commit 9f788377f66b975ed083a5d1acebd41aab0a8521 · bretton.dev/coves

+79 -2
docs/PRD_BACKLOG.md
···

       13
       13
        
       ## 🔴 P0: Critical (Alpha Blockers)

     

       14
       14
        
       

     

       15
       15
        
       ### OAuth DPoP Token Architecture - Voting Write-Forward

     

       16
       16
       -
       **Added:** 2025-11-02 | **Effort:** 4-6 hours | **Priority:** ALPHA BLOCKER

     

       17
       17
       -
       **Status:** ⚠️ ARCHITECTURE DECISION REQUIRED

     

       16
       16
       +
       **Added:** 2025-11-02 | **Completed:** 2025-11-02 | **Effort:** 2 hours | **Priority:** ALPHA BLOCKER

     

       17
       17
       +
       **Status:** ✅ COMPLETE

     

       18
       18
        
       

     

       19
       19
        
       **Problem:**

     

       20
       20
        
       Our backend is attempting to use DPoP-bound OAuth tokens to write votes to users' PDSs, causing "Malformed token" errors. This violates atProto architecture patterns.

     
···

       124
       124
        
       - Bluesky social-app: Direct PDS writes via agent

     

       125
       125
        
       - atProto OAuth spec: DPoP binding prevents token reuse

     

       126
       126
        
       - atProto architecture: AppView = read-only indexer

     

       127
       127
       +
       

     

       128
       128
       +
       ---

     

       129
       129
       +
       

     

       130
       130
       +
       ### OAuth DPoP Token Architecture - Community Subscriptions

     

       131
       131
       +
       **Added:** 2025-11-02 | **Effort:** 1-2 hours | **Priority:** ALPHA BLOCKER

     

       132
       132
       +
       **Status:** 📋 TODO (Waiting for frontend implementation)

     

       133
       133
       +
       

     

       134
       134
       +
       **Problem:**

     

       135
       135
       +
       Same DPoP token issue as voting - backend cannot use user's DPoP-bound OAuth tokens to write subscription records to user's PDS.

     

       136
       136
       +
       

     

       137
       137
       +
       **Affected Operations:**

     

       138
       138
       +
       - `SubscribeToCommunity()` - [service.go:564-624](../internal/core/communities/service.go#L564-L624)

     

       139
       139
       +
       - `UnsubscribeFromCommunity()` - [service.go:626-660](../internal/core/communities/service.go#L626-L660)

     

       140
       140
       +
       

     

       141
       141
       +
       **Collection:** `social.coves.community.subscription`

     

       142
       142
       +
       

     

       143
       143
       +
       **Solution:**

     

       144
       144
       +
       Client writes directly using `com.atproto.repo.createRecord`:

     

       145
       145
       +
       ```typescript

     

       146
       146
       +
       await agent.call('com.atproto.repo.createRecord', {

     

       147
       147
       +
         repo: userDid,

     

       148
       148
       +
         collection: 'social.coves.community.subscription',

     

       149
       149
       +
         record: {

     

       150
       150
       +
           $type: 'social.coves.community.subscription',

     

       151
       151
       +
           subject: communityDid,

     

       152
       152
       +
           contentVisibility: 3,

     

       153
       153
       +
           createdAt: new Date().toISOString()

     

       154
       154
       +
         }

     

       155
       155
       +
       })

     

       156
       156
       +
       ```

     

       157
       157
       +
       

     

       158
       158
       +
       **Backend Changes Needed:**

     

       159
       159
       +
       1. Remove write-forward from `SubscribeToCommunity()` and `UnsubscribeFromCommunity()`

     

       160
       160
       +
       2. Update handlers to return errors directing to client-direct pattern

     

       161
       161
       +
       3. Verify Jetstream consumer indexes subscriptions (already working)

     

       162
       162
       +
       

     

       163
       163
       +
       **Files to Modify:**

     

       164
       164
       +
       - `internal/core/communities/service.go`

     

       165
       165
       +
       - `internal/api/handlers/community/subscribe.go`

     

       166
       166
       +
       

     

       167
       167
       +
       ---

     

       168
       168
       +
       

     

       169
       169
       +
       ### OAuth DPoP Token Architecture - Community Blocking

     

       170
       170
       +
       **Added:** 2025-11-02 | **Effort:** 1-2 hours | **Priority:** ALPHA BLOCKER

     

       171
       171
       +
       **Status:** 📋 TODO (Waiting for frontend implementation)

     

       172
       172
       +
       

     

       173
       173
       +
       **Problem:**

     

       174
       174
       +
       Same DPoP token issue - backend cannot use user's DPoP-bound OAuth tokens to write block records to user's PDS.

     

       175
       175
       +
       

     

       176
       176
       +
       **Affected Operations:**

     

       177
       177
       +
       - `BlockCommunity()` - [service.go:709-781](../internal/core/communities/service.go#L709-L781)

     

       178
       178
       +
       - `UnblockCommunity()` - [service.go:783-816](../internal/core/communities/service.go#L783-L816)

     

       179
       179
       +
       

     

       180
       180
       +
       **Collection:** `social.coves.community.block`

     

       181
       181
       +
       

     

       182
       182
       +
       **Solution:**

     

       183
       183
       +
       Client writes directly using `com.atproto.repo.createRecord`:

     

       184
       184
       +
       ```typescript

     

       185
       185
       +
       await agent.call('com.atproto.repo.createRecord', {

     

       186
       186
       +
         repo: userDid,

     

       187
       187
       +
         collection: 'social.coves.community.block',

     

       188
       188
       +
         record: {

     

       189
       189
       +
           $type: 'social.coves.community.block',

     

       190
       190
       +
           subject: communityDid,

     

       191
       191
       +
           createdAt: new Date().toISOString()

     

       192
       192
       +
         }

     

       193
       193
       +
       })

     

       194
       194
       +
       ```

     

       195
       195
       +
       

     

       196
       196
       +
       **Backend Changes Needed:**

     

       197
       197
       +
       1. Remove write-forward from `BlockCommunity()` and `UnblockCommunity()`

     

       198
       198
       +
       2. Update handlers to return errors directing to client-direct pattern

     

       199
       199
       +
       3. Verify Jetstream consumer indexes blocks (already working)

     

       200
       200
       +
       

     

       201
       201
       +
       **Files to Modify:**

     

       202
       202
       +
       - `internal/core/communities/service.go`

     

       203
       203
       +
       - `internal/api/handlers/community/block.go`

     

       127
       204
        
       

     

       128
       205
        
       ---

     

       129
       206