResolver, InnerIdentityResolver, HickoryDnsResolver},
     storage::DidDocumentStorage,
     storage_lru::LruDidDocumentStorage,
 };
···
     client_builder = client_builder.user_agent(user_agent);
     let http_client = client_builder.build()?;
 
-    let dns_resolver = create_resolver(dns_nameservers.as_ref());
+    let dns_resolver = HickoryDnsResolver::create_resolver(dns_nameservers.as_ref());
 
     let external_base = require_env("EXTERNAL_BASE")?;
     let port = default_env("PORT", "8080");
···
     let service_did = ServiceDID(service_did);
 
     let identity_resolver = IdentityResolver(Arc::new(InnerIdentityResolver {
-        dns_resolver,
+        dns_resolver: Box::new(dns_resolver),
         http_client: http_client.clone(),
         plc_hostname,
     }));

crates/atproto-xrpcs/Cargo.toml

···
 axum = { version = "0.8", features = ["macros"] }
 http = "1.0.0"
 
+[features]
+default = ["hickory-dns"]
+hickory-dns = ["atproto-identity/hickory-dns", "atproto-oauth/hickory-dns"]
+
 [lints]
 workspace = true