comparing 30020b044b87df2eea75c3548f54d2106ff9608a and main on bretton.dev/coves

+125

internal/atproto/pds/factory.go

···

       1
       1
       +
       package pds

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"fmt"

     

       6
       6
       +
       	"net/http"

     

       7
       7
       +
       

     

       8
       8
       +
       	"github.com/bluesky-social/indigo/atproto/atclient"

     

       9
       9
       +
       	"github.com/bluesky-social/indigo/atproto/auth/oauth"

     

       10
       10
       +
       	"github.com/bluesky-social/indigo/atproto/syntax"

     

       11
       11
       +
       )

     

       12
       12
       +
       

     

       13
       13
       +
       // NewFromOAuthSession creates a PDS client from an OAuth session.

     

       14
       14
       +
       // This uses DPoP authentication - the correct method for OAuth tokens.

     

       15
       15
       +
       //

     

       16
       16
       +
       // The oauthClient is used to resume the session and get a properly configured

     

       17
       17
       +
       // APIClient that handles DPoP proof generation and nonce rotation automatically.

     

       18
       18
       +
       func NewFromOAuthSession(ctx context.Context, oauthClient *oauth.ClientApp, sessionData *oauth.ClientSessionData) (Client, error) {

     

       19
       19
       +
       	if oauthClient == nil {

     

       20
       20
       +
       		return nil, fmt.Errorf("oauthClient is required")

     

       21
       21
       +
       	}

     

       22
       22
       +
       	if sessionData == nil {

     

       23
       23
       +
       		return nil, fmt.Errorf("sessionData is required")

     

       24
       24
       +
       	}

     

       25
       25
       +
       

     

       26
       26
       +
       	// ResumeSession reconstructs the OAuth session with DPoP key

     

       27
       27
       +
       	// and returns a ClientSession that can generate authenticated requests

     

       28
       28
       +
       	sess, err := oauthClient.ResumeSession(ctx, sessionData.AccountDID, sessionData.SessionID)

     

       29
       29
       +
       	if err != nil {

     

       30
       30
       +
       		return nil, fmt.Errorf("failed to resume OAuth session: %w", err)

     

       31
       31
       +
       	}

     

       32
       32
       +
       

     

       33
       33
       +
       	// APIClient() returns an *atclient.APIClient configured with DPoP auth

     

       34
       34
       +
       	apiClient := sess.APIClient()

     

       35
       35
       +
       

     

       36
       36
       +
       	return &client{

     

       37
       37
       +
       		apiClient: apiClient,

     

       38
       38
       +
       		did:       sessionData.AccountDID.String(),

     

       39
       39
       +
       		host:      sessionData.HostURL,

     

       40
       40
       +
       	}, nil

     

       41
       41
       +
       }

     

       42
       42
       +
       

     

       43
       43
       +
       // NewFromPasswordAuth creates a PDS client using password authentication.

     

       44
       44
       +
       // This uses Bearer token authentication from com.atproto.server.createSession.

     

       45
       45
       +
       //

     

       46
       46
       +
       // Primarily used for:

     

       47
       47
       +
       // - E2E tests with local PDS

     

       48
       48
       +
       // - Development/debugging tools

     

       49
       49
       +
       // - Non-OAuth clients

     

       50
       50
       +
       //

     

       51
       51
       +
       // Note: This establishes a new session with the PDS. For repeated calls,

     

       52
       52
       +
       // consider using NewFromAccessToken if you already have a valid access token.

     

       53
       53
       +
       func NewFromPasswordAuth(ctx context.Context, host, handle, password string) (Client, error) {

     

       54
       54
       +
       	if host == "" {

     

       55
       55
       +
       		return nil, fmt.Errorf("host is required")

     

       56
       56
       +
       	}

     

       57
       57
       +
       	if handle == "" {

     

       58
       58
       +
       		return nil, fmt.Errorf("handle is required")

     

       59
       59
       +
       	}

     

       60
       60
       +
       	if password == "" {

     

       61
       61
       +
       		return nil, fmt.Errorf("password is required")

     

       62
       62
       +
       	}

     

       63
       63
       +
       

     

       64
       64
       +
       	// LoginWithPasswordHost creates a session and returns an authenticated APIClient

     

       65
       65
       +
       	// This handles the createSession call and Bearer token setup

     

       66
       66
       +
       	apiClient, err := atclient.LoginWithPasswordHost(ctx, host, handle, password, "", nil)

     

       67
       67
       +
       	if err != nil {

     

       68
       68
       +
       		return nil, fmt.Errorf("failed to login with password: %w", err)

     

       69
       69
       +
       	}

     

       70
       70
       +
       

     

       71
       71
       +
       	// Get DID from the authenticated client

     

       72
       72
       +
       	did := ""

     

       73
       73
       +
       	if apiClient.AccountDID != nil {

     

       74
       74
       +
       		did = apiClient.AccountDID.String()

     

       75
       75
       +
       	}

     

       76
       76
       +
       

     

       77
       77
       +
       	return &client{

     

       78
       78
       +
       		apiClient: apiClient,

     

       79
       79
       +
       		did:       did,

     

       80
       80
       +
       		host:      host,

     

       81
       81
       +
       	}, nil

     

       82
       82
       +
       }

     

       83
       83
       +
       

     

       84
       84
       +
       // NewFromAccessToken creates a PDS client from an existing access token.

     

       85
       85
       +
       // This is useful when you already have a valid Bearer token (e.g., from createSession)

     

       86
       86
       +
       // and don't want to re-authenticate.

     

       87
       87
       +
       //

     

       88
       88
       +
       // WARNING: This creates a client with Bearer auth only. Do NOT use this with

     

       89
       89
       +
       // OAuth access tokens - those require DPoP proofs. Use NewFromOAuthSession instead.

     

       90
       90
       +
       func NewFromAccessToken(host, did, accessToken string) (Client, error) {

     

       91
       91
       +
       	if host == "" {

     

       92
       92
       +
       		return nil, fmt.Errorf("host is required")

     

       93
       93
       +
       	}

     

       94
       94
       +
       	if did == "" {

     

       95
       95
       +
       		return nil, fmt.Errorf("did is required")

     

       96
       96
       +
       	}

     

       97
       97
       +
       	if accessToken == "" {

     

       98
       98
       +
       		return nil, fmt.Errorf("accessToken is required")

     

       99
       99
       +
       	}

     

       100
       100
       +
       

     

       101
       101
       +
       	// Create APIClient with Bearer auth

     

       102
       102
       +
       	apiClient := atclient.NewAPIClient(host)

     

       103
       103
       +
       	apiClient.Auth = &bearerAuth{token: accessToken}

     

       104
       104
       +
       

     

       105
       105
       +
       	return &client{

     

       106
       106
       +
       		apiClient: apiClient,

     

       107
       107
       +
       		did:       did,

     

       108
       108
       +
       		host:      host,

     

       109
       109
       +
       	}, nil

     

       110
       110
       +
       }

     

       111
       111
       +
       

     

       112
       112
       +
       // bearerAuth implements atclient.AuthMethod for simple Bearer token auth.

     

       113
       113
       +
       // This is used for password-based sessions where DPoP is not required.

     

       114
       114
       +
       type bearerAuth struct {

     

       115
       115
       +
       	token string

     

       116
       116
       +
       }

     

       117
       117
       +
       

     

       118
       118
       +
       // Ensure bearerAuth implements atclient.AuthMethod.

     

       119
       119
       +
       var _ atclient.AuthMethod = (*bearerAuth)(nil)

     

       120
       120
       +
       

     

       121
       121
       +
       // DoWithAuth adds the Bearer token to the request and executes it.

     

       122
       122
       +
       func (b *bearerAuth) DoWithAuth(c *http.Client, req *http.Request, _ syntax.NSID) (*http.Response, error) {

     

       123
       123
       +
       	req.Header.Set("Authorization", "Bearer "+b.token)

     

       124
       124
       +
       	return c.Do(req)

     

       125
       125
       +
       }

+18

tests/integration/helpers.go

···

       3
       3
        
       import (

     

       4
       4
        
       	"Coves/internal/api/middleware"

     

       5
       5
        
       	"Coves/internal/atproto/oauth"

     

       6
       6
       +
       	"Coves/internal/atproto/pds"

     

       6
       7
        
       	"Coves/internal/core/users"

     

       8
       8
       +
       	"Coves/internal/core/votes"

     

       7
       9
        
       	"bytes"

     

       8
       10
        
       	"context"

     

       9
       11
        
       	"database/sql"

     
···

       425
       427
        
       	e.store.AddSessionWithPDS(did, sessionID, pdsAccessToken, pdsURL)

     

       426
       428
        
       	return token

     

       427
       429
        
       }

     

       430
       430
       +
       

     

       431
       431
       +
       // PasswordAuthPDSClientFactory creates a PDSClientFactory that uses password-based Bearer auth.

     

       432
       432
       +
       // This is for E2E tests that use createSession instead of OAuth.

     

       433
       433
       +
       // The factory extracts the access token and host URL from the session data.

     

       434
       434
       +
       func PasswordAuthPDSClientFactory() votes.PDSClientFactory {

     

       435
       435
       +
       	return func(ctx context.Context, session *oauthlib.ClientSessionData) (pds.Client, error) {

     

       436
       436
       +
       		if session.AccessToken == "" {

     

       437
       437
       +
       			return nil, fmt.Errorf("session has no access token")

     

       438
       438
       +
       		}

     

       439
       439
       +
       		if session.HostURL == "" {

     

       440
       440
       +
       			return nil, fmt.Errorf("session has no host URL")

     

       441
       441
       +
       		}

     

       442
       442
       +
       

     

       443
       443
       +
       		return pds.NewFromAccessToken(session.HostURL, session.AccountDID.String(), session.AccessToken)

     

       444
       444
       +
       	}

     

       445
       445
       +
       }

+267

cmd/reindex-votes/main.go

···

       1
       1
       +
       // cmd/reindex-votes/main.go

     

       2
       2
       +
       // Quick tool to reindex votes from PDS to AppView database

     

       3
       3
       +
       package main

     

       4
       4
       +
       

     

       5
       5
       +
       import (

     

       6
       6
       +
       	"context"

     

       7
       7
       +
       	"database/sql"

     

       8
       8
       +
       	"encoding/json"

     

       9
       9
       +
       	"fmt"

     

       10
       10
       +
       	"log"

     

       11
       11
       +
       	"net/http"

     

       12
       12
       +
       	"net/url"

     

       13
       13
       +
       	"os"

     

       14
       14
       +
       	"strings"

     

       15
       15
       +
       	"time"

     

       16
       16
       +
       

     

       17
       17
       +
       	_ "github.com/lib/pq"

     

       18
       18
       +
       )

     

       19
       19
       +
       

     

       20
       20
       +
       type ListRecordsResponse struct {

     

       21
       21
       +
       	Records []Record `json:"records"`

     

       22
       22
       +
       	Cursor  string   `json:"cursor"`

     

       23
       23
       +
       }

     

       24
       24
       +
       

     

       25
       25
       +
       type Record struct {

     

       26
       26
       +
       	URI   string                 `json:"uri"`

     

       27
       27
       +
       	CID   string                 `json:"cid"`

     

       28
       28
       +
       	Value map[string]interface{} `json:"value"`

     

       29
       29
       +
       }

     

       30
       30
       +
       

     

       31
       31
       +
       func main() {

     

       32
       32
       +
       	// Get config from env

     

       33
       33
       +
       	dbURL := os.Getenv("DATABASE_URL")

     

       34
       34
       +
       	if dbURL == "" {

     

       35
       35
       +
       		dbURL = "postgres://dev_user:dev_password@localhost:5435/coves_dev?sslmode=disable"

     

       36
       36
       +
       	}

     

       37
       37
       +
       	pdsURL := os.Getenv("PDS_URL")

     

       38
       38
       +
       	if pdsURL == "" {

     

       39
       39
       +
       		pdsURL = "http://localhost:3001"

     

       40
       40
       +
       	}

     

       41
       41
       +
       

     

       42
       42
       +
       	log.Printf("Connecting to database...")

     

       43
       43
       +
       	db, err := sql.Open("postgres", dbURL)

     

       44
       44
       +
       	if err != nil {

     

       45
       45
       +
       		log.Fatalf("Failed to connect to database: %v", err)

     

       46
       46
       +
       	}

     

       47
       47
       +
       	defer db.Close()

     

       48
       48
       +
       

     

       49
       49
       +
       	ctx := context.Background()

     

       50
       50
       +
       

     

       51
       51
       +
       	// Get all accounts directly from the PDS

     

       52
       52
       +
       	log.Printf("Fetching accounts from PDS (%s)...", pdsURL)

     

       53
       53
       +
       	dids, err := fetchAllAccountsFromPDS(pdsURL)

     

       54
       54
       +
       	if err != nil {

     

       55
       55
       +
       		log.Fatalf("Failed to fetch accounts from PDS: %v", err)

     

       56
       56
       +
       	}

     

       57
       57
       +
       	log.Printf("Found %d accounts on PDS to check for votes", len(dids))

     

       58
       58
       +
       

     

       59
       59
       +
       	// Reset vote counts first

     

       60
       60
       +
       	log.Printf("Resetting all vote counts...")

     

       61
       61
       +
       	if _, err := db.ExecContext(ctx, "DELETE FROM votes"); err != nil {

     

       62
       62
       +
       		log.Fatalf("Failed to clear votes table: %v", err)

     

       63
       63
       +
       	}

     

       64
       64
       +
       	if _, err := db.ExecContext(ctx, "UPDATE posts SET upvote_count = 0, downvote_count = 0, score = 0"); err != nil {

     

       65
       65
       +
       		log.Fatalf("Failed to reset post vote counts: %v", err)

     

       66
       66
       +
       	}

     

       67
       67
       +
       	if _, err := db.ExecContext(ctx, "UPDATE comments SET upvote_count = 0, downvote_count = 0, score = 0"); err != nil {

     

       68
       68
       +
       		log.Fatalf("Failed to reset comment vote counts: %v", err)

     

       69
       69
       +
       	}

     

       70
       70
       +
       

     

       71
       71
       +
       	// For each user, fetch their votes from PDS

     

       72
       72
       +
       	totalVotes := 0

     

       73
       73
       +
       	for _, did := range dids {

     

       74
       74
       +
       		votes, err := fetchVotesFromPDS(pdsURL, did)

     

       75
       75
       +
       		if err != nil {

     

       76
       76
       +
       			log.Printf("Warning: failed to fetch votes for %s: %v", did, err)

     

       77
       77
       +
       			continue

     

       78
       78
       +
       		}

     

       79
       79
       +
       

     

       80
       80
       +
       		if len(votes) == 0 {

     

       81
       81
       +
       			continue

     

       82
       82
       +
       		}

     

       83
       83
       +
       

     

       84
       84
       +
       		log.Printf("Found %d votes for %s", len(votes), did)

     

       85
       85
       +
       

     

       86
       86
       +
       		// Index each vote

     

       87
       87
       +
       		for _, vote := range votes {

     

       88
       88
       +
       			if err := indexVote(ctx, db, did, vote); err != nil {

     

       89
       89
       +
       				log.Printf("Warning: failed to index vote %s: %v", vote.URI, err)

     

       90
       90
       +
       				continue

     

       91
       91
       +
       			}

     

       92
       92
       +
       			totalVotes++

     

       93
       93
       +
       		}

     

       94
       94
       +
       	}

     

       95
       95
       +
       

     

       96
       96
       +
       	log.Printf("✓ Reindexed %d votes from PDS", totalVotes)

     

       97
       97
       +
       }

     

       98
       98
       +
       

     

       99
       99
       +
       // fetchAllAccountsFromPDS queries the PDS sync API to get all repo DIDs

     

       100
       100
       +
       func fetchAllAccountsFromPDS(pdsURL string) ([]string, error) {

     

       101
       101
       +
       	// Use com.atproto.sync.listRepos to get all repos on this PDS

     

       102
       102
       +
       	var allDIDs []string

     

       103
       103
       +
       	cursor := ""

     

       104
       104
       +
       

     

       105
       105
       +
       	for {

     

       106
       106
       +
       		reqURL := fmt.Sprintf("%s/xrpc/com.atproto.sync.listRepos?limit=100", pdsURL)

     

       107
       107
       +
       		if cursor != "" {

     

       108
       108
       +
       			reqURL += "&cursor=" + url.QueryEscape(cursor)

     

       109
       109
       +
       		}

     

       110
       110
       +
       

     

       111
       111
       +
       		resp, err := http.Get(reqURL)

     

       112
       112
       +
       		if err != nil {

     

       113
       113
       +
       			return nil, fmt.Errorf("HTTP request failed: %w", err)

     

       114
       114
       +
       		}

     

       115
       115
       +
       		defer resp.Body.Close()

     

       116
       116
       +
       

     

       117
       117
       +
       		if resp.StatusCode != 200 {

     

       118
       118
       +
       			return nil, fmt.Errorf("unexpected status code: %d", resp.StatusCode)

     

       119
       119
       +
       		}

     

       120
       120
       +
       

     

       121
       121
       +
       		var result struct {

     

       122
       122
       +
       			Repos []struct {

     

       123
       123
       +
       				DID string `json:"did"`

     

       124
       124
       +
       			} `json:"repos"`

     

       125
       125
       +
       			Cursor string `json:"cursor"`

     

       126
       126
       +
       		}

     

       127
       127
       +
       		if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {

     

       128
       128
       +
       			return nil, fmt.Errorf("failed to decode response: %w", err)

     

       129
       129
       +
       		}

     

       130
       130
       +
       

     

       131
       131
       +
       		for _, repo := range result.Repos {

     

       132
       132
       +
       			allDIDs = append(allDIDs, repo.DID)

     

       133
       133
       +
       		}

     

       134
       134
       +
       

     

       135
       135
       +
       		if result.Cursor == "" {

     

       136
       136
       +
       			break

     

       137
       137
       +
       		}

     

       138
       138
       +
       		cursor = result.Cursor

     

       139
       139
       +
       	}

     

       140
       140
       +
       

     

       141
       141
       +
       	return allDIDs, nil

     

       142
       142
       +
       }

     

       143
       143
       +
       

     

       144
       144
       +
       func fetchVotesFromPDS(pdsURL, did string) ([]Record, error) {

     

       145
       145
       +
       	var allRecords []Record

     

       146
       146
       +
       	cursor := ""

     

       147
       147
       +
       	collection := "social.coves.feed.vote"

     

       148
       148
       +
       

     

       149
       149
       +
       	for {

     

       150
       150
       +
       		reqURL := fmt.Sprintf("%s/xrpc/com.atproto.repo.listRecords?repo=%s&collection=%s&limit=100",

     

       151
       151
       +
       			pdsURL, url.QueryEscape(did), url.QueryEscape(collection))

     

       152
       152
       +
       		if cursor != "" {

     

       153
       153
       +
       			reqURL += "&cursor=" + url.QueryEscape(cursor)

     

       154
       154
       +
       		}

     

       155
       155
       +
       

     

       156
       156
       +
       		resp, err := http.Get(reqURL)

     

       157
       157
       +
       		if err != nil {

     

       158
       158
       +
       			return nil, fmt.Errorf("HTTP request failed: %w", err)

     

       159
       159
       +
       		}

     

       160
       160
       +
       		defer resp.Body.Close()

     

       161
       161
       +
       

     

       162
       162
       +
       		if resp.StatusCode == 400 {

     

       163
       163
       +
       			// User doesn't exist on this PDS or has no records - that's OK

     

       164
       164
       +
       			return nil, nil

     

       165
       165
       +
       		}

     

       166
       166
       +
       		if resp.StatusCode != 200 {

     

       167
       167
       +
       			return nil, fmt.Errorf("unexpected status code: %d", resp.StatusCode)

     

       168
       168
       +
       		}

     

       169
       169
       +
       

     

       170
       170
       +
       		var result ListRecordsResponse

     

       171
       171
       +
       		if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {

     

       172
       172
       +
       			return nil, fmt.Errorf("failed to decode response: %w", err)

     

       173
       173
       +
       		}

     

       174
       174
       +
       

     

       175
       175
       +
       		allRecords = append(allRecords, result.Records...)

     

       176
       176
       +
       

     

       177
       177
       +
       		if result.Cursor == "" {

     

       178
       178
       +
       			break

     

       179
       179
       +
       		}

     

       180
       180
       +
       		cursor = result.Cursor

     

       181
       181
       +
       	}

     

       182
       182
       +
       

     

       183
       183
       +
       	return allRecords, nil

     

       184
       184
       +
       }

     

       185
       185
       +
       

     

       186
       186
       +
       func indexVote(ctx context.Context, db *sql.DB, voterDID string, record Record) error {

     

       187
       187
       +
       	// Extract vote data from record

     

       188
       188
       +
       	subject, ok := record.Value["subject"].(map[string]interface{})

     

       189
       189
       +
       	if !ok {

     

       190
       190
       +
       		return fmt.Errorf("missing subject")

     

       191
       191
       +
       	}

     

       192
       192
       +
       	subjectURI, _ := subject["uri"].(string)

     

       193
       193
       +
       	subjectCID, _ := subject["cid"].(string)

     

       194
       194
       +
       	direction, _ := record.Value["direction"].(string)

     

       195
       195
       +
       	createdAtStr, _ := record.Value["createdAt"].(string)

     

       196
       196
       +
       

     

       197
       197
       +
       	if subjectURI == "" || direction == "" {

     

       198
       198
       +
       		return fmt.Errorf("invalid vote record: missing required fields")

     

       199
       199
       +
       	}

     

       200
       200
       +
       

     

       201
       201
       +
       	// Parse created_at

     

       202
       202
       +
       	createdAt, err := time.Parse(time.RFC3339, createdAtStr)

     

       203
       203
       +
       	if err != nil {

     

       204
       204
       +
       		createdAt = time.Now()

     

       205
       205
       +
       	}

     

       206
       206
       +
       

     

       207
       207
       +
       	// Extract rkey from URI (at://did/collection/rkey)

     

       208
       208
       +
       	parts := strings.Split(record.URI, "/")

     

       209
       209
       +
       	if len(parts) < 5 {

     

       210
       210
       +
       		return fmt.Errorf("invalid URI format: %s", record.URI)

     

       211
       211
       +
       	}

     

       212
       212
       +
       	rkey := parts[len(parts)-1]

     

       213
       213
       +
       

     

       214
       214
       +
       	// Start transaction

     

       215
       215
       +
       	tx, err := db.BeginTx(ctx, nil)

     

       216
       216
       +
       	if err != nil {

     

       217
       217
       +
       		return fmt.Errorf("failed to begin transaction: %w", err)

     

       218
       218
       +
       	}

     

       219
       219
       +
       	defer tx.Rollback()

     

       220
       220
       +
       

     

       221
       221
       +
       	// Insert vote

     

       222
       222
       +
       	_, err = tx.ExecContext(ctx, `

     

       223
       223
       +
       		INSERT INTO votes (uri, cid, rkey, voter_did, subject_uri, subject_cid, direction, created_at, indexed_at)

     

       224
       224
       +
       		VALUES ($1, $2, $3, $4, $5, $6, $7, $8, NOW())

     

       225
       225
       +
       		ON CONFLICT (uri) DO NOTHING

     

       226
       226
       +
       	`, record.URI, record.CID, rkey, voterDID, subjectURI, subjectCID, direction, createdAt)

     

       227
       227
       +
       	if err != nil {

     

       228
       228
       +
       		return fmt.Errorf("failed to insert vote: %w", err)

     

       229
       229
       +
       	}

     

       230
       230
       +
       

     

       231
       231
       +
       	// Update post/comment counts

     

       232
       232
       +
       	collection := extractCollectionFromURI(subjectURI)

     

       233
       233
       +
       	var updateQuery string

     

       234
       234
       +
       

     

       235
       235
       +
       	switch collection {

     

       236
       236
       +
       	case "social.coves.community.post":

     

       237
       237
       +
       		if direction == "up" {

     

       238
       238
       +
       			updateQuery = `UPDATE posts SET upvote_count = upvote_count + 1, score = upvote_count + 1 - downvote_count WHERE uri = $1 AND deleted_at IS NULL`

     

       239
       239
       +
       		} else {

     

       240
       240
       +
       			updateQuery = `UPDATE posts SET downvote_count = downvote_count + 1, score = upvote_count - (downvote_count + 1) WHERE uri = $1 AND deleted_at IS NULL`

     

       241
       241
       +
       		}

     

       242
       242
       +
       	case "social.coves.community.comment":

     

       243
       243
       +
       		if direction == "up" {

     

       244
       244
       +
       			updateQuery = `UPDATE comments SET upvote_count = upvote_count + 1, score = upvote_count + 1 - downvote_count WHERE uri = $1 AND deleted_at IS NULL`

     

       245
       245
       +
       		} else {

     

       246
       246
       +
       			updateQuery = `UPDATE comments SET downvote_count = downvote_count + 1, score = upvote_count - (downvote_count + 1) WHERE uri = $1 AND deleted_at IS NULL`

     

       247
       247
       +
       		}

     

       248
       248
       +
       	default:

     

       249
       249
       +
       		// Unknown collection, just index the vote

     

       250
       250
       +
       		return tx.Commit()

     

       251
       251
       +
       	}

     

       252
       252
       +
       

     

       253
       253
       +
       	if _, err := tx.ExecContext(ctx, updateQuery, subjectURI); err != nil {

     

       254
       254
       +
       		return fmt.Errorf("failed to update vote counts: %w", err)

     

       255
       255
       +
       	}

     

       256
       256
       +
       

     

       257
       257
       +
       	return tx.Commit()

     

       258
       258
       +
       }

     

       259
       259
       +
       

     

       260
       260
       +
       func extractCollectionFromURI(uri string) string {

     

       261
       261
       +
       	// at://did:plc:xxx/social.coves.community.post/rkey

     

       262
       262
       +
       	parts := strings.Split(uri, "/")

     

       263
       263
       +
       	if len(parts) >= 4 {

     

       264
       264
       +
       		return parts[3]

     

       265
       265
       +
       	}

     

       266
       266
       +
       	return ""

     

       267
       267
       +
       }

+7 -5

internal/api/routes/communityFeed.go

···

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
        
       	"Coves/internal/api/handlers/communityFeed"

     

       5
       5
       +
       	"Coves/internal/api/middleware"

     

       5
       6
        
       	"Coves/internal/core/communityFeeds"

     

       7
       7
       +
       	"Coves/internal/core/votes"

     

       6
       8
        
       

     

       7
       9
        
       	"github.com/go-chi/chi/v5"

     

       8
       10
        
       )

     
···

       11
       13
        
       func RegisterCommunityFeedRoutes(

     

       12
       14
        
       	r chi.Router,

     

       13
       15
        
       	feedService communityFeeds.Service,

     

       16
       16
       +
       	voteService votes.Service,

     

       17
       17
       +
       	authMiddleware *middleware.OAuthAuthMiddleware,

     

       14
       18
        
       ) {

     

       15
       19
        
       	// Create handlers

     

       16
       16
       -
       	getCommunityHandler := communityFeed.NewGetCommunityHandler(feedService)

     

       20
       20
       +
       	getCommunityHandler := communityFeed.NewGetCommunityHandler(feedService, voteService)

     

       17
       21
        
       

     

       18
       22
        
       	// GET /xrpc/social.coves.communityFeed.getCommunity

     

       19
       19
       -
       	// Public endpoint - basic community sorting only for Alpha

     

       20
       20
       -
       	// TODO(feed-generator): Add OptionalAuth middleware when implementing viewer-specific state

     

       21
       21
       -
       	//                       (blocks, upvotes, saves, etc.) in feed generator skeleton

     

       22
       22
       -
       	r.Get("/xrpc/social.coves.communityFeed.getCommunity", getCommunityHandler.HandleGetCommunity)

     

       23
       23
       +
       	// Public endpoint with optional auth for viewer-specific state (vote state)

     

       24
       24
       +
       	r.With(authMiddleware.OptionalAuth).Get("/xrpc/social.coves.communityFeed.getCommunity", getCommunityHandler.HandleGetCommunity)

     

       23
       25
        
       }

+3 -1

internal/api/routes/timeline.go

···

       4
       4
        
       	"Coves/internal/api/handlers/timeline"

     

       5
       5
        
       	"Coves/internal/api/middleware"

     

       6
       6
        
       	timelineCore "Coves/internal/core/timeline"

     

       7
       7
       +
       	"Coves/internal/core/votes"

     

       7
       8
        
       

     

       8
       9
        
       	"github.com/go-chi/chi/v5"

     

       9
       10
        
       )

     
···

       12
       13
        
       func RegisterTimelineRoutes(

     

       13
       14
        
       	r chi.Router,

     

       14
       15
        
       	timelineService timelineCore.Service,

     

       16
       16
       +
       	voteService votes.Service,

     

       15
       17
        
       	authMiddleware *middleware.OAuthAuthMiddleware,

     

       16
       18
        
       ) {

     

       17
       19
        
       	// Create handlers

     

       18
       18
       -
       	getTimelineHandler := timeline.NewGetTimelineHandler(timelineService)

     

       20
       20
       +
       	getTimelineHandler := timeline.NewGetTimelineHandler(timelineService, voteService)

     

       19
       21
        
       

     

       20
       22
        
       	// GET /xrpc/social.coves.feed.getTimeline

     

       21
       23
        
       	// Requires authentication - user must be logged in to see their timeline

+221

internal/core/votes/cache.go

···

       1
       1
       +
       package votes

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"fmt"

     

       6
       6
       +
       	"log/slog"

     

       7
       7
       +
       	"strings"

     

       8
       8
       +
       	"sync"

     

       9
       9
       +
       	"time"

     

       10
       10
       +
       

     

       11
       11
       +
       	"Coves/internal/atproto/pds"

     

       12
       12
       +
       )

     

       13
       13
       +
       

     

       14
       14
       +
       // CachedVote represents a vote stored in the cache

     

       15
       15
       +
       type CachedVote struct {

     

       16
       16
       +
       	Direction string // "up" or "down"

     

       17
       17
       +
       	URI       string // vote record URI (at://did/collection/rkey)

     

       18
       18
       +
       	RKey      string // record key

     

       19
       19
       +
       }

     

       20
       20
       +
       

     

       21
       21
       +
       // VoteCache provides an in-memory cache of user votes fetched from their PDS.

     

       22
       22
       +
       // This avoids eventual consistency issues with the AppView database.

     

       23
       23
       +
       type VoteCache struct {

     

       24
       24
       +
       	mu     sync.RWMutex

     

       25
       25
       +
       	votes  map[string]map[string]*CachedVote // userDID -> subjectURI -> vote

     

       26
       26
       +
       	expiry map[string]time.Time              // userDID -> expiry time

     

       27
       27
       +
       	ttl    time.Duration

     

       28
       28
       +
       	logger *slog.Logger

     

       29
       29
       +
       }

     

       30
       30
       +
       

     

       31
       31
       +
       // NewVoteCache creates a new vote cache with the specified TTL

     

       32
       32
       +
       func NewVoteCache(ttl time.Duration, logger *slog.Logger) *VoteCache {

     

       33
       33
       +
       	if logger == nil {

     

       34
       34
       +
       		logger = slog.Default()

     

       35
       35
       +
       	}

     

       36
       36
       +
       	return &VoteCache{

     

       37
       37
       +
       		votes:  make(map[string]map[string]*CachedVote),

     

       38
       38
       +
       		expiry: make(map[string]time.Time),

     

       39
       39
       +
       		ttl:    ttl,

     

       40
       40
       +
       		logger: logger,

     

       41
       41
       +
       	}

     

       42
       42
       +
       }

     

       43
       43
       +
       

     

       44
       44
       +
       // GetVotesForUser returns all cached votes for a user.

     

       45
       45
       +
       // Returns nil if cache is empty or expired for this user.

     

       46
       46
       +
       func (c *VoteCache) GetVotesForUser(userDID string) map[string]*CachedVote {

     

       47
       47
       +
       	c.mu.RLock()

     

       48
       48
       +
       	defer c.mu.RUnlock()

     

       49
       49
       +
       

     

       50
       50
       +
       	// Check if cache exists and is not expired

     

       51
       51
       +
       	expiry, exists := c.expiry[userDID]

     

       52
       52
       +
       	if !exists || time.Now().After(expiry) {

     

       53
       53
       +
       		return nil

     

       54
       54
       +
       	}

     

       55
       55
       +
       

     

       56
       56
       +
       	return c.votes[userDID]

     

       57
       57
       +
       }

     

       58
       58
       +
       

     

       59
       59
       +
       // GetVote returns the cached vote for a specific subject, or nil if not found/expired

     

       60
       60
       +
       func (c *VoteCache) GetVote(userDID, subjectURI string) *CachedVote {

     

       61
       61
       +
       	votes := c.GetVotesForUser(userDID)

     

       62
       62
       +
       	if votes == nil {

     

       63
       63
       +
       		return nil

     

       64
       64
       +
       	}

     

       65
       65
       +
       	return votes[subjectURI]

     

       66
       66
       +
       }

     

       67
       67
       +
       

     

       68
       68
       +
       // IsCached returns true if the user's votes are cached and not expired

     

       69
       69
       +
       func (c *VoteCache) IsCached(userDID string) bool {

     

       70
       70
       +
       	c.mu.RLock()

     

       71
       71
       +
       	defer c.mu.RUnlock()

     

       72
       72
       +
       

     

       73
       73
       +
       	expiry, exists := c.expiry[userDID]

     

       74
       74
       +
       	return exists && time.Now().Before(expiry)

     

       75
       75
       +
       }

     

       76
       76
       +
       

     

       77
       77
       +
       // SetVotesForUser replaces all cached votes for a user

     

       78
       78
       +
       func (c *VoteCache) SetVotesForUser(userDID string, votes map[string]*CachedVote) {

     

       79
       79
       +
       	c.mu.Lock()

     

       80
       80
       +
       	defer c.mu.Unlock()

     

       81
       81
       +
       

     

       82
       82
       +
       	c.votes[userDID] = votes

     

       83
       83
       +
       	c.expiry[userDID] = time.Now().Add(c.ttl)

     

       84
       84
       +
       

     

       85
       85
       +
       	c.logger.Debug("vote cache updated",

     

       86
       86
       +
       		"user", userDID,

     

       87
       87
       +
       		"vote_count", len(votes),

     

       88
       88
       +
       		"expires_at", c.expiry[userDID])

     

       89
       89
       +
       }

     

       90
       90
       +
       

     

       91
       91
       +
       // SetVote adds or updates a single vote in the cache

     

       92
       92
       +
       func (c *VoteCache) SetVote(userDID, subjectURI string, vote *CachedVote) {

     

       93
       93
       +
       	c.mu.Lock()

     

       94
       94
       +
       	defer c.mu.Unlock()

     

       95
       95
       +
       

     

       96
       96
       +
       	if c.votes[userDID] == nil {

     

       97
       97
       +
       		c.votes[userDID] = make(map[string]*CachedVote)

     

       98
       98
       +
       	}

     

       99
       99
       +
       

     

       100
       100
       +
       	c.votes[userDID][subjectURI] = vote

     

       101
       101
       +
       

     

       102
       102
       +
       	// Always extend expiry on vote action - active users keep their cache fresh

     

       103
       103
       +
       	c.expiry[userDID] = time.Now().Add(c.ttl)

     

       104
       104
       +
       

     

       105
       105
       +
       	c.logger.Debug("vote cached",

     

       106
       106
       +
       		"user", userDID,

     

       107
       107
       +
       		"subject", subjectURI,

     

       108
       108
       +
       		"direction", vote.Direction)

     

       109
       109
       +
       }

     

       110
       110
       +
       

     

       111
       111
       +
       // RemoveVote removes a vote from the cache (for toggle-off)

     

       112
       112
       +
       func (c *VoteCache) RemoveVote(userDID, subjectURI string) {

     

       113
       113
       +
       	c.mu.Lock()

     

       114
       114
       +
       	defer c.mu.Unlock()

     

       115
       115
       +
       

     

       116
       116
       +
       	if c.votes[userDID] != nil {

     

       117
       117
       +
       		delete(c.votes[userDID], subjectURI)

     

       118
       118
       +
       

     

       119
       119
       +
       		// Extend expiry on vote action - active users keep their cache fresh

     

       120
       120
       +
       		c.expiry[userDID] = time.Now().Add(c.ttl)

     

       121
       121
       +
       

     

       122
       122
       +
       		c.logger.Debug("vote removed from cache",

     

       123
       123
       +
       			"user", userDID,

     

       124
       124
       +
       			"subject", subjectURI)

     

       125
       125
       +
       	}

     

       126
       126
       +
       }

     

       127
       127
       +
       

     

       128
       128
       +
       // Invalidate removes all cached votes for a user

     

       129
       129
       +
       func (c *VoteCache) Invalidate(userDID string) {

     

       130
       130
       +
       	c.mu.Lock()

     

       131
       131
       +
       	defer c.mu.Unlock()

     

       132
       132
       +
       

     

       133
       133
       +
       	delete(c.votes, userDID)

     

       134
       134
       +
       	delete(c.expiry, userDID)

     

       135
       135
       +
       

     

       136
       136
       +
       	c.logger.Debug("vote cache invalidated", "user", userDID)

     

       137
       137
       +
       }

     

       138
       138
       +
       

     

       139
       139
       +
       // FetchAndCacheFromPDS fetches all votes from the user's PDS and caches them.

     

       140
       140
       +
       // This should be called on first authenticated request or when cache is expired.

     

       141
       141
       +
       func (c *VoteCache) FetchAndCacheFromPDS(ctx context.Context, pdsClient pds.Client) error {

     

       142
       142
       +
       	userDID := pdsClient.DID()

     

       143
       143
       +
       

     

       144
       144
       +
       	c.logger.Debug("fetching votes from PDS",

     

       145
       145
       +
       		"user", userDID,

     

       146
       146
       +
       		"pds", pdsClient.HostURL())

     

       147
       147
       +
       

     

       148
       148
       +
       	votes, err := c.fetchAllVotesFromPDS(ctx, pdsClient)

     

       149
       149
       +
       	if err != nil {

     

       150
       150
       +
       		return fmt.Errorf("failed to fetch votes from PDS: %w", err)

     

       151
       151
       +
       	}

     

       152
       152
       +
       

     

       153
       153
       +
       	c.SetVotesForUser(userDID, votes)

     

       154
       154
       +
       

     

       155
       155
       +
       	c.logger.Info("vote cache populated from PDS",

     

       156
       156
       +
       		"user", userDID,

     

       157
       157
       +
       		"vote_count", len(votes))

     

       158
       158
       +
       

     

       159
       159
       +
       	return nil

     

       160
       160
       +
       }

     

       161
       161
       +
       

     

       162
       162
       +
       // fetchAllVotesFromPDS paginates through all vote records on the user's PDS

     

       163
       163
       +
       func (c *VoteCache) fetchAllVotesFromPDS(ctx context.Context, pdsClient pds.Client) (map[string]*CachedVote, error) {

     

       164
       164
       +
       	votes := make(map[string]*CachedVote)

     

       165
       165
       +
       	cursor := ""

     

       166
       166
       +
       	const pageSize = 100

     

       167
       167
       +
       	const collection = "social.coves.feed.vote"

     

       168
       168
       +
       

     

       169
       169
       +
       	for {

     

       170
       170
       +
       		result, err := pdsClient.ListRecords(ctx, collection, pageSize, cursor)

     

       171
       171
       +
       		if err != nil {

     

       172
       172
       +
       			if pds.IsAuthError(err) {

     

       173
       173
       +
       				return nil, ErrNotAuthorized

     

       174
       174
       +
       			}

     

       175
       175
       +
       			return nil, fmt.Errorf("listRecords failed: %w", err)

     

       176
       176
       +
       		}

     

       177
       177
       +
       

     

       178
       178
       +
       		for _, rec := range result.Records {

     

       179
       179
       +
       			// Extract subject from record value

     

       180
       180
       +
       			subject, ok := rec.Value["subject"].(map[string]any)

     

       181
       181
       +
       			if !ok {

     

       182
       182
       +
       				continue

     

       183
       183
       +
       			}

     

       184
       184
       +
       

     

       185
       185
       +
       			subjectURI, ok := subject["uri"].(string)

     

       186
       186
       +
       			if !ok || subjectURI == "" {

     

       187
       187
       +
       				continue

     

       188
       188
       +
       			}

     

       189
       189
       +
       

     

       190
       190
       +
       			direction, _ := rec.Value["direction"].(string)

     

       191
       191
       +
       			if direction == "" {

     

       192
       192
       +
       				continue

     

       193
       193
       +
       			}

     

       194
       194
       +
       

     

       195
       195
       +
       			// Extract rkey from URI

     

       196
       196
       +
       			rkey := extractRKeyFromURI(rec.URI)

     

       197
       197
       +
       

     

       198
       198
       +
       			votes[subjectURI] = &CachedVote{

     

       199
       199
       +
       				Direction: direction,

     

       200
       200
       +
       				URI:       rec.URI,

     

       201
       201
       +
       				RKey:      rkey,

     

       202
       202
       +
       			}

     

       203
       203
       +
       		}

     

       204
       204
       +
       

     

       205
       205
       +
       		if result.Cursor == "" {

     

       206
       206
       +
       			break

     

       207
       207
       +
       		}

     

       208
       208
       +
       		cursor = result.Cursor

     

       209
       209
       +
       	}

     

       210
       210
       +
       

     

       211
       211
       +
       	return votes, nil

     

       212
       212
       +
       }

     

       213
       213
       +
       

     

       214
       214
       +
       // extractRKeyFromURI extracts the rkey from an AT-URI (at://did/collection/rkey)

     

       215
       215
       +
       func extractRKeyFromURI(uri string) string {

     

       216
       216
       +
       	parts := strings.Split(uri, "/")

     

       217
       217
       +
       	if len(parts) >= 5 {

     

       218
       218
       +
       		return parts[len(parts)-1]

     

       219
       219
       +
       	}

     

       220
       220
       +
       	return ""

     

       221
       221
       +
       }

+14

internal/core/votes/service.go

···

       44
       44
        
       	// - Deletes the user's vote record from their PDS

     

       45
       45
        
       	// - AppView will soft-delete via Jetstream consumer

     

       46
       46
        
       	DeleteVote(ctx context.Context, session *oauthlib.ClientSessionData, req DeleteVoteRequest) error

     

       47
       47
       +
       

     

       48
       48
       +
       	// EnsureCachePopulated fetches the user's votes from their PDS if not already cached.

     

       49
       49
       +
       	// This should be called before rendering feeds to ensure vote state is available.

     

       50
       50
       +
       	// If cache is already populated and not expired, this is a no-op.

     

       51
       51
       +
       	EnsureCachePopulated(ctx context.Context, session *oauthlib.ClientSessionData) error

     

       52
       52
       +
       

     

       53
       53
       +
       	// GetViewerVote returns the viewer's vote for a specific subject, or nil if not voted.

     

       54
       54
       +
       	// Returns from cache if available, otherwise returns nil (caller should ensure cache is populated).

     

       55
       55
       +
       	GetViewerVote(userDID, subjectURI string) *CachedVote

     

       56
       56
       +
       

     

       57
       57
       +
       	// GetViewerVotesForSubjects returns the viewer's votes for multiple subjects.

     

       58
       58
       +
       	// Returns a map of subjectURI -> CachedVote for subjects the user has voted on.

     

       59
       59
       +
       	// This is efficient for batch lookups when rendering feeds.

     

       60
       60
       +
       	GetViewerVotesForSubjects(userDID string, subjectURIs []string) map[string]*CachedVote

     

       47
       61
        
       }

     

       48
       62
        
       

     

       49
       63
        
       // CreateVoteRequest contains the parameters for creating a vote

+76 -16

internal/atproto/jetstream/vote_consumer.go

···

       99
       99
        
       	}

     

       100
       100
        
       

     

       101
       101
        
       	// Atomically: Index vote + Update post counts

     

       102
       102
       -
       	if err := c.indexVoteAndUpdateCounts(ctx, vote); err != nil {

     

       102
       102
       +
       	wasNew, err := c.indexVoteAndUpdateCounts(ctx, vote)

     

       103
       103
       +
       	if err != nil {

     

       103
       104
        
       		return fmt.Errorf("failed to index vote and update counts: %w", err)

     

       104
       105
        
       	}

     

       105
       106
        
       

     

       106
       106
       -
       	log.Printf("✓ Indexed vote: %s (%s on %s)", uri, vote.Direction, vote.SubjectURI)

     

       107
       107
       +
       	if wasNew {

     

       108
       108
       +
       		log.Printf("✓ Indexed vote: %s (%s on %s)", uri, vote.Direction, vote.SubjectURI)

     

       109
       109
       +
       	}

     

       107
       110
        
       	return nil

     

       108
       111
        
       }

     

       109
       112
        
       

     
···

       133
       136
        
       }

     

       134
       137
        
       

     

       135
       138
        
       // indexVoteAndUpdateCounts atomically indexes a vote and updates post vote counts

     

       136
       136
       -
       func (c *VoteEventConsumer) indexVoteAndUpdateCounts(ctx context.Context, vote *votes.Vote) error {

     

       139
       139
       +
       // Returns (true, nil) if vote was newly inserted, (false, nil) if already existed (idempotent)

     

       140
       140
       +
       func (c *VoteEventConsumer) indexVoteAndUpdateCounts(ctx context.Context, vote *votes.Vote) (bool, error) {

     

       137
       141
        
       	tx, err := c.db.BeginTx(ctx, nil)

     

       138
       142
        
       	if err != nil {

     

       139
       139
       -
       		return fmt.Errorf("failed to begin transaction: %w", err)

     

       143
       143
       +
       		return false, fmt.Errorf("failed to begin transaction: %w", err)

     

       140
       144
        
       	}

     

       141
       145
        
       	defer func() {

     

       142
       146
        
       		if rollbackErr := tx.Rollback(); rollbackErr != nil && rollbackErr != sql.ErrTxDone {

     
···

       144
       148
        
       		}

     

       145
       149
        
       	}()

     

       146
       150
        
       

     

       147
       147
       -
       	// 1. Index the vote (idempotent with ON CONFLICT DO NOTHING)

     

       151
       151
       +
       	// 1. Check for existing active vote with different URI (stale record)

     

       152
       152
       +
       	// This handles cases where:

     

       153
       153
       +
       	// - User voted on another client and we missed the delete event

     

       154
       154
       +
       	// - Vote was reindexed but user created a new vote with different rkey

     

       155
       155
       +
       	// - Any other state mismatch between PDS and AppView

     

       156
       156
       +
       	var existingDirection sql.NullString

     

       157
       157
       +
       	checkQuery := `

     

       158
       158
       +
       		SELECT direction FROM votes

     

       159
       159
       +
       		WHERE voter_did = $1

     

       160
       160
       +
       		  AND subject_uri = $2

     

       161
       161
       +
       		  AND deleted_at IS NULL

     

       162
       162
       +
       		  AND uri != $3

     

       163
       163
       +
       		LIMIT 1

     

       164
       164
       +
       	`

     

       165
       165
       +
       	if err := tx.QueryRowContext(ctx, checkQuery, vote.VoterDID, vote.SubjectURI, vote.URI).Scan(&existingDirection); err != nil && err != sql.ErrNoRows {

     

       166
       166
       +
       		return false, fmt.Errorf("failed to check existing vote: %w", err)

     

       167
       167
       +
       	}

     

       168
       168
       +
       

     

       169
       169
       +
       	// If there's a stale vote, soft-delete it and adjust counts

     

       170
       170
       +
       	if existingDirection.Valid {

     

       171
       171
       +
       		softDeleteQuery := `

     

       172
       172
       +
       			UPDATE votes

     

       173
       173
       +
       			SET deleted_at = NOW()

     

       174
       174
       +
       			WHERE voter_did = $1

     

       175
       175
       +
       			  AND subject_uri = $2

     

       176
       176
       +
       			  AND deleted_at IS NULL

     

       177
       177
       +
       			  AND uri != $3

     

       178
       178
       +
       		`

     

       179
       179
       +
       		if _, err := tx.ExecContext(ctx, softDeleteQuery, vote.VoterDID, vote.SubjectURI, vote.URI); err != nil {

     

       180
       180
       +
       			return false, fmt.Errorf("failed to soft-delete existing votes: %w", err)

     

       181
       181
       +
       		}

     

       182
       182
       +
       

     

       183
       183
       +
       		// Decrement the old vote's count (will be re-incremented below if same direction)

     

       184
       184
       +
       		collection := utils.ExtractCollectionFromURI(vote.SubjectURI)

     

       185
       185
       +
       		var decrementQuery string

     

       186
       186
       +
       		if existingDirection.String == "up" {

     

       187
       187
       +
       			if collection == "social.coves.community.post" {

     

       188
       188
       +
       				decrementQuery = `UPDATE posts SET upvote_count = GREATEST(0, upvote_count - 1), score = upvote_count - 1 - downvote_count WHERE uri = $1 AND deleted_at IS NULL`

     

       189
       189
       +
       			} else if collection == "social.coves.community.comment" {

     

       190
       190
       +
       				decrementQuery = `UPDATE comments SET upvote_count = GREATEST(0, upvote_count - 1), score = upvote_count - 1 - downvote_count WHERE uri = $1 AND deleted_at IS NULL`

     

       191
       191
       +
       			}

     

       192
       192
       +
       		} else {

     

       193
       193
       +
       			if collection == "social.coves.community.post" {

     

       194
       194
       +
       				decrementQuery = `UPDATE posts SET downvote_count = GREATEST(0, downvote_count - 1), score = upvote_count - (downvote_count - 1) WHERE uri = $1 AND deleted_at IS NULL`

     

       195
       195
       +
       			} else if collection == "social.coves.community.comment" {

     

       196
       196
       +
       				decrementQuery = `UPDATE comments SET downvote_count = GREATEST(0, downvote_count - 1), score = upvote_count - (downvote_count - 1) WHERE uri = $1 AND deleted_at IS NULL`

     

       197
       197
       +
       			}

     

       198
       198
       +
       		}

     

       199
       199
       +
       		if decrementQuery != "" {

     

       200
       200
       +
       			if _, err := tx.ExecContext(ctx, decrementQuery, vote.SubjectURI); err != nil {

     

       201
       201
       +
       				return false, fmt.Errorf("failed to decrement old vote count: %w", err)

     

       202
       202
       +
       			}

     

       203
       203
       +
       		}

     

       204
       204
       +
       		log.Printf("Cleaned up stale vote for %s on %s (was %s)", vote.VoterDID, vote.SubjectURI, existingDirection.String)

     

       205
       205
       +
       	}

     

       206
       206
       +
       

     

       207
       207
       +
       	// 2. Index the vote (idempotent with ON CONFLICT DO NOTHING)

     

       148
       208
        
       	query := `

     

       149
       209
        
       		INSERT INTO votes (

     

       150
       210
        
       			uri, cid, rkey, voter_did,

     
···

       169
       229
        
       

     

       170
       230
        
       	// If no rows returned, vote already exists (idempotent - OK for Jetstream replays)

     

       171
       231
        
       	if err == sql.ErrNoRows {

     

       172
       172
       -
       		log.Printf("Vote already indexed: %s (idempotent)", vote.URI)

     

       232
       232
       +
       		// Silently handle idempotent case - no log needed for replayed events

     

       173
       233
        
       		if commitErr := tx.Commit(); commitErr != nil {

     

       174
       174
       -
       			return fmt.Errorf("failed to commit transaction: %w", commitErr)

     

       234
       234
       +
       			return false, fmt.Errorf("failed to commit transaction: %w", commitErr)

     

       175
       235
        
       		}

     

       176
       176
       -
       		return nil

     

       236
       236
       +
       		return false, nil // Vote already existed

     

       177
       237
        
       	}

     

       178
       238
        
       

     

       179
       239
        
       	if err != nil {

     

       180
       180
       -
       		return fmt.Errorf("failed to insert vote: %w", err)

     

       240
       240
       +
       		return false, fmt.Errorf("failed to insert vote: %w", err)

     

       181
       241
        
       	}

     

       182
       242
        
       

     

       183
       183
       -
       	// 2. Update vote counts on the subject (post or comment)

     

       243
       243
       +
       	// 3. Update vote counts on the subject (post or comment)

     

       184
       244
        
       	// Parse collection from subject URI to determine target table

     

       185
       245
        
       	collection := utils.ExtractCollectionFromURI(vote.SubjectURI)

     

       186
       246
        
       

     
···

       227
       287
        
       		// Vote is still indexed in votes table, we just don't update denormalized counts

     

       228
       288
        
       		log.Printf("Vote subject has unsupported collection: %s (vote indexed, counts not updated)", collection)

     

       229
       289
        
       		if commitErr := tx.Commit(); commitErr != nil {

     

       230
       230
       -
       			return fmt.Errorf("failed to commit transaction: %w", commitErr)

     

       290
       290
       +
       			return false, fmt.Errorf("failed to commit transaction: %w", commitErr)

     

       231
       291
        
       		}

     

       232
       232
       -
       		return nil

     

       292
       292
       +
       		return true, nil // Vote was newly indexed

     

       233
       293
        
       	}

     

       234
       294
        
       

     

       235
       295
        
       	result, err := tx.ExecContext(ctx, updateQuery, vote.SubjectURI)

     

       236
       296
        
       	if err != nil {

     

       237
       237
       -
       		return fmt.Errorf("failed to update vote counts: %w", err)

     

       297
       297
       +
       		return false, fmt.Errorf("failed to update vote counts: %w", err)

     

       238
       298
        
       	}

     

       239
       299
        
       

     

       240
       300
        
       	rowsAffected, err := result.RowsAffected()

     

       241
       301
        
       	if err != nil {

     

       242
       242
       -
       		return fmt.Errorf("failed to check update result: %w", err)

     

       302
       302
       +
       		return false, fmt.Errorf("failed to check update result: %w", err)

     

       243
       303
        
       	}

     

       244
       304
        
       

     

       245
       305
        
       	// If subject doesn't exist or is deleted, that's OK (vote still indexed)

     
···

       249
       309
        
       

     

       250
       310
        
       	// Commit transaction

     

       251
       311
        
       	if err := tx.Commit(); err != nil {

     

       252
       252
       -
       		return fmt.Errorf("failed to commit transaction: %w", err)

     

       312
       312
       +
       		return false, fmt.Errorf("failed to commit transaction: %w", err)

     

       253
       313
        
       	}

     

       254
       314
        
       

     

       255
       255
       -
       	return nil

     

       315
       315
       +
       	return true, nil // Vote was newly indexed

     

       256
       316
        
       }

     

       257
       317
        
       

     

       258
       318
        
       // deleteVoteAndUpdateCounts atomically soft-deletes a vote and updates post vote counts

+109

internal/atproto/lexicon/social/coves/community/comment/create.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "lexicon": 1,

     

       3
       3
       +
         "id": "social.coves.community.comment.create",

     

       4
       4
       +
         "defs": {

     

       5
       5
       +
           "main": {

     

       6
       6
       +
             "type": "procedure",

     

       7
       7
       +
             "description": "Create a comment on a post or another comment. Comments support nested threading, rich text, embeds, and self-labeling.",

     

       8
       8
       +
             "input": {

     

       9
       9
       +
               "encoding": "application/json",

     

       10
       10
       +
               "schema": {

     

       11
       11
       +
                 "type": "object",

     

       12
       12
       +
                 "required": ["reply", "content"],

     

       13
       13
       +
                 "properties": {

     

       14
       14
       +
                   "reply": {

     

       15
       15
       +
                     "type": "object",

     

       16
       16
       +
                     "description": "References for maintaining thread structure. Root always points to the original post, parent points to the immediate parent (post or comment).",

     

       17
       17
       +
                     "required": ["root", "parent"],

     

       18
       18
       +
                     "properties": {

     

       19
       19
       +
                       "root": {

     

       20
       20
       +
                         "type": "ref",

     

       21
       21
       +
                         "ref": "com.atproto.repo.strongRef",

     

       22
       22
       +
                         "description": "Strong reference to the original post that started the thread"

     

       23
       23
       +
                       },

     

       24
       24
       +
                       "parent": {

     

       25
       25
       +
                         "type": "ref",

     

       26
       26
       +
                         "ref": "com.atproto.repo.strongRef",

     

       27
       27
       +
                         "description": "Strong reference to the immediate parent (post or comment) being replied to"

     

       28
       28
       +
                       }

     

       29
       29
       +
                     }

     

       30
       30
       +
                   },

     

       31
       31
       +
                   "content": {

     

       32
       32
       +
                     "type": "string",

     

       33
       33
       +
                     "maxGraphemes": 10000,

     

       34
       34
       +
                     "maxLength": 100000,

     

       35
       35
       +
                     "description": "Comment text content"

     

       36
       36
       +
                   },

     

       37
       37
       +
                   "facets": {

     

       38
       38
       +
                     "type": "array",

     

       39
       39
       +
                     "description": "Annotations for rich text (mentions, links, etc.)",

     

       40
       40
       +
                     "items": {

     

       41
       41
       +
                       "type": "ref",

     

       42
       42
       +
                       "ref": "social.coves.richtext.facet"

     

       43
       43
       +
                     }

     

       44
       44
       +
                   },

     

       45
       45
       +
                   "embed": {

     

       46
       46
       +
                     "type": "union",

     

       47
       47
       +
                     "description": "Embedded media or quoted posts",

     

       48
       48
       +
                     "refs": [

     

       49
       49
       +
                       "social.coves.embed.images",

     

       50
       50
       +
                       "social.coves.embed.post"

     

       51
       51
       +
                     ]

     

       52
       52
       +
                   },

     

       53
       53
       +
                   "langs": {

     

       54
       54
       +
                     "type": "array",

     

       55
       55
       +
                     "description": "Languages used in the comment content (ISO 639-1)",

     

       56
       56
       +
                     "maxLength": 3,

     

       57
       57
       +
                     "items": {

     

       58
       58
       +
                       "type": "string",

     

       59
       59
       +
                       "format": "language"

     

       60
       60
       +
                     }

     

       61
       61
       +
                   },

     

       62
       62
       +
                   "labels": {

     

       63
       63
       +
                     "type": "ref",

     

       64
       64
       +
                     "ref": "com.atproto.label.defs#selfLabels",

     

       65
       65
       +
                     "description": "Self-applied content labels"

     

       66
       66
       +
                   }

     

       67
       67
       +
                 }

     

       68
       68
       +
               }

     

       69
       69
       +
             },

     

       70
       70
       +
             "output": {

     

       71
       71
       +
               "encoding": "application/json",

     

       72
       72
       +
               "schema": {

     

       73
       73
       +
                 "type": "object",

     

       74
       74
       +
                 "required": ["uri", "cid"],

     

       75
       75
       +
                 "properties": {

     

       76
       76
       +
                   "uri": {

     

       77
       77
       +
                     "type": "string",

     

       78
       78
       +
                     "format": "at-uri",

     

       79
       79
       +
                     "description": "AT-URI of the created comment"

     

       80
       80
       +
                   },

     

       81
       81
       +
                   "cid": {

     

       82
       82
       +
                     "type": "string",

     

       83
       83
       +
                     "format": "cid",

     

       84
       84
       +
                     "description": "CID of the created comment record"

     

       85
       85
       +
                   }

     

       86
       86
       +
                 }

     

       87
       87
       +
               }

     

       88
       88
       +
             },

     

       89
       89
       +
             "errors": [

     

       90
       90
       +
               {

     

       91
       91
       +
                 "name": "InvalidReply",

     

       92
       92
       +
                 "description": "The reply reference is invalid, malformed, or refers to non-existent content"

     

       93
       93
       +
               },

     

       94
       94
       +
               {

     

       95
       95
       +
                 "name": "ContentTooLong",

     

       96
       96
       +
                 "description": "Comment content exceeds maximum length constraints"

     

       97
       97
       +
               },

     

       98
       98
       +
               {

     

       99
       99
       +
                 "name": "ContentEmpty",

     

       100
       100
       +
                 "description": "Comment content is empty or contains only whitespace"

     

       101
       101
       +
               },

     

       102
       102
       +
               {

     

       103
       103
       +
                 "name": "NotAuthorized",

     

       104
       104
       +
                 "description": "User is not authorized to create comments on this content"

     

       105
       105
       +
               }

     

       106
       106
       +
             ]

     

       107
       107
       +
           }

     

       108
       108
       +
         }

     

       109
       109
       +
       }

+41

internal/atproto/lexicon/social/coves/community/comment/delete.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "lexicon": 1,

     

       3
       3
       +
         "id": "social.coves.community.comment.delete",

     

       4
       4
       +
         "defs": {

     

       5
       5
       +
           "main": {

     

       6
       6
       +
             "type": "procedure",

     

       7
       7
       +
             "description": "Delete a comment. Only the comment author can delete their own comments.",

     

       8
       8
       +
             "input": {

     

       9
       9
       +
               "encoding": "application/json",

     

       10
       10
       +
               "schema": {

     

       11
       11
       +
                 "type": "object",

     

       12
       12
       +
                 "required": ["uri"],

     

       13
       13
       +
                 "properties": {

     

       14
       14
       +
                   "uri": {

     

       15
       15
       +
                     "type": "string",

     

       16
       16
       +
                     "format": "at-uri",

     

       17
       17
       +
                     "description": "AT-URI of the comment to delete"

     

       18
       18
       +
                   }

     

       19
       19
       +
                 }

     

       20
       20
       +
               }

     

       21
       21
       +
             },

     

       22
       22
       +
             "output": {

     

       23
       23
       +
               "encoding": "application/json",

     

       24
       24
       +
               "schema": {

     

       25
       25
       +
                 "type": "object",

     

       26
       26
       +
                 "properties": {}

     

       27
       27
       +
               }

     

       28
       28
       +
             },

     

       29
       29
       +
             "errors": [

     

       30
       30
       +
               {

     

       31
       31
       +
                 "name": "CommentNotFound",

     

       32
       32
       +
                 "description": "Comment with the specified URI does not exist"

     

       33
       33
       +
               },

     

       34
       34
       +
               {

     

       35
       35
       +
                 "name": "NotAuthorized",

     

       36
       36
       +
                 "description": "User is not authorized to delete this comment (not the author)"

     

       37
       37
       +
               }

     

       38
       38
       +
             ]

     

       39
       39
       +
           }

     

       40
       40
       +
         }

     

       41
       41
       +
       }

+97

internal/atproto/lexicon/social/coves/community/comment/update.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "lexicon": 1,

     

       3
       3
       +
         "id": "social.coves.community.comment.update",

     

       4
       4
       +
         "defs": {

     

       5
       5
       +
           "main": {

     

       6
       6
       +
             "type": "procedure",

     

       7
       7
       +
             "description": "Update an existing comment's content, facets, embed, languages, or labels. Threading references (reply.root and reply.parent) are immutable and cannot be changed.",

     

       8
       8
       +
             "input": {

     

       9
       9
       +
               "encoding": "application/json",

     

       10
       10
       +
               "schema": {

     

       11
       11
       +
                 "type": "object",

     

       12
       12
       +
                 "required": ["uri", "content"],

     

       13
       13
       +
                 "properties": {

     

       14
       14
       +
                   "uri": {

     

       15
       15
       +
                     "type": "string",

     

       16
       16
       +
                     "format": "at-uri",

     

       17
       17
       +
                     "description": "AT-URI of the comment to update"

     

       18
       18
       +
                   },

     

       19
       19
       +
                   "content": {

     

       20
       20
       +
                     "type": "string",

     

       21
       21
       +
                     "maxGraphemes": 10000,

     

       22
       22
       +
                     "maxLength": 100000,

     

       23
       23
       +
                     "description": "Updated comment text content"

     

       24
       24
       +
                   },

     

       25
       25
       +
                   "facets": {

     

       26
       26
       +
                     "type": "array",

     

       27
       27
       +
                     "description": "Updated annotations for rich text (mentions, links, etc.)",

     

       28
       28
       +
                     "items": {

     

       29
       29
       +
                       "type": "ref",

     

       30
       30
       +
                       "ref": "social.coves.richtext.facet"

     

       31
       31
       +
                     }

     

       32
       32
       +
                   },

     

       33
       33
       +
                   "embed": {

     

       34
       34
       +
                     "type": "union",

     

       35
       35
       +
                     "description": "Updated embedded media or quoted posts",

     

       36
       36
       +
                     "refs": [

     

       37
       37
       +
                       "social.coves.embed.images",

     

       38
       38
       +
                       "social.coves.embed.post"

     

       39
       39
       +
                     ]

     

       40
       40
       +
                   },

     

       41
       41
       +
                   "langs": {

     

       42
       42
       +
                     "type": "array",

     

       43
       43
       +
                     "description": "Updated languages used in the comment content (ISO 639-1)",

     

       44
       44
       +
                     "maxLength": 3,

     

       45
       45
       +
                     "items": {

     

       46
       46
       +
                       "type": "string",

     

       47
       47
       +
                       "format": "language"

     

       48
       48
       +
                     }

     

       49
       49
       +
                   },

     

       50
       50
       +
                   "labels": {

     

       51
       51
       +
                     "type": "ref",

     

       52
       52
       +
                     "ref": "com.atproto.label.defs#selfLabels",

     

       53
       53
       +
                     "description": "Updated self-applied content labels"

     

       54
       54
       +
                   }

     

       55
       55
       +
                 }

     

       56
       56
       +
               }

     

       57
       57
       +
             },

     

       58
       58
       +
             "output": {

     

       59
       59
       +
               "encoding": "application/json",

     

       60
       60
       +
               "schema": {

     

       61
       61
       +
                 "type": "object",

     

       62
       62
       +
                 "required": ["uri", "cid"],

     

       63
       63
       +
                 "properties": {

     

       64
       64
       +
                   "uri": {

     

       65
       65
       +
                     "type": "string",

     

       66
       66
       +
                     "format": "at-uri",

     

       67
       67
       +
                     "description": "AT-URI of the updated comment (unchanged from input)"

     

       68
       68
       +
                   },

     

       69
       69
       +
                   "cid": {

     

       70
       70
       +
                     "type": "string",

     

       71
       71
       +
                     "format": "cid",

     

       72
       72
       +
                     "description": "New CID of the updated comment record"

     

       73
       73
       +
                   }

     

       74
       74
       +
                 }

     

       75
       75
       +
               }

     

       76
       76
       +
             },

     

       77
       77
       +
             "errors": [

     

       78
       78
       +
               {

     

       79
       79
       +
                 "name": "CommentNotFound",

     

       80
       80
       +
                 "description": "Comment with the specified URI does not exist"

     

       81
       81
       +
               },

     

       82
       82
       +
               {

     

       83
       83
       +
                 "name": "ContentTooLong",

     

       84
       84
       +
                 "description": "Updated comment content exceeds maximum length constraints"

     

       85
       85
       +
               },

     

       86
       86
       +
               {

     

       87
       87
       +
                 "name": "ContentEmpty",

     

       88
       88
       +
                 "description": "Updated comment content is empty or contains only whitespace"

     

       89
       89
       +
               },

     

       90
       90
       +
               {

     

       91
       91
       +
                 "name": "NotAuthorized",

     

       92
       92
       +
                 "description": "User is not authorized to update this comment (not the author)"

     

       93
       93
       +
               }

     

       94
       94
       +
             ]

     

       95
       95
       +
           }

     

       96
       96
       +
         }

     

       97
       97
       +
       }

+38

internal/core/comments/types.go

···

       1
       1
       +
       package comments

     

       2
       2
       +
       

     

       3
       3
       +
       // CreateCommentRequest contains parameters for creating a comment

     

       4
       4
       +
       type CreateCommentRequest struct {

     

       5
       5
       +
       	Reply   ReplyRef      `json:"reply"`

     

       6
       6
       +
       	Content string        `json:"content"`

     

       7
       7
       +
       	Facets  []interface{} `json:"facets,omitempty"`

     

       8
       8
       +
       	Embed   interface{}   `json:"embed,omitempty"`

     

       9
       9
       +
       	Langs   []string      `json:"langs,omitempty"`

     

       10
       10
       +
       	Labels  *SelfLabels   `json:"labels,omitempty"`

     

       11
       11
       +
       }

     

       12
       12
       +
       

     

       13
       13
       +
       // CreateCommentResponse contains the result of creating a comment

     

       14
       14
       +
       type CreateCommentResponse struct {

     

       15
       15
       +
       	URI string `json:"uri"`

     

       16
       16
       +
       	CID string `json:"cid"`

     

       17
       17
       +
       }

     

       18
       18
       +
       

     

       19
       19
       +
       // UpdateCommentRequest contains parameters for updating a comment

     

       20
       20
       +
       type UpdateCommentRequest struct {

     

       21
       21
       +
       	URI     string        `json:"uri"`

     

       22
       22
       +
       	Content string        `json:"content"`

     

       23
       23
       +
       	Facets  []interface{} `json:"facets,omitempty"`

     

       24
       24
       +
       	Embed   interface{}   `json:"embed,omitempty"`

     

       25
       25
       +
       	Langs   []string      `json:"langs,omitempty"`

     

       26
       26
       +
       	Labels  *SelfLabels   `json:"labels,omitempty"`

     

       27
       27
       +
       }

     

       28
       28
       +
       

     

       29
       29
       +
       // UpdateCommentResponse contains the result of updating a comment

     

       30
       30
       +
       type UpdateCommentResponse struct {

     

       31
       31
       +
       	URI string `json:"uri"`

     

       32
       32
       +
       	CID string `json:"cid"`

     

       33
       33
       +
       }

     

       34
       34
       +
       

     

       35
       35
       +
       // DeleteCommentRequest contains parameters for deleting a comment

     

       36
       36
       +
       type DeleteCommentRequest struct {

     

       37
       37
       +
       	URI string `json:"uri"`

     

       38
       38
       +
       }

+130

internal/api/handlers/comments/create_comment.go

···

       1
       1
       +
       package comments

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"Coves/internal/api/middleware"

     

       5
       5
       +
       	"Coves/internal/core/comments"

     

       6
       6
       +
       	"encoding/json"

     

       7
       7
       +
       	"log"

     

       8
       8
       +
       	"net/http"

     

       9
       9
       +
       )

     

       10
       10
       +
       

     

       11
       11
       +
       // CreateCommentHandler handles comment creation requests

     

       12
       12
       +
       type CreateCommentHandler struct {

     

       13
       13
       +
       	service comments.Service

     

       14
       14
       +
       }

     

       15
       15
       +
       

     

       16
       16
       +
       // NewCreateCommentHandler creates a new handler for creating comments

     

       17
       17
       +
       func NewCreateCommentHandler(service comments.Service) *CreateCommentHandler {

     

       18
       18
       +
       	return &CreateCommentHandler{

     

       19
       19
       +
       		service: service,

     

       20
       20
       +
       	}

     

       21
       21
       +
       }

     

       22
       22
       +
       

     

       23
       23
       +
       // CreateCommentInput matches the lexicon input schema for social.coves.community.comment.create

     

       24
       24
       +
       type CreateCommentInput struct {

     

       25
       25
       +
       	Reply struct {

     

       26
       26
       +
       		Root struct {

     

       27
       27
       +
       			URI string `json:"uri"`

     

       28
       28
       +
       			CID string `json:"cid"`

     

       29
       29
       +
       		} `json:"root"`

     

       30
       30
       +
       		Parent struct {

     

       31
       31
       +
       			URI string `json:"uri"`

     

       32
       32
       +
       			CID string `json:"cid"`

     

       33
       33
       +
       		} `json:"parent"`

     

       34
       34
       +
       	} `json:"reply"`

     

       35
       35
       +
       	Content string        `json:"content"`

     

       36
       36
       +
       	Facets  []interface{} `json:"facets,omitempty"`

     

       37
       37
       +
       	Embed   interface{}   `json:"embed,omitempty"`

     

       38
       38
       +
       	Langs   []string      `json:"langs,omitempty"`

     

       39
       39
       +
       	Labels  interface{}   `json:"labels,omitempty"`

     

       40
       40
       +
       }

     

       41
       41
       +
       

     

       42
       42
       +
       // CreateCommentOutput matches the lexicon output schema

     

       43
       43
       +
       type CreateCommentOutput struct {

     

       44
       44
       +
       	URI string `json:"uri"`

     

       45
       45
       +
       	CID string `json:"cid"`

     

       46
       46
       +
       }

     

       47
       47
       +
       

     

       48
       48
       +
       // HandleCreate handles comment creation requests

     

       49
       49
       +
       // POST /xrpc/social.coves.community.comment.create

     

       50
       50
       +
       //

     

       51
       51
       +
       // Request body: { "reply": { "root": {...}, "parent": {...} }, "content": "..." }

     

       52
       52
       +
       // Response: { "uri": "at://...", "cid": "..." }

     

       53
       53
       +
       func (h *CreateCommentHandler) HandleCreate(w http.ResponseWriter, r *http.Request) {

     

       54
       54
       +
       	// 1. Check method is POST

     

       55
       55
       +
       	if r.Method != http.MethodPost {

     

       56
       56
       +
       		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)

     

       57
       57
       +
       		return

     

       58
       58
       +
       	}

     

       59
       59
       +
       

     

       60
       60
       +
       	// 2. Limit request body size to prevent DoS attacks (100KB should be plenty for comments)

     

       61
       61
       +
       	r.Body = http.MaxBytesReader(w, r.Body, 100*1024)

     

       62
       62
       +
       

     

       63
       63
       +
       	// 3. Parse JSON body into CreateCommentInput

     

       64
       64
       +
       	var input CreateCommentInput

     

       65
       65
       +
       	if err := json.NewDecoder(r.Body).Decode(&input); err != nil {

     

       66
       66
       +
       		writeError(w, http.StatusBadRequest, "InvalidRequest", "Invalid request body")

     

       67
       67
       +
       		return

     

       68
       68
       +
       	}

     

       69
       69
       +
       

     

       70
       70
       +
       	// 4. Get OAuth session from context (injected by auth middleware)

     

       71
       71
       +
       	session := middleware.GetOAuthSession(r)

     

       72
       72
       +
       	if session == nil {

     

       73
       73
       +
       		writeError(w, http.StatusUnauthorized, "AuthRequired", "Authentication required")

     

       74
       74
       +
       		return

     

       75
       75
       +
       	}

     

       76
       76
       +
       

     

       77
       77
       +
       	// 5. Convert labels interface{} to *comments.SelfLabels if provided

     

       78
       78
       +
       	var labels *comments.SelfLabels

     

       79
       79
       +
       	if input.Labels != nil {

     

       80
       80
       +
       		labelsJSON, err := json.Marshal(input.Labels)

     

       81
       81
       +
       		if err != nil {

     

       82
       82
       +
       			writeError(w, http.StatusBadRequest, "InvalidLabels", "Invalid labels format")

     

       83
       83
       +
       			return

     

       84
       84
       +
       		}

     

       85
       85
       +
       		var selfLabels comments.SelfLabels

     

       86
       86
       +
       		if err := json.Unmarshal(labelsJSON, &selfLabels); err != nil {

     

       87
       87
       +
       			writeError(w, http.StatusBadRequest, "InvalidLabels", "Invalid labels structure")

     

       88
       88
       +
       			return

     

       89
       89
       +
       		}

     

       90
       90
       +
       		labels = &selfLabels

     

       91
       91
       +
       	}

     

       92
       92
       +
       

     

       93
       93
       +
       	// 6. Convert input to CreateCommentRequest

     

       94
       94
       +
       	req := comments.CreateCommentRequest{

     

       95
       95
       +
       		Reply: comments.ReplyRef{

     

       96
       96
       +
       			Root: comments.StrongRef{

     

       97
       97
       +
       				URI: input.Reply.Root.URI,

     

       98
       98
       +
       				CID: input.Reply.Root.CID,

     

       99
       99
       +
       			},

     

       100
       100
       +
       			Parent: comments.StrongRef{

     

       101
       101
       +
       				URI: input.Reply.Parent.URI,

     

       102
       102
       +
       				CID: input.Reply.Parent.CID,

     

       103
       103
       +
       			},

     

       104
       104
       +
       		},

     

       105
       105
       +
       		Content: input.Content,

     

       106
       106
       +
       		Facets:  input.Facets,

     

       107
       107
       +
       		Embed:   input.Embed,

     

       108
       108
       +
       		Langs:   input.Langs,

     

       109
       109
       +
       		Labels:  labels,

     

       110
       110
       +
       	}

     

       111
       111
       +
       

     

       112
       112
       +
       	// 7. Call service to create comment

     

       113
       113
       +
       	response, err := h.service.CreateComment(r.Context(), session, req)

     

       114
       114
       +
       	if err != nil {

     

       115
       115
       +
       		handleServiceError(w, err)

     

       116
       116
       +
       		return

     

       117
       117
       +
       	}

     

       118
       118
       +
       

     

       119
       119
       +
       	// 8. Return JSON response with URI and CID

     

       120
       120
       +
       	output := CreateCommentOutput{

     

       121
       121
       +
       		URI: response.URI,

     

       122
       122
       +
       		CID: response.CID,

     

       123
       123
       +
       	}

     

       124
       124
       +
       

     

       125
       125
       +
       	w.Header().Set("Content-Type", "application/json")

     

       126
       126
       +
       	w.WriteHeader(http.StatusOK)

     

       127
       127
       +
       	if err := json.NewEncoder(w).Encode(output); err != nil {

     

       128
       128
       +
       		log.Printf("Failed to encode response: %v", err)

     

       129
       129
       +
       	}

     

       130
       130
       +
       }

+80

internal/api/handlers/comments/delete_comment.go

···

       1
       1
       +
       package comments

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"Coves/internal/api/middleware"

     

       5
       5
       +
       	"Coves/internal/core/comments"

     

       6
       6
       +
       	"encoding/json"

     

       7
       7
       +
       	"log"

     

       8
       8
       +
       	"net/http"

     

       9
       9
       +
       )

     

       10
       10
       +
       

     

       11
       11
       +
       // DeleteCommentHandler handles comment deletion requests

     

       12
       12
       +
       type DeleteCommentHandler struct {

     

       13
       13
       +
       	service comments.Service

     

       14
       14
       +
       }

     

       15
       15
       +
       

     

       16
       16
       +
       // NewDeleteCommentHandler creates a new handler for deleting comments

     

       17
       17
       +
       func NewDeleteCommentHandler(service comments.Service) *DeleteCommentHandler {

     

       18
       18
       +
       	return &DeleteCommentHandler{

     

       19
       19
       +
       		service: service,

     

       20
       20
       +
       	}

     

       21
       21
       +
       }

     

       22
       22
       +
       

     

       23
       23
       +
       // DeleteCommentInput matches the lexicon input schema for social.coves.community.comment.delete

     

       24
       24
       +
       type DeleteCommentInput struct {

     

       25
       25
       +
       	URI string `json:"uri"`

     

       26
       26
       +
       }

     

       27
       27
       +
       

     

       28
       28
       +
       // DeleteCommentOutput is empty per lexicon specification

     

       29
       29
       +
       type DeleteCommentOutput struct{}

     

       30
       30
       +
       

     

       31
       31
       +
       // HandleDelete handles comment deletion requests

     

       32
       32
       +
       // POST /xrpc/social.coves.community.comment.delete

     

       33
       33
       +
       //

     

       34
       34
       +
       // Request body: { "uri": "at://..." }

     

       35
       35
       +
       // Response: {}

     

       36
       36
       +
       func (h *DeleteCommentHandler) HandleDelete(w http.ResponseWriter, r *http.Request) {

     

       37
       37
       +
       	// 1. Check method is POST

     

       38
       38
       +
       	if r.Method != http.MethodPost {

     

       39
       39
       +
       		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)

     

       40
       40
       +
       		return

     

       41
       41
       +
       	}

     

       42
       42
       +
       

     

       43
       43
       +
       	// 2. Limit request body size to prevent DoS attacks (100KB should be plenty for comments)

     

       44
       44
       +
       	r.Body = http.MaxBytesReader(w, r.Body, 100*1024)

     

       45
       45
       +
       

     

       46
       46
       +
       	// 3. Parse JSON body into DeleteCommentInput

     

       47
       47
       +
       	var input DeleteCommentInput

     

       48
       48
       +
       	if err := json.NewDecoder(r.Body).Decode(&input); err != nil {

     

       49
       49
       +
       		writeError(w, http.StatusBadRequest, "InvalidRequest", "Invalid request body")

     

       50
       50
       +
       		return

     

       51
       51
       +
       	}

     

       52
       52
       +
       

     

       53
       53
       +
       	// 4. Get OAuth session from context (injected by auth middleware)

     

       54
       54
       +
       	session := middleware.GetOAuthSession(r)

     

       55
       55
       +
       	if session == nil {

     

       56
       56
       +
       		writeError(w, http.StatusUnauthorized, "AuthRequired", "Authentication required")

     

       57
       57
       +
       		return

     

       58
       58
       +
       	}

     

       59
       59
       +
       

     

       60
       60
       +
       	// 5. Convert input to DeleteCommentRequest

     

       61
       61
       +
       	req := comments.DeleteCommentRequest{

     

       62
       62
       +
       		URI: input.URI,

     

       63
       63
       +
       	}

     

       64
       64
       +
       

     

       65
       65
       +
       	// 6. Call service to delete comment

     

       66
       66
       +
       	err := h.service.DeleteComment(r.Context(), session, req)

     

       67
       67
       +
       	if err != nil {

     

       68
       68
       +
       		handleServiceError(w, err)

     

       69
       69
       +
       		return

     

       70
       70
       +
       	}

     

       71
       71
       +
       

     

       72
       72
       +
       	// 7. Return empty JSON object per lexicon specification

     

       73
       73
       +
       	output := DeleteCommentOutput{}

     

       74
       74
       +
       

     

       75
       75
       +
       	w.Header().Set("Content-Type", "application/json")

     

       76
       76
       +
       	w.WriteHeader(http.StatusOK)

     

       77
       77
       +
       	if err := json.NewEncoder(w).Encode(output); err != nil {

     

       78
       78
       +
       		log.Printf("Failed to encode response: %v", err)

     

       79
       79
       +
       	}

     

       80
       80
       +
       }

+34 -2

internal/api/handlers/comments/errors.go

···

       3
       3
        
       import (

     

       4
       4
        
       	"Coves/internal/core/comments"

     

       5
       5
        
       	"encoding/json"

     

       6
       6
       +
       	"errors"

     

       6
       7
        
       	"log"

     

       7
       8
        
       	"net/http"

     

       8
       9
        
       )

     
···

       30
       31
        
       func handleServiceError(w http.ResponseWriter, err error) {

     

       31
       32
        
       	switch {

     

       32
       33
        
       	case comments.IsNotFound(err):

     

       33
       33
       -
       		writeError(w, http.StatusNotFound, "NotFound", err.Error())

     

       34
       34
       +
       		// Map specific not found errors to appropriate messages

     

       35
       35
       +
       		switch {

     

       36
       36
       +
       		case errors.Is(err, comments.ErrCommentNotFound):

     

       37
       37
       +
       			writeError(w, http.StatusNotFound, "CommentNotFound", "Comment not found")

     

       38
       38
       +
       		case errors.Is(err, comments.ErrParentNotFound):

     

       39
       39
       +
       			writeError(w, http.StatusNotFound, "ParentNotFound", "Parent post or comment not found")

     

       40
       40
       +
       		case errors.Is(err, comments.ErrRootNotFound):

     

       41
       41
       +
       			writeError(w, http.StatusNotFound, "RootNotFound", "Root post not found")

     

       42
       42
       +
       		default:

     

       43
       43
       +
       			writeError(w, http.StatusNotFound, "NotFound", err.Error())

     

       44
       44
       +
       		}

     

       34
       45
        
       

     

       35
       46
        
       	case comments.IsValidationError(err):

     

       36
       36
       -
       		writeError(w, http.StatusBadRequest, "InvalidRequest", err.Error())

     

       47
       47
       +
       		// Map specific validation errors to appropriate messages

     

       48
       48
       +
       		switch {

     

       49
       49
       +
       		case errors.Is(err, comments.ErrInvalidReply):

     

       50
       50
       +
       			writeError(w, http.StatusBadRequest, "InvalidReply", "The reply reference is invalid or malformed")

     

       51
       51
       +
       		case errors.Is(err, comments.ErrContentTooLong):

     

       52
       52
       +
       			writeError(w, http.StatusBadRequest, "ContentTooLong", "Comment content exceeds 10000 graphemes")

     

       53
       53
       +
       		case errors.Is(err, comments.ErrContentEmpty):

     

       54
       54
       +
       			writeError(w, http.StatusBadRequest, "ContentEmpty", "Comment content is required")

     

       55
       55
       +
       		default:

     

       56
       56
       +
       			writeError(w, http.StatusBadRequest, "InvalidRequest", err.Error())

     

       57
       57
       +
       		}

     

       58
       58
       +
       

     

       59
       59
       +
       	case errors.Is(err, comments.ErrNotAuthorized):

     

       60
       60
       +
       		writeError(w, http.StatusForbidden, "NotAuthorized", "User is not authorized to perform this action")

     

       61
       61
       +
       

     

       62
       62
       +
       	case errors.Is(err, comments.ErrBanned):

     

       63
       63
       +
       		writeError(w, http.StatusForbidden, "Banned", "User is banned from this community")

     

       64
       64
       +
       

     

       65
       65
       +
       	// NOTE: IsConflict case removed - the PDS handles duplicate detection via CreateRecord,

     

       66
       66
       +
       	// so ErrCommentAlreadyExists is never returned from the service layer. If the PDS rejects

     

       67
       67
       +
       	// a duplicate record, it returns an auth/validation error which is handled by other cases.

     

       68
       68
       +
       	// Keeping this code would be dead code that never executes.

     

       37
       69
        
       

     

       38
       70
        
       	default:

     

       39
       71
        
       		// Don't leak internal error details to clients

+112

internal/api/handlers/comments/update_comment.go

···

       1
       1
       +
       package comments

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"Coves/internal/api/middleware"

     

       5
       5
       +
       	"Coves/internal/core/comments"

     

       6
       6
       +
       	"encoding/json"

     

       7
       7
       +
       	"log"

     

       8
       8
       +
       	"net/http"

     

       9
       9
       +
       )

     

       10
       10
       +
       

     

       11
       11
       +
       // UpdateCommentHandler handles comment update requests

     

       12
       12
       +
       type UpdateCommentHandler struct {

     

       13
       13
       +
       	service comments.Service

     

       14
       14
       +
       }

     

       15
       15
       +
       

     

       16
       16
       +
       // NewUpdateCommentHandler creates a new handler for updating comments

     

       17
       17
       +
       func NewUpdateCommentHandler(service comments.Service) *UpdateCommentHandler {

     

       18
       18
       +
       	return &UpdateCommentHandler{

     

       19
       19
       +
       		service: service,

     

       20
       20
       +
       	}

     

       21
       21
       +
       }

     

       22
       22
       +
       

     

       23
       23
       +
       // UpdateCommentInput matches the lexicon input schema for social.coves.community.comment.update

     

       24
       24
       +
       type UpdateCommentInput struct {

     

       25
       25
       +
       	URI     string        `json:"uri"`

     

       26
       26
       +
       	Content string        `json:"content"`

     

       27
       27
       +
       	Facets  []interface{} `json:"facets,omitempty"`

     

       28
       28
       +
       	Embed   interface{}   `json:"embed,omitempty"`

     

       29
       29
       +
       	Langs   []string      `json:"langs,omitempty"`

     

       30
       30
       +
       	Labels  interface{}   `json:"labels,omitempty"`

     

       31
       31
       +
       }

     

       32
       32
       +
       

     

       33
       33
       +
       // UpdateCommentOutput matches the lexicon output schema

     

       34
       34
       +
       type UpdateCommentOutput struct {

     

       35
       35
       +
       	URI string `json:"uri"`

     

       36
       36
       +
       	CID string `json:"cid"`

     

       37
       37
       +
       }

     

       38
       38
       +
       

     

       39
       39
       +
       // HandleUpdate handles comment update requests

     

       40
       40
       +
       // POST /xrpc/social.coves.community.comment.update

     

       41
       41
       +
       //

     

       42
       42
       +
       // Request body: { "uri": "at://...", "content": "..." }

     

       43
       43
       +
       // Response: { "uri": "at://...", "cid": "..." }

     

       44
       44
       +
       func (h *UpdateCommentHandler) HandleUpdate(w http.ResponseWriter, r *http.Request) {

     

       45
       45
       +
       	// 1. Check method is POST

     

       46
       46
       +
       	if r.Method != http.MethodPost {

     

       47
       47
       +
       		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)

     

       48
       48
       +
       		return

     

       49
       49
       +
       	}

     

       50
       50
       +
       

     

       51
       51
       +
       	// 2. Limit request body size to prevent DoS attacks (100KB should be plenty for comments)

     

       52
       52
       +
       	r.Body = http.MaxBytesReader(w, r.Body, 100*1024)

     

       53
       53
       +
       

     

       54
       54
       +
       	// 3. Parse JSON body into UpdateCommentInput

     

       55
       55
       +
       	var input UpdateCommentInput

     

       56
       56
       +
       	if err := json.NewDecoder(r.Body).Decode(&input); err != nil {

     

       57
       57
       +
       		writeError(w, http.StatusBadRequest, "InvalidRequest", "Invalid request body")

     

       58
       58
       +
       		return

     

       59
       59
       +
       	}

     

       60
       60
       +
       

     

       61
       61
       +
       	// 4. Get OAuth session from context (injected by auth middleware)

     

       62
       62
       +
       	session := middleware.GetOAuthSession(r)

     

       63
       63
       +
       	if session == nil {

     

       64
       64
       +
       		writeError(w, http.StatusUnauthorized, "AuthRequired", "Authentication required")

     

       65
       65
       +
       		return

     

       66
       66
       +
       	}

     

       67
       67
       +
       

     

       68
       68
       +
       	// 5. Convert labels interface{} to *comments.SelfLabels if provided

     

       69
       69
       +
       	var labels *comments.SelfLabels

     

       70
       70
       +
       	if input.Labels != nil {

     

       71
       71
       +
       		labelsJSON, err := json.Marshal(input.Labels)

     

       72
       72
       +
       		if err != nil {

     

       73
       73
       +
       			writeError(w, http.StatusBadRequest, "InvalidLabels", "Invalid labels format")

     

       74
       74
       +
       			return

     

       75
       75
       +
       		}

     

       76
       76
       +
       		var selfLabels comments.SelfLabels

     

       77
       77
       +
       		if err := json.Unmarshal(labelsJSON, &selfLabels); err != nil {

     

       78
       78
       +
       			writeError(w, http.StatusBadRequest, "InvalidLabels", "Invalid labels structure")

     

       79
       79
       +
       			return

     

       80
       80
       +
       		}

     

       81
       81
       +
       		labels = &selfLabels

     

       82
       82
       +
       	}

     

       83
       83
       +
       

     

       84
       84
       +
       	// 6. Convert input to UpdateCommentRequest

     

       85
       85
       +
       	req := comments.UpdateCommentRequest{

     

       86
       86
       +
       		URI:     input.URI,

     

       87
       87
       +
       		Content: input.Content,

     

       88
       88
       +
       		Facets:  input.Facets,

     

       89
       89
       +
       		Embed:   input.Embed,

     

       90
       90
       +
       		Langs:   input.Langs,

     

       91
       91
       +
       		Labels:  labels,

     

       92
       92
       +
       	}

     

       93
       93
       +
       

     

       94
       94
       +
       	// 7. Call service to update comment

     

       95
       95
       +
       	response, err := h.service.UpdateComment(r.Context(), session, req)

     

       96
       96
       +
       	if err != nil {

     

       97
       97
       +
       		handleServiceError(w, err)

     

       98
       98
       +
       		return

     

       99
       99
       +
       	}

     

       100
       100
       +
       

     

       101
       101
       +
       	// 8. Return JSON response with URI and CID

     

       102
       102
       +
       	output := UpdateCommentOutput{

     

       103
       103
       +
       		URI: response.URI,

     

       104
       104
       +
       		CID: response.CID,

     

       105
       105
       +
       	}

     

       106
       106
       +
       

     

       107
       107
       +
       	w.Header().Set("Content-Type", "application/json")

     

       108
       108
       +
       	w.WriteHeader(http.StatusOK)

     

       109
       109
       +
       	if err := json.NewEncoder(w).Encode(output); err != nil {

     

       110
       110
       +
       		log.Printf("Failed to encode response: %v", err)

     

       111
       111
       +
       	}

     

       112
       112
       +
       }

+35

internal/api/routes/comment.go

···

       1
       1
       +
       package routes

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"Coves/internal/api/handlers/comments"

     

       5
       5
       +
       	"Coves/internal/api/middleware"

     

       6
       6
       +
       	commentsCore "Coves/internal/core/comments"

     

       7
       7
       +
       

     

       8
       8
       +
       	"github.com/go-chi/chi/v5"

     

       9
       9
       +
       )

     

       10
       10
       +
       

     

       11
       11
       +
       // RegisterCommentRoutes registers comment-related XRPC endpoints on the router

     

       12
       12
       +
       // Implements social.coves.community.comment.* lexicon endpoints

     

       13
       13
       +
       // All write operations (create, update, delete) require authentication

     

       14
       14
       +
       func RegisterCommentRoutes(r chi.Router, service commentsCore.Service, authMiddleware *middleware.OAuthAuthMiddleware) {

     

       15
       15
       +
       	// Initialize handlers

     

       16
       16
       +
       	createHandler := comments.NewCreateCommentHandler(service)

     

       17
       17
       +
       	updateHandler := comments.NewUpdateCommentHandler(service)

     

       18
       18
       +
       	deleteHandler := comments.NewDeleteCommentHandler(service)

     

       19
       19
       +
       

     

       20
       20
       +
       	// Procedure endpoints (POST) - require authentication

     

       21
       21
       +
       	// social.coves.community.comment.create - create a new comment on a post or another comment

     

       22
       22
       +
       	r.With(authMiddleware.RequireAuth).Post(

     

       23
       23
       +
       		"/xrpc/social.coves.community.comment.create",

     

       24
       24
       +
       		createHandler.HandleCreate)

     

       25
       25
       +
       

     

       26
       26
       +
       	// social.coves.community.comment.update - update an existing comment's content

     

       27
       27
       +
       	r.With(authMiddleware.RequireAuth).Post(

     

       28
       28
       +
       		"/xrpc/social.coves.community.comment.update",

     

       29
       29
       +
       		updateHandler.HandleUpdate)

     

       30
       30
       +
       

     

       31
       31
       +
       	// social.coves.community.comment.delete - soft delete a comment

     

       32
       32
       +
       	r.With(authMiddleware.RequireAuth).Post(

     

       33
       33
       +
       		"/xrpc/social.coves.community.comment.delete",

     

       34
       34
       +
       		deleteHandler.HandleDelete)

     

       35
       35
       +
       }

+4 -2

tests/integration/comment_query_test.go

···

       785
       785
        
       	postRepo := postgres.NewPostRepository(db)

     

       786
       786
        
       	userRepo := postgres.NewUserRepository(db)

     

       787
       787
        
       	communityRepo := postgres.NewCommunityRepository(db)

     

       788
       788
       -
       	return comments.NewCommentService(commentRepo, userRepo, postRepo, communityRepo)

     

       788
       788
       +
       	// Use factory constructor with nil factory - these tests only use the read path (GetComments)

     

       789
       789
       +
       	return comments.NewCommentServiceWithPDSFactory(commentRepo, userRepo, postRepo, communityRepo, nil, nil)

     

       789
       790
        
       }

     

       790
       791
        
       

     

       791
       792
        
       // Helper: createTestCommentWithScore creates a comment with specific vote counts

     
···

       871
       872
        
       	postRepo := postgres.NewPostRepository(db)

     

       872
       873
        
       	userRepo := postgres.NewUserRepository(db)

     

       873
       874
        
       	communityRepo := postgres.NewCommunityRepository(db)

     

       874
       874
       -
       	service := comments.NewCommentService(commentRepo, userRepo, postRepo, communityRepo)

     

       875
       875
       +
       	// Use factory constructor with nil factory - these tests only use the read path (GetComments)

     

       876
       876
       +
       	service := comments.NewCommentServiceWithPDSFactory(commentRepo, userRepo, postRepo, communityRepo, nil, nil)

     

       875
       877
        
       	return &testCommentServiceAdapter{service: service}

     

       876
       878
        
       }

     

       877
       879

+6 -3

tests/integration/comment_vote_test.go

···

       417
       417
        
       		}

     

       418
       418
        
       

     

       419
       419
        
       		// Query comments with viewer authentication

     

       420
       420
       -
       		commentService := comments.NewCommentService(commentRepo, userRepo, postRepo, communityRepo)

     

       420
       420
       +
       		// Use factory constructor with nil factory - this test only uses the read path (GetComments)

     

       421
       421
       +
       		commentService := comments.NewCommentServiceWithPDSFactory(commentRepo, userRepo, postRepo, communityRepo, nil, nil)

     

       421
       422
        
       		response, err := commentService.GetComments(ctx, &comments.GetCommentsRequest{

     

       422
       423
        
       			PostURI:   testPostURI,

     

       423
       424
        
       			Sort:      "new",

     
···

       499
       500
        
       		}

     

       500
       501
        
       

     

       501
       502
        
       		// Query with authentication but no vote

     

       502
       502
       -
       		commentService := comments.NewCommentService(commentRepo, userRepo, postRepo, communityRepo)

     

       503
       503
       +
       		// Use factory constructor with nil factory - this test only uses the read path (GetComments)

     

       504
       504
       +
       		commentService := comments.NewCommentServiceWithPDSFactory(commentRepo, userRepo, postRepo, communityRepo, nil, nil)

     

       503
       505
        
       		response, err := commentService.GetComments(ctx, &comments.GetCommentsRequest{

     

       504
       506
        
       			PostURI:   testPostURI,

     

       505
       507
        
       			Sort:      "new",

     
···

       542
       544
        
       

     

       543
       545
        
       	t.Run("Unauthenticated request has no viewer state", func(t *testing.T) {

     

       544
       546
        
       		// Query without authentication

     

       545
       545
       -
       		commentService := comments.NewCommentService(commentRepo, userRepo, postRepo, communityRepo)

     

       547
       547
       +
       		// Use factory constructor with nil factory - this test only uses the read path (GetComments)

     

       548
       548
       +
       		commentService := comments.NewCommentServiceWithPDSFactory(commentRepo, userRepo, postRepo, communityRepo, nil, nil)

     

       546
       549
        
       		response, err := commentService.GetComments(ctx, &comments.GetCommentsRequest{

     

       547
       550
        
       			PostURI:   testPostURI,

     

       548
       551
        
       			Sort:      "new",

+2 -1

tests/integration/concurrent_scenarios_test.go

···

       454
       454
        
       		}

     

       455
       455
        
       

     

       456
       456
        
       		// Verify all comments are retrievable via service

     

       457
       457
       -
       		commentService := comments.NewCommentService(commentRepo, userRepo, postRepo, communityRepo)

     

       457
       457
       +
       		// Use factory constructor with nil factory - this test only uses the read path (GetComments)

     

       458
       458
       +
       		commentService := comments.NewCommentServiceWithPDSFactory(commentRepo, userRepo, postRepo, communityRepo, nil, nil)

     

       458
       459
        
       		response, err := commentService.GetComments(ctx, &comments.GetCommentsRequest{

     

       459
       460
        
       			PostURI:   postURI,

     

       460
       461
        
       			Sort:      "new",

+1 -1

go.mod

···

       72
       72
        
       	github.com/prometheus/client_model v0.5.0 // indirect

     

       73
       73
        
       	github.com/prometheus/common v0.45.0 // indirect

     

       74
       74
        
       	github.com/prometheus/procfs v0.12.0 // indirect

     

       75
       75
       -
       	github.com/rivo/uniseg v0.1.0 // indirect

     

       75
       75
       +
       	github.com/rivo/uniseg v0.4.7 // indirect

     

       76
       76
        
       	github.com/segmentio/asm v1.2.0 // indirect

     

       77
       77
        
       	github.com/sethvargo/go-retry v0.3.0 // indirect

     

       78
       78
        
       	github.com/spaolacci/murmur3 v1.1.0 // indirect

go.sum

···

       159
       159
        
       github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=

     

       160
       160
        
       github.com/rivo/uniseg v0.1.0 h1:+2KBaVoUmb9XzDsrx/Ct0W/EYOSFf/nWTauy++DprtY=

     

       161
       161
        
       github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=

     

       162
       162
       +
       github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=

     

       163
       163
       +
       github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=

     

       162
       164
        
       github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=

     

       163
       165
        
       github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=

     

       164
       166
        
       github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=

+66

internal/db/migrations/021_add_comment_deletion_metadata.sql

···

       1
       1
       +
       -- +goose Up

     

       2
       2
       +
       -- Add deletion reason tracking to preserve thread structure while respecting privacy

     

       3
       3
       +
       -- When comments are deleted, we blank content but keep the record for threading

     

       4
       4
       +
       

     

       5
       5
       +
       -- Create enum type for deletion reasons

     

       6
       6
       +
       CREATE TYPE deletion_reason AS ENUM ('author', 'moderator');

     

       7
       7
       +
       

     

       8
       8
       +
       -- Add new columns to comments table

     

       9
       9
       +
       ALTER TABLE comments ADD COLUMN deletion_reason deletion_reason;

     

       10
       10
       +
       ALTER TABLE comments ADD COLUMN deleted_by TEXT;

     

       11
       11
       +
       

     

       12
       12
       +
       -- Add comments for new columns

     

       13
       13
       +
       COMMENT ON COLUMN comments.deletion_reason IS 'Reason for deletion: author (user deleted), moderator (community mod removed)';

     

       14
       14
       +
       COMMENT ON COLUMN comments.deleted_by IS 'DID of the actor who performed the deletion';

     

       15
       15
       +
       

     

       16
       16
       +
       -- Backfill existing deleted comments as author-deleted

     

       17
       17
       +
       -- This handles existing soft-deleted comments gracefully

     

       18
       18
       +
       UPDATE comments

     

       19
       19
       +
       SET deletion_reason = 'author',

     

       20
       20
       +
           deleted_by = commenter_did

     

       21
       21
       +
       WHERE deleted_at IS NOT NULL AND deletion_reason IS NULL;

     

       22
       22
       +
       

     

       23
       23
       +
       -- Modify existing indexes to NOT filter deleted_at IS NULL

     

       24
       24
       +
       -- This allows deleted comments to appear in thread queries for structure preservation

     

       25
       25
       +
       -- Note: We drop and recreate to change the partial index condition

     

       26
       26
       +
       

     

       27
       27
       +
       -- Drop old partial indexes that exclude deleted comments

     

       28
       28
       +
       DROP INDEX IF EXISTS idx_comments_root;

     

       29
       29
       +
       DROP INDEX IF EXISTS idx_comments_parent;

     

       30
       30
       +
       DROP INDEX IF EXISTS idx_comments_parent_score;

     

       31
       31
       +
       DROP INDEX IF EXISTS idx_comments_uri_active;

     

       32
       32
       +
       

     

       33
       33
       +
       -- Recreate indexes without the deleted_at filter (include all comments for threading)

     

       34
       34
       +
       CREATE INDEX idx_comments_root ON comments(root_uri, created_at DESC);

     

       35
       35
       +
       CREATE INDEX idx_comments_parent ON comments(parent_uri, created_at DESC);

     

       36
       36
       +
       CREATE INDEX idx_comments_parent_score ON comments(parent_uri, score DESC, created_at DESC);

     

       37
       37
       +
       CREATE INDEX idx_comments_uri_lookup ON comments(uri);

     

       38
       38
       +
       

     

       39
       39
       +
       -- Add index for querying by deletion_reason (for moderation dashboard)

     

       40
       40
       +
       CREATE INDEX idx_comments_deleted_reason ON comments(deletion_reason, deleted_at DESC)

     

       41
       41
       +
       WHERE deleted_at IS NOT NULL;

     

       42
       42
       +
       

     

       43
       43
       +
       -- Add index for querying by deleted_by (for moderation audit/filtering)

     

       44
       44
       +
       CREATE INDEX idx_comments_deleted_by ON comments(deleted_by, deleted_at DESC)

     

       45
       45
       +
       WHERE deleted_at IS NOT NULL;

     

       46
       46
       +
       

     

       47
       47
       +
       -- +goose Down

     

       48
       48
       +
       -- Remove deletion metadata columns and restore original indexes

     

       49
       49
       +
       

     

       50
       50
       +
       DROP INDEX IF EXISTS idx_comments_deleted_by;

     

       51
       51
       +
       DROP INDEX IF EXISTS idx_comments_deleted_reason;

     

       52
       52
       +
       DROP INDEX IF EXISTS idx_comments_uri_lookup;

     

       53
       53
       +
       DROP INDEX IF EXISTS idx_comments_parent_score;

     

       54
       54
       +
       DROP INDEX IF EXISTS idx_comments_parent;

     

       55
       55
       +
       DROP INDEX IF EXISTS idx_comments_root;

     

       56
       56
       +
       

     

       57
       57
       +
       -- Restore original partial indexes (excluding deleted comments)

     

       58
       58
       +
       CREATE INDEX idx_comments_root ON comments(root_uri, created_at DESC) WHERE deleted_at IS NULL;

     

       59
       59
       +
       CREATE INDEX idx_comments_parent ON comments(parent_uri, created_at DESC) WHERE deleted_at IS NULL;

     

       60
       60
       +
       CREATE INDEX idx_comments_parent_score ON comments(parent_uri, score DESC, created_at DESC) WHERE deleted_at IS NULL;

     

       61
       61
       +
       CREATE INDEX idx_comments_uri_active ON comments(uri) WHERE deleted_at IS NULL;

     

       62
       62
       +
       

     

       63
       63
       +
       ALTER TABLE comments DROP COLUMN IF EXISTS deleted_by;

     

       64
       64
       +
       ALTER TABLE comments DROP COLUMN IF EXISTS deletion_reason;

     

       65
       65
       +
       

     

       66
       66
       +
       DROP TYPE IF EXISTS deletion_reason;

+17 -13

internal/core/comments/view_models.go

···

       7
       7
        
       // CommentView represents the full view of a comment with all metadata

     

       8
       8
        
       // Matches social.coves.community.comment.getComments#commentView lexicon

     

       9
       9
        
       // Used in thread views and get endpoints

     

       10
       10
       +
       // For deleted comments, IsDeleted=true and content-related fields are empty/nil

     

       10
       11
        
       type CommentView struct {

     

       11
       11
       -
       	Embed         interface{}         `json:"embed,omitempty"`

     

       12
       12
       -
       	Record        interface{}         `json:"record"`

     

       13
       13
       -
       	Viewer        *CommentViewerState `json:"viewer,omitempty"`

     

       14
       14
       -
       	Author        *posts.AuthorView   `json:"author"`

     

       15
       15
       -
       	Post          *CommentRef         `json:"post"`

     

       16
       16
       -
       	Parent        *CommentRef         `json:"parent,omitempty"`

     

       17
       17
       -
       	Stats         *CommentStats       `json:"stats"`

     

       18
       18
       -
       	Content       string              `json:"content"`

     

       19
       19
       -
       	CreatedAt     string              `json:"createdAt"`

     

       20
       20
       -
       	IndexedAt     string              `json:"indexedAt"`

     

       21
       21
       -
       	URI           string              `json:"uri"`

     

       22
       22
       -
       	CID           string              `json:"cid"`

     

       23
       23
       -
       	ContentFacets []interface{}       `json:"contentFacets,omitempty"`

     

       12
       12
       +
       	Embed          interface{}         `json:"embed,omitempty"`

     

       13
       13
       +
       	Record         interface{}         `json:"record"`

     

       14
       14
       +
       	Viewer         *CommentViewerState `json:"viewer,omitempty"`

     

       15
       15
       +
       	Author         *posts.AuthorView   `json:"author"`

     

       16
       16
       +
       	Post           *CommentRef         `json:"post"`

     

       17
       17
       +
       	Parent         *CommentRef         `json:"parent,omitempty"`

     

       18
       18
       +
       	Stats          *CommentStats       `json:"stats"`

     

       19
       19
       +
       	Content        string              `json:"content"`

     

       20
       20
       +
       	CreatedAt      string              `json:"createdAt"`

     

       21
       21
       +
       	IndexedAt      string              `json:"indexedAt"`

     

       22
       22
       +
       	URI            string              `json:"uri"`

     

       23
       23
       +
       	CID            string              `json:"cid"`

     

       24
       24
       +
       	ContentFacets  []interface{}       `json:"contentFacets,omitempty"`

     

       25
       25
       +
       	IsDeleted      bool                `json:"isDeleted,omitempty"`

     

       26
       26
       +
       	DeletionReason *string             `json:"deletionReason,omitempty"`

     

       27
       27
       +
       	DeletedAt      *string             `json:"deletedAt,omitempty"`

     

       24
       28
        
       }

     

       25
       29
        
       

     

       26
       30
        
       // ThreadViewComment represents a comment with its nested replies

+23 -1

internal/core/comments/interfaces.go

···

       1
       1
        
       package comments

     

       2
       2
        
       

     

       3
       3
       -
       import "context"

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"database/sql"

     

       6
       6
       +
       )

     

       4
       7
        
       

     

       5
       8
        
       // Repository defines the data access interface for comments

     

       6
       9
        
       // Used by Jetstream consumer to index comments from firehose

     
···

       25
       28
        
       

     

       26
       29
        
       	// Delete soft-deletes a comment (sets deleted_at)

     

       27
       30
        
       	// Called by Jetstream consumer after comment is deleted from PDS

     

       31
       31
       +
       	// Deprecated: Use SoftDeleteWithReason for new code to preserve thread structure

     

       28
       32
        
       	Delete(ctx context.Context, uri string) error

     

       29
       33
        
       

     

       34
       34
       +
       	// SoftDeleteWithReason performs a soft delete that blanks content but preserves thread structure

     

       35
       35
       +
       	// This allows deleted comments to appear as "[deleted]" placeholders in thread views

     

       36
       36
       +
       	// reason: "author" (user deleted) or "moderator" (mod removed)

     

       37
       37
       +
       	// deletedByDID: DID of the actor who performed the deletion

     

       38
       38
       +
       	SoftDeleteWithReason(ctx context.Context, uri, reason, deletedByDID string) error

     

       39
       39
       +
       

     

       30
       40
        
       	// ListByRoot retrieves all comments in a thread (flat)

     

       31
       41
        
       	// Used for fetching entire comment threads on posts

     

       32
       42
        
       	ListByRoot(ctx context.Context, rootURI string, limit, offset int) ([]*Comment, error)

     
···

       76
       86
        
       		limitPerParent int,

     

       77
       87
        
       	) (map[string][]*Comment, error)

     

       78
       88
        
       }

     

       89
       89
       +
       

     

       90
       90
       +
       // RepositoryTx provides transaction-aware operations for consumers that need atomicity

     

       91
       91
       +
       // Used by Jetstream consumer to perform atomic delete + count updates

     

       92
       92
       +
       // Implementations that support transactions should also implement this interface

     

       93
       93
       +
       type RepositoryTx interface {

     

       94
       94
       +
       	// SoftDeleteWithReasonTx performs a soft delete within a transaction

     

       95
       95
       +
       	// If tx is nil, executes directly against the database

     

       96
       96
       +
       	// Returns rows affected count for callers that need to check idempotency

     

       97
       97
       +
       	// reason: must be DeletionReasonAuthor or DeletionReasonModerator

     

       98
       98
       +
       	// deletedByDID: DID of the actor who performed the deletion

     

       99
       99
       +
       	SoftDeleteWithReasonTx(ctx context.Context, tx *sql.Tx, uri, reason, deletedByDID string) (int64, error)

     

       100
       100
       +
       }

+87 -27

internal/db/postgres/comment_repo.go

···

       120
       120
        
       			id, uri, cid, rkey, commenter_did,

     

       121
       121
        
       			root_uri, root_cid, parent_uri, parent_cid,

     

       122
       122
        
       			content, content_facets, embed, content_labels, langs,

     

       123
       123
       -
       			created_at, indexed_at, deleted_at,

     

       123
       123
       +
       			created_at, indexed_at, deleted_at, deletion_reason, deleted_by,

     

       124
       124
        
       			upvote_count, downvote_count, score, reply_count

     

       125
       125
        
       		FROM comments

     

       126
       126
        
       		WHERE uri = $1

     
···

       133
       133
        
       		&comment.ID, &comment.URI, &comment.CID, &comment.RKey, &comment.CommenterDID,

     

       134
       134
        
       		&comment.RootURI, &comment.RootCID, &comment.ParentURI, &comment.ParentCID,

     

       135
       135
        
       		&comment.Content, &comment.ContentFacets, &comment.Embed, &comment.ContentLabels, &langs,

     

       136
       136
       -
       		&comment.CreatedAt, &comment.IndexedAt, &comment.DeletedAt,

     

       136
       136
       +
       		&comment.CreatedAt, &comment.IndexedAt, &comment.DeletedAt, &comment.DeletionReason, &comment.DeletedBy,

     

       137
       137
        
       		&comment.UpvoteCount, &comment.DownvoteCount, &comment.Score, &comment.ReplyCount,

     

       138
       138
        
       	)

     

       139
       139
        
       

     
···

       152
       152
        
       // Delete soft-deletes a comment (sets deleted_at)

     

       153
       153
        
       // Called by Jetstream consumer after comment is deleted from PDS

     

       154
       154
        
       // Idempotent: Returns success if comment already deleted

     

       155
       155
       +
       // Deprecated: Use SoftDeleteWithReason for new code to preserve thread structure

     

       155
       156
        
       func (r *postgresCommentRepo) Delete(ctx context.Context, uri string) error {

     

       156
       157
        
       	query := `

     

       157
       158
        
       		UPDATE comments

     
···

       177
       178
        
       	return nil

     

       178
       179
        
       }

     

       179
       180
        
       

     

       180
       180
       -
       // ListByRoot retrieves all active comments in a thread (flat)

     

       181
       181
       +
       // SoftDeleteWithReason performs a soft delete that blanks content but preserves thread structure

     

       182
       182
       +
       // This allows deleted comments to appear as "[deleted]" placeholders in thread views

     

       183
       183
       +
       // Idempotent: Returns success if comment already deleted

     

       184
       184
       +
       // Validates that reason is a known deletion reason constant

     

       185
       185
       +
       func (r *postgresCommentRepo) SoftDeleteWithReason(ctx context.Context, uri, reason, deletedByDID string) error {

     

       186
       186
       +
       	// Validate deletion reason

     

       187
       187
       +
       	if reason != comments.DeletionReasonAuthor && reason != comments.DeletionReasonModerator {

     

       188
       188
       +
       		return fmt.Errorf("invalid deletion reason: %s", reason)

     

       189
       189
       +
       	}

     

       190
       190
       +
       

     

       191
       191
       +
       	_, err := r.SoftDeleteWithReasonTx(ctx, nil, uri, reason, deletedByDID)

     

       192
       192
       +
       	return err

     

       193
       193
       +
       }

     

       194
       194
       +
       

     

       195
       195
       +
       // SoftDeleteWithReasonTx performs a soft delete within an optional transaction

     

       196
       196
       +
       // If tx is nil, executes directly against the database

     

       197
       197
       +
       // Returns rows affected count for callers that need to check idempotency

     

       198
       198
       +
       // This method is used by both the repository and the Jetstream consumer

     

       199
       199
       +
       func (r *postgresCommentRepo) SoftDeleteWithReasonTx(ctx context.Context, tx *sql.Tx, uri, reason, deletedByDID string) (int64, error) {

     

       200
       200
       +
       	query := `

     

       201
       201
       +
       		UPDATE comments

     

       202
       202
       +
       		SET

     

       203
       203
       +
       			content = '',

     

       204
       204
       +
       			content_facets = NULL,

     

       205
       205
       +
       			embed = NULL,

     

       206
       206
       +
       			content_labels = NULL,

     

       207
       207
       +
       			deleted_at = NOW(),

     

       208
       208
       +
       			deletion_reason = $2,

     

       209
       209
       +
       			deleted_by = $3

     

       210
       210
       +
       		WHERE uri = $1 AND deleted_at IS NULL

     

       211
       211
       +
       	`

     

       212
       212
       +
       

     

       213
       213
       +
       	var result sql.Result

     

       214
       214
       +
       	var err error

     

       215
       215
       +
       

     

       216
       216
       +
       	if tx != nil {

     

       217
       217
       +
       		result, err = tx.ExecContext(ctx, query, uri, reason, deletedByDID)

     

       218
       218
       +
       	} else {

     

       219
       219
       +
       		result, err = r.db.ExecContext(ctx, query, uri, reason, deletedByDID)

     

       220
       220
       +
       	}

     

       221
       221
       +
       

     

       222
       222
       +
       	if err != nil {

     

       223
       223
       +
       		return 0, fmt.Errorf("failed to soft delete comment: %w", err)

     

       224
       224
       +
       	}

     

       225
       225
       +
       

     

       226
       226
       +
       	rowsAffected, err := result.RowsAffected()

     

       227
       227
       +
       	if err != nil {

     

       228
       228
       +
       		return 0, fmt.Errorf("failed to check delete result: %w", err)

     

       229
       229
       +
       	}

     

       230
       230
       +
       

     

       231
       231
       +
       	return rowsAffected, nil

     

       232
       232
       +
       }

     

       233
       233
       +
       

     

       234
       234
       +
       // ListByRoot retrieves all comments in a thread (flat), including deleted ones

     

       181
       235
        
       // Used for fetching entire comment threads on posts

     

       236
       236
       +
       // Includes deleted comments to preserve thread structure (shown as "[deleted]" placeholders)

     

       182
       237
        
       func (r *postgresCommentRepo) ListByRoot(ctx context.Context, rootURI string, limit, offset int) ([]*comments.Comment, error) {

     

       183
       238
        
       	query := `

     

       184
       239
        
       		SELECT

     

       185
       240
        
       			id, uri, cid, rkey, commenter_did,

     

       186
       241
        
       			root_uri, root_cid, parent_uri, parent_cid,

     

       187
       242
        
       			content, content_facets, embed, content_labels, langs,

     

       188
       188
       -
       			created_at, indexed_at, deleted_at,

     

       243
       243
       +
       			created_at, indexed_at, deleted_at, deletion_reason, deleted_by,

     

       189
       244
        
       			upvote_count, downvote_count, score, reply_count

     

       190
       245
        
       		FROM comments

     

       191
       191
       -
       		WHERE root_uri = $1 AND deleted_at IS NULL

     

       246
       246
       +
       		WHERE root_uri = $1

     

       192
       247
        
       		ORDER BY created_at ASC

     

       193
       248
        
       		LIMIT $2 OFFSET $3

     

       194
       249
        
       	`

     
···

       212
       267
        
       			&comment.ID, &comment.URI, &comment.CID, &comment.RKey, &comment.CommenterDID,

     

       213
       268
        
       			&comment.RootURI, &comment.RootCID, &comment.ParentURI, &comment.ParentCID,

     

       214
       269
        
       			&comment.Content, &comment.ContentFacets, &comment.Embed, &comment.ContentLabels, &langs,

     

       215
       215
       -
       			&comment.CreatedAt, &comment.IndexedAt, &comment.DeletedAt,

     

       270
       270
       +
       			&comment.CreatedAt, &comment.IndexedAt, &comment.DeletedAt, &comment.DeletionReason, &comment.DeletedBy,

     

       216
       271
        
       			&comment.UpvoteCount, &comment.DownvoteCount, &comment.Score, &comment.ReplyCount,

     

       217
       272
        
       		)

     

       218
       273
        
       		if err != nil {

     
···

       230
       285
        
       	return result, nil

     

       231
       286
        
       }

     

       232
       287
        
       

     

       233
       233
       -
       // ListByParent retrieves direct replies to a post or comment

     

       288
       288
       +
       // ListByParent retrieves direct replies to a post or comment, including deleted ones

     

       234
       289
        
       // Used for building nested/threaded comment views

     

       290
       290
       +
       // Includes deleted comments to preserve thread structure (shown as "[deleted]" placeholders)

     

       235
       291
        
       func (r *postgresCommentRepo) ListByParent(ctx context.Context, parentURI string, limit, offset int) ([]*comments.Comment, error) {

     

       236
       292
        
       	query := `

     

       237
       293
        
       		SELECT

     

       238
       294
        
       			id, uri, cid, rkey, commenter_did,

     

       239
       295
        
       			root_uri, root_cid, parent_uri, parent_cid,

     

       240
       296
        
       			content, content_facets, embed, content_labels, langs,

     

       241
       241
       -
       			created_at, indexed_at, deleted_at,

     

       297
       297
       +
       			created_at, indexed_at, deleted_at, deletion_reason, deleted_by,

     

       242
       298
        
       			upvote_count, downvote_count, score, reply_count

     

       243
       299
        
       		FROM comments

     

       244
       244
       -
       		WHERE parent_uri = $1 AND deleted_at IS NULL

     

       300
       300
       +
       		WHERE parent_uri = $1

     

       245
       301
        
       		ORDER BY created_at ASC

     

       246
       302
        
       		LIMIT $2 OFFSET $3

     

       247
       303
        
       	`

     
···

       265
       321
        
       			&comment.ID, &comment.URI, &comment.CID, &comment.RKey, &comment.CommenterDID,

     

       266
       322
        
       			&comment.RootURI, &comment.RootCID, &comment.ParentURI, &comment.ParentCID,

     

       267
       323
        
       			&comment.Content, &comment.ContentFacets, &comment.Embed, &comment.ContentLabels, &langs,

     

       268
       268
       -
       			&comment.CreatedAt, &comment.IndexedAt, &comment.DeletedAt,

     

       324
       324
       +
       			&comment.CreatedAt, &comment.IndexedAt, &comment.DeletedAt, &comment.DeletionReason, &comment.DeletedBy,

     

       269
       325
        
       			&comment.UpvoteCount, &comment.DownvoteCount, &comment.Score, &comment.ReplyCount,

     

       270
       326
        
       		)

     

       271
       327
        
       		if err != nil {

     
···

       302
       358
        
       }

     

       303
       359
        
       

     

       304
       360
        
       // ListByCommenter retrieves all active comments by a specific user

     

       305
       305
       -
       // Future: Used for user comment history

     

       361
       361
       +
       // Used for user comment history - filters out deleted comments

     

       306
       362
        
       func (r *postgresCommentRepo) ListByCommenter(ctx context.Context, commenterDID string, limit, offset int) ([]*comments.Comment, error) {

     

       307
       363
        
       	query := `

     

       308
       364
        
       		SELECT

     

       309
       365
        
       			id, uri, cid, rkey, commenter_did,

     

       310
       366
        
       			root_uri, root_cid, parent_uri, parent_cid,

     

       311
       367
        
       			content, content_facets, embed, content_labels, langs,

     

       312
       312
       -
       			created_at, indexed_at, deleted_at,

     

       368
       368
       +
       			created_at, indexed_at, deleted_at, deletion_reason, deleted_by,

     

       313
       369
        
       			upvote_count, downvote_count, score, reply_count

     

       314
       370
        
       		FROM comments

     

       315
       371
        
       		WHERE commenter_did = $1 AND deleted_at IS NULL

     
···

       336
       392
        
       			&comment.ID, &comment.URI, &comment.CID, &comment.RKey, &comment.CommenterDID,

     

       337
       393
        
       			&comment.RootURI, &comment.RootCID, &comment.ParentURI, &comment.ParentCID,

     

       338
       394
        
       			&comment.Content, &comment.ContentFacets, &comment.Embed, &comment.ContentLabels, &langs,

     

       339
       339
       -
       			&comment.CreatedAt, &comment.IndexedAt, &comment.DeletedAt,

     

       395
       395
       +
       			&comment.CreatedAt, &comment.IndexedAt, &comment.DeletedAt, &comment.DeletionReason, &comment.DeletedBy,

     

       340
       396
        
       			&comment.UpvoteCount, &comment.DownvoteCount, &comment.Score, &comment.ReplyCount,

     

       341
       397
        
       		)

     

       342
       398
        
       		if err != nil {

     
···

       391
       447
        
       			c.id, c.uri, c.cid, c.rkey, c.commenter_did,

     

       392
       448
        
       			c.root_uri, c.root_cid, c.parent_uri, c.parent_cid,

     

       393
       449
        
       			c.content, c.content_facets, c.embed, c.content_labels, c.langs,

     

       394
       394
       -
       			c.created_at, c.indexed_at, c.deleted_at,

     

       450
       450
       +
       			c.created_at, c.indexed_at, c.deleted_at, c.deletion_reason, c.deleted_by,

     

       395
       451
        
       			c.upvote_count, c.downvote_count, c.score, c.reply_count,

     

       396
       452
        
       			log(greatest(2, c.score + 2)) / power(((EXTRACT(EPOCH FROM (NOW() - c.created_at)) / 3600) + 2), 1.8) as hot_rank,

     

       397
       453
        
       			COALESCE(u.handle, c.commenter_did) as author_handle

     
···

       402
       458
        
       			c.id, c.uri, c.cid, c.rkey, c.commenter_did,

     

       403
       459
        
       			c.root_uri, c.root_cid, c.parent_uri, c.parent_cid,

     

       404
       460
        
       			c.content, c.content_facets, c.embed, c.content_labels, c.langs,

     

       405
       405
       -
       			c.created_at, c.indexed_at, c.deleted_at,

     

       461
       461
       +
       			c.created_at, c.indexed_at, c.deleted_at, c.deletion_reason, c.deleted_by,

     

       406
       462
        
       			c.upvote_count, c.downvote_count, c.score, c.reply_count,

     

       407
       463
        
       			NULL::numeric as hot_rank,

     

       408
       464
        
       			COALESCE(u.handle, c.commenter_did) as author_handle

     
···

       411
       467
        
       

     

       412
       468
        
       	// Build complete query with JOINs and filters

     

       413
       469
        
       	// LEFT JOIN prevents data loss when user record hasn't been indexed yet (out-of-order Jetstream events)

     

       470
       470
       +
       	// Includes deleted comments to preserve thread structure (shown as "[deleted]" placeholders)

     

       414
       471
        
       	query := fmt.Sprintf(`

     

       415
       472
        
       		%s

     

       416
       473
        
       		LEFT JOIN users u ON c.commenter_did = u.did

     

       417
       417
       -
       		WHERE c.parent_uri = $1 AND c.deleted_at IS NULL

     

       474
       474
       +
       		WHERE c.parent_uri = $1

     

       418
       475
        
       			%s

     

       419
       476
        
       			%s

     

       420
       477
        
       		ORDER BY %s

     
···

       449
       506
        
       			&comment.ID, &comment.URI, &comment.CID, &comment.RKey, &comment.CommenterDID,

     

       450
       507
        
       			&comment.RootURI, &comment.RootCID, &comment.ParentURI, &comment.ParentCID,

     

       451
       508
        
       			&comment.Content, &comment.ContentFacets, &comment.Embed, &comment.ContentLabels, &langs,

     

       452
       452
       -
       			&comment.CreatedAt, &comment.IndexedAt, &comment.DeletedAt,

     

       509
       509
       +
       			&comment.CreatedAt, &comment.IndexedAt, &comment.DeletedAt, &comment.DeletionReason, &comment.DeletedBy,

     

       453
       510
        
       			&comment.UpvoteCount, &comment.DownvoteCount, &comment.Score, &comment.ReplyCount,

     

       454
       511
        
       			&hotRank, &authorHandle,

     

       455
       512
        
       		)

     
···

       687
       744
        
       

     

       688
       745
        
       // GetByURIsBatch retrieves multiple comments by their AT-URIs in a single query

     

       689
       746
        
       // Returns map[uri]*Comment for efficient lookups without N+1 queries

     

       747
       747
       +
       // Includes deleted comments to preserve thread structure

     

       690
       748
        
       func (r *postgresCommentRepo) GetByURIsBatch(ctx context.Context, uris []string) (map[string]*comments.Comment, error) {

     

       691
       749
        
       	if len(uris) == 0 {

     

       692
       750
        
       		return make(map[string]*comments.Comment), nil

     
···

       694
       752
        
       

     

       695
       753
        
       	// LEFT JOIN prevents data loss when user record hasn't been indexed yet (out-of-order Jetstream events)

     

       696
       754
        
       	// COALESCE falls back to DID when handle is NULL (user not yet in users table)

     

       755
       755
       +
       	// Includes deleted comments to preserve thread structure (shown as "[deleted]" placeholders)

     

       697
       756
        
       	query := `

     

       698
       757
        
       		SELECT

     

       699
       758
        
       			c.id, c.uri, c.cid, c.rkey, c.commenter_did,

     

       700
       759
        
       			c.root_uri, c.root_cid, c.parent_uri, c.parent_cid,

     

       701
       760
        
       			c.content, c.content_facets, c.embed, c.content_labels, c.langs,

     

       702
       702
       -
       			c.created_at, c.indexed_at, c.deleted_at,

     

       761
       761
       +
       			c.created_at, c.indexed_at, c.deleted_at, c.deletion_reason, c.deleted_by,

     

       703
       762
        
       			c.upvote_count, c.downvote_count, c.score, c.reply_count,

     

       704
       763
        
       			COALESCE(u.handle, c.commenter_did) as author_handle

     

       705
       764
        
       		FROM comments c

     

       706
       765
        
       		LEFT JOIN users u ON c.commenter_did = u.did

     

       707
       707
       -
       		WHERE c.uri = ANY($1) AND c.deleted_at IS NULL

     

       766
       766
       +
       		WHERE c.uri = ANY($1)

     

       708
       767
        
       	`

     

       709
       768
        
       

     

       710
       769
        
       	rows, err := r.db.QueryContext(ctx, query, pq.Array(uris))

     
···

       727
       786
        
       			&comment.ID, &comment.URI, &comment.CID, &comment.RKey, &comment.CommenterDID,

     

       728
       787
        
       			&comment.RootURI, &comment.RootCID, &comment.ParentURI, &comment.ParentCID,

     

       729
       788
        
       			&comment.Content, &comment.ContentFacets, &comment.Embed, &comment.ContentLabels, &langs,

     

       730
       730
       -
       			&comment.CreatedAt, &comment.IndexedAt, &comment.DeletedAt,

     

       789
       789
       +
       			&comment.CreatedAt, &comment.IndexedAt, &comment.DeletedAt, &comment.DeletionReason, &comment.DeletedBy,

     

       731
       790
        
       			&comment.UpvoteCount, &comment.DownvoteCount, &comment.Score, &comment.ReplyCount,

     

       732
       791
        
       			&authorHandle,

     

       733
       792
        
       		)

     
···

       769
       828
        
       			c.id, c.uri, c.cid, c.rkey, c.commenter_did,

     

       770
       829
        
       			c.root_uri, c.root_cid, c.parent_uri, c.parent_cid,

     

       771
       830
        
       			c.content, c.content_facets, c.embed, c.content_labels, c.langs,

     

       772
       772
       -
       			c.created_at, c.indexed_at, c.deleted_at,

     

       831
       831
       +
       			c.created_at, c.indexed_at, c.deleted_at, c.deletion_reason, c.deleted_by,

     

       773
       832
        
       			c.upvote_count, c.downvote_count, c.score, c.reply_count,

     

       774
       833
        
       			log(greatest(2, c.score + 2)) / power(((EXTRACT(EPOCH FROM (NOW() - c.created_at)) / 3600) + 2), 1.8) as hot_rank,

     

       775
       834
        
       			COALESCE(u.handle, c.commenter_did) as author_handle`

     
···

       780
       839
        
       			c.id, c.uri, c.cid, c.rkey, c.commenter_did,

     

       781
       840
        
       			c.root_uri, c.root_cid, c.parent_uri, c.parent_cid,

     

       782
       841
        
       			c.content, c.content_facets, c.embed, c.content_labels, c.langs,

     

       783
       783
       -
       			c.created_at, c.indexed_at, c.deleted_at,

     

       842
       842
       +
       			c.created_at, c.indexed_at, c.deleted_at, c.deletion_reason, c.deleted_by,

     

       784
       843
        
       			c.upvote_count, c.downvote_count, c.score, c.reply_count,

     

       785
       844
        
       			NULL::numeric as hot_rank,

     

       786
       845
        
       			COALESCE(u.handle, c.commenter_did) as author_handle`

     
···

       790
       849
        
       			c.id, c.uri, c.cid, c.rkey, c.commenter_did,

     

       791
       850
        
       			c.root_uri, c.root_cid, c.parent_uri, c.parent_cid,

     

       792
       851
        
       			c.content, c.content_facets, c.embed, c.content_labels, c.langs,

     

       793
       793
       -
       			c.created_at, c.indexed_at, c.deleted_at,

     

       852
       852
       +
       			c.created_at, c.indexed_at, c.deleted_at, c.deletion_reason, c.deleted_by,

     

       794
       853
        
       			c.upvote_count, c.downvote_count, c.score, c.reply_count,

     

       795
       854
        
       			NULL::numeric as hot_rank,

     

       796
       855
        
       			COALESCE(u.handle, c.commenter_did) as author_handle`

     
···

       801
       860
        
       			c.id, c.uri, c.cid, c.rkey, c.commenter_did,

     

       802
       861
        
       			c.root_uri, c.root_cid, c.parent_uri, c.parent_cid,

     

       803
       862
        
       			c.content, c.content_facets, c.embed, c.content_labels, c.langs,

     

       804
       804
       -
       			c.created_at, c.indexed_at, c.deleted_at,

     

       863
       863
       +
       			c.created_at, c.indexed_at, c.deleted_at, c.deletion_reason, c.deleted_by,

     

       805
       864
        
       			c.upvote_count, c.downvote_count, c.score, c.reply_count,

     

       806
       865
        
       			log(greatest(2, c.score + 2)) / power(((EXTRACT(EPOCH FROM (NOW() - c.created_at)) / 3600) + 2), 1.8) as hot_rank,

     

       807
       866
        
       			COALESCE(u.handle, c.commenter_did) as author_handle`

     
···

       812
       871
        
       	// Use window function to limit results per parent

     

       813
       872
        
       	// This is more efficient than LIMIT in a subquery per parent

     

       814
       873
        
       	// LEFT JOIN prevents data loss when user record hasn't been indexed yet (out-of-order Jetstream events)

     

       874
       874
       +
       	// Includes deleted comments to preserve thread structure (shown as "[deleted]" placeholders)

     

       815
       875
        
       	query := fmt.Sprintf(`

     

       816
       876
        
       		WITH ranked_comments AS (

     

       817
       877
        
       			SELECT

     
···

       822
       882
        
       				) as rn

     

       823
       883
        
       			FROM comments c

     

       824
       884
        
       			LEFT JOIN users u ON c.commenter_did = u.did

     

       825
       825
       -
       			WHERE c.parent_uri = ANY($1) AND c.deleted_at IS NULL

     

       885
       885
       +
       			WHERE c.parent_uri = ANY($1)

     

       826
       886
        
       		)

     

       827
       887
        
       		SELECT

     

       828
       888
        
       			id, uri, cid, rkey, commenter_did,

     

       829
       889
        
       			root_uri, root_cid, parent_uri, parent_cid,

     

       830
       890
        
       			content, content_facets, embed, content_labels, langs,

     

       831
       831
       -
       			created_at, indexed_at, deleted_at,

     

       891
       891
       +
       			created_at, indexed_at, deleted_at, deletion_reason, deleted_by,

     

       832
       892
        
       			upvote_count, downvote_count, score, reply_count,

     

       833
       893
        
       			hot_rank, author_handle

     

       834
       894
        
       		FROM ranked_comments

     
···

       858
       918
        
       			&comment.ID, &comment.URI, &comment.CID, &comment.RKey, &comment.CommenterDID,

     

       859
       919
        
       			&comment.RootURI, &comment.RootCID, &comment.ParentURI, &comment.ParentCID,

     

       860
       920
        
       			&comment.Content, &comment.ContentFacets, &comment.Embed, &comment.ContentLabels, &langs,

     

       861
       861
       -
       			&comment.CreatedAt, &comment.IndexedAt, &comment.DeletedAt,

     

       921
       921
       +
       			&comment.CreatedAt, &comment.IndexedAt, &comment.DeletedAt, &comment.DeletionReason, &comment.DeletedBy,

     

       862
       922
        
       			&comment.UpvoteCount, &comment.DownvoteCount, &comment.Score, &comment.ReplyCount,

     

       863
       923
        
       			&hotRank, &authorHandle,

     

       864
       924
        
       		)

+5 -6

internal/core/comments/comment_service.go

···

       750
       750
        
       		CreatedAt: createdAt, // Preserve original timestamp

     

       751
       751
        
       	}

     

       752
       752
        
       

     

       753
       753
       -
       	// Update the record on PDS (putRecord)

     

       754
       754
       -
       	// Note: This creates a new CID even though the URI stays the same

     

       755
       755
       -
       	// TODO: Use PutRecord instead of CreateRecord for proper update semantics with optimistic locking.

     

       756
       756
       -
       	// PutRecord should accept the existing CID (existingRecord.CID) to ensure concurrent updates are detected.

     

       757
       757
       -
       	// However, PutRecord is not yet implemented in internal/atproto/pds/client.go.

     

       758
       758
       -
       	uri, cid, err := pdsClient.CreateRecord(ctx, commentCollection, rkey, updatedRecord)

     

       753
       753
       +
       	// Update the record on PDS with optimistic locking via swapRecord CID

     

       754
       754
       +
       	uri, cid, err := pdsClient.PutRecord(ctx, commentCollection, rkey, updatedRecord, existingRecord.CID)

     

       759
       755
        
       	if err != nil {

     

       760
       756
        
       		s.logger.Error("failed to update comment on PDS",

     

       761
       757
        
       			"error", err,

     
···

       764
       760
        
       		if pds.IsAuthError(err) {

     

       765
       761
        
       			return nil, ErrNotAuthorized

     

       766
       762
        
       		}

     

       763
       763
       +
       		if errors.Is(err, pds.ErrConflict) {

     

       764
       764
       +
       			return nil, ErrConcurrentModification

     

       765
       765
       +
       		}

     

       767
       766
        
       		return nil, fmt.Errorf("failed to update comment: %w", err)

     

       768
       767
        
       	}

     

       769
       768

+2 -2

cmd/server/main.go

···

       543
       543
        
       	routes.RegisterTimelineRoutes(r, timelineService, voteService, authMiddleware)

     

       544
       544
        
       	log.Println("Timeline XRPC endpoints registered (requires authentication, includes viewer vote state)")

     

       545
       545
        
       

     

       546
       546
       -
       	routes.RegisterDiscoverRoutes(r, discoverService)

     

       547
       547
       -
       	log.Println("Discover XRPC endpoints registered (public, no auth required)")

     

       546
       546
       +
       	routes.RegisterDiscoverRoutes(r, discoverService, voteService, authMiddleware)

     

       547
       547
       +
       	log.Println("Discover XRPC endpoints registered (public with optional auth for viewer vote state)")

     

       548
       548
        
       

     

       549
       549
        
       	routes.RegisterAggregatorRoutes(r, aggregatorService, userService, identityResolver)

     

       550
       550
        
       	log.Println("Aggregator XRPC endpoints registered (query endpoints public, registration endpoint public)")

+73

internal/api/handlers/common/viewer_state.go

···

       1
       1
       +
       package common

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"Coves/internal/api/middleware"

     

       5
       5
       +
       	"Coves/internal/core/posts"

     

       6
       6
       +
       	"Coves/internal/core/votes"

     

       7
       7
       +
       	"context"

     

       8
       8
       +
       	"log"

     

       9
       9
       +
       	"net/http"

     

       10
       10
       +
       )

     

       11
       11
       +
       

     

       12
       12
       +
       // FeedPostProvider is implemented by any feed post wrapper that contains a PostView.

     

       13
       13
       +
       // This allows the helper to work with different feed post types (discover, timeline, communityFeed).

     

       14
       14
       +
       type FeedPostProvider interface {

     

       15
       15
       +
       	GetPost() *posts.PostView

     

       16
       16
       +
       }

     

       17
       17
       +
       

     

       18
       18
       +
       // PopulateViewerVoteState enriches feed posts with the authenticated user's vote state.

     

       19
       19
       +
       // This is a no-op if voteService is nil or the request is unauthenticated.

     

       20
       20
       +
       //

     

       21
       21
       +
       // Parameters:

     

       22
       22
       +
       //   - ctx: Request context for PDS calls

     

       23
       23
       +
       //   - r: HTTP request (used to extract OAuth session)

     

       24
       24
       +
       //   - voteService: Vote service for cache lookup (may be nil)

     

       25
       25
       +
       //   - feedPosts: Posts to enrich with viewer state (must implement FeedPostProvider)

     

       26
       26
       +
       //

     

       27
       27
       +
       // The function logs but does not fail on errors - viewer state is optional enrichment.

     

       28
       28
       +
       func PopulateViewerVoteState[T FeedPostProvider](

     

       29
       29
       +
       	ctx context.Context,

     

       30
       30
       +
       	r *http.Request,

     

       31
       31
       +
       	voteService votes.Service,

     

       32
       32
       +
       	feedPosts []T,

     

       33
       33
       +
       ) {

     

       34
       34
       +
       	if voteService == nil {

     

       35
       35
       +
       		return

     

       36
       36
       +
       	}

     

       37
       37
       +
       

     

       38
       38
       +
       	session := middleware.GetOAuthSession(r)

     

       39
       39
       +
       	if session == nil {

     

       40
       40
       +
       		return

     

       41
       41
       +
       	}

     

       42
       42
       +
       

     

       43
       43
       +
       	userDID := middleware.GetUserDID(r)

     

       44
       44
       +
       

     

       45
       45
       +
       	// Ensure vote cache is populated from PDS

     

       46
       46
       +
       	if err := voteService.EnsureCachePopulated(ctx, session); err != nil {

     

       47
       47
       +
       		log.Printf("Warning: failed to populate vote cache: %v", err)

     

       48
       48
       +
       		return

     

       49
       49
       +
       	}

     

       50
       50
       +
       

     

       51
       51
       +
       	// Collect post URIs to batch lookup

     

       52
       52
       +
       	postURIs := make([]string, 0, len(feedPosts))

     

       53
       53
       +
       	for _, feedPost := range feedPosts {

     

       54
       54
       +
       		if post := feedPost.GetPost(); post != nil {

     

       55
       55
       +
       			postURIs = append(postURIs, post.URI)

     

       56
       56
       +
       		}

     

       57
       57
       +
       	}

     

       58
       58
       +
       

     

       59
       59
       +
       	// Get viewer votes for all posts

     

       60
       60
       +
       	viewerVotes := voteService.GetViewerVotesForSubjects(userDID, postURIs)

     

       61
       61
       +
       

     

       62
       62
       +
       	// Populate viewer state on each post

     

       63
       63
       +
       	for _, feedPost := range feedPosts {

     

       64
       64
       +
       		if post := feedPost.GetPost(); post != nil {

     

       65
       65
       +
       			if vote, exists := viewerVotes[post.URI]; exists {

     

       66
       66
       +
       				post.Viewer = &posts.ViewerState{

     

       67
       67
       +
       					Vote:    &vote.Direction,

     

       68
       68
       +
       					VoteURI: &vote.URI,

     

       69
       69
       +
       				}

     

       70
       70
       +
       			}

     

       71
       71
       +
       		}

     

       72
       72
       +
       	}

     

       73
       73
       +
       }

+11 -4

internal/api/handlers/discover/get_discover.go

···

       1
       1
        
       package discover

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/api/handlers/common"

     

       4
       5
        
       	"Coves/internal/core/discover"

     

       5
       6
        
       	"Coves/internal/core/posts"

     

       7
       7
       +
       	"Coves/internal/core/votes"

     

       6
       8
        
       	"encoding/json"

     

       7
       9
        
       	"log"

     

       8
       10
        
       	"net/http"

     
···

       11
       13
        
       

     

       12
       14
        
       // GetDiscoverHandler handles discover feed retrieval

     

       13
       15
        
       type GetDiscoverHandler struct {

     

       14
       14
       -
       	service discover.Service

     

       16
       16
       +
       	service     discover.Service

     

       17
       17
       +
       	voteService votes.Service

     

       15
       18
        
       }

     

       16
       19
        
       

     

       17
       20
        
       // NewGetDiscoverHandler creates a new discover handler

     

       18
       18
       -
       func NewGetDiscoverHandler(service discover.Service) *GetDiscoverHandler {

     

       21
       21
       +
       func NewGetDiscoverHandler(service discover.Service, voteService votes.Service) *GetDiscoverHandler {

     

       19
       22
        
       	return &GetDiscoverHandler{

     

       20
       20
       -
       		service: service,

     

       23
       23
       +
       		service:     service,

     

       24
       24
       +
       		voteService: voteService,

     

       21
       25
        
       	}

     

       22
       26
        
       }

     

       23
       27
        
       

     

       24
       28
        
       // HandleGetDiscover retrieves posts from all communities (public feed)

     

       25
       29
        
       // GET /xrpc/social.coves.feed.getDiscover?sort=hot&limit=15&cursor=...

     

       26
       26
       -
       // Public endpoint - no authentication required

     

       30
       30
       +
       // Public endpoint with optional auth - if authenticated, includes viewer vote state

     

       27
       31
        
       func (h *GetDiscoverHandler) HandleGetDiscover(w http.ResponseWriter, r *http.Request) {

     

       28
       32
        
       	if r.Method != http.MethodGet {

     

       29
       33
        
       		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)

     
···

       40
       44
        
       		return

     

       41
       45
        
       	}

     

       42
       46
        
       

     

       47
       47
       +
       	// Populate viewer vote state if authenticated

     

       48
       48
       +
       	common.PopulateViewerVoteState(r.Context(), r, h.voteService, response.Feed)

     

       49
       49
       +
       

     

       43
       50
        
       	// Transform blob refs to URLs for all posts

     

       44
       51
        
       	for _, feedPost := range response.Feed {

     

       45
       52
        
       		if feedPost.Post != nil {

+9 -4

internal/api/routes/discover.go

···

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
        
       	"Coves/internal/api/handlers/discover"

     

       5
       5
       +
       	"Coves/internal/api/middleware"

     

       5
       6
        
       	discoverCore "Coves/internal/core/discover"

     

       7
       7
       +
       	"Coves/internal/core/votes"

     

       6
       8
        
       

     

       7
       9
        
       	"github.com/go-chi/chi/v5"

     

       8
       10
        
       )

     
···

       10
       12
        
       // RegisterDiscoverRoutes registers discover-related XRPC endpoints

     

       11
       13
        
       //

     

       12
       14
        
       // SECURITY & RATE LIMITING:

     

       13
       13
       -
       // - Discover feed is PUBLIC (no authentication required)

     

       15
       15
       +
       // - Discover feed is PUBLIC (works without authentication)

     

       16
       16
       +
       // - Optional auth: if authenticated, includes viewer vote state on posts

     

       14
       17
        
       // - Protected by global rate limiter: 100 requests/minute per IP (main.go:84)

     

       15
       18
        
       // - Query timeout enforced via context (prevents long-running queries)

     

       16
       19
        
       // - Result limit capped at 50 posts per request (validated in service layer)

     
···

       18
       21
        
       func RegisterDiscoverRoutes(

     

       19
       22
        
       	r chi.Router,

     

       20
       23
        
       	discoverService discoverCore.Service,

     

       24
       24
       +
       	voteService votes.Service,

     

       25
       25
       +
       	authMiddleware *middleware.OAuthAuthMiddleware,

     

       21
       26
        
       ) {

     

       22
       27
        
       	// Create handlers

     

       23
       23
       -
       	getDiscoverHandler := discover.NewGetDiscoverHandler(discoverService)

     

       28
       28
       +
       	getDiscoverHandler := discover.NewGetDiscoverHandler(discoverService, voteService)

     

       24
       29
        
       

     

       25
       30
        
       	// GET /xrpc/social.coves.feed.getDiscover

     

       26
       26
       -
       	// Public endpoint - no authentication required

     

       31
       31
       +
       	// Public endpoint with optional auth for viewer-specific state (vote state)

     

       27
       32
        
       	// Shows posts from ALL communities (not personalized)

     

       28
       33
        
       	// Rate limited: 100 req/min per IP via global middleware

     

       29
       29
       -
       	r.Get("/xrpc/social.coves.feed.getDiscover", getDiscoverHandler.HandleGetDiscover)

     

       34
       34
       +
       	r.With(authMiddleware.OptionalAuth).Get("/xrpc/social.coves.feed.getDiscover", getDiscoverHandler.HandleGetDiscover)

     

       30
       35
        
       }

internal/core/communityFeeds/types.go

···

       31
       31
        
       	Reply  *ReplyRef       `json:"reply,omitempty"`  // Reply context

     

       32
       32
        
       }

     

       33
       33
        
       

     

       34
       34
       +
       // GetPost returns the underlying PostView for viewer state enrichment

     

       35
       35
       +
       func (f *FeedViewPost) GetPost() *posts.PostView {

     

       36
       36
       +
       	return f.Post

     

       37
       37
       +
       }

     

       38
       38
       +
       

     

       34
       39
        
       // FeedReason is a union type for feed context

     

       35
       40
        
       // Can be reasonRepost or reasonPin

     

       36
       41
        
       type FeedReason struct {

internal/core/discover/types.go

···

       39
       39
        
       	Reply  *ReplyRef       `json:"reply,omitempty"`

     

       40
       40
        
       }

     

       41
       41
        
       

     

       42
       42
       +
       // GetPost returns the underlying PostView for viewer state enrichment

     

       43
       43
       +
       func (f *FeedViewPost) GetPost() *posts.PostView {

     

       44
       44
       +
       	return f.Post

     

       45
       45
       +
       }

     

       46
       46
       +
       

     

       42
       47
        
       // FeedReason is a union type for feed context

     

       43
       48
        
       type FeedReason struct {

     

       44
       49
        
       	Repost    *ReasonRepost    `json:"-"`

internal/core/timeline/types.go

···

       42
       42
        
       	Reply  *ReplyRef       `json:"reply,omitempty"`  // Reply context

     

       43
       43
        
       }

     

       44
       44
        
       

     

       45
       45
       +
       // GetPost returns the underlying PostView for viewer state enrichment

     

       46
       46
       +
       func (f *FeedViewPost) GetPost() *posts.PostView {

     

       47
       47
       +
       	return f.Post

     

       48
       48
       +
       }

     

       49
       49
       +
       

     

       45
       50
        
       // FeedReason is a union type for feed context

     

       46
       51
        
       // Future: Can be reasonRepost or reasonCommunity

     

       47
       52
        
       type FeedReason struct {

+193 -5

tests/integration/discover_test.go

···

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
        
       	"Coves/internal/api/handlers/discover"

     

       5
       5
       +
       	"Coves/internal/api/middleware"

     

       6
       6
       +
       	"Coves/internal/core/votes"

     

       5
       7
        
       	"Coves/internal/db/postgres"

     

       6
       8
        
       	"context"

     

       7
       9
        
       	"encoding/json"

     
···

       13
       15
        
       

     

       14
       16
        
       	discoverCore "Coves/internal/core/discover"

     

       15
       17
        
       

     

       18
       18
       +
       	oauthlib "github.com/bluesky-social/indigo/atproto/auth/oauth"

     

       19
       19
       +
       	"github.com/bluesky-social/indigo/atproto/syntax"

     

       16
       20
        
       	"github.com/stretchr/testify/assert"

     

       17
       21
        
       	"github.com/stretchr/testify/require"

     

       18
       22
        
       )

     

       19
       23
        
       

     

       24
       24
       +
       // mockVoteService implements votes.Service for testing viewer vote state

     

       25
       25
       +
       type mockVoteService struct {

     

       26
       26
       +
       	cachedVotes map[string]*votes.CachedVote // userDID:subjectURI -> vote

     

       27
       27
       +
       }

     

       28
       28
       +
       

     

       29
       29
       +
       func newMockVoteService() *mockVoteService {

     

       30
       30
       +
       	return &mockVoteService{

     

       31
       31
       +
       		cachedVotes: make(map[string]*votes.CachedVote),

     

       32
       32
       +
       	}

     

       33
       33
       +
       }

     

       34
       34
       +
       

     

       35
       35
       +
       func (m *mockVoteService) AddVote(userDID, subjectURI, direction, voteURI string) {

     

       36
       36
       +
       	key := userDID + ":" + subjectURI

     

       37
       37
       +
       	m.cachedVotes[key] = &votes.CachedVote{

     

       38
       38
       +
       		Direction: direction,

     

       39
       39
       +
       		URI:       voteURI,

     

       40
       40
       +
       	}

     

       41
       41
       +
       }

     

       42
       42
       +
       

     

       43
       43
       +
       func (m *mockVoteService) CreateVote(_ context.Context, _ *oauthlib.ClientSessionData, _ votes.CreateVoteRequest) (*votes.CreateVoteResponse, error) {

     

       44
       44
       +
       	return &votes.CreateVoteResponse{}, nil

     

       45
       45
       +
       }

     

       46
       46
       +
       

     

       47
       47
       +
       func (m *mockVoteService) DeleteVote(_ context.Context, _ *oauthlib.ClientSessionData, _ votes.DeleteVoteRequest) error {

     

       48
       48
       +
       	return nil

     

       49
       49
       +
       }

     

       50
       50
       +
       

     

       51
       51
       +
       func (m *mockVoteService) EnsureCachePopulated(_ context.Context, _ *oauthlib.ClientSessionData) error {

     

       52
       52
       +
       	return nil // Mock always succeeds - votes pre-populated via AddVote

     

       53
       53
       +
       }

     

       54
       54
       +
       

     

       55
       55
       +
       func (m *mockVoteService) GetViewerVote(userDID, subjectURI string) *votes.CachedVote {

     

       56
       56
       +
       	key := userDID + ":" + subjectURI

     

       57
       57
       +
       	return m.cachedVotes[key]

     

       58
       58
       +
       }

     

       59
       59
       +
       

     

       60
       60
       +
       func (m *mockVoteService) GetViewerVotesForSubjects(userDID string, subjectURIs []string) map[string]*votes.CachedVote {

     

       61
       61
       +
       	result := make(map[string]*votes.CachedVote)

     

       62
       62
       +
       	for _, uri := range subjectURIs {

     

       63
       63
       +
       		key := userDID + ":" + uri

     

       64
       64
       +
       		if vote, exists := m.cachedVotes[key]; exists {

     

       65
       65
       +
       			result[uri] = vote

     

       66
       66
       +
       		}

     

       67
       67
       +
       	}

     

       68
       68
       +
       	return result

     

       69
       69
       +
       }

     

       70
       70
       +
       

     

       20
       71
        
       // TestGetDiscover_ShowsAllCommunities tests discover feed shows posts from ALL communities

     

       21
       72
        
       func TestGetDiscover_ShowsAllCommunities(t *testing.T) {

     

       22
       73
        
       	if testing.Short() {

     
···

       29
       80
        
       	// Setup services

     

       30
       81
        
       	discoverRepo := postgres.NewDiscoverRepository(db, "test-cursor-secret")

     

       31
       82
        
       	discoverService := discoverCore.NewDiscoverService(discoverRepo)

     

       32
       32
       -
       	handler := discover.NewGetDiscoverHandler(discoverService)

     

       83
       83
       +
       	handler := discover.NewGetDiscoverHandler(discoverService, nil) // nil vote service - tests don't need vote state

     

       33
       84
        
       

     

       34
       85
        
       	ctx := context.Background()

     

       35
       86
        
       	testID := time.Now().UnixNano()

     
···

       100
       151
        
       	// Setup services

     

       101
       152
        
       	discoverRepo := postgres.NewDiscoverRepository(db, "test-cursor-secret")

     

       102
       153
        
       	discoverService := discoverCore.NewDiscoverService(discoverRepo)

     

       103
       103
       -
       	handler := discover.NewGetDiscoverHandler(discoverService)

     

       154
       154
       +
       	handler := discover.NewGetDiscoverHandler(discoverService, nil) // nil vote service - tests don't need vote state

     

       104
       155
        
       

     

       105
       156
        
       	ctx := context.Background()

     

       106
       157
        
       	testID := time.Now().UnixNano()

     
···

       147
       198
        
       	// Setup services

     

       148
       199
        
       	discoverRepo := postgres.NewDiscoverRepository(db, "test-cursor-secret")

     

       149
       200
        
       	discoverService := discoverCore.NewDiscoverService(discoverRepo)

     

       150
       150
       -
       	handler := discover.NewGetDiscoverHandler(discoverService)

     

       201
       201
       +
       	handler := discover.NewGetDiscoverHandler(discoverService, nil)

     

       151
       202
        
       

     

       152
       203
        
       	ctx := context.Background()

     

       153
       204
        
       	testID := time.Now().UnixNano()

     
···

       197
       248
        
       	// Setup services

     

       198
       249
        
       	discoverRepo := postgres.NewDiscoverRepository(db, "test-cursor-secret")

     

       199
       250
        
       	discoverService := discoverCore.NewDiscoverService(discoverRepo)

     

       200
       200
       -
       	handler := discover.NewGetDiscoverHandler(discoverService)

     

       251
       251
       +
       	handler := discover.NewGetDiscoverHandler(discoverService, nil)

     

       201
       252
        
       

     

       202
       253
        
       	ctx := context.Background()

     

       203
       254
        
       	testID := time.Now().UnixNano()

     
···

       254
       305
        
       	// Setup services

     

       255
       306
        
       	discoverRepo := postgres.NewDiscoverRepository(db, "test-cursor-secret")

     

       256
       307
        
       	discoverService := discoverCore.NewDiscoverService(discoverRepo)

     

       257
       257
       -
       	handler := discover.NewGetDiscoverHandler(discoverService)

     

       308
       308
       +
       	handler := discover.NewGetDiscoverHandler(discoverService, nil)

     

       258
       309
        
       

     

       259
       310
        
       	t.Run("Limit exceeds maximum", func(t *testing.T) {

     

       260
       311
        
       		req := httptest.NewRequest(http.MethodGet, "/xrpc/social.coves.feed.getDiscover?sort=new&limit=100", nil)

     
···

       271
       322
        
       		assert.Contains(t, errorResp["message"], "limit")

     

       272
       323
        
       	})

     

       273
       324
        
       }

     

       325
       325
       +
       

     

       326
       326
       +
       // TestGetDiscover_ViewerVoteState tests that authenticated users see their vote state on posts

     

       327
       327
       +
       func TestGetDiscover_ViewerVoteState(t *testing.T) {

     

       328
       328
       +
       	if testing.Short() {

     

       329
       329
       +
       		t.Skip("Skipping integration test in short mode")

     

       330
       330
       +
       	}

     

       331
       331
       +
       

     

       332
       332
       +
       	db := setupTestDB(t)

     

       333
       333
       +
       	t.Cleanup(func() { _ = db.Close() })

     

       334
       334
       +
       

     

       335
       335
       +
       	ctx := context.Background()

     

       336
       336
       +
       	testID := time.Now().UnixNano()

     

       337
       337
       +
       

     

       338
       338
       +
       	// Create community and posts

     

       339
       339
       +
       	communityDID, err := createFeedTestCommunity(db, ctx, fmt.Sprintf("votes-%d", testID), fmt.Sprintf("alice-%d.test", testID))

     

       340
       340
       +
       	require.NoError(t, err)

     

       341
       341
       +
       

     

       342
       342
       +
       	post1URI := createTestPost(t, db, communityDID, "did:plc:author1", "Post with upvote", 10, time.Now().Add(-1*time.Hour))

     

       343
       343
       +
       	post2URI := createTestPost(t, db, communityDID, "did:plc:author2", "Post with downvote", 5, time.Now().Add(-2*time.Hour))

     

       344
       344
       +
       	_ = createTestPost(t, db, communityDID, "did:plc:author3", "Post without vote", 3, time.Now().Add(-3*time.Hour))

     

       345
       345
       +
       

     

       346
       346
       +
       	// Setup mock vote service with pre-populated votes

     

       347
       347
       +
       	viewerDID := "did:plc:viewer123"

     

       348
       348
       +
       	mockVotes := newMockVoteService()

     

       349
       349
       +
       	mockVotes.AddVote(viewerDID, post1URI, "up", "at://"+viewerDID+"/social.coves.vote/vote1")

     

       350
       350
       +
       	mockVotes.AddVote(viewerDID, post2URI, "down", "at://"+viewerDID+"/social.coves.vote/vote2")

     

       351
       351
       +
       

     

       352
       352
       +
       	// Setup handler with mock vote service

     

       353
       353
       +
       	discoverRepo := postgres.NewDiscoverRepository(db, "test-cursor-secret")

     

       354
       354
       +
       	discoverService := discoverCore.NewDiscoverService(discoverRepo)

     

       355
       355
       +
       	handler := discover.NewGetDiscoverHandler(discoverService, mockVotes)

     

       356
       356
       +
       

     

       357
       357
       +
       	// Create request with authenticated user context

     

       358
       358
       +
       	req := httptest.NewRequest(http.MethodGet, "/xrpc/social.coves.feed.getDiscover?sort=new&limit=50", nil)

     

       359
       359
       +
       

     

       360
       360
       +
       	// Inject OAuth session into context (simulates OptionalAuth middleware)

     

       361
       361
       +
       	did, _ := syntax.ParseDID(viewerDID)

     

       362
       362
       +
       	session := &oauthlib.ClientSessionData{

     

       363
       363
       +
       		AccountDID:  did,

     

       364
       364
       +
       		AccessToken: "test_token",

     

       365
       365
       +
       	}

     

       366
       366
       +
       	reqCtx := context.WithValue(req.Context(), middleware.UserDIDKey, viewerDID)

     

       367
       367
       +
       	reqCtx = context.WithValue(reqCtx, middleware.OAuthSessionKey, session)

     

       368
       368
       +
       	req = req.WithContext(reqCtx)

     

       369
       369
       +
       

     

       370
       370
       +
       	rec := httptest.NewRecorder()

     

       371
       371
       +
       	handler.HandleGetDiscover(rec, req)

     

       372
       372
       +
       

     

       373
       373
       +
       	// Assertions

     

       374
       374
       +
       	assert.Equal(t, http.StatusOK, rec.Code)

     

       375
       375
       +
       

     

       376
       376
       +
       	var response discoverCore.DiscoverResponse

     

       377
       377
       +
       	err = json.Unmarshal(rec.Body.Bytes(), &response)

     

       378
       378
       +
       	require.NoError(t, err)

     

       379
       379
       +
       

     

       380
       380
       +
       	// Find our test posts and verify vote state

     

       381
       381
       +
       	var foundPost1, foundPost2, foundPost3 bool

     

       382
       382
       +
       	for _, feedPost := range response.Feed {

     

       383
       383
       +
       		switch feedPost.Post.URI {

     

       384
       384
       +
       		case post1URI:

     

       385
       385
       +
       			foundPost1 = true

     

       386
       386
       +
       			require.NotNil(t, feedPost.Post.Viewer, "Post1 should have viewer state")

     

       387
       387
       +
       			require.NotNil(t, feedPost.Post.Viewer.Vote, "Post1 should have vote direction")

     

       388
       388
       +
       			assert.Equal(t, "up", *feedPost.Post.Viewer.Vote, "Post1 should show upvote")

     

       389
       389
       +
       			require.NotNil(t, feedPost.Post.Viewer.VoteURI, "Post1 should have vote URI")

     

       390
       390
       +
       			assert.Contains(t, *feedPost.Post.Viewer.VoteURI, "vote1", "Post1 should have correct vote URI")

     

       391
       391
       +
       

     

       392
       392
       +
       		case post2URI:

     

       393
       393
       +
       			foundPost2 = true

     

       394
       394
       +
       			require.NotNil(t, feedPost.Post.Viewer, "Post2 should have viewer state")

     

       395
       395
       +
       			require.NotNil(t, feedPost.Post.Viewer.Vote, "Post2 should have vote direction")

     

       396
       396
       +
       			assert.Equal(t, "down", *feedPost.Post.Viewer.Vote, "Post2 should show downvote")

     

       397
       397
       +
       			require.NotNil(t, feedPost.Post.Viewer.VoteURI, "Post2 should have vote URI")

     

       398
       398
       +
       

     

       399
       399
       +
       		default:

     

       400
       400
       +
       			// Posts without votes should have nil Viewer or nil Vote

     

       401
       401
       +
       			if feedPost.Post.Viewer != nil && feedPost.Post.Viewer.Vote != nil {

     

       402
       402
       +
       				// This post has a vote from our viewer - it's not post3

     

       403
       403
       +
       				continue

     

       404
       404
       +
       			}

     

       405
       405
       +
       			foundPost3 = true

     

       406
       406
       +
       		}

     

       407
       407
       +
       	}

     

       408
       408
       +
       

     

       409
       409
       +
       	assert.True(t, foundPost1, "Should find post1 with upvote")

     

       410
       410
       +
       	assert.True(t, foundPost2, "Should find post2 with downvote")

     

       411
       411
       +
       	assert.True(t, foundPost3, "Should find post3 without vote")

     

       412
       412
       +
       }

     

       413
       413
       +
       

     

       414
       414
       +
       // TestGetDiscover_NoViewerStateWithoutAuth tests that unauthenticated users don't get viewer state

     

       415
       415
       +
       func TestGetDiscover_NoViewerStateWithoutAuth(t *testing.T) {

     

       416
       416
       +
       	if testing.Short() {

     

       417
       417
       +
       		t.Skip("Skipping integration test in short mode")

     

       418
       418
       +
       	}

     

       419
       419
       +
       

     

       420
       420
       +
       	db := setupTestDB(t)

     

       421
       421
       +
       	t.Cleanup(func() { _ = db.Close() })

     

       422
       422
       +
       

     

       423
       423
       +
       	ctx := context.Background()

     

       424
       424
       +
       	testID := time.Now().UnixNano()

     

       425
       425
       +
       

     

       426
       426
       +
       	// Create community and post

     

       427
       427
       +
       	communityDID, err := createFeedTestCommunity(db, ctx, fmt.Sprintf("noauth-%d", testID), fmt.Sprintf("alice-%d.test", testID))

     

       428
       428
       +
       	require.NoError(t, err)

     

       429
       429
       +
       

     

       430
       430
       +
       	postURI := createTestPost(t, db, communityDID, "did:plc:author", "Some post", 10, time.Now())

     

       431
       431
       +
       

     

       432
       432
       +
       	// Setup mock vote service with a vote (but request will be unauthenticated)

     

       433
       433
       +
       	mockVotes := newMockVoteService()

     

       434
       434
       +
       	mockVotes.AddVote("did:plc:someuser", postURI, "up", "at://did:plc:someuser/social.coves.vote/vote1")

     

       435
       435
       +
       

     

       436
       436
       +
       	// Setup handler with mock vote service

     

       437
       437
       +
       	discoverRepo := postgres.NewDiscoverRepository(db, "test-cursor-secret")

     

       438
       438
       +
       	discoverService := discoverCore.NewDiscoverService(discoverRepo)

     

       439
       439
       +
       	handler := discover.NewGetDiscoverHandler(discoverService, mockVotes)

     

       440
       440
       +
       

     

       441
       441
       +
       	// Create request WITHOUT auth context

     

       442
       442
       +
       	req := httptest.NewRequest(http.MethodGet, "/xrpc/social.coves.feed.getDiscover?sort=new&limit=50", nil)

     

       443
       443
       +
       	rec := httptest.NewRecorder()

     

       444
       444
       +
       	handler.HandleGetDiscover(rec, req)

     

       445
       445
       +
       

     

       446
       446
       +
       	// Should succeed

     

       447
       447
       +
       	assert.Equal(t, http.StatusOK, rec.Code)

     

       448
       448
       +
       

     

       449
       449
       +
       	var response discoverCore.DiscoverResponse

     

       450
       450
       +
       	err = json.Unmarshal(rec.Body.Bytes(), &response)

     

       451
       451
       +
       	require.NoError(t, err)

     

       452
       452
       +
       

     

       453
       453
       +
       	// Find our post and verify NO viewer state (unauthenticated)

     

       454
       454
       +
       	for _, feedPost := range response.Feed {

     

       455
       455
       +
       		if feedPost.Post.URI == postURI {

     

       456
       456
       +
       			assert.Nil(t, feedPost.Post.Viewer, "Unauthenticated request should not have viewer state")

     

       457
       457
       +
       			return

     

       458
       458
       +
       		}

     

       459
       459
       +
       	}

     

       460
       460
       +
       	t.Fatal("Test post not found in response")

     

       461
       461
       +
       }

+11 -11

tests/integration/feed_test.go

···

       37
       37
        
       		nil,

     

       38
       38
        
       	)

     

       39
       39
        
       	feedService := communityFeeds.NewCommunityFeedService(feedRepo, communityService)

     

       40
       40
       -
       	handler := communityFeed.NewGetCommunityHandler(feedService)

     

       40
       40
       +
       	handler := communityFeed.NewGetCommunityHandler(feedService, nil)

     

       41
       41
        
       

     

       42
       42
        
       	// Setup test data: community, users, and posts

     

       43
       43
        
       	ctx := context.Background()

     
···

       114
       114
        
       		nil,

     

       115
       115
        
       	)

     

       116
       116
        
       	feedService := communityFeeds.NewCommunityFeedService(feedRepo, communityService)

     

       117
       117
       -
       	handler := communityFeed.NewGetCommunityHandler(feedService)

     

       117
       117
       +
       	handler := communityFeed.NewGetCommunityHandler(feedService, nil)

     

       118
       118
        
       

     

       119
       119
        
       	// Setup test data

     

       120
       120
        
       	ctx := context.Background()

     
···

       190
       190
        
       		nil,

     

       191
       191
        
       	)

     

       192
       192
        
       	feedService := communityFeeds.NewCommunityFeedService(feedRepo, communityService)

     

       193
       193
       -
       	handler := communityFeed.NewGetCommunityHandler(feedService)

     

       193
       193
       +
       	handler := communityFeed.NewGetCommunityHandler(feedService, nil)

     

       194
       194
        
       

     

       195
       195
        
       	// Setup test data

     

       196
       196
        
       	ctx := context.Background()

     
···

       246
       246
        
       		nil,

     

       247
       247
        
       	)

     

       248
       248
        
       	feedService := communityFeeds.NewCommunityFeedService(feedRepo, communityService)

     

       249
       249
       -
       	handler := communityFeed.NewGetCommunityHandler(feedService)

     

       249
       249
       +
       	handler := communityFeed.NewGetCommunityHandler(feedService, nil)

     

       250
       250
        
       

     

       251
       251
        
       	// Setup test data with many posts

     

       252
       252
        
       	ctx := context.Background()

     
···

       337
       337
        
       		nil,

     

       338
       338
        
       	)

     

       339
       339
        
       	feedService := communityFeeds.NewCommunityFeedService(feedRepo, communityService)

     

       340
       340
       -
       	handler := communityFeed.NewGetCommunityHandler(feedService)

     

       340
       340
       +
       	handler := communityFeed.NewGetCommunityHandler(feedService, nil)

     

       341
       341
        
       

     

       342
       342
        
       	// Request feed for non-existent community

     

       343
       343
        
       	req := httptest.NewRequest(http.MethodGet, "/xrpc/social.coves.communityFeed.getCommunity?community=did:plc:nonexistent&sort=hot&limit=10", nil)

     
···

       373
       373
        
       		nil,

     

       374
       374
        
       	)

     

       375
       375
        
       	feedService := communityFeeds.NewCommunityFeedService(feedRepo, communityService)

     

       376
       376
       -
       	handler := communityFeed.NewGetCommunityHandler(feedService)

     

       376
       376
       +
       	handler := communityFeed.NewGetCommunityHandler(feedService, nil)

     

       377
       377
        
       

     

       378
       378
        
       	// Setup test community

     

       379
       379
        
       	ctx := context.Background()

     
···

       429
       429
        
       		nil,

     

       430
       430
        
       	)

     

       431
       431
        
       	feedService := communityFeeds.NewCommunityFeedService(feedRepo, communityService)

     

       432
       432
       -
       	handler := communityFeed.NewGetCommunityHandler(feedService)

     

       432
       432
       +
       	handler := communityFeed.NewGetCommunityHandler(feedService, nil)

     

       433
       433
        
       

     

       434
       434
        
       	// Create community with no posts

     

       435
       435
        
       	ctx := context.Background()

     
···

       473
       473
        
       		nil,

     

       474
       474
        
       	)

     

       475
       475
        
       	feedService := communityFeeds.NewCommunityFeedService(feedRepo, communityService)

     

       476
       476
       -
       	handler := communityFeed.NewGetCommunityHandler(feedService)

     

       476
       476
       +
       	handler := communityFeed.NewGetCommunityHandler(feedService, nil)

     

       477
       477
        
       

     

       478
       478
        
       	// Setup test community

     

       479
       479
        
       	ctx := context.Background()

     
···

       526
       526
        
       		nil,

     

       527
       527
        
       	)

     

       528
       528
        
       	feedService := communityFeeds.NewCommunityFeedService(feedRepo, communityService)

     

       529
       529
       -
       	handler := communityFeed.NewGetCommunityHandler(feedService)

     

       529
       529
       +
       	handler := communityFeed.NewGetCommunityHandler(feedService, nil)

     

       530
       530
        
       

     

       531
       531
        
       	// Setup test data

     

       532
       532
        
       	ctx := context.Background()

     
···

       627
       627
        
       		nil,

     

       628
       628
        
       	)

     

       629
       629
        
       	feedService := communityFeeds.NewCommunityFeedService(feedRepo, communityService)

     

       630
       630
       -
       	handler := communityFeed.NewGetCommunityHandler(feedService)

     

       630
       630
       +
       	handler := communityFeed.NewGetCommunityHandler(feedService, nil)

     

       631
       631
        
       

     

       632
       632
        
       	// Setup test data

     

       633
       633
        
       	ctx := context.Background()

     
···

       720
       720
        
       		nil,

     

       721
       721
        
       	)

     

       722
       722
        
       	feedService := communityFeeds.NewCommunityFeedService(feedRepo, communityService)

     

       723
       723
       -
       	handler := communityFeed.NewGetCommunityHandler(feedService)

     

       723
       723
       +
       	handler := communityFeed.NewGetCommunityHandler(feedService, nil)

     

       724
       724
        
       

     

       725
       725
        
       	// Setup test data

     

       726
       726
        
       	ctx := context.Background()

+7 -7

tests/integration/timeline_test.go

···

       30
       30
        
       	// Setup services

     

       31
       31
        
       	timelineRepo := postgres.NewTimelineRepository(db, "test-cursor-secret")

     

       32
       32
        
       	timelineService := timelineCore.NewTimelineService(timelineRepo)

     

       33
       33
       -
       	handler := timeline.NewGetTimelineHandler(timelineService)

     

       33
       33
       +
       	handler := timeline.NewGetTimelineHandler(timelineService, nil)

     

       34
       34
        
       

     

       35
       35
        
       	ctx := context.Background()

     

       36
       36
        
       	testID := time.Now().UnixNano()

     
···

       119
       119
        
       	// Setup services

     

       120
       120
        
       	timelineRepo := postgres.NewTimelineRepository(db, "test-cursor-secret")

     

       121
       121
        
       	timelineService := timelineCore.NewTimelineService(timelineRepo)

     

       122
       122
       -
       	handler := timeline.NewGetTimelineHandler(timelineService)

     

       122
       122
       +
       	handler := timeline.NewGetTimelineHandler(timelineService, nil)

     

       123
       123
        
       

     

       124
       124
        
       	ctx := context.Background()

     

       125
       125
        
       	testID := time.Now().UnixNano()

     
···

       190
       190
        
       	// Setup services

     

       191
       191
        
       	timelineRepo := postgres.NewTimelineRepository(db, "test-cursor-secret")

     

       192
       192
        
       	timelineService := timelineCore.NewTimelineService(timelineRepo)

     

       193
       193
       -
       	handler := timeline.NewGetTimelineHandler(timelineService)

     

       193
       193
       +
       	handler := timeline.NewGetTimelineHandler(timelineService, nil)

     

       194
       194
        
       

     

       195
       195
        
       	ctx := context.Background()

     

       196
       196
        
       	testID := time.Now().UnixNano()

     
···

       266
       266
        
       	// Setup services

     

       267
       267
        
       	timelineRepo := postgres.NewTimelineRepository(db, "test-cursor-secret")

     

       268
       268
        
       	timelineService := timelineCore.NewTimelineService(timelineRepo)

     

       269
       269
       -
       	handler := timeline.NewGetTimelineHandler(timelineService)

     

       269
       269
       +
       	handler := timeline.NewGetTimelineHandler(timelineService, nil)

     

       270
       270
        
       

     

       271
       271
        
       	ctx := context.Background()

     

       272
       272
        
       	testID := time.Now().UnixNano()

     
···

       308
       308
        
       	// Setup services

     

       309
       309
        
       	timelineRepo := postgres.NewTimelineRepository(db, "test-cursor-secret")

     

       310
       310
        
       	timelineService := timelineCore.NewTimelineService(timelineRepo)

     

       311
       311
       -
       	handler := timeline.NewGetTimelineHandler(timelineService)

     

       311
       311
       +
       	handler := timeline.NewGetTimelineHandler(timelineService, nil)

     

       312
       312
        
       

     

       313
       313
        
       	// Request timeline WITHOUT auth context

     

       314
       314
        
       	req := httptest.NewRequest(http.MethodGet, "/xrpc/social.coves.feed.getTimeline?sort=new&limit=10", nil)

     
···

       337
       337
        
       	// Setup services

     

       338
       338
        
       	timelineRepo := postgres.NewTimelineRepository(db, "test-cursor-secret")

     

       339
       339
        
       	timelineService := timelineCore.NewTimelineService(timelineRepo)

     

       340
       340
       -
       	handler := timeline.NewGetTimelineHandler(timelineService)

     

       340
       340
       +
       	handler := timeline.NewGetTimelineHandler(timelineService, nil)

     

       341
       341
        
       

     

       342
       342
        
       	ctx := context.Background()

     

       343
       343
        
       	testID := time.Now().UnixNano()

     
···

       388
       388
        
       	// Setup services

     

       389
       389
        
       	timelineRepo := postgres.NewTimelineRepository(db, "test-cursor-secret")

     

       390
       390
        
       	timelineService := timelineCore.NewTimelineService(timelineRepo)

     

       391
       391
       -
       	handler := timeline.NewGetTimelineHandler(timelineService)

     

       391
       391
       +
       	handler := timeline.NewGetTimelineHandler(timelineService, nil)

     

       392
       392
        
       

     

       393
       393
        
       	ctx := context.Background()

     

       394
       394
        
       	testID := time.Now().UnixNano()

+1 -1

tests/integration/user_journey_e2e_test.go

···

       143
       143
        
       	r := chi.NewRouter()

     

       144
       144
        
       	routes.RegisterCommunityRoutes(r, communityService, e2eAuth.OAuthAuthMiddleware, nil) // nil = allow all community creators

     

       145
       145
        
       	routes.RegisterPostRoutes(r, postService, e2eAuth.OAuthAuthMiddleware)

     

       146
       146
       -
       	routes.RegisterTimelineRoutes(r, timelineService, e2eAuth.OAuthAuthMiddleware)

     

       146
       146
       +
       	routes.RegisterTimelineRoutes(r, timelineService, nil, e2eAuth.OAuthAuthMiddleware)

     

       147
       147
        
       	httpServer := httptest.NewServer(r)

     

       148
       148
        
       	defer httpServer.Close()

     

       149
       149

Compare changes