commit 6eb2a6e1ecab98bb7eb0c4e0e19d74527c4a0f38 · bretton.dev/coves

+4 -4

internal/api/handlers/aggregator/get_authorizations.go

···

       105
        
       

     

       106
        
       // GetAuthorizationsResponse matches the lexicon output

     

       107
        
       type GetAuthorizationsResponse struct {

     

       0
        
       
     

       108
        
       	Authorizations []CommunityAuthView `json:"authorizations"`

     

       109
       -
       	Cursor         *string             `json:"cursor,omitempty"` // Pagination cursor

     

       110
        
       }

     

       111
        
       

     

       112
        
       // CommunityAuthView matches social.coves.aggregator.defs#communityAuthView

     

       113
        
       // Shows authorization from aggregator's perspective with nested aggregator details

     

       114
        
       type CommunityAuthView struct {

     

       115
       -
       	Aggregator AggregatorView `json:"aggregator"` // REQUIRED: Nested full aggregator object

     

       116
       -
       	Enabled    bool           `json:"enabled"`    // REQUIRED

     

       117
        
       	Config     interface{}    `json:"config,omitempty"`

     

       118
       -
       	CreatedAt  string         `json:"createdAt"` // REQUIRED

     

       0
        
       
     

       119
        
       	RecordUri  string         `json:"recordUri,omitempty"`

     

       0
        
       
     

       120
        
       }

     

       121
        
       

     

       122
        
       // toCommunityAuthView converts domain model to API view

···

       105
        
       

     

       106
        
       // GetAuthorizationsResponse matches the lexicon output

     

       107
        
       type GetAuthorizationsResponse struct {

     

       108
       +
       	Cursor         *string             `json:"cursor,omitempty"`

     

       109
        
       	Authorizations []CommunityAuthView `json:"authorizations"`

     

       0
        
       
     

       110
        
       }

     

       111
        
       

     

       112
        
       // CommunityAuthView matches social.coves.aggregator.defs#communityAuthView

     

       113
        
       // Shows authorization from aggregator's perspective with nested aggregator details

     

       114
        
       type CommunityAuthView struct {

     

       0
        
       
     

       0
        
       
     

       115
        
       	Config     interface{}    `json:"config,omitempty"`

     

       116
       +
       	Aggregator AggregatorView `json:"aggregator"`

     

       117
       +
       	CreatedAt  string         `json:"createdAt"`

     

       118
        
       	RecordUri  string         `json:"recordUri,omitempty"`

     

       119
       +
       	Enabled    bool           `json:"enabled"`

     

       120
        
       }

     

       121
        
       

     

       122
        
       // toCommunityAuthView converts domain model to API view

+7 -7

internal/api/handlers/aggregator/list_for_community.go

···

       111
        
       

     

       112
        
       // ListForCommunityResponse matches the lexicon output

     

       113
        
       type ListForCommunityResponse struct {

     

       0
        
       
     

       114
        
       	Aggregators []AuthorizationView `json:"aggregators"`

     

       115
       -
       	Cursor      *string             `json:"cursor,omitempty"` // Pagination cursor

     

       116
        
       }

     

       117
        
       

     

       118
        
       // AuthorizationView matches social.coves.aggregator.defs#authorizationView

     

       119
        
       // Shows authorization from community's perspective

     

       120
        
       type AuthorizationView struct {

     

       121
       -
       	AggregatorDID   string      `json:"aggregatorDid"`

     

       122
       -
       	CommunityDID    string      `json:"communityDid"`

     

       123
       -
       	CommunityHandle *string     `json:"communityHandle,omitempty"` // Optional: populated when communities service integration is complete

     

       124
       -
       	CommunityName   *string     `json:"communityName,omitempty"`   // Optional: populated when communities service integration is complete

     

       125
       -
       	Enabled         bool        `json:"enabled"`

     

       126
        
       	Config          interface{} `json:"config,omitempty"`

     

       127
       -
       	CreatedAt       string      `json:"createdAt"` // REQUIRED

     

       0
        
       
     

       128
        
       	CreatedBy       *string     `json:"createdBy,omitempty"`

     

       129
        
       	DisabledAt      *string     `json:"disabledAt,omitempty"`

     

       130
        
       	DisabledBy      *string     `json:"disabledBy,omitempty"`

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       131
        
       	RecordUri       string      `json:"recordUri,omitempty"`

     

       0
        
       
     

       132
        
       }

     

       133
        
       

     

       134
        
       // toAuthorizationView converts domain model to API view

···

       111
        
       

     

       112
        
       // ListForCommunityResponse matches the lexicon output

     

       113
        
       type ListForCommunityResponse struct {

     

       114
       +
       	Cursor      *string             `json:"cursor,omitempty"`

     

       115
        
       	Aggregators []AuthorizationView `json:"aggregators"`

     

       0
        
       
     

       116
        
       }

     

       117
        
       

     

       118
        
       // AuthorizationView matches social.coves.aggregator.defs#authorizationView

     

       119
        
       // Shows authorization from community's perspective

     

       120
        
       type AuthorizationView struct {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       121
        
       	Config          interface{} `json:"config,omitempty"`

     

       122
       +
       	CommunityHandle *string     `json:"communityHandle,omitempty"`

     

       123
       +
       	CommunityName   *string     `json:"communityName,omitempty"`

     

       124
        
       	CreatedBy       *string     `json:"createdBy,omitempty"`

     

       125
        
       	DisabledAt      *string     `json:"disabledAt,omitempty"`

     

       126
        
       	DisabledBy      *string     `json:"disabledBy,omitempty"`

     

       127
       +
       	AggregatorDID   string      `json:"aggregatorDid"`

     

       128
       +
       	CommunityDID    string      `json:"communityDid"`

     

       129
       +
       	CreatedAt       string      `json:"createdAt"`

     

       130
        
       	RecordUri       string      `json:"recordUri,omitempty"`

     

       131
       +
       	Enabled         bool        `json:"enabled"`

     

       132
        
       }

     

       133
        
       

     

       134
        
       // toAuthorizationView converts domain model to API view

+14 -2

internal/atproto/auth/jwt.go

···

       10
        
       	"fmt"

     

       11
        
       	"math/big"

     

       12
        
       	"net/url"

     

       0
        
       
     

       13
        
       	"strings"

     

       14
        
       	"time"

     

       15
        
       

     
···

       133
        
       

     

       134
        
       	// Validate issuer is either an HTTPS URL or a DID

     

       135
        
       	// atProto uses DIDs (did:web:, did:plc:) or HTTPS URLs as issuer identifiers

     

       136
       -
       	if !strings.HasPrefix(claims.Issuer, "https://") && !strings.HasPrefix(claims.Issuer, "did:") {

     

       137
       -
       		return fmt.Errorf("issuer must be HTTPS URL or DID, got: %s", claims.Issuer)

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       138
        
       	}

     

       139
        
       

     

       140
        
       	// Parse to ensure it's a valid URL

···

       10
        
       	"fmt"

     

       11
        
       	"math/big"

     

       12
        
       	"net/url"

     

       13
       +
       	"os"

     

       14
        
       	"strings"

     

       15
        
       	"time"

     

       16
        
       

     
···

       134
        
       

     

       135
        
       	// Validate issuer is either an HTTPS URL or a DID

     

       136
        
       	// atProto uses DIDs (did:web:, did:plc:) or HTTPS URLs as issuer identifiers

     

       137
       +
       	// In dev mode (IS_DEV_ENV=true), allow HTTP for local PDS testing

     

       138
       +
       	isHTTP := strings.HasPrefix(claims.Issuer, "http://")

     

       139
       +
       	isHTTPS := strings.HasPrefix(claims.Issuer, "https://")

     

       140
       +
       	isDID := strings.HasPrefix(claims.Issuer, "did:")

     

       141
       +
       

     

       142
       +
       	if !isHTTPS && !isDID && !isHTTP {

     

       143
       +
       		return fmt.Errorf("issuer must be HTTPS URL, HTTP URL (dev only), or DID, got: %s", claims.Issuer)

     

       144
       +
       	}

     

       145
       +
       

     

       146
       +
       	// In production, reject HTTP issuers (only for non-dev environments)

     

       147
       +
       	// Check IS_DEV_ENV environment variable

     

       148
       +
       	if isHTTP && os.Getenv("IS_DEV_ENV") != "true" {

     

       149
       +
       		return fmt.Errorf("HTTP issuer not allowed in production, got: %s", claims.Issuer)

     

       150
        
       	}

     

       151
        
       

     

       152
        
       	// Parse to ensure it's a valid URL

+6 -6

internal/atproto/jetstream/aggregator_consumer.go

···

       306
        
       

     

       307
        
       // AggregatorAuthorizationRecord represents the authorization record structure

     

       308
        
       type AggregatorAuthorizationRecord struct {

     

       0
        
       
     

       309
        
       	Type         string                 `json:"$type"`

     

       310
       -
       	Aggregator   string                 `json:"aggregatorDid"` // Aggregator DID - fixed field name

     

       311
       -
       	CommunityDid string                 `json:"communityDid"`  // Community DID (must match repo DID)

     

       312
       -
       	Enabled      bool                   `json:"enabled"`

     

       313
       -
       	Config       map[string]interface{} `json:"config,omitempty"` // Aggregator-specific config

     

       314
       -
       	CreatedBy    string                 `json:"createdBy"`        // Required: DID of moderator who authorized

     

       315
        
       	DisabledBy   string                 `json:"disabledBy,omitempty"`

     

       316
       -
       	DisabledAt   string                 `json:"disabledAt,omitempty"` // When authorization was disabled (for modlog/audit)

     

       317
        
       	CreatedAt    string                 `json:"createdAt"`

     

       0
        
       
     

       318
        
       }

     

       319
        
       

     

       320
        
       // parseAggregatorAuthorization parses an aggregator authorization record

···

       306
        
       

     

       307
        
       // AggregatorAuthorizationRecord represents the authorization record structure

     

       308
        
       type AggregatorAuthorizationRecord struct {

     

       309
       +
       	Config       map[string]interface{} `json:"config,omitempty"`

     

       310
        
       	Type         string                 `json:"$type"`

     

       311
       +
       	Aggregator   string                 `json:"aggregatorDid"`

     

       312
       +
       	CommunityDid string                 `json:"communityDid"`

     

       313
       +
       	CreatedBy    string                 `json:"createdBy"`

     

       0
        
       
     

       0
        
       
     

       314
        
       	DisabledBy   string                 `json:"disabledBy,omitempty"`

     

       315
       +
       	DisabledAt   string                 `json:"disabledAt,omitempty"`

     

       316
        
       	CreatedAt    string                 `json:"createdAt"`

     

       317
       +
       	Enabled      bool                   `json:"enabled"`

     

       318
        
       }

     

       319
        
       

     

       320
        
       // parseAggregatorAuthorization parses an aggregator authorization record

+27 -27

internal/core/aggregators/aggregator.go

···

       6
        
       // Aggregators are autonomous services that can post content to communities after authorization

     

       7
        
       // Following Bluesky's pattern: app.bsky.feed.generator and app.bsky.labeler.service

     

       8
        
       type Aggregator struct {

     

       9
       -
       	DID              string    `json:"did" db:"did"`                                // Aggregator's DID (primary key)

     

       10
       -
       	DisplayName      string    `json:"displayName" db:"display_name"`               // Human-readable name

     

       11
       -
       	Description      string    `json:"description,omitempty" db:"description"`      // What the aggregator does

     

       12
       -
       	AvatarURL        string    `json:"avatarUrl,omitempty" db:"avatar_url"`         // Optional avatar image URL

     

       13
       -
       	ConfigSchema     []byte    `json:"configSchema,omitempty" db:"config_schema"`   // JSON Schema for configuration (JSONB)

     

       14
       -
       	MaintainerDID    string    `json:"maintainerDid,omitempty" db:"maintainer_did"` // Contact for support/issues

     

       15
       -
       	SourceURL        string    `json:"sourceUrl,omitempty" db:"source_url"`         // Source code URL (transparency)

     

       16
       -
       	CommunitiesUsing int       `json:"communitiesUsing" db:"communities_using"`     // Auto-updated by trigger

     

       17
       -
       	PostsCreated     int       `json:"postsCreated" db:"posts_created"`             // Auto-updated by trigger

     

       18
       -
       	CreatedAt        time.Time `json:"createdAt" db:"created_at"`                   // When aggregator was created (from lexicon)

     

       19
       -
       	IndexedAt        time.Time `json:"indexedAt" db:"indexed_at"`                   // When we indexed this record

     

       20
       -
       	RecordURI        string    `json:"recordUri,omitempty" db:"record_uri"`         // at://did/social.coves.aggregator.service/self

     

       21
       -
       	RecordCID        string    `json:"recordCid,omitempty" db:"record_cid"`         // Content hash

     

       22
        
       }

     

       23
        
       

     

       24
        
       // Authorization represents a community's authorization for an aggregator

     

       25
        
       // Stored in community's repository: at://community_did/social.coves.aggregator.authorization/{rkey}

     

       26
        
       type Authorization struct {

     

       27
       -
       	ID            int        `json:"id" db:"id"`                            // Database ID

     

       28
       -
       	AggregatorDID string     `json:"aggregatorDid" db:"aggregator_did"`     // Which aggregator

     

       29
       -
       	CommunityDID  string     `json:"communityDid" db:"community_did"`       // Which community

     

       30
       -
       	Enabled       bool       `json:"enabled" db:"enabled"`                  // Current status

     

       31
       -
       	Config        []byte     `json:"config,omitempty" db:"config"`          // Aggregator-specific config (JSONB)

     

       32
       -
       	CreatedBy     string     `json:"createdBy,omitempty" db:"created_by"`   // Moderator DID who enabled it

     

       33
       -
       	DisabledBy    string     `json:"disabledBy,omitempty" db:"disabled_by"` // Moderator DID who disabled it

     

       34
       -
       	CreatedAt     time.Time  `json:"createdAt" db:"created_at"`             // When authorization was created

     

       35
       -
       	DisabledAt    *time.Time `json:"disabledAt,omitempty" db:"disabled_at"` // When authorization was disabled (for modlog/audit)

     

       36
       -
       	IndexedAt     time.Time  `json:"indexedAt" db:"indexed_at"`             // When we indexed this record

     

       37
       -
       	RecordURI     string     `json:"recordUri,omitempty" db:"record_uri"`   // at://community_did/social.coves.aggregator.authorization/{rkey}

     

       38
       -
       	RecordCID     string     `json:"recordCid,omitempty" db:"record_cid"`   // Content hash

     

       39
        
       }

     

       40
        
       

     

       41
        
       // AggregatorPost represents tracking of posts created by aggregators

     

       42
        
       // AppView-only table for rate limiting and statistics

     

       43
        
       type AggregatorPost struct {

     

       44
       -
       	ID            int       `json:"id" db:"id"`

     

       45
        
       	AggregatorDID string    `json:"aggregatorDid" db:"aggregator_did"`

     

       46
        
       	CommunityDID  string    `json:"communityDid" db:"community_did"`

     

       47
        
       	PostURI       string    `json:"postUri" db:"post_uri"`

     

       48
        
       	PostCID       string    `json:"postCid" db:"post_cid"`

     

       49
       -
       	CreatedAt     time.Time `json:"createdAt" db:"created_at"`

     

       50
        
       }

     

       51
        
       

     

       52
        
       // EnableAggregatorRequest represents input for enabling an aggregator in a community

···

       6
        
       // Aggregators are autonomous services that can post content to communities after authorization

     

       7
        
       // Following Bluesky's pattern: app.bsky.feed.generator and app.bsky.labeler.service

     

       8
        
       type Aggregator struct {

     

       9
       +
       	CreatedAt        time.Time `json:"createdAt" db:"created_at"`

     

       10
       +
       	IndexedAt        time.Time `json:"indexedAt" db:"indexed_at"`

     

       11
       +
       	AvatarURL        string    `json:"avatarUrl,omitempty" db:"avatar_url"`

     

       12
       +
       	DID              string    `json:"did" db:"did"`

     

       13
       +
       	MaintainerDID    string    `json:"maintainerDid,omitempty" db:"maintainer_did"`

     

       14
       +
       	SourceURL        string    `json:"sourceUrl,omitempty" db:"source_url"`

     

       15
       +
       	Description      string    `json:"description,omitempty" db:"description"`

     

       16
       +
       	DisplayName      string    `json:"displayName" db:"display_name"`

     

       17
       +
       	RecordURI        string    `json:"recordUri,omitempty" db:"record_uri"`

     

       18
       +
       	RecordCID        string    `json:"recordCid,omitempty" db:"record_cid"`

     

       19
       +
       	ConfigSchema     []byte    `json:"configSchema,omitempty" db:"config_schema"`

     

       20
       +
       	CommunitiesUsing int       `json:"communitiesUsing" db:"communities_using"`

     

       21
       +
       	PostsCreated     int       `json:"postsCreated" db:"posts_created"`

     

       22
        
       }

     

       23
        
       

     

       24
        
       // Authorization represents a community's authorization for an aggregator

     

       25
        
       // Stored in community's repository: at://community_did/social.coves.aggregator.authorization/{rkey}

     

       26
        
       type Authorization struct {

     

       27
       +
       	CreatedAt     time.Time  `json:"createdAt" db:"created_at"`

     

       28
       +
       	IndexedAt     time.Time  `json:"indexedAt" db:"indexed_at"`

     

       29
       +
       	DisabledAt    *time.Time `json:"disabledAt,omitempty" db:"disabled_at"`

     

       30
       +
       	AggregatorDID string     `json:"aggregatorDid" db:"aggregator_did"`

     

       31
       +
       	CommunityDID  string     `json:"communityDid" db:"community_did"`

     

       32
       +
       	CreatedBy     string     `json:"createdBy,omitempty" db:"created_by"`

     

       33
       +
       	DisabledBy    string     `json:"disabledBy,omitempty" db:"disabled_by"`

     

       34
       +
       	RecordURI     string     `json:"recordUri,omitempty" db:"record_uri"`

     

       35
       +
       	RecordCID     string     `json:"recordCid,omitempty" db:"record_cid"`

     

       36
       +
       	Config        []byte     `json:"config,omitempty" db:"config"`

     

       37
       +
       	ID            int        `json:"id" db:"id"`

     

       38
       +
       	Enabled       bool       `json:"enabled" db:"enabled"`

     

       39
        
       }

     

       40
        
       

     

       41
        
       // AggregatorPost represents tracking of posts created by aggregators

     

       42
        
       // AppView-only table for rate limiting and statistics

     

       43
        
       type AggregatorPost struct {

     

       44
       +
       	CreatedAt     time.Time `json:"createdAt" db:"created_at"`

     

       45
        
       	AggregatorDID string    `json:"aggregatorDid" db:"aggregator_did"`

     

       46
        
       	CommunityDID  string    `json:"communityDid" db:"community_did"`

     

       47
        
       	PostURI       string    `json:"postUri" db:"post_uri"`

     

       48
        
       	PostCID       string    `json:"postCid" db:"post_cid"`

     

       49
       +
       	ID            int       `json:"id" db:"id"`

     

       50
        
       }

     

       51
        
       

     

       52
        
       // EnableAggregatorRequest represents input for enabling an aggregator in a community

+2 -1

internal/core/communities/service.go

···

       474
        
       	newAccessToken, newRefreshToken, err := refreshPDSToken(ctx, fresh.PDSURL, fresh.PDSAccessToken, fresh.PDSRefreshToken)

     

       475
        
       	if err != nil {

     

       476
        
       		// Check if refresh token expired (need password fallback)

     

       477
       -
       		if strings.Contains(err.Error(), "expired or invalid") {

     

       0
        
       
     

       478
        
       			log.Printf("[TOKEN-REFRESH] Community: %s, Event: refresh_token_expired, Message: Re-authenticating with password", fresh.DID)

     

       479
        
       

     

       480
        
       			// Fallback: Re-authenticate with stored password

···

       474
        
       	newAccessToken, newRefreshToken, err := refreshPDSToken(ctx, fresh.PDSURL, fresh.PDSAccessToken, fresh.PDSRefreshToken)

     

       475
        
       	if err != nil {

     

       476
        
       		// Check if refresh token expired (need password fallback)

     

       477
       +
       		// Match both "ExpiredToken" and "Token has expired" error messages

     

       478
       +
       		if strings.Contains(strings.ToLower(err.Error()), "expired") {

     

       479
        
       			log.Printf("[TOKEN-REFRESH] Community: %s, Event: refresh_token_expired, Message: Re-authenticating with password", fresh.DID)

     

       480
        
       

     

       481
        
       			// Fallback: Re-authenticate with stored password

+2 -2

tests/integration/discover_test.go

···

       1
        
       package integration

     

       2
        
       

     

       3
        
       import (

     

       0
        
       
     

       0
        
       
     

       4
        
       	"context"

     

       5
        
       	"encoding/json"

     

       6
        
       	"fmt"

     
···

       9
        
       	"testing"

     

       10
        
       	"time"

     

       11
        
       

     

       12
       -
       	"Coves/internal/api/handlers/discover"

     

       13
        
       	discoverCore "Coves/internal/core/discover"

     

       14
       -
       	"Coves/internal/db/postgres"

     

       15
        
       

     

       16
        
       	"github.com/stretchr/testify/assert"

     

       17
        
       	"github.com/stretchr/testify/require"

···

       1
        
       package integration

     

       2
        
       

     

       3
        
       import (

     

       4
       +
       	"Coves/internal/api/handlers/discover"

     

       5
       +
       	"Coves/internal/db/postgres"

     

       6
        
       	"context"

     

       7
        
       	"encoding/json"

     

       8
        
       	"fmt"

     
···

       11
        
       	"testing"

     

       12
        
       	"time"

     

       13
        
       

     

       0
        
       
     

       14
        
       	discoverCore "Coves/internal/core/discover"

     

       0
        
       
     

       15
        
       

     

       16
        
       	"github.com/stretchr/testify/assert"

     

       17
        
       	"github.com/stretchr/testify/require"

-1

tests/integration/post_handler_test.go

···

       546
        
       		}

     

       547
        
       

     

       548
        
       		_, err := postService.CreatePost(ctx, postReq)

     

       549
       -
       

     

       550
        
       		// May fail for other reasons (community not found), but NOT due to DID mismatch

     

       551
        
       		if err != nil {

     

       552
        
       			assert.NotContains(t, strings.ToLower(err.Error()), "does not match",

···

       546
        
       		}

     

       547
        
       

     

       548
        
       		_, err := postService.CreatePost(ctx, postReq)

     

       0
        
       
     

       549
        
       		// May fail for other reasons (community not found), but NOT due to DID mismatch

     

       550
        
       		if err != nil {

     

       551
        
       			assert.NotContains(t, strings.ToLower(err.Error()), "does not match",

+3 -3

tests/integration/timeline_test.go

···

       1
        
       package integration

     

       2
        
       

     

       3
        
       import (

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       4
        
       	"context"

     

       5
        
       	"encoding/json"

     

       6
        
       	"fmt"

     
···

       9
        
       	"testing"

     

       10
        
       	"time"

     

       11
        
       

     

       12
       -
       	"Coves/internal/api/handlers/timeline"

     

       13
       -
       	"Coves/internal/api/middleware"

     

       14
        
       	timelineCore "Coves/internal/core/timeline"

     

       15
       -
       	"Coves/internal/db/postgres"

     

       16
        
       

     

       17
        
       	"github.com/stretchr/testify/assert"

     

       18
        
       	"github.com/stretchr/testify/require"

···

       1
        
       package integration

     

       2
        
       

     

       3
        
       import (

     

       4
       +
       	"Coves/internal/api/handlers/timeline"

     

       5
       +
       	"Coves/internal/api/middleware"

     

       6
       +
       	"Coves/internal/db/postgres"

     

       7
        
       	"context"

     

       8
        
       	"encoding/json"

     

       9
        
       	"fmt"

     
···

       12
        
       	"testing"

     

       13
        
       	"time"

     

       14
        
       

     

       0
        
       
     

       0
        
       
     

       15
        
       	timelineCore "Coves/internal/core/timeline"

     

       0
        
       
     

       16
        
       

     

       17
        
       	"github.com/stretchr/testify/assert"

     

       18
        
       	"github.com/stretchr/testify/require"