commit 76189e0aca518fa79ef9716636bb6c9af1ff1e6b · bretton.dev/coves

+24 -1
cmd/server/main.go
···

       10
       10
        
       	"log"

     

       11
       11
        
       	"net/http"

     

       12
       12
        
       	"os"

     

       13
       13
       +
       	"strings"

     

       13
       14
        
       	"time"

     

       14
       15
        
       

     

       15
       16
        
       	"github.com/go-chi/chi/v5"

     
···

       116
       117
        
       	if instanceDID == "" {

     

       117
       118
        
       		instanceDID = "did:web:coves.local" // Default for development

     

       118
       119
        
       	}

     

       119
       119
       -
       	communityService := communities.NewCommunityService(communityRepo, didGenerator, defaultPDS, instanceDID)

     

       120
       120
       +
       

     

       121
       121
       +
       	// V2: Extract instance domain for community handles

     

       122
       122
       +
       	// IMPORTANT: This MUST match the domain in INSTANCE_DID for security

     

       123
       123
       +
       	// We cannot allow arbitrary domains to prevent impersonation attacks

     

       124
       124
       +
       	// Example attack: !leagueoflegends@riotgames.com on a non-Riot instance

     

       125
       125
       +
       	var instanceDomain string

     

       126
       126
       +
       	if strings.HasPrefix(instanceDID, "did:web:") {

     

       127
       127
       +
       		// Extract domain from did:web (this is the authoritative source)

     

       128
       128
       +
       		instanceDomain = strings.TrimPrefix(instanceDID, "did:web:")

     

       129
       129
       +
       	} else {

     

       130
       130
       +
       		// For non-web DIDs (e.g., did:plc), require explicit INSTANCE_DOMAIN

     

       131
       131
       +
       		instanceDomain = os.Getenv("INSTANCE_DOMAIN")

     

       132
       132
       +
       		if instanceDomain == "" {

     

       133
       133
       +
       			log.Fatal("INSTANCE_DOMAIN must be set for non-web DIDs")

     

       134
       134
       +
       		}

     

       135
       135
       +
       	}

     

       136
       136
       +
       

     

       137
       137
       +
       	log.Printf("Instance domain: %s (extracted from DID: %s)", instanceDomain, instanceDID)

     

       138
       138
       +
       

     

       139
       139
       +
       	// V2: Initialize PDS account provisioner for communities

     

       140
       140
       +
       	provisioner := communities.NewPDSAccountProvisioner(userService, instanceDomain, defaultPDS)

     

       141
       141
       +
       

     

       142
       142
       +
       	communityService := communities.NewCommunityService(communityRepo, didGenerator, defaultPDS, instanceDID, instanceDomain, provisioner)

     

       120
       143
        
       

     

       121
       144
        
       	// Authenticate Coves instance with PDS to enable community record writes

     

       122
       145
        
       	// The instance needs a PDS account to write community records it owns