commit 5daaf9e43909901af87d17ec4588f0ec8e67437c · bretton.dev/coves

+35 -18

cmd/server/main.go

···

       4
       4
        
       	"Coves/internal/api/handlers/oauth"

     

       5
       5
        
       	"Coves/internal/api/middleware"

     

       6
       6
        
       	"Coves/internal/api/routes"

     

       7
       7
       -
       	"Coves/internal/atproto/did"

     

       8
       7
        
       	"Coves/internal/atproto/identity"

     

       9
       8
        
       	"Coves/internal/atproto/jetstream"

     

       10
       9
        
       	"Coves/internal/core/communities"

     
···

       83
       82
        
       	r.Use(rateLimiter.Middleware)

     

       84
       83
        
       

     

       85
       84
        
       	// Initialize identity resolver

     

       85
       85
       +
       	// IMPORTANT: In dev mode, identity resolution MUST use the same local PLC

     

       86
       86
       +
       	// directory as DID registration to ensure E2E tests work without hitting

     

       87
       87
       +
       	// the production plc.directory

     

       86
       88
        
       	identityConfig := identity.DefaultConfig()

     

       87
       87
       -
       	// Override from environment if set

     

       88
       88
       -
       	if plcURL := os.Getenv("IDENTITY_PLC_URL"); plcURL != "" {

     

       89
       89
       -
       		identityConfig.PLCURL = plcURL

     

       89
       89
       +
       

     

       90
       90
       +
       	isDevEnv := os.Getenv("IS_DEV_ENV") == "true"

     

       91
       91
       +
       	plcDirectoryURL := os.Getenv("PLC_DIRECTORY_URL")

     

       92
       92
       +
       	if plcDirectoryURL == "" {

     

       93
       93
       +
       		plcDirectoryURL = "https://plc.directory" // Default to production PLC

     

       94
       94
       +
       	}

     

       95
       95
       +
       

     

       96
       96
       +
       	// In dev mode, use PLC_DIRECTORY_URL for identity resolution

     

       97
       97
       +
       	// In prod mode, use IDENTITY_PLC_URL if set, otherwise PLC_DIRECTORY_URL

     

       98
       98
       +
       	if isDevEnv {

     

       99
       99
       +
       		identityConfig.PLCURL = plcDirectoryURL

     

       100
       100
       +
       		log.Printf("🧪 DEV MODE: Identity resolver will use local PLC: %s", plcDirectoryURL)

     

       101
       101
       +
       	} else {

     

       102
       102
       +
       		// Production: Allow separate IDENTITY_PLC_URL for read operations

     

       103
       103
       +
       		if identityPLCURL := os.Getenv("IDENTITY_PLC_URL"); identityPLCURL != "" {

     

       104
       104
       +
       			identityConfig.PLCURL = identityPLCURL

     

       105
       105
       +
       		} else {

     

       106
       106
       +
       			identityConfig.PLCURL = plcDirectoryURL

     

       107
       107
       +
       		}

     

       108
       108
       +
       		log.Printf("✅ PRODUCTION MODE: Identity resolver using PLC: %s", identityConfig.PLCURL)

     

       90
       109
        
       	}

     

       110
       110
       +
       

     

       91
       111
        
       	if cacheTTL := os.Getenv("IDENTITY_CACHE_TTL"); cacheTTL != "" {

     

       92
       112
        
       		if duration, parseErr := time.ParseDuration(cacheTTL); parseErr == nil {

     

       93
       113
        
       			identityConfig.CacheTTL = duration

     
···

       95
       115
        
       	}

     

       96
       116
        
       

     

       97
       117
        
       	identityResolver := identity.NewResolver(db, identityConfig)

     

       98
       98
       -
       	log.Println("Identity resolver initialized with PLC:", identityConfig.PLCURL)

     

       99
       118
        
       

     

       100
       119
        
       	// Initialize OAuth session store

     

       101
       120
        
       	sessionStore := oauthCore.NewPostgresSessionStore(db)

     
···

       107
       126
        
       

     

       108
       127
        
       	communityRepo := postgresRepo.NewCommunityRepository(db)

     

       109
       128
        
       

     

       110
       110
       -
       	// Initialize DID generator for communities

     

       111
       111
       -
       	// IS_DEV_ENV=true:  Generate did:plc:xxx without registering to PLC directory

     

       112
       112
       -
       	// IS_DEV_ENV=false: Generate did:plc:xxx and register with PLC_DIRECTORY_URL

     

       113
       113
       -
       	isDevEnv := os.Getenv("IS_DEV_ENV") == "true"

     

       114
       114
       -
       	plcDirectoryURL := os.Getenv("PLC_DIRECTORY_URL")

     

       115
       115
       -
       	if plcDirectoryURL == "" {

     

       116
       116
       -
       		plcDirectoryURL = "https://plc.directory" // Default to Bluesky's PLC

     

       117
       117
       -
       	}

     

       118
       118
       -
       	didGenerator := did.NewGenerator(isDevEnv, plcDirectoryURL)

     

       119
       119
       -
       	log.Printf("DID generator initialized (dev_mode=%v, plc_url=%s)", isDevEnv, plcDirectoryURL)

     

       129
       129
       +
       	// V2.0: PDS-managed DID generation

     

       130
       130
       +
       	// Community DIDs and keys are generated entirely by the PDS

     

       131
       131
       +
       	// No Coves-side DID generator needed (reserved for future V2.1 hybrid approach)

     

       120
       132
        
       

     

       121
       133
        
       	instanceDID := os.Getenv("INSTANCE_DID")

     

       122
       134
        
       	if instanceDID == "" {

     
···

       148
       160
        
       

     

       149
       161
        
       	log.Printf("Instance domain: %s (extracted from DID: %s)", instanceDomain, instanceDID)

     

       150
       162
        
       

     

       151
       151
       -
       	// V2: Initialize PDS account provisioner for communities

     

       152
       152
       -
       	provisioner := communities.NewPDSAccountProvisioner(userService, instanceDomain, defaultPDS)

     

       163
       163
       +
       	// V2.0: Initialize PDS account provisioner for communities (simplified)

     

       164
       164
       +
       	// PDS handles all DID and key generation - no Coves-side cryptography needed

     

       165
       165
       +
       	provisioner := communities.NewPDSAccountProvisioner(instanceDomain, defaultPDS)

     

       166
       166
       +
       	log.Printf("✅ Community provisioner initialized (PDS-managed keys)")

     

       167
       167
       +
       	log.Printf("   - Communities will be created at: %s", defaultPDS)

     

       168
       168
       +
       	log.Printf("   - PDS will generate and manage all DIDs and keys")

     

       153
       169
        
       

     

       154
       154
       -
       	communityService := communities.NewCommunityService(communityRepo, didGenerator, defaultPDS, instanceDID, instanceDomain, provisioner)

     

       170
       170
       +
       	// Initialize community service (no longer needs didGenerator directly)

     

       171
       171
       +
       	communityService := communities.NewCommunityService(communityRepo, defaultPDS, instanceDID, instanceDomain, provisioner)

     

       155
       172
        
       

     

       156
       173
        
       	// Authenticate Coves instance with PDS to enable community record writes

     

       157
       174
        
       	// The instance needs a PDS account to write community records it owns

+13 -9

internal/core/communities/service.go

···

       1
       1
        
       package communities

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       -
       	"Coves/internal/atproto/did"

     

       5
       4
        
       	"bytes"

     

       6
       5
        
       	"context"

     

       7
       6
        
       	"encoding/json"

     
···

       20
       19
        
       

     

       21
       20
        
       type communityService struct {

     

       22
       21
        
       	repo           Repository

     

       23
       23
       -
       	didGen         *did.Generator

     

       24
       22
        
       	provisioner    *PDSAccountProvisioner

     

       25
       23
        
       	pdsURL         string

     

       26
       24
        
       	instanceDID    string

     
···

       29
       27
        
       }

     

       30
       28
        
       

     

       31
       29
        
       // NewCommunityService creates a new community service

     

       32
       32
       -
       func NewCommunityService(repo Repository, didGen *did.Generator, pdsURL, instanceDID, instanceDomain string, provisioner *PDSAccountProvisioner) Service {

     

       30
       30
       +
       func NewCommunityService(repo Repository, pdsURL, instanceDID, instanceDomain string, provisioner *PDSAccountProvisioner) Service {

     

       33
       31
        
       	return &communityService{

     

       34
       32
        
       		repo:           repo,

     

       35
       35
       -
       		didGen:         didGen,

     

       36
       33
        
       		pdsURL:         pdsURL,

     

       37
       34
        
       		instanceDID:    instanceDID,

     

       38
       35
        
       		instanceDomain: instanceDomain,

     
···

       141
       138
        
       		return nil, fmt.Errorf("failed to create community profile record: %w", err)

     

       142
       139
        
       	}

     

       143
       140
        
       

     

       144
       144
       -
       	// Build Community object with PDS credentials

     

       141
       141
       +
       	// Build Community object with PDS credentials AND cryptographic keys

     

       145
       142
        
       	community := &Community{

     

       146
       143
        
       		DID:                    pdsAccount.DID,    // Community's DID (owns the repo!)

     

       147
       144
        
       		Handle:                 pdsAccount.Handle, // atProto handle (e.g., gaming.communities.coves.social)

     
···

       152
       149
        
       		CreatedByDID:           req.CreatedByDID,

     

       153
       150
        
       		HostedByDID:            req.HostedByDID,

     

       154
       151
        
       		PDSEmail:               pdsAccount.Email,

     

       155
       155
       -
       		PDSPasswordHash:        pdsAccount.PasswordHash,

     

       152
       152
       +
       		PDSPassword:            pdsAccount.Password,

     

       156
       153
        
       		PDSAccessToken:         pdsAccount.AccessToken,

     

       157
       154
        
       		PDSRefreshToken:        pdsAccount.RefreshToken,

     

       158
       155
        
       		PDSURL:                 pdsAccount.PDSURL,

     
···

       164
       161
        
       		UpdatedAt:              time.Now(),

     

       165
       162
        
       		RecordURI:              recordURI,

     

       166
       163
        
       		RecordCID:              recordCID,

     

       164
       164
       +
       		// V2: Cryptographic keys for portability (will be encrypted by repository)

     

       165
       165
       +
       		RotationKeyPEM: pdsAccount.RotationKeyPEM, // CRITICAL: Enables DID migration

     

       166
       166
       +
       		SigningKeyPEM:  pdsAccount.SigningKeyPEM,  // For atproto operations

     

       167
       167
        
       	}

     

       168
       168
        
       

     

       169
       169
        
       	// CRITICAL: Persist PDS credentials immediately to database

     
···

       515
       515
        
       		return NewValidationError("name", "required")

     

       516
       516
        
       	}

     

       517
       517
        
       

     

       518
       518
       -
       	if len(req.Name) > 64 {

     

       519
       519
       -
       		return NewValidationError("name", "must be 64 characters or less")

     

       518
       518
       +
       	// DNS label limit: 63 characters per label

     

       519
       519
       +
       	// Community handle format: {name}.communities.{instanceDomain}

     

       520
       520
       +
       	// The first label is just req.Name, so it must be <= 63 chars

     

       521
       521
       +
       	if len(req.Name) > 63 {

     

       522
       522
       +
       		return NewValidationError("name", "must be 63 characters or less (DNS label limit)")

     

       520
       523
        
       	}

     

       521
       524
        
       

     

       522
       525
        
       	// Name can only contain alphanumeric and hyphens

     

       523
       523
       -
       	nameRegex := regexp.MustCompile(`^[a-zA-Z0-9]([a-zA-Z0-9-]{0,62}[a-zA-Z0-9])?$`)

     

       526
       526
       +
       	// Must start and end with alphanumeric (not hyphen)

     

       527
       527
       +
       	nameRegex := regexp.MustCompile(`^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?$`)

     

       524
       528
        
       	if !nameRegex.MatchString(req.Name) {

     

       525
       529
        
       		return NewValidationError("name", "must contain only alphanumeric characters and hyphens")

     

       526
       530
        
       	}