···

       
1
       
1
       
 
       
package community

     

       
2
       
2
       
 
       


     

       
3
       
3
       
 
       
import (

     

       
4
       
4
       
+
       
	"Coves/internal/api/middleware"

     

       
4
       
5
       
 
       
	"Coves/internal/core/communities"

     

       
5
       
6
       
 
       
	"encoding/json"

     

       
6
       
7
       
 
       
	"net/http"

     
···

       
34
       
35
       
 
       
		return

     

       
35
       
36
       
 
       
	}

     

       
36
       
37
       
 
       


     

       
37
       
37
       
-
       
	// TODO(Communities-OAuth): Extract authenticated user DID from request context

     

       
38
       
38
       
-
       
	// This MUST be replaced with OAuth middleware before production deployment

     

       
39
       
39
       
-
       
	// Expected implementation:

     

       
40
       
40
       
-
       
	//   userDID := r.Context().Value("authenticated_user_did").(string)

     

       
41
       
41
       
-
       
	//   req.CreatedByDID = userDID

     

       
42
       
42
       
-
       
	// For now, we require client to send it (INSECURE - allows impersonation)

     

       
43
       
43
       
-
       
	if req.CreatedByDID == "" {

     

       
38
       
38
       
+
       
	// Extract authenticated user DID from request context (injected by auth middleware)

     

       
39
       
39
       
+
       
	userDID := middleware.GetUserDID(r)

     

       
40
       
40
       
+
       
	if userDID == "" {

     

       
44
       
41
       
 
       
		writeError(w, http.StatusUnauthorized, "AuthRequired", "Authentication required")

     

       
45
       
42
       
 
       
		return

     

       
46
       
43
       
 
       
	}

     

       
47
       
44
       
 
       


     

       
48
       
48
       
-
       
	if req.HostedByDID == "" {

     

       
49
       
49
       
-
       
		writeError(w, http.StatusBadRequest, "InvalidRequest", "hostedByDid is required")

     

       
45
       
45
       
+
       
	// Client should not send createdByDid - we derive it from authenticated user

     

       
46
       
46
       
+
       
	if req.CreatedByDID != "" {

     

       
47
       
47
       
+
       
		writeError(w, http.StatusBadRequest, "InvalidRequest",

     

       
48
       
48
       
+
       
			"createdByDid must not be provided - derived from authenticated user")

     

       
49
       
49
       
+
       
		return

     

       
50
       
50
       
+
       
	}

     

       
51
       
51
       
+
       


     

       
52
       
52
       
+
       
	// Client should not send hostedByDid - we derive it from the instance

     

       
53
       
53
       
+
       
	if req.HostedByDID != "" {

     

       
54
       
54
       
+
       
		writeError(w, http.StatusBadRequest, "InvalidRequest",

     

       
55
       
55
       
+
       
			"hostedByDid must not be provided - derived from instance")

     

       
50
       
56
       
 
       
		return

     

       
51
       
57
       
 
       
	}

     

       
58
       
58
       
+
       


     

       
59
       
59
       
+
       
	// Set the authenticated user as the creator

     

       
60
       
60
       
+
       
	req.CreatedByDID = userDID

     

       
61
       
61
       
+
       
	// Note: hostedByDID will be set by the service layer based on instance configuration

     

       
52
       
62
       
 
       


     

       
53
       
63
       
 
       
	// Create community via service (write-forward to PDS)

     

       
54
       
64
       
 
       
	community, err := h.service.CreateCommunity(r.Context(), req)

     

···

       
1
       
1
       
 
       
package community

     

       
2
       
2
       
 
       


     

       
3
       
3
       
 
       
import (

     

       
4
       
4
       
+
       
	"Coves/internal/api/middleware"

     

       
4
       
5
       
 
       
	"Coves/internal/core/communities"

     

       
5
       
6
       
 
       
	"encoding/json"

     

       
6
       
7
       
 
       
	"log"

     
···

       
43
       
44
       
 
       
		return

     

       
44
       
45
       
 
       
	}

     

       
45
       
46
       
 
       


     

       
46
       
46
       
-
       
	// TODO(Communities-OAuth): Extract authenticated user DID from request context

     

       
47
       
47
       
-
       
	// This MUST be replaced with OAuth middleware before production deployment

     

       
48
       
48
       
-
       
	// Expected implementation:

     

       
49
       
49
       
-
       
	//   userDID := r.Context().Value("authenticated_user_did").(string)

     

       
50
       
50
       
-
       
	// For now, we read from header (INSECURE - allows impersonation)

     

       
51
       
51
       
-
       
	userDID := r.Header.Get("X-User-DID")

     

       
47
       
47
       
+
       
	// Extract authenticated user DID and access token from request context (injected by auth middleware)

     

       
48
       
48
       
+
       
	userDID := middleware.GetUserDID(r)

     

       
52
       
49
       
 
       
	if userDID == "" {

     

       
53
       
50
       
 
       
		writeError(w, http.StatusUnauthorized, "AuthRequired", "Authentication required")

     

       
54
       
51
       
 
       
		return

     

       
55
       
52
       
 
       
	}

     

       
56
       
53
       
 
       


     

       
54
       
54
       
+
       
	userAccessToken := middleware.GetUserAccessToken(r)

     

       
55
       
55
       
+
       
	if userAccessToken == "" {

     

       
56
       
56
       
+
       
		writeError(w, http.StatusUnauthorized, "AuthRequired", "Missing access token")

     

       
57
       
57
       
+
       
		return

     

       
58
       
58
       
+
       
	}

     

       
59
       
59
       
+
       


     

       
57
       
60
       
 
       
	// Subscribe via service (write-forward to PDS)

     

       
58
       
58
       
-
       
	subscription, err := h.service.SubscribeToCommunity(r.Context(), userDID, req.Community)

     

       
61
       
61
       
+
       
	subscription, err := h.service.SubscribeToCommunity(r.Context(), userDID, userAccessToken, req.Community)

     

       
59
       
62
       
 
       
	if err != nil {

     

       
60
       
63
       
 
       
		handleServiceError(w, err)

     

       
61
       
64
       
 
       
		return

     
···

       
99
       
102
       
 
       
		return

     

       
100
       
103
       
 
       
	}

     

       
101
       
104
       
 
       


     

       
102
       
102
       
-
       
	// TODO(Communities-OAuth): Extract authenticated user DID from request context

     

       
103
       
103
       
-
       
	// This MUST be replaced with OAuth middleware before production deployment

     

       
104
       
104
       
-
       
	// Expected implementation:

     

       
105
       
105
       
-
       
	//   userDID := r.Context().Value("authenticated_user_did").(string)

     

       
106
       
106
       
-
       
	// For now, we read from header (INSECURE - allows impersonation)

     

       
107
       
107
       
-
       
	userDID := r.Header.Get("X-User-DID")

     

       
105
       
105
       
+
       
	// Extract authenticated user DID and access token from request context (injected by auth middleware)

     

       
106
       
106
       
+
       
	userDID := middleware.GetUserDID(r)

     

       
108
       
107
       
 
       
	if userDID == "" {

     

       
109
       
108
       
 
       
		writeError(w, http.StatusUnauthorized, "AuthRequired", "Authentication required")

     

       
110
       
109
       
 
       
		return

     

       
111
       
110
       
 
       
	}

     

       
112
       
111
       
 
       


     

       
112
       
112
       
+
       
	userAccessToken := middleware.GetUserAccessToken(r)

     

       
113
       
113
       
+
       
	if userAccessToken == "" {

     

       
114
       
114
       
+
       
		writeError(w, http.StatusUnauthorized, "AuthRequired", "Missing access token")

     

       
115
       
115
       
+
       
		return

     

       
116
       
116
       
+
       
	}

     

       
117
       
117
       
+
       


     

       
113
       
118
       
 
       
	// Unsubscribe via service (delete record on PDS)

     

       
114
       
114
       
-
       
	err := h.service.UnsubscribeFromCommunity(r.Context(), userDID, req.Community)

     

       
119
       
119
       
+
       
	err := h.service.UnsubscribeFromCommunity(r.Context(), userDID, userAccessToken, req.Community)

     

       
115
       
120
       
 
       
	if err != nil {

     

       
116
       
121
       
 
       
		handleServiceError(w, err)

     

       
117
       
122
       
 
       
		return

     

···

       
1
       
1
       
 
       
package community

     

       
2
       
2
       
 
       


     

       
3
       
3
       
 
       
import (

     

       
4
       
4
       
+
       
	"Coves/internal/api/middleware"

     

       
4
       
5
       
 
       
	"Coves/internal/core/communities"

     

       
5
       
6
       
 
       
	"encoding/json"

     

       
6
       
7
       
 
       
	"net/http"

     
···

       
40
       
41
       
 
       
		return

     

       
41
       
42
       
 
       
	}

     

       
42
       
43
       
 
       


     

       
43
       
43
       
-
       
	// TODO(Communities-OAuth): Extract authenticated user DID from request context

     

       
44
       
44
       
-
       
	// This MUST be replaced with OAuth middleware before production deployment

     

       
45
       
45
       
-
       
	// Expected implementation:

     

       
46
       
46
       
-
       
	//   userDID := r.Context().Value("authenticated_user_did").(string)

     

       
47
       
47
       
-
       
	//   req.UpdatedByDID = userDID

     

       
48
       
48
       
-
       
	// For now, we require client to send it (INSECURE - allows impersonation)

     

       
49
       
49
       
-
       
	if req.UpdatedByDID == "" {

     

       
44
       
44
       
+
       
	// Extract authenticated user DID from request context (injected by auth middleware)

     

       
45
       
45
       
+
       
	userDID := middleware.GetUserDID(r)

     

       
46
       
46
       
+
       
	if userDID == "" {

     

       
50
       
47
       
 
       
		writeError(w, http.StatusUnauthorized, "AuthRequired", "Authentication required")

     

       
51
       
48
       
 
       
		return

     

       
52
       
49
       
 
       
	}

     

       
50
       
50
       
+
       


     

       
51
       
51
       
+
       
	// Set the authenticated user as the updater

     

       
52
       
52
       
+
       
	req.UpdatedByDID = userDID

     

       
53
       
53
       
 
       


     

       
54
       
54
       
 
       
	// Update community via service (write-forward to PDS)

     

       
55
       
55
       
 
       
	community, err := h.service.UpdateCommunity(r.Context(), req)